Configuration issue between Suricata 8 and NDPI 5

[Anthony-76]

Hi,

I use Suricata 8 with nDPI-4.14. It works fine.

Today, I tried ton "nstall" nDPI 5.0 with Suricata 8.

I have the following errros:

Making all in plugins
make[1] : on entre dans le répertoire « /usr/src/suricata-8.0.2/plugins »
Making all in ndpi
make[2] : on entre dans le répertoire « /usr/src/suricata-8.0.2/plugins/ndpi »
CC ndpi_la-ndpi.lo
ndpi.c: In function 'OnFlowUpdate':
ndpi.c:130:22: error: implicit declaration of function 'ndpi_extra_dissection_possible' [-Wimplicit-function-declaration]
130 | if (!ndpi_extra_dissection_possible(threadctx->ndpi, flowctx->ndpi_flow))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ndpi.c:140:25: error: too many arguments to function 'ndpi_detection_giveup'
140 | ndpi_detection_giveup(threadctx->ndpi, flowctx->ndpi_flow, &proto_guessed);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from ndpi.c:34:
/usr/src/nDPI-5.0/src/include/ndpi_api.h:333:17: note: declared here
333 | ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_struct,
| ^~~~~~~~~~~~~~~~~~~~~
ndpi.c: In function 'OnThreadInit':
ndpi.c:174:5: error: unknown type name 'NDPI_PROTOCOL_BITMASK'; did you mean 'NDPI_PROTOCOL_SIZE'?
174 | NDPI_PROTOCOL_BITMASK protos;
| ^~~~~~~~~~~~~~~~~~~~~
| NDPI_PROTOCOL_SIZE
ndpi.c:175:5: error: implicit declaration of function 'NDPI_BITMASK_SET_ALL' [-Wimplicit-function-declaration]
175 | NDPI_BITMASK_SET_ALL(protos);
| ^~~~~~~~~~~~~~~~~~~~
ndpi.c:176:5: error: implicit declaration of function 'ndpi_set_protocol_detection_bitmask2' [-Wimplicit-function-declaration]
176 | ndpi_set_protocol_detection_bitmask2(context->ndpi, &protos);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ndpi.c: In function 'DetectnDPIProtocolParse':
ndpi.c:228:5: error: unknown type name 'NDPI_PROTOCOL_BITMASK'; did you mean 'NDPI_PROTOCOL_SIZE'?
228 | NDPI_PROTOCOL_BITMASK all;
| ^~~~~~~~~~~~~~~~~~~~~
| NDPI_PROTOCOL_SIZE
ndpi.c: In function 'DetectnDPIRiskParse':
ndpi.c:347:5: error: unknown type name 'NDPI_PROTOCOL_BITMASK'; did you mean 'NDPI_PROTOCOL_SIZE'?
347 | NDPI_PROTOCOL_BITMASK all;
| ^~~~~~~~~~~~~~~~~~~~~
| NDPI_PROTOCOL_SIZE
make[2]: *** [Makefile:522: ndpi_la-ndpi.lo] Error 1
make[2] : on quitte le répertoire « /usr/src/suricata-8.0.2/plugins/ndpi »
make[1]: *** [Makefile:432: all-recursive] Error 1
make[1] : on quitte le répertoire « /usr/src/suricata-8.0.2/plugins »
make: *** [Makefile:510: all-recursive] Error 1

The new features like:
"The old static NDPI_PROTOCOL_BITMASK has been replaced with a dynamic ndpi_bitmask structure."

Are not compatible the code of ndpi.c in Suricata 8 .

Do you have somes tips or ideas in order to configure nDPI 5 with Suricata 8?

Best regards
Anthony

[IvanNardi]

yeah, the code needs to be updated to latest API.
Not sure if it is better to track this issue here or in the Suricata repository: @lucaderi and @cardigliano?

[lucaderi]

This is a change that has to be done on Suricata

[victorjulien]

We're tracking the issue here https://redmine.openinfosecfoundation.org/issues/8077#note-7, however we have no intention of working on it. Hope for someone from the community to work on this.

[IvanNardi]

Closing here since the issue is tracked on Suricata repository

[victorjulien]

We see some interest in this, but are unsure what a good solution would be.

On the code side the update to the 5 API seems simple enough, but we're unsure what it means for the user experience. For example, will the output be different? Will matching behavior on the Suricata rule keywords (ndpi-risk and ndpi-protocol currently) change? We generally need matching and logging behavior to remain stable and predictable during a Suricata stable branch, so updating sounds risky to me.

I guess an alternative way could be to add a 5-specific plugin, and add ndpi5-risk and ndpi5-protocol, etc. But I suspect it would then not be possible to have 2 plugins active at the same time, where one links to ndpi 4 and the other to ndpi 5, but maybe I'm wrong on that.