Added additional (minimalistic) detection information to flow updates.

This will only affect flows with the state `FT_FINISHED' (detection done).

 * nDPIsrvd.py: force use of JSON schema Draft 7 validator
 * flow-dash.py: gather/use total processed layer4 payload size
 * flow-info.py: added additional event filter
 * flow-info.py: prettified flow events printing whose detection is in progress
 * py-semantic-validation.py: added validation checks for FT_FINISHED
 * updated flow event JSON schema

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
This commit is contained in:
Toni Uhlig
2022-02-04 00:32:04 +01:00
parent f9e4c58854
commit 6fd6dff14d
253 changed files with 25007 additions and 24891 deletions

View File

@@ -170,12 +170,13 @@ class FlowManager:
json_dict['daemon_event_name'].lower() == 'shutdown':
# invalidate all existing flows with that alias/source
for flow_id in instance.flows:
flow = instance.flows.pop(flow_id)
flow = instance.flows[flow_id]
if json_dict['daemon_event_name'].lower() == 'init':
flow.cleanup_reason = FlowManager.CLEANUP_REASON_DAEMON_INIT
else:
flow.cleanup_reason = FlowManager.CLEANUP_REASON_DAEMON_SHUTDOWN
flows[flow_id] = flow
instance.flows = dict()
del self.instances[instance.alias][instance.source]
elif 'flow_event_name' in json_dict and \
@@ -434,16 +435,28 @@ def validateAgainstSchema(json_dict):
import jsonschema
if 'packet_event_id' in json_dict:
jsonschema.validate(instance=json_dict, schema=schema['packet_event_schema'])
try:
jsonschema.Draft7Validator(schema=schema['packet_event_schema']).validate(instance=json_dict)
except AttributeError:
jsonschema.validate(instance=json_dict, schema=schema['packet_event_schema'])
return True
if 'basic_event_id' in json_dict:
jsonschema.validate(instance=json_dict, schema=schema['basic_event_schema'])
try:
jsonschema.Draft7Validator(schema=schema['basic_event_schema']).validate(instance=json_dict)
except AttributeError:
jsonschema.validate(instance=json_dict, schema=schema['basic_event_schema'])
return True
if 'daemon_event_id' in json_dict:
jsonschema.validate(instance=json_dict, schema=schema['daemon_event_schema'])
try:
jsonschema.Draft7Validator(schema=schema['daemon_event_schema']).validate(instance=json_dict)
except AttributeError:
jsonschema.validate(instance=json_dict, schema=schema['daemon_event_schema'])
return True
if 'flow_event_id' in json_dict:
jsonschema.validate(instance=json_dict, schema=schema['flow_event_schema'])
try:
jsonschema.Draft7Validator(schema=schema['flow_event_schema']).validate(instance=json_dict)
except AttributeError:
jsonschema.validate(instance=json_dict, schema=schema['flow_event_schema'])
return True
return False