From a19fcb824c8d443cafa42f7d826407e475f40fa8 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 9 Jul 2013 12:00:43 -0400 Subject: [PATCH] Add independent logging choices to disable logging of bogon network rules and private network rules. Add upgrade code to obey the existing behavior for users (if default block logging was disabled, so is bogon/private rule blocking). Also add a checkbox to disable the lighttpd log for people who don't want their system log spammed by lighty. --- etc/inc/filter.inc | 26 ++++++++++----- etc/inc/globals.inc | 2 +- etc/inc/system.inc | 11 +++++-- etc/inc/upgrade_config.inc | 8 +++++ usr/local/www/diag_logs_settings.php | 47 +++++++++++++++++++++++----- 5 files changed, 75 insertions(+), 19 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index da59a6a667..cbb5e79e45 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -2606,17 +2606,22 @@ EOD; /* block bogon networks */ /* http://www.cymru.com/Documents/bogon-bn-nonagg.txt */ /* file is automatically in cron every 3000 minutes */ + if(!isset($config['syslog']['nologbogons'])) + $bogonlog = "log"; + else + $bogonlog = ""; + if(isset($config['interfaces'][$on]['blockbogons'])) { $ipfrules .= << to any label "block bogon IPv4 networks from {$oc['descr']}" +block in $bogonlog quick on \${$oc['descr']} from to any label "block bogon IPv4 networks from {$oc['descr']}" EOD; if(isset($config['system']['ipv6allow'])) { $ipfrules .= << to any label "block bogon IPv6 networks from {$oc['descr']}" +block in $bogonlog quick on \${$oc['descr']} from to any label "block bogon IPv6 networks from {$oc['descr']}" EOD; } @@ -2633,17 +2638,22 @@ EOD; if($oc['ip'] && !($isbridged) && isset($oc['spoofcheck'])) $ipfrules .= filter_rules_spoofcheck_generate($on, $oc['if'], $oc['sa'], $oc['sn'], $log); /* block private networks ? */ + if(!isset($config['syslog']['nologprivatenets'])) + $privnetlog = "log"; + else + $privnetlog = ""; + if(isset($config['interfaces'][$on]['blockpriv'])) { if($isbridged == false) { $ipfrules .= << false, "crashreporterurl" => "http://crashreporter.pfsense.org/crash_reporter.php", "debug" => false, - "latest_config" => "9.6", + "latest_config" => "9.7", "nopkg_platforms" => array("cdrom"), "minimum_ram_warning" => "101", "minimum_ram_warning_text" => "128 MB", diff --git a/etc/inc/system.inc b/etc/inc/system.inc index bbf018078c..7674e14c1d 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -904,6 +904,14 @@ function system_generate_lighty_config($filename, else $fast_cgi_path = "{$g['tmp_path']}/php-fastcgi.socket"; + if(!isset($config['syslog']['nologlighttpd'])) { + $lighty_use_syslog = << diff --git a/usr/local/www/diag_logs_settings.php b/usr/local/www/diag_logs_settings.php index 42cf79ee07..ee4fdd8972 100755 --- a/usr/local/www/diag_logs_settings.php +++ b/usr/local/www/diag_logs_settings.php @@ -63,6 +63,9 @@ $pconfig['logall'] = isset($config['syslog']['logall']); $pconfig['system'] = isset($config['syslog']['system']); $pconfig['enable'] = isset($config['syslog']['enable']); $pconfig['logdefaultblock'] = !isset($config['syslog']['nologdefaultblock']); +$pconfig['logbogons'] = !isset($config['syslog']['nologbogons']); +$pconfig['logprivatenets'] = !isset($config['syslog']['nologprivatenets']); +$pconfig['loglighttpd'] = !isset($config['syslog']['nologlighttpd']); $pconfig['rawfilter'] = isset($config['syslog']['rawfilter']); $pconfig['filterdescriptions'] = $config['syslog']['filterdescriptions']; $pconfig['disablelocallogging'] = isset($config['syslog']['disablelocallogging']); @@ -115,7 +118,13 @@ if ($_POST) { $config['syslog']['disablelocallogging'] = $_POST['disablelocallogging'] ? true : false; $config['syslog']['enable'] = $_POST['enable'] ? true : false; $oldnologdefaultblock = isset($config['syslog']['nologdefaultblock']); + $oldnologbogons = isset($config['syslog']['nologbogons']); + $oldnologprivatenets = isset($config['syslog']['nologprivatenets']); + $oldnologlighttpd = isset($config['syslog']['nologlighttpd']); $config['syslog']['nologdefaultblock'] = $_POST['logdefaultblock'] ? false : true; + $config['syslog']['nologbogons'] = $_POST['logbogons'] ? false : true; + $config['syslog']['nologprivatenets'] = $_POST['logprivatenets'] ? false : true; + $config['syslog']['nologlighttpd'] = $_POST['loglighttpd'] ? false : true; $config['syslog']['rawfilter'] = $_POST['rawfilter'] ? true : false; if (is_numeric($_POST['filterdescriptions']) && $_POST['filterdescriptions'] > 0) $config['syslog']['filterdescriptions'] = $_POST['filterdescriptions']; @@ -131,12 +140,22 @@ if ($_POST) { $retval = 0; $retval = system_syslogd_start(); - if ($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock'])) + if (($oldnologdefaultblock !== isset($config['syslog']['nologdefaultblock'])) + || ($oldnologbogons !== isset($config['syslog']['nologbogons'])) + || ($oldnologprivatenets !== isset($config['syslog']['nologprivatenets']))) $retval |= filter_configure(); - filter_pflog_start(true); - $savemsg = get_std_save_message($retval); + + if ($oldnologlighttpd !== isset($config['syslog']['nologlighttpd'])) { + ob_flush(); + flush(); + log_error(gettext("webConfigurator configuration has changed. Restarting webConfigurator.")); + send_event("service restart webgui"); + $savemsg .= "
" . gettext("WebGUI process is restarting."); + } + + filter_pflog_start(true); } } @@ -253,11 +272,23 @@ function check_everything() { Log Firewall Default Blocks - > -
- + + > +
+ +
+ > +
+
+ > +
+ + + + Web Server Log + > +
+ Raw Logs