Skip to content

Commit 86666ee

Browse files
IvanNardiIvanNardi
committed
Preliminary work to rework struct ndpi_flow_struct
No significant changes: * Move around some fields to avoid holes in the structures. * Some fields are about protocols based only on TCP. * Remove some unused (or set but never read) fields. See #2631
1 parent ecf0f8a commit 86666ee

File tree

6 files changed

+124
-129
lines changed

6 files changed

+124
-129
lines changed

‎src/include/ndpi_typedefs.h

Lines changed: 86 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -805,6 +805,51 @@ struct ndpi_lru_cache {
805805
/* ************************************************** */
806806

807807
struct ndpi_flow_tcp_struct {
808+
/* TCP sequence number */
809+
u_int32_t next_tcp_seq_nr[2];
810+
u_int16_t last_tcp_pkt_payload_len;
811+
812+
/* Part of the TCP header */
813+
u_int8_t cli2srv_tcp_flags, srv2cli_tcp_flags;
814+
u_int32_t seen_syn:1, seen_syn_ack:1, seen_ack:1;
815+
816+
/* NDPI_PROTOCOL_IRC */
817+
u_int32_t irc_3a_counter:3;
818+
819+
/* NDPI_PROTOCOL_USENET */
820+
u_int32_t usenet_stage:2;
821+
822+
/* NDPI_PROTOCOL_HTTP */
823+
u_int32_t http_stage:3;
824+
u_int32_t http_asymmetric_stage:2;
825+
826+
/* NDPI_PROTOCOL_GNUTELLA */
827+
u_int32_t gnutella_stage:2; // 0 - 2
828+
829+
/* NDPI_PROTOCOL_SSH */
830+
u_int32_t ssh_stage:3;
831+
832+
/* NDPI_PROTOCOL_VNC */
833+
u_int32_t vnc_stage:2; // 0 - 3
834+
835+
/* NDPI_PROTOCOL_TELNET */
836+
u_int32_t telnet_stage:2; // 0 - 2
837+
838+
/* NDPI_PROTOCOL_RADMIN */
839+
u_int32_t radmin_stage:1;
840+
841+
/* NDPI_PROTOCOL_FTP_CONTROL */
842+
u_int32_t ftp_control_stage:2;
843+
844+
/* NDPI_PROTOCOL_SOAP */
845+
u_int32_t soap_stage:1;
846+
847+
/* NDPI_PROTOCOL_SOCKS */
848+
u_int32_t socks5_stage:2, socks4_stage:2;
849+
850+
/* NDPI_PROTOCOL_Z3950 */
851+
u_int32_t z3950_stage:2;
852+
808853
/* NDPI_PROTOCOL_MAIL_SMTP */
809854
/* NDPI_PROTOCOL_MAIL_POP */
810855
/* NDPI_PROTOCOL_MAIL_IMAP */
@@ -815,6 +860,9 @@ struct ndpi_flow_tcp_struct {
815860
char username[32], password[16];
816861
} ftp_imap_pop_smtp;
817862

863+
/* NDPI_PROTOCOL_LOTUS_NOTES */
864+
u_int8_t lotus_notes_packet_id;
865+
818866
/* NDPI_PROTOCOL_MAIL_SMTP */
819867
u_int16_t smtp_command_bitmask;
820868

@@ -830,31 +878,11 @@ struct ndpi_flow_tcp_struct {
830878
/* NDPI_PROTOCOL_GNUTELLA */
831879
u_int8_t gnutella_msg_id[3];
832880

833-
/* NDPI_PROTOCOL_IRC */
834-
u_int32_t irc_3a_counter:3;
835-
836-
/* NDPI_PROTOCOL_USENET */
837-
u_int32_t usenet_stage:2;
838-
839-
/* NDPI_PROTOCOL_HTTP */
840-
u_int32_t http_stage:3;
841-
u_int32_t http_asymmetric_stage:2;
842-
843-
/* NDPI_PROTOCOL_GNUTELLA */
844-
u_int32_t gnutella_stage:2; // 0 - 2
845-
846-
/* NDPI_PROTOCOL_SSH */
847-
u_int32_t ssh_stage:3;
848-
849-
/* NDPI_PROTOCOL_VNC */
850-
u_int32_t vnc_stage:2; // 0 - 3
851-
852-
/* NDPI_PROTOCOL_TELNET */
853-
u_int32_t telnet_stage:2; // 0 - 2
881+
/* NDPI_PROTOCOL_NEST_LOG_SINK */
882+
u_int8_t nest_log_sink_matches;
854883

855-
/* NDPI_PROTOCOL_RTMP */
856-
u_int32_t rtmp_stage:2;
857-
u_int16_t rtmp_client_buffer_len;
884+
/* NDPI_PROTOCOL_MEMCACHED */
885+
u_int8_t memcached_matches;
858886

859887
struct {
860888
/* NDPI_PROTOCOL_TLS */
@@ -863,12 +891,16 @@ struct ndpi_flow_tcp_struct {
863891
int16_t tls_application_blocks_len[NDPI_MAX_NUM_TLS_APPL_BLOCKS]; /* + = src->dst, - = dst->src */
864892
} tls;
865893

894+
/* NDPI_PROTOCOL_ZMQ */
895+
u_char prev_zmq_pkt[10];
896+
u_int8_t prev_zmq_pkt_len;
897+
898+
/* NDPI_PROTOCOL_RTMP */
899+
u_int16_t rtmp_client_buffer_len;
900+
u_int32_t rtmp_stage:2;
901+
866902
/* NDPI_PROTOCOL_POSTGRES */
867903
u_int32_t postgres_stage:3;
868-
869-
/* Part of the TCP header. */
870-
u_int32_t seen_syn:1, seen_syn_ack:1, seen_ack:1, __notused:29;
871-
u_int8_t cli2srv_tcp_flags, srv2cli_tcp_flags;
872904

873905
/* NDPI_PROTOCOL_ICECAST */
874906
u_int32_t icecast_stage:1;
@@ -884,25 +916,6 @@ struct ndpi_flow_tcp_struct {
884916

885917
/* NDPI_PROTOCOL_MAIL_IMAP */
886918
u_int32_t mail_imap_stage:3, mail_imap_starttls:2;
887-
888-
/* NDPI_PROTOCOL_SOAP */
889-
u_int32_t soap_stage:1;
890-
891-
/* NDPI_PROTOCOL_LOTUS_NOTES */
892-
u_int8_t lotus_notes_packet_id;
893-
894-
/* NDPI_PROTOCOL_ZMQ */
895-
u_int8_t prev_zmq_pkt_len;
896-
u_char prev_zmq_pkt[10];
897-
898-
/* NDPI_PROTOCOL_MEMCACHED */
899-
u_int8_t memcached_matches;
900-
901-
/* NDPI_PROTOCOL_NEST_LOG_SINK */
902-
u_int8_t nest_log_sink_matches;
903-
904-
/* NDPI_PROTOCOL_RADMIN */
905-
u_int32_t radmin_stage:1;
906919
};
907920

908921
/* ************************************************** */
@@ -928,27 +941,33 @@ struct ndpi_flow_udp_struct {
928941
/* NDPI_PROTOCOL_ZOOM */
929942
u_int32_t zoom_p2p:1;
930943

931-
/* NDPI_PROTOCOL_EPICGAMES */
932-
u_int32_t epicgames_stage:1;
933-
u_int32_t epicgames_word;
934-
935944
/* NDPI_PROTOCOL_RAKNET */
936945
u_int32_t raknet_custom:1;
937946

938-
/* NDPI_PROTOCOL_EAQ */
939-
u_int8_t eaq_pkt_id;
940-
u_int32_t eaq_sequence;
947+
/* NDPI_PROTOCOL_MUMBLE */
948+
u_int32_t mumble_stage:1;
949+
950+
/* NDPI_PROTOCOL_EPICGAMES */
951+
u_int32_t epicgames_stage:1;
952+
u_int32_t epicgames_word;
941953

942954
/* NDPI_PROTOCOL_RX */
943955
u_int32_t rx_conn_epoch;
944956
u_int32_t rx_conn_id;
945957

958+
/* NDPI_PROTOCOL_WIREGUARD */
959+
u_int32_t wireguard_peer_index[2];
960+
u_int8_t wireguard_stage;
961+
946962
/* NDPI_PROTOCOL_MEMCACHED */
947963
u_int8_t memcached_matches;
948964

949-
/* NDPI_PROTOCOL_WIREGUARD */
950-
u_int8_t wireguard_stage;
951-
u_int32_t wireguard_peer_index[2];
965+
/* NDPI_PROTOCOL_EAQ */
966+
u_int8_t eaq_pkt_id;
967+
u_int32_t eaq_sequence;
968+
969+
/* NDPI_PROTOCOL_MUMBLE */
970+
u_int64_t mumble_ident;
952971

953972
/* NDPI_PROTOCOL_QUIC */
954973
u_int8_t *quic_reasm_buf;
@@ -975,9 +994,6 @@ struct ndpi_flow_udp_struct {
975994
u_int16_t tftp_data_num;
976995
u_int16_t tftp_ack_num;
977996

978-
/* NDPI_PROTOCOL_MUMBLE */
979-
u_int8_t mumble_stage:1;
980-
u_int64_t mumble_ident;
981997
};
982998

983999
/* ************************************************** */
@@ -1272,7 +1288,7 @@ struct ndpi_flow_struct {
12721288
u_int16_t guessed_protocol_id; /* Classification by-port. Set with the first pkt and never updated */
12731289
u_int16_t guessed_protocol_id_by_ip; /* Classification by-ip. Set with the first pkt and never updated */
12741290
u_int16_t fast_callback_protocol_id; /* Partial/incomplete classification. Used internally as first callback when iterating all the protocols */
1275-
u_int16_t guessed_category, guessed_header_category;
1291+
u_int16_t guessed_header_category;
12761292
u_int8_t l4_proto, protocol_id_already_guessed:1, fail_with_unknown:1,
12771293
init_finished:1, client_packet_direction:1, packet_direction:1, is_ipv6:1, first_pkt_fully_encrypted:1, skip_entropy_check: 1;
12781294
u_int8_t monitoring:1, _pad:7;
@@ -1282,13 +1298,6 @@ struct ndpi_flow_struct {
12821298

12831299
/* First Packet Classification info */
12841300
struct ndpi_fpc_info fpc;
1285-
1286-
/*
1287-
if ndpi_struct->direction_detect_disable == 1
1288-
tcp sequence number connection tracking
1289-
*/
1290-
u_int32_t next_tcp_seq_nr[2];
1291-
u_int16_t last_tcp_pkt_payload_len;
12921301

12931302
/* Flow addresses (useful for LRU lookups in ndpi_detection_giveup())
12941303
and ports. All in *network* byte order.
@@ -1310,6 +1319,15 @@ struct ndpi_flow_struct {
13101319

13111320
u_int64_t last_packet_time_ms;
13121321

1322+
ndpi_protocol_category_t category;
1323+
1324+
/* Counters with only packets with L5 data (ie no TCP SYN, pure ACKs, ...) */
1325+
u_int16_t packet_counter;
1326+
u_int16_t packet_direction_counter[2];
1327+
/* Counters with all packets even those without payload */
1328+
u_int16_t all_packets_counter;
1329+
u_int16_t packet_direction_complete_counter[2];
1330+
13131331
/*
13141332
the tcp / udp / other l4 value union
13151333
used to reduce the number of bytes for tcp or udp protocol states
@@ -1548,17 +1566,6 @@ struct ndpi_flow_struct {
15481566
/* protocols which have marked a connection as this connection cannot be protocol XXX, multiple u_int64_t */
15491567
NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask;
15501568

1551-
ndpi_protocol_category_t category;
1552-
1553-
/* Only packets with L5 data (ie no TCP SYN, pure ACKs, ...) */
1554-
u_int16_t packet_counter; // can be 0 - 65000
1555-
u_int16_t packet_direction_counter[2];
1556-
u_int8_t packet_direction_with_payload_observed[2]; /* 0 = no packet with payload observed, 1 = at least one packet with payload observed */
1557-
1558-
/* All packets even those without payload */
1559-
u_int16_t all_packets_counter;
1560-
u_int16_t packet_direction_complete_counter[2]; // can be 0 - 65000
1561-
15621569
/* NDPI_PROTOCOL_BITTORRENT */
15631570
u_int8_t bittorrent_stage; // can be 0 - 255
15641571
u_int8_t bt_check_performed : 1;
@@ -1569,18 +1576,9 @@ struct ndpi_flow_struct {
15691576
/* NDPI_PROTOCOL_ZATTOO */
15701577
u_int8_t zattoo_stage:3;
15711578

1572-
/* NDPI_PROTOCOL_SOCKS */
1573-
u_int8_t socks5_stage:2, socks4_stage:2; // 0 - 3
1574-
1575-
/* NDPI_PROTOCOL_FTP_CONTROL */
1576-
u_int8_t ftp_control_stage:2;
1577-
15781579
/* NDPI_PROTOCOL_STARCRAFT */
15791580
u_int8_t starcraft_udp_stage : 3; // 0-7
15801581

1581-
/* NDPI_PROTOCOL_Z3950 */
1582-
u_int8_t z3950_stage : 2; // 0-3
1583-
15841582
/* NDPI_PROTOCOL_OOKLA */
15851583
u_int8_t ookla_stage : 1;
15861584

‎src/lib/ndpi_main.c

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7232,7 +7232,7 @@ static void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_s
72327232
if(ndpi_str->cfg.tcp_ack_paylod_heuristic && tcp_ack_padding(packet)) {
72337233
NDPI_LOG_DBG2(ndpi_str, "TCP ACK with zero padding. Ignoring\n");
72347234
packet->tcp_retransmission = 1;
7235-
} else if(flow->next_tcp_seq_nr[0] == 0 || flow->next_tcp_seq_nr[1] == 0 ||
7235+
} else if(flow->l4.tcp.next_tcp_seq_nr[0] == 0 || flow->l4.tcp.next_tcp_seq_nr[1] == 0 ||
72367236
(tcph->syn && flow->packet_counter == 0)) {
72377237
/* initialize tcp sequence counters */
72387238
/* the ack flag needs to be set to get valid sequence numbers from the other
@@ -7245,41 +7245,41 @@ static void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_s
72457245
* If we receive multiple syn-ack (before any real data), keep the last one
72467246
*/
72477247
if(tcph->ack != 0) {
7248-
flow->next_tcp_seq_nr[packet->packet_direction] =
7248+
flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] =
72497249
ntohl(tcph->seq) + (tcph->syn ? 1 : packet->payload_packet_len);
72507250

72517251
/*
72527252
Check to avoid discrepancies in case we analyze a flow that does not start with SYN...
72537253
but that is already started when nDPI being to process it. See also (***) below
72547254
*/
72557255
if(flow->num_processed_pkts > 1)
7256-
flow->next_tcp_seq_nr[1 - packet->packet_direction] = ntohl(tcph->ack_seq);
7256+
flow->l4.tcp.next_tcp_seq_nr[1 - packet->packet_direction] = ntohl(tcph->ack_seq);
72577257
}
72587258
} else if(packet->payload_packet_len > 0) {
72597259
/* check tcp sequence counters */
7260-
if(((u_int32_t)(ntohl(tcph->seq) - flow->next_tcp_seq_nr[packet->packet_direction])) >
7260+
if(((u_int32_t)(ntohl(tcph->seq) - flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction])) >
72617261
ndpi_str->tcp_max_retransmission_window_size) {
7262-
if(flow->last_tcp_pkt_payload_len > 0)
7262+
if(flow->l4.tcp.last_tcp_pkt_payload_len > 0)
72637263
packet->tcp_retransmission = 1;
72647264

72657265
/* CHECK IF PARTIAL RETRY IS HAPPENING */
7266-
if((flow->next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq) <
7266+
if((flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq) <
72677267
packet->payload_packet_len)) {
72687268
if(flow->num_processed_pkts > 1) /* See also (***) above */
7269-
flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
7269+
flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
72707270
}
72717271
}
72727272
else {
7273-
flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
7273+
flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
72747274
}
72757275
}
72767276

72777277
if(tcph->rst) {
7278-
flow->next_tcp_seq_nr[0] = 0;
7279-
flow->next_tcp_seq_nr[1] = 0;
7278+
flow->l4.tcp.next_tcp_seq_nr[0] = 0;
7279+
flow->l4.tcp.next_tcp_seq_nr[1] = 0;
72807280
}
72817281

7282-
flow->last_tcp_pkt_payload_len = packet->payload_packet_len;
7282+
flow->l4.tcp.last_tcp_pkt_payload_len = packet->payload_packet_len;
72837283
} else if(udph != NULL) {
72847284
if(ndpi_str->cfg.direction_detect_enabled &&
72857285
(udph->source != udph->dest))
@@ -7370,9 +7370,6 @@ static void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_s
73707370
flow->packet_direction_complete_counter[packet->packet_direction]++;
73717371
}
73727372

7373-
if(packet->payload_packet_len > 0)
7374-
flow->packet_direction_with_payload_observed[packet->packet_direction] = 1;
7375-
73767373
if(!ndpi_is_multi_or_broadcast(packet)) {
73777374
/* ! (multicast or broadcast) */
73787375

@@ -7953,8 +7950,8 @@ static void ndpi_check_probing_attempt(struct ndpi_detection_module_struct *ndpi
79537950
if((flow->l4_proto == IPPROTO_TCP)
79547951
&& (flow->l4.tcp.cli2srv_tcp_flags & TH_PUSH)
79557952
&& (flow->l4.tcp.srv2cli_tcp_flags & TH_PUSH)) {
7956-
if(flow->packet_direction_with_payload_observed[0]
7957-
&& flow->packet_direction_with_payload_observed[1]) {
7953+
if(flow->packet_direction_counter[0]
7954+
&& flow->packet_direction_counter[1]) {
79587955
/* Both directions observed */
79597956
/* Nothing to do */
79607957
} else {

0 commit comments

Comments
 (0)