74 lines
3.2 KiB
Java
74 lines
3.2 KiB
Java
package com.realtime.protection.server.alertmessage;
|
||
|
||
import com.realtime.protection.configuration.entity.defense.template.ProtectLevel;
|
||
import com.realtime.protection.configuration.entity.rule.dynamicrule.AlertMessage;
|
||
import com.realtime.protection.configuration.entity.task.FiveTupleWithMask;
|
||
import com.realtime.protection.configuration.entity.task.TaskCommandInfo;
|
||
import com.realtime.protection.configuration.utils.enums.StateEnum;
|
||
import com.realtime.protection.server.command.CommandService;
|
||
import com.realtime.protection.server.task.TaskService;
|
||
import org.springframework.stereotype.Service;
|
||
|
||
@Service
|
||
public class AlertMessageService {
|
||
private final CommandService commandService;
|
||
private final AlertMessageMapper alertMessageMapper;
|
||
private final TaskService taskService;
|
||
|
||
public AlertMessageService(CommandService commandService,TaskService taskService,
|
||
AlertMessageMapper alertMessageMapper) {
|
||
this.commandService = commandService;
|
||
this.taskService = taskService;
|
||
this.alertMessageMapper = alertMessageMapper;
|
||
}
|
||
|
||
public void processAlertMessage(AlertMessage alertMessage) {
|
||
Long taskId = alertMessage.getTaskId();
|
||
//检查task status是否为running？
|
||
Integer taskStatus = taskService.queryTaskStatus(taskId);
|
||
Integer temp = StateEnum.RUNNING.getStateNum();
|
||
// if (taskStatus != StateEnum.RUNNING.getStateNum()) {
|
||
// return;
|
||
// }
|
||
|
||
//查task信息,和alertMessage中的fiveTuple信息 合并成 TaskCommandInfo
|
||
TaskCommandInfo dynamicTaskCommandInfo = alertMessageMapper.getDynamicTaskInfos(taskId);
|
||
|
||
//根据策略模板更新五元组
|
||
ProtectLevel templateProtectLevel = alertMessageMapper.queryTemplateProtectLevel(
|
||
dynamicTaskCommandInfo.getTemplateId(),
|
||
dynamicTaskCommandInfo.getProtectLevel(),
|
||
alertMessage.getFiveTupleWithMask());
|
||
updateFiveTupleWithMask(alertMessage.getFiveTupleWithMask(), templateProtectLevel);
|
||
dynamicTaskCommandInfo.setFiveTupleWithMask(alertMessage.getFiveTupleWithMask());
|
||
|
||
// command入库
|
||
commandService.createCommand(dynamicTaskCommandInfo);
|
||
|
||
}
|
||
|
||
private void updateFiveTupleWithMask(FiveTupleWithMask alertMessageFiveTupleW, ProtectLevel templateProtectLevel) {
|
||
if(!templateProtectLevel.getHasProtectObjectIP()){
|
||
alertMessageFiveTupleW.setDestinationIP(null);
|
||
alertMessageFiveTupleW.setMaskDestinationIP(null);
|
||
}
|
||
if(!templateProtectLevel.getHasProtectObjectPort()){
|
||
alertMessageFiveTupleW.setDestinationPort(null);
|
||
alertMessageFiveTupleW.setMaskDestinationPort(null);
|
||
}
|
||
if(!templateProtectLevel.getHasPeerIP()){
|
||
alertMessageFiveTupleW.setSourceIP(null);
|
||
alertMessageFiveTupleW.setMaskSourceIP(null);
|
||
}
|
||
if(!templateProtectLevel.getHasPeerPort()){
|
||
alertMessageFiveTupleW.setSourcePort(null);
|
||
alertMessageFiveTupleW.setMaskSourcePort(null);
|
||
}
|
||
if (!templateProtectLevel.getHasProtocol()) {
|
||
alertMessageFiveTupleW.setProtocol(null);
|
||
alertMessageFiveTupleW.setMaskProtocol(null);
|
||
}
|
||
//目前告警信息还只是五元组，没有url、dns
|
||
}
|
||
}
|