]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - html/cgi-bin/guardian.cgi
projects / people / pmueller / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
misc-progs: getipstat: Refactor + extend
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / guardian.cgi
CommitLineData
01dbccb1
SS		 1#!/usr/bin/perl
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
b5f7d903 5# Copyright (C) 2016 IPFire Team <info@ipfire.org> #
01dbccb1
SS		 6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
21
22use strict;
af6856af 23use Guardian::Socket;
01dbccb1
SS		 24
25# enable only the following on debugging purpose
eff1feb8
SS		 26#use warnings;
27#use CGI::Carp 'fatalsToBrowser';
01dbccb1
SS		 28
29require '/var/ipfire/general-functions.pl';
30require "${General::swroot}/lang.pl";
31require "${General::swroot}/header.pl";
32
33#workaround to suppress a warning when a variable is used only once
b1597f87
MF		 34my @dummy = (
35 ${Header::colourred},
36 ${Header::colourgreen}
37);
38
01dbccb1
SS		 39undef (@dummy);
40
41my $string=();
42my $memory=();
43my @memory=();
44my @pid=();
45my @guardian=();
01dbccb1
SS		 46
47# Path to the guardian.ignore file.
48my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
49
52958991
SS		 50# Hash which contains the supported modules and the
51# file locations on IPFire systems.
52my %module_file_locations = (
53 "HTTPD" => "/var/log/httpd/error_log",
52958991
SS		 54 "SSH" => "/var/log/messages",
55);
56
01dbccb1
SS		 57our %netsettings = ();
58&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
59
60our %color = ();
61our %mainsettings = ();
62&General::readhash("${General::swroot}/main/settings", \%mainsettings);
8186b372 63&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
01dbccb1 64
7edbe063
SS		 65# File declarations.
66my $settingsfile = "${General::swroot}/guardian/settings";
67my $ignoredfile = "${General::swroot}/guardian/ignored";
68
69# Create empty settings and ignoredfile if they do not exist yet.
70unless (-e "$settingsfile") { system("touch $settingsfile"); }
71unless (-e "$ignoredfile") { system("touch $ignoredfile"); }
72
01dbccb1 73our %settings = ();
7edbe063 74our %ignored = ();
01dbccb1 75
28981fac
SS		 76$settings{'ACTION'} = '';
77
01dbccb1 78$settings{'GUARDIAN_ENABLED'} = 'off';
723648ac
SS		 79$settings{'GUARDIAN_MONITOR_SSH'} = 'on';
80$settings{'GUARDIAN_MONITOR_HTTPD'} = 'on';
81$settings{'GUARDIAN_MONITOR_OWNCLOUD'} = '';
52958991 82$settings{'GUARDIAN_LOG_FACILITY'} = 'syslog';
a35a0668
SS		 83$settings{'GUARDIAN_LOGLEVEL'} = 'info';
84$settings{'GUARDIAN_BLOCKCOUNT'} = '3';
01dbccb1 85$settings{'GUARDIAN_BLOCKTIME'} = '86400';
2d17c6e6 86$settings{'GUARDIAN_FIREWALL_ACTION'} = 'DROP';
01dbccb1 87$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
01dbccb1 88
01dbccb1
SS		 89my $errormessage = '';
90
91&Header::showhttpheaders();
92
93# Get GUI values.
94&Header::getcgihash(\%settings);
01dbccb1 95
f8c3bfe0
SS		 96# Check if guardian is running and grab some stats.
97&daemonstats();
922ddf0e 98my $pid = $pid[0];
f8c3bfe0 99
01dbccb1
SS		 100## Perform input checks and save settings.
101#
102if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
01dbccb1 103 # Check for valid blocktime.
96655fa6 104 unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
01dbccb1 105 $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
a35a0668
SS		 106 }
107
d68ead3d 108 # Check if the blockcount is valid.
96655fa6 109 unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
a35a0668 110 $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
01dbccb1
SS		 111 }
112
113 # Check Logfile.
96655fa6 114 unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
a35a0668 115 $errormessage = "$Lang::tr{'guardian invalid logfile'}";
01dbccb1
SS		 116 }
117
01dbccb1 118 # Only continue if no error message has been set.
96655fa6 119 if($errormessage eq '') {
01dbccb1
SS		 120 # Write configuration settings to file.
121 &General::writehash("${General::swroot}/guardian/settings", \%settings);
122
123 # Update configuration files.
124 &BuildConfiguration();
125 }
126
7edbe063 127## Add/edit an entry to the ignore file.
01dbccb1 128#
7edbe063 129} elsif (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang::tr{'update'})) {
01dbccb1
SS		 130
131 # Check if any input has been performed.
7edbe063 132 if ($settings{'IGNORE_ENTRY_ADDRESS'} ne '') {
01dbccb1
SS		 133
134 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
7edbe063 135 if ((!&General::validip($settings{'IGNORE_ENTRY_ADDRESS'})) && (!&General::validipandmask($settings{'IGNORE_ENTRY_ADDRESS'}))) {
01dbccb1
SS		 136 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
137 }
138 } else {
139 $errormessage = "$Lang::tr{'guardian empty input'}";
140 }
141
142 # Go further if there was no error.
143 if ($errormessage eq '') {
7edbe063
SS		 144 my %ignored = ();
145 my $id;
146 my $status;
147
148 # Assign hash values.
149 my $new_entry_address = $settings{'IGNORE_ENTRY_ADDRESS'};
150 my $new_entry_remark = $settings{'IGNORE_ENTRY_REMARK'};
151
152 # Read-in ignoredfile.
153 &General::readhasharray($ignoredfile, \%ignored);
154
155 # Check if we should edit an existing entry and got an ID.
156 if (($settings{'ACTION'} eq $Lang::tr{'update'}) && ($settings{'ID'})) {
157 # Assin the provided id.
158 $id = $settings{'ID'};
159
160 # Undef the given ID.
161 undef($settings{'ID'});
162
163 # Grab the configured status of the corresponding entry.
164 $status = $ignored{$id}[2];
165 } else {
166 # Each newly added entry automatically should be enabled.
167 $status = "enabled";
01dbccb1 168
7edbe063
SS		 169 # Generate the ID for the new entry.
170 #
d68ead3d 171 # Sort the keys by their ID and store them in an array.
7edbe063 172 my @keys = sort { $a <=> $b } keys %ignored;
01dbccb1 173
7edbe063
SS		 174 # Reverse the key array.
175 my @reversed = reverse(@keys);
176
177 # Obtain the last used id.
178 my $last_id = @reversed[0];
179
180 # Increase the last id by one and use it as id for the new entry.
181 $id = ++$last_id;
182 }
183
184 # Add/Modify the entry to/in the ignored hash.
185 $ignored{$id} = ["$new_entry_address", "$new_entry_remark", "$status"];
186
187 # Write the changed ignored hash to the ignored file.
188 &General::writehasharray($ignoredfile, \%ignored);
189
190 # Regenerate the ignore file.
97849142 191 &GenerateIgnoreFile();
01dbccb1
SS		 192 }
193
f8c3bfe0
SS		 194 # Check if guardian is running.
195 if ($pid > 0) {
af6856af 196 # Send reload command through socket connection.
1cc65323 197 &Guardian::Socket::Client("reload-ignore-list");
f8c3bfe0
SS		 198 }
199
7edbe063 200## Toggle Enabled/Disabled for an existing entry on the ignore list.
01dbccb1 201#
7edbe063
SS		 202
203} elsif ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
204 my %ignored = ();
205
206 # Only go further, if an ID has been passed.
207 if ($settings{'ID'}) {
208 # Assign the given ID.
209 my $id = $settings{'ID'};
210
211 # Undef the given ID.
212 undef($settings{'ID'});
213
214 # Read-in ignoredfile.
215 &General::readhasharray($ignoredfile, \%ignored);
216
217 # Grab the configured status of the corresponding entry.
218 my $status = $ignored{$id}[2];
219
220 # Switch the status.
221 if ($status eq "disabled") {
222 $status = "enabled";
223 } else {
224 $status = "disabled";
225 }
226
227 # Modify the status of the existing entry.
228 $ignored{$id} = ["$ignored{$id}[0]", "$ignored{$id}[1]", "$status"];
229
230 # Write the changed ignored hash to the ignored file.
231 &General::writehasharray($ignoredfile, \%ignored);
232
233 # Regenerate the ignore file.
97849142 234 &GenerateIgnoreFile();
7edbe063
SS		 235
236 # Check if guardian is running.
237 if ($pid > 0) {
238 # Send reload command through socket connection.
1cc65323 239 &Guardian::Socket::Client("reload-ignore-list");
01dbccb1
SS		 240 }
241 }
7edbe063
SS		 242
243## Remove entry from ignore list.
244#
245} elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
246 my %ignored = ();
247
248 # Read-in ignoredfile.
249 &General::readhasharray($ignoredfile, \%ignored);
250
251 # Drop entry from the hash.
252 delete($ignored{$settings{'ID'}});
253
254 # Undef the given ID.
255 undef($settings{'ID'});
256
257 # Write the changed ignored hash to the ignored file.
258 &General::writehasharray($ignoredfile, \%ignored);
259
260 # Regenerate the ignore file.
97849142 261 &GenerateIgnoreFile();
01dbccb1 262
f8c3bfe0
SS		 263 # Check if guardian is running.
264 if ($pid > 0) {
af6856af 265 # Send reload command through socket connection.
1cc65323 266 &Guardian::Socket::Client("reload-ignore-list");
f8c3bfe0
SS		 267 }
268
01dbccb1
SS		 269## Block a user given address or subnet.
270#
271} elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
272
c973d6da
SS		 273 # Assign some temporary variables used for input validation.
274 my $input = $settings{'ADDRESS_BLOCK'};
275 my $green = $netsettings{'GREEN_ADDRESS'};
276 my $blue = $netsettings{'BLUE_ADDRESS'};
277 my $orange = $netsettings{'ORANGE_ADDRESS'};
278 my $red = $netsettings{'RED_ADDRESS'};
01dbccb1 279
c232e348
SS		 280 # File declarations.
281 my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
c232e348 282
c973d6da 283 # Get gateway address.
9f9b2b8e 284 my $gateway = &General::grab_address_from_file($gatewayfile);
01dbccb1 285
c973d6da
SS		 286 # Check if any input has been performed.
287 if ($input eq '') {
288 $errormessage = "$Lang::tr{'guardian empty input'}";
289 }
290
291 # Check if the given input is localhost (127.0.0.1).
292 elsif ($input eq "127.0.0.1") {
293 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
294 }
295
296 # Check if the given input is anywhere (0.0.0.0).
297 elsif ($input eq "0.0.0.0") {
298 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
299 }
300
301 # Check if the given input is one of the interface addresses or our gateway.
9f9b2b8e 302 elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
c973d6da
SS		 303 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
304 }
305
306 # Check if the given input is a valid IP address.
307 elsif (!&General::validip($input)) {
308 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
309 }
01dbccb1
SS		 310
311 # Go further if there was no error.
312 if ($errormessage eq '') {
313 my $block = $settings{'ADDRESS_BLOCK'};
314
af6856af
SS		 315 # Send command to block the specified address through socket connection.
316 &Guardian::Socket::Client("block $block");
01dbccb1
SS		 317 }
318
319## Unblock address or subnet.
320#
321} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
322
323 # Check if no empty input has been performed.
324 if ($settings{'ADDRESS_UNBLOCK'} ne '') {
325
326 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
327 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
328 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
329 }
330
331 } else {
332 $errormessage = "$Lang::tr{'guardian empty input'}";
333 }
334
335 # Go further if there was no error.
336 if ($errormessage eq '') {
337 my $unblock = $settings{'ADDRESS_UNBLOCK'};
338
af6856af
SS		 339 # Send command to unblock the given address through socket connection.
340 &Guardian::Socket::Client("unblock $unblock");
01dbccb1
SS		 341 }
342
343## Unblock all.
344#
345} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
346
af6856af
SS		 347 # Send flush command through socket connection.
348 &Guardian::Socket::Client("flush");
01dbccb1
SS		 349}
350
7edbe063 351# Load settings from files.
36dbcf2e 352&General::readhash("${General::swroot}/guardian/settings", \%settings);
7edbe063 353&General::readhasharray("${General::swroot}/guardian/ignored", \%ignored);
01dbccb1
SS		 354
355# Call functions to generate whole page.
356&showMainBox();
357&showIgnoreBox();
358
359# Display area only if guardian is running.
f8c3bfe0 360if ( ($memory != 0) && ($pid > 0) ) {
01dbccb1
SS		 361 &showBlockedBox();
362}
363
364# Function to display the status of guardian and allow base configuration.
365sub showMainBox() {
366 my %checked = ();
7899718f 367 my %selected = ();
01dbccb1
SS		 368
369 $checked{'GUARDIAN_ENABLED'}{'on'} = '';
370 $checked{'GUARDIAN_ENABLED'}{'off'} = '';
371 $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
723648ac
SS		 372 $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = '';
373 $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = '';
374 $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'";
375 $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} = '';
376 $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} = '';
377 $checked{'GUARDIAN_MONITOR_HTTPD'}{$settings{'GUARDIAN_MONITOR_HTTPD'}} = "checked='checked'";
378 $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} = '';
379 $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} = '';
380 $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{$settings{'GUARDIAN_MONITOR_OWNCLOUD'}} = "checked='checked'";
01dbccb1 381
52958991 382 $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected';
4a7fc9f6 383 $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
2d17c6e6 384 $selected{'GUARDIAN_FIREWALL_ACTION'}{$settings{'GUARDIAN_FIREWALL_ACTION'}} = 'selected';
7899718f 385
01dbccb1
SS		 386 &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
387 &Header::openbigbox('100%', 'left', '', $errormessage);
388
389 # Print errormessage if there is one.
390 if ($errormessage) {
391 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
392 print "<font class='base'>$errormessage&nbsp;</font>\n";
393 &Header::closebox();
394 }
395
2daa1f5b
SS		 396 ### Java Script ###
397 print<<END;
398 <script>
f617f21c 399 var update_options = function() {
2daa1f5b
SS		 400
401 var logfacility = \$("#GUARDIAN_LOG_FACILITY").val();
f617f21c 402 var loglevel = \$("#GUARDIAN_LOGLEVEL").val();
2daa1f5b
SS		 403
404 if (logfacility === undefined)
405 return;
406
f617f21c
SS		 407 if (loglevel === undefined)
408 return;
409
410 // Show / Hide input for specifying the path to the logfile.
2daa1f5b
SS		 411 if (logfacility === "file") {
412 \$(".GUARDIAN_LOGFILE").show();
413 } else {
414 \$(".GUARDIAN_LOGFILE").hide();
415 }
f617f21c
SS		 416
417 // Show / Hide loglevel debug if the facility is set to syslog.
418 if (logfacility === "syslog") {
419 \$("#loglevel_debug").hide();
420 } else {
421 \$("#loglevel_debug").show();
422 }
423
424 // Show / Hide logfacility syslog if the loglevel is set to debug.
425 if (loglevel === "debug") {
426 \$("#logfacility_syslog").hide();
427 } else {
428 \$("#logfacility_syslog").show();
429 }
2daa1f5b
SS		 430 };
431
432 \$(document).ready(function() {
f617f21c
SS		 433 \$("#GUARDIAN_LOG_FACILITY").change(update_options);
434 \$("#GUARDIAN_LOGLEVEL").change(update_options);
435 update_options();
2daa1f5b
SS		 436 });
437 </script>
438END
439
440
01dbccb1
SS		 441
442 # Draw current guardian state.
443 &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
444
f8c3bfe0 445 # Get current status of guardian.
01dbccb1 446 &daemonstats();
922ddf0e 447 $pid = $pid[0];
01dbccb1
SS		 448
449 # Display some useful information related to guardian, if daemon is running.
f8c3bfe0 450 if ( ($memory != 0) && ($pid > 0) ){
01dbccb1
SS		 451 print <<END;
452 <table width='95%' cellspacing='0' class='tbl'>
453 <tr>
454 <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
455 </tr>
456 <tr>
457 <td class='base'>$Lang::tr{'guardian daemon'}</td>
458 <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
459 </tr>
460 <tr>
461 <td class='base'></td>
462 <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
463 <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
464 </tr>
465 <tr>
466 <td class='base'></td>
922ddf0e 467 <td bgcolor='$color{'color22'}' align='center'>$pid</td>
01dbccb1
SS		 468 <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
469 </tr>
470 </table>
471END
472 } else {
473 # Otherwise display a hint that the service is not launched.
474 print <<END;
475 <table width='95%' cellspacing='0' class='tbl'>
476 <tr>
477 <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
478 </tr>
479 <tr>
480 <td class='base'>$Lang::tr{'guardian daemon'}</td>
481 <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
482 </tr>
483 </table>
484END
485 }
486
487 &Header::closebox();
488
489 # Draw elements for guardian configuration.
490 &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
491
492 print <<END;
493 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
494
495 <table width='95%'>
496 <tr>
d2fea55e 497 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
01dbccb1 498 </tr>
c5f633c9 499
01dbccb1 500 <tr>
c5f633c9 501 <td width='25%' class='base'>$Lang::tr{'guardian enabled'}:</td>
d2fea55e 502 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
01dbccb1 503 </tr>
c5f633c9 504
26fcd31e
SS		 505 <tr>
506 <td colspan='2'><br></td>
507 </tr>
c5f633c9 508
26fcd31e 509 <tr>
c5f633c9 510 <td width='25%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
723648ac
SS		 511 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> /
512 <input type='radio' name='GUARDIAN_MONITOR_SSH' value='off' $checked{'GUARDIAN_MONITOR_SSH'}{'off'} /> off</td>
26fcd31e 513 </tr>
c5f633c9 514
26fcd31e 515 <tr>
c5f633c9 516 <td width='25%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
723648ac
SS		 517 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='on' $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} /> /
518 <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='off' $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} /> off</td>
26fcd31e 519 </tr>
c5f633c9 520
52958991
SS		 521 <tr>
522 <td colspan='2'><br></td>
523 </tr>
c5f633c9 524
52958991
SS		 525 <tr>
526 <td align='left' width='20%'>$Lang::tr{'guardian logfacility'}:</td>
c5f633c9
MF		 527 <td width='25%'><select id='GUARDIAN_LOG_FACILITY' name='GUARDIAN_LOG_FACILITY'>
528 <option id='logfacility_syslog' value='syslog' $selected{'GUARDIAN_LOG_FACILITY'}{'syslog'}>$Lang::tr{'guardian logtarget_syslog'}</option>
529 <option id='logfacility_file' value='file' $selected{'GUARDIAN_LOG_FACILITY'}{'file'}>$Lang::tr{'guardian logtarget_file'}</option>
530 <option id='logfacility_console' value='console' $selected{'GUARDIAN_LOG_FACILITY'}{'console'}>$Lang::tr{'guardian logtarget_console'}</option>
531 </select></td>
532
533 <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
534 <td width='25%'><select id='GUARDIAN_LOGLEVEL' name='GUARDIAN_LOGLEVEL'>
535 <option id='loglevel_off' value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>$Lang::tr{'guardian loglevel_off'}</option>
536 <option id='loglevel_info' value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>$Lang::tr{'guardian loglevel_info'}</option>
537 <option id='loglevel_debug' value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>$Lang::tr{'guardian loglevel_debug'}</option>
52958991
SS		 538 </select></td>
539 </tr>
c5f633c9
MF		 540
541 <tr class="GUARDIAN_LOGFILE">
26fcd31e
SS		 542 <td colspan='2'><br></td>
543 </tr>
c5f633c9
MF		 544
545 <tr class="GUARDIAN_LOGFILE">
546 <td width='25%' class='base'>$Lang::tr{'guardian logfile'}:</td>
547 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
7899718f 548 </tr>
c5f633c9 549
d2b54a31 550 <tr>
a35a0668
SS		 551 <td colspan='2'><br></td>
552 </tr>
c5f633c9 553
d2b54a31
SS		 554 <tr>
555 <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td>
556 <td><select name='GUARDIAN_FIREWALL_ACTION'>
557 <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option>
558 <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option>
4a7fc9f6 559 </select></td>
c5f633c9
MF		 560
561 <td width='25%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
562 <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
4a7fc9f6 563 </tr>
c5f633c9 564
4a7fc9f6
SS		 565 <tr>
566 <td colspan='2'><br></td>
567 </tr>
c5f633c9 568
2d17c6e6 569 <tr>
c5f633c9 570 <td width='25%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
d2fea55e 571 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
01dbccb1 572 </tr>
c5f633c9 573
01dbccb1
SS		 574 </table>
575END
576
577 print <<END;
578 <hr>
579
580 <table width='95%'>
581 <tr>
582 <td>&nbsp;</td>
583 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
584 <td>&nbsp;</td>
585 </tr>
586 </table>
587 </form>
588END
589
590 &Header::closebox();
591}
592
593# Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
594sub showIgnoreBox() {
595 &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
596
597 print <<END;
7edbe063 598 <table width='80%'>
01dbccb1 599 <tr>
7edbe063
SS		 600 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'ip address'}</b></td>
601 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'remark'}</b></td>
602 <td class='base' colspan='3' bgcolor='$color{'color20'}'></td>
01dbccb1
SS		 603 </tr>
604END
d68ead3d 605 # Check if some hosts have been added to be ignored.
7edbe063 606 if (keys (%ignored)) {
01dbccb1
SS		 607 my $col = "";
608
d68ead3d 609 # Loop through all entries of the hash.
7edbe063
SS		 610 while( (my $key) = each %ignored) {
611 # Assign data array positions to some nice variable names.
612 my $address = $ignored{$key}[0];
613 my $remark = $ignored{$key}[1];
614 my $status = $ignored{$key}[2];
615
616 # Check if the key (id) number is even or not.
617 if ($settings{'ID'} eq $key) {
618 $col="bgcolor='${Header::colouryellow}'";
619 } elsif ($key % 2) {
01dbccb1
SS		 620 $col="bgcolor='$color{'color22'}'";
621 } else {
622 $col="bgcolor='$color{'color20'}'";
623 }
624
7edbe063
SS		 625 # Choose icon for the checkbox.
626 my $gif;
627 my $gdesc;
628
629 # Check if the status is enabled and select the correct image and description.
630 if ($status eq 'enabled' ) {
631 $gif = 'on.gif';
632 $gdesc = $Lang::tr{'click to disable'};
633 } else {
634 $gif = 'off.gif';
635 $gdesc = $Lang::tr{'click to enable'};
636 }
637
01dbccb1
SS		 638 print <<END;
639 <tr>
7edbe063
SS		 640 <td width='20%' class='base' $col>$address</td>
641 <td width='65%' class='base' $col>$remark</td>
642
643 <td align='center' $col>
644 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
645 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
646 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$gdesc' title='$gdesc' />
647 <input type='hidden' name='ID' value='$key' />
648 </form>
649 </td>
650
651 <td align='center' $col>
652 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
653 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
654 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
655 <input type='hidden' name='ID' value='$key' />
656 </form>
657 </td>
658
659 <td align='center' $col>
660 <form method='post' name='$key' action='$ENV{'SCRIPT_NAME'}'>
01dbccb1 661 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
7edbe063 662 <input type='hidden' name='ID' value='$key'>
01dbccb1
SS		 663 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
664 </form>
665 </td>
666 </tr>
667END
668 }
01dbccb1 669 } else {
7edbe063 670 # Print notice that currently no hosts are ignored.
01dbccb1
SS		 671 print "<tr>\n";
672 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
673 print "</tr>\n";
674 }
675
676 print "</table>\n";
677
7edbe063 678 # Section to add new elements or edit existing ones.
01dbccb1 679 print <<END;
1d5702a7 680 <br>
7edbe063
SS		 681 <hr>
682 <br>
683
1d5702a7 684 <div align='center'>
7edbe063
SS		 685 <table width='100%'>
686END
687
688 # Assign correct headline and button text.
689 my $buttontext;
690 my $entry_address;
691 my $entry_remark;
692
693 # Check if an ID (key) has been given, in this case an existing entry should be edited.
694 if ($settings{'ID'} ne '') {
695 $buttontext = $Lang::tr{'update'};
696 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'update'}</b></td></tr>\n";
697
698 # Grab address and remark for the given key.
699 $entry_address = $ignored{$settings{'ID'}}[0];
700 $entry_remark = $ignored{$settings{'ID'}}[1];
701 } else {
702 $buttontext = $Lang::tr{'add'};
703 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'dnsforward add a new entry'}</b></td></tr>\n";
704 }
705
706 print <<END;
01dbccb1 707 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
7edbe063 708 <input type='hidden' name='ID' value='$settings{'ID'}'>
01dbccb1 709 <tr>
7edbe063
SS		 710 <td width='30%'>$Lang::tr{'ip address'}: </td>
711 <td width='50%'><input type='text' name='IGNORE_ENTRY_ADDRESS' value='$entry_address' size='24' /></td>
712
713 <td width='30%'>$Lang::tr{'remark'}: </td>
714 <td wicth='50%'><input type='text' name=IGNORE_ENTRY_REMARK value='$entry_remark' size='24' /></td>
715 <td align='center' width='20%'><input type='submit' name='ACTION' value='$buttontext' /></td>
01dbccb1
SS		 716 </tr>
717 </form>
718 </table>
719 </div>
720END
1d5702a7
SS		 721
722 &Header::closebox();
01dbccb1
SS		 723}
724
d68ead3d 725# Function to list currently blocked addresses from guardian and unblock them or add custom entries to block.
01dbccb1
SS		 726sub showBlockedBox() {
727 &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
728
01dbccb1
SS		 729 print <<END;
730 <table width='60%'>
731 <tr>
732 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
733 </tr>
734END
735
d68ead3d 736 # Launch function to get the currently blocked hosts.
5f462919
SS		 737 my @blocked_hosts = &GetBlockedHosts();
738
01dbccb1 739 my $id = 0;
01dbccb1 740 my $col = "";
01dbccb1 741
5f462919
SS		 742 # Loop through our blocked hosts array.
743 foreach my $blocked_host (@blocked_hosts) {
01dbccb1
SS		 744
745 # Increase id number for each element in the ignore file.
746 $id++;
747
748 # Check if the id number is even or not.
749 if ($id % 2) {
750 $col="bgcolor='$color{'color22'}'";
751 } else {
752 $col="bgcolor='$color{'color20'}'";
753 }
754
755 print <<END;
756 <tr>
8b8413e5 757 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
01dbccb1
SS		 758 <td width='20%' align='center' $col>
759 <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
760 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
761 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
762 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
763 </form>
764 </td>
765 </tr>
766END
767 }
768
d68ead3d 769 # If the loop only has been run once the id still is "0", which means there are no
01dbccb1
SS		 770 # additional entries (blocked hosts) in the iptables chain.
771 if ($id == 0) {
772
773 # Print notice that currently no hosts are blocked.
774 print "<tr>\n";
775 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
776 print "</tr>\n";
777 }
778
779 print "</table>\n";
780
01dbccb1
SS		 781 # Section for a manual block of an IP-address.
782 print <<END;
1d5702a7
SS		 783 <br>
784 <div align='center'>
785 <table width='60%' border='0'>
01dbccb1
SS		 786 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
787 <tr>
788 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
789 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
790 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
791 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
792 </tr>
793 </form>
794 </table>
795 </div>
796END
1d5702a7
SS		 797
798 &Header::closebox();
01dbccb1
SS		 799}
800
801&Header::closebigbox();
802&Header::closepage();
803
804# Function to check if guardian has been started.
805# Grab process id and consumed memory if the daemon is running.
806sub daemonstats() {
807 $memory = 0;
808 # for pid and memory
809 open(FILE, '/usr/local/bin/addonctrl guardian status | ');
810 @guardian = <FILE>;
811 close(FILE);
812 $string = join("", @guardian);
813 $string =~ s/[a-z_]//gi;
814 $string =~ s/\[[0-1]\;[0-9]+//gi;
815 $string =~ s/[\(\)\.]//gi;
816 $string =~ s/ //gi;
817 $string =~ s/\e//gi;
818 @pid = split(/\s/,$string);
819 if (open(FILE, "/proc/$pid[0]/statm")){
820 my $temp = <FILE>;
821 @memory = split(/ /,$temp);
822 close(FILE);
823 }
824 $memory+=$memory[0];
825}
826
5f462919 827sub GetBlockedHosts() {
5f462919
SS		 828 # Create new, empty array.
829 my @hosts;
830
d68ead3d 831 # Launch helper to get chains from iptables.
8b68ed12 832 open (FILE, '/usr/local/bin/getipstat | ');
891ba055 833
8b68ed12 834 # Loop through the entire output.
891ba055
SS		 835 while (<FILE>) {
836 my $line = $_;
837
838 # Search for the guardian chain and extract
839 # the lines between it and the next empty line
840 # which is placed before the next firewall
841 # chain starts.
842 if ($line =~ /^Chain GUARDIAN/ .. /^\s*$/) {
843 # Skip descriptive lines.
844 next if ($line =~ /^Chain/);
845 next if ($line =~ /^ pkts/);
846
d68ead3d 847 # Generate array, based on the line content (separator is a single or multiple space)
891ba055
SS		 848 my @comps = split(/\s{1,}/, $line);
849 my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
850
851 # Assign different variable names.
852 my $blocked_host = $source;
853
854 # Add host to our hosts array.
855 if ($blocked_host) {
856 push(@hosts, $blocked_host);
857 }
858 }
859 }
5f462919 860
891ba055
SS		 861 # Close filehandle.
862 close(FILE);
5f462919 863
5f462919
SS		 864 # Convert entries, sort them, write back and store the sorted entries into new array.
865 my @sorted = map { $_->[0] }
866 sort { $a->[1] <=> $b->[1] }
867 map { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
868 @hosts;
869
870 # Return our sorted list.
871 return @sorted
872}
873
01dbccb1
SS		 874sub BuildConfiguration() {
875 my %settings = ();
876 &General::readhash("${General::swroot}/guardian/settings", \%settings);
877
878 my $configfile = "${General::swroot}/guardian/guardian.conf";
879
d68ead3d 880 # Create the configfile if none exists yet.
c880c2cb
SS		 881 unless (-e "$configfile") { system("touch $configfile"); }
882
7f728591 883 # Open configfile for writing.
01dbccb1
SS		 884 open(FILE, ">$configfile");
885
52958991
SS		 886 # Config file header.
887 print FILE "# Autogenerated configuration file.\n";
888 print FILE "# All user modifications will be overwritten.\n\n";
28981fac 889
52958991
SS		 890 # Settings for the logging mechanism.
891 print FILE "# Log settings.\n";
892 print FILE "LogFacility = $settings{'GUARDIAN_LOG_FACILITY'}\n";
893
894 if ($settings{'GUARDIAN_LOG_FACILITY'} eq "file") {
895 print FILE "LogFile = $settings{'GUARDIAN_LOGFILE'}\n";
28981fac
SS		 896 }
897
52958991
SS		 898 print FILE "LogLevel = $settings{'GUARDIAN_LOGLEVEL'}\n\n";
899
900 # IPFire related static settings.
901 print FILE "# IPFire related settings.\n";
902 print FILE "FirewallEngine = IPtables\n";
903 print FILE "SocketOwner = nobody:nobody\n";
904 print FILE "IgnoreFile = $ignorefile\n\n";
905
906 # Configured block values.
2d17c6e6 907 print FILE "# Configured block settings.\n";
52958991 908 print FILE "BlockCount = $settings{'GUARDIAN_BLOCKCOUNT'}\n";
2d17c6e6
SS		 909 print FILE "BlockTime = $settings{'GUARDIAN_BLOCKTIME'}\n";
910 print FILE "FirewallAction = $settings{'GUARDIAN_FIREWALL_ACTION'}\n\n";
52958991
SS		 911
912 # Enabled modules.
913 # Loop through whole settings hash.
914 print FILE "# Enabled modules.\n";
915 foreach my $option (keys %settings) {
916 # Search for enabled modules.
917 if ($option =~ /GUARDIAN_MONITOR_(.*)/) {
918 # Skip if module is not enabled.
919 next unless($settings{$option} eq "on");
920
921 # Skip module if no file location is available.
922 next unless(exists($module_file_locations{$1}));
923
924 # Add enabled module and defined path to the config file.
925 print FILE "Monitor_$1 = $module_file_locations{$1}\n";
926 }
927 }
928
929 # Module settings.
930 print FILE "\n# Module settings.\n";
01dbccb1
SS		 931 close(FILE);
932
efd9c5ff
SS		 933 # Generate ignore file.
934 &GenerateIgnoreFile();
935
f8c3bfe0
SS		 936 # Check if guardian should be started or stopped.
937 if($settings{'GUARDIAN_ENABLED'} eq 'on') {
938 if($pid > 0) {
af6856af
SS		 939 # Send reload command through socket connection.
940 &Guardian::Socket::Client("reload");
f8c3bfe0
SS		 941 } else {
942 # Launch guardian.
af6856af 943 system("/usr/local/bin/addonctrl guardian start &>/dev/null");
f8c3bfe0 944 }
01dbccb1 945 } else {
f8c3bfe0 946 # Stop the daemon.
af6856af 947 system("/usr/local/bin/addonctrl guardian stop &>/dev/null");
01dbccb1
SS		 948 }
949}
97849142
SS		 950
951sub GenerateIgnoreFile() {
952 my %ignored = ();
953
954 # Read-in ignoredfile.
955 &General::readhasharray($ignoredfile, \%ignored);
956
c880c2cb
SS		 957 # Create the guardian.ignore file if not exist yet.
958 unless (-e "$ignorefile") { system("touch $ignorefile"); }
959
97849142
SS		 960 # Open ignorefile for writing.
961 open(FILE, ">$ignorefile");
962
963 # Config file header.
964 print FILE "# Autogenerated configuration file.\n";
965 print FILE "# All user modifications will be overwritten.\n\n";
966
967 # Add IFPire interfaces and gateway to the ignore file.
968 #
969 # Assign some temporary variables for the IPFire interfaces.
970 my $green = $netsettings{'GREEN_ADDRESS'};
971 my $blue = $netsettings{'BLUE_ADDRESS'};
972 my $orange = $netsettings{'ORANGE_ADDRESS'};
97849142
SS		 973
974 # File declarations.
1cc65323 975 my $public_address_file = "${General::swroot}/red/local-ipaddress";
97849142 976 my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
97849142 977
97849142
SS		 978 # Write the obtained addresses to the ignore file.
979 print FILE "# IPFire local interfaces.\n";
980 print FILE "$green\n";
981
982 # Check if a blue interface exists.
983 if ($blue) {
984 # Add blue address.
985 print FILE "$blue\n";
986 }
987
988 # Check if an orange interface exists.
989 if ($orange) {
990 # Add orange address.
991 print FILE "$orange\n";
992 }
993
994 print FILE "\n# IPFire red interface, gateway and used DNS-servers.\n";
1cc65323
SS		 995 print FILE "# Include the corresponding files to obtain the addresses.\n";
996 print FILE "Include_File = $public_address_file\n";
997 print FILE "Include_File = $gatewayfile\n";
97849142
SS		 998
999 # Add all user defined hosts and networks to the ignore file.
1000 #
1001 # Check if the hash contains any elements.
1002 if (keys (%ignored)) {
1003 # Write headline.
1cc65323 1004 print FILE "\n# User defined hosts/networks.\n";
97849142
SS		 1005
1006 # Loop through the entire hash and write the host/network
1007 # and remark to the ignore file.
1008 while ( (my $key) = each %ignored) {
1009 my $address = $ignored{$key}[0];
1010 my $remark = $ignored{$key}[1];
1011 my $status = $ignored{$key}[2];
1012
1013 # Check if the status of the entry is "enabled".
1014 if ($status eq "enabled") {
1015 # Check if the address/network is valid.
1016 if ((&General::validip($address)) || (&General::validipandmask($address))) {
1017 # Write the remark to the file.
1018 print FILE "# $remark\n";
1019
1020 # Write the address/network to the ignore file.
1021 print FILE "$address\n\n";
1022 }
1023 }
1024 }
1025 }
1026
1027 close(FILE);
1028}
Peter's tree of IPFire 2.x