chg: [sightingdb] Added support for bulk lookups and namespacing

- aligned with the latest version of the sightingdb (support for the /rb endpoint)
- added namespacing as an option / sightingdb connection, defaults to "all" if left empty
pull/5390/head
iglocska 2019-11-08 08:24:04 +01:00
parent f9e4569e17
commit 5f25f451df
No known key found for this signature in database
GPG Key ID: BEA224F1FEF113AC
5 changed files with 55 additions and 23 deletions

View File

@ -74,7 +74,7 @@ class SightingdbController extends AppController
if (empty($this->request->data['Sightingdb'])) {
$this->request->data = array('Sightingdb' => $this->request->data);
}
$keys = array('host', 'port', 'description', 'name', 'owner', 'enabled', 'skip_proxy', 'ssl_skip_verification');
$keys = array('host', 'port', 'description', 'name', 'owner', 'enabled', 'skip_proxy', 'ssl_skip_verification', 'namespace');
foreach ($keys as $key) {
if (!empty($this->request->data['Sightingdb'][$key])) {
$existingEntry['Sightingdb'][$key] = $this->request->data['Sightingdb'][$key];

View File

@ -76,7 +76,7 @@ class AppModel extends Model
21 => false, 22 => false, 23 => false, 24 => false, 25 => false, 26 => false,
27 => false, 28 => false, 29 => false, 30 => false, 31 => false, 32 => false,
33 => false, 34 => false, 35 => false, 36 => false, 37 => false, 38 => false,
39 => false, 40 => false, 41 => false, 42 => false
39 => false, 40 => false, 41 => false, 42 => false, 43 => false
);
public $advanced_updates_description = array(
@ -1295,6 +1295,9 @@ class AppModel extends Model
INDEX `org_id` (`org_id`)
) ENGINE=InnoDB;";
break;
case 43:
$sqlArray[] = "ALTER TABLE sightingdbs ADD namespace varchar(255) DEFAULT '';";
break;
case 'fixNonEmptySharingGroupID':
$sqlArray[] = 'UPDATE `events` SET `sharing_group_id` = 0 WHERE `distribution` != 4;';
$sqlArray[] = 'UPDATE `attributes` SET `sharing_group_id` = 0 WHERE `distribution` != 4;';

View File

@ -237,28 +237,48 @@ class Sightingdb extends AppModel
'skip_proxy' => !empty($sightingdb['Sightingdb']['skip_proxy'])
);
$HttpSocket = $syncTool->createHttpSocket($params);
$payload = array('items' => array());
$namespace = empty($sightingdb['Sightingdb']['namespace']) ? 'all' : $sightingdb['Sightingdb']['namespace'];
$valueLookup = array();
foreach ($values as $k => $value) {
try {
$response = $HttpSocket->get(
sprintf(
'%s:%s/r/all?val=%s',
$host,
$port,
hash('sha256', $k)
)
);
} catch (Exception $e) {
return $values;
}
if ($response->code == 200) {
$responseData = json_decode($response->body, true);
if ($responseData !== false && empty($responseData['error'])) {
$values[$k][$sightingdb['Sightingdb']['id']] = array(
'first_seen' => $responseData['first_seen'],
'last_seen' => $responseData['last_seen'],
'count' => $responseData['count'],
'sightingdb_id' => $sightingdb['Sightingdb']['id']
);
$hashedValue = hash('sha256', $k);
$payload['items'][] = array(
'namespace' => $namespace,
'value' => $hashedValue
);
$valueLookup[$hashedValue] = $k;
}
$request = array(
'header' => array(
'Accept' => 'application/json',
'Content-Type' => 'application/json'
)
);
try {
$response = $HttpSocket->post(
sprintf(
'%s:%s/rb',
$host,
$port
),
json_encode($payload),
$request
);
} catch (Exception $e) {
return $values;
}
if ($response->code == 200) {
$responseData = json_decode($response->body, true);
if ($responseData !== false && empty($responseData['error'])) {
foreach ($responseData['items'] as $k => $item) {
if (empty($item['error'])) {
$values[$valueLookup[$item['value']]][$sightingdb['Sightingdb']['id']] = array(
'first_seen' => $item['first_seen'],
'last_seen' => $item['last_seen'],
'count' => $item['count'],
'sightingdb_id' => $sightingdb['Sightingdb']['id']
);
}
}
}
}

View File

@ -24,6 +24,10 @@
'field' => 'port',
'class' => 'input'
),
array(
'field' => 'namespace',
'class' => 'input-xxlarge'
),
array(
'field' => 'owner',
'class' => 'input-xxlarge'

View File

@ -67,6 +67,11 @@
'class' => 'short',
'data_path' => 'Sightingdb.port'
),
array(
'name' => __('Namespace'),
'sort' => 'namespace',
'data_path' => 'Sightingdb.namespace'
),
array(
'name' => __('Skip Proxy'),
'class' => 'short',