nDPI 6.0 requires the application to declare under which license the
library is used and, for for-profit use without an agreement with
ntop, does not load its dual-licensed dissectors (DHCP, DNS, QUIC and
TLS as of 6.0), so rules on those protocols never fire.
Expose this as "ndpi.license" with the values not-for-profit (the
default), for-profit and for-profit-dual. An invalid value is fatal.
Older nDPI releases accept and ignore the option with a warning.
Ticket: 8077
Suricata knows the direction of every packet, so tell nDPI instead of
letting it guess. Whether the flow beginning was seen is left unknown
as the flow API exposes no reliable flag for it.
Ticket: 8077
nDPI correlates flows through LRU caches (DNS to TLS, STUN to RTP, TLS
certificates, ...) that are private to each worker's detection module.
As Suricata spreads a host's flows over all workers, these correlations
mostly missed.
Create a global context at plugin init, attach the worker modules to it
and make every cache global. Failures are logged and non-fatal. nDPI
creates a shared cache on first finalization without locking, which is
fine as thread init callbacks run sequentially from TmThreadCreate().
Ticket: 8077
nDPI 5.0 removed the protocol bitmask, ndpi_extra_dissection_possible()
and the third argument of ndpi_detection_giveup(), and introduced a
classification state; nDPI 6.0 added a license argument to
ndpi_init_detection_module(). The plugin only built against nDPI 4.x.
Wrap these differences in a small header of static inline helpers
selected on NDPI_MAJOR so that ndpi.c stays version agnostic. On 5.0
and later a flow is final once classified with no extra dissection
pending, as in ndpiReader, or in monitoring state, where the
classification can no longer change. The packet cap now also applies
to classified flows still under extra dissection.
Ticket: 8077
Remove the check for Flow.storage being NULL. With flex arrays, as long as the
flow is allocated, .storage will never be NULL. We do make sure the flow
is not NULL, and the storage functions are safe to the storage being
NULL.
Prevents NDPI from accessing this flow field to be less sensitive to ABI
changes with respect to data structure sizes.
Ticket: #8632
Add --plugin <PATH> to load an additional plugin from the command
line. This is more convenient than "--set plugins.X" especially when
you may already have a plugins loaded and you want to load an
additional one.
Ticket: 8463
Apply zero-padding to Napatech worker threads so alphanumeric sorting
displays workers in proper order.
Set padding for thread names according to stream count:
1-9 streams: no padding, e.g, nt1, nt9
10-99 streams: use padding, e.g, nt01, nt99
100-999 streams: use padding, e.g, nt001, nt099, nt999
This will insure that thread names, when sorted alphanumerically,
maintain thread worker id order.
Issue: 8337
This should cause the following warning to error out:
runmode-pfring.c: In function 'OldParsePfringConfig':
runmode-pfring.c:118:17: error: implicit declaration of function 'StringParseUnt16'; did you mean 'StringParseInt16'? [-Wimplicit-function-declaration]
118 | if (StringParseUnt16(&pfconf->threads, 10, 0, threadsstr) < 0) {
| ^~~~~~~~~~~~~~~~
| StringParseInt16
Ticket: #8271
For an easier review process, this is a two-step change process,
in which pcap_cnt is first accessed by functions-to-be, implemented
as simple macros.
In the follow-up commit, the actual refactor is implemented with the new
function. The old macros are deleted.
Ticket: 7835
util-device.h exposes some details that are particularly problematic
for C++, even when wrapped in 'extern "C"'. To address this, break the
header into public and private parts. The public part exposes
LiveDevice as an opaque data structure, while the private header has
the actual definition.
The idea is that only Suricata C source files should include the
private header, it should not be re-included in any other header
file. And this is the header library users should use, however we
don't enforce it with tecnical means, a library user could still
include the private header, but the clue there is in the name.
This can happen when the flow is UDP, but an ICMP unreachable is
returned, which gets assigned to the same flow.
Reference: https://github.com/ntop/nDPI/issues/2762
Split DetectHelperKeywordRegister into 2 functions, one for acquiring
a new keyword ID, and another to perform the registration.
This makes it easier to do the traditional C keyword initialization
with a dynamic ID.
TripleA150
Jason Ish
Philippe Antoine
Victor Julien
Jeff Lucovsky
Antoine Abou Faysal
Lukas Sismis
Alfredo Cardigliano
Jeff Lucovsky
Victor Julien