diff --git a/encoder/ac4d5de9f5785044565fe1fd9578413738e9b7c9c4df6fd4dae247d8d2828c4e2a490b9edb0d6c84f5a1b6679b8d8815a2ec8e5524407f1b25d6eb1c46.php b/encoder/ac4d5de9f5785044565fe1fd9578413738e9b7c9c4df6fd4dae247d8d2828c4e2a490b9edb0d6c84f5a1b6679b8d8815a2ec8e5524407f1b25d6eb1c46.php deleted file mode 100755 index ba2e1f6..0000000 --- a/encoder/ac4d5de9f5785044565fe1fd9578413738e9b7c9c4df6fd4dae247d8d2828c4e2a490b9edb0d6c84f5a1b6679b8d8815a2ec8e5524407f1b25d6eb1c46.php +++ /dev/null @@ -1,5 +0,0 @@ - \ No newline at end of file diff --git a/encoder/firewall.php b/encoder/firewall.php index 3be4aac..e2276e0 100644 --- a/encoder/firewall.php +++ b/encoder/firewall.php @@ -1,510 +1,188 @@ + 65535) return null; - return $p; +if (file_exists($file)) { + $json = file_get_contents($file); + $rules = json_decode($json, true) ?: []; } -/** - * Very basic CIDR/subnet validation. - * Accepts forms like: - * 10.0.0.0/24 - * 192.168.1.5 - */ -function sanitize_subnet($subnet) { - $subnet = trim($subnet); - if ($subnet === '') return null; - - // allow plain IP - if (filter_var($subnet, FILTER_VALIDATE_IP)) { - return $subnet; - } - - // allow IP/CIDR - $parts = explode('/', $subnet); - if (count($parts) === 2) { - [$ip, $mask] = $parts; - $ip = trim($ip); - $mask = trim($mask); - if (!filter_var($ip, FILTER_VALIDATE_IP)) { - return null; - } - if (!ctype_digit($mask)) { - return null; - } - $m = (int)$mask; - if ($m < 0 || $m > 32) { - return null; - } - return $ip . '/' . $m; - } - - return null; -} - -/** - * Run a UFW command and capture output. - */ -function run_ufw_command($cmd, $dryRun = false) { - $cmdline = UFW_BIN . ' ' . $cmd; - - if ($dryRun) { - return [ - 'cmd' => $cmdline, - 'output' => ['[DRY RUN] Command not executed'], - 'exit_code' => 0, - ]; - } - - $output = []; - $ret = 0; - exec($cmdline . ' 2>&1', $output, $ret); - - return [ - 'cmd' => $cmdline, - 'output' => $output, - 'exit_code' => $ret, - ]; -} - -// Handle POST if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $action = $_POST['action'] ?? ''; + $rules = []; - if ($action === 'apply_firewall') { - $globalPorts = $_POST['global_ports'] ?? []; - $restrictedPorts = $_POST['restricted_port'] ?? []; - $restrictedSubnets = $_POST['restricted_subnet'] ?? []; - $dryRunChecked = isset($_POST['dry_run']) && $_POST['dry_run'] === '1'; - - $didAnything = false; - - // 1) Open ports for all IP (allow) - foreach ($globalPorts as $rawPort) { - $rawPort = trim($rawPort); - if ($rawPort === '') { - continue; - } - - $port = sanitize_port($rawPort); - if ($port === null) { - $errors[] = "Invalid open port: " . htmlspecialchars($rawPort); - continue; - } - - $didAnything = true; - - $res = run_ufw_command('allow ' . (int)$port, $dryRunChecked || $DRY_RUN); - if ($res['exit_code'] !== 0) { - $errors[] = "Failed to allow port {$port}: " . implode(" ", $res['output']); - } else { - $messages[] = "Allowed port {$port} for all IPs."; - } + if (!empty($_POST['ip_version'])) { + foreach ($_POST['ip_version'] as $i => $v) { + $rules[] = [ + 'ip_version' => $_POST['ip_version'][$i] ?? '', + 'ip_address' => $_POST['ip_address'][$i] ?? '', + 'port' => $_POST['port'][$i] ?? '', + 'protocol' => $_POST['protocol'][$i] ?? '', + 'description' => $_POST['description'][$i] ?? '' + ]; } - - // 2) Restricted ports with subnets - // Model: Deny port globally, then allow from specified subnets. - $count = max(count($restrictedPorts), count($restrictedSubnets)); - - for ($i = 0; $i < $count; $i++) { - $rawPort = $restrictedPorts[$i] ?? ''; - $rawSubnet = $restrictedSubnets[$i] ?? ''; - - $rawPort = trim($rawPort); - $rawSubnet = trim($rawSubnet); - - if ($rawPort === '' || $rawSubnet === '') { - continue; - } - - $port = sanitize_port($rawPort); - $subnet = sanitize_subnet($rawSubnet); - - if ($port === null) { - $errors[] = "Invalid restricted port: " . htmlspecialchars($rawPort); - continue; - } - if ($subnet === null) { - $errors[] = "Invalid subnet/CIDR for port {$port}: " . htmlspecialchars($rawSubnet); - continue; - } - - $didAnything = true; - - // Deny port from everywhere - $denyRes = run_ufw_command('deny ' . (int)$port, $dryRunChecked || $DRY_RUN); - if ($denyRes['exit_code'] !== 0) { - $errors[] = "Failed to deny port {$port}: " . implode(" ", $denyRes['output']); - } else { - $messages[] = "Denied port {$port} for all IPs."; - } - - // Allow from subnet - $allowCmd = 'allow from ' . escapeshellarg($subnet) . ' to any port ' . (int)$port; - // We used escapeshellarg() here, but run_ufw_command expects only the ufw arguments, - // so we need to build carefully: - // Rebuild without full path: - $allowCmdForRun = 'allow from ' . $subnet . ' to any port ' . (int)$port; - - $allowRes = run_ufw_command($allowCmdForRun, $dryRunChecked || $DRY_RUN); - if ($allowRes['exit_code'] !== 0) { - $errors[] = "Failed to allow port {$port} from {$subnet}: " . implode(" ", $allowRes['output']); - } else { - $messages[] = "Allowed port {$port} only from {$subnet}."; - } - } - - if (!$didAnything) { - $errors[] = "No valid firewall rules submitted."; - } - - // Optional: reload or enable ufw here - // $reload = run_ufw_command('reload', $dryRunChecked || $DRY_RUN); - } -} -// Get current UFW status -$currentStatus = []; -$statusExit = 0; -if (file_exists(UFW_BIN)) { - exec(UFW_BIN . ' status numbered 2>&1', $currentStatus, $statusExit); -} else { - $currentStatus[] = "UFW binary not found at " . UFW_BIN; - $statusExit = 1; + file_put_contents($file, json_encode($rules, JSON_PRETTY_PRINT)); } ?> - - - - - Firewall Rule Manager - - - -
-

Firewall Rule Manager

-
- Configure simple UFW rules to open ports for all IPs and restrict ports to specific subnets. - Ensure this interface is accessible only to trusted administrators. -
+ +
+
+

Firewall Rules

+ +
+ - - - - - + + + + + + + + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + +
PortComment (optional)
IP VersionIP AddressPortProtocolDescription
- -
- -
- -
+ + + + + +
+ + + + + +
- -
- Example: 80, 443, 1935, 22 etc. Empty rows will be ignored. -
-
- -
-
-

Restricted Ports (Only From Subnets)

- -
-

- For each row: port is first globally denied, then allowed only from the subnet. - Typical use: restrict 8080/8443 to internal networks. -

- - - - - - - - - - - - - - - - - - - - - - -
PortSubnet / CIDR (e.g. 192.168.1.0/24)
- -
- -
- -
- Subnet examples: 192.168.1.0/24, 10.0.0.0/8, or a single IP like 203.0.113.5. -
-
- -
-
- -
- -
-
-
- Use preview first to verify behaviour. Always test on a non-production system before applying to live servers. -
-
- - -
-

Current UFW Status

-

Output of ufw status numbered:

-
+
+ +

+ +

+

+ +

- - + \ No newline at end of file diff --git a/encoder/firmware.php b/encoder/firmware.php index 271480c..ed20340 100755 --- a/encoder/firmware.php +++ b/encoder/firmware.php @@ -13,11 +13,15 @@ switch ($_POST['action']) { unlink($file); } } + deleteDir('/var/www/encoder/setup'); break; case 'reboot': exec('sudo reboot'); break; } + +$board_id = trim(@file_get_contents('/sys/class/dmi/id/board_serial')); + ?>