. * Copyright (C) 2003-2004 Manuel Kasper . * Copyright (C) 2006 Scott Ullrich * Copyright (C) 2009 Robert Zelaya Sr. Developer * Copyright (C) 2012 Ermal Luci * Copyright (C) 2014 Jim Pingle jim@pingle.org * All rights reserved. * * Adapted for Suricata by: * Copyright (C) 2014 Bill Meeks * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ require_once("guiconfig.inc"); require_once("/usr/local/pkg/suricata/suricata.inc"); $suricatalogdir = SURICATALOGDIR; $suri_pf_table = SURICATA_PF_TABLE; if (!is_array($config['installedpackages']['suricata']['alertsblocks'])) $config['installedpackages']['suricata']['alertsblocks'] = array(); $pconfig['brefresh'] = $config['installedpackages']['suricata']['alertsblocks']['brefresh']; $pconfig['blertnumber'] = $config['installedpackages']['suricata']['alertsblocks']['blertnumber']; if (empty($pconfig['blertnumber'])) $bnentries = '500'; else $bnentries = $pconfig['blertnumber']; # --- AJAX REVERSE DNS RESOLVE Start --- if (isset($_POST['resolve'])) { $ip = strtolower($_POST['resolve']); $res = (is_ipaddr($ip) ? gethostbyaddr($ip) : ''); if ($res && $res != $ip) $response = array('resolve_ip' => $ip, 'resolve_text' => $res); else $response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve")); echo json_encode(str_replace("\\","\\\\", $response)); // single escape chars can break JSON decode exit; } # --- AJAX REVERSE DNS RESOLVE End --- if ($_POST['todelete']) { $ip = ""; if ($_POST['ip']) $ip = $_POST['ip']; if (is_ipaddr($ip)) exec("/sbin/pfctl -t {$suri_pf_table} -T delete {$ip}"); else $input_errors[] = gettext("An invalid IP address was provided as a parameter."); } if ($_POST['remove']) { exec("/sbin/pfctl -t {$suri_pf_table} -T flush"); header("Location: /suricata/suricata_blocked.php"); exit; } /* TODO: build a file with block ip and disc */ if ($_POST['download']) { $blocked_ips_array_save = ""; exec("/sbin/pfctl -t {$suri_pf_table} -T show", $blocked_ips_array_save); /* build the list */ if (is_array($blocked_ips_array_save) && count($blocked_ips_array_save) > 0) { $save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"'); $file_name = "suricata_blocked_{$save_date}.tar.gz"; exec('/bin/mkdir -p /tmp/suricata_blocked'); file_put_contents("/tmp/suricata_blocked/suricata_block.pf", ""); foreach($blocked_ips_array_save as $counter => $fileline) { if (empty($fileline)) continue; $fileline = trim($fileline, " \n\t"); file_put_contents("/tmp/suricata_blocked/suricata_block.pf", "{$fileline}\n", FILE_APPEND); } // Create a tar gzip archive of blocked host IP addresses exec("/usr/bin/tar -czf /tmp/{$file_name} -C/tmp/suricata_blocked suricata_block.pf"); // If we successfully created the archive, send it to the browser. if(file_exists("/tmp/{$file_name}")) { ob_start(); //important or other posts will fail if (isset($_SERVER['HTTPS'])) { header('Pragma: '); header('Cache-Control: '); } else { header("Pragma: private"); header("Cache-Control: private, must-revalidate"); } header("Content-Type: application/octet-stream"); header("Content-length: " . filesize("/tmp/{$file_name}")); header("Content-disposition: attachment; filename = {$file_name}"); ob_end_clean(); //important or other post will fail readfile("/tmp/{$file_name}"); // Clean up the temp files and directory @unlink("/tmp/{$file_name}"); exec("/bin/rm -fr /tmp/suricata_blocked"); } else $savemsg = gettext("An error occurred while creating archive"); } else $savemsg = gettext("No content on suricata block list"); } if ($_POST['save']) { /* no errors */ if (!$input_errors) { $config['installedpackages']['suricata']['alertsblocks']['brefresh'] = $_POST['brefresh'] ? 'on' : 'off'; $config['installedpackages']['suricata']['alertsblocks']['blertnumber'] = $_POST['blertnumber']; write_config("Suricata pkg: updated BLOCKED tab settings."); header("Location: /suricata/suricata_blocked.php"); exit; } } $pgtitle = gettext("Suricata: Blocked Hosts"); include_once("head.inc"); ?> \n"; /* Display Alert message */ if ($input_errors) { print_input_errors($input_errors); // TODO: add checks } if ($savemsg) { print_info_box($savemsg); } ?>
"/>     " onClick="return confirm('');"/>   
"/>    />  ', '', '', ''); ?>    ', '', '', ''); ?>
$blocked_msg) { $blocked_desc = implode("
", $blocked_msg); if($counter > $bnentries) break; else $counter++; $block_ip_str = inet_ntop($blocked_ip); /* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */ $tmp_ip = str_replace(":", ":​", $block_ip_str); /* Add reverse DNS lookup icons */ $rdns_link = ""; $rdns_link .= "\"Icon"; /* use one echo to do the magic*/ echo "\n"; } } ?>
#
{$counter} {$tmp_ip}
{$rdns_link}
{$blocked_desc}
1) echo "{$counter}" . gettext(" host IP addresses are currently being blocked."); else echo "{$counter}" . gettext(" host IP address is currently being blocked."); } else { echo gettext("There are currently no hosts being blocked by Suricata."); } ?>