vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-03 09:20:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Added use of local variables.

Browse source 
Used flow.getInfo() and srv.ip instead flow.getServerKey().
Now the for breaks when a match is found.
This commit is contained in:
Daniele Zulberti 2020-10-11 18:09:47 +02:00
parent 735073f832
commit 3b8ee0e9f0
3 changed files with 39 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

33
scripts/plugins/alerts/security/unexpected_smtp/user_scripts/flow/unexpected_smtp.lua
View file

@ -40,28 +40,27 @@ local script = {
function script.hooks.protocolDetected(now, conf)
if(table.len(conf.items) > 0) then
ok = 0
server_ip = flow.getServerKey()
-- the string format returned by flow.geServerKey() is "x.x.x.x@0", :sub(1, -3) deletes "@0"
server_ip = server_ip:sub(1, -3)
local ok = 0
local flow_info = flow.getInfo()
local server_ip = flow_info["srv.ip"]
for _, smtp_ip in pairs(conf.items) do
if server_ip == smtp_ip then
ok = 1
end
if server_ip == smtp_ip then
ok = 1
break
end
end
if ok == 0 then
flow.triggerStatus(
flow_consts.status_types.status_unexpected_smtp.create(
flow_consts.status_types.status_unexpected_smtp.alert_severity,
server_ip
),
100, -- flow_score
0, -- cli_score
100 --srv_score
)
flow.triggerStatus(
flow_consts.status_types.status_unexpected_smtp.create(
flow_consts.status_types.status_unexpected_smtp.alert_severity,
server_ip
),
100, -- flow_score
0, -- cli_score
100 --srv_score
)
end
end
end