html/cgi-bin/guardian.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2016  IPFire Team  <info@ipfire.org>                          #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Guardian::Socket;
  24
  25 # enable only the following on debugging purpose
  26 #use warnings;
  27 #use CGI::Carp 'fatalsToBrowser';
  28
  29 require '/var/ipfire/general-functions.pl';
  30 require "${General::swroot}/lang.pl";
  31 require "${General::swroot}/header.pl";
  32
  33 #workaround to suppress a warning when a variable is used only once
  34 my @dummy = (
  35         ${Header::colourred},
  36         ${Header::colourgreen}
  37 );
  38
  39 undef (@dummy);
  40
  41 my $string=();
  42 my $memory=();
  43 my @memory=();
  44 my @pid=();
  45 my @guardian=();
  46
  47 # Path to the guardian.ignore file.
  48 my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
  49
  50 # Hash which contains the supported modules and the
  51 # file locations on IPFire systems.
  52 my %module_file_locations = (
  53         "HTTPD" => "/var/log/httpd/error_log",
  54         "SSH" => "/var/log/messages",
  55 );
  56
  57 our %netsettings = ();
  58 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  59
  60 our %color = ();
  61 our %mainsettings = ();
  62 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  63 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  64
  65 # File declarations.
  66 my $settingsfile = "${General::swroot}/guardian/settings";
  67 my $ignoredfile = "${General::swroot}/guardian/ignored";
  68
  69 # Create empty settings and ignoredfile if they do not exist yet.
  70 unless (-e "$settingsfile") { system("touch $settingsfile"); }
  71 unless (-e "$ignoredfile") { system("touch $ignoredfile"); }
  72
  73 our %settings = ();
  74 our %ignored  = ();
  75
  76 $settings{'ACTION'} = '';
  77
  78 $settings{'GUARDIAN_ENABLED'} = 'off';
  79 $settings{'GUARDIAN_MONITOR_SSH'} = 'on';
  80 $settings{'GUARDIAN_MONITOR_HTTPD'} = 'on';
  81 $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = '';
  82 $settings{'GUARDIAN_LOG_FACILITY'} = 'syslog';
  83 $settings{'GUARDIAN_LOGLEVEL'} = 'info';
  84 $settings{'GUARDIAN_BLOCKCOUNT'} = '3';
  85 $settings{'GUARDIAN_BLOCKTIME'} = '86400';
  86 $settings{'GUARDIAN_FIREWALL_ACTION'} = 'DROP';
  87 $settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
  88
  89 my $errormessage = '';
  90
  91 &Header::showhttpheaders();
  92
  93 # Get GUI values.
  94 &Header::getcgihash(\%settings);
  95
  96 # Check if guardian is running and grab some stats.
  97 &daemonstats();
  98 my $pid = $pid[0];
  99
 100 ## Perform input checks and save settings.
 101 #
 102 if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
 103         # Check for valid blocktime.
 104         unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
 105                         $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
 106         }
 107
 108         # Check if the blockcount is valid.
 109         unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
 110                         $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
 111         }
 112
 113         # Check Logfile.
 114         unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
 115                 $errormessage = "$Lang::tr{'guardian invalid logfile'}";
 116         }
 117
 118         # Only continue if no error message has been set.
 119         if($errormessage eq '') {
 120                 # Write configuration settings to file.
 121                 &General::writehash("${General::swroot}/guardian/settings", \%settings);
 122
 123                 # Update configuration files.
 124                 &BuildConfiguration();
 125         }
 126
 127 ## Add/edit an entry to the ignore file.
 128 #
 129 } elsif (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang::tr{'update'})) {
 130
 131         # Check if any input has been performed.
 132         if ($settings{'IGNORE_ENTRY_ADDRESS'} ne '') {
 133
 134                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 135                 if ((!&General::validip($settings{'IGNORE_ENTRY_ADDRESS'})) && (!&General::validipandmask($settings{'IGNORE_ENTRY_ADDRESS'}))) {
 136                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 137                 }
 138         } else {
 139                 $errormessage = "$Lang::tr{'guardian empty input'}";
 140         }
 141
 142         # Go further if there was no error.
 143         if ($errormessage eq '') {
 144                 my %ignored = ();
 145                 my $id;
 146                 my $status;
 147
 148                 # Assign hash values.
 149                 my $new_entry_address = $settings{'IGNORE_ENTRY_ADDRESS'};
 150                 my $new_entry_remark = $settings{'IGNORE_ENTRY_REMARK'};
 151
 152                 # Read-in ignoredfile.
 153                 &General::readhasharray($ignoredfile, \%ignored);
 154
 155                 # Check if we should edit an existing entry and got an ID.
 156                 if (($settings{'ACTION'} eq $Lang::tr{'update'}) && ($settings{'ID'})) {
 157                         # Assin the provided id.
 158                         $id = $settings{'ID'};
 159
 160                         # Undef the given ID.
 161                         undef($settings{'ID'});
 162
 163                         # Grab the configured status of the corresponding entry.
 164                         $status = $ignored{$id}[2];
 165                 } else {
 166                         # Each newly added entry automatically should be enabled.
 167                         $status = "enabled";
 168
 169                         # Generate the ID for the new entry.
 170                         #
 171                         # Sort the keys by their ID and store them in an array.
 172                         my @keys = sort { $a <=> $b } keys %ignored;
 173
 174                         # Reverse the key array.
 175                         my @reversed = reverse(@keys);
 176
 177                         # Obtain the last used id.
 178                         my $last_id = @reversed[0];
 179
 180                         # Increase the last id by one and use it as id for the new entry.
 181                         $id = ++$last_id;
 182                 }
 183
 184                 # Add/Modify the entry to/in the ignored hash.
 185                 $ignored{$id} = ["$new_entry_address", "$new_entry_remark", "$status"];
 186
 187                 # Write the changed ignored hash to the ignored file.
 188                 &General::writehasharray($ignoredfile, \%ignored);
 189
 190                 # Regenerate the ignore file.
 191                 &GenerateIgnoreFile();
 192         }
 193
 194         # Check if guardian is running.
 195         if ($pid > 0) {
 196                 # Send reload command through socket connection.
 197                 &Guardian::Socket::Client("reload-ignore-list");
 198         }
 199
 200 ## Toggle Enabled/Disabled for an existing entry on the ignore list.
 201 #
 202
 203 } elsif ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
 204         my %ignored = ();
 205
 206         # Only go further, if an ID has been passed.
 207         if ($settings{'ID'}) {
 208                 # Assign the given ID.
 209                 my $id = $settings{'ID'};
 210
 211                 # Undef the given ID.
 212                 undef($settings{'ID'});
 213
 214                 # Read-in ignoredfile.
 215                 &General::readhasharray($ignoredfile, \%ignored);
 216
 217                 # Grab the configured status of the corresponding entry.
 218                 my $status = $ignored{$id}[2];
 219
 220                 # Switch the status.
 221                 if ($status eq "disabled") {
 222                         $status = "enabled";
 223                 } else {
 224                         $status = "disabled";
 225                 }
 226
 227                 # Modify the status of the existing entry.
 228                 $ignored{$id} = ["$ignored{$id}[0]", "$ignored{$id}[1]", "$status"];
 229
 230                 # Write the changed ignored hash to the ignored file.
 231                 &General::writehasharray($ignoredfile, \%ignored);
 232
 233                 # Regenerate the ignore file.
 234                 &GenerateIgnoreFile();
 235
 236                 # Check if guardian is running.
 237                 if ($pid > 0) {
 238                         # Send reload command through socket connection.
 239                         &Guardian::Socket::Client("reload-ignore-list");
 240                 }
 241         }
 242
 243 ## Remove entry from ignore list.
 244 #
 245 } elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
 246         my %ignored = ();
 247
 248         # Read-in ignoredfile.
 249         &General::readhasharray($ignoredfile, \%ignored);
 250
 251         # Drop entry from the hash.
 252         delete($ignored{$settings{'ID'}});
 253
 254         # Undef the given ID.
 255         undef($settings{'ID'});
 256
 257         # Write the changed ignored hash to the ignored file.
 258         &General::writehasharray($ignoredfile, \%ignored);
 259
 260         # Regenerate the ignore file.
 261         &GenerateIgnoreFile();
 262
 263         # Check if guardian is running.
 264         if ($pid > 0) {
 265                 # Send reload command through socket connection.
 266                 &Guardian::Socket::Client("reload-ignore-list");
 267         }
 268
 269 ## Block a user given address or subnet.
 270 #
 271 } elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
 272
 273         # Assign some temporary variables used for input validation.
 274         my $input = $settings{'ADDRESS_BLOCK'};
 275         my $green = $netsettings{'GREEN_ADDRESS'};
 276         my $blue = $netsettings{'BLUE_ADDRESS'};
 277         my $orange = $netsettings{'ORANGE_ADDRESS'};
 278         my $red = $netsettings{'RED_ADDRESS'};
 279
 280         # File declarations.
 281         my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
 282
 283         # Get gateway address.
 284         my $gateway = &General::grab_address_from_file($gatewayfile);
 285
 286         # Check if any input has been performed.
 287         if ($input eq '') {
 288                 $errormessage = "$Lang::tr{'guardian empty input'}";
 289         }
 290
 291         # Check if the given input is localhost (127.0.0.1).
 292         elsif ($input eq "127.0.0.1") {
 293                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 294         }
 295
 296         # Check if the given input is anywhere (0.0.0.0).
 297         elsif ($input eq "0.0.0.0") {
 298                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 299         }
 300
 301         # Check if the given input is one of the interface addresses or our gateway.
 302         elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
 303                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 304         }
 305
 306         # Check if the given input is a valid IP address.
 307         elsif (!&General::validip($input)) {
 308                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 309         }
 310
 311         # Go further if there was no error.
 312         if ($errormessage eq '') {
 313                 my $block = $settings{'ADDRESS_BLOCK'};
 314
 315                 # Send command to block the specified address through socket connection.
 316                 &Guardian::Socket::Client("block $block");
 317         }
 318
 319 ## Unblock address or subnet.
 320 #
 321 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
 322
 323         # Check if no empty input has been performed.
 324         if ($settings{'ADDRESS_UNBLOCK'} ne '') {
 325
 326                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 327                 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
 328                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 329                 }
 330
 331         } else {
 332                 $errormessage = "$Lang::tr{'guardian empty input'}";
 333         }
 334
 335         # Go further if there was no error.
 336         if ($errormessage eq '') {
 337                 my $unblock = $settings{'ADDRESS_UNBLOCK'};
 338
 339                 # Send command to unblock the given address through socket connection.
 340                 &Guardian::Socket::Client("unblock $unblock");
 341         }
 342
 343 ## Unblock all.
 344 #
 345 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
 346
 347         # Send flush command through socket connection.
 348         &Guardian::Socket::Client("flush");
 349 }
 350
 351 # Load settings from files.
 352 &General::readhash("${General::swroot}/guardian/settings", \%settings);
 353 &General::readhasharray("${General::swroot}/guardian/ignored", \%ignored);
 354
 355 # Call functions to generate whole page.
 356 &showMainBox();
 357 &showIgnoreBox();
 358
 359 # Display area only if guardian is running.
 360 if ( ($memory != 0) && ($pid > 0) ) {
 361         &showBlockedBox();
 362 }
 363
 364 # Function to display the status of guardian and allow base configuration.
 365 sub showMainBox() {
 366         my %checked = ();
 367         my %selected = ();
 368
 369         $checked{'GUARDIAN_ENABLED'}{'on'} = '';
 370         $checked{'GUARDIAN_ENABLED'}{'off'} = '';
 371         $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
 372         $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = '';
 373         $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = '';
 374         $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'";
 375         $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} = '';
 376         $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} = '';
 377         $checked{'GUARDIAN_MONITOR_HTTPD'}{$settings{'GUARDIAN_MONITOR_HTTPD'}} = "checked='checked'";
 378         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} = '';
 379         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} = '';
 380         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{$settings{'GUARDIAN_MONITOR_OWNCLOUD'}} = "checked='checked'";
 381
 382         $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected';
 383         $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
 384         $selected{'GUARDIAN_FIREWALL_ACTION'}{$settings{'GUARDIAN_FIREWALL_ACTION'}} = 'selected';
 385
 386         &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
 387         &Header::openbigbox('100%', 'left', '', $errormessage);
 388
 389         # Print errormessage if there is one.
 390         if ($errormessage) {
 391                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 392                 print "<font class='base'>$errormessage&nbsp;</font>\n";
 393                 &Header::closebox();
 394         }
 395
 396         ### Java Script ###
 397         print<<END;
 398         <script>
 399                 var update_options = function() {
 400
 401                         var logfacility = \$("#GUARDIAN_LOG_FACILITY").val();
 402                         var loglevel = \$("#GUARDIAN_LOGLEVEL").val();
 403
 404                         if (logfacility === undefined)
 405                                 return;
 406
 407                         if (loglevel === undefined)
 408                                 return;
 409
 410                         // Show / Hide input for specifying the path to the logfile.
 411                         if (logfacility === "file") {
 412                                 \$(".GUARDIAN_LOGFILE").show();
 413                         } else {
 414                                 \$(".GUARDIAN_LOGFILE").hide();
 415                         }
 416
 417                         // Show / Hide loglevel debug if the facility is set to syslog.
 418                         if (logfacility === "syslog") {
 419                                 \$("#loglevel_debug").hide();
 420                         } else {
 421                                 \$("#loglevel_debug").show();
 422                         }
 423
 424                         // Show / Hide logfacility syslog if the loglevel is set to debug.
 425                         if (loglevel === "debug") {
 426                                 \$("#logfacility_syslog").hide();
 427                         } else {
 428                                 \$("#logfacility_syslog").show();
 429                         }
 430                 };
 431
 432                 \$(document).ready(function() {
 433                         \$("#GUARDIAN_LOG_FACILITY").change(update_options);
 434                         \$("#GUARDIAN_LOGLEVEL").change(update_options);
 435                         update_options();
 436                 });
 437         </script>
 438 END
 439
 440
 441
 442         # Draw current guardian state.
 443         &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
 444
 445         # Get current status of guardian.
 446         &daemonstats();
 447         $pid = $pid[0];
 448
 449         # Display some useful information related to guardian, if daemon is running.
 450         if ( ($memory != 0) && ($pid > 0) ){
 451                 print <<END;
 452                         <table width='95%' cellspacing='0' class='tbl'>
 453                                 <tr>
 454                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 455                                 </tr>
 456                                 <tr>
 457                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 458                                         <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
 459                                 </tr>
 460                                 <tr>
 461                                         <td class='base'></td>
 462                                         <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
 463                                         <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
 464                                 </tr>
 465                                 <tr>
 466                                         <td class='base'></td>
 467                                         <td bgcolor='$color{'color22'}' align='center'>$pid</td>
 468                                         <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
 469                                 </tr>
 470                         </table>
 471 END
 472         } else {
 473                 # Otherwise display a hint that the service is not launched.
 474                 print <<END;
 475                         <table width='95%' cellspacing='0' class='tbl'>
 476                                 <tr>
 477                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 478                                 </tr>
 479                                 <tr>
 480                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 481                                         <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
 482                                 </tr>
 483                         </table>
 484 END
 485         }
 486
 487         &Header::closebox();
 488
 489         # Draw elements for guardian configuration.
 490         &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
 491
 492         print <<END;
 493                 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 494
 495                 <table width='95%'>
 496                         <tr>
 497                                 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
 498                         </tr>
 499
 500                         <tr>
 501                                 <td width='25%' class='base'>$Lang::tr{'guardian enabled'}:</td>
 502                                 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
 503                         </tr>
 504
 505                         <tr>
 506                                 <td colspan='2'><br></td>
 507                         </tr>
 508
 509                         <tr>
 510                                 <td width='25%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
 511                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> /
 512                                 <input type='radio' name='GUARDIAN_MONITOR_SSH' value='off' $checked{'GUARDIAN_MONITOR_SSH'}{'off'} /> off</td>
 513                         </tr>
 514
 515                         <tr>
 516                                 <td width='25%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
 517                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='on' $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} /> /
 518                                 <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='off' $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} /> off</td>
 519                         </tr>
 520
 521                         <tr>
 522                                 <td colspan='2'><br></td>
 523                         </tr>
 524
 525                         <tr>
 526                                 <td align='left' width='20%'>$Lang::tr{'guardian logfacility'}:</td>
 527                                 <td width='25%'><select id='GUARDIAN_LOG_FACILITY' name='GUARDIAN_LOG_FACILITY'>
 528                                         <option id='logfacility_syslog' value='syslog' $selected{'GUARDIAN_LOG_FACILITY'}{'syslog'}>$Lang::tr{'guardian logtarget_syslog'}</option>
 529                                         <option id='logfacility_file' value='file' $selected{'GUARDIAN_LOG_FACILITY'}{'file'}>$Lang::tr{'guardian logtarget_file'}</option>
 530                                         <option id='logfacility_console' value='console' $selected{'GUARDIAN_LOG_FACILITY'}{'console'}>$Lang::tr{'guardian logtarget_console'}</option>
 531                                 </select></td>
 532
 533                                 <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
 534                                 <td width='25%'><select id='GUARDIAN_LOGLEVEL' name='GUARDIAN_LOGLEVEL'>
 535                                         <option id='loglevel_off' value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>$Lang::tr{'guardian loglevel_off'}</option>
 536                                         <option id='loglevel_info' value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>$Lang::tr{'guardian loglevel_info'}</option>
 537                                         <option id='loglevel_debug' value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>$Lang::tr{'guardian loglevel_debug'}</option>
 538                                 </select></td>
 539                         </tr>
 540
 541                         <tr class="GUARDIAN_LOGFILE">
 542                                 <td colspan='2'><br></td>
 543                         </tr>
 544
 545                         <tr class="GUARDIAN_LOGFILE">
 546                                 <td width='25%' class='base'>$Lang::tr{'guardian logfile'}:</td>
 547                                 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
 548                         </tr>
 549
 550                         <tr>
 551                                 <td colspan='2'><br></td>
 552                         </tr>
 553
 554                         <tr>
 555                                 <td width='25%' class='base'>$Lang::tr{'guardian firewallaction'}:</td>
 556                                 <td><select name='GUARDIAN_FIREWALL_ACTION'>
 557                                         <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option>
 558                                         <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option>
 559                                 </select></td>
 560
 561                                 <td width='25%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
 562                                 <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
 563                         </tr>
 564
 565                         <tr>
 566                                 <td colspan='2'><br></td>
 567                         </tr>
 568
 569                         <tr>
 570                                 <td width='25%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
 571                                 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
 572                         </tr>
 573
 574                 </table>
 575 END
 576
 577         print <<END;
 578                 <hr>
 579
 580                 <table width='95%'>
 581                         <tr>
 582                                 <td>&nbsp;</td>
 583                                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
 584                                 <td>&nbsp;</td>
 585                         </tr>
 586                 </table>
 587         </form>
 588 END
 589
 590         &Header::closebox();
 591 }
 592
 593 # Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
 594 sub showIgnoreBox() {
 595         &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
 596
 597         print <<END;
 598                 <table width='80%'>
 599                         <tr>
 600                                 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'ip address'}</b></td>
 601                                 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'remark'}</b></td>
 602                                 <td class='base' colspan='3' bgcolor='$color{'color20'}'></td>
 603                         </tr>
 604 END
 605                         # Check if some hosts have been added to be ignored.
 606                         if (keys (%ignored)) {
 607                                 my $col = "";
 608
 609                                 # Loop through all entries of the hash.
 610                                 while( (my $key) = each %ignored)  {
 611                                         # Assign data array positions to some nice variable names.
 612                                         my $address = $ignored{$key}[0];
 613                                         my $remark = $ignored{$key}[1];
 614                                         my $status  = $ignored{$key}[2];
 615
 616                                         # Check if the key (id) number is even or not.
 617                                         if ($settings{'ID'} eq $key) {
 618                                                 $col="bgcolor='${Header::colouryellow}'";
 619                                         } elsif ($key % 2) {
 620                                                 $col="bgcolor='$color{'color22'}'";
 621                                         } else {
 622                                                 $col="bgcolor='$color{'color20'}'";
 623                                         }
 624
 625                                         # Choose icon for the checkbox.
 626                                         my $gif;
 627                                         my $gdesc;
 628
 629                                         # Check if the status is enabled and select the correct image and description.
 630                                         if ($status eq 'enabled' ) {
 631                                                 $gif = 'on.gif';
 632                                                 $gdesc = $Lang::tr{'click to disable'};
 633                                         } else {
 634                                                 $gif = 'off.gif';
 635                                                 $gdesc = $Lang::tr{'click to enable'};
 636                                         }
 637
 638                                         print <<END;
 639                                         <tr>
 640                                                 <td width='20%' class='base' $col>$address</td>
 641                                                 <td width='65%' class='base' $col>$remark</td>
 642
 643                                                 <td align='center' $col>
 644                                                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 645                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
 646                                                                 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$gdesc' title='$gdesc' />
 647                                                                 <input type='hidden' name='ID' value='$key' />
 648                                                         </form>
 649                                                 </td>
 650
 651                                                 <td align='center' $col>
 652                                                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 653                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
 654                                                                 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
 655                                                                 <input type='hidden' name='ID' value='$key' />
 656                                                         </form>
 657                                                 </td>
 658
 659                                                 <td align='center' $col>
 660                                                         <form method='post' name='$key' action='$ENV{'SCRIPT_NAME'}'>
 661                                                                 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
 662                                                                 <input type='hidden' name='ID' value='$key'>
 663                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
 664                                                         </form>
 665                                                 </td>
 666                                         </tr>
 667 END
 668                                 }
 669                         } else {
 670                                 # Print notice that currently no hosts are ignored.
 671                                 print "<tr>\n";
 672                                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 673                                 print "</tr>\n";
 674                         }
 675
 676                 print "</table>\n";
 677
 678         # Section to add new elements or edit existing ones.
 679         print <<END;
 680         <br>
 681         <hr>
 682         <br>
 683
 684         <div align='center'>
 685                 <table width='100%'>
 686 END
 687
 688         # Assign correct headline and button text.
 689         my $buttontext;
 690         my $entry_address;
 691         my $entry_remark;
 692
 693         # Check if an ID (key) has been given, in this case an existing entry should be edited.
 694         if ($settings{'ID'} ne '') {
 695                 $buttontext = $Lang::tr{'update'};
 696                 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'update'}</b></td></tr>\n";
 697
 698                 # Grab address and remark for the given key.
 699                 $entry_address = $ignored{$settings{'ID'}}[0];
 700                 $entry_remark = $ignored{$settings{'ID'}}[1];
 701         } else {
 702                 $buttontext = $Lang::tr{'add'};
 703                 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'dnsforward add a new entry'}</b></td></tr>\n";
 704         }
 705
 706         print <<END;
 707                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 708                         <input type='hidden' name='ID' value='$settings{'ID'}'>
 709                         <tr>
 710                                 <td width='30%'>$Lang::tr{'ip address'}: </td>
 711                                 <td width='50%'><input type='text' name='IGNORE_ENTRY_ADDRESS' value='$entry_address' size='24' /></td>
 712
 713                                 <td width='30%'>$Lang::tr{'remark'}: </td>
 714                                 <td wicth='50%'><input type='text' name=IGNORE_ENTRY_REMARK value='$entry_remark' size='24' /></td>
 715                                 <td align='center' width='20%'><input type='submit' name='ACTION' value='$buttontext' /></td>
 716                         </tr>
 717                         </form>
 718                 </table>
 719         </div>
 720 END
 721
 722         &Header::closebox();
 723 }
 724
 725 # Function to list currently blocked addresses from guardian and unblock them or add custom entries to block.
 726 sub showBlockedBox() {
 727         &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
 728
 729         print <<END;
 730         <table width='60%'>
 731                 <tr>
 732                         <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
 733                 </tr>
 734 END
 735
 736                 # Launch function to get the currently blocked hosts.
 737                 my @blocked_hosts = &GetBlockedHosts();
 738
 739                 my $id = 0;
 740                 my $col = "";
 741
 742                 # Loop through our blocked hosts array.
 743                 foreach my $blocked_host (@blocked_hosts) {
 744
 745                         # Increase id number for each element in the ignore file.
 746                         $id++;
 747
 748                         # Check if the id number is even or not.
 749                         if ($id % 2) {
 750                                 $col="bgcolor='$color{'color22'}'";
 751                         } else {
 752                                 $col="bgcolor='$color{'color20'}'";
 753                         }
 754
 755                         print <<END;
 756                         <tr>
 757                                 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
 758                                 <td width='20%' align='center' $col>
 759                                         <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
 760                                                 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
 761                                                 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
 762                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
 763                                         </form>
 764                                 </td>
 765                         </tr>
 766 END
 767                 }
 768
 769         # If the loop only has been run once the id still is "0", which means there are no
 770         # additional entries (blocked hosts) in the iptables chain.
 771         if ($id == 0) {
 772
 773                 # Print notice that currently no hosts are blocked.
 774                 print "<tr>\n";
 775                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 776                 print "</tr>\n";
 777         }
 778
 779         print "</table>\n";
 780
 781         # Section for a manual block of an IP-address.
 782         print <<END;
 783         <br>
 784         <div align='center'>
 785                 <table width='60%' border='0'>
 786                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 787                         <tr>
 788                                 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
 789                                 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
 790                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
 791                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
 792                         </tr>
 793                         </form>
 794                 </table>
 795         </div>
 796 END
 797
 798         &Header::closebox();
 799 }
 800
 801 &Header::closebigbox();
 802 &Header::closepage();
 803
 804 # Function to check if guardian has been started.
 805 # Grab process id and consumed memory if the daemon is running.
 806 sub daemonstats() {
 807         $memory = 0;
 808         # for pid and memory
 809         open(FILE, '/usr/local/bin/addonctrl guardian status | ');
 810         @guardian = <FILE>;
 811         close(FILE);
 812         $string = join("", @guardian);
 813         $string =~ s/[a-z_]//gi;
 814         $string =~ s/\[[0-1]\;[0-9]+//gi;
 815         $string =~ s/[\(\)\.]//gi;
 816         $string =~ s/  //gi;
 817         $string =~ s/\e//gi;
 818         @pid = split(/\s/,$string);
 819         if (open(FILE, "/proc/$pid[0]/statm")){
 820                 my $temp = <FILE>;
 821                 @memory = split(/ /,$temp);
 822                 close(FILE);
 823         }
 824         $memory+=$memory[0];
 825 }
 826
 827 sub GetBlockedHosts() {
 828         # Create new, empty array.
 829         my @hosts;
 830
 831         # Launch helper to get chains from iptables.
 832         system('/usr/local/bin/getipstat');
 833
 834         # Open temporary file which contains the chains and rules.
 835         open (FILE, '/var/tmp/iptables.txt');
 836
 837         # Loop through the entire file.
 838         while (<FILE>) {
 839                 my $line = $_;
 840
 841                 # Search for the guardian chain and extract
 842                 # the lines between it and the next empty line
 843                 # which is placed before the next firewall
 844                 # chain starts.
 845                 if ($line =~ /^Chain GUARDIAN/ .. /^\s*$/) {
 846                         # Skip descriptive lines.
 847                         next if ($line =~ /^Chain/);
 848                         next if ($line =~ /^ pkts/);
 849
 850                         # Generate array, based on the line content (separator is a single or multiple space)
 851                         my @comps = split(/\s{1,}/, $line);
 852                         my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
 853
 854                         # Assign different variable names.
 855                         my $blocked_host = $source;
 856
 857                         # Add host to our hosts array.
 858                         if ($blocked_host) {
 859                                 push(@hosts, $blocked_host);
 860                         }
 861                 }
 862         }
 863
 864         # Close filehandle.
 865         close(FILE);
 866
 867         # Remove recently created temporary files of the "getipstat" binary.
 868         system("rm -f /var/tmp/iptables.txt");
 869         system("rm -f /var/tmp/iptablesmangle.txt");
 870         system("rm -f /var/tmp/iptablesnat.txt");
 871
 872         # Convert entries, sort them, write back and store the sorted entries into new array.
 873         my @sorted = map  { $_->[0] }
 874              sort { $a->[1] <=> $b->[1] }
 875              map  { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
 876              @hosts;
 877
 878         # Return our sorted list.
 879         return @sorted
 880 }
 881
 882 sub BuildConfiguration() {
 883         my %settings = ();
 884         &General::readhash("${General::swroot}/guardian/settings", \%settings);
 885
 886         my $configfile = "${General::swroot}/guardian/guardian.conf";
 887
 888         # Create the configfile if none exists yet.
 889         unless (-e "$configfile") { system("touch $configfile"); }
 890
 891         # Open configfile for writing.
 892         open(FILE, ">$configfile");
 893
 894         # Config file header.
 895         print FILE "# Autogenerated configuration file.\n";
 896         print FILE "# All user modifications will be overwritten.\n\n";
 897
 898         # Settings for the logging mechanism.
 899         print FILE "# Log settings.\n";
 900         print FILE "LogFacility = $settings{'GUARDIAN_LOG_FACILITY'}\n";
 901
 902         if ($settings{'GUARDIAN_LOG_FACILITY'} eq "file") {
 903                 print FILE "LogFile = $settings{'GUARDIAN_LOGFILE'}\n";
 904         }
 905
 906         print FILE "LogLevel = $settings{'GUARDIAN_LOGLEVEL'}\n\n";
 907
 908         # IPFire related static settings.
 909         print FILE "# IPFire related settings.\n";
 910         print FILE "FirewallEngine = IPtables\n";
 911         print FILE "SocketOwner = nobody:nobody\n";
 912         print FILE "IgnoreFile = $ignorefile\n\n";
 913
 914         # Configured block values.
 915         print FILE "# Configured block settings.\n";
 916         print FILE "BlockCount = $settings{'GUARDIAN_BLOCKCOUNT'}\n";
 917         print FILE "BlockTime = $settings{'GUARDIAN_BLOCKTIME'}\n";
 918         print FILE "FirewallAction = $settings{'GUARDIAN_FIREWALL_ACTION'}\n\n";
 919
 920         # Enabled modules.
 921         # Loop through whole settings hash.
 922         print FILE "# Enabled modules.\n";
 923         foreach my $option (keys %settings) {
 924                 # Search for enabled modules.
 925                 if ($option =~ /GUARDIAN_MONITOR_(.*)/) {
 926                         # Skip if module is not enabled.
 927                         next unless($settings{$option} eq "on");
 928
 929                         # Skip module if no file location is available.
 930                         next unless(exists($module_file_locations{$1}));
 931
 932                         # Add enabled module and defined path to the config file.
 933                         print FILE "Monitor_$1 = $module_file_locations{$1}\n";
 934                 }
 935         }
 936
 937         # Module settings.
 938         print FILE "\n# Module settings.\n";
 939         close(FILE);
 940
 941         # Generate ignore file.
 942         &GenerateIgnoreFile();
 943
 944         # Check if guardian should be started or stopped.
 945         if($settings{'GUARDIAN_ENABLED'} eq 'on') {
 946                 if($pid > 0) {
 947                         # Send reload command through socket connection.
 948                         &Guardian::Socket::Client("reload");
 949                 } else {
 950                         # Launch guardian.
 951                         system("/usr/local/bin/addonctrl guardian start &>/dev/null");
 952                 }
 953         } else {
 954                 # Stop the daemon.
 955                 system("/usr/local/bin/addonctrl guardian stop &>/dev/null");
 956         }
 957 }
 958
 959 sub GenerateIgnoreFile() {
 960         my %ignored = ();
 961
 962         # Read-in ignoredfile.
 963         &General::readhasharray($ignoredfile, \%ignored);
 964
 965         # Create the guardian.ignore file if not exist yet.
 966         unless (-e "$ignorefile") { system("touch $ignorefile"); }
 967
 968         # Open ignorefile for writing.
 969         open(FILE, ">$ignorefile");
 970
 971         # Config file header.
 972         print FILE "# Autogenerated configuration file.\n";
 973         print FILE "# All user modifications will be overwritten.\n\n";
 974
 975         # Add IFPire interfaces and gateway to the ignore file.
 976         #
 977         # Assign some temporary variables for the IPFire interfaces.
 978         my $green = $netsettings{'GREEN_ADDRESS'};
 979         my $blue = $netsettings{'BLUE_ADDRESS'};
 980         my $orange = $netsettings{'ORANGE_ADDRESS'};
 981
 982         # File declarations.
 983         my $public_address_file = "${General::swroot}/red/local-ipaddress";
 984         my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
 985
 986         # Write the obtained addresses to the ignore file.
 987         print FILE "# IPFire local interfaces.\n";
 988         print FILE "$green\n";
 989
 990         # Check if a blue interface exists.
 991         if ($blue) {
 992                 # Add blue address.
 993                 print FILE "$blue\n";
 994         }
 995
 996         # Check if an orange interface exists.
 997         if ($orange) {
 998                 # Add orange address.
 999                 print FILE "$orange\n";
1000         }
1001
1002         print FILE "\n# IPFire red interface, gateway and used DNS-servers.\n";
1003         print FILE "# Include the corresponding files to obtain the addresses.\n";
1004         print FILE "Include_File = $public_address_file\n";
1005         print FILE "Include_File = $gatewayfile\n";
1006
1007         # Add all user defined hosts and networks to the ignore file.
1008         #
1009         # Check if the hash contains any elements.
1010         if (keys (%ignored)) {
1011                 # Write headline.
1012                 print FILE "\n# User defined hosts/networks.\n";
1013
1014                 # Loop through the entire hash and write the host/network
1015                 # and remark to the ignore file.
1016                 while ( (my $key) = each %ignored) {
1017                         my $address = $ignored{$key}[0];
1018                         my $remark = $ignored{$key}[1];
1019                         my $status = $ignored{$key}[2];
1020
1021                         # Check if the status of the entry is "enabled".
1022                         if ($status eq "enabled") {
1023                                 # Check if the address/network is valid.
1024                                 if ((&General::validip($address)) || (&General::validipandmask($address))) {
1025                                         # Write the remark to the file.
1026                                         print FILE "# $remark\n";
1027
1028                                         # Write the address/network to the ignore file.
1029                                         print FILE "$address\n\n";
1030                                 }
1031                         }
1032                 }
1033         }
1034
1035         close(FILE);
1036 }