diff --git a/include/Prefs.h b/include/Prefs.h index fb86862863..67335f3b2d 100644 --- a/include/Prefs.h +++ b/include/Prefs.h @@ -44,11 +44,11 @@ class Prefs { Ntop *ntop; bool enable_dns_resolution, sniff_dns_responses, categorization_enabled, resolve_all_host_ip, change_user, daemonize, - enable_auto_logout, use_promiscuous_mode, + enable_auto_logout, use_promiscuous_mode, notifications_enabled, disable_alerts, enable_ixia_timestamps, enable_vss_apcon_timestamps, - enable_users_login, disable_localhost_login, online_license_check; - bool enable_idle_local_hosts_cache, enable_active_local_hosts_cache; - bool enable_probing_alerts, enable_syslog_alerts; + enable_users_login, disable_localhost_login, online_license_check, + enable_idle_local_hosts_cache, enable_active_local_hosts_cache, + enable_probing_alerts, enable_syslog_alerts, dump_flow_alerts_when_iface_alerted; LocationPolicy dump_hosts_to_db, sticky_hosts; u_int non_local_host_max_idle, local_host_cache_duration, local_host_max_idle, flow_max_idle; u_int16_t intf_rrd_raw_days, intf_rrd_1min_days, intf_rrd_1h_days, intf_rrd_1d_days; @@ -177,7 +177,9 @@ class Prefs { inline u_int16_t get_flow_max_idle() { return(flow_max_idle); }; inline u_int32_t get_max_num_hosts() { return(max_num_hosts); }; inline u_int32_t get_max_num_flows() { return(max_num_flows); }; + inline bool are_notifications_enabled() { return(notifications_enabled); }; inline bool daemonize_ntopng() { return(daemonize); }; + inline bool do_dump_flow_alerts_when_iface_alerted() { return(dump_flow_alerts_when_iface_alerted); }; void add_default_interfaces(); int loadFromCLI(int argc, char *argv[]); int loadFromFile(const char *path); diff --git a/include/ntop_defines.h b/include/ntop_defines.h index f6ac14d83c..6c10173ba6 100644 --- a/include/ntop_defines.h +++ b/include/ntop_defines.h @@ -552,7 +552,8 @@ #define ALERTS_MANAGER_NOTIFICATION_ENABLED "ntopng.alerts.notification_enabled" #define ALERTS_MANAGER_NOTIFICATION_SENDER "ntopng.alerts.sender_username" #define ALERTS_MANAGER_NOTIFICATION_WEBHOOK "ntopng.alerts.slack_webhook" -#define ALERTS_MANAGER_NOTIFICATION_SEVERITY "ntopng.prefs.slack_alert_severity" +#define ALERTS_MANAGER_NOTIFICATION_SEVERITY "ntopng.alerts.slack_alert_severity" +#define ALERTS_DUMP_DURING_IFACE_ALERTED "ntopng.alerts.dump_alerts_when_iface_is_alerted" #define STARTUP_SCRIPT_PATH "startup.lua" #define HOUSEKEEPING_SCRIPT_PATH "housekeeping.lua" diff --git a/scripts/lua/admin/prefs.lua b/scripts/lua/admin/prefs.lua index e23d2d5c2d..d28b5a0742 100644 --- a/scripts/lua/admin/prefs.lua +++ b/scripts/lua/admin/prefs.lua @@ -209,6 +209,13 @@ function printAlerts() "toggle_alert_probing", "ntopng.prefs.probing_alerts", "1", false, nil, nil, showElements) + toggleTableButtonPrefs("Dump Flow Alerts", + "Enable flow alert generation when the network interface is alerted.", + "On", "1", "success", + "Off","0", "danger", + "toggle_flow_alerts_iface", "ntopng.alerts.dump_alerts_when_iface_is_alerted", "0", + false, nil, nil, showElements) + toggleTableButtonPrefs("Enable Hosts Malware Blacklists", "Enable alerts generated by traffic sent/received by malware-marked hosts. Overnight new blacklist rules are refreshed.", "On", "enabled", "success", @@ -245,7 +252,7 @@ function printAlerts() local retVal = multipleTableButtonPrefs("Notification Preference Based On Severity", "Errors (errors only), Errors and Warnings (errors and warnings, no info), All (every kind of alerts will be notified).", - labels, values, "only_errors", "primary", "slack_notification_severity_preference", "ntopng.prefs.slack_alert_severity", nil, nil, nil, nil, showElements and showSlackNotificationPrefs) + labels, values, "only_errors", "primary", "slack_notification_severity_preference", "ntopng.alerts.slack_alert_severity", nil, nil, nil, nil, showElements and showSlackNotificationPrefs) prefsInputFieldPrefs("Notification Sender Username", "Set the username of the sender of slack notifications", "ntopng.alerts.", "sender_username", "ntopng Webhook", nil, showElements and showSlackNotificationPrefs, false) @@ -650,4 +657,9 @@ print[[ aysHandleForm(); ]]) +if(_GET["disable_alerts_generation"] ~= nil) then + -- Check if we navigate the page or if we have set something + ntop.reloadPreferences() +end + end diff --git a/src/AlertsManager.cpp b/src/AlertsManager.cpp index 83aa03312a..594cca2b07 100644 --- a/src/AlertsManager.cpp +++ b/src/AlertsManager.cpp @@ -774,12 +774,10 @@ void AlertsManager::notifySlack(AlertEntity alert_entity, const char *alert_enti const char *alert_json, const char *alert_origin, const char *alert_target) { char buf[4], choice[32]; - bool alert_to_be_notified = false; // Checks if the notification has to be done according to the slack notifications preference + bool alert_to_be_notified = false; SlackNotificationChoice notification_choice; - if((ntop->getRedis()->get((char*)ALERTS_MANAGER_NOTIFICATION_ENABLED, - buf, sizeof(buf)) >= 0) - && (!strcmp(buf, "1"))) { + if(ntop->getPrefs()->are_notifications_enabled()) { ntop->getRedis()->get((char*) ALERTS_MANAGER_NOTIFICATION_SEVERITY, choice, sizeof(choice)); notification_choice = getSlackNotificationChoice(choice); diff --git a/src/Flow.cpp b/src/Flow.cpp index e3ea44e9bd..72db7c6401 100644 --- a/src/Flow.cpp +++ b/src/Flow.cpp @@ -239,48 +239,60 @@ void Flow::dumpFlowAlert(bool partial_dump) { char buf[128], *f = print(buf, sizeof(buf)); AlertType aType; const char *msg = Utils::flowStatus2str(status, &aType); + bool do_dump = true; ntop->getTrace()->traceEvent(TRACE_INFO, "[%s] %s", msg, f); switch(status) { + case status_normal: + do_dump = false; + break; + case status_slow_tcp_connection: /* 1 */ case status_slow_application_header: /* 2 */ case status_slow_data_exchange: /* 3 */ case status_low_goodput: /* 4 */ case status_tcp_connection_issues: /* 6 - i.e. too many retransmission ooo... or similaria */ - case status_tcp_connection_refused: /* 9 */ /* Don't log them for the time being otherwise we'll have too many flows */ + do_dump = false; break; - - default: - if(ntop->getPrefs()->are_probing_alerts_enabled() && cli_host && srv_host) { - char c_buf[256], s_buf[256], *c, *s, fbuf[256], alert_msg[1024]; - c = cli_host->get_ip()->print(c_buf, sizeof(c_buf)); - if(c && cli_host->get_vlan_id()) - sprintf(&c[strlen(c)], "@%i", cli_host->get_vlan_id()); - - s = srv_host->get_ip()->print(s_buf, sizeof(s_buf)); - if(s && srv_host->get_vlan_id()) - sprintf(&s[strlen(s)], "@%i", srv_host->get_vlan_id()); - - snprintf(alert_msg, sizeof(alert_msg), - "%s: %s > " - "%s [%s]", - msg, /* TODO: remove string and save numeric status */ - ntop->getPrefs()->get_http_prefix(), - c, iface->get_name(), - cli_host->get_name() ? cli_host->get_name() : c, - ntop->getPrefs()->get_http_prefix(), - s, iface->get_name(), - srv_host->get_name() ? srv_host->get_name() : s, - print(fbuf, sizeof(fbuf))); - - iface->getAlertsManager()->storeFlowAlert(this, aType, - alert_level_warning, alert_msg); - } + case status_suspicious_tcp_syn_probing: /* 5 */ + case status_suspicious_tcp_probing: /* 7 */ + case status_tcp_connection_refused: /* 9 */ + do_dump = ntop->getPrefs()->are_probing_alerts_enabled(); break; - } + + case status_flow_when_interface_alerted /* 8 */: + do_dump = ntop->getPrefs()->do_dump_flow_alerts_when_iface_alerted(); + break; + } + + if(do_dump && cli_host && srv_host) { + char c_buf[256], s_buf[256], *c, *s, fbuf[256], alert_msg[1024]; + + c = cli_host->get_ip()->print(c_buf, sizeof(c_buf)); + if(c && cli_host->get_vlan_id()) + sprintf(&c[strlen(c)], "@%i", cli_host->get_vlan_id()); + + s = srv_host->get_ip()->print(s_buf, sizeof(s_buf)); + if(s && srv_host->get_vlan_id()) + sprintf(&s[strlen(s)], "@%i", srv_host->get_vlan_id()); + + snprintf(alert_msg, sizeof(alert_msg), + "%s: %s > " + "%s [%s]", + msg, /* TODO: remove string and save numeric status */ + ntop->getPrefs()->get_http_prefix(), + c, iface->get_name(), + cli_host->get_name() ? cli_host->get_name() : c, + ntop->getPrefs()->get_http_prefix(), + s, iface->get_name(), + srv_host->get_name() ? srv_host->get_name() : s, + print(fbuf, sizeof(fbuf))); + + iface->getAlertsManager()->storeFlowAlert(this, aType, alert_level_warning, alert_msg); + } setFlowAlerted(); } diff --git a/src/Lua.cpp b/src/Lua.cpp index f672c023a1..9c048695ca 100644 --- a/src/Lua.cpp +++ b/src/Lua.cpp @@ -1197,6 +1197,15 @@ static int ntop_get_local_networks(lua_State* vm) { /* ****************************************** */ +static int ntop_reload_preferences(lua_State* vm) { + lua_newtable(vm); + ntop->getPrefs()->reloadPrefsFromRedis(); + + return(CONST_LUA_OK); +} + +/* ****************************************** */ + /** * @brief Check if the trace level of ntop is verbose. * @details Push true into the lua stack if the trace level of ntop is set to MAX_TRACE_LEVEL, false otherwise. @@ -5210,8 +5219,8 @@ static const luaL_Reg ntop_reg[] = { { "zmq_connect", ntop_zmq_connect }, { "zmq_disconnect", ntop_zmq_disconnect }, { "zmq_receive", ntop_zmq_receive }, - - { "getLocalNetworks", ntop_get_local_networks }, + { "getLocalNetworks", ntop_get_local_networks }, + { "reloadPreferences", ntop_reload_preferences }, #ifdef NTOPNG_PRO { "sendNagiosAlert", ntop_nagios_send_alert }, diff --git a/src/Prefs.cpp b/src/Prefs.cpp index 75c99f1167..6b9511822d 100755 --- a/src/Prefs.cpp +++ b/src/Prefs.cpp @@ -394,7 +394,7 @@ void Prefs::getDefaultStringPrefsValue(const char *pref_key, char **buffer, cons /* ******************************************* */ void Prefs::reloadPrefsFromRedis() { - /* attempt to load preferences set from the web ui and apply default values in not found */ + /* Attempt to load preferences set from the web ui and apply default values in not found */ local_host_cache_duration = getDefaultPrefsValue(CONST_LOCAL_HOST_CACHE_DURATION_PREFS, LOCAL_HOSTS_CACHE_DURATION); local_host_max_idle = getDefaultPrefsValue(CONST_LOCAL_HOST_IDLE_PREFS, MAX_LOCAL_HOST_IDLE); non_local_host_max_idle = getDefaultPrefsValue(CONST_REMOTE_HOST_IDLE_PREFS, MAX_REMOTE_HOST_IDLE); @@ -411,8 +411,10 @@ void Prefs::reloadPrefsFromRedis() { host_activity_rrd_raw_hours = getDefaultPrefsValue(CONST_HOST_ACTIVITY_RRD_RAW_HOURS, HOST_ACTIVITY_RRD_RAW_HOURS); host_activity_rrd_1h_days = getDefaultPrefsValue(CONST_HOST_ACTIVITY_RRD_1H_DAYS, HOST_ACTIVITY_RRD_1H_DAYS); host_activity_rrd_1d_days = getDefaultPrefsValue(CONST_HOST_ACTIVITY_RRD_1D_DAYS, HOST_ACTIVITY_RRD_1D_DAYS); - housekeeping_frequency = getDefaultPrefsValue(CONST_RUNTIME_PREFS_HOUSEKEEPING_FREQUENCY, - HOUSEKEEPING_FREQUENCY); + housekeeping_frequency = getDefaultPrefsValue(CONST_RUNTIME_PREFS_HOUSEKEEPING_FREQUENCY, + HOUSEKEEPING_FREQUENCY); + notifications_enabled = getDefaultPrefsValue(ALERTS_MANAGER_NOTIFICATION_ENABLED, 0 /* Disabled by default */); + dump_flow_alerts_when_iface_alerted = getDefaultPrefsValue(ALERTS_DUMP_DURING_IFACE_ALERTED, 0 /* Disabled by default */); // sets to the default value in redis if no key is found getDefaultPrefsValue(CONST_RUNTIME_IS_AUTOLOGOUT_ENABLED,