]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - html/cgi-bin/guardian.cgi
projects / people / pmueller / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
guardian.cgi: Add function to generate the guardian.ignore file.
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / guardian.cgi
CommitLineData
01dbccb1
SS		 1#!/usr/bin/perl
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
b5f7d903 5# Copyright (C) 2016 IPFire Team <info@ipfire.org> #
01dbccb1
SS		 6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
21
22use strict;
b5f7d903 23use Locale::Codes::Country;
af6856af 24use Guardian::Socket;
01dbccb1
SS		 25
26# enable only the following on debugging purpose
eff1feb8
SS		 27#use warnings;
28#use CGI::Carp 'fatalsToBrowser';
01dbccb1
SS		 29
30require '/var/ipfire/general-functions.pl';
31require "${General::swroot}/lang.pl";
32require "${General::swroot}/header.pl";
33
34#workaround to suppress a warning when a variable is used only once
b1597f87
MF		 35my @dummy = (
36 ${Header::colourred},
37 ${Header::colourgreen}
38);
39
01dbccb1
SS		 40undef (@dummy);
41
42my $string=();
43my $memory=();
44my @memory=();
45my @pid=();
46my @guardian=();
01dbccb1
SS		 47
48# Path to the guardian.ignore file.
49my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
50
52958991
SS		 51# Hash which contains the supported modules and the
52# file locations on IPFire systems.
53my %module_file_locations = (
54 "HTTPD" => "/var/log/httpd/error_log",
55 "OWNCLOUD" => "/var/owncloud/data/owncloud.log",
56 "SNORT" => "/var/log/snort.alert",
57 "SSH" => "/var/log/messages",
58);
59
01dbccb1
SS		 60our %netsettings = ();
61&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
62
63our %color = ();
64our %mainsettings = ();
65&General::readhash("${General::swroot}/main/settings", \%mainsettings);
66&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
67
28981fac
SS		 68# Pakfire meta file for owncloud.
69# (File exists when the addon is installed.)
bfb860ce 70my $owncloud_meta = "/opt/pakfire/db/installed/meta-owncloud";
28981fac 71
7edbe063
SS		 72
73# File declarations.
74my $settingsfile = "${General::swroot}/guardian/settings";
75my $ignoredfile = "${General::swroot}/guardian/ignored";
76
77# Create empty settings and ignoredfile if they do not exist yet.
78unless (-e "$settingsfile") { system("touch $settingsfile"); }
79unless (-e "$ignoredfile") { system("touch $ignoredfile"); }
80
01dbccb1 81our %settings = ();
7edbe063 82our %ignored = ();
01dbccb1 83
28981fac
SS		 84$settings{'ACTION'} = '';
85
01dbccb1 86$settings{'GUARDIAN_ENABLED'} = 'off';
723648ac
SS		 87$settings{'GUARDIAN_MONITOR_SNORT'} = 'on';
88$settings{'GUARDIAN_MONITOR_SSH'} = 'on';
89$settings{'GUARDIAN_MONITOR_HTTPD'} = 'on';
90$settings{'GUARDIAN_MONITOR_OWNCLOUD'} = '';
52958991 91$settings{'GUARDIAN_LOG_FACILITY'} = 'syslog';
a35a0668
SS		 92$settings{'GUARDIAN_LOGLEVEL'} = 'info';
93$settings{'GUARDIAN_BLOCKCOUNT'} = '3';
01dbccb1
SS		 94$settings{'GUARDIAN_BLOCKTIME'} = '86400';
95$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
52958991 96$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'} = '3';
01dbccb1 97
28981fac
SS		 98# Default settings for owncloud if installed.
99if ( -e "$owncloud_meta") {
723648ac 100 $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = 'off';
28981fac 101}
01dbccb1
SS		 102
103my $errormessage = '';
104
105&Header::showhttpheaders();
106
107# Get GUI values.
108&Header::getcgihash(\%settings);
01dbccb1 109
f8c3bfe0
SS		 110# Check if guardian is running and grab some stats.
111&daemonstats();
922ddf0e 112my $pid = $pid[0];
f8c3bfe0 113
01dbccb1
SS		 114## Perform input checks and save settings.
115#
116if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
01dbccb1 117 # Check for valid blocktime.
96655fa6 118 unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
01dbccb1 119 $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
a35a0668
SS		 120 }
121
122 # Check if the bloccount is valid.
96655fa6 123 unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
a35a0668 124 $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
01dbccb1
SS		 125 }
126
127 # Check Logfile.
96655fa6 128 unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
a35a0668 129 $errormessage = "$Lang::tr{'guardian invalid logfile'}";
01dbccb1
SS		 130 }
131
01dbccb1 132 # Only continue if no error message has been set.
96655fa6 133 if($errormessage eq '') {
01dbccb1
SS		 134 # Write configuration settings to file.
135 &General::writehash("${General::swroot}/guardian/settings", \%settings);
136
137 # Update configuration files.
138 &BuildConfiguration();
139 }
140
7edbe063 141## Add/edit an entry to the ignore file.
01dbccb1 142#
7edbe063 143} elsif (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang::tr{'update'})) {
01dbccb1
SS		 144
145 # Check if any input has been performed.
7edbe063 146 if ($settings{'IGNORE_ENTRY_ADDRESS'} ne '') {
01dbccb1
SS		 147
148 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
7edbe063 149 if ((!&General::validip($settings{'IGNORE_ENTRY_ADDRESS'})) && (!&General::validipandmask($settings{'IGNORE_ENTRY_ADDRESS'}))) {
01dbccb1
SS		 150 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
151 }
152 } else {
153 $errormessage = "$Lang::tr{'guardian empty input'}";
154 }
155
156 # Go further if there was no error.
157 if ($errormessage eq '') {
7edbe063
SS		 158 my %ignored = ();
159 my $id;
160 my $status;
161
162 # Assign hash values.
163 my $new_entry_address = $settings{'IGNORE_ENTRY_ADDRESS'};
164 my $new_entry_remark = $settings{'IGNORE_ENTRY_REMARK'};
165
166 # Read-in ignoredfile.
167 &General::readhasharray($ignoredfile, \%ignored);
168
169 # Check if we should edit an existing entry and got an ID.
170 if (($settings{'ACTION'} eq $Lang::tr{'update'}) && ($settings{'ID'})) {
171 # Assin the provided id.
172 $id = $settings{'ID'};
173
174 # Undef the given ID.
175 undef($settings{'ID'});
176
177 # Grab the configured status of the corresponding entry.
178 $status = $ignored{$id}[2];
179 } else {
180 # Each newly added entry automatically should be enabled.
181 $status = "enabled";
01dbccb1 182
7edbe063
SS		 183 # Generate the ID for the new entry.
184 #
185 # Sort the keys by it's ID and store them in an array.
186 my @keys = sort { $a <=> $b } keys %ignored;
01dbccb1 187
7edbe063
SS		 188 # Reverse the key array.
189 my @reversed = reverse(@keys);
190
191 # Obtain the last used id.
192 my $last_id = @reversed[0];
193
194 # Increase the last id by one and use it as id for the new entry.
195 $id = ++$last_id;
196 }
197
198 # Add/Modify the entry to/in the ignored hash.
199 $ignored{$id} = ["$new_entry_address", "$new_entry_remark", "$status"];
200
201 # Write the changed ignored hash to the ignored file.
202 &General::writehasharray($ignoredfile, \%ignored);
203
204 # Regenerate the ignore file.
97849142 205 &GenerateIgnoreFile();
01dbccb1
SS		 206 }
207
f8c3bfe0
SS		 208 # Check if guardian is running.
209 if ($pid > 0) {
af6856af
SS		 210 # Send reload command through socket connection.
211 &Guardian::Socket::Client("reload");
f8c3bfe0
SS		 212 }
213
7edbe063 214## Toggle Enabled/Disabled for an existing entry on the ignore list.
01dbccb1 215#
7edbe063
SS		 216
217} elsif ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
218 my %ignored = ();
219
220 # Only go further, if an ID has been passed.
221 if ($settings{'ID'}) {
222 # Assign the given ID.
223 my $id = $settings{'ID'};
224
225 # Undef the given ID.
226 undef($settings{'ID'});
227
228 # Read-in ignoredfile.
229 &General::readhasharray($ignoredfile, \%ignored);
230
231 # Grab the configured status of the corresponding entry.
232 my $status = $ignored{$id}[2];
233
234 # Switch the status.
235 if ($status eq "disabled") {
236 $status = "enabled";
237 } else {
238 $status = "disabled";
239 }
240
241 # Modify the status of the existing entry.
242 $ignored{$id} = ["$ignored{$id}[0]", "$ignored{$id}[1]", "$status"];
243
244 # Write the changed ignored hash to the ignored file.
245 &General::writehasharray($ignoredfile, \%ignored);
246
247 # Regenerate the ignore file.
97849142 248 &GenerateIgnoreFile();
7edbe063
SS		 249
250 # Check if guardian is running.
251 if ($pid > 0) {
252 # Send reload command through socket connection.
253 &Guardian::Socket::Client("reload");
01dbccb1
SS		 254 }
255 }
7edbe063
SS		 256
257## Remove entry from ignore list.
258#
259} elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
260 my %ignored = ();
261
262 # Read-in ignoredfile.
263 &General::readhasharray($ignoredfile, \%ignored);
264
265 # Drop entry from the hash.
266 delete($ignored{$settings{'ID'}});
267
268 # Undef the given ID.
269 undef($settings{'ID'});
270
271 # Write the changed ignored hash to the ignored file.
272 &General::writehasharray($ignoredfile, \%ignored);
273
274 # Regenerate the ignore file.
97849142 275 &GenerateIgnoreFile();
01dbccb1 276
f8c3bfe0
SS		 277 # Check if guardian is running.
278 if ($pid > 0) {
af6856af
SS		 279 # Send reload command through socket connection.
280 &Guardian::Socket::Client("reload");
f8c3bfe0
SS		 281 }
282
01dbccb1
SS		 283## Block a user given address or subnet.
284#
285} elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
286
c973d6da
SS		 287 # Assign some temporary variables used for input validation.
288 my $input = $settings{'ADDRESS_BLOCK'};
289 my $green = $netsettings{'GREEN_ADDRESS'};
290 my $blue = $netsettings{'BLUE_ADDRESS'};
291 my $orange = $netsettings{'ORANGE_ADDRESS'};
292 my $red = $netsettings{'RED_ADDRESS'};
01dbccb1 293
c973d6da
SS		 294 # Get gateway address.
295 my $gateway = &General::get_gateway();
01dbccb1 296
c973d6da
SS		 297 # Check if any input has been performed.
298 if ($input eq '') {
299 $errormessage = "$Lang::tr{'guardian empty input'}";
300 }
301
302 # Check if the given input is localhost (127.0.0.1).
303 elsif ($input eq "127.0.0.1") {
304 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
305 }
306
307 # Check if the given input is anywhere (0.0.0.0).
308 elsif ($input eq "0.0.0.0") {
309 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
310 }
311
312 # Check if the given input is one of the interface addresses or our gateway.
313 elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
314 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
315 }
316
317 # Check if the given input is a valid IP address.
318 elsif (!&General::validip($input)) {
319 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
320 }
01dbccb1
SS		 321
322 # Go further if there was no error.
323 if ($errormessage eq '') {
324 my $block = $settings{'ADDRESS_BLOCK'};
325
af6856af
SS		 326 # Send command to block the specified address through socket connection.
327 &Guardian::Socket::Client("block $block");
01dbccb1
SS		 328 }
329
330## Unblock address or subnet.
331#
332} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
333
334 # Check if no empty input has been performed.
335 if ($settings{'ADDRESS_UNBLOCK'} ne '') {
336
337 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
338 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
339 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
340 }
341
342 } else {
343 $errormessage = "$Lang::tr{'guardian empty input'}";
344 }
345
346 # Go further if there was no error.
347 if ($errormessage eq '') {
348 my $unblock = $settings{'ADDRESS_UNBLOCK'};
349
af6856af
SS		 350 # Send command to unblock the given address through socket connection.
351 &Guardian::Socket::Client("unblock $unblock");
01dbccb1
SS		 352 }
353
354## Unblock all.
355#
356} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
357
af6856af
SS		 358 # Send flush command through socket connection.
359 &Guardian::Socket::Client("flush");
01dbccb1
SS		 360}
361
7edbe063 362# Load settings from files.
36dbcf2e 363&General::readhash("${General::swroot}/guardian/settings", \%settings);
7edbe063 364&General::readhasharray("${General::swroot}/guardian/ignored", \%ignored);
01dbccb1
SS		 365
366# Call functions to generate whole page.
367&showMainBox();
368&showIgnoreBox();
369
370# Display area only if guardian is running.
f8c3bfe0 371if ( ($memory != 0) && ($pid > 0) ) {
01dbccb1
SS		 372 &showBlockedBox();
373}
374
375# Function to display the status of guardian and allow base configuration.
376sub showMainBox() {
377 my %checked = ();
7899718f 378 my %selected = ();
01dbccb1
SS		 379
380 $checked{'GUARDIAN_ENABLED'}{'on'} = '';
381 $checked{'GUARDIAN_ENABLED'}{'off'} = '';
382 $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
723648ac
SS		 383 $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} = '';
384 $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} = '';
385 $checked{'GUARDIAN_MONITOR_SNORT'}{$settings{'GUARDIAN_MONITOR_SNORT'}} = "checked='checked'";
386 $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = '';
387 $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = '';
388 $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'";
389 $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} = '';
390 $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} = '';
391 $checked{'GUARDIAN_MONITOR_HTTPD'}{$settings{'GUARDIAN_MONITOR_HTTPD'}} = "checked='checked'";
392 $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} = '';
393 $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} = '';
394 $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{$settings{'GUARDIAN_MONITOR_OWNCLOUD'}} = "checked='checked'";
01dbccb1 395
52958991 396 $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected';
4a7fc9f6 397 $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
52958991 398 $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}} = 'selected';
7899718f 399
01dbccb1
SS		 400 &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
401 &Header::openbigbox('100%', 'left', '', $errormessage);
402
403 # Print errormessage if there is one.
404 if ($errormessage) {
405 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
406 print "<font class='base'>$errormessage&nbsp;</font>\n";
407 &Header::closebox();
408 }
409
410
411 # Draw current guardian state.
412 &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
413
f8c3bfe0 414 # Get current status of guardian.
01dbccb1 415 &daemonstats();
922ddf0e 416 $pid = $pid[0];
01dbccb1
SS		 417
418 # Display some useful information related to guardian, if daemon is running.
f8c3bfe0 419 if ( ($memory != 0) && ($pid > 0) ){
01dbccb1
SS		 420 print <<END;
421 <table width='95%' cellspacing='0' class='tbl'>
422 <tr>
423 <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
424 </tr>
425 <tr>
426 <td class='base'>$Lang::tr{'guardian daemon'}</td>
427 <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
428 </tr>
429 <tr>
430 <td class='base'></td>
431 <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
432 <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
433 </tr>
434 <tr>
435 <td class='base'></td>
922ddf0e 436 <td bgcolor='$color{'color22'}' align='center'>$pid</td>
01dbccb1
SS		 437 <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
438 </tr>
439 </table>
440END
441 } else {
442 # Otherwise display a hint that the service is not launched.
443 print <<END;
444 <table width='95%' cellspacing='0' class='tbl'>
445 <tr>
446 <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
447 </tr>
448 <tr>
449 <td class='base'>$Lang::tr{'guardian daemon'}</td>
450 <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
451 </tr>
452 </table>
453END
454 }
455
456 &Header::closebox();
457
458 # Draw elements for guardian configuration.
459 &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
460
461 print <<END;
462 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
463
464 <table width='95%'>
465 <tr>
d2fea55e 466 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
01dbccb1
SS		 467 </tr>
468 <tr>
469 <td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
d2fea55e 470 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
01dbccb1 471 </tr>
26fcd31e
SS		 472 <tr>
473 <td colspan='2'><br></td>
474 </tr>
475 <tr>
06ff7e28 476 <td width='20%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td>
723648ac
SS		 477 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='on' $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} /> /
478 <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='off' $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} /> off</td>
26fcd31e
SS		 479 </tr>
480 <tr>
06ff7e28 481 <td width='20%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
723648ac
SS		 482 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> /
483 <input type='radio' name='GUARDIAN_MONITOR_SSH' value='off' $checked{'GUARDIAN_MONITOR_SSH'}{'off'} /> off</td>
26fcd31e
SS		 484 </tr>
485 <tr>
06ff7e28 486 <td width='20%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
723648ac
SS		 487 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='on' $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} /> /
488 <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='off' $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} /> off</td>
26fcd31e 489 </tr>
28981fac
SS		 490END
491 # Display owncloud checkbox when the addon is installed.
492 if ( -e "$owncloud_meta" ) {
493 print"<tr>\n";
494 print"<td width='20%' class='base'>$Lang::tr{'guardian block owncloud brute-force'}</td>\n";
723648ac
SS		 495 print"<td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='on' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} /> /\n";
496 print"<input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='off' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} /> off</td>\n";
28981fac
SS		 497 print"</tr>\n";
498 }
499 print <<END;
52958991
SS		 500 <tr>
501 <td colspan='2'><br></td>
502 </tr>
503 <tr>
504 <td align='left' width='20%'>$Lang::tr{'guardian logfacility'}:</td>
505 <td><select name='GUARDIAN_LOG_FACILITY'>
506 <option value='syslog' $selected{'GUARDIAN_LOG_FACILITY'}{'syslog'}>syslog</option>
507 <option value='file' $selected{'GUARDIAN_LOG_FACILITY'}{'file'}>file</option>
508 <option value='console' $selected{'GUARDIAN_LOG_FACILITY'}{'console'}>console</option>
509 </select></td>
510 </tr>
26fcd31e
SS		 511 <tr>
512 <td colspan='2'><br></td>
513 </tr>
7899718f 514 <tr>
a35a0668 515 <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
7899718f
SS		 516 <td><select name='GUARDIAN_LOGLEVEL'>
517 <option value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>off</option>
518 <option value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>info</option>
519 <option value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>debug</option>
520 </select></td>
521 </tr>
a35a0668
SS		 522 <tr>
523 <td colspan='2'><br></td>
524 </tr>
4a7fc9f6
SS		 525 <tr>
526 <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td>
52958991
SS		 527 <td><select name='GUARDIAN_SNORT_PRIORITY_LEVEL'>
528 <option value='1' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'1'}>1</option>
529 <option value='2' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'2'}>2</option>
530 <option value='3' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'3'}>3</option>
531 <option value='4' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'4'}>4</option>
4a7fc9f6
SS		 532 </select></td>
533 </tr>
534 <tr>
535 <td colspan='2'><br></td>
536 </tr>
a35a0668
SS		 537 <tr>
538 <td width='20%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
539 <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
540 </tr>
01dbccb1
SS		 541 <tr>
542 <td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
d2fea55e 543 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
01dbccb1
SS		 544 </tr>
545 <tr>
546 <td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
d2fea55e 547 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
01dbccb1 548 </tr>
01dbccb1
SS		 549 </table>
550END
551
552 print <<END;
553 <hr>
554
555 <table width='95%'>
556 <tr>
557 <td>&nbsp;</td>
558 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
559 <td>&nbsp;</td>
560 </tr>
561 </table>
562 </form>
563END
564
565 &Header::closebox();
566}
567
568# Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
569sub showIgnoreBox() {
570 &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
571
572 print <<END;
7edbe063 573 <table width='80%'>
01dbccb1 574 <tr>
7edbe063
SS		 575 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'ip address'}</b></td>
576 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'remark'}</b></td>
577 <td class='base' colspan='3' bgcolor='$color{'color20'}'></td>
01dbccb1
SS		 578 </tr>
579END
7edbe063
SS		 580 # Check if some hosts have been add to be ignored.
581 if (keys (%ignored)) {
01dbccb1
SS		 582 my $col = "";
583
7edbe063
SS		 584 # Loop through all entries of the hash..
585 while( (my $key) = each %ignored) {
586 # Assign data array positions to some nice variable names.
587 my $address = $ignored{$key}[0];
588 my $remark = $ignored{$key}[1];
589 my $status = $ignored{$key}[2];
590
591 # Check if the key (id) number is even or not.
592 if ($settings{'ID'} eq $key) {
593 $col="bgcolor='${Header::colouryellow}'";
594 } elsif ($key % 2) {
01dbccb1
SS		 595 $col="bgcolor='$color{'color22'}'";
596 } else {
597 $col="bgcolor='$color{'color20'}'";
598 }
599
7edbe063
SS		 600 # Choose icon for the checkbox.
601 my $gif;
602 my $gdesc;
603
604 # Check if the status is enabled and select the correct image and description.
605 if ($status eq 'enabled' ) {
606 $gif = 'on.gif';
607 $gdesc = $Lang::tr{'click to disable'};
608 } else {
609 $gif = 'off.gif';
610 $gdesc = $Lang::tr{'click to enable'};
611 }
612
01dbccb1
SS		 613 print <<END;
614 <tr>
7edbe063
SS		 615 <td width='20%' class='base' $col>$address</td>
616 <td width='65%' class='base' $col>$remark</td>
617
618 <td align='center' $col>
619 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
620 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
621 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$gdesc' title='$gdesc' />
622 <input type='hidden' name='ID' value='$key' />
623 </form>
624 </td>
625
626 <td align='center' $col>
627 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
628 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
629 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
630 <input type='hidden' name='ID' value='$key' />
631 </form>
632 </td>
633
634 <td align='center' $col>
635 <form method='post' name='$key' action='$ENV{'SCRIPT_NAME'}'>
01dbccb1 636 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
7edbe063 637 <input type='hidden' name='ID' value='$key'>
01dbccb1
SS		 638 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
639 </form>
640 </td>
641 </tr>
642END
643 }
01dbccb1 644 } else {
7edbe063 645 # Print notice that currently no hosts are ignored.
01dbccb1
SS		 646 print "<tr>\n";
647 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
648 print "</tr>\n";
649 }
650
651 print "</table>\n";
652
7edbe063 653 # Section to add new elements or edit existing ones.
01dbccb1 654 print <<END;
1d5702a7 655 <br>
7edbe063
SS		 656 <hr>
657 <br>
658
1d5702a7 659 <div align='center'>
7edbe063
SS		 660 <table width='100%'>
661END
662
663 # Assign correct headline and button text.
664 my $buttontext;
665 my $entry_address;
666 my $entry_remark;
667
668 # Check if an ID (key) has been given, in this case an existing entry should be edited.
669 if ($settings{'ID'} ne '') {
670 $buttontext = $Lang::tr{'update'};
671 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'update'}</b></td></tr>\n";
672
673 # Grab address and remark for the given key.
674 $entry_address = $ignored{$settings{'ID'}}[0];
675 $entry_remark = $ignored{$settings{'ID'}}[1];
676 } else {
677 $buttontext = $Lang::tr{'add'};
678 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'dnsforward add a new entry'}</b></td></tr>\n";
679 }
680
681 print <<END;
01dbccb1 682 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
7edbe063 683 <input type='hidden' name='ID' value='$settings{'ID'}'>
01dbccb1 684 <tr>
7edbe063
SS		 685 <td width='30%'>$Lang::tr{'ip address'}: </td>
686 <td width='50%'><input type='text' name='IGNORE_ENTRY_ADDRESS' value='$entry_address' size='24' /></td>
687
688 <td width='30%'>$Lang::tr{'remark'}: </td>
689 <td wicth='50%'><input type='text' name=IGNORE_ENTRY_REMARK value='$entry_remark' size='24' /></td>
690 <td align='center' width='20%'><input type='submit' name='ACTION' value='$buttontext' /></td>
01dbccb1
SS		 691 </tr>
692 </form>
693 </table>
694 </div>
695END
1d5702a7
SS		 696
697 &Header::closebox();
01dbccb1
SS		 698}
699
700# Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
701sub showBlockedBox() {
702 &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
703
01dbccb1
SS		 704 print <<END;
705 <table width='60%'>
706 <tr>
707 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
708 </tr>
709END
710
5f462919
SS		 711 # Lauch function to get the currently blocked hosts.
712 my @blocked_hosts = &GetBlockedHosts();
713
01dbccb1 714 my $id = 0;
01dbccb1 715 my $col = "";
01dbccb1 716
5f462919
SS		 717 # Loop through our blocked hosts array.
718 foreach my $blocked_host (@blocked_hosts) {
01dbccb1
SS		 719
720 # Increase id number for each element in the ignore file.
721 $id++;
722
723 # Check if the id number is even or not.
724 if ($id % 2) {
725 $col="bgcolor='$color{'color22'}'";
726 } else {
727 $col="bgcolor='$color{'color20'}'";
728 }
729
730 print <<END;
731 <tr>
8b8413e5 732 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
01dbccb1
SS		 733 <td width='20%' align='center' $col>
734 <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
735 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
736 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
737 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
738 </form>
739 </td>
740 </tr>
741END
742 }
743
01dbccb1
SS		 744 # If the loop only has been runs once the id still is "0", which means there are no
745 # additional entries (blocked hosts) in the iptables chain.
746 if ($id == 0) {
747
748 # Print notice that currently no hosts are blocked.
749 print "<tr>\n";
750 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
751 print "</tr>\n";
752 }
753
754 print "</table>\n";
755
01dbccb1
SS		 756 # Section for a manual block of an IP-address.
757 print <<END;
1d5702a7
SS		 758 <br>
759 <div align='center'>
760 <table width='60%' border='0'>
01dbccb1
SS		 761 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
762 <tr>
763 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
764 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
765 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
766 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
767 </tr>
768 </form>
769 </table>
770 </div>
771END
1d5702a7
SS		 772
773 &Header::closebox();
01dbccb1
SS		 774}
775
776&Header::closebigbox();
777&Header::closepage();
778
779# Function to check if guardian has been started.
780# Grab process id and consumed memory if the daemon is running.
781sub daemonstats() {
782 $memory = 0;
783 # for pid and memory
784 open(FILE, '/usr/local/bin/addonctrl guardian status | ');
785 @guardian = <FILE>;
786 close(FILE);
787 $string = join("", @guardian);
788 $string =~ s/[a-z_]//gi;
789 $string =~ s/\[[0-1]\;[0-9]+//gi;
790 $string =~ s/[\(\)\.]//gi;
791 $string =~ s/ //gi;
792 $string =~ s/\e//gi;
793 @pid = split(/\s/,$string);
794 if (open(FILE, "/proc/$pid[0]/statm")){
795 my $temp = <FILE>;
796 @memory = split(/ /,$temp);
797 close(FILE);
798 }
799 $memory+=$memory[0];
800}
801
5f462919 802sub GetBlockedHosts() {
5f462919
SS		 803 # Create new, empty array.
804 my @hosts;
805
806 # Lauch helper to get chains from iptables.
891ba055
SS		 807 system('/usr/local/bin/getipstat');
808
809 # Open temporary file which contains the chains and rules.
810 open (FILE, '/srv/web/ipfire/html/iptables.txt');
811
812 # Loop through the entire file.
813 while (<FILE>) {
814 my $line = $_;
815
816 # Search for the guardian chain and extract
817 # the lines between it and the next empty line
818 # which is placed before the next firewall
819 # chain starts.
820 if ($line =~ /^Chain GUARDIAN/ .. /^\s*$/) {
821 # Skip descriptive lines.
822 next if ($line =~ /^Chain/);
823 next if ($line =~ /^ pkts/);
824
825 # Generate array, based on the line content (seperator is a single or multiple space's)
826 my @comps = split(/\s{1,}/, $line);
827 my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
828
829 # Assign different variable names.
830 my $blocked_host = $source;
831
832 # Add host to our hosts array.
833 if ($blocked_host) {
834 push(@hosts, $blocked_host);
835 }
836 }
837 }
5f462919 838
891ba055
SS		 839 # Close filehandle.
840 close(FILE);
5f462919 841
891ba055
SS		 842 # Remove recently created temporary files of the "getipstat" binary.
843 system(rm -f "/srv/web/ipfire/html/iptables.txt");
844 system(rm -f "/srv/web/ipfire/html/iptablesmangle.txt");
845 system(rm -f "/srv/web/ipfire/html/iptablesnat.txt");
5f462919
SS		 846
847 # Convert entries, sort them, write back and store the sorted entries into new array.
848 my @sorted = map { $_->[0] }
849 sort { $a->[1] <=> $b->[1] }
850 map { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
851 @hosts;
852
853 # Return our sorted list.
854 return @sorted
855}
856
01dbccb1
SS		 857sub BuildConfiguration() {
858 my %settings = ();
859 &General::readhash("${General::swroot}/guardian/settings", \%settings);
860
861 my $configfile = "${General::swroot}/guardian/guardian.conf";
862
7f728591 863 # Open configfile for writing.
01dbccb1
SS		 864 open(FILE, ">$configfile");
865
52958991
SS		 866 # Config file header.
867 print FILE "# Autogenerated configuration file.\n";
868 print FILE "# All user modifications will be overwritten.\n\n";
28981fac 869
52958991
SS		 870 # Settings for the logging mechanism.
871 print FILE "# Log settings.\n";
872 print FILE "LogFacility = $settings{'GUARDIAN_LOG_FACILITY'}\n";
873
874 if ($settings{'GUARDIAN_LOG_FACILITY'} eq "file") {
875 print FILE "LogFile = $settings{'GUARDIAN_LOGFILE'}\n";
28981fac
SS		 876 }
877
52958991
SS		 878 print FILE "LogLevel = $settings{'GUARDIAN_LOGLEVEL'}\n\n";
879
880 # IPFire related static settings.
881 print FILE "# IPFire related settings.\n";
882 print FILE "FirewallEngine = IPtables\n";
883 print FILE "SocketOwner = nobody:nobody\n";
884 print FILE "IgnoreFile = $ignorefile\n\n";
885
886 # Configured block values.
887 print FILE "# Configured block values.\n";
888 print FILE "BlockCount = $settings{'GUARDIAN_BLOCKCOUNT'}\n";
889 print FILE "BlockTime = $settings{'GUARDIAN_BLOCKTIME'}\n\n";
890
891 # Enabled modules.
892 # Loop through whole settings hash.
893 print FILE "# Enabled modules.\n";
894 foreach my $option (keys %settings) {
895 # Search for enabled modules.
896 if ($option =~ /GUARDIAN_MONITOR_(.*)/) {
897 # Skip if module is not enabled.
898 next unless($settings{$option} eq "on");
899
900 # Skip module if no file location is available.
901 next unless(exists($module_file_locations{$1}));
902
903 # Add enabled module and defined path to the config file.
904 print FILE "Monitor_$1 = $module_file_locations{$1}\n";
905 }
906 }
907
908 # Module settings.
909 print FILE "\n# Module settings.\n";
910 # Check if SNORT is enabled and add snort priority.
911 if ($settings{'GUARDIAN_MONITOR_SNORT'} eq "on") {
912 print FILE "SnortPriorityLevel = $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}\n";
913 }
01dbccb1
SS		 914
915 close(FILE);
916
f8c3bfe0
SS		 917 # Check if guardian should be started or stopped.
918 if($settings{'GUARDIAN_ENABLED'} eq 'on') {
919 if($pid > 0) {
af6856af
SS		 920 # Send reload command through socket connection.
921 &Guardian::Socket::Client("reload");
f8c3bfe0
SS		 922 } else {
923 # Launch guardian.
af6856af 924 system("/usr/local/bin/addonctrl guardian start &>/dev/null");
f8c3bfe0 925 }
01dbccb1 926 } else {
f8c3bfe0 927 # Stop the daemon.
af6856af 928 system("/usr/local/bin/addonctrl guardian stop &>/dev/null");
01dbccb1
SS		 929 }
930}
97849142
SS		 931
932sub GenerateIgnoreFile() {
933 my %ignored = ();
934
935 # Read-in ignoredfile.
936 &General::readhasharray($ignoredfile, \%ignored);
937
938 # Open ignorefile for writing.
939 open(FILE, ">$ignorefile");
940
941 # Config file header.
942 print FILE "# Autogenerated configuration file.\n";
943 print FILE "# All user modifications will be overwritten.\n\n";
944
945 # Add IFPire interfaces and gateway to the ignore file.
946 #
947 # Assign some temporary variables for the IPFire interfaces.
948 my $green = $netsettings{'GREEN_ADDRESS'};
949 my $blue = $netsettings{'BLUE_ADDRESS'};
950 my $orange = $netsettings{'ORANGE_ADDRESS'};
951 my $red = $netsettings{'RED_ADDRESS'};
952
953 # File declarations.
954 my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
955 my $dns1file = "${General::swroot}/red/dns1";
956 my $dns2file = "${General::swroot}/red/dns2";
957
958 # Get gateway address.
959 my $gateway = &_get_address_from_file($gatewayfile);
960
961 # Get addresses from the used dns servers.
962 my $dns1 = &_get_address_from_file($dns1file);
963 my $dns2 = &_get_address_from_file($dns2file);
964
965 # Write the obtained addresses to the ignore file.
966 print FILE "# IPFire local interfaces.\n";
967 print FILE "$green\n";
968
969 # Check if a blue interface exists.
970 if ($blue) {
971 # Add blue address.
972 print FILE "$blue\n";
973 }
974
975 # Check if an orange interface exists.
976 if ($orange) {
977 # Add orange address.
978 print FILE "$orange\n";
979 }
980
981 print FILE "\n# IPFire red interface, gateway and used DNS-servers.\n";
982 print FILE "$red\n";
983 print FILE "$gateway\n";
984 print FILE "$dns1\n";
985 print FILE "$dns2\n";
986
987 # Add all user defined hosts and networks to the ignore file.
988 #
989 # Check if the hash contains any elements.
990 if (keys (%ignored)) {
991 # Write headline.
992 print FILE "# User defined hosts/networks.\n";
993
994 # Loop through the entire hash and write the host/network
995 # and remark to the ignore file.
996 while ( (my $key) = each %ignored) {
997 my $address = $ignored{$key}[0];
998 my $remark = $ignored{$key}[1];
999 my $status = $ignored{$key}[2];
1000
1001 # Check if the status of the entry is "enabled".
1002 if ($status eq "enabled") {
1003 # Check if the address/network is valid.
1004 if ((&General::validip($address)) || (&General::validipandmask($address))) {
1005 # Write the remark to the file.
1006 print FILE "# $remark\n";
1007
1008 # Write the address/network to the ignore file.
1009 print FILE "$address\n\n";
1010 }
1011 }
1012 }
1013 }
1014
1015 close(FILE);
1016}
1017
1018# Private subfunction to obtain IP-addresses from given file names.
1019#
1020sub _get_address_from_file ($) {
1021 my $file = shift;
1022
1023 # Check if the file exists.
1024 if (-e $file) {
1025 # Open the given file.
1026 open(FILE, "$file") or die "Could not open $file.";
1027
1028 # Obtain the address from the first line of the file.
1029 my $address = <FILE>;
1030
1031 # Close filehandle
1032 close(FILE);
1033
1034 # Remove newlines.
1035 chomp $address;
1036
1037 # Check if the grabbed address is valid.
1038 if (&General::validip($address)) {
1039 # Return the address.
1040 return $address;
1041 }
1042 }
1043
1044 # Return nothing.
1045 return;
1046}
Peter's tree of IPFire 2.x