html/cgi-bin/guardian.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2016  IPFire Team  <info@ipfire.org>                          #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Locale::Codes::Country;
  24 use Guardian::Socket;
  25
  26 # enable only the following on debugging purpose
  27 #use warnings;
  28 #use CGI::Carp 'fatalsToBrowser';
  29
  30 require '/var/ipfire/general-functions.pl';
  31 require "${General::swroot}/lang.pl";
  32 require "${General::swroot}/header.pl";
  33
  34 #workaround to suppress a warning when a variable is used only once
  35 my @dummy = (
  36         ${Header::colourred},
  37         ${Header::colourgreen}
  38 );
  39
  40 undef (@dummy);
  41
  42 my $string=();
  43 my $memory=();
  44 my @memory=();
  45 my @pid=();
  46 my @guardian=();
  47
  48 # Path to the guardian.ignore file.
  49 my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
  50
  51 # Hash which contains the supported modules and the
  52 # file locations on IPFire systems.
  53 my %module_file_locations = (
  54         "HTTPD" => "/var/log/httpd/error_log",
  55         "OWNCLOUD" => "/var/owncloud/data/owncloud.log",
  56         "SNORT" => "/var/log/snort.alert",
  57         "SSH" => "/var/log/messages",
  58 );
  59
  60 our %netsettings = ();
  61 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  62
  63 our %color = ();
  64 our %mainsettings = ();
  65 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  66 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  67
  68 # Pakfire meta file for owncloud.
  69 # (File exists when the addon is installed.)
  70 my $owncloud_meta = "/opt/pakfire/db/installed/meta-owncloud";
  71
  72
  73 # File declarations.
  74 my $settingsfile = "${General::swroot}/guardian/settings";
  75 my $ignoredfile = "${General::swroot}/guardian/ignored";
  76
  77 # Create empty settings and ignoredfile if they do not exist yet.
  78 unless (-e "$settingsfile") { system("touch $settingsfile"); }
  79 unless (-e "$ignoredfile") { system("touch $ignoredfile"); }
  80
  81 our %settings = ();
  82 our %ignored  = ();
  83
  84 $settings{'ACTION'} = '';
  85
  86 $settings{'GUARDIAN_ENABLED'} = 'off';
  87 $settings{'GUARDIAN_MONITOR_SNORT'} = 'on';
  88 $settings{'GUARDIAN_MONITOR_SSH'} = 'on';
  89 $settings{'GUARDIAN_MONITOR_HTTPD'} = 'on';
  90 $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = '';
  91 $settings{'GUARDIAN_LOG_FACILITY'} = 'syslog';
  92 $settings{'GUARDIAN_LOGLEVEL'} = 'info';
  93 $settings{'GUARDIAN_BLOCKCOUNT'} = '3';
  94 $settings{'GUARDIAN_BLOCKTIME'} = '86400';
  95 $settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
  96 $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'} = '3';
  97
  98 # Default settings for owncloud if installed.
  99 if ( -e "$owncloud_meta") {
 100         $settings{'GUARDIAN_MONITOR_OWNCLOUD'} = 'off';
 101 }
 102
 103 my $errormessage = '';
 104
 105 &Header::showhttpheaders();
 106
 107 # Get GUI values.
 108 &Header::getcgihash(\%settings);
 109
 110 # Check if guardian is running and grab some stats.
 111 &daemonstats();
 112 my $pid = $pid[0];
 113
 114 ## Perform input checks and save settings.
 115 #
 116 if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
 117         # Check for valid blocktime.
 118         unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
 119                         $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
 120         }
 121
 122         # Check if the bloccount is valid.
 123         unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
 124                         $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
 125         }
 126
 127         # Check Logfile.
 128         unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
 129                 $errormessage = "$Lang::tr{'guardian invalid logfile'}";
 130         }
 131
 132         # Only continue if no error message has been set.
 133         if($errormessage eq '') {
 134                 # Write configuration settings to file.
 135                 &General::writehash("${General::swroot}/guardian/settings", \%settings);
 136
 137                 # Update configuration files.
 138                 &BuildConfiguration();
 139         }
 140
 141 ## Add/edit an entry to the ignore file.
 142 #
 143 } elsif (($settings{'ACTION'} eq $Lang::tr{'add'}) || ($settings{'ACTION'} eq $Lang::tr{'update'})) {
 144
 145         # Check if any input has been performed.
 146         if ($settings{'IGNORE_ENTRY_ADDRESS'} ne '') {
 147
 148                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 149                 if ((!&General::validip($settings{'IGNORE_ENTRY_ADDRESS'})) && (!&General::validipandmask($settings{'IGNORE_ENTRY_ADDRESS'}))) {
 150                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 151                 }
 152         } else {
 153                 $errormessage = "$Lang::tr{'guardian empty input'}";
 154         }
 155
 156         # Go further if there was no error.
 157         if ($errormessage eq '') {
 158                 my %ignored = ();
 159                 my $id;
 160                 my $status;
 161
 162                 # Assign hash values.
 163                 my $new_entry_address = $settings{'IGNORE_ENTRY_ADDRESS'};
 164                 my $new_entry_remark = $settings{'IGNORE_ENTRY_REMARK'};
 165
 166                 # Read-in ignoredfile.
 167                 &General::readhasharray($ignoredfile, \%ignored);
 168
 169                 # Check if we should edit an existing entry and got an ID.
 170                 if (($settings{'ACTION'} eq $Lang::tr{'update'}) && ($settings{'ID'})) {
 171                         # Assin the provided id.
 172                         $id = $settings{'ID'};
 173
 174                         # Undef the given ID.
 175                         undef($settings{'ID'});
 176
 177                         # Grab the configured status of the corresponding entry.
 178                         $status = $ignored{$id}[2];
 179                 } else {
 180                         # Each newly added entry automatically should be enabled.
 181                         $status = "enabled";
 182
 183                         # Generate the ID for the new entry.
 184                         #
 185                         # Sort the keys by it's ID and store them in an array.
 186                         my @keys = sort { $a <=> $b } keys %ignored;
 187
 188                         # Reverse the key array.
 189                         my @reversed = reverse(@keys);
 190
 191                         # Obtain the last used id.
 192                         my $last_id = @reversed[0];
 193
 194                         # Increase the last id by one and use it as id for the new entry.
 195                         $id = ++$last_id;
 196                 }
 197
 198                 # Add/Modify the entry to/in the ignored hash.
 199                 $ignored{$id} = ["$new_entry_address", "$new_entry_remark", "$status"];
 200
 201                 # Write the changed ignored hash to the ignored file.
 202                 &General::writehasharray($ignoredfile, \%ignored);
 203
 204                 # Regenerate the ignore file.
 205                 # &GenerateIgnoreFile();
 206         }
 207
 208         # Check if guardian is running.
 209         if ($pid > 0) {
 210                 # Send reload command through socket connection.
 211                 &Guardian::Socket::Client("reload");
 212         }
 213
 214 ## Toggle Enabled/Disabled for an existing entry on the ignore list.
 215 #
 216
 217 } elsif ($settings{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
 218         my %ignored = ();
 219
 220         # Only go further, if an ID has been passed.
 221         if ($settings{'ID'}) {
 222                 # Assign the given ID.
 223                 my $id = $settings{'ID'};
 224
 225                 # Undef the given ID.
 226                 undef($settings{'ID'});
 227
 228                 # Read-in ignoredfile.
 229                 &General::readhasharray($ignoredfile, \%ignored);
 230
 231                 # Grab the configured status of the corresponding entry.
 232                 my $status = $ignored{$id}[2];
 233
 234                 # Switch the status.
 235                 if ($status eq "disabled") {
 236                         $status = "enabled";
 237                 } else {
 238                         $status = "disabled";
 239                 }
 240
 241                 # Modify the status of the existing entry.
 242                 $ignored{$id} = ["$ignored{$id}[0]", "$ignored{$id}[1]", "$status"];
 243
 244                 # Write the changed ignored hash to the ignored file.
 245                 &General::writehasharray($ignoredfile, \%ignored);
 246
 247                 # Regenerate the ignore file.
 248                 # &GenerateIgnoreFile();
 249
 250                 # Check if guardian is running.
 251                 if ($pid > 0) {
 252                         # Send reload command through socket connection.
 253                         &Guardian::Socket::Client("reload");
 254                 }
 255         }
 256
 257 ## Remove entry from ignore list.
 258 #
 259 } elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
 260         my %ignored = ();
 261
 262         # Read-in ignoredfile.
 263         &General::readhasharray($ignoredfile, \%ignored);
 264
 265         # Drop entry from the hash.
 266         delete($ignored{$settings{'ID'}});
 267
 268         # Undef the given ID.
 269         undef($settings{'ID'});
 270
 271         # Write the changed ignored hash to the ignored file.
 272         &General::writehasharray($ignoredfile, \%ignored);
 273
 274         # Regenerate the ignore file.
 275         # &GenerateIgnoreFile();
 276
 277         # Check if guardian is running.
 278         if ($pid > 0) {
 279                 # Send reload command through socket connection.
 280                 &Guardian::Socket::Client("reload");
 281         }
 282
 283 ## Block a user given address or subnet.
 284 #
 285 } elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
 286
 287         # Assign some temporary variables used for input validation.
 288         my $input = $settings{'ADDRESS_BLOCK'};
 289         my $green = $netsettings{'GREEN_ADDRESS'};
 290         my $blue = $netsettings{'BLUE_ADDRESS'};
 291         my $orange = $netsettings{'ORANGE_ADDRESS'};
 292         my $red = $netsettings{'RED_ADDRESS'};
 293
 294         # Get gateway address.
 295         my $gateway = &General::get_gateway();
 296
 297         # Check if any input has been performed.
 298         if ($input eq '') {
 299                 $errormessage = "$Lang::tr{'guardian empty input'}";
 300         }
 301
 302         # Check if the given input is localhost (127.0.0.1).
 303         elsif ($input eq "127.0.0.1") {
 304                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 305         }
 306
 307         # Check if the given input is anywhere (0.0.0.0).
 308         elsif ($input eq "0.0.0.0") {
 309                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 310         }
 311
 312         # Check if the given input is one of the interface addresses or our gateway.
 313         elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
 314                 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
 315         }
 316
 317         # Check if the given input is a valid IP address.
 318         elsif (!&General::validip($input)) {
 319                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 320         }
 321
 322         # Go further if there was no error.
 323         if ($errormessage eq '') {
 324                 my $block = $settings{'ADDRESS_BLOCK'};
 325
 326                 # Send command to block the specified address through socket connection.
 327                 &Guardian::Socket::Client("block $block");
 328         }
 329
 330 ## Unblock address or subnet.
 331 #
 332 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
 333
 334         # Check if no empty input has been performed.
 335         if ($settings{'ADDRESS_UNBLOCK'} ne '') {
 336
 337                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 338                 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
 339                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 340                 }
 341
 342         } else {
 343                 $errormessage = "$Lang::tr{'guardian empty input'}";
 344         }
 345
 346         # Go further if there was no error.
 347         if ($errormessage eq '') {
 348                 my $unblock = $settings{'ADDRESS_UNBLOCK'};
 349
 350                 # Send command to unblock the given address through socket connection.
 351                 &Guardian::Socket::Client("unblock $unblock");
 352         }
 353
 354 ## Unblock all.
 355 #
 356 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
 357
 358         # Send flush command through socket connection.
 359         &Guardian::Socket::Client("flush");
 360 }
 361
 362 # Load settings from files.
 363 &General::readhash("${General::swroot}/guardian/settings", \%settings);
 364 &General::readhasharray("${General::swroot}/guardian/ignored", \%ignored);
 365
 366 # Call functions to generate whole page.
 367 &showMainBox();
 368 &showIgnoreBox();
 369
 370 # Display area only if guardian is running.
 371 if ( ($memory != 0) && ($pid > 0) ) {
 372         &showBlockedBox();
 373 }
 374
 375 # Function to display the status of guardian and allow base configuration.
 376 sub showMainBox() {
 377         my %checked = ();
 378         my %selected = ();
 379
 380         $checked{'GUARDIAN_ENABLED'}{'on'} = '';
 381         $checked{'GUARDIAN_ENABLED'}{'off'} = '';
 382         $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
 383         $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} = '';
 384         $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} = '';
 385         $checked{'GUARDIAN_MONITOR_SNORT'}{$settings{'GUARDIAN_MONITOR_SNORT'}} = "checked='checked'";
 386         $checked{'GUARDIAN_MONITOR_SSH'}{'off'} = '';
 387         $checked{'GUARDIAN_MONITOR_SSH'}{'on'} = '';
 388         $checked{'GUARDIAN_MONITOR_SSH'}{$settings{'GUARDIAN_MONITOR_SSH'}} = "checked='checked'";
 389         $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} = '';
 390         $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} = '';
 391         $checked{'GUARDIAN_MONITOR_HTTPD'}{$settings{'GUARDIAN_MONITOR_HTTPD'}} = "checked='checked'";
 392         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} = '';
 393         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} = '';
 394         $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{$settings{'GUARDIAN_MONITOR_OWNCLOUD'}} = "checked='checked'";
 395
 396         $selected{'GUARDIAN_LOG_FACILITY'}{$settings{'GUARDIAN_LOG_FACILITY'}} = 'selected';
 397         $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
 398         $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{$settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}} = 'selected';
 399
 400         &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
 401         &Header::openbigbox('100%', 'left', '', $errormessage);
 402
 403         # Print errormessage if there is one.
 404         if ($errormessage) {
 405                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 406                 print "<font class='base'>$errormessage&nbsp;</font>\n";
 407                 &Header::closebox();
 408         }
 409
 410
 411         # Draw current guardian state.
 412         &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
 413
 414         # Get current status of guardian.
 415         &daemonstats();
 416         $pid = $pid[0];
 417
 418         # Display some useful information related to guardian, if daemon is running.
 419         if ( ($memory != 0) && ($pid > 0) ){
 420                 print <<END;
 421                         <table width='95%' cellspacing='0' class='tbl'>
 422                                 <tr>
 423                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 424                                 </tr>
 425                                 <tr>
 426                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 427                                         <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
 428                                 </tr>
 429                                 <tr>
 430                                         <td class='base'></td>
 431                                         <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
 432                                         <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
 433                                 </tr>
 434                                 <tr>
 435                                         <td class='base'></td>
 436                                         <td bgcolor='$color{'color22'}' align='center'>$pid</td>
 437                                         <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
 438                                 </tr>
 439                         </table>
 440 END
 441         } else {
 442                 # Otherwise display a hint that the service is not launched.
 443                 print <<END;
 444                         <table width='95%' cellspacing='0' class='tbl'>
 445                                 <tr>
 446                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 447                                 </tr>
 448                                 <tr>
 449                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 450                                         <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
 451                                 </tr>
 452                         </table>
 453 END
 454         }
 455
 456         &Header::closebox();
 457
 458         # Draw elements for guardian configuration.
 459         &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
 460
 461         print <<END;
 462                 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 463
 464                 <table width='95%'>
 465                         <tr>
 466                                 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
 467                         </tr>
 468                         <tr>
 469                                 <td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
 470                                 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
 471                         </tr>
 472                         <tr>
 473                                 <td colspan='2'><br></td>
 474                         </tr>
 475                         <tr>
 476                                 <td width='20%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td>
 477                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='on' $checked{'GUARDIAN_MONITOR_SNORT'}{'on'} /> /
 478                                 <input type='radio' name='GUARDIAN_MONITOR_SNORT' value='off' $checked{'GUARDIAN_MONITOR_SNORT'}{'off'} /> off</td>
 479                         </tr>
 480                         <tr>
 481                                 <td width='20%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
 482                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_SSH' value='on' $checked{'GUARDIAN_MONITOR_SSH'}{'on'} /> /
 483                                 <input type='radio' name='GUARDIAN_MONITOR_SSH' value='off' $checked{'GUARDIAN_MONITOR_SSH'}{'off'} /> off</td>
 484                         </tr>
 485                         <tr>
 486                                 <td width='20%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
 487                                 <td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='on' $checked{'GUARDIAN_MONITOR_HTTPD'}{'on'} /> /
 488                                 <input type='radio' name='GUARDIAN_MONITOR_HTTPD' value='off' $checked{'GUARDIAN_MONITOR_HTTPD'}{'off'} /> off</td>
 489                         </tr>
 490 END
 491                         # Display owncloud checkbox when the addon is installed.
 492                         if ( -e "$owncloud_meta" ) {
 493                                 print"<tr>\n";
 494                                 print"<td width='20%' class='base'>$Lang::tr{'guardian block owncloud brute-force'}</td>\n";
 495                                 print"<td align='left'>on <input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='on' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'on'} /> /\n";
 496                                 print"<input type='radio' name='GUARDIAN_MONITOR_OWNCLOUD' value='off' $checked{'GUARDIAN_MONITOR_OWNCLOUD'}{'off'} /> off</td>\n";
 497                                 print"</tr>\n";
 498                         }
 499         print <<END;
 500                         <tr>
 501                                 <td colspan='2'><br></td>
 502                         </tr>
 503                         <tr>
 504                                 <td align='left' width='20%'>$Lang::tr{'guardian logfacility'}:</td>
 505                                 <td><select name='GUARDIAN_LOG_FACILITY'>
 506                                         <option value='syslog' $selected{'GUARDIAN_LOG_FACILITY'}{'syslog'}>syslog</option>
 507                                         <option value='file' $selected{'GUARDIAN_LOG_FACILITY'}{'file'}>file</option>
 508                                         <option value='console' $selected{'GUARDIAN_LOG_FACILITY'}{'console'}>console</option>
 509                                 </select></td>
 510                         </tr>
 511                         <tr>
 512                                 <td colspan='2'><br></td>
 513                         </tr>
 514                         <tr>
 515                                 <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
 516                                 <td><select name='GUARDIAN_LOGLEVEL'>
 517                                         <option value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>off</option>
 518                                         <option value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>info</option>
 519                                         <option value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>debug</option>
 520                                 </select></td>
 521                         </tr>
 522                         <tr>
 523                                 <td colspan='2'><br></td>
 524                         </tr>
 525                         <tr>
 526                                 <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td>
 527                                 <td><select name='GUARDIAN_SNORT_PRIORITY_LEVEL'>
 528                                         <option value='1' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'1'}>1</option>
 529                                         <option value='2' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'2'}>2</option>
 530                                         <option value='3' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'3'}>3</option>
 531                                         <option value='4' $selected{'GUARDIAN_SNORT_PRIORITY_LEVEL'}{'4'}>4</option>
 532                                 </select></td>
 533                         </tr>
 534                         <tr>
 535                                 <td colspan='2'><br></td>
 536                         </tr>
 537                         <tr>
 538                                 <td width='20%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
 539                                 <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
 540                         </tr>
 541                         <tr>
 542                                 <td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
 543                                 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
 544                         </tr>
 545                         <tr>
 546                                 <td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
 547                                 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
 548                         </tr>
 549                 </table>
 550 END
 551
 552         print <<END;
 553                 <hr>
 554
 555                 <table width='95%'>
 556                         <tr>
 557                                 <td>&nbsp;</td>
 558                                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
 559                                 <td>&nbsp;</td>
 560                         </tr>
 561                 </table>
 562         </form>
 563 END
 564
 565         &Header::closebox();
 566 }
 567
 568 # Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
 569 sub showIgnoreBox() {
 570         &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
 571
 572         print <<END;
 573                 <table width='80%'>
 574                         <tr>
 575                                 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'ip address'}</b></td>
 576                                 <td class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'remark'}</b></td>
 577                                 <td class='base' colspan='3' bgcolor='$color{'color20'}'></td>
 578                         </tr>
 579 END
 580                         # Check if some hosts have been add to be ignored.
 581                         if (keys (%ignored)) {
 582                                 my $col = "";
 583
 584                                 # Loop through all entries of the hash..
 585                                 while( (my $key) = each %ignored)  {
 586                                         # Assign data array positions to some nice variable names.
 587                                         my $address = $ignored{$key}[0];
 588                                         my $remark = $ignored{$key}[1];
 589                                         my $status  = $ignored{$key}[2];
 590
 591                                         # Check if the key (id) number is even or not.
 592                                         if ($settings{'ID'} eq $key) {
 593                                                 $col="bgcolor='${Header::colouryellow}'";
 594                                         } elsif ($key % 2) {
 595                                                 $col="bgcolor='$color{'color22'}'";
 596                                         } else {
 597                                                 $col="bgcolor='$color{'color20'}'";
 598                                         }
 599
 600                                         # Choose icon for the checkbox.
 601                                         my $gif;
 602                                         my $gdesc;
 603
 604                                         # Check if the status is enabled and select the correct image and description.
 605                                         if ($status eq 'enabled' ) {
 606                                                 $gif = 'on.gif';
 607                                                 $gdesc = $Lang::tr{'click to disable'};
 608                                         } else {
 609                                                 $gif = 'off.gif';
 610                                                 $gdesc = $Lang::tr{'click to enable'};
 611                                         }
 612
 613                                         print <<END;
 614                                         <tr>
 615                                                 <td width='20%' class='base' $col>$address</td>
 616                                                 <td width='65%' class='base' $col>$remark</td>
 617
 618                                                 <td align='center' $col>
 619                                                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 620                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
 621                                                                 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$gdesc' title='$gdesc' />
 622                                                                 <input type='hidden' name='ID' value='$key' />
 623                                                         </form>
 624                                                 </td>
 625
 626                                                 <td align='center' $col>
 627                                                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 628                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
 629                                                                 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
 630                                                                 <input type='hidden' name='ID' value='$key' />
 631                                                         </form>
 632                                                 </td>
 633
 634                                                 <td align='center' $col>
 635                                                         <form method='post' name='$key' action='$ENV{'SCRIPT_NAME'}'>
 636                                                                 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
 637                                                                 <input type='hidden' name='ID' value='$key'>
 638                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
 639                                                         </form>
 640                                                 </td>
 641                                         </tr>
 642 END
 643                                 }
 644                         } else {
 645                                 # Print notice that currently no hosts are ignored.
 646                                 print "<tr>\n";
 647                                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 648                                 print "</tr>\n";
 649                         }
 650
 651                 print "</table>\n";
 652
 653         # Section to add new elements or edit existing ones.
 654         print <<END;
 655         <br>
 656         <hr>
 657         <br>
 658
 659         <div align='center'>
 660                 <table width='100%'>
 661 END
 662
 663         # Assign correct headline and button text.
 664         my $buttontext;
 665         my $entry_address;
 666         my $entry_remark;
 667
 668         # Check if an ID (key) has been given, in this case an existing entry should be edited.
 669         if ($settings{'ID'} ne '') {
 670                 $buttontext = $Lang::tr{'update'};
 671                 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'update'}</b></td></tr>\n";
 672
 673                 # Grab address and remark for the given key.
 674                 $entry_address = $ignored{$settings{'ID'}}[0];
 675                 $entry_remark = $ignored{$settings{'ID'}}[1];
 676         } else {
 677                 $buttontext = $Lang::tr{'add'};
 678                 print "<tr><td class='boldbase' colspan='3'><b>$Lang::tr{'dnsforward add a new entry'}</b></td></tr>\n";
 679         }
 680
 681         print <<END;
 682                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 683                         <input type='hidden' name='ID' value='$settings{'ID'}'>
 684                         <tr>
 685                                 <td width='30%'>$Lang::tr{'ip address'}: </td>
 686                                 <td width='50%'><input type='text' name='IGNORE_ENTRY_ADDRESS' value='$entry_address' size='24' /></td>
 687
 688                                 <td width='30%'>$Lang::tr{'remark'}: </td>
 689                                 <td wicth='50%'><input type='text' name=IGNORE_ENTRY_REMARK value='$entry_remark' size='24' /></td>
 690                                 <td align='center' width='20%'><input type='submit' name='ACTION' value='$buttontext' /></td>
 691                         </tr>
 692                         </form>
 693                 </table>
 694         </div>
 695 END
 696
 697         &Header::closebox();
 698 }
 699
 700 # Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
 701 sub showBlockedBox() {
 702         &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
 703
 704         print <<END;
 705         <table width='60%'>
 706                 <tr>
 707                         <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
 708                 </tr>
 709 END
 710
 711                 # Lauch function to get the currently blocked hosts.
 712                 my @blocked_hosts = &GetBlockedHosts();
 713
 714                 my $id = 0;
 715                 my $col = "";
 716
 717                 # Loop through our blocked hosts array.
 718                 foreach my $blocked_host (@blocked_hosts) {
 719
 720                         # Increase id number for each element in the ignore file.
 721                         $id++;
 722
 723                         # Check if the id number is even or not.
 724                         if ($id % 2) {
 725                                 $col="bgcolor='$color{'color22'}'";
 726                         } else {
 727                                 $col="bgcolor='$color{'color20'}'";
 728                         }
 729
 730                         print <<END;
 731                         <tr>
 732                                 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
 733                                 <td width='20%' align='center' $col>
 734                                         <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
 735                                                 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
 736                                                 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
 737                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
 738                                         </form>
 739                                 </td>
 740                         </tr>
 741 END
 742                 }
 743
 744         # If the loop only has been runs once the id still is "0", which means there are no
 745         # additional entries (blocked hosts) in the iptables chain.
 746         if ($id == 0) {
 747
 748                 # Print notice that currently no hosts are blocked.
 749                 print "<tr>\n";
 750                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 751                 print "</tr>\n";
 752         }
 753
 754         print "</table>\n";
 755
 756         # Section for a manual block of an IP-address.
 757         print <<END;
 758         <br>
 759         <div align='center'>
 760                 <table width='60%' border='0'>
 761                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 762                         <tr>
 763                                 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
 764                                 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
 765                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
 766                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
 767                         </tr>
 768                         </form>
 769                 </table>
 770         </div>
 771 END
 772
 773         &Header::closebox();
 774 }
 775
 776 &Header::closebigbox();
 777 &Header::closepage();
 778
 779 # Function to check if guardian has been started.
 780 # Grab process id and consumed memory if the daemon is running.
 781 sub daemonstats() {
 782         $memory = 0;
 783         # for pid and memory
 784         open(FILE, '/usr/local/bin/addonctrl guardian status | ');
 785         @guardian = <FILE>;
 786         close(FILE);
 787         $string = join("", @guardian);
 788         $string =~ s/[a-z_]//gi;
 789         $string =~ s/\[[0-1]\;[0-9]+//gi;
 790         $string =~ s/[\(\)\.]//gi;
 791         $string =~ s/  //gi;
 792         $string =~ s/\e//gi;
 793         @pid = split(/\s/,$string);
 794         if (open(FILE, "/proc/$pid[0]/statm")){
 795                 my $temp = <FILE>;
 796                 @memory = split(/ /,$temp);
 797                 close(FILE);
 798         }
 799         $memory+=$memory[0];
 800 }
 801
 802 sub GetBlockedHosts() {
 803         # Create new, empty array.
 804         my @hosts;
 805
 806         # Lauch helper to get chains from iptables.
 807         system('/usr/local/bin/getipstat');
 808
 809         # Open temporary file which contains the chains and rules.
 810         open (FILE, '/srv/web/ipfire/html/iptables.txt');
 811
 812         # Loop through the entire file.
 813         while (<FILE>) {
 814                 my $line = $_;
 815
 816                 # Search for the guardian chain and extract
 817                 # the lines between it and the next empty line
 818                 # which is placed before the next firewall
 819                 # chain starts.
 820                 if ($line =~ /^Chain GUARDIAN/ .. /^\s*$/) {
 821                         # Skip descriptive lines.
 822                         next if ($line =~ /^Chain/);
 823                         next if ($line =~ /^ pkts/);
 824
 825                         # Generate array, based on the line content (seperator is a single or multiple space's)
 826                         my @comps = split(/\s{1,}/, $line);
 827                         my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
 828
 829                         # Assign different variable names.
 830                         my $blocked_host = $source;
 831
 832                         # Add host to our hosts array.
 833                         if ($blocked_host) {
 834                                 push(@hosts, $blocked_host);
 835                         }
 836                 }
 837         }
 838
 839         # Close filehandle.
 840         close(FILE);
 841
 842         # Remove recently created temporary files of the "getipstat" binary.
 843         system(rm -f "/srv/web/ipfire/html/iptables.txt");
 844         system(rm -f "/srv/web/ipfire/html/iptablesmangle.txt");
 845         system(rm -f "/srv/web/ipfire/html/iptablesnat.txt");
 846
 847         # Convert entries, sort them, write back and store the sorted entries into new array.
 848         my @sorted = map  { $_->[0] }
 849              sort { $a->[1] <=> $b->[1] }
 850              map  { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
 851              @hosts;
 852
 853         # Return our sorted list.
 854         return @sorted
 855 }
 856
 857 sub BuildConfiguration() {
 858         my %settings = ();
 859         &General::readhash("${General::swroot}/guardian/settings", \%settings);
 860
 861         my $configfile = "${General::swroot}/guardian/guardian.conf";
 862
 863         # Open configfile for writing.
 864         open(FILE, ">$configfile");
 865
 866         # Config file header.
 867         print FILE "# Autogenerated configuration file.\n";
 868         print FILE "# All user modifications will be overwritten.\n\n";
 869
 870         # Settings for the logging mechanism.
 871         print FILE "# Log settings.\n";
 872         print FILE "LogFacility = $settings{'GUARDIAN_LOG_FACILITY'}\n";
 873
 874         if ($settings{'GUARDIAN_LOG_FACILITY'} eq "file") {
 875                 print FILE "LogFile = $settings{'GUARDIAN_LOGFILE'}\n";
 876         }
 877
 878         print FILE "LogLevel = $settings{'GUARDIAN_LOGLEVEL'}\n\n";
 879
 880         # IPFire related static settings.
 881         print FILE "# IPFire related settings.\n";
 882         print FILE "FirewallEngine = IPtables\n";
 883         print FILE "SocketOwner = nobody:nobody\n";
 884         print FILE "IgnoreFile = $ignorefile\n\n";
 885
 886         # Configured block values.
 887         print FILE "# Configured block values.\n";
 888         print FILE "BlockCount = $settings{'GUARDIAN_BLOCKCOUNT'}\n";
 889         print FILE "BlockTime = $settings{'GUARDIAN_BLOCKTIME'}\n\n";
 890
 891         # Enabled modules.
 892         # Loop through whole settings hash.
 893         print FILE "# Enabled modules.\n";
 894         foreach my $option (keys %settings) {
 895                 # Search for enabled modules.
 896                 if ($option =~ /GUARDIAN_MONITOR_(.*)/) {
 897                         # Skip if module is not enabled.
 898                         next unless($settings{$option} eq "on");
 899
 900                         # Skip module if no file location is available.
 901                         next unless(exists($module_file_locations{$1}));
 902
 903                         # Add enabled module and defined path to the config file.
 904                         print FILE "Monitor_$1 = $module_file_locations{$1}\n";
 905                 }
 906         }
 907
 908         # Module settings.
 909         print FILE "\n# Module settings.\n";
 910         # Check if SNORT is enabled and add snort priority.
 911         if ($settings{'GUARDIAN_MONITOR_SNORT'} eq "on") {
 912                 print FILE "SnortPriorityLevel = $settings{'GUARDIAN_SNORT_PRIORITY_LEVEL'}\n";
 913         }
 914
 915         close(FILE);
 916
 917         # Check if guardian should be started or stopped.
 918         if($settings{'GUARDIAN_ENABLED'} eq 'on') {
 919                 if($pid > 0) {
 920                         # Send reload command through socket connection.
 921                         &Guardian::Socket::Client("reload");
 922                 } else {
 923                         # Launch guardian.
 924                         system("/usr/local/bin/addonctrl guardian start &>/dev/null");
 925                 }
 926         } else {
 927                 # Stop the daemon.
 928                 system("/usr/local/bin/addonctrl guardian stop &>/dev/null");
 929         }
 930 }