diff --git a/admin/database_updates/2.7.2.php b/admin/database_updates/2.7.2.php new file mode 100644 index 000000000..e984ef047 --- /dev/null +++ b/admin/database_updates/2.7.2.php @@ -0,0 +1,27 @@ + +
+
New IP Address
+ +
+
+ + + +
+ +
+ +
+ + +
+ — +
+ +
+ +
+ + +
+
+ +
+ +
+ + +
+
+ +
+
+ + +
+
+ + +
+
Editing
+ +
+
+ + + +
+ +
+ +
+ + +
+ — +
+ +
+ +
+ + +
+
+ +
+ +
+ + +
+
+ +
+
+ + +
+
+ + + +
+
Export IP Addresses
+ +
+
+ + + +
+ + + +
+
+ +
+
+ + + +
+
Import IP Addresses
+ +
+
+ + + +
+

Format csv file with headings & data:
IP Address, Hostname, Description

+

Importing into (). Rows that aren't a valid address, fall outside the subnet, or are already documented here are skipped.

+
+
+ +
+
+
Download: sample csv template
+
+
+ + +
+
+ +

Nothing to see here

Go Back"; + +} else { + + $row = mysqli_fetch_assoc($sql); + $client_id = intval($row['network_client_id']); + $client_name = escapeHtml($row['client_name']); + $network_name = escapeHtml($row['network_name']); + $network_description = escapeHtml($row['network_description']); + $network_vlan = intval($row['network_vlan']); + $network = escapeHtml($row['network']); + $network_gateway = escapeHtml($row['network_gateway']); + $network_primary_dns = escapeHtml($row['network_primary_dns']); + $network_secondary_dns = escapeHtml($row['network_secondary_dns']); + $network_dhcp_range = escapeHtml($row['network_dhcp_range']); + $network_notes = escapeHtml($row['network_notes']); + $location_name = escapeHtml($row['location_name']); + + // Belt and braces - the query above is already scoped, but the no-client_id + // entry point relies entirely on clientScopeSql() + enforceClientAccess(); + + // Sorting - the search box posts back through filter_header.php, which will + // accept any lowercase column name, so keep this to columns that exist + if (!in_array($sort, ['ip_address', 'ip_hostname', 'ip_description'], true)) { + $sort = 'ip_address'; + } + + // Addresses sort by value, not as text - .9 belongs before .10, and this is + // the one ordering that works for IPv4 and IPv6 in the same column + $order_by = ($sort === 'ip_address') ? "INET6_ATON(ip_address)" : $sort; + + $sql_ips = mysqli_query( + $mysqli, + "SELECT SQL_CALC_FOUND_ROWS ip_address, ip_description, ip_hostname, ip_id FROM network_ips + WHERE ip_network_id = $network_id + AND (ip_address LIKE '%$q%' OR ip_hostname LIKE '%$q%' OR ip_description LIKE '%$q%') + ORDER BY $order_by $order LIMIT $record_from, $record_to" + ); + + $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + + ?> + +
+ +
+ +
+
+ +

+ +
+ +
+
+
+ +
VLAN
+ +
+ +
+ +
+ +
+ +
+ +
+ + All Networks + +
+
+
+ + +
+
+
Notes
+
+
+ +
+
+ + +
+ +
+ +
+
+

IP Addresses

+
+
+ + +
+ 0) { ?> + + Export + +
+ + + Import + +
+
+
+
+
+
+ + + + +
+ +
+
+ + +
+
+ +
+
+ +
+
+ +
+
+
+
+ +
+ + + + "> + + + + + + + + + + + + + + + + + + + + + +
+
+ +
+ 		+ + IP Address + + + + Hostname + + + + Description + + Action
+
+ +
+ 		+ + + + +
+ +
+ + Edit + +
+ + Delete + +
+
+
+ +
+
+ +
+ +
+ +
+ + + + @@ -298,11 +300,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - +
-
+
+ + + + +
@@ -323,6 +330,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+ + IP Addresses + +
Edit @@ -338,7 +349,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + Archive diff --git a/agent/post/network_ip.php b/agent/post/network_ip.php new file mode 100644 index 000000000..c62e34dac --- /dev/null +++ b/agent/post/network_ip.php @@ -0,0 +1,341 @@ +$ip_address documented"); + + redirect(); + +} + +if (isset($_POST['edit_network_ip'])) { + + validateCSRFToken(); + + enforceUserPermission('module_support', 2); + + require_once 'network_ip_model.php'; + + $ip_id = intval($_POST['ip_id']); + + $network_id = intval(getFieldById('network_ips', $ip_id, 'ip_network_id')); + + $client_id = intval(getFieldById('networks', $network_id, 'network_client_id')); + + enforceClientAccess(); + + // The row's own id is excluded so saving without changing the address + // doesn't trip the duplicate check against itself + $ip_error = checkIpForNetwork($ip_address, $network_id, $ip_id); + + if ($ip_error) { + flashAlert($ip_error, 'error'); + redirect(); + } + + $ip_address_escaped = escapeSql($ip_address); + + mysqli_query($mysqli, "UPDATE network_ips SET ip_address = '$ip_address_escaped', ip_hostname = '$hostname', ip_description = '$description' WHERE ip_id = $ip_id"); + + $network_name = escapeSql(getFieldById('networks', $network_id, 'network_name')); + + logAudit("IP Address", "Edit", "$session_name edited IP $ip_address_escaped on network $network_name", $client_id, $ip_id); + + flashAlert("IP $ip_address updated"); + + redirect(); + +} + +if (isset($_GET['delete_network_ip'])) { + + validateCSRFToken(); + + enforceUserPermission('module_support', 2); + + $ip_id = intval($_GET['delete_network_ip']); + + // Get IP and Client ID for logging and alert message + $sql = mysqli_query($mysqli, "SELECT ip_address, network_client_id FROM network_ips LEFT JOIN networks ON network_id = ip_network_id WHERE ip_id = $ip_id"); + $row = mysqli_fetch_assoc($sql); + $ip_address = escapeSql($row['ip_address']); + $client_id = intval($row['network_client_id']); + + enforceClientAccess(); + + mysqli_query($mysqli, "DELETE FROM network_ips WHERE ip_id = $ip_id"); + + logAudit("IP Address", "Delete", "$session_name deleted IP $ip_address", $client_id); + + flashAlert("IP $ip_address deleted", 'error'); + + redirect(); + +} + +if (isset($_POST['bulk_delete_network_ips'])) { + + validateCSRFToken(); + + enforceUserPermission('module_support', 2); + + if (isset($_POST['network_ip_ids'])) { + + // Get Selected Count + $count = count($_POST['network_ip_ids']); + + $client_id = 0; + + // Cycle through array and delete each IP + foreach ($_POST['network_ip_ids'] as $ip_id) { + + $ip_id = intval($ip_id); + + // Get IP and Client ID for logging and the access check + $sql = mysqli_query($mysqli, "SELECT ip_address, network_client_id FROM network_ips LEFT JOIN networks ON network_id = ip_network_id WHERE ip_id = $ip_id"); + $row = mysqli_fetch_assoc($sql); + $ip_address = escapeSql($row['ip_address']); + $client_id = intval($row['network_client_id']); + + enforceClientAccess(); + + mysqli_query($mysqli, "DELETE FROM network_ips WHERE ip_id = $ip_id"); + + logAudit("IP Address", "Delete", "$session_name deleted IP $ip_address", $client_id); + + } + + logAudit("IP Address", "Bulk Delete", "$session_name deleted $count IP(s)", $client_id); + + flashAlert("Deleted $count IP(s)", 'error'); + + } + + redirect(); + +} + +if (isset($_GET['download_network_ips_csv_template'])) { + + enforceUserPermission('module_support'); + + $network_id = intval($_GET['download_network_ips_csv_template']); + + $client_id = intval(getFieldById('networks', $network_id, 'network_client_id')); + + enforceClientAccess(); + + $network_name = getFieldById('networks', $network_id, 'network_name'); + + $delimiter = ","; + $enclosure = '"'; + $escape = '\\'; + $filename = toAlphanumeric($network_name) . "-IPs-Template.csv"; + + // Create a file pointer + $f = fopen('php://memory', 'w'); + + // Set column headers + $fields = array('IP Address', 'Hostname', 'Description'); + fputcsv($f, $fields, $delimiter, $enclosure, $escape); + + // Move back to beginning of file + fseek($f, 0); + + // Set headers to download file rather than displayed + header('Content-Type: text/csv'); + header('Content-Disposition: attachment; filename="' . $filename . '";'); + + // Output all remaining data on a file pointer + fpassthru($f); + exit; + +} + +if (isset($_POST['import_network_ips_csv'])) { + + validateCSRFToken(); + + enforceUserPermission('module_support', 2); + + $network_id = intval($_POST['network_id']); + + $client_id = intval(getFieldById('networks', $network_id, 'network_client_id')); + + enforceClientAccess(); + + $network_name = escapeSql(getFieldById('networks', $network_id, 'network_name')); + + $error = false; + + // File provided? + if (!empty($_FILES['file']['tmp_name'])) { + $file_name = $_FILES['file']['tmp_name']; + } else { + flashAlert("Please select a file to upload.", 'error'); + redirect(); + } + + // Check file is CSV + $file_parts = explode('.', $_FILES['file']['name']); + $file_extension = strtolower(end($file_parts)); + if ($file_extension !== 'csv') { + $error = true; + flashAlert("Bad file extension - only .csv files are accepted.", 'error'); + } + + // Check file isn't empty + elseif ($_FILES['file']['size'] < 1) { + $error = true; + flashAlert("Bad file size (empty file?).", 'error'); + } + + // Check column count (IP Address, Hostname, Description) + else { + $f = fopen($file_name, 'r'); + $f_columns = fgetcsv($f, 1000, ','); + fclose($f); + + if (count($f_columns) !== 3) { + $error = true; + flashAlert("Bad column count - expected 3 columns: IP Address, Hostname, Description.", 'error'); + } + } + + // Parse and insert + if (!$error) { + + $file = fopen($file_name, 'r'); + fgetcsv($file, 1000, ','); // Skip header row + + $row_count = 0; + $skipped_count = 0; + + while (($column = fgetcsv($file, 1000, ',')) !== false) { + + $ip_address = trim($column[0] ?? ''); + $hostname = escapeSql($column[1] ?? ''); + $description = escapeSql($column[2] ?? ''); + + // Skip blank lines + if ($ip_address === '') { + continue; + } + + // Same safeguards as the add form - invalid, out of subnet or + // already documented all mean skip. Rows inserted earlier in this + // same run are in the table already, so a file that repeats an + // address imports it once + if (checkIpForNetwork($ip_address, $network_id) !== '') { + $skipped_count++; + continue; + } + + $ip_address_escaped = escapeSql($ip_address); + + mysqli_query($mysqli, "INSERT INTO network_ips SET ip_address = '$ip_address_escaped', ip_hostname = '$hostname', ip_description = '$description', ip_network_id = $network_id"); + + $row_count++; + + } + + fclose($file); + + logAudit("IP Address", "Import", "$session_name imported $row_count IP(s) to network $network_name. $skipped_count row(s) skipped", $client_id); + + flashAlert("$row_count IP(s) imported, $skipped_count skipped (invalid, outside the subnet or already documented)"); + + } + + redirect(); + +} + +if (isExportRequest('export_network_ips')) { + + validateCSRFToken(); + + // Exports are reads - see CONTRIBUTING.md + enforceUserPermission('module_support'); + + $format = resolveExportFormat($_POST['export_network_ips']); + + $network_id = intval($_POST['network_id']); + + $client_id = intval(getFieldById('networks', $network_id, 'network_client_id')); + + enforceClientAccess(); + + $network_name = getFieldById('networks', $network_id, 'network_name'); + + // Scoped to the one network, so no page filters apply + $sql = mysqli_query( + $mysqli, + "SELECT ip_address, ip_hostname, ip_description, network_name, client_name FROM network_ips + LEFT JOIN networks ON network_id = ip_network_id + LEFT JOIN clients ON client_id = network_client_id + WHERE ip_network_id = $network_id + ORDER BY INET6_ATON(ip_address) ASC" + ); + + $num_rows = mysqli_num_rows($sql); + + if ($num_rows > 0) { + + guardExportPdfRowCount($format, $num_rows); + + $export = beginExport('network_ips', $format, toAlphanumeric($network_name) . '-IPs', "$network_name - IP Addresses", ''); + + while ($row = mysqli_fetch_assoc($sql)) { + addExportRow($export, $row); + } + + finishExport($export); + } + + logAudit("IP Address", "Export", "$session_name exported $num_rows IP(s) to a " . strtoupper($format) . " file", $client_id); + + exit; + +} diff --git a/agent/post/network_ip_model.php b/agent/post/network_ip_model.php new file mode 100644 index 000000000..46aca7c6a --- /dev/null +++ b/agent/post/network_ip_model.php @@ -0,0 +1,9 @@ + ['label' => 'Secondary DNS'], ], + 'network_ips' => [ + 'ip_address' => ['label' => 'IP Address'], + 'ip_hostname' => ['label' => 'Hostname', 'weight' => 2], + 'ip_description' => ['label' => 'Description', 'weight' => 3], + // Available from the handler's join but not exported by default - + // the export is always scoped to one network of one client + 'network_name' => ['label' => 'Network', 'default' => false], + 'client_name' => ['label' => 'Client', 'default' => false], + ], + 'certificates' => [ 'certificate_name' => ['label' => 'Name', 'weight' => 2], 'certificate_description' => ['label' => 'Description', 'weight' => 3], diff --git a/functions/network.php b/functions/network.php new file mode 100644 index 000000000..c2d9a9b1e --- /dev/null +++ b/functions/network.php @@ -0,0 +1,227 @@ + $octet) { + $octets[$index] = ltrim($octet, '0'); + if ($octets[$index] === '') { + $octets[$index] = '0'; + } + } + $ip = implode('.', $octets); + } + + $bin = @inet_pton($ip); + + if ($bin === false) { + return false; + } + + return inet_ntop($bin); + +} + +/* + * Parses a subnet into its binary network address and prefix length. + * + * Accepts CIDR (192.168.1.0/24, 2001:db8::/64) and the dotted-mask form + * (192.168.1.0/255.255.255.0) that hand-entered records sometimes carry. + * + * Returns ['network' => , 'prefix' => int, 'bytes' => 4|16], + * or false when the value isn't something we can reason about. + */ +function parseSubnet($subnet) { + + $subnet = trim($subnet); + + if (strpos($subnet, '/') === false) { + return false; + } + + list($address, $prefix) = explode('/', $subnet, 2); + + $bin = @inet_pton(trim($address)); + + if ($bin === false) { + return false; + } + + $bytes = strlen($bin); + $prefix = trim($prefix); + + // Dotted subnet mask (IPv4 only) - count the leading 1 bits + if (strpos($prefix, '.') !== false) { + + $mask_bin = @inet_pton($prefix); + + if ($mask_bin === false || strlen($mask_bin) !== 4 || $bytes !== 4) { + return false; + } + + $mask_bits = ''; + for ($i = 0; $i < 4; $i++) { + $mask_bits .= str_pad(decbin(ord($mask_bin[$i])), 8, '0', STR_PAD_LEFT); + } + + // Must be contiguous - 255.255.254.0 is a mask, 255.0.255.0 is a typo + if (!preg_match('/^(1*)0*$/', $mask_bits, $match)) { + return false; + } + + $prefix = strlen($match[1]); + + } elseif (!ctype_digit($prefix)) { + return false; + } + + $prefix = intval($prefix); + + if ($prefix < 0 || $prefix > $bytes * 8) { + return false; + } + + return [ + 'network' => applyIpMask($bin, $prefix), + 'prefix' => $prefix, + 'bytes' => $bytes, + ]; + +} + +/* + * Zeroes every bit past the prefix length, giving the network address. + * Operates on the packed binary form from inet_pton(). + */ +function applyIpMask($bin, $prefix) { + + $bytes = strlen($bin); + + for ($i = 0; $i < $bytes; $i++) { + + $bits_left = $prefix - ($i * 8); + + if ($bits_left >= 8) { + continue; + } + + if ($bits_left <= 0) { + $bin[$i] = chr(0); + } else { + $bin[$i] = chr(ord($bin[$i]) & ((0xFF << (8 - $bits_left)) & 0xFF)); + } + + } + + return $bin; + +} + +/* + * True when the address falls inside the subnet. Families must match - an IPv4 + * address is never inside an IPv6 subnet and vice versa. + * + * Returns TRUE when the subnet itself can't be parsed. Networks created before + * the CIDR field was there can hold anything, and refusing to let someone + * document addresses on those is worse than not checking them. + */ +function isIpInSubnet($ip, $subnet) { + + $parsed = parseSubnet($subnet); + + if ($parsed === false) { + return true; + } + + $bin = @inet_pton(trim($ip)); + + if ($bin === false || strlen($bin) !== $parsed['bytes']) { + return false; + } + + return applyIpMask($bin, $parsed['prefix']) === $parsed['network']; + +} + +/* + * The two safeguards on a documented IP, in one place so add, edit and CSV + * import can't drift apart: the address must be valid and inside its network's + * subnet, and the network must not already have it. + * + * $ip is rewritten by reference to its canonical form, so callers store what + * was checked rather than what was typed. + * + * Returns an error message for the user, or an empty string when it's good. + * Pass the row's own id as $ignore_ip_id when editing so a row doesn't collide + * with itself. + */ +function checkIpForNetwork(&$ip, $network_id, $ignore_ip_id = 0) { + + global $mysqli; + + $original = trim($ip); + $normalized = normalizeIpAddress($original); + + if ($normalized === false) { + return "$original is not a valid IP address"; + } + + $ip = $normalized; + + $network_id = intval($network_id); + $subnet = getFieldById('networks', $network_id, 'network'); + + if (!isIpInSubnet($ip, $subnet)) { + return "$ip is outside $subnet"; + } + + $ip_escaped = escapeSql($ip); + $ignore_ip_id = intval($ignore_ip_id); + + $sql = mysqli_query( + $mysqli, + "SELECT ip_id FROM network_ips + WHERE ip_network_id = $network_id + AND ip_address = '$ip_escaped' + AND ip_id != $ignore_ip_id + LIMIT 1" + ); + + if (mysqli_num_rows($sql) > 0) { + return "$ip is already documented on this network"; + } + + return ''; + +}