Add Apache Thrift detection

[0xA50C1A1]

Apache Thrift is a commonly used RPC framework.

This detector is quite simple and only checks the HTTP content-type field or looks for the Thrift strict or compact header in TCP or UDP packets. This can give false-positive results in theory, but I guess such accuracy is enough in practice.

[IvanNardi]

@0xA50C1A1 , I didn't look at your code yet, but could you attached a trace with also an example of detection over HTTP, please?
BTW: you need to add the new .c file to the VisualStudio configuration file....

[0xA50C1A1]

@0xA50C1A1 , I didn't look at your code yet, but could you attached a trace with also an example of detection over HTTP, please? BTW: you need to add the new .c file to the VisualStudio configuration file....

I don't have a PCAP sample with Thrift-over-HTTP traffic yet, but I'm looking for.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[IvanNardi]

Even ignoring the HTTP change, it seems there a lots of false positives....

[IvanNardi]

Could you try, at least, something like that:

/* As a HTTP sub-protocol */
if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
   flow->detected_protocol_stack[1] == NDPI_PROTOCOL_HTTP) {
  /* Content line stuff */
} else  { /* Standard dissector */
  if (packet->payload_packet_len > 5) {

  }
}
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);

[0xA50C1A1]

Sorry, I was too hasty with a pull request, so I'll change it to a draft until I fix this dissector.

[utoni]

@0xA50C1A1 please rebase to the current dev branch

[utoni]

Superseeded by #2007.