mirror of https://github.com/OISF/suricata
Alfredo Cardigliano
8 months ago
committed by
Victor Julien
parent
ce2e7aed74
commit
dfd9ef5784
@ -0,0 +1,43 @@
|
||||
nDPI Protocol Keyword
|
||||
=====================
|
||||
|
||||
ndpi-protocol
|
||||
-------------
|
||||
|
||||
Match on the Layer-7 protocol detected by nDPI.
|
||||
|
||||
Suricata should be compiled with the nDPI support and the ``ndpi``
|
||||
plugin must be loaded before it can be used.
|
||||
|
||||
Example of configuring Suricata to be compiled with nDPI support:
|
||||
|
||||
.. code-block:: console
|
||||
|
||||
./configure --enable-ndpi --with-ndpi=/home/user/nDPI
|
||||
|
||||
Example of suricata.yaml configuration file to load the ``ndpi`` plugin::
|
||||
|
||||
plugins:
|
||||
- /usr/lib/suricata/ndpi.so
|
||||
|
||||
Syntax::
|
||||
|
||||
ndpi-protocol:[!]<protocol>;
|
||||
|
||||
Where protocol is one of the application protocols detected by nDPI.
|
||||
Plase check ndpiReader -H for the full list.
|
||||
It is possible to specify the transport protocol, the application
|
||||
protocol, or both (dot-separated).
|
||||
|
||||
Examples::
|
||||
|
||||
ndpi-protocol:HTTP;
|
||||
ndpi-protocol:!TLS;
|
||||
ndpi-protocol:TLS.YouTube;
|
||||
|
||||
Here is an example of a rule matching TLS traffic on port 53:
|
||||
|
||||
.. container:: example-rule
|
||||
|
||||
alert tcp any any -> any 53 (msg:"TLS traffic over DNS standard port"; ndpi-protocol:TLS; sid:1;)
|
||||
|
||||
@ -0,0 +1,49 @@
|
||||
nDPI Risk Keyword
|
||||
=================
|
||||
|
||||
ndpi-risk
|
||||
---------
|
||||
|
||||
Match on the flow risks detected by nDPI. Risks are potential issues detected
|
||||
by nDPI during the packet dissection and include:
|
||||
|
||||
- Known Proto on Non Std Port
|
||||
- Binary App Transfer
|
||||
- Self-signed Certificate
|
||||
- Susp DGA Domain name
|
||||
- Malware host contacted
|
||||
- and many other...
|
||||
|
||||
Suricata should be compiled with the nDPI support and the ``ndpi``
|
||||
plugin must be loaded before it can be used.
|
||||
|
||||
Example of configuring Suricata to be compiled with nDPI support:
|
||||
|
||||
.. code-block:: console
|
||||
|
||||
./configure --enable-ndpi --with-ndpi=/home/user/nDPI
|
||||
|
||||
Example of suricata.yaml configuration file to load the ``ndpi`` plugin::
|
||||
|
||||
plugins:
|
||||
- /usr/lib/suricata/ndpi.so
|
||||
|
||||
Syntax::
|
||||
|
||||
ndpi-risk:[!]<risk>;
|
||||
|
||||
Where risk is one (or multiple comma-separated) of the risk codes supported by
|
||||
nDPI (e.g. NDPI_BINARY_APPLICATION_TRANSFER). Please check ndpiReader -H for the
|
||||
full list.
|
||||
|
||||
Examples::
|
||||
|
||||
ndpi-risk:NDPI_BINARY_APPLICATION_TRANSFER;
|
||||
ndpi-risk:NDPI_TLS_OBSOLETE_VERSION,NDPI_TLS_WEAK_CIPHER;
|
||||
|
||||
Here is an example of a rule matching HTTP traffic transferring a binary application:
|
||||
|
||||
.. container:: example-rule
|
||||
|
||||
alert tcp any any -> any any (msg:"Binary application transfer over HTTP"; ndpi-protocol:HTTP; ndpi-risk:NDPI_BINARY_APPLICATION_TRANSFER; sid:1;)
|
||||
|
||||
@ -0,0 +1,13 @@
|
||||
pkglib_LTLIBRARIES = ndpi.la
|
||||
|
||||
ndpi_la_LDFLAGS = -module -avoid-version -shared
|
||||
ndpi_la_LIBADD = @NDPI_LIB@
|
||||
|
||||
# Only required to find these headers when building plugins from the
|
||||
# source directory.
|
||||
ndpi_la_CFLAGS = -I../../rust/gen -I../../rust/dist
|
||||
|
||||
ndpi_la_SOURCES = ndpi.c
|
||||
|
||||
install-exec-hook:
|
||||
cd $(DESTDIR)$(pkglibdir) && $(RM) $(pkglib_LTLIBRARIES)
|
||||
@ -0,0 +1,540 @@
|
||||
/* Copyright (C) 2024-2025 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/* License note: While this "glue" code to the nDPI library is GPLv2,
|
||||
* nDPI is itself LGPLv3 which is known to be incompatible with the
|
||||
* GPLv2. */
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "suricata-plugin.h"
|
||||
|
||||
#include "detect-engine-helper.h"
|
||||
#include "detect-parse.h"
|
||||
#include "flow-callbacks.h"
|
||||
#include "flow-storage.h"
|
||||
#include "output-eve.h"
|
||||
#include "thread-callbacks.h"
|
||||
#include "thread-storage.h"
|
||||
#include "util-debug.h"
|
||||
|
||||
#include "ndpi_api.h"
|
||||
|
||||
static ThreadStorageId thread_storage_id = { .id = -1 };
|
||||
static FlowStorageId flow_storage_id = { .id = -1 };
|
||||
static int ndpi_protocol_keyword_id = -1;
|
||||
static int ndpi_risk_keyword_id = -1;
|
||||
|
||||
struct NdpiThreadContext {
|
||||
struct ndpi_detection_module_struct *ndpi;
|
||||
};
|
||||
|
||||
struct NdpiFlowContext {
|
||||
struct ndpi_flow_struct *ndpi_flow;
|
||||
ndpi_protocol detected_l7_protocol;
|
||||
bool detection_completed;
|
||||
};
|
||||
|
||||
typedef struct DetectnDPIProtocolData_ {
|
||||
ndpi_master_app_protocol l7_protocol;
|
||||
bool negated;
|
||||
} DetectnDPIProtocolData;
|
||||
|
||||
typedef struct DetectnDPIRiskData_ {
|
||||
ndpi_risk risk_mask; /* uint64 */
|
||||
bool negated;
|
||||
} DetectnDPIRiskData;
|
||||
|
||||
static void ThreadStorageFree(void *ptr)
|
||||
{
|
||||
SCLogDebug("Free'ing nDPI thread storage");
|
||||
struct NdpiThreadContext *context = ptr;
|
||||
ndpi_exit_detection_module(context->ndpi);
|
||||
SCFree(context);
|
||||
}
|
||||
|
||||
static void FlowStorageFree(void *ptr)
|
||||
{
|
||||
struct NdpiFlowContext *ctx = ptr;
|
||||
ndpi_flow_free(ctx->ndpi_flow);
|
||||
SCFree(ctx);
|
||||
}
|
||||
|
||||
static void OnFlowInit(ThreadVars *tv, Flow *f, const Packet *p, void *_data)
|
||||
{
|
||||
struct NdpiFlowContext *flowctx = SCCalloc(1, sizeof(*flowctx));
|
||||
if (flowctx == NULL) {
|
||||
FatalError("Failed to allocate nDPI flow context");
|
||||
}
|
||||
|
||||
flowctx->ndpi_flow = ndpi_flow_malloc(SIZEOF_FLOW_STRUCT);
|
||||
if (flowctx->ndpi_flow == NULL) {
|
||||
FatalError("Failed to allocate nDPI flow");
|
||||
}
|
||||
|
||||
memset(flowctx->ndpi_flow, 0, SIZEOF_FLOW_STRUCT);
|
||||
flowctx->detection_completed = false;
|
||||
FlowSetStorageById(f, flow_storage_id, flowctx);
|
||||
}
|
||||
|
||||
static void OnFlowUpdate(ThreadVars *tv, Flow *f, Packet *p, void *_data)
|
||||
{
|
||||
struct NdpiThreadContext *threadctx = ThreadGetStorageById(tv, thread_storage_id);
|
||||
struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
|
||||
uint16_t ip_len = 0;
|
||||
void *ip_ptr = NULL;
|
||||
|
||||
if (!threadctx->ndpi || !flowctx->ndpi_flow) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (PacketIsIPv4(p)) {
|
||||
const IPV4Hdr *ip4h = PacketGetIPv4(p);
|
||||
ip_len = IPV4_GET_RAW_IPLEN(ip4h);
|
||||
ip_ptr = (void *)PacketGetIPv4(p);
|
||||
} else if (PacketIsIPv6(p)) {
|
||||
const IPV6Hdr *ip6h = PacketGetIPv6(p);
|
||||
ip_len = IPV6_HEADER_LEN + IPV6_GET_RAW_PLEN(ip6h);
|
||||
ip_ptr = (void *)PacketGetIPv6(p);
|
||||
}
|
||||
|
||||
if (!flowctx->detection_completed && ip_ptr != NULL && ip_len > 0) {
|
||||
uint64_t time_ms = ((uint64_t)p->ts.secs) * 1000 + p->ts.usecs / 1000;
|
||||
|
||||
SCLogDebug("Performing nDPI detection...");
|
||||
|
||||
flowctx->detected_l7_protocol = ndpi_detection_process_packet(
|
||||
threadctx->ndpi, flowctx->ndpi_flow, ip_ptr, ip_len, time_ms, NULL);
|
||||
|
||||
if (ndpi_is_protocol_detected(flowctx->detected_l7_protocol) != 0) {
|
||||
if (!ndpi_is_proto_unknown(flowctx->detected_l7_protocol.proto)) {
|
||||
if (!ndpi_extra_dissection_possible(threadctx->ndpi, flowctx->ndpi_flow))
|
||||
flowctx->detection_completed = true;
|
||||
}
|
||||
} else {
|
||||
uint16_t max_num_pkts = (f->proto == IPPROTO_UDP) ? 8 : 24;
|
||||
|
||||
if ((f->todstpktcnt + f->tosrcpktcnt) > max_num_pkts) {
|
||||
uint8_t proto_guessed;
|
||||
|
||||
flowctx->detected_l7_protocol =
|
||||
ndpi_detection_giveup(threadctx->ndpi, flowctx->ndpi_flow, &proto_guessed);
|
||||
flowctx->detection_completed = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (SCLogDebugEnabled() && flowctx->detection_completed) {
|
||||
SCLogDebug("Detected protocol: %s | app protocol: %s | category: %s",
|
||||
ndpi_get_proto_name(
|
||||
threadctx->ndpi, flowctx->detected_l7_protocol.proto.master_protocol),
|
||||
ndpi_get_proto_name(
|
||||
threadctx->ndpi, flowctx->detected_l7_protocol.proto.app_protocol),
|
||||
ndpi_category_get_name(
|
||||
threadctx->ndpi, flowctx->detected_l7_protocol.category));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static void OnFlowFinish(ThreadVars *tv, Flow *f, void *_data)
|
||||
{
|
||||
/* Nothing to do here, the storage API has taken care of cleaning
|
||||
* up storage, just here for example purposes. */
|
||||
SCLogDebug("Flow %p is now finished", f);
|
||||
}
|
||||
|
||||
static void OnThreadInit(ThreadVars *tv, void *_data)
|
||||
{
|
||||
struct NdpiThreadContext *context = SCCalloc(1, sizeof(*context));
|
||||
if (context == NULL) {
|
||||
FatalError("Failed to allocate nDPI thread context");
|
||||
}
|
||||
context->ndpi = ndpi_init_detection_module(NULL);
|
||||
if (context->ndpi == NULL) {
|
||||
FatalError("Failed to initialize nDPI detection module");
|
||||
}
|
||||
NDPI_PROTOCOL_BITMASK protos;
|
||||
NDPI_BITMASK_SET_ALL(protos);
|
||||
ndpi_set_protocol_detection_bitmask2(context->ndpi, &protos);
|
||||
ndpi_finalize_initialization(context->ndpi);
|
||||
ThreadSetStorageById(tv, thread_storage_id, context);
|
||||
}
|
||||
|
||||
static int DetectnDPIProtocolPacketMatch(
|
||||
DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
|
||||
{
|
||||
const Flow *f = p->flow;
|
||||
struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
|
||||
const DetectnDPIProtocolData *data = (const DetectnDPIProtocolData *)ctx;
|
||||
|
||||
SCEnter();
|
||||
|
||||
/* if the sig is PD-only we only match when PD packet flags are set */
|
||||
/*
|
||||
if (s->type == SIG_TYPE_PDONLY &&
|
||||
(p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) {
|
||||
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
*/
|
||||
|
||||
if (!flowctx->detection_completed) {
|
||||
SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", p->pcap_cnt);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
if (f == NULL) {
|
||||
SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
bool r = ndpi_is_proto_equals(flowctx->detected_l7_protocol.proto, data->l7_protocol, false);
|
||||
r = r ^ data->negated;
|
||||
|
||||
if (r) {
|
||||
SCLogDebug("ndpi protocol match on protocol = %u.%u (match %u)",
|
||||
flowctx->detected_l7_protocol.proto.app_protocol,
|
||||
flowctx->detected_l7_protocol.proto.master_protocol,
|
||||
data->l7_protocol.app_protocol);
|
||||
SCReturnInt(1);
|
||||
}
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
static DetectnDPIProtocolData *DetectnDPIProtocolParse(const char *arg, bool negate)
|
||||
{
|
||||
DetectnDPIProtocolData *data;
|
||||
struct ndpi_detection_module_struct *ndpi_struct;
|
||||
ndpi_master_app_protocol l7_protocol;
|
||||
char *l7_protocol_name = (char *)arg;
|
||||
NDPI_PROTOCOL_BITMASK all;
|
||||
|
||||
/* convert protocol name (string) to ID */
|
||||
ndpi_struct = ndpi_init_detection_module(NULL);
|
||||
if (unlikely(ndpi_struct == NULL))
|
||||
return NULL;
|
||||
|
||||
ndpi_struct = ndpi_init_detection_module(NULL);
|
||||
NDPI_BITMASK_SET_ALL(all);
|
||||
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
|
||||
ndpi_finalize_initialization(ndpi_struct);
|
||||
|
||||
l7_protocol = ndpi_get_protocol_by_name(ndpi_struct, l7_protocol_name);
|
||||
ndpi_exit_detection_module(ndpi_struct);
|
||||
|
||||
if (ndpi_is_proto_unknown(l7_protocol)) {
|
||||
SCLogError("failure parsing nDPI protocol '%s'", l7_protocol_name);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
data = SCMalloc(sizeof(DetectnDPIProtocolData));
|
||||
if (unlikely(data == NULL))
|
||||
return NULL;
|
||||
|
||||
memcpy(&data->l7_protocol, &l7_protocol, sizeof(ndpi_master_app_protocol));
|
||||
data->negated = negate;
|
||||
|
||||
return data;
|
||||
}
|
||||
|
||||
static bool nDPIProtocolDataHasConflicts(
|
||||
const DetectnDPIProtocolData *us, const DetectnDPIProtocolData *them)
|
||||
{
|
||||
/* check for mix of negated and non negated */
|
||||
if (them->negated ^ us->negated)
|
||||
return true;
|
||||
|
||||
/* check for multiple non-negated */
|
||||
if (!us->negated)
|
||||
return true;
|
||||
|
||||
/* check for duplicate */
|
||||
if (ndpi_is_proto_equals(us->l7_protocol, them->l7_protocol, true))
|
||||
return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
static int DetectnDPIProtocolSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
||||
{
|
||||
DetectnDPIProtocolData *data = DetectnDPIProtocolParse(arg, s->init_data->negated);
|
||||
if (data == NULL)
|
||||
goto error;
|
||||
|
||||
SigMatch *tsm = s->init_data->smlists[DETECT_SM_LIST_MATCH];
|
||||
for (; tsm != NULL; tsm = tsm->next) {
|
||||
if (tsm->type == ndpi_protocol_keyword_id) {
|
||||
const DetectnDPIProtocolData *them = (const DetectnDPIProtocolData *)tsm->ctx;
|
||||
|
||||
if (nDPIProtocolDataHasConflicts(data, them)) {
|
||||
SCLogError("can't mix "
|
||||
"positive ndpi-protocol match with negated");
|
||||
goto error;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (SigMatchAppendSMToList(de_ctx, s, ndpi_protocol_keyword_id, (SigMatchCtx *)data,
|
||||
DETECT_SM_LIST_MATCH) == NULL) {
|
||||
goto error;
|
||||
}
|
||||
return 0;
|
||||
|
||||
error:
|
||||
if (data != NULL)
|
||||
SCFree(data);
|
||||
return -1;
|
||||
}
|
||||
|
||||
static void DetectnDPIProtocolFree(DetectEngineCtx *de_ctx, void *ptr)
|
||||
{
|
||||
SCFree(ptr);
|
||||
}
|
||||
|
||||
static int DetectnDPIRiskPacketMatch(
|
||||
DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
|
||||
{
|
||||
const Flow *f = p->flow;
|
||||
struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
|
||||
const DetectnDPIRiskData *data = (const DetectnDPIRiskData *)ctx;
|
||||
|
||||
SCEnter();
|
||||
|
||||
if (!flowctx->detection_completed) {
|
||||
SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", p->pcap_cnt);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
if (f == NULL) {
|
||||
SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt);
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
bool r = ((flowctx->ndpi_flow->risk & data->risk_mask) == data->risk_mask);
|
||||
r = r ^ data->negated;
|
||||
|
||||
if (r) {
|
||||
SCLogDebug("ndpi risks match on risk bitmap = %" PRIu64 " (matching bitmap %" PRIu64 ")",
|
||||
flowctx->ndpi_flow->risk, data->risk_mask);
|
||||
SCReturnInt(1);
|
||||
}
|
||||
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
static DetectnDPIRiskData *DetectnDPIRiskParse(const char *arg, bool negate)
|
||||
{
|
||||
DetectnDPIRiskData *data;
|
||||
struct ndpi_detection_module_struct *ndpi_struct;
|
||||
ndpi_risk risk_mask;
|
||||
NDPI_PROTOCOL_BITMASK all;
|
||||
|
||||
/* convert list of risk names (string) to mask */
|
||||
ndpi_struct = ndpi_init_detection_module(NULL);
|
||||
if (unlikely(ndpi_struct == NULL))
|
||||
return NULL;
|
||||
|
||||
ndpi_struct = ndpi_init_detection_module(NULL);
|
||||
NDPI_BITMASK_SET_ALL(all);
|
||||
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
|
||||
ndpi_finalize_initialization(ndpi_struct);
|
||||
|
||||
if (isdigit(arg[0]))
|
||||
risk_mask = atoll(arg);
|
||||
else {
|
||||
char *dup = SCStrdup(arg), *tmp, *token;
|
||||
|
||||
NDPI_ZERO_BIT(risk_mask);
|
||||
|
||||
if (dup != NULL) {
|
||||
token = strtok_r(dup, ",", &tmp);
|
||||
|
||||
while (token != NULL) {
|
||||
ndpi_risk_enum risk_id = ndpi_code2risk(token);
|
||||
if (risk_id >= NDPI_MAX_RISK) {
|
||||
SCLogError("unrecognized risk '%s', "
|
||||
"please check ndpiReader -H for valid risk codes",
|
||||
token);
|
||||
return NULL;
|
||||
}
|
||||
NDPI_SET_BIT(risk_mask, risk_id);
|
||||
token = strtok_r(NULL, ",", &tmp);
|
||||
}
|
||||
|
||||
SCFree(dup);
|
||||
}
|
||||
}
|
||||
|
||||
data = SCMalloc(sizeof(DetectnDPIRiskData));
|
||||
if (unlikely(data == NULL))
|
||||
return NULL;
|
||||
|
||||
data->risk_mask = risk_mask;
|
||||
data->negated = negate;
|
||||
|
||||
return data;
|
||||
}
|
||||
|
||||
static bool nDPIRiskDataHasConflicts(const DetectnDPIRiskData *us, const DetectnDPIRiskData *them)
|
||||
{
|
||||
/* check for duplicate */
|
||||
if (us->risk_mask == them->risk_mask)
|
||||
return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
static int DetectnDPIRiskSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
|
||||
{
|
||||
DetectnDPIRiskData *data = DetectnDPIRiskParse(arg, s->init_data->negated);
|
||||
if (data == NULL)
|
||||
goto error;
|
||||
|
||||
SigMatch *tsm = s->init_data->smlists[DETECT_SM_LIST_MATCH];
|
||||
for (; tsm != NULL; tsm = tsm->next) {
|
||||
if (tsm->type == ndpi_risk_keyword_id) {
|
||||
const DetectnDPIRiskData *them = (const DetectnDPIRiskData *)tsm->ctx;
|
||||
|
||||
if (nDPIRiskDataHasConflicts(data, them)) {
|
||||
SCLogError("can't mix "
|
||||
"positive ndpi-risk match with negated");
|
||||
goto error;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (SigMatchAppendSMToList(de_ctx, s, ndpi_risk_keyword_id, (SigMatchCtx *)data,
|
||||
DETECT_SM_LIST_MATCH) == NULL) {
|
||||
goto error;
|
||||
}
|
||||
return 0;
|
||||
|
||||
error:
|
||||
if (data != NULL)
|
||||
SCFree(data);
|
||||
return -1;
|
||||
}
|
||||
|
||||
static void DetectnDPIRiskFree(DetectEngineCtx *de_ctx, void *ptr)
|
||||
{
|
||||
SCFree(ptr);
|
||||
}
|
||||
|
||||
static void EveCallback(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *jb, void *data)
|
||||
{
|
||||
/* Adding ndpi info to EVE requires a flow. */
|
||||
if (f == NULL) {
|
||||
return;
|
||||
}
|
||||
|
||||
struct NdpiThreadContext *threadctx = ThreadGetStorageById(tv, thread_storage_id);
|
||||
struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
|
||||
ndpi_serializer serializer;
|
||||
char *buffer;
|
||||
uint32_t buffer_len;
|
||||
|
||||
SCLogDebug("EveCallback: tv=%p, p=%p, f=%p", tv, p, f);
|
||||
|
||||
ndpi_init_serializer(&serializer, ndpi_serialization_format_inner_json);
|
||||
|
||||
/* Use ndpi_dpi2json to get a JSON with nDPI metadata */
|
||||
ndpi_dpi2json(threadctx->ndpi, flowctx->ndpi_flow, flowctx->detected_l7_protocol, &serializer);
|
||||
|
||||
buffer = ndpi_serializer_get_buffer(&serializer, &buffer_len);
|
||||
|
||||
/* Inject the nDPI JSON to the JsonBuilder */
|
||||
jb_set_formatted(jb, buffer);
|
||||
|
||||
ndpi_term_serializer(&serializer);
|
||||
}
|
||||
|
||||
static void NdpInitRiskKeyword(void)
|
||||
{
|
||||
/* SCSigTableElmt and DetectHelperKeywordRegister don't yet
|
||||
* support all the fields required to register the nDPI keywords,
|
||||
* so we'll just register with an empty keyword specifier to get
|
||||
* the ID, then fill in the ID. */
|
||||
SCSigTableElmt keyword = {};
|
||||
ndpi_protocol_keyword_id = DetectHelperKeywordRegister(&keyword);
|
||||
SCLogDebug("Registered new ndpi-protocol keyword with ID %" PRIu32, ndpi_protocol_keyword_id);
|
||||
|
||||
sigmatch_table[ndpi_protocol_keyword_id].name = "ndpi-protocol";
|
||||
sigmatch_table[ndpi_protocol_keyword_id].desc = "match on the detected nDPI protocol";
|
||||
sigmatch_table[ndpi_protocol_keyword_id].url = "/rules/ndpi-protocol.html";
|
||||
sigmatch_table[ndpi_protocol_keyword_id].Match = DetectnDPIProtocolPacketMatch;
|
||||
sigmatch_table[ndpi_protocol_keyword_id].Setup = DetectnDPIProtocolSetup;
|
||||
sigmatch_table[ndpi_protocol_keyword_id].Free = DetectnDPIProtocolFree;
|
||||
sigmatch_table[ndpi_protocol_keyword_id].flags =
|
||||
(SIGMATCH_QUOTES_OPTIONAL | SIGMATCH_HANDLE_NEGATION);
|
||||
|
||||
ndpi_risk_keyword_id = DetectHelperKeywordRegister(&keyword);
|
||||
SCLogDebug("Registered new ndpi-risk keyword with ID %" PRIu32, ndpi_risk_keyword_id);
|
||||
|
||||
sigmatch_table[ndpi_risk_keyword_id].name = "ndpi-risk";
|
||||
sigmatch_table[ndpi_risk_keyword_id].desc = "match on the detected nDPI risk";
|
||||
sigmatch_table[ndpi_risk_keyword_id].url = "/rules/ndpi-risk.html";
|
||||
sigmatch_table[ndpi_risk_keyword_id].Match = DetectnDPIRiskPacketMatch;
|
||||
sigmatch_table[ndpi_risk_keyword_id].Setup = DetectnDPIRiskSetup;
|
||||
sigmatch_table[ndpi_risk_keyword_id].Free = DetectnDPIRiskFree;
|
||||
sigmatch_table[ndpi_risk_keyword_id].flags =
|
||||
(SIGMATCH_QUOTES_OPTIONAL | SIGMATCH_HANDLE_NEGATION);
|
||||
}
|
||||
|
||||
static void NdpiInit(void)
|
||||
{
|
||||
SCLogDebug("Initializing nDPI plugin");
|
||||
|
||||
/* Register thread storage. */
|
||||
thread_storage_id = ThreadStorageRegister("ndpi", sizeof(void *), NULL, ThreadStorageFree);
|
||||
if (thread_storage_id.id < 0) {
|
||||
FatalError("Failed to register nDPI thread storage");
|
||||
}
|
||||
|
||||
/* Register flow storage. */
|
||||
flow_storage_id = FlowStorageRegister("ndpi", sizeof(void *), NULL, FlowStorageFree);
|
||||
if (flow_storage_id.id < 0) {
|
||||
FatalError("Failed to register nDPI flow storage");
|
||||
}
|
||||
|
||||
/* Register flow lifecycle callbacks. */
|
||||
SCFlowRegisterInitCallback(OnFlowInit, NULL);
|
||||
SCFlowRegisterUpdateCallback(OnFlowUpdate, NULL);
|
||||
|
||||
/* Not needed for nDPI, but exists for completeness. */
|
||||
SCFlowRegisterFinishCallback(OnFlowFinish, NULL);
|
||||
|
||||
/* Register thread init callback. */
|
||||
SCThreadRegisterInitCallback(OnThreadInit, NULL);
|
||||
|
||||
/* Register an EVE callback. */
|
||||
SCEveRegisterCallback(EveCallback, NULL);
|
||||
|
||||
NdpInitRiskKeyword();
|
||||
}
|
||||
|
||||
const SCPlugin PluginRegistration = {
|
||||
.version = SC_API_VERSION,
|
||||
.suricata_version = SC_PACKAGE_VERSION,
|
||||
.name = "ndpi",
|
||||
.author = "Luca Deri",
|
||||
.license = "GPLv3",
|
||||
.Init = NdpiInit,
|
||||
|
||||
};
|
||||
|
||||
const SCPlugin *SCPluginRegister()
|
||||
{
|
||||
return &PluginRegistration;
|
||||
}
|
||||
Loading…
Reference in New Issue