Joseph.Rawlings/Virtnet.bond
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: enhance network analysis with improved matching logic and detailed logging

Browse Source
This commit is contained in:
Joseph.Rawlings
2025-12-04 22:32:33 -05:00
parent 58adb9b4a5
commit 3db1a4c193
1 changed files with 58 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
extensions/Servers/Proxmox/Livewire/Firewall.php
View File

@@ -1621,8 +1621,19 @@ class Firewall extends Component
// Fetch all firewall states // Fetch all firewall states
$allStates = $client->listStates(); $allStates = $client->listStates();
// Log the search parameters for debugging
Log::info('Searching for network analysis match', [
'sourceIP' => $sourceIP,
'destIP' => $destIP,
'sourcePort' => $sourcePort,
'destPort' => $destPort,
'protocol' => $protocol,
'total_states' => count($allStates)
]);
// Filter states matching the log entry // Filter states matching the log entry
$matchingConnections = []; $matchingConnections = [];
$debugSamples = [];
foreach ($allStates as $state) { foreach ($allStates as $state) {
$rawSource = (string)($state['source'] ?? ''); $rawSource = (string)($state['source'] ?? '');
@@ -1632,6 +1643,16 @@ class Firewall extends Component
$stateSourceIP = $this->extractIpFromField($rawSource); $stateSourceIP = $this->extractIpFromField($rawSource);
$stateDestIP = $this->extractIpFromField($rawDestination); $stateDestIP = $this->extractIpFromField($rawDestination);
// Store first 5 for debugging
if (count($debugSamples) < 5) {
$debugSamples[] = [
'raw_source' => $rawSource,
'raw_destination' => $rawDestination,
'extracted_source' => $stateSourceIP,
'extracted_dest' => $stateDestIP,
];
}
// Extract ports // Extract ports
$stateSourcePort = null; $stateSourcePort = null;
$stateDestPort = null; $stateDestPort = null;
@@ -1650,26 +1671,42 @@ class Firewall extends Component
$stateProtocol = strtoupper($state['protocol'] ?? ''); $stateProtocol = strtoupper($state['protocol'] ?? '');
// Check if this state matches the log entry // More flexible matching - try multiple approaches
// Match can be source->dest or dest->source (bidirectional) $normalizedSourceIP = strtolower(trim($sourceIP));
$sourceMatch = ( $normalizedDestIP = strtolower(trim($destIP));
strtolower(trim($stateSourceIP)) === strtolower(trim($sourceIP)) && $normalizedStateSourceIP = strtolower(trim($stateSourceIP));
strtolower(trim($stateDestIP)) === strtolower(trim($destIP)) $normalizedStateDestIP = strtolower(trim($stateDestIP));
);
$reverseMatch = ( // Check if this state matches the log entry (more lenient matching)
strtolower(trim($stateSourceIP)) === strtolower(trim($destIP)) && $sourceMatch = false;
strtolower(trim($stateDestIP)) === strtolower(trim($sourceIP)) $reverseMatch = false;
);
// Check protocol match // Try exact match
$protocolMatch = empty($protocol) || if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) {
strtoupper(trim($protocol)) === $stateProtocol; $sourceMatch = true;
} elseif ($normalizedStateSourceIP === $normalizedDestIP && $normalizedStateDestIP === $normalizedSourceIP) {
$reverseMatch = true;
}
// Check port match (if specified in log) // Try partial match (contains) for cases where IP format differs
if (!$sourceMatch && !$reverseMatch) {
if ((str_contains($normalizedStateSourceIP, $normalizedSourceIP) || str_contains($normalizedSourceIP, $normalizedStateSourceIP)) &&
(str_contains($normalizedStateDestIP, $normalizedDestIP) || str_contains($normalizedDestIP, $normalizedStateDestIP))) {
$sourceMatch = true;
}
}
// Check protocol match (more lenient)
$protocolMatch = true;
if (!empty($protocol) && $protocol !== '-') {
$protocolMatch = (strtoupper(trim($protocol)) === $stateProtocol);
}
// Check port match (more lenient - check if either port matches)
$portMatch = true; $portMatch = true;
if (!empty($destPort) && $destPort !== '-') { if (!empty($destPort) && $destPort !== '-') {
$portMatch = ($stateDestPort == $destPort) || ($stateSourcePort == $destPort); $destPortNum = (int)$destPort;
$portMatch = ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum);
} }
if (($sourceMatch || $reverseMatch) && $protocolMatch && $portMatch) { if (($sourceMatch || $reverseMatch) && $protocolMatch && $portMatch) {
@@ -1697,6 +1734,12 @@ class Firewall extends Component
} }
} }
// Log results for debugging
Log::info('Network analysis match results', [
'matches_found' => count($matchingConnections),
'debug_samples' => $debugSamples
]);
// Sort by bytes (highest first) // Sort by bytes (highest first)
usort($matchingConnections, fn($a, $b) => $b['bytes'] <=> $a['bytes']); usort($matchingConnections, fn($a, $b) => $b['bytes'] <=> $a['bytes']);