html/cgi-bin/connections.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 my @network=();
  23 my @masklen=();
  24 my @colour=();
  25
  26 use Net::IPv4Addr qw( :all );
  27
  28 use strict;
  29
  30 # enable only the following on debugging purpose
  31 #use warnings;
  32 #use CGI::Carp 'fatalsToBrowser';
  33
  34 require '/var/ipfire/general-functions.pl';
  35 require "${General::swroot}/lang.pl";
  36 require "${General::swroot}/header.pl";
  37
  38 #workaround to suppress a warning when a variable is used only once
  39 my @dummy = ( ${Header::table1colour} );
  40 undef (@dummy);
  41
  42 # Read various files
  43
  44 my %netsettings=();
  45 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  46
  47 open (ACTIVE, '/usr/local/bin/getiptstate |') or die 'Unable to open ip_conntrack';
  48 my @active = <ACTIVE>;
  49 close (ACTIVE);
  50
  51 if (open(IP, "${General::swroot}/red/local-ipaddress")) {
  52         my $redip = <IP>;
  53         close(IP);
  54         chomp $redip;
  55         push(@network, $redip);
  56         push(@masklen, '255.255.255.255' );
  57         push(@colour, ${Header::colourfw} );
  58 }
  59
  60 my @vpn = ` route -n | grep ipsec | awk '{ print \$1" "\$3}'`;
  61   foreach my $route (@vpn) {
  62                 chomp($route);
  63                 my @temp = split(/[\t ]+/, $route);
  64                 if ( $temp[0] eq '$redip' ){next;}
  65                 push(@network, $temp[0]);
  66                 push(@masklen, $temp[1]);
  67                 push(@colour, ${Header::colourvpn} );
  68         }
  69
  70 my $aliasfile = "${General::swroot}/ethernet/aliases";
  71 open(ALIASES, $aliasfile) or die 'Unable to open aliases file.';
  72 my @aliases = <ALIASES>;
  73 close(ALIASES);
  74
  75 # Add Green Firewall Interface
  76 push(@network, $netsettings{'GREEN_ADDRESS'});
  77 push(@masklen, "255.255.255.255" );
  78 push(@colour, ${Header::colourfw} );
  79
  80 # Add Green Network to Array
  81 push(@network, $netsettings{'GREEN_NETADDRESS'});
  82 push(@masklen, $netsettings{'GREEN_NETMASK'} );
  83 push(@colour, ${Header::colourgreen} );
  84
  85 # Add Green Routes to Array
  86 my @routes = `/sbin/route -n | /bin/grep $netsettings{'GREEN_DEV'}`;
  87 foreach my $route (@routes) {
  88         chomp($route);
  89         my @temp = split(/[\t ]+/, $route);
  90         push(@network, $temp[0]);
  91         push(@masklen, $temp[2]);
  92         push(@colour, ${Header::colourgreen} );
  93 }
  94
  95 # Add Firewall Localhost 127.0.0.1
  96 push(@network, '127.0.0.1');
  97 push(@masklen, '255.255.255.255' );
  98 push(@colour, ${Header::colourfw} );
  99
 100 # Add Orange Network
 101 if ($netsettings{'ORANGE_DEV'}) {
 102         push(@network, $netsettings{'ORANGE_NETADDRESS'});
 103         push(@masklen, $netsettings{'ORANGE_NETMASK'} );
 104         push(@colour, ${Header::colourorange} );
 105         # Add Orange Routes to Array
 106         @routes = `/sbin/route -n | /bin/grep $netsettings{'ORANGE_DEV'}`;
 107         foreach my $route (@routes) {
 108                   chomp($route);
 109                 my @temp = split(/[\t ]+/, $route);
 110                 push(@network, $temp[0]);
 111                 push(@masklen, $temp[2]);
 112                 push(@colour, ${Header::colourorange} );
 113         }
 114 }
 115
 116 # Add Blue Firewall Interface
 117 push(@network, $netsettings{'BLUE_ADDRESS'});
 118 push(@masklen, "255.255.255.255" );
 119 push(@colour, ${Header::colourfw} );
 120
 121 # Add Blue Network
 122 if ($netsettings{'BLUE_DEV'}) {
 123         push(@network, $netsettings{'BLUE_NETADDRESS'});
 124         push(@masklen, $netsettings{'BLUE_NETMASK'} );
 125         push(@colour, ${Header::colourblue} );
 126         # Add Blue Routes to Array
 127         @routes = `/sbin/route -n | /bin/grep $netsettings{'BLUE_DEV'}`;
 128         foreach my $route (@routes) {
 129                   chomp($route);
 130                 my @temp = split(/[\t ]+/, $route);
 131                 push(@network, $temp[0]);
 132                 push(@masklen, $temp[2]);
 133                 push(@colour, ${Header::colourblue} );
 134         }
 135 }
 136
 137 # Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate)
 138 if (-e "${General::swroot}/ovpn/settings") {
 139     my %ovpnsettings = ();
 140     &General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
 141     my @tempovpnsubnet = split("\/",$ovpnsettings{'DOVPN_SUBNET'});
 142
 143     # add OpenVPN net
 144                 push(@network, $tempovpnsubnet[0]);
 145                 push(@masklen, $tempovpnsubnet[1]);
 146                 push(@colour, ${Header::colourovpn} );
 147
 148
 149     if ( ($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'} ) {
 150       # add BLUE:port / proto
 151             push(@network, $netsettings{'BLUE_ADDRESS'} );
 152             push(@masklen, '255.255.255.255' );
 153                   push(@colour, ${Header::colourovpn} );
 154     }
 155     if ( ($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'} ) {
 156       # add ORANGE:port / proto
 157             push(@network, $netsettings{'ORANGE_ADDRESS'} );
 158             push(@masklen, '255.255.255.255' );
 159                   push(@colour, ${Header::colourovpn} );
 160     }
 161 }
 162
 163 # Add STATIC RED aliases
 164 if ($netsettings{'RED_DEV'}) {
 165         # We have a RED eth iface
 166         if ($netsettings{'RED_TYPE'} eq 'STATIC') {
 167                 # We have a STATIC RED eth iface
 168                 foreach my $line (@aliases)
 169                 {
 170                         chomp($line);
 171                         my @temp = split(/\,/,$line);
 172                         if ( $temp[0] ) {
 173                                 push(@network, $temp[0]);
 174                                 push(@masklen, $netsettings{'RED_NETMASK'} );
 175                                 push(@colour, ${Header::colourfw} );
 176                         }
 177                 }
 178         }
 179 }
 180
 181 # Add VPNs
 182 if ( $vpn[0] ne 'none' ) {
 183         foreach my $line (@vpn) {
 184                 my @temp = split(/[\t ]+/,$line);
 185                 my @temp1 = split(/[\/:]+/,$temp[3]);
 186                 push(@network, $temp1[0]);
 187                 push(@masklen, ipv4_cidr2msk($temp1[1]));
 188                 push(@colour, ${Header::colourvpn} );
 189         }
 190 }
 191
 192 #Establish simple filtering&sorting boxes on top of table
 193
 194 our %cgiparams;
 195 &Header::getcgihash(\%cgiparams);
 196
 197 my @list_proto = ($Lang::tr{'all'}, 'icmp', 'udp', 'tcp');
 198 my @list_state = ($Lang::tr{'all'}, 'SYN_SENT', 'SYN_RECV', 'ESTABLISHED', 'FIN_WAIT',
 199                     'CLOSE_WAIT', 'LAST_ACK', 'TIME_WAIT', 'CLOSE', 'LISTEN');
 200 my @list_mark = ($Lang::tr{'all'}, '[ASSURED]', '[UNREPLIED]');
 201 my @list_sort = ('orgsip','protocol', 'expires', 'status', 'orgdip', 'orgsp',
 202                     'orgdp', 'exsip', 'exdip', 'exsp', 'exdp', 'marked');
 203
 204 # init or silently correct unknown value...
 205 if ( ! grep ( /^$cgiparams{'SEE_PROTO'}$/ , @list_proto )) { $cgiparams{'SEE_PROTO'} = $list_proto[0] };
 206 if ( ! grep ( /^$cgiparams{'SEE_STATE'}$/ , @list_state )) { $cgiparams{'SEE_STATE'} = $list_state[0] };
 207 if ( ($cgiparams{'SEE_MARK'} ne $Lang::tr{'all'}) &&    # ok the grep should work but it doesn't because of
 208      ($cgiparams{'SEE_MARK'} ne '[ASSURED]') &&         # the '[' & ']' interpreted as list separator.
 209      ($cgiparams{'SEE_MARK'} ne '[UNREPLIED]')          # So, explicitly enumerate items.
 210    )  { $cgiparams{'SEE_MARK'}  = $list_mark[0] };
 211 if ( ! grep ( /^$cgiparams{'SEE_SORT'}$/  , @list_sort ))  { $cgiparams{'SEE_SORT'}  = $list_sort[0] };
 212 # *.*.*.* or a valid IP
 213 if ( $cgiparams{'SEE_SRC'}  !~ /^(\*\.\*\.\*\.\*\.|\d+\.\d+\.\d+\.\d+)$/) {  $cgiparams{'SEE_SRC'} = '*.*.*.*' };
 214 if ( $cgiparams{'SEE_DEST'} !~ /^(\*\.\*\.\*\.\*\.|\d+\.\d+\.\d+\.\d+)$/) {  $cgiparams{'SEE_DEST'} = '*.*.*.*' };
 215
 216
 217 our %entries = ();      # will hold the lines analyzed correctly
 218 my $unknownlines = '';  # should be empty all the time...
 219 my $index = 0;          # just a counter to make unique entryies in entries
 220
 221 &Header::showhttpheaders();
 222 &Header::openpage($Lang::tr{'connections'}, 1, '');
 223 &Header::openbigbox('100%', 'left');
 224 &Header::openbox('100%', 'left', $Lang::tr{'connection tracking'});
 225
 226 # Build listbox objects
 227 my $menu_proto = &make_select ('SEE_PROTO', $cgiparams{'SEE_PROTO'}, @list_proto);
 228 my $menu_state = &make_select ('SEE_STATE', $cgiparams{'SEE_STATE'}, @list_state);
 229
 230 print <<END
 231 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 232 <table width='100%'>
 233 <tr><td align='center'><b>$Lang::tr{'legend'} : </b></td>
 234     <td align='center' bgcolor='${Header::colourgreen}'><b><font color='#FFFFFF'>$Lang::tr{'lan'}</font></b></td>
 235     <td align='center' bgcolor='${Header::colourred}'><b><font color='#FFFFFF'>$Lang::tr{'internet'}</font></b></td>
 236     <td align='center' bgcolor='${Header::colourorange}'><b><font color='#FFFFFF'>$Lang::tr{'dmz'}</font></b></td>
 237     <td align='center' bgcolor='${Header::colourblue}'><b><font color='#FFFFFF'>$Lang::tr{'wireless'}</font></b></td>
 238     <td align='center' bgcolor='${Header::colourfw}'><b><font color='#FFFFFF'>IPFire</font></b></td>
 239     <td align='center' bgcolor='${Header::colourvpn}'><b><font color='#FFFFFF'>$Lang::tr{'vpn'}</font></b></td>
 240     <td align='center' bgcolor='${Header::colourovpn}'><b><font color='#FFFFFF'>$Lang::tr{'OpenVPN'}</font></b></td>
 241 </tr>
 242 </table>
 243 <br />
 244 <table width='100%'>
 245 <tr><td align='center'><font size=2>$Lang::tr{'source ip and port'}</font></td>
 246                 <td>&nbsp;</td>
 247                 <td align='center'><font size=2>$Lang::tr{'dest ip and port'}</font></td>
 248                 <td>&nbsp;</td>
 249                 <td align='center'><font size=2>$Lang::tr{'protocol'}</font></td>
 250                 <td align='center'><font size=2>$Lang::tr{'connection'}<br></br>$Lang::tr{'status'}</font></td>
 251     <td align='center'><font size=2>$Lang::tr{'expires'}<br></br>($Lang::tr{'seconds'})</font></td>
 252
 253 </tr>
 254 <tr><td colspan='4'>&nbsp;</td>
 255                 <td align='center'>$menu_proto</td>
 256     <td align='center'>$menu_state</td>
 257     <td>&nbsp;</td>
 258 </tr>
 259 <tr>
 260     <td align='center' colspan='7'></td>
 261 </tr>
 262 <tr>
 263     <td align='center' colspan='7'><input type='submit' value="$Lang::tr{'update'}" /></td>
 264 </tr>
 265
 266 END
 267 ;
 268
 269 my $i=0;
 270 foreach my $line (@active) {
 271     $i++;
 272     if ($i < 3) {
 273                         next;
 274     }
 275     chomp($line);
 276     my @temp = split(' ',$line);
 277
 278     my ($sip, $sport) = split(':', $temp[0]);
 279     my ($dip, $dport) = split(':', $temp[1]);
 280     my $proto = $temp[2];
 281     my $state; my $ttl;
 282     if ( $proto eq "esp" ){$state = "";$ttl = $temp[3];}
 283     elsif ( $proto eq "icmp" ){$state = "";$ttl = $temp[4];}
 284     else{$state = $temp[3];$ttl = $temp[4];}
 285
 286     next if( !(
 287                         (($cgiparams{'SEE_PROTO'}  eq $Lang::tr{'all'}) || ($proto  eq $cgiparams{'SEE_PROTO'} ))
 288                  && (($cgiparams{'SEE_STATE'}  eq $Lang::tr{'all'}) || ($state  eq $cgiparams{'SEE_STATE'} ))
 289                && (($cgiparams{'SEE_SRC'}    eq "*.*.*.*")        || ($sip    eq $cgiparams{'SEE_SRC'}   ))
 290                && (($cgiparams{'SEE_DEST'}   eq "*.*.*.*")        || ($dip    eq $cgiparams{'SEE_DEST'}  ))
 291               ));
 292
 293     if (($proto eq 'udp') && ($ttl eq '')) {
 294                         $ttl = $state;
 295                         $state = '&nbsp;';
 296     }
 297
 298     my $sipcol = ipcolour($sip);
 299     my $dipcol = ipcolour($dip);
 300
 301     my $sserv = '';
 302     if ($sport < 1024) {
 303         $sserv = uc(getservbyport($sport, lc($proto)));
 304         if ($sserv ne '') {
 305             $sserv = "&nbsp;($sserv)";
 306         }
 307     }
 308
 309     my $dserv = '';
 310     if ($dport < 1024) {
 311         $dserv = uc(getservbyport($dport, lc($proto)));
 312         if ($dserv ne '') {
 313             $dserv = "&nbsp;($dserv)";
 314         }
 315     }
 316
 317     print <<END
 318     <tr >
 319       <td align='center' bgcolor='$sipcol'>
 320         <a href='/cgi-bin/ipinfo.cgi?ip=$sip'>
 321           <font color='#FFFFFF'>$sip</font>
 322         </a>
 323       </td>
 324       <td align='center' bgcolor='$sipcol'>
 325         <a href='http://isc.sans.org/port_details.php?port=$sport' target='top'>
 326           <font color='#FFFFFF'>$sport$sserv</font>
 327         </a>
 328       </td>
 329       <td align='center' bgcolor='$dipcol'>
 330         <a href='/cgi-bin/ipinfo.cgi?ip=$dip'>
 331           <font color='#FFFFFF'>$dip</font>
 332         </a>
 333       </td>
 334       <td align='center' bgcolor='$dipcol'>
 335         <a href='http://isc.sans.org/port_details.php?port=$dport' target='top'>
 336           <font color='#FFFFFF'>$dport$dserv</font>
 337         </a>
 338       </td>
 339       <td align='center'>$proto</td>
 340       <td align='center'>$state</td>
 341       <td align='center'>$ttl</td>
 342     </tr>
 343 END
 344 ;
 345 }
 346
 347 print "</table></form>";
 348
 349 &Header::closebox();
 350 &Header::closebigbox();
 351 &Header::closepage();
 352
 353 sub ipcolour($) {
 354         my $id = 0;
 355         my $line;
 356         my $colour = ${Header::colourred};
 357         my ($ip) = $_[0];
 358         my $found = 0;
 359         foreach $line (@network) {
 360                                         if ($network[$id] eq '') {
 361                                                 $id++;
 362                                         } else {
 363                                                 if (!$found && ipv4_in_network( $network[$id] , $masklen[$id], $ip) ) {
 364                                                         $found = 1;
 365                                                         $colour = $colour[$id];
 366                                                 }
 367                                                 $id++;
 368                                         }
 369         }
 370         return $colour
 371 }
 372
 373 # Create a string containing a complete SELECT html object
 374 # param1: name
 375 # param2: current value selected
 376 # param3: field list
 377 sub make_select ($,$,$) {
 378         my $select_name = shift;
 379         my $selected    = shift;
 380         my $select = "<select name='$select_name'>";
 381
 382         foreach my $value (@_) {
 383                     my $check = $selected eq $value ? "selected='selected'" : '';
 384                     $select .= "<option $check value='$value'>$value</option>";
 385         }
 386         $select .= "</select>";
 387         return $select;
 388 }
 389
 390 # Build a list of IP obtained from the %entries hash
 391 # param1: IP field name
 392 sub get_known_ips ($) {
 393         my $field = shift;
 394         my $qs = $cgiparams{'SEE_SORT'};        # switch the sort order
 395         $cgiparams{'SEE_SORT'} = $field;
 396
 397         my @liste=('*.*.*.*');
 398         foreach my $entry ( sort sort_entries keys %entries) {
 399                     push (@liste, $entries{$entry}->{$field}) if (! grep (/^$entries{$entry}->{$field}$/,@liste) );
 400         }
 401
 402         $cgiparams{'SEE_SORT'} = $qs;   #restore sort order
 403         return @liste;
 404 }
 405
 406 # Used to sort the table containing the lines displayed.
 407 sub sort_entries { #Reverse is not implemented
 408         my $qs=$cgiparams{'SEE_SORT'};
 409         if ($qs =~ /orgsip|orgdip|exsip|exdip/) {
 410                 my @a = split(/\./,$entries{$a}->{$qs});
 411                 my @b = split(/\./,$entries{$b}->{$qs});
 412                 ($a[0]<=>$b[0]) ||
 413                 ($a[1]<=>$b[1]) ||
 414                 ($a[2]<=>$b[2]) ||
 415                 ($a[3]<=>$b[3]);
 416         } elsif ($qs =~ /expire|orgsp|orgdp|exsp|exdp/) {
 417                     $entries{$a}->{$qs} <=> $entries{$b}->{$qs};
 418         } else {
 419                     $entries{$a}->{$qs} cmp $entries{$b}->{$qs};
 420         }
 421 }
 422
 423 1;