ipv4guard.cna

# IPv4Guard
# Version: 0.3
# Author: SavSanta

# Profile
# Optimizations on speed/mem necessary

beacon_command_register(
	"ipv4check",
	"IP helper tool",
	"Usage: IPv4 helper script to determine available IP address or number of usable hosts in a subnet. \nipv4check <ADDR>/<CIDR> <hostcount | hosts>\nipv4check <ADDR> <NETMASK> <hostcount | hosts>\nExample:\n\tipv4check 192.168.1.1/24 hostcount\n\tipv4check 192.168.1.1 255.255.255.0 hosts\n");

global('$hosts');

sub ipv4calc {
    
    local('$splitted $action');

    if (indexOf($2, "/"))
    {
        $splitted = split("/", $2);
        blog2($1, "Assuming CIDR address.");
        iff(vdateip($1, $splitted[0]), ticks(), exit(["ERROR: IP validation"]));
        iff(vdatecidr($1, $splitted[1]), ticks(), exit(["ERROR: CIDR validation"]));
        $cidrsymb = $splitted[1];
        $action = $3;
    }
    else if (($2 ne $null) && ($3 ne $null))
    {
		println("$2 is arg2, and $3 is arg3");
    	$splitted = split(" ", $2);
        blog2($1, "Assuming IP Addr: $2 with Netmask: $3");
        iff(vdateip($1, $2), ticks(), exit(["ERROR: IPAddr validation"]));
        iff(vdateip($1, $3), ticks(), exit(["ERROR: Netmask validation"]));
        $cidrsymb = %netmask2cidr[$3];
        $action = $4;
    }
    else 
    {   
	println("Error else for $2 is arg2, and $3 is arg3");
        berror("Couldnt parse address");
        throw("IPAddr-Netmask Error.");
        exit([""]);
    }
   
   $new = "$splitted[0]"."/$cidrsymb";
   $hosts = iprange($new);
   
   if ($action ismatch 'hostcount')
   {
	printnumhosts($1);
   }
   else if ($action ismatch 'hosts')
   {
   	printallhosts($1);
   }
   else if ($action ismatch 'gethosts')
   {
   	return $hosts;
   }
   else
   {
   	println("Unsupported Action.");
   	println("Errrrrrrorrrrrrrrrr");
   	exit(["ERROR: Unsupported action."]);
   }

}

sub vdatecidr {
    local('$splitted');
    
    if ("$2" !in %cidr2hosts)
    {
        berror($1, "Invalid CIDR Mask: $2");
        return false;
    }
    else 
    {
        return true;
    }

 }
 
 sub vdateip { 

    if ("$2" ismatch '((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}')
    {
        return true;
    }
    else 
    {
    	berror($1, "ERROR: Invalid IPv4 address: $2");
        return false;
    }
 }

sub printnumhosts {

	local('$hc');
	$hc = size($hosts);
	blog2($1, "Hostcount: $hc");
	
}

sub printallhosts { 

	local('$hv');
	$hv = join(", ", $hosts);
	blog2($1, "Hosts: $hv");
}

%cidr2hosts = @(1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32);

%netmask2cidr = 
%(

128.0.0.0	  => "1" ,
192.0.0.0	  => "2" ,
224.0.0.0	  => "3" ,
240.0.0.0	  => "4" ,
248.0.0.0	  => "5" ,
252.0.0.0	  => "6" ,
254.0.0.0	  => "7" ,
255.0.0.0 	  => "8" ,
255.128.0.0       => "9" ,
255.192.0.0       => "10",
255.224.0.0       => "11",
255.240.0.0       => "12",
255.248.0.0       => "13",
255.252.0.0       => "14",
255.254.0.0       => "15",
255.255.0.0       => "16",
255.255.128.0     => "17",
255.255.192.0     => "18",
255.255.224.0     => "19",
255.255.240.0     => "20",
255.255.248.0     => "21",
255.255.252.0     => "22",
255.255.254.0     => "23",
255.255.255.0     => "24",
255.255.255.128   => "25",
255.255.255.192   => "26",
255.255.255.224   => "27",
255.255.255.240   => "28",
255.255.255.248   => "29",
255.255.255.252   => "30",
255.255.255.254   => "31",
255.255.255.255   => "32"
);

alias("ipv4check", &ipv4calc);

##########################
# Merged second CNA script into here due to limitations of the language.
###########################

global('$ac $guardips')
$guardips = @();
# Change ips variable name as it has logical reading naming conflicts

sub handle {
    global('$bid');
    local('$ip $ips');
    # Update Auto Task Cancel setting	
    $ac = $3['autocancel'];
    $ap = $3['combo'];

    # Grab IP address
    $ip = $3['ipaddr'];

    #blog2($bid, "Check the DATA IN IP var ---> $ip");
    #println("Beacone ID is $bid || Check the DATA IN IP var ---> $ip");
 
    # Process ips    
    #$ips = fireAlias($1, "ipv4check", "169.254.254.254/30 gethosts");
    $ips = ipv4calc($bid, $ip, "gethosts") ;
    
    # Dispatch to add/remove/list

    if ($ap ismatch 'Add')
    {
	add_ips($ips);
	blog($bid, "Add action complete.") ;        
    }
    else if ($ap ismatch 'Remove')
    {
	remove_ips($ips);
	blog($bid, "Remove action complete.") ;
    }
    else if ($ap ismatch 'List')
    {
	query_ips();
	blog($bid, "List action complete.") ;
    }
    else 
    {
    	berror($bid, "No match for action in IPGuard") ;
    	return;
    }

}

sub add_ips { 
	global('$guardips');
	addAll($guardips, flatten($1));
}

sub remove_ips {
	global('$guardips');
	removeAll($guardips, flatten($1));

}

sub query_ips {
    global('$guardips');
    blog2($bid, "Hosts: $guardips");
}

on beacon_input {
    local('$iphit');
    global('$guardip');
    # is this the best loop for this?
    # My preferred regex with regex [ismatch '((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}'] produces partitioned chunk arary with [$hit = matched()] and misses last octet. So cant use hence alt regex.
    # This out of all regex options tried is the best fit for AGS limitation.

   # TODO: Need a match logic for CIDR IP inputs too.
   # TODO: In regards to above. Settle on regex. Regex with greater than 4 digits in the last octet either require hte a \s to delineate which then requires a trimmer.
   
   while ("$3" hasmatch '(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})') 
   {
   	$iphit = pop(matched());

   	if ($iphit in $guardips) 
   	{
		if ($ac == true)
		{
			blog2($1, "IP match - $iphit - found in IPGuard.\nAuto-Cancel is ENABLED. Cancelling ALL pending commands for beacon.");
			bclear($1);
			blog2($1, "All Commands Cleared.");
		}
		else
		{
			#blog2($1, " Line -> $3");
			blog2($1, "IP match - $iphit - found in IPGuard.");
			blog2($1, "VERIFY your command.");
		}
	}
    }
    return;
}

popup beacon {
        item "IPv4 Guard" {
                local('$dialog %defaults');
                
		$bid = $1;
                # setup our defaults
                %defaults["autocancel"] = $autocancel;
                %defaults["ipaddr"] = "169.254.254.254/32";
                
                # create our dialog
                $dialog = dialog("IPv4 Guard", %defaults, &handle);
                dialog_description($dialog, "IPv4 Guard - Add or Remove IPv4 addresses to the beacon b	locklist.\nWhen a command with a blocklist/offlimit IP is detected in a beacon, then automatically cancels ALL pending beacon tasks for that beacon.");
                drow_text($dialog, "ipaddr",  "IP Address: ");
                drow_combobox($dialog, "combo", "Action For IP Guard", @("Add", "Remove", "List"));
                drow_checkbox($dialog, "autocancel", "Auto cancel command/tasks on blocked IP", "(Globally affects on *ANY* blocked IP!)");
                dbutton_action($dialog, "Perform");
                # show our dialog
                dialog_show($dialog);
        }
}