* Jim Pingle jim@pingle.org * originally based on m0n0wall (http://m0n0.ch/wall) * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgment: * "This product includes software developed by the pfSense Project * for use in the pfSense software distribution. (http://www.pfsense.org/). * * 4. The names "pfSense" and "pfSense Project" must not be used to * endorse or promote products derived from this software without * prior written permission. For written permission, please contact * coreteam@pfsense.org. * * 5. Products derived from this software may not be called "pfSense" * nor may "pfSense" appear in their names without prior written * permission of the Electric Sheep Fencing, LLC. * * 6. Redistributions of any form whatsoever must retain the following * acknowledgment: * * "This product includes software developed by the pfSense Project * for use in the pfSense software distribution (http://www.pfsense.org/). * * THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. * * ==================================================================== * */ /* pfSense_MODULE: filter */ ##|+PRIV ##|*IDENT=page-diagnostics-logs-firewall ##|*NAME=Diagnostics: Logs: Firewall page ##|*DESCR=Allow access to the 'Diagnostics: Logs: Firewall' page. ##|*MATCH=diag_logs_filter.php* ##|-PRIV require("guiconfig.inc"); require_once("filter_log.inc"); # --- AJAX RESOLVE --- if (isset($_POST['resolve'])) { $ip = strtolower($_POST['resolve']); $res = (is_ipaddr($ip) ? gethostbyaddr($ip) : ''); if ($res && $res != $ip) { $response = array('resolve_ip' => $ip, 'resolve_text' => $res); } else { $response = array('resolve_ip' => $ip, 'resolve_text' => gettext("Cannot resolve")); } echo json_encode(str_replace("\\", "\\\\", $response)); // single escape chars can break JSON decode exit; } function getGETPOSTsettingvalue($settingname, $default) { $settingvalue = $default; if ($_GET[$settingname]) { $settingvalue = $_GET[$settingname]; } if ($_POST[$settingname]) { $settingvalue = $_POST[$settingname]; } return $settingvalue; } $rulenum = getGETPOSTsettingvalue('getrulenum', null); if ($rulenum) { list($rulenum, $tracker, $type) = explode(',', $rulenum); $rule = find_rule_by_number($rulenum, $tracker, $type); echo gettext("The rule that triggered this action is") . ":\n\n{$rule}"; exit; } $filtersubmit = getGETPOSTsettingvalue('filtersubmit', null); if ($filtersubmit) { $interfacefilter = getGETPOSTsettingvalue('interface', null); $filtertext = getGETPOSTsettingvalue('filtertext', ""); $filterlogentries_qty = getGETPOSTsettingvalue('filterlogentries_qty', null); } $filterlogentries_submit = getGETPOSTsettingvalue('filterlogentries_submit', null); if ($filterlogentries_submit) { $filterfieldsarray = array(); $actpass = getGETPOSTsettingvalue('actpass', null); $actblock = getGETPOSTsettingvalue('actblock', null); $filterfieldsarray['act'] = str_replace(" ", " ", trim($actpass . " " . $actblock)); $filterfieldsarray['act'] = $filterfieldsarray['act'] != "" ? $filterfieldsarray['act'] : 'All'; $filterfieldsarray['time'] = getGETPOSTsettingvalue('filterlogentries_time', null); $filterfieldsarray['interface'] = getGETPOSTsettingvalue('filterlogentries_interfaces', null); $filterfieldsarray['srcip'] = getGETPOSTsettingvalue('filterlogentries_sourceipaddress', null); $filterfieldsarray['srcport'] = getGETPOSTsettingvalue('filterlogentries_sourceport', null); $filterfieldsarray['dstip'] = getGETPOSTsettingvalue('filterlogentries_destinationipaddress', null); $filterfieldsarray['dstport'] = getGETPOSTsettingvalue('filterlogentries_destinationport', null); $filterfieldsarray['proto'] = getGETPOSTsettingvalue('filterlogentries_protocol', null); $filterfieldsarray['tcpflags'] = getGETPOSTsettingvalue('filterlogentries_protocolflags', null); $filterlogentries_qty = getGETPOSTsettingvalue('filterlogentries_qty', null); } $filter_logfile = "{$g['varlog_path']}/filter.log"; $nentries = $config['syslog']['nentries']; # Override Display Quantity if ($filterlogentries_qty) { $nentries = $filterlogentries_qty; } if (!$nentries || !is_numeric($nentries)) { $nentries = 50; } if ($_POST['clear']) { clear_log_file($filter_logfile); } $pgtitle = array(gettext("Status"), gettext("System logs"), gettext("Firewall")); $shortcut_section = "firewall"; include("head.inc"); function build_if_list() { $iflist = get_configured_interface_with_descr(false, true); //$iflist = get_interface_list(); // Allow extending of the firewall edit interfaces pfSense_handle_custom_code("/usr/local/pkg/firewall_nat/pre_interfaces_edit"); foreach ($iflist as $if => $ifdesc) $interfaces[$if] = $ifdesc; if ($config['l2tp']['mode'] == "server") $interfaces['l2tp'] = "L2TP VPN"; if (is_pppoe_server_enabled() && have_ruleint_access("pppoe")) $interfaces['pppoe'] = "PPPoE Server"; /* add ipsec interfaces */ if (isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) $interfaces["enc0"] = "IPsec"; /* add openvpn/tun interfaces */ if ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"]) $interfaces["openvpn"] = "OpenVPN"; return($interfaces); } $tab_array = array(); $tab_array[] = array(gettext("System"), false, "diag_logs.php"); $tab_array[] = array(gettext("Firewall"), true, "diag_logs_filter.php"); $tab_array[] = array(gettext("DHCP"), false, "diag_logs.php?logfile=dhcpd"); $tab_array[] = array(gettext("Portal Auth"), false, "diag_logs.php?logfile=portalauth"); $tab_array[] = array(gettext("IPsec"), false, "diag_logs.php?logfile=ipsec"); $tab_array[] = array(gettext("PPP"), false, "diag_logs.php?logfile=ppp"); $tab_array[] = array(gettext("VPN"), false, "diag_logs_vpn.php"); $tab_array[] = array(gettext("Load Balancer"), false, "diag_logs.php?logfile=relayd"); $tab_array[] = array(gettext("OpenVPN"), false, "diag_logs.php?logfile=openvpn"); $tab_array[] = array(gettext("NTP"), false, "diag_logs.php?logfile=ntpd"); $tab_array[] = array(gettext("Settings"), false, "diag_logs_settings.php"); display_top_tabs($tab_array); $tab_array = array(); $tab_array[] = array(gettext("Normal View"), true, "/diag_logs_filter.php"); $tab_array[] = array(gettext("Dynamic View"), false, "/diag_logs_filter_dynamic.php"); $tab_array[] = array(gettext("Summary View"), false, "/diag_logs_filter_summary.php"); display_top_tabs($tab_array, false, 'nav nav-tabs'); $Include_Act = explode(",", str_replace(" ", ",", $filterfieldsarray['act'])); if ($filterfieldsarray['interface'] == "All") $interface = ""; require_once('classes/Form.class.php'); if (!isset($config['syslog']['rawfilter'])) { // Advanced log filter form $form = new Form(new Form_Button( 'filterlogentries_submit', 'Filter' )); $section = new Form_Section('Advanced Log Filter'); $group = new Form_Group(''); $group->add(new Form_Input( 'filterlogentries_sourceipaddress', null, 'text', $filterfieldsarray['srcip'] ))->setHelp('Source IP Address'); $group->add(new Form_Input( 'filterlogentries_destinationipaddress', null, 'text', $filterfieldsarray['dstip'] ))->setHelp('Destination IP Address'); $section->add($group); $group = new Form_Group(''); $group->add(new Form_Checkbox( 'actpass', 'Pass', 'Pass', in_arrayi('Pass', $Include_Act) )); $group->add(new Form_Input( 'filterlogentries_time', null, 'text', $filterfieldsarray['time'] ))->setHelp('Time'); $group->add(new Form_Input( 'filterlogentries_sourceport', null, 'text', $filterfieldsarray['srcport'] ))->setHelp('Source Port'); $group->add(new Form_Input( 'filterlogentries_protocol', null, 'text', $filterfieldsarray['proto'] ))->setHelp('Protocol'); $group->add(new Form_Input( 'filterlogentries_qty', null, 'text', $filterlogentries_qty ))->setHelp('Quantity'); $section->add($group); $group = new Form_Group(''); $group->add(new Form_Checkbox( 'actblock', 'Block', 'Block', in_arrayi('Block', $Include_Act) )); $group->add(new Form_Input( 'filterlogentries_interfaces', null, 'text', $filterfieldsarray['interface'] ))->setHelp('Interface'); $group->add(new Form_Input( 'filterlogentries_destinationport', null, 'text', $filterfieldsarray['dstport'] ))->setHelp('Destination Port'); $group->add(new Form_Input( 'filterlogentries_protocolflags', null, 'text', $filterfieldsarray['tcpflags'] ))->setHelp('Protocol Flags'); } else { // Simple log filter form $form = new Form(new Form_Button( 'filtersubmit', 'Filter' )); $section = new Form_Section('Log Filter'); $section->addInput(new Form_Select( 'filterdescriptions', 'Where to show rule descriptions', $interfacefilter, build_if_list() )); $group = new Form_Group(''); $group->add(new Form_Input( 'filtertext', null, 'text', $filtertext ))->setHelp('Filter Expression'); $group->add(new Form_Input( 'filterlogentries_qty', null, 'text', $filterlogentries_qty ))->setHelp('Quantity'); } $group->setHelp('' . 'Regular expression reference Precede with exclamation (!) to exclude match.'); $section->add($group); $form->add($section); print($form); // Now the forms are complete we can draw the log table and its controls if (!isset($config['syslog']['rawfilter'])) { $iflist = get_configured_interface_with_descr(false, true); if ($iflist[$interfacefilter]) $interfacefilter = $iflist[$interfacefilter]; if ($filterlogentries_submit) $filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filterfieldsarray); else $filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100, $filtertext, $interfacefilter); ?>
=gettext("Act")?> | =gettext("Time")?> | =gettext("IF")?> | =gettext("Rule")?> | =gettext("Source")?> | =gettext("Destination")?> | =gettext("Proto")?> |
---|---|---|---|---|---|---|
', outputrule);"> =gettext('Block')?> | =htmlspecialchars($filterent['time'])?> | =htmlspecialchars($filterent['interface'])?> | =find_rule_by_number_buffer($filterent['rulenum'], $filterent['tracker'], $filterent['act'])?> | ');" title="=gettext("Click to resolve")?>" alt="Reverse Resolve with DNS"/> " alt="Easy Rule: Add to Block List" title="=gettext("Easy Rule: Add to Block List")?>" onclick="return confirm('=gettext("Do you really want to add this BLOCK rule?")?>')"> =$srcstr . ''?> | ');" title="=gettext("Click to resolve")?>" class="ICON-= $dst_htmlclass; ?>" alt="Reverse Resolve with DNS"/> " title="=gettext("Easy Rule: Pass this traffic")?>" onclick="return confirm('=gettext("Do you really want to add this PASS rule?")?>')"> =$dststr . ''?> | =htmlspecialchars($filterent['proto'])?> |
=find_rule_by_number_buffer($filterent['rulenum'],$filterent['tracker'],$filterent['act'])?> | ||||||
' . gettext("TCP Flags") . ': F - FIN, S - SYN, A or . - ACK, R - RST, P - PSH, U - URG, E - ECE, C - CWR' . '