scottk/nDPId
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/nDPId.git synced 2025-11-01 18:57:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed possible NULL pointer deref in dependencies/nDPIsrvd.h and examples/c-captured/c-captured.c

Browse Source 
* `make install` C examples
 * examples/py-flow-info/flow-info.py supports filtering
 * added breed to examples/py-flow-info/flow-info.py

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
This commit is contained in:
Toni Uhlig
2021-02-28 11:27:22 +01:00
parent 06ff353099
commit 4699263d65
4 changed files with 71 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
examples/py-flow-info/flow-info.py
View File

@@ -7,6 +7,8 @@ sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
import nDPIsrvd
from nDPIsrvd import nDPIsrvdSocket, TermColor
global args
def prettifyEvent(color_list, whitespaces, text):
term_attrs = str()
for color in color_list:
@@ -14,6 +16,26 @@ def prettifyEvent(color_list, whitespaces, text):
fmt = '{}{:>' + str(whitespaces) + '}{}'
return fmt.format(term_attrs, text, TermColor.END)
def checkEventFilter(json_dict):
if json_dict['flow_event_name'] == 'guessed':
if args.guessed is True:
return True
if json_dict['flow_event_name'] == 'not-detected':
if args.undetected is True:
return True
if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
if args.risky is True:
return True
if json_dict['midstream'] != 0:
if args.midstream is True:
return True
if args.guessed is False and args.undetected is False and \
args.risky is False and args.midstream is False:
return True
return False
def onJsonLineRecvd(json_dict, current_flow, global_user_data):
instance_and_source = ''
instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['alias']))
@@ -25,15 +47,21 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
elif 'flow_event_id' not in json_dict:
return True
ndpi_proto_categ = ''
if checkEventFilter(json_dict) is False:
return True
ndpi_proto_categ_breed = ''
ndpi_frisk = ''
if 'ndpi' in json_dict:
if 'proto' in json_dict['ndpi']:
ndpi_proto_categ += '[' + str(json_dict['ndpi']['proto']) + ']'
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'
if 'category' in json_dict['ndpi']:
ndpi_proto_categ += '[' + str(json_dict['ndpi']['category']) + ']'
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'
if 'breed' in json_dict['ndpi']:
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'
if 'flow_risk' in json_dict['ndpi']:
cnt = 0
@@ -62,7 +90,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
'[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
json_dict['dst_ip'].lower(),
'[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
ndpi_proto_categ, line_suffix))
ndpi_proto_categ_breed, line_suffix))
elif json_dict['l3_proto'] == 'ip6':
print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{} {}{}' \
''.format(instance_and_source, flow_event_name,
@@ -71,7 +99,7 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
'[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
json_dict['dst_ip'].lower(),
'[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
ndpi_proto_categ, line_suffix))
ndpi_proto_categ_breed, line_suffix))
else:
raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))
@@ -82,7 +110,12 @@ def onJsonLineRecvd(json_dict, current_flow, global_user_data):
if __name__ == '__main__':
argparser = nDPIsrvd.defaultArgumentParser()
argparser.add_argument('--guessed', action='store_true', default=False, help='Print only guessed flow events.')
argparser.add_argument('--undetected', action='store_true', default=False, help='Print only undetected flow events.')
argparser.add_argument('--risky', action='store_true', default=False, help='Print only risky flow events.')
argparser.add_argument('--midstream', action='store_true', default=False, help='Print only midstream flow events.')
args = argparser.parse_args()
address = nDPIsrvd.validateAddress(args)
sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))