Skip to content

O
OpnSense
Commit 72ab9e21 authored by Ad Schellevis's avatar Ad Schellevis Committed by Franco Fichtner
Browse files
Options

(legacy) spaces, curly braces etc diag_logs_filter.php 

(cherry picked from commit db3601f4)
parent 9e3def1a
Hide whitespace changes
Inline Side-by-side
Showing with 779 additions and 739 deletions
src/www/diag_logs_filter.php
View file @ 72ab9e21
<?php <?php
/* /*
Copyright (C) 2014 Deciso B.V. Copyright (C) 2014 Deciso B.V.
Copyright (C) 2009-2010 Jim Pingle <jim@pingle.org> Copyright (C) 2009-2010 Jim Pingle <jim@pingle.org>
Copyright (C) 2004-2009 Scott Ullrich Copyright (C) 2004-2009 Scott Ullrich
Copyright (C) 2003-2009 Manuel Kasper <mk@neon1.net> Copyright (C) 2003-2009 Manuel Kasper <mk@neon1.net>
Originally Sponsored By Anathematic @ pfSense Forums Originally Sponsored By Anathematic @ pfSense Forums
All rights reserved. All rights reserved.
Redistribution and use in source and binary forms, with or without Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met: modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, 1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer. this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright 2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution. documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE. POSSIBILITY OF SUCH DAMAGE.
*/ */
require_once("guiconfig.inc"); require_once("guiconfig.inc");
...@@ -42,341 +42,359 @@ require_once("interfaces.inc"); ...@@ -42,341 +42,359 @@ require_once("interfaces.inc");
********************************************************************************************************************/ ********************************************************************************************************************/
function easyrule_find_rule_interface($int) { function easyrule_find_rule_interface($int) {
global $config; global $config;
/* Borrowed from firewall_rules.php */ /* Borrowed from firewall_rules.php */
$iflist = get_configured_interface_with_descr(false, true); $iflist = get_configured_interface_with_descr(false, true);
if (isset($config['pptpd']['mode']) && $config['pptpd']['mode'] == "server") if (isset($config['pptpd']['mode']) && $config['pptpd']['mode'] == "server") {
$iflist['pptp'] = "PPTP VPN"; $iflist['pptp'] = "PPTP VPN";
}
if (isset($config['pppoe']['mode']) && $config['pppoe']['mode'] == "server")
$iflist['pppoe'] = "PPPoE VPN"; if (isset($config['pppoe']['mode']) && $config['pppoe']['mode'] == "server") {
$iflist['pppoe'] = "PPPoE VPN";
if (isset($config['l2tp']['mode']) && $config['l2tp']['mode'] == "server") }
$iflist['l2tp'] = "L2TP VPN";
if (isset($config['l2tp']['mode']) && $config['l2tp']['mode'] == "server") {
/* add ipsec interfaces */ $iflist['l2tp'] = "L2TP VPN";
if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])){ }
$iflist["enc0"] = "IPSEC";
} /* add ipsec interfaces */
if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])){
if (isset($iflist[$int])) $iflist["enc0"] = "IPSEC";
return $int; }
foreach ($iflist as $if => $ifd) { if (isset($iflist[$int])) {
if (strtolower($int) == strtolower($ifd)) return $int;
return $if; }
}
foreach ($iflist as $if => $ifd) {
if (substr($int, 0, 4) == "ovpn") if (strtolower($int) == strtolower($ifd)) {
return "openvpn"; return $if;
}
return false; }
if (substr($int, 0, 4) == "ovpn") {
return "openvpn";
}
return false;
} }
function easyrule_block_rule_exists($int = 'wan', $ipproto = "inet") { function easyrule_block_rule_exists($int = 'wan', $ipproto = "inet") {
global $config; global $config;
$blockaliasname = 'EasyRuleBlockHosts'; $blockaliasname = 'EasyRuleBlockHosts';
/* No rules, we we know it doesn't exist */ /* No rules, we we know it doesn't exist */
if (!is_array($config['filter']['rule'])) { if (!is_array($config['filter']['rule'])) {
return false; return false;
} }
/* Search through the rules for one referencing our alias */ /* Search through the rules for one referencing our alias */
foreach ($config['filter']['rule'] as $rule) { foreach ($config['filter']['rule'] as $rule) {
if (!is_array($rule) || !is_array($rule['source'])) if (!is_array($rule) || !is_array($rule['source'])) {
continue; continue;
$checkproto = isset($rule['ipprotocol']) ? $rule['ipprotocol'] : "inet"; }
if ($rule['source']['address'] == $blockaliasname . strtoupper($int) && ($rule['interface'] == $int) && ($checkproto == $ipproto)) $checkproto = isset($rule['ipprotocol']) ? $rule['ipprotocol'] : "inet";
return true; if ($rule['source']['address'] == $blockaliasname . strtoupper($int) && ($rule['interface'] == $int) && ($checkproto == $ipproto)) {
} return true;
return false; }
}
return false;
} }
function easyrule_block_rule_create($int = 'wan', $ipproto = "inet") { function easyrule_block_rule_create($int = 'wan', $ipproto = "inet") {
global $config; global $config;
$blockaliasname = 'EasyRuleBlockHosts'; $blockaliasname = 'EasyRuleBlockHosts';
/* If the alias doesn't exist, exit. /* If the alias doesn't exist, exit.
* Can't create an empty alias, and we don't know a host */ * Can't create an empty alias, and we don't know a host */
if (easyrule_block_alias_getid($int) === false) if (easyrule_block_alias_getid($int) === false) {
return false; return false;
}
/* If the rule already exists, no need to do it again */
if (easyrule_block_rule_exists($int, $ipproto)) /* If the rule already exists, no need to do it again */
return true; if (easyrule_block_rule_exists($int, $ipproto)) {
return true;
/* No rules, start a new array */ }
if (!is_array($config['filter']['rule'])) {
$config['filter']['rule'] = array(); /* No rules, start a new array */
} if (!is_array($config['filter']['rule'])) {
$config['filter']['rule'] = array();
filter_rules_sort(); }
$a_filter = &$config['filter']['rule'];
filter_rules_sort();
/* Make up a new rule */ $a_filter = &$config['filter']['rule'];
$filterent = array();
$filterent['type'] = 'block'; /* Make up a new rule */
$filterent['interface'] = $int; $filterent = array();
$filterent['ipprotocol'] = $ipproto; $filterent['type'] = 'block';
$filterent['source']['address'] = $blockaliasname . strtoupper($int); $filterent['interface'] = $int;
$filterent['destination']['any'] = ''; $filterent['ipprotocol'] = $ipproto;
$filterent['descr'] = gettext("Easy Rule: Blocked from Firewall Log View"); $filterent['source']['address'] = $blockaliasname . strtoupper($int);
$filterent['created'] = make_config_revision_entry(); $filterent['destination']['any'] = '';
$filterent['descr'] = gettext("Easy Rule: Blocked from Firewall Log View");
array_splice($a_filter, 0, 0, array($filterent)); $filterent['created'] = make_config_revision_entry();
return true; array_splice($a_filter, 0, 0, array($filterent));
return true;
} }
function easyrule_block_alias_getid($int = 'wan') function easyrule_block_alias_getid($int = 'wan')
{ {
global $config; global $config;
$blockaliasname = 'EasyRuleBlockHosts'; $blockaliasname = 'EasyRuleBlockHosts';
if (!isset($config['aliases']) || !is_array($config['aliases'])) { if (!isset($config['aliases']) || !is_array($config['aliases'])) {
return false; return false;
} }
/* Hunt down an alias with the name we want, return its id */ /* Hunt down an alias with the name we want, return its id */
foreach ($config['aliases']['alias'] as $aliasid => $alias) { foreach ($config['aliases']['alias'] as $aliasid => $alias) {
if ($alias['name'] == $blockaliasname . strtoupper($int)) { if ($alias['name'] == $blockaliasname . strtoupper($int)) {
return $aliasid; return $aliasid;
} }
} }
return false; return false;
} }
function easyrule_block_alias_add($host, $int = 'wan') { function easyrule_block_alias_add($host, $int = 'wan') {
global $config; global $config;
$blockaliasname = 'EasyRuleBlockHosts'; $blockaliasname = 'EasyRuleBlockHosts';
/* If the host isn't a valid IP address, bail */ /* If the host isn't a valid IP address, bail */
$host = trim($host, "[]"); $host = trim($host, "[]");
if (!is_ipaddr($host) && !is_subnet($host)) if (!is_ipaddr($host) && !is_subnet($host)) {
return false; return false;
}
/* If there are no aliases, start an array */
if (!isset($config['aliases']) || !is_array($config['aliases'])) { /* If there are no aliases, start an array */
$config['aliases'] = array(); if (!isset($config['aliases']) || !is_array($config['aliases'])) {
} $config['aliases'] = array();
if (!isset($config['aliases']['alias'])) { }
$config['aliases']['alias'] = array(); if (!isset($config['aliases']['alias'])) {
} $config['aliases']['alias'] = array();
$a_aliases = &$config['aliases']['alias']; }
$a_aliases = &$config['aliases']['alias'];
/* Try to get the ID if the alias already exists */
$id = easyrule_block_alias_getid($int); /* Try to get the ID if the alias already exists */
if ($id === false) $id = easyrule_block_alias_getid($int);
unset($id); if ($id === false) {
unset($id);
$alias = array(); }
if (is_subnet($host)) {
list($host, $mask) = explode("/", $host); $alias = array();
} elseif (is_specialnet($host)) { if (is_subnet($host)) {
$mask = 0; list($host, $mask) = explode("/", $host);
} elseif (strpos($host,':') !== false && is_ipaddrv6($host)) { } elseif (is_specialnet($host)) {
$mask = 128; $mask = 0;
} else { } elseif (strpos($host,':') !== false && is_ipaddrv6($host)) {
$mask = 32; $mask = 128;
} } else {
$mask = 32;
if (isset($id) && $a_aliases[$id]) { }
/* Make sure this IP isn't already in the list. */
if (in_array($host.'/'.$mask, explode(" ", $a_aliases[$id]['address']))) if (isset($id) && $a_aliases[$id]) {
return true; /* Make sure this IP isn't already in the list. */
/* Since the alias already exists, just add to it. */ if (in_array($host.'/'.$mask, explode(" ", $a_aliases[$id]['address']))) {
$alias['name'] = $a_aliases[$id]['name']; return true;
$alias['type'] = $a_aliases[$id]['type']; }
$alias['descr'] = $a_aliases[$id]['descr']; /* Since the alias already exists, just add to it. */
$alias['name'] = $a_aliases[$id]['name'];
$alias['address'] = $a_aliases[$id]['address'] . ' ' . $host . '/' . $mask; $alias['type'] = $a_aliases[$id]['type'];
$alias['detail'] = $a_aliases[$id]['detail'] . gettext('Entry added') . ' ' . date('r') . '||'; $alias['descr'] = $a_aliases[$id]['descr'];
} else {
/* Create a new alias with all the proper information */ $alias['address'] = $a_aliases[$id]['address'] . ' ' . $host . '/' . $mask;
$alias['name'] = $blockaliasname . strtoupper($int); $alias['detail'] = $a_aliases[$id]['detail'] . gettext('Entry added') . ' ' . date('r') . '||';
$alias['type'] = 'network'; } else {
$alias['descr'] = gettext("Hosts blocked from Firewall Log view"); /* Create a new alias with all the proper information */
$alias['name'] = $blockaliasname . strtoupper($int);
$alias['address'] = $host . '/' . $mask; $alias['type'] = 'network';
$alias['detail'] = gettext('Entry added') . ' ' . date('r') . '||'; $alias['descr'] = gettext("Hosts blocked from Firewall Log view");
}
$alias['address'] = $host . '/' . $mask;
/* Replace the old alias if needed, otherwise tack it on the end */ $alias['detail'] = gettext('Entry added') . ' ' . date('r') . '||';
if (isset($id) && $a_aliases[$id]) }
$a_aliases[$id] = $alias;
else /* Replace the old alias if needed, otherwise tack it on the end */
$a_aliases[] = $alias; if (isset($id) && $a_aliases[$id]) {
$a_aliases[$id] = $alias;
// Sort list } else {
$a_aliases = msort($a_aliases, "name"); $a_aliases[] = $alias;
}
return true;
// Sort list
$a_aliases = msort($a_aliases, "name");
return true;
} }
function easyrule_block_host_add($host, $int = 'wan', $ipproto = "inet") { function easyrule_block_host_add($host, $int = 'wan', $ipproto = "inet") {
global $retval; global $retval;
/* Bail if the supplied host is not a valid IP address */ /* Bail if the supplied host is not a valid IP address */
$host = trim($host, "[]"); $host = trim($host, "[]");
if (!is_ipaddr($host) && !is_subnet($host)) if (!is_ipaddr($host) && !is_subnet($host)) {
return false; return false;
}
/* Flag whether or not we need to reload the filter */
$dirty = false; /* Flag whether or not we need to reload the filter */
$dirty = false;
/* Attempt to add this host to the alias */
if (easyrule_block_alias_add($host, $int)) { /* Attempt to add this host to the alias */
$dirty = true; if (easyrule_block_alias_add($host, $int)) {
} else { $dirty = true;
/* Couldn't add the alias, or adding the host failed. */ } else {
return false; /* Couldn't add the alias, or adding the host failed. */
} return false;
}
/* Attempt to add the firewall rule if it doesn't exist.
* Failing to add the rule isn't necessarily an error, it may /* Attempt to add the firewall rule if it doesn't exist.
* have been modified by the user in some way. Adding to the * Failing to add the rule isn't necessarily an error, it may
* Alias is what's important. * have been modified by the user in some way. Adding to the
*/ * Alias is what's important.
if (!easyrule_block_rule_exists($int, $ipproto)) { */
if (easyrule_block_rule_create($int, $ipproto)) { if (!easyrule_block_rule_exists($int, $ipproto)) {
$dirty = true; if (easyrule_block_rule_create($int, $ipproto)) {
} else { $dirty = true;
return false; } else {
} return false;
} }
}
/* If needed, write the config and reload the filter */
if ($dirty) { /* If needed, write the config and reload the filter */
write_config(); if ($dirty) {
$retval = filter_configure(); write_config();
return true; $retval = filter_configure();
} else { return true;
return false; } else {
} return false;
}
} }
function easyrule_pass_rule_add($int, $proto, $srchost, $dsthost, $dstport, $ipproto) { function easyrule_pass_rule_add($int, $proto, $srchost, $dsthost, $dstport, $ipproto) {
global $config; global $config;
/* No rules, start a new array */ /* No rules, start a new array */
if (!is_array($config['filter']['rule'])) { if (!is_array($config['filter']['rule'])) {
$config['filter']['rule'] = array(); $config['filter']['rule'] = array();
} }
filter_rules_sort(); filter_rules_sort();
$a_filter = &$config['filter']['rule']; $a_filter = &$config['filter']['rule'];
/* Make up a new rule */ /* Make up a new rule */
$filterent = array(); $filterent = array();
$filterent['type'] = 'pass'; $filterent['type'] = 'pass';
$filterent['interface'] = $int; $filterent['interface'] = $int;
$filterent['ipprotocol'] = $ipproto; $filterent['ipprotocol'] = $ipproto;
$filterent['descr'] = gettext("Easy Rule: Passed from Firewall Log View"); $filterent['descr'] = gettext("Easy Rule: Passed from Firewall Log View");
if ($proto != "any") if ($proto != "any") {
$filterent['protocol'] = $proto; $filterent['protocol'] = $proto;
else } else {
unset($filterent['protocol']); unset($filterent['protocol']);
}
/* Default to only allow echo requests, since that's what most people want and
* it should be a safe choice. */ /* Default to only allow echo requests, since that's what most people want and
if ($proto == "icmp") * it should be a safe choice. */
$filterent['icmptype'] = 'echoreq'; if ($proto == "icmp") {
$filterent['icmptype'] = 'echoreq';
if ((strtolower($proto) == "icmp6") || (strtolower($proto) == "icmpv6")) }
$filterent['protocol'] = "icmp";
if ((strtolower($proto) == "icmp6") || (strtolower($proto) == "icmpv6")) {
if (is_subnet($srchost)) { $filterent['protocol'] = "icmp";
list($srchost, $srcmask) = explode("/", $srchost); }
} elseif (is_specialnet($srchost)) {
$srcmask = 0; if (is_subnet($srchost)) {
} elseif (is_ipaddrv6($srchost)) { list($srchost, $srcmask) = explode("/", $srchost);
$srcmask = 128; } elseif (is_specialnet($srchost)) {
} else { $srcmask = 0;
$srcmask = 32; } elseif (is_ipaddrv6($srchost)) {
} $srcmask = 128;
} else {
if (is_subnet($dsthost)) { $srcmask = 32;
list($dsthost, $dstmask) = explode("/", $dsthost); }
} elseif (is_specialnet($dsthost)) {
$dstmask = 0; if (is_subnet($dsthost)) {
} elseif (is_ipaddrv6($dsthost)) { list($dsthost, $dstmask) = explode("/", $dsthost);
$dstmask = 128; } elseif (is_specialnet($dsthost)) {
} else { $dstmask = 0;
$dstmask = 32; } elseif (is_ipaddrv6($dsthost)) {
} $dstmask = 128;
} else {
pconfig_to_address($filterent['source'], $srchost, $srcmask); $dstmask = 32;
pconfig_to_address($filterent['destination'], $dsthost, $dstmask, '', $dstport, $dstport); }
$filterent['created'] = make_config_revision_entry(); pconfig_to_address($filterent['source'], $srchost, $srcmask);
$a_filter[] = $filterent; pconfig_to_address($filterent['destination'], $dsthost, $dstmask, '', $dstport, $dstport);
write_config($filterent['descr']); $filterent['created'] = make_config_revision_entry();
$retval = filter_configure(); $a_filter[] = $filterent;
return true;
write_config($filterent['descr']);
$retval = filter_configure();
return true;
} }
function easyrule_parse_block($int, $src, $ipproto = "inet") { function easyrule_parse_block($int, $src, $ipproto = "inet") {
if (!empty($src) && !empty($int)) { if (!empty($src) && !empty($int)) {
$src = trim($src, "[]"); $src = trim($src, "[]");
if (!is_ipaddr($src) && !is_subnet($src)) { if (!is_ipaddr($src) && !is_subnet($src)) {
return gettext("Tried to block invalid IP:") . ' ' . htmlspecialchars($src); return gettext("Tried to block invalid IP:") . ' ' . htmlspecialchars($src);
} }
$int = easyrule_find_rule_interface($int); $int = easyrule_find_rule_interface($int);
if ($int === false) { if ($int === false) {
return gettext("Invalid interface for block rule:") . ' ' . htmlspecialchars($int); return gettext("Invalid interface for block rule:") . ' ' . htmlspecialchars($int);
} }
if (easyrule_block_host_add($src, $int, $ipproto)) { if (easyrule_block_host_add($src, $int, $ipproto)) {
return gettext("Host added successfully"); return gettext("Host added successfully");
} else { } else {
return gettext("Failed to create block rule, alias, or add host."); return gettext("Failed to create block rule, alias, or add host.");
} }
} else { } else {
return gettext("Tried to block but had no host IP or interface"); return gettext("Tried to block but had no host IP or interface");
} }
return gettext("Unknown block error."); return gettext("Unknown block error.");
} }
function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0, $ipproto = "inet") { function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0, $ipproto = "inet") {
/* Check for valid int, srchost, dsthost, dstport, and proto */ /* Check for valid int, srchost, dsthost, dstport, and proto */
$protocols_with_ports = array('tcp', 'udp'); $protocols_with_ports = array('tcp', 'udp');
$src = trim($src, "[]"); $src = trim($src, "[]");
$dst = trim($dst, "[]"); $dst = trim($dst, "[]");
if (!empty($int) && !empty($proto) && !empty($src) && !empty($dst)) { if (!empty($int) && !empty($proto) && !empty($src) && !empty($dst)) {
$int = easyrule_find_rule_interface($int); $int = easyrule_find_rule_interface($int);
if ($int === false) { if ($int === false) {
return gettext("Invalid interface for pass rule:") . ' ' . htmlspecialchars($int); return gettext("Invalid interface for pass rule:") . ' ' . htmlspecialchars($int);
} }
if (getprotobyname($proto) == -1) { if (getprotobyname($proto) == -1) {
return gettext("Invalid protocol for pass rule:") . ' ' . htmlspecialchars($proto); return gettext("Invalid protocol for pass rule:") . ' ' . htmlspecialchars($proto);
} }
if (!is_ipaddr($src) && !is_subnet($src) && !is_ipaddroralias($src) && !is_specialnet($src)) { if (!is_ipaddr($src) && !is_subnet($src) && !is_ipaddroralias($src) && !is_specialnet($src)) {
return gettext("Tried to pass invalid source IP:") . ' ' . htmlspecialchars($src); return gettext("Tried to pass invalid source IP:") . ' ' . htmlspecialchars($src);
} }
if (!is_ipaddr($dst) && !is_subnet($dst) && !is_ipaddroralias($dst) && !is_specialnet($dst)) { if (!is_ipaddr($dst) && !is_subnet($dst) && !is_ipaddroralias($dst) && !is_specialnet($dst)) {
return gettext("Tried to pass invalid destination IP:") . ' ' . htmlspecialchars($dst); return gettext("Tried to pass invalid destination IP:") . ' ' . htmlspecialchars($dst);
} }
if (in_array($proto, $protocols_with_ports)) { if (in_array($proto, $protocols_with_ports)) {
if (empty($dstport)) { if (empty($dstport)) {
return gettext("Missing destination port:") . ' ' . htmlspecialchars($dstport); return gettext("Missing destination port:") . ' ' . htmlspecialchars($dstport);
} }
if (!is_port($dstport) && ($dstport != "any")) { if (!is_port($dstport) && ($dstport != "any")) {
return gettext("Tried to pass invalid destination port:") . ' ' . htmlspecialchars($dstport); return gettext("Tried to pass invalid destination port:") . ' ' . htmlspecialchars($dstport);
} }
} else { } else {
$dstport = 0; $dstport = 0;
} }
/* Should have valid input... */ /* Should have valid input... */
if (easyrule_pass_rule_add($int, $proto, $src, $dst, $dstport, $ipproto)) { if (easyrule_pass_rule_add($int, $proto, $src, $dst, $dstport, $ipproto)) {
return gettext("Successfully added pass rule!"); return gettext("Successfully added pass rule!");
} else { } else {
return gettext("Failed to add pass rule."); return gettext("Failed to add pass rule.");
} }
} else { } else {
return gettext("Missing parameters for pass rule."); return gettext("Missing parameters for pass rule.");
} }
return gettext("Unknown pass error."); return gettext("Unknown pass error.");
} }
/******************************************************************************************************************** /********************************************************************************************************************
...@@ -384,102 +402,105 @@ function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0, $ipproto = ...@@ -384,102 +402,105 @@ function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0, $ipproto =
********************************************************************************************************************/ ********************************************************************************************************************/
function get_port_with_service($port, $proto) { function get_port_with_service($port, $proto) {
if (!$port) if (!$port) {
return ''; return '';
}
$service = getservbyport($port, $proto);
$portstr = ""; $service = getservbyport($port, $proto);
if ($service) { $portstr = "";
$portstr = sprintf('<span title="Service %s/%s: %s">' . htmlspecialchars($port) . '</span>', $port, $proto, $service); if ($service) {
} else { $portstr = sprintf('<span title="Service %s/%s: %s">' . htmlspecialchars($port) . '</span>', $port, $proto, $service);
$portstr = htmlspecialchars($port); } else {
} $portstr = htmlspecialchars($port);
return ':' . $portstr; }
return ':' . $portstr;
} }
function find_rule_by_number($rulenum, $type = 'block') function find_rule_by_number($rulenum, $type = 'block')
{ {
/* Passing arbitrary input to grep could be a Very Bad Thing(tm) */ /* Passing arbitrary input to grep could be a Very Bad Thing(tm) */
if (!is_numeric($rulenum) || !in_array($type, array('pass', 'block', 'match', 'rdr'))) if (!is_numeric($rulenum) || !in_array($type, array('pass', 'block', 'match', 'rdr'))) {
return; return;
}
$lookup_pattern = "^@{$rulenum}[[:space:]]{$type}[[:space:]].*[[:space:]]log[[:space:]]";
/* At the moment, miniupnpd is the only thing I know of that $lookup_pattern = "^@{$rulenum}[[:space:]]{$type}[[:space:]].*[[:space:]]log[[:space:]]";
generates logging rdr rules */ /* At the moment, miniupnpd is the only thing I know of that
unset($buffer); generates logging rdr rules */
if ($type == "rdr") unset($buffer);
$_gb = exec("/sbin/pfctl -vvPsn -a \"miniupnpd\" | /usr/bin/egrep " . escapeshellarg("^@{$rulenum}"), $buffer); if ($type == "rdr") {
else { $_gb = exec("/sbin/pfctl -vvPsn -a \"miniupnpd\" | /usr/bin/egrep " . escapeshellarg("^@{$rulenum}"), $buffer);
if (file_exists('/tmp/rules.debug')) { } else {
$_gb = exec('/sbin/pfctl -vvPnf /tmp/rules.debug 2>/dev/null | /usr/bin/egrep ' . escapeshellarg($lookup_pattern), $buffer); if (file_exists('/tmp/rules.debug')) {
} else { $_gb = exec('/sbin/pfctl -vvPnf /tmp/rules.debug 2>/dev/null | /usr/bin/egrep ' . escapeshellarg($lookup_pattern), $buffer);
$_gb = exec('/sbin/pfctl -vvPsr | /usr/bin/egrep ' . escapeshellarg($lookup_pattern), $buffer); } else {
} $_gb = exec('/sbin/pfctl -vvPsr | /usr/bin/egrep ' . escapeshellarg($lookup_pattern), $buffer);
} }
if (is_array($buffer)) }
return $buffer[0]; if (is_array($buffer)) {
return $buffer[0];
return ""; }
return "";
} }
function buffer_rules_load() function buffer_rules_load()
{ {
global $buffer_rules_rdr, $buffer_rules_normal; global $buffer_rules_rdr, $buffer_rules_normal;
unset($buffer, $buffer_rules_rdr, $buffer_rules_normal); unset($buffer, $buffer_rules_rdr, $buffer_rules_normal);
/* Redeclare globals after unset to work around PHP */ /* Redeclare globals after unset to work around PHP */
global $buffer_rules_rdr, $buffer_rules_normal; global $buffer_rules_rdr, $buffer_rules_normal;
$buffer_rules_rdr = array(); $buffer_rules_rdr = array();
$buffer_rules_normal = array(); $buffer_rules_normal = array();
$_gb = exec("/sbin/pfctl -vvPsn -a \"miniupnpd\" | grep '^@'", $buffer); $_gb = exec("/sbin/pfctl -vvPsn -a \"miniupnpd\" | grep '^@'", $buffer);
if (is_array($buffer)) { if (is_array($buffer)) {
foreach ($buffer as $line) { foreach ($buffer as $line) {
list($key, $value) = explode (" ", $line, 2); list($key, $value) = explode (" ", $line, 2);
$buffer_rules_rdr[$key] = $value; $buffer_rules_rdr[$key] = $value;
} }
} }
unset($buffer, $_gb); unset($buffer, $_gb);
if (file_exists('/tmp/rules.debug')) { if (file_exists('/tmp/rules.debug')) {
$_gb = exec("/sbin/pfctl -vvPnf /tmp/rules.debug 2>/dev/null | /usr/bin/egrep '^@[0-9]+\([0-9]+\)[[:space:]].*[[:space:]]log[[:space:]]' | /usr/bin/egrep -v '^@[0-9]+\([0-9]+\)[[:space:]](nat|rdr|binat|no|scrub)'", $buffer); $_gb = exec("/sbin/pfctl -vvPnf /tmp/rules.debug 2>/dev/null | /usr/bin/egrep '^@[0-9]+\([0-9]+\)[[:space:]].*[[:space:]]log[[:space:]]' | /usr/bin/egrep -v '^@[0-9]+\([0-9]+\)[[:space:]](nat|rdr|binat|no|scrub)'", $buffer);
} else { } else {
$_gb = exec("/sbin/pfctl -vvPsr | /usr/bin/egrep '^@[0-9]+\([0-9]+\)[[:space:]].*[[:space:]]log[[:space:]]'", $buffer); $_gb = exec("/sbin/pfctl -vvPsr | /usr/bin/egrep '^@[0-9]+\([0-9]+\)[[:space:]].*[[:space:]]log[[:space:]]'", $buffer);
} }
if (is_array($buffer)) { if (is_array($buffer)) {
foreach ($buffer as $line) { foreach ($buffer as $line) {
list($key, $value) = explode (" ", $line, 2); list($key, $value) = explode (" ", $line, 2);
$matches = array(); $matches = array();
if (preg_match('/\@(?P<rulenum>\d+)\)/', $key, $matches) == 1) { if (preg_match('/\@(?P<rulenum>\d+)\)/', $key, $matches) == 1) {
$key = "@{$matches['rulenum']}"; $key = "@{$matches['rulenum']}";
} }
$buffer_rules_normal[$key] = $value; $buffer_rules_normal[$key] = $value;
} }
} }
unset($_gb, $buffer); unset($_gb, $buffer);
} }
function buffer_rules_clear() function buffer_rules_clear()
{ {
unset($GLOBALS['buffer_rules_normal']); unset($GLOBALS['buffer_rules_normal']);
unset($GLOBALS['buffer_rules_rdr']); unset($GLOBALS['buffer_rules_rdr']);
} }
function find_rule_by_number_buffer($rulenum, $type) function find_rule_by_number_buffer($rulenum, $type)
{ {
global $buffer_rules_rdr, $buffer_rules_normal; global $buffer_rules_rdr, $buffer_rules_normal;
$lookup_key = "@{$rulenum}"; $lookup_key = "@{$rulenum}";
if ($type == "rdr") { if ($type == "rdr") {
$ruleString = $buffer_rules_rdr[$lookup_key]; $ruleString = $buffer_rules_rdr[$lookup_key];
//TODO: get the correct 'description' part of a RDR log line. currently just first 30 characters.. //TODO: get the correct 'description' part of a RDR log line. currently just first 30 characters..
$rulename = substr($ruleString,0,30); $rulename = substr($ruleString,0,30);
} else { } else {
$ruleString = $buffer_rules_normal[$lookup_key]; $ruleString = $buffer_rules_normal[$lookup_key];
list(,$rulename,) = explode("\"",$ruleString); list(,$rulename,) = explode("\"",$ruleString);
$rulename = str_replace("USER_RULE: ",'<span class="glyphicon glyphicon-user" title="USER_RULE" alt="USER_RULE"></span>',$rulename); $rulename = str_replace("USER_RULE: ",'<span class="glyphicon glyphicon-user" title="USER_RULE" alt="USER_RULE"></span>',$rulename);
} }
return "{$rulename} ({$lookup_key})"; return "{$rulename} ({$lookup_key})";
} }
...@@ -490,164 +511,175 @@ function find_rule_by_number_buffer($rulenum, $type) ...@@ -490,164 +511,175 @@ function find_rule_by_number_buffer($rulenum, $type)
# --- AJAX RESOLVE --- # --- AJAX RESOLVE ---
if (isset($_POST['resolve'])) { if (isset($_POST['resolve'])) {
$ip = strtolower($_POST['resolve']); $ip = strtolower($_POST['resolve']);
$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : ''); $res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
if ($res && $res != $ip) if ($res && $res != $ip) {
$response = array('resolve_ip' => $ip, 'resolve_text' => $res); $response = array('resolve_ip' => $ip, 'resolve_text' => $res);
else } else {
$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve")); $response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
}
echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
exit; exit;
} }
if (isset($_POST['easyrule'])) { if (isset($_POST['easyrule'])) {
$response = array("status"=>"unknown") ;
$response = array("status"=>"unknown") ; switch ($_POST['easyrule']) {
switch ($_POST['easyrule']) { case 'block':
case 'block': easyrule_parse_block($_POST['intf'], $_POST['srcip'], $_POST['ipproto']);
easyrule_parse_block($_POST['intf'], $_POST['srcip'], $_POST['ipproto']); $response["status"] = "block" ;
$response["status"] = "block" ; break;
break; case 'pass':
case 'pass': easyrule_parse_pass($_POST['intf'], $_POST['proto'], $_POST['srcip'], $_POST['dstip'], $_POST['dstport'], $_POST['ipproto']);
easyrule_parse_pass($_POST['intf'], $_POST['proto'], $_POST['srcip'], $_POST['dstip'], $_POST['dstport'], $_POST['ipproto']); $response["status"] = "pass" ;
$response["status"] = "pass" ; break;
break; }
}
echo json_encode(str_replace("\\","\\\\", $response));
exit;
echo json_encode(str_replace("\\","\\\\", $response));
exit;
} }
function getGETPOSTsettingvalue($settingname, $default) function getGETPOSTsettingvalue($settingname, $default)
{ {
$settingvalue = $default; $settingvalue = $default;
if(isset($_GET[$settingname])) if (isset($_GET[$settingname])) {
$settingvalue = $_GET[$settingname]; $settingvalue = $_GET[$settingname];
if(isset($_POST[$settingname])) }
$settingvalue = $_POST[$settingname]; if (isset($_POST[$settingname])) {
return $settingvalue; $settingvalue = $_POST[$settingname];
}
return $settingvalue;
} }
$rulenum = getGETPOSTsettingvalue('getrulenum', null); $rulenum = getGETPOSTsettingvalue('getrulenum', null);
if($rulenum) { if ($rulenum) {
list($rulenum, $type) = explode(',', $rulenum); list($rulenum, $type) = explode(',', $rulenum);
$rule = find_rule_by_number($rulenum, $type); $rule = find_rule_by_number($rulenum, $type);
echo gettext("The rule that triggered this action is") . ":\n\n{$rule}"; echo gettext("The rule that triggered this action is") . ":\n\n{$rule}";
exit; exit;
} }
$filterfieldsarray = array(); $filterfieldsarray = array();
$filtersubmit = getGETPOSTsettingvalue('filtersubmit', null); $filtersubmit = getGETPOSTsettingvalue('filtersubmit', null);
if ($filtersubmit) { if ($filtersubmit) {
$interfacefilter = getGETPOSTsettingvalue('interface', null); $interfacefilter = getGETPOSTsettingvalue('interface', null);
$filtertext = getGETPOSTsettingvalue('filtertext', ""); $filtertext = getGETPOSTsettingvalue('filtertext', "");
$filterlogentries_qty = getGETPOSTsettingvalue('filterlogentries_qty', null); $filterlogentries_qty = getGETPOSTsettingvalue('filterlogentries_qty', null);
$actpass = getGETPOSTsettingvalue('actpass', null); $actpass = getGETPOSTsettingvalue('actpass', null);
$actblock = getGETPOSTsettingvalue('actblock', null); $actblock = getGETPOSTsettingvalue('actblock', null);
$filterfieldsarray['act'] = str_replace(" ", " ", trim($actpass . " " . $actblock)); $filterfieldsarray['act'] = str_replace(" ", " ", trim($actpass . " " . $actblock));
$filterfieldsarray['act'] = $filterfieldsarray['act'] != "" ? $filterfieldsarray['act'] : 'All'; $filterfieldsarray['act'] = $filterfieldsarray['act'] != "" ? $filterfieldsarray['act'] : 'All';
$filterfieldsarray['time'] = getGETPOSTsettingvalue('filterlogentries_time', null); $filterfieldsarray['time'] = getGETPOSTsettingvalue('filterlogentries_time', null);
$filterfieldsarray['interface'] = getGETPOSTsettingvalue('filterlogentries_interfaces', null); $filterfieldsarray['interface'] = getGETPOSTsettingvalue('filterlogentries_interfaces', null);
$filterfieldsarray['srcip'] = getGETPOSTsettingvalue('filterlogentries_sourceipaddress', null); $filterfieldsarray['srcip'] = getGETPOSTsettingvalue('filterlogentries_sourceipaddress', null);
$filterfieldsarray['srcport'] = getGETPOSTsettingvalue('filterlogentries_sourceport', null); $filterfieldsarray['srcport'] = getGETPOSTsettingvalue('filterlogentries_sourceport', null);
$filterfieldsarray['dstip'] = getGETPOSTsettingvalue('filterlogentries_destinationipaddress', null); $filterfieldsarray['dstip'] = getGETPOSTsettingvalue('filterlogentries_destinationipaddress', null);
$filterfieldsarray['dstport'] = getGETPOSTsettingvalue('filterlogentries_destinationport', null); $filterfieldsarray['dstport'] = getGETPOSTsettingvalue('filterlogentries_destinationport', null);
$filterfieldsarray['proto'] = getGETPOSTsettingvalue('filterlogentries_protocol', null); $filterfieldsarray['proto'] = getGETPOSTsettingvalue('filterlogentries_protocol', null);
$filterfieldsarray['tcpflags'] = getGETPOSTsettingvalue('filterlogentries_protocolflags', null); $filterfieldsarray['tcpflags'] = getGETPOSTsettingvalue('filterlogentries_protocolflags', null);
$filterfieldsarray['version'] = getGETPOSTsettingvalue('filterlogentries_version', null); $filterfieldsarray['version'] = getGETPOSTsettingvalue('filterlogentries_version', null);
$filterlogentries_qty = getGETPOSTsettingvalue('filterlogentries_qty', null); $filterlogentries_qty = getGETPOSTsettingvalue('filterlogentries_qty', null);
} else { } else {
$interfacefilter = null; $interfacefilter = null;
$filterlogentries_qty = null ; $filterlogentries_qty = null ;
$filtertext = null; $filtertext = null;
foreach (array('act','time','interface','srcip','srcport','dstip','dstport','proto','tcpflags', 'version') as $tag) { foreach (array('act','time','interface','srcip','srcport','dstip','dstport','proto','tcpflags', 'version') as $tag) {
$filterfieldsarray[$tag] = null; $filterfieldsarray[$tag] = null;
} }
} }
$filter_logfile = '/var/log/filter.log'; $filter_logfile = '/var/log/filter.log';
if (isset($config['syslog']['nentries'])) { if (isset($config['syslog']['nentries'])) {
$nentries = $config['syslog']['nentries']; $nentries = $config['syslog']['nentries'];
} else { } else {
$nentries = 50; $nentries = 50;
} }
# Override Display Quantity # Override Display Quantity
if (isset($filterlogentries_qty) && $filterlogentries_qty != null) { if (isset($filterlogentries_qty) && $filterlogentries_qty != null) {
$nentries = $filterlogentries_qty; $nentries = $filterlogentries_qty;
} }
if (isset($_POST['clear'])) { if (isset($_POST['clear'])) {
clear_clog($filter_logfile); clear_clog($filter_logfile);
} }
include("head.inc"); include("head.inc");
?> ?>
<script src="/javascript/filter_log.js" type="text/javascript"></script>
<body> <body>
<script src="/javascript/filter_log.js" type="text/javascript"></script>
<?php include("fbegin.inc"); ?> <?php include("fbegin.inc"); ?>
<section class="page-content-main">
<section class="page-content-main"> <div class="container-fluid">
<div class="container-fluid"> <div class="row">
<div class="row"> <?php print_service_banner('firewall'); ?>
<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?>
<?php print_service_banner('firewall'); ?> <section class="col-xs-12">
<?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?> <div class="tab-content content-box col-xs-12">
<form id="filterlogentries" name="filterlogentries" action="diag_logs_filter.php" method="post">
<section class="col-xs-12"> <?php
<div class="tab-content content-box col-xs-12"> $Include_Act = explode(",", str_replace(" ", ",", $filterfieldsarray['act']));
<form id="filterlogentries" name="filterlogentries" action="diag_logs_filter.php" method="post"> if ($filterfieldsarray['interface'] == "All") $interface = "";
<?php ?>
$Include_Act = explode(",", str_replace(" ", ",", $filterfieldsarray['act'])); <div class="table-responsive" id="filterlogentries_show">
if ($filterfieldsarray['interface'] == "All") $interface = ""; <table class="table table-striped">
?> <thead>
<div class="table-responsive widgetconfigdiv" id="filterlogentries_show"> <tr>
<table class="table table-striped"> <th><?= gettext('Action') ?></th>
<thead> <th><?= gettext('Time and interface') ?></th>
<tr> <th><?= gettext('Source and destination IP Address') ?></th>
<th><?= gettext('Action') ?></th> <th><?= gettext('Source and destination port') ?></th>
<th><?= gettext('Time and interface') ?></th> <th><?= gettext('Protocol') ?></th>
<th><?= gettext('Source and destination IP Address') ?></th> <th><?= gettext('Protocol') ?></th>
<th><?= gettext('Source and destination port') ?></th> </tr>
<th><?= gettext('Protocol') ?></th> </thead>
<th><?= gettext('Protocol') ?></th> <tbody>
</tr> <tr>
</thead> <td>
<tbody> <label class="__nowrap">
<tr> <input id="actpass" name="actpass" type="checkbox" value="Pass" <?php if (in_arrayi('Pass', $Include_Act)) echo "checked=\"checked\""; ?> />&nbsp;&nbsp;Pass
<td> </label>
<label class="__nowrap"> </td>
<input id="actpass" name="actpass" type="checkbox" value="Pass" <?php if (in_arrayi('Pass', $Include_Act)) echo "checked=\"checked\""; ?> />&nbsp;&nbsp;Pass <td>
</label> <input type="text" class="form-control" placeholder="<?= gettext('Time') ?>" id="filterlogentries_time" name="filterlogentries_time" value="<?= $filterfieldsarray['time'] ?>">
</td> </td>
<td><input type="text" class="form-control" placeholder="<?= gettext('Time') ?>" id="filterlogentries_time" name="filterlogentries_time" value="<?= $filterfieldsarray['time'] ?>"></td> <td>
<td><input type="text" class="form-control" placeholder="<?= gettext('Source IP Address') ?>" id="filterlogentries_sourceipaddress" name="filterlogentries_sourceipaddress" value="<?= $filterfieldsarray['srcip'] ?>"></td> <input type="text" class="form-control" placeholder="<?= gettext('Source IP Address') ?>" id="filterlogentries_sourceipaddress" name="filterlogentries_sourceipaddress" value="<?= $filterfieldsarray['srcip'] ?>">
<td><input type="text" class="form-control" placeholder="<?= gettext('Source Port') ?>" id="filterlogentries_sourceport" name="filterlogentries_sourceport" value="<?= $filterfieldsarray['srcport'] ?>"></td> </td>
<td><input type="text" class="form-control" placeholder="<?= gettext('Protocol') ?>" id="filterlogentries_protocol" name="filterlogentries_protocol" value="<?= $filterfieldsarray['proto'] ?>"></td> <td>
<td><input type="text" class="form-control" placeholder="<?= gettext('Quantity') ?>" id="filterlogentries_qty" name="filterlogentries_qty" value="<?= $filterlogentries_qty ?>"></td> <input type="text" class="form-control" placeholder="<?= gettext('Source Port') ?>" id="filterlogentries_sourceport" name="filterlogentries_sourceport" value="<?= $filterfieldsarray['srcport'] ?>">
</tr> </td>
<tr> <td>
<td> <input type="text" class="form-control" placeholder="<?= gettext('Protocol') ?>" id="filterlogentries_protocol" name="filterlogentries_protocol" value="<?= $filterfieldsarray['proto'] ?>">
<label class="__nowrap"> </td>
<input id="actblock" name="actblock" type="checkbox" value="Block" <?php if (in_arrayi('Block', $Include_Act)) echo "checked=\"checked\""; ?> /> &nbsp;&nbsp;Block <td>
</label> <input type="text" class="form-control" placeholder="<?= gettext('Quantity') ?>" id="filterlogentries_qty" name="filterlogentries_qty" value="<?= $filterlogentries_qty ?>">
</td> </td>
<td><input type="text" class="form-control" placeholder="<?= gettext('Interface') ?>" id="filterlogentries_interfaces" name="filterlogentries_interfaces" value="<?= $filterfieldsarray['interface'] ?>"></td> </tr>
<td><input type="text" class="form-control" placeholder="<?= gettext('Destination IP Address') ?>" id="filterlogentries_destinationipaddress" name="filterlogentries_destinationipaddress" value="<?= $filterfieldsarray['dstip'] ?>"></td> <tr>
<td><input type="text" class="form-control" placeholder="<?= gettext('Destination Port') ?>" id="filterlogentries_destinationport" name="filterlogentries_destinationport" value="<?= $filterfieldsarray['dstport'] ?>"></td> <td>
<td><input type="text" class="form-control" placeholder="<?= gettext('Protocol Flags') ?>" id="filterlogentries_protocolflags" name="filterlogentries_protocolflags" value="<?= $filterfieldsarray['tcpflags'] ?>"></td> <label class="__nowrap">
<input id="actblock" name="actblock" type="checkbox" value="Block" <?php if (in_arrayi('Block', $Include_Act)) echo "checked=\"checked\""; ?> /> &nbsp;&nbsp;Block
</label>
</td>
<td>
<input type="text" class="form-control" placeholder="<?= gettext('Interface') ?>" id="filterlogentries_interfaces" name="filterlogentries_interfaces" value="<?= $filterfieldsarray['interface'] ?>">
</td>
<td>
<input type="text" class="form-control" placeholder="<?= gettext('Destination IP Address') ?>" id="filterlogentries_destinationipaddress" name="filterlogentries_destinationipaddress" value="<?= $filterfieldsarray['dstip'] ?>">
</td>
<td>
<input type="text" class="form-control" placeholder="<?= gettext('Destination Port') ?>" id="filterlogentries_destinationport" name="filterlogentries_destinationport" value="<?= $filterfieldsarray['dstport'] ?>">
</td>
<td>
<input type="text" class="form-control" placeholder="<?= gettext('Protocol Flags') ?>" id="filterlogentries_protocolflags" name="filterlogentries_protocolflags" value="<?= $filterfieldsarray['tcpflags'] ?>">
</td>
<td> <td>
<select class="form-control" id="filterlogentries_version" name="filterlogentries_version"> <select class="form-control" id="filterlogentries_version" name="filterlogentries_version">
<?php <?php
...@@ -662,230 +694,238 @@ include("head.inc"); ...@@ -662,230 +694,238 @@ include("head.inc");
</tr> </tr>
<tr> <tr>
<td colspan="6"> <td colspan="6">
<span class="vexpl"><a href="http://en.wikipedia.org/wiki/Transmission_Control_Protocol">TCP Flags</a>: F - FIN, S - SYN, A or . - ACK, R - RST, P - PSH, U - URG, E - ECE, W - CWR</span> <span><a href="http://en.wikipedia.org/wiki/Transmission_Control_Protocol">TCP Flags</a>: F - FIN, S - SYN, A or . - ACK, R - RST, P - PSH, U - URG, E - ECE, W - CWR</span>
</td> </td>
</tr> </tr>
<tr> <tr>
<td colspan="6"> <td colspan="6">
<input id="filtersubmit" name="filtersubmit" type="submit" class="btn btn-primary" style="vertical-align:top;" value="<?=gettext("Filter");?>" /> <input id="filtersubmit" name="filtersubmit" type="submit" class="btn btn-primary" style="vertical-align:top;" value="<?=gettext("Filter");?>" />
<div class="pull-right"> <div class="pull-right">
<input name="clear" type="submit" class="btn" value="<?= gettext("Clear log");?>" /> <input name="clear" type="submit" class="btn" value="<?= gettext("Clear log");?>" />
</div> </div>
</td> </td>
</tr> </tr>
</tbody> </tbody>
</table> </table>
</div> </div>
</form>
</form> </div>
</div> </section>
</section> <section class="col-xs-12">
<section class="col-xs-12"> <div class="tab-content content-box col-xs-12">
<div class="table-responsive">
<div class="tab-content content-box col-xs-12"> <table class="table table-striped">
<?php
<div class="table-responsive"> $iflist = get_configured_interface_with_descr(false, true);
<table class="table table-striped table-sort"> if (isset($iflist[$interfacefilter])) {
$interfacefilter = $iflist[$interfacefilter];
}
<?php if (isset($filtersubmit)) {
$iflist = get_configured_interface_with_descr(false, true); $filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filterfieldsarray);
if (isset($iflist[$interfacefilter])) } else {
$interfacefilter = $iflist[$interfacefilter]; $filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filtertext, $interfacefilter);
if (isset($filtersubmit)) }
$filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filterfieldsarray); ?>
else <tr>
$filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filtertext, $interfacefilter); <td colspan="<?=isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions']==="1"?7:6?>">
<strong>
?> <?php
<tr> if ( (!$filtertext) && (!$filterfieldsarray) ) {
<td colspan="<?=isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions']==="1"?7:6?>" class="listtopic"> printf(gettext("Last %s firewall log entries."),count($filterlog));
<strong> } else {
<?php if ( (!$filtertext) && (!$filterfieldsarray) ) echo sprintf(gettext('Showing %s matching log entries (maximum is %s).'), count($filterlog), $nentries);
printf(gettext("Last %s firewall log entries."),count($filterlog)); }?>
else </strong>
echo sprintf(gettext('Showing %s matching log entries (maximum is %s).'), count($filterlog), $nentries);?> </td>
</strong> </tr>
</td> <tr>
</tr> <td width="50"><?=gettext("Act");?></td>
<tr class="sortableHeaderRowIdentifier"> <td><?=gettext("Time");?></td>
<td width="50" class="listhdrr"><?=gettext("Act");?></td> <td><?=gettext("If");?></td>
<td class="listhdrr"><?=gettext("Time");?></td> <?php if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "1"):?>
<td class="listhdrr"><?=gettext("If");?></td> <td width="10%"><?=gettext("Rule");?></td>
<?php if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "1"):?> <?php endif;?>
<td width="10%" class="listhdrr"><?=gettext("Rule");?></td> <td><?=gettext("Source");?></td>
<?php endif;?> <td><?=gettext("Destination");?></td>
<td class="listhdrr"><?=gettext("Source");?></td> <td><?=gettext("Proto");?></td>
<td class="listhdrr"><?=gettext("Destination");?></td> </tr>
<td class="listhdrr"><?=gettext("Proto");?></td> <?php
</tr> if (isset($config['syslog']['filterdescriptions'])) {
<?php buffer_rules_load();
if (isset($config['syslog']['filterdescriptions'])) }
buffer_rules_load(); $rowIndex = 0;
$rowIndex = 0; foreach ($filterlog as $filterent):
foreach ($filterlog as $filterent): $evenRowClass = $rowIndex % 2 ? " listMReven" : " listMRodd";
$evenRowClass = $rowIndex % 2 ? " listMReven" : " listMRodd"; $rowIndex++;?>
$rowIndex++;?> <tr class="<?=$evenRowClass?>">
<tr class="<?=$evenRowClass?>"> <td>
<td class="listMRlr nowrap" align="center" sorttable_customkey="<?=$filterent['act']?>"> <a href="#" onclick="javascript:getURL('diag_logs_filter.php?getrulenum=<?php echo "{$filterent['rulenum']},{$filterent['act']}"; ?>', outputrule);" title="<?php echo $filterent['act'];?>">
<a href="#" onclick="javascript:getURL('diag_logs_filter.php?getrulenum=<?php echo "{$filterent['rulenum']},{$filterent['act']}"; ?>', outputrule);" title="<?php echo $filterent['act'];?>"><span class="glyphicon glyphicon-<?php switch ($filterent['act']) { <span class="glyphicon glyphicon-<?php switch ($filterent['act']) {
case 'pass': case 'pass':
echo "play"; /* icon triangle */ echo "play"; /* icon triangle */
break; break;
case 'match': case 'match':
echo "random"; echo "random";
break; break;
case 'reject': case 'reject':
case 'block': case 'block':
default: default:
echo 'remove'; /* a x*/ echo 'remove'; /* a x*/
break; break;
} }?>">
?>"></span></a></td> </span>
<?php if (isset($filterent['count'])) echo $filterent['count'];?></a></center></td> </a>
<td class="listMRr nowrap"><?php echo htmlspecialchars($filterent['time']);?></td> </td>
<td class="listMRr nowrap"> <td><?php echo htmlspecialchars($filterent['time']);?></td>
<?php if ($filterent['direction'] == "out"): ?> <td>
<span class="glyphicon glyphicon-cloud-download" alt="<?= gettext('Direction=OUT') ?>" title="<?= gettext('Direction=OUT') ?>"></span> <?php
<?php endif; ?> if ($filterent['direction'] == "out"): ?>
<?php echo htmlspecialchars($filterent['interface']);?></td> <span class="glyphicon glyphicon-cloud-download" alt="<?= gettext('Direction=OUT') ?>" title="<?= gettext('Direction=OUT') ?>"></span>
<?php <?php
if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "1") endif; ?>
echo("<td class=\"listMRr nowrap\">".find_rule_by_number_buffer($filterent['rulenum'],$filterent['act'])."</td>"); <?=htmlspecialchars($filterent['interface']);?>
</td>
$int = strtolower($filterent['interface']); <?php
$proto = strtolower($filterent['proto']); if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "1") {
if($filterent['version'] == '6') { echo("<td class=\"listMRr nowrap\">".find_rule_by_number_buffer($filterent['rulenum'],$filterent['act'])."</td>");
$ipproto = "inet6"; }
$filterent['srcip'] = "[{$filterent['srcip']}]";
$filterent['dstip'] = "[{$filterent['dstip']}]"; $int = strtolower($filterent['interface']);
} else { $proto = strtolower($filterent['proto']);
$ipproto = "inet"; if($filterent['version'] == '6') {
} $ipproto = "inet6";
if (!isset($filterent['srcport'])) $filterent['srcport'] = null ; $filterent['srcip'] = "[{$filterent['srcip']}]";
$srcstr = $filterent['srcip'] . get_port_with_service($filterent['srcport'], $proto); $filterent['dstip'] = "[{$filterent['dstip']}]";
$src_htmlclass = str_replace(array('.', ':'), '-', $filterent['srcip']); } else {
if (!isset($filterent['dstport'])) $filterent['dstport'] = null ; $ipproto = "inet";
$dststr = $filterent['dstip'] . get_port_with_service($filterent['dstport'], $proto); }
$dst_htmlclass = str_replace(array('.', ':'), '-', $filterent['dstip']); if (!isset($filterent['srcport'])) {
?> $filterent['srcport'] = null ;
<td class="listMRr nowrap"> }
<span onclick="javascript:resolve_with_ajax('<?php echo "{$filterent['srcip']}"; ?>');" title="<?=gettext("Click to resolve");?>" class="ICON-<?= $src_htmlclass; ?>" alt="Icon Reverse Resolve with DNS"><span class="btn btn-default btn-xs glyphicon glyphicon-info-sign"></span></span> $srcstr = $filterent['srcip'] . get_port_with_service($filterent['srcport'], $proto);
$src_htmlclass = str_replace(array('.', ':'), '-', $filterent['srcip']);
<a title="<?=gettext("Easy Rule: Add to Block List");?>" href="#blockEasy" class="btn btn-danger btn-xs easy_block"> if (!isset($filterent['dstport'])) {
<input type="hidden" value="<?= $filterent['srcip']; ?>" id="srcip"/> $filterent['dstport'] = null ;
<input type="hidden" value="<?= $int;?>" id="intf"/> }
<input type="hidden" value="<?= $ipproto;?>" id="ipproto"/> $dststr = $filterent['dstip'] . get_port_with_service($filterent['dstport'], $proto);
<span class="glyphicon glyphicon-remove" alt="Icon Easy Rule: Add to Block List"></span></a> $dst_htmlclass = str_replace(array('.', ':'), '-', $filterent['dstip']);
<?php echo $srcstr . '<span class="RESOLVE-' . $src_htmlclass . '"></span>';?> ?>
</td> <td>
<td class="listMRr nowrap"> <span onclick="javascript:resolve_with_ajax('<?php echo "{$filterent['srcip']}"; ?>');" title="<?=gettext("Click to resolve");?>" class="ICON-<?= $src_htmlclass; ?>" alt="Icon Reverse Resolve with DNS"><span class="btn btn-default btn-xs glyphicon glyphicon-info-sign"></span></span>
<span onclick="javascript:resolve_with_ajax('<?php echo "{$filterent['dstip']}"; ?>');" title="<?=gettext("Click to resolve");?>" class="ICON-<?= $dst_htmlclass; ?>" alt="Icon Reverse Resolve with DNS"><span class="btn btn-default btn-xs glyphicon glyphicon-info-sign"></span></span> <a title="<?=gettext("Easy Rule: Add to Block List");?>" href="#blockEasy" class="btn btn-danger btn-xs easy_block">
<a title="<?=gettext("Easy Rule: Pass this traffic");?>" href="#blockEasy" class="btn btn-success btn-xs easy_pass"> <input type="hidden" value="<?= $filterent['srcip']; ?>" class="srcip"/>
<input type="hidden" value="<?= $filterent['srcip']; ?>" id="srcip"/> <input type="hidden" value="<?= $int;?>" class="intf"/>
<input type="hidden" value="<?= $filterent['dstip']; ?>" id="dstip"/> <input type="hidden" value="<?= $ipproto;?>" class="ipproto"/>
<input type="hidden" value="<?= $filterent['dstport']; ?>" id="dstport"/> <span class="glyphicon glyphicon-remove" alt="Icon Easy Rule: Add to Block List"></span></a>
<input type="hidden" value="<?= $int;?>" id="intf"/> <?php echo $srcstr . '<span class="RESOLVE-' . $src_htmlclass . '"></span>';?>
<input type="hidden" value="<?= $proto;?>" id="proto"/> </td>
<input type="hidden" value="<?= $ipproto;?>" id="ipproto"/> <td>
<span class="glyphicon glyphicon-play" alt="<?= gettext('Icon Easy Rule: Pass this traffic') ?>"></span></a> <span onclick="javascript:resolve_with_ajax('<?php echo "{$filterent['dstip']}"; ?>');" title="<?=gettext("Click to resolve");?>" class="ICON-<?= $dst_htmlclass; ?>" alt="Icon Reverse Resolve with DNS"><span class="btn btn-default btn-xs glyphicon glyphicon-info-sign"></span></span>
<?php echo $dststr . '<span class="RESOLVE-' . $dst_htmlclass . '"></span>';?> <a title="<?=gettext("Easy Rule: Pass this traffic");?>" href="#blockEasy" class="btn btn-success btn-xs easy_pass">
</td> <input type="hidden" value="<?= $filterent['srcip']; ?>" class="srcip"/>
<?php <input type="hidden" value="<?= $filterent['dstip']; ?>" class="dstip"/>
if ($filterent['proto'] == "TCP") <input type="hidden" value="<?= $filterent['dstport']; ?>" class="dstport"/>
$filterent['proto'] .= ":{$filterent['tcpflags']}"; <input type="hidden" value="<?= $int;?>" class="intf"/>
?> <input type="hidden" value="<?= $proto;?>" class="proto"/>
<td class="listMRr nowrap"><?php echo htmlspecialchars($filterent['proto']);?></td> <input type="hidden" value="<?= $ipproto;?>" class="ipproto"/>
</tr> <span class="glyphicon glyphicon-play" alt="<?= gettext('Icon Easy Rule: Pass this traffic') ?>"></span></a>
<?php if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "2"):?> <?php echo $dststr . '<span class="RESOLVE-' . $dst_htmlclass . '"></span>';?>
<tr class="<?=$evenRowClass?>"> </td>
<td colspan="2" class="listMRDescriptionL listMRlr" /> <?php
<td colspan="4" class="listMRDescriptionR listMRr nowrap"><?=find_rule_by_number_buffer($filterent['rulenum'],$filterent['act']);?></td> if ($filterent['proto'] == "TCP") {
</tr> $filterent['proto'] .= ":{$filterent['tcpflags']}";
<?php endif; }?>
endforeach; <td>
buffer_rules_clear(); ?> <?php echo htmlspecialchars($filterent['proto']);?>
</td>
</table> </tr>
</div> <?php
</td> if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "2"):?>
</tr> <tr class="<?=$evenRowClass?>">
</table> <td colspan="2"></td>
</div> <td colspan="4"><?=find_rule_by_number_buffer($filterent['rulenum'],$filterent['act']);?></td>
</section> </tr>
</div> <?php
</div> endif;
</section> endforeach;
buffer_rules_clear(); ?>
</table>
</div>
</div>
</section>
</div>
</div>
</section>
<!-- AJAXY STUFF --> <!-- AJAXY STUFF -->
<script type="text/javascript"> <script type="text/javascript">
//<![CDATA[ //<![CDATA[
$( document ).ready(function() { $( document ).ready(function() {
$(".easy_block").click(function(){ $(".easy_block").click(function(){
$.ajax( $.ajax(
"/diag_logs_filter.php", "/diag_logs_filter.php",
{ {
type: 'post', type: 'post',
dataType: 'json', dataType: 'json',
data: { data: {
easyrule:'block', easyrule:'block',
srcip:$(this).find('#srcip').val(), srcip:$(this).find('.srcip').val(),
ipproto:$(this).find('#ipproto').val(), ipproto:$(this).find('.ipproto').val(),
intf:$(this).find('#intf').val() intf:$(this).find('.intf').val()
}, },
complete: function(data,status) { complete: function(data,status) {
alert("<?= gettext('added block rule') ?>"); alert("<?= gettext('added block rule') ?>");
}, },
}); });
}); });
$(".easy_pass").click(function(){ $(".easy_pass").click(function(){
$.ajax( $.ajax(
"/diag_logs_filter.php", "/diag_logs_filter.php",
{ {
type: 'post', type: 'post',
dataType: 'json', dataType: 'json',
data: { data: {
easyrule:'pass', easyrule:'pass',
srcip:$(this).find('#srcip').val(), srcip:$(this).find('.srcip').val(),
dstip:$(this).find('#dstip').val(), dstip:$(this).find('.dstip').val(),
dstport:$(this).find('#dstport').val(), dstport:$(this).find('.dstport').val(),
proto:$(this).find('#proto').val(), proto:$(this).find('.proto').val(),
ipproto:$(this).find('#ipproto').val(), ipproto:$(this).find('.ipproto').val(),
intf:$(this).find('#intf').val() intf:$(this).find('.intf').val()
}, },
complete: function(data,status) { complete: function(data,status) {
alert("<?= gettext('added pass rule') ?>"); alert("<?= gettext('added pass rule') ?>");
}, },
}); });
}); });
}); });
function resolve_with_ajax(ip_to_resolve) { function resolve_with_ajax(ip_to_resolve) {
var url = "/diag_logs_filter.php"; var url = "/diag_logs_filter.php";
jQuery.ajax( jQuery.ajax(
url, url,
{ {
type: 'post', type: 'post',
dataType: 'json', dataType: 'json',
data: { data: {
resolve: ip_to_resolve, resolve: ip_to_resolve,
}, },
complete: resolve_ip_callback complete: resolve_ip_callback
}); });
} }
function resolve_ip_callback(transport) { function resolve_ip_callback(transport) {
var response = jQuery.parseJSON(transport.responseText); var response = jQuery.parseJSON(transport.responseText);
var resolve_class = htmlspecialchars(response.resolve_ip.replace(/[.:]/g, '-')); var resolve_class = htmlspecialchars(response.resolve_ip.replace(/[.:]/g, '-'));
var resolve_text = '<small><br />' + htmlspecialchars(response.resolve_text) + '<\/small>'; var resolve_text = '<small><br />' + htmlspecialchars(response.resolve_text) + '<\/small>';
jQuery('span.RESOLVE-' + resolve_class).html(resolve_text); jQuery('span.RESOLVE-' + resolve_class).html(resolve_text);
} }
// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities // From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023