[draft] plugins: ndpi stub plugin - v1

configure.ac

@@ -2310,6 +2310,42 @@ fi
     ])
     AC_SUBST(RUST_FEATURES)
 
+# nDPI support (no library checks for this stub)
+    NDPI_HOME=
+    AC_ARG_ENABLE(ndpi,
+           AS_HELP_STRING([--enable-ndpi], [Enable nDPI support]),
+           [enable_ndpi=$enableval],[enable_ndpi=no])
+    AC_ARG_WITH([ndpi],
+           [  --with-ndpi=<path>    path to nDPI source tree.],
+           [NDPI_HOME="$withval"])
+
+    if ! test -z "${NDPI_HOME}" = "yes"; then
+        AC_MSG_CHECKING(for nDPI source)
+        if test ! -z "$NDPI_HOME" ; then :
+            AC_MSG_RESULT(found in $NDPI_HOME)
+            NDPI_LIB=$NDPI_HOME/src/lib/libndpi.a
+            AC_MSG_CHECKING(for $NDPI_LIB)
+            if test -r $NDPI_LIB ; then :
+                AC_MSG_RESULT(found $NDPI_LIB)
+            fi
+            CPPFLAGS="${CPPFLAGS} -I$NDPI_HOME/src/include"
+            NDPI_LIB="$NDPI_HOME/src/lib/libndpi.a"
+            AC_SUBST([NDPI_LIB])
+        else
+            AC_MSG_RESULT(not found)
+            enable_ndpi="no"
+        fi
+    fi
+
+    if test "x$enable_ndpi" = "xyes"; then
+        AM_CONDITIONAL([BUILD_NDPI], [true])
+        ndpi_comment=""
+    else
+        AM_CONDITIONAL([BUILD_NDPI], [false])
+        ndpi_comment="#"
+    fi
+    AC_SUBST([ndpi_comment])
+
     AC_ARG_ENABLE(warnings,
            AS_HELP_STRING([--enable-warnings], [Enable supported C compiler warnings]),[enable_warnings=$enableval],[enable_warnings=no])
     AS_IF([test "x$enable_warnings" = "xyes"], [
@@ -2531,6 +2567,7 @@ AC_CONFIG_FILES(examples/lib/simple/Makefile examples/lib/simple/Makefile.exampl
 AC_CONFIG_FILES(plugins/Makefile)
 AC_CONFIG_FILES(plugins/pfring/Makefile)
 AC_CONFIG_FILES(plugins/napatech/Makefile)
+AC_CONFIG_FILES(plugins/ndpi-dummy/Makefile)
 
 AC_OUTPUT
 
@@ -2587,6 +2624,9 @@ SURICATA_BUILD_CONF="Suricata Configuration:
   Plugin support (experimental):           ${plugin_support}
   DPDK Bond PMD:                           ${enable_dpdk_bond_pmd}
 
+Plugins:
+  nDPI                                     ${enable_ndpi}
+
 Development settings:
   Coccinelle / spatch:                     ${enable_coccinelle}
   Unit tests enabled:                      ${enable_unittests}

examples/plugins/c-json-filetype/Makefile.in

@@ -5,7 +5,7 @@
 
 # But as this is an example in the Suricata source tree we'll look for
 # includes in the source tree.
-CPPFLAGS +=	-I@top_srcdir@/src -DHAVE_CONFIG_H
+CPPFLAGS +=	-I@top_srcdir@/src -I@top_srcdir@/rust/gen -I@top_srcdir@/rust/dist -DHAVE_CONFIG_H
 
 # Currently the Suricata logging system requires this to be even for
 # plugins.

plugins/Makefile.am

@@ -7,3 +7,7 @@ endif
 if BUILD_NAPATECH
 SUBDIRS += napatech
 endif
+
+if BUILD_NDPI
+SUBDIRS += ndpi-dummy
+endif

plugins/ndpi-dummy/Makefile.am

@@ -0,0 +1,13 @@
+pkglib_LTLIBRARIES = ndpi.la
+
+ndpi_la_LDFLAGS = -module -avoid-version -shared
+ndpi_la_LIBADD = @NDPI_LIB@
+
+# Only required to find these headers when building plugins from the
+# source directory.
+ndpi_la_CFLAGS = -I../../rust/gen -I../../rust/dist
+
+ndpi_la_SOURCES = ndpi.c
+
+install-exec-hook:
+	cd $(DESTDIR)$(pkglibdir) && $(RM) $(pkglib_LTLIBRARIES)

plugins/ndpi-dummy/ndpi.c

@@ -0,0 +1,206 @@
+/* Copyright (C) 2024 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/* License note: While this "glue" code to the nDPI library is GPLv2,
+ * nDPI is itself LGPLv3 which is known to be incompatible with the
+ * GPLv2. */
+
+#include "suricata-common.h"
+#include "suricata-plugin.h"
+
+#include "detect-engine-helper.h"
+#include "detect-parse.h"
+#include "flow-callbacks.h"
+#include "flow-storage.h"
+#include "output-eve.h"
+#include "thread-callbacks.h"
+#include "thread-storage.h"
+#include "util-debug.h"
+
+#include "ndpi_api.h"
+
+static ThreadStorageId thread_storage_id = { .id = -1 };
+static FlowStorageId flow_storage_id = { .id = -1 };
+static int ndpi_risk_keyword_id = -1;
+
+struct NdpiThreadContext {
+    struct ndpi_detection_module_struct *ndpi;
+};
+
+struct NdpiFlowContext {
+    struct ndpi_flow_struct *ndpi;
+    ndpi_protocol detect_l7_protocol;
+    uint8_t detection_completed;
+};
+
+static void ThreadStorageFree(void *ptr)
+{
+    SCLogNotice("Free'ing nDPI thread storage");
+    struct NdpiThreadContext *context = ptr;
+    ndpi_exit_detection_module(context->ndpi);
+    SCFree(context);
+}
+
+static void FlowStorageFree(void *ptr)
+{
+    struct NdpiFlowContext *ctx = ptr;
+    ndpi_flow_free(ctx->ndpi);
+    SCFree(ctx);
+}
+
+static void OnFlowInit(ThreadVars *tv, Flow *f, const Packet *p, void *_data)
+{
+    struct NdpiFlowContext *flowctx = SCCalloc(1, sizeof(*flowctx));
+    if (flowctx == NULL) {
+        FatalError("Failed to allocate nDPI flow context");
+    }
+
+    flowctx->ndpi = ndpi_flow_malloc(SIZEOF_FLOW_STRUCT);
+    if (flowctx->ndpi == NULL) {
+        FatalError("Failed to allocate nDPI flow");
+    }
+
+    memset(flowctx->ndpi, 0, SIZEOF_FLOW_STRUCT);
+    flowctx->detection_completed = 0;
+    FlowSetStorageById(f, flow_storage_id, flowctx);
+}
+
+static void OnFlowUpdate(ThreadVars *tv, Flow *f, Packet *p, void *_data)
+{
+    struct NdpiThreadContext *threadctx = ThreadGetStorageById(tv, thread_storage_id);
+    struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
+
+    if (threadctx->ndpi && flowctx->ndpi) {
+        SCLogNotice("Performing nDPI detection...");
+    }
+}
+
+static void OnFlowFinish(ThreadVars *tv, Flow *f, void *_data)
+{
+    /* Nothing to do here, the storage API has taken care of cleaning
+     * up storage, just here for example purposes. */
+    SCLogNotice("Flow %p is now finished", f);
+}
+
+static void OnThreadInit(ThreadVars *tv, void *_data)
+{
+    struct NdpiThreadContext *context = SCCalloc(1, sizeof(*context));
+    if (context == NULL) {
+        FatalError("Failed to allocate nDPI thread context");
+    }
+    context->ndpi = ndpi_init_detection_module(NULL);
+    if (context->ndpi == NULL) {
+        FatalError("Failed to initialize nDPI detection module");
+    }
+    NDPI_PROTOCOL_BITMASK protos;
+    NDPI_BITMASK_SET_ALL(protos);
+    ndpi_set_protocol_detection_bitmask2(context->ndpi, &protos);
+    ndpi_finalize_initialization(context->ndpi);
+    ThreadSetStorageById(tv, thread_storage_id, context);
+}
+
+static void EveCallback(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *jb, void *data)
+{
+    SCLogNotice("EveCallback: tv=%p, p=%p, f=%p", tv, p, f);
+    jb_open_object(jb, "ndpi");
+    jb_set_bool(jb, "packet", p == NULL ? false : true);
+    jb_set_bool(jb, "flow", f == NULL ? false : true);
+
+    if (f) {
+        struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
+        if (flowctx->ndpi->risk) {
+            // ...
+        }
+    }
+
+    jb_close(jb);
+}
+
+static int DetectnDPIRiskPacketMatch(
+        DetectEngineThreadCtx *det_ctx, Packet *p, const Signature *s, const SigMatchCtx *ctx)
+{
+    SCLogNotice("...");
+    return 0;
+}
+
+static int DetectnDPIRiskSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
+{
+    SCLogNotice("...");
+    SigMatchAppendSMToList(de_ctx, s, ndpi_risk_keyword_id, NULL, DETECT_SM_LIST_MATCH);
+    return 0;
+}
+
+static void NdpInitRiskKeyword(void)
+{
+    /* SCSigTableElmt and DetectHelperKeywordRegister don't yet
+     * support all the fields required to register the nDPI keywords,
+     * so we'll just register with an empty keyword specifier to get
+     * the ID, then fill in the ID. */
+    SCSigTableElmt keyword = {};
+    ndpi_risk_keyword_id = DetectHelperKeywordRegister(&keyword);
+    SCLogNotice("Registered new keyword with ID %" PRIu32, ndpi_risk_keyword_id);
+
+    sigmatch_table[ndpi_risk_keyword_id].name = "ndpi-risk";
+    sigmatch_table[ndpi_risk_keyword_id].desc = "match on the detected nDPI risk";
+    sigmatch_table[ndpi_risk_keyword_id].url = "/rules/ndpi-risk.html";
+    sigmatch_table[ndpi_risk_keyword_id].Match = DetectnDPIRiskPacketMatch;
+    sigmatch_table[ndpi_risk_keyword_id].Setup = DetectnDPIRiskSetup;
+}
+
+static void NdpiInit(void)
+{
+    SCLogNotice("Initializing nDPI plugin");
+
+    /* Register thread storage. */
+    thread_storage_id = ThreadStorageRegister("ndpi", sizeof(void *), NULL, ThreadStorageFree);
+    if (thread_storage_id.id < 0) {
+        FatalError("Failed to register nDPI thread storage");
+    }
+
+    /* Register flow storage. */
+    flow_storage_id = FlowStorageRegister("ndpi", sizeof(void *), NULL, FlowStorageFree);
+    if (flow_storage_id.id < 0) {
+        FatalError("Failed to register nDPI flow storage");
+    }
+
+    /* Register flow lifecycle callbacks. */
+    SCFlowRegisterInitCallback(OnFlowInit, NULL);
+    SCFlowRegisterUpdateCallback(OnFlowUpdate, NULL);
+
+    /* Not needed for nDPI, but exists for completeness. */
+    SCFlowRegisterFinishCallback(OnFlowFinish, NULL);
+
+    /* Register thread init callback. */
+    SCThreadRegisterInitCallback(OnThreadInit, NULL);
+
+    /* Register an EVE callback. */
+    SCEveRegisterCallback(EveCallback, NULL);
+
+    NdpInitRiskKeyword();
+}
+
+const SCPlugin PluginRegistration = {
+    .name = "ndpi-dummy",
+    .author = "FirstName LastName",
+    .license = "GPLv2",
+    .Init = NdpiInit,
+};
+
+const SCPlugin *SCPluginRegister()
+{
+    return &PluginRegistration;
+}

src/Makefile.am

@@ -328,6 +328,7 @@ noinst_HEADERS = \
 	feature.h \
 	flow-bit.h \
 	flow-bypass.h \
+	flow-callbacks.h \
 	flow.h \
 	flow-hash.h \
 	flow-manager.h \
@@ -448,6 +449,8 @@ noinst_HEADERS = \
 	suricata-common.h \
 	suricata.h \
 	suricata-plugin.h \
+	thread-callbacks.h \
+	thread-storage.h \
 	threads-debug.h \
 	threads.h \
 	threads-profile.h \
@@ -897,6 +900,7 @@ libsuricata_c_a_SOURCES = \
 	feature.c \
 	flow-bit.c \
 	flow-bypass.c \
+	flow-callbacks.c \
 	flow.c \
 	flow-hash.c \
 	flow-manager.c \
@@ -1010,6 +1014,8 @@ libsuricata_c_a_SOURCES = \
 	stream-tcp-sack.c \
 	stream-tcp-util.c \
 	suricata.c \
+	thread-callbacks.c \
+	thread-storage.c \
 	threads.c \
 	tm-modules.c \
 	tmqh-flow.c \

src/detect-engine-register.c

@@ -450,18 +450,20 @@ void SigTableCleanup(void)
     }
 }
 
-void SigTableSetup(void)
+void SigTableInit(void)
 {
     if (sigmatch_table == NULL) {
         DETECT_TBLSIZE = DETECT_TBLSIZE_STATIC + DETECT_TBLSIZE_STEP;
         sigmatch_table = SCCalloc(DETECT_TBLSIZE, sizeof(SigTableElmt));
         if (sigmatch_table == NULL) {
             DETECT_TBLSIZE = 0;
             FatalError("Could not allocate sigmatch_table");
-            return;
         }
     }
+}
 
+void SigTableSetup(void)
+{
     DetectSidRegister();
     DetectPriorityRegister();
     DetectPrefilterRegister();

src/detect-engine-register.h

@@ -338,6 +338,7 @@ extern int DETECT_TBLSIZE_IDX;
 #define DETECT_TBLSIZE_STEP 256
 int SigTableList(const char *keyword);
 void SigTableCleanup(void);
+void SigTableInit(void);
 void SigTableSetup(void);
 void SigTableRegisterTests(void);