mirror of
https://github.com/ntop/ntopng.git
synced 2026-05-10 09:19:04 +00:00
Scaffolding code of the host scripts
Scaffolding code for host alerts
Adds host_callbacks/ for .cpp files
Implements all classes for host callbacks
Removes pro/enterprise host callbacks
Adds typedefs with callback deltas
Compilation fix
Creates instances of host callbacks in loader
Link fix
Removes redundant/non-necessary host alerts
Merges Scan and Flood callbacks together
Removes outdated API files
Refactors alert keys into entity|id
Refactors all flow alert_{...} into flow_alert_{...}
Refactors C++ flow alert_{...} into flow_alert_{...}
Reworks alert ids to include an entity type
Cleanup and merge alertTypeRaw with getAlertType
Minor fix
Refactors alert definitions and keys into sub directories
Implement host alert callback execution and trigger/release logic
Update callbacks API
Adds base CallbacksLoader for {Host,Flow}CallbacksLoader
Implements load of host user scripts with periodicities
Implements runtime reload of host callbacks
Add logic for periodic callbacks
Add 'expired' flag to host alerts
Implements execution of host callbacks and SYN flood checks
Adds triggerAlertAsync calls to SYNFlood
Implements JSON host alert generation info
Handle callback getPeriod. Optimize callback lookup.
Implements host recipients in C++
Add callback status
Define destructor
Iterator fixes
Cleanup host Lua calls (now performed in C++)
Changes to show new host alerts in SQLite
Adds release/engage action on alert JSON
Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.
Implements SYN Flood Attacker with params
Uses parametrized thresholds to trigger syn flood alerts
Implements build alert of both attacker and victim
Implement HostAlertableEntity
Implements SYN scan attacker/victim alerts
Implements flow flood attacker/victim alerts
Removes a debug flag
Add virtual allocStatus
Add HostAlert disableAutoRelease()
Add Ãexplicit releaseAlert()
Implements SYNFloodHostCallbackStatus
Implements SYNScanHostCallbackStatus
Implements FlowFloodHostCallbackStatus
Change trigger API to handle cli/src score
Implements {DNS,SMTP,NTP}ServerContactsAlert
Reworks ServerContacts host alerts
Implement exclusion bitmaps for host alerts
Implements {SMTP,DNS,NTP}ServerContactsAlert
Adds host_info to the generated alert JSON
Minor cleanup
Optimize access to callback status
Move RepliesRequestsRatio to pro
Rework triggerAlert on host to avoid multiple call and unneeded status data
Compilation fix
Reworked host alerts API (wip)
Cleanup unused host callbacks
Compilation fixes
Finishes backend implementation of host alerts exclusions
Rework host callbacks executor
Implements disable of host alerts
Port SYNFlood to the new api
Cleanup
Reduce duplicated code
Comments
Port ServerContacts to the new api
Clenaup
Adds parsing of configuration for host callbacks
Port SYNScanAlert to the new API
Port FlowFlood to the new API
Cleanup unused HostAlert getName
Reworks DNSRequestsErrorsRatioAlert
Adds JSON for DNSTrafficAlert
Adds FlowsAlert
Adds P2PTrafficAlert
Add RepliesRequestsRatioAlert
Adds ScoreAlert
Adds ThroughputAlert
Adds TrafficAlert
Fixes for scan/flood alerts
DNS ratio alert support
Add HTTP stats getters
Implements deltas for many host callbacks
Host score inc
Adds missing Alert params to host alerts
Release all host alerts on idle
Refactors score classes
Implements class Score to contain scores for hosts, flows, etc
Adds scores to VLANs, Networks, ASes and Countries
Host callbacks can trigger a single alert now
FlowFlood, SYNFloo, SYNScan now inherit from FlowHits
Move severity and score to constructor
Add else branch to hits callbacks
Alert definition update for flows_flood, syn_flood, syn_scan
Update field name
Engaged alert init
Adds score incs/decs for AS, VLAN, country, os and network
Restore network scripts
Restored other alert definitions for floods
Handle decreasing alert score
Removes include
Rename flows_flood to flow_flood for consistency
Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions
Fixes for non-host engaged/release alerts
Cleanup LuaEngineFlow and LuaEngineHost classes
Fixes old calls to host lua during shutdown
Removes AlertCheckLuaEngine instance
Fixes purging of flows
Fixes alerts release upon shutdown causing wrong uses
Removes a debug flag
Fix getNumEngagedAlerts
Cleanup unnecessary host callbacks
Removes array of callback statuses inside host
Bitmap fixes
Refactors Bitmap into Bitmap128
Implements 16-bits bitmaps for host alerts
Adds class HostCallbacksStatus
Moves callback status p2p and DNS inside HostCallbacksStatus
Removes unused callbacks in typedefs
Minor cleanup
Adds trigger/release for DNS/p2p alerts
Reworks UI of hosts user scripts
Rename HostCallbackType to HostCallbackID, getType to getID, others
126 lines
5.3 KiB
C++
126 lines
5.3 KiB
C++
/*
|
|
*
|
|
* (C) 2013-21 - ntop.org
|
|
*
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software Foundation,
|
|
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
*
|
|
*/
|
|
|
|
#ifndef _LOCAL_HOST_H_
|
|
#define _LOCAL_HOST_H_
|
|
|
|
#include "ntop_includes.h"
|
|
|
|
class DoHDoTStats {
|
|
private:
|
|
IpAddress ip;
|
|
u_int16_t vlan_id;
|
|
u_int32_t num_uses;
|
|
|
|
public:
|
|
DoHDoTStats(IpAddress i, u_int16_t id) { ip = i, vlan_id = id, num_uses = 0; }
|
|
|
|
inline void incUses() { num_uses++; }
|
|
|
|
void lua(lua_State *vm) {
|
|
char buf[64];
|
|
|
|
lua_push_str_table_entry(vm, "ip", ip.print(buf, sizeof(buf)));
|
|
lua_push_uint32_table_entry(vm, "vlan_id", vlan_id);
|
|
lua_push_uint32_table_entry(vm, "num_uses", num_uses);
|
|
}
|
|
};
|
|
|
|
/* ************************************************************ */
|
|
|
|
class LocalHost : public Host, public SerializableElement {
|
|
protected:
|
|
int16_t local_network_id;
|
|
bool systemHost;
|
|
time_t initialization_time;
|
|
LocalHostStats *initial_ts_point;
|
|
std::unordered_map<u_int32_t, DoHDoTStats*> doh_dot_map;
|
|
|
|
/* LocalHost data: update LocalHost::deleteHostData when adding new fields */
|
|
char *os_detail;
|
|
bool drop_all_host_traffic;
|
|
/* END Host data: */
|
|
|
|
void initialize();
|
|
void freeLocalHostData();
|
|
virtual void deleteHostData();
|
|
|
|
char* getMacBasedSerializationKey(char *redis_key, size_t size, char *mac_key);
|
|
char* getIpBasedSerializationKey(char *redis_key, size_t size);
|
|
void luaDoHDot(lua_State *vm);
|
|
|
|
public:
|
|
LocalHost(NetworkInterface *_iface, Mac *_mac, u_int16_t _vlanId, IpAddress *_ip);
|
|
LocalHost(NetworkInterface *_iface, char *ipAddress, u_int16_t _vlanId);
|
|
virtual ~LocalHost();
|
|
|
|
virtual void set_hash_entry_state_idle();
|
|
virtual int16_t get_local_network_id() const { return(local_network_id); };
|
|
virtual bool isLocalHost() const { return(true); };
|
|
virtual bool isSystemHost() const { return(systemHost); };
|
|
|
|
virtual NetworkStats* getNetworkStats(int16_t networkId) {
|
|
return(iface->getNetworkStats(networkId));
|
|
};
|
|
virtual u_int32_t getActiveHTTPHosts() { return(getHTTPstats() ? getHTTPstats()->get_num_virtual_hosts() : 0); };
|
|
virtual HostStats* allocateStats() { return(new LocalHostStats(this)); };
|
|
|
|
virtual bool dropAllTraffic() const { return(drop_all_host_traffic); };
|
|
virtual void inlineSetOSDetail(const char *_os_detail);
|
|
virtual const char* getOSDetail(char * const buf, ssize_t buf_len);
|
|
virtual void updateHostTrafficPolicy(char *key);
|
|
|
|
virtual void luaHTTP(lua_State *vm) { stats->luaHTTP(vm); };
|
|
virtual void luaDNS(lua_State *vm, bool verbose) { stats->luaDNS(vm, verbose); luaDoHDot(vm); };
|
|
virtual void luaICMP(lua_State *vm, bool isV4, bool verbose) { stats->luaICMP(vm,isV4,verbose); };
|
|
virtual void lua_get_timeseries(lua_State* vm);
|
|
virtual void lua_peers_stats(lua_State* vm) const;
|
|
virtual void lua_contacts_stats(lua_State *vm) const;
|
|
virtual void incrVisitedWebSite(char *hostname) { stats->incrVisitedWebSite(hostname); };
|
|
virtual HTTPstats* getHTTPstats() { return(stats->getHTTPstats()); };
|
|
virtual DnsStats* getDNSstats() { return(stats->getDNSstats()); };
|
|
virtual ICMPstats* getICMPstats() { return(stats->getICMPstats()); };
|
|
virtual void luaTCP(lua_State *vm) { stats->lua(vm,false,details_normal); };
|
|
virtual u_int16_t getNumActiveContactsAsClient() { return stats->getNumActiveContactsAsClient(); };
|
|
virtual u_int16_t getNumActiveContactsAsServer() { return stats->getNumActiveContactsAsServer(); };
|
|
virtual void reloadPrefs();
|
|
|
|
virtual void deserialize(json_object *obj);
|
|
virtual void serialize(json_object *obj, DetailsLevel details_level) { return Host::serialize(obj, details_level); };
|
|
virtual char* getSerializationKey(char *buf, uint bufsize);
|
|
|
|
virtual void lua(lua_State* vm, AddressTree * ptree, bool host_details,
|
|
bool verbose, bool returnHost, bool asListElement);
|
|
void custom_periodic_stats_update(const struct timeval *tv) { ; }
|
|
|
|
virtual void luaHostBehaviour(lua_State* vm) { if(stats) stats->luaHostBehaviour(vm); }
|
|
virtual void incDohDoTUses(Host *srv_host);
|
|
|
|
virtual void incNTPContactCardinality(Host *h) { stats->incNTPContactCardinality(h); }
|
|
virtual void incDNSContactCardinality(Host *h) { stats->incDNSContactCardinality(h); }
|
|
virtual void incSMTPContactCardinality(Host *h) { stats->incSMTPContactCardinality(h); }
|
|
|
|
virtual u_int32_t getNTPContactCardinality() { return(stats->getNTPContactCardinality()); }
|
|
virtual u_int32_t getDNSContactCardinality() { return(stats->getDNSContactCardinality()); }
|
|
virtual u_int32_t getSMTPContactCardinality() { return(stats->getSMTPContactCardinality()); }
|
|
};
|
|
|
|
#endif /* _LOCAL_HOST_H_ */
|