html/cgi-bin/guardian.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2016  IPFire Team  <info@ipfire.org>                          #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Locale::Codes::Country;
  24 use Guardian::Socket;
  25
  26 # enable only the following on debugging purpose
  27 #use warnings;
  28 #use CGI::Carp 'fatalsToBrowser';
  29
  30 require '/var/ipfire/general-functions.pl';
  31 require "${General::swroot}/lang.pl";
  32 require "${General::swroot}/header.pl";
  33
  34 #workaround to suppress a warning when a variable is used only once
  35 my @dummy = (
  36         ${Header::colourred},
  37         ${Header::colourgreen}
  38 );
  39
  40 undef (@dummy);
  41
  42 my $string=();
  43 my $memory=();
  44 my @memory=();
  45 my @pid=();
  46 my @guardian=();
  47
  48 # Path to the guardian.ignore file.
  49 my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
  50
  51 # Hash which contains the supported modules and the
  52 # file locations on IPFire systems.
  53 my %module_file_locations = (
  54         "HTTPD" => "/var/log/httpd/error_log",
  55         "OWNCLOUD" => "/var/owncloud/data/owncloud.log",
  56         "SNORT" => "/var/log/snort.alert",
  57         "SSH" => "/var/log/messages",
  58 );
  59
  60 our %netsettings = ();
  61 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  62
  63 our %color = ();
  64 our %mainsettings = ();
  65 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  66 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  67
  68 # Pakfire meta file for owncloud.
  69 # (File exists when the addon is installed.)
  70 my $owncloud_meta = "/opt/pakfire/db/installed/meta-owncloud";
  71
  72
  73 # File declarations.
  74 my $settingsfile = "${General::swroot}/guardian/settings";
  75 my $ignoredfile = "${General::swroot}/guardian/ignored";
  76
  77 # Create empty settings and ignoredfile if they do not exist yet.
  78 unless (-e "$settingsfile") { system("touch $settingsfile"); }
  79 unless (-e "$ignoredfile") { system("touch $ignoredfile"); }
  80
  81 our %settings = ();
  82 our %ignored  = ();
  83
  84 $settings{'ACTION'} = '';
  85
  86 $settings{'GUARDIAN_ENABLED'} = 'off';
  87 $settings{'GUARDIAN_MONITOR_SNORT'} = 'on';
  88 $settings{'GUARDIAN_MONITOR_SSH'} = 'on';
  89 $settings{'GUARDIAN_MONITOR_HTTPD'} = 'on';
  90 $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = '';
  91 $settings{'GUARDIAN_LOG_FACILITY'} = 'syslog';
  92 $settings{'GUARDIAN_LOGLEVEL'} = 'info';
  93 $settings{'GUARDIAN_BLOCKCOUNT'} = '3';
  94 $settings{'GUARDIAN_BLOCKTIME'} = '86400';
  95 $settings{'GUARDIAN_FIREWALL_ACTION'} = 'DROP';
  96 $settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
  97 $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'} = '3';
  98
  99 # Default settings for owncloud if installed.
 100 if ( -e "$owncloud_meta") {
 101         $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = 'off';
 102 }
 103
 104 my $errormessage = '';
 105
 106 &Header::showhttpheaders();
 107
 108 # Get GUI values.
 109 &Header::getcgihash(\%settings);
 110
 111 # Check if guardian is running and grab some stats.
 112 &daemonstats();
 113 my $pid = $pid[0];
 114
 115 ## Perform input checks and save settings.
 116 #
 117 if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
 118         # Check for valid blocktime.
 119         unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
 120                         $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
 121         }
 122
 123         # Check if the bloccount is valid.
 124         unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
 125                         $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
 126         }
 127
 128         # Check Logfile.
 129         unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
 130                 $errormessage = "$Lang::tr{'guardian invalid logfile'}";
 131         }
 132
 133         # Only continue if no error message has been set.
 134         if($errormessage eq '') {
 135                 # Write configuration settings to file.
 136                 &General::writehash("${General::swroot}/guardian/settings", \%settings);
 137
 138                 # Update configuration files.
 139                 &BuildConfiguration();
 140         }
 141
 142 ## Add/edit an entry to the ignore file.
 143 #
 144 } elsif (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang::tr{'update'})) {
 145
 146         # Check if any input has been performed.
 147         if ($settings{'IGNORE_ENTRY_ADDRESS'} ne '') {
 148
 149                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 150                 if ((!&General::validip($settings{'IGNORE_ENTRY_ADDRESS'})) && (!&General::validipandmask($settings{'IGNORE_ENTRY_ADDRESS'}))) {
 151                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 152                 }
 153         } else {
 154                 $errormessage = "$Lang::tr{'guardian empty input'}";
 155         }
 156
 157         # Go further if there was no error.
 158         if ($errormessage eq '') {
 159                 my %ignored = ();
 160                 my $id;
 161                 my $status;
 162
 163                 # Assign hash values.
 164                 my $new_entry_address = $settings{'IGNORE_ENTRY_ADDRESS'};
 165                 my $new_entry_remark = $settings{'IGNORE_ENTRY_REMARK'};
 166
 167                 # Read-in ignoredfile.
 168                 &General::readhasharray($ignoredfile, \%ignored);
 169
 170                 # Check if we should edit an existing entry and got an ID.
 171                 if (($settings{'ACTION'} eq $Lang::tr{'update'}) && ($settings{'ID'})) {
 172                         # Assin the provided id.
 173                         $id = $settings{'ID'};
 174
 175                         # Undef the given ID.
 176                         undef($settings{'ID'});
 177
 178                         # Grab the configured status of the corresponding entry.
 179                         $status = $ignored{$id}[2];
 180                 } else {
 181                         # Each newly added entry automatically should be enabled.
 182                         $status = "enabled";
 183
 184                         # Generate the ID for the new entry.
 185                         #
 186                         # Sort the keys by it's ID and store them in an array.
 187                         my @keys = sort { $a <=> $b } keys %ignored;
 188
 189                         # Reverse the key array.
 190                         my @reversed = reverse(@keys);
 191
 192                         # Obtain the last used id.
 193                         my $last_id = @reversed[0];
 194
 195                         # Increase the last id by one and use it as id for the new entry.
 196                         $id = ++$last_id;
 197                 }
 198
 199                 # Add/Modify the entry to/in the ignored hash.
 200                 $ignored{$id} = ["$new_entry_address", "$new_entry_remark", "$status"];
 201
 202                 # Write the changed ignored hash to the ignored file.
 203                 &General::writehasharray($ignoredfile, \%ignored);
 204
 205                 # Regenerate the ignore file.
 206                 &GenerateIgnoreFile();
 207         }
 208
 209         # Check if guardian is running.
 210         if ($pid > 0) {
 211                 # Send reload command through socket connection.
 212                 &Guardian::Socket::Client("reload-ignore-list");
 213         }
 214
 215 ## Toggle Enabled/Disabled for an existing entry on the ignore list.
 216 #
 217
 218 } elsif ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
 219         my %ignored = ();
 220
 221         # Only go further, if an ID has been passed.
 222         if ($settings{'ID'}) {
 223                 # Assign the given ID.
 224                 my $id = $settings{'ID'};
 225
 226                 # Undef the given ID.
 227                 undef($settings{'ID'});
 228
 229                 # Read-in ignoredfile.
 230                 &General::readhasharray($ignoredfile, \%ignored);
 231
 232                 # Grab the configured status of the corresponding entry.
 233                 my $status = $ignored{$id}[2];
 234
 235                 # Switch the status.
 236                 if ($status eq "disabled") {
 237                         $status = "enabled";
 238                 } else {
 239                         $status = "disabled";
 240                 }
 241
 242                 # Modify the status of the existing entry.
 243                 $ignored{$id} = ["$ignored{$id}[0]", "$ignored{$id}[1]", "$status"];
 244
 245                 # Write the changed ignored hash to the ignored file.
 246                 &General::writehasharray($ignoredfile, \%ignored);
 247
 248                 # Regenerate the ignore file.
 249                 &GenerateIgnoreFile();
 250
 251                 # Check if guardian is running.
 252                 if ($pid > 0) {
 253                         # Send reload command through socket connection.
 254                         &Guardian::Socket::Client("reload-ignore-list");
 255                 }
 256         }
 257
 258 ## Remove entry from ignore list.
 259 #
 260 } elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
 261         my %ignored = ();
 262
 263         # Read-in ignoredfile.
 264         &General::readhasharray($ignoredfile, \%ignored);
 265
 266         # Drop entry from the hash.
 267         delete($ignored{$settings{'ID'}});
 268
 269         # Undef the given ID.
 270         undef($settings{'ID'});
 271
 272         # Write the changed ignored hash to the ignored file.
 273         &General::writehasharray($ignoredfile, \%ignored);
 274
 275         # Regenerate the ignore file.
 276         &GenerateIgnoreFile();
 277
 278         # Check if guardian is running.
 279         if ($pid > 0) {
 280                 # Send reload command through socket connection.
 281                 &Guardian::Socket::Client("reload-ignore-list");
 282         }
 283
 284 ## Block a user given address or subnet.
 285 #
 286 } elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
 287
 288         # Assign some temporary variables used for input validation.
 289         my $input = $settings{'ADDRESS_BLOCK'};
 290         my $green = $netsettings{'GREEN_ADDRESS'};
 291         my $blue = $netsettings{'BLUE_ADDRESS'};
 292         my $orange = $netsettings{'ORANGE_ADDRESS'};
 293         my $red = $netsettings{'RED_ADDRESS'};
 294
 295         # File declarations.
 296         my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
 297         my $dns1file = "${General::swroot}/red/dns1";
 298         my $dns2file = "${General::swroot}/red/dns2";
 299
 300         # Get gateway address.
 301         my $gateway = &_get_address_from_file($gatewayfile);
 302
 303         # Get addresses from the used dns servers.
 304         my $dns1 = &_get_address_from_file($dns1file);
 305         my $dns2 = &_get_address_from_file($dns2file);
 306
 307         # Check if any input has been performed.
 308         if ($input eq '') {
 309                 $errormessage = "$Lang::tr{'guardian empty input'}";
 310         }
 311
 312         # Check if the given input is localhost (127.0.0.1).
 313         elsif ($input eq "127.0.0.1") {
 314                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 315         }
 316
 317         # Check if the given input is anywhere (0.0.0.0).
 318         elsif ($input eq "0.0.0.0") {
 319                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 320         }
 321
 322         # Check if the given input is one of the interface addresses or our gateway.
 323         elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway" || $input eq "$dns1" || $input eq "$dns2") {
 324                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 325         }
 326
 327         # Check if the given input is a valid IP address.
 328         elsif (!&General::validip($input)) {
 329                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 330         }
 331
 332         # Go further if there was no error.
 333         if ($errormessage eq '') {
 334                 my $block = $settings{'ADDRESS_BLOCK'};
 335
 336                 # Send command to block the specified address through socket connection.
 337                 &Guardian::Socket::Client("block $block");
 338         }
 339
 340 ## Unblock address or subnet.
 341 #
 342 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
 343
 344         # Check if no empty input has been performed.
 345         if ($settings{'ADDRESS_UNBLOCK'} ne '') {
 346
 347                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 348                 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
 349                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 350                 }
 351
 352         } else {
 353                 $errormessage = "$Lang::tr{'guardian empty input'}";
 354         }
 355
 356         # Go further if there was no error.
 357         if ($errormessage eq '') {
 358                 my $unblock = $settings{'ADDRESS_UNBLOCK'};
 359
 360                 # Send command to unblock the given address through socket connection.
 361                 &Guardian::Socket::Client("unblock $unblock");
 362         }
 363
 364 ## Unblock all.
 365 #
 366 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
 367
 368         # Send flush command through socket connection.
 369         &Guardian::Socket::Client("flush");
 370 }
 371
 372 # Load settings from files.
 373 &General::readhash("${General::swroot}/guardian/settings", \%settings);
 374 &General::readhasharray("${General::swroot}/guardian/ignored", \%ignored);
 375
 376 # Call functions to generate whole page.
 377 &showMainBox();
 378 &showIgnoreBox();
 379
 380 # Display area only if guardian is running.
 381 if ( ($memory != 0) && ($pid > 0) ) {
 382         &showBlockedBox();
 383 }
 384
 385 # Function to display the status of guardian and allow base configuration.
 386 sub showMainBox() {
 387         my %checked = ();
 388         my %selected = ();
 389
 390         $checked{'GUARDIAN_ENABLED'}{'on'} = '';
 391         $checked{'GUARDIAN_ENABLED'}{'off'} = '';
 392         $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
 393         $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} = '';
 394         $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} = '';
 395         $checked{'GUARDIAN_MONITOR_SNORT'}{$settings{'GUARDIAN_MONITOR_SNORT'}} = "checked='checked'";
 396         $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = '';
 397         $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = '';
 398         $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'";
 399         $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} = '';
 400         $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} = '';
 401         $checked{'GUARDIAN_MONITOR_HTTPD'}{$settings{'GUARDIAN_MONITOR_HTTPD'}} = "checked='checked'";
 402         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} = '';
 403         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} = '';
 404         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{$settings{'GUARDIAN_MONITOR_OWNCLOUD'}} = "checked='checked'";
 405
 406         $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected';
 407         $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
 408         $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}} = 'selected';
 409         $selected{'GUARDIAN_FIREWALL_ACTION'}{$settings{'GUARDIAN_FIREWALL_ACTION'}} = 'selected';
 410
 411         &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
 412         &Header::openbigbox('100%', 'left', '', $errormessage);
 413
 414         # Print errormessage if there is one.
 415         if ($errormessage) {
 416                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 417                 print "<font class='base'>$errormessage&nbsp;</font>\n";
 418                 &Header::closebox();
 419         }
 420
 421
 422         # Draw current guardian state.
 423         &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
 424
 425         # Get current status of guardian.
 426         &daemonstats();
 427         $pid = $pid[0];
 428
 429         # Display some useful information related to guardian, if daemon is running.
 430         if ( ($memory != 0) && ($pid > 0) ){
 431                 print <<END;
 432                         <table width='95%' cellspacing='0' class='tbl'>
 433                                 <tr>
 434                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 435                                 </tr>
 436                                 <tr>
 437                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 438                                         <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
 439                                 </tr>
 440                                 <tr>
 441                                         <td class='base'></td>
 442                                         <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
 443                                         <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
 444                                 </tr>
 445                                 <tr>
 446                                         <td class='base'></td>
 447                                         <td bgcolor='$color{'color22'}' align='center'>$pid</td>
 448                                         <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
 449                                 </tr>
 450                         </table>
 451 END
 452         } else {
 453                 # Otherwise display a hint that the service is not launched.
 454                 print <<END;
 455                         <table width='95%' cellspacing='0' class='tbl'>
 456                                 <tr>
 457                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 458                                 </tr>
 459                                 <tr>
 460                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 461                                         <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
 462                                 </tr>
 463                         </table>
 464 END
 465         }
 466
 467         &Header::closebox();
 468
 469         # Draw elements for guardian configuration.
 470         &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
 471
 472         print <<END;
 473                 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 474
 475                 <table width='95%'>
 476                         <tr>
 477                                 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
 478                         </tr>
 479                         <tr>
 480                                 <td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
 481                                 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
 482                         </tr>
 483                         <tr>
 484                                 <td colspan='2'><br></td>
 485                         </tr>
 486                         <tr>
 487                                 <td width='20%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td>
 488                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='on' $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} /> /
 489                                 <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='off' $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} /> off</td>
 490                         </tr>
 491                         <tr>
 492                                 <td width='20%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
 493                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> /
 494                                 <input type='radio' name='GUARDIAN_MONITOR_SSH' value='off' $checked{'GUARDIAN_MONITOR_SSH'}{'off'} /> off</td>
 495                         </tr>
 496                         <tr>
 497                                 <td width='20%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
 498                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='on' $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} /> /
 499                                 <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='off' $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} /> off</td>
 500                         </tr>
 501 END
 502                         # Display owncloud checkbox when the addon is installed.
 503                         if ( -e "$owncloud_meta" ) {
 504                                 print"<tr>\n";
 505                                 print"<td width='20%' class='base'>$Lang::tr{'guardian block owncloud brute-force'}</td>\n";
 506                                 print"<td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='on' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} /> /\n";
 507                                 print"<input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='off' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} /> off</td>\n";
 508                                 print"</tr>\n";
 509                         }
 510         print <<END;
 511                         <tr>
 512                                 <td colspan='2'><br></td>
 513                         </tr>
 514                         <tr>
 515                                 <td align='left' width='20%'>$Lang::tr{'guardian logfacility'}:</td>
 516                                 <td><select name='GUARDIAN_LOG_FACILITY'>
 517                                         <option value='syslog' $selected{'GUARDIAN_LOG_FACILITY'}{'syslog'}>syslog</option>
 518                                         <option value='file' $selected{'GUARDIAN_LOG_FACILITY'}{'file'}>file</option>
 519                                         <option value='console' $selected{'GUARDIAN_LOG_FACILITY'}{'console'}>console</option>
 520                                 </select></td>
 521                         </tr>
 522                         <tr>
 523                                 <td colspan='2'><br></td>
 524                         </tr>
 525                         <tr>
 526                                 <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
 527                                 <td><select name='GUARDIAN_LOGLEVEL'>
 528                                         <option value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>off</option>
 529                                         <option value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>info</option>
 530                                         <option value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>debug</option>
 531                                 </select></td>
 532                         </tr>
 533                         <tr>
 534                                 <td colspan='2'><br></td>
 535                         </tr>
 536                         <tr>
 537                                 <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td>
 538                                 <td><select name='GUARDIAN_SNORT_PRIORITY_LEVEL'>
 539                                         <option value='1' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'1'}>1</option>
 540                                         <option value='2' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'2'}>2</option>
 541                                         <option value='3' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'3'}>3</option>
 542                                         <option value='4' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'4'}>4</option>
 543                                 </select></td>
 544                         </tr>
 545                         <tr>
 546                                 <td colspan='2'><br></td>
 547                         </tr>
 548                         <tr>
 549                                 <td width='20%' class='base'>$Lang::tr{'guardian firewallaction'}:</td>
 550                                 <td><select name='GUARDIAN_FIREWALL_ACTION'>
 551                                         <option value='DROP' $selected{'GUARDIAN_FIREWALL_ACTION'}{'DROP'}>Drop</option>
 552                                         <option value='REJECT' $selected{'GUARDIAN_FIREWALL_ACTION'}{'REJECT'}>Reject</option>
 553                                 </select></td>
 554                         </tr>
 555                         <tr>
 556                                 <td colspan='2'><br></td>
 557                         </tr>
 558                         <tr>
 559                                 <td width='20%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
 560                                 <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
 561                         </tr>
 562                         <tr>
 563                                 <td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
 564                                 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
 565                         </tr>
 566                         <tr>
 567                                 <td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
 568                                 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
 569                         </tr>
 570                 </table>
 571 END
 572
 573         print <<END;
 574                 <hr>
 575
 576                 <table width='95%'>
 577                         <tr>
 578                                 <td>&nbsp;</td>
 579                                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
 580                                 <td>&nbsp;</td>
 581                         </tr>
 582                 </table>
 583         </form>
 584 END
 585
 586         &Header::closebox();
 587 }
 588
 589 # Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
 590 sub showIgnoreBox() {
 591         &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
 592
 593         print <<END;
 594                 <table width='80%'>
 595                         <tr>
 596                                 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'ip address'}</b></td>
 597                                 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'remark'}</b></td>
 598                                 <td class='base' colspan='3' bgcolor='$color{'color20'}'></td>
 599                         </tr>
 600 END
 601                         # Check if some hosts have been add to be ignored.
 602                         if (keys (%ignored)) {
 603                                 my $col = "";
 604
 605                                 # Loop through all entries of the hash..
 606                                 while( (my $key) = each %ignored)  {
 607                                         # Assign data array positions to some nice variable names.
 608                                         my $address = $ignored{$key}[0];
 609                                         my $remark = $ignored{$key}[1];
 610                                         my $status  = $ignored{$key}[2];
 611
 612                                         # Check if the key (id) number is even or not.
 613                                         if ($settings{'ID'} eq $key) {
 614                                                 $col="bgcolor='${Header::colouryellow}'";
 615                                         } elsif ($key % 2) {
 616                                                 $col="bgcolor='$color{'color22'}'";
 617                                         } else {
 618                                                 $col="bgcolor='$color{'color20'}'";
 619                                         }
 620
 621                                         # Choose icon for the checkbox.
 622                                         my $gif;
 623                                         my $gdesc;
 624
 625                                         # Check if the status is enabled and select the correct image and description.
 626                                         if ($status eq 'enabled' ) {
 627                                                 $gif = 'on.gif';
 628                                                 $gdesc = $Lang::tr{'click to disable'};
 629                                         } else {
 630                                                 $gif = 'off.gif';
 631                                                 $gdesc = $Lang::tr{'click to enable'};
 632                                         }
 633
 634                                         print <<END;
 635                                         <tr>
 636                                                 <td width='20%' class='base' $col>$address</td>
 637                                                 <td width='65%' class='base' $col>$remark</td>
 638
 639                                                 <td align='center' $col>
 640                                                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 641                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
 642                                                                 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$gdesc' title='$gdesc' />
 643                                                                 <input type='hidden' name='ID' value='$key' />
 644                                                         </form>
 645                                                 </td>
 646
 647                                                 <td align='center' $col>
 648                                                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 649                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
 650                                                                 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
 651                                                                 <input type='hidden' name='ID' value='$key' />
 652                                                         </form>
 653                                                 </td>
 654
 655                                                 <td align='center' $col>
 656                                                         <form method='post' name='$key' action='$ENV{'SCRIPT_NAME'}'>
 657                                                                 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
 658                                                                 <input type='hidden' name='ID' value='$key'>
 659                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
 660                                                         </form>
 661                                                 </td>
 662                                         </tr>
 663 END
 664                                 }
 665                         } else {
 666                                 # Print notice that currently no hosts are ignored.
 667                                 print "<tr>\n";
 668                                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 669                                 print "</tr>\n";
 670                         }
 671
 672                 print "</table>\n";
 673
 674         # Section to add new elements or edit existing ones.
 675         print <<END;
 676         <br>
 677         <hr>
 678         <br>
 679
 680         <div align='center'>
 681                 <table width='100%'>
 682 END
 683
 684         # Assign correct headline and button text.
 685         my $buttontext;
 686         my $entry_address;
 687         my $entry_remark;
 688
 689         # Check if an ID (key) has been given, in this case an existing entry should be edited.
 690         if ($settings{'ID'} ne '') {
 691                 $buttontext = $Lang::tr{'update'};
 692                 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'update'}</b></td></tr>\n";
 693
 694                 # Grab address and remark for the given key.
 695                 $entry_address = $ignored{$settings{'ID'}}[0];
 696                 $entry_remark = $ignored{$settings{'ID'}}[1];
 697         } else {
 698                 $buttontext = $Lang::tr{'add'};
 699                 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'dnsforward add a new entry'}</b></td></tr>\n";
 700         }
 701
 702         print <<END;
 703                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 704                         <input type='hidden' name='ID' value='$settings{'ID'}'>
 705                         <tr>
 706                                 <td width='30%'>$Lang::tr{'ip address'}: </td>
 707                                 <td width='50%'><input type='text' name='IGNORE_ENTRY_ADDRESS' value='$entry_address' size='24' /></td>
 708
 709                                 <td width='30%'>$Lang::tr{'remark'}: </td>
 710                                 <td wicth='50%'><input type='text' name=IGNORE_ENTRY_REMARK value='$entry_remark' size='24' /></td>
 711                                 <td align='center' width='20%'><input type='submit' name='ACTION' value='$buttontext' /></td>
 712                         </tr>
 713                         </form>
 714                 </table>
 715         </div>
 716 END
 717
 718         &Header::closebox();
 719 }
 720
 721 # Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
 722 sub showBlockedBox() {
 723         &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
 724
 725         print <<END;
 726         <table width='60%'>
 727                 <tr>
 728                         <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
 729                 </tr>
 730 END
 731
 732                 # Lauch function to get the currently blocked hosts.
 733                 my @blocked_hosts = &GetBlockedHosts();
 734
 735                 my $id = 0;
 736                 my $col = "";
 737
 738                 # Loop through our blocked hosts array.
 739                 foreach my $blocked_host (@blocked_hosts) {
 740
 741                         # Increase id number for each element in the ignore file.
 742                         $id++;
 743
 744                         # Check if the id number is even or not.
 745                         if ($id % 2) {
 746                                 $col="bgcolor='$color{'color22'}'";
 747                         } else {
 748                                 $col="bgcolor='$color{'color20'}'";
 749                         }
 750
 751                         print <<END;
 752                         <tr>
 753                                 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
 754                                 <td width='20%' align='center' $col>
 755                                         <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
 756                                                 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
 757                                                 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
 758                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
 759                                         </form>
 760                                 </td>
 761                         </tr>
 762 END
 763                 }
 764
 765         # If the loop only has been runs once the id still is "0", which means there are no
 766         # additional entries (blocked hosts) in the iptables chain.
 767         if ($id == 0) {
 768
 769                 # Print notice that currently no hosts are blocked.
 770                 print "<tr>\n";
 771                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 772                 print "</tr>\n";
 773         }
 774
 775         print "</table>\n";
 776
 777         # Section for a manual block of an IP-address.
 778         print <<END;
 779         <br>
 780         <div align='center'>
 781                 <table width='60%' border='0'>
 782                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 783                         <tr>
 784                                 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
 785                                 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
 786                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
 787                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
 788                         </tr>
 789                         </form>
 790                 </table>
 791         </div>
 792 END
 793
 794         &Header::closebox();
 795 }
 796
 797 &Header::closebigbox();
 798 &Header::closepage();
 799
 800 # Function to check if guardian has been started.
 801 # Grab process id and consumed memory if the daemon is running.
 802 sub daemonstats() {
 803         $memory = 0;
 804         # for pid and memory
 805         open(FILE, '/usr/local/bin/addonctrl guardian status | ');
 806         @guardian = <FILE>;
 807         close(FILE);
 808         $string = join("", @guardian);
 809         $string =~ s/[a-z_]//gi;
 810         $string =~ s/\[[0-1]\;[0-9]+//gi;
 811         $string =~ s/[\(\)\.]//gi;
 812         $string =~ s/  //gi;
 813         $string =~ s/\e//gi;
 814         @pid = split(/\s/,$string);
 815         if (open(FILE, "/proc/$pid[0]/statm")){
 816                 my $temp = <FILE>;
 817                 @memory = split(/ /,$temp);
 818                 close(FILE);
 819         }
 820         $memory+=$memory[0];
 821 }
 822
 823 sub GetBlockedHosts() {
 824         # Create new, empty array.
 825         my @hosts;
 826
 827         # Lauch helper to get chains from iptables.
 828         system('/usr/local/bin/getipstat');
 829
 830         # Open temporary file which contains the chains and rules.
 831         open (FILE, '/srv/web/ipfire/html/iptables.txt');
 832
 833         # Loop through the entire file.
 834         while (<FILE>) {
 835                 my $line = $_;
 836
 837                 # Search for the guardian chain and extract
 838                 # the lines between it and the next empty line
 839                 # which is placed before the next firewall
 840                 # chain starts.
 841                 if ($line =~ /^Chain GUARDIAN/ .. /^\s*$/) {
 842                         # Skip descriptive lines.
 843                         next if ($line =~ /^Chain/);
 844                         next if ($line =~ /^ pkts/);
 845
 846                         # Generate array, based on the line content (seperator is a single or multiple space's)
 847                         my @comps = split(/\s{1,}/, $line);
 848                         my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
 849
 850                         # Assign different variable names.
 851                         my $blocked_host = $source;
 852
 853                         # Add host to our hosts array.
 854                         if ($blocked_host) {
 855                                 push(@hosts, $blocked_host);
 856                         }
 857                 }
 858         }
 859
 860         # Close filehandle.
 861         close(FILE);
 862
 863         # Remove recently created temporary files of the "getipstat" binary.
 864         system(rm -f "/srv/web/ipfire/html/iptables.txt");
 865         system(rm -f "/srv/web/ipfire/html/iptablesmangle.txt");
 866         system(rm -f "/srv/web/ipfire/html/iptablesnat.txt");
 867
 868         # Convert entries, sort them, write back and store the sorted entries into new array.
 869         my @sorted = map  { $_->[0] }
 870              sort { $a->[1] <=> $b->[1] }
 871              map  { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
 872              @hosts;
 873
 874         # Return our sorted list.
 875         return @sorted
 876 }
 877
 878 sub BuildConfiguration() {
 879         my %settings = ();
 880         &General::readhash("${General::swroot}/guardian/settings", \%settings);
 881
 882         my $configfile = "${General::swroot}/guardian/guardian.conf";
 883
 884         # Create the configfile if not exist yet.
 885         unless (-e "$configfile") { system("touch $configfile"); }
 886
 887         # Open configfile for writing.
 888         open(FILE, ">$configfile");
 889
 890         # Config file header.
 891         print FILE "# Autogenerated configuration file.\n";
 892         print FILE "# All user modifications will be overwritten.\n\n";
 893
 894         # Settings for the logging mechanism.
 895         print FILE "# Log settings.\n";
 896         print FILE "LogFacility = $settings{'GUARDIAN_LOG_FACILITY'}\n";
 897
 898         if ($settings{'GUARDIAN_LOG_FACILITY'} eq "file") {
 899                 print FILE "LogFile = $settings{'GUARDIAN_LOGFILE'}\n";
 900         }
 901
 902         print FILE "LogLevel = $settings{'GUARDIAN_LOGLEVEL'}\n\n";
 903
 904         # IPFire related static settings.
 905         print FILE "# IPFire related settings.\n";
 906         print FILE "FirewallEngine = IPtables\n";
 907         print FILE "SocketOwner = nobody:nobody\n";
 908         print FILE "IgnoreFile = $ignorefile\n\n";
 909
 910         # Configured block values.
 911         print FILE "# Configured block settings.\n";
 912         print FILE "BlockCount = $settings{'GUARDIAN_BLOCKCOUNT'}\n";
 913         print FILE "BlockTime = $settings{'GUARDIAN_BLOCKTIME'}\n";
 914         print FILE "FirewallAction = $settings{'GUARDIAN_FIREWALL_ACTION'}\n\n";
 915
 916         # Enabled modules.
 917         # Loop through whole settings hash.
 918         print FILE "# Enabled modules.\n";
 919         foreach my $option (keys %settings) {
 920                 # Search for enabled modules.
 921                 if ($option =~ /GUARDIAN_MONITOR_(.*)/) {
 922                         # Skip if module is not enabled.
 923                         next unless($settings{$option} eq "on");
 924
 925                         # Skip module if no file location is available.
 926                         next unless(exists($module_file_locations{$1}));
 927
 928                         # Add enabled module and defined path to the config file.
 929                         print FILE "Monitor_$1 = $module_file_locations{$1}\n";
 930                 }
 931         }
 932
 933         # Module settings.
 934         print FILE "\n# Module settings.\n";
 935         # Check if SNORT is enabled and add snort priority.
 936         if ($settings{'GUARDIAN_MONITOR_SNORT'} eq "on") {
 937                 print FILE "SnortPriorityLevel = $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}\n";
 938         }
 939
 940         close(FILE);
 941
 942         # Check if guardian should be started or stopped.
 943         if($settings{'GUARDIAN_ENABLED'} eq 'on') {
 944                 if($pid > 0) {
 945                         # Send reload command through socket connection.
 946                         &Guardian::Socket::Client("reload");
 947                 } else {
 948                         # Launch guardian.
 949                         system("/usr/local/bin/addonctrl guardian start &>/dev/null");
 950                 }
 951         } else {
 952                 # Stop the daemon.
 953                 system("/usr/local/bin/addonctrl guardian stop &>/dev/null");
 954         }
 955 }
 956
 957 sub GenerateIgnoreFile() {
 958         my %ignored = ();
 959
 960         # Read-in ignoredfile.
 961         &General::readhasharray($ignoredfile, \%ignored);
 962
 963         # Create the guardian.ignore file if not exist yet.
 964         unless (-e "$ignorefile") { system("touch $ignorefile"); }
 965
 966         # Open ignorefile for writing.
 967         open(FILE, ">$ignorefile");
 968
 969         # Config file header.
 970         print FILE "# Autogenerated configuration file.\n";
 971         print FILE "# All user modifications will be overwritten.\n\n";
 972
 973         # Add IFPire interfaces and gateway to the ignore file.
 974         #
 975         # Assign some temporary variables for the IPFire interfaces.
 976         my $green = $netsettings{'GREEN_ADDRESS'};
 977         my $blue = $netsettings{'BLUE_ADDRESS'};
 978         my $orange = $netsettings{'ORANGE_ADDRESS'};
 979
 980         # File declarations.
 981         my $public_address_file = "${General::swroot}/red/local-ipaddress";
 982         my $gatewayfile = "${General::swroot}/red/remote-ipaddress";
 983         my $dns1file = "${General::swroot}/red/dns1";
 984         my $dns2file = "${General::swroot}/red/dns2";
 985
 986         # Write the obtained addresses to the ignore file.
 987         print FILE "# IPFire local interfaces.\n";
 988         print FILE "$green\n";
 989
 990         # Check if a blue interface exists.
 991         if ($blue) {
 992                 # Add blue address.
 993                 print FILE "$blue\n";
 994         }
 995
 996         # Check if an orange interface exists.
 997         if ($orange) {
 998                 # Add orange address.
 999                 print FILE "$orange\n";
1000         }
1001
1002         print FILE "\n# IPFire red interface, gateway and used DNS-servers.\n";
1003         print FILE "# Include the corresponding files to obtain the addresses.\n";
1004         print FILE "Include_File = $public_address_file\n";
1005         print FILE "Include_File = $gatewayfile\n";
1006         print FILE "Include_File = $dns1file\n";
1007         print FILE "Include_File = $dns2file\n";
1008
1009         # Add all user defined hosts and networks to the ignore file.
1010         #
1011         # Check if the hash contains any elements.
1012         if (keys (%ignored)) {
1013                 # Write headline.
1014                 print FILE "\n# User defined hosts/networks.\n";
1015
1016                 # Loop through the entire hash and write the host/network
1017                 # and remark to the ignore file.
1018                 while ( (my $key) = each %ignored) {
1019                         my $address = $ignored{$key}[0];
1020                         my $remark = $ignored{$key}[1];
1021                         my $status = $ignored{$key}[2];
1022
1023                         # Check if the status of the entry is "enabled".
1024                         if ($status eq "enabled") {
1025                                 # Check if the address/network is valid.
1026                                 if ((&General::validip($address)) || (&General::validipandmask($address))) {
1027                                         # Write the remark to the file.
1028                                         print FILE "# $remark\n";
1029
1030                                         # Write the address/network to the ignore file.
1031                                         print FILE "$address\n\n";
1032                                 }
1033                         }
1034                 }
1035         }
1036
1037         close(FILE);
1038 }
1039
1040 # Private subfunction to obtain IP-addresses from given file names.
1041 #
1042 sub _get_address_from_file ($) {
1043         my $file = shift;
1044
1045         # Check if the file exists.
1046         if (-e $file) {
1047                 # Open the given file.
1048                 open(FILE, "$file") or die "Could not open $file.";
1049
1050                 # Obtain the address from the first line of the file.
1051                 my $address = <FILE>;
1052
1053                 # Close filehandle
1054                 close(FILE);
1055
1056                 # Remove newlines.
1057                 chomp $address;
1058
1059                 # Check if the grabbed address is valid.
1060                 if (&General::validip($address)) {
1061                         # Return the address.
1062                         return $address;
1063                 }
1064         }
1065
1066         # Return nothing.
1067         return;
1068 }