html/cgi-bin/guardian.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2014  IPFire Team  <info@ipfire.org>                          #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Locale::Country;
  24
  25 # enable only the following on debugging purpose
  26 use warnings;
  27 use CGI::Carp 'fatalsToBrowser';
  28
  29 require '/var/ipfire/general-functions.pl';
  30 require "${General::swroot}/lang.pl";
  31 require "${General::swroot}/header.pl";
  32
  33 #workaround to suppress a warning when a variable is used only once
  34 my @dummy = ( ${Header::colouryellow} );
  35 undef (@dummy);
  36
  37 my $string=();
  38 my $memory=();
  39 my @memory=();
  40 my @pid=();
  41 my @guardian=();
  42 my %cgiparams=();
  43
  44 # Path to the guardian.ignore file.
  45 my $ignorefile ='/var/ipfire/guardian/guardian.ignore';
  46
  47 # Path to the guardian.target file.
  48 my $targetfile ='/var/ipfire/guardian/guardian.ignore';
  49
  50 our %netsettings = ();
  51 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  52
  53 our %color = ();
  54 our %mainsettings = ();
  55 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  56 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  57
  58 our %settings = ();
  59
  60 $settings{'GUARDIAN_ENABLED'} = 'off';
  61 $settings{'GUARDIAN_BLOCKTIME'} = '86400';
  62 $settings{'GUARDIAN_LOGFILE'} = '/var/log/guardian/guardian.log';
  63 $settings{'GUARDIAN_SNORT_ALERTFILE'} = '/var/log/snort/alert';
  64
  65 $settings{'ACTION'} = '';
  66
  67 my $errormessage = '';
  68
  69 &Header::showhttpheaders();
  70
  71 # Get GUI values.
  72 &Header::getcgihash(\%settings);
  73 &Header::getcgihash(\%cgiparams);
  74
  75 ## Perform input checks and save settings.
  76 #
  77 if ($settings{'ACTION'} eq $Lang::tr{'save'}) {
  78
  79         # Check for valid blocktime.
  80         if ($settings{'GUARDIAN_BLOCKTIME'} ne '') {
  81                 if (($settings{'GUARDIAN_BLOCKTIME'} !~ /^[0-9]+$/) || ($settings{'GUARDIAN_BLOCKTIME'} le '0')) {
  82                         $errormessage = "$Lang::tr{'guardian invalid blocktime'}";
  83                 }
  84         }
  85
  86         # Check Logfile.
  87         if ($settings{'GUARDIAN_LOGFILE'} ne '') {
  88                 if ($settings{'GUARDIAN_LOGFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
  89                         $errormessage = "$Lang::tr{'guardian invalid logfile'}";
  90                 }
  91         }
  92
  93         # Check input for snort alert file.
  94         if ($settings{'GUARDIAN_SNORT_ALERTFILE'} ne '') {
  95                 if ($settings{'GUARDIAN_SNORT_ALERTFILE'} !~ /^[a-zA-Z0-9\.\/]+$/) {
  96                         $errormessage = "$Lang::tr{'guardian invalid alertfile'}";
  97                 }
  98         }
  99
 100         # Only continue if no error message has been set.
 101         if ($errormessage eq '') {
 102                 # Write configuration settings to file.
 103                 &General::writehash("${General::swroot}/guardian/settings", \%settings);
 104
 105                 # Update configuration files.
 106                 &BuildConfiguration();
 107         }
 108
 109 ## Add a new entry to the ignore file.
 110 #
 111 } elsif ($settings{'ACTION'} eq $Lang::tr{'add'}) {
 112
 113         # Check if any input has been performed.
 114         if ($settings{'NEW_IGNORE_ENTRY'} ne '') {
 115
 116                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 117                 if ((!&General::validip($settings{'NEW_IGNORE_ENTRY'})) && (!&General::validipandmask($settings{'NEW_IGNORE_ENTRY'}))) {
 118                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 119                 }
 120         } else {
 121                 $errormessage = "$Lang::tr{'guardian empty input'}";
 122         }
 123
 124         # Go further if there was no error.
 125         if ($errormessage eq '') {
 126                 my $new_entry = $settings{'NEW_IGNORE_ENTRY'};
 127
 128                 # Open file for appending the new entry.
 129                 open (FILE, ">>$ignorefile") or die "Unable to open $ignorefile for writing";
 130
 131                 # Write the new entry to the ignore file.
 132                 print FILE "$new_entry\n";
 133                 close(FILE);
 134         }
 135
 136 ## Remove entry from ignore list.
 137 #
 138 } elsif ($settings{'ACTION'} eq $Lang::tr{'remove'}) {
 139         my $id = 0;
 140
 141         # Open ignorefile and read content.
 142         open(FILE, "<$ignorefile") or die "Unable to open $ignorefile.";
 143         my @current = <FILE>;
 144         close(FILE);
 145
 146         # Re-open ignorefile for writing.
 147         open(FILE, ">$ignorefile") or die "Unable to open $ignorefile for writing";
 148         flock FILE, 2;
 149
 150         # Read line by line from ignorefile and write them back except the line with the given ID.
 151         # So this line is missing in the new file and the entry has been deleted.
 152         foreach my $line (@current) {
 153                 $id++;
 154                 unless ($cgiparams{'ID'} eq $id) {
 155                         print FILE "$line";
 156                 }
 157         }
 158         close(FILE);
 159
 160 ## Block a user given address or subnet.
 161 #
 162 } elsif ($settings{'ACTION'} eq $Lang::tr{'block'}) {
 163
 164         # Check if no empty input has been performed.
 165         if ($settings{'ADDRESS_BLOCK'} ne '') {
 166
 167                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 168                 if ((!&General::validip($settings{'ADDRESS_BLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_BLOCK'}))) {
 169                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 170                 }
 171
 172         } else {
 173                 $errormessage = "$Lang::tr{'guardian empty input'}";
 174         }
 175
 176         # Go further if there was no error.
 177         if ($errormessage eq '') {
 178                 my $block = $settings{'ADDRESS_BLOCK'};
 179
 180                 # Call helper to unblock address.
 181                 system("/usr/local/bin/guardianctrl block $block &>/dev/null");
 182         }
 183
 184 ## Unblock address or subnet.
 185 #
 186 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock'}) {
 187
 188         # Check if no empty input has been performed.
 189         if ($settings{'ADDRESS_UNBLOCK'} ne '') {
 190
 191                 # Check if the given input is no valid IP-address or IP-address with subnet, display an error message.
 192                 if ((!&General::validip($settings{'ADDRESS_UNBLOCK'})) && (!&General::validipandmask($settings{'ADDRESS_UNBLOCK'}))) {
 193                         $errormessage = "$Lang::tr{'guardian invalid address or subnet'}";
 194                 }
 195
 196         } else {
 197                 $errormessage = "$Lang::tr{'guardian empty input'}";
 198         }
 199
 200         # Go further if there was no error.
 201         if ($errormessage eq '') {
 202                 my $unblock = $settings{'ADDRESS_UNBLOCK'};
 203
 204                 # Call helper to unblock address.
 205                 system("/usr/local/bin/guardianctrl unblock $unblock &>/dev/null");
 206         }
 207
 208 ## Unblock all.
 209 #
 210 } elsif ($settings{'ACTION'} eq $Lang::tr{'unblock all'}) {
 211
 212         # Call helper to flush iptables chain from guardian.
 213         system("/usr/local/bin/guardianctrl flush-chain &>/dev/null");
 214
 215 } else {
 216         # Load settings from file.
 217         &General::readhash("${General::swroot}/guardian/settings", \%settings);
 218 }
 219
 220
 221 # Call functions to generate whole page.
 222 &showMainBox();
 223 &showIgnoreBox();
 224
 225 # Display area only if guardian is running.
 226 if ( ($memory != 0) && (@pid[0] ne "///") ) {
 227         &showBlockedBox();
 228 }
 229
 230 # Function to display the status of guardian and allow base configuration.
 231 sub showMainBox() {
 232         my %checked = ();
 233
 234         $checked{'GUARDIAN_ENABLED'}{'on'} = '';
 235         $checked{'GUARDIAN_ENABLED'}{'off'} = '';
 236         $checked{'GUARDIAN_ENABLED'}{$settings{'GUARDIAN_ENABLED'}} = 'checked';
 237
 238         &Header::openpage($Lang::tr{'guardian configuration'}, 1, '');
 239         &Header::openbigbox('100%', 'left', '', $errormessage);
 240
 241         # Print errormessage if there is one.
 242         if ($errormessage) {
 243                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 244                 print "<font class='base'>$errormessage&nbsp;</font>\n";
 245                 &Header::closebox();
 246         }
 247
 248
 249         # Draw current guardian state.
 250         &Header::openbox('100%', 'center', $Lang::tr{'guardian'});
 251
 252         # Check if guardian is running and grab some stats.
 253         &daemonstats();
 254
 255         # Display some useful information related to guardian, if daemon is running.
 256         if ( ($memory != 0) && (@pid[0] ne "///") ){
 257                 print <<END;
 258                         <table width='95%' cellspacing='0' class='tbl'>
 259                                 <tr>
 260                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 261                                 </tr>
 262                                 <tr>
 263                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 264                                         <td align='center' colspan='2' width='75%' bgcolor='${Header::colourgreen}'><font color='white'><strong>$Lang::tr{'running'}</strong></font></td>
 265                                 </tr>
 266                                 <tr>
 267                                         <td class='base'></td>
 268                                         <td bgcolor='$color{'color20'}' align='center'><strong>PID</strong></td>
 269                                         <td bgcolor='$color{'color20'}' align='center'><strong>$Lang::tr{'memory'}</strong></td>
 270                                 </tr>
 271                                 <tr>
 272                                         <td class='base'></td>
 273                                         <td bgcolor='$color{'color22'}' align='center'>@pid[0]</td>
 274                                         <td bgcolor='$color{'color22'}' align='center'>$memory KB</td>
 275                                 </tr>
 276                         </table>
 277 END
 278         } else {
 279                 # Otherwise display a hint that the service is not launched.
 280                 print <<END;
 281                         <table width='95%' cellspacing='0' class='tbl'>
 282                                 <tr>
 283                                         <th bgcolor='$color{'color20'}' colspan='3' align='left'><strong>$Lang::tr{'guardian service'}</strong></th>
 284                                 </tr>
 285                                 <tr>
 286                                         <td class='base'>$Lang::tr{'guardian daemon'}</td>
 287                                         <td align='center' width='75%' bgcolor='${Header::colourred}'><font color='white'><strong>$Lang::tr{'stopped'}</strong></font></td>
 288                                 </tr>
 289                         </table>
 290 END
 291         }
 292
 293         &Header::closebox();
 294
 295         # Draw elements for guardian configuration.
 296         &Header::openbox('100%', 'center', $Lang::tr{'guardian configuration'});
 297
 298         print <<END;
 299                 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 300
 301                 <table width='95%'>
 302                         <tr>
 303                                 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian common settings'}</b></td>
 304                         </tr>
 305                         <tr>
 306                                 <td width='20%' class='base'>$Lang::tr{'guardian enabled'}:</td>
 307                                 <td><input type='checkbox' name='GUARDIAN_ENABLED' $checked{'GUARDIAN_ENABLED'}{'on'} /></td>
 308                         </tr>
 309                         <tr>
 310                                 <td width='20%' class='base'>$Lang::tr{'guardian blocktime'}:</td>
 311                                 <td><input type='text' name='GUARDIAN_BLOCKTIME' value='$settings{'GUARDIAN_BLOCKTIME'}' size='10' /></td>
 312                         </tr>
 313                         <tr>
 314                                 <td width='20%' class='base'>$Lang::tr{'guardian logfile'}:</td>
 315                                 <td><input type='text' name='GUARDIAN_LOGFILE' value='$settings{'GUARDIAN_LOGFILE'}' size='30' /></td>
 316                         </tr>
 317                         <tr>
 318                                 <td width='20%' class='base'>$Lang::tr{'guardian snort alertfile'}:</td>
 319                                 <td><input type='text' name='GUARDIAN_SNORT_ALERTFILE' value='$settings{'GUARDIAN_SNORT_ALERTFILE'}' size='30' /></td>
 320                         </tr>
 321                 </table>
 322 END
 323
 324         print <<END;
 325                 <hr>
 326
 327                 <table width='95%'>
 328                         <tr>
 329                                 <td>&nbsp;</td>
 330                                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
 331                                 <td>&nbsp;</td>
 332                         </tr>
 333                 </table>
 334         </form>
 335 END
 336
 337         &Header::closebox();
 338 }
 339
 340 # Function to show elements of the guardian ignorefile and allow to add or remove single members of it.
 341 sub showIgnoreBox() {
 342         &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts'});
 343
 344         print <<END;
 345                 <table width='60%'>
 346                         <tr>
 347                                 <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian ignored hosts'}</b></td>
 348                         </tr>
 349 END
 350                         # Check if the guardian ignore file contains any content.
 351                         if (-s $ignorefile) {
 352
 353                                 # Open file and print contents.
 354                                 open FILE, $ignorefile or die "Could not open $ignorefile";
 355
 356                                 my $id = 0;
 357                                 my $col = "";
 358
 359                                 # Read file line by line and print out the elements.
 360                                 while( my $ignored_element = <FILE> )  {
 361
 362                                         # Increase id number for each element in the ignore file.
 363                                         $id++;
 364
 365                                         # Check if the id number is even or not.
 366                                         if ($id % 2) {
 367                                                 $col="bgcolor='$color{'color22'}'";
 368                                         } else {
 369                                                 $col="bgcolor='$color{'color20'}'";
 370                                         }
 371
 372                                         print <<END;
 373                                         <tr>
 374                                                 <td width='80%' class='base' $col>$ignored_element</td>
 375                                                 <td width='20%' align='center' $col>
 376                                                         <form method='post' name='frma$id' action='$ENV{'SCRIPT_NAME'}'>
 377                                                                 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' title='$Lang::tr{'remove'}' alt='$Lang::tr{'remove'}'>
 378                                                                 <input type='hidden' name='ID' value='$id'>
 379                                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}'>
 380                                                         </form>
 381                                                 </td>
 382                                         </tr>
 383 END
 384                                 }
 385                         close (FILE);
 386                         } else {
 387                                 # Print notice that currently no elements are stored in the ignore file.
 388                                 print "<tr>\n";
 389                                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 390                                 print "</tr>\n";
 391                         }
 392
 393                 print "</table>\n";
 394
 395         # Section to add new elements to the ignore list.
 396         print <<END;
 397         <br>
 398         <div align='center'>
 399                 <table width='60%'>
 400                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 401                         <tr>
 402                                 <td width='30%'>$Lang::tr{'dnsforward add a new entry'}: </td>
 403                                 <td width='50%'><input type='text' name='NEW_IGNORE_ENTRY' value='' size='24' /></td>
 404                                 <td align='center' width='20%'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
 405                         </tr>
 406                         </form>
 407                 </table>
 408         </div>
 409 END
 410
 411         &Header::closebox();
 412 }
 413
 414 # Function to list currently bocked addresses from guardian and unblock them or add custom entries to block.
 415 sub showBlockedBox() {
 416         &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'});
 417
 418         print <<END;
 419         <table width='60%'>
 420                 <tr>
 421                         <td colspan='2' class='base' bgcolor='$color{'color20'}'><b>$Lang::tr{'guardian blocked hosts'}</b></td>
 422                 </tr>
 423 END
 424
 425                 # Lauch function to get the currently blocked hosts.
 426                 my @blocked_hosts = &GetBlockedHosts();
 427
 428                 my $id = 0;
 429                 my $col = "";
 430
 431                 # Loop through our blocked hosts array.
 432                 foreach my $blocked_host (@blocked_hosts) {
 433
 434                         # Increase id number for each element in the ignore file.
 435                         $id++;
 436
 437                         # Check if the id number is even or not.
 438                         if ($id % 2) {
 439                                 $col="bgcolor='$color{'color22'}'";
 440                         } else {
 441                                 $col="bgcolor='$color{'color20'}'";
 442                         }
 443
 444                         print <<END;
 445                         <tr>
 446                                 <td width='80%' class='base' $col><a href='/cgi-bin/ipinfo.cgi?ip=$blocked_host'>$blocked_host</a></td>
 447                                 <td width='20%' align='center' $col>
 448                                         <form method='post' name='frmb$id' action='$ENV{'SCRIPT_NAME'}'>
 449                                                 <input type='image' name='$Lang::tr{'unblock'}' src='/images/delete.gif' title='$Lang::tr{'unblock'}' alt='$Lang::tr{'unblock'}'>
 450                                                 <input type='hidden' name='ADDRESS_UNBLOCK' value='$blocked_host'>
 451                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'unblock'}'>
 452                                         </form>
 453                                 </td>
 454                         </tr>
 455 END
 456                 }
 457
 458         # If the loop only has been runs once the id still is "0", which means there are no
 459         # additional entries (blocked hosts) in the iptables chain.
 460         if ($id == 0) {
 461
 462                 # Print notice that currently no hosts are blocked.
 463                 print "<tr>\n";
 464                 print "<td class='base' colspan='2'>$Lang::tr{'guardian no entries'}</td>\n";
 465                 print "</tr>\n";
 466         }
 467
 468         print "</table>\n";
 469
 470         # Section for a manual block of an IP-address.
 471         print <<END;
 472         <br>
 473         <div align='center'>
 474                 <table width='60%' border='0'>
 475                         <form method='post' action='$ENV{'SCRIPT_NAME'}'>
 476                         <tr>
 477                                 <td width='30%'>$Lang::tr{'guardian block a host'}: </td>
 478                                 <td width='40%'><input type='text' name='ADDRESS_BLOCK' value='' size='24' /></td>
 479                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'block'}'></td>
 480                                 <td align='center' width='15%'><input type='submit' name='ACTION' value='$Lang::tr{'unblock all'}'></td>
 481                         </tr>
 482                         </form>
 483                 </table>
 484         </div>
 485 END
 486
 487         &Header::closebox();
 488 }
 489
 490 &Header::closebigbox();
 491 &Header::closepage();
 492
 493 # Function to check if guardian has been started.
 494 # Grab process id and consumed memory if the daemon is running.
 495 sub daemonstats() {
 496         $memory = 0;
 497         # for pid and memory
 498         open(FILE, '/usr/local/bin/addonctrl guardian status | ');
 499         @guardian = <FILE>;
 500         close(FILE);
 501         $string = join("", @guardian);
 502         $string =~ s/[a-z_]//gi;
 503         $string =~ s/\[[0-1]\;[0-9]+//gi;
 504         $string =~ s/[\(\)\.]//gi;
 505         $string =~ s/  //gi;
 506         $string =~ s/\e//gi;
 507         @pid = split(/\s/,$string);
 508         if (open(FILE, "/proc/$pid[0]/statm")){
 509                 my $temp = <FILE>;
 510                 @memory = split(/ /,$temp);
 511                 close(FILE);
 512         }
 513         $memory+=$memory[0];
 514 }
 515
 516 sub GetBlockedHosts() {
 517
 518         # Create new, empty array.
 519         my @hosts;
 520
 521         # Lauch helper to get chains from iptables.
 522         open(FILE, "/usr/local/bin/guardianctrl get-chain |");
 523
 524         # Read file line by line and print out the elements.
 525         foreach my $line (<FILE>) {
 526
 527                 # Skip descriptive lines.
 528                 next if ($line =~ /^Chain/);
 529                 next if ($line =~ /^ pkts/);
 530
 531                 # Generate array, based on the line content (seperator is a single or multiple space's)
 532                 my @comps = split(/\s{1,}/, $line);
 533                 my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination) = @comps;
 534
 535                 # Assign different variable names.
 536                 my $blocked_host = $source;
 537
 538                 # Add host to our hosts array.
 539                 push(@hosts, $blocked_host);
 540         }
 541
 542         # Convert entries, sort them, write back and store the sorted entries into new array.
 543         my @sorted = map  { $_->[0] }
 544              sort { $a->[1] <=> $b->[1] }
 545              map  { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] }
 546              @hosts;
 547
 548         # Return our sorted list.
 549         return @sorted
 550 }
 551
 552 sub BuildConfiguration() {
 553         my %settings = ();
 554         &General::readhash("${General::swroot}/guardian/settings", \%settings);
 555
 556         my $configfile = "${General::swroot}/guardian/guardian.conf";
 557
 558         # We set this to 1 (enabled) to prevent guardian from blocking the ISP gateway.
 559         my $HostGatewayByte = "1";
 560
 561         # Grab interface of red network zone.
 562         my $red_interface = &General::get_red_interface();
 563
 564         # Open configfile for writing.
 565         open(FILE, ">$configfile");
 566
 567         print FILE "Interface           $red_interface\n";
 568         print FILE "HostGatewayByte     $HostGatewayByte\n";
 569         print FILE "LogFile             $settings{'GUARDIAN_LOGFILE'}\n";
 570         print FILE "AlertFile           $settings{'GUARDIAN_SNORT_ALERTFILE'}\n";
 571         print FILE "IgnoreFile          $ignorefile\n";
 572         print FILE "TargetFile          $targetfile\n";
 573         print FILE "TimeLimit           $settings{'GUARDIAN_BLOCKTIME'}\n";
 574
 575         close(FILE);
 576
 577         # Restart the service.
 578         if ($settings{'GUARDIAN_ENABLED'} eq 'on') {
 579                 system("/usr/local/bin/guardianctrl restart &>/dev/null");
 580         } else {
 581                 system("/usr/local/bin/guardianctrl stop &>/dev/null");
 582         }
 583 }