diff --git a/src/main/java/com/nis/domain/restful/DkBehaviorLog.java b/src/main/java/com/nis/domain/restful/DkBehaviorLog.java new file mode 100644 index 0000000..1ae9d07 --- /dev/null +++ b/src/main/java/com/nis/domain/restful/DkBehaviorLog.java @@ -0,0 +1,58 @@ +package com.nis.domain.restful; + +import java.util.Date; + +import com.nis.domain.LogEntity; +import com.wordnik.swagger.annotations.ApiModelProperty; + +/** + * @ClassName:DkBehaviorLog + * @Description:TODO(这里用一句话描述这个类的作用) + * @author (zdx) + * @date 2018年7月12日 下午5:09:21 + * @version V1.0 + */ +public class DkBehaviorLog extends LogEntity { + private static final long serialVersionUID = -589390375816690510L; + @ApiModelProperty(value = "协议标签", required = true) + protected Integer appLabel; + @ApiModelProperty(value = "c2s包数", required = true) + protected String c2sPktNum; + @ApiModelProperty(value = "s2c包数", required = true) + protected String s2cPktNum; + @ApiModelProperty(value = "c2s字节数", required = true) + protected String c2sByteNum; + @ApiModelProperty(value = "s2c字节数", required = true) + protected String s2cByteNum; + public Integer getAppLabel() { + return appLabel; + } + public void setAppLabel(Integer appLabel) { + this.appLabel = appLabel; + } + public String getC2sPktNum() { + return c2sPktNum; + } + public void setC2sPktNum(String c2sPktNum) { + this.c2sPktNum = c2sPktNum; + } + public String getS2cPktNum() { + return s2cPktNum; + } + public void setS2cPktNum(String s2cPktNum) { + this.s2cPktNum = s2cPktNum; + } + public String getC2sByteNum() { + return c2sByteNum; + } + public void setC2sByteNum(String c2sByteNum) { + this.c2sByteNum = c2sByteNum; + } + public String getS2cByteNum() { + return s2cByteNum; + } + public void setS2cByteNum(String s2cByteNum) { + this.s2cByteNum = s2cByteNum; + } + +} diff --git a/src/main/java/com/nis/restful/RestBusinessCode.java b/src/main/java/com/nis/restful/RestBusinessCode.java index 312d823..f1b1192 100644 --- a/src/main/java/com/nis/restful/RestBusinessCode.java +++ b/src/main/java/com/nis/restful/RestBusinessCode.java @@ -346,6 +346,11 @@ public enum RestBusinessCode { */ CompileIdIsNeq(4002009,"Maat配置分组与编译配置的compileId不一致"), + /** + * 配置的service与action关系不存在 + */ + Service2ActionIsNull(4002010, "配置的service与action关系不存在"), + /** * 配置分组中同一groupId出现多次 */ diff --git a/src/main/java/com/nis/util/CompileVal.java b/src/main/java/com/nis/util/CompileVal.java index cff5591..2c3f157 100644 --- a/src/main/java/com/nis/util/CompileVal.java +++ b/src/main/java/com/nis/util/CompileVal.java @@ -879,6 +879,11 @@ public class CompileVal { public static String serviceConfigCompileVal(ConfigCompile configCompile) { Long compileId = configCompile.getCompileId(); Integer action = ServiceAndRDBIndexReal.getActionByService(configCompile.getService()); + if (StringUtil.isEmpty(action)) { + businessCode = RestBusinessCode.Service2ActionIsNull.getValue(); + return "编译配置id为" + compileId + "的配置中service与action的关系不存在"; + } + if (action.compareTo(configCompile.getAction()) != 0) { businessCode = RestBusinessCode.ServiceUnmatchAction.getValue(); return "编译配置id为" + compileId + "的配置中service的值为" + configCompile.getService() + "时action只能为" + action; diff --git a/src/main/java/com/nis/web/controller/restful/LogController.java b/src/main/java/com/nis/web/controller/restful/LogController.java index eadf2d9..dbfb891 100644 --- a/src/main/java/com/nis/web/controller/restful/LogController.java +++ b/src/main/java/com/nis/web/controller/restful/LogController.java @@ -18,6 +18,7 @@ import org.springframework.web.bind.annotation.RestController; import com.nis.domain.LogEntity; import com.nis.domain.Page; +import com.nis.domain.restful.DkBehaviorLog; import com.nis.domain.restful.NtcAppLog; import com.nis.domain.restful.NtcDdosLog; import com.nis.domain.restful.NtcDnsLog; @@ -847,7 +848,64 @@ public class LogController extends BaseRestController { return serviceLogResponse(auditLogThread, System.currentTimeMillis() - start, request, "DDos日志检索成功", ntcDdosLogPage, 0); } - + @RequestMapping(value = "/dkBehaviorLogs", method = RequestMethod.GET) + @ApiOperation(value = "行为识别日志查询", httpMethod = "GET", notes = "对日志功能“行为识别”提供数据基础查询服务") + public Map dkBehaviorLogs(Page page, DkBehaviorLog dkBehaviorLog, Model model, HttpServletRequest request, + HttpServletResponse response) { + long start = System.currentTimeMillis(); + SaveRequestLogThread auditLogThread = super.saveRequestLog(servicesRequestLogService, Constants.OPACTION_GET, + request, null); + + Page logPage = null; + try { + resetTime(dkBehaviorLog); + testService.queryConditionCheck(auditLogThread, start, dkBehaviorLog, DkBehaviorLog.class, page); + logPage = new Page(); + logPage.setPageNo(page.getPageNo()); + logPage.setPageSize(page.getPageSize()); + String orderBy = ""; + if (null != page.getOrderBy() && !page.getOrderBy().equals("")) { + orderBy = Page.getOrderBySql(DkBehaviorLog.class.getSimpleName(), page.getOrderBy()); + } else { + orderBy = "found_Time"; + } + ResultSet rs = HiveSqlService.getResultSet(page, dkBehaviorLog, + Configurations.getStringProperty(DkBehaviorLog.class.getSimpleName() + "HiveTable", "DK_BEHAVIOR_LOG"), + getCol2Col(), orderBy, null); + Map tableMapping = HiveJDBC.tableMapping(page, null, rs, DkBehaviorLog.class, "foundTime", + "recvTime"); + if (tableMapping == null) { + logPage.setList(new ArrayList()); + } else { + List list = tableMapping.get("obj"); +// if (tableMapping.get("obj").size() > page.getPageSize()) { +// list = tableMapping.get("obj").subList(0, page.getPageSize()); +// } else { +// list = tableMapping.get("obj").subList(0, tableMapping.get("obj").size()); +// } + if (list.size() > 0) { + String jsonString = JsonMapper.toJsonString(list); + List List = (java.util.List) JsonMapper.fromJsonList(jsonString, + NtcDdosLog.class); + logPage.setList(List); + logPage.setCount(List.size()); + + } else { + logPage.setList(new ArrayList()); + } + } + } catch (Exception e) { + e.printStackTrace(); + auditLogThread.setExceptionInfo(e.getMessage() + " " + e.getCause()); + logger.error(e); + if (!(e instanceof RestServiceException)) { + e = new RestServiceException(auditLogThread, System.currentTimeMillis() - start, "行为识别日志检索失败"); + } + throw ((RestServiceException) e); + } + return serviceLogResponse(auditLogThread, System.currentTimeMillis() - start, request, "行为识别日志检索成功", + logPage, 0); + } @RequestMapping(value = "/ntcPzReport", method = RequestMethod.GET) @ApiOperation(value = "配置日志总量统计", httpMethod = "GET", notes = "配置命中日志数量实时统计报表，对外提供多种数据表现形式，具体可应用于界面配置命中总量业务、配置报表业务等") public Map ntcPzReport(Page page, NtcPzReport ntcPzReport, Model model, HttpServletRequest request, diff --git a/src/main/java/com/nis/web/dao/DfLogSearchDao.xml b/src/main/java/com/nis/web/dao/DfLogSearchDao.xml index 4284ba6..b818b7a 100644 --- a/src/main/java/com/nis/web/dao/DfLogSearchDao.xml +++ b/src/main/java/com/nis/web/dao/DfLogSearchDao.xml @@ -354,7 +354,30 @@ - + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/main/java/com/nis/web/service/restful/ConfigSourcesService.java b/src/main/java/com/nis/web/service/restful/ConfigSourcesService.java index 3ae1d03..61142f0 100644 --- a/src/main/java/com/nis/web/service/restful/ConfigSourcesService.java +++ b/src/main/java/com/nis/web/service/restful/ConfigSourcesService.java @@ -1246,6 +1246,7 @@ public class ConfigSourcesService extends BaseService { if (!"ok".equals(msg)) { logger1.error(msg); thread.setExceptionInfo(msg + sb.toString()); + thread.setBusinessCode(CompileVal.getBusinessCode()); throw new RestServiceException(thread, System.currentTimeMillis() - start, msg + sb.toString(), @@ -1550,7 +1551,7 @@ public class ConfigSourcesService extends BaseService { } catch (Exception e) { // TODO: handle exception msgList.add(e); - CompileVal.setBusinessCode(RestBusinessCode.unknow_error.getValue()); + //CompileVal.setBusinessCode(RestBusinessCode.unknow_error.getValue()); return "error"; } try { @@ -2950,7 +2951,7 @@ public class ConfigSourcesService extends BaseService { Integer action = null; for (CommonSourceFieldCfg commonSourceFieldCfg : commonSourceFieldCfgList) { - if (commonSourceFieldCfg.getDstName().equals("ip_type")) { + if (commonSourceFieldCfg.getDstName().equals("addr_type")) { String dstVal = srcMap.get( commonSourceFieldCfg.getSrcName()).toString(); ipTypeName = commonSourceFieldCfg.getSrcName(); @@ -2996,6 +2997,9 @@ public class ConfigSourcesService extends BaseService { } } } + if (ipType==null) { + ipType = 4; + } for (CommonSourceFieldCfg commonSourceFieldCfg : commonSourceFieldCfgList) { // 是否必填 if (commonSourceFieldCfg.getIsRequired() @@ -3055,7 +3059,7 @@ public class ConfigSourcesService extends BaseService { RestBusinessCode.MastDate.getValue()); } break; - case "Ip": + case "IP": if (!BasicProvingUtil.isIpOrIpMask(dstStr, ipType)) { logger1.error(commonSourceFieldCfg.getSrcName() + "参数格式不正确或与" + ipTypeName + "不一致"); diff --git a/src/main/resources/commonSources/commonSources.xml b/src/main/resources/commonSources/commonSources.xml index 2387be0..1ca155a 100644 --- a/src/main/resources/commonSources/commonSources.xml +++ b/src/main/resources/commonSources/commonSources.xml @@ -7,10 +7,9 @@ #0x04 IP地址丢弃 4=0:INLINE_IP_CB #0x19 IPSec丢弃 25=0:INLINE_IP_CB #0x1C GRE 丢弃 28=0:INLINE_IP_CB - #0x1D IPSEC丢弃 29=0:INLINE_IP_CB #0x05 DDOS流量丢弃 5=0:DDOS_PROTECT_TARGET_IP_CB --> - + @@ -72,9 +71,11 @@ + - + + diff --git a/src/main/resources/maatXml/maat.xml b/src/main/resources/maatXml/maat.xml index 47ca227..4da1508 100644 --- a/src/main/resources/maatXml/maat.xml +++ b/src/main/resources/maatXml/maat.xml @@ -63,10 +63,9 @@ #0x04 IP地址丢弃 4=0:INLINE_IP_CB #0x19 IPSec丢弃 25=0:INLINE_IP_CB #0x1C GRE 丢弃 28=0:INLINE_IP_CB - #0x1D IPSEC丢弃 29=0:INLINE_IP_CB #0x05 DDOS流量丢弃 5=0:DDOS_PROTECT_TARGET_IP_CB --> - + EFFECTIVE_RULE;:;{un_maat_table_name};,;[cfg_id] [cfg_id];\t;[addr_type];\t;[src_ip];\t;[mask_src_ip];\t;[src_port];\t;[mask_src_port];\t;[dst_ip];\t;[mask_dst_ip];\t;[dst_port];\t;[mask_dst_port];\t;[protocol];\t;[direction];\t;[is_valid];\t;[action];\t;[service];\t;[op_time]; \n @@ -138,7 +137,7 @@ EFFECTIVE_RULE;:;{un_maat_table_name};,;[cfg_id] - [cfg_id];\t;[policy_group];\t;[addr_type];\t;[ip];\t;[port];\t;[user_region];\t;[location];\t;[is_valid];\t;[op_time]; [service];\t;[action];\n + [cfg_id];\t;[addr_type];\t;[protocol];\t;[ip];\t;[port];\t;[direction];\t;[user_region];\t;[location];\t;[is_valid];\t;[action];\t;[service];\t;[policy_group];\t;[op_time]; \n diff --git a/src/main/resources/serviceTable.properties b/src/main/resources/serviceTable.properties index f4c7075..f966c55 100644 --- a/src/main/resources/serviceTable.properties +++ b/src/main/resources/serviceTable.properties @@ -1,6 +1,6 @@ ################################################################################# ####maat格式配置各业务类型对应的编译,分组,域配置等的表名 -####1:固定需要写service=业务类型1:动作;业务类型2:动作 +####1:固定需要写service=业务类型1:动作;业务类型2:动作 （ 用于验证maat配置service与action对应关系） ####2:然后每个业务类型:业务类型1=type1:表名1;type2:表名2;type3:表名3 ####3:例如:80=10:MM_COMPILE;11:MM_GROUP;12:AV_CONT_IP_PORT ####4:type中10代表是编译配置,11代表是分组配置,12代表是ip类域配置,13代表是数值类配置,14代表是字符串类域配置,15代表是增强字符串类域配置,16代表是文件摘要类域配置,17代表是文本相似性域配置,18代表是生效范围IP段配置 @@ -56,7 +56,7 @@ service=1:128;2:128;16:16;17:16;18:16;19:16;20:16;21:16;22:16;23:16;24:16;26:16; #0X20 文件摘要配置 32=10:NTC_COMPILE;11:NTC_GROUP;16:NTC_FILE_DIGEST;18:NTC_IP_RANGE #0x21 APP阻断 -33=10:NTC_COMPILE;11:NTC_GROUP;14:APP_POLICY;18:NTC_IP_RANGE +33=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_UNIVERSAL_IP;13:NTC_UNIVERSAL_PROTO_TYPE;14:APP_POLICY;18:NTC_IP_RANGE #0x22 P2P阻断 34=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_P2P_IP;14:NTC_P2P_HASH_BIN,NTC_P2P_KEYWORDS;18:NTC_IP_RANGE @@ -79,7 +79,7 @@ service=1:128;2:128;16:16;17:16;18:16;19:16;20:16;21:16;22:16;23:16;24:16;26:16; #0x88 OpenVPN监测 136=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_UNIVERSAL_IP;13:NTC_UNIVERSAL_PROTO_TYPE;18:NTC_IP_RANGE #0x89 IPSec监测 -137=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_IP;13:NTC_UNIVERSAL_PROTO_TYPE;18:NTC_IP_RANGE +137=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_UNIVERSAL_IP;13:NTC_UNIVERSAL_PROTO_TYPE;18:NTC_IP_RANGE #0x8A SSH监测 138=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_UNIVERSAL_IP;13:NTC_UNIVERSAL_PROTO_TYPE;18:NTC_IP_RANGE #0x8B SOCKS监测 @@ -95,7 +95,7 @@ service=1:128;2:128;16:16;17:16;18:16;19:16;20:16;21:16;22:16;23:16;24:16;26:16; #0X90 文件摘要监测 144=10:NTC_COMPILE;11:NTC_GROUP;16:NTC_FILE_DIGEST;18:NTC_IP_RANGE #0x91 APP监测 -145=10:NTC_COMPILE;11:NTC_GROUP;14:APP_POLICY;18:NTC_IP_RANGE +145=10:NTC_COMPILE;11:NTC_GROUP;12:NTC_UNIVERSAL_IP;13:NTC_UNIVERSAL_PROTO_TYPE;14:APP_POLICY;18:NTC_IP_RANGE #0xA0 通联关系监测 monit 无配置 #0xA1 邮件泛收 monit 无配置 #0xA2 RADIUS泛收 monit 无配置 @@ -167,7 +167,8 @@ service=1:128;2:128;16:16;17:16;18:16;19:16;20:16;21:16;22:16;23:16;24:16;26:16; #0x422 域名限流 1058=10:LIMIT_COMPILE;11:LIMIT_GROUP;14:LIMIT_DOMAIN;18:NTC_IP_RANGE -unMaatService=3:32;4:96;5:32;25:32;28:32;29:32;64:16;65:16;261:16;262:16;263:16;264:16;265:16;266:16;389:1;390:1;391:1;392:1;393:1;394:1;832:96; +#格式：业务类型1:动作;业务类型2:动作 （ 用于验证回调类service与action对应关系） +unMaatService=3:32;4:96;5:32;25:32;28:32;64:16;65:16;261:16;262:16;263:16;264:16;265:16;266:16;389:1;390:1;391:1;392:1;393:1;394:1;832:96; #0x03 IP地址丢弃 3=0:INLINE_IP_CB @@ -180,7 +181,7 @@ unMaatService=3:32;4:96;5:32;25:32;28:32;29:32;64:16;65:16;261:16;262:16;263:16; #0x1C GRE 丢弃 28=0:INLINE_IP_CB #0x1D IPSEC丢弃 -29=0:INLINE_IP_CB +#29=0:INLINE_IP_CB #0x40 DNS欺骗配置(回调) 64=0:NTC_DNS_FAKE_IP_CB @@ -244,7 +245,7 @@ unMaatService=3:32;4:96;5:32;25:32;28:32;29:32;64:16;65:16;261:16;262:16;263:16; #0x19 IPSec丢弃 25:2,7; #0x340 IP复用地址池配置（回调）832:2,4,7 ########## -serviceDBIndex=1:2,3,4,6,7;2:2,3,4,6,7;16:2;17:2;18:2;19:2;20:2;21:2;22:2;23:2;24:2;26:2;27:2;30:2;31:2;32:2;33:2,6,7;34:2;128:2;129:2;130:2;131:2;132:2;133:2;134:2;135:2;136:2;137:2;138:2;139:2;140:2;141:2;143:2;144:2;145:2,6,7;256:3;257:3;258:3;259:3;260:3;384:3;385:3;386:3;387:3;388:3;512:4,7;513:4,2,7;528:4;529:4;544:4;545:4;560:4;561:4;768:4;848:2;1024:2,6,7;1025:2;1026:2,6,7;1027:2;1028:2,6,7;1040:2,6,7;1056:2,6,7;1057:6,7;1058:6,2,7;3:2,7;4:2,7;5:2;25:2,7;28:2,7;29:2;64:2;65:2;261:3;262:3;263:3;264:3;265:3;266:3;389:3;390:3;391:3;392:3;393:3;394:3;832:2,4,7 +serviceDBIndex=1:2,3,4,6,7;2:2,3,4,6,7;16:2;17:2;18:2;19:2;20:2;21:2;22:2;23:2;24:2;26:2;27:2;30:2;31:2;32:2;33:2,6,7;34:2;128:2;129:2;130:2;131:2;132:2;133:2;134:2;135:2;136:2;137:2;138:2;139:2;140:2;141:2;143:2;144:2;145:2,6,7;256:3;257:3;258:3;259:3;260:3;384:3;385:3;386:3;387:3;388:3;512:4,7;513:4,2,7;528:4;529:4;544:4;545:4;560:4;561:4;768:4;848:2;1024:2,6,7;1025:2;1026:2,6,7;1027:2;1028:2,6,7;1040:2,6,7;1056:2,6,7;1057:6,7;1058:6,2,7;3:2,7;4:2,7;5:2;25:2,7;28:2,7;64:2;65:2;261:3;262:3;263:3;264:3;265:3;266:3;389:3;390:3;391:3;392:3;393:3;394:3;832:2,4,7 ##maat配置入阀门需要将编译中的部分参数写到域配置中，目前最多包含ACTION，SERVICE，USER_REGION三个属性 @@ -262,5 +263,5 @@ serviceDBIndex=1:2,3,4,6,7;2:2,3,4,6,7;16:2;17:2;18:2;19:2;20:2;21:2;22:2;23:2;2 #0x420 APP限流 1056 #0x421 IP限流 1057 #0x422 域名限流 1058 -maat2Valve=33:strRegion@ACTION&SERVICE&USER_REGION;145:strRegion@ACTION&SERVICE&USER_REGION;512:ipRegion@ACTION&SERVICE;513:strRegion@ACTION&SERVICE&USER_REGION;1024:strRegion|strStrRegion@USER_REGION;1026:strRegion|strStrRegion@USER_REGION;1028:ipRegion@ACTION&SERVICE&USER_REGION;1040:strRegion@ACTION&SERVICE&USER_REGION;1056:strRegion@ACTION&SERVICE&USER_REGION;1057:ipRegion@ACTION&SERVICE&USER_REGION;1058:strRegion@ACTION&SERVICE&USER_REGION +maat2Valve=33:strRegion@ACTION&SERVICE&USER_REGION;145:strRegion@ACTION&SERVICE&USER_REGION;512:ipRegion@ACTION&SERVICE;513:strRegion@ACTION&SERVICE&USER_REGION;1024:strRegion|strStrRegion@USER_REGION;1026:strRegion|strStrRegion@USER_REGION;1028:ipRegion@USER_REGION;1040:strRegion@ACTION&SERVICE&USER_REGION;1056:strRegion@ACTION&SERVICE&USER_REGION;1057:ipRegion@ACTION&SERVICE;1058:strRegion@ACTION&SERVICE&USER_REGION diff --git a/src/main/resources/table.properties b/src/main/resources/table.properties index 5857579..52c3c4b 100644 --- a/src/main/resources/table.properties +++ b/src/main/resources/table.properties @@ -12,6 +12,8 @@ NtcSshLogHiveTable=NTC_SSH_LOG NtcFtpLogHiveTable=NTC_FTP_LOG NtcAppLogHiveTable=NTC_APP_LOG NtcDdosLogHiveTable=NTC_DDOS_LOG +DkBehaviorLogHiveTable=DK_BEHAVIOR_LOG +