pfSense

<?php

/*

 * parser_dhcpv6_leases.inc

 *

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * Copyright (c) 2014-2019 Rubicon Communications, LLC (Netgate)

 * All rights reserved.

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

require_once 'tools_for_debugging_n_testing.inc';

require_once 'parser_ipv6.inc';

/*

 * Moved over from status_dhcpv6_leases.php

 */

function parse_duid($duid_string) {

	$parsed_duid = array();

	for ($i = 0; $i < strlen($duid_string); $i++) {

		$s = substr($duid_string, $i, 1);

		if ($s == '\\') {

			$n = substr($duid_string, $i+1, 1);

			if (($n == '\\') || ($n == '"')) {

				$parsed_duid[] = sprintf("%02x", ord($n));

				$i += 1;

			} else {

				$n = substr($duid_string, $i+1, 3);

				if (preg_match('/[0-3][0-7]{2}/', $n)) {

					$parsed_duid[] = sprintf("%02x", octdec($n));

					$i += 3;

				}

			}

		} else {

			$parsed_duid[] = sprintf("%02x", ord($s));

		}

	}

	$iaid = array_slice($parsed_duid, 0, 4);

	$duid = array_slice($parsed_duid, 4);

	return array($iaid, $duid);

}

/*

 * Moved over from status_dhcpv6_leases.php

 */

	$ndpdata = array();

	foreach ($rawdata as $line) {

		$elements = preg_split('/\s+/ ', $line);

		if ($elements[1] != "(incomplete)") {

			$ndpent = array();

			$ip = trim(str_replace(array('(', ')'), '', $elements[0]));

			$ndpent['mac'] = trim($elements[1]);

			$ndpent['interface'] = trim($elements[2]);

			$ndpdata[$ip] = $ndpent;

		}

	}

	return $ndpdata;

}

const IA_NA = 1;

const IA_PD = 2;

const IA_TA = 3;

/*

 * returns false if it was not possible to parse the leases.

 */

	if ($amount_of_matches == false) {

		return false;

	}

			   'duid' => implode(":", $iaid_duid[1]) ];

		general_debug($entry, 'duid');

		if (preg_match('/^ia-na$/i', $val['IA_ASSOC'])) {

			gui_parse_single_lease(IA_PD, $val['NEXT_LEVEL'], $lang_pack, $ndpdata, $mappings, $entry);

			$prefixes[] = $entry;

		} elseif (preg_match('/^ia-ta$/i', $val['IA_ASSOC'])) {

	// Handle failover - NOTE Experimental;

	// has not been tested on a live configured system.

	$amount_of_leases = 0;

		gui_parse_single_failover($val['NEXT_LEVEL'], $entry);

	general_debug('Prefixes', $prefixes);

	general_debug('Mappings', $mappings);

	general_debug('Pools', $pools);

	switch ($type) {

		case IA_NA:

			preg_match_all('/'.na_regex.'/i', $content, $matches, PREG_SET_ORDER);

			break;

		case IA_PD:

			preg_match_all('/'.pd_regex.'/i', $content, $matches, PREG_SET_ORDER);

			break;

		// case IA_TA: // Not implemented in pfSense.

		default:

			general_debug('Error: Unhandled lease type.');

			return -1;

	foreach ($matches as $val) {

		general_debug("Matched: " . $val[0]);

			general_debug($val, 'WEEKDAY', 'DATE', 'YEAR', 'MONTH', 'DAY', 'TIME');

			return $val['DATE'] . ' ' . $val['TIME'];});

			general_debug($val, 'NEXT_LEVEL');

			gui_handle_ia($val['NEXT_LEVEL'], $entry, $lang_pack);

		}

		// For now it does not matter that this goes last.

		if ($type === IA_NA) {

		} elseif ($type === IA_PD) {

			gui_parse_single_pd_lease($val, $lang_pack, $entry);

}

	if (setnlen($val, 'ADDRESS')) {

	  	general_debug($val, 'ADDRESS');

		if (count($space_result) == 1) {

				general_debug("We have a valid ipv6 address");

				if (check_n_set($entry, 'ip', $space_result[0]['MATCH'], true)) {

					// In general we trust that $lang_pack exists with values so no checking (either

					// it works for a certain language/translation or it does not (for all entries.)

					check_n_set($entry, 'type', $lang_pack['dynamic'], true);

					in_array($entry['ip'], array_keys($ndpdata))

						? check_n_set($entry, 'online',	$lang_pack['online'], true)

						: check_n_set($entry, 'online',	$lang_pack['offline'], true);

					// mappings - using DUID and IAID

					if (setnlen($entry, 'duid') && setnlen($entry, 'iaid')) {

						// We assume $mappings array exist - else nothing works.

						general_debug('Setting the mappings array for DUID ' . $entry['duid'] .

							      ' with IAID ' . $entry['iaid'] . ' as index with value ' .

							      $entry['ip']);

						check_n_set($mappings[$entry['duid']], $entry['iaid'], $entry['ip'], true);

					} else {

						general_debug('WARNING: DUID or IAID is missing in entry. Likely either has zero length content.');

					}

				} // else { } - we use overwrite set to true and entry must have been set.

			} else {

				general_debug('Unknown problem with IPv6 address. See output just above.');

			general_debug('WARNING: Count of IPv6 addresses is: '.count($space_result));

	}

}

	if (setnlen($val, 'SPACE')) {

		general_debug($val, 'SPACE');

		if (count($space_result) == 1) {

				general_debug("We have a valid ipv6 address");

				    preg_match('/::$/', $space_result[0]['CMR6'])) {

					general_debug("that is properly terminated with ::");

				} else {

					general_debug(", but not a proper subnet that ends with ::");

					function () use (&$val, &$lang_pack, &$entry, &$space_result) {

					check_n_set($entry, 'type', $lang_pack['dynamic'], true);

					return $space_result[0]['MATCH'].'/'.$val['PREFIX'];});

			} else {

				general_debug('Unknown problem with IPv6 address. See output just above.');

			general_debug('WARNING: Count of IPv6 addresses is: '.count($space_result));

	}

}

function gui_handle_ia($content, &$entry, $lang_pack) {

	/* The reason why we use foreach and not simply just try lookup content is due to the

	 * fact that we match with alternation different sets of values from different

	 * regex groups.

	 * In theory one set/group could be repeated inside $ia_matches which means we want to

	 * know if that is the case. check_n_set makes sure to check if the value exists already

	 * and returns debug info about that.

	 */

				case "active":

					break;

				case "expired":

					check_n_set($entry, 'act', $lang_pack['expired'], true);

				case "free":

					check_n_set($entry, 'online', $lang_pack['offline'], true);

				case "backup":

					check_n_set($entry, 'online', $lang_pack['offline'], true);

				case "released":

					check_n_set($entry, 'online', $lang_pack['offline'], true);

					break;

				default:

					general_debug('Notice: Binding state "' . $ia_val['BINDINGSTATE'] .

						      '" is not handled.');

			}

		check_value_set_entry($ia_val, 'PREFLIFE');

		// does not seem to be used by lease gui so we do not set anything; we just debug.

		check_value_set_entry($ia_val, 'MAXLIFE');

		check_value_set_entry($ia_val, 'ENDS', $entry, 'end', true, function () use (&$ia_val) {

			general_debug($ia_val, 'WEEKDAY', 'DATE', 'YEAR', 'MONTH', 'DAY', 'TIME');

			return $ia_val['DATE'] . ' ' . $ia_val['TIME'];});

}

	preg_match_all('/'.failover_level1_regex.'/i', $content, $matches, PREG_SET_ORDER);

	 * fact that we match with alternation different sets of values from different

	 * regex groups.

	 * In theory one set/group could be repeated inside $matches which means we want to

	 * know if that is the case. check_value_set_entry makes sure to check if the value

	 * exists already and returns debug info about that.

	 */

		check_value_set_entry($val, 'MYDATE', $entry, 'mydate', true,

				      function () use (&$val) {return $val['DATE'] . ' ' . $val['TIME'];});

		check_value_set_entry($val, 'PEERSTATE', $entry, 'peerstate', true);

		check_value_set_entry($val, 'PEERDATE', $entry, 'peerdate', true,

				      function () use (&$val) {return $val['PDATE'] . ' ' . $val['PTIME'];});

		/* Does not seem to be used by lease gui so we do not set anything; we just debug.

		 * mclt (Maximum Client Lead Time):

		 * https://kb.isc.org/article/AA-00502/0/A-Basic-Guide-to-Configuring-DHCP-Failover.html

		 * https://kb.isc.org/article/AA-00268/0/DHCP-Failover-and-MCLT-configuration-implications.html

		 */

		check_value_set_entry($val, 'MCLT');

}

/* Main leases - Level 0

 * regex matches the outer/top level of a lease

 * We allow free spacing and comments with (?x)

 * We capture:

 * . the identity association of a temporary address and non-temporary address

 * and delegated prefix (IA-TA, IA-NA and IA-PD)

 * . the partly octal encoded iaid + duid (Identity association identifier + DHCP Unique Identifier)

 * . the content at the next level,

 * but our matching also reuses our

 * current match (RECURSE) to make sure

 * there is a balance to the curly braces {}

 * semicolons where there are no curly braces

 * and sub-content to curly braces - but neither the

 * next level and sub levels are directly

 * individually matched/captured (that is for later

 * regex matches to achieve!)

 *

 *	 \x5C = \

 *	 Octal numbers are the characters that are found in the IAID and DUID with a

 *	 backslash \ in front of them.

 *	 Hex values in ranges are those characters that are printed as characters (not

 *	 octal values):

 *	 [\x20\x21\x23-\x5B\x5D-\x7E]

 *	 1. See ascii table that includes hex values:

 *	    https://en.wikipedia.org/wiki/ASCII#Printable_characters

 *	    https://en.wikipedia.org/wiki/ASCII#Character_set

 *	 2. Check: https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=common/print.c

 *	 3. isprint is more limited than isascii: http://www.cplusplus.com/reference/cctype/isprint/

 */

/* Notice (?x) must be a the beginning of the line - cannot be tabbed in,

 * because free spacing mode must start at the very beginning (^) of the

 * content.

 */

const base_regex = <<<'BASE'

(?x)

	(?'IA_ASSOC'ia-(?>ta|na|pd))

	\s+"

	(?'IAID_DUID'

		(?>

				[\x20\x21\x23-\x5B\x5D-\x7E]

			|

				\x5C

				(?>

						"

					|

						\x5C

					|

						(?>00[0-7]|0[1-3][0-7]|177|[2-3][0-7]{2})

				)

		)*

	)

	"\s+

	\{

		(?'NEXT_LEVEL'

			(?>

				\s*

				(?>

						[^\{\}\n]+;

					|

						[^\{\}\n]+

						\s*

						\{

							(?&NEXT_LEVEL)

						\}

						\s*

				)*

			)*

		)

	\}

BASE;

/* Inside the: (?'NEXT_LEVEL' ... )

 * various white space characters where substituted with \s* to match all white

 * space, but at different places before the substitutions some of the white

 * space characters were as mentioned below and their purpose:

 * *  (star) needed for when no space or newline e.g. nested {} is used in e.g.:

 *    something {dww w{} w {d;}}

 * \n (new line) needed for quicker matching (here)

 * \  (space) needed so we eat all space before a faulty double {}:

 *    something {} {}

 *    , is repeated - which we consider illegal.

 * \ \n has been substituted with \s to cover more white space characters!

 */

/* https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=includes/dhcpd.h

 * struct lease etc. and various write_lease methods

 *

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=server/db.c

 * method for write lease file content is found here e.g. write_lease()

 *

 * Notice lease time entries are written with C gmtime() as UTC:

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=common/print.c

 * const char * print_time(TIME t) last else clause:

 * if (strftime(buf, sizeof(buf), "%w %Y/%m/%d %H:%M:%S;",

 *                              gmtime(&t)) == 0)

 */

const date_time = <<<'DATETIME'

	(?'WEEKDAY'[0-6])\s+

	(?'DATE'

		(?'YEAR'\d+)\/(?'MONTH'(?>0[1-9]|1[0-2]))\/

		(?'DAY'(?>0[1-9]|[1-2][0-9]|30|31))

	)\s+

	(?'TIME'(?>[0-1][0-9]|2[0-3]):(?>[0-5][0-9]):(?>[0-5][0-9]|60))

DATETIME;

// Level 1

const common_napd_top =

'(?x)

cltt\s+(?\'CLTT\''.date_time.');|';

# Perform real check of the IPv6 address/space somewhere else.

const pd_specific = <<<'PD'

iaprefix\s+(?'SPACE'[\.\da-fA-F:]*)\/(?'PREFIX'\d{1,3})\s+\{

PD;

const na_specific = <<<'NA'

iaaddr\s+(?'ADDRESS'[\.\da-fA-F:]*)\s+\{

NA;

/* Level 1

 * This part handles matching properly placed curly braces and semicolons.

 * If in doubt just do experiments! To achieve matching the curly braces we need

 * to check at all levels however we do just capture it all since matching the

 * Same idea as with base_regex above, but not expanded to save space.

 */

const common_napd_bottom = <<<'COMMON'

(?'NEXT_LEVEL'(?>\s*

(?>[^\{\}\n]+;|

[^\{\}\n]+\s*\{

(?&NEXT_LEVEL)

\}\s*

)*)*)

\}

COMMON;

/* Level 2 stuff

 * binding state names defined in array binding_state_names

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=server/stables.c

 * "free", "active", "expired", "released", "abandoned", "reset", "backup"

 * write_lease and write_ia use binding_state_names in:

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=server/db.c

const ia_regex =

'(?x)

(binding\s+state\s+(?\'BINDINGSTATE\'free|active|expired|released|abandoned|reset|backup)|

preferred-life\s+(?\'PREFLIFE\'\d+)|

max-life\s+(?\'MAXLIFE\'\d+)|

ends\s+(?\'ENDS\''.date_time.'));\s*';

const pd_regex = common_napd_top."\n".pd_specific."\n".common_napd_bottom;

const na_regex = common_napd_top."\n".na_specific."\n".common_napd_bottom;

/* Print these out if you would like to test and debug with (online) tools such

   as https://regex101.com - you could also test and debug some parts mentioned

   above. Just use the raw lease file as input and see how they match. */

// NOTE THIS IS NOT TESTED ON A REAL FAILOVER CONFIGURED SYSTEM

/*

 * Handling of failover base - level 0

 * Documentation is misleading so the source of ISC DHCP server is the best

 * resource combined with this article:

 * https://deepthought.isc.org/article/AA-00252/31/Putting-the-working-server-in-a-failover-pair-into-partner-down-state.html

 * , that seems to be right! Whereas the documentation tells something different

 * in: https://www.isc.org/wp-content/uploads/2017/08/dhcp43leases.html

 * , it writes: peer state state at date;

 * For more about how we implement see under level 1 below.

 *

 * FPN = failover pair name

 * Relevant source places:

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=server/db.c

 * method: write_failover_state

 *

 * Same idea as with base_regex above, but not expanded to save space.

 */

const failover_base_regex = <<<'FAILOVERBASE'

(?x)

	failover\s+peer\s+\"(?'FPN'.*)\"\s+state\s+\{

	(?'NEXT_LEVEL'(?>\s*

	(?>[^\{\}\n]+;|

	[^\{\}\n]+\s*\{

	(?&NEXT_LEVEL)

	\}\s*

	)*)*)

	\}

FAILOVERBASE;

/*

 * Handling of failover statements - level 1

 *

 * Definition of state names:

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=server/failover.c;h=25e1b72b5ed1705981fa7867d7c6172daa27f5a0;hb=HEAD

 * const char *dhcp_failover_state_name_print (enum failover_state state)

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=includes/failover.h

 * enum failover_state, that holds the enumerated state names and the typedef

 * of dhcp_failover_state_t with references to dhcp_failover_config_t me,

 * partner and the enumerated failover_state for saved_state that is used by

 * int write_failover_state (dhcp_failover_state_t *state) in:

 * https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=blob;f=server/db.c

 * to write the actual failover info in our lease file!

 *

 */

const p_date_time = <<< 'PDATETIME'

	(?'PWEEKDAY'[0-6])\s+

	(?'PDATE'

		(?'PYEAR'\d+)\/(?'PMONTH'(?>0[1-9]|1[0-2]))\/

		(?'PDAY'(?>0[1-9]|[1-2][0-9]|30|31))

	)\s+

	(?'PTIME'(?>[0-1][0-9]|2[0-3]):(?>[0-5][0-9]):(?>[0-5][0-9]|60))

PDATETIME;

/* Layout of these matters. 'recover-...' must come before 'recover', because

 * we make use of atomic grouping in failover_level1 to save amount of steps to

 * match!

 */

const failover_states = 'unknown-state|partner-down|normal|conflict-done'.

			'|communications-interrupted|resolution-interrupted|potential-conflict'.

			'|recover-done|recover-wait|recover|shutdown|paused|startup';

const failover_level1_regex =

	'(?x)

	(

			my\s+state\s+(?\'MYSTATE\'(?>'.failover_states.'))\s+

			at\s+(?\'MYDATE\''.date_time.')

		|

			partner\s+state\s+(?\'PEERSTATE\'(?&MYSTATE))\s+

			at\s+(?\'PEERDATE\''.p_date_time.')

		|

			mclt\s+(?\'MCLT\'\d+)

	);\s*';