]>
git.ipfire.org Git - ipfire-2.x.git/blob - html/cgi-bin/connections.cgi
3 # (c) 2001 Jack Beglinger <jackb_guppy@yahoo.com>
5 # (c) 2003 Dave Roberts <countzerouk@hotmail.com> - colour coded netfilter/iptables rewrite for 1.3
7 # (c) 2006 Franck - add sorting+filtering capability
10 # Setup GREEN, ORANGE, IPFIRE, VPN CIDR networks, masklengths and colours only once
16 use Net
::IPv4Addr
qw( :all );
20 # enable only the following on debugging purpose
22 use CGI
::Carp
'fatalsToBrowser';
24 require '/var/ipfire/general-functions.pl';
25 require "${General::swroot}/lang.pl";
26 require "${General::swroot}/header.pl";
28 #workaround to suppress a warning when a variable is used only once
29 my @dummy = ( ${Header
::table1colour
} );
35 &General
::readhash
("${General::swroot}/ethernet/settings", \
%netsettings);
37 open (ACTIVE
, "/proc/net/ip_conntrack") or die 'Unable to open ip_conntrack';
38 my @active = <ACTIVE
>;
42 open (ACTIVE
, "/proc/net/ipsec_eroute") and @vpn = <ACTIVE
>;
45 my $aliasfile = "${General::swroot}/ethernet/aliases";
46 open(ALIASES
, $aliasfile) or die 'Unable to open aliases file.';
47 my @aliases = <ALIASES
>;
50 # Add Green Firewall Interface
51 push(@network, $netsettings{'GREEN_ADDRESS'});
52 push(@masklen, "255.255.255.255" );
53 push(@colour, ${Header
::colourfw
} );
55 # Add Green Network to Array
56 push(@network, $netsettings{'GREEN_NETADDRESS'});
57 push(@masklen, $netsettings{'GREEN_NETMASK'} );
58 push(@colour, ${Header
::colourgreen
} );
60 # Add Green Routes to Array
61 my @routes = `/sbin/route -n | /bin/grep $netsettings{'GREEN_DEV'}`;
62 foreach my $route (@routes) {
64 my @temp = split(/[\t ]+/, $route);
65 push(@network, $temp[0]);
66 push(@masklen, $temp[2]);
67 push(@colour, ${Header
::colourgreen
} );
70 # Add Firewall Localhost 127.0.0.1
71 push(@network, '127.0.0.1');
72 push(@masklen, '255.255.255.255' );
73 push(@colour, ${Header
::colourfw
} );
76 if ($netsettings{'ORANGE_DEV'}) {
77 push(@network, $netsettings{'ORANGE_NETADDRESS'});
78 push(@masklen, $netsettings{'ORANGE_NETMASK'} );
79 push(@colour, ${Header
::colourorange
} );
80 # Add Orange Routes to Array
81 @routes = `/sbin/route -n | /bin/grep $netsettings{'ORANGE_DEV'}`;
82 foreach my $route (@routes) {
84 my @temp = split(/[\t ]+/, $route);
85 push(@network, $temp[0]);
86 push(@masklen, $temp[2]);
87 push(@colour, ${Header
::colourorange
} );
92 if ($netsettings{'BLUE_DEV'}) {
93 push(@network, $netsettings{'BLUE_NETADDRESS'});
94 push(@masklen, $netsettings{'BLUE_NETMASK'} );
95 push(@colour, ${Header
::colourblue
} );
96 # Add Blue Routes to Array
97 @routes = `/sbin/route -n | /bin/grep $netsettings{'BLUE_DEV'}`;
98 foreach my $route (@routes) {
100 my @temp = split(/[\t ]+/, $route);
101 push(@network, $temp[0]);
102 push(@masklen, $temp[2]);
103 push(@colour, ${Header
::colourblue
} );
107 # Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate)
108 if (-e
"${General::swroot}/ovpn/settings") {
109 my %ovpnsettings = ();
110 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
111 my @tempovpnsubnet = split("\/",$ovpnsettings{'DOVPN_SUBNET'});
114 push(@network, $tempovpnsubnet[0]);
115 push(@masklen, $tempovpnsubnet[1]);
116 push(@colour, ${Header
::colourovpn
} );
118 if ( ($ovpnsettings{'ENABLED'} eq 'on') && open(IP
, "${General::swroot}/red/local-ipaddress") ) {
119 # add RED:port / proto
123 push(@network, $redip );
124 push(@masklen, '255.255.255.255' );
125 push(@colour, ${Header
::colourovpn
} );
127 if ( ($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'} ) {
128 # add BLUE:port / proto
129 push(@network, $netsettings{'BLUE_ADDRESS'} );
130 push(@masklen, '255.255.255.255' );
131 push(@colour, ${Header
::colourovpn
} );
133 if ( ($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'} ) {
134 # add ORANGE:port / proto
135 push(@network, $netsettings{'ORANGE_ADDRESS'} );
136 push(@masklen, '255.255.255.255' );
137 push(@colour, ${Header
::colourovpn
} );
141 # Add STATIC RED aliases
142 if ($netsettings{'RED_DEV'}) {
143 # We have a RED eth iface
144 if ($netsettings{'RED_TYPE'} eq 'STATIC') {
145 # We have a STATIC RED eth iface
146 foreach my $line (@aliases)
149 my @temp = split(/\,/,$line);
151 push(@network, $temp[0]);
152 push(@masklen, $netsettings{'RED_NETMASK'} );
153 push(@colour, ${Header
::colourfw
} );
160 if ( $vpn[0] ne 'none' ) {
161 foreach my $line (@vpn) {
162 my @temp = split(/[\t ]+/,$line);
163 my @temp1 = split(/[\/:]+/,$temp[3]);
164 push(@network, $temp1[0]);
165 push(@masklen, ipv4_cidr2msk
($temp1[1]));
166 push(@colour, ${Header
::colourvpn
} );
169 if (open(IP
, "${General::swroot}/red/local-ipaddress")) {
173 push(@network, $redip);
174 push(@masklen, '255.255.255.255' );
175 push(@colour, ${Header
::colourfw
} );
179 #Establish simple filtering&sorting boxes on top of table
182 &Header
::getcgihash
(\
%cgiparams);
184 my @list_proto = ($Lang::tr
{'all'}, 'icmp', 'udp', 'tcp');
185 my @list_state = ($Lang::tr
{'all'}, 'SYN_SENT', 'SYN_RECV', 'ESTABLISHED', 'FIN_WAIT',
186 'CLOSE_WAIT', 'LAST_ACK', 'TIME_WAIT', 'CLOSE', 'LISTEN');
187 my @list_mark = ($Lang::tr
{'all'}, '[ASSURED]', '[UNREPLIED]');
188 my @list_sort = ('orgsip','protocol', 'expires', 'status', 'orgdip', 'orgsp',
189 'orgdp', 'exsip', 'exdip', 'exsp', 'exdp', 'marked');
191 # init or silently correct unknown value...
192 if ( ! grep ( /^$cgiparams{'SEE_PROTO'}$/ , @list_proto )) { $cgiparams{'SEE_PROTO'} = $list_proto[0] };
193 if ( ! grep ( /^$cgiparams{'SEE_STATE'}$/ , @list_state )) { $cgiparams{'SEE_STATE'} = $list_state[0] };
194 if ( ($cgiparams{'SEE_MARK'} ne $Lang::tr
{'all'}) && # ok the grep should work but it doesn't because of
195 ($cgiparams{'SEE_MARK'} ne '[ASSURED]') && # the '[' & ']' interpreted as list separator.
196 ($cgiparams{'SEE_MARK'} ne '[UNREPLIED]') # So, explicitly enumerate items.
197 ) { $cgiparams{'SEE_MARK'} = $list_mark[0] };
198 if ( ! grep ( /^$cgiparams{'SEE_SORT'}$/ , @list_sort )) { $cgiparams{'SEE_SORT'} = $list_sort[0] };
199 # *.*.*.* or a valid IP
200 if ( $cgiparams{'SEE_SRC'} !~ /^(\*\.\*\.\*\.\*\.|\d+\.\d+\.\d+\.\d+)$/) { $cgiparams{'SEE_SRC'} = '*.*.*.*' };
201 if ( $cgiparams{'SEE_DEST'} !~ /^(\*\.\*\.\*\.\*\.|\d+\.\d+\.\d+\.\d+)$/) { $cgiparams{'SEE_DEST'} = '*.*.*.*' };
204 our %entries = (); # will hold the lines analyzed correctly
205 my $unknownlines = ''; # should be empty all the time...
206 my $index = 0; # just a counter to make unique entryies in entries
208 foreach my $line (@active) {
224 my @temp = split(' ',$line);
226 if ($temp[0] eq 'icmp') {
227 $protocol = $temp[0];
228 $status = $Lang::tr
{'all'};
229 $orgsip = substr $temp[3], 4;
230 $orgdip = substr $temp[4], 4;
231 $marked = $temp[8] eq '[UNREPLIED]' ?
'[UNREPLIED]' : ' ';
233 if ($temp[0] eq 'udp') {
234 $protocol = $temp[0];
235 $status = $Lang::tr
{'all'};
236 $orgsip = substr $temp[3], 4;
237 $orgdip = substr $temp[4], 4;
238 $marked = $temp[7] eq '[UNREPLIED]' ?
'[UNREPLIED]' : defined ($temp[12]) ?
$temp[11] : ' ';
240 if ($temp[0] eq 'tcp') {
241 $protocol = $temp[0];
243 $orgsip = substr $temp[4], 4;
244 $orgdip = substr $temp[5], 4;
245 $marked = $temp[8] eq '[UNREPLIED]' ?
'[UNREPLIED]' : defined ($temp[13]) ?
$temp[12] : ' ';
248 # filter the line if we found a known proto
250 (($cgiparams{'SEE_PROTO'} eq $Lang::tr
{'all'}) || ($protocol eq $cgiparams{'SEE_PROTO'} ))
251 && (($cgiparams{'SEE_STATE'} eq $Lang::tr
{'all'}) || ($status eq $cgiparams{'SEE_STATE'} ))
252 && (($cgiparams{'SEE_MARK'} eq $Lang::tr
{'all'}) || ($marked eq $cgiparams{'SEE_MARK'} ))
253 && (($cgiparams{'SEE_SRC'} eq "*.*.*.*") || ($orgsip eq $cgiparams{'SEE_SRC'} ))
254 && (($cgiparams{'SEE_DEST'} eq "*.*.*.*") || ($orgdip eq $cgiparams{'SEE_DEST'} ))
257 if ($temp[0] eq 'icmp') {
259 $protocol = $temp[0] . " (" . $temp[1] . ")";
262 if ($temp[8] eq '[UNREPLIED]' ) {
265 $orgsip = substr $temp[3], 4;
266 $orgdip = substr $temp[4], 4;
267 $orgsp = &General
::GetIcmpDescription
(substr( $temp[5], 5)) . "/" . substr( $temp[6], 5);;
268 $orgdp = 'id=' . substr( $temp[7], 3);
269 $exsip = substr $temp[8 + $offset], 4;
270 $exdip = substr $temp[9 + $offset], 4;
271 $exsp = &General
::GetIcmpDescription
(substr( $temp[10 + $offset], 5)). "/" . substr( $temp[11 + $offset], 5);
272 $exdp = 'id=' . substr( $temp[11 + $offset], 5);
273 $marked = $temp[8] eq '[UNREPLIED]' ?
'[UNREPLIED]' : ' ';
274 $use = substr( $temp[13 + $offset], 4 );
276 if ($temp[0] eq 'udp') {
279 $protocol = $temp[0] . " (" . $temp[1] . ")";
282 $orgsip = substr $temp[3], 4;
283 $orgdip = substr $temp[4], 4;
284 $orgsp = substr $temp[5], 6;
285 $orgdp = substr $temp[6], 6;
286 if ($temp[7] eq '[UNREPLIED]') {
289 $use = substr $temp[12], 4;
291 if ((substr $temp[11], 0, 3) eq 'use' ) {
293 $use = substr $temp[11], 4;
296 $use = substr $temp[12], 4;
299 $exsip = substr $temp[7 + $offset], 4;
300 $exdip = substr $temp[8 + $offset], 4;
301 $exsp = substr $temp[9 + $offset], 6;
302 $exdp = substr $temp[10 + $offset], 6;
304 if ($temp[0] eq 'tcp') {
306 $protocol = $temp[0] . " (" . $temp[1] . ")";
309 $orgsip = substr $temp[4], 4;
310 $orgdip = substr $temp[5], 4;
311 $orgsp = substr $temp[6], 6;
312 $orgdp = substr $temp[7], 6;
313 if ($temp[8] eq '[UNREPLIED]') {
319 $exsip = substr $temp[8 + $offset], 4;
320 $exdip = substr $temp[9 + $offset], 4;
321 $exsp = substr $temp[10 + $offset], 6;
322 $exdp = substr $temp[11 + $offset], 6;
323 $use = substr $temp[13], 4;
325 if ($temp[0] eq 'unknown') {
327 $protocol = "??? (" . $temp[1] . ")";
328 $protocol = "esp (" . $temp[1] . ")" if ($temp[1] == 50);
329 $protocol = "ah (" . $temp[1] . ")" if ($temp[1] == 51);
332 $orgsip = substr $temp[3], 4;
333 $orgdip = substr $temp[4], 4;
336 $exsip = substr $temp[5], 4;
337 $exdip = substr $temp[6], 4;
343 if ($temp[0] eq 'gre') {
345 $protocol = $temp[0] . " (" . $temp[1] . ")";
347 $orgsip = substr $temp[5], 4;
348 $orgdip = substr $temp[6], 4;
351 $exsip = substr $temp[11], 4;
352 $exdip = substr $temp[12], 4;
358 # Only from this point, lines have the same known format/field
359 # The floating fields [UNREPLIED] [ASSURED] etc are ok.
361 # Store the line in a hash array for sorting
362 if ( $protocol ) { # line is decoded ?
363 my @record = ( 'index', $index++,
364 'protocol', $protocol,
377 my $record = {}; # create a reference to empty hash
378 %{$record} = @record; # populate that hash with @record
379 $entries{$record->{index}} = $record; # add this to a hash of hashes
380 } else { # it was not a known line
381 $unknownlines .= "<tr bgcolor='${Header::table1colour}'>";
382 $unknownlines .= "<td colspan='9'> unknown:$line></td></tr>";
386 # Build listbox objects
387 my $menu_proto = &make_select
('SEE_PROTO', $cgiparams{'SEE_PROTO'}, @list_proto);
388 my $menu_state = &make_select
('SEE_STATE', $cgiparams{'SEE_STATE'}, @list_state);
389 my $menu_src = &make_select
('SEE_SRC', $cgiparams{'SEE_SRC'}, &get_known_ips
('orgsip'));
390 my $menu_dest = &make_select
('SEE_DEST', $cgiparams{'SEE_DEST'}, &get_known_ips
('orgdip'));
391 my $menu_mark = &make_select
('SEE_MARK', $cgiparams{'SEE_MARK'}, @list_mark);
392 my $menu_sort = &make_select
('SEE_SORT', $cgiparams{'SEE_SORT'}, @list_sort);
394 &Header
::showhttpheaders
();
395 &Header
::openpage
($Lang::tr
{'connections'}, 1, '');
396 &Header
::openbigbox
('100%', 'left');
397 &Header
::openbox
('100%', 'left', $Lang::tr
{'connection tracking'});
400 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
402 <tr><td align='center'><b>$Lang::tr{'legend'} : </b></td>
403 <td align='center' bgcolor='${Header::colourgreen}'><b><font color='#FFFFFF'>$Lang::tr{'lan'}</font></b></td>
404 <td align='center' bgcolor='${Header::colourred}'><b><font color='#FFFFFF'>$Lang::tr{'internet'}</font></b></td>
405 <td align='center' bgcolor='${Header::colourorange}'><b><font color='#FFFFFF'>$Lang::tr{'dmz'}</font></b></td>
406 <td align='center' bgcolor='${Header::colourblue}'><b><font color='#FFFFFF'>$Lang::tr{'wireless'}</font></b></td>
407 <td align='center' bgcolor='${Header::colourfw}'><b><font color='#FFFFFF'>IPFire</font></b></td>
408 <td align='center' bgcolor='${Header::colourvpn}'><b><font color='#FFFFFF'>$Lang::tr{'vpn'}</font></b></td>
409 <td align='center' bgcolor='${Header::colourovpn}'><b><font color='#FFFFFF'>$Lang::tr{'OpenVPN'}</font></b></td>
413 <table cellpadding='2'>
414 <tr><td align='center'><b>$Lang::tr{'protocol'}</b></td>
415 <td align='center'><b>$Lang::tr{'expires'}<br />($Lang::tr{'seconds'})</b></td>
416 <td align='center'><b>$Lang::tr{'connection'}<br />$Lang::tr{'status'}</b></td>
417 <td align='center'><b>$Lang::tr{'original'}<br />$Lang::tr{'source ip and port'}</b></td>
418 <td align='center'><b>$Lang::tr{'original'}<br />$Lang::tr{'dest ip and port'}</b></td>
419 <td align='center'><b>$Lang::tr{'expected'}<br />$Lang::tr{'source ip and port'}</b></td>
420 <td align='center'><b>$Lang::tr{'expected'}<br />$Lang::tr{'dest ip and port'}</b></td>
421 <td align='center'><b>$Lang::tr{'marked'}</b></td>
422 <td align='center'><b>$Lang::tr{'use'}</b></td>
425 <td align='center'>$menu_proto</td>
427 <td align='center'>$menu_state</td>
428 <td align='center'>$menu_src</td>
429 <td align='center'>$menu_dest</td>
430 <td align='center'colspan='2'>$Lang::tr{'sort ascending'}:$menu_sort </td>
431 <td align='center'>$menu_mark</td>
432 <td align='center'><input type='submit' value='!' /></td>
437 foreach my $entry (sort sort_entries
keys %entries) {
438 my $orgsipcolour = &ipcolour
( $entries{$entry}->{orgsip
} );
439 my $orgdipcolour = &ipcolour
( $entries{$entry}->{orgdip
} );
440 my $exsipcolour = &ipcolour
( $entries{$entry}->{exsip
} );
441 my $exdipcolour = &ipcolour
( $entries{$entry}->{exdip
} );
443 <tr bgcolor='${Header::table1colour}'>
444 <td align='center'>$entries{$entry}->{protocol}</td>
445 <td align='center'>$entries{$entry}->{expires}</td>
446 <td align='center'>$entries{$entry}->{status}</td>
447 <td align='center' bgcolor='$orgsipcolour'>
448 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{orgsip}'>
449 <font color='#FFFFFF'>$entries{$entry}->{orgsip}</font>
450 </a><font color='#FFFFFF'>:$entries{$entry}->{orgsp}</font></td>
451 <td align='center' bgcolor='$orgdipcolour'>
452 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{orgdip}'>
453 <font color='#FFFFFF'>$entries{$entry}->{orgdip}</font>
454 </a><font color='#FFFFFF'>:$entries{$entry}->{orgdp}</font></td>
455 <td align='center' bgcolor='$exsipcolour'>
456 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{exsip}'>
457 <font color='#FFFFFF'>$entries{$entry}->{exsip}</font>
458 </a><font color='#FFFFFF'>:$entries{$entry}->{exsp}</font></td>
459 <td align='center' bgcolor='$exdipcolour'>
460 <a href='/cgi-bin/ipinfo.cgi?ip=$entries{$entry}->{exdip}'>
461 <font color='#FFFFFF'>$entries{$entry}->{exdip}</font>
462 </a><font color='#FFFFFF'>:$entries{$entry}->{exdp}</font></td>
463 <td align='center'>$entries{$entry}->{marked}</td>
464 <td align='center'>$entries{$entry}->{use}</td>
470 print "$unknownlines</table></form>";
473 &Header
::closebigbox
();
474 &Header
::closepage
();
479 my $colour = ${Header
::colourred
};
482 foreach $line (@network) {
483 if (!$found && ipv4_in_network
( $network[$id] , $masklen[$id], $ip) ) {
485 $colour = $colour[$id];
492 # Create a string containing a complete SELECT html object
494 # param2: current value selected
496 sub make_select
($,$,$) {
497 my $select_name = shift;
498 my $selected = shift;
499 my $select = "<select name='$select_name'>";
501 foreach my $value (@_) {
502 my $check = $selected eq $value ?
"selected='selected'" : '';
503 $select .= "<option $check value='$value'>$value</option>";
505 $select .= "</select>";
509 # Build a list of IP obtained from the %entries hash
510 # param1: IP field name
511 sub get_known_ips
($) {
513 my $qs = $cgiparams{'SEE_SORT'}; # switch the sort order
514 $cgiparams{'SEE_SORT'} = $field;
516 my @liste=('*.*.*.*');
517 foreach my $entry ( sort sort_entries
keys %entries) {
518 push (@liste, $entries{$entry}->{$field}) if (! grep (/^$entries{$entry}->{$field}$/,@liste) );
521 $cgiparams{'SEE_SORT'} = $qs; #restore sort order
525 # Used to sort the table containing the lines displayed.
526 sub sort_entries
{ #Reverse is not implemented
527 my $qs=$cgiparams{'SEE_SORT'};
528 if ($qs =~ /orgsip|orgdip|exsip|exdip/) {
529 my @a = split(/\./,$entries{$a}->{$qs});
530 my @b = split(/\./,$entries{$b}->{$qs});
535 } elsif ($qs =~ /expire|orgsp|orgdp|exsp|exdp/) {
536 $entries{$a}->{$qs} <=> $entries{$b}->{$qs};
538 $entries{$a}->{$qs} cmp $entries{$b}->{$qs};