]>
git.ipfire.org Git - ipfire-2.x.git/blob - html/cgi-bin/connections.cgi
973a7d2ef8610415614fb28331d2cdc7d479fcac
2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2012 IPFire Team <info@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
24 use Net
::IPv4Addr
qw( :all );
27 # enable only the following on debugging purpose
29 #use CGI::Carp 'fatalsToBrowser';
31 require '/var/ipfire/general-functions.pl';
32 require "${General::swroot}/lang.pl";
33 require "${General::swroot}/header.pl";
35 my $colour_multicast = "#A0A0A0";
37 &Header
::showhttpheaders
();
44 &General
::readhash
("${General::swroot}/ethernet/settings", \
%netsettings);
46 #workaround to suppress a warning when a variable is used only once
47 my @dummy = ( ${Header
::table1colour
} );
50 # Read the connection tracking table.
51 open(CONNTRACK
, "/usr/local/bin/getconntracktable | sort -k 5,5 --numeric-sort --reverse |") or die "Unable to read conntrack table";
52 my @conntrack = <CONNTRACK
>;
55 # Collect data for the @network array.
57 # Add Firewall Localhost 127.0.0.1
58 push(@network, '127.0.0.1');
59 push(@masklen, '255.255.255.255');
60 push(@colour, ${Header
::colourfw
});
62 if (open(IP
, "${General::swroot}/red/local-ipaddress")) {
67 push(@network, $redip);
68 push(@masklen, '255.255.255.255');
69 push(@colour, ${Header
::colourfw
});
72 # Add STATIC RED aliases
73 if ($netsettings{'RED_DEV'}) {
74 my $aliasfile = "${General::swroot}/ethernet/aliases";
75 open(ALIASES
, $aliasfile) or die 'Unable to open aliases file.';
76 my @aliases = <ALIASES
>;
79 # We have a RED eth iface
80 if ($netsettings{'RED_TYPE'} eq 'STATIC') {
81 # We have a STATIC RED eth iface
82 foreach my $line (@aliases) {
84 my @temp = split(/\,/,$line);
86 push(@network, $temp[0]);
87 push(@masklen, $netsettings{'RED_NETMASK'} );
88 push(@colour, ${Header
::colourfw
} );
94 # Add Green Firewall Interface
95 push(@network, $netsettings{'GREEN_ADDRESS'});
96 push(@masklen, "255.255.255.255" );
97 push(@colour, ${Header
::colourfw
} );
99 # Add Green Network to Array
100 push(@network, $netsettings{'GREEN_NETADDRESS'});
101 push(@masklen, $netsettings{'GREEN_NETMASK'} );
102 push(@colour, ${Header
::colourgreen
} );
104 # Add Green Routes to Array
105 my @routes = `/sbin/route -n | /bin/grep $netsettings{'GREEN_DEV'}`;
106 foreach my $route (@routes) {
108 my @temp = split(/[\t ]+/, $route);
109 push(@network, $temp[0]);
110 push(@masklen, $temp[2]);
111 push(@colour, ${Header
::colourgreen
} );
114 # Add Blue Firewall Interface
115 push(@network, $netsettings{'BLUE_ADDRESS'});
116 push(@masklen, "255.255.255.255" );
117 push(@colour, ${Header
::colourfw
} );
120 if ($netsettings{'BLUE_DEV'}) {
121 push(@network, $netsettings{'BLUE_NETADDRESS'});
122 push(@masklen, $netsettings{'BLUE_NETMASK'} );
123 push(@colour, ${Header
::colourblue
} );
125 # Add Blue Routes to Array
126 @routes = `/sbin/route -n | /bin/grep $netsettings{'BLUE_DEV'}`;
127 foreach my $route (@routes) {
129 my @temp = split(/[\t ]+/, $route);
130 push(@network, $temp[0]);
131 push(@masklen, $temp[2]);
132 push(@colour, ${Header
::colourblue
} );
136 # Add Orange Firewall Interface
137 push(@network, $netsettings{'ORANGE_ADDRESS'});
138 push(@masklen, "255.255.255.255" );
139 push(@colour, ${Header
::colourfw
} );
142 if ($netsettings{'ORANGE_DEV'}) {
143 push(@network, $netsettings{'ORANGE_NETADDRESS'});
144 push(@masklen, $netsettings{'ORANGE_NETMASK'} );
145 push(@colour, ${Header
::colourorange
} );
146 # Add Orange Routes to Array
147 @routes = `/sbin/route -n | /bin/grep $netsettings{'ORANGE_DEV'}`;
148 foreach my $route (@routes) {
150 my @temp = split(/[\t ]+/, $route);
151 push(@network, $temp[0]);
152 push(@masklen, $temp[2]);
153 push(@colour, ${Header
::colourorange
} );
157 # Highlight multicast connections.
158 push(@network, "224.0.0.0");
159 push(@masklen, "239.0.0.0");
160 push(@colour, $colour_multicast);
162 # Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate)
163 if (-e
"${General::swroot}/ovpn/settings") {
164 my %ovpnsettings = ();
165 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
166 my @tempovpnsubnet = split("\/",$ovpnsettings{'DOVPN_SUBNET'});
169 push(@network, $tempovpnsubnet[0]);
170 push(@masklen, $tempovpnsubnet[1]);
171 push(@colour, ${Header
::colourovpn
} );
173 # add BLUE:port / proto
174 if (($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'}) {
175 push(@network, $netsettings{'BLUE_ADDRESS'} );
176 push(@masklen, '255.255.255.255' );
177 push(@colour, ${Header
::colourovpn
});
180 # add ORANGE:port / proto
181 if (($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'}) {
182 push(@network, $netsettings{'ORANGE_ADDRESS'} );
183 push(@masklen, '255.255.255.255' );
184 push(@colour, ${Header
::colourovpn
} );
188 open(IPSEC
, "${General::swroot}/vpn/config");
192 foreach my $line (@ipsec) {
193 my @vpn = split(',', $line);
194 my ($network, $mask) = split("/", $vpn[12]);
196 if (!&General
::validip
($mask)) {
197 $mask = ipv4_cidr2msk
($mask);
200 push(@network, $network);
201 push(@masklen, $mask);
202 push(@colour, ${Header
::colourvpn
});
205 if (-e
"${General::swroot}/ovpn/n2nconf") {
206 open(OVPNN2N
, "${General::swroot}/ovpn/ovpnconfig");
207 my @ovpnn2n = <OVPNN2N
>;
210 foreach my $line (@ovpnn2n) {
211 my @ovpn = split(',', $line);
212 next if ($ovpn[4] ne 'net');
214 my ($network, $mask) = split("/", $ovpn[12]);
215 if (!&General
::validip
($mask)) {
216 $mask = ipv4_cidr2msk
($mask);
219 push(@network, $network);
220 push(@masklen, $mask);
221 push(@colour, ${Header
::colourovpn
});
226 &Header
::openpage
($Lang::tr
{'connections'}, 1, '');
227 &Header
::openbigbox
('100%', 'left');
228 &Header
::openbox
('100%', 'left', $Lang::tr
{'connection tracking'});
235 <b>$Lang::tr{'legend'} : </b>
237 <td align='center' bgcolor='${Header::colourgreen}'>
238 <b><font color='#FFFFFF'>$Lang::tr{'lan'}</font></b>
240 <td align='center' bgcolor='${Header::colourred}'>
241 <b><font color='#FFFFFF'>$Lang::tr{'internet'}</font></b>
243 <td align='center' bgcolor='${Header::colourorange}'>
244 <b><font color='#FFFFFF'>$Lang::tr{'dmz'}</font></b>
246 <td align='center' bgcolor='${Header::colourblue}'>
247 <b><font color='#FFFFFF'>$Lang::tr{'wireless'}</font></b>
249 <td align='center' bgcolor='${Header::colourfw}'>
250 <b><font color='#FFFFFF'>IPFire</font></b>
252 <td align='center' bgcolor='${Header::colourvpn}'>
253 <b><font color='#FFFFFF'>$Lang::tr{'vpn'}</font></b>
255 <td align='center' bgcolor='${Header::colourovpn}'>
256 <b><font color='#FFFFFF'>$Lang::tr{'OpenVPN'}</font></b>
258 <td align='center' bgcolor='$colour_multicast'>
259 <b><font color='#FFFFFF'>Multicast</font></b>
266 # Print table header.
271 $Lang::tr{'protocol'}
274 $Lang::tr{'source ip and port'}
278 $Lang::tr{'dest ip and port'}
282 $Lang::tr{'download'} /
283 <br>$Lang::tr{'upload'}
286 $Lang::tr{'connection'}<br>$Lang::tr{'status'}
289 $Lang::tr{'expires'}<br>($Lang::tr{'seconds'})
294 foreach my $line (@conntrack) {
295 my @conn = split(' ', $line);
297 # The first bit is the l3 protocol.
298 my $l3proto = $conn[0];
300 # Skip everything that is not IPv4.
301 if ($l3proto ne 'ipv4') {
305 # L4 protocol (tcp, udp, ...).
306 my $l4proto = $conn[2];
308 # Translate unknown protocols.
309 if ($l4proto eq 'unknown') {
310 my $l4protonum = $conn[3];
311 if ($l4protonum eq '2') {
313 } elsif ($l4protonum eq '4') {
314 $l4proto = 'IPv4 Encap';
315 } elsif ($l4protonum eq '33') {
317 } elsif ($l4protonum eq '41') {
318 $l4proto = 'IPv6 Encap';
319 } elsif ($l4protonum eq '50') {
321 } elsif ($l4protonum eq '51') {
323 } elsif ($l4protonum eq '132') {
326 $l4proto = $l4protonum;
329 $l4proto = uc($l4proto);
332 # Source and destination.
342 if ($l4proto eq 'TCP') {
346 # Kick out everything that is not IPv4.
347 foreach my $item (@conn) {
348 my ($key, $val) = split('=', $item);
364 push(@packets, $val);
372 my $sip_colour = ipcolour
($sip);
373 my $dip_colour = ipcolour
($dip);
377 $sserv = uc(getservbyport($sport, lc($l4proto)));
379 $sserv = " ($sserv)";
385 $dserv = uc(getservbyport($dport, lc($l4proto)));
387 $dserv = " ($dserv)";
391 my $bytes_in = format_bytes
($bytes[0]);
392 my $bytes_out = format_bytes
($bytes[1]);
395 $ttl = format_time
($ttl);
399 <td align='center'>$l4proto</td>
400 <td align='center' bgcolor='$sip_colour'>
401 <a href='/cgi-bin/ipinfo.cgi?ip=$sip'>
402 <font color='#FFFFFF'>$sip</font>
405 <td align='center' bgcolor='$sip_colour'>
406 <a href='http://isc.sans.org/port_details.php?port=$sport' target='top'>
407 <font color='#FFFFFF'>$sport$sserv</font>
410 <td align='center' bgcolor='$dip_colour'>
411 <a href='/cgi-bin/ipinfo.cgi?ip=$dip'>
412 <font color='#FFFFFF'>$dip</font>
415 <td align='center' bgcolor='$dip_colour'>
416 <a href='http://isc.sans.org/port_details.php?port=$dport' target='top'>
417 <font color='#FFFFFF'>$dport$dserv</font>
421 $bytes_in / $bytes_out
423 <td align='center'>$state</td>
424 <td align='center'>$ttl</td>
429 # Close the main table.
433 &Header
::closebigbox
();
434 &Header
::closepage
();
436 sub format_bytes
($) {
438 my @units = ("B", "k", "M", "G", "T");
440 foreach my $unit (@units) {
442 return sprintf("%d%s", $bytes, $unit);
448 return sprintf("%d%s", $bytes, $units[$#units]);
454 my $seconds = $time % 60;
455 my $minutes = $time / 60;
458 if ($minutes >= 60) {
459 $hours = $minutes / 60;
463 return sprintf("%3d:%02d:%02d", $hours, $minutes, $seconds);
468 my $colour = ${Header
::colourred
};
472 foreach my $line (@network) {
473 if ($network[$id] eq '') {
476 if (!$found && ipv4_in_network
($network[$id], $masklen[$id], $ip) ) {
478 $colour = $colour[$id];