annotate maltfilter @ 20:429b42047d04

Fix blocklist entry updating.
author Matti Hamalainen <ccr@tnsp.org>
date Sat, 15 Aug 2009 21:16:34 +0300
parents b0017a324040
children 403cb1a110ce
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
1 #!/usr/bin/perl -w
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
2 #############################################################################
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
3 #
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
4 # Malicious Attack Livid Termination Filter daemon (maltfilter)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
5 # Programmed by Matti 'ccr' Hämäläinen <ccr@tnsp.org>
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
6 # (C) Copyright 2009 Tecnic Software productions (TNSP)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
7 #
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
8 #############################################################################
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
9 use strict;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
10 use Date::Parse;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
11 use Net::IP;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
12
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
13 my $progversion = "0.9";
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
14 my $progbanner =
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
15 "Malicious Attack Livid Termination Filter daemon (maltfilter) v$progversion\n".
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
16 "Programmed by Matti 'ccr' Hamalainen <ccr\@tnsp.org>\n".
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
17 "(C) Copyright 2009 Tecnic Software productions (TNSP)\n";
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
18
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
19 #############################################################################
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
20 ### Settings / configuration
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
21 #############################################################################
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
22 my %settings = (
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
23 "VERBOSITY" => 3,
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
24 "DRY_RUN" => 1,
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
25 "WEEDPERIOD" => 150,
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
26 "TRESHOLD" => 3,
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
27 "ACTION" => "DROP",
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
28 "LOGFILE" => "",
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
29 "IPTABLES" => "/sbin/iptables",
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
30
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
31 "STATUS_FILE_PLAIN" => "",
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
32 "STATUS_FILE_HTML" => "",
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
33 "STATUS_FILE_CSS" => "",
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
34
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
35 "WHOIS_URL" => "http://whois.domaintools.com/",
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
36
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
37 "CHK_SSHD" => 1,
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
38 "CHK_KNOWN_CGI" => 1,
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
39 "CHK_PHP_XSS" => 1,
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
40 "CHK_PROXY_SCAN" => 1,
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
41 "CHK_ROOT_SSH_PWD" => 0,
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
42 "CHK_GOOD_HOSTS" => "",
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
43 );
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
44
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
45 # Default logfiles to monitor (SCANFILES setting of configuration overrides these)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
46 my @scanfiles_def = (
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
47 "/var/log/auth.log",
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
48 "/var/log/httpd/error.log",
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
49 "/var/log/httpd/access.log"
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
50 );
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
51
7
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
52 my @noblock_ips_def = (
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
53 "127.0.0.1",
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
54 );
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
55
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
56 #############################################################################
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
57 ### Script code
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
58 #############################################################################
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
59 my $reportmode = 0; # Full report mode
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
60 my @scanfiles = (); # Files to scan
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
61 my @noblock_ips = (); # IPs not to block
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
62 my %filehandles = (); # Global hash holding opened scanned log filehandles
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
63 my $pid_file = ""; # Name of Maltfilter daemon pid file
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
64 my $LOGFILE; # Maltfilter logfile handle
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
65
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
66 # IPs currently blocked in Netfilter $blocklist{$ip} = date
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
67 my %blocklist = ();
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
68
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
69 # Gathered information about hosts
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
70 # $statlist{$ip}->
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
71 # "date1" = timestamp of first hit
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
72 # "date2" = timestamp of latest hit
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
73 # "hits" = number of hits to this IP
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
74 # $statlist{$ip}{"reason"}{$class}->
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
75 # "msg" = reason message (array if $reportmode)
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
76 # "hits" = hits to this class
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
77 # "date1" = timestamp of first hit
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
78 # "date2" = timestamp of latest hit
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
79 my %statlist = ();
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
80
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
81 # Gathered information about ignored hits (e.g. hits for tests that are not enabled)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
82 # Same fields as in %statlist
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
83 my %ignorelist = ();
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
84
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
85
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
86 ### Check given logfile line for matches
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
87 sub check_log_line($)
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
88 {
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
89 # (1) SSHD scans
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
90 if (/^(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+\S+\s+sshd\S*?: (.*)/) {
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
91 my $mdate = $1;
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
92 my $merr = $2;
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
93
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
94 # (1.1) Generic login scan attempts
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
95 if ($merr =~ /^Failed password for invalid user \S+ from (\d+\.\d+\.\d+\.\d+)/) {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
96 check_add_hit($1, $mdate, "SSH login scan", "", $settings{"CHK_SSHD"});
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
97 }
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
98 # (1.2) Root SSH login password bruteforcing attempts
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
99 # NOTICE! Do not enable this setting, if you allow SSH root logins via
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
100 # password authentication! Mistyping password may get you blocked then. :)
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
101 elsif (/^Failed password for root from (\d+\.\d+\.\d+\.\d+)/) {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
102 check_add_hit($1, $mdate, "Root SSH password bruteforce", "", $settings{"CHK_ROOT_SSH_PWD"});
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
103 }
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
104 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
105 # (2) Common/known exploitable CGI/PHP software scans (like phpMyAdmin)
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
106 # NOTICE! This matches ERRORLOG, thus it only works if you DO NOT have
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
107 # any or some of these installed. Preferably none, or use uncommon
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
108 # paths and prefixes.
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
109 elsif (/^\[(.+?)\]\s+\[error\]\s+\[client\s+(\d+\.\d+\.\d+\.\d+)\]\s+(.+)$/) {
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
110 my $mdate = $1;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
111 my $mip = $2;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
112 my $merr = $3;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
113 if ($merr =~ /^File does not exist: (.+)$/) {
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
114 my $tmp = $1;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
115 if ($tmp =~ /\/mss2|\/pma|admin|sql|\/roundcube|\/webmail|\/bin|\/mail|xampp|zen|mailto:|appserv|cube|round|_vti_bin|wiki/i) {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
116 check_add_hit($mip, $mdate, "CGI vuln scan", $tmp, $settings{"CHK_KNOWN_CGI"});
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
117 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
118 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
119 }
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
120 # (3) Match Apache common logging format GET requests here
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
121 elsif (/(\d+\.\d+\.\d+\.\d+)\s+-\s+-\s+\[(.+?)\]\s+\"GET (\S*?) HTTP\//) {
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
122 my $mdate = $2;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
123 my $mip = $1;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
124 my $merr = $3;
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
125
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
126 # (3.1) Simple match for generic PHP XSS vulnerability scans
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
127 # NOTICE! If your site genuinely uses (checked) PHP parameters with
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
128 # URIs, you should set CHK_GOOD_HOSTS to match your hostname(s)/IP(s)
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
129 # used in the URIs.
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
130 if ($merr =~ /\.php\?\S*?=http:\/\/([^\/]+)/) {
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
131 if (!check_hosts($settings{"CHK_GOOD_HOSTS"}, $1)) {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
132 check_add_hit($mip, $mdate, "PHP XSS", $merr, $settings{"CHK_PHP_XSS"});
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
133 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
134 }
4
b2c7c76b3529 Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents: 3
diff changeset
135 # (3.2) Try to match proxy scanning attempts
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
136 elsif ($merr =~ /^http:\/\/([^\/]+)/) {
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
137 if (!check_hosts($settings{"CHK_GOOD_HOSTS"}, $1)) {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
138 check_add_hit($mip, $mdate, "Proxy scan", $merr, $settings{"CHK_PROXY_SCAN"});
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
139 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
140 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
141 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
142 }
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
143
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
144
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
145 #############################################################################
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
146 ### Status output functionality
2
3da95f3082d9 Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 0
diff changeset
147 #############################################################################
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
148 sub urlencode($)
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
149 {
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
150 my $value = $_[0];
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
151 $value =~ s/([^a-zA-Z_0-9 ])/"%" . uc(sprintf "%lx" , unpack("C", $1))/eg;
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
152 $value =~ tr/ /+/;
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
153 return $value;
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
154 }
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
155
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
156 my %entities = (
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
157 "<" => "lt",
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
158 ">" => "gt",
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
159 "&" => "amp",
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
160 );
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
161
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
162 sub htmlentities($)
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
163 {
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
164 my $value = $_[0];
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
165 # $value =~ s/([keys %entities])/"&".$entities{$1}.";"/eg;
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
166 foreach my $val (keys %entities) {
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
167 $value =~ s/$val/\&$entities{$val}\;/g;
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
168 }
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
169 return $value;
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
170 }
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
171
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
172 sub printH($$$$)
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
173 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
174 my $fh = $_[1];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
175 if ($_[0]) {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
176 print $fh "<h".$_[2].">".$_[3]."</h".$_[2].">\n";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
177 } else {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
178 my $c = ($_[2] <= 1) ? "=" : "-";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
179 print $fh $_[3]."\n". $c x length($_[3]) ."\n";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
180 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
181 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
182
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
183 sub printTD($$$)
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
184 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
185 my $fh = $_[1];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
186 if ($_[0]) {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
187 print $fh "<td>".$_[2]."</td>";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
188 } else {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
189 print $fh $_[2];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
190 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
191 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
192
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
193 sub printP($$$)
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
194 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
195 my $fh = $_[1];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
196 if ($_[0]) {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
197 print $fh "<p>\n".$_[2]."</p>\n";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
198 } else {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
199 print $fh $_[2]."\n";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
200 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
201 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
202
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
203 sub printElem
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
204 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
205 my $fh = $_[1];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
206 if ($_[0]) {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
207 print $fh $_[2];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
208 } elsif (defined($_[3])) {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
209 print $fh $_[3];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
210 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
211 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
212
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
213 sub bb($)
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
214 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
215 return $_[0] ? "<b>" : "";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
216 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
217
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
218
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
219 sub eb($)
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
220 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
221 return $_[0] ? "</b>" : "";
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
222 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
223
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
224 sub pe($$)
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
225 {
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
226 return $_[0] ? "<$_[1]>" : "";
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
227 }
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
228
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
229 sub getLink($$)
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
230 {
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
231 if ($settings{"WHOIS_URL"} ne "") {
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
232 return $_[0] ? "<a href=\"".$settings{"WHOIS_URL"}.$_[1].
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
233 "\">".htmlentities($_[1])."</a>" : $_[1];
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
234 } else {
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
235 return $_[0];
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
236 }
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
237 }
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
238
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
239 sub printTable1($$$$$)
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
240 {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
241 my ($m, $f, $table, $keys, $func) = @_;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
242 my $ntotal = 0;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
243
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
244 printElem($m, $f,
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
245 "<table class=\"detailed\">\n".
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
246 "<tr><th>Hits</th><th>IP-address</th><th>First hit</th><th>Latest hit</th><th>Reason(s)</th></tr>\n",
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
247
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
248 "Hits | IP-address | First hit | Latest hit | Reason(s)\n"
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
249 );
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
250
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
251 foreach my $mip (sort { $func->($table, $a, $b) } keys %{$keys}) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
252 printElem($m, $f, " <tr>");
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
253 printTD($m, $f, sprintf(bb($m)."%-10d".eb($m), $table->{$mip}{"hits"}));
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
254 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
255 printTD($m, $f, sprintf("%-15s", getLink($m, $mip)));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
256 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
257 printTD($m, $f, scalar localtime($table->{$mip}{"date1"}));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
258 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
259 printTD($m, $f, scalar localtime($table->{$mip}{"date2"}));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
260 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
261 my @reasons = ();
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
262 foreach my $class (sort keys %{$table->{$mip}{"reason"}}) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
263 my $msgs;
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
264 if ($class ne "IPTABLES") {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
265 if ($reportmode) {
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
266 my @tmp = reverse(@{$table->{$mip}{"reason"}{$class}{"msg"}});
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
267 if ($#tmp > 5) { $#tmp = 5; }
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
268 foreach (@tmp) { $_ = htmlentities($_); }
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
269 $msgs = join(" ".bb($m)."|".eb($m)." ", @tmp);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
270 } else {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
271 $msgs = $table->{$mip}{"reason"}{$class}{"msg"};
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
272 }
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
273 push(@reasons, bb($m).$class.eb($m)." #".$table->{$mip}{"reason"}{$class}{"hits"}.
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
274 " ( ".$msgs." )");
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
275 }
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
276 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
277 printTD($m, $f, join(", ", @reasons));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
278 printElem($m, $f, "</tr>\n", "\n");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
279 $ntotal++;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
280 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
281 printElem($m, $f, "</table>\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
282 printP($m, $f, bb($m).$ntotal.eb($m)." entries total.\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
283 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
284
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
285
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
286 sub printTable2($$$$$)
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
287 {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
288 my ($m, $f, $table, $keys, $func) = @_;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
289 my $nhits = 0;
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
290 my $str = "<th>IP-address</th><th>Hits</th><th>Latest hit</th><th>Class</th>";
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
291 my $str2 = "IP-address | Hits | Latest hit | Class ";
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
292
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
293 printElem($m, $f,
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
294 "<table class=\"summary\">\n<tr>". $str."<th> </th>".$str ."</tr>\n",
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
295 $str2." || ".$str2."\n");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
296
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
297 my $printEntry = sub {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
298 printTD($m, $f, sprintf("%-15s", getLink($m, $_[0])));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
299 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
300 printTD($m, $f, sprintf("%-8d ", $table->{$_[0]}{"hits"}));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
301 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
302 printTD($m, $f, scalar localtime($table->{$_[0]}{"date2"}));
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
303 printElem(!$m, $f, " | ");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
304 my $tmp = join(", ", sort keys %{$table->{$_[0]}{"reason"}});
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
305 printTD($m, $f, sprintf("%-30s", $tmp));
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
306 $nhits += $table->{$_[0]}{"hits"};
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
307 };
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
308
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
309 my @mkeys = sort { $func->($table, $a, $b) } keys %{$keys};
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
310 my $nkeys = scalar @mkeys;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
311 my $kmax = $nkeys / 2;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
312 for (my $i = 0; $i <= $kmax; $i++) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
313 printElem($m, $f, " <tr>");
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
314 if ($i < $kmax) {
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
315 $printEntry->($mkeys[$i]);
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
316 printElem($m, $f, "<th> </th>", " || ");
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
317 }
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
318 if ($i + $kmax + 1 < $nkeys) { $printEntry->($mkeys[$i + $kmax + 1]); }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
319 printElem($m, $f, "</tr>\n", "\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
320 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
321
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
322 printElem($m, $f, "</table>\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
323 printP($m, $f, bb($m).$nkeys.eb($m)." entries total, ".bb($m).$nhits.eb($m)." hits total.\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
324 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
325
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
326 sub cmp_ips($$$)
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
327 {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
328 my @ipa = split(/\./, $_[1]);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
329 my @ipb = split(/\./, $_[2]);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
330 for (my $i = 0; $i < 4; $i++) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
331 return -1 if ($ipa[$i] > $ipb[$i]);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
332 return 1 if ($ipa[$i] < $ipb[$i]);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
333 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
334 return 0;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
335 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
336
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
337 sub cmp_hits($$$)
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
338 {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
339 return $_[0]->{$_[2]}{"hits"} <=> $_[0]->{$_[1]}{"hits"};
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
340 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
341
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
342
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
343 sub generate_status($$)
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
344 {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
345 my $filename = shift;
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
346 my $m = shift;
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
347
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
348 return unless ($filename ne "");
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
349
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
350 open(STATUS, ">", $filename) or die("Could not open '".$filename."'!\n");
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
351 my $f = \*STATUS;
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
352 my $mtime = scalar localtime();
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
353
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
354 printElem($m, $f, "
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
355 <html>
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
356 <head>
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
357 <title>Maltfilter status report</title>
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
358 ");
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
359
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
360 printElem($m, $f, "<link href=\"".$settings{"STATUS_FILE_CSS"}."\" rel=\"stylesheet\" type=\"text/css\" />")
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
361 if ($settings{"STATUS_FILE_CSS"});
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
362
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
363 printElem($m, $f, "
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
364 </head>
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
365 <body>
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
366 ");
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
367
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
368 printH($m, $f, 1, "Maltfilter v$progversion status report");
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
369 my $val = $settings{"WEEDPERIOD"};
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
370 my $period;
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
371
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
372 if ($val > 30 * 24) {
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
373 $period = sprintf("%1.1f months", $val / (30.0 * 24.0));
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
374 } elsif ($val > 24 * 7) {
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
375 $period = sprintf("%1.1f weeks", $val / 24);
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
376 } elsif ($val > 24) {
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
377 $period = sprintf("%d days", $val / 24);
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
378 } else {
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
379 $period = sprintf("%d hours", $val);
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
380 }
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
381
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
382 printP($m, $f,
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
383 "Generated ".bb($m).$mtime.eb($m).". Data computed from ".
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
384 ($reportmode ? "complete logfile scan" : "a period of last $period").".\n");
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
385 printP($m, $f, "The hit classes marked as 'IPTABLES' are a pseudo-class meaning an\n".
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
386 "blocked IP that was in Netfilter before Maltfilter was started.\n");
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
387
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
388 printH($m, $f, 2, "Currently blocked entries");
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
389 printP($m, $f, "List of IPs that are currently blocked (or would be, if this is\n".
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
390 "a report-only mode).");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
391 printTable1($m, $f, \%statlist, \%blocklist, \&cmp_hits);
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
392
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
393 printH($m, $f, 2, "Summary of non-ignored entries");
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
394 printP($m, $f, "List of 'hits' of suspicious activity noticed by Maltfilter, but not\n".
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
395 "necessarily acted upon. Sorted by descending IP address.\n");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
396 printTable2($m, $f, \%statlist, \%statlist, \&cmp_ips);
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
397
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
398 printH($m, $f, 2, "Ignored entries");
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
399 printP($m, $f, "List of hits that were ignored (not acted upon), because the test was disabled.\n");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
400 printTable1($m, $f, \%ignorelist, \%ignorelist, \&cmp_hits);
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
401
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
402 printElem($m, $f, "</body>\n</html>\n");
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
403 close(STATUS);
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
404 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
405
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
406
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
407 #############################################################################
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
408 ### Entry management / handling functions
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
409 #############################################################################
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
410 ### Check if given IP or host exists in array
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
411 sub check_hosts_array($$)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
412 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
413 my $chk_host = $_[1];
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
414 my $chk_ip = new Net::IP($chk_host);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
415 foreach my $host (@{$_[0]}) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
416 if ($chk_host eq $host) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
417 return 1;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
418 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
419 my $ip = new Net::IP($host);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
420 if (defined($chk_ip) && defined($ip)) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
421 if ($chk_ip->binip() eq $ip->binip()) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
422 return 1;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
423 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
424 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
425 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
426 return 0;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
427 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
428
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
429 ### Check IP/host against | separated list of IPs/hosts
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
430 sub check_hosts($$)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
431 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
432 my @tmp = split(/\s*\|\s*/, $_[0]);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
433 return check_hosts_array(\@tmp, $_[1]);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
434 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
435
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
436 ### Execute iptables
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
437 sub exec_iptables(@)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
438 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
439 my @args = ($settings{"IPTABLES"}, @_);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
440 if ($settings{"DRY_RUN"}) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
441 mlog(3, ":: ".join(" ", @args)."\n");
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
442 } else {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
443 system(@args) == 0 or print join(" ", @args)." failed: $?\n";
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
444 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
445 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
446
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
447 ### Get current Netfilter INPUT table entries that match
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
448 ### entry types we manage, e.g. blocklist
20
429b42047d04 Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents: 18
diff changeset
449 sub update_blocklist()
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
450 {
17
fe220b5a975a Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents: 16
diff changeset
451 $ENV{"PATH"} = "";
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
452 open(STATUS, $settings{"IPTABLES"}." -v -n -L INPUT |") or
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
453 die("Could not execute ".$settings{"IPTABLES"}."\n");
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
454 %blocklist = ();
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
455 undef(%blocklist);
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
456 while (<STATUS>) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
457 chomp;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
458 if (/^\s*(\d+)\s+\d+\s+$settings{"ACTION"}\s+all\s+--\s+\*\s+\*\s+(\d+\.\d+\.\d+\.\d+)\s+0\.0\.0\.0\/0\s*$/) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
459 my $mip = $2;
20
429b42047d04 Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents: 18
diff changeset
460 my $mdate = time();
429b42047d04 Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents: 18
diff changeset
461 if (!defined($blocklist{$mip})) {
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
462 mlog(2, "* $mip appeared in iptables.\n");
20
429b42047d04 Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents: 18
diff changeset
463 $blocklist{$2} = $mdate;
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
464 }
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
465 update_entry(\%statlist, $mip, $mdate, "IPTABLES", "");
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
466 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
467 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
468 close(STATUS);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
469 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
470
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
471 ### Check if given timestamp is _newer_ than weedperiod threshold.
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
472 ### Returns false if timestamp is over weed period, e.g. needs weeding.
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
473 sub check_time($)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
474 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
475 return ($_[0] >= time() - ($settings{"WEEDPERIOD"} * 60 * 60));
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
476 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
477
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
478 ### Weed out old entries
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
479 sub weed_do($)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
480 {
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
481 my $mtime = $blocklist{$_[0]};
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
482 mlog(2, "* Weeding $_[0] (".($mtime >= 0 ? scalar localtime($mtime) : $mtime)."\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
483 exec_iptables("-D", "INPUT", "-s", $_[0], "-d", "0.0.0.0/0", "-j", $settings{"ACTION"});
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
484 delete($blocklist{$_[0]});
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
485 delete($statlist{$_[0]});
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
486 delete($ignorelist{$_[0]});
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
487 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
488
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
489 sub weed_entries()
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
490 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
491 # Don't weed in report mode.
18
b0017a324040 Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents: 17
diff changeset
492 return if ($reportmode);
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
493
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
494 my @mips = keys %blocklist;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
495 foreach my $mip (@mips) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
496 if (defined($blocklist{$mip})) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
497 if ($blocklist{$mip} >= 0) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
498 weed_do($mip) unless check_time($blocklist{$mip});
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
499 } else {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
500 weed_do($mip);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
501 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
502 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
503 }
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
504 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
505
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
506 ### Update one entry of
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
507 sub update_entry($$$$$)
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
508 {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
509 my ($struct, $mip, $mdate, $mclass, $mreason) = @_;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
510
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
511 my $cnt = $struct->{$mip}{"hits"}++;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
512 $struct->{$mip}{"reason"}{$mclass}{"hits"}++;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
513
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
514 if ($reportmode) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
515 push(@{$struct->{$mip}{"reason"}{$mclass}{"msg"}}, $mreason);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
516 } else {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
517 $struct->{$mip}{"reason"}{$mclass}{"msg"} = $mreason;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
518 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
519
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
520 if (!defined($struct->{$mip}{"date1"})) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
521 $struct->{$mip}{"date1"} = $mdate;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
522 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
523 $struct->{$mip}{"date2"} = $mdate;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
524
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
525 if (!defined($struct->{$mip}{"reason"}{$mclass}{"date2"})) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
526 $struct->{$mip}{"reason"}{$mclass}{"date2"} = $mdate;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
527 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
528 $struct->{$mip}{"reason"}{$mclass}{"date2"} = $mdate;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
529
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
530 return $cnt;
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
531 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
532
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
533 ### Check if given "try count" exceeds treshold and if entry
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
534 ### is NOT in Netfilter already, then add it if so.
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
535 sub check_add_hit($$$$$)
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
536 {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
537 my $mip = $_[0];
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
538 my $mdate = str2time($_[1]);
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
539 my $mclass = $_[2];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
540 my $mreason = $_[3];
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
541 my $mcond = $_[4];
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
542 my $cnt;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
543
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
544 if (check_hosts_array(\@noblock_ips, $mip)) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
545 mlog(3, "Hit to NOBLOCK_IPS($mip): [$mclass] $mreason\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
546 return;
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
547 }
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
548
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
549 # If condition is true, we add to regular statlist
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
550 if ($mcond) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
551 $cnt = update_entry(\%statlist, $mip, $mdate, $mclass, $mreason);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
552 } else {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
553 # This is an ignored hit (for disabled test), add to ignorelist
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
554 update_entry(\%ignorelist, $mip, $mdate, $mclass, $mreason);
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
555 return;
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
556 }
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
557
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
558 # Check if we have exceeded treshold etc.
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
559 if ($cnt >= $settings{"TRESHOLD"} && check_time($mdate)) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
560 # Add to blocklist, unless already there.
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
561 if (!defined($blocklist{$mip})) {
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
562 mlog(1, "* Adding $mip ($mdate): [$mclass] $mreason\n");
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
563 exec_iptables("-I", "INPUT", "1", "-s", $mip, "-j", $settings{"ACTION"});
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
564 }
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
565 # Update date of last hit
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
566 $blocklist{$mip} = $mdate;
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
567 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
568 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
569
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
570
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
571 #############################################################################
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
572 ### Main helper functions
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
573 #############################################################################
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
574 ### Print log entry
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
575 sub mlog
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
576 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
577 my $level = shift;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
578 my $msg = shift;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
579 if (defined($LOGFILE)) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
580 print $LOGFILE "[".scalar localtime()."] ".$msg if ($settings{"VERBOSITY"} > $level);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
581 } elsif ($settings{"DRY_RUN"}) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
582 print STDERR $msg if ($settings{"VERBOSITY"} > $level);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
583 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
584 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
585
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
586 ### Initialize
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
587 sub malt_init {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
588 mlog(0, "Updating initial blocklist from netfilter.\n");
20
429b42047d04 Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents: 18
diff changeset
589 update_blocklist();
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
590
3
368182409eac More variable cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 2
diff changeset
591 foreach my $filename (@scanfiles) {
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
592 local *INFILE;
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
593 mlog(0, "Parsing ".$filename." ...\n");
3
368182409eac More variable cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 2
diff changeset
594 open(INFILE, "<", $filename) or die("Could not open '".$filename."'!\n");
368182409eac More variable cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 2
diff changeset
595 $filehandles{$filename} = *INFILE;
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
596 while (<INFILE>) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
597 chomp;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
598 check_log_line($_);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
599 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
600 }
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
601
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
602 mlog(0, "Weeding old entries.\n");
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
603 weed_entries();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
604 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
605
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
606 ### Quick cleanup (not complete shutdown)
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
607 sub malt_cleanup {
3
368182409eac More variable cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 2
diff changeset
608 foreach my $filename (keys %filehandles) {
368182409eac More variable cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents: 2
diff changeset
609 close($filehandles{$filename});
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
610 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
611 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
612
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
613 sub malt_finish {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
614 # Unlink pid-file
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
615 if ($pid_file ne "" && -e $pid_file) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
616 unlink $pid_file;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
617 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
618 # Close logfile
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
619 close($LOGFILE) if (defined($LOGFILE));
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
620 undef($LOGFILE);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
621 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
622
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
623 ### Signal handlers
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
624 sub malt_int {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
625 mlog(-1, "\nCaught Interrupt (^C), aborting.\n");
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
626 malt_cleanup();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
627 malt_finish();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
628 exit(1);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
629 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
630
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
631 sub malt_term {
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
632 mlog(-1, "Received TERM, quitting.\n");
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
633 malt_cleanup();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
634 malt_finish();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
635 exit(1);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
636 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
637
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
638 sub malt_hup {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
639 mlog(-1, "Received HUP, reinitializing.\n");
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
640 malt_cleanup();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
641 malt_init();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
642 mlog(-1, "Reinitialization finished, resuming scanning.\n");
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
643 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
644
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
645 ### Main scanning function
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
646 sub malt_scan {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
647 mlog(1, "Entering main scanning loop.\n");
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
648 my $counter = -1;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
649 while (1) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
650 my %filepos = ();
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
651 foreach my $filename (keys %filehandles) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
652 for ($filepos{$filename} = tell($filehandles{$filename}); $_ = <$filehandles{$filename}>; $filepos{$filename} = tell($filehandles{$filename})) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
653 chomp;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
654 check_log_line($_);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
655 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
656 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
657 if ($counter < 0 || $counter++ >= 30) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
658 # Every once in a while, update known IP list from iptables
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
659 # (in case entries have appeared there from "outside")
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
660 # and perform weeding of old entries.
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
661 $counter = 0;
20
429b42047d04 Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents: 18
diff changeset
662 update_blocklist();
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
663 weed_entries();
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
664 generate_status($settings{"STATUS_FILE_PLAIN"}, 0);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
665 generate_status($settings{"STATUS_FILE_HTML"}, 1);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
666 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
667 sleep(5);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
668 foreach my $filename (keys %filehandles) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
669 seek($filehandles{$filename}, $filepos{$filename}, 0);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
670 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
671 }
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
672 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
673
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
674 ### Read one configuration file
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
675 sub malt_read_config($)
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
676 {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
677 my $filename = $_[0];
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
678 my $errors = 0;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
679 my $line = 0;
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
680
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
681 open(CONFFILE, "<", $filename) or die("Could not open configuration '".$filename."'!\n");
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
682 while (<CONFFILE>) {
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
683 $line++;
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
684 chomp;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
685 if (/(^\s*#|^\s*$)/) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
686 # Ignore comments and empty lines
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
687 } elsif (/^\s*\"?([a-zA-Z0-9_]+)\"?\s*=>?\s*(\d+),?\s*$/) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
688 my $key = uc($1);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
689 my $value = $2;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
690 if (defined($settings{$key})) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
691 $settings{$key} = $value;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
692 } else {
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
693 print STDERR "[$filename:$line] Unknown setting '$key' = $value\n";
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
694 $errors = 1;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
695 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
696 } elsif (/^\s*\"?([a-zA-Z0-9_]+)\"?\s*=>?\s*\"(.*?)\",?\s*$/) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
697 my $key = uc($1);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
698 my $value = $2;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
699 if ($key eq "SCANFILE") {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
700 push(@scanfiles_def, $value);
8
29ddb6b9b521 Moar changes!
Matti Hamalainen <ccr@tnsp.org>
parents: 7
diff changeset
701 } elsif ($key eq "NOBLOCK_IPS") {
7
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
702 push(@noblock_ips_def, $value);
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
703 } elsif (defined($settings{$key})) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
704 $settings{$key} = $value;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
705 } else {
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
706 print STDERR "[$filename:$line] Unknown setting '$key' = '$value'\n";
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
707 $errors = 1;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
708 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
709 } else {
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
710 print STDERR "[$filename:$line] Syntax error: $_\n";
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
711 $errors = 1;
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
712 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
713 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
714 close(CONFFILE);
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
715 return $errors;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
716 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
717
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
718
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
719 #############################################################################
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
720 ###
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
721 ### Main program
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
722 ###
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
723 #############################################################################
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
724 # Setup signal handlers
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
725 $SIG{'INT'} = 'malt_int';
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
726 $SIG{'TERM'} = 'malt_term';
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
727 $SIG{'HUP'} = 'malt_hup';
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
728
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
729 # Print banner and help if no arguments
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
730 my $argc = $#ARGV + 1;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
731 if ($argc < 1) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
732 print $progbanner.
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
733 "\n".
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
734 "Usage: maltfilter <pid filename> [config filename] [config filename...]\n".
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
735 " maltfilter -f [config filename] [config filename...]\n".
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
736 "-f turns on the full report mode.\n";
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
737 exit;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
738 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
739
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
740 # Test pid file existence unless report mode
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
741 $pid_file = shift;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
742 if ($pid_file eq "-f") {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
743 $reportmode = 1;
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
744 } else {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
745 die("'$pid_file' already exists, not starting.\n".
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
746 "If the daemon is NOT running, remove the pid-file and re-start.\n")
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
747 if (-e $pid_file);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
748 }
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
749
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
750 # Read configuration files
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
751 if (defined(my $filename = shift)) {
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
752 # Let user define his/her own logfiles to scan
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
753 @scanfiles_def = ();
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
754 undef(@scanfiles_def);
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
755 die("Errors in configuration file '$filename', bailing out.\n")
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
756 unless (malt_read_config($filename) == 0);
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
757 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
758
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
759 # Force dry run mode if we are reporting only
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
760 if ($reportmode) {
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
761 $settings{"DRY_RUN"} = 1;
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
762 $settings{"VERBOSITY"} = 1;
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
763 }
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
764
7
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
765 # Clean up certain arrays duplicate entries
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
766 my %saw = ();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
767 @scanfiles = grep(!$saw{$_}++, @scanfiles_def);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
768
16
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
769 %saw = ();
87c0cdc048f5 Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents: 15
diff changeset
770 @noblock_ips = grep(!$saw{$_}++, @noblock_ips_def);
7
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
771 undef(%saw);
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
772
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
773 # Open logfile
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
774 if ($settings{"DRY_RUN"}) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
775 print $progbanner.
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
776 "*********************************************\n".
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
777 "* NOTICE! DRY-RUN MODE ENABLED! No changes *\n".
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
778 "* will actually get committed to netfilter! *\n".
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
779 "*********************************************\n";
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
780 } elsif ($settings{"LOGFILE"} ne "") {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
781 open($LOGFILE, ">>", $settings{"LOGFILE"}) or die("Could not open logfile '".$settings{"LOGFILE"}."' for writing!\n");
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
782 mlog(-1, "Log started\n");
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
783 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
784
7
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
785 # Test existence of iptables
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
786 if (! -e $settings{"IPTABLES"} || ! -x $settings{"IPTABLES"}) {
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
787 my $msg = "iptables binary does not exist or is not executable: ".$settings{"IPTABLES"}."\n";
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
788 mlog(-1, $msg);
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
789 die($msg);
ee5f7b8dcdea Features, yay.
Matti Hamalainen <ccr@tnsp.org>
parents: 4
diff changeset
790 }
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
791
8
29ddb6b9b521 Moar changes!
Matti Hamalainen <ccr@tnsp.org>
parents: 7
diff changeset
792 mlog(-1, "Not blocking following IPs: ".join(", ", @noblock_ips)."\n");
29ddb6b9b521 Moar changes!
Matti Hamalainen <ccr@tnsp.org>
parents: 7
diff changeset
793
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
794 # Initialize
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
795 malt_init();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
796
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
797 # Fork to background, unless dry-running
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
798 if ($settings{"DRY_RUN"}) {
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
799 if ($reportmode) {
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
800 mlog(-1, "Outputting report files.\n");
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
801 generate_status($settings{"STATUS_FILE_PLAIN"}, 0);
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
802 generate_status($settings{"STATUS_FILE_HTML"}, 1);
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
803 malt_cleanup();
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
804 } else {
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
805 malt_scan();
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
806 malt_cleanup();
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 8
diff changeset
807 }
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
808 } else {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
809 if (my $pid = fork) {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
810 open(PIDFILE, ">", $pid_file) or die("Could not open pid file '".$pid_file."' for writing!\n");
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
811 print PIDFILE "$pid\n";
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
812 close(PIDFILE);
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
813 } else {
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
814 malt_scan();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
815 malt_cleanup();
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
816 }
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
817 }