gfwleak/enderbyendera-realtime-protection
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1、修改一些告警信息模板匹配的bug

Browse Source
This commit is contained in:
Hao Miao
2024-04-01 15:48:11 +08:00
parent 22ada4590e
commit 0ea3fe40c7
4 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/realtime/protection/configuration/entity/task/TaskCommandInfo.java
View File

@@ -97,7 +97,7 @@ public class TaskCommandInfo {
@Schema(description = "防御策略模板ID", accessMode = Schema.AccessMode.READ_ONLY)
private Integer templateId;
@Schema(description = "防护等级", accessMode = Schema.AccessMode.READ_ONLY)
@Schema(description = "防护等级,1代表low、2代表medium、3代表high", accessMode = Schema.AccessMode.READ_ONLY)
private Integer protectLevel;
@Schema(description = "指令所属任务的运行状态", accessMode = Schema.AccessMode.READ_ONLY)

9
src/main/java/com/realtime/protection/server/alertmessage/AlertMessageService.java
View File

@@ -158,6 +158,7 @@ public class AlertMessageService {
}
CommunicateObject protectObject;
CommunicateObject peer;
//0代表命中防护对象在告警信息的源ip
if (protectIsSrcOrDst == 0) {
protectObject = new CommunicateObject(
fiveTupleWithMask.getSourceIP(),
@@ -211,8 +212,8 @@ public class AlertMessageService {
command1.setMaskSourcePort(peer.getMaskPort());
command1.setDestinationIP(protectObject.getIP());
command1.setMaskDestinationIP(protectObject.getMaskIP());
command1.setSourcePort(protectObject.getPort());
command1.setMaskSourcePort(protectObject.getMaskPort());
command1.setDestinationPort(protectObject.getPort());
command1.setMaskDestinationPort(protectObject.getMaskPort());
if (templateProtectLevel.getHasProtocol()){
command1.setProtocol(fiveTupleWithMask.getProtocol());
command1.setProtocol(fiveTupleWithMask.getMaskProtocol());
@@ -229,8 +230,8 @@ public class AlertMessageService {
command2.setDestinationIP(peer.getIP());
command2.setMaskDestinationIP(peer.getMaskIP());
command2.setSourcePort(peer.getPort());
command2.setMaskSourcePort(peer.getMaskPort());
command2.setDestinationPort(peer.getPort());
command2.setMaskDestinationPort(peer.getMaskPort());
if (templateProtectLevel.getHasProtocol()){
command2.setProtocol(fiveTupleWithMask.getProtocol());
command2.setProtocol(fiveTupleWithMask.getMaskProtocol());

4
src/main/resources/mappers/AlertMessageMapper.xml
View File

@@ -32,6 +32,7 @@
<result column="has_protocol" property="hasProtocol"/>
<result column="has_url" property="hasURL"/>
<result column="has_dns" property="hasDNS"/>
<result column="is_full_flow" property="isFullFlow"/>
</resultMap>
<resultMap id="alertMessageMap" type="com.realtime.protection.configuration.entity.alert.AlertMessage">
@@ -113,7 +114,8 @@
t_protect_level.has_peer_port,
t_protect_level.has_protocol,
t_protect_level.has_url,
t_protect_level.has_dns
t_protect_level.has_dns,
t_protect_level.is_full_flow
FROM t_strategy_template
<if test="protectLevel == 1">
left join t_protect_level on t_strategy_template.strategy_template_low_level_id = t_protect_level.protect_level_id

12
src/test/java/com/realtime/protection/server/alertmessage/AlertMessageTest.java
View File

@@ -56,7 +56,7 @@ public class AlertMessageTest {
object.setDynamicRuleFrequency(1);
object.setDynamicRulePriority(1);
object.setDynamicRuleRange("北京");
object.setDynamicRuleProtectLevel(2);
object.setDynamicRuleProtectLevel(1);
object.setTemplateId(templates.get(0).getTemplateId());
object.setProtectObjectIds(List.of(new Integer[]{protectObject.get(0).getProtectObjectId()}));
Integer dynamicRuleId = dynamicRuleService.newDynamicRuleObject(object);
@@ -75,6 +75,7 @@ public class AlertMessageTest {
task.setTaskCreateDepart("xxx");
task.setDynamicRuleIds(List.of(new Integer[]{dynamicRuleId}));
Long taskId = taskService.newTask(task);
System.out.println(taskId);
//审核状态
taskService.changeTaskAuditStatus(taskId, 2);
//启动任务
@@ -83,16 +84,17 @@ public class AlertMessageTest {
for (int i = 0 ; i< 10; i++) {
AlertMessage alert = new AlertMessage();
FiveTupleWithMask fiveTupleWithMask = new FiveTupleWithMask();
fiveTupleWithMask.setSourceIP("1.1.1." + i);
fiveTupleWithMask.setDestinationIP("2.2.2." + i);
fiveTupleWithMask.setSourcePort("80");
fiveTupleWithMask.setDestinationPort("80");
fiveTupleWithMask.setSourceIP("111.1.1." + i);
fiveTupleWithMask.setDestinationIP("222.22.2." + i);
fiveTupleWithMask.setSourcePort("111");
fiveTupleWithMask.setDestinationPort("222");
fiveTupleWithMask.setProtocol("tcp");
alert.setDynamicRuleId(dynamicRuleId);
alert.setTaskId(taskId);
alert.setFiveTupleWithMask(fiveTupleWithMask);
alert.setContent("testcontent");
alert.setProtectIsSrcOrDst(1);
alertMessageService.processAlertMessage(alert);
}