diff --git a/usr/local/www/diag_logs_filter.php b/usr/local/www/diag_logs_filter.php index 2e4045f212..960956f322 100755 --- a/usr/local/www/diag_logs_filter.php +++ b/usr/local/www/diag_logs_filter.php @@ -38,13 +38,15 @@ ##|-PRIV require("guiconfig.inc"); +require_once("filter_log.inc"); if($_GET['getrulenum'] or $_POST['getrulenum']) { if($_GET['getrulenum']) - $rulenum = escapeshellarg($_GET['getrulenum']); + $rulenum = $_GET['getrulenum']; if($_POST['getrulenum']) - $rulenum = escapeshellarg($_POST['getrulenum']); - $rule = `pfctl -vvsr | grep '@{$rulenum} '`; + $rulenum = $_POST['getrulenum']; + list($rulenum, $type) = explode(',', $rulenum); + $rule = find_rule_by_number($rulenum, $type); echo "The rule that triggered this action is:\n\n{$rule}"; exit; } @@ -58,126 +60,12 @@ if (!$nentries) if ($_POST['clear']) clear_log_file($filter_logfile); -/* format filter logs */ -function conv_clog($logfile, $tail = 50) { - global $config, $nentries, $g; - $logarr = ""; - /* make interface/port table */ - $iftable = array(); - $iflist = get_configured_interface_with_descr(); - foreach ($iflist as $if => $ifdesc) - $iftable[get_real_interface($if)] = $ifdesc; - - $sor = isset($config['syslog']['reverse']) ? "-r" : ""; - - if(isset($config['system']['usefifolog'])) - exec("/usr/sbin/fifolog_reader {$logfile} | /usr/bin/tail {$sor} -n 500", $logarr); - else - exec("/usr/sbin/clog {$logfile} | grep -v \"CLOG\" | grep -v \"\033\" | /usr/bin/tail {$sor} -n 500", $logarr); - - $filterlog = array(); - - $counter = 1; - - foreach ($logarr as $logent) { - - if($counter > $nentries) - break; - - $log_split = ""; - - - preg_match("/(\b(?:\d{1,3}\.){3}\d{1,3}(\.\w+)?)\s.*\s(\b(?:\d{1,3}\.){3}\d{1,3}(\.\w+)?)/", $logent, $log_split); - - $flent['src'] = convert_port_period_to_colon($log_split[1]); - $flent['dst'] = convert_port_period_to_colon($log_split[3]); - - preg_match("/(.*)\s.*\spf:\s.*\srule\s(.*)\(match\)\:\s(.*)\s\w+\son\s(\w+)\:\s(.*)\s>\s(.*)\:\s.*/", $logent, $log_split); - - $beforeupper = $logent; - $logent = strtoupper($logent); - - if(stristr(strtoupper($logent), "UDP") == true) - $flent['proto'] = "UDP"; - else if(stristr(strtoupper($logent), "TCP") == true) - $flent['proto'] = "TCP"; - else if(stristr(strtoupper($logent), "ICMP") == true) - $flent['proto'] = "ICMP"; - else if(stristr(strtoupper($logent), "HSRP") == true) - $flent['proto'] = "HSRP"; - else if(stristr(strtoupper($logent), "ESP") == true) - $flent['proto'] = "ESP"; - else if(stristr(strtoupper($logent), "AH") == true) - $flent['proto'] = "AH"; - else if(stristr(strtoupper($logent), "GRE") == true) - $flent['proto'] = "GRE"; - else if(stristr(strtoupper($logent), "IGMP") == true) - $flent['proto'] = "IGMP"; - else if(stristr(strtoupper($logent), "CARP") == true) - $flent['proto'] = "CARP"; - else if(stristr(strtoupper($logent), "VRRP") == true) - $flent['proto'] = "VRRP"; - else if(stristr(strtoupper($logent), "PFSYNC") == true) - $flent['proto'] = "PFSYNC"; - else if(stristr($logent, "sack") == true) - $flent['proto'] = "TCP"; - else - $flent['proto'] = "TCP"; - - $flent['time'] = $log_split[1]; - $flent['act'] = $log_split[3]; - $flent['interface'] = empty($iftable[$log_split[4]]) ? $log_split[4] : $iftable[$log_split[4]]; - - $tmp = split("/", $log_split[2]); - $flent['rulenum'] = $tmp[0]; - - $shouldadd = true; - - if(trim($flent['src']) == "") - $shouldadd = false; - if(trim($flent['dst']) == "") - $shouldadd = false; - if(trim($flent['time']) == "") - $shouldadd = false; - - if($shouldadd == true) { - $counter++; - $filterlog[] = $flent; - } else { - if($g['debug']) { - log_error("There was a error parsing rule: $beforeupper . Please report to mailing list or forum."); - } - } - - } - - return $filterlog; -} - -function convert_port_period_to_colon($addr) { - $addr_split = split("\.", $addr); - if($addr_split[4] == "") - $newvar = $addr_split[0] . "." . $addr_split[1] . "." . $addr_split[2] . "." . $addr_split[3]; - else - $newvar = $addr_split[0] . "." . $addr_split[1] . "." . $addr_split[2] . "." . $addr_split[3] . ":" . $addr_split[4]; - if($newvar == "...") - return $addr; - return $newvar; -} - -function format_ipf_ip($ipfip) { - list($ip,$port) = explode(",", $ipfip); - if (!$port) - return $ip; - - return $ip . ", port " . $port; -} - $pgtitle = array("Status","System logs","Firewall"); include("head.inc"); ?> +
@@ -201,11 +89,11 @@ include("head.inc");
+ Last firewall log entries    (switch to dynamic view) @@ -218,79 +106,37 @@ include("head.inc"); - - - - - + + + + + + + Last firewall log entries - +
- Last firewall log entries    (switch to dynamic view)
Act
- - - + ', outputrule);"> + <?php echo $filterent['act'];?>
- Last firewall log entries

-

+
- +

TCP Flags: F - FIN, S - SYN, A or . - ACK, R - RST, P - PSH, U - URG, E - ECE, C - CWR

+ diff --git a/usr/local/www/diag_logs_filter_dynamic.php b/usr/local/www/diag_logs_filter_dynamic.php index 54cb51f43c..3e4cae3a2c 100755 --- a/usr/local/www/diag_logs_filter_dynamic.php +++ b/usr/local/www/diag_logs_filter_dynamic.php @@ -38,134 +38,20 @@ ##|-PRIV require("guiconfig.inc"); +require_once("filter_log.inc"); $filter_logfile = "{$g['varlog_path']}/filter.log"; -$nentries = $config['syslog']['nentries']; -if (!$nentries) - $nentries = 50; + +/* Hardcode this. AJAX doesn't do so well with large numbers */ +$nentries = 50; /* AJAX related routines */ -handle_ajax(); +handle_ajax($nentries, $nentries + 20); if ($_POST['clear']) clear_log_file($filter_logfile); -/* format filter logs */ -function conv_clog_filter($logfile, $tail = 50) { - global $config, $nentries; - - /* make interface/port table */ - $iftable = array(); - $iflist = get_configured_interface_with_descr(false, true); - foreach ($iflist as $if => $ifdesc) - $iftable[get_real_interface($if)] = $ifdesc; - - $sor = isset($config['syslog']['reverse']) ? "-r" : ""; - - $logarr = ""; - if(isset($config['system']['usefifolog'])) - exec("/usr/sbin/fifolog_reader {$logfile} | /usr/bin/tail {$sor} -n {$tail}", $logarr); - else - exec("/usr/sbin/clog {$logfile} | grep -v \"CLOG\" | grep -v \"\033\" | /usr/bin/tail {$sor} -n {$tail}", $logarr); - - $filterlog = array(); - - $counter = 0; - - foreach ($logarr as $logent) { - - if($counter > $nentries) - break; - - $log_split = ""; - - preg_match("/(\b(?:\d{1,3}\.){3}\d{1,3}(\.\w+)?)\s.*\s(\b(?:\d{1,3}\.){3}\d{1,3}(\.\w+)?)/", $logent, $log_split); - - $flent['src'] = convert_port_period_to_colon($log_split[1]); - $flent['dst'] = convert_port_period_to_colon($log_split[3]); - - preg_match("/(.*)\s.*\spf:\s.*\srule\s(.*)\(match\)\:\s(.*)\s\w+\son\s(\w+)\:\s(.*)\s>\s(.*)\:\s.*/", $logent, $log_split); - - $beforeupper = $logent; - $logent = strtoupper($logent); - - if(stristr(strtoupper($logent), "UDP") == true) - $flent['proto'] = "UDP"; - else if(stristr(strtoupper($logent), "TCP") == true) - $flent['proto'] = "TCP"; - else if(stristr(strtoupper($logent), "ICMP") == true) - $flent['proto'] = "ICMP"; - else if(stristr(strtoupper($logent), "HSRP") == true) - $flent['proto'] = "HSRP"; - else if(stristr(strtoupper($logent), "ESP") == true) - $flent['proto'] = "ESP"; - else if(stristr(strtoupper($logent), "AH") == true) - $flent['proto'] = "AH"; - else if(stristr(strtoupper($logent), "GRE") == true) - $flent['proto'] = "GRE"; - else if(stristr(strtoupper($logent), "IGMP") == true) - $flent['proto'] = "IGMP"; - else if(stristr(strtoupper($logent), "CARP") == true) - $flent['proto'] = "CARP"; - else if(stristr(strtoupper($logent), "VRRP") == true) - $flent['proto'] = "VRRP"; - else if(stristr(strtoupper($logent), "PFSYNC") == true) - $flent['proto'] = "PFSYNC"; - else if(stristr($logent, "sack") == true) - $flent['proto'] = "TCP"; - else - $flent['proto'] = "TCP"; - - $flent['time'] = $log_split[1]; - $flent['act'] = $log_split[3]; - $flent['interface'] = empty($iftable[$log_split[4]]) ? $log_split[4] : $iftable[$log_split[4]]; - - $tmp = split("/", $log_split[2]); - $flent['rulenum'] = $tmp[0]; - - $shouldadd = true; - - if(trim($flent['src']) == "") - $shouldadd = false; - if(trim($flent['dst']) == "") - $shouldadd = false; - if(trim($flent['time']) == "") - $shouldadd = false; - - if($shouldadd == true) { - $counter++; - $filterlog[] = $flent; - } else { - if($g['debug']) { - log_error("There was a error parsing rule: $beforeupper . Please report to mailing list or forum."); - } - } - - } - - return $filterlog; -} - -function convert_port_period_to_colon($addr) { - $addr_split = split("\.", $addr); - if($addr_split[4] == "") - $newvar = $addr_split[0] . "." . $addr_split[1] . "." . $addr_split[2] . "." . $addr_split[3]; - else - $newvar = $addr_split[0] . "." . $addr_split[1] . "." . $addr_split[2] . "." . $addr_split[3] . ":" . $addr_split[4]; - if($newvar == "...") - return ""; - return $newvar; -} - -function format_ipf_ip($ipfip) { - list($ip,$port) = explode(",", $ipfip); - if (!$port) - return $ip; - - return $ip . ", port " . $port; -} - -$filterlog = conv_clog_filter($filter_logfile, $nentries); +$filterlog = conv_log_filter($filter_logfile, $nentries, $nentries + 100); $pgtitle = array("Diagnostics","System logs","Firewall"); include("head.inc"); @@ -173,6 +59,8 @@ include("head.inc"); ?> + + +
- Last records; Pause: + Last records; (Switch to regular view) Pause:
@@ -220,234 +121,27 @@ include("head.inc"); Proto
- -
> - +
> + ', outputrule);"> + <?php echo $filterent['act'];?> + + + + - - - - - - +
- +
- -"; - else if(strstr(strtolower($filterent['act']), "r")) - $img = ""; - else - $img = ""; - //echo "{$time_regex[1]} - $row_time > $lastsawtime

"; - if($row_time > $lastsawtime) - $new_rules .= "{$img}||{$log_row['time']}||{$log_row['interface']}||{$log_row['src']}||{$log_row['dst']}||{$log_row['proto']}||" . time() . "||\n"; - } - echo $new_rules; - exit; - } -} - -?> diff --git a/usr/local/www/filter_log.inc b/usr/local/www/filter_log.inc new file mode 100644 index 0000000000..aa5957b27e --- /dev/null +++ b/usr/local/www/filter_log.inc @@ -0,0 +1,226 @@ +@.org + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +/* format filter logs */ +function conv_log_filter($logfile, $nentries, $tail = 50) { + global $config, $g; + + /* Make sure this is a number before using it in a system call */ + if (!(is_numeric($tail))) + return; + + /* Always do a reverse tail, to be sure we're grabbing the 'end' of the log. */ + $logarr = ""; + + if(isset($config['system']['usefifolog'])) + exec("/usr/sbin/fifolog_reader {$logfile} | /usr/bin/tail -r -n 500", $logarr); + else + exec("/usr/sbin/clog {$logfile} | grep -v \"CLOG\" | grep -v \"\033\" | /usr/bin/tail -r -n 500", $logarr); + + $filterlog = array(); + $counter = 0; + + foreach ($logarr as $logent) { + if($counter >= $nentries) + break; + + $flent = parse_filter_line($logent); + if ($flent != "") { + $counter++; + $filterlog[] = $flent; + } + } + /* Since the lines are in reverse order, flip them around if needed based on the user's preference */ + return isset($config['syslog']['reverse']) ? $filterlog : array_reverse($filterlog); +} + +function parse_filter_line($line) { + global $config, $g; + $log_split = ""; + preg_match("/(.*)\s(.*)\spf:\s.*\srule\s(.*)\(match\)\:\s(.*)\s\w+\son\s(\w+)\:\s\((.*)\)\s(.*)\s>\s(.*)\:\s(.*)/", $line, $log_split); + + list($all, $flent['time'], $host, $rule, $flent['act'], $flent['realint'], $details, $src, $dst, $leftovers) = $log_split; + + $flent['src'] = convert_port_period_to_colon($src); + $flent['dst'] = convert_port_period_to_colon($dst); + $flent['interface'] = convert_log_interface_to_friendly_interface_name($flent['realint']); + + $tmp = split("/", $rule); + $flent['rulenum'] = $tmp[0]; + + $proto = array(" ", "(?)"); + /* Attempt to determine the protocol, based on several possible patterns. + * The value returned by strpos() must be strictly checkeded against the + * boolean FALSE because it could return a valid answer of 0 upon success. */ + if (!(strpos($details, 'proto ') === FALSE)) { + preg_match("/.*\sproto\s(.*)\s\(/", $details, $proto); + } elseif (!(strpos($details, 'proto: ') === FALSE)) { + preg_match("/.*\sproto\:(.*)\s\(/", $details, $proto); + } elseif (!(strpos($leftovers, 'sum ok] ') === FALSE)) { + preg_match("/.*\ssum ok]\s(.*)\,\s.*/", $leftovers, $proto); + } elseif (!(strpos($line, 'sum ok] ') === FALSE)) { + preg_match("/.*\ssum ok]\s(.*)\,\s.*/", $line, $proto); + } + $proto = split(" ", trim($proto[1])); + $flent['proto'] = rtrim($proto[0], ","); + + /* If we're dealing with TCP, try to determine the flags/control bits */ + $flent['tcpflags'] = ""; + if ($flent['proto'] == "TCP") { + $flags = split('[\, ]', $leftovers); + $flent['tcpflags'] = $flags[0]; + if ($flent['tcpflags'] == ".") + $flent['tcpflags'] = "A"; + } + + /* If there is a src, a dst, and a time, then the line should be usable/good */ + if (!((trim($flent['src']) == "") || (trim($flent['dst']) == "") || (trim($flent['time']) == ""))) { + return $flent; + } else { + if($g['debug']) { + log_error("There was a error parsing rule: $errline. Please report to mailing list or forum."); + } + return ""; + } +} + +function convert_log_interface_to_friendly_interface_name($int) { + global $config; + + $iflist = get_configured_interface_with_descr(); + foreach ($iflist as $if => $ifdesc) + $iftable[get_real_interface($if)] = $ifdesc; + + /* Check for WAN first, pppoe (ng0) doesn't return properly otherwise */ + if ($int == get_real_wan_interface($int)) + $int = 'wan'; + else + $int = empty($iftable[$int]) ? $int : $iftable[$int]; + + return $int; +} + +function convert_port_period_to_colon($addr) { + if (substr_count($addr, '.') > 1) { + /* IPv4 - Change the port delimiter to : */ + $addr_split = split("\.", $addr); + if($addr_split[4] == "") { + $newvar = "{$addr_split[0]}.{$addr_split[1]}.{$addr_split[2]}.{$addr_split[3]}"; + $newvar = rtrim($newvar, ":"); + } else { + $port_split = split("\:", $addr_split[4]); + $newvar = "{$addr_split[0]}.{$addr_split[1]}.{$addr_split[2]}.{$addr_split[3]}:{$port_split[0]}"; + $newvar = rtrim($newvar, ":"); + } + if($newvar == "...") + return $addr; + return $newvar; + } else { + /* IPv6 - Leave it alone */ + $addr = split(" ", $addr); + return rtrim($addr[0], ":"); + } +} + +function find_rule_by_number($rulenum, $type="rules") { + /* Passing arbitrary input to grep could be a Very Bad Thing(tm) */ + if (!(is_numeric($rulenum))) + return; + /* At the moment, miniupnpd is the only thing I know of that + generates logging rdr rules */ + if ($type == "rdr") + return `pfctl -vvsn -a "miniupnpd" | grep '^@{$rulenum} '`; + else + return `pfctl -vvsr | grep '^@{$rulenum} '`; +} + +function find_action_image($action) { + global $g; + if ((strstr(strtolower($action), "p")) || (strtolower($action) == "rdr")) + return "/themes/{$g['theme']}/images/icons/icon_pass.gif"; + else if(strstr(strtolower($action), "r")) + return "/themes/{$g['theme']}/images/icons/icon_reject.gif"; + else + return "/themes/{$g['theme']}/images/icons/icon_block.gif"; +} + +function is_first_row($rownum, $totalrows) { + global $config; + if(isset($config['syslog']['reverse'])) { + /* Honor reverse logging setting */ + if($rownum == 0) + return " id=\"firstrow\""; + } else { + /* non-reverse logging */ + if($rownum == $totalrows - 1) + return " id=\"firstrow\""; + } + return ""; +} + +/* AJAX specific handlers */ +function handle_ajax($nentries, $tail = 50) { + global $config; + if($_GET['lastsawtime'] or $_POST['lastsawtime']) { + global $filter_logfile,$filterent; + if($_GET['lastsawtime']) + $lastsawtime = $_GET['lastsawtime']; + if($_POST['lastsawtime']) + $lastsawtime = $_POST['lastsawtime']; + /* compare lastsawrule's time stamp to filter logs. + * afterwards return the newer records so that client + * can update AJAX interface screen. + */ + $new_rules = ""; + $filterlog = conv_log_filter($filter_logfile, $nentries, $tail); + /* We need this to always be in forward order for the AJAX update to work properly */ + $filterlog = isset($config['syslog']['reverse']) ? array_reverse($filterlog) : $filterlog; + foreach($filterlog as $log_row) { + $time_regex = ""; + preg_match("/.*([0-9][0-9]:[0-9][0-9]:[0-9][0-9])/", $log_row['time'], $time_regex); + $row_time = strtotime($time_regex[1]); + $img = "{$log_row['act']}"; + //echo "{$time_regex[1]} - $row_time > $lastsawtime

"; + if($row_time > $lastsawtime) { + if ($log_row['proto'] == "TCP") + $log_row['proto'] .= ":{$log_row['tcpflags']}"; + + $img = "{$img}"; + $new_rules .= "{$img}||{$log_row['time']}||{$log_row['interface']}||{$log_row['src']}||{$log_row['dst']}||{$log_row['proto']}||" . time() . "||\n"; + } + } + echo $new_rules; + exit; + } +} + +?> diff --git a/usr/local/www/filterparser.php b/usr/local/www/filterparser.php new file mode 100644 index 0000000000..e352746e80 --- /dev/null +++ b/usr/local/www/filterparser.php @@ -0,0 +1,59 @@ +#!/usr/local/bin/php -q +@.org + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + A quick CLI log parser. + Examples: + clog /var/log/filter.log | tail -50 | /usr/local/www/filterparser.php + clog -f /var/log/filter.log | /usr/local/www/filterparser.php +*/ +include_once("filter_log.inc"); +include_once("interfaces.inc"); + +$log = fopen("php://stdin", "r"); +while(!feof($log)) { + $line = fgets($log); + $flent = parse_filter_line(trim($line)); + /* Available fields: + time - Time the packet was seen + rulenum - Rule number matched + act - Action (pass/block) + interface - Friendly interface name (WAN, LAN, etc) + realint - Real interface name (fxp0, em0, vr0, etc) + proto - Protocol (e.g. TCP, UDP, ICMP, etc) + tcpflags - TCP flags/control bits + src - Source address with port + dst - Destination address with port + */ + if ($flent != "") + echo "{$flent['time']} {$flent['act']} {$flent['realint']} {$flent['proto']} {$flent['src']} {$flent['dst']}\n"; +} +fclose($log); ?> \ No newline at end of file diff --git a/usr/local/www/widgets/javascript/log.js b/usr/local/www/javascript/filter_log.js similarity index 65% rename from usr/local/www/widgets/javascript/log.js rename to usr/local/www/javascript/filter_log.js index 45288822a7..b34d7f1f57 100644 --- a/usr/local/www/widgets/javascript/log.js +++ b/usr/local/www/javascript/filter_log.js @@ -1,18 +1,4 @@ -lastsawtime = ';'; -var lines = Array(); -var timer; -var updateDelay = 30000; -var isBusy = false; -var isPaused = true; - - - if (typeof getURL == 'undefined') { getURL = function(url, callback) { if (!url) @@ -74,20 +60,13 @@ function fetch_new_rules_callback(callback_data) { for(var x=0; x'; - line += ' ' + row_split[2] + ''; - line += ' ' + row_split[3] + ''; - line += ' ' + row_split[4] + ''; - line += ' ' + row_split[5] + ''; - line += ''; lastsawtime = row_split[6]; - new_data_to_add[new_data_to_add.length] = line; + new_data_to_add[new_data_to_add.length] = format_log_line(row_split); } update_div_rows(new_data_to_add); isBusy = false; } + function update_div_rows(data) { if(isPaused) return; @@ -101,29 +80,32 @@ function update_div_rows(data) { if (isIE) { showanim = 0; } - //alert(data.length); + + var startat = data.length - nentries; + if (startat < 0) { + startat = 0; + } + data = data.slice(startat, data.length); + for(var x=0; x 0; i--) { nextrecord = i + 1; if(nextrecord < numrows) rows[nextrecord].innerHTML = rows[i].innerHTML; } - appearatrow = 1; - //} + } var item = document.getElementById('firstrow'); if(x == data.length-1) { /* nothing */ @@ -132,15 +114,13 @@ function update_div_rows(data) { showanim = false; } if (showanim) { - rows[appearatrow].style.display = 'none'; - rows[appearatrow].innerHTML = data[x]; - new Effect.Appear(rows[appearatrow]); + item.style.display = 'none'; + item.innerHTML = data[x]; + new Effect.Appear(item); } else { - rows[appearatrow].innerHTML = data[x]; + item.innerHTML = data[x]; } } - /* rechedule AJAX interval */ - timer = setInterval('fetch_new_rules()', updateDelay); } function toggle_pause() { if(isPaused) { @@ -151,5 +131,4 @@ function toggle_pause() { } } /* start local AJAX engine */ -lastsawtime = ';'; timer = setInterval('fetch_new_rules()', updateDelay); diff --git a/usr/local/www/widgets/include/log.inc b/usr/local/www/widgets/include/log.inc deleted file mode 100644 index 08d420507c..0000000000 --- a/usr/local/www/widgets/include/log.inc +++ /dev/null @@ -1,170 +0,0 @@ - $ifdesc) - $iftable[get_real_interface($ifl)] = $ifdesc; - - $sor = isset($config['syslog']['reverse']) ? "-r" : ""; - - exec("/usr/sbin/fifolog_reader {$logfile} | /usr/bin/tail {$sor} -n 500", $logarr); - - $filterlog = array(); - - $counter = 1; - - foreach ($logarr as $logent) { - - if($counter > $nentries) - break; - - $log_split = ""; - - - preg_match("/(\b(?:\d{1,3}\.){3}\d{1,3}(\.\w+)?)\s.*\s(\b(?:\d{1,3}\.){3}\d{1,3}(\.\w+)?)/", $logent, $log_split); - - $flent['src'] = convert_port_period_to_colon($log_split[1]); - $flent['dst'] = convert_port_period_to_colon($log_split[3]); - - preg_match("/(.*)\s.*\spf:\s.*\srule\s(.*)\(match\)\:\s(.*)\s\w+\son\s(\w+)\:\s(.*)\s>\s(.*)\:\s.*/", $logent, $log_split); - - $beforeupper = $logent; - $logent = strtoupper($logent); - - if(stristr(strtoupper($logent), "UDP") == true) - $flent['proto'] = "UDP"; - else if(stristr(strtoupper($logent), "TCP") == true) - $flent['proto'] = "TCP"; - else if(stristr(strtoupper($logent), "ICMP") == true) - $flent['proto'] = "ICMP"; - else if(stristr(strtoupper($logent), "HSRP") == true) - $flent['proto'] = "HSRP"; - else if(stristr(strtoupper($logent), "ESP") == true) - $flent['proto'] = "ESP"; - else if(stristr(strtoupper($logent), "AH") == true) - $flent['proto'] = "AH"; - else if(stristr(strtoupper($logent), "GRE") == true) - $flent['proto'] = "GRE"; - else if(stristr(strtoupper($logent), "IGMP") == true) - $flent['proto'] = "IGMP"; - else if(stristr(strtoupper($logent), "CARP") == true) - $flent['proto'] = "CARP"; - else if(stristr(strtoupper($logent), "VRRP") == true) - $flent['proto'] = "VRRP"; - else if(stristr(strtoupper($logent), "PFSYNC") == true) - $flent['proto'] = "PFSYNC"; - else if(stristr($logent, "sack") == true) - $flent['proto'] = "TCP"; - else - $flent['proto'] = "TCP"; - - $flent['time'] = $log_split[1]; - $flent['act'] = $log_split[3]; - $flent['interface'] = empty($iftable[$log_split[4]]) ? $log_split[4] : $iftable[$log_split[4]]; - - $tmp = split("/", $log_split[2]); - $flent['rulenum'] = $tmp[0]; - - $shouldadd = true; - - if(trim($flent['src']) == "") - $shouldadd = false; - if(trim($flent['dst']) == "") - $shouldadd = false; - if(trim($flent['time']) == "") - $shouldadd = false; - - if($shouldadd == true) { - $counter++; - $filterlog[] = $flent; - } else { - if($g['debug']) { - log_error("There was a error parsing rule: $beforeupper . Please report to mailing list or forum."); - } - } - - } - - return $filterlog; -} - -function convert_port_period_to_colon($addr) { - $addr_split = split("\.", $addr); - if($addr_split[4] == "") - $newvar = $addr_split[0] . "." . $addr_split[1] . "." . $addr_split[2] . "." . $addr_split[3]; - else - $newvar = $addr_split[0] . "." . $addr_split[1] . "." . $addr_split[2] . "." . $addr_split[3] . ":" . $addr_split[4]; - if($newvar == "...") - return $addr; - return $newvar; -} - -function format_ipf_ip($ipfip) { - list($ip,$port) = explode(",", $ipfip); - if (!$port) - return $ip; - - return $ip . ", port " . $port; -} - -/* AJAX specific handlers */ -function handle_ajax() { - if($_GET['getrulenum'] or $_POST['getrulenum']) { - if($_GET['getrulenum']) - $rulenum = $_GET['getrulenum']; - if($_POST['getrulenum']) - $rulenum = $_POST['getrulenum']; - $rule = `pfctl -vvsr | grep @{$rulenum}`; - echo "The rule that triggered this action is:\n\n{$rule}"; - exit; - } - - if($_GET['lastsawtime'] or $_POST['lastsawtime']) { - global $filter_logfile,$filterent; - if($_GET['lastsawtime']) - $lastsawtime = $_GET['lastsawtime']; - if($_POST['lastsawtime']) - $lastsawtime = $_POST['lastsawtime']; - /* compare lastsawrule's time stamp to filter logs. - * afterwards return the newer records so that client - * can update AJAX interface screen. - */ - $new_rules = ""; - $filterlog = conv_clog_filter($filter_logfile, 8); - foreach($filterlog as $log_row) { - $time_regex = ""; - preg_match("/.*([0-9][0-9]:[0-9][0-9]:[0-9][0-9])/", $log_row['time'], $time_regex); - $row_time = strtotime($time_regex[1]); - if (strstr(strtolower($log_row['act']), "p")) - $img = ""; - else if(strstr(strtolower($filterent['act']), "r")) - $img = ""; - else - $img = ""; - //echo "{$time_regex[1]} - $row_time > $lastsawtime

"; - if($row_time > $lastsawtime) - $new_rules .= "{$img}||{$log_row['time']}||{$log_row['interface']}||{$log_row['src']}||{$log_row['dst']}||{$log_row['proto']}||" . time() . "||\n"; - } - echo $new_rules; - exit; - } -} -?> diff --git a/usr/local/www/widgets/widgets/log.widget.php b/usr/local/www/widgets/widgets/log.widget.php index 521cd0508a..45335484bf 100644 --- a/usr/local/www/widgets/widgets/log.widget.php +++ b/usr/local/www/widgets/widgets/log.widget.php @@ -34,9 +34,73 @@ require_once("guiconfig.inc"); require_once("pfsense-utils.inc"); require_once("functions.inc"); -require_once("/usr/local/www/widgets/include/log.inc"); + +/* In an effort to reduce duplicate code, many shared functions have been moved here. */ +require_once("filter_log.inc"); + +//set variable for custom title +$log_title = "Firewall Logs"; +$log_title_link = "diag_logs_filter.php"; + +if($_POST['filterlogentries']) { + $config['widgets']['filterlogentries'] = $_POST['filterlogentries']; + write_config("Saved Filter Log Entries via Dashboard"); + Header("Location: /"); +} + +$nentries = isset($config['widgets']['filterlogentries']) ? $config['widgets']['filterlogentries'] : 5; + +//set variables for log +$filter_logfile = "{$g['varlog_path']}/filter.log"; +$filterlog = conv_log_filter($filter_logfile, $nentries); + +/* AJAX related routines */ +handle_ajax($nentries, $nentries + 20); + ?> + + + + +

+
Act IF @@ -45,36 +109,23 @@ require_once("/usr/local/www/widgets/include/log.inc"); Prot
- -
style="clear:both;"> +
style="clear:both;"> +  ', outputrule);"><?php echo $filterent['act'];?>  +   +   +   -    -   -   -   -   +  
- \ No newline at end of file + + + +