|
|
= '2.2') {
$pfblines = exec("/usr/local/sbin/clog {$filter_logfile} | /usr/bin/grep -c ^");
} else {
$pfblines = (exec("/usr/local/sbin/clog {$filter_logfile} | /usr/bin/grep -c ^") /2 );
}
$fields_array = conv_log_filter_lite($filter_logfile, $pfblines, $pfblines, $pfbdenycnt, $pfbpermitcnt, $pfbmatchcnt);
$continents = array('pfB_Africa','pfB_Antartica','pfB_Asia','pfB_Europe','pfB_NAmerica','pfB_Oceania','pfB_SAmerica','pfB_Top');
$supp_ip_txt .= "Clicking this Suppression Icon, will immediately remove the Block.\n\nSuppressing a /32 CIDR is better than Suppressing the full /24";
$supp_ip_txt .= " CIDR.\nThe Host will be added to the pfBlockerNG Suppress Alias Table.\n\nOnly 32 or 24 CIDR IPs can be Suppressed with the '+' Icon.";
$supp_ip_txt .= "\nTo manually add Host(s), edit the 'pfBlockerNGSuppress' Alias in the Alias Tab.\nManual entries will not remove existing Blocked Hosts";
// Array of all Local IPs for Alert Analysis
$pfb_local = array();
// Collect Gateway IP Addresses for Inbound/Outbound List matching
$int_gateway = get_interfaces_with_gateway();
if (is_array($int_gateway)) {
foreach ($int_gateway as $gateway) {
$convert = get_interface_ip($gateway);
$pfb_local[] = $convert;
}
}
// Collect Virtual IP Aliases for Inbound/Outbound List Matching
if (is_array($config['virtualip']['vip'])) {
foreach ($config['virtualip']['vip'] as $list) {
$pfb_local[] = $list['subnet'];
}
}
// Collect NAT IP Addresses for Inbound/Outbound List Matching
if (is_array($config['nat']['rule'])) {
foreach ($config['nat']['rule'] as $natent) {
$pfb_local[] = $natent['target'];
}
}
// Collect 1:1 NAT IP Addresses for Inbound/Outbound List Matching
if(is_array($config['nat']['onetoone'])) {
foreach ($config['nat']['onetoone'] as $onetoone) {
$pfb_local[] = $onetoone['source']['address'];
}
}
// Convert any 'Firewall Aliases' to IP Address Format
if (is_array($config['aliases']['alias'])) {
for ($cnt = 0; $cnt <= count($pfb_local); $cnt++) {
foreach ($config['aliases']['alias'] as $i=> $alias) {
if (isset($alias['name']) && isset($pfb_local[$cnt])) {
if ($alias['name'] == $pfb_local[$cnt]) {
$pfb_local[$cnt] = $alias['address'];
}
}
}
}
}
// Remove any Duplicate IPs
$pfb_local = array_unique($pfb_local);
// Determine Lan IP Address and Mask
if (is_array($config['interfaces']['lan'])) {
$lan_ip = $config['interfaces']['lan']['ipaddr'];
$lan_mask = $config['interfaces']['lan']['subnet'];
}
}
$counter = 0;
// Process Fields_array and generate Output
if (!empty($fields_array[$type]) && !empty($rule_list)) {
$key = 0;
foreach ($fields_array[$type] as $fields) {
$rulenum = "";
$alert_ip = "";
$supp_ip = "";
$pfb_query = "";
/* Fields_array Reference [0] = Rulenum [6] = Protocol
[1] = Real Interface [7] = SRC IP
[2] = Friendly Interface Name [8] = DST IP
[3] = Action [9] = SRC Port
[4] = Version [10] = DST Port
[5] = Protocol ID [11] = Flags
[99] = Timestamp */
$rulenum = $fields[0];
if ($counter < $pfbentries) {
$proto = str_replace("TCP", "TCP-", $fields[6]) . $fields[11];
// Cleanup Port Output
if ($fields[6] == "ICMP" || $fields[6] == "ICMPV6") {
$srcport = "";
$dstport = "";
} else {
$srcport = ":" . $fields[9];
$dstport = ":" . $fields[10];
}
// Don't add Suppress Icon to Country Block Lines
if (in_array(substr($rule_list[$rulenum]['name'], 0, -3), $continents)) {
$pfb_query = "Country";
}
// Add DNS Resolve and Suppression Icons to External IPs only. GeoIP Code to External IPs only.
if (in_array($fields[8], $pfb_local) || check_lan_dest($lan_ip,$lan_mask,$fields[8],"32")) {
// Destination is Gateway/NAT/VIP
$rule = $rule_list[$rulenum]['name'] . "
(" . $rulenum .")";
$host = $fields[7];
$alert_ip .= " ![](\"/themes/{$g['theme']}/images/icons/icon_log.gif\") ";
if ($pfb_query != "Country" && $rtype == "block" && $pfb['supp'] == "on") {
$supp_ip .= "";
}
if ($pfb_query != "Country" && $rtype == "block" && $hostlookup == "on") {
$hostname = getpfbhostname('src', $fields[7], $counter);
} else {
$hostname = "";
}
$src_icons = $alert_ip . " " . $supp_ip . " ";
$dst_icons = "";
} else {
// Outbound
$rule = $rule_list[$rulenum]['name'] . "
(" . $rulenum .")";
$host = $fields[8];
$alert_ip .= " ";
if ($pfb_query != "Country" && $rtype == "block" && $pfb['supp'] == "on") {
$supp_ip .= "";
}
if ($pfb_query != "Country" && $rtype == "block" && $hostlookup == "on") {
$hostname = getpfbhostname('dst', $fields[8], $counter);
} else {
$hostname = "";
}
$src_icons = "";
$dst_icons = $alert_ip . " " . $supp_ip . " ";
}
// Determine Country Code of Host
if (is_ipaddrv4($host)) {
$country = substr(exec("$pathgeoip -f $pathgeoipdat $host"),23,2);
} else {
$country = substr(exec("$pathgeoip6 -f $pathgeoipdat6 $host"),26,2);
}
# IP Query Grep Exclusion
$pfb_ex1 = "grep -v 'pfB\_\|\_v6\.txt'";
$pfb_ex2 = "grep -v 'pfB\_\|/32\|/24\|\_v6\.txt' | grep -m1 '/'";
// Find List which contains Blocked IP Host
if (is_ipaddrv4($host) && $pfb_query != "Country") {
// Search for exact IP Match
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1\.$2\.$3\.$4\'', $host);
$pfb_query = exec("/usr/bin/grep -rHm1 {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/:.*//' -e 's/\..*/ /' | {$pfb_ex1}");
// Search for IP in /24 CIDR
if (empty($pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1\.$2\.$3\.0/24\'', $host);
$pfb_query = exec("/usr/bin/grep -rHm1 {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex1}");
}
// Search for First Two IP Octets in CIDR Matches Only. Skip any pfB (Country Lists) or /32,/24 Addresses.
if (empty($pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.$2\.\'', $host);
$pfb_query = exec("/usr/bin/grep -rH {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}");
}
// Search for First Two IP Octets in CIDR Matches Only (Subtract 1 from second Octet on each loop).
// Skip (Country Lists) or /32,/24 Addresses.
if (empty($pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.', $host);
$host2 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '$2', $host);
for ($cnt = 1; $cnt <= 5; $cnt++) {
$host3 = $host2 - $cnt . '\'';
$pfb_query = exec("/usr/bin/grep -rH {$host1}{$host3} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}");
// Break out of loop if found.
if (!empty($pfb_query))
$cnt = 6;
}
}
// Search for First Three Octets
if (empty($pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.$2\.$3\.\'', $host);
$pfb_query = exec("/usr/bin/grep -rH {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}");
}
// Search for First Two Octets
if (empty($pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.$2\.\'', $host);
$pfb_query = exec("/usr/bin/grep -rH {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}");
}
// Report Specific ET IQRisk Details
if ($pfb['et_header'] && preg_match("/{$et_header}/", $pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1\.$2\.$3\.$4\'', $host);
$pfb_query = exec("/usr/bin/grep -Hm1 {$host1} {$pfb['etdir']}/* | sed -e 's/^.*[a-zA-Z]\///' -e 's/:.*//' -e 's/\..*/ /' -e 's/ET_/ET IPrep /' ");
if (empty($pfb_query)) {
$host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1.$2.$3.0/24\'', $host);
$pfb_query = exec("/usr/bin/grep -rHm1 {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex1}");
}
}
}
elseif (is_ipaddrv6($host) && $pfb_query != "Country") {
$pfb_query = exec("/usr/bin/grep -Hm1 '{$host}' {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | grep -v 'pfB\_'");
}
// Default to "No Match" if not found.
if (empty($pfb_query))
$pfb_query = "No Match";
# Split List Column into Two lines.
unset ($pfb_match);
if ($pfb_query == "No Match") {
$pfb_match[1] = "{$pfb_query}";
$pfb_match[2] = "";
} else {
preg_match ("/(.*)\s(.*)/", $pfb_query, $pfb_match);
if ($pfb_match[1] == "") {
$pfb_match[1] = "{$pfb_query}";
$pfb_match[2] = "";
}
}
// Add []'s to IPv6 Addresses and add a zero-width space as soft-break opportunity after each colon if we have an IPv6 address (from Snort)
if ($fields[4] == "6") {
$fields[97] = "[" . str_replace(":", ":", $fields[7]) . "]";
$fields[98] = "[" . str_replace(":", ":", $fields[8]) . "]";
}
else {
$fields[97] = $fields[7];
$fields[98] = $fields[8];
}
// Truncate Long List Names
$pfb_matchtitle = "Country Block Rules cannot be suppressed.\n\nTo allow a particular Country IP, either remove the particular Country or add the Host\nto a Permit Alias in the Firewall Tab.\n\nIf the IP is not listed beside the List, this means that the Block is a /32 entry.\nOnly /32 or /24 CIDR Hosts can be suppressed.\n\nIf (Duplication) Checking is not enabled. You may see /24 and /32 CIDR Blocks for a given blocked Host";
if (strlen($pfb_match[1]) >= 17) {
$pfb_matchtitle = $pfb_match[1];
$pfb_match[1] = substr($pfb_match[1], 0, 16) . '...';
}
// Print Alternating Line Shading
if ($pfb['pfsenseversion'] > '2.0') {
$alertRowEvenClass = "listMReven";
$alertRowOddClass = "listMRodd";
} else {
$alertRowEvenClass = "listr";
$alertRowOddClass = "listr";
}
$alertRowClass = $counter % 2 ? $alertRowEvenClass : $alertRowOddClass;
echo "
| {$fields[99]} |
{$fields[2]} |
{$rule} |
{$proto} |
{$src_icons}{$fields[97]}{$srcport}
{$hostname['src']} |
{$dst_icons}{$fields[98]}{$dstport}
{$hostname['dst']} |
{$country} |
{$pfb_match[1]}
{$pfb_match[2]} | ";
$counter++;
if ($counter > 0 && $rtype == "block") {
$mycounter = $counter;
}
}
}
}
?>
|