Scaffolding code of the host scripts
Scaffolding code for host alerts
Adds host_callbacks/ for .cpp files
Implements all classes for host callbacks
Removes pro/enterprise host callbacks
Adds typedefs with callback deltas
Compilation fix
Creates instances of host callbacks in loader
Link fix
Removes redundant/non-necessary host alerts
Merges Scan and Flood callbacks together
Removes outdated API files
Refactors alert keys into entity|id
Refactors all flow alert_{...} into flow_alert_{...}
Refactors C++ flow alert_{...} into flow_alert_{...}
Reworks alert ids to include an entity type
Cleanup and merge alertTypeRaw with getAlertType
Minor fix
Refactors alert definitions and keys into sub directories
Implement host alert callback execution and trigger/release logic
Update callbacks API
Adds base CallbacksLoader for {Host,Flow}CallbacksLoader
Implements load of host user scripts with periodicities
Implements runtime reload of host callbacks
Add logic for periodic callbacks
Add 'expired' flag to host alerts
Implements execution of host callbacks and SYN flood checks
Adds triggerAlertAsync calls to SYNFlood
Implements JSON host alert generation info
Handle callback getPeriod. Optimize callback lookup.
Implements host recipients in C++
Add callback status
Define destructor
Iterator fixes
Cleanup host Lua calls (now performed in C++)
Changes to show new host alerts in SQLite
Adds release/engage action on alert JSON
Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.
Implements SYN Flood Attacker with params
Uses parametrized thresholds to trigger syn flood alerts
Implements build alert of both attacker and victim
Implement HostAlertableEntity
Implements SYN scan attacker/victim alerts
Implements flow flood attacker/victim alerts
Removes a debug flag
Add virtual allocStatus
Add HostAlert disableAutoRelease()
Add Ãexplicit releaseAlert()
Implements SYNFloodHostCallbackStatus
Implements SYNScanHostCallbackStatus
Implements FlowFloodHostCallbackStatus
Change trigger API to handle cli/src score
Implements {DNS,SMTP,NTP}ServerContactsAlert
Reworks ServerContacts host alerts
Implement exclusion bitmaps for host alerts
Implements {SMTP,DNS,NTP}ServerContactsAlert
Adds host_info to the generated alert JSON
Minor cleanup
Optimize access to callback status
Move RepliesRequestsRatio to pro
Rework triggerAlert on host to avoid multiple call and unneeded status data
Compilation fix
Reworked host alerts API (wip)
Cleanup unused host callbacks
Compilation fixes
Finishes backend implementation of host alerts exclusions
Rework host callbacks executor
Implements disable of host alerts
Port SYNFlood to the new api
Cleanup
Reduce duplicated code
Comments
Port ServerContacts to the new api
Clenaup
Adds parsing of configuration for host callbacks
Port SYNScanAlert to the new API
Port FlowFlood to the new API
Cleanup unused HostAlert getName
Reworks DNSRequestsErrorsRatioAlert
Adds JSON for DNSTrafficAlert
Adds FlowsAlert
Adds P2PTrafficAlert
Add RepliesRequestsRatioAlert
Adds ScoreAlert
Adds ThroughputAlert
Adds TrafficAlert
Fixes for scan/flood alerts
DNS ratio alert support
Add HTTP stats getters
Implements deltas for many host callbacks
Host score inc
Adds missing Alert params to host alerts
Release all host alerts on idle
Refactors score classes
Implements class Score to contain scores for hosts, flows, etc
Adds scores to VLANs, Networks, ASes and Countries
Host callbacks can trigger a single alert now
FlowFlood, SYNFloo, SYNScan now inherit from FlowHits
Move severity and score to constructor
Add else branch to hits callbacks
Alert definition update for flows_flood, syn_flood, syn_scan
Update field name
Engaged alert init
Adds score incs/decs for AS, VLAN, country, os and network
Restore network scripts
Restored other alert definitions for floods
Handle decreasing alert score
Removes include
Rename flows_flood to flow_flood for consistency
Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions
Fixes for non-host engaged/release alerts
Cleanup LuaEngineFlow and LuaEngineHost classes
Fixes old calls to host lua during shutdown
Removes AlertCheckLuaEngine instance
Fixes purging of flows
Fixes alerts release upon shutdown causing wrong uses
Removes a debug flag
Fix getNumEngagedAlerts
Cleanup unnecessary host callbacks
Removes array of callback statuses inside host
Bitmap fixes
Refactors Bitmap into Bitmap128
Implements 16-bits bitmaps for host alerts
Adds class HostCallbacksStatus
Moves callback status p2p and DNS inside HostCallbacksStatus
Removes unused callbacks in typedefs
Minor cleanup
Adds trigger/release for DNS/p2p alerts
Reworks UI of hosts user scripts
Rename HostCallbackType to HostCallbackID, getType to getID, others
- Removed unused google assistant scripts
- Cleaned up existing REST calls using _POST["payload"]
The _GET["parameter"] element is still present and it will be removed soon
When direct username:password are submitted, there is no need to enforce
such checks as it cannot be a CSRF attack. Indeed, CSRF attacks rely
on a session.
Fixes#4014
Implements #3105
Initial work to add elastisearch alerts
Initial implementation of ES alerts
Implements version check
Implements flow alerts format
Changes Elasticsearch index name
Comments the Elasticsearch alert endpoint
The point was discarded because of a bad RRD start time during the RRD creation.
The start time is now computed as "insertion_timestamp - heartbeat".
Fixes#3751
Such resources can be placed into the following plugin subdirs:
- ./httpdocs: javascript, css and similar, see plugins_utils.getHttpdocsDir
- ./modules: Lua modules, see plugins_utils.loadModule
- ./templates: HTML templates, see plugins_utils.renderTemplate
Basic rules to avoid corruptions:
- CONST_LUA_OK must be followed by a lua_push* / lua_newtable
- CONST_LUA_ERROR must *not* be followed by a lua_push* / lua_newtable
Detailed information can be found at https://www.lua.org/manual/5.2/manual.html#lua_CFunction
Class was not used and didn't handle concurrent accesses to strings,
yielding crashes such as
Thread 14 "stats_update.lu" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb3fff700 (LWP 25268)]
0x00005555556b9183 in IpAddress::intoa (this=0x28c, buf=0x7fffb3ffe030 "", bufLen=64, bitmask=255 '\377') at src/IpAddress.cpp:352
352 src/IpAddress.cpp: No such file or directory.
(gdb)
(gdb) bt
at src/GenericHash.cpp:222
#9 0x00005555556c0413 in NetworkInterface::walker (this=0x555556159e70, begin_slot=0x7fffb3ffe454, walk_all=true, wtype=walker_flows, walker=0x5555556c6b79 <host_flow_update_stats(GenericHashEntry*, void*, bool*)>,
user_data=0x7fffb3ffe458) at src/NetworkInterface.cpp:795
#10 0x00005555556c6f7c in NetworkInterface::periodicStatsUpdate (this=0x555556159e70, vm=0x7fffac0a5578) at src/NetworkInterface.cpp:2589
#11 0x0000555555671d62 in ntop_periodic_stats_update (vm=0x7fffac0a5578) at src/LuaEngine.cpp:6304
#12 0x000055555576c2f6 in luaD_precall ()
#13 0x0000555555777acd in luaV_execute ()
#14 0x000055555576c5cf in luaD_call ()
#15 0x000055555576c621 in luaD_callnoyield ()
#16 0x000055555576ba42 in luaD_rawrunprotected ()
#17 0x000055555576c91b in luaD_pcall ()
#18 0x0000555555769cd4 in lua_pcallk ()
#19 0x0000555555681e8a in LuaEngine::run_loaded_script (this=0x7fffac01fe10) at src/LuaEngine.cpp:12188
#20 0x000055555563eca2 in ThreadedActivity::runScript (this=0x555562aee4e0, now=1585309410, script_path=0x7fff88002620 "/usr/share/ntopng/scripts/callbacks/interface/stats_update.lua", iface=0x555556159e70, deadline=1585309420)
at src/ThreadedActivity.cpp:418
#21 0x00005555556ba04d in ThreadPool::run (this=0x5555624525a0) at src/ThreadPool.cpp:103
#22 0x00005555556b9c79 in doRun (ptr=0x5555624525a0) at src/ThreadPool.cpp:31
#23 0x00007ffff65aa6db in start_thread (arg=0x7fffb3fff700) at pthread_create.c:463
#24 0x00007ffff3ea388f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
A "shadow directory" is now populated when the reload occurs and then swapped as the active directory.
This avoids breaking the directory structure or changing files when other threads are possibly working
on them.
Fixes#3595
