<?php /* Copyright (C) 2016 Deciso B.V. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ require_once("guiconfig.inc"); require_once("pfsense-utils.inc"); require_once("interfaces.inc"); /** * kill tcp dump process */ function stop_capture() { $processes_running = trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep packetcapture.cap | /usr/bin/egrep -v '(pflog|grep)'")); foreach (explode("\n", $processes_running) as $process) { exec("kill ". explode(' ',$process)[0]); } } /** * start capture operation * @param array $option, options to pass to tpcdump (interface, promiscuous, snaplen, fam, host, proto, port) */ function start_capture($options) { $cmd_opts = array(); $filter_opts = array(); $intf = get_real_interface($options['interface']); $cmd_opts[] = '-i ' . $intf; if (empty($options['promiscuous'])) { // disable promiscuous mode $cmd_opts[] = '-p'; } if (!empty($options['snaplen']) && is_numeric($options['snaplen'])) { // setup Packet Length $cmd_opts[] = '-s '. $options['snaplen']; } if (!empty($options['count']) && is_numeric($options['count'])) { // setup count $cmd_opts[] = '-c '. $options['count']; } if (!empty($options['fam']) && in_array($options['fam'], array('ip', 'ip6'))) { // filter address family $filter_opts[] = $options['fam']; } if (!empty($options['proto'])) { // filter protocol $filter_opts[] = $options['proto']; } if (!empty($options['host'])) { // filter host argument $filter = ''; $prev_token = ''; foreach (explode(' ', $options['host']) as $token) { if (in_array(trim($token), array('and', 'or'))) { $filter .= $token; } elseif (is_ipaddr($token)) { $filter .= "host " . $prev_token . " " . $token; } elseif (is_subnet($token)) { $filter .= "net " . $prev_token . " " . $token; } if (trim($token) == 'not') { $prev_token = 'not'; } else { $prev_token = ''; } $filter .= " "; } $filter_opts[] = "( ". $filter . " )"; } if (!empty($options['port'])) { // filter port $filter_opts[] = "port " . str_replace("!", "not ", $options['port']); } if (!empty($intf)) { $cmd = '/usr/sbin/tcpdump '; $cmd .= implode(' ', $cmd_opts); $cmd .= ' -w /root/packetcapture.cap '; $cmd .= " ".escapeshellarg(implode(' and ', $filter_opts)); //delete previous packet capture if it exists if (file_exists('/root/packetcapture.cap')) { unlink ('/root/packetcapture.cap'); } mwexec_bg($cmd); } } /** * check if packetcapture is running * @return bool */ function capture_running() { $processcheck = (trim(shell_exec("/bin/ps axw -O pid= | /usr/bin/grep tcpdump | /usr/bin/grep packetcapture.cap | /usr/bin/egrep -v '(pflog|grep)'"))); if (!empty($processcheck)) { return true; } else { return false; } } // define selectable interfaces $interfaces = get_configured_interface_with_descr(); if (isset($config['ipsec']['enable'])) { $interfaces['ipsec'] = 'IPsec'; } foreach (array('server', 'client') as $mode) { if (isset($config['openvpn']["openvpn-{$mode}"])) { foreach ($config['openvpn']["openvpn-{$mode}"] as $id => $setting) { if (!isset($setting['disable'])) { $interfaces['ovpn' . substr($mode, 0, 1) . $setting['vpnid']] = gettext("OpenVPN") . " ".$mode.": ".htmlspecialchars($setting['description']); } } } } if ($_SERVER['REQUEST_METHOD'] === 'GET') { if (isset($_GET['download'])) { // download capture file header("Content-Type: application/octet-stream"); header("Content-Disposition: attachment; filename=packetcapture.cap"); header("Content-Length: ".filesize("/root/packetcapture.cap")); readfile("/root/packetcapture.cap"); exit; } elseif (!empty($_GET['view'])) { // download capture contents if (!empty($_GET['dnsquery'])) { //if dns lookup is checked $disabledns = ""; } else { //if dns lookup is unchecked $disabledns = "-n"; } $detail_args = ""; switch (!empty($_GET['detail']) ? $_GET['detail'] : null) { case "full": $detail_args = "-vv -e"; break; case "high": $detail_args = "-vv"; break; case "medium": $detail_args = "-v"; break; case "normal": default: $detail_args = "-q"; break; } $result = array(); $dump_output = array(); exec("/usr/sbin/tcpdump {$disabledns} {$detail_args} -r /root/packetcapture.cap", $dump_output); // reformat raw output to 1 packet per array item foreach ($dump_output as $line) { if ($line[0] == ' ' && count($result) > 0) { $result[count($result)-1] .= "\n" . $line; } else { $result[] = $line; } } echo json_encode($result); exit; } else { // set form defaults $pconfig = array(); $pconfig['interface'] = "WAN"; $pconfig['promiscuous'] = null; $pconfig['fam'] = null; $pconfig['proto'] = null; $pconfig['host'] = null; $pconfig['port'] = null; $pconfig['snaplen'] = null; $pconfig['count'] = 100; } } elseif ($_SERVER['REQUEST_METHOD'] === 'POST') { $input_errors = array(); $pconfig = $_POST; if (!empty($_POST['start'])) { if (!array_key_exists($pconfig['interface'], $interfaces)) { $input_errors[] = gettext("Invalid interface."); } if ($pconfig['fam'] !== "" && $pconfig['fam'] !== "ip" && $pconfig['fam'] !== "ip6") { $input_errors[] = gettext("Invalid address family."); } $protos = array('icmp', 'icmp6', 'tcp', 'udp', 'arp', 'carp', 'esp', '!icmp', '!icmp6', '!tcp', '!udp', '!arp', '!carp', '!esp'); if ($pconfig['proto'] !== "" && !in_array(ltrim(trim($pconfig['proto']), '!'), $protos)) { $input_errors[] = gettext("Invalid protocol."); } if (!empty($pconfig['host'])) { foreach (explode(' ', $pconfig['host']) as $token) { if (!in_array(trim($token), array('and', 'or','not')) && !is_ipaddr($token) && !is_subnet($token) ) { $input_errors[] = sprintf(gettext("A valid IP address or CIDR block must be specified. [%s]"), $token); } } } if (!empty($pconfig['port']) && !is_port(ltrim(trim($pconfig['port']), 'not'))) { $input_errors[] = gettext("Invalid value specified for port."); } if (!empty($pconfig['snaplen']) && (!is_numeric($pconfig['snaplen']) || $snaplen < 0)) { $input_errors[] = gettext("Invalid value specified for packet length."); } if (!empty($pconfig['count']) && (!is_numeric($pconfig['count']) || $count < 0)) { $input_errors[] = gettext("Invalid value specified for packet count."); } if (count($input_errors) == 0) { start_capture($pconfig); } } elseif (!empty($pconfig['stop'])) { stop_capture(); } elseif (!empty($pconfig['remove'])) { if (file_exists('/root/packetcapture.cap')) { unlink ('/root/packetcapture.cap'); } header("Location: diag_packet_capture.php"); exit; } } legacy_html_escape_form_data($pconfig); include("head.inc"); ?> <body> <script type="text/javascript"> $( document ).ready(function() { $("#view").click(function(){ $.ajax("diag_packet_capture.php",{ type: 'get', cache: false, dataType: "json", data: {view: 'view', 'dnsquery': $("#dnsquery:checked").val() ,'detail': $("#detail").val()}, success: function(response) { var html = []; $.each(response, function(idx, line){ html.push('<tr><td>'+line+'</td></tr>'); }); $("#capture_output").html(html.join('')); $("#capture").removeClass('hidden'); // scroll to capture output $('html, body').animate({ scrollTop: $("#capture").offset().top }, 2000); } }); }); }); </script> <?php include("fbegin.inc"); ?> <section class="page-content-main"> <div class="container-fluid"> <div class="row"> <section class="col-xs-12"> <div class="content-box"> <?php if (isset($input_errors) && count($input_errors) > 0) print_input_errors($input_errors); ?> <div class="table-responsive"> <form method="post" name="iform" id="iform"> <table class="table table-striped"> <thead> <tr> <td width="22%"><strong><?=gettext("Packet capture");?></strong></td> <td width="78%" align="right"> <small><?=gettext("full help"); ?> </small> <i class="fa fa-toggle-off text-danger" style="cursor: pointer;" id="show_all_help_page" type="button"></i></a> </td> </tr> </thead> <tbody> <tr> <td><a id="help_for_if" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Interface");?></td> <td> <select name="interface" class="form-control"> <?php foreach ($interfaces as $iface => $ifacename): ?> <option value="<?=$iface;?>" <?=$pconfig['interface'] == $iface ? "selected=\"selected\"" : ""; ?>> <?=$ifacename;?> </option> <?php endforeach; ?> </select> <div class="hidden" for="help_for_if"> <?=gettext("Select the interface on which to capture traffic.");?> </div> </td> </tr> <tr> <td><a id="help_for_promiscuous" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Promiscuous");?></td> <td> <input name="promiscuous" type="checkbox" <?= !empty($pconfig['promiscuous']) ? " checked=\"checked\"" : ""; ?> /> <div class="hidden" for="help_for_promiscuous"> <?=gettext("If checked, the");?> <a target="_blank" href="http://www.freebsd.org/cgi/man.cgi?query=tcpdump&apropos=0&sektion=0&manpath=FreeBSD+8.3-stable&arch=default&format=html"><?= gettext("packet capture")?></a> <?= gettext("will be performed using promiscuous mode.");?> <br /><b><?=gettext("Note");?>: </b><?=gettext("Some network adapters do not support or work well in promiscuous mode.");?> </div> </td> </tr> <tr> <td><a id="help_for_fam" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Address Family");?></td> <td> <select name="fam" class="form-control"> <option value=""><?=gettext('Any') ?></option> <option value="ip" <?=!empty($pconfig['fam'] == "ip") ? "selected=\"selected\"" : ""; ?>> <?= gettext('IPv4 Only') ?> </option> <option value="ip6" <?=!empty($pconfig['fam'] == "ip6") ? "selected=\"selected\"" : ""; ?>> <?= gettext('IPv6 Only') ?> </option> </select> <div class="hidden" for="help_for_fam"> <?=gettext("Select the type of traffic to be captured, either Any, IPv4 only or IPv6 only.");?> </div> </td> </tr> <tr> <td><a id="help_for_proto" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Protocol");?></td> <td> <select name="proto" class="form-control"> <option value=""><?=gettext('Any') ?></option> <option value="icmp" <?=$pconfig['proto'] == "icmp" ? "selected=\"selected\"" : ""; ?>><?= gettext('ICMP') ?></option> <option value="!icmp" <?=$pconfig['proto'] == "!icmp" ? "selected=\"selected\"" : ""; ?>><?= gettext('Exclude ICMP') ?></option> <option value="icmp6" <?=$pconfig['proto'] == "icmp6" ? "selected=\"selected\"" : ""; ?>><?= gettext('ICMPv6') ?></option> <option value="!icmp6" <?=$pconfig['proto'] == "!icmp6" ? "selected=\"selected\"" : ""; ?>><?= gettext('Exclude ICMPv6') ?></option> <option value="tcp" <?=$pconfig['proto'] == "tcp" ? "selected=\"selected\"" : ""; ?>><?= gettext('TCP') ?></option> <option value="!tcp" <?=$pconfig['proto'] == "!tcp" ? "selected=\"selected\"" : ""; ?>><?= gettext('Exclude TCP') ?></option> <option value="udp" <?=$pconfig['proto'] == "udp" ? "selected=\"selected\"" : ""; ?>><?= gettext('UDP') ?></option> <option value="!udp" <?=$pconfig['proto'] == "!udp" ? "selected=\"selected\"" : ""; ?>><?= gettext('Exclude UDP') ?></option> <option value="arp" <?=$pconfig['proto'] == "arp" ? "selected=\"selected\"" : ""; ?>><?= gettext('ARP') ?></option> <option value="!arp" <?=$pconfig['proto'] == "!arp" ? "selected=\"selected\"" : ""; ?>><?= gettext('Exclude ARP') ?></option> <option value="carp" <?=$pconfig['proto'] == "carp" ? "selected=\"selected\"" : ""; ?>><?= gettext('CARP (VRRP)') ?></option> <option value="!carp" <?=$pconfig['proto'] == "!carp" ? "selected=\"selected\"" : ""; ?>><?= gettext('Exclude CARP (VRRP)') ?></option> <option value="esp" <?=$pconfig['proto'] == "esp" ? "selected=\"selected\"" : ""; ?>><?= gettext('ESP') ?></option> </select> <div class="hidden" for="help_for_proto"> <?=gettext("Select the protocol to capture, or Any.");?> </div> </td> </tr> <tr> <td><a id="help_for_host" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Host Address");?></td> <td> <input type="text" name="host" value="<?=$pconfig['host'];?>" /> <div class="hidden" for="help_for_host"> <?=gettext("This value is either the Source or Destination IP address or subnet in CIDR notation. The packet capture will look for this address in either field.");?> <?=gettext("Matching can be negated by preceding the value with \"not\". Multiple IP addresses or CIDR subnets may be specified as boolean expresion.");?> <?=gettext("If you leave this field blank, all packets on the specified interface will be captured.");?> <br/><br/><?=gettext("Example:");?> not 10.0.0.0/24 not and not 11.0.0.1 </div> </td> </tr> <tr> <td><a id="help_for_port" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Port");?></td> <td> <input type="text" name="port" value="<?=$pconfig['port'];?>" /> <div class="hidden" for="help_for_port"> <?=gettext("The port can be either the source or destination port. The packet capture will look for this port in either field.");?> <?=gettext("Leave blank if you do not want to filter by port.");?> </div> </td> </tr> <tr> <td><a id="help_for_snaplen" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Packet Length");?></td> <td> <input type="text" name="snaplen" value="<?=$pconfig['snaplen'];?>" /> <div class="hidden" for="help_for_snaplen"> <?=gettext("The Packet length is the number of bytes of each packet that will be captured. Default value is 0, which will capture the entire frame regardless of its size.");?> </div> </td> </tr> <tr> <td><a id="help_for_count" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Count");?></td> <td> <input type="text" name="count" class="formfld unknown" id="count" size="5" value="<?=$pconfig['count'];?>" /> <div class="hidden" for="help_for_count"> <?=gettext("This is the number of packets the packet capture will grab. Default value is 100.") . "<br />" . gettext("Enter 0 (zero) for no count limit.");?> </div> </td> </tr> <tr> <td colspan="2"><b><?=gettext("View settings");?></b></td> </tr> <tr> <td><a id="help_for_detail" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Level of Detail");?></td> <td> <select name="detail" class="selectpicker" id="detail"> <option value="normal"><?=gettext("Normal");?></option> <option value="medium"><?=gettext("Medium");?></option> <option value="high"><?=gettext("High");?></option> <option value="full"><?=gettext("Full");?></option> </select> <div class="hidden" for="help_for_detail"> <?=gettext("This is the level of detail that will be displayed after hitting 'Stop' when the packets have been captured.") . "<br /><b>" . gettext("Note:") . "</b> " . gettext("This option does not affect the level of detail when downloading the packet capture.");?> </div> </td> </tr> <tr> <td><a id="help_for_dnsquery" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Reverse DNS Lookup");?></td> <td> <input name="dnsquery" id="dnsquery" type="checkbox"/> <div class="hidden" for="help_for_dnsquery"> <?=gettext("This check box will cause the packet capture to perform a reverse DNS lookup associated with all IP addresses.");?> <br /><b><?=gettext("Note");?>: </b><?=gettext("This option can cause delays for large packet captures.");?> </div> </td> </tr> <tr> <td> </td> <td> <?php if (capture_running()):?> <input type="submit" class="btn" name="stop" value="<?=gettext("Stop");?>"/> <?php else:?> <input type="submit" class="btn" name="start" value="<?=gettext("Start");?>"/> <?php if (file_exists('/root/packetcapture.cap')):?> <button type="button" id="view" class="btn"> <?=gettext("View Capture");?> </button> <a href="?download" type="submit" class="btn"><?=gettext("Download Capture");?></a> <input type="submit" class="btn" name="remove" value="<?=gettext("Delete Capture");?>"/> <?php endif; endif;?> </td> </tr> </tbody> </table> </form> </div> </div> </section> <section class="col-xs-12 hidden" id="capture"> <div class="content-box"> <div class="table-responsive"> <table class="table table-condensed"> <thead> <tr> <th><?=gettext("Capture output");?></th> </tr> </thead> <tbody style="white-space: pre-wrap; font-family: monospace;" id="capture_output"> </tbody> </table> </div> </div> </section> </div> </div> </section> <?php include("foot.inc");