vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-03 09:20:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fixes TLS-risks sometimes handled twice

Browse source
This commit is contained in:
Simone Mainardi 2021-02-18 14:45:02 +01:00
parent 604ccebaa8
commit c70c635e3f
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/plugins/alerts/security/flow_risks/user_scripts/flow/flow_risks.lua
View file

@ -42,6 +42,16 @@ local script = {
-- #################################################################
local excluded_risks = {
[6] = i18n("flow_risk.ndpi_tls_selfsigned_certificate"), -- handled in tls_certificate_selfsigned.lua
[7] = i18n("flow_risk.ndpi_tls_obsolete_version"), -- handled in tls_old_protocol_version.lua
[8] = i18n("flow_risk.ndpi_tls_weak_cipher"), -- handled in tls_certificate_expired.lua
[9] = i18n("flow_risk.ndpi_tls_certificate_expired"), -- handled in tls_certificate_expired.lua
[10] = i18n("flow_risk.ndpi_tls_certificate_mismatch"), -- handled in tls_certificate_mismatch.lua TODO: migrate to flow risk
}
-- #################################################################
-- Default scores to use for flow risks
local DEFAULT_SCORES = {
50 --[[ flow score --]],
@ -107,6 +117,10 @@ function script.hooks.protocolDetected(now, conf)
local all_risks = flow.getRiskInfo()
for risk_str, risk_id in pairsByValues(all_risks, asc) do
if excluded_risks[risk_id] then
goto continue
end
-- If the risk is not among those enabled, just skip it
local handler
if handlers[risk_id] then
@ -121,6 +135,8 @@ function script.hooks.protocolDetected(now, conf)
-- Handler expect three params, namely flow-, client- and server-scores
handler.handle_risk(risk_id, table.unpack(risk2scores[risk_id] or DEFAULT_SCORES))
end
::continue::
end
end
end