vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-04-30 16:09:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

UDP open|filtered ports are not discarded from open port count

Browse source
This commit is contained in:
Luca Deri 2023-10-27 14:12:01 +02:00
parent 8fa10497f7
commit b9125e4a71
1 changed files with 12 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/lua/modules/vulnerability_scan/vs_utils.lua
View file

@ -165,8 +165,10 @@ local function format_port_list_to_string(ports)
end
-- ##############################################
local function find_port(port, port_list)
local found = false
for _,item in ipairs(port_list) do
if (item == port) then
found = true
@ -176,6 +178,8 @@ local function find_port(port, port_list)
return found
end
-- ##############################################
local function check_ports_diffences(num_old_ports, old_ports, num_new_ports, new_ports)
local rsp = {
trigger = true
@ -285,10 +289,8 @@ local function analyze_ports_diff(ports_difference)
end
-- ##############################################
-- This function checks the differences between an old and a new host scan
-- and return a table containing those differences
local function check_differences(host, host_name, scan_type, old_data, new_data)
@ -458,7 +460,8 @@ function vs_utils.cleanup_nmap_result(scan_result, scan_type)
local udp_ports = {}
for _,l in pairs(scan_result) do
if(string.find(l, "open") ~= nil) then
-- Ignore "open|filtered" ports
if((string.find(l, "open") ~= nil) and (string.find(l, "filtered") == nil)) then
local t = string.find(l, "/tcp ") or 0
local u = string.find(l, "/udp ") or 0
@ -499,6 +502,7 @@ end
-- **********************************************************
-- remove the first/last few lines that contain nmap information that change at each scan
function vs_utils.cleanup_nmap_vulners_result(scan_result, scan_type)
scan_result = scan_result:gsub("|_", "")
scan_result = scan_result:gsub("|", "")
@ -624,7 +628,6 @@ local function save_scanning_host(scan_info)
ntop.setHashCache(host_in_scanning_hash_key, host_to_scan_hash_key, json.encode(scan_info))
end
-- **********************************************************
-- Function to select correctly redis keys on periodic or scan all
@ -637,14 +640,11 @@ local function get_counter_periodic_all_scan_keys(is_periodic)
end
end
-- **********************************************************
-- Function to update counters of periodically scan or scan all
-- @param is_periodic (true -> is a periodic scan, false -> is a scan all)
local function update_periodicity_or_all_scan_info(is_periodic, new_item)
-- select correctly redis keys
local redis_info_key = get_counter_periodic_all_scan_keys(is_periodic)
@ -965,6 +965,7 @@ local function format_num_for_email(num, case)
end
end
-- **********************************************************
-- Function to send notification after periodicity scan
@ -1487,7 +1488,6 @@ end
-- periodicity can be set to "1day" "1week" "disabled"
function vs_utils.schedule_periodic_scan(periodicity)
local host_to_scan_list = vs_utils.retrieve_hosts_to_scan()
if (#host_to_scan_list > 0 ) then
@ -1723,6 +1723,8 @@ function vs_utils.retrieve_detected_ports(host)
return tcp_ports_detected, host_in_mem, udp_ports_detected
end
-- **********************************************************
-- Search port in ports list
local function find_port(port_to_find, port_list)
for _, port in ipairs(port_list) do
@ -1733,9 +1735,10 @@ local function find_port(port_to_find, port_list)
return false
end
-- **********************************************************
-- Compare vs ports and ntopng detected ports
function vs_utils.compare_ports(vs_scan_port_string_list, ntopng_ports)
local vs_scan_ports = split(vs_scan_port_string_list, ",")
local ports_unused = {}