Joseph.Rawlings/Virtnet.bond
Private
Public Access
1
0
Fork 0
Code Activity

feat: enhance firewall log matching logic with flexible multi-level IP matching and improved port checks

Browse Source
This commit is contained in:
Joseph.Rawlings
2025-12-04 22:47:23 -05:00
parent 1bad173b3f
commit 27c8a8ebfd
1 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
extensions/Servers/Proxmox/Livewire/Firewall.php
View File

@@ -1677,23 +1677,35 @@ class Firewall extends Component
$normalizedStateDestIP = strtolower(trim($stateDestIP)); $normalizedStateDestIP = strtolower(trim($stateDestIP));
$normalizedProtocol = strtoupper(trim($protocol)); $normalizedProtocol = strtoupper(trim($protocol));
// Matching logic - check if both IPs from the log are present in the state // Flexible matching logic - multiple levels of matching
// Either in the same direction or swapped (for return traffic)
$ipMatch = false; $ipMatch = false;
$matchType = '';
// Direction 1: Log source → Log dest matches State source → State dest // Level 1: Exact bidirectional match (both IPs match in either direction)
if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) { if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) {
$ipMatch = true; $ipMatch = true;
$matchType = 'exact';
} }
// Direction 2: Swapped (return traffic)
elseif ($normalizedStateSourceIP === $normalizedDestIP && $normalizedStateDestIP === $normalizedSourceIP) { elseif ($normalizedStateSourceIP === $normalizedDestIP && $normalizedStateDestIP === $normalizedSourceIP) {
$ipMatch = true; $ipMatch = true;
$matchType = 'exact-reversed';
}
// Level 2: Destination IP match (log dest matches either state IP) - catches related traffic
elseif ($normalizedStateSourceIP === $normalizedDestIP || $normalizedStateDestIP === $normalizedDestIP) {
$ipMatch = true;
$matchType = 'dest-partial';
}
// Level 3: Source IP match (log source matches either state IP) - catches related traffic
elseif ($normalizedStateSourceIP === $normalizedSourceIP || $normalizedStateDestIP === $normalizedSourceIP) {
$ipMatch = true;
$matchType = 'source-partial';
} }
// Protocol match // Protocol match - be flexible
$protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol); $protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol);
// Port match - check if destination port from log matches any port in state // Port match - check if destination port from log matches any port in state
// Also allow match if no port specified or if it's a partial IP match
$portMatch = false; $portMatch = false;
if (empty($destPort) || $destPort === '-') { if (empty($destPort) || $destPort === '-') {
$portMatch = true; // No port specified, match all $portMatch = true; // No port specified, match all
@@ -1702,11 +1714,16 @@ class Firewall extends Component
if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) { if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) {
$portMatch = true; $portMatch = true;
} }
// For partial matches, also accept if protocol matches even if port doesn't
if (!$portMatch && str_contains($matchType, 'partial') && $protocolMatch) {
$portMatch = true;
}
} }
// Log first potential match for debugging // Log first potential match for debugging
if ($ipMatch && $protocolMatch && $portMatch && count($matchingConnections) === 0) { if ($ipMatch && $protocolMatch && $portMatch && count($matchingConnections) === 0) {
Log::info('First match found', [ Log::info('First match found', [
'match_type' => $matchType,
'state_source' => $stateSourceIP, 'state_source' => $stateSourceIP,
'state_dest' => $stateDestIP, 'state_dest' => $stateDestIP,
'state_protocol' => $stateProtocol, 'state_protocol' => $stateProtocol,