dns: support an opt-in custom detection port

[RajaMuhammadAwais]

Related issue

Fixes #1788

Summary

DNS detection is currently restricted to the standard DNS, mDNS, and LLMNR ports. This prevents nDPI from recognizing valid DNS traffic deployed on a user-selected nonstandard port. The behavior was confirmed in the issue discussion and reproduced with the official dns_on_port_80.pcapng capture.

This pull request adds an explicit, disabled-by-default configuration parameter that enables DNS detection on one additional exact TCP or UDP port.

Configuration

--cfg=dns,custom_port,80

The default value is 0, which keeps existing behavior unchanged. The accepted range is 0 through 65535. Only the configured port is added to the DNS entry-point gate. Standard DNS on port 53, mDNS on port 5353, and LLMNR on port 5355 retain their existing handling.

Implementation details

The DNS port classification helper now receives the nDPI configuration context and returns NDPI_PROTOCOL_DNS only when the configured custom port matches either flow endpoint. Existing DNS structural validation remains mandatory, so enabling a custom port does not classify arbitrary traffic solely because it uses that port.

The configuration parameter is registered in src/lib/ndpi_config.c, stored in the private configuration structure, and documented in doc/configuration_parameters.rst.

Evidence and regression testing

The official issue capture is included as the positive regression fixture:

PCAP: tests/cfgs/dns_custom_port/pcap/dns_on_port_80.pcapng
Config: --cfg=dns,custom_port,80
Result: DNS, 2 packets, 1 flow

The same capture without the configuration remains Unknown, confirming that the option is disabled by default. Standard DNS traffic remains classified as DNS when the option is enabled. An unrelated HTTP capture with port 80 produced no DNS classification. An invalid value of 70000 is rejected by the configuration API.

The following checks passed locally:

make -j2
./tests/unit/unit
Focused positive and negative ndpiReader checks
Standard DNS compatibility check
Port-80 HTTP false-positive check
Invalid configuration range check
Address, Undefined, and Leak Sanitizer build and fixture run
git diff --check

The sanitizer run completed without an AddressSanitizer, UndefinedBehaviorSanitizer, or LeakSanitizer report.

Files changed

File	Change
src/lib/protocols/dns.c	Add exact custom-port matching while preserving standard-port logic
src/lib/ndpi_config.c	Register dns.custom_port with default 0 and range 0 to 65535
src/include/ndpi_private.h	Add the private configuration field
doc/configuration_parameters.rst	Document the parameter and its default behavior
tests/cfgs/dns_custom_port/	Add the official PCAP fixture, configuration, and expected output

Checklist

• I have signed the ntop Contributor License Agreement.
• I have read the nDPI contributing guidelines.
• I have updated the documentation where applicable.
• I have added a focused regression fixture.
• I have kept this change isolated from PR fix: avoid unaligned reads in DNS and serializers #3231 and issue DNS dissector do not proceed next paket when receice CNAME #2575.

References

1. nDPI issue #1788
2. nDPI contributing guidelines
3. Fork branch

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[lucaderi]

Thank you