]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - html/cgi-bin/guardian.cgi
projects / people / pmueller / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
guardian.cgi: Add configure options for owncloud.
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / guardian.cgi
CommitLineData
01dbccb1
SS		 1#!/usr/bin/perl
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
5# Copyright (C) 2014 IPFire Team <info@ipfire.org> #
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
21
22use strict;
23use Locale::Country;
24
25# enable only the following on debugging purpose
26use warnings;
27use CGI::Carp 'fatalsToBrowser';
28
29require '/var/ipfire/general-functions.pl';
30require "${General::swroot}/lang.pl";
31require "${General::swroot}/header.pl";
32
33#workaround to suppress a warning when a variable is used only once
34my @dummy = ( ${Header::colouryellow} );
35undef (@dummy);
36
37my $string=();
38my $memory=();
39my @memory=();
40my @pid=();
41my @guardian=();
01dbccb1
SS		 42
43# Path to the guardian.ignore file.
44my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
45
01dbccb1
SS		 46our %netsettings = ();
47&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
48
49our %color = ();
50our %mainsettings = ();
51&General::readhash("${General::swroot}/main/settings", \%mainsettings);
52&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
53
28981fac
SS		 54# Pakfire meta file for owncloud.
55# (File exists when the addon is installed.)
56my $owncloud_meta = "/opt/pakfire/db/meta/meta-owncloud";
57
01dbccb1
SS		 58our %settings = ();
59
28981fac
SS		 60$settings{'ACTION'} = '';
61
01dbccb1 62$settings{'GUARDIAN_ENABLED'} = 'off';
26fcd31e
SS		 63$settings{'GUARDIAN_ENABLE_SNORT'} = 'on';
64$settings{'GUARDIAN_ENABLE_SSH'} = 'on';
65$settings{'GUARDIAN_ENABLE_HTTPD'} = 'on';
a35a0668
SS		 66$settings{'GUARDIAN_LOGLEVEL'} = 'info';
67$settings{'GUARDIAN_BLOCKCOUNT'} = '3';
01dbccb1
SS		 68$settings{'GUARDIAN_BLOCKTIME'} = '86400';
69$settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
70$settings{'GUARDIAN_SNORT_ALERTFILE'} = '/var/log/snort/alert';
4a7fc9f6 71$settings{'GUARDIAN_PRIORITY_LEVEL'} = '3';
01dbccb1 72
28981fac
SS		 73# Default settings for owncloud if installed.
74if ( -e "$owncloud_meta") {
75 $settings{'GUARDIAN_ENABLE_OWNCLOUD'} = 'off';
76}
01dbccb1
SS		 77
78my $errormessage = '';
79
80&Header::showhttpheaders();
81
82# Get GUI values.
83&Header::getcgihash(\%settings);
01dbccb1 84
f8c3bfe0
SS		 85# Check if guardian is running and grab some stats.
86&daemonstats();
87my $pid = @pid[0];
88
01dbccb1
SS		 89## Perform input checks and save settings.
90#
91if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
01dbccb1 92 # Check for valid blocktime.
96655fa6 93 unless(($settings{'GUARDIAN_BLOCKTIME'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKTIME'} ne "0")) {
01dbccb1 94 $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
a35a0668
SS		 95 }
96
97 # Check if the bloccount is valid.
96655fa6 98 unless(($settings{'GUARDIAN_BLOCKCOUNT'} =~ /^\d+$/) && ($settings{'GUARDIAN_BLOCKCOUNT'} ne "0")) {
a35a0668 99 $errormessage = "$Lang::tr{'guardian invalid blockcount'}";
01dbccb1
SS		 100 }
101
102 # Check Logfile.
96655fa6 103 unless($settings{'GUARDIAN_LOGFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
a35a0668 104 $errormessage = "$Lang::tr{'guardian invalid logfile'}";
01dbccb1
SS		 105 }
106
107 # Check input for snort alert file.
96655fa6 108 unless($settings{'GUARDIAN_SNORT_ALERTFILE'} =~ /^[a-zA-Z0-9\.\/]+$/) {
a35a0668
SS		 109 $errormessage = "$Lang::tr{'guardian invalid alertfile'}";
110 }
01dbccb1
SS		 111
112 # Only continue if no error message has been set.
96655fa6 113 if($errormessage eq '') {
01dbccb1
SS		 114 # Write configuration settings to file.
115 &General::writehash("${General::swroot}/guardian/settings", \%settings);
116
117 # Update configuration files.
118 &BuildConfiguration();
119 }
120
121## Add a new entry to the ignore file.
122#
123} elsif ($settings{'ACTION'} eq $Lang::tr{'add'}) {
124
125 # Check if any input has been performed.
126 if ($settings{'NEW_IGNORE_ENTRY'} ne '') {
127
128 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
129 if ((!&General::validip($settings{'NEW_IGNORE_ENTRY'})) && (!&General::validipandmask($settings{'NEW_IGNORE_ENTRY'}))) {
130 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
131 }
132 } else {
133 $errormessage = "$Lang::tr{'guardian empty input'}";
134 }
135
136 # Go further if there was no error.
137 if ($errormessage eq '') {
138 my $new_entry = $settings{'NEW_IGNORE_ENTRY'};
139
140 # Open file for appending the new entry.
141 open (FILE, ">>$ignorefile") or die "Unable to open $ignorefile for writing";
142
143 # Write the new entry to the ignore file.
144 print FILE "$new_entry\n";
145 close(FILE);
146 }
147
f8c3bfe0
SS		 148 # Check if guardian is running.
149 if ($pid > 0) {
150 # Call guardianctrl to perform a reload.
151 system("/usr/local/bin/guardianctrl reload &>/dev/null");
152 }
153
01dbccb1
SS		 154## Remove entry from ignore list.
155#
156} elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
157 my $id = 0;
158
159 # Open ignorefile and read content.
160 open(FILE, "<$ignorefile") or die "Unable to open $ignorefile.";
161 my @current = <FILE>;
162 close(FILE);
163
164 # Re-open ignorefile for writing.
165 open(FILE, ">$ignorefile") or die "Unable to open $ignorefile for writing";
166 flock FILE, 2;
167
168 # Read line by line from ignorefile and write them back except the line with the given ID.
169 # So this line is missing in the new file and the entry has been deleted.
170 foreach my $line (@current) {
171 $id++;
a35a0668 172 unless ($settings{'ID'} eq $id) {
01dbccb1
SS		 173 print FILE "$line";
174 }
175 }
176 close(FILE);
177
f8c3bfe0
SS		 178 # Check if guardian is running.
179 if ($pid > 0) {
180 # Call guardianctrl to perform a reload.
181 system("/usr/local/bin/guardianctrl reload &>/dev/null");
182 }
183
01dbccb1
SS		 184## Block a user given address or subnet.
185#
186} elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
187
c973d6da
SS		 188 # Assign some temporary variables used for input validation.
189 my $input = $settings{'ADDRESS_BLOCK'};
190 my $green = $netsettings{'GREEN_ADDRESS'};
191 my $blue = $netsettings{'BLUE_ADDRESS'};
192 my $orange = $netsettings{'ORANGE_ADDRESS'};
193 my $red = $netsettings{'RED_ADDRESS'};
01dbccb1 194
c973d6da
SS		 195 # Get gateway address.
196 my $gateway = &General::get_gateway();
01dbccb1 197
c973d6da
SS		 198 # Check if any input has been performed.
199 if ($input eq '') {
200 $errormessage = "$Lang::tr{'guardian empty input'}";
201 }
202
203 # Check if the given input is localhost (127.0.0.1).
204 elsif ($input eq "127.0.0.1") {
205 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
206 }
207
208 # Check if the given input is anywhere (0.0.0.0).
209 elsif ($input eq "0.0.0.0") {
210 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
211 }
212
213 # Check if the given input is one of the interface addresses or our gateway.
214 elsif ($input eq "$green" || $input eq "$blue" || $input eq "$orange" || $input eq "$red" || $input eq "$gateway") {
215 $errormessage = "$Lang::tr{'guardian blocking of this address is not allowed'}";
216 }
217
218 # Check if the given input is a valid IP address.
219 elsif (!&General::validip($input)) {
220 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
221 }
01dbccb1
SS		 222
223 # Go further if there was no error.
224 if ($errormessage eq '') {
225 my $block = $settings{'ADDRESS_BLOCK'};
226
227 # Call helper to unblock address.
228 system("/usr/local/bin/guardianctrl block $block &>/dev/null");
229 }
230
231## Unblock address or subnet.
232#
233} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
234
235 # Check if no empty input has been performed.
236 if ($settings{'ADDRESS_UNBLOCK'} ne '') {
237
238 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
239 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
240 $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
241 }
242
243 } else {
244 $errormessage = "$Lang::tr{'guardian empty input'}";
245 }
246
247 # Go further if there was no error.
248 if ($errormessage eq '') {
249 my $unblock = $settings{'ADDRESS_UNBLOCK'};
250
251 # Call helper to unblock address.
252 system("/usr/local/bin/guardianctrl unblock $unblock &>/dev/null");
253 }
254
255## Unblock all.
256#
257} elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
258
259 # Call helper to flush iptables chain from guardian.
260 system("/usr/local/bin/guardianctrl flush-chain &>/dev/null");
01dbccb1
SS		 261}
262
36dbcf2e
SS		 263# Load settings from file.
264&General::readhash("${General::swroot}/guardian/settings", \%settings);
01dbccb1
SS		 265
266# Call functions to generate whole page.
267&showMainBox();
268&showIgnoreBox();
269
270# Display area only if guardian is running.
f8c3bfe0 271if ( ($memory != 0) && ($pid > 0) ) {
01dbccb1
SS		 272 &showBlockedBox();
273}
274
275# Function to display the status of guardian and allow base configuration.
276sub showMainBox() {
277 my %checked = ();
7899718f 278 my %selected = ();
01dbccb1
SS		 279
280 $checked{'GUARDIAN_ENABLED'}{'on'} = '';
281 $checked{'GUARDIAN_ENABLED'}{'off'} = '';
282 $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
26fcd31e
SS		 283 $checked{'GUARDIAN_ENABLE_SNORT'}{'off'} = '';
284 $checked{'GUARDIAN_ENABLE_SNORT'}{'on'} = '';
285 $checked{'GUARDIAN_ENABLE_SNORT'}{$settings{'GUARDIAN_ENABLE_SNORT'}} = "checked='checked'";
286 $checked{'GUARDIAN_ENABLE_SSH'}{'off'} = '';
287 $checked{'GUARDIAN_ENABLE_SSH'}{'on'} = '';
288 $checked{'GUARDIAN_ENABLE_SSH'}{$settings{'GUARDIAN_ENABLE_SSH'}} = "checked='checked'";
289 $checked{'GUARDIAN_ENABLE_HTTPD'}{'off'} = '';
290 $checked{'GUARDIAN_ENABLE_HTTPD'}{'on'} = '';
291 $checked{'GUARDIAN_ENABLE_HTTPD'}{$settings{'GUARDIAN_ENABLE_HTTPD'}} = "checked='checked'";
28981fac
SS		 292 $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'off'} = '';
293 $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'on'} = '';
294 $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{$settings{'GUARDIAN_ENABLE_OWNCLOUD'}} = "checked='checked'";
01dbccb1 295
4a7fc9f6
SS		 296 $selected{'GUARDIAN_LOGLEVEL'}{$settings{'GUARDIAN_LOGLEVEL'}} = 'selected';
297 $selected{'GUARDIAN_PRIORITY_LEVEL'}{$settings{'GUARDIAN_PRIORITY_LEVEL'}} = 'selected';
7899718f 298
01dbccb1
SS		 299 &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
300 &Header::openbigbox('100%', 'left', '', $errormessage);
301
302 # Print errormessage if there is one.
303 if ($errormessage) {
304 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
305 print "<font class='base'>$errormessage&nbsp;</font>\n";
306 &Header::closebox();
307 }
308
309
310 # Draw current guardian state.
311 &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
312
f8c3bfe0 313 # Get current status of guardian.
01dbccb1 314 &daemonstats();
f8c3bfe0 315 $pid = @pid[0];
01dbccb1
SS		 316
317 # Display some useful information related to guardian, if daemon is running.
f8c3bfe0 318 if ( ($memory != 0) && ($pid > 0) ){
01dbccb1
SS		 319 print <<END;
320 <table width='95%' cellspacing='0' class='tbl'>
321 <tr>
322 <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
323 </tr>
324 <tr>
325 <td class='base'>$Lang::tr{'guardian daemon'}</td>
326 <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
327 </tr>
328 <tr>
329 <td class='base'></td>
330 <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
331 <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
332 </tr>
333 <tr>
334 <td class='base'></td>
335 <td bgcolor='$color{'color22'}' align='center'>@pid[0]</td>
336 <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
337 </tr>
338 </table>
339END
340 } else {
341 # Otherwise display a hint that the service is not launched.
342 print <<END;
343 <table width='95%' cellspacing='0' class='tbl'>
344 <tr>
345 <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
346 </tr>
347 <tr>
348 <td class='base'>$Lang::tr{'guardian daemon'}</td>
349 <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
350 </tr>
351 </table>
352END
353 }
354
355 &Header::closebox();
356
357 # Draw elements for guardian configuration.
358 &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
359
360 print <<END;
361 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
362
363 <table width='95%'>
364 <tr>
d2fea55e 365 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
01dbccb1
SS		 366 </tr>
367 <tr>
368 <td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
d2fea55e 369 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
01dbccb1 370 </tr>
26fcd31e
SS		 371 <tr>
372 <td colspan='2'><br></td>
373 </tr>
374 <tr>
06ff7e28 375 <td width='20%' class='base'>$Lang::tr{'guardian watch snort alertfile'}</td>
26fcd31e
SS		 376 <td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_SNORT' value='on' $checked{'GUARDIAN_ENABLE_SNORT'}{'on'} /> /
377 <input type='radio' name='GUARDIAN_ENABLE_SNORT' value='off' $checked{'GUARDIAN_ENABLE_SNORT'}{'off'} /> off</td>
378 </tr>
379 <tr>
06ff7e28 380 <td width='20%' class='base'>$Lang::tr{'guardian block ssh brute-force'}</td>
26fcd31e
SS		 381 <td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_SSH' value='on' $checked{'GUARDIAN_ENABLE_SSH'}{'on'} /> /
382 <input type='radio' name='GUARDIAN_ENABLE_SSH' value='off' $checked{'GUARDIAN_ENABLE_SSH'}{'off'} /> off</td>
383 </tr>
384 <tr>
06ff7e28 385 <td width='20%' class='base'>$Lang::tr{'guardian block httpd brute-force'}</td>
26fcd31e
SS		 386 <td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_HTTPD' value='on' $checked{'GUARDIAN_ENABLE_HTTPD'}{'on'} /> /
387 <input type='radio' name='GUARDIAN_ENABLE_HTTPD' value='off' $checked{'GUARDIAN_ENABLE_HTTPD'}{'off'} /> off</td>
388 </tr>
28981fac
SS		 389END
390 # Display owncloud checkbox when the addon is installed.
391 if ( -e "$owncloud_meta" ) {
392 print"<tr>\n";
393 print"<td width='20%' class='base'>$Lang::tr{'guardian block owncloud brute-force'}</td>\n";
394 print"<td align='left'>on <input type='radio' name='GUARDIAN_ENABLE_OWNCLOUD' value='on' $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'on'} /> /\n";
395 print"<input type='radio' name='GUARDIAN_ENABLE_OWNCLOUD' value='off' $checked{'GUARDIAN_ENABLE_OWNCLOUD'}{'off'} /> off</td>\n";
396 print"</tr>\n";
397 }
398 print <<END;
26fcd31e
SS		 399 <tr>
400 <td colspan='2'><br></td>
401 </tr>
7899718f 402 <tr>
a35a0668 403 <td align='left' width='20%'>$Lang::tr{'guardian loglevel'}:</td>
7899718f
SS		 404 <td><select name='GUARDIAN_LOGLEVEL'>
405 <option value='off' $selected{'GUARDIAN_LOGLEVEL'}{'off'}>off</option>
406 <option value='info' $selected{'GUARDIAN_LOGLEVEL'}{'info'}>info</option>
407 <option value='debug' $selected{'GUARDIAN_LOGLEVEL'}{'debug'}>debug</option>
408 </select></td>
409 </tr>
a35a0668
SS		 410 <tr>
411 <td colspan='2'><br></td>
412 </tr>
4a7fc9f6
SS		 413 <tr>
414 <td align='left' width='20%'>$Lang::tr{'guardian priority level'}:</td>
415 <td><select name='GUARDIAN_PRIORITY_LEVEL'>
416 <option value='1' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'1'}>1</option>
417 <option value='2' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'2'}>2</option>
418 <option value='3' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'3'}>3</option>
419 <option value='4' $selected{'GUARDIAN_PRIORITY_LEVEL'}{'4'}>4</option>
420 </select></td>
421 </tr>
422 <tr>
423 <td colspan='2'><br></td>
424 </tr>
a35a0668
SS		 425 <tr>
426 <td width='20%' class='base'>$Lang::tr{'guardian blockcount'}:</td>
427 <td><input type='text' name='GUARDIAN_BLOCKCOUNT' value='$settings{'GUARDIAN_BLOCKCOUNT'}' size='5' /></td>
428 </tr>
01dbccb1
SS		 429 <tr>
430 <td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
d2fea55e 431 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
01dbccb1
SS		 432 </tr>
433 <tr>
434 <td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
d2fea55e 435 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
01dbccb1
SS		 436 </tr>
437 <tr>
438 <td width='20%' class='base'>$Lang::tr{'guardian snort alertfile'}:</td>
d2fea55e 439 <td><input type='text' name='GUARDIAN_SNORT_ALERTFILE' value='$settings{'GUARDIAN_SNORT_ALERTFILE'}' size='30' /></td>
01dbccb1
SS		 440 </tr>
441 </table>
442END
443
444 print <<END;
445 <hr>
446
447 <table width='95%'>
448 <tr>
449 <td>&nbsp;</td>
450 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
451 <td>&nbsp;</td>
452 </tr>
453 </table>
454 </form>
455END
456
457 &Header::closebox();
458}
459
460# Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
461sub showIgnoreBox() {
462 &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
463
464 print <<END;
465 <table width='60%'>
466 <tr>
467 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian ignored hosts'}</b></td>
468 </tr>
469END
470 # Check if the guardian ignore file contains any content.
471 if (-s $ignorefile) {
472
473 # Open file and print contents.
474 open FILE, $ignorefile or die "Could not open $ignorefile";
475
476 my $id = 0;
477 my $col = "";
478
479 # Read file line by line and print out the elements.
480 while( my $ignored_element = <FILE> ) {
481
482 # Increase id number for each element in the ignore file.
483 $id++;
484
485 # Check if the id number is even or not.
486 if ($id % 2) {
487 $col="bgcolor='$color{'color22'}'";
488 } else {
489 $col="bgcolor='$color{'color20'}'";
490 }
491
492 print <<END;
493 <tr>
494 <td width='80%' class='base' $col>$ignored_element</td>
495 <td width='20%' align='center' $col>
a35a0668 496 <form method='post' name='$id' action='$ENV{'SCRIPT_NAME'}'>
01dbccb1
SS		 497 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
498 <input type='hidden' name='ID' value='$id'>
499 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
500 </form>
501 </td>
502 </tr>
503END
504 }
505 close (FILE);
506 } else {
507 # Print notice that currently no elements are stored in the ignore file.
508 print "<tr>\n";
509 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
510 print "</tr>\n";
511 }
512
513 print "</table>\n";
514
01dbccb1
SS		 515 # Section to add new elements to the ignore list.
516 print <<END;
1d5702a7
SS		 517 <br>
518 <div align='center'>
01dbccb1
SS		 519 <table width='60%'>
520 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
521 <tr>
522 <td width='30%'>$Lang::tr{'dnsforward add a new entry'}: </td>
523 <td width='50%'><input type='text' name='NEW_IGNORE_ENTRY' value='' size='24' /></td>
524 <td align='center' width='20%'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
525 </tr>
526 </form>
527 </table>
528 </div>
529END
1d5702a7
SS		 530
531 &Header::closebox();
01dbccb1
SS		 532}
533
534# Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
535sub showBlockedBox() {
536 &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
537
01dbccb1
SS		 538 print <<END;
539 <table width='60%'>
540 <tr>
541 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
542 </tr>
543END
544
5f462919
SS		 545 # Lauch function to get the currently blocked hosts.
546 my @blocked_hosts = &GetBlockedHosts();
547
01dbccb1 548 my $id = 0;
01dbccb1 549 my $col = "";
01dbccb1 550
5f462919
SS		 551 # Loop through our blocked hosts array.
552 foreach my $blocked_host (@blocked_hosts) {
01dbccb1
SS		 553
554 # Increase id number for each element in the ignore file.
555 $id++;
556
557 # Check if the id number is even or not.
558 if ($id % 2) {
559 $col="bgcolor='$color{'color22'}'";
560 } else {
561 $col="bgcolor='$color{'color20'}'";
562 }
563
564 print <<END;
565 <tr>
8b8413e5 566 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
01dbccb1
SS		 567 <td width='20%' align='center' $col>
568 <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
569 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
570 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
571 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
572 </form>
573 </td>
574 </tr>
575END
576 }
577
01dbccb1
SS		 578 # If the loop only has been runs once the id still is "0", which means there are no
579 # additional entries (blocked hosts) in the iptables chain.
580 if ($id == 0) {
581
582 # Print notice that currently no hosts are blocked.
583 print "<tr>\n";
584 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
585 print "</tr>\n";
586 }
587
588 print "</table>\n";
589
01dbccb1
SS		 590 # Section for a manual block of an IP-address.
591 print <<END;
1d5702a7
SS		 592 <br>
593 <div align='center'>
594 <table width='60%' border='0'>
01dbccb1
SS		 595 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
596 <tr>
597 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
598 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
599 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
600 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
601 </tr>
602 </form>
603 </table>
604 </div>
605END
1d5702a7
SS		 606
607 &Header::closebox();
01dbccb1
SS		 608}
609
610&Header::closebigbox();
611&Header::closepage();
612
613# Function to check if guardian has been started.
614# Grab process id and consumed memory if the daemon is running.
615sub daemonstats() {
616 $memory = 0;
617 # for pid and memory
618 open(FILE, '/usr/local/bin/addonctrl guardian status | ');
619 @guardian = <FILE>;
620 close(FILE);
621 $string = join("", @guardian);
622 $string =~ s/[a-z_]//gi;
623 $string =~ s/\[[0-1]\;[0-9]+//gi;
624 $string =~ s/[\(\)\.]//gi;
625 $string =~ s/ //gi;
626 $string =~ s/\e//gi;
627 @pid = split(/\s/,$string);
628 if (open(FILE, "/proc/$pid[0]/statm")){
629 my $temp = <FILE>;
630 @memory = split(/ /,$temp);
631 close(FILE);
632 }
633 $memory+=$memory[0];
634}
635
5f462919
SS		 636sub GetBlockedHosts() {
637
638 # Create new, empty array.
639 my @hosts;
640
641 # Lauch helper to get chains from iptables.
642 open(FILE, "/usr/local/bin/guardianctrl get-chain |");
643
644 # Read file line by line and print out the elements.
645 foreach my $line (<FILE>) {
646
647 # Skip descriptive lines.
648 next if ($line =~ /^Chain/);
649 next if ($line =~ /^ pkts/);
650
651 # Generate array, based on the line content (seperator is a single or multiple space's)
652 my @comps = split(/\s{1,}/, $line);
653 my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
654
655 # Assign different variable names.
656 my $blocked_host = $source;
657
658 # Add host to our hosts array.
659 push(@hosts, $blocked_host);
660 }
661
662 # Convert entries, sort them, write back and store the sorted entries into new array.
663 my @sorted = map { $_->[0] }
664 sort { $a->[1] <=> $b->[1] }
665 map { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
666 @hosts;
667
668 # Return our sorted list.
669 return @sorted
670}
671
01dbccb1
SS		 672sub BuildConfiguration() {
673 my %settings = ();
674 &General::readhash("${General::swroot}/guardian/settings", \%settings);
675
676 my $configfile = "${General::swroot}/guardian/guardian.conf";
677
7f728591
SS		 678 # We set this to 1 (enabled) to prevent guardian from blocking the ISP gateway.
679 my $HostGatewayByte = "1";
680
7f728591 681 # Open configfile for writing.
01dbccb1
SS		 682 open(FILE, ">$configfile");
683
473c7257
SS		 684 print FILE "EnableSnortMonitoring\t\t$settings{'GUARDIAN_ENABLE_SNORT'}\n";
685 print FILE "EnableSSHMonitoring\t\t$settings{'GUARDIAN_ENABLE_SSH'}\n";
686 print FILE "EnableHTTPDMonitoring\t\t$settings{'GUARDIAN_ENABLE_HTTPD'}\n";
28981fac
SS		 687
688 # Check if owncloud settings should be written.
689 if (exists $settings{'GUARDIAN_ENABLE_OWNCLOUD'}) {
690 print FILE "EnableOwncloudMonitoring\t$settings{'GUARDIAN_ENABLE_OWNCLOUD'}\n";
691 }
692
473c7257
SS		 693 print FILE "LogLevel\t\t\t$settings{'GUARDIAN_LOGLEVEL'}\n";
694 print FILE "BlockCount\t\t\t$settings{'GUARDIAN_BLOCKCOUNT'}\n";
695 print FILE "HostGatewayByte\t\t\t$HostGatewayByte\n";
696 print FILE "LogFile\t\t\t\t$settings{'GUARDIAN_LOGFILE'}\n";
697 print FILE "AlertFile\t\t\t$settings{'GUARDIAN_SNORT_ALERTFILE'}\n";
698 print FILE "IgnoreFile\t\t\t$ignorefile\n";
699 print FILE "TimeLimit\t\t\t$settings{'GUARDIAN_BLOCKTIME'}\n";
700 print FILE "PriorityLevel\t\t\t$settings{'GUARDIAN_PRIORITY_LEVEL'}\n";
01dbccb1
SS		 701
702 close(FILE);
703
f8c3bfe0
SS		 704 # Check if guardian should be started or stopped.
705 if($settings{'GUARDIAN_ENABLED'} eq 'on') {
706 if($pid > 0) {
707 # Call guardianctl to perform a reload.
708 system("/usr/local/bin/guardianctrl reload &>/dev/null");
709 } else {
710 # Launch guardian.
711 system("/usr/local/bin/guardianctrl start &>/dev/null");
712 }
01dbccb1 713 } else {
f8c3bfe0 714 # Stop the daemon.
01dbccb1
SS		 715 system("/usr/local/bin/guardianctrl stop &>/dev/null");
716 }
717}
Peter's tree of IPFire 2.x