]>
git.ipfire.org Git - people/mfischer/ipfire-2.x.git/blob - html/cgi-bin/connections.cgi
2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2021 IPFire Team <info@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
23 use experimental
'smartmatch';
25 use Net
::IPv4Addr
qw( :all );
28 # enable only the following on debugging purpose
30 #use CGI::Carp 'fatalsToBrowser';
32 require '/var/ipfire/general-functions.pl';
33 require "${General::swroot}/lang.pl";
34 require "${General::swroot}/header.pl";
35 require "${General::swroot}/location-functions.pl";
37 my $colour_multicast = "#A0A0A0";
39 # sort arguments for connection tracking table
40 # the sort field. eg. 1=src IP, 2=dst IP, 3=src port, 4=dst port
42 # the sort order. (a)scending orr (d)escending
49 # retrieve query arguments
50 # note: let a-z A-Z and 0-9 pass as value only
51 if (length ($ENV{'QUERY_STRING'}) > 0){
54 my $buffer = $ENV{'QUERY_STRING'};
55 my @pairs = split(/&/, $buffer);
56 foreach my $pair (@pairs){
57 ($name, $value) = split(/=/, $pair);
58 $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; # e.g. "%20" => " "
59 $value =~ s/[^a-zA-Z0-9]*//g; # a-Z 0-9 will pass
60 $cgiin{$name} = $value;
64 &Header
::showhttpheaders
();
71 &General
::readhash
("${General::swroot}/ethernet/settings", \
%netsettings);
73 # output cgi query arrguments to browser on debug
75 &Header
::openbox
('100%', 'center', 'DEBUG');
77 foreach my $line (sort keys %cgiin) {
78 print "$line = '$cgiin{$line}'<br />\n";
81 print " Count: $debugCount\n";
85 #workaround to suppress a warning when a variable is used only once
86 my @dummy = ( ${Header
::table1colour
} );
89 # check sorting arguments
90 if ( $cgiin{'sort_field'} ~~ [ '1','2','3','4','5','6','7','8','9' ] ) {
91 $SORT_FIELD = $cgiin{'sort_field'};
93 if ( $cgiin{'sort_order'} ~~ [ 'a','d','A','D' ] ) {
94 $SORT_ORDER = lc($cgiin{'sort_order'});
98 # Read and sort the connection tracking table
100 if ($SORT_FIELD and $SORT_ORDER) {
101 # field sorting when sorting arguments are sane
102 open(CONNTRACK
, "/usr/local/bin/getconntracktable | /usr/local/bin/consort.sh $SORT_FIELD $SORT_ORDER |") or die "Unable to read conntrack table";
104 # default sorting with no query arguments
105 open(CONNTRACK
, "/usr/local/bin/getconntracktable | sort -k 5,5 --numeric-sort --reverse |") or die "Unable to read conntrack table";
107 my @conntrack = <CONNTRACK
>;
110 # Collect data for the @network array.
112 # Add Firewall Localhost 127.0.0.1
113 push(@network, '127.0.0.1');
114 push(@masklen, '255.255.255.255');
115 push(@colour, ${Header
::colourfw
});
117 if (open(IP
, "${General::swroot}/red/local-ipaddress")) {
122 push(@network, $redip);
123 push(@masklen, '255.255.255.255');
124 push(@colour, ${Header
::colourfw
});
127 # Add STATIC RED aliases
128 if ($netsettings{'RED_DEV'}) {
129 my $aliasfile = "${General::swroot}/ethernet/aliases";
130 open(ALIASES
, $aliasfile) or die 'Unable to open aliases file.';
131 my @aliases = <ALIASES
>;
134 # We have a RED eth iface
135 if ($netsettings{'RED_TYPE'} eq 'STATIC') {
136 # We have a STATIC RED eth iface
137 foreach my $line (@aliases) {
139 my @temp = split(/\,/,$line);
141 push(@network, $temp[0]);
142 push(@masklen, $netsettings{'RED_NETMASK'} );
143 push(@colour, ${Header
::colourfw
} );
149 # Call safe system_output function to get all available routes.
150 my @all_routes = &General
::system_output
("/sbin/route", "-n");
152 # Add Green Firewall Interface
153 push(@network, $netsettings{'GREEN_ADDRESS'});
154 push(@masklen, "255.255.255.255" );
155 push(@colour, ${Header
::colourfw
} );
157 if ($netsettings{'GREEN_DEV'}) {
158 # Add Green Network to Array
159 push(@network, $netsettings{'GREEN_NETADDRESS'});
160 push(@masklen, $netsettings{'GREEN_NETMASK'} );
161 push(@colour, ${Header
::colourgreen
} );
163 # Add Green Routes to Array
164 my @routes = grep (/$netsettings{'GREEN_DEV'}/, @all_routes);
165 foreach my $route (@routes) {
167 my @temp = split(/[\t ]+/, $route);
168 push(@network, $temp[0]);
169 push(@masklen, $temp[2]);
170 push(@colour, ${Header
::colourgreen
} );
174 # Add Blue Firewall Interface
175 push(@network, $netsettings{'BLUE_ADDRESS'});
176 push(@masklen, "255.255.255.255" );
177 push(@colour, ${Header
::colourfw
} );
180 if ($netsettings{'BLUE_DEV'}) {
181 push(@network, $netsettings{'BLUE_NETADDRESS'});
182 push(@masklen, $netsettings{'BLUE_NETMASK'} );
183 push(@colour, ${Header
::colourblue
} );
185 # Add Blue Routes to Array
186 my @routes = grep(/$netsettings{'BLUE_DEV'}/, @all_routes);
187 foreach my $route (@routes) {
189 my @temp = split(/[\t ]+/, $route);
190 push(@network, $temp[0]);
191 push(@masklen, $temp[2]);
192 push(@colour, ${Header
::colourblue
} );
196 # Add Orange Firewall Interface
197 push(@network, $netsettings{'ORANGE_ADDRESS'});
198 push(@masklen, "255.255.255.255" );
199 push(@colour, ${Header
::colourfw
} );
202 if ($netsettings{'ORANGE_DEV'}) {
203 push(@network, $netsettings{'ORANGE_NETADDRESS'});
204 push(@masklen, $netsettings{'ORANGE_NETMASK'} );
205 push(@colour, ${Header
::colourorange
} );
206 # Add Orange Routes to Array
207 my @routes = grep(/$netsettings{'ORANGE_DEV'}/, @all_routes);
208 foreach my $route (@routes) {
210 my @temp = split(/[\t ]+/, $route);
211 push(@network, $temp[0]);
212 push(@masklen, $temp[2]);
213 push(@colour, ${Header
::colourorange
} );
217 # Highlight multicast connections.
218 push(@network, "224.0.0.0");
219 push(@masklen, "239.0.0.0");
220 push(@colour, $colour_multicast);
222 # Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate)
223 if (-e
"${General::swroot}/ovpn/settings") {
224 my %ovpnsettings = ();
225 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
226 my @tempovpnsubnet = split("\/",$ovpnsettings{'DOVPN_SUBNET'});
229 push(@network, $tempovpnsubnet[0]);
230 push(@masklen, $tempovpnsubnet[1]);
231 push(@colour, ${Header
::colourovpn
} );
233 # add BLUE:port / proto
234 if (($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'}) {
235 push(@network, $netsettings{'BLUE_ADDRESS'} );
236 push(@masklen, '255.255.255.255' );
237 push(@colour, ${Header
::colourovpn
});
240 # add ORANGE:port / proto
241 if (($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'}) {
242 push(@network, $netsettings{'ORANGE_ADDRESS'} );
243 push(@masklen, '255.255.255.255' );
244 push(@colour, ${Header
::colourovpn
} );
248 # Add OpenVPN net for custom OVPNs
249 if (-e
"${General::swroot}/ovpn/ccd.conf") {
250 open(OVPNSUB
, "${General::swroot}/ovpn/ccd.conf");
251 my @ovpnsub = <OVPNSUB
>;
255 my ($network, $mask) = split '/', (split ',', $_)[2];
257 $mask = ipv4_cidr2msk
($mask) unless &General
::validip
($mask);
259 push(@network, $network);
260 push(@masklen, $mask);
261 push(@colour, ${Header
::colourovpn
});
265 open(IPSEC
, "${General::swroot}/vpn/config");
269 foreach my $line (@ipsec) {
270 my @vpn = split(',', $line);
272 my @subnets = split(/\|/, $vpn[12]);
273 for my $subnet (@subnets) {
274 my ($network, $mask) = split("/", $subnet);
276 if (!&General
::validip
($mask)) {
277 $mask = ipv4_cidr2msk
($mask);
280 push(@network, $network);
281 push(@masklen, $mask);
282 push(@colour, ${Header
::colourvpn
});
286 if (-e
"${General::swroot}/ovpn/n2nconf") {
287 open(OVPNN2N
, "${General::swroot}/ovpn/ovpnconfig");
288 my @ovpnn2n = <OVPNN2N
>;
291 foreach my $line (@ovpnn2n) {
292 my @ovpn = split(',', $line);
293 next if ($ovpn[4] ne 'net');
295 my ($network, $mask) = split("/", $ovpn[12]);
296 if (!&General
::validip
($mask)) {
297 $mask = ipv4_cidr2msk
($mask);
300 push(@network, $network);
301 push(@masklen, $mask);
302 push(@colour, ${Header
::colourovpn
});
307 &Header
::openpage
($Lang::tr
{'connections'}, 1, '');
308 &Header
::openbigbox
('100%', 'left');
309 &Header
::openbox
('100%', 'left', $Lang::tr
{'connection tracking'});
313 <table style='width:100%'>
315 <td style='text-align:center;'>
316 <b>$Lang::tr{'legend'} :</b>
318 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourgreen}; font-weight:bold;'>
319 <b>$Lang::tr{'lan'}</b>
321 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourred};'>
322 <b>$Lang::tr{'internet'}</b>
324 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourorange};'>
325 <b>$Lang::tr{'dmz'}</b>
327 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourblue};'>
328 <b>$Lang::tr{'wireless'}</b>
330 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourfw};'>
333 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourvpn};'>
334 <b>$Lang::tr{'vpn'}</b>
336 <td style='text-align:center; color:#FFFFFF; background-color:${Header::colourovpn};'>
337 <b>$Lang::tr{'OpenVPN'}</b>
339 <td style='text-align:center; color:#FFFFFF; background-color:$colour_multicast;'>
347 if ($SORT_FIELD and $SORT_ORDER) {
348 my @sort_field_name = (
349 $Lang::tr
{'source ip'},
350 $Lang::tr
{'destination ip'},
351 $Lang::tr
{'source port'},
352 $Lang::tr
{'destination port'},
353 $Lang::tr
{'protocol'},
354 $Lang::tr
{'connection'}.' '.$Lang::tr
{'status'},
355 $Lang::tr
{'expires'}.' ('.$Lang::tr
{'seconds'}.')',
356 $Lang::tr
{'download'},
360 if (lc($SORT_ORDER) eq "a") {
361 $sort_order_name = $Lang::tr
{'sort ascending'};
363 $sort_order_name = $Lang::tr
{'sort descending'};
367 <div style="font-weight:bold;margin:10px;font-size: 70%">
368 $sort_order_name: $sort_field_name[$SORT_FIELD-1]
374 # Print table header.
376 <table style='width:100%'>
378 <th style='text-align:center'>
379 <a href="?sort_field=5&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
380 <a href="?sort_field=5&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
382 <th style='text-align:center' colspan='2'>
383 <a href="?sort_field=1&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
384 <a href="?sort_field=1&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
385
386 <a href="?sort_field=3&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
387 <a href="?sort_field=3&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
390 <th style='text-align:center' colspan='2'>
391 <a href="?sort_field=2&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
392 <a href="?sort_field=2&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
393
394 <a href="?sort_field=4&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
395 <a href="?sort_field=4&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
398 <th style='text-align:center'>
399 <a href="?sort_field=8&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
400 <a href="?sort_field=8&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
401
402 <a href="?sort_field=9&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
403 <a href="?sort_field=9&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
405 <th style='text-align:center'>
406 <a href="?sort_field=6&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
407 <a href="?sort_field=6&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
409 <th style='text-align:center'>
410 <a href="?sort_field=7&sort_order=d"><img style="width:10px" src="/images/up.gif" alt=""></a>
411 <a href="?sort_field=7&sort_order=a"><img style="width:10px" src="/images/down.gif" alt=""></a>
415 <th style='text-align:center'>
416 $Lang::tr{'protocol'}
418 <th style='text-align:center' colspan='2'>
419 $Lang::tr{'source ip and port'}
421 <th style='text-align:center'>
424 <th style='text-align:center' colspan='2'>
425 $Lang::tr{'dest ip and port'}
427 <th style='text-align:center'>
430 <th style='text-align:center'>
431 $Lang::tr{'download'} /
432 <br>$Lang::tr{'upload'}
434 <th style='text-align:center'>
435 $Lang::tr{'connection'}<br>$Lang::tr{'status'}
437 <th style='text-align:center'>
438 $Lang::tr{'expires'}<br>($Lang::tr{'seconds'})
443 foreach my $line (@conntrack) {
444 my @conn = split(' ', $line);
446 # The first bit is the l3 protocol.
447 my $l3proto = $conn[0];
449 # Skip everything that is not IPv4.
450 if ($l3proto ne 'ipv4') {
454 # L4 protocol (tcp, udp, ...).
455 my $l4proto = $conn[2];
457 # Translate unknown protocols.
458 if ($l4proto eq 'unknown') {
459 my $l4protonum = $conn[3];
460 if ($l4protonum eq '2') {
462 } elsif ($l4protonum eq '4') {
463 $l4proto = 'IPv4 Encap';
464 } elsif ($l4protonum eq '33') {
466 } elsif ($l4protonum eq '41') {
467 $l4proto = 'IPv6 Encap';
468 } elsif ($l4protonum eq '50') {
470 } elsif ($l4protonum eq '51') {
472 } elsif ($l4protonum eq '132') {
475 $l4proto = $l4protonum;
478 $l4proto = uc($l4proto);
481 # Source and destination.
495 if ($l4proto eq 'TCP') {
499 # Kick out everything that is not IPv4.
500 foreach my $item (@conn) {
501 my ($key, $val) = split('=', $item);
533 push(@packets, $val);
541 my $sip_colour = ipcolour
($sip);
542 # use colour of destination network for DNAT
543 my $dip_colour = $dip ne $dip_ret ? ipcolour
($dip_ret) : ipcolour
($dip);
547 $sserv = uc(getservbyport($sport, lc($l4proto)));
552 $dserv = uc(getservbyport($dport, lc($l4proto)));
555 my $bytes_in = format_bytes
($bytes[0]);
556 my $bytes_out = format_bytes
($bytes[1]);
558 # enumerate location information
559 my $srcccode = &Location
::Functions
::lookup_country_code
($sip_ret);
560 my $src_flag_icon = &Location
::Functions
::get_flag_icon
($srcccode);
561 my $dstccode = &Location
::Functions
::lookup_country_code
($dip_ret);
562 my $dst_flag_icon = &Location
::Functions
::get_flag_icon
($dstccode);
565 $ttl = format_time
($ttl);
568 if ($sip_ret && $sip ne $sip_ret) {
569 $sip_extra = "<span style='color:#FFFFFF;'>></span> ";
570 $sip_extra .= "<a href='/cgi-bin/ipinfo.cgi?ip=$sip_ret'>";
571 $sip_extra .= " <span style='color:#FFFFFF;'>$sip_ret</span>";
572 $sip_extra .= "</a>";
576 if ($dip_ret && $dip ne $dip_ret) {
577 $dip_extra = "<span style='color:#FFFFFF;'>></span> ";
578 $dip_extra .= "<a href='/cgi-bin/ipinfo.cgi?ip=$dip_ret'>";
579 $dip_extra .= " <span style='color:#FFFFFF;'>$dip_ret</span>";
580 $dip_extra .= "</a>";
585 if ($sport ne $sport_ret) {
587 if ($sport_ret < 1024) {
588 $sserv_ret = uc(getservbyport($sport_ret, lc($l4proto)));
591 $sport_extra = "<span style='color:#FFFFFF;'>></span> ";
592 $sport_extra .= "<a href='http://isc.sans.org/port_details.php?port=$sport_ret' target='top' title='$sserv_ret'>";
593 $sport_extra .= " <span style='color:#FFFFFF;'>$sport_ret</span>";
594 $sport_extra .= "</a>";
598 if ($dport ne $dport_ret) {
600 if ($dport_ret < 1024) {
601 $dserv_ret = uc(getservbyport($dport_ret, lc($l4proto)));
604 $dport_extra = "<span style='color:#FFFFFF;'>></span> ";
605 $dport_extra .= "<a href='http://isc.sans.org/port_details.php?port=$dport_ret' target='top' title='$dserv_ret'>";
606 $dport_extra .= " <span style='color:#FFFFFF;'>$dport_ret</span>";
607 $dport_extra .= "</a>";
612 <td style='text-align:center'>$l4proto</td>
613 <td style='text-align:center; background-color:$sip_colour;'>
614 <a href='/cgi-bin/ipinfo.cgi?ip=$sip'>
615 <span style='color:#FFFFFF;'>$sip</span>
619 <td style='text-align:center; background-color:$sip_colour;'>
620 <a href='http://isc.sans.org/port_details.php?port=$sport' target='top' title='$sserv'>
621 <span style='color:#FFFFFF;'>$sport</span>
625 <td style='text-align:center; background-color:$sip_colour;'>
626 <a href='country.cgi#$srcccode'><img src='$src_flag_icon' border='0' align='absmiddle' alt='$srcccode' title='$srcccode' /></a>
628 <td style='text-align:center; background-color:$dip_colour;'>
629 <a href='/cgi-bin/ipinfo.cgi?ip=$dip'>
630 <span style='color:#FFFFFF;'>$dip</span>
634 <td style='text-align:center; background-color:$dip_colour;'>
635 <a href='http://isc.sans.org/port_details.php?port=$dport' target='top' title='$dserv'>
636 <span style='color:#FFFFFF;'>$dport</span>
640 <td style='text-align:center; background-color:$sip_colour;'>
641 <a href='country.cgi#$dstccode'><img src='$dst_flag_icon' border='0' align='absmiddle' alt='$dstccode' title='$dstccode' /></a>
643 <td style='text-align:center'>
644 $bytes_in / $bytes_out
646 <td style='text-align:center'>$state</td>
647 <td style='text-align:center'>$ttl</td>
652 # Close the main table.
656 &Header
::closebigbox
();
657 &Header
::closepage
();
659 sub format_bytes
($) {
661 my @units = ("B", "k", "M", "G", "T");
663 foreach my $unit (@units) {
665 return sprintf("%d%s", $bytes, $unit);
671 return sprintf("%d%s", $bytes, $units[$#units]);
677 my $seconds = $time % 60;
678 my $minutes = $time / 60;
681 if ($minutes >= 60) {
682 $hours = $minutes / 60;
686 return sprintf("%3d:%02d:%02d", $hours, $minutes, $seconds);
691 my $colour = ${Header
::colourred
};
696 foreach my $line (@network) {
697 if ($network[$id] eq '') {
700 if (!$found && ipv4_in_network
($network[$id], $masklen[$id], $ip) ) {
702 $colour = $colour[$id];