Joseph.Rawlings/Virtnet.bond
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: improve firewall log matching logic with relaxed port checks for better accuracy

Browse Source
This commit is contained in:
Joseph.Rawlings
2025-12-04 22:35:23 -05:00
parent 3db1a4c193
commit ab1668213d
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
extensions/Servers/Proxmox/Livewire/Firewall.php
View File

@@ -1702,14 +1702,29 @@ class Firewall extends Component
$protocolMatch = (strtoupper(trim($protocol)) === $stateProtocol);
}
// Check port match (more lenient - check if either port matches)
// Check port match - focus on destination port which is the service port
// Source port is usually ephemeral and not relevant for matching
$portMatch = true;
if (!empty($destPort) && $destPort !== '-') {
$destPortNum = (int)$destPort;
// Match if either state's source or destination port equals the log's destination port
// This handles bidirectional connections
$portMatch = ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum);
}
if (($sourceMatch || $reverseMatch) && $protocolMatch && $portMatch) {
// Also consider matching without port if IPs and protocol match
// This is useful for firewall logs that don't include source port
$relaxedMatch = false;
if (!$sourceMatch && !$reverseMatch && empty($sourcePort)) {
// If no source port in log, be more lenient with matching
if (($normalizedStateSourceIP === $normalizedSourceIP || $normalizedStateDestIP === $normalizedSourceIP) &&
($normalizedStateSourceIP === $normalizedDestIP || $normalizedStateDestIP === $normalizedDestIP) &&
$protocolMatch && $portMatch) {
$relaxedMatch = true;
}
}
if (($sourceMatch || $reverseMatch || $relaxedMatch) && $protocolMatch && $portMatch) {
$bytes = (int)($state['bytes_total'] ?? $state['bytes'] ?? 0);
$packets = (int)($state['packets_total'] ?? $state['packets'] ?? 0);
$stateName = strtoupper($state['state'] ?? 'UNKNOWN');