From ac8128399a17b743936f8333c2fc385bc8b2983f Mon Sep 17 00:00:00 2001
From: Marcello Coutinho <marcellocoutinho@gmail.com>
Date: Tue, 22 May 2012 05:47:06 +0000
Subject: ipguard-dev - first package release after sucessfully testing on
 2.0.1 ipguard has no pkg dependecie and is running fine with 8.3 freebsd
 package. I've tested on amd64 as well i386 platform.

---
 config/ipguard/ipguard.inc      | 217 ++++++++++++++++++++++++++++++++++++++++
 config/ipguard/ipguard.xml      | 192 +++++++++++++++++++++++++++++++++++
 config/ipguard/ipguard_sync.xml |  97 ++++++++++++++++++
 3 files changed, 506 insertions(+)
 create mode 100644 config/ipguard/ipguard.inc
 create mode 100644 config/ipguard/ipguard.xml
 create mode 100755 config/ipguard/ipguard_sync.xml

(limited to 'config')

diff --git a/config/ipguard/ipguard.inc b/config/ipguard/ipguard.inc
new file mode 100644
index 00000000..052f6f31
--- /dev/null
+++ b/config/ipguard/ipguard.inc
@@ -0,0 +1,217 @@
+<?php
+
+/* ========================================================================== */
+/*
+    ipguard.inc
+    part of the ipguard package for pfSense (http://www.pfSense.com)
+    Copyright (C) 2012 Marcello Coutinho
+    All rights reserved.
+
+    Based on m0n0wall (http://m0n0.ch/wall)
+    Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+    All rights reserved.
+                                                                              */
+/* ========================================================================== */
+/*
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+     1. Redistributions of source code must retain the above copyright notice,
+        this list of conditions and the following disclaimer.
+
+     2. Redistributions in binary form must reproduce the above copyright
+        notice, this list of conditions and the following disclaimer in the
+        documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+                                                                              */
+/* ========================================================================== */
+ require_once("config.inc");
+ require_once("util.inc");
+ 
+function ipguard_custom_php_deinstall_command(){
+	global $g, $config;
+
+	conf_mount_rw();
+	
+	stop_service('ipguard');
+	chmod("/usr/local/etc/rc.d/ipguard.sh",0444);
+
+	conf_mount_ro();
+	}
+
+function ipguard_custom_php_write_config(){
+	global $g, $config;
+	
+	# detect boot process
+	if (is_array($_POST)){
+		if (!preg_match("/\w+/",$_POST['__csrf_magic']))
+			return;
+		}
+
+		
+	if (is_array($config['installedpackages']['ipguard']['config'])){
+		// Mount Read-write
+		conf_mount_rw();
+		
+		// Read config
+		$new_config=array();
+		foreach ($config['installedpackages']['ipguard']['config'] as $ipguard){
+			if ($ipguard['enable'] && $ipguard['interface'] && $ipguard['mac'] && $ipguard['ip']){
+				$new_config[$ipguard['interface']].= "{$ipguard['mac']} {$ipguard['ip']} {$ipguard['description']}\n";
+			}
+		}
+	}
+
+	//Save /etc/ssh/ipguard_extra
+	$script="/usr/local/etc/rc.d/ipguard.sh";
+	$start="";
+	$stop="pkill -anx ipguard";
+	conf_mount_rw();
+	if (count ($new_config) > 0 && $ipguard['enable']){
+			foreach ($new_config as $key => $value){
+				$conf_file="/usr/local/etc/ipguard_{$key}.conf";
+				file_put_contents($conf_file,$value,LOCK_EX);
+				$config_file=file_put_contents($conf_file,$new_config[$key],LOCK_EX);
+				$iface=convert_friendly_interface_to_real_interface_name($key);
+				$start.="/usr/local/sbin/ipguard -l /var/log/ipguard_{$key}.log -p /var/run/ipguard_{$key}.pid -f {$conf_file} -u 300 -z {$iface}\n\t";
+			}
+			write_rcfile(array(
+					'file' => 'ipguard.sh',
+					'start' => $start,
+					'stop' => $stop
+					));
+			restart_service('ipguard');
+			
+		}
+	else{
+		#remove config files
+		stop_service('ipguard');
+		chmod("/usr/local/etc/rc.d/ipguard.sh",0444);
+	}
+	// Mount Read-only
+	conf_mount_ro();
+	
+	//sync config with other pfsense servers
+	ipguard_sync_on_changes();
+	}
+
+/* Uses XMLRPC to synchronize the changes to a remote node */
+function ipguard_sync_on_changes() {
+	global $config, $g;
+	
+	if (is_array($config['installedpackages']['ipguardsync']))
+		if (!$config['installedpackages']['ipguardsync']['config'][0]['synconchanges'])	
+			return;
+
+	log_error("[ipguard] xmlrpc sync is starting.");
+	foreach ($config['installedpackages']['ipguardsync']['config'] as $rs ){
+		foreach($rs['row'] as $sh){
+			$sync_to_ip = $sh['ipaddress'];
+			$password = $sh['password'];
+			if($password && $sync_to_ip)
+				ipguard_do_xmlrpc_sync($sync_to_ip, $password);
+			}
+	}
+	log_error("[ipguard] xmlrpc sync is ending.");
+}
+
+/* Do the actual XMLRPC sync */
+function ipguard_do_xmlrpc_sync($sync_to_ip, $password) {
+	global $config, $g;
+
+	if(!$password)
+		return;
+
+	if(!$sync_to_ip)
+		return;
+
+	$username='admin';
+	$xmlrpc_sync_neighbor = $sync_to_ip;
+    if($config['system']['webgui']['protocol'] != "") {
+		$synchronizetoip = $config['system']['webgui']['protocol'];
+		$synchronizetoip .= "://";
+    }
+    $port = $config['system']['webgui']['port'];
+    /* if port is empty lets rely on the protocol selection */
+    if($port == "") {
+		if($config['system']['webgui']['protocol'] == "http") 
+			$port = "80";
+		else 
+			$port = "443";
+    }
+	$synchronizetoip .= $sync_to_ip;
+
+	/* xml will hold the sections to sync */
+	$xml = array();
+	$xml['ipguard'] = $config['installedpackages']['ipguard'];
+	/* assemble xmlrpc payload */
+	$params = array(
+		XML_RPC_encode($password),
+		XML_RPC_encode($xml)
+	);
+
+	/* set a few variables needed for sync code borrowed from filter.inc */
+	$url = $synchronizetoip;
+	log_error("Beginning ipguard XMLRPC sync to {$url}:{$port}.");
+	$method = 'pfsense.merge_installedpackages_section_xmlrpc';
+	$msg = new XML_RPC_Message($method, $params);
+	$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+	$cli->setCredentials($username, $password);
+	if($g['debug'])
+		$cli->setDebug(1);
+	/* send our XMLRPC message and timeout after 250 seconds */
+	$resp = $cli->send($msg, "250");
+	if(!$resp) {
+		$error = "A communications error occurred while attempting ipguard XMLRPC sync with {$url}:{$port}.";
+		log_error($error);
+		file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+	} elseif($resp->faultCode()) {
+		$cli->setDebug(1);
+		$resp = $cli->send($msg, "250");
+		$error = "An error code was received while attempting ipguard XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		log_error($error);
+		file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+	} else {
+		log_error("ipguard XMLRPC sync successfully completed with {$url}:{$port}.");
+	}
+	
+	/* tell ipguard to reload our settings on the destionation sync host. */
+	$method = 'pfsense.exec_php';
+	$execcmd  = "require_once('/usr/local/pkg/ipguard.inc');\n";
+	$execcmd .= "ipguard_custom_php_write_config();";
+	/* assemble xmlrpc payload */
+	$params = array(
+		XML_RPC_encode($password),
+		XML_RPC_encode($execcmd)
+	);
+	
+	log_error("ipguard XMLRPC reload data {$url}:{$port}.");
+	$msg = new XML_RPC_Message($method, $params);
+	$cli = new XML_RPC_Client('/xmlrpc.php', $url, $port);
+	$cli->setCredentials($username, $password);
+	$resp = $cli->send($msg, "250");
+	if(!$resp) {
+		$error = "A communications error occurred while attempting ipguard XMLRPC sync with {$url}:{$port} (pfsense.exec_php).";
+		log_error($error);
+		file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+	} elseif($resp->faultCode()) {
+		$cli->setDebug(1);
+		$resp = $cli->send($msg, "250");
+		$error = "An error code was received while attempting ipguard XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString();
+		log_error($error);
+		file_notice("sync_settings", $error, "ipguard Settings Sync", "");
+	} else {
+		log_error("ipguard XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php).");
+	}
+}
+	?>
\ No newline at end of file
diff --git a/config/ipguard/ipguard.xml b/config/ipguard/ipguard.xml
new file mode 100644
index 00000000..ca13fc25
--- /dev/null
+++ b/config/ipguard/ipguard.xml
@@ -0,0 +1,192 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<packagegui>
+<copyright>
+        <![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+    ipguard.xml
+    part of the ipguard package for pfSense (http://www.pfSense.com)
+    Copyright (C) 2012 Marcello Coutinho
+    All rights reserved.
+
+    Based on m0n0wall (http://m0n0.ch/wall)
+    Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
+    All rights reserved.
+                                                                              */
+/* ========================================================================== */
+/*
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+     1. Redistributions of source code must retain the above copyright notice,
+        this list of conditions and the following disclaimer.
+
+     2. Redistributions in binary form must reproduce the above copyright
+        notice, this list of conditions and the following disclaimer in the
+        documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+                                                                              */
+/* ========================================================================== */
+        ]]>
+        </copyright>
+
+	<name>ipguard</name>
+	<version>1.0</version>
+	<title>Ipguard</title>
+	<description>Ipguard macs/ip</description>
+	<savetext>Save</savetext>
+	<include_file>/usr/local/pkg/ipguard.inc</include_file>
+	<menu>
+		<name>Ipguard</name>
+		<tooltiptext>Tool designed to protect LAN IP adress space by ARP spoofing</tooltiptext>
+		<section>Services</section>
+		<url>/pkg.php?xml=ipguard.xml</url>
+	</menu>
+	<service>
+		<name>ipguard</name>
+		<rcfile>ipguard.sh</rcfile>
+		<executable>ipguard</executable>
+		<description>Tool designed to protect LAN IP adress space by ARP spoofing.</description>
+	</service>
+	<configpath>installedpackages->package->ipguard</configpath>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/</prefix>
+		<chmod>755</chmod>
+		<item>http://www.pfsense.com/packages/config/ipguard/ipguard.inc</item>
+	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/</prefix>
+		<chmod>755</chmod>
+		<item>http://www.pfsense.com/packages/config/ipguard/ipguard_sync.xml</item>
+	</additional_files_needed>
+	<tabs>
+		<tab>
+			<text>General</text>
+			<url>/pkg.php?xml=ipguard.xml</url>
+			<active/>
+		</tab>
+		<tab>
+			<text>Sync</text>
+			<url>/pkg_edit.php?xml=ipguard_sync.xml</url>
+		</tab>
+	</tabs>
+	<adddeleteeditpagefields>
+		<columnitem>
+			<fielddescr>Enable</fielddescr>
+			<fieldname>enable</fieldname>
+			<type>checkbox</type>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Interface</fielddescr>
+			<fieldname>interface</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Mac Address</fielddescr>
+			<fieldname>mac</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Ip Address(es)</fielddescr>
+			<fieldname>ip</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>description</fielddescr>
+			<fieldname>description</fieldname>
+		</columnitem>
+	</adddeleteeditpagefields>
+	<fields>
+		<field>
+			<type>listtopic</type>
+			<name>Ipguard Options</name>
+			<fieldname>temp</fieldname>
+		</field>
+		<field>
+		<fielddescr>sortable</fielddescr>
+		<fieldname>sortable</fieldname>
+		<display_maximum_rows>20</display_maximum_rows>
+		<type>sorting</type>
+		<include_filtering_inputbox/>
+		<sortablefields>
+			<item>
+				<name>Mac Address</name>
+				<fieldname>mac</fieldname>
+				<regex>/%FILTERTEXT%/i</regex>
+			</item>
+			<item>
+				<name>Ip Adress</name>
+				<fieldname>ip</fieldname>
+				<regex>/%FILTERTEXT%/i</regex>
+			</item>
+		</sortablefields>
+		</field>
+		<field>
+		<fielddescr>Enable</fielddescr>
+			<fieldname>enable</fieldname>
+			<type>checkbox</type>
+		<description><![CDATA[Enable this mac rule.<br><strong>Important Note:</strong> Always create rules to pfsense mac and ip address to avoid denying access to pfsense gui.]]></description>
+		</field>
+		<field>
+			<fielddescr>Interface</fielddescr>
+			<fieldname>interface</fieldname>
+			<description>The interface ipguard server will check this mac</description>
+			<type>interfaces_selection</type>
+			<required/>
+			<default_value>lan</default_value>
+		</field>
+		<field>
+			<fielddescr>Description</fielddescr>
+			<fieldname>description</fieldname>
+			<description>Describe this mac rule.</description>
+			<type>input</type>
+			<size>50</size>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Mac address</fielddescr>
+			<fieldname>mac</fieldname>
+			<description><![CDATA[Insert mac address you what to filter.<br>
+				<strong>To include a permit rule, use mac=00:00:00:00:00:00</strong>]]></description>
+			<type>input</type>
+			<size>25</size>
+			<required/>
+		</field>
+		<field>
+			<fielddescr>Ip address</fielddescr>
+			<fieldname>ip</fieldname>
+			<description><![CDATA[Insert ip address, hostname or network cidr you want to apply on this ipguard rule.<br>
+				<strong>To include a permit rule, use your lan cidr or 0.0.0.0</strong>]]></description>
+			<type>input</type>
+			<size>40</size>
+			<required/>
+		</field>
+	</fields>
+
+	<custom_delete_php_command>
+		ipguard_custom_php_write_config();
+	</custom_delete_php_command>
+	<custom_add_php_command>
+		ipguard_custom_php_write_config();
+	</custom_add_php_command>
+	<custom_php_install_command>
+	</custom_php_install_command>
+	<custom_php_deinstall_command>
+		ipguard_custom_php_deinstall_command();
+	</custom_php_deinstall_command>
+	<custom_php_resync_config_command>
+		ipguard_custom_php_write_config();
+	</custom_php_resync_config_command>
+	<custom_php_command_before_form>
+		unset($_POST['temp']);
+	</custom_php_command_before_form>
+
+</packagegui>
\ No newline at end of file
diff --git a/config/ipguard/ipguard_sync.xml b/config/ipguard/ipguard_sync.xml
new file mode 100755
index 00000000..645ba413
--- /dev/null
+++ b/config/ipguard/ipguard_sync.xml
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>
+<packagegui>
+	<copyright>
+	<![CDATA[
+/* $Id$ */
+/* ========================================================================== */
+/*
+    ipguard_sync.xml
+    part of the ipguard package for pfSense (http://www.pfSense.com)
+    Copyright (C) 2012 Marcello Coutinho
+    All rights reserved.            
+                                                                  */
+/* ========================================================================== */
+/*
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+     1. Redistributions of source code must retain the above copyright notice,
+        this list of conditions and the following disclaimer.
+
+     2. Redistributions in binary form must reproduce the above copyright
+        notice, this list of conditions and the following disclaimer in the
+        documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+                                                                              */
+/* ========================================================================== */
+	]]>
+	</copyright>
+	<description>Describe your package here</description>
+	<requirements>Describe your package requirements here</requirements>
+	<faq>Currently there are no FAQ items provided.</faq>
+	<name>ipguardsync</name>
+	<version>1.0</version>
+	<title>SSH Conditional - Sync</title>
+	<include_file>/usr/local/pkg/ipguard.inc</include_file>
+	<tabs>
+		<tab>
+			<text>General</text>
+			<url>/pkg.php?xml=ipguard.xml</url>
+		</tab>
+		<tab>
+			<text>Sync</text>
+			<url>/pkg_edit.php?xml=ipguard_sync.xml</url>
+			<active/>
+		</tab>
+	</tabs>
+	<fields>
+		<field>
+			<name>XMLRPC Sync</name>
+			<type>listtopic</type>
+		</field>
+		<field>
+			<fielddescr>Automatically sync configuration changes</fielddescr>
+			<fieldname>synconchanges</fieldname>
+			<description>Automatically sync changes to the hosts defined below.</description>
+			<type>checkbox</type>
+		</field>
+		<field>
+			<fielddescr>Remote Server</fielddescr>
+			<fieldname>none</fieldname>
+			<type>rowhelper</type>
+			<rowhelper>
+			<rowhelperfield>
+				<fielddescr>IP Address</fielddescr>
+				<fieldname>ipaddress</fieldname>
+				<description>IP Address of remote server</description>
+				<type>input</type>
+				<size>20</size>
+			</rowhelperfield>
+			<rowhelperfield>
+				<fielddescr>Password</fielddescr>
+				<fieldname>password</fieldname>
+				<description>Password for remote server.</description>
+				<type>password</type>
+				<size>20</size>
+			</rowhelperfield>
+			</rowhelper>
+		</field>
+	</fields>
+	<custom_php_validation_command>
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		ipguard_custom_php_write_config();
+	</custom_php_resync_config_command>
+</packagegui>
-- 
cgit v1.2.3