"> "> $pfb['denydir'] . " " . $pfb['nativedir'], "Permit" => $pfb['permitdir'], "Match" => $pfb['matchdir']) as $type => $pfbfolder ): switch($type) { case "Deny": $rtype = "block"; $pfbentries = "{$pfbdenycnt}"; break; case "Permit": $rtype = "pass"; $pfbentries = "{$pfbpermitcnt}"; break; case "Match": $rtype = "unkn(%u)"; $pfbentries = "{$pfbmatchcnt}"; break; } // Skip Table output if $pfbentries is zero. if ($pfbentries == 0 && $skipcount != 2) { $skipcount++; continue; } ?>

	', ''); ?> ', ''); ?> ', ''); ?>   />    />           ', '');?>
	" onclick="enable_showFilter();" />
', '');?>   " title="" />    " title="" />    " onclick="enable_hideFilter();" title="" />

= 24) { $pfb_local = array_merge(subnetv4_expand("{$list['subnet']}/{$list['subnet_bits']}"), $pfb_local); } else { $pfb_localsub[] = "{$list['subnet']}/{$list['subnet_bits']}"; } } } } // Collect NAT IP Addresses for Inbound/Outbound List Matching if (is_array($config['nat']['rule'])) { foreach ($config['nat']['rule'] as $natent) { $pfb_local[] = $natent['target']; } } // Collect 1:1 NAT IP Addresses for Inbound/Outbound List Matching if (is_array($config['nat']['onetoone'])) { foreach ($config['nat']['onetoone'] as $onetoone) { $pfb_local[] = $onetoone['source']['address']; } } // Convert any 'Firewall Aliases' to IP Address Format if (is_array($config['aliases']['alias'])) { for ($cnt = 0; $cnt <= count($pfb_local); $cnt++) { foreach ($config['aliases']['alias'] as $i=> $alias) { if (isset($alias['name']) && isset($pfb_local[$cnt])) { if ($alias['name'] == $pfb_local[$cnt]) { $pfb_local[$cnt] = $alias['address']; } } } } } // Collect all Interface Addresses for Inbound/Outbound List Matching if (is_array($config['interfaces'])) { foreach ($config['interfaces'] as $int) { if ($int['ipaddr'] != "dhcp") { if ($int['ipaddr'] != "" && $int['subnet'] != "") { if ($int['subnet'] >= 24) { $pfb_local = array_merge(subnetv4_expand("{$int['ipaddr']}/{$int['subnet']}"), $pfb_local); } else { $pfb_localsub[] = "{$int['ipaddr']}/{$int['subnet']}"; } } } } } // Remove any Duplicate IPs $pfb_local = array_unique($pfb_local); $pfb_localsub = array_unique($pfb_localsub); } // Process Fields_array and generate Output if (!empty($fields_array[$type]) && !empty($rule_list)) { $key = 0; foreach ($fields_array[$type] as $fields) { $rulenum = ""; $alert_ip = ""; $supp_ip = ""; $pfb_query = ""; /* Fields_array Reference [0] = Rulenum [6] = Protocol [1] = Real Interface [7] = SRC IP [2] = Friendly Interface Name [8] = DST IP [3] = Action [9] = SRC Port [4] = Version [10] = DST Port [5] = Protocol ID [11] = Flags [99] = Timestamp */ $rulenum = $fields[0]; if ($counter < $pfbentries) { // Cleanup Port Output if ($fields[6] == "ICMP" || $fields[6] == "ICMPV6") { $srcport = ""; $dstport = ""; } else { $srcport = ":" . $fields[9]; $dstport = ":" . $fields[10]; } // Don't add Suppress Icon to Country Block Lines if (in_array(substr($rule_list[$rulenum]['name'], 0, -3), $continents)) { $pfb_query = "Country"; } // Add DNS Resolve and Suppression Icons to External IPs only. GeoIP Code to External IPs only. if (in_array($fields[8], $pfb_local) || ip_in_pfb_localsub($fields[8])) { // Destination is Gateway/NAT/VIP $rule = $rule_list[$rulenum]['name'] . " (" . $rulenum .")"; $host = $fields[7]; $alert_ip = " "; if ($pfb_query != "Country" && $rtype == "block" && $pfb['supp'] == "on") { $supp_ip = ""; } if ($pfb_query != "Country" && $rtype == "block" && $hostlookup == "on") { $hostname = getpfbhostname('src', $fields[7], $counter); } else { $hostname = ""; } $src_icons = $alert_ip . " " . $supp_ip . " "; $dst_icons = ""; } else { // Outbound $rule = $rule_list[$rulenum]['name'] . " (" . $rulenum .")"; $host = $fields[8]; $alert_ip = " "; if ($pfb_query != "Country" && $rtype == "block" && $pfb['supp'] == "on") { $supp_ip = ""; } if ($pfb_query != "Country" && $rtype == "block" && $hostlookup == "on") { $hostname = getpfbhostname('dst', $fields[8], $counter); } else { $hostname = ""; } $src_icons = ""; $dst_icons = $alert_ip . " " . $supp_ip . " "; } // Determine Country Code of Host if (is_ipaddrv4($host)) { $country = substr(exec("$pathgeoip -f $pathgeoipdat $host"),23,2); } else { $country = substr(exec("$pathgeoip6 -f $pathgeoipdat6 $host"),26,2); } // IP Query Grep Exclusion $pfb_ex1 = "grep -v 'pfB\_\|\_v6\.txt'"; $pfb_ex2 = "grep -v 'pfB\_\|/32\|/24\|\_v6\.txt' | grep -m1 '/'"; // Find List which contains Blocked IP Host if (is_ipaddrv4($host) && $pfb_query != "Country") { // Search for exact IP Match $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1\.$2\.$3\.$4\'', $host); $pfb_query = exec("/usr/bin/grep -rHm1 {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/:.*//' -e 's/\..*/ /' | {$pfb_ex1}"); // Search for IP in /24 CIDR if (empty($pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1\.$2\.$3\.0/24\'', $host); $pfb_query = exec("/usr/bin/grep -rHm1 {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex1}"); } // Search for First Two IP Octets in CIDR Matches Only. Skip any pfB (Country Lists) or /32,/24 Addresses. if (empty($pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.$2\.\'', $host); $pfb_query = exec("/usr/bin/grep -rH {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}"); } // Search for First Two IP Octets in CIDR Matches Only (Subtract 1 from second Octet on each loop). // Skip (Country Lists) or /32,/24 Addresses. if (empty($pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.', $host); $host2 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '$2', $host); for ($cnt = 1; $cnt <= 5; $cnt++) { $host3 = $host2 - $cnt . '\''; $pfb_query = exec("/usr/bin/grep -rH {$host1}{$host3} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}"); // Break out of loop if found. if (!empty($pfb_query)) { $cnt = 6; } } } // Search for First Three Octets if (empty($pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.$2\.$3\.\'', $host); $pfb_query = exec("/usr/bin/grep -rH {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}"); } // Search for First Two Octets if (empty($pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'^$1\.$2\.\'', $host); $pfb_query = exec("/usr/bin/grep -rH {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex2}"); } // Report Specific ET IQRisk Details if ($pfb['et_header'] && preg_match("/{$et_header}/", $pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1\.$2\.$3\.$4\'', $host); $pfb_query = exec("/usr/bin/grep -Hm1 {$host1} {$pfb['etdir']}/* | sed -e 's/^.*[a-zA-Z]\///' -e 's/:.*//' -e 's/\..*/ /' -e 's/ET_/ET IPrep /' "); if (empty($pfb_query)) { $host1 = preg_replace("/(\d{1,3})\.(\d{1,3}).(\d{1,3}).(\d{1,3})/", '\'$1.$2.$3.0/24\'', $host); $pfb_query = exec("/usr/bin/grep -rHm1 {$host1} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | {$pfb_ex1}"); } } } elseif (is_ipaddrv6($host) && $pfb_query != "Country") { $pfb_query = exec("/usr/bin/grep -Hm1 {$host} {$pfbfolder} | sed -e 's/^.*[a-zA-Z]\///' -e 's/\.txt:/ /' | grep -v 'pfB\_'"); } // Default to "No Match" if not found. if (empty($pfb_query)) { $pfb_query = "No Match"; } // Split List Column into Two lines. unset ($pfb_match); if ($pfb_query == "No Match") { $pfb_match[1] = "{$pfb_query}"; $pfb_match[2] = ""; } else { preg_match ("/(.*)\s(.*)/", $pfb_query, $pfb_match); if ($pfb_match[1] == "") { $pfb_match[1] = "{$pfb_query}"; $pfb_match[2] = ""; } } // Add []'s to IPv6 Addresses and add a zero-width space as soft-break opportunity after each colon if we have an IPv6 address (from Snort) if ($fields[4] == "6") { $fields[97] = "[" . str_replace(":", ":​", $fields[7]) . "]"; $fields[98] = "[" . str_replace(":", ":​", $fields[8]) . "]"; } else { $fields[97] = $fields[7]; $fields[98] = $fields[8]; } // Truncate Long List Names $pfb_matchtitle = "Country Block Rules cannot be suppressed.\n\nTo allow a particular Country IP, either remove the particular Country or add the Host\nto a Permit Alias in the Firewall Tab.\n\nIf the IP is not listed beside the List, this means that the Block is a /32 entry.\nOnly /32 or /24 CIDR Hosts can be suppressed.\n\nIf (Duplication) Checking is not enabled. You may see /24 and /32 CIDR Blocks for a given blocked Host"; if (strlen($pfb_match[1]) >= 17) { $pfb_matchtitle = $pfb_match[1]; $pfb_match[1] = substr($pfb_match[1], 0, 16) . '...'; } // Print Alternating Line Shading $alertRowEvenClass = "style='background-color: #D8D8D8;'"; $alertRowOddClass = "style='background-color: #E8E8E8;'"; $alertRowClass = $counter % 2 ? $alertRowEvenClass : $alertRowOddClass; echo ""; $counter++; if ($rtype == "block") { $resolvecounter = $counter; } } } } ?> Found {$counter} Alert Entries {$msg}"); $counter = 0; $msg = ''; ?> {$fields[99]} {$fields[2]} {$rule} {$fields[6]} {$src_icons}{$fields[97]}{$srcport} {$hostname['src']} {$dst_icons}{$fields[98]}{$dstport} {$hostname['dst']} {$country} {$pfb_match[1]} {$pfb_match[2]}