Fix-up reverse DNS lookup and table sorting for pfSense 2.2.

author: bmeeks8 <bmeeks8@bellsouth.net> 2014-08-14 14:58:26 -0400
committer: bmeeks8 <bmeeks8@bellsouth.net> 2014-08-14 14:58:26 -0400
commit: 409def867de5eabfb4295dd74c297daafa4e3641 (patch)
tree: af8fe6e27b3699144532f48388730e35bdbc4736 /config/snort
parent: a7282dff6730944265a74a5df9fb78f8ae57a3a8 (diff)
download: pfsense-packages-409def867de5eabfb4295dd74c297daafa4e3641.tar.gz
pfsense-packages-409def867de5eabfb4295dd74c297daafa4e3641.tar.bz2
pfsense-packages-409def867de5eabfb4295dd74c297daafa4e3641.zip
4 files changed, 128 insertions, 43 deletions
diff --git a/config/snort/snort_alerts.php b/config/snort/snort_alerts.php
index 1c9d8492..c04f4e31 100755
--- a/config/snort/snort_alerts.php
+++ b/config/snort/snort_alerts.php
@@ -7,6 +7,7 @@
  * Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.
  * Copyright (C) 2006 Scott Ullrich
  * Copyright (C) 2012 Ermal Luci
+ * Copyright (C) 2014 Jim Pingle jim@pingle.org
  * Copyright (C) 2013,2014 Bill Meeks
  * All rights reserved.
  *
@@ -164,6 +165,21 @@ if (empty($pconfig['arefresh']))
 	$pconfig['arefresh'] = 'off';
 $anentries = $pconfig['alertnumber'];
 
+# --- AJAX REVERSE DNS RESOLVE Start ---
+if (isset($_POST['resolve'])) {
+	$ip = strtolower($_POST['resolve']);
+	$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
+	
+	if ($res && $res != $ip)
+		$response = array('resolve_ip' => $ip, 'resolve_text' => $res);
+	else
+		$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
+	
+	echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
+	exit;
+}
+# --- AJAX REVERSE DNS RESOLVE End ---
+
 if ($_POST['save']) {
 	if (!is_array($config['installedpackages']['snortglobal']['alertsblocks']))
 		$config['installedpackages']['snortglobal']['alertsblocks'] = array();
@@ -344,7 +360,6 @@ include_once("head.inc");
 ?>
 
 <body link="#0000CC" vlink="#0000CC" alink="#0000CC">
-<script src="/javascript/filter_log.js" type="text/javascript"></script>
 <?php
 include_once("fbegin.inc");
 
@@ -444,7 +459,7 @@ if ($savemsg) {
 			<col axis="string">
 		</colgroup>
 		<thead>
-		   <tr>
+		   <tr class="sortableHeaderRowIdentifier">
 			<th class="listhdrr" axis="date"><?php echo gettext("Date"); ?></th>
 			<th class="listhdrr" axis="number"><?php echo gettext("Pri"); ?></th>
 			<th class="listhdrr" axis="string"><?php echo gettext("Proto"); ?></th>
@@ -488,16 +503,12 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 			$alert_ip_src = $fields[6];
 			/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
 			$alert_ip_src = str_replace(":", ":&#8203;", $alert_ip_src);
+
 			/* Add Reverse DNS lookup icons (two different links if pfSense version supports them) */
 			$alert_ip_src .= "<br/>";
-			if ($pfs_version > 2.0) {
-				$alert_ip_src .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$fields[6]}&dialog_output=true', outputrule);\">";
-				$alert_ip_src .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-				$alert_ip_src .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-			}
-			$alert_ip_src .= "<a href='/diag_dns.php?host={$fields[6]}&instance={$instanceid}'>";
-			$alert_ip_src .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-			$alert_ip_src .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";
+			$alert_ip_src .= "<img onclick=\"javascript:resolve_with_ajax('{$fields[6]}');\" title=\"";
+			$alert_ip_src .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+			$alert_ip_src .= " style=\"cursor: pointer;\"/>";
 
 			/* Add icons for auto-adding to Suppress List if appropriate */
 			if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2]) && 
@@ -521,16 +532,13 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 			$alert_ip_dst = $fields[8];
 			/* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */
 			$alert_ip_dst = str_replace(":", ":&#8203;", $alert_ip_dst);
+
 			/* Add Reverse DNS lookup icons (two different links if pfSense version supports them) */
 			$alert_ip_dst .= "<br/>";
-			if ($pfs_version > 2.0) {
-				$alert_ip_dst .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$fields[8]}&dialog_output=true', outputrule);\">";
-				$alert_ip_dst .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-				$alert_ip_dst .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-			}
-			$alert_ip_dst .= "<a href='/diag_dns.php?host={$fields[8]}&instance={$instanceid}'>";
-			$alert_ip_dst .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-			$alert_ip_dst .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";	
+			$alert_ip_dst .= "<img onclick=\"javascript:resolve_with_ajax('{$fields[8]}');\" title=\"";
+			$alert_ip_dst .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+			$alert_ip_dst .= " style=\"cursor: pointer;\"/>";
+
 			/* Add icons for auto-adding to Suppress List if appropriate */
 			if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2]) && 
 			    !isset($supplist[$fields[1]][$fields[2]]['by_dst'][$fields[8]])) {
@@ -580,11 +588,11 @@ if (file_exists("{$snortlogdir}/snort_{$if_real}{$snort_uuid}/alert")) {
 				<td class='listr' align='center'>{$alert_priority}</td>
 				<td class='listr' align='center'>{$alert_proto}</td>
 				<td class='listr' style=\"word-wrap:break-word;\">{$alert_class}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[6]}'>{$alert_ip_src}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields[6]};\" sorttable_customkey=\"{$fields[6]}\">{$alert_ip_src}</td>
 				<td class='listr' align='center'>{$alert_src_p}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[8]}'>{$alert_ip_dst}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields[8]};\" sorttable_customkey=\"{$fields[8]}\">{$alert_ip_dst}</td>
 				<td class='listr' align='center'>{$alert_dst_p}</td>
-				<td class='listr' align='center' sorttable_customkey='{$fields[2]}'>{$alert_sid_str}<br/>{$sidsupplink}&nbsp;&nbsp;{$sid_dsbl_link}</td>
+				<td class='listr' align='center' style=\"sorttable_customkey:{$fields[2]};\" sorttable_customkey=\"{$fields[2]}\">{$alert_sid_str}<br/>{$sidsupplink}&nbsp;&nbsp;{$sid_dsbl_link}</td>
 				<td class='listbg' style=\"word-wrap:break-word;\">{$alert_descr}</td>
 				</tr>\n";
 			$counter++;
@@ -622,5 +630,38 @@ function encRuleSig(rulegid,rulesid,srcip,ruledescr) {
 	document.getElementById("descr").value = ruledescr;
 }
 </script>
+
+<!-- The following AJAX code was borrowed from the diag_logs_filter.php -->
+<!-- file in pfSense.  See copyright info at top of this page.          -->
+<script type="text/javascript">
+//<![CDATA[
+function resolve_with_ajax(ip_to_resolve) {
+	var url = "/snort/snort_alerts.php";
+
+	jQuery.ajax(
+		url,
+		{
+			type: 'post',
+			dataType: 'json',
+			data: {
+				resolve: ip_to_resolve,
+				},
+			complete: resolve_ip_callback
+		});
+}
+
+function resolve_ip_callback(transport) {
+	var response = jQuery.parseJSON(transport.responseText);
+	var msg = 'IP address "' + response.resolve_ip + '" resolves to\n';
+	alert(msg + 'host "' + htmlspecialchars(response.resolve_text) + '"');
+}
+
+// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
+function htmlspecialchars(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//]]>
+</script>
+
 </body>
 </html>
diff --git a/config/snort/snort_blocked.php b/config/snort/snort_blocked.php
index 97301a0f..087724e3 100644
--- a/config/snort/snort_blocked.php
+++ b/config/snort/snort_blocked.php
@@ -7,6 +7,7 @@
  *
  * Modified for the Pfsense snort package v. 1.8+
  * Copyright (C) 2009 Robert Zelaya Sr. Developer
+ * Copyright (C) 2014 Jim Pingle jim@pingle.org
  * Copyright (C) 2014 Bill Meeks
  *
  * Redistribution and use in source and binary forms, with or without
@@ -50,6 +51,21 @@ if (empty($pconfig['blertnumber']))
 else
 	$bnentries = $pconfig['blertnumber'];
 
+# --- AJAX REVERSE DNS RESOLVE Start ---
+if (isset($_POST['resolve'])) {
+	$ip = strtolower($_POST['resolve']);
+	$res = (is_ipaddr($ip) ? gethostbyaddr($ip) : '');
+	
+	if ($res && $res != $ip)
+		$response = array('resolve_ip' => $ip, 'resolve_text' => $res);
+	else
+		$response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve"));
+	
+	echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode
+	exit;
+}
+# --- AJAX REVERSE DNS RESOLVE End ---
+
 if ($_POST['todelete']) {
 	$ip = "";
 	if ($_POST['ip'])
@@ -133,7 +149,6 @@ include_once("head.inc");
 ?>
 
 <body link="#000000" vlink="#000000" alink="#000000">
-<script src="/javascript/filter_log.js" type="text/javascript"></script>
 
 <?php
 
@@ -214,11 +229,11 @@ if ($savemsg) {
 						<col width="10%" align="center">
 					</colgroup>
 					<thead>
-					   <tr>
+					   <tr class="sortableHeaderRowIdentifier">
 						<th class="listhdrr" axis="number">#</th>
 						<th class="listhdrr" axis="string"><?php echo gettext("IP"); ?></th>
 						<th class="listhdrr" axis="string"><?php echo gettext("Alert Description"); ?></th>
-						<th class="listhdrr"><?php echo gettext("Remove"); ?></th>
+						<th class="listhdrr sorttable_nosort"><?php echo gettext("Remove"); ?></th>
 					   </tr>
 					</thead>
 				<tbody>
@@ -278,20 +293,16 @@ if ($savemsg) {
 				$tmp_ip = str_replace(":", ":&#8203;", $blocked_ip);
 				/* Add reverse DNS lookup icons (two different links if pfSense version supports them) */
 				$rdns_link = "";
-				if ($pfs_version > 2.0) {
-					$rdns_link .= "<a onclick=\"javascript:getURL('/diag_dns.php?host={$blocked_ip}&dialog_output=true', outputrule);\">";
-					$rdns_link .= "<img src='../themes/{$g['theme']}/images/icons/icon_log_d.gif' width='11' height='11' border='0' ";
-					$rdns_link .= "title='" . gettext("Resolve host via reverse DNS lookup (quick pop-up)") . "' style=\"cursor: pointer;\"></a>&nbsp;";
-				}
-				$rdns_link .= "<a href='/diag_dns.php?host={$blocked_ip}'>";
-				$rdns_link .= "<img src='../themes/{$g['theme']}/images/icons/icon_log.gif' width='11' height='11' border='0' ";
-				$rdns_link .= "title='" . gettext("Resolve host via reverse DNS lookup") . "'></a>";
+				$rdns_link .= "<img onclick=\"javascript:resolve_with_ajax('{$blocked_ip}');\" title=\"";
+				$rdns_link .= gettext("Resolve host via reverse DNS lookup") . "\" border=\"0\" src=\"/themes/{$g['theme']}/images/icons/icon_log.gif\" alt=\"Icon Reverse Resolve with DNS\" ";
+				$rdns_link.= " style=\"cursor: pointer;\"/>";
+
 				/* use one echo to do the magic*/
 					echo "<tr>
 						<td align=\"center\" valign=\"middle\" class=\"listr\">{$counter}</td>
 						<td align=\"center\" valign=\"middle\" class=\"listr\">{$tmp_ip}<br/>{$rdns_link}</td>
 						<td valign=\"middle\" class=\"listr\">{$blocked_desc}</td>
-						<td align=\"center\" valign=\"middle\" class=\"listr\" sorttable_customkey=\"\">
+						<td align=\"center\" valign=\"middle\" class=\"listr\">
 						<input type=\"image\" name=\"todelete[]\" onClick=\"document.getElementById('ip').value='{$blocked_ip}';\" 
 						src=\"../themes/{$g['theme']}/images/icons/icon_x.gif\" title=\"" . gettext("Delete host from Blocked Table") . "\" border=\"0\" /></td>
 					</tr>\n";
@@ -325,5 +336,38 @@ if ($savemsg) {
 <?php
 include("fend.inc");
 ?>
+
+<!-- The following AJAX code was borrowed from the diag_logs_filter.php -->
+<!-- file in pfSense.  See copyright info at top of this page.          -->
+<script type="text/javascript">
+//<![CDATA[
+function resolve_with_ajax(ip_to_resolve) {
+	var url = "/snort/snort_blocked.php";
+
+	jQuery.ajax(
+		url,
+		{
+			type: 'post',
+			dataType: 'json',
+			data: {
+				resolve: ip_to_resolve,
+				},
+			complete: resolve_ip_callback
+		});
+}
+
+function resolve_ip_callback(transport) {
+	var response = jQuery.parseJSON(transport.responseText);
+	var msg = 'IP address "' + response.resolve_ip + '" resolves to\n';
+	alert(msg + 'host "' + htmlspecialchars(response.resolve_text) + '"');
+}
+
+// From http://stackoverflow.com/questions/5499078/fastest-method-to-escape-html-tags-as-html-entities
+function htmlspecialchars(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&apos;');
+}
+//]]>
+</script>
+
 </body>
 </html>
diff --git a/config/snort/snort_rules.php b/config/snort/snort_rules.php
index 8c31d55d..8d9aa6ba 100755
--- a/config/snort/snort_rules.php
+++ b/config/snort/snort_rules.php
@@ -157,8 +157,8 @@ if ($_POST['toggle'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid']) &
 	$sid = $_POST['sid'];
 
 	// See if the target SID is in our list of modified SIDs,
-	// and toggle it back to default if present; otherwise,
-	// add it to the appropriate modified SID list.
+	// and toggle if present; otherwise, add it to the
+	// appropriate modified SID list.
 	if (isset($enablesid[$gid][$sid])) {
 		unset($enablesid[$gid][$sid]);
 		$disablesid[$gid][$sid] = "disablesid";
@@ -600,8 +600,8 @@ if ($savemsg) {
 							<col axis="string">
 						</colgroup>
 						<thead>
-						   <tr>
-							<th class="list">&nbsp;</th>
+						   <tr class="sortableHeaderRowIdentifier">
+							<th class="list sorttable_nosort">&nbsp;</th>
 							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Proto"); ?></th>
@@ -668,7 +668,7 @@ if ($savemsg) {
 								$message = snort_get_msg($v['rule']); // description field
 								$sid_tooltip = gettext("View the raw text for this rule");
 
-								echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\" sorttable_customkey=\"\">{$textss}
+								echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\">{$textss}
 								<a id=\"rule_{$gid}_{$sid}\" href=''><input type=\"image\" onClick=\"document.getElementById('sid').value='{$sid}';
 								document.getElementById('gid').value='{$gid}';\" 
 								src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\"  
@@ -723,8 +723,8 @@ if ($savemsg) {
 							<col align="left" axis="string">
 						</colgroup>
 						<thead>
-						   <tr>
-							<th class="list">&nbsp;</th>
+						   <tr class="sortableHeaderRowIdentifier">
+							<th class="list" sorttable_nosort>&nbsp;</th>
 							<th class="listhdrr"><?php echo gettext("GID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("SID"); ?></th>
 							<th class="listhdrr"><?php echo gettext("Classification"); ?></th>
@@ -777,7 +777,7 @@ if ($savemsg) {
 										else
 											$policy = "none";
 
-										echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\" sorttable_customkey=\"\">{$textss}
+										echo "<tr><td class=\"listt\" align=\"left\" valign=\"middle\">{$textss}
 										<input type=\"image\" onClick=\"document.getElementById('sid').value='{$sid}';
 										document.getElementById('gid').value='{$gid}';\" 
 										src=\"../themes/{$g['theme']}/images/icons/{$iconb}\" width=\"11\" height=\"11\" border=\"0\"  
diff --git a/config/snort/snort_rules_flowbits.php b/config/snort/snort_rules_flowbits.php
index d7c18a9d..cbb7b631 100644
--- a/config/snort/snort_rules_flowbits.php
+++ b/config/snort/snort_rules_flowbits.php
@@ -216,7 +216,7 @@ if ($savemsg)
 				<col axis="string">
 			</colgroup>
 			<thead>
-			   <tr>
+			   <tr class="sortableHeaderRowIdentifier">
 				<th class="listhdrr" axis="number"><?php echo gettext("SID"); ?></th>
 				<th class="listhdrr" axis="string"><?php echo gettext("Proto"); ?></th>
 				<th class="listhdrr" axis="string"><?php echo gettext("Source"); ?></th>
@@ -263,7 +263,7 @@ if ($savemsg)
 
 							// Use "echo" to write the table HTML row-by-row.
 							echo "<tr>" . 
-								"<td class=\"listr\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
+								"<td class=\"listr\" style=\"sorttable_customkey:{$sid};\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
 								"<td class=\"listr\" style=\"text-align:center;\">{$protocol}</td>" . 
 								"<td class=\"listr\" style=\"overflow: hidden; text-overflow: ellipsis; text-align:center;\" nowrap><span title=\"{$rule_content[2]}\">{$source}</span></td>" . 
 								"<td class=\"listr\" style=\"overflow: hidden; text-overflow: ellipsis; text-align:center;\" nowrap><span title=\"{$rule_content[5]}\">{$destination}</span></td>" .
author	bmeeks8 <bmeeks8@bellsouth.net>	2014-08-14 14:58:26 -0400
committer	bmeeks8 <bmeeks8@bellsouth.net>	2014-08-14 14:58:26 -0400
commit	409def867de5eabfb4295dd74c297daafa4e3641 (patch)
tree	af8fe6e27b3699144532f48388730e35bdbc4736 /config/snort
parent	a7282dff6730944265a74a5df9fb78f8ae57a3a8 (diff)
download	pfsense-packages-409def867de5eabfb4295dd74c297daafa4e3641.tar.gz pfsense-packages-409def867de5eabfb4295dd74c297daafa4e3641.tar.bz2 pfsense-packages-409def867de5eabfb4295dd74c297daafa4e3641.zip