aboutsummaryrefslogtreecommitdiffstats
path: root/config/ipguard
diff options
context:
space:
mode:
Diffstat (limited to 'config/ipguard')
-rw-r--r--config/ipguard/ipguard.inc218
-rw-r--r--config/ipguard/ipguard.xml194
-rwxr-xr-xconfig/ipguard/ipguard_sync.xml97
3 files changed, 509 insertions, 0 deletions
diff --git a/config/ipguard/ipguard.inc b/config/ipguard/ipguard.inc
new file mode 100644
index 00000000..1891b24b
--- /dev/null
+++ b/config/ipguard/ipguard.inc
@@ -0,0 +1,218 @@
+<?php
+
+/* ========================================================================== */
+/*
+ ipguard.inc
+ part of the ipguard package for pfSense (http://www.pfSense.com)
+ Copyright (C) 2012 Marcello Coutinho
+ All rights reserved.
+
+ Based on m0n0wall (http://m0n0.ch/wall)
+ Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+ All rights reserved.
+ */
+/* ========================================================================== */
+/*
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+ */
+/* ========================================================================== */
+ require_once("config.inc");
+ require_once("util.inc");
+
+function ipguard_custom_php_deinstall_command(){
+ global $g, $config;
+
+ conf_mount_rw();
+
+ stop_service('ipguard');
+ $ipguard_sh_file = "/usr/local/etc/rc.d/ipguard.sh";
+ if (is_file($ipguard_sh_file))
+ chmod($ipguard_sh_file,0444);
+
+ conf_mount_ro();
+ }
+
+function ipguard_custom_php_write_config(){
+ global $g, $config;
+
+ # detect boot process
+ if (is_array($_POST)){
+ if (!preg_match("/\w+/",$_POST['__csrf_magic']))
+ return;
+ }
+
+
+ if (is_array($config['installedpackages']['ipguard']['config'])){
+ // Read config
+ $new_config=array();
+ foreach ($config['installedpackages']['ipguard']['config'] as $ipguard){
+ if ($ipguard['enable'] && $ipguard['interface'] && $ipguard['mac'] && $ipguard['ip']){
+ $new_config[$ipguard['interface']].= "{$ipguard['mac']} {$ipguard['ip']} {$ipguard['description']}\n";
+ }
+ }
+ }
+
+ //Save /etc/ssh/ipguard_extra
+ $script="/usr/local/etc/rc.d/ipguard.sh";
+ $start="";
+ $stop="pkill -anx ipguard";
+ conf_mount_rw();
+ if (count ($new_config) > 0 && $ipguard['enable']){
+ foreach ($new_config as $key => $value){
+ $conf_file="/usr/local/etc/ipguard_{$key}.conf";
+ file_put_contents($conf_file,$value,LOCK_EX);
+ $config_file=file_put_contents($conf_file,$new_config[$key],LOCK_EX);
+ $iface=convert_friendly_interface_to_real_interface_name($key);
+ $start.="/usr/local/sbin/ipguard -l /var/log/ipguard_{$key}.log -p /var/run/ipguard_{$key}.pid -f {$conf_file} -u 300 -z {$iface}\n\t";
+ }
+ write_rcfile(array(
+ 'file' => 'ipguard.sh',
+ 'start' => $start,
+ 'stop' => $stop
+ ));
+ restart_service('ipguard');
+
+ }
+ else{
+ #remove config files
+ stop_service('ipguard');
+ $ipguard_sh_file = "/usr/local/etc/rc.d/ipguard.sh";
+ if (is_file($ipguard_sh_file))
+ chmod($ipguard_sh_file,0444);
+ }
+ // Mount Read-only
+ conf_mount_ro();
+
+ //sync config with other pfsense servers
+ ipguard_sync_on_changes();
+ }
+
+/* Uses XMLRPC to synchronize the changes to a remote node */
+function ipguard_sync_on_changes() {
+ global $config, $g;
+
+ if (is_array($config['installedpackages']['ipguardsync'])) {
+ if ($config['installedpackages']['ipguardsync']['config'][0]['synconchanges']) {
+ log_error("[ipguard] xmlrpc sync is starting.");
+ foreach ($config['installedpackages']['ipguardsync']['config'] as $rs ){
+ foreach($rs['row'] as $sh){
+ $sync_to_ip = $sh['ipaddress'];
+ $password = $sh['password'];
+ if($password && $sync_to_ip)
+ ipguard_do_xmlrpc_sync($sync_to_ip, $password);
+ }
+ }
+ log_error("[ipguard] xmlrpc sync is ending.");
+ }
+ }
+}
+
+/* Do the actual XMLRPC sync */
+function ipguard_do_xmlrpc_sync($sync_to_ip, $password) {
+ global $config, $g;
+
+ if(!$password)
+ return;
+
+ if(!$sync_to_ip)
+ return;
+
+ $username='admin';
+ $xmlrpc_sync_neighbor = $sync_to_ip;
+ if($config['system']['webgui']['protocol'] != "") {
+ $synchronizetoip = $config['system']['webgui']['protocol'];
+ $synchronizetoip .= "://";
+ }
+ $port = $config['system']['webgui']['port'];
+ /* if port is empty lets rely on the protocol selection */
+ if($port == "") {
+ if($config['system']['webgui']['protocol'] == "http")
+ $port = "80";
+ else
+ $port = "443";
+ }
+ $synchronizetoip .= $sync_to_ip;
+
+ /* xml will hold the sections to sync */
+ $xml = array();
+ $xml['ipguard'] = $config['installedpackages']['ipguard'];
+ /* assemble xmlrpc payload */
+ $params = array(
+ XML_RPC_encode($password),
+ XML_RPC_encode($xml)
+ );
+
+ /* set a few variables needed for sync code borrowed from filter.inc */
+ $url = $synchronizetoip;
+ log_error("Beginning ipguard XMLRPC sync to {$url}:{$port}.");
+ $method = 'pfsense.merge_installedpackages_section_xmlrpc';
+ $msg = new XML_RPC_Message($method, $params);
+ $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+ $cli->setCredentials($username, $password);
+ if($g['debug'])
+ $cli->setDebug(1);
+ /* send our XMLRPC message and timeout after 250 seconds */
+ $resp = $cli->send($msg, "250");
+ if(!$resp) {
+ $error = "A communications error occurred while attempting ipguard XMLRPC sync with {$url}:{$port}.";
+ log_error($error);
+ file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+ } elseif($resp->faultCode()) {
+ $cli->setDebug(1);
+ $resp = $cli->send($msg, "250");
+ $error = "An error code was received while attempting ipguard XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+ log_error($error);
+ file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+ } else {
+ log_error("ipguard XMLRPC sync successfully completed with {$url}:{$port}.");
+ }
+
+ /* tell ipguard to reload our settings on the destination sync host. */
+ $method = 'pfsense.exec_php';
+ $execcmd = "require_once('/usr/local/pkg/ipguard.inc');\n";
+ $execcmd .= "ipguard_custom_php_write_config();";
+ /* assemble xmlrpc payload */
+ $params = array(
+ XML_RPC_encode($password),
+ XML_RPC_encode($execcmd)
+ );
+
+ log_error("ipguard XMLRPC reload data {$url}:{$port}.");
+ $msg = new XML_RPC_Message($method, $params);
+ $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+ $cli->setCredentials($username, $password);
+ $resp = $cli->send($msg, "250");
+ if(!$resp) {
+ $error = "A communications error occurred while attempting ipguard XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
+ log_error($error);
+ file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+ } elseif($resp->faultCode()) {
+ $cli->setDebug(1);
+ $resp = $cli->send($msg, "250");
+ $error = "An error code was received while attempting ipguard XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+ log_error($error);
+ file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+ } else {
+ log_error("ipguard XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php).");
+ }
+}
+ ?> \ No newline at end of file
diff --git a/config/ipguard/ipguard.xml b/config/ipguard/ipguard.xml
new file mode 100644
index 00000000..cafc6e4e
--- /dev/null
+++ b/config/ipguard/ipguard.xml
@@ -0,0 +1,194 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<packagegui>
+<copyright>
+ <![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+ ipguard.xml
+ part of the ipguard package for pfSense (http://www.pfSense.com)
+ Copyright (C) 2012 Marcello Coutinho
+ All rights reserved.
+
+ Based on m0n0wall (http://m0n0.ch/wall)
+ Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+ All rights reserved.
+ */
+/* ========================================================================== */
+/*
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+ */
+/* ========================================================================== */
+ ]]>
+ </copyright>
+
+ <name>ipguard</name>
+ <version>1.0</version>
+ <title>Ipguard</title>
+ <description>Ipguard macs/ip</description>
+ <savetext>Save</savetext>
+ <include_file>/usr/local/pkg/ipguard.inc</include_file>
+ <menu>
+ <name>Ipguard</name>
+ <tooltiptext>Tool designed to protect LAN IP address space by ARP spoofing</tooltiptext>
+ <section>Firewall</section>
+ <url>/pkg.php?xml=ipguard.xml</url>
+ </menu>
+ <service>
+ <name>ipguard</name>
+ <rcfile>ipguard.sh</rcfile>
+ <executable>ipguard</executable>
+ <description>Tool designed to protect LAN IP address space by ARP spoofing.</description>
+ </service>
+ <configpath>installedpackages->package->ipguard</configpath>
+ <additional_files_needed>
+ <prefix>/usr/local/pkg/</prefix>
+ <chmod>755</chmod>
+ <item>http://www.pfsense.com/packages/config/ipguard/ipguard.inc</item>
+ </additional_files_needed>
+ <additional_files_needed>
+ <prefix>/usr/local/pkg/</prefix>
+ <chmod>755</chmod>
+ <item>http://www.pfsense.com/packages/config/ipguard/ipguard_sync.xml</item>
+ </additional_files_needed>
+ <tabs>
+ <tab>
+ <text>General</text>
+ <url>/pkg.php?xml=ipguard.xml</url>
+ <active/>
+ </tab>
+ <tab>
+ <text>Sync</text>
+ <url>/pkg_edit.php?xml=ipguard_sync.xml</url>
+ </tab>
+ </tabs>
+ <adddeleteeditpagefields>
+ <columnitem>
+ <fielddescr>Enable</fielddescr>
+ <fieldname>enable</fieldname>
+ <type>checkbox</type>
+ </columnitem>
+ <columnitem>
+ <fielddescr>Interface</fielddescr>
+ <fieldname>interface</fieldname>
+ </columnitem>
+ <columnitem>
+ <fielddescr>Mac Address</fielddescr>
+ <fieldname>mac</fieldname>
+ </columnitem>
+ <columnitem>
+ <fielddescr>Ip Address(es)</fielddescr>
+ <fieldname>ip</fieldname>
+ </columnitem>
+ <columnitem>
+ <fielddescr>Description</fielddescr>
+ <fieldname>description</fieldname>
+ </columnitem>
+ <movable>on</movable>
+ <description><![CDATA[If firewall receives traffic with MAC/IP pair not listed here, it will send ARP reply with configured fake address.<br>This will prevent not permitted host from working properly in the specified ethernet segment.]]></description>
+ </adddeleteeditpagefields>
+ <fields>
+ <field>
+ <type>listtopic</type>
+ <name>Ipguard Options</name>
+ <fieldname>temp</fieldname>
+ </field>
+ <field>
+ <fielddescr>sortable</fielddescr>
+ <fieldname>sortable</fieldname>
+ <display_maximum_rows>20</display_maximum_rows>
+ <type>sorting</type>
+ <include_filtering_inputbox/>
+ <sortablefields>
+ <item>
+ <name>Mac Address</name>
+ <fieldname>mac</fieldname>
+ <regex>/%FILTERTEXT%/i</regex>
+ </item>
+ <item>
+ <name>Ip Address</name>
+ <fieldname>ip</fieldname>
+ <regex>/%FILTERTEXT%/i</regex>
+ </item>
+ </sortablefields>
+ </field>
+ <field>
+ <fielddescr>Enable</fielddescr>
+ <fieldname>enable</fieldname>
+ <type>checkbox</type>
+ <description><![CDATA[Enable this mac rule.<br><strong>Important Note:</strong> Always create rules for pfsense mac and ip address to avoid denying access to pfsense gui.]]></description>
+ </field>
+ <field>
+ <fielddescr>Interface</fielddescr>
+ <fieldname>interface</fieldname>
+ <description>The interface on which ipguard server will check this mac</description>
+ <type>interfaces_selection</type>
+ <required/>
+ <default_value>lan</default_value>
+ </field>
+ <field>
+ <fielddescr>Description</fielddescr>
+ <fieldname>description</fieldname>
+ <description>Describe this mac rule.</description>
+ <type>input</type>
+ <size>50</size>
+ <required/>
+ </field>
+ <field>
+ <fielddescr>Mac address</fielddescr>
+ <fieldname>mac</fieldname>
+ <description><![CDATA[Insert mac address you want to filter.<br>
+ <strong>To include a permit rule, use mac=00:00:00:00:00:00</strong>]]></description>
+ <type>input</type>
+ <size>25</size>
+ <required/>
+ </field>
+ <field>
+ <fielddescr>Ip address</fielddescr>
+ <fieldname>ip</fieldname>
+ <description><![CDATA[Insert ip address, hostname or network cidr you want to apply on this ipguard rule.<br>
+ <strong>To include a permit rule, use your lan cidr or 0.0.0.0</strong>]]></description>
+ <type>input</type>
+ <size>40</size>
+ <required/>
+ </field>
+ </fields>
+
+ <custom_delete_php_command>
+ ipguard_custom_php_write_config();
+ </custom_delete_php_command>
+ <custom_add_php_command>
+ ipguard_custom_php_write_config();
+ </custom_add_php_command>
+ <custom_php_install_command>
+ </custom_php_install_command>
+ <custom_php_deinstall_command>
+ ipguard_custom_php_deinstall_command();
+ </custom_php_deinstall_command>
+ <custom_php_resync_config_command>
+ ipguard_custom_php_write_config();
+ </custom_php_resync_config_command>
+ <custom_php_command_before_form>
+ unset($_POST['temp']);
+ </custom_php_command_before_form>
+
+</packagegui> \ No newline at end of file
diff --git a/config/ipguard/ipguard_sync.xml b/config/ipguard/ipguard_sync.xml
new file mode 100755
index 00000000..0b5ffecb
--- /dev/null
+++ b/config/ipguard/ipguard_sync.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+ <copyright>
+ <![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+ ipguard_sync.xml
+ part of the ipguard package for pfSense (http://www.pfSense.com)
+ Copyright (C) 2012 Marcello Coutinho
+ All rights reserved.
+ */
+/* ========================================================================== */
+/*
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+ */
+/* ========================================================================== */
+ ]]>
+ </copyright>
+ <description>Describe your package here</description>
+ <requirements>Describe your package requirements here</requirements>
+ <faq>Currently there are no FAQ items provided.</faq>
+ <name>ipguardsync</name>
+ <version>1.0</version>
+ <title>Ipguard - Sync</title>
+ <include_file>/usr/local/pkg/ipguard.inc</include_file>
+ <tabs>
+ <tab>
+ <text>General</text>
+ <url>/pkg.php?xml=ipguard.xml</url>
+ </tab>
+ <tab>
+ <text>Sync</text>
+ <url>/pkg_edit.php?xml=ipguard_sync.xml</url>
+ <active/>
+ </tab>
+ </tabs>
+ <fields>
+ <field>
+ <name>XMLRPC Sync</name>
+ <type>listtopic</type>
+ </field>
+ <field>
+ <fielddescr>Automatically sync configuration changes</fielddescr>
+ <fieldname>synconchanges</fieldname>
+ <description>Automatically sync changes to the hosts defined below.</description>
+ <type>checkbox</type>
+ </field>
+ <field>
+ <fielddescr>Remote Server</fielddescr>
+ <fieldname>none</fieldname>
+ <type>rowhelper</type>
+ <rowhelper>
+ <rowhelperfield>
+ <fielddescr>IP Address</fielddescr>
+ <fieldname>ipaddress</fieldname>
+ <description>IP Address of remote server</description>
+ <type>input</type>
+ <size>20</size>
+ </rowhelperfield>
+ <rowhelperfield>
+ <fielddescr>Password</fielddescr>
+ <fieldname>password</fieldname>
+ <description>Password for remote server.</description>
+ <type>password</type>
+ <size>20</size>
+ </rowhelperfield>
+ </rowhelper>
+ </field>
+ </fields>
+ <custom_php_validation_command>
+ </custom_php_validation_command>
+ <custom_php_resync_config_command>
+ ipguard_custom_php_write_config();
+ </custom_php_resync_config_command>
+</packagegui>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 18:23:59 +0000