marcus/mitm-webserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test ebpf
All checks were successful
Build and Deploy MITM Webserver / build (push) Successful in 1m40s
Details

Browse Source
This commit is contained in:
malmert
2026-03-07 10:06:24 +01:00
parent a98054cb5b
commit f9bbe9b73c
13 changed files with 1271 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
backend/src/utilities/database.py
View File

@@ -15,6 +15,16 @@ from src.Models.packets import PacketDBModel
logger = logging.getLogger("af_packet_sniffer")
def _db_text(value: Any) -> Any:
if value is None:
return None
if isinstance(value, (str, int)):
return value
if hasattr(value, "value"):
return getattr(value, "value")
return str(value)
class DatabasePool:
"""Asyncpg connection pool wrapper used by the packet APIs."""
@@ -65,15 +75,33 @@ class DatabasePool:
async def insert_packet(self, pkt_info: Dict[str, Any]) -> None:
"""Insert one packet record and publish it to subscribers."""
await self.upsert_packet(pkt_info)
async def upsert_packet(self, pkt_info: Dict[str, Any]) -> None:
"""Insert or update one packet record and publish it to subscribers."""
if self._pool is None:
await self.init_pool()
dpi_metadata = pkt_info.get("dpi_metadata")
telemetry_metadata = pkt_info.get("telemetry_metadata")
try:
async with self._pool.acquire() as conn:
new_row = await conn.fetchrow(
"""
INSERT INTO packets(
INSERT INTO packets (
packet_uid,
iface,
ingress_if,
egress_if,
observed_ifaces,
direction,
verdict,
verdict_reason,
verdict_confidence,
ingress_seen_at,
egress_seen_at,
verdict_seen_at,
src_mac,
dst_mac,
eth_type,
@@ -84,7 +112,6 @@ class DatabasePool:
src_port,
dst_port,
length,
raw,
app_protocol,
app_master_protocol,
app_category,
@@ -92,22 +119,70 @@ class DatabasePool:
app_hostname,
app_is_encrypted,
app_risk_score,
dpi_metadata
) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20::jsonb)
dpi_metadata,
telemetry_metadata,
raw
) VALUES(
$1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,
$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,
$24,$25,$26,$27,$28,$29,$30::jsonb,$31::jsonb,$32
)
ON CONFLICT (packet_uid) DO UPDATE SET
iface = COALESCE(EXCLUDED.iface, packets.iface),
ingress_if = COALESCE(EXCLUDED.ingress_if, packets.ingress_if),
egress_if = COALESCE(EXCLUDED.egress_if, packets.egress_if),
observed_ifaces = COALESCE(EXCLUDED.observed_ifaces, packets.observed_ifaces),
direction = COALESCE(EXCLUDED.direction, packets.direction),
verdict = COALESCE(EXCLUDED.verdict, packets.verdict),
verdict_reason = COALESCE(EXCLUDED.verdict_reason, packets.verdict_reason),
verdict_confidence = COALESCE(EXCLUDED.verdict_confidence, packets.verdict_confidence),
ingress_seen_at = COALESCE(EXCLUDED.ingress_seen_at, packets.ingress_seen_at),
egress_seen_at = COALESCE(EXCLUDED.egress_seen_at, packets.egress_seen_at),
verdict_seen_at = COALESCE(EXCLUDED.verdict_seen_at, packets.verdict_seen_at),
src_mac = COALESCE(EXCLUDED.src_mac, packets.src_mac),
dst_mac = COALESCE(EXCLUDED.dst_mac, packets.dst_mac),
eth_type = COALESCE(EXCLUDED.eth_type, packets.eth_type),
vlan_id = COALESCE(EXCLUDED.vlan_id, packets.vlan_id),
src_ip = COALESCE(EXCLUDED.src_ip, packets.src_ip),
dst_ip = COALESCE(EXCLUDED.dst_ip, packets.dst_ip),
ip_proto = COALESCE(EXCLUDED.ip_proto, packets.ip_proto),
src_port = COALESCE(EXCLUDED.src_port, packets.src_port),
dst_port = COALESCE(EXCLUDED.dst_port, packets.dst_port),
length = COALESCE(EXCLUDED.length, packets.length),
app_protocol = COALESCE(EXCLUDED.app_protocol, packets.app_protocol),
app_master_protocol = COALESCE(EXCLUDED.app_master_protocol, packets.app_master_protocol),
app_category = COALESCE(EXCLUDED.app_category, packets.app_category),
app_confidence = COALESCE(EXCLUDED.app_confidence, packets.app_confidence),
app_hostname = COALESCE(EXCLUDED.app_hostname, packets.app_hostname),
app_is_encrypted = COALESCE(EXCLUDED.app_is_encrypted, packets.app_is_encrypted),
app_risk_score = COALESCE(EXCLUDED.app_risk_score, packets.app_risk_score),
dpi_metadata = COALESCE(EXCLUDED.dpi_metadata, packets.dpi_metadata),
telemetry_metadata = COALESCE(EXCLUDED.telemetry_metadata, packets.telemetry_metadata),
raw = COALESCE(EXCLUDED.raw, packets.raw)
RETURNING id, timestamp
""",
pkt_info["iface"],
pkt_info["packet_uid"],
pkt_info.get("iface"),
pkt_info.get("ingress_if"),
pkt_info.get("egress_if"),
pkt_info.get("observed_ifaces"),
pkt_info.get("direction"),
pkt_info.get("verdict"),
pkt_info.get("verdict_reason"),
pkt_info.get("verdict_confidence"),
pkt_info.get("ingress_seen_at"),
pkt_info.get("egress_seen_at"),
pkt_info.get("verdict_seen_at"),
pkt_info.get("src_mac"),
pkt_info.get("dst_mac"),
pkt_info.get("eth_type"),
_db_text(pkt_info.get("eth_type")),
pkt_info.get("vlan_id"),
pkt_info.get("src_ip"),
pkt_info.get("dst_ip"),
pkt_info.get("protocol"),
_db_text(pkt_info.get("protocol_name") or pkt_info.get("protocol")),
pkt_info.get("src_port"),
pkt_info.get("dst_port"),
pkt_info["length"],
pkt_info["raw"],
pkt_info.get("length"),
pkt_info.get("app_protocol"),
pkt_info.get("app_master_protocol"),
pkt_info.get("app_category"),
@@ -115,10 +190,12 @@ class DatabasePool:
pkt_info.get("app_hostname"),
pkt_info.get("app_is_encrypted"),
pkt_info.get("app_risk_score"),
json.dumps(pkt_info.get("dpi_metadata")) if pkt_info.get("dpi_metadata") is not None else None,
json.dumps(dpi_metadata) if dpi_metadata is not None else None,
json.dumps(telemetry_metadata) if telemetry_metadata is not None else None,
pkt_info.get("raw"),
)
except Exception:
logger.exception("DB insert failed")
logger.exception("DB upsert failed")
return
if new_row: