gfwleak/k18-ntcs-web-argus-service
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1、IP限流下发阀门只添加action和service;2、APP阻断、APP监测添加两个域表；IPSec监测IP类域表改为NTC_UNIVERSAL_IP；

Browse Source 
2、添加service和action关系不存在的验证；
3、添加行为识别原始日志查询接口；
This commit is contained in:
zhangdongxu
2018-07-13 12:06:34 +08:00
parent d8e736d048
commit db4bdd7722
10 changed files with 175 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

58
src/main/java/com/nis/domain/restful/DkBehaviorLog.java Normal file
View File

@@ -0,0 +1,58 @@
package com.nis.domain.restful;
import java.util.Date;
import com.nis.domain.LogEntity;
import com.wordnik.swagger.annotations.ApiModelProperty;
/**
* @ClassName:DkBehaviorLog
* @Description:TODO(这里用一句话描述这个类的作用)
* @author (zdx)
* @date 2018年7月12日 下午5:09:21
* @version V1.0
*/
public class DkBehaviorLog extends LogEntity<DkBehaviorLog> {
private static final long serialVersionUID = -589390375816690510L;
@ApiModelProperty(value = "协议标签", required = true)
protected Integer appLabel;
@ApiModelProperty(value = "c2s包数", required = true)
protected String c2sPktNum;
@ApiModelProperty(value = "s2c包数", required = true)
protected String s2cPktNum;
@ApiModelProperty(value = "c2s字节数", required = true)
protected String c2sByteNum;
@ApiModelProperty(value = "s2c字节数", required = true)
protected String s2cByteNum;
public Integer getAppLabel() {
return appLabel;
}
public void setAppLabel(Integer appLabel) {
this.appLabel = appLabel;
}
public String getC2sPktNum() {
return c2sPktNum;
}
public void setC2sPktNum(String c2sPktNum) {
this.c2sPktNum = c2sPktNum;
}
public String getS2cPktNum() {
return s2cPktNum;
}
public void setS2cPktNum(String s2cPktNum) {
this.s2cPktNum = s2cPktNum;
}
public String getC2sByteNum() {
return c2sByteNum;
}
public void setC2sByteNum(String c2sByteNum) {
this.c2sByteNum = c2sByteNum;
}
public String getS2cByteNum() {
return s2cByteNum;
}
public void setS2cByteNum(String s2cByteNum) {
this.s2cByteNum = s2cByteNum;
}
}

5
src/main/java/com/nis/restful/RestBusinessCode.java
View File

@@ -346,6 +346,11 @@ public enum RestBusinessCode {
*/
CompileIdIsNeq(4002009,"Maat配置分组与编译配置的compileId不一致"),
/**
* 配置的service与action关系不存在
*/
Service2ActionIsNull(4002010, "配置的service与action关系不存在"),
/**
* 配置分组中同一groupId出现多次
*/

5
src/main/java/com/nis/util/CompileVal.java
View File

@@ -879,6 +879,11 @@ public class CompileVal {
public static String serviceConfigCompileVal(ConfigCompile configCompile) {
Long compileId = configCompile.getCompileId();
Integer action = ServiceAndRDBIndexReal.getActionByService(configCompile.getService());
if (StringUtil.isEmpty(action)) {
businessCode = RestBusinessCode.Service2ActionIsNull.getValue();
return "编译配置id为" + compileId + "的配置中service与action的关系不存在";
}
if (action.compareTo(configCompile.getAction()) != 0) {
businessCode = RestBusinessCode.ServiceUnmatchAction.getValue();
return "编译配置id为" + compileId + "的配置中service的值为" + configCompile.getService() + "时action只能为" + action;

60
src/main/java/com/nis/web/controller/restful/LogController.java
View File

@@ -18,6 +18,7 @@ import org.springframework.web.bind.annotation.RestController;
import com.nis.domain.LogEntity;
import com.nis.domain.Page;
import com.nis.domain.restful.DkBehaviorLog;
import com.nis.domain.restful.NtcAppLog;
import com.nis.domain.restful.NtcDdosLog;
import com.nis.domain.restful.NtcDnsLog;
@@ -847,7 +848,64 @@ public class LogController extends BaseRestController {
return serviceLogResponse(auditLogThread, System.currentTimeMillis() - start, request, "DDos日志检索成功",
ntcDdosLogPage, 0);
}
@RequestMapping(value = "/dkBehaviorLogs", method = RequestMethod.GET)
@ApiOperation(value = "行为识别日志查询", httpMethod = "GET", notes = "对日志功能“行为识别”提供数据基础查询服务")
public Map<String, ?> dkBehaviorLogs(Page page, DkBehaviorLog dkBehaviorLog, Model model, HttpServletRequest request,
HttpServletResponse response) {
long start = System.currentTimeMillis();
SaveRequestLogThread auditLogThread = super.saveRequestLog(servicesRequestLogService, Constants.OPACTION_GET,
request, null);
Page<DkBehaviorLog> logPage = null;
try {
resetTime(dkBehaviorLog);
testService.queryConditionCheck(auditLogThread, start, dkBehaviorLog, DkBehaviorLog.class, page);
logPage = new Page<DkBehaviorLog>();
logPage.setPageNo(page.getPageNo());
logPage.setPageSize(page.getPageSize());
String orderBy = "";
if (null != page.getOrderBy() && !page.getOrderBy().equals("")) {
orderBy = Page.getOrderBySql(DkBehaviorLog.class.getSimpleName(), page.getOrderBy());
} else {
orderBy = "found_Time";
}
ResultSet rs = HiveSqlService.getResultSet(page, dkBehaviorLog,
Configurations.getStringProperty(DkBehaviorLog.class.getSimpleName() + "HiveTable", "DK_BEHAVIOR_LOG"),
getCol2Col(), orderBy, null);
Map<String, List> tableMapping = HiveJDBC.tableMapping(page, null, rs, DkBehaviorLog.class, "foundTime",
"recvTime");
if (tableMapping == null) {
logPage.setList(new ArrayList());
} else {
List list = tableMapping.get("obj");
// if (tableMapping.get("obj").size() > page.getPageSize()) {
// list = tableMapping.get("obj").subList(0, page.getPageSize());
// } else {
// list = tableMapping.get("obj").subList(0, tableMapping.get("obj").size());
// }
if (list.size() > 0) {
String jsonString = JsonMapper.toJsonString(list);
List<DkBehaviorLog> List = (java.util.List<DkBehaviorLog>) JsonMapper.fromJsonList(jsonString,
NtcDdosLog.class);
logPage.setList(List);
logPage.setCount(List.size());
} else {
logPage.setList(new ArrayList());
}
}
} catch (Exception e) {
e.printStackTrace();
auditLogThread.setExceptionInfo(e.getMessage() + " " + e.getCause());
logger.error(e);
if (!(e instanceof RestServiceException)) {
e = new RestServiceException(auditLogThread, System.currentTimeMillis() - start, "行为识别日志检索失败");
}
throw ((RestServiceException) e);
}
return serviceLogResponse(auditLogThread, System.currentTimeMillis() - start, request, "行为识别日志检索成功",
logPage, 0);
}
@RequestMapping(value = "/ntcPzReport", method = RequestMethod.GET)
@ApiOperation(value = "配置日志总量统计", httpMethod = "GET", notes = "配置命中日志数量实时统计报表，对外提供多种数据表现形式，具体可应用于界面配置命中总量业务、配置报表业务等")
public Map<String, ?> ntcPzReport(Page page, NtcPzReport ntcPzReport, Model model, HttpServletRequest request,

25
src/main/java/com/nis/web/dao/DfLogSearchDao.xml
View File

@@ -354,7 +354,30 @@
<result column="attack_total_byte" jdbcType="VARCHAR" property="attackTotalByte" />
<result column="is_blcok" jdbcType="INTEGER" property="isBlcok" />
</resultMap>
<resultMap id="DkBehaviorLogMap" type="com.nis.domain.restful.DkBehaviorLog">
<result column="cfg_id" jdbcType="BIGINT" property="cfgId" />
<result column="found_Time" jdbcType="TIMESTAMP" property="foundTime" />
<result column="recv_Time" jdbcType="TIMESTAMP" property="recvTime" />
<result column="trans_proto" jdbcType="VARCHAR" property="transProto" />
<result column="addr_type" jdbcType="INTEGER" property="addrType" />
<result column="d_ip" jdbcType="VARCHAR" property="dIp" />
<result column="s_ip" jdbcType="VARCHAR" property="sIp" />
<result column="d_port" jdbcType="VARCHAR" property="dPort" />
<result column="s_port" jdbcType="VARCHAR" property="sPort" />
<result column="service" jdbcType="INTEGER" property="service" />
<result column="entrance_id" jdbcType="BIGINT" property="entranceId" />
<result column="device_id" jdbcType="INTEGER" property="deviceId" />
<result column="direction" jdbcType="INTEGER" property="direction" />
<result column="stream_dir" jdbcType="INTEGER" property="streamDir" />
<result column="cap_ip" jdbcType="VARCHAR" property="capIp" />
<result column="addr_list" jdbcType="VARCHAR" property="addrList" />
<result column="user_region" jdbcType="VARCHAR" property="userRegion" />
<result column="c2s_pkt_num" jdbcType="VARCHAR" property="c2sPktNum" />
<result column="s2c_pkt_num" jdbcType="VARCHAR" property="s2cPktNum" />
<result column="c2s_byte_num" jdbcType="VARCHAR" property="c2sByteNum" />
<result column="s2c_byte_num" jdbcType="VARCHAR" property="s2cByteNum" />
</resultMap>
</mapper>

10
src/main/java/com/nis/web/service/restful/ConfigSourcesService.java
View File

@@ -1246,6 +1246,7 @@ public class ConfigSourcesService extends BaseService {
if (!"ok".equals(msg)) {
logger1.error(msg);
thread.setExceptionInfo(msg + sb.toString());
thread.setBusinessCode(CompileVal.getBusinessCode());
throw new RestServiceException(thread,
System.currentTimeMillis() - start, msg
+ sb.toString(),
@@ -1550,7 +1551,7 @@ public class ConfigSourcesService extends BaseService {
} catch (Exception e) {
// TODO: handle exception
msgList.add(e);
CompileVal.setBusinessCode(RestBusinessCode.unknow_error.getValue());
//CompileVal.setBusinessCode(RestBusinessCode.unknow_error.getValue());
return "error";
}
try {
@@ -2950,7 +2951,7 @@ public class ConfigSourcesService extends BaseService {
Integer action = null;
for (CommonSourceFieldCfg commonSourceFieldCfg : commonSourceFieldCfgList) {
if (commonSourceFieldCfg.getDstName().equals("ip_type")) {
if (commonSourceFieldCfg.getDstName().equals("addr_type")) {
String dstVal = srcMap.get(
commonSourceFieldCfg.getSrcName()).toString();
ipTypeName = commonSourceFieldCfg.getSrcName();
@@ -2996,6 +2997,9 @@ public class ConfigSourcesService extends BaseService {
}
}
}
if (ipType==null) {
ipType = 4;
}
for (CommonSourceFieldCfg commonSourceFieldCfg : commonSourceFieldCfgList) {
// 是否必填
if (commonSourceFieldCfg.getIsRequired()
@@ -3055,7 +3059,7 @@ public class ConfigSourcesService extends BaseService {
RestBusinessCode.MastDate.getValue());
}
break;
case "Ip":
case "IP":
if (!BasicProvingUtil.isIpOrIpMask(dstStr, ipType)) {
logger1.error(commonSourceFieldCfg.getSrcName()
+ "参数格式不正确或与" + ipTypeName + "不一致");