diff --git a/include/AlertsManager.h b/include/AlertsManager.h index a62ef8b940..5fb527190c 100644 --- a/include/AlertsManager.h +++ b/include/AlertsManager.h @@ -74,7 +74,11 @@ class AlertsManager : protected StoreManager { int getAlerts(lua_State* vm, patricia_tree_t *allowed_hosts, u_int32_t start_offset, u_int32_t end_offset, bool engaged, const char *sql_where_clause); + int getFlowAlerts(lua_State* vm, patricia_tree_t *allowed_hosts, + u_int32_t start_offset, u_int32_t end_offset, + const char *sql_where_clause); int getNumAlerts(bool engaged, const char *sql_where_clause); + int getNumFlowAlerts(const char *sql_where_clause); /* private methods to check the goodness of submitted inputs and possible return the input database string */ bool isValidHost(Host *h, char *host_string, size_t host_string_len); @@ -132,13 +136,14 @@ class AlertsManager : protected StoreManager { /* ========== FLOW alerts API ========= */ - int storeFlowAlert(Flow *f, AlertType alert_type, AlertLevel alert_severity, const char *alert_json, - Host *alert_origin, Host *alert_target); - inline int storeFlowAlert(Flow *f, AlertType alert_type, AlertLevel alert_severity, const char *alert_json) { - return storeFlowAlert(f, alert_type, alert_severity, alert_json, NULL, NULL); + int storeFlowAlert(Flow *f, AlertType alert_type, AlertLevel alert_severity, const char *alert_json); + inline int getFlowAlerts(lua_State* vm, patricia_tree_t *allowed_hosts, + u_int32_t start_offset, u_int32_t end_offset) { + return getFlowAlerts(vm, allowed_hosts, start_offset, end_offset, NULL); + }; + inline int getNumFlowAlerts() { + return getNumFlowAlerts(NULL); }; - - /* ========== NETWORK alerts API ====== */ @@ -183,7 +188,7 @@ class AlertsManager : protected StoreManager { return engaged ? num_alerts_engaged : num_alerts_stored; }; inline void refreshCachedNumAlerts() { - num_alerts_stored = getNumAlerts(false, static_cast(NULL)); + num_alerts_stored = getNumAlerts(false, static_cast(NULL)) + getNumFlowAlerts(NULL); num_alerts_engaged = getNumAlerts(true, static_cast(NULL)); }; inline int getNumAlerts(bool engaged) { @@ -198,6 +203,7 @@ class AlertsManager : protected StoreManager { /* ========== delete API ====== */ + int deleteFlowAlerts(const int *rowid); int deleteAlerts(bool engaged, const int *rowid); int deleteAlerts(bool engaged, AlertEntity alert_entity, const char *alert_entity_value); int deleteAlerts(bool engaged, AlertEntity alert_entity, const char *alert_entity_value, AlertType alert_type); diff --git a/include/Flow.h b/include/Flow.h index bef6a53cd5..dd3e93a97c 100644 --- a/include/Flow.h +++ b/include/Flow.h @@ -212,7 +212,9 @@ class Flow : public GenericHashEntry { char* serialize(bool partial_dump = false, bool es_json = false); json_object* flow2json(bool partial_dump); json_object* flow2es(json_object *flow_object); - inline u_int8_t getTcpFlags() { return(src2dst_tcp_flags | dst2src_tcp_flags); }; + inline u_int8_t getTcpFlags() { return(src2dst_tcp_flags | dst2src_tcp_flags); }; + inline u_int8_t getTcpFlagsCli2Srv() { return(src2dst_tcp_flags); }; + inline u_int8_t getTcpFlagsSrv2Cli() { return(dst2src_tcp_flags); }; bool isPassVerdict(); void setDropVerdict() { passVerdict = false; }; u_int32_t getPid(bool client); @@ -265,6 +267,8 @@ class Flow : public GenericHashEntry { inline u_int64_t get_bytes_srv2cli() { return(srv2cli_bytes); }; inline u_int64_t get_goodput_bytes() { return(cli2srv_goodput_bytes+srv2cli_goodput_bytes); }; inline u_int64_t get_packets() { return(cli2srv_packets+srv2cli_packets); }; + inline u_int64_t get_packets_cli2srv() { return(cli2srv_packets); }; + inline u_int64_t get_packets_srv2cli() { return(srv2cli_packets); }; inline u_int64_t get_partial_bytes() { return(get_bytes() - (last_db_dump.cli2srv_bytes+last_db_dump.srv2cli_bytes)); }; inline u_int64_t get_partial_bytes_cli2srv() { return(cli2srv_bytes - last_db_dump.cli2srv_bytes); }; inline u_int64_t get_partial_bytes_srv2cli() { return(srv2cli_bytes - last_db_dump.srv2cli_bytes); }; diff --git a/include/ntop_defines.h b/include/ntop_defines.h index fe02ac869d..1e5473ee4f 100644 --- a/include/ntop_defines.h +++ b/include/ntop_defines.h @@ -511,6 +511,7 @@ #define STORE_MANAGER_MAX_KEY 20 #define ALERTS_MANAGER_MAX_ENTITY_ALERTS 1024 #define ALERTS_MANAGER_TABLE_NAME "closed_alerts" +#define ALERTS_MANAGER_FLOWS_TABLE_NAME "flows_alerts" #define ALERTS_MANAGER_ENGAGED_TABLE_NAME "engaged_alerts" #define ALERTS_MANAGER_STORE_NAME "alerts_v2.db" #define ALERTS_MANAGER_QUEUE_NAME "ntopng.alerts.ifid_%i.queue" diff --git a/scripts/lua/get_alerts_data.lua b/scripts/lua/get_alerts_data.lua index 5beff32d0c..0c7e30978b 100644 --- a/scripts/lua/get_alerts_data.lua +++ b/scripts/lua/get_alerts_data.lua @@ -41,7 +41,10 @@ local num_alerts if _GET["entity"] == "host" then alerts = interface.getAlerts(initial_idx, perPage, engaged, "host", _GET["entity_val"]) num_alerts = interface.getNumAlerts(engaged, "host", _GET["entity_val"]) -else +elseif status == "historical-flows" then + alerts = interface.getFlowAlerts(initial_idx, perPage) + num_alerts = interface.getNumFlowAlerts() +else --if status == "historical" then alerts = interface.getAlerts(initial_idx, perPage, engaged) num_alerts = interface.getNumAlerts(engaged) end @@ -58,8 +61,18 @@ for _key,_value in ipairs(alerts) do if(total > 0) then print(",\n") end alert_id = _value["rowid"] - alert_entity = alertEntityLabel(_value["alert_entity"]) - alert_entity_val= _value["alert_entity_val"] + if _value["alert_entity"] ~= nil then + alert_entity = alertEntityLabel(_value["alert_entity"]) + else + alert_entity = "flow" -- flow alerts page doesn't have an entity + end + if _value["alert_entity_val"] ~= nil then + alert_entity_val = _value["alert_entity_val"] + else + alert_entity_val = "" + end +-- tprint(alert_entity) +-- tprint(alert_entity_val) column_date = os.date("%c", _value["alert_tstamp"]) if tonumber(_value["alert_tstamp_end"]) ~= nil then local duration = secondsToTime(tonumber(_value["alert_tstamp_end"]) - tonumber(_value["alert_tstamp"])) @@ -69,7 +82,7 @@ for _key,_value in ipairs(alerts) do column_type = alertTypeLabel(tonumber(_value["alert_type"])) column_msg = _value["alert_json"] - column_id = "
" + column_id = "" if _GET["ifname"] ~= nil and _GET["ifname"] ~= "" then column_id = column_id.."" end @@ -82,7 +95,7 @@ for _key,_value in ipairs(alerts) do if _GET["page"] ~= nil and _GET["page"] ~= "" then column_id = column_id.."" end - column_id = column_id.."
" + column_id = column_id.."" print('{ "column_key" : "'..column_id..'", "column_date" : "'..column_date..'", "column_severity" : "'..column_severity..'", "column_type" : "'..column_type..'", "column_msg" : "'..column_msg..'", "column_entity":"'..alert_entity..'", "column_entity_val":"'..alert_entity_val..'" }') diff --git a/scripts/lua/host_details.lua b/scripts/lua/host_details.lua index 0c1eb2704d..a52cbe38d5 100644 --- a/scripts/lua/host_details.lua +++ b/scripts/lua/host_details.lua @@ -1981,7 +1981,7 @@ if num_alerts > 0 or num_engaged_alerts > 0 then print("Detected Alerts\n") else -- if there are no alerts, we show the first alert granularity configuration page - if(tab == nil) then tab = alerts_granularity[1][1] end + if(tab == nil or tab=="alert_list") then tab = alerts_granularity[1][1] end end for _,e in pairs(alerts_granularity) do @@ -2065,7 +2065,7 @@ if tab == "alert_list" then _GET["host"] = host_ip _GET["vlan"] = host_vlan _GET["ifname"] = ifId - drawAlertTables(num_alerts, num_engaged_alerts, _GET) + drawAlertTables(num_alerts, num_engaged_alerts, 0, _GET) else print [[ diff --git a/scripts/lua/modules/alert_utils.lua b/scripts/lua/modules/alert_utils.lua index 3ddf5055a0..454e4efbfb 100644 --- a/scripts/lua/modules/alert_utils.lua +++ b/scripts/lua/modules/alert_utils.lua @@ -658,14 +658,17 @@ function checkDeleteStoredAlerts() -- delete all existing alerts interface.deleteAlerts(true --[[ engaged --]]) interface.deleteAlerts(false --[[ and not engaged --]]) + interface.deleteFlowAlerts() end else local id_to_delete = tonumber(_GET["id_to_delete"]) if id_to_delete ~= nil then - if _GET["engaged"] == "true" then + if _GET["status"] == "engaged" then interface.deleteAlerts(true, id_to_delete) - else + elseif _GET["status"] == "historical" then interface.deleteAlerts(false, id_to_delete) + elseif _GET["status"] == "historical-flows" then + interface.deleteFlowAlerts(id_to_delete) end end end @@ -675,17 +678,31 @@ end -- ################################# -function drawAlertTables(num_alerts, num_engaged_alerts, url_params) +function drawAlertTables(num_alerts, num_engaged_alerts, num_flow_alerts, url_params) local alert_items = {} + print[[ +
+ + +
+]] + + local status = _GET["status"] if num_engaged_alerts > 0 then - alert_items[#alert_items + 1] = {["label"] = "Currently Engaged Alerts", ["div-id"] = "table-engaged-alerts", ["status"] = "engaged", ["date"] = "First Seen"} + alert_items[#alert_items + 1] = {["label"] = "Engaged Alerts", ["div-id"] = "table-engaged-alerts", ["status"] = "engaged", ["date"] = "First Seen"} end if num_alerts > 0 then alert_items[#alert_items +1] = {["label"] = "Alerts History", ["div-id"] = "table-alerts-history", ["status"] = "historical", ["date"] = "Time"} end + if num_flow_alerts > 0 then + alert_items[#alert_items +1] = {["label"] = "Flow Alerts History", ["div-id"] = "table-flow-alerts-history", ["status"] = "historical-flows", ["date"] = "Time"} + end + local url_extra_params = "" if type(url_params) == "table" then for k, v in pairs(url_params) do @@ -696,9 +713,22 @@ function drawAlertTables(num_alerts, num_engaged_alerts, url_params) end for k, t in ipairs(alert_items) do + local clicked = "0" + if (k == 1 and status == nil) or (status ~= nil and status == t["status"]) then + clicked = "1" + end print [[ -
- ]] end - if (num_alerts > 0 or num_engaged_alerts > 0) then - print [[ - Purge All Alerts + + if (num_alerts > 0 or num_flow_alerts > 0 or num_engaged_alerts > 0) then + -- trigger the click on the right tab to force table load + print[[ + +]] + + local entity = nil + if _GET["entity"] ~= nil and _GET["entity"] ~= "" then entity = _GET["entity"] end + local purge_msg = " Purge All " + if entity ~= nil and entity ~= "" then purge_msg = purge_msg..firstToUpper(entity).." " end + purge_msg = purge_msg.."Alerts" + print [[ +
+ +]] print(purge_msg) print[[