mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add independent logging choices to disable logging of bogon network rules and private network rules. Add upgrade code to obey the existing behavior for users (if default block logging was disabled, so is bogon/private rule blocking). Also add a checkbox to disable the lighttpd log for people who don't want their system log spammed by lighty.

Browse Source
This commit is contained in:
jim-p 2013-07-09 12:00:43 -04:00
parent e7bc770e1a
commit a19fcb824c
5 changed files with 75 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
etc/inc/filter.inc
View File

@ -2606,17 +2606,22 @@ EOD;
/* block bogon networks */
/* http://www.cymru.com/Documents/bogon-bn-nonagg.txt */
/* file is automatically in cron every 3000 minutes */
if(!isset($config['syslog']['nologbogons']))
$bogonlog = "log";
else
$bogonlog = "";
if(isset($config['interfaces'][$on]['blockbogons'])) {
$ipfrules .= <<<EOD
# block bogon networks
# http://www.cymru.com/Documents/bogon-bn-nonagg.txt
# http://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt
block in $log quick on \${$oc['descr']} from <bogons> to any label "block bogon IPv4 networks from {$oc['descr']}"
block in $bogonlog quick on \${$oc['descr']} from <bogons> to any label "block bogon IPv4 networks from {$oc['descr']}"
EOD;
if(isset($config['system']['ipv6allow'])) {
$ipfrules .= <<<EOD
block in $log quick on \${$oc['descr']} from <bogonsv6> to any label "block bogon IPv6 networks from {$oc['descr']}"
block in $bogonlog quick on \${$oc['descr']} from <bogonsv6> to any label "block bogon IPv6 networks from {$oc['descr']}"
EOD;
}
@ -2633,17 +2638,22 @@ EOD;
if($oc['ip'] && !($isbridged) && isset($oc['spoofcheck']))
$ipfrules .= filter_rules_spoofcheck_generate($on, $oc['if'], $oc['sa'], $oc['sn'], $log);
/* block private networks ? */
if(!isset($config['syslog']['nologprivatenets']))
$privnetlog = "log";
else
$privnetlog = "";
if(isset($config['interfaces'][$on]['blockpriv'])) {
if($isbridged == false) {
$ipfrules .= <<<EOD
# block anything from private networks on interfaces with the option set
antispoof for \${$oc['descr']}
block in $log quick on \${$oc['descr']} from 10.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 10/8"
block in $log quick on \${$oc['descr']} from 127.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 127/8"
block in $log quick on \${$oc['descr']} from 100.64.0.0/10 to any label "Block private networks from {$oc['descr']} block 100.64/10"
block in $log quick on \${$oc['descr']} from 172.16.0.0/12 to any label "Block private networks from {$oc['descr']} block 172.16/12"
block in $log quick on \${$oc['descr']} from 192.168.0.0/16 to any label "Block private networks from {$oc['descr']} block 192.168/16"
block in $log quick on \${$oc['descr']} from fc00::/7 to any label "Block ULA networks from {$oc['descr']} block fc00::/7"
block in $privnetlog quick on \${$oc['descr']} from 10.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 10/8"
block in $privnetlog quick on \${$oc['descr']} from 127.0.0.0/8 to any label "Block private networks from {$oc['descr']} block 127/8"
block in $privnetlog quick on \${$oc['descr']} from 100.64.0.0/10 to any label "Block private networks from {$oc['descr']} block 100.64/10"
block in $privnetlog quick on \${$oc['descr']} from 172.16.0.0/12 to any label "Block private networks from {$oc['descr']} block 172.16/12"
block in $privnetlog quick on \${$oc['descr']} from 192.168.0.0/16 to any label "Block private networks from {$oc['descr']} block 192.168/16"
block in $privnetlog quick on \${$oc['descr']} from fc00::/7 to any label "Block ULA networks from {$oc['descr']} block fc00::/7"
EOD;
}

2
etc/inc/globals.inc
View File

@ -71,7 +71,7 @@ $g = array(
"disablecrashreporter" => false,
"crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php",
"debug" => false,
"latest_config" => "9.6",
"latest_config" => "9.7",
"nopkg_platforms" => array("cdrom"),
"minimum_ram_warning" => "101",
"minimum_ram_warning_text" => "128 MB",

11
etc/inc/system.inc
View File

@ -904,6 +904,14 @@ function system_generate_lighty_config($filename,
else
$fast_cgi_path = "{$g['tmp_path']}/php-fastcgi.socket";
if(!isset($config['syslog']['nologlighttpd'])) {
$lighty_use_syslog = <<<EOD
## where to send error-messages to
server.errorlog-use-syslog="enable"
EOD;
}
$fastcgi_config = <<<EOD
#### fastcgi module
## read fastcgi.txt for more info
@ -952,8 +960,7 @@ server.document-root = "{$document_root}"
# Maximum idle time with nothing being written (php downloading)
server.max-write-idle = 999
## where to send error-messages to
server.errorlog-use-syslog="enable"
{$lighty_use_syslog}
# files to check for if .../ is requested
server.indexfiles = ( "index.php", "index.html",

8
etc/inc/upgrade_config.inc
View File

@ -3111,4 +3111,12 @@ function upgrade_095_to_096() {
enable_rrd_graphing();
}
function upgrade_096_to_097() {
global $config, $g;
/* If the user had disabled default block rule logging before, then bogon/private network logging was already off, so respect their choice. */
if (isset($config['syslog']['nologdefaultblock'])) {
$config['syslog']['nologbogons'] = true;
$config['syslog']['nologprivatenets'] = true;
}
}
?>

47
usr/local/www/diag_logs_settings.php
View File

@ -63,6 +63,9 @@ $pconfig['logall'] = isset($config['syslog']['logall']);
$pconfig['system'] = isset($config['syslog']['system']);
$pconfig['enable'] = isset($config['syslog']['enable']);
$pconfig['logdefaultblock'] = !isset($config['syslog']['nologdefaultblock']);
$pconfig['logbogons'] = !isset($config['syslog']['nologbogons']);
$pconfig['logprivatenets'] = !isset($config['syslog']['nologprivatenets']);
$pconfig['loglighttpd'] = !isset($config['syslog']['nologlighttpd']);
$pconfig['rawfilter'] = isset($config['syslog']['rawfilter']);
$pconfig['filterdescriptions'] = $config['syslog']['filterdescriptions'];
$pconfig['disablelocallogging'] = isset($config['syslog']['disablelocallogging']);
@ -115,7 +118,13 @@ if ($_POST) {
$config['syslog']['disablelocallogging'] = $_POST['disablelocallogging'] ? true : false;
$config['syslog']['enable'] = $_POST['enable'] ? true : false;
$oldnologdefaultblock = isset($config['syslog']['nologdefaultblock']);
$oldnologbogons = isset($config['syslog']['nologbogons']);
$oldnologprivatenets = isset($config['syslog']['nologprivatenets']);
$oldnologlighttpd = isset($config['syslog']['nologlighttpd']);
$config['syslog']['nologdefaultblock'] = $_POST['logdefaultblock'] ? false : true;
$config['syslog']['nologbogons'] = $_POST['logbogons'] ? false : true;
$config['syslog']['nologprivatenets'] = $_POST['logprivatenets'] ? false : true;
$config['syslog']['nologlighttpd'] = $_POST['loglighttpd'] ? false : true;
$config['syslog']['rawfilter'] = $_POST['rawfilter'] ? true : false;
if (is_numeric($_POST['filterdescriptions']) && $_POST['filterdescriptions'] > 0)
$config['syslog']['filterdescriptions'] = $_POST['filterdescriptions'];
@ -131,12 +140,22 @@ if ($_POST) {
$retval = 0;
$retval = system_syslogd_start();
if ($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock']))
if (($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock']))
|| ($oldnologbogons !== isset($config['syslog']['nologbogons']))
|| ($oldnologprivatenets !== isset($config['syslog']['nologprivatenets'])))
$retval |= filter_configure();
filter_pflog_start(true);
$savemsg = get_std_save_message($retval);
if ($oldnologlighttpd !== isset($config['syslog']['nologlighttpd'])) {
ob_flush();
flush();
log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator."));
send_event("service restart webgui");
$savemsg .= "<br />" . gettext("WebGUI process is restarting.");
}
filter_pflog_start(true);
}
}
@ -253,11 +272,23 @@ function check_everything() {
</tr>
<tr>
<td valign="top" class="vtable">Log Firewall Default Blocks</td>
<td class="vtable"> <input name="logdefaultblock" type="checkbox" id="logdefaultblock" value="yes" <?php if ($pconfig['logdefaultblock']) echo "checked"; ?>>
<strong><?=gettext("Log packets blocked by the default rule");?></strong><br>
<?=gettext("Hint: packets that are blocked by the " .
"implicit default block rule will not be logged " .
"if you uncheck this option. Per-rule logging options are still respected.");?></td>
<td class="vtable">
<input name="logdefaultblock" type="checkbox" id="logdefaultblock" value="yes" <?php if ($pconfig['logdefaultblock']) echo "checked"; ?>>
<strong><?=gettext("Log packets blocked by the default rule");?></strong><br/>
<?=gettext("Hint: packets that are blocked by the implicit default block rule will not be logged if you uncheck this option. Per-rule logging options are still respected.");?>
<br/>
<input name="logbogons" type="checkbox" id="logbogons" value="yes" <?php if ($pconfig['logbogons']) echo "checked"; ?>>
<strong><?=gettext("Log packets blocked by 'Block Bogon Networks' rules");?></strong><br/>
<br/>
<input name="logprivatenets" type="checkbox" id="logprivatenets" value="yes" <?php if ($pconfig['logprivatenets']) echo "checked"; ?>>
<strong><?=gettext("Log packets blocked by 'Block Private Networks' rules");?></strong><br/>
</td>
</tr>
<tr>
<td valign="top" class="vtable">Web Server Log</td>
<td class="vtable"> <input name="loglighttpd" type="checkbox" id="loglighttpd" value="yes" <?php if ($pconfig['loglighttpd']) echo "checked"; ?>>
<strong><?=gettext("Log errors from the web server process.");?></strong><br>
<?=gettext("Hint: If this is checked, errors from the lighttpd web server process for the GUI or Captive Portal will appear in the main system log.");?></td>
</tr>
<tr>
<td valign="top" class="vtable">Raw Logs</td>