$id]); if (empty($advanced_filter)) { $type = 0; } else { $type = 1; } echo $type; } // Get values of the current netflow filter. if ($get_filter_values) { $id = get_parameter('id'); $filter_values = db_get_row_filter('tnetflow_filter', ['id_sg' => $id]); // Decode HTML entities. $filter_values['advanced_filter'] = io_safe_output($filter_values['advanced_filter']); echo json_encode($filter_values); } return; } // Read filter configuration. $filter_id = (int) get_parameter('filter_id', 0); $filter['id_name'] = get_parameter('new_filter_name', ''); $filter['id_group'] = (int) get_parameter('assign_group', 0); $filter['aggregate'] = get_parameter('aggregate', ''); $filter['ip_dst'] = get_parameter('ip_dst', ''); $filter['ip_src'] = get_parameter('ip_src', ''); $filter['dst_port'] = get_parameter('dst_port', ''); $filter['src_port'] = get_parameter('src_port', ''); $filter['advanced_filter'] = get_parameter('advanced_filter', ''); $filter['netflow_monitoring'] = (bool) get_parameter('netflow_monitoring'); $filter['netflow_monitoring_interval'] = (int) get_parameter('netflow_monitoring_interval', 300); $filter['traffic_max'] = get_parameter('traffic_max', 0); $filter['traffic_critical'] = get_parameter('traffic_critical', 0); $filter['traffic_warning'] = get_parameter('traffic_warning', 0); // Read chart configuration. $chart_type = get_parameter('chart_type', 'netflow_area'); $max_aggregates = (int) get_parameter('max_aggregates', 10); $update_date = (int) get_parameter('update_date', 0); $connection_name = get_parameter('connection_name', ''); $interval_length = get_parameter('interval_length', NETFLOW_RES_MEDD); $address_resolution = (int) get_parameter('address_resolution', ($config['netflow_get_ip_hostname'] ?? '')); $filter_selected = (int) get_parameter('filter_selected', 0); // Calculate range dates. $custom_date = get_parameter('custom_date', '0'); $date = get_parameter('date', SECONDS_1DAY); if ($custom_date === '1') { $date_init = get_parameter('date_init'); $time_init = get_parameter('time_init'); $date_end = get_parameter('date_end'); $time_end = get_parameter('time_end'); $date_from = strtotime($date_init.' '.$time_init); $date_to = strtotime($date_end.' '.$time_end); } else if ($custom_date === '2') { $date_text = get_parameter('date_text'); $date_units = get_parameter('date_units'); $period = ($date_text * $date_units); $date_to = strtotime(date('Y-m-d H:i:s')); $date_from = (strtotime($date_to) - $period); } else if (in_array($date, ['this_week', 'this_month', 'past_week', 'past_month'])) { if ($date === 'this_week') { $date_from = strtotime('last monday'); $date_to = strtotime($date_from.' +6 days'); } else if ($date === 'this_month') { $date_from = strtotime('first day of this month'); $date_to = strtotime('last day of this month'); } else if ($date === 'past_month') { $date_from = strtotime('first day of previous month'); $date_to = strtotime('last day of previous month'); } else if ($date === 'past_week') { $date_from = strtotime('monday', strtotime('last week')); $date_to = strtotime('sunday', strtotime('last week')); } } else { $date_to = strtotime(date('Y-m-d H:i:s')); $date_from = ($date_to - $date); } // Read buttons. $draw = get_parameter('draw_button', ''); $save = get_parameter('save_button', ''); $update = get_parameter('update_button', ''); // Header. ui_print_standard_header( __('Netflow live view'), 'images/op_netflow.png', false, '', false, [], [ [ 'link' => '', 'label' => __('Monitoring'), ], [ 'link' => '', 'label' => __('Network'), ], ] ); $is_windows = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'); if ($is_windows === true) { ui_print_error_message(__('Not supported in Windows systems')); } else { netflow_print_check_version_error(); } // Save user defined filter. if ($save != '' && check_acl($config['id_user'], 0, 'AW')) { // Save filter args. $filter['filter_args'] = netflow_get_filter_arguments($filter, true); if ($filter['id_name'] === '') { $filter['id_name'] = 'Netflow_Filter_'.time(); } $filter_id = db_process_sql_insert('tnetflow_filter', $filter); if ($filter_id === false) { $filter_id = 0; ui_print_error_message(__('Error creating filter')); } else { ui_print_success_message(__('Filter created successfully')); } } else if ($update != '' && check_acl($config['id_user'], 0, 'AW')) { // Update current filter. // Do not update the filter name and group. $filter_copy = $filter; unset($filter_copy['id_name']); unset($filter_copy['id_group']); // Save filter args. $filter_copy['filter_args'] = netflow_get_filter_arguments($filter_copy, true); $result = db_process_sql_update( 'tnetflow_filter', $filter_copy, ['id_sg' => $filter_id] ); ui_print_result_message( $result, __('Filter updated successfully'), __('Error updating filter') ); } // The filter name will not be needed anymore. $filter['id_name'] = ''; $netflow_disable_custom_lvfilters = false; if (isset($config['netflow_disable_custom_lvfilters'])) { $netflow_disable_custom_lvfilters = $config['netflow_disable_custom_lvfilters']; } // Add nodes list. if (is_metaconsole() === true) { $list_servers = []; $servers = db_get_all_rows_sql( 'SELECT * FROM tmetaconsole_setup' ); if ($servers === false) { $servers = []; } foreach ($servers as $server) { // If connection was good then retrieve all data server. if (metaconsole_load_external_db($server)) { $connection = true; } else { $connection = false; } $row = db_get_row('tconfig', 'token', 'activate_netflow'); if ($row['value']) { $list_servers[$server['server_name']] = $server['server_name']; } metaconsole_restore_db(); } $nodeListInput = html_print_label_input_block( __('Connection'), html_print_select( $list_servers, 'connection_name', $connection_name, '', '', 0, true, false, false ) ); } else { $nodeListInput = ''; } $class_not_period = ($is_period === true) ? 'nf_hidden' : 'nf_display'; $class_period = ($is_period === true) ? 'nf_display' : 'nf_hidden'; $max_values = [ '2' => '2', '5' => '5', '10' => '10', '15' => '15', '20' => '20', '25' => '25', '50' => '50', $max_aggregates => $max_aggregates, ]; $aggregate_list = []; $aggregate_list = [ 'srcip' => __('Src Ip Address'), 'dstip' => __('Dst Ip Address'), 'srcport' => __('Src Port'), 'dstport' => __('Dst Port'), ]; $advanced_toggle = '
'; $advanced_toggle .= ' | '; } else { $advanced_toggle .= ' | '.__('Filter').' | '; $advanced_toggle .= ''.__('Normal').' '.html_print_radio_button_extended('filter_type', 0, '', $filter_type, false, 'displayNormalFilter();', 'style="margin-right: 40px;"', true).__('Custom').' '.html_print_radio_button_extended('filter_type', 1, '', $filter_type, false, 'displayAdvancedFilter();', 'style="margin-right: 40px;"', true).' | '; } $advanced_toggle .= ''.__('Load filter').' | '; $user_groups = users_get_groups($config['id_user'], 'AR', $own_info['is_admin'], true); $user_groups[0] = 0; // Add all groups. $sql = 'SELECT * FROM tnetflow_filter WHERE id_group IN ('.implode(',', array_keys($user_groups)).')'; $advanced_toggle .= "".html_print_select_from_sql($sql, 'filter_id', $filter_id, '', __('Select a filter'), 0, true); $advanced_toggle .= html_print_input_hidden('filter_selected', $filter_selected, false); $advanced_toggle .= ' | '; $advanced_toggle .= '||||
'; $advanced_toggle .= ' | '; } else { $advanced_toggle .= " | ".__('Dst Ip').ui_print_help_tip(__('Destination IP. A comma separated list of destination ip. If we leave the field blank, will show all ip. Example filter by ip: 25.46.157.214,160.253.135.249'), true).' | ';
$advanced_toggle .= ''.html_print_input_text('ip_dst', $filter['ip_dst'], false, 40, 80, true).' | '; } if ($netflow_disable_custom_lvfilters) { $advanced_toggle .= ''; $advanced_toggle .= ' | '; } else { $advanced_toggle .= " | ".__('Src Ip').ui_print_help_tip(__('Source IP. A comma separated list of source ip. If we leave the field blank, will show all ip. Example filter by ip: 25.46.157.214,160.253.135.249'), true).' | ';
$advanced_toggle .= ''.html_print_input_text('ip_src', $filter['ip_src'], false, 40, 80, true).' | '; } $advanced_toggle .= '||
'; $advanced_toggle .= ' | '; } else { $advanced_toggle .= " | ".__('Dst Port').ui_print_help_tip(__('Destination port. A comma separated list of destination ports. If we leave the field blank, will show all ports. Example filter by ports 80 and 22: 80,22'), true).' | ';
$advanced_toggle .= ''.html_print_input_text('dst_port', $filter['dst_port'], false, 40, 80, true).' | '; } if ($netflow_disable_custom_lvfilters) { $advanced_toggle .= ''; $advanced_toggle .= ' | '; } else { $advanced_toggle .= " | ".__('Src Port').ui_print_help_tip(__('Source port. A comma separated list of source ports. If we leave the field blank, will show all ports. Example filter by ports 80 and 22: 80,22'), true).' | ';
$advanced_toggle .= ''.html_print_input_text('src_port', $filter['src_port'], false, 40, 80, true).' | '; } $advanced_toggle .= '||
'.__('IP address resolution').''.ui_print_help_tip(__('Resolve the IP addresses to get their hostnames.'), true).' | '; $advanced_toggle .= ''.$radio_buttons.' | '; $advanced_toggle .= ''.__('Source ip').' | '; $advanced_toggle .= ''.html_print_input_text('router_ip', $filter['router_ip'], false, 40, 80, true).' | '; $advanced_toggle .= '||||||
".__('Enable Netflow monitoring').ui_print_help_tip(__('Allows you to create an agent that monitors the traffic volume of this filter. It also creates a module that measures if the traffic of any IP of this filter exceeds a certain threshold. A text type module will be created with the traffic rate for each IP within this filter every five minutes (the 10 IP\'s with the most traffic). Only available for Enterprise version.'), true).' | '; $advanced_toggle .= ''.html_print_checkbox_switch( 'netflow_monitoring', 1, (bool) $filter['netflow_monitoring'], true, false, 'displayMonitoringFilter()', ).' | '; $advanced_toggle .= ''.__('New filter name').' | '; $advanced_toggle .= ''.html_print_input_text('new_filter_name', '', false, 40, 80, true).' | '; $advanced_toggle .= '||||||
".__('Netflow monitoring interval').ui_print_help_tip(__('Netflow monitoring interval in secs.'), true).' | '; $advanced_toggle .= ''.html_print_input_number( [ 'step' => 1, 'name' => 'netflow_monitoring_interval', 'id' => 'netflow_monitoring_interval', 'value' => $filter['netflow_monitoring_interval'], ] ).' | '; $advanced_toggle .= "".__('Maximum traffic value of the filter').ui_print_help_tip(__('Specifies the maximum rate (in bytes/sec) of traffic in the filter. It is then used to calculate the % of maximum traffic per IP.'), true).' | '; $advanced_toggle .= ''.html_print_input_number( [ 'step' => 1, 'name' => 'traffic_max', 'id' => 'traffic_max', 'value' => $filter['traffic_max'], ] ).' | '; $advanced_toggle .= '||||||
".__('CRITICAL threshold for the maximum % of traffic for an IP.').ui_print_help_tip(__('If this % is exceeded by any IP within the filter, a CRITICAL status will be generated.'), true).' | '; $advanced_toggle .= ''.html_print_input_number( [ 'step' => 0.01, 'name' => 'traffic_critical', 'id' => 'traffic_critical', 'value' => $filter['traffic_critical'], ] ).' | '; $advanced_toggle .= "".__('WARNING threshold for the maximum % of traffic of an IP.').ui_print_help_tip(__('If this % is exceeded by any IP within the filter, a WARNING status will be generated.'), true).' | '; $advanced_toggle .= ''.html_print_input_number( [ 'step' => 0.01, 'name' => 'traffic_warning', 'id' => 'traffic_warning', 'value' => $filter['traffic_warning'], ] ).' | '; $advanced_toggle .= '