]>
git.ipfire.org Git - ipfire-2.x.git/blob - html/cgi-bin/connections.cgi
2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2012 IPFire Team <info@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
24 use Net
::IPv4Addr
qw( :all );
27 # enable only the following on debugging purpose
29 #use CGI::Carp 'fatalsToBrowser';
31 require '/var/ipfire/general-functions.pl';
32 require "${General::swroot}/lang.pl";
33 require "${General::swroot}/header.pl";
35 my $colour_multicast = "#A0A0A0";
37 # sort arguments for connection tracking table
38 # the sort field. eg. 1=src IP, 2=dst IP, 3=src port, 4=dst port
40 # the sort order. (a)scending orr (d)escending
47 # retrieve query arguments
48 # note: let a-z A-Z and 0-9 pass as value only
49 if (length ($ENV{'QUERY_STRING'}) > 0){
52 my $buffer = $ENV{'QUERY_STRING'};
53 my @pairs = split(/&/, $buffer);
54 foreach my $pair (@pairs){
55 ($name, $value) = split(/=/, $pair);
56 $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; # e.g. "%20" => " "
57 $value =~ s/[^a-zA-Z0-9]*//g; # a-Z 0-9 will pass
58 $cgiin{$name} = $value;
62 &Header
::showhttpheaders
();
69 &General
::readhash
("${General::swroot}/ethernet/settings", \
%netsettings);
71 # output cgi query arrguments to browser on debug
73 &Header
::openbox
('100%', 'center', 'DEBUG');
75 foreach my $line (sort keys %cgiin) {
76 print "$line = '$cgiin{$line}'<br />\n";
79 print " Count: $debugCount\n";
83 #workaround to suppress a warning when a variable is used only once
84 my @dummy = ( ${Header
::table1colour
} );
87 # check sorting arguments
88 if ( $cgiin{'sort_field'} ~~ [ '1','2','3','4','5','6','7','8','9' ] ) {
89 $SORT_FIELD = $cgiin{'sort_field'};
91 if ( $cgiin{'sort_order'} ~~ [ 'a','d','A','D' ] ) {
92 $SORT_ORDER = lc($cgiin{'sort_order'});
96 # Read and sort the connection tracking table
98 if ($SORT_FIELD and $SORT_ORDER) {
99 # field sorting when sorting arguments are sane
100 open(CONNTRACK
, "/usr/local/bin/getconntracktable | /usr/local/bin/consort.sh $SORT_FIELD $SORT_ORDER |") or die "Unable to read conntrack table";
102 # default sorting with no query arguments
103 open(CONNTRACK
, "/usr/local/bin/getconntracktable | sort -k 5,5 --numeric-sort --reverse |") or die "Unable to read conntrack table";
105 my @conntrack = <CONNTRACK
>;
108 # Collect data for the @network array.
110 # Add Firewall Localhost 127.0.0.1
111 push(@network, '127.0.0.1');
112 push(@masklen, '255.255.255.255');
113 push(@colour, ${Header
::colourfw
});
115 if (open(IP
, "${General::swroot}/red/local-ipaddress")) {
120 push(@network, $redip);
121 push(@masklen, '255.255.255.255');
122 push(@colour, ${Header
::colourfw
});
125 # Add STATIC RED aliases
126 if ($netsettings{'RED_DEV'}) {
127 my $aliasfile = "${General::swroot}/ethernet/aliases";
128 open(ALIASES
, $aliasfile) or die 'Unable to open aliases file.';
129 my @aliases = <ALIASES
>;
132 # We have a RED eth iface
133 if ($netsettings{'RED_TYPE'} eq 'STATIC') {
134 # We have a STATIC RED eth iface
135 foreach my $line (@aliases) {
137 my @temp = split(/\,/,$line);
139 push(@network, $temp[0]);
140 push(@masklen, $netsettings{'RED_NETMASK'} );
141 push(@colour, ${Header
::colourfw
} );
147 # Add Green Firewall Interface
148 push(@network, $netsettings{'GREEN_ADDRESS'});
149 push(@masklen, "255.255.255.255" );
150 push(@colour, ${Header
::colourfw
} );
152 # Add Green Network to Array
153 push(@network, $netsettings{'GREEN_NETADDRESS'});
154 push(@masklen, $netsettings{'GREEN_NETMASK'} );
155 push(@colour, ${Header
::colourgreen
} );
157 # Add Green Routes to Array
158 my @routes = `/sbin/route -n | /bin/grep $netsettings{'GREEN_DEV'}`;
159 foreach my $route (@routes) {
161 my @temp = split(/[\t ]+/, $route);
162 push(@network, $temp[0]);
163 push(@masklen, $temp[2]);
164 push(@colour, ${Header
::colourgreen
} );
167 # Add Blue Firewall Interface
168 push(@network, $netsettings{'BLUE_ADDRESS'});
169 push(@masklen, "255.255.255.255" );
170 push(@colour, ${Header
::colourfw
} );
173 if ($netsettings{'BLUE_DEV'}) {
174 push(@network, $netsettings{'BLUE_NETADDRESS'});
175 push(@masklen, $netsettings{'BLUE_NETMASK'} );
176 push(@colour, ${Header
::colourblue
} );
178 # Add Blue Routes to Array
179 @routes = `/sbin/route -n | /bin/grep $netsettings{'BLUE_DEV'}`;
180 foreach my $route (@routes) {
182 my @temp = split(/[\t ]+/, $route);
183 push(@network, $temp[0]);
184 push(@masklen, $temp[2]);
185 push(@colour, ${Header
::colourblue
} );
189 # Add Orange Firewall Interface
190 push(@network, $netsettings{'ORANGE_ADDRESS'});
191 push(@masklen, "255.255.255.255" );
192 push(@colour, ${Header
::colourfw
} );
195 if ($netsettings{'ORANGE_DEV'}) {
196 push(@network, $netsettings{'ORANGE_NETADDRESS'});
197 push(@masklen, $netsettings{'ORANGE_NETMASK'} );
198 push(@colour, ${Header
::colourorange
} );
199 # Add Orange Routes to Array
200 @routes = `/sbin/route -n | /bin/grep $netsettings{'ORANGE_DEV'}`;
201 foreach my $route (@routes) {
203 my @temp = split(/[\t ]+/, $route);
204 push(@network, $temp[0]);
205 push(@masklen, $temp[2]);
206 push(@colour, ${Header
::colourorange
} );
210 # Highlight multicast connections.
211 push(@network, "224.0.0.0");
212 push(@masklen, "239.0.0.0");
213 push(@colour, $colour_multicast);
215 # Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate)
216 if (-e
"${General::swroot}/ovpn/settings") {
217 my %ovpnsettings = ();
218 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
219 my @tempovpnsubnet = split("\/",$ovpnsettings{'DOVPN_SUBNET'});
222 push(@network, $tempovpnsubnet[0]);
223 push(@masklen, $tempovpnsubnet[1]);
224 push(@colour, ${Header
::colourovpn
} );
226 # add BLUE:port / proto
227 if (($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'}) {
228 push(@network, $netsettings{'BLUE_ADDRESS'} );
229 push(@masklen, '255.255.255.255' );
230 push(@colour, ${Header
::colourovpn
});
233 # add ORANGE:port / proto
234 if (($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'}) {
235 push(@network, $netsettings{'ORANGE_ADDRESS'} );
236 push(@masklen, '255.255.255.255' );
237 push(@colour, ${Header
::colourovpn
} );
241 open(IPSEC
, "${General::swroot}/vpn/config");
245 foreach my $line (@ipsec) {
246 my @vpn = split(',', $line);
247 my ($network, $mask) = split("/", $vpn[12]);
249 if (!&General
::validip
($mask)) {
250 $mask = ipv4_cidr2msk
($mask);
253 push(@network, $network);
254 push(@masklen, $mask);
255 push(@colour, ${Header
::colourvpn
});
258 if (-e
"${General::swroot}/ovpn/n2nconf") {
259 open(OVPNN2N
, "${General::swroot}/ovpn/ovpnconfig");
260 my @ovpnn2n = <OVPNN2N
>;
263 foreach my $line (@ovpnn2n) {
264 my @ovpn = split(',', $line);
265 next if ($ovpn[4] ne 'net');
267 my ($network, $mask) = split("/", $ovpn[12]);
268 if (!&General
::validip
($mask)) {
269 $mask = ipv4_cidr2msk
($mask);
272 push(@network, $network);
273 push(@masklen, $mask);
274 push(@colour, ${Header
::colourovpn
});
279 &Header
::openpage
($Lang::tr
{'connections'}, 1, '');
280 &Header
::openbigbox
('100%', 'left');
281 &Header
::openbox
('100%', 'left', $Lang::tr
{'connection tracking'});
285 <table style='width:100%'>
287 <td style='text-align:center;'>
288 <b>$Lang::tr{'legend'} :</b>
290 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourgreen}; font-weight:bold;'>
291 <b>$Lang::tr{'lan'}</b>
293 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourred};'>
294 <b>$Lang::tr{'internet'}</b>
296 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourorange};'>
297 <b>$Lang::tr{'dmz'}</b>
299 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourblue};'>
300 <b>$Lang::tr{'wireless'}</b>
302 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourfw};'>
305 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourvpn};'>
306 <b>$Lang::tr{'vpn'}</b>
308 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourovpn};'>
309 <b>$Lang::tr{'OpenVPN'}</b>
311 <td style='text-align:center; color:#FFFFFF; background-color:$colour_multicast;'>
319 if ($SORT_FIELD and $SORT_ORDER) {
320 my @sort_field_name = (
321 $Lang::tr
{'source ip'},
322 $Lang::tr
{'destination ip'},
323 $Lang::tr
{'source port'},
324 $Lang::tr
{'destination port'},
325 $Lang::tr
{'protocol'},
326 $Lang::tr
{'connection'}.' '.$Lang::tr
{'status'},
327 $Lang::tr
{'expires'}.' ('.$Lang::tr
{'seconds'}.')',
328 $Lang::tr
{'download'},
332 if (lc($SORT_ORDER) eq "a") {
333 $sort_order_name = $Lang::tr
{'sort ascending'};
335 $sort_order_name = $Lang::tr
{'sort descending'};
339 <div style="font-weight:bold;margin:10px;font-size: 70%">
340 $sort_order_name: $sort_field_name[$SORT_FIELD-1]
346 # Print table header.
348 <table style='width:100%'>
350 <th style='text-align:center'>
351 <a href="?sort_field=5&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
352 <a href="?sort_field=5&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
354 <th style='text-align:center' colspan='2'>
355 <a href="?sort_field=1&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
356 <a href="?sort_field=1&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
357
358 <a href="?sort_field=3&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
359 <a href="?sort_field=3&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
361 <th style='text-align:center' colspan='2'>
362 <a href="?sort_field=2&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
363 <a href="?sort_field=2&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
364
365 <a href="?sort_field=4&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
366 <a href="?sort_field=4&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
368 <th style='text-align:center'>
369 <a href="?sort_field=8&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
370 <a href="?sort_field=8&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
371
372 <a href="?sort_field=9&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
373 <a href="?sort_field=9&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
375 <th style='text-align:center'>
376 <a href="?sort_field=6&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
377 <a href="?sort_field=6&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
379 <th style='text-align:center'>
380 <a href="?sort_field=7&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
381 <a href="?sort_field=7&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
385 <th style='text-align:center'>
386 $Lang::tr{'protocol'}
388 <th style='text-align:center' colspan='2'>
389 $Lang::tr{'source ip and port'}
391 <th style='text-align:center' colspan='2'>
392 $Lang::tr{'dest ip and port'}
394 <th style='text-align:center'>
395 $Lang::tr{'download'} /
396 <br>$Lang::tr{'upload'}
398 <th style='text-align:center'>
399 $Lang::tr{'connection'}<br>$Lang::tr{'status'}
401 <th style='text-align:center'>
402 $Lang::tr{'expires'}<br>($Lang::tr{'seconds'})
407 foreach my $line (@conntrack) {
408 my @conn = split(' ', $line);
410 # The first bit is the l3 protocol.
411 my $l3proto = $conn[0];
413 # Skip everything that is not IPv4.
414 if ($l3proto ne 'ipv4') {
418 # L4 protocol (tcp, udp, ...).
419 my $l4proto = $conn[2];
421 # Translate unknown protocols.
422 if ($l4proto eq 'unknown') {
423 my $l4protonum = $conn[3];
424 if ($l4protonum eq '2') {
426 } elsif ($l4protonum eq '4') {
427 $l4proto = 'IPv4 Encap';
428 } elsif ($l4protonum eq '33') {
430 } elsif ($l4protonum eq '41') {
431 $l4proto = 'IPv6 Encap';
432 } elsif ($l4protonum eq '50') {
434 } elsif ($l4protonum eq '51') {
436 } elsif ($l4protonum eq '132') {
439 $l4proto = $l4protonum;
442 $l4proto = uc($l4proto);
445 # Source and destination.
459 if ($l4proto eq 'TCP') {
463 # Kick out everything that is not IPv4.
464 foreach my $item (@conn) {
465 my ($key, $val) = split('=', $item);
497 push(@packets, $val);
505 my $sip_colour = ipcolour
($sip);
506 my $dip_colour = ipcolour
($dip);
510 $sserv = uc(getservbyport($sport, lc($l4proto)));
515 $dserv = uc(getservbyport($dport, lc($l4proto)));
518 my $bytes_in = format_bytes
($bytes[0]);
519 my $bytes_out = format_bytes
($bytes[1]);
522 $ttl = format_time
($ttl);
525 if ($sip ne $sip_ret) {
526 $sip_extra = "<span style='color:#FFFFFF;'>></span> ";
527 $sip_extra .= "<a href='/cgi-bin/ipinfo.cgi?ip=$sip_ret'>";
528 $sip_extra .= " <span style='color:#FFFFFF;'>$sip_ret</span>";
529 $sip_extra .= "</a>";
533 if ($dip ne $dip_ret) {
534 $dip_extra = "<span style='color:#FFFFFF;'>></span> ";
535 $dip_extra .= "<a href='/cgi-bin/ipinfo.cgi?ip=$dip_ret'>";
536 $dip_extra .= " <span style='color:#FFFFFF;'>$dip_ret</span>";
537 $dip_extra .= "</a>";
542 if ($sport ne $sport_ret) {
544 if ($sport_ret < 1024) {
545 $sserv_ret = uc(getservbyport($sport_ret, lc($l4proto)));
548 $sport_extra = "<span style='color:#FFFFFF;'>></span> ";
549 $sport_extra .= "<a href='http://isc.sans.org/port_details.php?port=$sport_ret' target='top' title='$sserv_ret'>";
550 $sport_extra .= " <span style='color:#FFFFFF;'>$sport_ret</span>";
551 $sport_extra .= "</a>";
555 if ($dport ne $dport_ret) {
557 if ($dport_ret < 1024) {
558 $dserv_ret = uc(getservbyport($dport_ret, lc($l4proto)));
561 $dport_extra = "<span style='color:#FFFFFF;'>></span> ";
562 $dport_extra .= "<a href='http://isc.sans.org/port_details.php?port=$dport_ret' target='top' title='$dserv_ret'>";
563 $dport_extra .= " <span style='color:#FFFFFF;'>$dport_ret</span>";
564 $dport_extra .= "</a>";
569 <td style='text-align:center'>$l4proto</td>
570 <td style='text-align:center; background-color:$sip_colour;'>
571 <a href='/cgi-bin/ipinfo.cgi?ip=$sip'>
572 <span style='color:#FFFFFF;'>$sip</span>
576 <td style='text-align:center; background-color:$sip_colour;'>
577 <a href='http://isc.sans.org/port_details.php?port=$sport' target='top' title='$sserv'>
578 <span style='color:#FFFFFF;'>$sport</span>
582 <td style='text-align:center; background-color:$dip_colour;'>
583 <a href='/cgi-bin/ipinfo.cgi?ip=$dip'>
584 <span style='color:#FFFFFF;'>$dip</span>
588 <td style='text-align:center; background-color:$dip_colour;'>
589 <a href='http://isc.sans.org/port_details.php?port=$dport' target='top' title='$dserv'>
590 <span style='color:#FFFFFF;'>$dport</span>
594 <td style='text-align:center'>
595 $bytes_in / $bytes_out
597 <td style='text-align:center'>$state</td>
598 <td style='text-align:center'>$ttl</td>
603 # Close the main table.
607 &Header
::closebigbox
();
608 &Header
::closepage
();
610 sub format_bytes
($) {
612 my @units = ("B", "k", "M", "G", "T");
614 foreach my $unit (@units) {
616 return sprintf("%d%s", $bytes, $unit);
622 return sprintf("%d%s", $bytes, $units[$#units]);
628 my $seconds = $time % 60;
629 my $minutes = $time / 60;
632 if ($minutes >= 60) {
633 $hours = $minutes / 60;
637 return sprintf("%3d:%02d:%02d", $hours, $minutes, $seconds);
642 my $colour = ${Header
::colourred
};
646 foreach my $line (@network) {
647 if ($network[$id] eq '') {
650 if (!$found && ipv4_in_network
($network[$id], $masklen[$id], $ip) ) {
652 $colour = $colour[$id];