vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-03 09:20:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor fixe: when the list of DNS/SMTP servers is empty, no check is performed

Browse source
This commit is contained in:
Luca Deri 2020-10-10 10:33:47 +02:00
parent 03f9de5b8c
commit 2093488db3
3 changed files with 47 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

52
scripts/plugins/alerts/security/unexpected_dns/user_scripts/flow/unexpected_dns.lua
View file

@ -25,11 +25,6 @@ local script = {
items = {},
},
-- The frequency for the periodicUpdate hook invocation. Must be
-- multiple of 30 seconds.
periodic_update_seconds = 30,
gui = {
i18n_title = "unexpected_dns.unexpected_dns_title",
i18n_description = "unexpected_dns.unexpected_dns_description",
@ -44,30 +39,31 @@ local script = {
-- #################################################################
function script.hooks.protocolDetected(now, conf)
ok = 0
server_ip = flow.getServerKey()
-- the fortmat of the string returned by flow.geServerKey() is "x.x.x.x@0", :sub(1, -3) deletes "@0"
server_ip = server_ip:sub(1, -3)
for _, dns_ip in pairs(conf.items or script.default_value.items) do
if server_ip == dns_ip then
ok = 1
end
if(table.len(conf.items) > 0) then
ok = 0
server_ip = flow.getServerKey()
-- the string format returned by flow.geServerKey() is "x.x.x.x@0", :sub(1, -3) deletes "@0"
server_ip = server_ip:sub(1, -3)
for _, dns_ip in pairs(conf.items) do
if server_ip == dns_ip then
ok = 1
end
end
if ok == 0 then
flow.triggerStatus(
flow_consts.status_types.status_unexpected_dns.create(
flow_consts.status_types.status_unexpected_dns.alert_severity,
server_ip
),
100, -- flow_score
0, -- cli_score
100 --srv_score
)
end
end
if ok == 0 then
flow.triggerStatus(
flow_consts.status_types.status_unexpected_dns.create(
flow_consts.status_types.status_unexpected_dns.alert_severity,
server_ip
),
100, -- flow_score
0, -- cli_score
100 --srv_score
)
end
end
-- #################################################################