mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-05-03 01:10:17 +00:00
400cd516b5
Add the concept of "global context". Right now every instance of `struct ndpi_detection_module_struct` (we will call it "local context" in this description) is completely independent from each other. This provide optimal performances in multithreaded environment, where we pin each local context to a thread, and each thread to a specific CPU core: we don't have any data shared across the cores. Each local context has, internally, also some information correlating **different** flows; something like: ``` if flow1 (PeerA <-> Peer B) is PROTOCOL_X; then flow2 (PeerC <-> PeerD) will be PROTOCOL_Y ``` To get optimal classification results, both flow1 and flow2 must be processed by the same local context. This is not an issue at all in the far most common scenario where there is only one local context, but it might be impractical in some more complex scenarios. Create the concept of "global context": multiple local contexts can use the same global context and share some data (structures) using it. This way the data correlating multiple flows can be read/write from different local contexts. This is an optional feature, disabled by default. Obviously data structures shared in a global context must be thread safe. This PR updates the code of the LRU implementation to be, optionally, thread safe. Right now, only the LRU caches can be shared; the other main structures (trees and automas) are basically read-only: there is little sense in sharing them. Furthermore, these structures don't have any information correlating multiple flows. Every LRU cache can be shared, independently from the others, via `ndpi_set_config(ndpi_struct, NULL, "lru.$CACHE_NAME.scope", "1")`. It's up to the user to find the right trade-off between performances (i.e. without shared data) and classification results (i.e. with some shared data among the local contexts), depending on the specific traffic patterns and on the algorithms used to balance the flows across the threads/cores/local contexts. Add some basic examples of library initialization in `doc/library_initialization.md`. This code needs libpthread as external dependency. It shouldn't be a big issue; however a configure flag has been added to disable global context support. A new CI job has been added to test it. TODO: we should need to find a proper way to add some tests on multithreaded enviroment... not an easy task... *** API changes *** If you are not interested in this feature, simply add a NULL parameter to any `ndpi_init_detection_module()` calls.
112 lines
3 KiB
C++
112 lines
3 KiB
C++
#include "ndpi_api.h"
|
|
#include "fuzz_common_code.h"
|
|
#include "reader_util.h"
|
|
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include "fuzzer/FuzzedDataProvider.h"
|
|
|
|
extern u_int8_t enable_doh_dot_detection;
|
|
|
|
u_int8_t enable_payload_analyzer = 0;
|
|
u_int8_t enable_flow_stats = 0;
|
|
u_int8_t human_readeable_string_len = 5;
|
|
u_int8_t max_num_udp_dissected_pkts = 16 /* 8 is enough for most protocols, Signal requires more */, max_num_tcp_dissected_pkts = 80 /* due to telnet */;
|
|
int malloc_size_stats = 0;
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
FuzzedDataProvider fuzzed_data(data, size);
|
|
ndpi_workflow *w;
|
|
struct ndpi_global_context *g_ctx;
|
|
struct ndpi_workflow_prefs prefs;
|
|
pcap_t *pcap_handle;
|
|
ndpi_serialization_format serialization_format;
|
|
NDPI_PROTOCOL_BITMASK enabled_bitmask;
|
|
ndpi_risk flow_risk;
|
|
const u_char *pkt;
|
|
struct pcap_pkthdr *header;
|
|
int r, rc;
|
|
char errbuf[PCAP_ERRBUF_SIZE];
|
|
FILE *fd;
|
|
u_int8_t debug_protos_index;
|
|
char *_debug_protocols;
|
|
const char *strs[] = { "all",
|
|
"dns,quic",
|
|
"+dns:-quic",
|
|
"all;-http",
|
|
"foo",
|
|
"openvpn",
|
|
"+bar;-foo",
|
|
NULL,
|
|
"http;bar" };
|
|
|
|
|
|
/* Data structure: 8 bytes header for random values + pcap file */
|
|
if(size < 8)
|
|
return 0;
|
|
|
|
/* To allow memory allocation failures */
|
|
fuzz_set_alloc_callbacks_and_seed(size);
|
|
|
|
prefs.decode_tunnels = fuzzed_data.ConsumeBool();
|
|
prefs.quiet_mode = fuzzed_data.ConsumeBool();
|
|
prefs.ignore_vlanid = fuzzed_data.ConsumeBool();
|
|
prefs.num_roots = fuzzed_data.ConsumeIntegral<u_int8_t>();
|
|
if(prefs.num_roots == 0)
|
|
prefs.num_roots = 1;
|
|
prefs.max_ndpi_flows = fuzzed_data.ConsumeIntegral<u_int8_t>();
|
|
|
|
serialization_format = static_cast<ndpi_serialization_format>(fuzzed_data.ConsumeIntegralInRange(1, 4));
|
|
|
|
debug_protos_index = fuzzed_data.ConsumeIntegralInRange(0, static_cast<int>(sizeof(strs) / sizeof(char *) - 1));
|
|
_debug_protocols = ndpi_strdup(strs[debug_protos_index]);
|
|
|
|
/* byte8 is still unused */
|
|
|
|
enable_doh_dot_detection = 1;
|
|
|
|
fd = buffer_to_file(data + 8, size - 8);
|
|
if(fd == NULL) {
|
|
ndpi_free(_debug_protocols);
|
|
return 0;
|
|
}
|
|
|
|
pcap_handle = pcap_fopen_offline(fd, errbuf);
|
|
if(pcap_handle == NULL) {
|
|
fclose(fd);
|
|
ndpi_free(_debug_protocols);
|
|
return 0;
|
|
}
|
|
if(ndpi_is_datalink_supported(pcap_datalink(pcap_handle)) == 0) {
|
|
pcap_close(pcap_handle);
|
|
ndpi_free(_debug_protocols);
|
|
return 0;
|
|
}
|
|
|
|
g_ctx = ndpi_global_init();
|
|
|
|
w = ndpi_workflow_init(&prefs, pcap_handle, 1, serialization_format, g_ctx);
|
|
if(w) {
|
|
NDPI_BITMASK_SET_ALL(enabled_bitmask);
|
|
rc = ndpi_set_protocol_detection_bitmask2(w->ndpi_struct, &enabled_bitmask);
|
|
if(rc == 0) {
|
|
ndpi_finalize_initialization(w->ndpi_struct);
|
|
|
|
header = NULL;
|
|
r = pcap_next_ex(pcap_handle, &header, &pkt);
|
|
while (r > 0) {
|
|
ndpi_workflow_process_packet(w, header, pkt, &flow_risk);
|
|
r = pcap_next_ex(pcap_handle, &header, &pkt);
|
|
}
|
|
}
|
|
|
|
ndpi_workflow_free(w);
|
|
}
|
|
pcap_close(pcap_handle);
|
|
|
|
ndpi_global_deinit(g_ctx);
|
|
|
|
ndpi_free(_debug_protocols);
|
|
|
|
return 0;
|
|
}
|