如何在nDPI中添加自定义分析协议

添加协议编号

在文件src/include/ndpi_protocol_ids.h中添加自定义的协议NDPI_PROTOCOL_XXXX并延续使用新协议编号

  NDPI_PROTOCOL_NANO                  = 420,
  NDPI_PROTOCOL_OPENWIRE              = 421,

  // Add new protocols here
  NDPI_PROTOCOL_UOSDETECT             = 422,

创建协议文件

创建协议文件（文件名建议与协议对应）src/lib/protocols/uosdetect.c

添加头文件及相关定义

#include "ndpi_protocol_ids.h"

#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_UOSDETECT

#include "ndpi_api.h"
#include "ndpi_private.h"

为协议编写 ndpi_search_uosdetect 查找函数

static void ndpi_search_uosdetect(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
  struct ndpi_packet_struct *packet = &ndpi_struct->packet;

  NDPI_LOG_DBG(ndpi_struct, "search UOS Detect\n");

  if (packet->payload_packet_len > 123)
  {
    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UOSDETECT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
    NDPI_LOG_INFO(ndpi_struct,"UOSDETECT found\n");
    return;
  }
  
  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}

协议识别完成使用函数ndpi_set_detected_protocol标识当前流为自定义协议，否则使用NDPI_EXCLUDE_PROTO 表示未识别

为协议编写init_uosdetect_dissector解析器初始化函数。由于我们分析的内容在HTTP Payload中，所以使用掩码NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION

void init_uosdetect_dissector(struct ndpi_detection_module_struct *ndpi_struct,
                                         u_int32_t *id)
{
  ndpi_set_bitmask_protocol_detection("UOSDetect", ndpi_struct, *id,
                                      NDPI_PROTOCOL_UOSDETECT,
                                      ndpi_search_uosdetect,
                                      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
                                      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
                                      ADD_TO_DETECTION_BITMASK);

  *id += 1;
}

协议解析器注册

在文件src/include/ndpi_private.h中添加协议解析器定义

void init_nano_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_openwire_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);

// add custom protocol dissector
void init_uosdetect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);

在文件src/lib/ndpi_main.c中添加协议默认设置

  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, 
        NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UOSDETECT,
        "UOSDetect", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS,
        ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
        ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */

配置默认的TCP端口为80会导致协议解析与计数出现故障

由于是基于HTTP协议进行判断，所以要注册为HTTP协议的子协议，否则只能识别为HTTP协议

  ndpi_set_proto_subprotocols(ndpi_str, NDPI_PROTOCOL_HTTP,
                  NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP,
                  NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_GNUTELLA,
                  NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_WORLDOFWARCRAFT, 
                  NDPI_PROTOCOL_IRC,
                  NDPI_PROTOCOL_UOSDETECT,
                  NDPI_PROTOCOL_IPP,
                  NDPI_PROTOCOL_MPEGDASH,
                  NDPI_PROTOCOL_RTSP,
                  NDPI_PROTOCOL_APACHE_THRIFT,
                  NDPI_PROTOCOL_JSON_RPC,
                  NDPI_PROTOCOL_HL7,
                  NDPI_PROTOCOL_MATCHED_BY_CONTENT,
                  NDPI_PROTOCOL_NO_MORE_SUBPROTOCOLS); /* NDPI_PROTOCOL_HTTP can have (content-matched) subprotocols */

并初始化协议解析器

    // custom protocols dissectors
  init_uosdetect_dissector(ndpi_str, &a);