Skip to content

Commit 07eb92f

Browse files
IvanNardiIvanNardi
authored
Preliminary work to rework struct ndpi_flow_struct (#2705)
No significant changes: * Move around some fields to avoid holes in the structures. * Some fields are about protocols based only on TCP. * Remove some unused (or set but never read) fields. See #2631
1 parent 642cf57 commit 07eb92f

File tree

6 files changed

+124
-129
lines changed

6 files changed

+124
-129
lines changed

‎src/include/ndpi_typedefs.h

+86-88
Original file line numberDiff line numberDiff line change
@@ -805,6 +805,51 @@ struct ndpi_lru_cache {
805805
/* ************************************************** */
806806

807807
struct ndpi_flow_tcp_struct {
808+
/* TCP sequence number */
809+
u_int32_t next_tcp_seq_nr[2];
810+
u_int16_t last_tcp_pkt_payload_len;
811+
812+
/* Part of the TCP header */
813+
u_int8_t cli2srv_tcp_flags, srv2cli_tcp_flags;
814+
u_int32_t seen_syn:1, seen_syn_ack:1, seen_ack:1;
815+
816+
/* NDPI_PROTOCOL_IRC */
817+
u_int32_t irc_3a_counter:3;
818+
819+
/* NDPI_PROTOCOL_USENET */
820+
u_int32_t usenet_stage:2;
821+
822+
/* NDPI_PROTOCOL_HTTP */
823+
u_int32_t http_stage:3;
824+
u_int32_t http_asymmetric_stage:2;
825+
826+
/* NDPI_PROTOCOL_GNUTELLA */
827+
u_int32_t gnutella_stage:2; // 0 - 2
828+
829+
/* NDPI_PROTOCOL_SSH */
830+
u_int32_t ssh_stage:3;
831+
832+
/* NDPI_PROTOCOL_VNC */
833+
u_int32_t vnc_stage:2; // 0 - 3
834+
835+
/* NDPI_PROTOCOL_TELNET */
836+
u_int32_t telnet_stage:2; // 0 - 2
837+
838+
/* NDPI_PROTOCOL_RADMIN */
839+
u_int32_t radmin_stage:1;
840+
841+
/* NDPI_PROTOCOL_FTP_CONTROL */
842+
u_int32_t ftp_control_stage:2;
843+
844+
/* NDPI_PROTOCOL_SOAP */
845+
u_int32_t soap_stage:1;
846+
847+
/* NDPI_PROTOCOL_SOCKS */
848+
u_int32_t socks5_stage:2, socks4_stage:2;
849+
850+
/* NDPI_PROTOCOL_Z3950 */
851+
u_int32_t z3950_stage:2;
852+
808853
/* NDPI_PROTOCOL_MAIL_SMTP */
809854
/* NDPI_PROTOCOL_MAIL_POP */
810855
/* NDPI_PROTOCOL_MAIL_IMAP */
@@ -815,6 +860,9 @@ struct ndpi_flow_tcp_struct {
815860
char username[32], password[16];
816861
} ftp_imap_pop_smtp;
817862

863+
/* NDPI_PROTOCOL_LOTUS_NOTES */
864+
u_int8_t lotus_notes_packet_id;
865+
818866
/* NDPI_PROTOCOL_MAIL_SMTP */
819867
u_int16_t smtp_command_bitmask;
820868

@@ -830,31 +878,11 @@ struct ndpi_flow_tcp_struct {
830878
/* NDPI_PROTOCOL_GNUTELLA */
831879
u_int8_t gnutella_msg_id[3];
832880

833-
/* NDPI_PROTOCOL_IRC */
834-
u_int32_t irc_3a_counter:3;
835-
836-
/* NDPI_PROTOCOL_USENET */
837-
u_int32_t usenet_stage:2;
838-
839-
/* NDPI_PROTOCOL_HTTP */
840-
u_int32_t http_stage:3;
841-
u_int32_t http_asymmetric_stage:2;
842-
843-
/* NDPI_PROTOCOL_GNUTELLA */
844-
u_int32_t gnutella_stage:2; // 0 - 2
845-
846-
/* NDPI_PROTOCOL_SSH */
847-
u_int32_t ssh_stage:3;
848-
849-
/* NDPI_PROTOCOL_VNC */
850-
u_int32_t vnc_stage:2; // 0 - 3
851-
852-
/* NDPI_PROTOCOL_TELNET */
853-
u_int32_t telnet_stage:2; // 0 - 2
881+
/* NDPI_PROTOCOL_NEST_LOG_SINK */
882+
u_int8_t nest_log_sink_matches;
854883

855-
/* NDPI_PROTOCOL_RTMP */
856-
u_int32_t rtmp_stage:2;
857-
u_int16_t rtmp_client_buffer_len;
884+
/* NDPI_PROTOCOL_MEMCACHED */
885+
u_int8_t memcached_matches;
858886

859887
struct {
860888
/* NDPI_PROTOCOL_TLS */
@@ -863,12 +891,16 @@ struct ndpi_flow_tcp_struct {
863891
int16_t tls_application_blocks_len[NDPI_MAX_NUM_TLS_APPL_BLOCKS]; /* + = src->dst, - = dst->src */
864892
} tls;
865893

894+
/* NDPI_PROTOCOL_ZMQ */
895+
u_char prev_zmq_pkt[10];
896+
u_int8_t prev_zmq_pkt_len;
897+
898+
/* NDPI_PROTOCOL_RTMP */
899+
u_int16_t rtmp_client_buffer_len;
900+
u_int32_t rtmp_stage:2;
901+
866902
/* NDPI_PROTOCOL_POSTGRES */
867903
u_int32_t postgres_stage:3;
868-
869-
/* Part of the TCP header. */
870-
u_int32_t seen_syn:1, seen_syn_ack:1, seen_ack:1, __notused:29;
871-
u_int8_t cli2srv_tcp_flags, srv2cli_tcp_flags;
872904

873905
/* NDPI_PROTOCOL_ICECAST */
874906
u_int32_t icecast_stage:1;
@@ -884,25 +916,6 @@ struct ndpi_flow_tcp_struct {
884916

885917
/* NDPI_PROTOCOL_MAIL_IMAP */
886918
u_int32_t mail_imap_stage:3, mail_imap_starttls:2;
887-
888-
/* NDPI_PROTOCOL_SOAP */
889-
u_int32_t soap_stage:1;
890-
891-
/* NDPI_PROTOCOL_LOTUS_NOTES */
892-
u_int8_t lotus_notes_packet_id;
893-
894-
/* NDPI_PROTOCOL_ZMQ */
895-
u_int8_t prev_zmq_pkt_len;
896-
u_char prev_zmq_pkt[10];
897-
898-
/* NDPI_PROTOCOL_MEMCACHED */
899-
u_int8_t memcached_matches;
900-
901-
/* NDPI_PROTOCOL_NEST_LOG_SINK */
902-
u_int8_t nest_log_sink_matches;
903-
904-
/* NDPI_PROTOCOL_RADMIN */
905-
u_int32_t radmin_stage:1;
906919
};
907920

908921
/* ************************************************** */
@@ -928,27 +941,33 @@ struct ndpi_flow_udp_struct {
928941
/* NDPI_PROTOCOL_ZOOM */
929942
u_int32_t zoom_p2p:1;
930943

931-
/* NDPI_PROTOCOL_EPICGAMES */
932-
u_int32_t epicgames_stage:1;
933-
u_int32_t epicgames_word;
934-
935944
/* NDPI_PROTOCOL_RAKNET */
936945
u_int32_t raknet_custom:1;
937946

938-
/* NDPI_PROTOCOL_EAQ */
939-
u_int8_t eaq_pkt_id;
940-
u_int32_t eaq_sequence;
947+
/* NDPI_PROTOCOL_MUMBLE */
948+
u_int32_t mumble_stage:1;
949+
950+
/* NDPI_PROTOCOL_EPICGAMES */
951+
u_int32_t epicgames_stage:1;
952+
u_int32_t epicgames_word;
941953

942954
/* NDPI_PROTOCOL_RX */
943955
u_int32_t rx_conn_epoch;
944956
u_int32_t rx_conn_id;
945957

958+
/* NDPI_PROTOCOL_WIREGUARD */
959+
u_int32_t wireguard_peer_index[2];
960+
u_int8_t wireguard_stage;
961+
946962
/* NDPI_PROTOCOL_MEMCACHED */
947963
u_int8_t memcached_matches;
948964

949-
/* NDPI_PROTOCOL_WIREGUARD */
950-
u_int8_t wireguard_stage;
951-
u_int32_t wireguard_peer_index[2];
965+
/* NDPI_PROTOCOL_EAQ */
966+
u_int8_t eaq_pkt_id;
967+
u_int32_t eaq_sequence;
968+
969+
/* NDPI_PROTOCOL_MUMBLE */
970+
u_int64_t mumble_ident;
952971

953972
/* NDPI_PROTOCOL_QUIC */
954973
u_int8_t *quic_reasm_buf;
@@ -975,9 +994,6 @@ struct ndpi_flow_udp_struct {
975994
u_int16_t tftp_data_num;
976995
u_int16_t tftp_ack_num;
977996

978-
/* NDPI_PROTOCOL_MUMBLE */
979-
u_int8_t mumble_stage:1;
980-
u_int64_t mumble_ident;
981997
};
982998

983999
/* ************************************************** */
@@ -1272,7 +1288,7 @@ struct ndpi_flow_struct {
12721288
u_int16_t guessed_protocol_id; /* Classification by-port. Set with the first pkt and never updated */
12731289
u_int16_t guessed_protocol_id_by_ip; /* Classification by-ip. Set with the first pkt and never updated */
12741290
u_int16_t fast_callback_protocol_id; /* Partial/incomplete classification. Used internally as first callback when iterating all the protocols */
1275-
u_int16_t guessed_category, guessed_header_category;
1291+
u_int16_t guessed_header_category;
12761292
u_int8_t l4_proto, protocol_id_already_guessed:1, fail_with_unknown:1,
12771293
init_finished:1, client_packet_direction:1, packet_direction:1, is_ipv6:1, first_pkt_fully_encrypted:1, skip_entropy_check: 1;
12781294
u_int8_t monitoring:1, _pad:7;
@@ -1282,13 +1298,6 @@ struct ndpi_flow_struct {
12821298

12831299
/* First Packet Classification info */
12841300
struct ndpi_fpc_info fpc;
1285-
1286-
/*
1287-
if ndpi_struct->direction_detect_disable == 1
1288-
tcp sequence number connection tracking
1289-
*/
1290-
u_int32_t next_tcp_seq_nr[2];
1291-
u_int16_t last_tcp_pkt_payload_len;
12921301

12931302
/* Flow addresses (useful for LRU lookups in ndpi_detection_giveup())
12941303
and ports. All in *network* byte order.
@@ -1310,6 +1319,15 @@ struct ndpi_flow_struct {
13101319

13111320
u_int64_t last_packet_time_ms;
13121321

1322+
ndpi_protocol_category_t category;
1323+
1324+
/* Counters with only packets with L5 data (ie no TCP SYN, pure ACKs, ...) */
1325+
u_int16_t packet_counter;
1326+
u_int16_t packet_direction_counter[2];
1327+
/* Counters with all packets even those without payload */
1328+
u_int16_t all_packets_counter;
1329+
u_int16_t packet_direction_complete_counter[2];
1330+
13131331
/*
13141332
the tcp / udp / other l4 value union
13151333
used to reduce the number of bytes for tcp or udp protocol states
@@ -1548,17 +1566,6 @@ struct ndpi_flow_struct {
15481566
/* protocols which have marked a connection as this connection cannot be protocol XXX, multiple u_int64_t */
15491567
NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask;
15501568

1551-
ndpi_protocol_category_t category;
1552-
1553-
/* Only packets with L5 data (ie no TCP SYN, pure ACKs, ...) */
1554-
u_int16_t packet_counter; // can be 0 - 65000
1555-
u_int16_t packet_direction_counter[2];
1556-
u_int8_t packet_direction_with_payload_observed[2]; /* 0 = no packet with payload observed, 1 = at least one packet with payload observed */
1557-
1558-
/* All packets even those without payload */
1559-
u_int16_t all_packets_counter;
1560-
u_int16_t packet_direction_complete_counter[2]; // can be 0 - 65000
1561-
15621569
/* NDPI_PROTOCOL_BITTORRENT */
15631570
u_int8_t bittorrent_stage; // can be 0 - 255
15641571
u_int8_t bt_check_performed : 1;
@@ -1569,18 +1576,9 @@ struct ndpi_flow_struct {
15691576
/* NDPI_PROTOCOL_ZATTOO */
15701577
u_int8_t zattoo_stage:3;
15711578

1572-
/* NDPI_PROTOCOL_SOCKS */
1573-
u_int8_t socks5_stage:2, socks4_stage:2; // 0 - 3
1574-
1575-
/* NDPI_PROTOCOL_FTP_CONTROL */
1576-
u_int8_t ftp_control_stage:2;
1577-
15781579
/* NDPI_PROTOCOL_STARCRAFT */
15791580
u_int8_t starcraft_udp_stage : 3; // 0-7
15801581

1581-
/* NDPI_PROTOCOL_Z3950 */
1582-
u_int8_t z3950_stage : 2; // 0-3
1583-
15841582
/* NDPI_PROTOCOL_OOKLA */
15851583
u_int8_t ookla_stage : 1;
15861584

‎src/lib/ndpi_main.c

+13-16
Original file line numberDiff line numberDiff line change
@@ -7281,7 +7281,7 @@ static void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_s
72817281
if(ndpi_str->cfg.tcp_ack_paylod_heuristic && tcp_ack_padding(packet)) {
72827282
NDPI_LOG_DBG2(ndpi_str, "TCP ACK with zero padding. Ignoring\n");
72837283
packet->tcp_retransmission = 1;
7284-
} else if(flow->next_tcp_seq_nr[0] == 0 || flow->next_tcp_seq_nr[1] == 0 ||
7284+
} else if(flow->l4.tcp.next_tcp_seq_nr[0] == 0 || flow->l4.tcp.next_tcp_seq_nr[1] == 0 ||
72857285
(tcph->syn && flow->packet_counter == 0)) {
72867286
/* initialize tcp sequence counters */
72877287
/* the ack flag needs to be set to get valid sequence numbers from the other
@@ -7294,41 +7294,41 @@ static void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_s
72947294
* If we receive multiple syn-ack (before any real data), keep the last one
72957295
*/
72967296
if(tcph->ack != 0) {
7297-
flow->next_tcp_seq_nr[packet->packet_direction] =
7297+
flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] =
72987298
ntohl(tcph->seq) + (tcph->syn ? 1 : packet->payload_packet_len);
72997299

73007300
/*
73017301
Check to avoid discrepancies in case we analyze a flow that does not start with SYN...
73027302
but that is already started when nDPI being to process it. See also (***) below
73037303
*/
73047304
if(flow->num_processed_pkts > 1)
7305-
flow->next_tcp_seq_nr[1 - packet->packet_direction] = ntohl(tcph->ack_seq);
7305+
flow->l4.tcp.next_tcp_seq_nr[1 - packet->packet_direction] = ntohl(tcph->ack_seq);
73067306
}
73077307
} else if(packet->payload_packet_len > 0) {
73087308
/* check tcp sequence counters */
7309-
if(((u_int32_t)(ntohl(tcph->seq) - flow->next_tcp_seq_nr[packet->packet_direction])) >
7309+
if(((u_int32_t)(ntohl(tcph->seq) - flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction])) >
73107310
ndpi_str->tcp_max_retransmission_window_size) {
7311-
if(flow->last_tcp_pkt_payload_len > 0)
7311+
if(flow->l4.tcp.last_tcp_pkt_payload_len > 0)
73127312
packet->tcp_retransmission = 1;
73137313

73147314
/* CHECK IF PARTIAL RETRY IS HAPPENING */
7315-
if((flow->next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq) <
7315+
if((flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq) <
73167316
packet->payload_packet_len)) {
73177317
if(flow->num_processed_pkts > 1) /* See also (***) above */
7318-
flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
7318+
flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
73197319
}
73207320
}
73217321
else {
7322-
flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
7322+
flow->l4.tcp.next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
73237323
}
73247324
}
73257325

73267326
if(tcph->rst) {
7327-
flow->next_tcp_seq_nr[0] = 0;
7328-
flow->next_tcp_seq_nr[1] = 0;
7327+
flow->l4.tcp.next_tcp_seq_nr[0] = 0;
7328+
flow->l4.tcp.next_tcp_seq_nr[1] = 0;
73297329
}
73307330

7331-
flow->last_tcp_pkt_payload_len = packet->payload_packet_len;
7331+
flow->l4.tcp.last_tcp_pkt_payload_len = packet->payload_packet_len;
73327332
} else if(udph != NULL) {
73337333
if(ndpi_str->cfg.direction_detect_enabled &&
73347334
(udph->source != udph->dest))
@@ -7419,9 +7419,6 @@ static void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_s
74197419
flow->packet_direction_complete_counter[packet->packet_direction]++;
74207420
}
74217421

7422-
if(packet->payload_packet_len > 0)
7423-
flow->packet_direction_with_payload_observed[packet->packet_direction] = 1;
7424-
74257422
if(!ndpi_is_multi_or_broadcast(packet)) {
74267423
/* ! (multicast or broadcast) */
74277424

@@ -8002,8 +7999,8 @@ static void ndpi_check_probing_attempt(struct ndpi_detection_module_struct *ndpi
80027999
if((flow->l4_proto == IPPROTO_TCP)
80038000
&& (flow->l4.tcp.cli2srv_tcp_flags & TH_PUSH)
80048001
&& (flow->l4.tcp.srv2cli_tcp_flags & TH_PUSH)) {
8005-
if(flow->packet_direction_with_payload_observed[0]
8006-
&& flow->packet_direction_with_payload_observed[1]) {
8002+
if(flow->packet_direction_counter[0]
8003+
&& flow->packet_direction_counter[1]) {
80078004
/* Both directions observed */
80088005
/* Nothing to do */
80098006
} else {

0 commit comments

Comments
 (0)