WebSVN – ALCASAR – Path Comparison – /

Ignore whitespace Rev 858 → Rev 859

 /conf/sudoers
 ,7 → 19,7
 Cmnd_Alias      SQL=/usr/local/sbin/alcasar-mysql.sh                                                    # pour exporter la base mysql
 Cmnd_Alias      SYSTEM_BACKUP=/usr/local/bin/alcasar-conf.sh                                            # pour générer l'archive de configuration du serveur
 Cmnd_Alias      EXPORT=/usr/local/bin/alcasar-log-export.sh                                             # pour exporter/sauvegarder les fichiers journaux
-Cmnd_Alias      BL=/usr/local/sbin/alcasar-bl.sh,/usr/local/sbin/alcasar-havp.sh                        # pour gérer le filtrage WEB (blacklists, whitelist et antivirus)
+Cmnd_Alias      BL=/usr/local/sbin/alcasar-bl.sh,/usr/local/sbin/alcasar-havp.sh,/usr/local/bin/alcasar-file-clean.sh           # pour gérer le filtrage WEB (blacklists, whitelist et antivirus)
 Cmnd_Alias      NF=/usr/local/sbin/alcasar-nf.sh,/usr/local/bin/alcasar-iptables.sh                     # pour gérer le filtrage réseau
 Cmnd_Alias      LOGOUT=/usr/local/sbin/alcasar-logout.sh                                                # pour déconnecter les usagers
 Cmnd_Alias      UAM=/usr/local/sbin/alcasar-uamallowed.sh                                               # pour gérer les site de confiance (uamallowed)

 /scripts/alcasar-iptables.sh
 ,8 → 27,6
 DNSSERVERS="$dns1,$dns2"                                                # first and second DNS IP servers addresses
 PROTOCOLS_FILTERING=`grep PROTOCOLS_FILTERING= $conf_file|cut -d"=" -f2`        # Network protocols filter (on/off)
 PROTOCOLS_FILTERING=${PROTOCOLS_FILTERING:=off}
-EXT_LAN_FILTERING=`grep EXT_LAN_FILTERING= $conf_file|cut -d"=" -f2`    # filter acces to the lan on alcasar/eth0 (on/off)
-EXT_LAN_FILTERING=${EXT_LAN_FILTERING:=off}
 DNS_FILTERING=`grep DNS_FILTERING= $conf_file|cut -d"=" -f2`            # DNS and URLs filter (on/off)
 DNS_FILTERING=${DNS_FILTERING:=off}
 QOS=`grep QOS= $conf_file|cut -d"=" -f2`                                # QOS (on/off)
 ,18 → 114,6
 # accept all on loopback
 $IPTABLES -A INPUT -i lo -j ACCEPT
-# Insertion de règles de blocage (Devel)
-# Here, we add block rules (Devel)
-if [ -s /usr/local/etc/alcasar-iptables-block ]; then
-    while read ip_blocked
-    do
-      echo "Network Address blocked : $ip_blocked"
-      $IPTABLES -A FORWARD -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
-      $IPTABLES -A FORWARD -d $ip_blocked -j REJECT
-      $IPTABLES -A FORWARD -s $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
-      $IPTABLES -A FORWARD -s $ip_blocked -j REJECT
-    done < /usr/local/etc/alcasar-iptables-block
-fi
 # Rejet des demandes de connexions non conformes (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 # Drop non standard connexions (FIN-URG-PUSH, XMAS, NullScan, SYN-RST et NEW not SYN)
 ,15 → 135,23
 # Deny direct connections on DansGuardian port (8080). The concerned paquets are marked in mangle table (PREROUTING)
 $IPTABLES -A INPUT -i $TUNIF -p tcp --dport 8080 -m mark --mark 1 -j REJECT --reject-with tcp-reset
-# Filtrage de l'accès au LAN connecté sur EXTIF (eth0)
-# EXTIF (eth0) connected LAN filtering
-if [ $EXT_LAN_FILTERING = on ]; then
-$IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK ! -d $public_ip_mask -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
-else
+# Insertion des règles de blocage IP
+# Here, we add IP block rules
+if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
+        while read ip_line
+        do
+                ip_on=`echo $ip_line|cut -b1`
+                if [ $ip_on != "#" ]
+                then
+                        ip_blocked=`echo $ip_line|cut -d" " -f1`
+                        $IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
+                        $IPTABLES -A INPUT -i $TUNIF -d $ip_blocked -p tcp --dport 8080 -m state --state NEW --syn -j REJECT
+                fi
+        done < /usr/local/etc/alcasar-ip-blocked
+fi
 # Autorisation des connexions légitimes à DansGuardian
 # Allow connections for DansGuardian
 $IPTABLES -A INPUT -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport 8080 -m state --state NEW --syn -j ACCEPT
-fi
 # On interdit les connexions directes au port UDP 54. Les packets concernés ont été marqués dans la table mangle (PREROUTING)
 # Deny direct connections on UDP 54. The concerned paquets are marked in mangle table (PREROUTING)
 ,13 → 210,23
 $IPTABLES -A FORWARD -i $TUNIF -p udp --dport domain -j REJECT --reject-with icmp-port-unreachable
 $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport domain -j REJECT --reject-with tcp-reset
-# Filtrage de l'accès au LAN connecté sur EXTIF (eth0)
-# EXTIF (eth0) connected LAN filtering
-if [ $EXT_LAN_FILTERING = on ]; then
-$IPTABLES -A FORWARD -i $TUNIF -p udp -d $public_ip_mask -j REJECT --reject-with icmp-port-unreachable
-$IPTABLES -A FORWARD -i $TUNIF -p icmp -d $public_ip_mask -j REJECT --reject-with icmp-port-unreachable
-$IPTABLES -A FORWARD -i $TUNIF -p tcp -d $public_ip_mask -j REJECT --reject-with tcp-reset
+# Insertion des règles de blocage IP
+# Here, we add IP block rules
+if [ -s /usr/local/etc/alcasar-ip-blocked ]; then
+        while read ip_line
+        do
+                ip_on=`echo $ip_line|cut -b1`
+                if [ $ip_on != "#" ]
+                then
+                        ip_blocked=`echo $ip_line|cut -d" " -f1`
+                        $IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -j ULOG --ulog-prefix "RULE IP-blocked -- REJECT "
+                        $IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p udp -j REJECT --reject-with icmp-port-unreachable
+                        $IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p icmp -j REJECT --reject-with icmp-port-unreachable
+                        $IPTABLES -A FORWARD -i $TUNIF -d $ip_blocked -p tcp -j REJECT --reject-with tcp-reset
+                fi
+        done < /usr/local/etc/alcasar-ip-blocked
 fi
 # Autorisation des retours de connexions légitimes
 # Allow conntrack
 $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 ,12 → 265,12
                         svc_port=`echo $svc_line|cut -d" " -f2`
                         if [ $svc_name = "icmp" ]
                         then
-                                $IPTABLES -A FORWARD -i $TUNIF -p icmp -j ACCEPT
+                                $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p icmp -j ACCEPT
                         else
-                                $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
-                                $IPTABLES -A FORWARD -i $TUNIF -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
-                                $IPTABLES -A FORWARD -i $TUNIF -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
-                                $IPTABLES -A FORWARD -i $TUNIF -p udp --dport $svc_port -m state --state NEW -j ACCEPT
+                                $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_TCP-$svc_name -- ACCEPT "
+                                $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p tcp --dport $svc_port -m state --state NEW -j ACCEPT
+                                $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ULOG --ulog-prefix "RULE F_UDP-$svc_name -- ACCEPT "
+                                $IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -p udp --dport $svc_port -m state --state NEW -j ACCEPT
                         fi
                 fi
         done < /usr/local/etc/alcasar-services
 ,8 → 289,8
 # Autorisation des connections sortant du LAN
 # Allow forward connections with log
-$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
-$IPTABLES -A FORWARD -i $TUNIF -m state --state NEW -j ACCEPT
+$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ULOG --ulog-prefix "RULE F_all -- ACCEPT "
+$IPTABLES -A FORWARD -i $TUNIF -s $PRIVATE_NETWORK_MASK -m state --state NEW -j ACCEPT
 #############################
 #         OUTPUT            #

 /scripts/sbin/alcasar-nf.sh
 ,7 → 2,7
 # $Id$
 # alcasar-nf.sh
-# by Richard REY
+# by Rexy
 # This script is distributed under the Gnu General Public License (GPL)
 # active ou desactive le filtrage de protocoles réseau
 ,16 → 9,14
 # enable or disable the network protocols filter
 SED="/bin/sed -i"
-FIC_SERVICES="/usr/local/etc/alcasar-services"
-FIC_EXCEPTIONS="/usr/local/etc/alcasar-filter-exceptions"
 FIC_CONF="/usr/local/etc/alcasar.conf"
-usage="Usage: alcasar-nf.sh {--on | -on} | {--off | -off} | {--lan_ext_filter_on | -lan_ext_filter_on} | {--lan_ext_filter_off | -lan_ext_filter_off}"
+usage="Usage: alcasar-nf.sh {--on | -on} | {--off | -off}"
 nb_args=$#
 args=$1
 if [ $nb_args -eq 0 ]
 then
-        /usr/local/bin/alcasar-iptables.sh
+        echo $usage
         exit 1
 fi
 case $args in
 ,16 → 25,6
                 exit 0
                 ;;
         -on|-on) # enable protocols filter
-                # sort service file
-                $SED "/^$/d" $FIC_SERVICES # delete empty lines
-                sort -k2n $FIC_SERVICES > /tmp/alcasar-services-sort
-                mv -f /tmp/alcasar-services-sort $FIC_SERVICES
-                chown root:apache $FIC_SERVICES
-                chmod 660 $FIC_SERVICES
-                # vérify exception file
-                [ -e $FIC_EXCEPTIONS ] || touch $FIC_EXCEPTIONS
-                chown root:apache $FIC_EXCEPTIONS
-                chmod 664 $FIC_EXCEPTIONS
                 $SED "s?^PROTOCOLS_FILTERING.*?PROTOCOLS_FILTERING=on?g" $FIC_CONF
                 /usr/local/bin/alcasar-iptables.sh
                 ;;
 ,14 → 32,6
                 $SED "s?^PROTOCOLS_FILTERING.*?PROTOCOLS_FILTERING=off?g" $FIC_CONF
                 /usr/local/bin/alcasar-iptables.sh
                 ;;
-        --lan_ext_filter_on|-lan_ext_filter_on) # allow external LAN access (LAN located between ALCASAR and the Internet gateway)
-                $SED "s?^EXT_LAN_FILTERING.*?EXT_LAN_FILTERING=on?g" $FIC_CONF
-                /usr/local/bin/alcasar-iptables.sh
-                ;;
-        --lan_ext_filter_off|-lan_ext_filter_off) # allow external LAN access (LAN located between ALCASAR and the Internet gateway)
-                $SED "s?^EXT_LAN_FILTERING.*?EXT_LAN_FILTERING=off?g" $FIC_CONF
-                /usr/local/bin/alcasar-iptables.sh
-                ;;
         *)
                 echo "Argument inconnu :$1";
                 echo "$usage"

 /scripts/alcasar-file-clean.sh
 ,0 → 1,32
+#/bin/bash
+# alcasar-nf.sh
+# by Rexy
+# This script is distributed under the Gnu General Public License (GPL)
+# clean alcasar conf files (remove empty lines, sort and control)
+# nettoie les fichiers de conf d'alcasar (suppression des lignes vides, tri et contrôle)
+SED="/bin/sed -i"
+DIR_CONF="/usr/local/etc"
+ALCASAR_SERVICES="$DIR_CONF/alcasar-services"
+ALCASAR_EXCEPTIONS="$DIR_CONF/alcasar-filter-exceptions"
+ALCASAR_IP_BLOCKED="$DIR_CONF/alcasar-ip-blocked"
+ALCASAR_CONF="$DIR_CONF/alcasar.conf"
+# sort file content
+for file in $ALCASAR_SERVICES $ALCASAR_IP_BLOCKED
+do
+        sort -k2n $file > /tmp/alcasar-tmp-sort
+        mv -f /tmp/alcasar-tmp-sort $file
+done
+# remove empty lines and put rights
+for file in $ALCASAR_SERVICES $ALCASAR_EXCEPTIONS $ALCASAR_IP_BLOCKED $ALCASAR_CONF
+do
+        echo $file
+        $SED "/^$/d" $file
+        chown root:apache $file
+        chmod 660 $file
+done
 Property changes:
 Added: svn:eol-style
 +native
 \ No newline at end of property
 Added: svn:executable
 +*
 \ No newline at end of property

 /web/acc/admin/network.php
 ,16 → 1,16
 <?php
 /* written by steweb57 & Rexy */
-/****************************************************************
-*       CONSTANTES AVEC CHEMINS DES FICHIERS DE CONFIGURATION   *
-*****************************************************************/
+/***************************************
+* CONSTANTES AVEC CHEMINS DES FICHIERS *
+****************************************/
 define ("ALCASAR_CHILLI", "/etc/chilli.conf");
 define ("CONF_FILE", "/usr/local/etc/alcasar.conf");
 define ("ETHERS_FILE", "/usr/local/etc/alcasar-ethers");
-/********************************************************************************
-*                               TEST DES FICHIERS DE CONFIGURATION              *
-********************************************************************************/
+/********************
+* TEST DES FICHIERS *
+*********************/
 //Test de présence et des droits en lecture des fichiers de configuration.
 if (!file_exists(ALCASAR_CHILLI)){
         exit("Fichier de configuration ".ALCASAR_CHILLI." non présent");
 ,16 → 98,16
                 $insert="True";
                 if ($tab)  # le fichier n'est pas vide
                         {
-                        foreach ($tab as $line)  # on vérifie que les adresses mac et IP ne sont pas déjà présentes
+                        foreach ($tab as $line)  # verify that MAC or IP addresses doesn't exist
                                 {
                                 $field=explode(" ", $line);
                                 $mac_addr=trim($field[0]);$ip_addr=trim($field[1]);
-                                if (trim($_POST['add_mac']) == trim ($mac_addr))
+                                if (strcasecmp(trim($_POST['add_mac']),trim($mac_addr)) == 0)
                                         {
                                         $insert="False";
                                         break;
                                         }
-                                if (trim($_POST['add_iip']) == trim ($ip_addr))
+                                if (strcasecmp(trim($_POST['add_ip']), trim($ip_addr)) == 0)
                                         {
                                         $insert="False";
                                         break;
 ,7 → 120,7
                         $pointeur=fopen(ETHERS_FILE,"a");
                         fwrite ($pointeur, $line);
                         fclose ($pointeur);
-                        # exec ("sudo service chilli restart");
+                        exec ("sudo service chilli restart");
                         }
                 }
         break;

 /web/acc/admin/net_filter.php
 ,11 → 19,13
   $l_antivir_off="L'antivirus de flux WEB est actuellement désactiv&eacute;";
   $l_switch_antivir_on="Activer l'antivirus";
   $l_switch_antivir_off="D&eacute;sactiver l'antivirus";
-  $l_title_lan_ext = "Filtrage de l'accès au LAN extérieur";
-  $l_lan_ext_on="L'accès au réseau situé entre ALCASAR et le routeur Internet (box) est actuellement autorisé";
-  $l_lan_ext_off="L'accès au réseau situé entre ALCASAR et le routeur Internet (box) est actuellement interdit";
-  $l_switch_lan_ext_on="Autoriser l'accès";
-  $l_switch_lan_ext_off="Interdire l'accès";
+  $l_title_ip_block="Filtrage d'adresses IP";
+  $l_ip_address="Adresses IP (ou addresse de réseau) bloquées";
+  $l_blocked_ip_address="Adresses IP";
+  $l_blocked_ip_address_comment="Commentaires";
+  $l_blocked="Bloquée";
+  $l_ip_block_explain="Liste des adresses IP (ou adresses IP de réseaux) bloquées";
+  $l_remove="Retirer de la liste";
   $l_title_proto = "Filtrage de protocoles r&eacute;seau";
   $l_netfilter_on="Le filtrage de protocoles r&eacute;seau est actuellement activ&eacute;";
   $l_netfilter_off="Le filtrage de protocoles réseau est actuellement désactiv&eacute";
 ,9 → 35,9
   $l_comment_off="(tous les protocoles réseau sont autoris&eacute;s)";
   $l_protocols="Protocoles autoris&eacute;s";
   $l_error_open_file="Erreur d'ouverture du fichier";
-  $l_proto="Protocole";
+  $l_port="Numéro de port";
+  $l_proto="Nom du protocole";
   $l_enabled="Autoris&eacute;";
-  $l_delete="Supprimer de la liste";
   $l_add_to_list="Ajouter &agrave; la liste";
   $l_save_modif="Enregistrer les modifications";
 }
 ,11 → 47,13
   $l_antivir_off="Actually, the WEB antivirus is off";
   $l_switch_antivir_on="Switch the antivirus on";
   $l_switch_antivir_off="Switch the antivirus off";
-  $l_title_lan_ext = "External LAN access filtering";
-  $l_lan_ext_on="The access to the LAN located between ALCASAR and the Internet Gateway (box) is allowed";
-  $l_lan_ext_off="The access to the LAN located between ALCASAR and the Internet Gateway (box) is forbidden";
-  $l_switch_lan_ext_on="Allow access";
-  $l_switch_lan_ext_off="Deny access";
+  $l_title_ip_block="IP address filter";
+  $l_ip_address="IP address (or network IP address)";
+  $l_blocked_ip_address="IP addresses";
+  $l_blocked_ip_address_comment="Comments";
+  $l_blocked="Blocked";
+  $l_ip_block_explain="List of blocked IP addresses (or network IP adresses)";
+  $l_remove="Remove from list";
   $l_title_proto = "Network protocols filter";
   $l_netfilter_on="Actually, the network protocols filter is enable";
   $l_netfilter_off="Actually, the network protocols filter is disable";
 ,17 → 60,30
   $l_switch_on="Switch the Filter on";
   $l_switch_off="Switch the Filter off";
   $l_comment_on="(choose the authorized network protocols)";
+  $l_comment_on="Except for the WEB (port 80), all protocols are blocked.<BR>Choose in the list below, the protocols you want authorize";
   $l_comment_off="(all the network protocols are allowed for authenticated users)";
   $l_protocols="Authorize protocols";
   $l_error_open_file="Error opening the file";
-  $l_proto="Protocol";
-  $l_enabled="Enable";
-  $l_delete="Delete from list";
+  $l_port="Port number";
+  $l_proto="protocol name";
+  $l_enabled="Authorized";
   $l_add_to_list="Add to the list";
   $l_save_modif="Save modifications";
 }
-$services_list="/usr/local/etc/alcasar-services";
-$conf_file="/usr/local/etc/alcasar.conf";
+/********************
+*  TEST CONF FILES  *
+*********************/
+define ("SERVICES_LIST", "/usr/local/etc/alcasar-services");
+define ("CONF_FILE", "/usr/local/etc/alcasar.conf");
+define ("IP_BLOCKED", "/usr/local/etc/alcasar-ip-blocked");
+$conf_files=array(SERVICES_LIST,CONF_FILE,IP_BLOCKED);
+foreach ($conf_files as $file){
+if (!file_exists($file)){
+        exit("Requested file ".$file." isn't present");}
+if (!is_readable($file)){
+        exit("Can't read the file ".$file);}
+}
 if (isset($_POST['choix'])){$choix=$_POST['choix'];} else {$choix="";}
 switch ($choix)
 {
 ,12 → 93,6
 case 'AV_Off' :
         exec ("sudo /usr/local/sbin/alcasar-havp.sh -off");
         break;
-case 'Lan_Ext_Filter_Off' :
-        exec ("sudo /usr/local/sbin/alcasar-nf.sh -lan_ext_filter_off");
-        break;
-case 'Lan_Ext_Filter_On' :
-        exec ("sudo /usr/local/sbin/alcasar-nf.sh -lan_ext_filter_on");
-        break;
 case 'NF_On' :
         exec ("sudo /usr/local/sbin/alcasar-nf.sh -on");
         break;
 ,40 → 99,65
 case 'NF_Off' :
         exec ("sudo /usr/local/sbin/alcasar-nf.sh -off");
         break;
-case 'new_proto' :
+case 'new_port' :
         $_POST['add_proto'] = str_replace (CHR(32),"-",$_POST['add_proto']);
         if ((trim($_POST['add_port']) != "80") and ($_POST['add_port'] != "") and ($_POST['add_proto'] != "") and (is_numeric($_POST['add_port'])))
                 {
-                $tab=file($services_list);
+                $tab=file(SERVICES_LIST);
                 if ($tab)
                         {
-                        $pointeur=fopen($services_list,"r");
-                        //on teste si le port n'est pas déjà présent
+                        $pointeur=fopen(SERVICES_LIST,"r");
+                        // test if port doesn't already exist
                         $insert = true;
-                        foreach ($tab as $ligne)
+                        foreach ($tab as $line)
                                 {
-                                $proto_f=explode(" ", $ligne);
+                                $proto_f=explode(" ", $line);
                                 if (trim($_POST['add_port']) == trim($proto_f[1])) {$insert = false;}
                                 }
                         fclose($pointeur);
                         if ($insert == true)
                                 {
-                                $line = "#" . trim($_POST['add_proto']) . " " . trim($_POST['add_port']);
-                                $pointeur=fopen($services_list,"a");
+                                $line = "\n" . "#" . trim($_POST['add_proto']) . " " . trim($_POST['add_port']);
+                                $pointeur=fopen(SERVICES_LIST,"a");
                                 fwrite ($pointeur, $line);
                                 fclose ($pointeur);
-                                exec ("sudo /usr/local/sbin/alcasar-nf.sh -on");
+                                exec ("sudo /usr/local/bin/alcasar-file-clean.sh");
                                 }
                         }
-                else {echo "$l_error_open_file $services_list";}
                 }
         break;
-case 'change' :
-        $tab=file($services_list);
+case 'new_ip' :
+        if (trim($_POST['add_ip']) != "")
+                {
+                $tab=file(IP_BLOCKED);
+                if ($tab)
+                        {
+                        $pointeur=fopen(IP_BLOCKED,"r");
+                        // test if IP doesn't already exist
+                        $insert = true;
+                        foreach ($tab as $line)
+                                {
+                                $IP_f=explode("#", $line);
+                                if (trim($_POST['add_ip']) == trim($IP_f[0])) {$insert = false;}
+                                }
+                        fclose($pointeur);
+                        if ($insert == true)
+                                {
+                                $line ="\n" . trim($_POST['add_ip']) . " # " . trim($_POST['add_comment']);
+                                $pointeur=fopen(IP_BLOCKED,"a");
+                                fwrite ($pointeur, $line);
+                                fclose ($pointeur);
+                                exec ("sudo /usr/local/bin/alcasar-file-clean.sh");
+                                }
+                        }
+                }
+        break;
+case 'change_port' :
+        $tab=file(SERVICES_LIST);
         if ($tab)
                 {
-//on active|désactive les protocoles
-                $pointeur=fopen($services_list,"w+");
+// authorize/block protocols
+                $pointeur=fopen(SERVICES_LIST,"w+");
                 foreach ($tab as $ligne)
                         {
                         $proto_f=explode(" ", $ligne);
 ,14 → 193,56
                         }
                 fclose($pointeur);
                 }
-        else {echo "$l_error_open_file $services_list";}
         exec ("sudo /usr/local/sbin/alcasar-nf.sh -on");
         break;
+case 'change_ip' :
+        $tab=file(IP_BLOCKED);
+        if ($tab)
+                {
+// authorize/block IPs
+                $pointeur=fopen(IP_BLOCKED,"w+");
+                foreach ($tab as $ligne)
+                        {
+                        $ip_f=explode(" ", $ligne);
+                        $ip_blocked1=trim($ip_f[0],"#");
+                        $actif = False; $remove_line = false;
+                        foreach ($_POST as $key => $value)
+                                {
+                                if (strstr($key,'del-'))
+                                        {
+                                        $ip_blocked2 = str_replace('del-','',$key);
+                                        if ($ip_blocked1 == $ip_blocked2)
+                                                {
+                                                $remove_line = True;
+                                                break;
+                                                }
+                                        }
+                                if (strstr($key,'chk-'))
+                                        {
+                                        $ip_blocked2 = str_replace('chk-','',$key);
+                                        if ($ip_blocked1 == $ip_blocked2)
+                                                {
+                                                $actif = True;
+                                                break;
+                                                }
+                                        }
+                                }
+                        if (! $remove_line)
+                                {
+                                if (! $actif) { $line="#$ip_blocked1 $ip_f[1]";}
+                                else { $line="$ip_blocked1 $ip_f[1]";}
+                                fwrite($pointeur,$line);
+                                }
+                        }
+                fclose($pointeur);
+                }
+        #exec ("sudo /usr/local/bin/alcasar-iptables.sh");
+        break;
         }
 # default values
-if (is_file ($conf_file))
+if (is_file (CONF_FILE))
         {
-        $tab=file($conf_file);
+        $tab=file(CONF_FILE);
         if ($tab)
                 {
                 foreach ($tab as $line)
 ,12 → 249,10
                         {
                         $field=explode("=", $line);
                         if ($field[0] == "PROTOCOLS_FILTERING") {$PROTOCOLS_FILTERING=trim($field[1]);}
-                        if ($field[0] == "EXT_LAN_FILTERING")   {$EXT_LAN_FILTERING=trim($field[1]);}
                         if ($field[0] == "WEB_ANTIVIRUS")       {$WEB_ANTIVIRUS=trim($field[1]);}
                         }
                 }
         }
-else { echo "$l_error_open_file $conf_file";}
 echo "<tr><th>$l_title_antivir</th></tr>";
 ?>
 <tr bgcolor=#FFCC66><td><img src=/images/pix.gif width=1 height=2></td></tr>
 ,28 → 279,56
 </td></tr>
 </table>
 <TABLE width="100%" border=0 cellspacing=0 cellpadding=0>
-<tr><th><?echo "$l_title_lan_ext";?></th></tr>
+<tr><th><?echo "$l_title_ip_block";?></th></tr>
 <tr bgcolor="#FFCC66"><td><img src="/images/pix.gif" width="1" height="2"></td></tr>
 </table>
-<TABLE width="100%" border=1 cellspacing=0 cellpadding=0>
-        <tr><td valign="middle" align="left">
-<?php
-if ($EXT_LAN_FILTERING == "on")
+<table width="100%" border=1 cellspacing=0 cellpadding=1>
+<tr><td colspan=2 align="center">
+<?
+echo "$l_ip_block_explain</td></tr>";
+echo "<tr><td align='center' valign='middle'>";
+echo "<FORM action='$_SERVER[PHP_SELF]' method='POST'>";
+echo "<input type=hidden name='choix' value=\"IP_block_filter\">";
+echo "<table cellspacing=2 cellpadding=2 border=1>";
+echo "<tr><th>$l_blocked_ip_address<th>$l_blocked_ip_address_comment<th>$l_blocked<th>$l_remove</tr>";
+// Read the "IP_block" file
+$tab=file(IP_BLOCKED);
+if ($tab)  # the file isn't empty
         {
-        echo "<CENTER><H3>$l_lan_ext_off</H3></CENTER>";
-        echo "<FORM action='$_SERVER[PHP_SELF]' method=POST>";
-        echo "<input type=hidden name='choix' value=\"Lan_Ext_Filter_Off\">";
-        echo "<input type=submit value=\"$l_switch_lan_ext_on\">";
-}
-else
-        {
-        echo "<CENTER><H3>$l_lan_ext_on</H3></CENTER>";
-        echo "<FORM action='$_SERVER[PHP_SELF]' method=POST>";
-        echo "<input type=hidden name='choix' value=\"Lan_Ext_Filter_On\">";
-        echo "<input type=submit value=\"$l_switch_lan_ext_off\">";
+        foreach ($tab as $line)
+                {
+                if (trim($line) != '') # the line isn't empty
+                        {
+                        $blocked_ip=explode(" ", $line);
+                        $ip_addr=trim($blocked_ip[0],"#");
+                        echo "<tr><td>$ip_addr<td>$blocked_ip[1]";
+                        echo "<td><input type='checkbox' name='chk-$ip_addr'";
+                        // if the line is commented -> IP adress is not blocked
+                        if (preg_match('/^#/',$line, $r)) {
+                                echo ">";}
+                        else {
+                                echo "checked>";}
+                        echo "<td><input type='checkbox' name='del-$ip_addr'>";
+                        echo "</tr>";
+                        }
+                }
         }
 ?>
-</FORM>
+</table>
+<input type='hidden' name='choix' value='change_ip'>
+<input type='submit' value='<?echo"$l_save_modif";?>'>
+</form></td><td valign='middle' align='center'>
+<form action='<?echo"$_SERVER[PHP_SELF]"?>' method='POST'>
+<table cellspacing=2 cellpadding=3 border=1>
+<tr><th><?echo"$l_ip_address<th>$l_blocked_ip_address_comment";?>
+<td></td></tr>
+<tr><td>exemple1 : 15.25.26.27 <br>exemple2 : 18.20.20.0/24</td><td>exemple1 : CERT alert<br>exemple2 : LAN of zombies</td><td></td></tr>
+<tr><td><input type='text' name='add_ip' size='17'></td>
+<td><input type='text' name='add_comment' size='10'></td>
+<input type='hidden' name='choix' value='new_ip'>
+<td><input type='submit' value='<?echo"$l_add_to_list";?>'></td>
+</tr></table>
+</form>
 </td></tr>
 </table>
 <TABLE width="100%" border=0 cellspacing=0 cellpadding=0>
 ,26 → 336,26
 <tr bgcolor="#FFCC66"><td><img src="/images/pix.gif" width="1" height="2"></td></tr>
 </table>
 <TABLE width="100%" border=1 cellspacing=0 cellpadding=0>
-<tr><td valign="middle" align="left">
+<tr>
 <?
 if ($PROTOCOLS_FILTERING == "on")
         {
+        echo "<td colspan=\"2\" valign=\"middle\" align=\"left\">";
         echo "<CENTER><H3>$l_netfilter_on</H3>$l_comment_on</CENTER>";
         echo "<FORM action='$_SERVER[PHP_SELF]' method=POST>";
         echo "<input type=hidden name='choix' value=\"NF_Off\">";
         echo "<input type=submit value=\"$l_switch_off\">";
+        echo "</FORM></td></tr>";
+        require ('net_filter2.php');
         }
 else
         {
+        echo "<td valign=\"middle\" align=\"left\">";
         echo "<CENTER><H3>$l_netfilter_off</H3>$l_comment_off</CENTER>";
         echo "<FORM action='$_SERVER[PHP_SELF]' method=POST>";
         echo "<input type=hidden name='choix' value=\"NF_On\">";
         echo "<input type=submit value=\"$l_switch_on\">";
+        echo "</FORM></td></tr>";
+        echo "</table></body></html>";
         }
-echo "</FORM>";
-echo "</td></tr>";
-echo "</TABLE>";
-if ($PROTOCOLS_FILTERING == "on") require ('net_filter2.php');
 ?>
-</BODY>
-</HTML>

 /web/acc/admin/net_filter2.php
 ,24 → 1,22
-<table width="100%" border=1 cellspacing=0 cellpadding=1>
 <tr><td valign="middle" align="center">
 <form action='net_filter.php' method='POST'>
 <table cellspacing=2 cellpadding=3 border=1>
 <?
-echo "<tr><th>$l_proto / port<th>$l_enabled<th>$l_delete</tr>";
-// On lit et on interprète le fichier de filtrage de protocoles
-if (file_exists($services_list))
+echo "<tr><th>$l_port<th>$l_proto<th>$l_enabled<th>$l_remove</tr>";
+// Read and compute the protocols list
+$tab=file(SERVICES_LIST);
+if ($tab) # the file isn't empty
         {
-        $pointeur=fopen($services_list,"r");
-        while (!feof ($pointeur))
+        foreach ($tab as $line)
                 {
-                $ligne=fgets($pointeur, 4096);
-                if ($ligne)
+                if (trim($line) != '') # the line isn't empty
                         {
-                        $proto=explode(" ", $ligne);
+                        $proto=explode(" ", $line);
                         $name_svc=trim($proto[0],"#");
-                        echo "<tr><td>$name_svc / $proto[1]";
+                        echo "<tr><td>$proto[1]<td>$name_svc";
                         echo "<td><input type='checkbox' name='chk-$name_svc'";
-                        // si la ligne est commentée -> protocole non autorisé
-                        if (preg_match('/^#/',$ligne, $r)) {
+                        // if the line is commented -> protocol is not allowed
+                        if (preg_match('/^#/',$line, $r)) {
                                 echo ">";}
                         else {
                                 echo "checked>";}
 ,24 → 24,18
                         echo "</tr>";
                         }
                 }
-        fclose($pointeur);
         }
-else    {
-        echo "$l_error_open_file $services_list";
-        }
 ?>
 </table>
-<input type='hidden' name='choix' value='change'>
+<input type='hidden' name='choix' value='change_port'>
 <input type='submit' value='<?echo"$l_save_modif";?>'>
-</form>
-</td>
-<td valign='middle' align='center'>
+</form></td><td valign='middle' align='center'>
 <form action='net_filter.php' method='POST'>
 <table cellspacing=2 cellpadding=3 border=1>
-<tr><th><?echo"$l_proto";?><th>port</tr>
-<tr><td><input type='text' name='add_proto' size='10'></td>
-<td><input type='text' name='add_port' size='5'></td>
-<input type='hidden' name='choix' value='new_proto'>
+<tr><th><?echo"$l_port<th>$l_proto"?></tr>
+<tr><td><input type='text' name='add_port' size='5'></td>
+<td><input type='text' name='add_proto' size='10'></td>
+<input type='hidden' name='choix' value='new_port'>
 <td><input type='submit' value='<?echo"$l_add_to_list";?>'></td>
 </tr></table>
 </form>
 ,4 → 42,4
 </td></tr>
 </TABLE>
 </BODY>
-</HTML>
+</HTML>

Subversion Repositories ALCASAR

Compare Revisions

Ignore whitespace Rev 858 → Rev 859