From 7fdac071d8c3c351b6381bc670961c47db8dc0fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20K=C3=A1cha?= <ph@cesnet.cz> Date: Fri, 18 Feb 2022 17:21:19 +0100 Subject: [PATCH] Mitigate too big Idea events (close context if too big) --- contrib/connectors/hp-labrea/labrea-idea.py | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/contrib/connectors/hp-labrea/labrea-idea.py b/contrib/connectors/hp-labrea/labrea-idea.py index a5316e1..f8b323a 100755 --- a/contrib/connectors/hp-labrea/labrea-idea.py +++ b/contrib/connectors/hp-labrea/labrea-idea.py @@ -34,6 +34,9 @@ class WindowContextMgr(object): self.ideagen = ideagen self.first_update_queue = OrderedDict() self.last_update_queue = OrderedDict() + # Hammer to mitigate too big events + self.max_count = 2000 + self.max_src_ports = 1024 def expire_queue(self, queue, window): aggr_events = [] @@ -68,9 +71,16 @@ class WindowContextMgr(object): self.first_update_queue[ctx] = self.update_timestamp self.last_update_queue[ctx] = self.update_timestamp else: - self.ctx_append(self.contexts[ctx], event) - del self.last_update_queue[ctx] - self.last_update_queue[ctx] = self.update_timestamp + if not self.ctx_append(self.contexts[ctx], event): + closed = self.ctx_close(self.contexts[ctx]) + if closed is not None: + aggr_events.append(closed) + del self.contexts[ctx] + del self.first_update_queue[ctx] + del self.last_update_queue[ctx] + else: + del self.last_update_queue[ctx] + self.last_update_queue[ctx] = self.update_timestamp return aggr_events @@ -107,6 +117,7 @@ class PingContextMgr(WindowContextMgr): ctx["tgt_ips"].add(event.tgt_ip) ctx["count"] += 1 ctx["last_update"] = self.update_timestamp + return ctx["count"] < self.max_count def ctx_close(self, ctx): return self.ideagen.gen_idea( @@ -143,11 +154,13 @@ class ConnectContextMgr(WindowContextMgr): ctx["src_ports"].add(event.src_port) ctx["count"] += 1 ctx["last_update"] = self.update_timestamp + return ctx["count"] < self.max_count def ctx_close(self, ctx): + src_ports = ctx["src_ports"] if len(ctx["src_ports"]) <= self.max_src_ports else None return self.ideagen.gen_idea( src=ctx["src_ip"], - src_ports=ctx["src_ports"], + src_ports=src_ports, targets=ctx["tgt_ips_ports"].items(), detect_time=self.update_timestamp, event_time=ctx["first_update"], -- GitLab