github-personal/nDPId
1
0
Fork 0
mirror of https://github.com/outbackdingo/nDPId.git synced 2026-01-27 18:19:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed possible NULL pointer deref in dependencies/nDPIsrvd.h and examples/c-captured/c-captured.c

Browse Source 
* `make install` C examples
 * examples/py-flow-info/flow-info.py supports filtering
 * added breed to examples/py-flow-info/flow-info.py

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
This commit is contained in:
Toni Uhlig
2021-02-28 11:27:22 +01:00
parent 06ff353099
commit 4699263d65
4 changed files with 71 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
Makefile
View File

@@ -94,6 +94,11 @@ install: all
$(INSTALL) -d '$(DESTDIR)$(PREFIX)/bin' '$(DESTDIR)$(PREFIX)/sbin'
$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' nDPIsrvd
$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/sbin' nDPId
$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' examples/c-captured/c-captured
$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' examples/c-json-stdout/c-json-stdout
ifneq ($(GOCC),)
$(INSTALL) $(INSTALL_ARGS) -t '$(DESTDIR)$(PREFIX)/bin' examples/go-dashboard/go-dashboard
endif
clean:
$(RM) -f nDPId nDPIsrvd examples/c-captured/c-captured examples/c-json-stdout/c-json-stdout examples/go-dashboard/go-dashboard

31
dependencies/nDPIsrvd.h vendored
View File

@@ -501,9 +501,14 @@ token_get_value(struct nDPIsrvd_socket const * const sock, char const * const ke
return NULL;
}
static inline int is_token_valid(struct nDPIsrvd_json_token const * const token)
{
return token != NULL && token->value_length > 0 && token->value != NULL;
}
static inline int token_value_equals(struct nDPIsrvd_json_token const * const token, char const * const value, size_t value_length)
{
if (token == NULL || token->value == NULL)
if (is_token_valid(token) == 0)
{
return 0;
}
@@ -533,7 +538,7 @@ str_value_to_ull(char const * const value_as_string, nDPIsrvd_ull_ptr const valu
static inline enum nDPIsrvd_conversion_return
token_value_to_ull(struct nDPIsrvd_json_token const * const token, nDPIsrvd_ull_ptr const value)
{
if (token == NULL || token->value == NULL || token->value_length == 0)
if (is_token_valid(token) == 0)
{
return CONVERISON_KEY_NOT_FOUND;
}
@@ -544,9 +549,8 @@ token_value_to_ull(struct nDPIsrvd_json_token const * const token, nDPIsrvd_ull_
static inline int nDPIsrvd_build_flow_key(struct nDPIsrvd_flow_key * const key,
struct nDPIsrvd_json_token const * const tokens[nDPIsrvd_FLOW_KEY_TOKENS])
{
if (tokens[0]->value == NULL || tokens[0]->value_length == 0 ||
tokens[1]->value == NULL || tokens[1]->value_length == 0 ||
tokens[2]->value == NULL || tokens[2]->value_length == 0)
if (is_token_valid(tokens[0]) == 0 || is_token_valid(tokens[1]) == 0 ||
is_token_valid(tokens[2]) == 0)
{
return 1;
}
@@ -562,10 +566,11 @@ static inline int nDPIsrvd_build_flow_key(struct nDPIsrvd_flow_key * const key,
return 0;
}
static inline struct nDPIsrvd_flow * nDPIsrvd_get_flow(struct nDPIsrvd_socket * const sock)
static inline struct nDPIsrvd_flow * nDPIsrvd_get_flow(struct nDPIsrvd_socket * const sock,
struct nDPIsrvd_json_token const * const flow_id)
{
struct nDPIsrvd_json_token const * const tokens[nDPIsrvd_FLOW_KEY_TOKENS] = {
TOKEN_GET_SZ(sock, "flow_id"), TOKEN_GET_SZ(sock, "alias"), TOKEN_GET_SZ(sock, "source"),
flow_id, TOKEN_GET_SZ(sock, "alias"), TOKEN_GET_SZ(sock, "source"),
};
struct nDPIsrvd_flow_key key = {};
@@ -720,18 +725,22 @@ static inline enum nDPIsrvd_parse_return nDPIsrvd_parse(struct nDPIsrvd_socket *
}
}
struct nDPIsrvd_json_token const * const flow_id = TOKEN_GET_SZ(sock, "flow_id");
struct nDPIsrvd_flow * flow = NULL;
flow = nDPIsrvd_get_flow(sock);
if (flow == NULL)
if (is_token_valid(flow_id) != 0)
{
ret = PARSE_FLOW_MGMT_ERROR;
flow = nDPIsrvd_get_flow(sock, flow_id);
if (flow == NULL)
{
ret = PARSE_FLOW_MGMT_ERROR;
}
}
if (ret == PARSE_OK &&
sock->json_callback(sock, flow) != CALLBACK_OK)
{
ret = PARSE_JSON_CALLBACK_ERROR;
}
if (nDPIsrvd_check_flow_end(sock, flow) != 0)
if (is_token_valid(flow_id) != 0 && nDPIsrvd_check_flow_end(sock, flow) != 0)
{
ret = PARSE_FLOW_MGMT_ERROR;
}

10
examples/c-captured/c-captured.c
View File

@@ -1,5 +1,6 @@
#include <arpa/inet.h>
#include <errno.h>
#include <linux/limits.h>
#include <netinet/ip_icmp.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
@@ -290,6 +291,11 @@ static enum nDPIsrvd_conversion_return perror_ull(enum nDPIsrvd_conversion_retur
static enum nDPIsrvd_callback_return captured_json_callback(struct nDPIsrvd_socket * const sock,
struct nDPIsrvd_flow * const flow)
{
if (flow == NULL)
{
return CALLBACK_OK; // We do not care for non flow/packet-flow events for NOW.
}
struct flow_user_data * const flow_user = (struct flow_user_data *)flow->flow_user_data;
#ifdef VERBOSE
@@ -408,10 +414,10 @@ static enum nDPIsrvd_callback_return captured_json_callback(struct nDPIsrvd_sock
{
packet_data_print(flow_user->packets);
{
char pcap_filename[64];
char pcap_filename[PATH_MAX];
if (generate_pcap_filename(flow, flow_user, pcap_filename, sizeof(pcap_filename)) == NULL)
{
syslog(LOG_DAEMON | LOG_ERR, "%s", "Internal error, exit ..");
syslog(LOG_DAEMON | LOG_ERR, "%s", "Internal error. Could not generate PCAP filename, exit ..");
return CALLBACK_ERROR;
}
#ifdef VERBOSE

43
examples/py-flow-info/flow-info.py
View File

@@ -7,6 +7,8 @@ sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
import nDPIsrvd
from nDPIsrvd import nDPIsrvdSocket, TermColor
global args
def prettifyEvent(color_list, whitespaces, text):
term_attrs = str()
for color in color_list:
@@ -14,6 +16,26 @@ def prettifyEvent(color_list, whitespaces, text):
fmt = '{}{:>' + str(whitespaces) + '}{}'
return fmt.format(term_attrs, text, TermColor.END)
def checkEventFilter(json_dict):
if json_dict['flow_event_name'] == 'guessed':
if args.guessed is True:
return True
if json_dict['flow_event_name'] == 'not-detected':
if args.undetected is True:
return True
if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
if args.risky is True:
return True
if json_dict['midstream'] != 0:
if args.midstream is True:
return True
if args.guessed is False and args.undetected is False and \
args.risky is False and args.midstream is False:
return True
return False
def onJsonLineRecvd(json_dict, current_flow, global_user_data):
instance_and_source = ''
instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['alias']))
@@ -25,15 +47,21 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
elif 'flow_event_id' not in json_dict:
return True
ndpi_proto_categ = ''
if checkEventFilter(json_dict) is False:
return True
ndpi_proto_categ_breed = ''
ndpi_frisk = ''
if 'ndpi' in json_dict:
if 'proto' in json_dict['ndpi']:
ndpi_proto_categ += '[' + str(json_dict['ndpi']['proto']) + ']'
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'
if 'category' in json_dict['ndpi']:
ndpi_proto_categ += '[' + str(json_dict['ndpi']['category']) + ']'
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'
if 'breed' in json_dict['ndpi']:
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'
if 'flow_risk' in json_dict['ndpi']:
cnt = 0
@@ -62,7 +90,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
'[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
json_dict['dst_ip'].lower(),
'[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
ndpi_proto_categ, line_suffix))
ndpi_proto_categ_breed, line_suffix))
elif json_dict['l3_proto'] == 'ip6':
print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{} {}{}' \
''.format(instance_and_source, flow_event_name,
@@ -71,7 +99,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
'[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
json_dict['dst_ip'].lower(),
'[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
ndpi_proto_categ, line_suffix))
ndpi_proto_categ_breed, line_suffix))
else:
raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))
@@ -82,7 +110,12 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
if __name__ == '__main__':
argparser = nDPIsrvd.defaultArgumentParser()
argparser.add_argument('--guessed', action='store_true', default=False, help='Print only guessed flow events.')
argparser.add_argument('--undetected', action='store_true', default=False, help='Print only undetected flow events.')
argparser.add_argument('--risky', action='store_true', default=False, help='Print only risky flow events.')
argparser.add_argument('--midstream', action='store_true', default=False, help='Print only midstream flow events.')
args = argparser.parse_args()
address = nDPIsrvd.validateAddress(args)
sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))