Commit graph

303 commits

Author SHA1 Message Date
Simone Mainardi
b12fc91a6b Merge branch 'host-user-scripts' into dev 2021-04-03 10:18:09 +02:00
Luca
a4047c5a1c Implements flow callbacks and alerts in C++
Scaffolding code of the host scripts

Scaffolding code for host alerts

Adds host_callbacks/ for .cpp files

Implements all classes for host callbacks

Removes pro/enterprise host callbacks

Adds typedefs with callback deltas

Compilation fix

Creates instances of host callbacks in loader

Link fix

Removes redundant/non-necessary host alerts

Merges Scan and Flood callbacks together

Removes outdated API files

Refactors alert keys into entity|id

Refactors all flow alert_{...} into flow_alert_{...}

Refactors C++ flow alert_{...} into flow_alert_{...}

Reworks alert ids to include an entity type

Cleanup and merge alertTypeRaw with getAlertType

Minor fix

Refactors alert definitions and keys into sub directories

Implement host alert callback execution and trigger/release logic

Update callbacks API

Adds base CallbacksLoader for {Host,Flow}CallbacksLoader

Implements load of host user scripts with periodicities

Implements runtime reload of host callbacks

Add logic for periodic callbacks

Add 'expired' flag to host alerts

Implements execution of host callbacks and SYN flood checks

Adds triggerAlertAsync calls to SYNFlood

Implements JSON host alert generation info

Handle callback getPeriod. Optimize callback lookup.

Implements host recipients in C++

Add callback status

Define destructor

Iterator fixes

Cleanup host Lua calls (now performed in C++)

Changes to show new host alerts in SQLite

Adds release/engage action on alert JSON

Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.

Implements SYN Flood Attacker with params

Uses parametrized thresholds to trigger syn flood alerts

Implements build alert of both attacker and victim

Implement HostAlertableEntity

Implements SYN scan attacker/victim alerts

Implements flow flood attacker/victim alerts

Removes a debug flag

Add virtual allocStatus

Add HostAlert disableAutoRelease()

Add Ãexplicit releaseAlert()

Implements SYNFloodHostCallbackStatus

Implements SYNScanHostCallbackStatus

Implements FlowFloodHostCallbackStatus

Change trigger API to handle cli/src score

Implements {DNS,SMTP,NTP}ServerContactsAlert

Reworks ServerContacts host alerts

Implement exclusion bitmaps for host alerts

Implements {SMTP,DNS,NTP}ServerContactsAlert

Adds host_info to the generated alert JSON

Minor cleanup

Optimize access to callback status

Move RepliesRequestsRatio to pro

Rework triggerAlert on host to avoid multiple call and unneeded status data

Compilation fix

Reworked host alerts API (wip)

Cleanup unused host callbacks

Compilation fixes

Finishes backend implementation of host alerts exclusions

Rework host callbacks executor

Implements disable of host alerts

Port SYNFlood to the new api

Cleanup

Reduce duplicated code

Comments

Port ServerContacts to the new api

Clenaup

Adds parsing of configuration for host callbacks

Port SYNScanAlert to the new API

Port FlowFlood to the new API

Cleanup unused HostAlert getName

Reworks DNSRequestsErrorsRatioAlert

Adds JSON for DNSTrafficAlert

Adds FlowsAlert

Adds P2PTrafficAlert

Add RepliesRequestsRatioAlert

Adds ScoreAlert

Adds ThroughputAlert

Adds TrafficAlert

Fixes for scan/flood alerts

DNS ratio alert support

Add HTTP stats getters

Implements deltas for many host callbacks

Host score inc

Adds missing Alert params to host alerts

Release all host alerts on idle

Refactors score classes

Implements class Score to contain scores for hosts, flows, etc

Adds scores to VLANs, Networks, ASes and Countries

Host callbacks can trigger a single alert now

FlowFlood, SYNFloo, SYNScan now inherit from FlowHits

Move severity and score to constructor

Add else branch to hits callbacks

Alert definition update for flows_flood, syn_flood, syn_scan

Update field name

Engaged alert init

Adds score incs/decs for AS, VLAN, country, os and network

Restore network scripts

Restored other alert definitions for floods

Handle decreasing alert score

Removes include

Rename flows_flood to flow_flood for consistency

Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions

Fixes for non-host engaged/release alerts

Cleanup LuaEngineFlow and LuaEngineHost classes

Fixes old calls to host lua during shutdown

Removes AlertCheckLuaEngine instance

Fixes purging of flows

Fixes alerts release upon shutdown causing wrong uses

Removes a debug flag

Fix getNumEngagedAlerts

Cleanup unnecessary host callbacks

Removes array of callback statuses inside host

Bitmap fixes

Refactors Bitmap into Bitmap128

Implements 16-bits bitmaps for host alerts

Adds class HostCallbacksStatus

Moves callback status p2p and DNS inside HostCallbacksStatus

Removes unused callbacks in typedefs

Minor cleanup

Adds trigger/release for DNS/p2p alerts

Reworks UI of hosts user scripts

Rename HostCallbackType to HostCallbackID, getType to getID, others
2021-04-03 09:53:15 +02:00
Alfredo Cardigliano
5d27dde70d Add SNMP polling in nEdge (implement #3872) 2021-03-25 14:36:56 +00:00
Simone Mainardi
f61ffc045b Merge branch 'c-user-scripts' into dev 2021-03-22 10:36:13 +01:00
Simone Mainardi
aea9138bfb Implements flow callbacks and alerts in C++ 2021-03-22 09:51:36 +01:00
Matteo Biscosi
26af27d6a9 Implements active flow and host score behaviour 2021-03-13 00:31:01 +01:00
Matteo Biscosi
f7773fb715 Implemented behavioural counter for visited sites by local hosts 2021-02-24 15:25:36 +01:00
Alfredo Cardigliano
9c196d322b Use Patricia from nDPI 2021-02-23 12:34:49 +01:00
Luca Deri
f0853062b2 Implemented classes based on nDPI for behavioural traffic analysis 2021-02-09 13:06:08 +01:00
Matteo Biscosi
eba1aaa359 Implements #4984 core Internet resources misuse script 2021-02-03 12:41:18 +01:00
Matteo Biscosi
2a4ec8ee0c Fixed wrong filename include 2021-02-02 19:01:30 +01:00
Matteo Biscosi
fe01117324 Implements #4006 alerts when host contacts an unusual number of peers
Partial implementation, the rest is under the Pro Repository
2021-02-02 13:31:21 +01:00
Alfredo Cardigliano
ab7c490731 Add support for bash script in --test-script. Add --test-script-pre. Rework script for rest tests. (wip #4989) 2021-02-01 18:52:49 +01:00
Simone Mainardi
8a62783e2d Cleanup old partial host groups code
Fixes #1599
2021-01-21 11:27:17 +01:00
Matteo Biscosi
43fa8cf6e9 Implements OperatingSystem Hash
Implements #1599
2021-01-21 11:14:52 +01:00
Luca Deri
d7d0b69a5c Added new include 2021-01-15 12:14:37 +01:00
Matteo Biscosi
023b7fd1df Reviewed Top Sites per host and Added Top Sites per Interface 2021-01-08 20:07:19 +01:00
Luca Deri
a1178a0791 Updated (C) 2021-01-02 12:08:23 +01:00
Alfredo Cardigliano
662bfab50d Fix linux check macros, read mac from the interface 2020-12-30 10:02:48 +01:00
Alfredo Cardigliano
33415ad2dd Add support for traffic direction based on the MAC address (implement #4852) 2020-12-29 09:36:51 +01:00
Luca Deri
fb1ea36992 Win fixes 2020-12-17 17:14:56 +01:00
Alfredo Cardigliano
c27334818b Add AlertFifoQueue extending FifoQueue 2020-12-15 13:53:34 +01:00
Alfredo Cardigliano
b8cff9b5b5 Rename FifoStringsQueue to StringFifoQueue 2020-12-15 12:27:18 +01:00
Luca
e1158fb855 Removed Logstats implementation that was suboptinal
Replaced sys syslog that is more generic and that can also be used with Logstash
Fixes #4796
2020-12-14 13:52:12 +01:00
Luca Deri
599835c72f Reworked IEC104 implementation 2020-11-27 22:34:50 +01:00
matteo
f496b4e660 Moved localhost tree from AddressResolution.h to Ntop.h and removed AddressList class 2020-11-27 12:21:03 +01:00
Luca Deri
2ef29c7c5e Cleanup code removing .inc files 2020-11-25 22:05:06 +01:00
Luca Deri
2884cc9794 Reworked Doh/DoT handling 2020-11-11 18:55:12 +01:00
Matteo Biscosi
5a8fd8efd7
Fixes #2115 and added shell script user guide (#4702)
* Added shell endpoint user guide

* Fixes #2115 std::new exceptions not always handled

* Removed a nothrow due to the insert of a try-catch statement

* Trying to implement #4421

Co-authored-by: matteo <biscosi@ntop.org>
2020-11-11 12:28:18 +01:00
Luca Deri
dc072833ee Win fixes 2020-10-27 20:57:05 +01:00
Simone Mainardi
30f46a15da Misbehaving flows cleanup 2020-10-16 11:28:46 +02:00
Luca Deri
3af2b10a9f Reworked service and periodic map 2020-10-11 14:47:31 +02:00
Alfredo Cardigliano
fc8357ce6f Add support for Syslog stats (backend and lua API) 2020-10-09 12:00:55 +02:00
Simone Mainardi
8bf82dd0cb Implements stats page for interface queue drops monitoring 2020-10-08 12:52:55 +02:00
Luca Deri
80dfd37e04 Reworked baheviour analysis code 2020-09-28 12:55:37 +02:00
Luca Deri
dd50729bc3 Added condvar to SPSC queue to avoid active wait 2020-09-27 16:54:54 +02:00
Alfredo Cardigliano
2848d17b29 Move include 2020-09-08 18:04:34 +02:00
Simone Mainardi
3f2fa953aa Implements in-memory recipient queues 2020-09-07 17:54:14 +02:00
Alfredo Cardigliano
7b6bf76ba6 Add include for hw bypass support 2020-09-02 17:41:42 +02:00
Simone Mainardi
5fbe012134 Implements in-memory counters for alert queues and shows them in the UI 2020-09-01 17:42:03 +02:00
Luca Deri
1255158fe8 Compilation fix for the community build 2020-08-07 17:34:33 +02:00
Luca Deri
75efc0ec0c Partial fix (community code is now clean) for #2533
Reworked inteface disaggregation
Moved to attic some unused classes
Added ability to disaggregate also for Probe IP + Ingress Interface
2020-08-07 17:20:26 +02:00
Alfredo Cardigliano
bde41ff4b7 Cleanup nagios code 2020-07-28 11:33:04 +02:00
lucaderi
07f948a310 Added g++ 4.8 check 2020-07-22 00:31:32 +02:00
lucaderi
aea73b0591 Added clang check 2020-07-22 00:27:29 +02:00
lucaderi
e38156619d Added g++ check 2020-07-22 00:23:52 +02:00
lucaderi
13a67443fa Uses rework 2020-07-22 00:21:02 +02:00
Alfredo Cardigliano
0a84d0706e Add DSCP stats to the host, new DSCPStats class 2020-07-17 18:05:11 +02:00
Luca Deri
40689081c7 Implemented periodicity stats 2020-07-17 13:12:53 +02:00
Luca Deri
1f2f1fd25d BA improvemements 2020-07-14 18:14:59 +02:00