From ac8128399a17b743936f8333c2fc385bc8b2983f Mon Sep 17 00:00:00 2001 From: Marcello Coutinho Date: Tue, 22 May 2012 05:47:06 +0000 Subject: ipguard-dev - first package release after sucessfully testing on 2.0.1 ipguard has no pkg dependecie and is running fine with 8.3 freebsd package. I've tested on amd64 as well i386 platform. --- config/ipguard/ipguard.inc | 217 ++++++++++++++++++++++++++++++++++++++++ config/ipguard/ipguard.xml | 192 +++++++++++++++++++++++++++++++++++ config/ipguard/ipguard_sync.xml | 97 ++++++++++++++++++ 3 files changed, 506 insertions(+) create mode 100644 config/ipguard/ipguard.inc create mode 100644 config/ipguard/ipguard.xml create mode 100755 config/ipguard/ipguard_sync.xml (limited to 'config') diff --git a/config/ipguard/ipguard.inc b/config/ipguard/ipguard.inc new file mode 100644 index 00000000..052f6f31 --- /dev/null +++ b/config/ipguard/ipguard.inc @@ -0,0 +1,217 @@ +. + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + require_once("config.inc"); + require_once("util.inc"); + +function ipguard_custom_php_deinstall_command(){ + global $g, $config; + + conf_mount_rw(); + + stop_service('ipguard'); + chmod("/usr/local/etc/rc.d/ipguard.sh",0444); + + conf_mount_ro(); + } + +function ipguard_custom_php_write_config(){ + global $g, $config; + + # detect boot process + if (is_array($_POST)){ + if (!preg_match("/\w+/",$_POST['__csrf_magic'])) + return; + } + + + if (is_array($config['installedpackages']['ipguard']['config'])){ + // Mount Read-write + conf_mount_rw(); + + // Read config + $new_config=array(); + foreach ($config['installedpackages']['ipguard']['config'] as $ipguard){ + if ($ipguard['enable'] && $ipguard['interface'] && $ipguard['mac'] && $ipguard['ip']){ + $new_config[$ipguard['interface']].= "{$ipguard['mac']} {$ipguard['ip']} {$ipguard['description']}\n"; + } + } + } + + //Save /etc/ssh/ipguard_extra + $script="/usr/local/etc/rc.d/ipguard.sh"; + $start=""; + $stop="pkill -anx ipguard"; + conf_mount_rw(); + if (count ($new_config) > 0 && $ipguard['enable']){ + foreach ($new_config as $key => $value){ + $conf_file="/usr/local/etc/ipguard_{$key}.conf"; + file_put_contents($conf_file,$value,LOCK_EX); + $config_file=file_put_contents($conf_file,$new_config[$key],LOCK_EX); + $iface=convert_friendly_interface_to_real_interface_name($key); + $start.="/usr/local/sbin/ipguard -l /var/log/ipguard_{$key}.log -p /var/run/ipguard_{$key}.pid -f {$conf_file} -u 300 -z {$iface}\n\t"; + } + write_rcfile(array( + 'file' => 'ipguard.sh', + 'start' => $start, + 'stop' => $stop + )); + restart_service('ipguard'); + + } + else{ + #remove config files + stop_service('ipguard'); + chmod("/usr/local/etc/rc.d/ipguard.sh",0444); + } + // Mount Read-only + conf_mount_ro(); + + //sync config with other pfsense servers + ipguard_sync_on_changes(); + } + +/* Uses XMLRPC to synchronize the changes to a remote node */ +function ipguard_sync_on_changes() { + global $config, $g; + + if (is_array($config['installedpackages']['ipguardsync'])) + if (!$config['installedpackages']['ipguardsync']['config'][0]['synconchanges']) + return; + + log_error("[ipguard] xmlrpc sync is starting."); + foreach ($config['installedpackages']['ipguardsync']['config'] as $rs ){ + foreach($rs['row'] as $sh){ + $sync_to_ip = $sh['ipaddress']; + $password = $sh['password']; + if($password && $sync_to_ip) + ipguard_do_xmlrpc_sync($sync_to_ip, $password); + } + } + log_error("[ipguard] xmlrpc sync is ending."); +} + +/* Do the actual XMLRPC sync */ +function ipguard_do_xmlrpc_sync($sync_to_ip, $password) { + global $config, $g; + + if(!$password) + return; + + if(!$sync_to_ip) + return; + + $username='admin'; + $xmlrpc_sync_neighbor = $sync_to_ip; + if($config['system']['webgui']['protocol'] != "") { + $synchronizetoip = $config['system']['webgui']['protocol']; + $synchronizetoip .= "://"; + } + $port = $config['system']['webgui']['port']; + /* if port is empty lets rely on the protocol selection */ + if($port == "") { + if($config['system']['webgui']['protocol'] == "http") + $port = "80"; + else + $port = "443"; + } + $synchronizetoip .= $sync_to_ip; + + /* xml will hold the sections to sync */ + $xml = array(); + $xml['ipguard'] = $config['installedpackages']['ipguard']; + /* assemble xmlrpc payload */ + $params = array( + XML_RPC_encode($password), + XML_RPC_encode($xml) + ); + + /* set a few variables needed for sync code borrowed from filter.inc */ + $url = $synchronizetoip; + log_error("Beginning ipguard XMLRPC sync to {$url}:{$port}."); + $method = 'pfsense.merge_installedpackages_section_xmlrpc'; + $msg = new XML_RPC_Message($method, $params); + $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); + $cli->setCredentials($username, $password); + if($g['debug']) + $cli->setDebug(1); + /* send our XMLRPC message and timeout after 250 seconds */ + $resp = $cli->send($msg, "250"); + if(!$resp) { + $error = "A communications error occurred while attempting ipguard XMLRPC sync with {$url}:{$port}."; + log_error($error); + file_notice("sync_settings", $error, "ipguard Settings Sync", ""); + } elseif($resp->faultCode()) { + $cli->setDebug(1); + $resp = $cli->send($msg, "250"); + $error = "An error code was received while attempting ipguard XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); + log_error($error); + file_notice("sync_settings", $error, "ipguard Settings Sync", ""); + } else { + log_error("ipguard XMLRPC sync successfully completed with {$url}:{$port}."); + } + + /* tell ipguard to reload our settings on the destionation sync host. */ + $method = 'pfsense.exec_php'; + $execcmd = "require_once('/usr/local/pkg/ipguard.inc');\n"; + $execcmd .= "ipguard_custom_php_write_config();"; + /* assemble xmlrpc payload */ + $params = array( + XML_RPC_encode($password), + XML_RPC_encode($execcmd) + ); + + log_error("ipguard XMLRPC reload data {$url}:{$port}."); + $msg = new XML_RPC_Message($method, $params); + $cli = new XML_RPC_Client('/xmlrpc.php', $url, $port); + $cli->setCredentials($username, $password); + $resp = $cli->send($msg, "250"); + if(!$resp) { + $error = "A communications error occurred while attempting ipguard XMLRPC sync with {$url}:{$port} (pfsense.exec_php)."; + log_error($error); + file_notice("sync_settings", $error, "ipguard Settings Sync", ""); + } elseif($resp->faultCode()) { + $cli->setDebug(1); + $resp = $cli->send($msg, "250"); + $error = "An error code was received while attempting ipguard XMLRPC sync with {$url}:{$port} - Code " . $resp->faultCode() . ": " . $resp->faultString(); + log_error($error); + file_notice("sync_settings", $error, "ipguard Settings Sync", ""); + } else { + log_error("ipguard XMLRPC reload data success with {$url}:{$port} (pfsense.exec_php)."); + } +} + ?> \ No newline at end of file diff --git a/config/ipguard/ipguard.xml b/config/ipguard/ipguard.xml new file mode 100644 index 00000000..ca13fc25 --- /dev/null +++ b/config/ipguard/ipguard.xml @@ -0,0 +1,192 @@ + + + + . + All rights reserved. + */ +/* ========================================================================== */ +/* + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + */ +/* ========================================================================== */ + ]]> + + + ipguard + 1.0 + Ipguard + Ipguard macs/ip + Save + /usr/local/pkg/ipguard.inc + + Ipguard + Tool designed to protect LAN IP adress space by ARP spoofing +
Services
+ /pkg.php?xml=ipguard.xml +
+ + ipguard + ipguard.sh + ipguard + Tool designed to protect LAN IP adress space by ARP spoofing. + + installedpackages->package->ipguard + + /usr/local/pkg/ + 755 + http://www.pfsense.com/packages/config/ipguard/ipguard.inc + + + /usr/local/pkg/ + 755 + http://www.pfsense.com/packages/config/ipguard/ipguard_sync.xml + + + + General + /pkg.php?xml=ipguard.xml + + + + Sync + /pkg_edit.php?xml=ipguard_sync.xml + + + + + Enable + enable + checkbox + + + Interface + interface + + + Mac Address + mac + + + Ip Address(es) + ip + + + description + description + + + + + listtopic + Ipguard Options + temp + + + sortable + sortable + 20 + sorting + + + + Mac Address + mac + /%FILTERTEXT%/i + + + Ip Adress + ip + /%FILTERTEXT%/i + + + + + Enable + enable + checkbox + Important Note: Always create rules to pfsense mac and ip address to avoid denying access to pfsense gui.]]> + + + Interface + interface + The interface ipguard server will check this mac + interfaces_selection + + lan + + + Description + description + Describe this mac rule. + input + 50 + + + + Mac address + mac + + To include a permit rule, use mac=00:00:00:00:00:00]]> + input + 25 + + + + Ip address + ip + + To include a permit rule, use your lan cidr or 0.0.0.0]]> + input + 40 + + + + + + ipguard_custom_php_write_config(); + + + ipguard_custom_php_write_config(); + + + + + ipguard_custom_php_deinstall_command(); + + + ipguard_custom_php_write_config(); + + + unset($_POST['temp']); + + +
\ No newline at end of file diff --git a/config/ipguard/ipguard_sync.xml b/config/ipguard/ipguard_sync.xml new file mode 100755 index 00000000..645ba413 --- /dev/null +++ b/config/ipguard/ipguard_sync.xml @@ -0,0 +1,97 @@ + + + + + + + + Describe your package here + Describe your package requirements here + Currently there are no FAQ items provided. + ipguardsync + 1.0 + SSH Conditional - Sync + /usr/local/pkg/ipguard.inc + + + General + /pkg.php?xml=ipguard.xml + + + Sync + /pkg_edit.php?xml=ipguard_sync.xml + + + + + + XMLRPC Sync + listtopic + + + Automatically sync configuration changes + synconchanges + Automatically sync changes to the hosts defined below. + checkbox + + + Remote Server + none + rowhelper + + + IP Address + ipaddress + IP Address of remote server + input + 20 + + + Password + password + Password for remote server. + password + 20 + + + + + + + + ipguard_custom_php_write_config(); + + -- cgit v1.2.3