void *ClassificationLoop(void *ptr)
{
MaskKillSignals();
//Builds the Silent Alarm Network address
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(Config::Inst()->GetSaPort());
//Classification Loop
do
{
sleep(Config::Inst()->GetClassificationTimeout());
CheckForDroppedPackets();
//Calculate the "true" Feature Set for each Suspect
vector<uint64_t> updateKeys = suspects.GetKeys_of_ModifiedSuspects();
for(uint i = 0; i < updateKeys.size(); i++)
{
UpdateAndClassify(updateKeys[i]);
}
engine->m_dopp->UpdateDoppelganger();
if(Config::Inst()->GetSaveFreq() > 0)
{
if((time(NULL) - lastSaveTime) > Config::Inst()->GetSaveFreq())
{
AppendToStateFile();
}
}
if(Config::Inst()->GetDataTTL() > 0)
{
if((time(NULL) - lastLoadTime) > Config::Inst()->GetDataTTL())
{
AppendToStateFile();
suspects.EraseAllSuspects();
RefreshStateFile();
LoadStateFile();
}
}
}while(Config::Inst()->GetClassificationTimeout() && !Config::Inst()->GetReadPcap());
if(Config::Inst()->GetReadPcap())
{
return NULL;
}
//Shouldn't get here!!
if(Config::Inst()->GetClassificationTimeout())
{
LOG(CRITICAL, "The code should never get here, something went very wrong.", "");
}
return NULL;
}
void SaveAndExit(int param)
{
StopCapture();
AppendToStateFile();
if(Config::Inst()->GetIsDmEnabled())
{
if(system("sudo iptables -F") == -1)
{
LOG(WARNING, "Failed to flush iptables rules", "Command sudo iptables -F failed");
}
if(system("sudo iptables -t nat -F") == -1)
{
LOG(WARNING, "Failed to flush nat table rules", "Command sudo iptables -t nat -F failed");
}
if(system("sudo iptables -t nat -X DOPP") == -1)
{
LOG(WARNING, "Failed to delete chain DOPP in nat table", "Command sudo iptables -t nat -X DOPP failed");
}
if(system(std::string("sudo route del " + Config::Inst()->GetDoppelIp()).c_str()) == -1)
{
LOG(WARNING, "Failed to delete Doppelganger route", "Command sudo route del " + (string)Config::Inst()->GetDoppelIp() + " failed");
}
}
if(engine != NULL)
{
{
Lock lock(&shutdownClassificationMutex);
shutdownClassification = true;
}
pthread_cond_signal(&shutdownClassificationCond);
pthread_cond_destroy(&shutdownClassificationCond);
pthread_mutex_destroy(&shutdownClassificationMutex);
delete engine;
}
annClose();
LOG(ALERT, "Novad is exiting cleanly.", "");
exit(EXIT_SUCCESS);
}
