From bb0278f2a55efcaffada69d059ae342cf29a8e09 Mon Sep 17 00:00:00 2001 From: Jon Foster Date: Mon, 21 Mar 2022 15:21:46 -0700 Subject: [PATCH] Control Panel fixes & whole domain blocks * Fix config files and init script * Help text and error coloring in WUI template. * EOL white space. :-/ * Add whole domain blocking --- controlpanel/TODO.md | 12 ++++ controlpanel/data.h | 1 + controlpanel/default | 1 + controlpanel/init | 29 +++++---- controlpanel/lighttpd.conf | 6 +- controlpanel/mainskin.tmpl | 16 ++++- controlpanel/sample.js | 4 +- controlpanel/trafficctrl.cpp | 151 ++++++++++++++++++++++++++++++------------- 8 files changed, 157 insertions(+), 63 deletions(-) create mode 100644 controlpanel/TODO.md diff --git a/controlpanel/TODO.md b/controlpanel/TODO.md new file mode 100644 index 0000000..3c40fb9 --- /dev/null +++ b/controlpanel/TODO.md @@ -0,0 +1,12 @@ + + * Add comments to "dns" decision table + * "dns.decided" field should default to the last hit in "connections". + * format table centered with the title. + * Extend DNS mechanism to incorporate anonymous (no DNS) connections. + * Daemonization mechanism to allow us to run as non-root. + * C++CMS creates socket as original user:group (typically root:root). Yet the + PID file is written as the requested user:group. This means that permissions + on the socket have to be handled outside of C++CMS or it needs some patchery. + * Tool to read JSON conf and supply values to "init" script. + * Some list filtering tools in the WUI to target actions on specific subsets + of DNS names diff --git a/controlpanel/data.h b/controlpanel/data.h index 83b62fd..3455b14 100644 --- a/controlpanel/data.h +++ b/controlpanel/data.h @@ -28,6 +28,7 @@ struct Domain { struct DomainList :public cppcms::base_content { std::vector list; std::string filter; // Which filter was used to show list + std::string error; int page, pages, page_size, count; }; diff --git a/controlpanel/default b/controlpanel/default index ce62740..02c6476 100644 --- a/controlpanel/default +++ b/controlpanel/default @@ -2,6 +2,7 @@ # defaults. # Configuration file for the TrafficCtrl server +# NOTE: service won't start until this is set #CONF=/etc/poorman-ids/sample.js # Where "run" files are placed. This is the Debian+ default: #RUN=/run diff --git a/controlpanel/init b/controlpanel/init index e4809a2..c9f9c84 100755 --- a/controlpanel/init +++ b/controlpanel/init @@ -16,7 +16,7 @@ NAME="trafficctrl" DAEMON="/usr/sbin/$NAME" RUN=/run -CONF=/etc/poorman-ids/sample.js +CONF="" PID="" GROUP="" @@ -49,11 +49,16 @@ CTRL() { do_start() { echo -n "Starting Traffic Control: " + if [ -z "$CONF" ]; then + echo "NOT CONFIGURED" + return 0 + fi if CTRL --start --oknodo --umask 007 $GROUP -- -c "$CONF"; then echo "OK" + return 0 #JIC else echo "FAIL" - exit 1 + return 1 fi } @@ -63,9 +68,10 @@ do_stop() { echo -n "Stoping Traffic Control: " if CTRL --stop --remove-pidfile; then echo "OK" + return 0 #JIC else echo "FAIL" - exit 1 + return 1 fi } @@ -75,36 +81,37 @@ do_status() { echo -n "Traffic Control is: " if CTRL --status; then echo "Up" + return 0 #JIC else echo "Down" - exit 1 + return 1 fi } -### Main() +### Main() case "$1" in start) do_start ;; - + stop) do_stop ;; - + restart) do_status && do_stop do_start ;; - + status) do_status ;; - + *) echo "$0 {start | stop | restart | status}" ;; - -esac \ No newline at end of file + +esac diff --git a/controlpanel/lighttpd.conf b/controlpanel/lighttpd.conf index 61aa320..56ad7b1 100644 --- a/controlpanel/lighttpd.conf +++ b/controlpanel/lighttpd.conf @@ -5,11 +5,11 @@ #fastcgi.debug = 1 fastcgi.server = ( "/webmonitor" => - ( "trafficctrl" => + ( "trafficctrl" => ( "socket" => "/run/poorman-ids/trafficctrl.fcgi", "check-local" => "disable", # "fix-root-scriptname" => "enable", - #"docroot" => "/" # remote server may use + #"docroot" => "/" # remote server may use # its own docroot ) @@ -20,7 +20,7 @@ fastcgi.server = ( auth.backend = "htpasswd" auth.backend.htpasswd.userfile = "/etc/lighttpd/lighttpd.users" -auth.require += ( "/webmonitor" => ( +auth.require += ( "/webmonitor" => ( "method" => "basic", "realm" => "Web Monitor", #"require" => "user=root" diff --git a/controlpanel/mainskin.tmpl b/controlpanel/mainskin.tmpl index c172750..8c4906e 100644 --- a/controlpanel/mainskin.tmpl +++ b/controlpanel/mainskin.tmpl @@ -52,21 +52,31 @@ border-top: 2px solid black; border-bottom: 2px solid black; padding: 0.25em; - } + } div.pager { font-weight: bold; }
<% include menu() %>
- +

<% include title() %>

- +
<% foreach domain rowid r from 1 in list %> <% include pager(page, pages) %> + <% if not empty error %> +

<%= error %>

+ <% end %>
Whole Domain: +

NOTE: the root domain name listed here will match any records in + this list with the same suffix and record the decision as chosen below. + <% if ( content.filter == "undecided" ) %> + Whole domains can be blocked by prefixing them with "*.". This means that + even if the exact host name or subdomain is not listed here it will get + blocked. + <% end %>