Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed maxdur to include incoming connections #517

Merged
merged 2 commits into from
Dec 3, 2019
Merged

Fixed maxdur to include incoming connections #517

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4a3b509
fixed maxdur to include incoming connections
lisaSW Nov 26, 2019
f547676
ethan helped me fix a dumb bug where I was updating max dur to the la…
lisaSW Dec 3, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 19 additions & 11 deletions pkg/uconn/analyzer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,8 +114,13 @@ func (a *analyzer) start() {
output.uconn.selector = bson.M{"src": data.Src, "dst": data.Dst}

// get maxdur host table update
// since we are only updating stats for internal ips (as defined by the
// user in the file), we need to customize the query to update based on
// which ip in the connection was local.
if data.IsLocalSrc == true {
output.hostMaxDur = a.hostMaxDurQuery(data.MaxDuration, data.Src, data.Dst)
} else if data.IsLocalDst {
output.hostMaxDur = a.hostMaxDurQuery(data.MaxDuration, data.Dst, data.Src)
}

// set to writer channel
Expand All @@ -126,7 +131,7 @@ func (a *analyzer) start() {
}()
}

func (a *analyzer) hostMaxDurQuery(maxDur float64, src string, dst string) updateInfo {
func (a *analyzer) hostMaxDurQuery(maxDur float64, localIP string, externalIP string) updateInfo {
ssn := a.db.Session.Copy()
defer ssn.Close()

Expand All @@ -142,17 +147,19 @@ func (a *analyzer) hostMaxDurQuery(maxDur float64, src string, dst string) updat
var resListExactMatch []interface{}

maxDurMatchExactQuery := bson.M{
"ip": src,
"dat.mddst": dst,
"ip": localIP,
"dat": bson.M{"$elemMatch": bson.M{"mdip": externalIP, "max_duration": bson.M{"$lte": maxDur}}},
}

_ = ssn.DB(a.db.GetSelectedDB()).C(a.conf.T.Structure.HostTable).Find(maxDurMatchExactQuery).All(&resListExactMatch)

// if we have exact matches, update to new score and return
if len(resListExactMatch) > 0 {

// update chunk number
query["$set"] = bson.M{
"dat.$.max_duration": maxDur,
"dat.$.mddst": dst,
"dat.$.cid": a.chunk,
"dat.$.max_duration": maxDur,
}

// create selector for output
Expand All @@ -177,15 +184,15 @@ func (a *analyzer) hostMaxDurQuery(maxDur float64, src string, dst string) updat
// this query will find any matching chunk that is reporting a lower
// max beacon score than the current one we are working with
maxDurMatchLowerQuery := bson.M{
"ip": src,
"ip": localIP,
"dat": bson.M{"$elemMatch": bson.M{
"cid": a.chunk,
"max_duration": bson.M{"$lte": maxDur},
}},
}

maxDurMatchUpperQuery := bson.M{
"ip": src,
"ip": localIP,
"dat": bson.M{"$elemMatch": bson.M{
"cid": a.chunk,
"max_duration": bson.M{"$gte": maxDur},
Expand All @@ -200,6 +207,7 @@ func (a *analyzer) hostMaxDurQuery(maxDur float64, src string, dst string) updat

// find matching upper chunks
_ = ssn.DB(a.db.GetSelectedDB()).C(a.conf.T.Structure.HostTable).Find(maxDurMatchUpperQuery).All(&resListUpper)

// update if no upper chunks are found
if !(len(resListUpper) > 0) {
newFlag = true
Expand All @@ -208,7 +216,7 @@ func (a *analyzer) hostMaxDurQuery(maxDur float64, src string, dst string) updat
updateFlag = true
}

// since we didn't find any changeable lower max beacon scores, we will
// since we didn't find any changeable lower max duration scores, we will
// set the condition to push a new entry with the current score listed as the
// max beacon ONLY if no matching chunks reporting higher max beacon scores
// are found.
Expand All @@ -218,18 +226,18 @@ func (a *analyzer) hostMaxDurQuery(maxDur float64, src string, dst string) updat
query["$push"] = bson.M{
"dat": bson.M{
"max_duration": maxDur,
"mddst": dst,
"mdip": externalIP,
"cid": a.chunk,
}}

// create selector for output
output.query = query
output.selector = bson.M{"ip": src}
output.selector = bson.M{"ip": localIP}

} else if updateFlag {
query["$set"] = bson.M{
"dat.$.max_duration": maxDur,
"dat.$.mddst": dst,
"dat.$.mdip": externalIP,
"dat.$.cid": a.chunk,
}

Expand Down