Fixed possible NULL pointer deref in dependencies/nDPIsrvd.h and examples/c-captured/c-captured.c

 * `make install` C examples
 * examples/py-flow-info/flow-info.py supports filtering
 * added breed to examples/py-flow-info/flow-info.py

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

4 files changed, 71 insertions, 18 deletions

diff --git a/Makefile b/Makefile
index 13f7bf245..452e5105f 100644
--- a/Makefile
+++ b/Makefile
@@ -94,6 +94,11 @@ install: all
 	$(INSTALL) -d '$(DESTDIR)$(PREFIX)/bin' '$(DESTDIR)$(PREFIX)/sbin'
 	$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' nDPIsrvd
 	$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/sbin' nDPId
+	$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' examples/c-captured/c-captured
+	$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' examples/c-json-stdout/c-json-stdout
+ifneq ($(GOCC),)
+	$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' examples/go-dashboard/go-dashboard
+endif
 
 clean:
 	$(RM) -f nDPId nDPIsrvd examples/c-captured/c-captured examples/c-json-stdout/c-json-stdout examples/go-dashboard/go-dashboard
diff --git a/dependencies/nDPIsrvd.h b/dependencies/nDPIsrvd.h
index f1e7f8afc..e081bf988 100644
--- a/dependencies/nDPIsrvd.h
+++ b/dependencies/nDPIsrvd.h
@@ -501,9 +501,14 @@ token_get_value(struct nDPIsrvd_socket const * const sock, char const * const ke
     return NULL;
 }
 
+static inline int is_token_valid(struct nDPIsrvd_json_token const * const token)
+{
+    return token != NULL && token->value_length > 0 && token->value != NULL;
+}
+
 static inline int token_value_equals(struct nDPIsrvd_json_token const * const token, char const * const value, size_t value_length)
 {
-    if (token == NULL || token->value == NULL)
+    if (is_token_valid(token) == 0)
     {
         return 0;
     }
@@ -533,7 +538,7 @@ str_value_to_ull(char const * const value_as_string, nDPIsrvd_ull_ptr const valu
 static inline enum nDPIsrvd_conversion_return
 token_value_to_ull(struct nDPIsrvd_json_token const * const token, nDPIsrvd_ull_ptr const value)
 {
-    if (token == NULL || token->value == NULL || token->value_length == 0)
+    if (is_token_valid(token) == 0)
     {
         return CONVERISON_KEY_NOT_FOUND;
     }
@@ -544,9 +549,8 @@ token_value_to_ull(struct nDPIsrvd_json_token const * const token, nDPIsrvd_ull_
 static inline int nDPIsrvd_build_flow_key(struct nDPIsrvd_flow_key * const key,
                                           struct nDPIsrvd_json_token const * const tokens[nDPIsrvd_FLOW_KEY_TOKENS])
 {
-    if (tokens[0]->value == NULL || tokens[0]->value_length == 0 ||
-        tokens[1]->value == NULL || tokens[1]->value_length == 0 ||
-        tokens[2]->value == NULL || tokens[2]->value_length == 0)
+    if (is_token_valid(tokens[0]) == 0 || is_token_valid(tokens[1]) == 0 ||
+        is_token_valid(tokens[2]) == 0)
     {
         return 1;
     }
@@ -562,10 +566,11 @@ static inline int nDPIsrvd_build_flow_key(struct nDPIsrvd_flow_key * const key,
     return 0;
 }
 
-static inline struct nDPIsrvd_flow * nDPIsrvd_get_flow(struct nDPIsrvd_socket * const sock)
+static inline struct nDPIsrvd_flow * nDPIsrvd_get_flow(struct nDPIsrvd_socket * const sock,
+                                                       struct nDPIsrvd_json_token const * const flow_id)
 {
     struct nDPIsrvd_json_token const * const tokens[nDPIsrvd_FLOW_KEY_TOKENS] = {
-        TOKEN_GET_SZ(sock, "flow_id"), TOKEN_GET_SZ(sock, "alias"), TOKEN_GET_SZ(sock, "source"),
+        flow_id, TOKEN_GET_SZ(sock, "alias"), TOKEN_GET_SZ(sock, "source"),
     };
     struct nDPIsrvd_flow_key key = {};
 
@@ -720,18 +725,22 @@ static inline enum nDPIsrvd_parse_return nDPIsrvd_parse(struct nDPIsrvd_socket *
             }
         }
 
+        struct nDPIsrvd_json_token const * const flow_id = TOKEN_GET_SZ(sock, "flow_id");
         struct nDPIsrvd_flow * flow = NULL;
-        flow = nDPIsrvd_get_flow(sock);
-        if (flow == NULL)
+        if (is_token_valid(flow_id) != 0)
         {
-            ret = PARSE_FLOW_MGMT_ERROR;
+            flow = nDPIsrvd_get_flow(sock, flow_id);
+            if (flow == NULL)
+            {
+                ret = PARSE_FLOW_MGMT_ERROR;
+            }
         }
         if (ret == PARSE_OK &&
             sock->json_callback(sock, flow) != CALLBACK_OK)
         {
             ret = PARSE_JSON_CALLBACK_ERROR;
         }
-        if (nDPIsrvd_check_flow_end(sock, flow) != 0)
+        if (is_token_valid(flow_id) != 0 && nDPIsrvd_check_flow_end(sock, flow) != 0)
         {
             ret = PARSE_FLOW_MGMT_ERROR;
         }
diff --git a/examples/c-captured/c-captured.c b/examples/c-captured/c-captured.c
index 89a7b5eab..18d37056d 100644
--- a/examples/c-captured/c-captured.c
+++ b/examples/c-captured/c-captured.c
@@ -1,5 +1,6 @@
 #include <arpa/inet.h>
 #include <errno.h>
+#include <linux/limits.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
@@ -290,6 +291,11 @@ static enum nDPIsrvd_conversion_return perror_ull(enum nDPIsrvd_conversion_retur
 static enum nDPIsrvd_callback_return captured_json_callback(struct nDPIsrvd_socket * const sock,
                                                             struct nDPIsrvd_flow * const flow)
 {
+    if (flow == NULL)
+    {
+        return CALLBACK_OK; // We do not care for non flow/packet-flow events for NOW.
+    }
+
     struct flow_user_data * const flow_user = (struct flow_user_data *)flow->flow_user_data;
 
 #ifdef VERBOSE
@@ -408,10 +414,10 @@ static enum nDPIsrvd_callback_return captured_json_callback(struct nDPIsrvd_sock
         {
             packet_data_print(flow_user->packets);
             {
-                char pcap_filename[64];
+                char pcap_filename[PATH_MAX];
                 if (generate_pcap_filename(flow, flow_user, pcap_filename, sizeof(pcap_filename)) == NULL)
                 {
-                    syslog(LOG_DAEMON | LOG_ERR, "%s", "Internal error, exit ..");
+                    syslog(LOG_DAEMON | LOG_ERR, "%s", "Internal error. Could not generate PCAP filename, exit ..");
                     return CALLBACK_ERROR;
                 }
 #ifdef VERBOSE
diff --git a/examples/py-flow-info/flow-info.py b/examples/py-flow-info/flow-info.py
index a98b0743e..f9b71df91 100755
--- a/examples/py-flow-info/flow-info.py
+++ b/examples/py-flow-info/flow-info.py
@@ -7,6 +7,8 @@ sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
 import nDPIsrvd
 from nDPIsrvd import nDPIsrvdSocket, TermColor
 
+global args
+
 def prettifyEvent(color_list, whitespaces, text):
     term_attrs = str()
     for color in color_list:
@@ -14,6 +16,26 @@ def prettifyEvent(color_list, whitespaces, text):
     fmt = '{}{:>' + str(whitespaces) + '}{}'
     return fmt.format(term_attrs, text, TermColor.END)
 
+def checkEventFilter(json_dict):
+    if json_dict['flow_event_name'] == 'guessed':
+        if args.guessed is True:
+            return True
+    if json_dict['flow_event_name'] == 'not-detected':
+        if args.undetected is True:
+            return True
+    if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
+        if args.risky is True:
+            return True
+    if json_dict['midstream'] != 0:
+        if args.midstream is True:
+            return True
+
+    if args.guessed is False and args.undetected is False and \
+        args.risky is False and args.midstream is False:
+        return True
+
+    return False
+
 def onJsonLineRecvd(json_dict, current_flow, global_user_data):
     instance_and_source = ''
     instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['alias']))
@@ -25,15 +47,21 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
     elif 'flow_event_id' not in json_dict:
         return True
 
-    ndpi_proto_categ = ''
+    if checkEventFilter(json_dict) is False:
+        return True
+
+    ndpi_proto_categ_breed = ''
     ndpi_frisk = ''
 
     if 'ndpi' in json_dict:
         if 'proto' in json_dict['ndpi']:
-            ndpi_proto_categ += '[' + str(json_dict['ndpi']['proto']) + ']'
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'
 
         if 'category' in json_dict['ndpi']:
-            ndpi_proto_categ += '[' + str(json_dict['ndpi']['category']) + ']'
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'
+
+        if 'breed' in json_dict['ndpi']:
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'
 
         if 'flow_risk' in json_dict['ndpi']:
             cnt = 0
@@ -62,7 +90,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
               '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
               json_dict['dst_ip'].lower(),
               '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
-              ndpi_proto_categ, line_suffix))
+              ndpi_proto_categ_breed, line_suffix))
     elif json_dict['l3_proto'] == 'ip6':
         print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{} {}{}' \
                 ''.format(instance_and_source, flow_event_name,
@@ -71,7 +99,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
               '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
               json_dict['dst_ip'].lower(),
               '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
-              ndpi_proto_categ, line_suffix))
+              ndpi_proto_categ_breed, line_suffix))
     else:
         raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))
 
@@ -82,7 +110,12 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
 
 if __name__ == '__main__':
     argparser = nDPIsrvd.defaultArgumentParser()
+    argparser.add_argument('--guessed',    action='store_true', default=False, help='Print only guessed flow events.')
+    argparser.add_argument('--undetected', action='store_true', default=False, help='Print only undetected flow events.')
+    argparser.add_argument('--risky',      action='store_true', default=False, help='Print only risky flow events.')
+    argparser.add_argument('--midstream',  action='store_true', default=False, help='Print only midstream flow events.')
     args = argparser.parse_args()
+
     address = nDPIsrvd.validateAddress(args)
 
     sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))