← Back
Editing: bandwidth-lib.pl
# Functions for parsing the system log for iptables entries # XXX ipf support # XXX ipf missing some packets? large FTP transfer? # XXX option to specify ports considered 'server' (by ranges) # XXX option to make ports without names not server ports # XXX use is_server_port function BEGIN { push(@INC, ".."); }; use WebminCore; &init_config(); if (&has_command('journalctl')) { $syslog_module = undef; $syslog_journald = "journald" ; } elsif (&foreign_installed("syslog-ng", 1) == 2) { &foreign_require("syslog-ng"); $syslog_module = "syslog-ng"; } elsif (&foreign_installed("syslog")) { &foreign_require("syslog"); $syslog_module = "syslog"; } &foreign_require("cron", "cron-lib.pl"); &foreign_require("net", "net-lib.pl"); %access = &get_module_acl(); $bandwidth_log = $config{'bandwidth_log'} || "/var/log/bandwidth"; $hours_dir = $config{'bandwidth_dir'} || (-e "$module_config_directory/hours" ? "$module_config_directory/hours" : "$module_var_directory/hours"); $cron_cmd = "$module_config_directory/rotate.pl"; $pid_file = -e "$module_config_directory/rotate.pid" ? "$module_config_directory/rotate.pid" : "$module_var_directory/rotate.pid"; # list_hours() # Returns a list of all hours for which traffic is available sub list_hours { opendir(DIR, $hours_dir); local @rv = grep { $_ =~ /^\d+$/ } readdir(DIR); closedir(DIR); return @rv; } # get_hour(num) sub get_hour { if (!defined($hour_cache{$_[0]})) { local $file = "$hours_dir/$_[0]"; local %hour; if (&read_file($file, \%hour)) { $hour_cache{$_[0]} = \%hour; } else { $hour_cache{$_[0]} = { 'hour' => $_[0] }; } } return $hour_cache{$_[0]}; } # save_hour(hour) sub save_hour { mkdir($hours_dir, 0755); local $file = "$hours_dir/$_[0]->{'hour'}"; &write_file($file, $_[0]); } # find_rule(&table, chain, interface, dir) sub find_rule { local ($table, $chain, $iface, $dir) = @_; local $r; local $dd = $dir eq "i" ? "IN" : "OUT"; foreach $r (@{$table->{'rules'}}) { next if ($r->{'chain'} ne $chain); local $da = $r->{$dir}; if ($iface) { next if ($da->[1] ne $iface); } else { next if (!$da); } next if ($r->{'j'}->[1] ne 'LOG'); next if ($r->{'args'} !~ /\-\-log\-prefix\s+BANDWIDTH_\Q$dd\E:/ && $r->{'args'} !~ /\-\-log\-prefix\s+"BANDWIDTH_\Q$dd\E:"/ && $r->{'logprefix'}->[1] ne "BANDWIDTH_$dd"); return $r; } return undef; } # find_sysconf(&conf) # Returns the syslog entry for kernel debug messages to the log file sub find_sysconf { local ($conf) = @_; local $c; local @ll = &get_loglevel(); foreach $c (@$conf) { next if (!$c->{'active'}); next if ($c->{'file'} ne $bandwidth_log); next if ($c->{'sel'}->[0] ne $ll[0]); return $c; } return undef; } # find_sysconf_ng(&conf) # Returns the destination, filter and log objects for kernel debug messages sub find_sysconf_ng { local ($conf) = @_; local @dests = &syslog_ng::find("destination", $conf); local ($dest) = grep { $_->{'value'} eq "d_bandwidth" } @dests; local @filters = &syslog_ng::find("filter", $conf); local ($filter) = grep { $_->{'value'} eq "f_bandwidth" } @filters; local @logs = &syslog_ng::find("log", $conf); local $log; if ($dest && $filter) { foreach my $l (@logs) { local ($ldest) = &syslog_ng::find("destination", $l->{'members'}); local ($lfilter) = &syslog_ng::find("filter", $l->{'members'}); if ($ldest->{'value'} eq $dest->{'value'} && $lfilter->{'value'} eq $filter->{'value'}) { $log = $l; last; } } } return ($dest, $filter, $log); } # find_cron_job() # Returns the cron job used for bandwidth counting, or undef sub find_cron_job { local @jobs = &cron::list_cron_jobs(); local ($job) = grep { $_->{'user'} eq 'root' && $_->{'command'} eq $cron_cmd && $_->{'active'} } @jobs; return $job; } # date_input(day, month, year, prefix) sub date_input { return &ui_textbox("$_[3]_day", $_[0], 2)."/". &ui_select("$_[3]_month", $_[1], [ map { [ $_, $text{"smonth_".$_} ] } (1 .. 12) ])."/". &ui_textbox("$_[3]_year", $_[2], 4). &date_chooser_button("$_[3]_day", "$_[3]_month", "$_[3]_year"); } # hourmin_input(hour, min, prefix) sub hourmin_input { return &ui_textbox("$_[2]_hour", $_[0], 2).":". &ui_textbox("$_[2]_min", $_[1], 2); } # detect_firewall_system() # Guesses which firewall is installed sub detect_firewall_system { local $m; foreach $m ("shorewall", "firewalld", "firewall", "ipfw", "ipfilter") { return $m if (&check_firewall_system($m)); } return undef; } # check_firewall_system(type) # Returns 1 if some firewall is installed sub check_firewall_system { # XXX shorewall check should look for actual rules? return &foreign_installed($_[0], 1); } sub check_rules { local $cfunc = "check_".$config{'firewall_system'}."_rules"; return &$cfunc(@_); } sub setup_rules { local $sfunc = "setup_".$config{'firewall_system'}."_rules"; return &$sfunc(@_); } sub delete_rules { local $dfunc = "delete_".$config{'firewall_system'}."_rules"; return &$dfunc(@_); } sub process_line { local $pfunc = "process_".$config{'firewall_system'}."_line"; return &$pfunc(@_); } sub pre_process { local $pfunc = "pre_".$config{'firewall_system'}."_process"; if (defined(&$pfunc)) { &$pfunc(@_); } } sub get_loglevel { local $lfunc = "get_".$config{'firewall_system'}."_loglevel"; return &$lfunc(@_); } # is_server_port(num) sub is_server_port { } ############### functions for FirewallD ################# # get_firewalld_rule(family, chain, direction, iface) # Returns the rich rule for logging packets sub get_firewalld_rule { my ($family, $chain, $direction, $iface) = @_; # Define rule components my %switch = ( 'in' => 'i', 'out' => 'o', ); # Construct and return the rich rule my $udirection = uc($direction); my $rule = { 'family' => $family, 'table' => 'filter', 'chain' => uc($chain), 'priority' => 0, 'rule' => "-$switch{$direction} $iface -j LOG \ --log-prefix BANDWIDTH_$udirection:", }; return &firewalld::construct_direct_rule($rule); } # check_firewalld_rules(iface) # Returns 1 if the FirewallD rules needed are setup, 0 if not sub check_firewalld_rules { my $iface = shift // $config{'iface'}; &foreign_require("firewalld"); # Load the firewalld module my %ip_families = &firewalld::check_ip_family(); my @directions = ('in', 'out'); my @chains = ('input', 'output', 'forward'); my $conflicting = sub { my ($chain, $direction) = @_; return 1 if ($direction eq 'out' && $chain eq 'input'); return 1 if ($direction eq 'in' && $chain eq 'output'); }; # Check each direction for each available IP family for my $chain (@chains) { # If IPv4 is available if ($ip_families{ipv4}) { foreach my $direction (@directions) { next if ($conflicting->($chain, $direction)); return 0 if (!&firewalld::check_direct_rule( &get_firewalld_rule('ipv4', $chain, $direction, $iface))); } } # If IPv6 is available if ($ip_families{ipv6}) { foreach my $direction (@directions) { next if ($conflicting->($chain, $direction)); return 0 if (!&firewalld::check_direct_rule( &get_firewalld_rule('ipv6', $chain, $direction, $iface))); } } } return 1; } # setup_firewalld_rules() # If any FirewallD rules are missing, add them sub firewalld_rules_control { my ($action, $iface) = @_; &foreign_require("firewalld"); my %ip_families = &firewalld::check_ip_family(); my @directions = ('in', 'out'); my @chains = ('input', 'output', 'forward'); my $conflicting = sub { my ($chain, $direction) = @_; return 1 if ($direction eq 'out' && $chain eq 'input'); return 1 if ($direction eq 'in' && $chain eq 'output'); }; # Add the rules for each direction and IP family foreach my $chain (@chains) { if ($ip_families{ipv4}) { foreach my $direction (@directions) { next if ($conflicting->($chain, $direction)); my ($out, $rs) = &firewalld::direct_rule($action, { 'permanent' => 1, 'rule' => &get_firewalld_rule('ipv4', $chain, $direction, $iface), }); return $out if ($rs); } } if ($ip_families{ipv6}) { foreach my $direction (@directions) { next if ($conflicting->($chain, $direction)); my ($out, $rs) = &firewalld::direct_rule($action, { 'permanent' => 1, 'rule' => &get_firewalld_rule('ipv6', $chain, $direction, $iface), }); return $out if ($rs); } } } return &firewalld::apply_firewalld(); } # setup_firewalld_rules(iface) # If any FirewallD rules are missing, add them sub setup_firewalld_rules { my $iface = shift // $config{'iface'}; return &firewalld_rules_control('add', $iface); } # delete_firewalld_rules() # Delete firewall rules for bandwidth logging sub delete_firewalld_rules { my $iface = shift // $config{'iface'}; return &firewalld_rules_control('remove', $iface); } # process_firewalld_line(line, &hours, time-now) # Process an IPtables firewall line, and returns 1 if successful sub process_firewalld_line { return &process_firewall_line(@_); } # get_firewalld_loglevel() sub get_firewalld_loglevel { return ( "kern.=debug" ); } ############### functions for IPtables ################# # check_firewall_rules() # Returns 1 if the IPtables rules needed are setup, 0 if not sub check_firewall_rules { &foreign_require("firewall", "firewall-lib.pl"); &foreign_require("firewall", "firewall4-lib.pl"); local @tables = &firewall::get_iptables_save(); local ($filter) = grep { $_->{'name'} eq 'filter' } @tables; local $inrule = &find_rule($filter, "INPUT", $config{'iface'}, "i"); local $outrule = &find_rule($filter, "OUTPUT", $config{'iface'}, "o"); local $fwdinrule = &find_rule($filter, "FORWARD", $config{'iface'}, "i"); local $fwdoutrule = &find_rule($filter, "FORWARD", $config{'iface'}, "o"); return $inrule && $outrule && $fwdinrule && $fwdoutrule; } # setup_firewall_rules(iface) # If any IPtables rules are missing, add them sub setup_firewall_rules { &foreign_require("firewall", "firewall-lib.pl"); &foreign_require("firewall", "firewall4-lib.pl"); local @tables = &firewall::get_iptables_save(); local ($filter) = grep { $_->{'name'} eq 'filter' } @tables; $filter ||= { 'name' => 'filter', 'defaults' => { 'INPUT' => 'ACCEPT', 'OUTPUT' => 'ACCEPT', 'FORWARD' => 'ACCEPT' }, 'rules' => [ ], }; local $inrule = &find_rule($filter, "INPUT", $config{'iface'}, "i"); local $outrule = &find_rule($filter, "OUTPUT", $config{'iface'}, "o"); local $fwdinrule = &find_rule($filter, "FORWARD", $config{'iface'}, "i"); local $fwdoutrule = &find_rule($filter, "FORWARD", $config{'iface'}, "o"); local $missingrule = !$inrule || !$outrule || !$fwdinrule || !$fwdoutrule; if (!$inrule) { splice(@{$filter->{'rules'}}, 0, 0, { 'chain' => 'INPUT', 'j' => [ undef, 'LOG' ], 'i' => [ undef, $_[0] ], 'args' => "--log-level 7 --log-prefix BANDWIDTH_IN:" }); } if (!$outrule) { splice(@{$filter->{'rules'}}, 0, 0, { 'chain' => 'OUTPUT', 'j' => [ undef, 'LOG' ], 'o' => [ undef, $_[0] ], 'args' => "--log-level 7 --log-prefix BANDWIDTH_OUT:" }); } if (!$fwdinrule) { splice(@{$filter->{'rules'}}, 0, 0, { 'chain' => 'FORWARD', 'j' => [ undef, 'LOG' ], 'i' => [ undef, $_[0] ], 'args' => "--log-level 7 --log-prefix BANDWIDTH_IN:" }); } if (!$fwdoutrule) { splice(@{$filter->{'rules'}}, 0, 0, { 'chain' => 'FORWARD', 'j' => [ undef, 'LOG' ], 'o' => [ undef, $_[0] ], 'args' => "--log-level 7 --log-prefix BANDWIDTH_OUT:" }); } if ($missingrule) { # Save and apply &lock_file($firewall::iptables_save_file); &firewall::run_before_command(); &firewall::save_table($filter); &firewall::run_after_command(); &unlock_file($firewall::iptables_save_file); return &firewall::apply_configuration(); } return undef; } # delete_firewall_rules() # Delete firewall rules for bandwidth logging sub delete_firewall_rules { &foreign_require("firewall", "firewall-lib.pl"); &foreign_require("firewall", "firewall4-lib.pl"); local @tables = &firewall::get_iptables_save(); local ($filter) = grep { $_->{'name'} eq 'filter' } @tables; local $inrule = &find_rule($filter, "INPUT", $config{'iface'}, "i"); local $outrule = &find_rule($filter, "OUTPUT", $config{'iface'}, "o"); local $fwdinrule = &find_rule($filter, "FORWARD", $config{'iface'}, "i"); local $fwdoutrule = &find_rule($filter, "FORWARD", $config{'iface'}, "o"); local $anyrule = $inrule || $outrule || $fwdinrule || $fwdoutrule; if ($anyrule) { @{$filter->{'rules'}} = grep { $_ ne $inrule && $_ ne $outrule && $_ ne $fwdinrule && $_ ne $fwdoutrule }@{$filter->{'rules'}}; # Save and apply firewall &lock_file($firewall::iptables_save_file); &firewall::run_before_command(); &firewall::save_table($filter); &firewall::run_after_command(); &unlock_file($firewall::iptables_save_file); return &firewall::apply_configuration(); } return undef; } # process_firewall_line(line, &hours, time-now) # Process an IPtables firewall line, and returns 1 if successful sub process_firewall_line { local ($line, $hours, $time_now) = @_; my @time_now = localtime($time_now); if ($line =~ /^(\S+)\s+(\d+)\s+(\d+):(\d+):(\d+).*BANDWIDTH_(IN|OUT):(IN=.*)/) { # Found a valid line local ($mon, $day, $hr, $min, $sec) = ($1, $2, $3, $4, $5); local $dir = lc($6); local %line; local $w; foreach $w (split(/\s+/, $7)) { ($n, $v) = split(/=/, $w); if ($n) { $line{lc($n)} = $v; } } # Work out the real time local $tm = timelocal($sec, $min, $hr, $day, &month_to_number($mon), $time_now[5]); if ($tm > $time_now + 24*60*60) { # Was really last year $tm = timelocal($sec, $min, $hr, $day, &month_to_number($mon), $time_now[5]-1); } local $htm = int($tm/(60*60)); # Update the appropriate counters local $hour = &get_hour($htm); if (&indexof($hour, @$hours) < 0) { push(@$hours, $hour); } local $port; if ($line{'proto'} eq 'TCP' || $line{'proto'} eq 'UDP') { if ($dir eq "in") { $port = '_'.$line{'dpt'}.'_'.$line{'spt'}; } else { $port = '_'.$line{'spt'}.'_'.$line{'dpt'}; } } local $host = $dir eq "in" ? $line{'dst'} : $line{'src'}; local $key = $host.'_'.$line{'proto'}.$port; local ($in, $out) = split(/ /, $hour->{$key}); if ($dir eq "in") { $in += $line{'len'}; } else { $out += $line{'len'}; } $hour->{$key} = int($in)." ".int($out); return 1; } else { return 0; } } # get_firewall_loglevel() sub get_firewall_loglevel { return ( "kern.=debug" ); } ############### functions for ipfw ################# sub check_ipfw_rules { &foreign_require("ipfw", "ipfw-lib.pl"); local $rules = &ipfw::get_config(); local $rule = &find_ipfw_rule($rules, $config{'iface'}); return $rule ? 1 : 0; } # setup_ipfw_rules(iface) # Add the logging rule used for ipfw sub setup_ipfw_rules { &foreign_require("ipfw", "ipfw-lib.pl"); local $rules = &ipfw::get_config(); local $rule = &find_ipfw_rule($rules, $config{'iface'}); if (!$rule) { # Add the rule local $num = 100; if (@$rules && $rules->[0]->{'num'} < 100) { $num = int($rules->[0]->{'num'} / 2); } $rule = { 'action' => 'count', 'log' => 1, 'proto' => 'all', 'from' => 'any', 'to' => 'any', 'num' => $num, 'via' => $_[0] }; splice(@$rules, 0, 0, $rule); &ipfw::save_config($rules); # Apply config return &ipfw::apply_rules($rules); } return undef; } # delete_ipfw_rules() # Delete the logging rule used for ipfw sub delete_ipfw_rules { &foreign_require("ipfw", "ipfw-lib.pl"); local $rules = &ipfw::get_config(); local $rule = &find_ipfw_rule($rules, $config{'iface'}); if ($rule) { @$rules = grep { $_ ne $rule } @$rules; &ipfw::save_config($rules); return &ipfw::apply_rules(); } return undef; } # find_ipfw_rule(&rules, iface) sub find_ipfw_rule { local ($rule) = grep { ($_->{'action'} eq 'allow' || $_->{'action'} eq 'count') && $_->{'log'} && ($_->{'proto'} eq 'all' || $_->{'proto'} eq 'ip') && $_->{'from'} eq 'any' && $_->{'to'} eq 'any' && $_->{'via'} eq $_[1] } @{$_[0]}; return $rule; } # pre_ipfw_process() # Called before processing of the logs, to get the average packet size sub pre_ipfw_process { &foreign_require("ipfw", "ipfw-lib.pl"); local $active = &ipfw::get_config("$ipfw::config{'ipfw'} show |", \$out); local $rule = &find_ipfw_rule($active, $config{'iface'}); if ($rule && $rule->{'count1'}) { $average_packet_size = $rule->{'count2'} / $rule->{'count1'}; system("$ipfw::config{'ipfw'} zero $rule->{'num'} >/dev/null 2>&1"); } else { $average_packet_size = 1; } } # process_ipfw_line(line, &hours, time-now) # Process a BSD IPFW firewall line, and returns 1 if successful sub process_ipfw_line { local ($line, $hours, $time_now) = @_; if ($line =~ /^(\S+)\s+(\d+)\s+(\d+):(\d+):(\d+).*ipfw:\s+\S+\s+(Accept|Count)\s+(\S+)\s+(\S+)\s+(\S+)\s+(in|out)\s+via\s+(\S+)/) { # Found a valid line local ($mon, $day, $hr, $min, $sec) = ($1, $2, $3, $4, $5); local ($proto, $src, $dest, $dir, $iface) = ($7, $8, $9, $10, $11); local ($srchost, $srcport) = split(/:/, $src); local ($desthost, $destport) = split(/:/, $dest); $proto =~ s/:.*//; return undef if ($iface ne $config{'iface'}); # Work out the real time local $tm = timelocal($sec, $min, $hr, $day, &month_to_number($mon), $time_now[5]); if ($tm > $time_now + 24*60*60) { # Was really last year $tm = timelocal($sec, $min, $hr, $day, &month_to_number($mon), $time_now[5]-1); } local $htm = int($tm/(60*60)); # Update the appropriate counters local $hour = &get_hour($htm); if (&indexof($hour, @$hours) < 0) { push(@$hours, $hour); } local $port; if ($proto eq 'TCP' || $proto eq 'UDP') { if ($dir eq "in") { $port = '_'.$destport.'_'.$srcport; } else { $port = '_'.$srcport.'_'.$destport; } } local $host = $dir eq "in" ? $desthost : $srchost; local $key = $host.'_'.$proto.$port; local ($in, $out) = split(/ /, $hour->{$key}); if ($dir eq "in") { $in += $average_packet_size; } else { $out += $average_packet_size; } $hour->{$key} = int($in)." ".int($out); return 1; } else { return 0; } } # get_ipfw_loglevel() sub get_ipfw_loglevel { return ( "security.*", "kern.debug" ); } ############### functions for Shorewall ################# sub check_shorewall_rules { &foreign_require("shorewall", "shorewall-lib.pl"); local $lref = &read_file_lines("$shorewall::config{'config_dir'}/start"); local $rule1 = &find_shorewall_rule($lref, "INPUT", "-i", $config{'iface'}); local $rule2 = &find_shorewall_rule($lref, "FORWARD", "-i", $config{'iface'}); local $rule3 = &find_shorewall_rule($lref, "FORWARD", "-o", $config{'iface'}); local $rule4 = &find_shorewall_rule($lref, "OUTPUT", "-o", $config{'iface'}); return defined($rule1) && defined($rule2) && defined($rule3) && defined($rule4); } # setup_shorewall_rules(iface) # Add lines to the Shorewall start script to add logging IPtables rules sub setup_shorewall_rules { &foreign_require("shorewall", "shorewall-lib.pl"); local $lref = &read_file_lines("$shorewall::config{'config_dir'}/start"); local $rule1 = &find_shorewall_rule($lref, "INPUT", "-i", $_[0]); local $rule2 = &find_shorewall_rule($lref, "FORWARD", "-i", $_[0]); local $rule3 = &find_shorewall_rule($lref, "FORWARD", "-o", $_[0]); local $rule4 = &find_shorewall_rule($lref, "OUTPUT", "-o", $_[0]); local $gotall = defined($rule1) && defined($rule2) && defined($rule3) && defined($rule4); if (!defined($rule1)) { push(@$lref, "run_iptables -I INPUT -i $_[0] -j LOG --log-prefix BANDWIDTH_IN: --log-level debug"); } if (!defined($rule2)) { push(@$lref, "run_iptables -I FORWARD -i $_[0] -j LOG --log-prefix BANDWIDTH_IN: --log-level debug"); } if (!defined($rule3)) { push(@$lref, "run_iptables -I FORWARD -o $_[0] -j LOG --log-prefix BANDWIDTH_OUT: --log-level debug"); } if (!defined($rule4)) { push(@$lref, "run_iptables -I OUTPUT -o $_[0] -j LOG --log-prefix BANDWIDTH_OUT: --log-level debug"); } &flush_file_lines(); if (!$gotall) { # Apply config with a shorewall restart &shorewall::run_before_apply_command(); local $out = &backquote_logged("$shorewall::config{'shorewall'} restart 2>&1"); return "<pre>$out</pre>" if ($?); &shorewall::run_after_apply_command(); } return undef; } sub delete_shorewall_rules { &foreign_require("shorewall", "shorewall-lib.pl"); local $lref = &read_file_lines("$shorewall::config{'config_dir'}/start"); local $rule1 = &find_shorewall_rule($lref, "INPUT", "-i", $config{'iface'}); splice(@$lref, $rule1, 1) if (defined($rule1)); local $rule2 = &find_shorewall_rule($lref, "FORWARD", "-i", $config{'iface'}); splice(@$lref, $rule2, 1) if (defined($rule2)); local $rule3 = &find_shorewall_rule($lref, "FORWARD", "-o", $config{'iface'}); splice(@$lref, $rule3, 1) if (defined($rule3)); local $rule4 = &find_shorewall_rule($lref, "OUTPUT", "-o", $config{'iface'}); splice(@$lref, $rule4, 1) if (defined($rule4)); &flush_file_lines(); if (defined($rule1) || defined($rule2) || defined($rule3) || defined($rule4)) { # Apply config with a shorewall restart &shorewall::run_before_apply_command(); local $out = &backquote_logged("$shorewall::config{'shorewall'} restart 2>&1"); return "<pre>$out</pre>" if ($?); &shorewall::run_after_apply_command(); } return undef; } # find_shorewall_rule(&lref, chain, dir, iface) # Returns the line indexes of the shorewall start script entries that add # the extra logging IPtables rules sub find_shorewall_rule { local ($lref, $chain, $dir, $iface) = @_; local $io = $dir eq "-i" ? "BANDWIDTH_IN:" : "BANDWIDTH_OUT:"; local (@rv, $i); for($i=0; $i<@$lref; $i++) { if ($lref->[$i] =~ /^run_iptables\s+-I\s+$chain\s+$dir\s+$iface\s+-j\s+LOG\s+--log-prefix\s+$io\s+--log-level\s+debug/) { return $i; } } return undef; } # get_shorewall_loglevel() sub get_shorewall_loglevel { return ( "kern.=debug" ); } sub process_shorewall_line { return &process_firewall_line(@_); } ############### functions for ipfilter ################# sub check_ipfilter_rules { &foreign_require("ipfilter", "ipfilter-lib.pl"); local $rules = &ipfilter::get_config(); local $rule1 = &find_ipfilter_rule($rules, $config{'iface'}, "in"); local $rule2 = &find_ipfilter_rule($rules, $config{'iface'}, "out"); return $rule1 && $rule2; } # setup_ipfilter_rules(iface) # Add the logging rule used for ipfilter sub setup_ipfilter_rules { &foreign_require("ipfilter", "ipfilter-lib.pl"); local $rules = &ipfilter::get_config(); local $rule1 = &find_ipfilter_rule($rules, $_[0], "in"); local $rule2 = &find_ipfilter_rule($rules, $_[0], "out"); local $gotall = $rule1 && $rule2; if (!$rule1) { $rule1 = { 'action' => 'log', 'on' => $_[0], 'log-level' => 'local7.debug', 'dir' => 'in', 'all' => 1, 'active' => 1 }; if (@$rules) { &ipfilter::insert_rule($rule1, $rules->[0]); } else { &ipfilter::create_rule($rule1); } } if (!$rule2) { $rule2 = { 'action' => 'log', 'on' => $_[0], 'log-level' => 'local7.debug', 'dir' => 'out', 'all' => 1, 'active' => 1 }; if (@$rules) { &ipfilter::insert_rule($rule2, $rules->[0]); } else { &ipfilter::create_rule($rule2); } } if (!$gotall) { # Apply config return &ipfilter::apply_configuration(); } return undef; } # delete_ipfilter_rules() # Delete the logging rules used for ipfilter sub delete_ipfilter_rules { &foreign_require("ipfilter", "ipfilter-lib.pl"); local $rules = &ipfilter::get_config(); local $rule1 = &find_ipfilter_rule($rules, $config{'iface'}, "in"); local $rule2 = &find_ipfilter_rule($rules, $config{'iface'}, "out"); &ipfilter::delete_rule($rule1) if ($rule1); &ipfilter::delete_rule($rule2) if ($rule2); if ($rule1 || $rule2) { return &ipfilter::apply_configuration(); } return undef; } # find_ipfilter_rule(&rules, iface, dir) sub find_ipfilter_rule { local ($rule) = grep { $_->{'action'} eq 'log' && $_->{'on'} eq $_[1] && $_->{'all'} && $_->{'active'} && $_->{'log-level'} eq "local7.debug" && $_->{'dir'} eq $_[2] } @{$_[0]}; return $rule; } # process_ipfilter_line(line, &hours, time-now) # Process a IPFilter firewall line, and returns 1 if successful sub process_ipfilter_line { local ($line, $hours, $time_now) = @_; if ($line =~ /^(\S+)\s+(\d+)\s+(\d+):(\d+):(\d+).*ipmon\S*:.*\s$config{'iface'}\s+\S+\s+\S+\s+(\S+)\s+->\s+(\S+)\s+\S+\s+(\S+)\s+len\s+(\d+)\s+\(?(\d+)\)?.*(IN|OUT)/) { # Found a valid line local ($mon, $day, $hr, $min, $sec) = ($1, $2, $3, $4, $5); local ($src, $dest, $proto, $len, $dir) = ($6, $7, uc($8), $10, lc($11)); local ($srchost, $srcport) = split(/,/, $src); local ($desthost, $destport) = split(/,/, $dest); $proto =~ s/:.*//; local $len = 1024; # Work out the real time local $tm = timelocal($sec, $min, $hr, $day, &month_to_number($mon), $time_now[5]); if ($tm > $time_now + 24*60*60) { # Was really last year $tm = timelocal($sec, $min, $hr, $day, &month_to_number($mon), $time_now[5]-1); } local $htm = int($tm/(60*60)); # Update the appropriate counters local $hour = &get_hour($htm); if (&indexof($hour, @$hours) < 0) { push(@$hours, $hour); } local $port; if ($proto eq 'TCP' || $proto eq 'UDP') { if ($dir eq "in") { $port = '_'.$destport.'_'.$srcport; } else { $port = '_'.$srcport.'_'.$destport; } } local $host = $dir eq "in" ? $dest : $src; local $key = $host.'_'.$proto.$port; local ($in, $out) = split(/ /, $hour->{$key}); if ($dir eq "in") { $in += $len; } else { $out += $len; } $hour->{$key} = int($in)." ".int($out); return 1; } else { return 0; } } # get_ipfilter_loglevel() sub get_ipfilter_loglevel { return ( "local7.debug" ); } 1;
Save File
Cancel