From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tim FitzGeorge To: development@lists.ipfire.org Subject: [PATCH v2 4/8] ipblacklist: WUI Log details page Date: Mon, 27 Apr 2020 15:31:19 +0100 Message-ID: <20200427143123.6378-5-ipfr@tfitzgeorge.me.uk> In-Reply-To: <20200427143123.6378-1-ipfr@tfitzgeorge.me.uk> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8023033595194139296==" List-Id: --===============8023033595194139296== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Signed-off-by: Tim FitzGeorge --- html/cgi-bin/logs.cgi/showrequestfromblacklist.dat | 415 +++++++++++++++++++= ++ 1 file changed, 415 insertions(+) create mode 100755 html/cgi-bin/logs.cgi/showrequestfromblacklist.dat diff --git a/html/cgi-bin/logs.cgi/showrequestfromblacklist.dat b/html/cgi-bi= n/logs.cgi/showrequestfromblacklist.dat new file mode 100755 index 000000000..0de381a2d --- /dev/null +++ b/html/cgi-bin/logs.cgi/showrequestfromblacklist.dat @@ -0,0 +1,415 @@ +#!/usr/bin/perl +# SmoothWall CGIs +# +# This code is distributed under the terms of the GPL +# +# JC HERITIER +# page inspired from the initial firewalllog.dat +# +# Modified for IPFire by Christian Schmidt (www.ipfire.org) + +# enable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +use POSIX(); + +#workaround to suppress a warning when a variable is used only once +my @dummy =3D ( ${Header::table2colour} ); +undef (@dummy); + +my %cgiparams=3D(); +my %logsettings=3D(); +my $errormessage =3D ''; + +my @shortmonths =3D ( 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', + 'Sep', 'Oct', 'Nov', 'Dec' ); +my @longmonths =3D ( $Lang::tr{'january'}, $Lang::tr{'february'}, $Lang::tr{= 'march'}, + $Lang::tr{'april'}, $Lang::tr{'may'}, $Lang::tr{'june'}, $Lang::tr{'july'},= $Lang::tr{'august'}, + $Lang::tr{'september'}, $Lang::tr{'october'}, $Lang::tr{'november'}, + $Lang::tr{'december'} ); + +my @now =3D localtime(); +my $dow =3D $now[6]; +my $doy =3D $now[7]; +my $tdoy =3D $now[7]; +my $year =3D $now[5]+1900; + +$cgiparams{'DAY'} =3D $now[3]; +$cgiparams{'MONTH'} =3D $now[4]; +$cgiparams{'ACTION'} =3D ''; + +&Header::getcgihash(\%cgiparams); + +$logsettings{'LOGVIEW_REVERSE'} =3D 'off'; +&General::readhash("${General::swroot}/logging/settings", \%logsettings); + +my $start =3D -1; +my @blacklists; +if ($ENV{'QUERY_STRING'} && $cgiparams{'ACTION'} ne $Lang::tr{'update'}) +{ + my @temp =3D split(',',$ENV{'QUERY_STRING'}, 5); + $start =3D shift @temp; + $cgiparams{'MONTH'} =3D shift @temp; + $cgiparams{'DAY'} =3D shift @temp; + $cgiparams{'blacklist'} =3D shift @temp; + $cgiparams{'blacklists'} =3D shift @temp; +} + +if (!($cgiparams{'MONTH'} =3D~ /^(0|1|2|3|4|5|6|7|8|9|10|11)$/) || + !($cgiparams{'DAY'} =3D~ /^(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19= |20|21|22|23|24|25|26|27|28|29|30|31)$/)) +{ + $cgiparams{'DAY'} =3D $now[3]; + $cgiparams{'MONTH'} =3D $now[4]; +} +elsif($cgiparams{'ACTION'} eq '>>') +{ + my @temp_then=3D(); + my @temp_now =3D localtime(time); + $temp_now[4] =3D $cgiparams{'MONTH'}; + $temp_now[3] =3D $cgiparams{'DAY'}; + @temp_then =3D localtime(POSIX::mktime(@temp_now) + 86400); + ## Retrieve the same time on the next day - + ## 86400 seconds in a day + $cgiparams{'MONTH'} =3D $temp_then[4]; + $cgiparams{'DAY'} =3D $temp_then[3]; +} +elsif($cgiparams{'ACTION'} eq '<<') +{ + my @temp_then=3D(); + my @temp_now =3D localtime(time); + $temp_now[4] =3D $cgiparams{'MONTH'}; + $temp_now[3] =3D $cgiparams{'DAY'}; + @temp_then =3D localtime(POSIX::mktime(@temp_now) - 86400); + ## Retrieve the same time on the previous day - + ## 86400 seconds in a day + $cgiparams{'MONTH'} =3D $temp_then[4]; + $cgiparams{'DAY'} =3D $temp_then[3]; +} + +if (($cgiparams{'DAY'} ne $now[3]) || ($cgiparams{'MONTH'} ne $now[4])) +{ + my @then =3D (); + if ( ( $cgiparams{'MONTH'} eq $now[4]) && ($cgiparams{'DAY'} > $now[3]) || + ( $cgiparams{'MONTH'} > $now[4] ) ) { + @then =3D localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{= 'MONTH'}, $year - 1901 )); + } else { + @then =3D localtime(POSIX::mktime( 0, 0, 0, $cgiparams{'DAY'}, $cgiparams{= 'MONTH'}, $year - 1900 )); + } + $tdoy =3D $then[7]; + my $lastleap=3D($year-1)%4; + if ($tdoy>$doy) { + if ($lastleap =3D=3D 0 && $tdoy < 60) { + $doy=3D$tdoy+366; + } else { + $doy=3D$doy+365; + } + } +} + +if ($cgiparams{'blacklists'}) +{ + @blacklists =3D split ',', $cgiparams{'blacklists'}; +} + +my $datediff=3D0; +my $dowd=3D0; +my $multifile=3D0; +if ($tdoy ne $doy) { + $datediff=3Dint(($doy-$tdoy)/7); + $dowd=3D($doy-$tdoy)%7; + if (($dow-$dowd)<1) { + $datediff=3D$datediff+1; + } + if (($dow-$dowd)=3D=3D0) { + $multifile=3D1; + } +} + +my $monthstr =3D $shortmonths[$cgiparams{'MONTH'}]; +my $longmonthstr =3D $longmonths[$cgiparams{'MONTH'}]; +my $day =3D $cgiparams{'DAY'}; +my $daystr=3D''; +if ($day <=3D 9) { + $daystr =3D " $day"; } +else { + $daystr =3D $day; +} + +my $skip=3D0; +my $filestr=3D''; +if ($datediff=3D=3D0) { + $filestr=3D"/var/log/messages"; +} else { + $filestr=3D"/var/log/messages.$datediff"; + $filestr =3D "$filestr.gz" if -f "$filestr.gz"; +} + +if (!(open (FILE,($filestr =3D~ /.gz$/ ? "gzip -dc $filestr |" : $filestr)))= ) { + $errormessage =3D "$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could= not be opened'}"; + $skip=3D1; + # Note: This is in case the log does not exist for that date +} +my $lines =3D 0; +my @log=3D(); +my $blacklist =3D $cgiparams{blacklist}; + +if (!$skip) +{ + while () { + if (/^${monthstr} ${daystr} ..:..:.. [\w\-]+ kernel:.*BLKLST_(\w+)IN=3D.*/= ) { + if($1 eq $blacklist){ + $log[$lines] =3D $_; + $lines++; + } + } + } + close (FILE); +} + +$skip=3D0; +if ($multifile) { + $datediff=3D$datediff-1; + if ($datediff=3D=3D0) { + $filestr=3D"/var/log/messages"; + } else { + $filestr=3D"/var/log/messages.$datediff"; + $filestr =3D "$filestr.gz" if -f "$filestr.gz"; + } + if (!(open (FILE,($filestr =3D~ /.gz$/ ? "gzip -dc $filestr |" : $filestr))= )) { + $errormessage=3D"$Lang::tr{'date not in logs'}: $filestr $Lang::tr{'could = not be opened'}"; + $skip=3D1; + } + if (!$skip) { + while () { + if (/^${monthstr} ${daystr} ..:..:.. [\w\-]+ kernel:.*BLKLST_(\w+)IN=3D.*= /) { + if($1 eq $blacklist){ + $log[$lines] =3D $_; + $lines++; + } + } + } + close (FILE); + } +} + +&Header::showhttpheaders(); +&Header::openpage($Lang::tr{'ipblacklist log list'}, 1, ''); +&Header::openbigbox('100%', 'left', '', $errormessage); + +if ($errormessage) { + &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); + print "$errormessage \n"; + &Header::closebox(); +} + +&Header::openbox('100%', 'left', "$Lang::tr{'settings'}:"); + +print < + + + + + + + + + + + + +
$Lang::tr{'month'}:  +  $Lang::tr{'day'}:&nb= sp; +
$Lang::tr{'ipblacklist id'}
+ +END +; + +&Header::closebox(); + +&Header::openbox('100%', 'left', $Lang::tr{'ipblacklist log list'}); +print "

$Lang::tr{'firewall hits'} $longmonthstr $daystr: $lines"; + +if ($start =3D=3D -1) { + $start =3D $lines - ${Header::viewsize}; +} +if ($start >=3D $lines - ${Header::viewsize}) { $start =3D $lines - ${Header= ::viewsize}; }; +if ($start < 0) { $start =3D 0; } + +my $prev =3D $start - ${Header::viewsize}; +my $next =3D $start + ${Header::viewsize}; + +if ($prev < 0) { $prev =3D 0; } +if ($next >=3D $lines) { $next =3D -1 } +if ($start =3D=3D 0) { $prev =3D -1; } + +if ($lines !=3D 0) { &oldernewer(); } + +print < + +$Lang::tr{'time'} +$Lang::tr{'iface'} +$Lang::tr{'proto'} +$Lang::tr{'source'}= +$Lang::tr{'src port= '} +$Lang::tr{'destinat= ion'} +$Lang::tr{'dst port= '} + +END +; + +my @slice =3D splice(@log, $start, ${Header::viewsize}); + +if ($logsettings{'LOGVIEW_REVERSE'} eq 'on') { @slice =3D reverse @slice; } + +$lines =3D 0; +foreach $_ (@slice) { + $a =3D $_; + # Check whether valid ipv4 or ipv6 address + if (($_ =3D~ /BLKLST_(\w+)IN=3D/)) { + if($1 eq $blacklist) { + + my $in =3D '-'; my $out =3D '-'; + my $srcaddr =3D ''; my $dstaddr =3D ''; + my $protostr =3D ''; + my $srcport =3D ''; my $dstport =3D ''; + + # If ipv6 uses bridge, the use PHYSIN, otherwise use IN + if ($_ =3D~ /(^.* ..:..:..) [\w\-]+ kernel:.*(IN=3D.*)(PHYSIN=3D.*)$/)= {} + elsif ($_ =3D~ /(^.* ..:..:..) [\w\-]+ kernel:.*(IN=3D.*)$/) {} + my $timestamp =3D $1; my $packet =3D $2; + $timestamp =3D~ /(...) (..) (..:..:..)/; + my $month =3D $1; my $day =3D $2; my $time =3D $3; + + # If ipv6 uses bridge, the use PHYSIN and PHYSOUT, otherwise use IN and O= UT + if ($a =3D~ /PHYSIN=3D(\w+)/) { $iface =3D $1; } elsif ($a =3D~ /IN=3D(\= w+)/) { $iface =3D $1; } + if ($a =3D~ /PHYSOUT=3D(\w+)/) { $out =3D $1; } elsif ($a =3D~ /OUT=3D(= \w+)/) { $out =3D $1; } + # Detect ipv4 and ipv6 addresses + if (($a =3D~ /SRC\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =3D~ /SRC\= =3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $srcaddr =3D $1; } + if (($a =3D~ /DST\=3D(([\d]{1,3})(\.([\d]{1,3})){3})/) or ($a =3D~ /DST\= =3D(([0-9a-fA-F]{0,4})(\:([0-9a-fA-F]{0,4})){2,7})/)) { $dstaddr =3D $1; } + if ($a =3D~ /PROTO\=3D(\w+)/) { $protostr =3D $1; } + my $protostrlc =3D lc($protostr); + if ($a =3D~ /SPT\=3D([\d\.]+)/){ $srcport =3D $1; } + if ($a =3D~ /DPT\=3D([\d\.]+)/){ $dstport =3D $1; } + + if ($lines % 2) { + print "\n"; + } + else { + print "\n"; + } + print <$time + $iface + $protostr + + + +
$srcad= dr
+ + $srcport + + + +
$dstad= dr
+ + $dstport + +END + ; + $lines++; + } + } +} + +print < +END +; + +&oldernewer(); + + print"
3D'$Lang::tr{'back=
"; + +&Header::closebox(); + +&Header::closebigbox(); + +&Header::closepage(); + +sub oldernewer +{ + print < + +END + ; + + my $blacklists =3D join ',', @blacklists; + + print ""; + if ($prev !=3D -1) { + print "$Lang::= tr{'older'}"; + } + else { + print "$Lang::tr{'older'}"; + } + print "\n"; + + print ""; + if ($next !=3D -1) { + print "$Lang::= tr{'newer'}"; + } + else { + print "$Lang::tr{'newer'}"; + } + print "\n"; + + print < + +END + ; +} --=20 2.16.4 --===============8023033595194139296==--