Joseph.Rawlings/Virtnet.bond
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: enhance firewall log matching logic with flexible multi-level IP matching and improved port checks

Browse Source
This commit is contained in:
Joseph.Rawlings
2025-12-04 22:47:23 -05:00
parent 1bad173b3f
commit 27c8a8ebfd
1 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
extensions/Servers/Proxmox/Livewire/Firewall.php
View File

@@ -1677,23 +1677,35 @@ class Firewall extends Component
$normalizedStateDestIP = strtolower(trim($stateDestIP));
$normalizedProtocol = strtoupper(trim($protocol));
// Matching logic - check if both IPs from the log are present in the state
// Either in the same direction or swapped (for return traffic)
// Flexible matching logic - multiple levels of matching
$ipMatch = false;
$matchType = '';
// Direction 1: Log source → Log dest matches State source → State dest
// Level 1: Exact bidirectional match (both IPs match in either direction)
if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) {
$ipMatch = true;
$matchType = 'exact';
}
// Direction 2: Swapped (return traffic)
elseif ($normalizedStateSourceIP === $normalizedDestIP && $normalizedStateDestIP === $normalizedSourceIP) {
$ipMatch = true;
$matchType = 'exact-reversed';
}
// Level 2: Destination IP match (log dest matches either state IP) - catches related traffic
elseif ($normalizedStateSourceIP === $normalizedDestIP || $normalizedStateDestIP === $normalizedDestIP) {
$ipMatch = true;
$matchType = 'dest-partial';
}
// Level 3: Source IP match (log source matches either state IP) - catches related traffic
elseif ($normalizedStateSourceIP === $normalizedSourceIP || $normalizedStateDestIP === $normalizedSourceIP) {
$ipMatch = true;
$matchType = 'source-partial';
}
// Protocol match
// Protocol match - be flexible
$protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol);
// Port match - check if destination port from log matches any port in state
// Also allow match if no port specified or if it's a partial IP match
$portMatch = false;
if (empty($destPort) || $destPort === '-') {
$portMatch = true; // No port specified, match all
@@ -1702,11 +1714,16 @@ class Firewall extends Component
if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) {
$portMatch = true;
}
// For partial matches, also accept if protocol matches even if port doesn't
if (!$portMatch && str_contains($matchType, 'partial') && $protocolMatch) {
$portMatch = true;
}
}
// Log first potential match for debugging
if ($ipMatch && $protocolMatch && $portMatch && count($matchingConnections) === 0) {
Log::info('First match found', [
'match_type' => $matchType,
'state_source' => $stateSourceIP,
'state_dest' => $stateDestIP,
'state_protocol' => $stateProtocol,