Rework the `cppcheck:` recipe so it is usable in practice:
- `--enable=all` -> `--enable=warning,performance,portability`
(drops the `style`/`information`/`unusedFunction` groups, which produced
hundreds of opinion-level hits)
- drop `--force` (was re-analyzing every file once per #ifdef combination;
single files took 40+ min). Analyzes the default build config only.
- add `-j $(shell nproc)` + `--cppcheck-build-dir=.cppcheck-build` for
parallelism and incremental caching; `mkdir -p` the cache dir in the recipe
- suppress checks that are noise for this codebase:
* useInitializationList - micro perf, POD members
* duplInheritedMember - intentional non-virtual name shadowing
(operator[], swap, enqueue, incUses, lua, ...)
* noCopyConstructor / noOperatorEq - the flagged classes
(NetworkInterface, Ntop, Flow, ...) are non-copyable by design and
always held by pointer; the fix cppcheck suggests (add operator=)
is meaningless for them
- .gitignore: ignore the new .cppcheck-build/ cache directory
FlowAlertsLoader::registerRisk (src/FlowAlertsLoader.cpp)
Missing `else`: `alert_to_risk[alert_type.id] = risk` was executed even when
`alert_type.id >= MAX_DEFINED_FLOW_ALERT_TYPE` -> out-of-bounds array write.
The sibling registerAlert() already had the `else`.
Uninitialized ndpi_protocol structs (src/NetworkInterface.cpp x6,
src/LuaEngineInterface.cpp x1)
Local `ndpi_protocol` values were only partially initialized (proto.* set,
but breed/fpc/state/category/custom_category_userdata left indeterminate)
and then passed by value to get_ndpi_full_proto_name() /
get_ndpi_proto_category(). Added `memset(&x, 0, sizeof(x))` at each
declaration, matching the existing convention elsewhere in the tree.
Uninitialized locals
- src/ParserInterface.cpp: `src2dst_direction` was read on the
`flow == NULL` path (getFlow() not called). Initialize to a defined value;
the value is not otherwise observable on that path.
- include/Bitmap.h (toHexString): if `buf_len <= 0` the first loop never
runs and `strlen(buf)` reads uninitialized memory; also `strlen(buf) - 2`
underflows (unsigned) when the string is shorter than 2 bytes. Null-
terminate up front and hoist strlen into a `size_t`, iterate with
`pos + 2 < len`.
src/NetworkInterface.cpp incNumHosts()/decNumHosts()
`if (isShuttingDown() || (!host->isUnicastHost())) return;` - the second
term is always false, the function already returned on `!isUnicastHost()`
a few lines above. Dropped it.
include/NetworkInterface.h getActiveFlowsStats()
Declaration and definition disagreed on the first two parameter *names*
(`stats, status_stats` vs `ndpi_stats, stats`); types matched. Renamed the
header params to match the implementation.
No behavioural change; each argument was already non-negative.
- Interface id (`get_id()` returns int; kept int because 3 call sites test
`== -1`) formatted with %u in redis-key macros -> cast the argument
`(u_int)` at the call site:
include/AutonomousSystem.h, include/Country.h,
include/ObservationPoint.h, include/VLAN.h,
src/BroadcastDomains.cpp (x2), src/HostPools.cpp, src/LocalHost.cpp,
src/LuaEngineInterface.cpp (x3), src/NetworkInterface.cpp (x2),
src/SyslogParserInterface.cpp
- src/HTTPserver.cpp: `%d` with get_http_port()/get_https_port() (u_int)
-> `%u`; the scanf-width builder `"%%%u[^|]..."` fed `int` macros -> `%d`
- src/Flow.cpp: `"%u.%u.%u.%u"` with `int` octets from a `%d` sscanf -> `%d`;
`%u` (arg 13) with get_protocol_category() enum -> cast `(u_int)`
- src/MacManufacturers.cpp: `int _mac[3]` scanned with `%02x`
(wants `unsigned int*`) -> declare `u_int _mac[3]`
- src/StatsManager.cpp: `%lu` with `static_cast<long int>(key)` epoch values
-> `%ld` (respects the explicit signed cast)
- src/Trace.cpp: `"%s.%u"` with loop `int i` / `i + 1` -> `%d`
- src/Prefs.cpp: `%u` in usage() help text fed CONST_DEFAULT_* /
MAX_NUM_* / CLICKHOUSE_MAX_* int macros -> cast `(u_int)`
std::string / std::vector parameters taken by value, changed to `const &`
(declaration and definition kept in sync; none are virtual or overrides, so
callers are source-compatible):
- AggregatedFlowsStats::setInfoKey
- Flow::setL7JSON
- CustomFlowLuaScriptAlert::setAlertMessage
- CustomHostLuaScriptAlert::setAlertMessage, ctor (_msg)
- ScanRealtimeAlert ctor (_alerts, std::vector)
- CustomHostLuaScript::allocAlert (_msg)
- OtherAlertableEntity::getAlertCachedValue / setAlertCacheValue /
triggerAlert / releaseAlert (key, value)
- HostAlert::init and HostAlert(HostCheckID, ...) ctor (_check_name)
- Ntop::luaFlowCheckInfo / luaHostCheckInfo (check_name)
- Ntop::incBlacklisHits (listname)
- Ntop::setLuaCache (key, val)
Scaffolding code of the host scripts
Scaffolding code for host alerts
Adds host_callbacks/ for .cpp files
Implements all classes for host callbacks
Removes pro/enterprise host callbacks
Adds typedefs with callback deltas
Compilation fix
Creates instances of host callbacks in loader
Link fix
Removes redundant/non-necessary host alerts
Merges Scan and Flood callbacks together
Removes outdated API files
Refactors alert keys into entity|id
Refactors all flow alert_{...} into flow_alert_{...}
Refactors C++ flow alert_{...} into flow_alert_{...}
Reworks alert ids to include an entity type
Cleanup and merge alertTypeRaw with getAlertType
Minor fix
Refactors alert definitions and keys into sub directories
Implement host alert callback execution and trigger/release logic
Update callbacks API
Adds base CallbacksLoader for {Host,Flow}CallbacksLoader
Implements load of host user scripts with periodicities
Implements runtime reload of host callbacks
Add logic for periodic callbacks
Add 'expired' flag to host alerts
Implements execution of host callbacks and SYN flood checks
Adds triggerAlertAsync calls to SYNFlood
Implements JSON host alert generation info
Handle callback getPeriod. Optimize callback lookup.
Implements host recipients in C++
Add callback status
Define destructor
Iterator fixes
Cleanup host Lua calls (now performed in C++)
Changes to show new host alerts in SQLite
Adds release/engage action on alert JSON
Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.
Implements SYN Flood Attacker with params
Uses parametrized thresholds to trigger syn flood alerts
Implements build alert of both attacker and victim
Implement HostAlertableEntity
Implements SYN scan attacker/victim alerts
Implements flow flood attacker/victim alerts
Removes a debug flag
Add virtual allocStatus
Add HostAlert disableAutoRelease()
Add Ãexplicit releaseAlert()
Implements SYNFloodHostCallbackStatus
Implements SYNScanHostCallbackStatus
Implements FlowFloodHostCallbackStatus
Change trigger API to handle cli/src score
Implements {DNS,SMTP,NTP}ServerContactsAlert
Reworks ServerContacts host alerts
Implement exclusion bitmaps for host alerts
Implements {SMTP,DNS,NTP}ServerContactsAlert
Adds host_info to the generated alert JSON
Minor cleanup
Optimize access to callback status
Move RepliesRequestsRatio to pro
Rework triggerAlert on host to avoid multiple call and unneeded status data
Compilation fix
Reworked host alerts API (wip)
Cleanup unused host callbacks
Compilation fixes
Finishes backend implementation of host alerts exclusions
Rework host callbacks executor
Implements disable of host alerts
Port SYNFlood to the new api
Cleanup
Reduce duplicated code
Comments
Port ServerContacts to the new api
Clenaup
Adds parsing of configuration for host callbacks
Port SYNScanAlert to the new API
Port FlowFlood to the new API
Cleanup unused HostAlert getName
Reworks DNSRequestsErrorsRatioAlert
Adds JSON for DNSTrafficAlert
Adds FlowsAlert
Adds P2PTrafficAlert
Add RepliesRequestsRatioAlert
Adds ScoreAlert
Adds ThroughputAlert
Adds TrafficAlert
Fixes for scan/flood alerts
DNS ratio alert support
Add HTTP stats getters
Implements deltas for many host callbacks
Host score inc
Adds missing Alert params to host alerts
Release all host alerts on idle
Refactors score classes
Implements class Score to contain scores for hosts, flows, etc
Adds scores to VLANs, Networks, ASes and Countries
Host callbacks can trigger a single alert now
FlowFlood, SYNFloo, SYNScan now inherit from FlowHits
Move severity and score to constructor
Add else branch to hits callbacks
Alert definition update for flows_flood, syn_flood, syn_scan
Update field name
Engaged alert init
Adds score incs/decs for AS, VLAN, country, os and network
Restore network scripts
Restored other alert definitions for floods
Handle decreasing alert score
Removes include
Rename flows_flood to flow_flood for consistency
Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions
Fixes for non-host engaged/release alerts
Cleanup LuaEngineFlow and LuaEngineHost classes
Fixes old calls to host lua during shutdown
Removes AlertCheckLuaEngine instance
Fixes purging of flows
Fixes alerts release upon shutdown causing wrong uses
Removes a debug flag
Fix getNumEngagedAlerts
Cleanup unnecessary host callbacks
Removes array of callback statuses inside host
Bitmap fixes
Refactors Bitmap into Bitmap128
Implements 16-bits bitmaps for host alerts
Adds class HostCallbacksStatus
Moves callback status p2p and DNS inside HostCallbacksStatus
Removes unused callbacks in typedefs
Minor cleanup
Adds trigger/release for DNS/p2p alerts
Reworks UI of hosts user scripts
Rename HostCallbackType to HostCallbackID, getType to getID, others
- Alerts and flow status cleanup
- Community flow user scripts migration
- Implement scripts filters by l7 proto and packet interface only
- Migrate flow2statusinfojson
- Lower flow periodic update to 30 seconds if there is flow activity
- Display flow scripts without a gui section
