From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] Updated: Enable ipv6 addresses in Firewall logs
Date: Thu, 07 Jan 2016 23:44:25 +0000
Message-ID: <1452210265.4749.12.camel@ipfire.org>
In-Reply-To: <568EB436.9080309@eitelwein.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7027739526060374695=="
List-Id: <development.lists.ipfire.org>

--===============7027739526060374695==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

this patch is much bigger than the last one which makes it a bit
difficult to review.

On Thu, 2016-01-07 at 19:53 +0100, Michael Eitelwein wrote:
> Updated: Enable correct display of ipv6 entries in Firewall log pages
> of web UI.

Generally IPFire 2 does not support IPv6, but it is enabled at some
places so that it can be used. However, there will be no full IPv6
support in IPFire 2 since there is a horrible CGI web user interface
which is hardly extensible.

Patches like these are okay though.

> 3 main changes:
> =C2=A0 - Fill $iface and $out from PHYSIN and PHYSOUT when looking at
> bridged packets, otherwise fill from IN and OUT

This will hopefully work for IPv4 as well :)

> =C2=A0 - Recognize ipv4 and ipv6 address style for $srcaddr and $dstaddr
> =C2=A0 - Match color coding of tables to pie charts (see seperate patch
> sent earlier)

It looks like this is included in this one as well. It would be better
to have extra patches for both changes and reference the dependency in
the commit message.

> I am using the bridged ipv6 setup as proposed in the wiki. I do not
> think this breaks anything when not using ipv6. So it would be nice
> to include this even if ipv6 is not officially supported yet. It is
> quite useful when using the ipv6 setup.

@Matthias: Could you maybe review and test this patch in a non-IPv6
setup?

> This is an updated version to my previous email (as a full diff to
> master).

What has been updated?

>=20
> Signed-off-by: Michael Eitelwein <michael(a)eitelwein.net>
> ---
> diff --git a/html/cgi-bin/logs.cgi/firewalllog.dat b/html/cgi-
> bin/logs.cgi/firewalllog.dat
> index 5a584d6..df9b488 100644
> --- a/html/cgi-bin/logs.cgi/firewalllog.dat
> +++ b/html/cgi-bin/logs.cgi/firewalllog.dat
> @@ -328,17 +328,23 @@ END
> =C2=A0 $lines =3D 0;
> =C2=A0 foreach $_ (@log)
> =C2=A0 {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0/^... (..) (..:..:..) [\w\=
-]+ kernel:(.*)(IN=3D.*)$/;
> +=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses a bridge, PHYSIN=3D contains the re=
levant iface
> information
> +=C2=A0=C2=A0=C2=A0=C2=A0# otherwise use IN=3D
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $packet =3D '';
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($_ =3D~ /^... (..) (..=
:..:..) [\w\-]+
> kernel:(.*)(IN=3D.*)(PHYSIN=3D.*)$/) { $packet =3D $5; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0elsif ($_ =3D~ /^... (..) =
(..:..:..) [\w\-]+
> kernel:(.*)(IN=3D.*)$/) { $packet =3D $4; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $day =3D=C2=
=A0=C2=A0$1;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$day =3D~ tr / =
/0/;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $time =3D $c=
giparams{'DAY'} ? "$2" : "$day/$2" ;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $comment =3D $3;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $packet =3D $4;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $chain =3D $3;
>=20
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my ($iface, $sr=
caddr, $dstaddr, $macaddr, $proto, $srcport,
> $dstport);
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$iface=3D$1=C2=A0=C2=A0=C2=
=A0if $packet =3D~ /IN=3D(\w+)/;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$srcaddr=3D$1 if $packet =
=3D~ /SRC=3D([\d\.]+)/;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$dstaddr=3D$1 if $packet =
=3D~ /DST=3D([\d\.]+)/;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($packet =3D~ /PHYSIN=
=3D(\w+)/) { $iface=3D$1; } elsif ($packet
> =3D~ /IN=3D(\w+)/) { $iface =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# Identify whether ipv4 or=
 ipv6. Both are mutally exclusive.
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($packet =3D~ /SRC\=3D(=
([\d]{1,3})(\.([\d]{1,3})){3})/) {
> $srcaddr=3D$1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if ($packet =3D~ /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-
> fA-F]{0,4})){2,7})/) { $srcaddr=3D$1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($packet =3D~ /DST\=3D(=
([\d]{1,3})(\.([\d]{1,3})){3})/) {
> $dstaddr=3D$1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if ($packet =3D~ /DST\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-
> fA-F]{0,4})){2,7})/) { $dstaddr=3D$1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$macaddr=3D$1 i=
f $packet =3D~ /MAC=3D([\w+\:]+)/;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$proto=3D$1=C2=
=A0=C2=A0=C2=A0if $packet =3D~ /PROTO=3D(\w+)/;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$srcport=3D$1 i=
f $packet =3D~ /SPT=3D(\d+)/;
> @@ -366,7 +372,7 @@ foreach $_ (@log)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print <<END
>=20
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<td align=3D'ce=
nter' $col>$time</td>
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<td align=3D'center' $col>=
$comment</td>
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<td align=3D'center' $col>=
$chain</td>
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<td align=3D'ce=
nter' $col>$iface</td>
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<td align=3D'ce=
nter' $col>$proto</td>
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<td align=3D'ce=
nter' $col><a href=3D'/cgi-
> bin/ipinfo.cgi?ip=3D$srcaddr'>$srcaddr</a><br /><a href=3D'/cgi-
> bin/ipinfo.cgi?ip=3D$dstaddr'>$dstaddr</a></td>
> diff --git a/html/cgi-bin/logs.cgi/firewalllogcountry.dat b/html/cgi-
> bin/logs.cgi/firewalllogcountry.dat
> index f998a62..087b844 100644
> --- a/html/cgi-bin/logs.cgi/firewalllogcountry.dat
> +++ b/html/cgi-bin/logs.cgi/firewalllogcountry.dat
> @@ -261,7 +261,6 @@ if( $cgiparams{'pienumber'} !=3D
> 0){$pienumber=3D$cgiparams{'pienumber'};}
> =C2=A0 if( $cgiparams{'otherspie'} !=3D
> 0){$otherspie=3D$cgiparams{'otherspie'};}
> =C2=A0 if( $cgiparams{'showpie'} !=3D 0){$showpie=3D$cgiparams{'showpie'};}
> =C2=A0 if( $cgiparams{'sortcolumn'} !=3D
> 0){$sortcolumn=3D$cgiparams{'sortcolumn'};}
> -
> =C2=A0 print <<END
> =C2=A0 </select>
> =C2=A0 </td>
> @@ -294,15 +293,24 @@ $lines =3D 0;
>=20
> =C2=A0 foreach $_ (@log)
> =C2=A0 {
> -=C2=A0=C2=A0/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=3D.*)$/;
> +=C2=A0=C2=A0# If ipv6 uses bridge, use PHYSIN for iface, otherwise IN
> +=C2=A0=C2=A0if=C2=A0=C2=A0=C2=A0=C2=A0(/^... (..) (..:..:..) [\w\-]+ kerne=
l:(.*)(PHYSIN=3D.*)$/) {}
> +=C2=A0=C2=A0elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=3D.*)$/) {}

Could this not be written like =C2=A0 (PHYS)?IN=3D =C2=A0 ?

> =C2=A0=C2=A0=C2=A0=C2=A0my $packet =3D $4;
> -=C2=A0=C2=A0$packet =3D~ /IN=3D(\w+)/;=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0my $iface=3D$1; if ( $1 =3D~ /2./ ){
> $iface=3D"";}
> -=C2=A0=C2=A0$packet =3D~ /SRC=3D([\d\.]+)/;=C2=A0=C2=A0my $srcaddr=3D$1;
> +=C2=A0=C2=A0my $iface=C2=A0=C2=A0=3D '';
> +=C2=A0=C2=A0if ($packet =3D~ /PHYSIN=3D(\w+)/) { $iface =3D $1; } elsif ($=
packet =3D~
> /IN=3D(\w+)/) { $iface =3D $1; }
> +=C2=A0=C2=A0if ( $1 =3D~ /2./ ) { $iface=3D''; }
> +=C2=A0=C2=A0my $srcaddr =3D '';
> +=C2=A0=C2=A0# Find ipv4 and ipv6 addresses
> +=C2=A0=C2=A0if=C2=A0=C2=A0=C2=A0=C2=A0($packet =3D~ /SRC\=3D(([\d]{1,3})(\=
.([\d]{1,3})){3})/) {
> $srcaddr =3D $1; }
> +=C2=A0=C2=A0elsif ($packet =3D~ /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-
> F]{0,4})){2,7})/) { $srcaddr =3D $1; }
>=20
> =C2=A0=C2=A0=C2=A0=C2=A0if($iface eq $red_interface) {
> +=C2=A0=C2=A0=C2=A0=C2=A0# Traffic from red
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($srcaddr ne '') {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# srcaddr is set
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $ccode =3D $gi->country_=
code_by_name($srcaddr);
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if( $ccode eq '') {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($ccode eq '') {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$cc=
ode =3D 'unknown';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$tabjc{$ccode} =3D $tabjc{$=
ccode} + 1 ;
> @@ -311,11 +319,16 @@ foreach $_ (@log)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0else {
> +=C2=A0=C2=A0=C2=A0=C2=A0# Traffic not from red
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($iface ne '') {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$tabjc{$iface} =
=3D $tabjc{$iface} + 1 ;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if(($tabjc{$ifa=
ce} =3D=3D 1) && ($lines < $pienumber)) { $lines
> =3D $lines + 1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$linesjc++;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> +=C2=A0=C2=A0=C2=A0=C2=A0else {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# What to do with empty iface lines?
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# This probably is traffic from ipfire=
 itself (IN=3D OUT=3DXY)?
> +=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0 }
>=20
> @@ -423,7 +436,6 @@ if ($showpie !=3D 2 && $pienumber <=3D 50 &&
> $pienumber !=3D 0) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print "<img src=
=3D'/graphs/fwlog-country$imagerandom.png'>";
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print "</div>";
> =C2=A0 }
> -
> =C2=A0 print <<END
> =C2=A0 <table width=3D'100%' class=3D'tbl'>
> =C2=A0 <tr>
> @@ -448,10 +460,8 @@ for($s=3D0;$s<$lines;$s++)
> =C2=A0=C2=A0=C2=A0=C2=A0$percent =3D $value[$s] * 100 / $linesjc;
> =C2=A0=C2=A0=C2=A0=C2=A0$percent =3D sprintf("%.f", $percent);
> =C2=A0=C2=A0=C2=A0=C2=A0$total =3D $total + $value[$s];
> -=C2=A0=C2=A0my $colorIndex =3D $color % 10;
> -=C2=A0=C2=A0if($colorIndex =3D=3D 0) {
> -=C2=A0=C2=A0=C2=A0=C2=A0$colorIndex =3D 10;
> -=C2=A0=C2=A0}
> +=C2=A0=C2=A0# colors are numbered 1 to 10
> +=C2=A0=C2=A0my $colorIndex =3D ($color % 10) + 1;
> =C2=A0=C2=A0=C2=A0=C2=A0$col=3D"bgcolor=3D'$color{\"color$colorIndex\"}'";
> =C2=A0=C2=A0=C2=A0=C2=A0$color++;
> =C2=A0=C2=A0=C2=A0=C2=A0print "<tr>";
> @@ -466,8 +476,11 @@ for($s=3D0;$s<$lines;$s++)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print"<input type=3D'hidden' name=3D'co=
untry' value=3D'$key[$s]'>";
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print"<input type=3D'submit' value=3D'd=
etails'></form>";
> =C2=A0=C2=A0=C2=A0=C2=A0}
> -
> -=C2=A0=C2=A0if($key[$s] eq 'blue0' || $key[$s] eq 'green0' || $key[$s] eq
> 'orange0') {
> +=C2=A0=C2=A0elsif ($key[$s] eq 'unknown') {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print "unknown";
> +=C2=A0=C2=A0}
> +=C2=A0=C2=A0# Looks dangerous to use hardcoded interface names here. Proba=
bly
> needs fixing.
> +=C2=A0=C2=A0if ($key[$s] eq 'blue0' || $key[$s] eq 'green0' || $key[$s] eq
> 'orange0' ) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0print "<td align=3D'center'=
 $col>$key[$s]</td>";
> =C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0else {

This unfortunately happens in many places which is one of the biggest
reasons why we will rewrite the web user interface and why extending it
is nearly impossible. At least not fun.

> @@ -489,10 +502,8 @@ for($s=3D0;$s<$lines;$s++)
>=20
> =C2=A0 if($cgiparams{'otherspie'} =3D=3D 2 ){}
> =C2=A0 else{
> -=C2=A0=C2=A0my $colorIndex =3D $color % 10;
> -=C2=A0=C2=A0if($colorIndex =3D=3D 0) {
> -=C2=A0=C2=A0=C2=A0=C2=A0$colorIndex =3D 10;
> -=C2=A0=C2=A0}
> +=C2=A0=C2=A0# colors are numbered 1 to 10
> +=C2=A0=C2=A0my $colorIndex =3D ($color % 10) + 1;
> =C2=A0=C2=A0=C2=A0=C2=A0$col=3D"bgcolor=3D'$color{\"color$colorIndex\"}'";
> =C2=A0=C2=A0=C2=A0=C2=A0print "<tr>";
>=20
> diff --git a/html/cgi-bin/logs.cgi/firewalllogip.dat b/html/cgi-
> bin/logs.cgi/firewalllogip.dat
> index 7d82d20..6fc3422 100644
> --- a/html/cgi-bin/logs.cgi/firewalllogip.dat
> +++ b/html/cgi-bin/logs.cgi/firewalllogip.dat
> @@ -291,7 +291,8 @@ if ($pienumber =3D=3D -1 || $pienumber > $lines ||
> $sortcolumn =3D=3D 2) { $pienumber =3D
> =C2=A0 $lines =3D 0;
> =C2=A0 foreach $_ (@log)
> =C2=A0 {
> -=C2=A0=C2=A0if($_ =3D~=C2=A0=C2=A0/SRC\=3D([\d\.]+)/){
> +=C2=A0=C2=A0# Extract ipv4 or ipv6 address
> +=C2=A0=C2=A0if (($_ =3D~=C2=A0=C2=A0/SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3}=
)/) or ($_ =3D~
> /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$tabjc{$1} =3D $tabjc{$1} + 1 ;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if(($tabjc{$1} =3D=3D 1) && ($lines < $=
pienumber)) { $lines =3D
> $lines + 1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$linesjc++;
> @@ -428,10 +429,8 @@ for($s=3D0;$s<$lines;$s++)
> =C2=A0=C2=A0=C2=A0=C2=A0$percent =3D $value[$s] * 100 / $linesjc;
> =C2=A0=C2=A0=C2=A0=C2=A0$percent =3D sprintf("%.f", $percent);
> =C2=A0=C2=A0=C2=A0=C2=A0$total =3D $total + $value[$s];
> -=C2=A0=C2=A0my $colorIndex =3D $color % 10;
> -=C2=A0=C2=A0if($colorIndex =3D=3D 0) {
> -=C2=A0=C2=A0=C2=A0=C2=A0$colorIndex =3D 10;
> -=C2=A0=C2=A0}
> +=C2=A0=C2=A0# colors are numbered 1 to 10
> +=C2=A0=C2=A0my $colorIndex =3D ($color % 10) + 1;
> =C2=A0=C2=A0=C2=A0=C2=A0$col=3D"bgcolor=3D'$color{\"color$colorIndex\"}'";
> =C2=A0=C2=A0=C2=A0=C2=A0print "<tr>";
>=20
> @@ -459,10 +458,8 @@ for($s=3D0;$s<$lines;$s++)
>=20
> =C2=A0 if($cgiparams{'otherspie'} =3D=3D 2 ){}
> =C2=A0 else{
> -=C2=A0=C2=A0my $colorIndex =3D $color % 10;
> -=C2=A0=C2=A0if($colorIndex =3D=3D 0) {
> -=C2=A0=C2=A0=C2=A0=C2=A0$colorIndex =3D 10;
> -=C2=A0=C2=A0}
> +=C2=A0=C2=A0# colors are numbered 1 to 10
> +=C2=A0=C2=A0my $colorIndex =3D ($color % 10) + 1;
> =C2=A0=C2=A0=C2=A0=C2=A0$col=3D"bgcolor=3D'$color{\"color$colorIndex\"}'";
> =C2=A0=C2=A0=C2=A0=C2=A0print "<tr>";
>=20
> diff --git a/html/cgi-bin/logs.cgi/firewalllogport.dat b/html/cgi-
> bin/logs.cgi/firewalllogport.dat
> index 5b0db62..583c1b3 100644
> --- a/html/cgi-bin/logs.cgi/firewalllogport.dat
> +++ b/html/cgi-bin/logs.cgi/firewalllogport.dat
> @@ -429,10 +429,8 @@ for($s=3D0;$s<$lines;$s++)
> =C2=A0=C2=A0=C2=A0=C2=A0$percent =3D $value[$s] * 100 / $linesjc;
> =C2=A0=C2=A0=C2=A0=C2=A0$percent =3D sprintf("%.f", $percent);
> =C2=A0=C2=A0=C2=A0=C2=A0$total =3D $total + $value[$s];
> -=C2=A0=C2=A0my $colorIndex =3D $color % 10;
> -=C2=A0=C2=A0if($colorIndex =3D=3D 0) {
> -=C2=A0=C2=A0=C2=A0=C2=A0$colorIndex =3D 10;
> -=C2=A0=C2=A0}
> +=C2=A0=C2=A0# colors are numbered 1 to 10
> +=C2=A0=C2=A0my $colorIndex =3D ($color % 10) + 1;
> =C2=A0=C2=A0=C2=A0=C2=A0$col=3D"bgcolor=3D'$color{\"color$colorIndex\"}'";
> =C2=A0=C2=A0=C2=A0=C2=A0print "<tr>";
>=20
> @@ -446,10 +444,8 @@ for($s=3D0;$s<$lines;$s++)
>=20
> =C2=A0 if($cgiparams{'otherspie'} =3D=3D 2 ){}
> =C2=A0 else{
> -=C2=A0=C2=A0my $colorIndex =3D $color % 10;
> -=C2=A0=C2=A0if($colorIndex =3D=3D 0) {
> -=C2=A0=C2=A0=C2=A0=C2=A0$colorIndex =3D 10;
> -=C2=A0=C2=A0}
> +=C2=A0=C2=A0# colors are numbered 1 to 10
> +=C2=A0=C2=A0my $colorIndex =3D ($color % 10) + 1;
> =C2=A0=C2=A0=C2=A0=C2=A0$col=3D"bgcolor=3D'$color{\"color$colorIndex\"}'";
> =C2=A0=C2=A0=C2=A0=C2=A0print "<tr>";
>=20
> diff --git a/html/cgi-bin/logs.cgi/showrequestfromcountry.dat
> b/html/cgi-bin/logs.cgi/showrequestfromcountry.dat
> index 5283c42..27e7697 100644
> --- a/html/cgi-bin/logs.cgi/showrequestfromcountry.dat
> +++ b/html/cgi-bin/logs.cgi/showrequestfromcountry.dat
> @@ -158,23 +158,35 @@ if (!$skip)
> =C2=A0 {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0while (<FILE>)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (/(^${monthstr} $=
{daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my=
 $packet =3D $2;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$p=
acket =3D~ /IN=3D(\w+)/;=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $iface=
=3D$1; if ( $1 =3D~
> /2./ ){ $iface=3D"";}
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$p=
acket =3D~ /SRC=3D([\d\.]+)/;=C2=A0=C2=A0my $srcaddr=3D$1;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# First check whether valid log line (=
date, day)
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (/(^${month=
str} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, the=
n use PHYSIN otherwise use IN
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if=
=C2=A0=C2=A0=C2=A0=C2=A0(/(^${monthstr} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(PHYSIN=3D.*)$/) {}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0el=
sif (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {}

Same as above.

> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my=
 $packet=C2=A0=C2=A0=3D $2;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my=
 $iface=C2=A0=C2=A0=C2=A0=3D '';
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my=
 $srcaddr =3D '';
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# =
If ipv6 uses bridge, use PHYSIN otherwise IN
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if=
 ($packet =3D~ /PHYSIN=3D(\w+)/) { $iface =3D $1; } elsif
> ($packet =3D~ /IN=3D(\w+)/) { $iface =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# =
Extract ipv4 and ipv6 addresses
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if=
 (($packet =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/)
> or ($packet =3D~ /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-
> F]{0,4})){2,7})/)) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0$srcaddr =3D $1;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0};
>=20
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0if($iface eq $country) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0# iface matches country code
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$log[$lines] =3D $_;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$lines++;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0elsif($srcaddr ne '') {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0# or srcaddr matches country code
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $ccode =3D $gi->country_code_by_name($src=
addr);
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if($ccode eq $country){
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if($ccode eq uc($country)){
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$log[$lines] =3D $_;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$lines++;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0}
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0close (FILE);
> =C2=A0 }
> @@ -194,16 +206,28 @@ if ($multifile) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (!$skip) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0while (<FILE>) {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if($_ =3D~=C2=A0=C2=A0/SRC\=3D([\d\.]+)/){
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $srcaddr=3D$1;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $ccode =3D $gi->country_co=
de_by_name($srcaddr);
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($ccode eq $country){
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# Check if valid log line (date, day)
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (/(^$=
{monthstr} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my=C2=A0=C2=A0$iface =3D '';
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, then u=
se PHYSIN otherwise
> IN
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($_ =3D~ /PHYSIN=3D(\w+)/)=
 { $iface =3D $1; } elsif
> ($_ =3D~ /IN=3D(\w+)/) { $iface =3D $1; }
> +
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($iface eq $country) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# iface matches c=
ountry code
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$log[$lines] =3D =
$_;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$lines++;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# extract ipv4 and ipv6 addre=
ss
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0elsif (($_ =3D~
> /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =3D~ /SRC\=3D(([0-9a-fA-
> F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $srcaddr=3D$1;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $ccode =3D $gi-
> >country_code_by_name($srcaddr);
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($ccode eq uc($=
country)){
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# or =
srcaddr matches country code
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0$log[$lines] =3D $_;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0$lines++;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0}
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0close (FILE);
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> @@ -308,32 +332,45 @@ $lines =3D 0;
> =C2=A0 foreach $_ (@slice)
> =C2=A0 {
> =C2=A0=C2=A0=C2=A0=C2=A0$a =3D $_;
> -=C2=A0=C2=A0/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=3D.*)$/;
> +=C2=A0=C2=A0# If ipv6 uses bridge, use PHYSIN otherwise use IN
> +=C2=A0=C2=A0if=C2=A0=C2=A0=C2=A0=C2=A0(/^... (..) (..:..:..) [\w\-]+ kerne=
l:(.*)(PHYSIN=3D.*)$/) {}
> +=C2=A0=C2=A0elsif (/^... (..) (..:..:..) [\w\-]+ kernel:(.*)(IN=3D.*)$/) {=
};
> =C2=A0=C2=A0=C2=A0=C2=A0my $packet =3D $4;
> -=C2=A0=C2=A0$packet =3D~ /IN=3D(\w+)/;=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0my $iface=3D$1; if ( $1 =3D~ /2./ ){
> $iface=3D"";}
> -=C2=A0=C2=A0$packet =3D~ /SRC=3D([\d\.]+)/;=C2=A0=C2=A0my $srcaddr=3D$1;
> +=C2=A0=C2=A0my $iface =3D '';
> +=C2=A0=C2=A0# If ipv6 uses bridge, use PHYSIN otherwise use IN
> +=C2=A0=C2=A0if ($packet =3D~ /PHYSIN=3D(\w+)/) { $iface =3D $1; } elsif ($=
packet =3D~
> /IN=3D(\w+)/) { $iface =3D $1; }
> +=C2=A0=C2=A0if ( $1 =3D~ /2./ ){ $iface=3D""; }
> +=C2=A0=C2=A0my $srcaddr =3D '';
> +=C2=A0=C2=A0# Extract ipv4 and ipv6 addresses
> +=C2=A0=C2=A0if (($packet =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/) or
> ($packet =3D~ /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/))
> {
> +=C2=A0=C2=A0=C2=A0=C2=A0$srcaddr =3D $1;
> +=C2=A0=C2=A0};
>=20
> =C2=A0=C2=A0=C2=A0=C2=A0if($iface eq $country || $srcaddr ne '') {
> -=C2=A0=C2=A0=C2=A0=C2=A0my $ccode;
> +=C2=A0=C2=A0=C2=A0=C2=A0my $ccode=3D'';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($iface ne $country) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$ccode =3D $gi->country_cod=
e_by_name($srcaddr);
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> -=C2=A0=C2=A0=C2=A0=C2=A0if($iface eq $country || $ccode eq $country) {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $chain =3D '';
> +=C2=A0=C2=A0=C2=A0=C2=A0if($iface eq $country || $ccode eq uc($country)) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $chain =3D '';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $in =3D '-'; my $out =3D=
 '-';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $srcaddr =3D ''; my $dst=
addr =3D '';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $protostr =3D '';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $srcport =3D ''; my $dst=
port =3D '';
>=20
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$_ =3D~ /(^.* ..:..:..) [\w\-]+ kernel=
:(.*)(IN=3D.*)$/;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, the use PHYSIN =
otherwise use IN
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if=C2=A0=C2=A0=C2=A0=C2=A0($_ =3D~ /(^=
.* ..:..:..) [\w\-]+
> kernel:(.*)(IN=3D.*)(PHYSIN=3D.*)$/) {}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0elsif ($_ =3D~ /(^.* ..:..:..) [\w\-]+=
 kernel:(.*)(IN=3D.*)$/) {}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $timestamp =3D $1; my $c=
hain =3D $2; my $packet =3D $3;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$timestamp =3D~ /(...) (..)=
 (..:..:..)/;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $month =3D $1; my $day =
=3D $2; my $time =3D $3;
>=20
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /IN\=3D(\w+)/) { $iface =
=3D $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /OUT\=3D(\w+)/) { $out =3D=
 $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /SRC\=3D([\d\.]+)/) { $src=
addr =3D $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /DST\=3D([\d\.]+)/) { $dst=
addr =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, use PHYSIN and =
PHYSOUT, otherwise use
> IN and OUT
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PHYSIN=3D(\w+)/)=C2=A0=C2=
=A0{ $iface =3D $1; } elsif ($a =3D~
> /IN=3D(\w+)/)=C2=A0=C2=A0{ $iface =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PHYSOUT=3D(\w+)/) { $out =
=3D $1; }=C2=A0=C2=A0=C2=A0elsif ($a =3D~
> /OUT=3D(\w+)/) { $out =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# Extract ipv4 and ipv6 addresses
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (($a =3D~ /SRC\=3D(([\d]{1,3})(\.([=
\d]{1,3})){3})/) or ($a =3D~
> /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr =3D
> $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (($a =3D~ /DST\=3D(([\d]{1,3})(\.([=
\d]{1,3})){3})/) or ($a =3D~
> /DST\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr =3D
> $1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PROTO\=3D(\w+)=
/) { $protostr =3D $1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $protostrlc =3D lc($prot=
ostr);
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~=C2=A0=C2=A0/SPT=
\=3D([\d\.]+)/){ $srcport =3D $1; }
> diff --git a/html/cgi-bin/logs.cgi/showrequestfromip.dat b/html/cgi-
> bin/logs.cgi/showrequestfromip.dat
> index 09a60b5..d7d1ace 100644
> --- a/html/cgi-bin/logs.cgi/showrequestfromip.dat
> +++ b/html/cgi-bin/logs.cgi/showrequestfromip.dat
> @@ -155,7 +155,7 @@ if (!$skip)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0while (<FILE>)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0{
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (/(^${=
monthstr} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if($_ =3D~=C2=A0=C2=A0/SRC\=3D([\d\.]+)/){
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0if (($_ =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/)
> or ($_ =3D~ /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($1 eq $ip){
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0$log[$lines] =3D $_;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0$lines++;
> @@ -182,12 +182,12 @@ if ($multifile) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if (!$skip) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0while (<FILE>) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0if (/(^${monthstr} ${daystr} ..:..:..) [\w\-]+
> kernel:.*(IN=3D.*)$/) {
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($_ =3D~=
=C2=A0=C2=A0/SRC\=3D([\d\.]+)/){
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0if($1 eq $ip){
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0if (($_ =3D~
> /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =3D~ /SRC\=3D(([0-9a-fA-
> F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) {
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0if($1 eq $ip){
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$log[$lines] =3D $_;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$lines++;
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0}
> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0close (FILE);
> @@ -293,7 +293,8 @@ $lines =3D 0;
> =C2=A0 foreach $_ (@slice)
> =C2=A0 {
> =C2=A0=C2=A0=C2=A0=C2=A0$a =3D $_;
> -=C2=A0=C2=A0if($_ =3D~=C2=A0=C2=A0/SRC\=3D([\d\.]+)/){
> +=C2=A0=C2=A0# Check whether valid ipv4 or ipv6 address
> +=C2=A0=C2=A0if (($_ =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($_ =
=3D~
> /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) {
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if($1 eq $ip){
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $chain =3D '';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my =
$in =3D '-'; my $out =3D '-';
> @@ -301,15 +302,19 @@ foreach $_ (@slice)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $protostr =3D '';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $srcport =3D ''; my $dstport =3D '';
>=20
> -=C2=A0=C2=A0=C2=A0=C2=A0$_ =3D~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=3D.=
*)$/;
> +=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, the use PHYSIN, otherwise u=
se IN
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if=C2=A0=C2=A0=C2=A0=C2=A0=
($_ =3D~ /(^.* ..:..:..) [\w\-]+
> kernel:(.*)(IN=3D.*)(PHYSIN=3D.*)$/) {}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0elsif ($_ =3D~ /(^.* ..:..=
:..) [\w\-]+ kernel:(.*)(IN=3D.*)$/)
> {}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $timestamp =3D $1; my $chain =3D $2;=
 my $packet =3D $3;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$timestamp =3D~ /(...) (..) (..:..:..)/;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $month =3D $1; my $day =3D $2; my $t=
ime =3D $3;
>=20
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /IN\=3D(\w+)/) { $iface =3D $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /OUT\=3D(\w+)/) { $out =3D $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /SRC\=3D([\d\.]+)/) { $srcaddr =3D $1;=
 }
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /DST\=3D([\d\.]+)/) { $dstaddr =3D $1;=
 }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, the=
 use PHYSIN and PHYSOUT, otherwise
> use IN and OUT
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PHYSIN=3D(\w+=
)/)=C2=A0=C2=A0{ $iface =3D $1; } elsif ($a =3D~
> /IN=3D(\w+)/)=C2=A0=C2=A0{ $iface =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PHYSOUT=3D(\w=
+)/) { $out =3D $1; }=C2=A0=C2=A0=C2=A0elsif ($a =3D~
> /OUT=3D(\w+)/) { $out =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# Detect ipv4 and ipv6 add=
resses
> +=C2=A0=C2=A0=C2=A0=C2=A0if (($a =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3=
})/) or ($a =3D~
> /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr =3D
> $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0if (($a =3D~ /DST\=3D(([\d]{1,3})(\.([\d]{1,3})){3=
})/) or ($a =3D~
> /DST\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr =3D
> $1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PROTO\=3D(\w+)/) { $protos=
tr =3D $1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $protostrlc =3D lc($protostr);
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~=C2=A0=C2=A0/SPT\=3D([\d\.]+=
)/){ $srcport =3D $1; }
> diff --git a/html/cgi-bin/logs.cgi/showrequestfromport.dat
> b/html/cgi-bin/logs.cgi/showrequestfromport.dat
> index ad9823c..6f5f63b 100644
> --- a/html/cgi-bin/logs.cgi/showrequestfromport.dat
> +++ b/html/cgi-bin/logs.cgi/showrequestfromport.dat
> @@ -307,15 +307,19 @@ foreach $_ (@slice)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $protostr =3D '';
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $srcport =3D ''; my $dstport =3D '';
>=20
> -=C2=A0=C2=A0=C2=A0=C2=A0$_ =3D~ /(^.* ..:..:..) [\w\-]+ kernel:(.*)(IN=3D.=
*)$/;
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, the=
 use PHYSIN, otherwise use IN
> +=C2=A0=C2=A0=C2=A0=C2=A0if=C2=A0=C2=A0=C2=A0=C2=A0($_ =3D~ /(^.* ..:..:..)=
 [\w\-]+
> kernel:(.*)(IN=3D.*)(PHYSIN=3D.*)$/) {}
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0elsif ($_ =3D~ /(^.* ..:..=
:..) [\w\-]+ kernel:(.*)(IN=3D.*)$/)
> {}
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $timestamp =3D $1; my $chain =3D $2;=
 my $packet =3D $3;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0$timestamp =3D~ /(...) (..) (..:..:..)/;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $month =3D $1; my $day =3D $2; my $t=
ime =3D $3; my $iface;
>=20
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /IN\=3D(\w+)/) { $iface =3D $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /OUT\=3D(\w+)/) { $out =3D $1; }
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /SRC\=3D([\d\.]+)/) { $srcaddr =3D $1;=
 }
> -=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /DST\=3D([\d\.]+)/) { $dstaddr =3D $1;=
 }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0# If ipv6 uses bridge, the=
 use PHYSIN and PHYSOUT, otherwise
> use IN and OUT
> +=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PHYSIN\=3D(\w+)/)=C2=A0=C2=A0{ $iface=
 =3D $1; } elsif ($a =3D~
> /IN\=3D(\w+)/)=C2=A0=C2=A0{ $iface =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PHYSOUT\=3D(\=
w+)/) { $out =3D $1; }=C2=A0=C2=A0=C2=A0elsif ($a =3D~
> /OUT\=3D(\w+)/) { $out =3D $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0# Detect ipv4 and ipv6 addresses
> +=C2=A0=C2=A0=C2=A0=C2=A0if (($a =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3=
})/) or ($a =3D~
> /SRC\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr =3D
> $1; }
> +=C2=A0=C2=A0=C2=A0=C2=A0if (($a =3D~ /DST\=3D(([\d]{1,3})(\.([\d]{1,3})){3=
})/) or ($a =3D~
> /DST\=3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr =3D
> $1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~ /PROTO\=3D(\w+)/) { $protos=
tr =3D $1; }
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0my $protostrlc =3D lc($protostr);
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0if ($a =3D~=C2=A0=C2=A0/SPT\=3D([\d\.]+=
)/){ $srcport =3D $1; }
>=20

Best,
-Michael

--===============7027739526060374695==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjEKCmlRSWNCQUFC
Q2dBR0JRSldqdmhaQUFvSkVJQjU4UDl2a0FrSDBab1AvMGwzdzZUTHJzK0JIQlhHUi9XU1dJSkcK
U05HWkk4aGNhRjdpZnlVZVhydE5KNFFaN0JqYmdlamxQNElpeVJTY2ErWC9UZVJYZHFvM2xNalZn
UG5teXo5bgpLQllNbFh0M3hKTi9ZZWNDR0FrbkJaUWN3bktiRUxlbFNLbWVnVVl5NVUwTUxQSUc0
TVN0ZldBY2RTQ2pPSEZlCjlXb1UwTk9Hemtwd1hJQUhqYlJFVDRGR2RDUGcxSnVZd1ZMeTdMM2k5
TUMrVnpSTmluUjM4b1ZPNnVIdVVsWlUKOW5xTlpTUDV5WUF0dG13TDVwRVB1dTA2a2JWSEpYTklJ
Z1JGeWZwM2hGVVlYQWVUOFBSNlBoRm5KdkRGenpmTApMWDlQbitnUGo5dHN3dGJMWW1ZakQ5b081
Z21XV3lraFhZUXcwdTJqYTFFOFBwS3c3MUlEWmNhM2k3OForT2dFCjZNWkRUQXBtMWE2WmNKUUFr
TFU5SW5SOVpjNHBQbk1aREFGd2hoMmlEeWl3NGlnTGxsT1kxUnR6am1rd3p4K1AKSDVkbXlLQzEx
dXI2UEt6ZURPakYxN2p2R2p6RUFOUGhocWszMnYvVmM0RkJKa25zVXVZNnNGVldlUmhQQVV0dAp3
TTJydUxNcU54SzRmaThQVzRsdlJpZXQ2aEhzeEJkM2lxYkNWS1QvekdhaEU2UFh0aFRXRTJIbERU
c1hKSUlwClczemdxOVJQVGg1U0p4by94Nk9tYVBuMVcyK1dGRGRQbWQydUxTUHlHNkZVVmx6Tkp3
L0RVOVhtVVlYU25wMjkKeVByVml1L0dqNjZFZlh0Y1VWR2I0MXVlbUJSN0ZTbWxNMmF6a0UwQ1Y3
WHlZQ2RXMEpvelh3eVdWTE9ZcDV5egpFR3BLQ3k4aVV0Y3dwUFBZVk1ncAo9QlY1KwotLS0tLUVO
RCBQR1AgU0lHTkFUVVJFLS0tLS0K

--===============7027739526060374695==--