]>
Commit | Line | Data |
---|---|---|
e4aac473 AH |
1 | #!/usr/bin/perl |
2 | # SmoothWall CGIs | |
3 | # | |
4 | # This code is distributed under the terms of the GPL | |
5 | # | |
6 | # JC HERITIER | |
7 | # page inspired from the initial firewalllog.dat | |
8 | # | |
9 | # Modified for IPFire by Christian Schmidt (www.ipfire.org) | |
10 | ||
11 | # enable only the following on debugging purpose | |
12 | #use warnings; | |
13 | #use CGI::Carp 'fatalsToBrowser'; | |
14 | ||
15 | #use strict; | |
16 | use Geo::IP::PurePerl; | |
17 | ||
18 | require '/var/ipfire/general-functions.pl'; | |
19 | require "${General::swroot}/lang.pl"; | |
20 | require "${General::swroot}/header.pl"; | |
21 | ||
22 | use POSIX(); | |
23 | ||
24 | #workaround to suppress a warning when a variable is used only once | |
25 | my @dummy = ( ${Header::table2colour} ); | |
26 | undef (@dummy); | |
27 | ||
28 | my %cgiparams=(); | |
29 | my %logsettings=(); | |
30 | my $errormessage = ''; | |
31 | ||
32 | my @shortmonths = ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', | |
33 | 'Sep', 'Oct', 'Nov', 'Dec' ); | |
34 | my @longmonths = ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{'march'}, | |
35 | $Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'}, $Lang::tr{'august'}, | |
36 | $Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'}, | |
37 | $Lang::tr{'december'} ); | |
38 | ||
39 | my @now = localtime(); | |
40 | my $dow = $now[6]; | |
41 | my $doy = $now[7]; | |
42 | my $tdoy = $now[7]; | |
43 | my $year = $now[5]+1900; | |
44 | ||
45 | $cgiparams{'DAY'} = $now[3]; | |
46 | $cgiparams{'MONTH'} = $now[4]; | |
47 | $cgiparams{'ACTION'} = ''; | |
48 | ||
49 | &Header::getcgihash(\%cgiparams); | |
50 | ||
51 | $logsettings{'LOGVIEW_REVERSE'} = 'off'; | |
52 | &General::readhash("${General::swroot}/logging/settings", \%logsettings); | |
53 | ||
54 | my $start = -1; | |
55 | if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'}) | |
56 | { | |
57 | my @temp = split(',',$ENV{'QUERY_STRING'}); | |
58 | $start = $temp[0]; | |
59 | $cgiparams{'MONTH'} = $temp[1]; | |
60 | $cgiparams{'DAY'} = $temp[2]; | |
bde7a7d2 | 61 | $cgiparams{country} = $temp[3]; |
e4aac473 AH |
62 | } |
63 | ||
64 | if (!($cgiparams{'MONTH'} =~ /^(0|1|2|3|4|5|6|7|8|9|10|11)$/) || | |
65 | !($cgiparams{'DAY'} =~ /^(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)$/)) | |
66 | { | |
67 | $cgiparams{'DAY'} = $now[3]; | |
68 | $cgiparams{'MONTH'} = $now[4]; | |
69 | } | |
70 | elsif($cgiparams{'ACTION'} eq '>>') | |
71 | { | |
72 | my @temp_then=(); | |
73 | my @temp_now = localtime(time); | |
74 | $temp_now[4] = $cgiparams{'MONTH'}; | |
75 | $temp_now[3] = $cgiparams{'DAY'}; | |
76 | @temp_then = localtime(POSIX::mktime(@temp_now) + 86400); | |
77 | ## Retrieve the same time on the next day - | |
78 | ## 86400 seconds in a day | |
79 | $cgiparams{'MONTH'} = $temp_then[4]; | |
80 | $cgiparams{'DAY'} = $temp_then[3]; | |
81 | } | |
82 | elsif($cgiparams{'ACTION'} eq '<<') | |
83 | { | |
84 | my @temp_then=(); | |
85 | my @temp_now = localtime(time); | |
86 | $temp_now[4] = $cgiparams{'MONTH'}; | |
87 | $temp_now[3] = $cgiparams{'DAY'}; | |
88 | @temp_then = localtime(POSIX::mktime(@temp_now) - 86400); | |
89 | ## Retrieve the same time on the previous day - | |
90 | ## 86400 seconds in a day | |
91 | $cgiparams{'MONTH'} = $temp_then[4]; | |
92 | $cgiparams{'DAY'} = $temp_then[3]; | |
93 | } | |
94 | ||
95 | if (($cgiparams{'DAY'} ne $now[3]) || ($cgiparams{'MONTH'} ne $now[4])) | |
96 | { | |
97 | my @then = (); | |
98 | if ( ( $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) || | |
99 | ( $cgiparams{'MONTH'} > $now[4] ) ) { | |
100 | @then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1901 )); | |
101 | } else { | |
102 | @then = localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{'MONTH'}, $year - 1900 )); | |
103 | } | |
104 | $tdoy = $then[7]; | |
105 | my $lastleap=($year-1)%4; | |
106 | if ($tdoy>$doy) { | |
107 | if ($lastleap == 0 && $tdoy < 60) { | |
108 | $doy=$tdoy+366; | |
109 | } else { | |
110 | $doy=$doy+365; | |
111 | } | |
112 | } | |
113 | } | |
114 | my $datediff=0; | |
115 | my $dowd=0; | |
116 | my $multifile=0; | |
117 | if ($tdoy ne $doy) { | |
118 | $datediff=int(($doy-$tdoy)/7); | |
119 | $dowd=($doy-$tdoy)%7; | |
120 | if (($dow-$dowd)<1) { | |
121 | $datediff=$datediff+1; | |
122 | } | |
123 | if (($dow-$dowd)==0) { | |
124 | $multifile=1; | |
125 | } | |
126 | } | |
127 | ||
128 | my $monthstr = $shortmonths[$cgiparams{'MONTH'}]; | |
129 | my $longmonthstr = $longmonths[$cgiparams{'MONTH'}]; | |
130 | my $day = $cgiparams{'DAY'}; | |
131 | my $daystr=''; | |
132 | if ($day <= 9) { | |
133 | $daystr = " $day"; } | |
134 | else { | |
135 | $daystr = $day; | |
136 | } | |
137 | ||
138 | my $skip=0; | |
139 | my $filestr=''; | |
140 | if ($datediff==0) { | |
141 | $filestr="/var/log/messages"; | |
142 | } else { | |
143 | $filestr="/var/log/messages.$datediff"; | |
144 | $filestr = "$filestr.gz" if -f "$filestr.gz"; | |
145 | } | |
146 | ||
147 | if (!(open (FILE,($filestr =~ /.gz$/ ? "gzip -dc $filestr |" : $filestr)))) { | |
148 | $errormessage = "$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}"; | |
149 | $skip=1; | |
150 | # Note: This is in case the log does not exist for that date | |
151 | } | |
152 | my $lines = 0; | |
153 | my @log=(); | |
154 | my $country = $cgiparams{country}; | |
155 | my $gi = Geo::IP::PurePerl->new(); | |
156 | ||
157 | if (!$skip) | |
158 | { | |
bde7a7d2 AH |
159 | while (<FILE>) |
160 | { | |
9877d28d ME |
161 | # First check whether valid log line (date, day) |
162 | if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { | |
163 | # If ipv6 uses bridge, then use PHYSIN otherwise use IN | |
1b5b6c91 | 164 | if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(PHYSIN=.*)$/) {} |
9877d28d ME |
165 | elsif (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) {} |
166 | my $packet = $2; | |
167 | my $iface = ''; | |
168 | my $srcaddr = ''; | |
169 | # If ipv6 uses bridge, use PHYSIN otherwise IN | |
1b5b6c91 | 170 | if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1; } elsif ($packet =~ /IN=(\w+)/) { $iface = $1; } |
9877d28d ME |
171 | # Extract ipv4 and ipv6 addresses |
172 | if (($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { | |
1b5b6c91 | 173 | $srcaddr = $1; |
9877d28d | 174 | }; |
fde47f5a AH |
175 | |
176 | if($iface eq $country) { | |
9877d28d | 177 | # iface matches country code |
fde47f5a AH |
178 | $log[$lines] = $_; |
179 | $lines++; | |
180 | } | |
181 | elsif($srcaddr ne '') { | |
9877d28d | 182 | # or srcaddr matches country code |
e4aac473 | 183 | my $ccode = $gi->country_code_by_name($srcaddr); |
f97c6774 | 184 | if($ccode eq uc($country)){ |
e4aac473 AH |
185 | $log[$lines] = $_; |
186 | $lines++; | |
187 | } | |
188 | } | |
9877d28d | 189 | } |
e4aac473 AH |
190 | } |
191 | close (FILE); | |
192 | } | |
193 | ||
194 | $skip=0; | |
195 | if ($multifile) { | |
196 | $datediff=$datediff-1; | |
197 | if ($datediff==0) { | |
198 | $filestr="/var/log/messages"; | |
199 | } else { | |
200 | $filestr="/var/log/messages.$datediff"; | |
201 | $filestr = "$filestr.gz" if -f "$filestr.gz"; | |
202 | } | |
203 | if (!(open (FILE,($filestr =~ /.gz$/ ? "gzip -dc $filestr |" : $filestr)))) { | |
204 | $errormessage="$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could not be opened'}"; | |
205 | $skip=1; | |
206 | } | |
207 | if (!$skip) { | |
208 | while (<FILE>) { | |
9877d28d ME |
209 | # Check if valid log line (date, day) |
210 | if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+ kernel:.*(IN=.*)$/) { | |
211 | my $iface = ''; | |
212 | # If ipv6 uses bridge, then use PHYSIN otherwise IN | |
1b5b6c91 | 213 | if ($_ =~ /PHYSIN=(\w+)/) { $iface = $1; } elsif ($_ =~ /IN=(\w+)/) { $iface = $1; } |
9877d28d ME |
214 | |
215 | if($iface eq $country) { | |
216 | # iface matches country code | |
217 | $log[$lines] = $_; | |
218 | $lines++; | |
219 | } | |
220 | # extract ipv4 and ipv6 address | |
221 | elsif (($_ =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { | |
222 | my $srcaddr=$1; | |
223 | my $ccode = $gi->country_code_by_name($srcaddr); | |
f97c6774 | 224 | if($ccode eq uc($country)){ |
9877d28d | 225 | # or srcaddr matches country code |
e4aac473 AH |
226 | $log[$lines] = $_; |
227 | $lines++; | |
9877d28d | 228 | } |
e4aac473 | 229 | } |
9877d28d | 230 | } |
e4aac473 AH |
231 | } |
232 | close (FILE); | |
233 | } | |
234 | } | |
235 | ||
236 | &Header::showhttpheaders(); | |
237 | &Header::openpage($Lang::tr{'firewall log'}, 1, ''); | |
238 | &Header::openbigbox('100%', 'left', '', $errormessage); | |
239 | ||
240 | if ($errormessage) { | |
241 | &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); | |
242 | print "<font class='base'>$errormessage </font>\n"; | |
243 | &Header::closebox(); | |
244 | } | |
245 | ||
246 | &Header::openbox('100%', 'left', "$Lang::tr{'settings'}:"); | |
247 | ||
248 | print <<END | |
249 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> | |
250 | <table width='100%'> | |
251 | <tr> | |
252 | <td width='10%' class='base'>$Lang::tr{'month'}: </td> | |
253 | <td width='10%'> | |
254 | <select name='MONTH'> | |
255 | END | |
256 | ; | |
257 | my $month; | |
258 | for ($month = 0; $month < 12; $month++) | |
259 | { | |
260 | print "\t<option "; | |
261 | if ($month == $cgiparams{'MONTH'}) { | |
262 | print "selected='selected' "; } | |
263 | print "value='$month'>$longmonths[$month]</option>\n"; | |
264 | } | |
265 | print <<END | |
266 | </select> | |
267 | </td> | |
268 | <td width='10%' class='base' align='right'> $Lang::tr{'day'}: </td> | |
269 | <td width='40%'> | |
270 | <select name='DAY'> | |
271 | END | |
272 | ; | |
273 | for ($day = 1; $day <= 31; $day++) | |
274 | { | |
275 | print "\t<option "; | |
276 | if ($day == $cgiparams{'DAY'}) { | |
277 | print "selected='selected' "; } | |
278 | print "value='$day'>$day</option>\n"; | |
279 | } | |
280 | print <<END | |
281 | </select> | |
282 | </td> | |
283 | <td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day before'}' value='<<' /></td> | |
284 | <td width='5%' align='center'><input type='submit' name='ACTION' title='$Lang::tr{'day after'}' value='>>' /></td> | |
285 | <td width='10%' align='center'><input type='submit' name='ACTION' value='$Lang::tr{'update'}' /></td> | |
bde7a7d2 | 286 | <tr><td width='15%'>$Lang::tr{'source ip country'}</td><td><input type='text' name='country' value='$cgiparams{country}'size='15'></td></tr> |
e4aac473 AH |
287 | </tr> |
288 | </table> | |
289 | </form> | |
290 | END | |
291 | ; | |
292 | ||
293 | &Header::closebox(); | |
294 | ||
295 | &Header::openbox('100%', 'left', $Lang::tr{'firewall log'}); | |
296 | print "<p><b>$Lang::tr{'firewall hits'} $longmonthstr $daystr: $lines</b></p>"; | |
297 | ||
298 | if ($start == -1) { | |
299 | $start = $lines - ${Header::viewsize}; } | |
300 | if ($start >= $lines - ${Header::viewsize}) { $start = $lines - ${Header::viewsize}; }; | |
301 | if ($start < 0) { $start = 0; } | |
302 | ||
303 | my $prev = $start - ${Header::viewsize}; | |
304 | my $next = $start + ${Header::viewsize}; | |
305 | ||
306 | if ($prev < 0) { $prev = 0; } | |
307 | if ($next >= $lines) { $next = -1 } | |
308 | if ($start == 0) { $prev = -1; } | |
309 | ||
310 | if ($lines != 0) { &oldernewer(); } | |
311 | ||
312 | print <<END | |
bde7a7d2 AH |
313 | <table width='100%'> |
314 | <tr> | |
315 | <td width='10%' align='center' class='boldbase'><b>$Lang::tr{'time'}</b></td> | |
316 | <td width='13%' align='center' class='boldbase'><b>$Lang::tr{'chain'}</b></td> | |
317 | <td width='5%' align='center' class='boldbase'><b>$Lang::tr{'iface'}</b></td> | |
318 | <td width='5%' align='center' class='boldbase'><b>$Lang::tr{'proto'}</b></td> | |
319 | <td width='16%' align='center' class='boldbase'><b>$Lang::tr{'source'}</b></td> | |
320 | <td width='10%' align='center' class='boldbase'><b>$Lang::tr{'src port'}</b></td> | |
321 | <td width='16%' align='center' class='boldbase'><b>$Lang::tr{'destination'}</b></td> | |
322 | <td width='16%' align='center' class='boldbase'><b>$Lang::tr{'dst port'}</b></td> | |
323 | </tr> | |
e4aac473 AH |
324 | END |
325 | ; | |
326 | ||
327 | my @slice = splice(@log, $start, ${Header::viewsize}); | |
328 | ||
329 | if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @slice = reverse @slice; } | |
330 | ||
331 | $lines = 0; | |
332 | foreach $_ (@slice) | |
333 | { | |
334 | $a = $_; | |
9877d28d | 335 | # If ipv6 uses bridge, use PHYSIN otherwise use IN |
1b5b6c91 | 336 | if (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(PHYSIN=.*)$/) {} |
9877d28d | 337 | elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {}; |
fde47f5a | 338 | my $packet = $4; |
9877d28d ME |
339 | my $iface = ''; |
340 | # If ipv6 uses bridge, use PHYSIN otherwise use IN | |
1b5b6c91 ME |
341 | if ($packet =~ /PHYSIN=(\w+)/) { $iface = $1; } elsif ($packet =~ /IN=(\w+)/) { $iface = $1; } |
342 | if ( $1 =~ /2./ ){ $iface=""; } | |
9877d28d ME |
343 | my $srcaddr = ''; |
344 | # Extract ipv4 and ipv6 addresses | |
345 | if (($packet =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($packet =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { | |
1b5b6c91 | 346 | $srcaddr = $1; |
9877d28d | 347 | }; |
fde47f5a AH |
348 | |
349 | if($iface eq $country || $srcaddr ne '') { | |
9877d28d | 350 | my $ccode=''; |
fde47f5a AH |
351 | if($iface ne $country) { |
352 | $ccode = $gi->country_code_by_name($srcaddr); | |
353 | } | |
f97c6774 | 354 | if($iface eq $country || $ccode eq uc($country)) { |
9877d28d | 355 | my $chain = ''; |
bde7a7d2 AH |
356 | my $in = '-'; my $out = '-'; |
357 | my $srcaddr = ''; my $dstaddr = ''; | |
358 | my $protostr = ''; | |
359 | my $srcport = ''; my $dstport = ''; | |
360 | ||
9877d28d | 361 | # If ipv6 uses bridge, the use PHYSIN otherwise use IN |
1b5b6c91 | 362 | if ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)(PHYSIN=.*)$/) {} |
9877d28d | 363 | elsif ($_ =~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=.*)$/) {} |
bde7a7d2 AH |
364 | my $timestamp = $1; my $chain = $2; my $packet = $3; |
365 | $timestamp =~ /(...) (..) (..:..:..)/; | |
366 | my $month = $1; my $day = $2; my $time = $3; | |
367 | ||
9877d28d | 368 | # If ipv6 uses bridge, use PHYSIN and PHYSOUT, otherwise use IN and OUT |
1b5b6c91 ME |
369 | if ($a =~ /PHYSIN=(\w+)/) { $iface = $1; } elsif ($a =~ /IN=(\w+)/) { $iface = $1; } |
370 | if ($a =~ /PHYSOUT=(\w+)/) { $out = $1; } elsif ($a =~ /OUT=(\w+)/) { $out = $1; } | |
9877d28d ME |
371 | # Extract ipv4 and ipv6 addresses |
372 | if (($a =~ /SRC\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /SRC\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr = $1; } | |
373 | if (($a =~ /DST\=(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =~ /DST\=(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr = $1; } | |
bde7a7d2 AH |
374 | if ($a =~ /PROTO\=(\w+)/) { $protostr = $1; } |
375 | my $protostrlc = lc($protostr); | |
376 | if ($a =~ /SPT\=([\d\.]+)/){ $srcport = $1; } | |
377 | if ($a =~ /DPT\=([\d\.]+)/){ $dstport = $1; } | |
378 | ||
379 | if ($lines % 2) { | |
380 | print "<tr bgcolor='${Header::table1colour}'>\n"; } | |
381 | else { | |
382 | print "<tr bgcolor='${Header::table2colour}'>\n"; } | |
383 | print <<END | |
384 | <td align='center'>$time</td> | |
385 | <td align='center'>$chain</td> | |
386 | <td align='center'>$iface</td> | |
387 | <td align='center'>$protostr</td> | |
388 | <td align='center'> | |
389 | <table width='100%' cellpadding='0' cellspacing='0'><tr> | |
390 | <td align='center'><a href='/cgi-bin/ipinfo.cgi?ip=$srcaddr'>$srcaddr</a></td> | |
391 | </tr></table> | |
392 | </td> | |
393 | <td align='center'>$srcport</td> | |
394 | <td align='center'> | |
395 | <table width='100%' cellpadding='0' cellspacing='0'><tr> | |
396 | <td align='center'><a href='/cgi-bin/ipinfo.cgi?ip=$dstaddr'>$dstaddr</a></td> | |
397 | </tr></table> | |
398 | </td> | |
399 | <td align='center'>$dstport</td> | |
400 | </tr> | |
e4aac473 AH |
401 | END |
402 | ; | |
bde7a7d2 | 403 | $lines++; |
e4aac473 AH |
404 | } |
405 | } | |
406 | } | |
407 | ||
408 | print <<END | |
bde7a7d2 | 409 | </table> |
e4aac473 AH |
410 | END |
411 | ; | |
412 | ||
413 | &oldernewer(); | |
414 | ||
415 | &Header::closebox(); | |
416 | ||
417 | &Header::closebigbox(); | |
418 | ||
419 | &Header::closepage(); | |
420 | ||
421 | sub oldernewer | |
422 | { | |
bde7a7d2 AH |
423 | print <<END |
424 | <table width='100%'> | |
425 | <tr> | |
e4aac473 AH |
426 | END |
427 | ; | |
428 | ||
bde7a7d2 AH |
429 | print "<td align='center' width='50%'>"; |
430 | if ($prev != -1) { | |
431 | print "<a href='/cgi-bin/logs.cgi/showrequestfromcountry.dat?$prev,$cgiparams{'MONTH'},$cgiparams{'DAY'},$cgiparams{country}'>$Lang::tr{'older'}</a>"; } | |
432 | else { | |
433 | print "$Lang::tr{'older'}"; } | |
434 | print "</td>\n"; | |
e4aac473 | 435 | |
bde7a7d2 AH |
436 | print "<td align='center' width='50%'>"; |
437 | if ($next != -1) { | |
438 | print "<a href='/cgi-bin/logs.cgi/showrequestfromcountry.dat?$next,$cgiparams{'MONTH'},$cgiparams{'DAY'},$cgiparams{country}'>$Lang::tr{'newer'}</a>"; } | |
439 | else { | |
440 | print "$Lang::tr{'newer'}"; } | |
441 | print "</td>\n"; | |
e4aac473 AH |
442 | |
443 | print <<END | |
bde7a7d2 AH |
444 | </tr> |
445 | </table> | |
e4aac473 AH |
446 | END |
447 | ; | |
448 | } | |
bde7a7d2 | 449 |