Fixed possible NULL pointer deref in dependencies/nDPIsrvd.h and examples/c-captured/c-captured.c

 * `make install` C examples
 * examples/py-flow-info/flow-info.py supports filtering
 * added breed to examples/py-flow-info/flow-info.py

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

2 files changed, 46 insertions, 7 deletions

diff --git a/examples/c-captured/c-captured.c b/examples/c-captured/c-captured.c
index 89a7b5eab..18d37056d 100644
--- a/examples/c-captured/c-captured.c
+++ b/examples/c-captured/c-captured.c
@@ -1,5 +1,6 @@
 #include <arpa/inet.h>
 #include <errno.h>
+#include <linux/limits.h>
 #include <netinet/ip_icmp.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
@@ -290,6 +291,11 @@ static enum nDPIsrvd_conversion_return perror_ull(enum nDPIsrvd_conversion_retur
 static enum nDPIsrvd_callback_return captured_json_callback(struct nDPIsrvd_socket * const sock,
                                                             struct nDPIsrvd_flow * const flow)
 {
+    if (flow == NULL)
+    {
+        return CALLBACK_OK; // We do not care for non flow/packet-flow events for NOW.
+    }
+
     struct flow_user_data * const flow_user = (struct flow_user_data *)flow->flow_user_data;
 
 #ifdef VERBOSE
@@ -408,10 +414,10 @@ static enum nDPIsrvd_callback_return captured_json_callback(struct nDPIsrvd_sock
         {
             packet_data_print(flow_user->packets);
             {
-                char pcap_filename[64];
+                char pcap_filename[PATH_MAX];
                 if (generate_pcap_filename(flow, flow_user, pcap_filename, sizeof(pcap_filename)) == NULL)
                 {
-                    syslog(LOG_DAEMON | LOG_ERR, "%s", "Internal error, exit ..");
+                    syslog(LOG_DAEMON | LOG_ERR, "%s", "Internal error. Could not generate PCAP filename, exit ..");
                     return CALLBACK_ERROR;
                 }
 #ifdef VERBOSE
diff --git a/examples/py-flow-info/flow-info.py b/examples/py-flow-info/flow-info.py
index a98b0743e..f9b71df91 100755
--- a/examples/py-flow-info/flow-info.py
+++ b/examples/py-flow-info/flow-info.py
@@ -7,6 +7,8 @@ sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
 import nDPIsrvd
 from nDPIsrvd import nDPIsrvdSocket, TermColor
 
+global args
+
 def prettifyEvent(color_list, whitespaces, text):
     term_attrs = str()
     for color in color_list:
@@ -14,6 +16,26 @@ def prettifyEvent(color_list, whitespaces, text):
     fmt = '{}{:>' + str(whitespaces) + '}{}'
     return fmt.format(term_attrs, text, TermColor.END)
 
+def checkEventFilter(json_dict):
+    if json_dict['flow_event_name'] == 'guessed':
+        if args.guessed is True:
+            return True
+    if json_dict['flow_event_name'] == 'not-detected':
+        if args.undetected is True:
+            return True
+    if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
+        if args.risky is True:
+            return True
+    if json_dict['midstream'] != 0:
+        if args.midstream is True:
+            return True
+
+    if args.guessed is False and args.undetected is False and \
+        args.risky is False and args.midstream is False:
+        return True
+
+    return False
+
 def onJsonLineRecvd(json_dict, current_flow, global_user_data):
     instance_and_source = ''
     instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['alias']))
@@ -25,15 +47,21 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
     elif 'flow_event_id' not in json_dict:
         return True
 
-    ndpi_proto_categ = ''
+    if checkEventFilter(json_dict) is False:
+        return True
+
+    ndpi_proto_categ_breed = ''
     ndpi_frisk = ''
 
     if 'ndpi' in json_dict:
         if 'proto' in json_dict['ndpi']:
-            ndpi_proto_categ += '[' + str(json_dict['ndpi']['proto']) + ']'
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'
 
         if 'category' in json_dict['ndpi']:
-            ndpi_proto_categ += '[' + str(json_dict['ndpi']['category']) + ']'
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'
+
+        if 'breed' in json_dict['ndpi']:
+            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'
 
         if 'flow_risk' in json_dict['ndpi']:
             cnt = 0
@@ -62,7 +90,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
               '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
               json_dict['dst_ip'].lower(),
               '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
-              ndpi_proto_categ, line_suffix))
+              ndpi_proto_categ_breed, line_suffix))
     elif json_dict['l3_proto'] == 'ip6':
         print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{} {}{}' \
                 ''.format(instance_and_source, flow_event_name,
@@ -71,7 +99,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
               '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
               json_dict['dst_ip'].lower(),
               '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
-              ndpi_proto_categ, line_suffix))
+              ndpi_proto_categ_breed, line_suffix))
     else:
         raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))
 
@@ -82,7 +110,12 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
 
 if __name__ == '__main__':
     argparser = nDPIsrvd.defaultArgumentParser()
+    argparser.add_argument('--guessed',    action='store_true', default=False, help='Print only guessed flow events.')
+    argparser.add_argument('--undetected', action='store_true', default=False, help='Print only undetected flow events.')
+    argparser.add_argument('--risky',      action='store_true', default=False, help='Print only risky flow events.')
+    argparser.add_argument('--midstream',  action='store_true', default=False, help='Print only midstream flow events.')
     args = argparser.parse_args()
+
     address = nDPIsrvd.validateAddress(args)
 
     sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))