prewikka/master: Improve port/protocol filtering.

commit 4a0f93d9fda8d9ebf37df91315c9f73f684b1669
Author: Yoann Vandoorselaere <[email protected]>
Date:   Tue Jun 2 11:14:24 2009 +0200

    Improve port/protocol filtering.
    
    Clicking on a port / protocol now trigger a CSS menu allowing to filter
    on the port and protocol information, or to get information concerning
    this port / protocol.


========================================

 prewikka/templates/AlertListing.tmpl |   34 +++++++++++++++-------------------
 prewikka/views/alertlisting.py       |   31 +++++++++++++++++++++++++++----
 2 files changed, 42 insertions(+), 23 deletions(-)

========================================

diff --git a/prewikka/templates/AlertListing.tmpl b/prewikka/templates/AlertListing.tmpl
index 9ad1de1..fe954e5 100644
--- a/prewikka/templates/AlertListing.tmpl
+++ b/prewikka/templates/AlertListing.tmpl
@@ -736,6 +736,18 @@ function ${type}_set_filter_saved() {
 #end if
 #end def
 
+#def writeService($hstr, $direction)
+#if $direction.service.value != None#$hstr<a class="popup_menu_toggle">$str($direction.service.value)#end if
+</a>
+       <span class="popup_menu">
+        #filter Filter - $writeInlineFilter($direction.service, $_("Filter on this port/protocol"))<br/> #end filter
+        #if $direction.port.value
+        - <a target="$prewikka.external_link_target" href="https://www.prelude-ids.com/port_details.php?port=$str($direction.port.value)&amp;protocol=$direction.protocol.value.upper()">$_("Port/protocol information")</a>
+        #else
+        - <span>$_("Port/protocol information")</span>
+        #end if
+       </span>#slurp
+#end def
 
 #block message_fields
 #filter CleanOutput
@@ -802,14 +814,6 @@ function ${type}_set_filter_saved() {
       #end if
 
       #set $need_hr = 1
-      #set $service = ""
-      #set $proto_param = ""
-      #set $proto_str = ""
-
-      #if $direction.protocol.value != None
-       #set $proto_str = $direction.protocol.value.lower()
-       #set $proto_param = "&amp;protocol=" + $direction.protocol.value.upper()
-      #end if
 
       #for $address in $direction.addresses
        <a class="popup_menu_toggle">$address.hostname</a><span class="popup_menu">
@@ -824,20 +828,12 @@ function ${type}_set_filter_saved() {
           #end for
        #end if
        </span>#slurp
-#if $direction.service.value != None#:<a target="$prewikka.external_link_target" href="https://www.prelude-ids.com/port_details.php?port=$str($direction.service.value)$proto_param">$str($direction.service.value)#slurp
-         #if $proto_str
-/$proto_str</a>
-         #else
-</a>
-         #end if
-       #elif $proto_str
-:$proto_str
-       #end if
+#filter Filter $writeService(":", $direction) #end filter
 <br />
       #end for
 
-      #if $len($direction.addresses) == 0 and $service
-        service: $service[1:]
+      #if $len($direction.addresses) == 0
+        #filter Filter $writeService("service:", $direction) #end filter
       #end if
 
      #set $cnt = 0
diff --git a/prewikka/views/alertlisting.py b/prewikka/views/alertlisting.py
index bf96d82..0fb535c 100644
--- a/prewikka/views/alertlisting.py
+++ b/prewikka/views/alertlisting.py
@@ -386,8 +386,9 @@ class ListedAlert(ListedMessage):
         dataset[name] = value
 
     def _initDirection(self, dataset):
+        self._initValue(dataset, "port", { "value": None })
         self._initValue(dataset, "protocol", { "value": None })
-        self._initValue(dataset, "service", { "value": None })
+        self._initValue(dataset, "service", { "value": None, "inline_filter": None, "already_filtered": False })
         self._initValue(dataset, "addresses", [ ])
         self._initValue(dataset, "listed_values", [ ])
         self._initValue(dataset, "aggregated_hidden", 0)
@@ -476,19 +477,41 @@ class ListedAlert(ListedMessage):
         self._setMessageDirectionOther(dataset, direction, "alert.%s.process.name" % direction, obj["process.name"],
                                                            "alert.%s.process.pid" % direction, extra=obj["process.pid"])
 
+        pl = []
+        vl = []
+
         proto = None
         if obj["service.iana_protocol_name"]:
             proto = obj["service.iana_protocol_name"]
+            ppath = "alert.%s.service.iana_protocol_name" % direction
+            pl.append("alert.%s.service.iana_protocol_name" % direction)
+            vl.append(proto)
 
         elif obj["service.iana_protocol_number"]:
             num = obj["service.iana_protocol_number"]
             proto = utils.protocol_number_to_name(num)
+            pl.append("alert.%s.service.iana_protocol_number" % direction)
+            vl.append(num)
 
-        if not proto:
+        if not proto and obj["service.protocol"]:
             proto = obj["service.protocol"]
-
+            pl.append("alert.%s.service.protocol" % direction)
+            vl.append(proto)
+
+        pstr = None
+        if proto or obj["service.port"]:
+            if obj["service.port"]:
+                pl.append("alert.%s.service.port" % direction)
+                vl.append(obj["service.port"])
+                pstr = str(obj["service.port"])
+                if proto:
+                    pstr += "/" + proto
+            elif proto:
+                pstr = proto
+
+        dataset["service"] = self.createInlineFilteredField(pl, vl, direction, real_value=pstr)
         self._setMainAndExtraValues(dataset, "protocol", proto, None)
-        self._setMainAndExtraValues(dataset, "service", obj["service.port"], None)
+        self._setMainAndExtraValues(dataset, "port", obj["service.port"], None)
 
         dataset["files"] = []
 
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog