]>
git.ipfire.org Git - ipfire-2.x.git/blob - html/cgi-bin/connections.cgi
3 # (c) 2001 Jack Beglinger <jackb_guppy@yahoo.com>
5 # (c) 2003 Dave Roberts <countzerouk@hotmail.com> - colour coded netfilter/iptables rewrite for 1.3
7 # (c) 2006 Franck - add sorting+filtering capability
9 # $Id: connections.cgi,v 1.6.2.12 2006/02/27 19:48:46 franck78 Exp $
12 # Setup GREEN, ORANGE, IPCOP, VPN CIDR networks, masklengths and colours only once
18 use Net
::IPv4Addr
qw( :all );
22 # enable only the following on debugging purpose
24 #use CGI::Carp 'fatalsToBrowser';
26 require 'CONFIG_ROOT/general-functions.pl';
27 require "${General::swroot}/lang.pl";
28 require "${General::swroot}/header.pl";
30 #workaround to suppress a warning when a variable is used only once
31 my @dummy = ( ${Header
::table1colour
} );
37 &General
::readhash
("${General::swroot}/ethernet/settings", \
%netsettings);
39 open (ACTIVE
, "/proc/net/ip_conntrack") or die 'Unable to open ip_conntrack';
40 my @active = <ACTIVE
>;
44 open (ACTIVE
, "/proc/net/ipsec_eroute") and @vpn = <ACTIVE
>;
47 my $aliasfile = "${General::swroot}/ethernet/aliases";
48 open(ALIASES
, $aliasfile) or die 'Unable to open aliases file.';
49 my @aliases = <ALIASES
>;
52 # Add Green Firewall Interface
53 push(@network, $netsettings{'GREEN_ADDRESS'});
54 push(@masklen, "255.255.255.255" );
55 push(@colour, ${Header
::colourfw
} );
57 # Add Green Network to Array
58 push(@network, $netsettings{'GREEN_NETADDRESS'});
59 push(@masklen, $netsettings{'GREEN_NETMASK'} );
60 push(@colour, ${Header
::colourgreen
} );
62 # Add Green Routes to Array
63 my @routes = `/sbin/route -n | /bin/grep $netsettings{'GREEN_DEV'}`;
64 foreach my $route (@routes) {
66 my @temp = split(/[\t ]+/, $route);
67 push(@network, $temp[0]);
68 push(@masklen, $temp[2]);
69 push(@colour, ${Header
::colourgreen
} );
72 # Add Firewall Localhost 127.0.0.1
73 push(@network, '127.0.0.1');
74 push(@masklen, '255.255.255.255' );
75 push(@colour, ${Header
::colourfw
} );
77 # Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate)
78 if (-e
"${General::swroot}/ovpn/settings") {
79 my %ovpnsettings = ();
80 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
81 my @tempovpnsubnet = split("\/",$ovpnsettings{'DOVPN_SUBNET'});
84 push(@network, $tempovpnsubnet[0]);
85 push(@masklen, $tempovpnsubnet[1]);
86 push(@colour, ${Header
::colourovpn
} );
88 if ( ($ovpnsettings{'ENABLED'} eq 'on') && open(IP
, "${General::swroot}/red/local-ipaddress") ) {
89 # add RED:port / proto
93 push(@network, $redip );
94 push(@masklen, '255.255.255.255' );
95 push(@colour, ${Header
::colourovpn
} );
97 if ( ($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'} ) {
98 # add BLUE:port / proto
99 push(@network, $netsettings{'BLUE_ADDRESS'} );
100 push(@masklen, '255.255.255.255' );
101 push(@colour, ${Header
::colourovpn
} );
103 if ( ($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'} ) {
104 # add ORANGE:port / proto
105 push(@network, $netsettings{'ORANGE_ADDRESS'} );
106 push(@masklen, '255.255.255.255' );
107 push(@colour, ${Header
::colourovpn
} );
112 if ($netsettings{'ORANGE_DEV'}) {
113 push(@network, $netsettings{'ORANGE_NETADDRESS'});
114 push(@masklen, $netsettings{'ORANGE_NETMASK'} );
115 push(@colour, ${Header
::colourorange
} );
116 # Add Orange Routes to Array
117 @routes = `/sbin/route -n | /bin/grep $netsettings{'ORANGE_DEV'}`;
118 foreach my $route (@routes) {
120 my @temp = split(/[\t ]+/, $route);
121 push(@network, $temp[0]);
122 push(@masklen, $temp[2]);
123 push(@colour, ${Header
::colourorange
} );
128 if ($netsettings{'BLUE_DEV'}) {
129 push(@network, $netsettings{'BLUE_NETADDRESS'});
130 push(@masklen, $netsettings{'BLUE_NETMASK'} );
131 push(@colour, ${Header
::colourblue
} );
132 # Add Blue Routes to Array
133 @routes = `/sbin/route -n | /bin/grep $netsettings{'BLUE_DEV'}`;
134 foreach my $route (@routes) {
136 my @temp = split(/[\t ]+/, $route);
137 push(@network, $temp[0]);
138 push(@masklen, $temp[2]);
139 push(@colour, ${Header
::colourblue
} );
143 # Add STATIC RED aliases
144 if ($netsettings{'RED_DEV'}) {
145 # We have a RED eth iface
146 if ($netsettings{'RED_TYPE'} eq 'STATIC') {
147 # We have a STATIC RED eth iface
148 foreach my $line (@aliases)
151 my @temp = split(/\,/,$line);
153 push(@network, $temp[0]);
154 push(@masklen, $netsettings{'RED_NETMASK'} );
155 push(@colour, ${Header
::colourfw
} );
162 if ( $vpn[0] ne 'none' ) {
163 foreach my $line (@vpn) {
164 my @temp = split(/[\t ]+/,$line);
165 my @temp1 = split(/[\/:]+/,$temp[3]);
166 push(@network, $temp1[0]);
167 push(@masklen, ipv4_cidr2msk
($temp1[1]));
168 push(@colour, ${Header
::colourvpn
} );
171 if (open(IP
, "${General::swroot}/red/local-ipaddress")) {
175 push(@network, $redip);
176 push(@masklen, '255.255.255.255' );
177 push(@colour, ${Header
::colourfw
} );
181 #Establish simple filtering&sorting boxes on top of table
184 &Header
::getcgihash
(\
%cgiparams);
186 my @list_proto = ($Lang::tr
{'all'}, 'icmp', 'udp', 'tcp');
187 my @list_state = ($Lang::tr
{'all'}, 'SYN_SENT', 'SYN_RECV', 'ESTABLISHED', 'FIN_WAIT',
188 'CLOSE_WAIT', 'LAST_ACK', 'TIME_WAIT', 'CLOSE', 'LISTEN');
189 my @list_mark = ($Lang::tr
{'all'}, '[ASSURED]', '[UNREPLIED]');
190 my @list_sort = ('orgsip','protocol', 'expires', 'status', 'orgdip', 'orgsp',
191 'orgdp', 'exsip', 'exdip', 'exsp', 'exdp');
193 # init or silently correct unknown value...
194 if ( ! grep ( /^$cgiparams{'SEE_PROTO'}$/ , @list_proto )) { $cgiparams{'SEE_PROTO'} = $list_proto[0] };
195 if ( ! grep ( /^$cgiparams{'SEE_STATE'}$/ , @list_state )) { $cgiparams{'SEE_STATE'} = $list_state[0] };
196 if ( ! grep ( /^$cgiparams{'SEE_MARK'}$/ , @list_mark )) { $cgiparams{'SEE_MARK'} = $list_mark[0] };
197 if ( ! grep ( /^$cgiparams{'SEE_SORT'}$/ , @list_sort )) { $cgiparams{'SEE_SORT'} = $list_sort[0] };
198 # *.*.*.* or a valid IP
199 if ( $cgiparams{'SEE_SRC'} !~ /^(\*\.\*\.\*\.\*\.|\d+\.\d+\.\d+\.\d+)$/) { $cgiparams{'SEE_SRC'} = '*.*.*.*' };
200 if ( $cgiparams{'SEE_DEST'} !~ /^(\*\.\*\.\*\.\*\.|\d+\.\d+\.\d+\.\d+)$/) { $cgiparams{'SEE_DEST'} = '*.*.*.*' };
203 our %entries = (); # will hold the lines analyzed correctly
204 my $unknownlines = ''; # should be empty all the time...
205 my $index = 0; # just a counter to make unique entryies in entries
207 foreach my $line (@active) {
223 my @temp = split(' ',$line);
225 if ($temp[0] eq 'icmp') {
226 $protocol = $temp[0];
227 $status = $Lang::tr
{'all'};
228 $orgsip = substr $temp[3], 4;
229 $orgdip = substr $temp[4], 4;
230 $marked = $temp[8] eq '[UNREPLIED]' ?
'[UNREPLIED]' : ' ';
232 if ($temp[0] eq 'udp') {
233 $protocol = $temp[0];
234 $status = $Lang::tr
{'all'};
235 $orgsip = substr $temp[3], 4;
236 $orgdip = substr $temp[4], 4;
237 $marked = $temp[7] eq '[UNREPLIED]' ?
'[UNREPLIED]' : defined ($temp[12]) ?
$temp[11] : ' ';
239 if ($temp[0] eq 'tcp') {
240 $protocol = $temp[0];
242 $orgsip = substr $temp[4], 4;
243 $orgdip = substr $temp[5], 4;
244 $marked = $temp[8] eq '[UNREPLIED]' ?
'[UNREPLIED]' : defined ($temp[13]) ?
$temp[12] : ' ';
247 # filter the line if we found a known proto
249 (($cgiparams{'SEE_PROTO'} eq $Lang::tr
{'all'}) || ($protocol eq $cgiparams{'SEE_PROTO'} ))
250 && (($cgiparams{'SEE_STATE'} eq $Lang::tr
{'all'}) || ($status eq $cgiparams{'SEE_STATE'} ))
251 && (($cgiparams{'SEE_MARK'} eq $Lang::tr
{'all'}) || ($marked eq $cgiparams{'SEE_MARK'} ))
252 && (($cgiparams{'SEE_SRC'} eq "*.*.*.*") || ($orgsip eq $cgiparams{'SEE_SRC'} ))
253 && (($cgiparams{'SEE_DEST'} eq "*.*.*.*") || ($orgdip eq $cgiparams{'SEE_DEST'} ))
256 if ($temp[0] eq 'icmp') {
258 $protocol = $temp[0] . " (" . $temp[1] . ")";
261 if ($temp[8] eq '[UNREPLIED]' ) {
264 $orgsip = substr $temp[3], 4;
265 $orgdip = substr $temp[4], 4;
266 $orgsp = &General
::GetIcmpDescription
(substr( $temp[5], 5)) . "/" . substr( $temp[6], 5);;
267 $orgdp = 'id=' . substr( $temp[7], 3);
268 $exsip = substr $temp[8 + $offset], 4;
269 $exdip = substr $temp[9 + $offset], 4;
270 $exsp = &General
::GetIcmpDescription
(substr( $temp[10 + $offset], 5)). "/" . substr( $temp[11 + $offset], 5);
271 $exdp = 'id=' . substr( $temp[11 + $offset], 5);
272 $marked = $temp[8] eq '[UNREPLIED]' ?
'[UNREPLIED]' : ' ';
273 $use = substr( $temp[13 + $offset], 4 );
275 if ($temp[0] eq 'udp') {
278 $protocol = $temp[0] . " (" . $temp[1] . ")";
281 $orgsip = substr $temp[3], 4;
282 $orgdip = substr $temp[4], 4;
283 $orgsp = substr $temp[5], 6;
284 $orgdp = substr $temp[6], 6;
285 if ($temp[7] eq '[UNREPLIED]') {
288 $use = substr $temp[12], 4;
290 if ((substr $temp[11], 0, 3) eq 'use' ) {
292 $use = substr $temp[11], 4;
295 $use = substr $temp[12], 4;
298 $exsip = substr $temp[7 + $offset], 4;
299 $exdip = substr $temp[8 + $offset], 4;
300 $exsp = substr $temp[9 + $offset], 6;
301 $exdp = substr $temp[10 + $offset], 6;
303 if ($temp[0] eq 'tcp') {
305 $protocol = $temp[0] . " (" . $temp[1] . ")";
308 $orgsip = substr $temp[4], 4;
309 $orgdip = substr $temp[5], 4;
310 $orgsp = substr $temp[6], 6;
311 $orgdp = substr $temp[7], 6;
312 if ($temp[8] eq '[UNREPLIED]') {
318 $exsip = substr $temp[8 + $offset], 4;
319 $exdip = substr $temp[9 + $offset], 4;
320 $exsp = substr $temp[10 + $offset], 6;
321 $exdp = substr $temp[11 + $offset], 6;
322 $use = substr $temp[13], 4;
324 if ($temp[0] eq 'unknown') {
326 $protocol = "??? (" . $temp[1] . ")";
327 $protocol = "esp (" . $temp[1] . ")" if ($temp[1] == 50);
328 $protocol = "ah (" . $temp[1] . ")" if ($temp[1] == 51);
331 $orgsip = substr $temp[3], 4;
332 $orgdip = substr $temp[4], 4;
335 $exsip = substr $temp[5], 4;
336 $exdip = substr $temp[6], 4;
342 if ($temp[0] eq 'gre') {
344 $protocol = $temp[0] . " (" . $temp[1] . ")";
346 $orgsip = substr $temp[5], 4;
347 $orgdip = substr $temp[6], 4;
350 $exsip = substr $temp[11], 4;
351 $exdip = substr $temp[12], 4;
357 # Only from this point, lines have the same known format/field
358 # The floating fields [UNREPLIED] [ASSURED] etc are ok.
360 # Store the line in a hash array for sorting
361 if ( $protocol ) { # line is decoded ?
362 my @record = ( 'index', $index++,
363 'protocol', $protocol,
376 my $record = {}; # create a reference to empty hash
377 %{$record} = @record; # populate that hash with @record
378 $entries{$record->{index}} = $record; # add this to a hash of hashes
379 } else { # it was not a known line
380 $unknownlines .= "<tr bgcolor='${Header::table1colour}'>";
381 $unknownlines .= "<td colspan='9'> unknown:$line></td></tr>";
385 # Build listbox objects
386 my $menu_proto = &make_select
('SEE_PROTO', $cgiparams{'SEE_PROTO'}, @list_proto);
387 my $menu_state = &make_select
('SEE_STATE', $cgiparams{'SEE_STATE'}, @list_state);
388 my $menu_src = &make_select
('SEE_SRC', $cgiparams{'SEE_SRC'}, &get_known_ips
('orgsip'));
389 my $menu_dest = &make_select
('SEE_DEST', $cgiparams{'SEE_DEST'}, &get_known_ips
('orgdip'));
390 my $menu_mark = &make_select
('SEE_MARK', $cgiparams{'SEE_MARK'}, @list_mark);
391 my $menu_sort = &make_select
('SEE_SORT', $cgiparams{'SEE_SORT'}, @list_sort);
393 &Header
::showhttpheaders
();
394 &Header
::openpage
($Lang::tr
{'connections'}, 1, '');
395 &Header
::openbigbox
('100%', 'left');
396 &Header
::openbox
('100%', 'left', $Lang::tr
{'connection tracking'});
400 <tr><td align='center'><b>$Lang::tr{'legend'} : </b></td>
401 <td align='center' bgcolor='${Header::colourgreen}'><b><font color='#FFFFFF'>$Lang::tr{'lan'}</font></b></td>
402 <td align='center' bgcolor='${Header::colourred}'><b><font color='#FFFFFF'>$Lang::tr{'internet'}</font></b></td>
403 <td align='center' bgcolor='${Header::colourorange}'><b><font color='#FFFFFF'>$Lang::tr{'dmz'}</font></b></td>
404 <td align='center' bgcolor='${Header::colourblue}'><b><font color='#FFFFFF'>$Lang::tr{'wireless'}</font></b></td>
405 <td align='center' bgcolor='${Header::colourfw}'><b><font color='#FFFFFF'>IPFire</font></b></td>
406 <td align='center' bgcolor='${Header::colourvpn}'><b><font color='#FFFFFF'>$Lang::tr{'vpn'}</font></b></td>
407 <td align='center' bgcolor='${Header::colourovpn}'><b><font color='#FFFFFF'>$Lang::tr{'OpenVPN'}</font></b></td>
411 <table cellpadding='2'>
412 <tr><td align='center'><b>$Lang::tr{'protocol'}</b></td>
413 <td align='center'><b>$Lang::tr{'expires'}<br />($Lang::tr{'seconds'})</b></td>
414 <td align='center'><b>$Lang::tr{'connection'}<br />$Lang::tr{'status'}</b></td>
415 <td align='center'><b>$Lang::tr{'original'}<br />$Lang::tr{'source ip and port'}</b></td>
416 <td align='center'><b>$Lang::tr{'original'}<br />$Lang::tr{'dest ip and port'}</b></td>
417 <td align='center'><b>$Lang::tr{'expected'}<br />$Lang::tr{'source ip and port'}</b></td>
418 <td align='center'><b>$Lang::tr{'expected'}<br />$Lang::tr{'dest ip and port'}</b></td>
419 <td align='center'><b>$Lang::tr{'marked'}</b></td>
420 <td align='center'><b>$Lang::tr{'use'}</b></td>
422 <tr><form method='post' action='$ENV{'SCRIPT_NAME'}'>
423 <td align='center'>$menu_proto</td>
425 <td align='center'>$menu_state</td>
426 <td align='center'>$menu_src</td>
427 <td align='center'>$menu_dest</td>
428 <td align='center'colspan='2'>$Lang::tr{'sort ascending'}:$menu_sort </td>
429 <td align='center'>$menu_mark</td>
430 <td align='center'><input type='submit' value='!' /></td>
436 foreach my $entry (sort sort_entries
keys %entries) {
438 print "<tr bgcolor='${Header::table1colour}'>";
439 my $orgsipcolour = &ipcolour
( $entries{$entry}->{orgsip
} );
440 my $orgdipcolour = &ipcolour
( $entries{$entry}->{orgdip
} );
441 my $exsipcolour = &ipcolour
( $entries{$entry}->{exsip
} );
442 my $exdipcolour = &ipcolour
( $entries{$entry}->{exdip
} );
444 <td align='center'>$entries{$entry}->{protocol}</td>
445 <td align='center'>$entries{$entry}->{expires}</td>
446 <td align='center'>$entries{$entry}->{status}</td>
447 <td align='center' bgcolor='$orgsipcolour'>
448 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{orgsip}'>
449 <font color='#FFFFFF'>$entries{$entry}->{orgsip}</font>
450 </a><font color='#FFFFFF'>:$entries{$entry}->{orgsp}</font></td>
451 <td align='center' bgcolor='$orgdipcolour'>
452 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{orgdip}'>
453 <font color='#FFFFFF'>$entries{$entry}->{orgdip}</font>
454 </a><font color='#FFFFFF'>:$entries{$entry}->{orgdp}</font></td>
455 <td align='center' bgcolor='$exsipcolour'>
456 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{exsip}'>
457 <font color='#FFFFFF'>$entries{$entry}->{exsip}</font>
458 </a><font color='#FFFFFF'>:$entries{$entry}->{exsp}</font></td>
459 <td align='center' bgcolor='$exdipcolour'>
460 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{exdip}'>
461 <font color='#FFFFFF'>$entries{$entry}->{exdip}</font>
462 </a><font color='#FFFFFF'>:$entries{$entry}->{exdp}</font></td>
463 <td align='center'>$entries{$entry}->{marked}</td>
464 <td align='center'>$entries{$entry}->{use}</td>
470 print "$unknownlines</table>";
473 &Header
::closebigbox
();
474 &Header
::closepage
();
479 my $colour = ${Header
::colourred
};
482 foreach $line (@network) {
483 if (!$found && ipv4_in_network
( $network[$id] , $masklen[$id], $ip) ) {
485 $colour = $colour[$id];
492 # Create a string containing a complete SELECT html object
494 # param2: current value selected
496 sub make_select
($,$,$) {
497 my $select_name = shift;
498 my $selected = shift;
499 my $select = "<select name='$select_name'>";
501 foreach my $value (@_) {
502 my $check = $selected eq $value ?
"selected='selected'" : '';
503 $select .= "<option $check value='$value'>$value";
505 $select .= "</select>";
509 # Build a list of IP obtained from the %entries hash
510 # param1: IP field name
511 sub get_known_ips
($) {
513 my $qs = $cgiparams{'SEE_SORT'}; # switch the sort order
514 $cgiparams{'SEE_SORT'} = $field;
516 my @liste=('*.*.*.*');
517 foreach my $entry ( sort sort_entries
keys %entries) {
518 push (@liste, $entries{$entry}->{$field}) if (! grep (/^$entries{$entry}->{$field}$/,@liste) );
521 $cgiparams{'SEE_SORT'} = $qs; #restore sort order
525 # Used to sort the table containing the lines displayed.
526 sub sort_entries
{ #Reverse is not implemented
527 my $qs=$cgiparams{'SEE_SORT'};
528 if ($qs =~ /orgsip|orgdip|exsip|exdip/) {
529 my @a = split(/\./,$entries{$a}->{$qs});
530 my @b = split(/\./,$entries{$b}->{$qs});
535 } elsif ($qs =~ /expire|orgsp|orgdp|exsp|exdp/) {
536 $entries{$a}->{$qs} <=> $entries{$b}->{$qs};
538 $entries{$a}->{$qs} cmp $entries{$b}->{$qs};