opendpi学习

最新推荐文章于 2024-09-13 22:38:48 发布

原创最新推荐文章于 2024-09-13 22:38:48 发布 · 2.4k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#opendpi 特征识别

行为管理专栏收录该内容

2 篇文章

订阅专栏

本文深入探讨了网络设备优化与流量管理技术，包括PACE协议在增强产品功能和加速应用部署方面的作用，以及如何通过先进的模糊和加密技术提高网络设备的管理与可见性。介绍了从命令行参数解析到数据包捕获与处理的完整流程，重点讲解了如何利用ipque_init_detection_module函数进行初始化和配置，以实现高效的数据包检测与分析。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

opendpi-master\src\include\ipq_protocols_osdpi.h 协议特征对应的id和名字，包括长串和短串

缩写PACE: Protocol & Application Classfication Engine

enven if they use advanced obfuscation(模糊) and encryption techniques.

It helps network equipment vendors enhance their products with powerfull and proven Layer 7 protocol network

management and visibility capabilities.In addition it accelerates time-to-market for a variety of different application scenarios.

int main(int argc, char **argv)

{

parseOptions(argc, argv);-->

setupDetection();-->ipoque_init_detection_module (分配ipoque_detection_module_struct结构空间，

初始化该结构，设置各软件的超时，如pplive_connection_timeout)

openPcapFile();-->pcap_open_live(pcap.c)-->pcap_create(pcap-linux.c,注册操作函数pcap_activate_linux)-->

//注意在activate_mmap函数中重新注册了 handle->read_op = pcap_read_linux_mmap;

runPcapLoop();

closePcapFile();

printResults();

terminateDetection();

return 0;

}

pcap_activate_linux(pcap_t *handle) 初始化pcap_t结构体中的主要回调函数

handle->read_op = pcap_read_linux;

NETBIOS

MDNS

pcap_read_linux_mmap

struct pcap {

    int snapshot;

    int linktype;        /* Network linktype */

    int linktype_ext;       /* Extended information stored in the linktype field of a file */

    int tzoff;        /* timezone offset */

    int offset;        /* offset for proper alignment */

    int activated;        /* true if the capture is really started */

    int oldstyle;        /* if we're opening with pcap_open_live() */

    int break_loop;        /* flag set to force break from packet-reading loop */

    struct pcap_sf sf;

    struct pcap_md md;

    struct pcap_opt opt;

    int bufsize;

    u_char *buffer;

    u_char *bp;

    int cc;

    u_char *pkt;

    pcap_direction_t direction;

    activate_op_t activate_op;

    can_set_rfmon_op_t can_set_rfmon_op;

    read_op_t read_op;

    inject_op_t inject_op;

    setfilter_op_t setfilter_op;

    setdirection_op_t setdirection_op;

    set_datalink_op_t set_datalink_op;

    getnonblock_op_t getnonblock_op;

    setnonblock_op_t setnonblock_op;

    stats_op_t stats_op;

    pcap_handler oneshot_callback;

    cleanup_op_t cleanup_op;

    struct bpf_program fcode;

    char errbuf[PCAP_ERRBUF_SIZE + 1];

    int dlt_count;

    u_int *dlt_list;

    int tstamp_type_count;

    u_int *tstamp_type_list;

    struct pcap_pkthdr pcap_header;    /* This is needed for the pcap_next_ex() to work */

};

全局变量：

osdpi_ids:所有id对应的变量，每个id用来连接一个ip与一个表示该ip的ID

osdpi_flows:所有flow对应的变量，每个flows用来连接一个flow与一个表示该id的key

protocol_counter,protocol_counter_bytes:与协议相关的计数器

struct ipoque_packet_struct

typedef struct ipoque_packet_struct {

    const struct iphdr *iph;

#ifdef IPOQUE_DETECTION_SUPPORT_IPV6

    const struct ipq_ipv6hdr *iphv6;

#endif

    const struct tcphdr *tcp;

    const struct udphdr *udp;

    const u8 *generic_l4_ptr;    /* is set only for non tcp-udp traffic */

    const u8 *payload;

    IPOQUE_TIMESTAMP_COUNTER_SIZE tick_timestamp;

    u16 detected_protocol_stack[IPOQUE_PROTOCOL_HISTORY_SIZE];

    u8 detected_subprotocol_stack[IPOQUE_PROTOCOL_HISTORY_SIZE];

    /* this is for simple read-only access to the real protocol 

     * used for the main loop */

    u16 real_protocol_read_only;

#if IPOQUE_PROTOCOL_HISTORY_SIZE > 1

#  if IPOQUE_PROTOCOL_HISTORY_SIZE > 5

#    error protocol stack size not supported

#  endif

    struct {

        u8 entry_is_real_protocol:5;

        u8 current_stack_size_minus_one:3;

    } __attribute__ ((packed)) protocol_stack_info;

#endif

    struct ipoque_int_one_line_struct line[IPOQUE_MAX_PARSE_LINES_PER_PACKET];

    struct ipoque_int_one_line_struct

     unix_line[IPOQUE_MAX_PARSE_LINES_PER_PACKET];

    struct ipoque_int_one_line_struct host_line;

    struct ipoque_int_one_line_struct referer_line;

    struct ipoque_int_one_line_struct content_line;

    struct ipoque_int_one_line_struct accept_line;

    struct ipoque_int_one_line_struct user_agent_line;

    struct ipoque_int_one_line_struct http_url_name;

    struct ipoque_int_one_line_struct http_encoding;

    struct ipoque_int_one_line_struct http_transfer_encoding;

    struct ipoque_int_one_line_struct http_contentlen;

    struct ipoque_int_one_line_struct http_cookie;

    struct ipoque_int_one_line_struct http_x_session_type;

    struct ipoque_int_one_line_struct server_line;

    struct ipoque_int_one_line_struct http_method;

    struct ipoque_int_one_line_struct http_response;

    u16 l3_packet_len;

    u16 l4_packet_len;

    u16 payload_packet_len;

    u16 actual_payload_len;

    u16 num_retried_bytes;

    u16 parsed_lines;

    u16 parsed_unix_lines;

    u16 empty_line_position;

    u8 tcp_retransmission;

    u8 l4_protocol;

    u8 packet_lines_parsed_complete;

    u8 packet_unix_lines_parsed_complete;

    u8 empty_line_position_set;

    u8 packet_direction:1;

} ipoque_packet_struct_t;

struct ipoque_detection_module_struct

typedef struct ipoque_detection_module_struct {

    IPOQUE_PROTOCOL_BITMASK detection_bitmask;

    IPOQUE_PROTOCOL_BITMASK generic_http_packet_bitmask;

    IPOQUE_TIMESTAMP_COUNTER_SIZE current_ts;

    u32 ticks_per_second;

#ifdef IPOQUE_ENABLE_DEBUG_MESSAGES

    void *user_data;

#endif

    /* internal structures to save functions calls */

    struct ipoque_packet_struct packet;

    struct ipoque_flow_struct *flow;

    struct ipoque_id_struct *src;

    struct ipoque_id_struct *dst;

    /* callback function buffer */

    struct ipq_call_function_struct

     callback_buffer[IPOQUE_MAX_SUPPORTED_PROTOCOLS + 1];

    u32 callback_buffer_size;

    struct ipq_call_function_struct

     callback_buffer_tcp_no_payload[IPOQUE_MAX_SUPPORTED_PROTOCOLS + 1];

    u32 callback_buffer_size_tcp_no_payload;

    struct ipq_call_function_struct

     callback_buffer_tcp_payload[IPOQUE_MAX_SUPPORTED_PROTOCOLS + 1];

    u32 callback_buffer_size_tcp_payload;

    struct ipq_call_function_struct

     callback_buffer_udp[IPOQUE_MAX_SUPPORTED_PROTOCOLS + 1];

    u32 callback_buffer_size_udp;

    struct ipq_call_function_struct

     callback_buffer_non_tcp_udp[IPOQUE_MAX_SUPPORTED_PROTOCOLS + 1];

    u32 callback_buffer_size_non_tcp_udp;

#ifdef IPOQUE_ENABLE_DEBUG_MESSAGES

    /* debug callback, only set when debug is used */

    ipoque_debug_function_ptr ipoque_debug_printf;

    const char *ipoque_debug_print_file;

    const char *ipoque_debug_print_function;

    u32 ipoque_debug_print_line;

#endif

    /* misc parameters */

    u32 tcp_max_retransmission_window_size;

    u32 edonkey_upper_ports_only:1; //占一位

    u32 edonkey_safe_mode:1;

    //若4个字节未用完则对齐

    u32 directconnect_connection_ip_tick_timeout;

/*gadu gadu*/

    u32 gadugadu_peer_connection_timeout;

    /* pplive params */

    u32 pplive_connection_timeout;

    /* ftp parameters */

    u32 ftp_connection_timeout;

    /* irc parameters */

    u32 irc_timeout;

    /* gnutella parameters */

    u32 gnutella_timeout;

    /* battlefield parameters */

    u32 battlefield_timeout;

    /* thunder parameters */

    u32 thunder_timeout;

    /* SoulSeek parameters */

    u32 soulseek_connection_ip_tick_timeout;

    /* rtsp parameters */

    u32 rtsp_connection_timeout;

    /* tvants parameters */

    u32 tvants_connection_timeout;

    u32 orb_rstp_ts_timeout;

    /* yahoo */

//      u32 yahoo_http_filetransfer_timeout;

    u8 yahoo_detect_http_connections;

    u32 yahoo_lan_video_timeout;

    u32 zattoo_connection_timeout;

    u32 jabber_stun_timeout;

    u32 jabber_file_transfer_timeout;

    u32 manolito_subscriber_timeout;

#ifdef IPOQUE_ENABLE_DEBUG_MESSAGES

#define IPOQUE_IP_STRING_SIZE 40

    char ip_string[IPOQUE_IP_STRING_SIZE];

#endif

    u8 ip_version_limit;

} ipoque_detection_module_struct_t;

pcap-linux.c

activate_mmap()-->create_ring()-->初始化handle->buffer

handle->opt.buffer_size = 2.1024*1024(2M)环大小

static const struct proto_ops packet_ops_spkt = {

    .family =    PF_PACKET,

    .owner =    THIS_MODULE,

    .release =    packet_release,

    //挂载af_packet协议

    .bind =        packet_bind_spkt,

    .connect =    sock_no_connect,

    .socketpair =    sock_no_socketpair,

    .accept =    sock_no_accept,

    .getname =    packet_getname_spkt,

    .poll =        datagram_poll,

    .ioctl =    packet_ioctl,

    .listen =    sock_no_listen,

    .shutdown =    sock_no_shutdown,

    .setsockopt =    sock_no_setsockopt,

    .getsockopt =    sock_no_getsockopt,

    .sendmsg =    packet_sendmsg_spkt,

    .recvmsg =    packet_recvmsg,

    .mmap =        sock_no_mmap,

    .sendpage =    sock_no_sendpage,

};