/src/ntopng/src/flow_checks/RemoteAccess.cpp
Line | Count | Source |
1 | | /* |
2 | | * |
3 | | * (C) 2013-24 - ntop.org |
4 | | * |
5 | | * |
6 | | * This program is free software; you can redistribute it and/or modify |
7 | | * it under the terms of the GNU General Public License as published by |
8 | | * the Free Software Foundation; either version 3 of the License, or |
9 | | * (at your option) any later version. |
10 | | * |
11 | | * This program is distributed in the hope that it will be useful, |
12 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | | * GNU General Public License for more details. |
15 | | * |
16 | | * You should have received a copy of the GNU General Public License |
17 | | * along with this program; if not, write to the Free Software Foundation, |
18 | | * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
19 | | * |
20 | | */ |
21 | | |
22 | | #include "ntop_includes.h" |
23 | | #include "flow_checks_includes.h" |
24 | | |
25 | | /* ***************************************************** */ |
26 | | |
27 | 0 | void RemoteAccess::protocolDetected(Flow* f) { |
28 | 0 | FlowAlertType alert_type = RemoteAccessAlert::getClassType(); |
29 | 0 | u_int8_t c_score, s_score; |
30 | 0 | risk_percentage cli_score_pctg = CLIENT_FAIR_RISK_PERCENTAGE; |
31 | 0 | Host* cli = f->get_cli_host(); |
32 | |
|
33 | 0 | switch (f->get_protocol_category()) { |
34 | 0 | case NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS: |
35 | 0 | case NDPI_PROTOCOL_CATEGORY_VPN: |
36 | 0 | case NDPI_PROTOCOL_CATEGORY_FILE_SHARING: |
37 | 0 | if (!f->isLocalToLocal()) { |
38 | | #ifdef DEBUG_REMOTE_ACCESS |
39 | | ntop->getTrace()->traceEvent( |
40 | | TRACE_WARNING, "SYN Flag %s for flow %p; flags: %u", |
41 | | (f->getTcpFlags() & TH_SYN) ? "set" : "not set", f, |
42 | | f->getTcpFlags()); |
43 | | break; |
44 | | #endif |
45 | 0 | if (cli) cli->incrRemoteAccess(); |
46 | |
|
47 | 0 | computeCliSrvScore(ntop->getFlowAlertScore(alert_type.id), |
48 | 0 | cli_score_pctg, &c_score, &s_score); |
49 | |
|
50 | 0 | FlowAlert* alert = buildAlert(f); |
51 | 0 | alert->setCliSrvScores(c_score, s_score); |
52 | 0 | f->triggerAlert(alert); |
53 | 0 | } |
54 | 0 | break; |
55 | 0 | default: |
56 | 0 | break; |
57 | 0 | } |
58 | 0 | } |
59 | | |
60 | | /* ***************************************************** */ |
61 | | |
62 | 0 | void RemoteAccess::flowEnd(Flow* f) { |
63 | 0 | Host* cli = f->get_cli_host(); |
64 | |
|
65 | 0 | switch (f->get_protocol_category()) { |
66 | 0 | case NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS: |
67 | 0 | case NDPI_PROTOCOL_CATEGORY_VPN: |
68 | 0 | case NDPI_PROTOCOL_CATEGORY_FILE_SHARING: |
69 | 0 | if (cli) cli->decrRemoteAccess(); |
70 | |
|
71 | 0 | break; |
72 | 0 | default: |
73 | 0 | break; |
74 | 0 | } |
75 | 0 | } |
76 | | |
77 | | /* ***************************************************** */ |
78 | | |
79 | 0 | FlowAlert* RemoteAccess::buildAlert(Flow* f) { |
80 | 0 | return new RemoteAccessAlert(this, f); |
81 | 0 | } |
82 | | |
83 | | /* ***************************************************** */ |