Move LMS scoring from nameserver to firewall

This commit is contained in:
Patrick Pacher
2020-08-10 08:36:44 +02:00
parent b3657e17ce
commit 85e4beafa1
8 changed files with 53 additions and 42 deletions

View File

@@ -87,10 +87,10 @@ func NewConnectionFromDNSRequest(ctx context.Context, fqdn string, cnames []stri
timestamp := time.Now().Unix()
dnsConn := &Connection{
Scope: fqdn,
Entity: (&intel.Entity{
Entity: &intel.Entity{
Domain: fqdn,
CNAME: cnames,
}),
},
process: proc,
Started: timestamp,
Ended: timestamp,
@@ -123,20 +123,20 @@ func NewConnectionFromFirstPacket(pkt packet.Packet) *Connection {
default: // netutils.Invalid
scope = IncomingInvalid
}
entity = (&intel.Entity{
entity = &intel.Entity{
IP: pkt.Info().Src,
Protocol: uint8(pkt.Info().Protocol),
Port: pkt.Info().SrcPort,
})
}
} else {
// outbound connection
entity = (&intel.Entity{
entity = &intel.Entity{
IP: pkt.Info().Dst,
Protocol: uint8(pkt.Info().Protocol),
Port: pkt.Info().DstPort,
})
}
// check if we can find a domain for that IP
ipinfo, err := resolver.GetIPInfo(pkt.Info().Dst.String())