diff options
author | PiBa-NL <pba_2k3@yahoo.com> | 2012-09-10 16:32:28 +0200 |
---|---|---|
committer | PiBa-NL <pba_2k3@yahoo.com> | 2012-09-10 16:32:28 +0200 |
commit | 52b2726831c2f170b563ce7e579ffcaf24e17049 (patch) | |
tree | b7356c7dc78f16bc6bb73d248ac03b4066d952fe | |
parent | a6d5e0439da3945c77beeb5bab5956223973cc80 (diff) | |
download | pfsense-52b2726831c2f170b563ce7e579ffcaf24e17049.zip pfsense-52b2726831c2f170b563ce7e579ffcaf24e17049.tar.gz |
Added a setting for configuring the firewall log to either:
-Not load descriptions
-Show descriptions in a column
-Show descriptions on a second row (after a click on 'show descriptions')
'fixed' a few html validation issues..
-rw-r--r-- | etc/inc/filter.inc | 8 | ||||
-rw-r--r-- | etc/inc/filter_log.inc | 5 | ||||
-rwxr-xr-x | usr/local/www/diag_logs_filter.php | 76 | ||||
-rwxr-xr-x | usr/local/www/diag_logs_settings.php | 18 | ||||
-rw-r--r-- | usr/local/www/javascript/filter_log.js | 12 | ||||
-rw-r--r-- | usr/local/www/themes/pfsense_ng/all.css | 4 |
6 files changed, 89 insertions, 34 deletions
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 0b2b883..a3cb67a 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2432,7 +2432,7 @@ block quick from any to <snort2c> label "Block snort2c hosts" EOD; - $ipfrules .= filter_process_carp_rules(); + $ipfrules .= filter_process_carp_rules($log); $ipfrules .= "\n# SSH lockout\n"; if(is_array($config['system']['ssh']) && !empty($config['system']['ssh']['port'])) { @@ -3157,17 +3157,17 @@ function filter_process_carp_nat_rules() { return $lines; } -function filter_process_carp_rules() { +function filter_process_carp_rules($log) { global $g, $config; if(isset($config['system']['developerspew'])) { $mt = microtime(); - echo "filter_process_carp_rules() being called $mt\n"; + echo "filter_process_carp_rules($log) being called $mt\n"; } $lines = ""; /* return if there are no carp configured items */ if (!empty($config['hasync']) or !empty($config['virtualip']['vip'])) { - $lines .= "block in log quick proto carp from (self) to any\n"; + $lines .= "block in $log quick proto carp from (self) to any\n"; $lines .= "pass quick proto carp\n"; $lines .= "pass quick proto pfsync\n"; } diff --git a/etc/inc/filter_log.inc b/etc/inc/filter_log.inc index 11adfae..2bfc895 100644 --- a/etc/inc/filter_log.inc +++ b/etc/inc/filter_log.inc @@ -248,15 +248,14 @@ function buffer_rules_clear() { function find_rule_by_number_buffer($rulenum, $type){ global $g, $buffer_rules_rdr, $buffer_rules_normal; - if ($type == "rdr") - { + if ($type == "rdr") { $ruleString = $buffer_rules_rdr["@".$rulenum]; //TODO: get the correct 'description' part of a RDR log line. currently just first 30 characters.. $rulename = substr($ruleString,0,30); } else { $ruleString = $buffer_rules_normal["@".$rulenum]; list(,$rulename,) = explode("\"",$ruleString); - $rulename = str_replace("USER_RULE: ","<img src=\"/themes/".$g['theme'].'/images/icons/icon_frmfld_user.png\" width="11" height="12" title="USER_RULE" alt="USER_RULE"/> ',$rulename); + $rulename = str_replace("USER_RULE: ",'<img src="/themes/'.$g['theme'].'/images/icons/icon_frmfld_user.png" width="11" height="12" title="USER_RULE" alt="USER_RULE"/> ',$rulename); } return "@".$rulenum." ".$rulename; } diff --git a/usr/local/www/diag_logs_filter.php b/usr/local/www/diag_logs_filter.php index 112c916..a34e0a2 100755 --- a/usr/local/www/diag_logs_filter.php +++ b/usr/local/www/diag_logs_filter.php @@ -119,7 +119,7 @@ include("head.inc"); <table class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0"> <tr> <td colspan="<?=(!isset($config['syslog']['rawfilter']))?7:2?>" align="left" valign="middle"> - <div style="float: right;" valign="middle"> + <div style="float: right; vertical-align:middle"> <form id="filterform" name="filterform" action="diag_logs_filter.php" method="post"> <input id="filtertext" name="filtertext" class="formfld search" style="vertical-align:top;" value="<?=gettext($filtertext);?>" /> <input id="filtersubmit" name="filtersubmit" type="submit" class="formbtn" style="vertical-align:top;" value="<?=gettext("Filter");?>" /> @@ -128,42 +128,53 @@ include("head.inc"); </div> <div style="float: left;"> <?=gettext("Normal View");?> | <a href="diag_logs_filter_dynamic.php"><?=gettext("Dynamic View");?></a> | <a href="diag_logs_filter_summary.php"><?=gettext("Summary View");?></a> + <br/><br/> + <?php if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "2"):?> + <a href="#" onclick="showRuleDescriptions()">Show rule descriptions</a> + <?php endif;?> + <br/> </div> </td> </tr> <?php if (!isset($config['syslog']['rawfilter'])): $filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filtertext); ?> - <tr> - <td colspan="7" class="listtopic"> - <?php if (!$filtertext) { ?> - <?php printf(gettext("Last %s firewall log entries."),count($filterlog));?> - <?php } else { ?> - <?php echo count($filterlog). ' ' . gettext("matched log entries."); ?> - <?php } ?> - <?php printf(gettext("Max(%s)"),$nentries);?> + <tr> + <td colspan="<?=$config['syslog']['filterdescriptions']==="1"?7:6?>" class="listtopic"> + <?php if (!$filtertext) + printf(gettext("Last %s firewall log entries."),count($filterlog)); + else + echo count($filterlog). ' ' . gettext("matched log entries."); + printf(gettext("Max(%s)"),$nentries);?> + </td> </tr> <tr> <td width="10%" class="listhdrr"><?=gettext("Act");?></td> - <td width="10%" class="listhdrr"><?=gettext("Rule");?></td> <td width="10%" class="listhdrr"><?=gettext("Time");?></td> <td width="15%" class="listhdrr"><?=gettext("If");?></td> + <?php if ($config['syslog']['filterdescriptions'] === "1"):?> + <td width="10%" class="listhdrr"><?=gettext("Rule");?></td> + <?php endif;?> <td width="25%" class="listhdrr"><?=gettext("Source");?></td> <td width="25%" class="listhdrr"><?=gettext("Destination");?></td> <td width="15%" class="listhdrr"><?=gettext("Proto");?></td> - </tr><?php - buffer_rules_load(); + </tr> + <?php + if ($config['syslog']['filterdescriptions']) + buffer_rules_load(); foreach ($filterlog as $filterent): ?> <tr> - <td class="listlr" nowrap align="middle"> + <td class="listlr" nowrap="nowrap" align="center"> <center> - <a href="#" onClick="javascript:getURL('diag_logs_filter.php?getrulenum=<?php echo "{$filterent['rulenum']},{$filterent['act']}"; ?>', outputrule);"> - <img border="0" src="<?php echo find_action_image($filterent['act']);?>" width="11" height="11" align="absmiddle" alt="<?php echo $filterent['act'];?>" title="<?php echo $filterent['act'];?>" /> + <a href="#" onclick="javascript:getURL('diag_logs_filter.php?getrulenum=<?php echo "{$filterent['rulenum']},{$filterent['act']}"; ?>', outputrule);"> + <img border="0" src="<?php echo find_action_image($filterent['act']);?>" width="11" height="11" align="middle" alt="<?php echo $filterent['act'];?>" title="<?php echo $filterent['act'];?>" /> <?php if ($filterent['count']) echo $filterent['count'];?></a></center></td> - <td class="listr" nowrap><?=find_rule_by_number_buffer($filterent['rulenum'],$filterent['act']);?></td> - <td class="listr" nowrap><?php echo htmlspecialchars($filterent['time']);?></td> - <td class="listr" nowrap><?php echo htmlspecialchars($filterent['interface']);?></td> - <?php + <td class="listr" nowrap="nowrap"><?php echo htmlspecialchars($filterent['time']);?></td> + <td class="listr" nowrap="nowrap"><?php echo htmlspecialchars($filterent['interface']);?></td> + <?php + if ($config['syslog']['filterdescriptions'] === "1") + echo("<td class=\"listr\" nowrap=\"nowrap\">".find_rule_by_number_buffer($filterent['rulenum'],$filterent['act'])."</td>"); + $int = strtolower($filterent['interface']); $proto = strtolower($filterent['proto']); if(is_ipaddrv6($filterent['srcip'])) { @@ -177,22 +188,33 @@ include("head.inc"); $srcstr = $filterent['srcip'] . get_port_with_service($filterent['srcport'], $proto); $dststr = $filterent['dstip'] . get_port_with_service($filterent['dstport'], $proto); ?> - <td class="listr" nowrap> - <a href="diag_dns.php?host=<?php echo $filterent['srcip']; ?>" title="<?=gettext("Reverse Resolve with DNS");?>"><img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_log.gif"></a> - <a href="easyrule.php?<?php echo "action=block&int={$int}&src={$filterent['srcip']}&ipproto={$ipproto}"; ?>" title="<?=gettext("Easy Rule: Add to Block List");?>" onclick="return confirm('<?=gettext("Do you really want to add this BLOCK rule?")."\n\n".gettext("Easy Rule is still experimental.")."\n".gettext("Continue at risk of your own peril.")."\n".gettext("Backups are also nice.")?>')"><img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_block_add.gif"></a> + <td class="listr" nowrap="nowrap"> + <a href="diag_dns.php?host=<?php echo $filterent['srcip']; ?>" title="<?=gettext("Reverse Resolve with DNS");?>"> + <img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_log.gif" alt="Icon Reverse Resolve with DNS"/></a> + <a href="easyrule.php?<?php echo "action=block&int={$int}&src={$filterent['srcip']}&ipproto={$ipproto}"; ?>" title="<?=gettext("Easy Rule: Add to Block List");?>" onclick="return confirm('<?=gettext("Do you really want to add this BLOCK rule?")."\n\n".gettext("Easy Rule is still experimental.")."\n".gettext("Continue at risk of your own peril.")."\n".gettext("Backups are also nice.")?>')"> + <img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_block_add.gif" alt="Icon Easy Rule: Add to Block List" /></a> <?php echo $srcstr;?> </td> - <td class="listr" nowrap> - <a href="diag_dns.php?host=<?php echo $filterent['dstip']; ?>" title="<?=gettext("Reverse Resolve with DNS");?>"><img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_log.gif"></a> - <a href="easyrule.php?<?php echo "action=pass&int={$int}&proto={$proto}&src={$filterent['srcip']}&dst={$filterent['dstip']}&dstport={$filterent['dstport']}&ipproto={$ipproto}"; ?>" title="<?=gettext("Easy Rule: Pass this traffic");?>" onclick="return confirm('<?=gettext("Do you really want to add this PASS rule?")."\n\n".gettext("Easy Rule is still experimental.")."\n".gettext("Continue at risk of your own peril.")."\n".gettext("Backups are also nice.");?>')"><img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_pass_add.gif"></a> + <td class="listr" nowrap="nowrap"> + <a href="diag_dns.php?host=<?php echo $filterent['dstip']; ?>" title="<?=gettext("Reverse Resolve with DNS");?>"> + <img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_log.gif" alt="Icon Reverse Resolve with DNS" /></a> + <a href="easyrule.php?<?php echo "action=pass&int={$int}&proto={$proto}&src={$filterent['srcip']}&dst={$filterent['dstip']}&dstport={$filterent['dstport']}&ipproto={$ipproto}"; ?>" title="<?=gettext("Easy Rule: Pass this traffic");?>" onclick="return confirm('<?=gettext("Do you really want to add this PASS rule?")."\n\n".gettext("Easy Rule is still experimental.")."\n".gettext("Continue at risk of your own peril.")."\n".gettext("Backups are also nice.");?>')"> + <img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_pass_add.gif" alt="Icon Easy Rule: Pass this traffic" /></a> <?php echo $dststr;?> </td> <?php if ($filterent['proto'] == "TCP") $filterent['proto'] .= ":{$filterent['tcpflags']}"; ?> - <td class="listr" nowrap><?php echo htmlspecialchars($filterent['proto']);?></td> - </tr><?php endforeach; + <td class="listr" nowrap="nowrap"><?php echo htmlspecialchars($filterent['proto']);?></td> + </tr> + <?php if (isset($config['syslog']['filterdescriptions']) && $config['syslog']['filterdescriptions'] === "2"):?> + <tr> + <td colspan="2" class="listFirewall listlr" /> + <td class="listFirewall listr" colspan="4" nowrap="nowrap"><?=find_rule_by_number_buffer($filterent['rulenum'],$filterent['act']);?></td> + </tr> + <?php endif; + endforeach; buffer_rules_clear(); ?> <?php else: ?> <tr> diff --git a/usr/local/www/diag_logs_settings.php b/usr/local/www/diag_logs_settings.php index 23c4754..42cf79e 100755 --- a/usr/local/www/diag_logs_settings.php +++ b/usr/local/www/diag_logs_settings.php @@ -64,6 +64,7 @@ $pconfig['system'] = isset($config['syslog']['system']); $pconfig['enable'] = isset($config['syslog']['enable']); $pconfig['logdefaultblock'] = !isset($config['syslog']['nologdefaultblock']); $pconfig['rawfilter'] = isset($config['syslog']['rawfilter']); +$pconfig['filterdescriptions'] = $config['syslog']['filterdescriptions']; $pconfig['disablelocallogging'] = isset($config['syslog']['disablelocallogging']); if (!$pconfig['nentries']) @@ -116,6 +117,10 @@ if ($_POST) { $oldnologdefaultblock = isset($config['syslog']['nologdefaultblock']); $config['syslog']['nologdefaultblock'] = $_POST['logdefaultblock'] ? false : true; $config['syslog']['rawfilter'] = $_POST['rawfilter'] ? true : false; + if (is_numeric($_POST['filterdescriptions']) && $_POST['filterdescriptions'] > 0) + $config['syslog']['filterdescriptions'] = $_POST['filterdescriptions']; + else + unset($config['syslog']['filterdescriptions']); if($config['syslog']['enable'] == false) { unset($config['syslog']['remoteserver']); unset($config['syslog']['remoteserver2']); @@ -261,6 +266,19 @@ function check_everything() { <?=gettext("Hint: If this is checked, filter logs are shown as generated by the packet filter, without any formatting. This will reveal more detailed information, but it is more difficult to read.");?></td> </tr> <tr> + <td valign="top" class="vtable">Filter descriptions</td> + <td class="vtable"> + <select name="filterdescriptions" id="filterdescriptions" > + <option value="0"<?=!isset($pconfig['filterdescriptions'])?" selected":""?>>Dont load descriptions</option> + <option value="1"<?=($pconfig['filterdescriptions'])==="1"?" selected":""?>>Display as column</option> + <option value="2"<?=($pconfig['filterdescriptions'])==="2"?" selected":""?>>Display as second row</option> + </select> + <strong><?=gettext("Show the applied rule description below or in the firewall log rows.");?></strong> + <br/> + <?=gettext("Displaying rule descriptions for all lines in the log might affect performance with large rulessets.");?></td> + </td> + </tr> + <tr> <td width="22%" valign="top" class="vtable">Local Logging</td> <td width="78%" class="vtable"> <input name="disablelocallogging" type="checkbox" id="disablelocallogging" value="yes" <?php if ($pconfig['disablelocallogging']) echo "checked"; ?> onClick="enable_change(false)"> <?php if ($g['platform'] == "pfSense"): ?> diff --git a/usr/local/www/javascript/filter_log.js b/usr/local/www/javascript/filter_log.js index 1259afb..3bfab6b 100644 --- a/usr/local/www/javascript/filter_log.js +++ b/usr/local/www/javascript/filter_log.js @@ -120,3 +120,15 @@ function toggle_pause() { if (typeof updateDelay != 'undefined') { timer = setInterval('fetch_new_rules()', updateDelay); } + +function showRuleDescriptions(){ + var ss = document.styleSheets; + for (var i=0; i<ss.length; i++) { + var rules = ss[i].cssRules || ss[i].rules; + for (var j=0; j<rules.length; j++) { + if (rules[j].selectorText === ".listFirewall") { + rules[j].style.display = "table-cell"; + } + } + } +}
\ No newline at end of file diff --git a/usr/local/www/themes/pfsense_ng/all.css b/usr/local/www/themes/pfsense_ng/all.css index 3452c72..cdb9b9a 100644 --- a/usr/local/www/themes/pfsense_ng/all.css +++ b/usr/local/www/themes/pfsense_ng/all.css @@ -920,6 +920,10 @@ ul#wzdnav a:active { padding-top: 4px; padding-bottom: 4px; } +.listFirewall { + border-bottom: 2px solid #999999; + display:none; +} .listlrns { background-color: #FFFFFF; border-right: 1px solid #999999; |