Fixed possible NULL pointer deref in dependencies/nDPIsrvd.h and examples/c-captured/c-captured.c

 * `make install` C examples
 * examples/py-flow-info/flow-info.py supports filtering
 * added breed to examples/py-flow-info/flow-info.py

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 38 insertions, 5 deletions

diff --git a/examples/py-flow-info/flow-info.py b/examples/py-flow-info/flow-info.py
index a98b0743e..f9b71df91 100755
--- a/examples/py-flow-info/flow-info.py
+++ b/examples/py-flow-info/flow-info.py
@@ -7,6 +7,8 @@ sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
 import nDPIsrvd
 from nDPIsrvd import nDPIsrvdSocket, TermColor
 
+global args
+
 def prettifyEvent(color_list, whitespaces, text):
     term_attrs = str()
     for color in color_list:
@@ -14,6 +16,26 @@ def prettifyEvent(color_list, whitespaces, text):
     fmt = '{}{:>' + str(whitespaces) + '}{}'
     return fmt.format(term_attrs, text, TermColor.END)
 
+def checkEventFilter(json_dict):
+    if json_dict['flow_event_name'] == 'guessed':
+        if args.guessed is True:
+            return True
+    if json_dict['flow_event_name'] == 'not-detected':
+        if args.undetected is True:
+            return True
+    if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
+        if args.risky is True:
+            return True
+    if json_dict['midstream'] != 0:
+        if args.midstream is True:
+            return True
+
+    if args.guessed is False and args.undetected is False and \
+        args.risky is False and args.midstream is False:
+        return True
+
+    return False
+
 def onJsonLineRecvd(json_dict, current_flow, global_user_data):
     instance_and_source = ''
     instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['alias']))
@@ -25,15 +47,21 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
     elif 'flow_event_id' not in json_dict:
         return True
 
-    ndpi_proto_categ = ''
+    if checkEventFilter(json_dict) is False:
+        return True
+
+    ndpi_proto_categ_breed = ''
     ndpi_frisk = ''
 
     if 'ndpi' in json_dict:
         if 'proto' in json_dict['ndpi']:
-            ndpi_proto_categ += '[' + str(json_dict['ndpi']['proto']) + ']'
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'
 
         if 'category' in json_dict['ndpi']:
-            ndpi_proto_categ += '[' + str(json_dict['ndpi']['category']) + ']'
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'
+
+        if 'breed' in json_dict['ndpi']:
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'
 
         if 'flow_risk' in json_dict['ndpi']:
             cnt = 0
@@ -62,7 +90,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
               '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
               json_dict['dst_ip'].lower(),
               '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
-              ndpi_proto_categ, line_suffix))
+              ndpi_proto_categ_breed, line_suffix))
     elif json_dict['l3_proto'] == 'ip6':
         print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{} {}{}' \
                 ''.format(instance_and_source, flow_event_name,
@@ -71,7 +99,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
               '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
               json_dict['dst_ip'].lower(),
               '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
-              ndpi_proto_categ, line_suffix))
+              ndpi_proto_categ_breed, line_suffix))
     else:
         raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))
 
@@ -82,7 +110,12 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
 
 if __name__ == '__main__':
     argparser = nDPIsrvd.defaultArgumentParser()
+    argparser.add_argument('--guessed',    action='store_true', default=False, help='Print only guessed flow events.')
+    argparser.add_argument('--undetected', action='store_true', default=False, help='Print only undetected flow events.')
+    argparser.add_argument('--risky',      action='store_true', default=False, help='Print only risky flow events.')
+    argparser.add_argument('--midstream',  action='store_true', default=False, help='Print only midstream flow events.')
     args = argparser.parse_args()
+
     address = nDPIsrvd.validateAddress(args)
 
     sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))