Refactored client distributor C API.

 * Still not perfect, but the code before was not even able to deal with JSON arrays.
   Use common "speaking" function names for all functions in nDPIsrvd.h
 * Provide a more or less generic and easy extendable JSON walk function.
 * Modified C examples to align with the changed C API.
 * c-collectd: Reduced lot's of code duplication by providing mapping tables.
 * nDPId: IAT array requires one slot less (first packet has always an IAT of 0).

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 5 insertions, 5 deletions

diff --git a/test/results/nfsv3.pcap.out b/test/results/nfsv3.pcap.out
index 4116ee0dc..4a0044246 100644
--- a/test/results/nfsv3.pcap.out
+++ b/test/results/nfsv3.pcap.out
@@ -25,7 +25,7 @@
 00860{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":944207397400000,"flow_src_last_pkt_time":944207397400000,"flow_dst_last_pkt_time":944207397400000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":128,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":128,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":128,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":944207397400000,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1022,"dst_port":2049,"l4_proto":"udp","ndpi": {"confidence": {"6":"DPI"},"proto":"NFS","proto_id":"11","encrypted":0,"breed":"Acceptable","category_id":4,"category":"DataTransfer"}}
 00643{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":2,"flow_src_last_pkt_time":944207397400000,"flow_dst_last_pkt_time":944207397400000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":154,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":154,"pkt_l4_len":120,"thread_ts_usec":944207397400000,"pkt":"AMCV4Bm+AMCV+E3TCABFAACM5FMAAP8RlHKLGRZmixkWAggBA\/4AeFlmXh0L3AAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEHtAAAAAgAAAAAAAAABAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEIUAAAAAAACyWjhHdgwUQ\/0COEd16jDgNQI4R3XqMOA1Ag=="}
 00661{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":3,"flow_src_last_pkt_time":944207397400000,"flow_dst_last_pkt_time":944207397400000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":170,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":170,"pkt_l4_len":136,"thread_ts_usec":944207397400000,"pkt":"AMCV+E3TAMCV4Bm+CABFAACcZUIAAP8RE3SLGRYCixkWZgP+CAEAiHd0Xh0L3QAAAAAAAAACAAGGowAAAAMAAAATAAAAAQAAADQ4R3YLAAAACXdlcnJtc2NoZQAAAAAAAAAAAAABAAAABQAAAAEAAAAAAAAAAgAAAAMAAAARAAAAAAAAAAAAAAAgABAQhQAAA+cACgAAAACyWgAAACkACgAAAACyWgAAACk="}
-01662{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":42,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":944207397400000,"flow_src_last_pkt_time":944207397500000,"flow_dst_last_pkt_time":944207397500000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":128,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":184,"flow_dst_max_l4_payload_len":272,"flow_src_tot_l4_payload_len":2256,"flow_dst_tot_l4_payload_len":2044,"midstream":0,"thread_ts_usec":944207397500000,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1022,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"min":10000,"avg":16666.7,"max":50000,"stddev":14907.1,"var":222222224.0,"ent":3.2,"data": [10000,10000,50000,50000,10000,10000,10000,10000,10000,10000,10000,10000,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},"pktlen": {"min":74,"avg":176.4,"max":314,"stddev":63.4,"var":4021.9,"ent":4.9,"data": [170,154,170,206,170,210,170,182,178,74,178,74,226,314,170,154,206,186,178,74,178,74,178,282,178,74,222,302,178,282,178,74]},"bins": {"c_to_s": [0,0,0,0,13,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,6,0,2,2,2,0,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},"directions": [0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1]},"ndpi": {"confidence": {"6":"DPI"},"proto":"NFS","proto_id":"11","encrypted":0,"breed":"Acceptable","category_id":4,"category":"DataTransfer"}}
+01622{"flow_event_id":5,"flow_event_name":"analyse","thread_id":0,"packet_id":42,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":6,"flow_state":"finished","flow_src_packets_processed":16,"flow_dst_packets_processed":16,"flow_first_seen":944207397400000,"flow_src_last_pkt_time":944207397500000,"flow_dst_last_pkt_time":944207397500000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":128,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":184,"flow_dst_max_l4_payload_len":272,"flow_src_tot_l4_payload_len":2256,"flow_dst_tot_l4_payload_len":2044,"midstream":0,"thread_ts_usec":944207397500000,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":1022,"dst_port":2049,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3,"data_analysis": {"iat": {"min":10000,"avg":16666.7,"max":50000,"stddev":14907.1,"var":222222224.0,"ent":3.2,"data": [10000,10000,50000,50000,10000,10000,10000,10000,10000,10000,10000,10000]},"pktlen": {"min":74,"avg":176.4,"max":314,"stddev":63.4,"var":4021.9,"ent":4.9,"data": [170,154,170,206,170,210,170,182,178,74,178,74,226,314,170,154,206,186,178,74,178,74,178,282,178,74,222,302,178,282,178,74]},"bins": {"c_to_s": [0,0,0,0,13,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"s_to_c": [0,6,0,2,2,2,0,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},"directions": [0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1]},"ndpi": {"confidence": {"6":"DPI"},"proto":"NFS","proto_id":"11","encrypted":0,"breed":"Acceptable","category_id":4,"category":"DataTransfer"}}
 00748{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":125,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":944207397740000,"flow_src_last_pkt_time":944207397740000,"flow_dst_last_pkt_time":944207397740000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":64,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":64,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":64,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":944207397740000,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3299,"dst_port":111,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":3}
 00577{"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_src_last_pkt_time":944207397740000,"flow_dst_last_pkt_time":944207397740000,"flow_idle_time":200000000,"pkt_oversize":false,"pkt_caplen":106,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":106,"pkt_l4_len":72,"thread_ts_usec":944207397740000,"pkt":"AMCV+E3TAMCV4Bm+CABFAABcZXwAAEAR0nqLGRYCixkWZgzjAG8ASDjzOExLeQAAAAAAAAACAAGGoAAAAAMAAAADAAAAAAAAAAAAAAAAAAAAAAABhqUAAAABAAAAA3VkcAAAAAAAAAAAAA=="}
 00989{"flow_event_id":7,"flow_event_name":"detected","thread_id":0,"packet_id":125,"source":"nfsv3.pcap","alias":"nDPId-test","flow_id":7,"flow_state":"info","flow_src_packets_processed":1,"flow_dst_packets_processed":0,"flow_first_seen":944207397740000,"flow_src_last_pkt_time":944207397740000,"flow_dst_last_pkt_time":944207397740000,"flow_idle_time":200000000,"flow_src_min_l4_payload_len":64,"flow_dst_min_l4_payload_len":0,"flow_src_max_l4_payload_len":64,"flow_dst_max_l4_payload_len":0,"flow_src_tot_l4_payload_len":64,"flow_dst_tot_l4_payload_len":0,"midstream":0,"thread_ts_usec":944207397740000,"l3_proto":"ip4","src_ip":"139.25.22.2","dst_ip":"139.25.22.102","src_port":3299,"dst_port":111,"l4_proto":"udp","ndpi": {"flow_risk": {"5": {"risk":"Known Proto on Non Std Port","severity":"Medium","risk_score": {"total":260,"client":230,"server":30}}},"confidence": {"6":"DPI"},"proto":"NFS","proto_id":"11","encrypted":0,"breed":"Acceptable","category_id":4,"category":"DataTransfer"}}
@@ -51,10 +51,10 @@
 ~~ total active/idle flows...: 8/8
 ~~ total timeout flows.......: 0
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-~~ total memory allocated....: 6050753 bytes
-~~ total memory freed........: 6050753 bytes
+~~ total memory allocated....: 6050721 bytes
+~~ total memory freed........: 6050721 bytes
 ~~ total allocations/frees...: 121685/121685
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ~~ json string min len.......: 490 chars
-~~ json string max len.......: 1667 chars
-~~ json string avg len.......: 1077 chars
+~~ json string max len.......: 1627 chars
+~~ json string avg len.......: 1057 chars