{
    "name"  : "是否存在ip扫描",
    "problems" : {
        "IPScan" : {
            "desc"      : "【问题】检测到设备上存在IP扫描",
            "advice"    : "【建议】打开全局攻击检测,\r\nRuijie#config\r\nRuijie(config)#nfpp ${0}\r\nRuijie(config-nfpp)#end\r\nRuijie#write"
        },
        "exceptionIp" : {
            "desc"      : "【问题】设备上存在异常未解析的IP地址",
            "advice"    : "【建议】建议与客户确认哪些ARP绑定表项可以删除，然后删除这些异常的arp绑定表项。当前未解析的IP地址有:\r\n${0}"
        },
        "RLDP" : {
            "desc"      : "【问题】${0}",
            "advice"    : ["【建议】建议开启RLDP防环功能，或者开启风暴控制功能。"
                          ,"\t开启RLDP防环功能示例："
                          ,"\t\tRuijie#config"
                          ,"\t\tRuijie(config)#rldp enable "
                          ,"\t\tRuijie(config)#interface GigabitEthernet 0/1 "
                          ,"\t\tRuijie(config-if-range)#rldp port loop-detect block "
                          ,"\t\tRuijie(config-if-range)#spanning-tree bpdufilter enable "
                          ,"\t\tRuijie(config-if-range)#en "
                          ,"\t\tRuijie#write "
                          ,"\t开启广播风暴控制示例： "
                          ,"\t\tRuijie#config "
                          ,"\t\tRuijie(config)#interface GigabitEthernet 0/1 "
                          ,"\t\tRuijie(config-if-range)#spanning-tree portfast "
                          ,"\t\tRuijie(config-if-range)#spanning-tree bpduguard enable "
                          ,"\t\tRuijie(config-if-range)#storm-control broadcast "
                          ,"\t\tRuijie(config-if-range)#end"
                          ,"\t\tRuijie#write"]   
        },
        "MAC" : {
            "desc"      : "${0}",
            "advice"    : ["【建议】建议开启RLDP防环功能，或者开启风暴控制功能。"
                          ,"\t开启RLDP防环功能示例："
                          ,"\t\tRuijie#config"
                          ,"\t\tRuijie(config)#rldp enable "
                          ,"\t\tRuijie(config)#interface GigabitEthernet 0/1 "
                          ,"\t\tRuijie(config-if-range)#rldp port loop-detect block "
                          ,"\t\tRuijie(config-if-range)#spanning-tree bpdufilter enable "
                          ,"\t\tRuijie(config-if-range)#en "
                          ,"\t\tRuijie#write "
                          ,"\t开启广播风暴控制示例： "
                          ,"\t\tRuijie#config "
                          ,"\t\tRuijie(config)#interface GigabitEthernet 0/1 "
                          ,"\t\tRuijie(config-if-range)#spanning-tree portfast "
                          ,"\t\tRuijie(config-if-range)#spanning-tree bpduguard enable "
                          ,"\t\tRuijie(config-if-range)#storm-control broadcast "
                          ,"\t\tRuijie(config-if-range)#end"
                          ,"\t\tRuijie#write"] 
        }
    }
}
---------------------------code-------------------------------
#是否存在ip扫描 对应配置文件 是否存在攻击
response = cli('show arp counter')
if response.search('Invalid input | Unknown command.') != -1 :
    add_reason('无效指令：show arp counter')
    return 'skip'
end

totalReg        = /Total:\s+(\d+)/
incompleteReg   = /incomplete:\s+(\d+)/
responseTemp = response.match(totalReg)
if responseTemp.length > 1 :
    responseTemp = responseTemp[1]
    total = parse_int_catch(responseTemp)
end
responseTemp = response.match(incompleteReg)
if responseTemp.length > 1 :
    responseTemp = responseTemp[1]
    incomplete = parse_int_catch(responseTemp)
end

if total == "解析出错" || incomplete == "解析出错" :
    add_reason('解析出错')
    return 'skip'
end
if total > 50 && incomplete > (total * 0.3) :
    return 'success'
end

response = cli('show run | in guard enable')
if response.search('Invalid input | Unknown command.') != -1 :
    add_reason('无效指令：show run | in guard enable')
    return 'skip'    
end
noIpGuardReg  = /[\r\n]+\s*no ip-guard enable/
noArpGuardReg = /[\r\n]+\s*no arp-guard enable/
if response.match(noIpGuardReg) != null :
    isNoIpGuard = true
else :
    isNoIpGuard = false
end
if response.match(noArpGuardReg) != null :
    isNoArpGuard = true
else :
    isNoArpGuard = false
end
if  !(isNoIpGuard && isNoArpGuard) :
    return 'success'
end

strResult = ''
restore_cmd = []
restore_cmd.push('config')
restore_cmd.push('nfpp')


if isNoIpGuard :
	restore_cmd.push('ip-guard enable')
    strResult = strResult + '\tRuijie(config-nfpp)#ip-guard enable;'
end

if isNoArpGuard :
	restore_cmd.push('arp-guard enable')
    strResult = strResult + '\r\n\tRuijie(config-nfpp)#arp-guard enable;'
end

restore_cmd.push('en')
restore_cmd.push('write')

add_problem('IPScan',[strResult], restore_cmd, [])
return 'warn'
