ntopng/attic/scripts/callbacks/interface/host.lua
Luca a4047c5a1c Implements flow callbacks and alerts in C++
Scaffolding code of the host scripts

Scaffolding code for host alerts

Adds host_callbacks/ for .cpp files

Implements all classes for host callbacks

Removes pro/enterprise host callbacks

Adds typedefs with callback deltas

Compilation fix

Creates instances of host callbacks in loader

Link fix

Removes redundant/non-necessary host alerts

Merges Scan and Flood callbacks together

Removes outdated API files

Refactors alert keys into entity|id

Refactors all flow alert_{...} into flow_alert_{...}

Refactors C++ flow alert_{...} into flow_alert_{...}

Reworks alert ids to include an entity type

Cleanup and merge alertTypeRaw with getAlertType

Minor fix

Refactors alert definitions and keys into sub directories

Implement host alert callback execution and trigger/release logic

Update callbacks API

Adds base CallbacksLoader for {Host,Flow}CallbacksLoader

Implements load of host user scripts with periodicities

Implements runtime reload of host callbacks

Add logic for periodic callbacks

Add 'expired' flag to host alerts

Implements execution of host callbacks and SYN flood checks

Adds triggerAlertAsync calls to SYNFlood

Implements JSON host alert generation info

Handle callback getPeriod. Optimize callback lookup.

Implements host recipients in C++

Add callback status

Define destructor

Iterator fixes

Cleanup host Lua calls (now performed in C++)

Changes to show new host alerts in SQLite

Adds release/engage action on alert JSON

Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.

Implements SYN Flood Attacker with params

Uses parametrized thresholds to trigger syn flood alerts

Implements build alert of both attacker and victim

Implement HostAlertableEntity

Implements SYN scan attacker/victim alerts

Implements flow flood attacker/victim alerts

Removes a debug flag

Add virtual allocStatus

Add HostAlert disableAutoRelease()

Add Ãexplicit releaseAlert()

Implements SYNFloodHostCallbackStatus

Implements SYNScanHostCallbackStatus

Implements FlowFloodHostCallbackStatus

Change trigger API to handle cli/src score

Implements {DNS,SMTP,NTP}ServerContactsAlert

Reworks ServerContacts host alerts

Implement exclusion bitmaps for host alerts

Implements {SMTP,DNS,NTP}ServerContactsAlert

Adds host_info to the generated alert JSON

Minor cleanup

Optimize access to callback status

Move RepliesRequestsRatio to pro

Rework triggerAlert on host to avoid multiple call and unneeded status data

Compilation fix

Reworked host alerts API (wip)

Cleanup unused host callbacks

Compilation fixes

Finishes backend implementation of host alerts exclusions

Rework host callbacks executor

Implements disable of host alerts

Port SYNFlood to the new api

Cleanup

Reduce duplicated code

Comments

Port ServerContacts to the new api

Clenaup

Adds parsing of configuration for host callbacks

Port SYNScanAlert to the new API

Port FlowFlood to the new API

Cleanup unused HostAlert getName

Reworks DNSRequestsErrorsRatioAlert

Adds JSON for DNSTrafficAlert

Adds FlowsAlert

Adds P2PTrafficAlert

Add RepliesRequestsRatioAlert

Adds ScoreAlert

Adds ThroughputAlert

Adds TrafficAlert

Fixes for scan/flood alerts

DNS ratio alert support

Add HTTP stats getters

Implements deltas for many host callbacks

Host score inc

Adds missing Alert params to host alerts

Release all host alerts on idle

Refactors score classes

Implements class Score to contain scores for hosts, flows, etc

Adds scores to VLANs, Networks, ASes and Countries

Host callbacks can trigger a single alert now

FlowFlood, SYNFloo, SYNScan now inherit from FlowHits

Move severity and score to constructor

Add else branch to hits callbacks

Alert definition update for flows_flood, syn_flood, syn_scan

Update field name

Engaged alert init

Adds score incs/decs for AS, VLAN, country, os and network

Restore network scripts

Restored other alert definitions for floods

Handle decreasing alert score

Removes include

Rename flows_flood to flow_flood for consistency

Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions

Fixes for non-host engaged/release alerts

Cleanup LuaEngineFlow and LuaEngineHost classes

Fixes old calls to host lua during shutdown

Removes AlertCheckLuaEngine instance

Fixes purging of flows

Fixes alerts release upon shutdown causing wrong uses

Removes a debug flag

Fix getNumEngagedAlerts

Cleanup unnecessary host callbacks

Removes array of callback statuses inside host

Bitmap fixes

Refactors Bitmap into Bitmap128

Implements 16-bits bitmaps for host alerts

Adds class HostCallbacksStatus

Moves callback status p2p and DNS inside HostCallbacksStatus

Removes unused callbacks in typedefs

Minor cleanup

Adds trigger/release for DNS/p2p alerts

Reworks UI of hosts user scripts

Rename HostCallbackType to HostCallbackID, getType to getID, others
2021-04-03 09:53:15 +02:00

177 lines
6 KiB
Lua

--
-- (C) 2019-21 - ntop.org
--
local dirs = ntop.getDirs()
package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
require "lua_utils"
local alert_utils = require "alert_utils"
local alerts_api = require("alerts_api")
local user_scripts = require("user_scripts")
local alert_consts = require("alert_consts")
local host_pools = require "host_pools"
local do_benchmark = false -- Compute benchmarks and store their results
local do_print_benchmark = false -- Print benchmarks results to standard output
local do_trace = false -- Trace lua calls
-- DEBUG: benchmarks local to the execution of this script
-- Will be removed once all the host.<method> calls will be performed
-- inside the custom scripts
local do_script_benchmark = false
local script_benchmark_begin_time
local script_benchmark_tot_clock = 0
local script_benchmark_tot_calls = 0
local available_modules = nil
local configset = nil
local ifid = nil
local ts_enabled = nil
local host_entity = alert_consts.alert_entities.host.entity_id
local pools_instance = nil
-- #################################################################
local function benchmark_begin()
if do_benchmark then
script_benchmark_begin_time = os.clock()
end
end
-- #################################################################
local function benchmark_end()
if do_benchmark then
script_benchmark_tot_clock = script_benchmark_tot_clock + os.clock() - script_benchmark_begin_time
script_benchmark_tot_calls = script_benchmark_tot_calls + 1
end
end
-- #################################################################
-- The function below ia called once (#pragma once)
function setup(str_granularity)
ifid = interface.getId()
local ifname = interface.setActiveInterfaceId(ifid)
if(do_trace) then print("["..ifname.."] alert.lua:setup("..str_granularity..") called [deadline: "..formatEpoch(ntop.getDeadline()).."]\n") end
-- Load the threshold checking functions
available_modules = user_scripts.load(ifid, user_scripts.script_types.traffic_element, "host", {
hook_filter = str_granularity,
do_benchmark = do_benchmark,
})
configset = user_scripts.getConfigset()
pools_instance = host_pools:create()
ts_enabled = areHostTimeseriesEnabled()
end
-- #################################################################
-- The function below ia called once (#pragma once)
function teardown(str_granularity)
if(do_trace) then print("["..getInterfaceName(ifid).."] alert.lua:teardown("..str_granularity..") called [deadline: "..formatEpoch(ntop.getDeadline()).."]\n") end
if do_script_benchmark and script_benchmark_tot_calls > 0 then
traceError(TRACE_NORMAL,TRACE_CONSOLE, string.format("[tot_elapsed: %.4f][tot_num_calls: %u][avg time per call: %.4f]",
script_benchmark_tot_clock,
script_benchmark_tot_calls,
script_benchmark_tot_clock / script_benchmark_tot_calls))
end
user_scripts.teardown(available_modules, do_benchmark, do_print_benchmark)
end
-- #################################################################
local function in_time()
-- Read the deadline stored in the lua engine and, if the deadline is
-- too close, consider not time left for the script.
-- Calling os.time() every time is not expensive, see method in_time() inside flow.lua
-- for measurements.
if ntop.getDeadline() == 0 then
if do_trace then
print("No deadline set, always in time")
end
return true -- No deadline, always in time
end
local time_left = ntop.getDeadline() - os.time()
local res = time_left > 1
if do_trace then
if not res then
print(">>> No time left, [deadline: "..formatEpoch(ntop.getDeadline()).."]\n")
else
print("Enough time left [deadline: "..formatEpoch(ntop.getDeadline()).."]\n")
end
end
return res
end
-- #################################################################
-- The function below is called once per host
function runScripts(granularity)
if table.empty(available_modules.hooks[granularity]) then
if(do_trace) then print("host:runScripts("..granularity.."): no modules, skipping\n") end
return
end
local host_ip = host.getIp()
local pool_id = host.getPoolId()["host_pool_id"]
local host_key = hostinfo2hostkey({ip = host_ip.ip, vlan = host_ip.vlan}, nil, true --[[ force @[vlan] even when vlan is 0 --]])
local granularity_id = alert_consts.alerts_granularities[granularity].granularity_id
benchmark_begin()
local cur_alerts = host.getAlerts(granularity_id)
local is_localhost = host.isLocal()
benchmark_end()
local entity_info = alerts_api.hostAlertEntity(host_ip.ip, host_ip.vlan)
if in_time() then
-- Retrieve the configuration
local host_conf = user_scripts.getConfig(configset, "host")
local when = os.time()
for mod_key, hook_fn in pairs(available_modules.hooks[granularity]) do
local user_script = available_modules.modules[mod_key]
local conf = user_scripts.getTargetHookConfig(host_conf, user_script, granularity)
if(conf.enabled) then
alerts_api.invokeScriptHook(user_script, configset, hook_fn, {
granularity = granularity,
alert_entity = entity_info,
entity_info = host_ip,
cur_alerts = cur_alerts,
user_script_config = conf.script_conf,
user_script = user_script,
when = when,
ifid = ifid,
ts_enabled = ts_enabled,
})
end
end
end
-- cur_alerts now contains unprocessed triggered alerts, that is,
-- those alerts triggered but then disabled or unconfigured (e.g., when
-- the user removes a threshold from the gui)
if #cur_alerts > 0 then
alerts_api.releaseEntityAlerts(entity_info, cur_alerts)
end
end
-- #################################################################
function releaseAlerts(granularity)
local host_ip = host.getIp()
local entity_info = alerts_api.hostAlertEntity(host_ip.ip, host_ip.vlan)
alerts_api.releaseEntityAlerts(entity_info, host.getAlerts(granularity))
end