ntopng/include/RecipientQueues.h
Luca a4047c5a1c Implements flow callbacks and alerts in C++
Scaffolding code of the host scripts

Scaffolding code for host alerts

Adds host_callbacks/ for .cpp files

Implements all classes for host callbacks

Removes pro/enterprise host callbacks

Adds typedefs with callback deltas

Compilation fix

Creates instances of host callbacks in loader

Link fix

Removes redundant/non-necessary host alerts

Merges Scan and Flood callbacks together

Removes outdated API files

Refactors alert keys into entity|id

Refactors all flow alert_{...} into flow_alert_{...}

Refactors C++ flow alert_{...} into flow_alert_{...}

Reworks alert ids to include an entity type

Cleanup and merge alertTypeRaw with getAlertType

Minor fix

Refactors alert definitions and keys into sub directories

Implement host alert callback execution and trigger/release logic

Update callbacks API

Adds base CallbacksLoader for {Host,Flow}CallbacksLoader

Implements load of host user scripts with periodicities

Implements runtime reload of host callbacks

Add logic for periodic callbacks

Add 'expired' flag to host alerts

Implements execution of host callbacks and SYN flood checks

Adds triggerAlertAsync calls to SYNFlood

Implements JSON host alert generation info

Handle callback getPeriod. Optimize callback lookup.

Implements host recipients in C++

Add callback status

Define destructor

Iterator fixes

Cleanup host Lua calls (now performed in C++)

Changes to show new host alerts in SQLite

Adds release/engage action on alert JSON

Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.

Implements SYN Flood Attacker with params

Uses parametrized thresholds to trigger syn flood alerts

Implements build alert of both attacker and victim

Implement HostAlertableEntity

Implements SYN scan attacker/victim alerts

Implements flow flood attacker/victim alerts

Removes a debug flag

Add virtual allocStatus

Add HostAlert disableAutoRelease()

Add Ãexplicit releaseAlert()

Implements SYNFloodHostCallbackStatus

Implements SYNScanHostCallbackStatus

Implements FlowFloodHostCallbackStatus

Change trigger API to handle cli/src score

Implements {DNS,SMTP,NTP}ServerContactsAlert

Reworks ServerContacts host alerts

Implement exclusion bitmaps for host alerts

Implements {SMTP,DNS,NTP}ServerContactsAlert

Adds host_info to the generated alert JSON

Minor cleanup

Optimize access to callback status

Move RepliesRequestsRatio to pro

Rework triggerAlert on host to avoid multiple call and unneeded status data

Compilation fix

Reworked host alerts API (wip)

Cleanup unused host callbacks

Compilation fixes

Finishes backend implementation of host alerts exclusions

Rework host callbacks executor

Implements disable of host alerts

Port SYNFlood to the new api

Cleanup

Reduce duplicated code

Comments

Port ServerContacts to the new api

Clenaup

Adds parsing of configuration for host callbacks

Port SYNScanAlert to the new API

Port FlowFlood to the new API

Cleanup unused HostAlert getName

Reworks DNSRequestsErrorsRatioAlert

Adds JSON for DNSTrafficAlert

Adds FlowsAlert

Adds P2PTrafficAlert

Add RepliesRequestsRatioAlert

Adds ScoreAlert

Adds ThroughputAlert

Adds TrafficAlert

Fixes for scan/flood alerts

DNS ratio alert support

Add HTTP stats getters

Implements deltas for many host callbacks

Host score inc

Adds missing Alert params to host alerts

Release all host alerts on idle

Refactors score classes

Implements class Score to contain scores for hosts, flows, etc

Adds scores to VLANs, Networks, ASes and Countries

Host callbacks can trigger a single alert now

FlowFlood, SYNFloo, SYNScan now inherit from FlowHits

Move severity and score to constructor

Add else branch to hits callbacks

Alert definition update for flows_flood, syn_flood, syn_scan

Update field name

Engaged alert init

Adds score incs/decs for AS, VLAN, country, os and network

Restore network scripts

Restored other alert definitions for floods

Handle decreasing alert score

Removes include

Rename flows_flood to flow_flood for consistency

Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions

Fixes for non-host engaged/release alerts

Cleanup LuaEngineFlow and LuaEngineHost classes

Fixes old calls to host lua during shutdown

Removes AlertCheckLuaEngine instance

Fixes purging of flows

Fixes alerts release upon shutdown causing wrong uses

Removes a debug flag

Fix getNumEngagedAlerts

Cleanup unnecessary host callbacks

Removes array of callback statuses inside host

Bitmap fixes

Refactors Bitmap into Bitmap128

Implements 16-bits bitmaps for host alerts

Adds class HostCallbacksStatus

Moves callback status p2p and DNS inside HostCallbacksStatus

Removes unused callbacks in typedefs

Minor cleanup

Adds trigger/release for DNS/p2p alerts

Reworks UI of hosts user scripts

Rename HostCallbackType to HostCallbackID, getType to getID, others
2021-04-03 09:53:15 +02:00

119 lines
4.1 KiB
C++

/*
*
* (C) 2014-21 - ntop.org
*
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
*/
#ifndef _RECIPIENT_QUEUES_
#define _RECIPIENT_QUEUES_
#include "ntop_includes.h"
class RecipientQueues {
private:
AlertFifoQueue *queues_by_prio[RECIPIENT_NOTIFICATION_MAX_NUM_PRIORITIES];
/* Counters for the number of drops occurred when enqueuing */
u_int64_t drops_by_prio[RECIPIENT_NOTIFICATION_MAX_NUM_PRIORITIES];
/* Counters for the number of enqueues */
time_t uses_by_prio[RECIPIENT_NOTIFICATION_MAX_NUM_PRIORITIES];
/* Timestamp of the last dequeue, regardless of queue priority */
time_t last_use;
/* Minimum severity for notifications enqueued to this recipient */
AlertLevel minimum_severity;
/* Only enable enqueue/dequeue for notifications falling into these categories */
u_int8_t enabled_categories; /* MUST be large enough to contain MAX_NUM_SCRIPT_CATEGORIES */
/* Booleans indicating whether this is a flow/host recipient */
bool flow_recipient, host_recipient;
public:
RecipientQueues();
~RecipientQueues();
/**
* @brief Dequeues a notification from a `recipient_id` queue, given a certain priority
* @param prio The priority of the notification
* @param notification The dequeued notification
*
* @return Boolean, true if the dequeue was successful and `notification` is populated correctly, false otherwise
*/
bool dequeue(RecipientNotificationPriority prio, AlertFifoItem *notification);
/**
* @brief Enqueues a notification to a `recipient_id` queue, depending on the priority
* @param recipient_id An integer recipient identifier
* @param prio The priority of the notification
* @param notification A string containing the notification
*
* @return True if the enqueue succeeded, false otherwise
*/
bool enqueue(RecipientNotificationPriority prio, const AlertFifoItem* const notification);
/**
* @brief Sets the minimum severity for notifications to use this recipient
* @param minimum_severity The minimum severity for notifications to use this recipient
*
* @return
*/
inline void setMinimumSeverity(AlertLevel _minimum_severity) { minimum_severity = _minimum_severity; };
/**
* @brief Sets enabled notification categories to use this recipient
* @param enabled_categories A bitmap of notification categories to use this recipient
*
* @return
*/
inline void setEnabledCategories(u_int8_t _enabled_categories) { enabled_categories = _enabled_categories; };
/**
* @brief Marks/unmarks this recipient as a flow recipient, depending on the input boolean
*
* @return
*/
inline void setFlowRecipient(u_int8_t _enabled) { flow_recipient = _enabled; };
/**
* @brief Marks/unmarks this recipient as a host recipient, depending on the input boolean
*
* @return
*/
inline void setHostRecipient(u_int8_t _enabled) { host_recipient = _enabled; };
/**
* @brief Returns queue status (drops and uses)
* @param vm A Lua VM instance
*
* @return
*/
void lua(lua_State* vm);
/**
* @brief Returns queue last use
*
* @return An epoch with the last use, or 0 if never used.
*/
inline time_t get_last_use() const { return last_use; };
/**
* @brief Returns true if the recipient is a flow recipient
*
* @return A boolean
*/
inline bool isFlowRecipient() const { return flow_recipient; };
/**
* @brief Returns true if the recipient is a host recipient
*
* @return A boolean
*/
inline bool isHostRecipient() const { return host_recipient; };
};
#endif /* _RECIPIENT_QUEUES_ */