From f63d5b66b49abe5190703d9d251b7e2d462e993b Mon Sep 17 00:00:00 2001 From: Helder Pereira Date: Sat, 20 Dec 2008 23:57:09 +0000 Subject: This patch adds the initial support for layer7 protocol inspection gui. --- usr/local/www/diag_patterns.php | 130 ++++++ usr/local/www/firewall_shaper.php | 3 +- usr/local/www/firewall_shaper_layer7.php | 592 +++++++++++++++++++++++++++ usr/local/www/firewall_shaper_queues.php | 3 +- usr/local/www/firewall_shaper_vinterface.php | 3 +- usr/local/www/firewall_shaper_wizards.php | 3 +- 6 files changed, 730 insertions(+), 4 deletions(-) create mode 100755 usr/local/www/diag_patterns.php create mode 100755 usr/local/www/firewall_shaper_layer7.php (limited to 'usr/local/www') diff --git a/usr/local/www/diag_patterns.php b/usr/local/www/diag_patterns.php new file mode 100755 index 0000000..551fc44 --- /dev/null +++ b/usr/local/www/diag_patterns.php @@ -0,0 +1,130 @@ + + + + + + + +

You can upload new layer7 patterns to your system!

+" . $ulmsg . "

\n"; ?> + + +
+
+ + + + + + + + + + + + + + + + +
Upload
File to upload: + +
    +
+
+ + + + + + diff --git a/usr/local/www/firewall_shaper.php b/usr/local/www/firewall_shaper.php index 9f74264..ec803a1 100755 --- a/usr/local/www/firewall_shaper.php +++ b/usr/local/www/firewall_shaper.php @@ -424,7 +424,8 @@ include("fbegin.inc"); $tab_array[0] = array("By Interface", true, "firewall_shaper.php"); $tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php"); $tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php"); - $tab_array[3] = array("Wizards", false, "firewall_shaper_wizards.php"); + $tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php"); + $tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/firewall_shaper_layer7.php b/usr/local/www/firewall_shaper_layer7.php new file mode 100755 index 0000000..71574ec --- /dev/null +++ b/usr/local/www/firewall_shaper_layer7.php @@ -0,0 +1,592 @@ +"; +$default_layer7shaper_msg .= "

Note:
"; +$default_layer7shaper_msg .= "You can add new layer7 protocol patterns by simply uploading the file here.
"; +$default_layer7shaper_msg .= ""; + + +read_layer7_config(); + +if($_GET['reset'] <> "") { + mwexec("killall -9 pfctl php"); + mwexec("killall -9 ipfw-classifyd"); //kill all ipfw-classifyd processes + exit; +} + +if ($_GET) { + if ($_GET['container']) + $name = trim($_GET['container']); + if ($_GET['action']) + $action = $_GET['action']; +} + +if($_POST) { + if ($_POST['container']) { + $name = trim($_POST['container']); + } +} + +if ($name) { + //Get the object from the 7rules list + $container = $layer7_rules_list[$name]; +} + + +if ($_GET) { + switch ($action) { + case "add": + $show_proto_form = true; + $container = new layer7(); + $output_form .= $container->build_form(); //constructs the graphical interface on the right side + unset($container); + break; + case "show": + $show_proto_form = true; + if($container) { + $output_form .= $container->build_form(); + } + else { + $show_proto_form = false; + $input_errors[] = "Layer7 Rules Container not found!"; + } + break; + default: + echo log_error("Get default"); + $show_proto_form = false; + $output_form .= "

" . $dn_default_shaper_msg . $default_layer7shaper_msg . "

"; + break; + } +} + +//add a new l7rules container +else if ($_POST) { + $show_proto_form = true; + unset($input_errors); + + if($_POST['submit']) { + $l7r =& new layer7(); + $_POST['divert_port'] = $l7r->gen_divert_port(); + for($i=0; $i<100; $i++) { + if($_POST['protocol'][$i] <> "") { + $_POST['l7rules'][$i]['protocol'] = $_POST['protocol'][$i]; + $_POST['l7rules'][$i]['structure'] = $_POST['structure'][$i]; + $_POST['l7rules'][$i]['behaviour'] = $_POST['behaviour'][$i]; + } + else { + break; + } + } + $l7r->validate_input($_POST,&$input_errors); + $l7r->ReadConfig($_POST['container'], $_POST); + //Before writing the results, we need to test for repeated protocols + $non_dupes = array(); + $dupes = array(); + for($j=0; $j<$i; $j++) { + if(!$non_dupes[$_POST['protocol'][$j]]) + $non_dupes[$_POST['protocol'][$j]] = true; + else + $dupes[] = $_POST['protocol'][$j]; + } + unset($non_dupes); + if(sizeof($dupes) == 0 && !$input_errors) { + $l7r->wconfig(); + write_config(); + touch($d_shaperconfdirty_path); + + read_layer7_config(); + } + else { + if(sizeof($dupes) > 0) { + $dupe_error = "Found the following repeated protocol definitions: "; + foreach($dupes as $dupe) + $dupe_error .= "$dupe "; + $input_errors[] .= $dupe_error; + } + } + unset($dupes); + unset($dupe_error); + //Even if there are repeated protocols, we won't loose any previous values + //The user will be able to solve the situation + $output_form .= $l7r->build_form(); + //Necessary to correctly build the proto form + $container = $layer7_rules_list[$name]; + if($input_errors) + $container =& $l7r; + } else if($_POST['apply']) { + write_config(); + + $retval = 0; + $savemsg = get_std_save_message($retval); + + config_lock(); + $retval = filter_configure(); + config_unlock(); + + if(stristr($retval, "error") <> true) + $savemsg = get_std_save_message($retval); + else + $savemsg = $retval; + + unlink($d_shaperconfdirty_path); + + if($container) { + $output_form .= $container->build_form(); + } else { + $show_proto_form = false; + $output_form .= "

" . $dn_default_shaper_msg . $default_layer7shaper_msg . "

"; + } + } else if ($_POST['delete']) { + $container->delete_l7c(); + write_config(); + touch($d_shaperconfdirty_path); + unset($container); + + header("Location: firewall_shaper_layer7.php"); + exit; + } + else { + $show_proto_form = false; + } +} +else { + $show_proto_form = false; + $output_form .= "

" . $dn_default_shaper_msg . $default_layer7shaper_msg . "

"; +} + +// Builds the left tree +$tree = ""; + +$output = "
"; +$output .= $output_form; + +include("head.inc"); +?> + + + + + + + + +
+ + +
+ + +

+You must apply the changes in order for them to take effect.");?>
+ + + + + + +
+ +
+
+ + + 0): ?> + + + + + + +
+
+ +

+ + Create new l7 rules group +
+ 		+ + + + + + + + + + + + + + + + + +
+
+ Rule(s) +
+ 		+ + + + + + + + + + + + + + + + rsets as $l7rule) { + ?> + + + + + + + + + + + + +
+
+ Add one or more rules +
+
+
+ Protocol +
+ 		+
+ Structure +
+ 		+
+ Behaviour +
+
+ + + + + + + GetRStructure() == "queue"): ?> + + + + + + GetRStructure() == "limiter"): ?> + + + + + + + +
+ + +
+   + + + + + + + + + +
+ +
+
+
+

+ + + + \ No newline at end of file diff --git a/usr/local/www/firewall_shaper_queues.php b/usr/local/www/firewall_shaper_queues.php index 061314b..342083e 100755 --- a/usr/local/www/firewall_shaper_queues.php +++ b/usr/local/www/firewall_shaper_queues.php @@ -188,7 +188,8 @@ include("head.inc"); $tab_array[0] = array("By Interface", false, "firewall_shaper.php"); $tab_array[1] = array("By Queue", true, "firewall_shaper_queues.php"); $tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php"); - $tab_array[3] = array("Wizards", false, "firewall_shaper_wizards.php"); + $tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php"); + $tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/firewall_shaper_vinterface.php b/usr/local/www/firewall_shaper_vinterface.php index b1bf9a5..75b7e6c 100644 --- a/usr/local/www/firewall_shaper_vinterface.php +++ b/usr/local/www/firewall_shaper_vinterface.php @@ -367,7 +367,8 @@ include("fbegin.inc"); $tab_array[0] = array("By Interface", false, "firewall_shaper.php"); $tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php"); $tab_array[2] = array("Limiter", true, "firewall_shaper_vinterface.php"); - $tab_array[3] = array("Wizards", false, "firewall_shaper_wizards.php"); + $tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php"); + $tab_array[4] = array("Wizards", false, "firewall_shaper_wizards.php"); display_top_tabs($tab_array); ?> diff --git a/usr/local/www/firewall_shaper_wizards.php b/usr/local/www/firewall_shaper_wizards.php index a086cc1..2290a3f 100755 --- a/usr/local/www/firewall_shaper_wizards.php +++ b/usr/local/www/firewall_shaper_wizards.php @@ -97,7 +97,8 @@ include("fbegin.inc"); $tab_array[0] = array("By Interface", false, "firewall_shaper.php"); $tab_array[1] = array("By Queue", false, "firewall_shaper_queues.php"); $tab_array[2] = array("Limiter", false, "firewall_shaper_vinterface.php"); - $tab_array[3] = array("Wizards", true, "firewall_shaper_wizards.php"); + $tab_array[3] = array("Layer7", false, "firewall_shaper_layer7.php"); + $tab_array[4] = array("Wizards", true, "firewall_shaper_wizards.php"); display_top_tabs($tab_array); ?> -- cgit v1.1