From mboxrd@z Thu Jan 1 00:00:00 1970 From: Horace Michael To: development@lists.ipfire.org Subject: [[PATCH]] Guardian enhancements Date: Thu, 03 Nov 2016 01:42:17 +0200 Message-ID: <1478130137-31542-1-git-send-email-horace.michael@gmx.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5260892947692643980==" List-Id: --===============5260892947692643980== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable 1. Detect for each IP the network it belongs and change background of that IP= according to the network (Green, Red, Blue, Orange) 2. For each IP detect the country it belongs to and display country flag near= IP This is my second attempt to use GIT. Signed-off-by: Horace Michael --- html/cgi-bin/guardian.cgi | 687 +++++++++++++++++++++++++++++++-------------= -- 1 file changed, 470 insertions(+), 217 deletions(-) mode change 100644 =3D> 100755 html/cgi-bin/guardian.cgi diff --git a/html/cgi-bin/guardian.cgi b/html/cgi-bin/guardian.cgi old mode 100644 new mode 100755 index 963a56430768..b05d4f7f7bad --- a/html/cgi-bin/guardian.cgi +++ b/html/cgi-bin/guardian.cgi @@ -22,6 +22,9 @@ use strict; use Locale::Codes::Country; use Guardian::Socket; +use Net::IPv4Addr qw( :all ); +use Geo::IP::PurePerl; +use Switch; =20 # enable only the following on debugging purpose #use warnings; @@ -45,6 +48,16 @@ my @memory=3D(); my @pid=3D(); my @guardian=3D(); =20 +my @colour=3D(); +my @network=3D(); +my @masklen=3D(); +my $colour_multicast =3D "#A0A0A0"; +#needed for the country flag +my @key; +my @value; +my $color=3D0; + + # Path to the guardian.ignore file. my $ignorefile =3D'/var/ipfire/guardian/guardian.ignore'; =20 @@ -56,6 +69,9 @@ my %module_file_locations =3D ( "SNORT" =3D> "/var/log/snort/alert", "SSH" =3D> "/var/log/messages", ); +my %netsettings=3D(); +&General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + =20 our %netsettings =3D (); &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); @@ -65,6 +81,193 @@ our %mainsettings =3D (); &General::readhash("${General::swroot}/main/settings", \%mainsettings); &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/i= nclude/colors.txt", \%color); =20 +# ##################################################### +# Collect data for the @network array. + +# Add Firewall Localhost 127.0.0.1 +push(@network, '127.0.0.1'); +push(@masklen, '255.255.255.255'); +push(@colour, ${Header::colourfw}); + + + +if (open(IP, "${General::swroot}/red/local-ipaddress")) { + my $redip =3D ; + close(IP); + chomp $redip; + push(@network, $redip); + push(@masklen, '255.255.255.255'); + push(@colour, ${Header::colourfw}); +} + +# Add STATIC RED aliases +if ($netsettings{'RED_DEV'}) { + my $aliasfile =3D "${General::swroot}/ethernet/aliases"; + open(ALIASES, $aliasfile) or die 'Unable to open aliases file.'; + my @aliases =3D ; + close(ALIASES); + +# We have a RED eth iface +if ($netsettings{'RED_TYPE'} eq 'STATIC') { + +#We have a STATIC RED eth iface + foreach my $line (@aliases) { + chomp($line); + my @temp =3D split(/\,/,$line); + if ($temp[0]) { + push(@network, $temp[0]); + push(@masklen, $netsettings{'RED_NETMASK'} ); + push(@colour, ${Header::colourfw} ); + } + } + } +} + +# Add Green Firewall Interface + push(@network, $netsettings{'GREEN_ADDRESS'}); + push(@masklen, "255.255.255.255" ); + push(@colour, ${Header::colourfw} ); + +# Add Green Network to Array + push(@network, $netsettings{'GREEN_NETADDRESS'}); + push(@masklen, $netsettings{'GREEN_NETMASK'} ); + push(@colour, ${Header::colourgreen} ); + +# Add Green Routes to Array + my @routes =3D `/sbin/route -n | /bin/grep $netsettings{'GREEN_DEV'}`; + foreach my $route (@routes) { + chomp($route); + my @temp =3D split(/[\t ]+/, $route); + push(@network, $temp[0]); + push(@masklen, $temp[2]); + push(@colour, ${Header::colourgreen} ); + } + +# Add Blue Firewall Interface + push(@network, $netsettings{'BLUE_ADDRESS'}); + push(@masklen, "255.255.255.255" ); + push(@colour, ${Header::colourfw} ); + +# Add Blue Network + if ($netsettings{'BLUE_DEV'}) { + push(@network, $netsettings{'BLUE_NETADDRESS'}); + push(@masklen, $netsettings{'BLUE_NETMASK'} ); + push(@colour, ${Header::colourblue} ); + +# Add Blue Routes to Array + @routes =3D `/sbin/route -n | /bin/grep $netsettings{'BLUE_DEV'}`; + foreach my $route (@routes) { + chomp($route); + my @temp =3D split(/[\t ]+/, $route); + push(@network, $temp[0]); + push(@masklen, $temp[2]); + push(@colour, ${Header::colourblue} ); + } +} + +# Add Orange Firewall Interface + push(@network, $netsettings{'ORANGE_ADDRESS'}); + push(@masklen, "255.255.255.255" ); + push(@colour, ${Header::colourfw} ); + +# Add Orange Network + if ($netsettings{'ORANGE_DEV'}) { + push(@network, $netsettings{'ORANGE_NETADDRESS'}); + push(@masklen, $netsettings{'ORANGE_NETMASK'} ); + push(@colour, ${Header::colourorange} ); + # Add Orange Routes to Array + @routes =3D `/sbin/route -n | /bin/grep $netsettings{'ORANGE_DEV'}`; + foreach my $route (@routes) { + chomp($route); + my @temp =3D split(/[\t ]+/, $route); + push(@network, $temp[0]); + push(@masklen, $temp[2]); + push(@colour, ${Header::colourorange} ); + + } +} + +# Highlight multicast connections. + push(@network, "224.0.0.0"); + push(@masklen, "239.0.0.0"); + push(@colour, $colour_multicast); + +# Add OpenVPN net and RED/BLUE/ORANGE entry (when appropriate) + if (-e "${General::swroot}/ovpn/settings") { + my %ovpnsettings =3D (); + &General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings); + my @tempovpnsubnet =3D split("\/",$ovpnsettings{'DOVPN_SUBNET'}); + +# add OpenVPN net + push(@network, $tempovpnsubnet[0]); + push(@masklen, $tempovpnsubnet[1]); + push(@colour, ${Header::colourovpn} ); + +# add BLUE:port / proto + if (($ovpnsettings{'ENABLED_BLUE'} eq 'on') && $netsettings{'BLUE_DEV'}) { + push(@network, $netsettings{'BLUE_ADDRESS'} ); + push(@masklen, '255.255.255.255' ); + push(@colour, ${Header::colourovpn}); +} + +# add ORANGE:port / proto + if (($ovpnsettings{'ENABLED_ORANGE'} eq 'on') && $netsettings{'ORANGE_DEV'}= ) { + push(@network, $netsettings{'ORANGE_ADDRESS'} ); + push(@masklen, '255.255.255.255' ); + push(@colour, ${Header::colourovpn} ); + } +} + +# Add OpenVPN net for custom OVPNs + if (-e "${General::swroot}/ovpn/ccd.conf") { + open(OVPNSUB, "${General::swroot}/ovpn/ccd.conf"); + my @ovpnsub =3D ; + close(OVPNSUB); + foreach (@ovpnsub) { + my ($network, $mask) =3D split '/', (split ',', $_)[2]; + $mask =3D ipv4_cidr2msk($mask) unless &General::validip($mask); + push(@network, $network); + push(@masklen, $mask); + push(@colour, ${Header::colourovpn}); + } +} + +open(IPSEC, "${General::swroot}/vpn/config"); + my @ipsec =3D ; + close(IPSEC); + foreach my $line (@ipsec) { + my @vpn =3D split(',', $line); + my ($network, $mask) =3D split("/", $vpn[12]); + if (!&General::validip($mask)) { + $mask =3D ipv4_cidr2msk($mask); + } + push(@network, $network); + push(@masklen, $mask); + push(@colour, ${Header::colourvpn}); +} + +if (-e "${General::swroot}/ovpn/n2nconf") { + open(OVPNN2N, "${General::swroot}/ovpn/ovpnconfig"); + my @ovpnn2n =3D ; + close(OVPNN2N); + foreach my $line (@ovpnn2n) { + my @ovpn =3D split(',', $line); + next if ($ovpn[4] ne 'net'); + my ($network, $mask) =3D split("/", $ovpn[12]); + if (!&General::validip($mask)) { + $mask =3D ipv4_cidr2msk($mask); + } + push(@network, $network); + push(@masklen, $mask); + push(@colour, ${Header::colourovpn}); + } +} + + +# ##################################################### + + + # Pakfire meta file for owncloud. # (File exists when the addon is installed.) my $owncloud_meta =3D "/opt/pakfire/db/installed/meta-owncloud"; @@ -475,8 +678,6 @@ sub showMainBox() { END =20 - - # Draw current guardian state. &Header::openbox('100%', 'center', $Lang::tr{'guardian'}); =20 @@ -563,14 +764,14 @@ END END =20 - # Display owncloud checkbox when the addon is installed. - if ( -e "$owncloud_meta" ) { - print"\n"; - print"$Lang::tr{'guardian block ownclou= d brute-force'}\n"; - print"on /\n"; - print" off\n"; - print"\n"; - } + # Display owncloud checkbox when the addon is installed. + if ( -e "$owncloud_meta" ) { + print"\n"; + print"$Lang::tr{'guardian block owncloud = brute-force'}\n"; + print"on /\n"; + print" off\n"; + print"\n"; + } print <
@@ -657,128 +858,140 @@ sub showIgnoreBox() { &Header::openbox('100%', 'center', $Lang::tr{'guardian ignored hosts= '}); =20 print < + + - + END - # Check if some hosts have been add to be ignored. - if (keys (%ignored)) { - my $col =3D ""; - - # Loop through all entries of the hash.. - while( (my $key) =3D each %ignored) { - # Assign data array positions to some nice variable names. - my $address =3D $ignored{$key}[0]; - my $remark =3D $ignored{$key}[1]; - my $status =3D $ignored{$key}[2]; - - # Check if the key (id) number is even or not. - if ($settings{'ID'} eq $key) { - $col=3D"bgcolor=3D'${Header::colouryellow}'"; - } elsif ($key % 2) { - $col=3D"bgcolor=3D'$color{'color22'}'"; - } else { - $col=3D"bgcolor=3D'$color{'color20'}'"; - } - - # Choose icon for the checkbox. - my $gif; - my $gdesc; - - # Check if the status is enabled and select the correct image and descr= iption. - if ($status eq 'enabled' ) { - $gif =3D 'on.gif'; - $gdesc =3D $Lang::tr{'click to disable'}; - } else { - $gif =3D 'off.gif'; - $gdesc =3D $Lang::tr{'click to enable'}; - } - - print < - - - - - - - - - -END - } - } else { - # Print notice that currently no hosts are ignored. - print "\n"; - print "\n"; - print "\n"; - } +# Check if some hosts have been add to be ignored. + if (keys (%ignored)) { + my $col =3D ""; + my $col1 =3D ""; =20 - print "
$Lang::tr{'ip addres= s'}$Lang::tr{'country'} $Lang::tr{'remark'}<= /b>$Lang::tr{'action'}
$address$remark -
- - - -
- 		-
- - - -
- 		-
- - - -
-
$Lang::tr{'guardian no entries'}=
\n"; +# Loop through all entries of the hash.. + while( (my $key) =3D each %ignored) { + # Assign data array positions to some nice variable names. + my $address =3D $ignored{$key}[0]; + my $remark =3D $ignored{$key}[1]; + my $status =3D $ignored{$key}[2]; =20 - # Section to add new elements or edit existing ones. - print < -
-
+ # geoip lookup + my $gi =3D Geo::IP::PurePerl->new(); + my $ccode =3D $gi->country_code_by_name($address); + my $fcode =3D uc($ccode); =20 -
- -END + # Detect the network in which the IP belongs and set the color for that n= etwork. + $col1=3Dipcolour($address); =20 - # Assign correct headline and button text. - my $buttontext; - my $entry_address; - my $entry_remark; + # Check if the key (id) number is even or not. + if ($settings{'ID'} eq $key) { + $col=3D"bgcolor=3D'${Header::colouryellow}'"; + } elsif ($key % 2) { + $col=3D"bgcolor=3D'$color{'color22'}'"; + } else { + $col=3D"bgcolor=3D'$color{'color20'}'"; + } =20 - # Check if an ID (key) has been given, in this case an existing entry shoul= d be edited. - if ($settings{'ID'} ne '') { - $buttontext =3D $Lang::tr{'update'}; - print "\n"; +# Choose icon for the checkbox. +my $gif; +my $gdesc; + +# Check if the status is enabled and select the correct image and descriptio= n. +if ($status eq 'enabled' ) { + $gif =3D 'on.gif'; + $gdesc =3D $Lang::tr{'click to disable'}; +} else { + $gif =3D 'off.gif'; + $gdesc =3D $Lang::tr{'click to enable'}; +} =20 - # Grab address and remark for the given key. - $entry_address =3D $ignored{$settings{'ID'}}[0]; - $entry_remark =3D $ignored{$settings{'ID'}}[1]; +print ""; + print ""; + if ( $fcode ne "" ){ + print ""; + } + else { + print ""; + } + print ""; +print < +
+ + + + + + + + +END + } } else { - $buttontext =3D $Lang::tr{'add'}; - print "\n"; + # Print notice that currently no hosts are ignored. + print "\n"; + print "\n"; } =20 - print < - - - - + print "
$Lang::tr{'update'}=
$address3D'$ccode'$remark +
+ + + +
+ 		+
+ + + +
+
$Lang::tr{'dnsforward a= dd a new entry'}
$Lang::tr{'guardian no entries'}\n"; + print "
$Lang::tr{'ip address'}:
\n"; =20 - $Lang::tr{'remark'}: - - - - - -
+# Section to add new elements or edit existing ones. +print < +
+
+ +
+ +END + +# Assign correct headline and button text. +my $buttontext; +my $entry_address; +my $entry_remark; + +# Check if an ID (key) has been given, in this case an existing entry should= be edited. +if ($settings{'ID'} ne '') { + $buttontext =3D $Lang::tr{'update'}; + print "\n"; + + # Grab address and remark for the given key. + $entry_address =3D $ignored{$settings{'ID'}}[0]; + $entry_remark =3D $ignored{$settings{'ID'}}[1]; +} else { + $buttontext =3D $Lang::tr{'add'}; + print "\n"; +} + +print < + + + + + + + + + +
$Lang::tr{'update'}<= /td>
$Lang::tr{'dnsforward ad= d a new entry'}
$Lang::tr{'ip address'}: $Lang::tr{'remark'}:
+
END =20 &Header::closebox(); @@ -788,73 +1001,91 @@ END sub showBlockedBox() { &Header::openbox('100%', 'center', $Lang::tr{'guardian blocked hosts'}); =20 - print < - - $Lang::= tr{'guardian blocked hosts'} - + # VirusTotal + # DomainTools + # MultiRBL + # IPVoid +=09 +print < + + $Lang::t= r{'guardian blocked hosts'} + $Lang::tr{'country'} + $Lang::tr{'action'} + END =20 - # Lauch function to get the currently blocked hosts. - my @blocked_hosts =3D &GetBlockedHosts(); +# Launch function to get the currently blocked hosts. +my @blocked_hosts =3D &GetBlockedHosts(); =20 - my $id =3D 0; - my $col =3D ""; +my $id =3D 0; +my $col =3D ""; +my $col1 =3D ""; =20 - # Loop through our blocked hosts array. - foreach my $blocked_host (@blocked_hosts) { +# Loop through our blocked hosts array. +foreach my $blocked_host (@blocked_hosts) { + # geoip lookup + my $gi =3D Geo::IP::PurePerl->new(); + my $ccode =3D $gi->country_code_by_name($blocked_host); + my $fcode =3D uc($ccode); =20 - # Increase id number for each element in the ignore file. - $id++; + # Detect the network in which the IP belongs and set the color for that net= work. + $col1=3Dipcolour($blocked_host); =20 - # Check if the id number is even or not. - if ($id % 2) { - $col=3D"bgcolor=3D'$color{'color22'}'"; - } else { - $col=3D"bgcolor=3D'$color{'color20'}'"; - } + # Increase id number for each element in the ignore file. + $id++; =20 - print < - $blocked_host - -
- - - -
- - + # Check if the id number is even or not. + if ($id % 2) { + $col=3D"bgcolor=3D'$color{'color22'}'"; + } else { + $col=3D"bgcolor=3D'$color{'color20'}'"; + } + print ""; + print " $blocked_host"; + if ( $fcode ne "" ){ + print "3D'$ccode'";} + else { + print "$fcode";} + print < +
+ + + +
+ + END - } + } =20 - # If the loop only has been runs once the id still is "0", which means ther= e are no - # additional entries (blocked hosts) in the iptables chain. - if ($id =3D=3D 0) { +# If the loop only has been runs once the id still is "0", which means there= are no +# additional entries (blocked hosts) in the iptables chain. +if ($id =3D=3D 0) { =20 - # Print notice that currently no hosts are blocked. - print "\n"; - print "$Lang::tr{'guardian no entries'}\n"; - print "\n"; - } + # Print notice that currently no hosts are blocked. + print "\n"; + print "$Lang::tr{'guardian no entries'}\n"; + print "\n"; +} =20 print "\n"; =20 # Section for a manual block of an IP-address. - print < -
- - - - - - - - - -
$Lang::tr{'guardian block a host'}:
-
+print < +
+ + + + + + + + + +
$Lang::tr{'guardian block a host'}:
+
END =20 &Header::closebox(); @@ -887,58 +1118,58 @@ sub daemonstats() { } =20 sub GetBlockedHosts() { - # Create new, empty array. - my @hosts; - - # Lauch helper to get chains from iptables. - system('/usr/local/bin/getipstat'); - - # Open temporary file which contains the chains and rules. - open (FILE, '/srv/web/ipfire/html/iptables.txt'); - - # Loop through the entire file. - while () { - my $line =3D $_; - - # Search for the guardian chain and extract - # the lines between it and the next empty line - # which is placed before the next firewall - # chain starts. - if ($line =3D~ /^Chain GUARDIAN/ .. /^\s*$/) { - # Skip descriptive lines. - next if ($line =3D~ /^Chain/); - next if ($line =3D~ /^ pkts/); - - # Generate array, based on the line content (seperator is a single or mul= tiple space's) - my @comps =3D split(/\s{1,}/, $line); - my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $dest= ination) =3D @comps; - - # Assign different variable names. - my $blocked_host =3D $source; - - # Add host to our hosts array. - if ($blocked_host) { - push(@hosts, $blocked_host); - } +# Create new, empty array. +my @hosts; + +# Lauch helper to get chains from iptables. +system('/usr/local/bin/getipstat'); + +# Open temporary file which contains the chains and rules. +open (FILE, '/srv/web/ipfire/html/iptables.txt'); + +# Loop through the entire file. +while () { + my $line =3D $_; + + # Search for the guardian chain and extract + # the lines between it and the next empty line + # which is placed before the next firewall + # chain starts. + if ($line =3D~ /^Chain GUARDIAN/ .. /^\s*$/) { + # Skip descriptive lines. + next if ($line =3D~ /^Chain/); + next if ($line =3D~ /^ pkts/); + + # Generate array, based on the line content (seperator is a single or mult= iple space's) + my @comps =3D split(/\s{1,}/, $line); + my ($lead, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $desti= nation) =3D @comps; + + # Assign different variable names. + my $blocked_host =3D $source; + + # Add host to our hosts array. + if ($blocked_host) { + push(@hosts, $blocked_host); } } +} =20 - # Close filehandle. - close(FILE); +# Close filehandle. +close(FILE); =20 - # Remove recently created temporary files of the "getipstat" binary. - system(rm -f "/srv/web/ipfire/html/iptables.txt"); - system(rm -f "/srv/web/ipfire/html/iptablesmangle.txt"); - system(rm -f "/srv/web/ipfire/html/iptablesnat.txt"); +# Remove recently created temporary files of the "getipstat" binary. +system(rm -f "/srv/web/ipfire/html/iptables.txt"); +system(rm -f "/srv/web/ipfire/html/iptablesmangle.txt"); +system(rm -f "/srv/web/ipfire/html/iptablesnat.txt"); =20 - # Convert entries, sort them, write back and store the sorted entries into = new array. - my @sorted =3D map { $_->[0] } - sort { $a->[1] <=3D> $b->[1] } - map { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_)= )] } - @hosts; +# Convert entries, sort them, write back and store the sorted entries into n= ew array. +my @sorted =3D map { $_->[0] } + sort { $a->[1] <=3D> $b->[1] } + map { [$_, int sprintf("%03.f%03.f%03.f%03.f", split(/\./, $_))] } + @hosts; =20 - # Return our sorted list. - return @sorted +# Return our sorted list. +return @sorted } =20 sub BuildConfiguration() { @@ -1100,7 +1331,7 @@ sub GenerateIgnoreFile() { print FILE "$address\n\n"; } } - } + } } =20 close(FILE); @@ -1135,3 +1366,25 @@ sub _get_address_from_file ($) { # Return nothing. return; } + + +sub ipcolour($) { + my $id =3D 0; + my $colour =3D ${Header::colourred}; + my ($ip) =3D $_[0]; + my $found =3D 0; + + foreach my $line (@network) { + if ($network[$id] eq '') { + $id++; + } else { + if (!$found && ipv4_in_network($network[$id], $masklen[$id], $ip) ) { + $found =3D 1; + $colour =3D $colour[$id]; + } + $id++; + } + } + + return $colour; +} --=20 2.7.4 --===============5260892947692643980==--