Skip to content

Implementation for the ndpi kernel module version 4.9 #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Morwran wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Implementation for the ndpi kernel module version 4.9 #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions internal/3d-party/nftables/expr/ndpi.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,14 +17,15 @@ import (
)

const (
NFT_NDPI_FLAG_INVERT uint16 = 0x01 << iota
NFT_NDPI_FLAG_INVERT uint32 = 0x01 << iota
Copy link
Member

@EvgenyGri EvgenyGri Jan 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

чем обоснована замена uint16 --> uint32 ?

NFT_NDPI_FLAG_ERROR
NFT_NDPI_FLAG_M_PROTO
NFT_NDPI_FLAG_P_PROTO
NFT_NDPI_FLAG_HAVE_MASTER
NFT_NDPI_FLAG_HOST
NFT_NDPI_FLAG_RE
NFT_NDPI_FLAG_EMPTY
NFT_NDPI_FLAG_PROTO
NFT_NDPI_FLAG_INPROGRESS
NFT_NDPI_FLAG_JA3S
NFT_NDPI_FLAG_JA3C
Expand All @@ -41,7 +42,7 @@ const (

const (
//Version of the ndpi
NDPI_GIT_RELEASE = "4.3.0-8-6ae5394"
NDPI_GIT_RELEASE = "4.9"
Copy link
Member

@EvgenyGri EvgenyGri Jan 26, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

то есть версию 4.3 мы не поддерживаем ?

//Number of ndpi protocols
NDPI_NUM_BITS = 512
//Mask for available ndpi protocols
Expand Down Expand Up @@ -126,7 +127,7 @@ type Ndpi struct {
NFT_NDPI_FLAG_TLSV = 0x1000
NFT_NDPI_FLAG_UNTRACKED = 0x2000
*/
Flags uint16
Flags uint32

Protocols []string

Expand Down Expand Up @@ -218,7 +219,7 @@ func NdpiWithProtocols(pp ...string) ndpiOpt {
}

// NdpiWithFlags -
func NdpiWithFlags(flags uint16) ndpiOpt {
func NdpiWithFlags(flags uint32) ndpiOpt {
return ndpiOptFunc(func(o *Ndpi) {
o.Flags = flags
o.key |= NFTNL_EXPR_NDPI_FLAGS
Expand Down Expand Up @@ -298,7 +299,7 @@ func (e *Ndpi) marshal(fam byte) ([]byte, error) {
if e.key&NFTNL_EXPR_NDPI_FLAGS != 0 {
attrs = append(attrs, netlink.Attribute{
Type: NFTA_NDPI_FLAGS,
Data: binaryutil.BigEndian.PutUint16(e.Flags),
Data: binaryutil.BigEndian.PutUint32(e.Flags),
})
}

Expand All @@ -324,7 +325,7 @@ func (e *Ndpi) unmarshal(fam byte, data []byte) error {
data := ad.Bytes()
switch ad.Type() {
case NFTA_NDPI_FLAGS:
e.Flags = binaryutil.BigEndian.Uint16(data)
e.Flags = binaryutil.BigEndian.Uint32(data)
e.key |= NFTNL_EXPR_NDPI_FLAGS
case NFTA_NDPI_HOSTNAME:
// Getting rid of \x00 at the end of string
Expand Down Expand Up @@ -361,14 +362,14 @@ var (
// NdpiState - structure contains lists of supported and disabled protocols
NdpiState = ndpiLoadInternal()

reVerDetect = regexp.MustCompile(`#id.*#version\s+([^\s]+)`)
reVerDetect = regexp.MustCompile(`#id.*#version\s+(\d+\.\d+)`)

ndpiModuleLoaders = map[string]ndpiModuleLoader{
NDPI_GIT_RELEASE: mod_4_3_0_8_6ae5394_Loader,
NDPI_GIT_RELEASE: mod_v4_9_Loader,
}
)

func mod_4_3_0_8_6ae5394_Loader(r io.Reader) (ret ndpiModuleState) {
func mod_v4_9_Loader(r io.Reader) (ret ndpiModuleState) {
reParser := regexp.MustCompile(
`^([\da-f]+)\s+((?:[\da-f]+/[\da-f]+)|disabled)\s+([^\s#]+)`,
)
Expand Down
2 changes: 1 addition & 1 deletion internal/3d-party/nftables/expr/test-data/ndpi-info.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#id mark ~mask name # count #version 4.3.0-8-6ae5394
#id mark ~mask name # count #version 4.9.0-49-f213e93
00 0/000001ff unknown # 0 debug=0
01 1/000001ff ftp_control # 0 debug=0
02 2/000001ff pop3 # 0 debug=0
Expand Down