[people/pmueller/ipfire-2.x.git] / html / cgi-bin / guardian.cgi

#!/usr/bin/perl
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2014  IPFire Team  <info@ipfire.org>                          #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

use strict;
use Locale::Country;

# enable only the following on debugging purpose
use warnings;
use CGI::Carp 'fatalsToBrowser';

require '/var/ipfire/general-functions.pl';
require "${General::swroot}/lang.pl";
require "${General::swroot}/header.pl";

#workaround to suppress a warning when a variable is used only once
my @dummy = ( ${Header::colouryellow} );
undef (@dummy);

my $string=();
my $memory=();
my @memory=();
my @pid=();
my @guardian=();
my %cgiparams=();

# Path to the guardian.ignore file.
my $ignorefile ='/var/ipfire/guardian/guardian.ignore';

# Path to the guardian.target file.
my $targetfile ='/var/ipfire/guardian/guardian.ignore';

our %netsettings = ();
&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);

our %color = ();
our %mainsettings = ();
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);

our %settings = ();

$settings{'GUARDIAN_ENABLED'} = 'off';
$settings{'GUARDIAN_BLOCKTIME'} = '86400';
$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
$settings{'GUARDIAN_SNORT_ALERTFILE'} = '/var/log/snort/alert';

$settings{'ACTION'} = '';

my $errormessage = '';

&Header::showhttpheaders();

# Get GUI values.
&Header::getcgihash(\%settings);
&Header::getcgihash(\%cgiparams);

## Perform input checks and save settings.
#
if ($settings{'ACTION'} eq $Lang::tr{'save'}) {

	# Check for valid blocktime.
	if ($settings{'GUARDIAN_BLOCKTIME'} ne '') {
		if (($settings{'GUARDIAN_BLOCKTIME'} !~ /^[0-9]+$/) || ($settings{'GUARDIAN_BLOCKTIME'} le '0')) {
			$errormessage = "$Lang::tr{'guardian invalid blocktime'}";
		}
	}

	# Check Logfile.
	if ($settings{'GUARDIAN_LOGFILE'} ne '') {
		if ($settings{'GUARDIAN_LOGFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
			$errormessage = "$Lang::tr{'guardian invalid logfile'}";
		}
	}

	# Check input for snort alert file.
        if ($settings{'GUARDIAN_SNORT_ALERTFILE'} ne '') {
                if ($settings{'GUARDIAN_SNORT_ALERTFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
                        $errormessage = "$Lang::tr{'guardian invalid alertfile'}";
                }
        }

	# Only continue if no error message has been set.
	if ($errormessage eq '') {
		# Write configuration settings to file.
		&General::writehash("${General::swroot}/guardian/settings", \%settings);

		# Update configuration files.
		&BuildConfiguration();
	}

## Add a new entry to the ignore file.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'add'}) {

	# Check if any input has been performed.
	if ($settings{'NEW_IGNORE_ENTRY'} ne '') {

		# Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
		if ((!&General::validip($settings{'NEW_IGNORE_ENTRY'})) && (!&General::validipandmask($settings{'NEW_IGNORE_ENTRY'}))) {
			$errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
		}
	} else {
		$errormessage = "$Lang::tr{'guardian empty input'}";
	}

	# Go further if there was no error.
	if ($errormessage eq '') {
		my $new_entry = $settings{'NEW_IGNORE_ENTRY'};

		# Open file for appending the new entry.
		open (FILE, ">>$ignorefile") or die "Unable to open $ignorefile for writing";

		# Write the new entry to the ignore file.
		print FILE "$new_entry\n";
		close(FILE);
	}

## Remove entry from ignore list.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
	my $id = 0;

	# Open ignorefile and read content.
	open(FILE, "<$ignorefile") or die "Unable to open $ignorefile.";
	my @current = <FILE>;
	close(FILE);

	# Re-open ignorefile for writing.
	open(FILE, ">$ignorefile") or die "Unable to open $ignorefile for writing";
	flock FILE, 2;

	# Read line by line from ignorefile and write them back except the line with the given ID.
	# So this line is missing in the new file and the entry has been deleted.
	foreach my $line (@current) {
		$id++;
		unless ($cgiparams{'ID'} eq $id) {
			print FILE "$line";
		}
	}
	close(FILE);

## Block a user given address or subnet.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {

	# Check if no empty input has been performed.
        if ($settings{'ADDRESS_BLOCK'} ne '') {

                # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
                if ((!&General::validip($settings{'ADDRESS_BLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_BLOCK'}))) {
                        $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
                }

        } else {
                $errormessage = "$Lang::tr{'guardian empty input'}";
        }

        # Go further if there was no error.
        if ($errormessage eq '') {
                my $block = $settings{'ADDRESS_BLOCK'};

                # Call helper to unblock address.
                system("/usr/local/bin/guardianctrl block $block &>/dev/null");
        }

## Unblock address or subnet.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {

	# Check if no empty input has been performed.
	if ($settings{'ADDRESS_UNBLOCK'} ne '') {

		# Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
		if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
			$errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
		}

	} else {
		$errormessage = "$Lang::tr{'guardian empty input'}";
	}

	# Go further if there was no error.
	if ($errormessage eq '') {
                my $unblock = $settings{'ADDRESS_UNBLOCK'};

		# Call helper to unblock address.
		system("/usr/local/bin/guardianctrl unblock $unblock &>/dev/null");
	}

## Unblock all.
#
} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {

	# Call helper to flush iptables chain from guardian.
	system("/usr/local/bin/guardianctrl flush-chain &>/dev/null");

} else {
        # Load settings from file.
        &General::readhash("${General::swroot}/guardian/settings", \%settings);
}


# Call functions to generate whole page.
&showMainBox();
&showIgnoreBox();

# Display area only if guardian is running.
if ( ($memory != 0) && (@pid[0] ne "///") ) {
	&showBlockedBox();
}

# Function to display the status of guardian and allow base configuration.
sub showMainBox() {
	my %checked = ();

	$checked{'GUARDIAN_ENABLED'}{'on'} = '';
	$checked{'GUARDIAN_ENABLED'}{'off'} = '';
	$checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';

	&Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
	&Header::openbigbox('100%', 'left', '', $errormessage);

	# Print errormessage if there is one.
	if ($errormessage) {
		&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
		print "<font class='base'>$errormessage&nbsp;</font>\n";
		&Header::closebox();
	}


	# Draw current guardian state.
	&Header::openbox('100%', 'center', $Lang::tr{'guardian'});

	# Check if guardian is running and grab some stats.
	&daemonstats();

	# Display some useful information related to guardian, if daemon is running.
	if ( ($memory != 0) && (@pid[0] ne "///") ){
		print <<END;
			<table width='95%' cellspacing='0' class='tbl'>
				<tr>
					<th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
				</tr>
				<tr>
					<td class='base'>$Lang::tr{'guardian daemon'}</td>
					<td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
				</tr>
				<tr>
					<td class='base'></td>
					<td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
					<td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
				</tr>
				<tr>
					<td class='base'></td>
					<td bgcolor='$color{'color22'}' align='center'>@pid[0]</td>
					<td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
				</tr>
			</table>
END
	} else {
		# Otherwise display a hint that the service is not launched.
		print <<END;
			<table width='95%' cellspacing='0' class='tbl'>
				<tr>
					<th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
				</tr>
				<tr>
					<td class='base'>$Lang::tr{'guardian daemon'}</td>
					<td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
				</tr>
			</table>
END
	}

	&Header::closebox();

	# Draw elements for guardian configuration.
	&Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});

	print <<END;
		<form method='post' action='$ENV{'SCRIPT_NAME'}'>

		<table width='95%'>
			<tr>
				<td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
			</tr>
			<tr>
				<td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
				<td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
			</tr>
			<tr>
				<td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
				<td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
			</tr>
			<tr>
                                <td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
                                <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
                        </tr>
                        <tr>
                                <td width='20%' class='base'>$Lang::tr{'guardian snort alertfile'}:</td>
                                <td><input type='text' name='GUARDIAN_SNORT_ALERTFILE' value='$settings{'GUARDIAN_SNORT_ALERTFILE'}' size='30' /></td>
                        </tr>
		</table>
END

	print <<END;
		<hr>

		<table width='95%'>
			<tr>
				<td>&nbsp;</td>
				<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
				<td>&nbsp;</td>
			</tr>
		</table>
	</form>
END

	&Header::closebox();
}

# Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
sub showIgnoreBox() {
        &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});

	print <<END;
		<table width='60%'>
			<tr>
				<td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian ignored hosts'}</b></td>
			</tr>
END
			# Check if the guardian ignore file contains any content.
			if (-s $ignorefile) {

				# Open file and print contents.
				open FILE, $ignorefile or die "Could not open $ignorefile";

				my $id = 0;
				my $col = "";

				# Read file line by line and print out the elements.
				while( my $ignored_element = <FILE> )  {

					# Increase id number for each element in the ignore file.
					$id++;

					# Check if the id number is even or not.
					if ($id % 2) {
						$col="bgcolor='$color{'color22'}'";
					} else {
						$col="bgcolor='$color{'color20'}'";
					}

					print <<END;
					<tr>
						<td width='80%' class='base' $col>$ignored_element</td>
						<td width='20%' align='center' $col>
							<form method='post' name='frma$id' action='$ENV{'SCRIPT_NAME'}'>
								<input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
								<input type='hidden' name='ID' value='$id'>
								<input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
							</form>
						</td>
					</tr>
END
				}
			close (FILE);
			} else {
				# Print notice that currently no elements are stored in the ignore file.
				print "<tr>\n";
				print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
				print "</tr>\n";
			}

		print "</table>\n";

	# Section to add new elements to the ignore list.
	print <<END;
	<br>
	<div align='center'>
		<table width='60%'>
			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
			<tr>
				<td width='30%'>$Lang::tr{'dnsforward add a new entry'}: </td>
				<td width='50%'><input type='text' name='NEW_IGNORE_ENTRY' value='' size='24' /></td>
				<td align='center' width='20%'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
			</tr>
			</form>
		</table>
	</div>
END

	&Header::closebox();
}

# Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
sub showBlockedBox() {
	&Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});

	print <<END;
	<table width='60%'>
		<tr>
			<td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
		</tr>
END

		# Lauch function to get the currently blocked hosts.
		my @blocked_hosts = &GetBlockedHosts();

		my $id = 0;
		my $col = "";

		# Loop through our blocked hosts array.
		foreach my $blocked_host (@blocked_hosts) {

			# Increase id number for each element in the ignore file.
			$id++;

			# Check if the id number is even or not.
			if ($id % 2) {
				$col="bgcolor='$color{'color22'}'";
			} else {
				$col="bgcolor='$color{'color20'}'";
			}

			print <<END;
			<tr>
				<td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
				<td width='20%' align='center' $col>
					<form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
						<input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
						<input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
						<input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
					</form>
				</td>
			</tr>
END
		}

	# If the loop only has been runs once the id still is "0", which means there are no
	# additional entries (blocked hosts) in the iptables chain.
	if ($id == 0) {

		# Print notice that currently no hosts are blocked.
		print "<tr>\n";
		print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
		print "</tr>\n";
	}

	print "</table>\n";

        # Section for a manual block of an IP-address.
	print <<END;
	<br>
	<div align='center'>
		<table width='60%' border='0'>
			<form method='post' action='$ENV{'SCRIPT_NAME'}'>
			<tr>
				<td width='30%'>$Lang::tr{'guardian block a host'}: </td>
				<td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
				<td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
				<td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
			</tr>
			</form>
		</table>
	</div>
END

	&Header::closebox();
}

&Header::closebigbox();
&Header::closepage();

# Function to check if guardian has been started.
# Grab process id and consumed memory if the daemon is running.
sub daemonstats() {
        $memory = 0;
        # for pid and memory
        open(FILE, '/usr/local/bin/addonctrl guardian status | ');
        @guardian = <FILE>;
        close(FILE);
        $string = join("", @guardian);
        $string =~ s/[a-z_]//gi;
        $string =~ s/\[[0-1]\;[0-9]+//gi;
        $string =~ s/[\(\)\.]//gi;
        $string =~ s/  //gi;
        $string =~ s/\e//gi;
        @pid = split(/\s/,$string);
        if (open(FILE, "/proc/$pid[0]/statm")){
                my $temp = <FILE>;
                @memory = split(/ /,$temp);
                close(FILE);
        }
        $memory+=$memory[0];
}

sub GetBlockedHosts() {

	# Create new, empty array.
	my @hosts;

	# Lauch helper to get chains from iptables.
	open(FILE, "/usr/local/bin/guardianctrl get-chain |");

	# Read file line by line and print out the elements.
	foreach my $line (<FILE>) {

		# Skip descriptive lines.
		next if ($line =~ /^Chain/);
		next if ($line =~ /^ pkts/);

		# Generate array, based on the line content (seperator is a single or multiple space's)
		my @comps = split(/\s{1,}/, $line);
		my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;

		# Assign different variable names.
		my $blocked_host = $source;

		# Add host to our hosts array.
		push(@hosts, $blocked_host);
	}

	# Convert entries, sort them, write back and store the sorted entries into new array.
	my @sorted = map  { $_->[0] }
             sort { $a->[1] <=> $b->[1] }
             map  { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
             @hosts;

	# Return our sorted list.
	return @sorted
}

sub BuildConfiguration() {
	my %settings = ();
	&General::readhash("${General::swroot}/guardian/settings", \%settings);

	my $configfile = "${General::swroot}/guardian/guardian.conf";

	# We set this to 1 (enabled) to prevent guardian from blocking the ISP gateway.
	my $HostGatewayByte = "1";

	# Grab interface of red network zone.
	my $red_interface = &General::get_red_interface();

	# Open configfile for writing.
	open(FILE, ">$configfile");

	print FILE "Interface		$red_interface\n";
	print FILE "HostGatewayByte	$HostGatewayByte\n";
	print FILE "LogFile		$settings{'GUARDIAN_LOGFILE'}\n";
	print FILE "AlertFile		$settings{'GUARDIAN_SNORT_ALERTFILE'}\n";
	print FILE "IgnoreFile		$ignorefile\n";
	print FILE "TargetFile		$targetfile\n";
	print FILE "TimeLimit		$settings{'GUARDIAN_BLOCKTIME'}\n";

	close(FILE);

	# Restart the service.
	if ($settings{'GUARDIAN_ENABLED'} eq 'on') {
		system("/usr/local/bin/guardianctrl restart &>/dev/null");
	} else {
		system("/usr/local/bin/guardianctrl stop &>/dev/null");
	}
}
Commit	Line	Data
01dbccb1 SS	1	#!/usr/bin/perl
	2	###############################################################################
	3	# #
	4	# IPFire.org - A linux based firewall #
	5	# Copyright (C) 2014 IPFire Team <info@ipfire.org> #
	6	# #
	7	# This program is free software: you can redistribute it and/or modify #
	8	# it under the terms of the GNU General Public License as published by #
	9	# the Free Software Foundation, either version 3 of the License, or #
	10	# (at your option) any later version. #
	11	# #
	12	# This program is distributed in the hope that it will be useful, #
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	15	# GNU General Public License for more details. #
	16	# #
	17	# You should have received a copy of the GNU General Public License #
	18	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	19	# #
	20	###############################################################################
	21
	22	use strict;
	23	use Locale::Country;
	24
	25	# enable only the following on debugging purpose
	26	use warnings;
	27	use CGI::Carp 'fatalsToBrowser';
	28
	29	require '/var/ipfire/general-functions.pl';
	30	require "${General::swroot}/lang.pl";
	31	require "${General::swroot}/header.pl";
	32
	33	#workaround to suppress a warning when a variable is used only once
	34	my @dummy = ( ${Header::colouryellow} );
	35	undef (@dummy);
	36
	37	my $string=();
	38	my $memory=();
	39	my @memory=();
	40	my @pid=();
	41	my @guardian=();
	42	my %cgiparams=();
	43
	44	# Path to the guardian.ignore file.
	45	my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
	46
	47	# Path to the guardian.target file.
	48	my $targetfile ='/var/ipfire/guardian/guardian.ignore';
	49
	50	our %netsettings = ();
	51	&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
	52
	53	our %color = ();
	54	our %mainsettings = ();
	55	&General::readhash("${General::swroot}/main/settings", \%mainsettings);
	56	&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
	57
	58	our %settings = ();
	59
	60	$settings{'GUARDIAN_ENABLED'} = 'off';
01dbccb1 SS	61	$settings{'GUARDIAN_BLOCKTIME'} = '86400';
	62	$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
	63	$settings{'GUARDIAN_SNORT_ALERTFILE'} = '/var/log/snort/alert';
	64
	65	$settings{'ACTION'} = '';
	66
	67	my $errormessage = '';
	68
	69	&Header::showhttpheaders();
	70
	71	# Get GUI values.
	72	&Header::getcgihash(\%settings);
	73	&Header::getcgihash(\%cgiparams);
	74
	75	## Perform input checks and save settings.
	76	#
	77	if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
	78
	79	# Check for valid blocktime.
	80	if ($settings{'GUARDIAN_BLOCKTIME'} ne '') {
	81	if (($settings{'GUARDIAN_BLOCKTIME'} !~ /^[0-9]+$/) \|\| ($settings{'GUARDIAN_BLOCKTIME'} le '0')) {
	82	$errormessage = "$Lang::tr{'guardian invalid blocktime'}";
	83	}
	84	}
	85
	86	# Check Logfile.
	87	if ($settings{'GUARDIAN_LOGFILE'} ne '') {
	88	if ($settings{'GUARDIAN_LOGFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
	89	$errormessage = "$Lang::tr{'guardian invalid logfile'}";
	90	}
	91	}
	92
	93	# Check input for snort alert file.
	94	if ($settings{'GUARDIAN_SNORT_ALERTFILE'} ne '') {
	95	if ($settings{'GUARDIAN_SNORT_ALERTFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
	96	$errormessage = "$Lang::tr{'guardian invalid alertfile'}";
	97	}
	98	}
	99
	100	# Only continue if no error message has been set.
	101	if ($errormessage eq '') {
	102	# Write configuration settings to file.
	103	&General::writehash("${General::swroot}/guardian/settings", \%settings);
	104
	105	# Update configuration files.
	106	&BuildConfiguration();
	107	}
	108
	109	## Add a new entry to the ignore file.
	110	#
	111	} elsif ($settings{'ACTION'} eq $Lang::tr{'add'}) {
	112
	113	# Check if any input has been performed.
	114	if ($settings{'NEW_IGNORE_ENTRY'} ne '') {
	115
	116	# Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
	117	if ((!&General::validip($settings{'NEW_IGNORE_ENTRY'})) && (!&General::validipandmask($settings{'NEW_IGNORE_ENTRY'}))) {
	118	$errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
	119	}
	120	} else {
	121	$errormessage = "$Lang::tr{'guardian empty input'}";
	122	}
	123
	124	# Go further if there was no error.
125	if ($errormessage eq '') {
126	my $new_entry = $settings{'NEW_IGNORE_ENTRY'};
127
128	# Open file for appending the new entry.
129	open (FILE, ">>$ignorefile") or die "Unable to open $ignorefile for writing";
130
131	# Write the new entry to the ignore file.
132	print FILE "$new_entry\n";
133	close(FILE);
134	}
135
136	## Remove entry from ignore list.
137	#
138	} elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
139	my $id = 0;
140
141	# Open ignorefile and read content.
142	open(FILE, "<$ignorefile") or die "Unable to open $ignorefile.";
143	my @current = <FILE>;
144	close(FILE);
145
146	# Re-open ignorefile for writing.
147	open(FILE, ">$ignorefile") or die "Unable to open $ignorefile for writing";
148	flock FILE, 2;
149
150	# Read line by line from ignorefile and write them back except the line with the given ID.
151	# So this line is missing in the new file and the entry has been deleted.
152	foreach my $line (@current) {
153	$id++;
154	unless ($cgiparams{'ID'} eq $id) {
155	print FILE "$line";
156	}
157	}
158	close(FILE);
159
160	## Block a user given address or subnet.
161	#
162	} elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
163
164	# Check if no empty input has been performed.
165	if ($settings{'ADDRESS_BLOCK'} ne '') {
166
167	# Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
168	if ((!&General::validip($settings{'ADDRESS_BLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_BLOCK'}))) {
169	$errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
170	}
171
172	} else {
173	$errormessage = "$Lang::tr{'guardian empty input'}";
174	}
175
176	# Go further if there was no error.
177	if ($errormessage eq '') {
178	my $block = $settings{'ADDRESS_BLOCK'};
179
180	# Call helper to unblock address.
181	system("/usr/local/bin/guardianctrl block $block &>/dev/null");
182	}
183
184	## Unblock address or subnet.
185	#
186	} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
187
188	# Check if no empty input has been performed.
189	if ($settings{'ADDRESS_UNBLOCK'} ne '') {
190
191	# Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
192	if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
193	$errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
194	}
195
196	} else {
197	$errormessage = "$Lang::tr{'guardian empty input'}";
198	}
199
200	# Go further if there was no error.
201	if ($errormessage eq '') {
202	my $unblock = $settings{'ADDRESS_UNBLOCK'};
203
204	# Call helper to unblock address.
205	system("/usr/local/bin/guardianctrl unblock $unblock &>/dev/null");
206	}
207
208	## Unblock all.
209	#
210	} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
211
212	# Call helper to flush iptables chain from guardian.
213	system("/usr/local/bin/guardianctrl flush-chain &>/dev/null");
214
215	} else {
216	# Load settings from file.
217	&General::readhash("${General::swroot}/guardian/settings", \%settings);
218	}
219
220
221	# Call functions to generate whole page.
222	&showMainBox();
223	&showIgnoreBox();
224
225	# Display area only if guardian is running.
226	if ( ($memory != 0) && (@pid[0] ne "///") ) {
227	&showBlockedBox();
228	}
229
230	# Function to display the status of guardian and allow base configuration.
231	sub showMainBox() {
232	my %checked = ();
233
234	$checked{'GUARDIAN_ENABLED'}{'on'} = '';
235	$checked{'GUARDIAN_ENABLED'}{'off'} = '';
236	$checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
237
01dbccb1 SS	238	&Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
	239	&Header::openbigbox('100%', 'left', '', $errormessage);
	240
	241	# Print errormessage if there is one.
	242	if ($errormessage) {
	243	&Header::openbox('100%', 'left', $Lang::tr{'error messages'});
	244	print "<font class='base'>$errormessage </font>\n";
	245	&Header::closebox();
	246	}
	247
	248
	249	# Draw current guardian state.
	250	&Header::openbox('100%', 'center', $Lang::tr{'guardian'});
	251
	252	# Check if guardian is running and grab some stats.
	253	&daemonstats();
	254
	255	# Display some useful information related to guardian, if daemon is running.
	256	if ( ($memory != 0) && (@pid[0] ne "///") ){
	257	print <<END;
	258	<table width='95%' cellspacing='0' class='tbl'>
	259	<tr>
	260	<th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
	261	</tr>
	262	<tr>
	263	<td class='base'>$Lang::tr{'guardian daemon'}</td>
	264	<td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
	265	</tr>
	266	<tr>
	267	<td class='base'></td>
	268	<td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
	269	<td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
	270	</tr>
	271	<tr>
	272	<td class='base'></td>
	273	<td bgcolor='$color{'color22'}' align='center'>@pid[0]</td>
	274	<td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
	275	</tr>
	276	</table>
	277	END
	278	} else {
	279	# Otherwise display a hint that the service is not launched.
	280	print <<END;
	281	<table width='95%' cellspacing='0' class='tbl'>
	282	<tr>
	283	<th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
	284	</tr>
	285	<tr>
	286	<td class='base'>$Lang::tr{'guardian daemon'}</td>
	287	<td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
	288	</tr>
	289	</table>
	290	END
	291	}
	292
	293	&Header::closebox();
	294
	295	# Draw elements for guardian configuration.
	296	&Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
	297
	298	print <<END;
	299	<form method='post' action='$ENV{'SCRIPT_NAME'}'>
	300
	301	<table width='95%'>
302	<tr>
d2fea55e	303	<td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
01dbccb1 SS	304	</tr>
	305	<tr>
	306	<td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
d2fea55e	307	<td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
01dbccb1 SS	308	</tr>
	309	<tr>
	310	<td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
d2fea55e	311	<td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
01dbccb1 SS	312	</tr>
	313	<tr>
	314	<td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
d2fea55e	315	<td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
01dbccb1 SS	316	</tr>
	317	<tr>
	318	<td width='20%' class='base'>$Lang::tr{'guardian snort alertfile'}:</td>
d2fea55e	319	<td><input type='text' name='GUARDIAN_SNORT_ALERTFILE' value='$settings{'GUARDIAN_SNORT_ALERTFILE'}' size='30' /></td>
01dbccb1 SS	320	</tr>
	321	</table>
	322	END
	323
	324	print <<END;
	325	<hr>
	326
	327	<table width='95%'>
	328	<tr>
	329	<td> </td>
	330	<td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
	331	<td> </td>
	332	</tr>
	333	</table>
	334	</form>
	335	END
	336
	337	&Header::closebox();
	338	}
	339
	340	# Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
	341	sub showIgnoreBox() {
	342	&Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
	343
	344	print <<END;
	345	<table width='60%'>
	346	<tr>
	347	<td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian ignored hosts'}</b></td>
	348	</tr>
	349	END
	350	# Check if the guardian ignore file contains any content.
	351	if (-s $ignorefile) {
	352
	353	# Open file and print contents.
	354	open FILE, $ignorefile or die "Could not open $ignorefile";
	355
	356	my $id = 0;
	357	my $col = "";
	358
	359	# Read file line by line and print out the elements.
	360	while( my $ignored_element = <FILE> ) {
	361
	362	# Increase id number for each element in the ignore file.
	363	$id++;
	364
	365	# Check if the id number is even or not.
	366	if ($id % 2) {
	367	$col="bgcolor='$color{'color22'}'";
	368	} else {
	369	$col="bgcolor='$color{'color20'}'";
	370	}
	371
	372	print <<END;
	373	<tr>
	374	<td width='80%' class='base' $col>$ignored_element</td>
	375	<td width='20%' align='center' $col>
	376	<form method='post' name='frma$id' action='$ENV{'SCRIPT_NAME'}'>
	377	<input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
	378	<input type='hidden' name='ID' value='$id'>
	379	<input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
	380	</form>
	381	</td>
	382	</tr>
	383	END
384	}
385	close (FILE);
386	} else {
387	# Print notice that currently no elements are stored in the ignore file.
388	print "<tr>\n";
389	print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
390	print "</tr>\n";
391	}
392
393	print "</table>\n";
394
01dbccb1 SS	395	# Section to add new elements to the ignore list.
01dbccb1 SS	396	print <<END;
1d5702a7 SS	397	<br>
1d5702a7 SS	398	<div align='center'>
01dbccb1 SS	399	<table width='60%'>
	400	<form method='post' action='$ENV{'SCRIPT_NAME'}'>
	401	<tr>
	402	<td width='30%'>$Lang::tr{'dnsforward add a new entry'}: </td>
	403	<td width='50%'><input type='text' name='NEW_IGNORE_ENTRY' value='' size='24' /></td>
	404	<td align='center' width='20%'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
	405	</tr>
	406	</form>
	407	</table>
	408	</div>
	409	END
1d5702a7 SS	410
1d5702a7 SS	411	&Header::closebox();
01dbccb1 SS	412	}
	413
	414	# Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
	415	sub showBlockedBox() {
	416	&Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
	417
01dbccb1 SS	418	print <<END;
	419	<table width='60%'>
	420	<tr>
	421	<td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
	422	</tr>
	423	END
	424
5f462919 SS	425	# Lauch function to get the currently blocked hosts.
	426	my @blocked_hosts = &GetBlockedHosts();
	427
01dbccb1	428	my $id = 0;
01dbccb1	429	my $col = "";
01dbccb1	430
5f462919 SS	431	# Loop through our blocked hosts array.
5f462919 SS	432	foreach my $blocked_host (@blocked_hosts) {
01dbccb1 SS	433
	434	# Increase id number for each element in the ignore file.
	435	$id++;
	436
	437	# Check if the id number is even or not.
	438	if ($id % 2) {
	439	$col="bgcolor='$color{'color22'}'";
	440	} else {
	441	$col="bgcolor='$color{'color20'}'";
	442	}
	443
	444	print <<END;
	445	<tr>
8b8413e5	446	<td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
01dbccb1 SS	447	<td width='20%' align='center' $col>
	448	<form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
	449	<input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
	450	<input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
	451	<input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
	452	</form>
	453	</td>
	454	</tr>
	455	END
	456	}
	457
01dbccb1 SS	458	# If the loop only has been runs once the id still is "0", which means there are no
	459	# additional entries (blocked hosts) in the iptables chain.
	460	if ($id == 0) {
	461
	462	# Print notice that currently no hosts are blocked.
	463	print "<tr>\n";
	464	print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
	465	print "</tr>\n";
	466	}
	467
	468	print "</table>\n";
	469
01dbccb1 SS	470	# Section for a manual block of an IP-address.
01dbccb1 SS	471	print <<END;
1d5702a7 SS	472	<br>
	473	<div align='center'>
	474	<table width='60%' border='0'>
01dbccb1 SS	475	<form method='post' action='$ENV{'SCRIPT_NAME'}'>
	476	<tr>
	477	<td width='30%'>$Lang::tr{'guardian block a host'}: </td>
	478	<td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
	479	<td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
	480	<td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
	481	</tr>
	482	</form>
	483	</table>
	484	</div>
	485	END
1d5702a7 SS	486
1d5702a7 SS	487	&Header::closebox();
01dbccb1 SS	488	}
	489
	490	&Header::closebigbox();
	491	&Header::closepage();
	492
	493	# Function to check if guardian has been started.
	494	# Grab process id and consumed memory if the daemon is running.
	495	sub daemonstats() {
	496	$memory = 0;
	497	# for pid and memory
	498	open(FILE, '/usr/local/bin/addonctrl guardian status \| ');
	499	@guardian = <FILE>;
	500	close(FILE);
	501	$string = join("", @guardian);
	502	$string =~ s/[a-z_]//gi;
	503	$string =~ s/\[[0-1]\;[0-9]+//gi;
	504	$string =~ s/[\(\)\.]//gi;
	505	$string =~ s/ //gi;
	506	$string =~ s/\e//gi;
	507	@pid = split(/\s/,$string);
	508	if (open(FILE, "/proc/$pid[0]/statm")){
	509	my $temp = <FILE>;
	510	@memory = split(/ /,$temp);
	511	close(FILE);
	512	}
	513	$memory+=$memory[0];
	514	}
	515
5f462919 SS	516	sub GetBlockedHosts() {
	517
	518	# Create new, empty array.
	519	my @hosts;
	520
	521	# Lauch helper to get chains from iptables.
	522	open(FILE, "/usr/local/bin/guardianctrl get-chain \|");
	523
	524	# Read file line by line and print out the elements.
	525	foreach my $line (<FILE>) {
	526
	527	# Skip descriptive lines.
	528	next if ($line =~ /^Chain/);
	529	next if ($line =~ /^ pkts/);
	530
	531	# Generate array, based on the line content (seperator is a single or multiple space's)
	532	my @comps = split(/\s{1,}/, $line);
	533	my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
	534
	535	# Assign different variable names.
	536	my $blocked_host = $source;
	537
	538	# Add host to our hosts array.
	539	push(@hosts, $blocked_host);
	540	}
	541
	542	# Convert entries, sort them, write back and store the sorted entries into new array.
	543	my @sorted = map { $_->[0] }
	544	sort { $a->[1] <=> $b->[1] }
	545	map { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
	546	@hosts;
	547
	548	# Return our sorted list.
	549	return @sorted
	550	}
	551
01dbccb1 SS	552	sub BuildConfiguration() {
	553	my %settings = ();
	554	&General::readhash("${General::swroot}/guardian/settings", \%settings);
	555
	556	my $configfile = "${General::swroot}/guardian/guardian.conf";
	557
7f728591 SS	558	# We set this to 1 (enabled) to prevent guardian from blocking the ISP gateway.
	559	my $HostGatewayByte = "1";
	560
	561	# Grab interface of red network zone.
	562	my $red_interface = &General::get_red_interface();
	563
	564	# Open configfile for writing.
01dbccb1 SS	565	open(FILE, ">$configfile");
01dbccb1 SS	566
7f728591	567	print FILE "Interface $red_interface\n";
7f728591	568	print FILE "HostGatewayByte $HostGatewayByte\n";
01dbccb1 SS	569	print FILE "LogFile $settings{'GUARDIAN_LOGFILE'}\n";
	570	print FILE "AlertFile $settings{'GUARDIAN_SNORT_ALERTFILE'}\n";
	571	print FILE "IgnoreFile $ignorefile\n";
	572	print FILE "TargetFile $targetfile\n";
	573	print FILE "TimeLimit $settings{'GUARDIAN_BLOCKTIME'}\n";
	574
	575	close(FILE);
	576
	577	# Restart the service.
	578	if ($settings{'GUARDIAN_ENABLED'} eq 'on') {
	579	system("/usr/local/bin/guardianctrl restart &>/dev/null");
	580	} else {
	581	system("/usr/local/bin/guardianctrl stop &>/dev/null");
	582	}
	583	}