diff options
Diffstat (limited to 'config/pf-blocker/countryblocker.inc')
| -rwxr-xr-x | config/pf-blocker/countryblocker.inc | 402 |
1 files changed, 0 insertions, 402 deletions
diff --git a/config/pf-blocker/countryblocker.inc b/config/pf-blocker/countryblocker.inc deleted file mode 100755 index 5844f3d1..00000000 --- a/config/pf-blocker/countryblocker.inc +++ /dev/null @@ -1,402 +0,0 @@ -<?php -/* - countryblock.inc - part of the Postfix package for pfSense - Copyright (C) 2010 Erik Fonnesbeck - Copyright (C) 2011 Marcello Coutinho - - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - -*/ -require_once("util.inc"); -require_once("functions.inc"); -require_once("pkg-utils.inc"); -require_once("globals.inc"); -require_once("filter.inc"); - -function cb_text_area_decode($text){ - return preg_replace('/\r\n/', "\n",base64_decode($text)); -} - -function cb_get_real_interface_address($iface) { - global $config; - $iface = convert_friendly_interface_to_real_interface_name($iface); - $line = trim(shell_exec("ifconfig $iface | grep inet | grep -v inet6")); - list($dummy, $ip, $dummy2, $netmask) = explode(" ", $line); - return array($ip, long2ip(hexdec($netmask))); -} - -function sync_package_countryblock() { - global $config; - $countryblock_config=$config['installedpackages']['countryblock']['config'][0]; - $continents= array("Africa","Antartica","Asia","Europe","North America","Oceania","South America"); - - #get local web gui configuration - $web_local=($config['system']['webgui']['protocol'] != ""?$config['system']['webgui']['protocol']:"http"); - $port = $config['system']['webgui']['port']; - if($port == "") { - if($config['system']['webgui']['protocol'] == "http") - $port = "80"; - else - $port = "443"; - } - $web_local .= "://127.0.0.1:".$port.'/countryblock.php'; - - #get all selected countries - $countries=$config['installedpackages']['countryblock']['config'][0]['topspammers'].","; - foreach ($continents as $continent){ - if (is_array($config['installedpackages']['countryblock'.strtolower(preg_replace('/ /','',$continent))]['config'])) - $countries.=$config['installedpackages']['countryblock'.strtolower(preg_replace('/ /','',$continent))]['config'][0]['countries'].","; - } - $cb_files = explode(",", $countries); - $ips=""; - foreach ($cb_files as $iso){ - if ($iso <> ""){ - if (file_exists('/usr/local/pkg/countryblock/'.$iso.'.txt')) - $ips.=file_get_contents('/usr/local/pkg/countryblock/'.$iso.'.txt'); - } - } - #create all ip block lists based on gui - file_put_contents('/usr/local/pkg/cb.txt',$ips, LOCK_EX); - - #write white_list to filesystem - file_put_contents('/usr/local/pkg/cbw.txt',cb_text_area_decode($countryblock_config['whitelist']), LOCK_EX); - - #edit or assign alias "Countryblock" and "CountryblockWL" - $aliases=$config['aliases']['alias']; - #print "<pre>"; - $new_aliases=array(); - if ($ips != ""){ - #create or reaply alias - $new_aliases[]=array("name"=> 'Countryblock', - "url"=> $web_local.'?cb=1', - "updatefreq"=> "7", - "address"=>"", - "descr"=> "Countryblock deny list", - "type"=> "urltable", - "detail"=> "DO NOT EDIT THIS ALIAS"); - #force alias file update - if (! is_dir('/var/db/aliastables/')) - mkdir ('/var/db/aliastables/',0755); - if (file_exists('/var/db/aliastables/Countryblock.txt')) - file_put_contents('/var/db/aliastables/Countryblock.txt',$ips, LOCK_EX); - } - else{ - #remove previous aliastable if exist - if (file_exists('/var/db/aliastables/Countryblock.txt')) - unlink('/var/db/aliastables/Countryblock.txt'); - } - - if (cb_text_area_decode($countryblock_config['whitelist']) != ""){ - #create or reaply alias - $new_aliases[]=array("name"=> 'CountryblockWL', - "url"=> $web_local.'?cbw=1', - "updatefreq"=> "7", - "address"=>"", - "descr"=> "Countryblock white list", - "type"=> "urltable", - "detail"=> "DO NOT EDIT THIS ALIAS"); - #force alias file update - if (! is_dir('/var/db/aliastables/')) - mkdir ('/var/db/aliastables/',0755); - if (file_exists('/var/db/aliastables/CountryblockWL.txt')) - file_put_contents('/var/db/aliastables/CountryblockWL.txt',cb_text_area_decode($countryblock_config['whitelist']), LOCK_EX); - } - else{ - #remove previous aliastable if exist - if (file_exists('/var/db/aliastables/CountryblockWL.txt')) - unlink('/var/db/aliastables/CountryblockWL.txt'); - } - - if (is_array($aliases)) - foreach($aliases as $cbalias){ - if (! preg_match("/Countryblock.*list/",$cbalias['descr'])) - $new_aliases[]= $cbalias; - } - $config['aliases']['alias']=$new_aliases; - # check contryblock filter options - $rules=$config['filter']['rule']; - $ifaces = $countryblock_config['inbound_interface']; - foreach (explode(",", $ifaces) as $i => $iface) { - if (cb_text_area_decode($countryblock_config['whitelist']) != ""){ - ${$iface}[0]=array("id" => "", - "type"=>"pass", - "tag"=> "", - "interface" => $iface, - "tagged"=> "", - "max"=> "", - "max-src-nodes"=>"", - "max-src-conn"=> "", - "max-src-states"=>"", - "statetimeout"=>"", - "statetype"=>"keep state", - "os"=> "", - "source"=>array("address"=>"CountryblockWL"), - "destination"=>array("any"=>""), - "descr"=>"Countryblock inbound whitelist rule"); - - if ($countryblock_config['enable_log']) - ${$iface}[0]["log"]=""; - } - if ($ips != ""){ - ${$iface}[1]=array( "id" => "", - "type"=>"block", - "tag"=> "", - "interface" => $iface, - "tagged"=> "", - "max"=> "", - "max-src-nodes"=>"", - "max-src-conn"=> "", - "max-src-states"=>"", - "statetimeout"=>"", - "statetype"=>"keep state", - "os"=> "", - "source"=>array("address"=>"Countryblock"), - "destination"=>array("any"=>""), - "descr"=>"Countryblock inbound deny rule"); - - if ($countryblock_config['enable_log']) - ${$iface}[1]["log"]=""; - } - } - $ifaces = $countryblock_config['outbound_interface']; - foreach (explode(",", $ifaces) as $i => $iface) { - if (cb_text_area_decode($countryblock_config['whitelist']) != ""){ - ${$iface}[2]=array( "id" => "", - "type"=>"pass", - "tag"=> "", - "interface" => $iface, - "tagged"=> "", - "max"=> "", - "max-src-nodes"=>"", - "max-src-conn"=> "", - "max-src-states"=>"", - "statetimeout"=>"", - "statetype"=>"keep state", - "os"=> "", - "source"=>array("any"=>""), - "destination"=>array("address"=>"CountryblockWL"), - "descr"=>"Countryblock outbound whitelist rule"); - if ($countryblock_config['enable_log']) - ${$iface}[2]["log"]=""; - } - if ($ips != ""){ - ${$iface}[3]= array("id" => "", - "type"=>"block", - "tag"=> "", - "interface" => $iface, - "tagged"=> "", - "max"=> "", - "max-src-nodes"=>"", - "max-src-conn"=> "", - "max-src-states"=>"", - "statetimeout"=>"", - "statetype"=>"keep state", - "os"=> "", - "source"=>array("any"=>""), - "destination"=>array("address"=>"Countryblock"), - "descr"=>"Countryblock inbound deny rule"); - if ($countryblock_config['enable_log']) - ${$iface}[3]["log"]=""; - - } - - } - $last_iface=""; - foreach ($rules as $rule){ - if ($rule['interface'] <> $last_iface){ - $last_iface = $rule['interface']; - #apply countryblock rules if enabled - if ($config['installedpackages']['countryblock']['config'][0]['enable_cb'] == "on" && is_array(${$rule['interface']})) - foreach (${$rule['interface']} as $cb_rules) - $new_rules[]=$cb_rules; - } - if (!preg_match("/Countryblock.*rule/",$rule['descr'])) - $new_rules[]=$rule; - } - $config['filter']['rule']=$new_rules; - - #save and apply all changes - write_config(); - filter_configure(); - - countryblock_sync_on_changes(); -} - -function countryblock_validate_input($post, &$input_errors) { - foreach ($post as $key => $value) { - if (empty($value)) - continue; - if($key == "greet_time" && !preg_match("/(\d+),(\d+)(s|m|h|w)/",$value)) - $input_errors[] = "Wrong greet time sintax."; - if($key == "message_size_limit" && !is_numeric($value)) - $input_errors[] = "Message size limit must be numeric."; - if($key == "process_limit" && !is_numeric($value)) - $input_errors[] = "Process limit must be numeric."; - if($key == "freq" && (!preg_match("/^\d+(h|m|d)$/",$value) || $value == 0)) - $input_errors[] = "A valid number with a time reference is required for the field 'Frequency'"; - if (substr($key, 0, 2) == "dc" && !is_hostname($value)) - $input_errors[] = "{$value} is not a valid host name."; - if (substr($key, 0, 6) == "domain" && is_numeric(substr($key, 6))) { - if (!is_domain($value)) - $input_errors[] = "{$value} is not a valid domain name."; - } else if (substr($key, 0, 12) == "mailserverip" && is_numeric(substr($key, 12))) { - if (empty($post['domain' . substr($key, 12)])) - $input_errors[] = "Domain for {$value} cannot be blank."; - if (!is_ipaddr($value) && !is_hostname($value)) - $input_errors[] = "{$value} is not a valid IP address or host name."; - } - } -} - -function countryblock_php_install_command() { - include_once '/usr/local/www/countryblock.php'; - countryblock_get_countries(); - sync_package_countryblock(); -} - -function countryblock_php_deinstall_command() { - global $config; - $config['installedpackages']['countryblock']['config'][0]['enable_cb']=""; - write_config(); - sync_package_countryblock(); -} - -/* Uses XMLRPC to synchronize the changes to a remote node */ -function countryblock_sync_on_changes() { - global $config, $g; - log_error("[countryblock] countryblock_xmlrpc_sync.php is starting."); - $synconchanges = $config['installedpackages']['countryblocksync']['config'][0]['synconchanges']; - if(!$synconchanges) - return; - foreach ($config['installedpackages']['countryblocksync']['config'] as $rs ){ - foreach($rs['row'] as $sh){ - $sync_to_ip = $sh['ipaddress']; - $password = $sh['password']; - if($password && $sync_to_ip) - countryblock_do_xmlrpc_sync($sync_to_ip, $password); - } - } - log_error("[countryblock] countryblock_xmlrpc_sync.php is ending."); -} - -/* Do the actual XMLRPC sync */ -function countryblock_do_xmlrpc_sync($sync_to_ip, $password) { - global $config, $g; - - if(!$password) - return; - - if(!$sync_to_ip) - return; - - $xmlrpc_sync_neighbor = $sync_to_ip; - if($config['system']['webgui']['protocol'] != "") { - $synchronizetoip = $config['system']['webgui']['protocol']; - $synchronizetoip .= "://"; - } - $port = $config['system']['webgui']['port']; - /* if port is empty lets rely on the protocol selection */ - if($port == "") { - if($config['system']['webgui']['protocol'] == "http") - $port = "80"; - else - $port = "443"; - } - $synchronizetoip .= $sync_to_ip; - - /* xml will hold the sections to sync */ - $xml = array(); - $xml['countryblock'] = $config['installedpackages']['countryblock']; - $xml['countryblockafrica'] = $config['installedpackages']['countryblockafrica']; - $xml['countryblockantartica'] = $config['installedpackages']['countryblockantartica']; - $xml['countryblockasia'] = $config['installedpackages']['countryblockasia']; - $xml['countryblockeurope'] = $config['installedpackages']['countryblockeurope']; - $xml['countryblocknorthamerica'] = $config['installedpackages']['countryblocknorthamerica']; - $xml['countryblockoceania'] = $config['installedpackages']['countryblockoceania']; - $xml['countryblocksouthamerica'] = $config['installedpackages']['countryblocksouthamerica']; - /* assemble xmlrpc payload */ - $params = array( - XML_RPC_encode($password), - XML_RPC_encode($xml) - ); - - /* set a few variables needed for sync code borrowed from filter.inc */ - $url = $synchronizetoip; - log_error("Beginning countryblock XMLRPC sync to {$url}:{$port}."); - $method = 'pfsense.merge_installedpackages_section_xmlrpc'; - $msg = new XML_RPC_Message($method, $params); - $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); - $cli->setCredentials('admin', $password); - if($g['debug']) - $cli->setDebug(1); - /* send our XMLRPC message and timeout after 250 seconds */ - $resp = $cli->send($msg, "250"); - if(!$resp) { - $error = "A communications error occurred while attempting countryblock XMLRPC sync with {$url}:{$port}."; - log_error($error); - file_notice("sync_settings", $error, "countryblock Settings Sync", ""); - } elseif($resp->faultCode()) { - $cli->setDebug(1); - $resp = $cli->send($msg, "250"); - $error = "An error code was received while attempting countryblock XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); - log_error($error); - file_notice("sync_settings", $error, "countryblock Settings Sync", ""); - } else { - log_error("countryblock XMLRPC sync successfully completed with {$url}:{$port}."); - } - - /* tell countryblock to reload our settings on the destionation sync host. */ - $method = 'pfsense.exec_php'; - $execcmd = "require_once('/usr/local/pkg/countryblock.inc');\n"; - $execcmd .= "sync_package_countryblock();"; - - /* assemble xmlrpc payload */ - $params = array( - XML_RPC_encode($password), - XML_RPC_encode($execcmd) - ); - - log_error("countryblock XMLRPC reload data {$url}:{$port}."); - $msg = new XML_RPC_Message($method, $params); - $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); - $cli->setCredentials('admin', $password); - $resp = $cli->send($msg, "250"); - if(!$resp) { - $error = "A communications error occurred while attempting countryblock XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; - log_error($error); - file_notice("sync_settings", $error, "countryblock Settings Sync", ""); - } elseif($resp->faultCode()) { - $cli->setDebug(1); - $resp = $cli->send($msg, "250"); - $error = "An error code was received while attempting countryblock XMLRPC exec with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); - log_error($error); - file_notice("sync_settings", $error, "countryblock Settings Sync", ""); - } else { - log_error("countryblock XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); - } - -} - -?> |