opendpi学习

最新推荐文章于 2024-08-15 09:56:14 发布

i-derry

最新推荐文章于 2024-08-15 09:56:14 发布

阅读量2.3k

点赞数

分类专栏：行为管理文章标签： opendpi 特征识别

本文链接：https://blog.csdn.net/dxt1107/article/details/18373987

版权

行为管理专栏收录该内容

2 篇文章 0 订阅

订阅专栏

opendpi-master\src\include\ipq_protocols_osdpi.h 协议特征对应的id和名字，包括长串和短串

缩写PACE: Protocol & Application Classfication Engine

enven if they use advanced obfuscation(模糊) and encryption techniques.

It helps network equipment vendors enhance their products with powerfull and proven Layer 7 protocol network

management and visibility capabilities.In addition it accelerates time-to-market for a variety of different application scenarios.

int main(int argc, char **argv)

{

parseOptions(argc, argv);-->

setupDetection();-->ipoque_init_detection_module (分配ipoque_detection_module_struct结构空间，

初始化该结构，设置各软件的超时，如pplive_connection_timeout)

openPcapFile();-->pcap_open_live(pcap.c)-->pcap_create(pcap-linux.c,注册操作函数pcap_activate_linux)-->

//注意在activate_mmap函数中重新注册了 handle->read_op = pcap_read_linux_mmap;

runPcapLoop();

closePcapFile();

printResults();

terminateDetection();

return 0;

}

pcap_activate_linux(pcap_t *handle) 初始化pcap_t结构体中的主要回调函数

handle->read_op = pcap_read_linux;

NETBIOS

MDNS

pcap_read_linux_mmap

 
   struct pcap { 
   
   int snapshot; 
   
   int linktype;         
   /* Network linktype */ 
   
   int linktype_ext;        
   /* Extended information stored in the linktype field of a file */ 
   
   int tzoff;         
   /* timezone offset */ 
   
   int offset;         
   /* offset for proper alignment */ 
   
   int activated;         
   /* true if the capture is really started */ 
   
   int oldstyle;         
   /* if we're opening with pcap_open_live() */ 
   
   int break_loop;         
   /* flag set to force break from packet-reading loop */ 
   
   struct pcap_sf sf; 
   
   struct pcap_md md; 
   
   struct pcap_opt opt; 
   
   int bufsize; 
   
     u_char  
   *buffer; 
   
     u_char  
   *bp; 
   
   int cc; 
   
     u_char  
   *pkt; 
   
     pcap_direction_t direction; 
   
     activate_op_t  
   activate_op; 
   
     can_set_rfmon_op_t  
   can_set_rfmon_op; 
   
     read_op_t  
   read_op; 
   
     inject_op_t  
   inject_op; 
   
     setfilter_op_t  
   setfilter_op; 
   
     setdirection_op_t  
   setdirection_op; 
   
     set_datalink_op_t  
   set_datalink_op; 
   
     getnonblock_op_t  
   getnonblock_op; 
   
     setnonblock_op_t  
   setnonblock_op; 
   
     stats_op_t  
   stats_op; 
   
   pcap_handler  
   oneshot_callback; 
   
   cleanup_op_t  
   cleanup_op; 
   
   struct bpf_program fcode; 
   
   char errbuf[PCAP_ERRBUF_SIZE  
   +  
   1]; 
   
   int dlt_count; 
   
     u_int  
   *dlt_list; 
   
   int tstamp_type_count; 
   
     u_int  
   *tstamp_type_list; 
   
   struct pcap_pkthdr pcap_header;     
   /* This is needed for the pcap_next_ex() to work */ 
   
 };

全局变量：

osdpi_ids:所有id对应的变量，每个id用来连接一个ip与一个表示该ip的ID

osdpi_flows:所有flow对应的变量，每个flows用来连接一个flow与一个表示该id的key

protocol_counter,protocol_counter_bytes:与协议相关的计数器

struct ipoque_packet_struct

 
    typedef  
    struct ipoque_packet_struct { 
    
    const  
    struct iphdr  
    * 
    iph; 
    
 # 
    ifdef IPOQUE_DETECTION_SUPPORT_IPV6 
    
    const  
    struct ipq_ipv6hdr  
    *iphv6; 
    
 # 
    endif 
    
    const  
    struct tcphdr  
    * 
    tcp; 
    
    const  
    struct udphdr  
    * 
    udp; 
    
    const u8  
    *generic_l4_ptr;     
    /* is set only for non tcp-udp traffic */ 
    
    const u8  
    * 
    payload; 
    
     IPOQUE_TIMESTAMP_COUNTER_SIZE tick_timestamp; 
    
     u16 detected_protocol_stack[IPOQUE_PROTOCOL_HISTORY_SIZE]; 
    
     u8 detected_subprotocol_stack[IPOQUE_PROTOCOL_HISTORY_SIZE]; 
    
    /* this is for simple read-only access to the real protocol 
      * used for the main loop */ 
    
     u16 real_protocol_read_only; 
    
 # 
    if IPOQUE_PROTOCOL_HISTORY_SIZE  
    >  
    1 
    
 #   
    if IPOQUE_PROTOCOL_HISTORY_SIZE  
    >  
    5 
    
 #    error protocol stack size not supported 
    
 #   
    endif 
    
    struct { 
    
         u8 entry_is_real_protocol 
    : 
    5; 
    
         u8 current_stack_size_minus_one 
    : 
    3; 
    
     } __attribute__ ((packed)) protocol_stack_info; 
    
 # 
    endif 
    
    struct ipoque_int_one_line_struct line[IPOQUE_MAX_PARSE_LINES_PER_PACKET]; 
    
    struct ipoque_int_one_line_struct 
    
      unix_line[IPOQUE_MAX_PARSE_LINES_PER_PACKET]; 
    
    struct ipoque_int_one_line_struct  
    host_line; 
    
    struct ipoque_int_one_line_struct  
    referer_line; 
    
    struct ipoque_int_one_line_struct content_line; 
    
    struct ipoque_int_one_line_struct accept_line; 
    
    struct ipoque_int_one_line_struct user_agent_line; 
    
    struct ipoque_int_one_line_struct  
    http_url_name; 
    
    struct ipoque_int_one_line_struct  
    http_encoding; 
    
    struct ipoque_int_one_line_struct http_transfer_encoding; 
    
    struct ipoque_int_one_line_struct http_contentlen; 
    
    struct ipoque_int_one_line_struct http_cookie; 
    
    struct ipoque_int_one_line_struct http_x_session_type; 
    
    struct ipoque_int_one_line_struct server_line; 
    
    struct ipoque_int_one_line_struct http_method; 
    
    struct ipoque_int_one_line_struct http_response; 
    
     u16  
    l3_packet_len; 
    
     u16  
    l4_packet_len; 
    
     u16  
    payload_packet_len; 
    
     u16 actual_payload_len; 
    
     u16 num_retried_bytes; 
    
     u16 parsed_lines; 
    
     u16 parsed_unix_lines; 
    
     u16 empty_line_position; 
    
     u8 tcp_retransmission; 
    
     u8 l4_protocol; 
    
     u8 packet_lines_parsed_complete; 
    
     u8 packet_unix_lines_parsed_complete; 
    
     u8 empty_line_position_set; 
    
     u8 packet_direction 
    : 
    1; 
    
 } ipoque_packet_struct_t;

struct ipoque_detection_module_struct

 
    typedef  
    struct ipoque_detection_module_struct { 
    
     IPOQUE_PROTOCOL_BITMASK  
    detection_bitmask; 
    
     IPOQUE_PROTOCOL_BITMASK generic_http_packet_bitmask; 
    
     IPOQUE_TIMESTAMP_COUNTER_SIZE current_ts; 
    
     u32 ticks_per_second; 
    
 # 
    ifdef IPOQUE_ENABLE_DEBUG_MESSAGES 
    
    void  
    *user_data; 
    
 # 
    endif 
    
    /* internal structures to save functions calls */ 
    
    struct  
    ipoque_packet_struct  
    packet; 
    
    struct ipoque_flow_struct  
    * 
    flow; 
    
    struct ipoque_id_struct  
    * 
    src; 
    
    struct ipoque_id_struct  
    * 
    dst; 
    
    /* callback function buffer */ 
    
    struct ipq_call_function_struct 
    
      callback_buffer[IPOQUE_MAX_SUPPORTED_PROTOCOLS  
    +  
    1]; 
    
     u32 callback_buffer_size; 
    
    struct ipq_call_function_struct 
    
    callback_buffer_tcp_no_payload[IPOQUE_MAX_SUPPORTED_PROTOCOLS  
    +  
    1]; 
    
     u32  
    callback_buffer_size_tcp_no_payload;
  
    struct ipq_call_function_struct 
    
    callback_buffer_tcp_payload[IPOQUE_MAX_SUPPORTED_PROTOCOLS  
    +  
    1]; 
    
     u32 callback_buffer_size_tcp_payload; 
    
    struct ipq_call_function_struct 
    
    callback_buffer_udp[IPOQUE_MAX_SUPPORTED_PROTOCOLS  
    +  
    1]; 
    
     u32 callback_buffer_size_udp; 
    
    struct ipq_call_function_struct 
    
    callback_buffer_non_tcp_udp[IPOQUE_MAX_SUPPORTED_PROTOCOLS  
    +  
    1]; 
    
     u32 callback_buffer_size_non_tcp_udp; 
    
 # 
    ifdef IPOQUE_ENABLE_DEBUG_MESSAGES 
    
    /* debug callback, only set when debug is used */ 
    
     ipoque_debug_function_ptr ipoque_debug_printf; 
    
    const  
    char  
    *ipoque_debug_print_file; 
    
    const  
    char  
    *ipoque_debug_print_function; 
    
     u32 ipoque_debug_print_line; 
    
 # 
    endif 
    
    /* misc parameters */ 
    
     u32 tcp_max_retransmission_window_size; 
    
     u32 edonkey_upper_ports_only 
    : 
    1;  
    //占一位 
    
     u32 edonkey_safe_mode 
    : 
    1; 
    
    //若4个字节未用完则对齐 
    
     u32 directconnect_connection_ip_tick_timeout; 
    
    /*gadu gadu*/ 
    
     u32 gadugadu_peer_connection_timeout; 
    
    /* pplive params */ 
    
     u32 pplive_connection_timeout; 
    
    /* ftp parameters */ 
    
     u32 ftp_connection_timeout; 
    
    /* irc parameters */ 
    
     u32 irc_timeout; 
    
    /* gnutella parameters */ 
    
     u32 gnutella_timeout; 
    
    /* battlefield parameters */ 
    
     u32 battlefield_timeout; 
    
    /* thunder parameters */ 
    
     u32 thunder_timeout; 
    
    /* SoulSeek parameters */ 
    
     u32 soulseek_connection_ip_tick_timeout; 
    
    /* rtsp parameters */ 
    
     u32 rtsp_connection_timeout; 
    
    /* tvants parameters */ 
    
     u32 tvants_connection_timeout; 
    
     u32 orb_rstp_ts_timeout; 
    
    /* yahoo */ 
    
    //      u32 yahoo_http_filetransfer_timeout; 
    
     u8 yahoo_detect_http_connections; 
    
     u32 yahoo_lan_video_timeout; 
    
     u32 zattoo_connection_timeout; 
    
     u32 jabber_stun_timeout; 
    
     u32 jabber_file_transfer_timeout; 
    
     u32 manolito_subscriber_timeout; 
    
 # 
    ifdef IPOQUE_ENABLE_DEBUG_MESSAGES 
    
 # 
    define IPOQUE_IP_STRING_SIZE  
    40 
    
    char ip_string[IPOQUE_IP_STRING_SIZE]; 
    
 # 
    endif 
    
     u8 ip_version_limit; 
    
 } ipoque_detection_module_struct_t;

pcap-linux.c

activate_mmap()-->create_ring()-->初始化handle->buffer

handle->opt.buffer_size = 2.1024*1024(2M)环大小

 
   
 
   static  
   const  
   struct proto_ops packet_ops_spkt  
   = { 
   
     .family  
   =    PF_PACKET, 
   
     .owner  
   =    THIS_MODULE, 
   
     .release  
   =    packet_release, 
   
      
   //挂载af_packet协议 
   
     .bind  
   =         
   packet_bind_spkt, 
   
     .connect  
   =    sock_no_connect, 
   
     .socketpair  
   =    sock_no_socketpair, 
   
     .accept  
   =    sock_no_accept, 
   
     .getname  
   =    packet_getname_spkt, 
   
     .poll  
   =        datagram_poll, 
   
     .ioctl  
   =    packet_ioctl, 
   
     .listen  
   =    sock_no_listen, 
   
     .shutdown  
   =    sock_no_shutdown, 
   
     .setsockopt  
   =    sock_no_setsockopt, 
   
     .getsockopt  
   =    sock_no_getsockopt, 
   
     .sendmsg  
   =    packet_sendmsg_spkt, 
   
     .recvmsg  
   =    packet_recvmsg, 
   
     .mmap  
   =        sock_no_mmap, 
   
     .sendpage  
   =    sock_no_sendpage, 
   
 }; 
  