Mercurial > hg > maltfilter
annotate maltfilter @ 24:f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
we do not know from whence entries already in netfilter are from. Fixed.
author | Matti Hamalainen <ccr@tnsp.org> |
---|---|
date | Sat, 15 Aug 2009 23:11:20 +0300 |
parents | cb0a4b747cf0 |
children | 34dcb7462043 |
rev | line source |
---|---|
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
1 #!/usr/bin/perl -w |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
2 ############################################################################# |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
3 # |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
4 # Malicious Attack Livid Termination Filter daemon (maltfilter) |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
5 # Programmed by Matti 'ccr' Hämäläinen <ccr@tnsp.org> |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
6 # (C) Copyright 2009 Tecnic Software productions (TNSP) |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
7 # |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
8 ############################################################################# |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
9 use strict; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
10 use Date::Parse; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
11 use Net::IP; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
12 |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
13 my $progversion = "0.9.2"; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
14 my $progbanner = |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
15 "Malicious Attack Livid Termination Filter daemon (maltfilter) v$progversion\n". |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
16 "Programmed by Matti 'ccr' Hamalainen <ccr\@tnsp.org>\n". |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
17 "(C) Copyright 2009 Tecnic Software productions (TNSP)\n"; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
18 |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
19 ############################################################################# |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
20 ### Settings / configuration |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
21 ############################################################################# |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
22 my %settings = ( |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
23 "VERBOSITY" => 3, |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
24 "DRY_RUN" => 1, |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
25 "WEEDPERIOD" => 150, |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
26 "TRESHOLD" => 3, |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
27 "ACTION" => "DROP", |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
28 "LOGFILE" => "", |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
29 "IPTABLES" => "/sbin/iptables", |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
30 |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
31 "STATUS_FILE_PLAIN" => "", |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
32 "STATUS_FILE_HTML" => "", |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
33 "STATUS_FILE_CSS" => "", |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
34 |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
35 "WHOIS_URL" => "http://whois.domaintools.com/", |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
36 |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
37 "CHK_SSHD" => 1, |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
38 "CHK_KNOWN_CGI" => 1, |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
39 "CHK_PHP_XSS" => 1, |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
40 "CHK_PROXY_SCAN" => 1, |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
41 "CHK_ROOT_SSH_PWD" => 0, |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
42 "CHK_GOOD_HOSTS" => "", |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
43 ); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
44 |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
45 # Default logfiles to monitor (SCANFILES setting of configuration overrides these) |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
46 my @scanfiles_def = ( |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
47 "/var/log/auth.log", |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
48 "/var/log/httpd/error.log", |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
49 "/var/log/httpd/access.log" |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
50 ); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
51 |
7 | 52 my @noblock_ips_def = ( |
53 "127.0.0.1", | |
54 ); | |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
55 |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
56 ############################################################################# |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
57 ### Script code |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
58 ############################################################################# |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
59 my $reportmode = 0; # Full report mode |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
60 my @scanfiles = (); # Files to scan |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
61 my @noblock_ips = (); # IPs not to block |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
62 my %filehandles = (); # Global hash holding opened scanned log filehandles |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
63 my $pid_file = ""; # Name of Maltfilter daemon pid file |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
64 my $LOGFILE; # Maltfilter logfile handle |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
65 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
66 # IPs currently blocked in Netfilter $blocklist{$ip} = date |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
67 my %blocklist = (); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
68 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
69 # Gathered information about hosts |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
70 # $statlist{$ip}-> |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
71 # "date1" = timestamp of first hit |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
72 # "date2" = timestamp of latest hit |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
73 # "hits" = number of hits to this IP |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
74 # $statlist{$ip}{"reason"}{$class}-> |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
75 # "msg" = reason message (array if $reportmode) |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
76 # "hits" = hits to this class |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
77 # "date1" = timestamp of first hit |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
78 # "date2" = timestamp of latest hit |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
79 my %statlist = (); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
80 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
81 # Gathered information about ignored hits (e.g. hits for tests that are not enabled) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
82 # Same fields as in %statlist |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
83 my %ignorelist = (); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
84 |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
85 |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
86 ### Check given logfile line for matches |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
87 sub check_log_line($) |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
88 { |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
89 # (1) SSHD scans |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
90 if (/^(\S+\s+\d+\s+\d\d:\d\d:\d\d)\s+\S+\s+sshd\S*?: (.*)/) { |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
91 my $mdate = $1; |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
92 my $merr = $2; |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
93 |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
94 # (1.1) Generic login scan attempts |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
95 if ($merr =~ /^Failed password for invalid user \S+ from (\d+\.\d+\.\d+\.\d+)/) { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
96 check_add_hit($1, $mdate, "SSH login scan", "", $settings{"CHK_SSHD"}); |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
97 } |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
98 # (1.2) Root SSH login password bruteforcing attempts |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
99 # NOTICE! Do not enable this setting, if you allow SSH root logins via |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
100 # password authentication! Mistyping password may get you blocked then. :) |
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
101 elsif (/^Failed password for root from (\d+\.\d+\.\d+\.\d+)/) { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
102 check_add_hit($1, $mdate, "Root SSH password bruteforce", "", $settings{"CHK_ROOT_SSH_PWD"}); |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
103 } |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
104 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
105 # (2) Common/known exploitable CGI/PHP software scans (like phpMyAdmin) |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
106 # NOTICE! This matches ERRORLOG, thus it only works if you DO NOT have |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
107 # any or some of these installed. Preferably none, or use uncommon |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
108 # paths and prefixes. |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
109 elsif (/^\[(.+?)\]\s+\[error\]\s+\[client\s+(\d+\.\d+\.\d+\.\d+)\]\s+(.+)$/) { |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
110 my $mdate = $1; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
111 my $mip = $2; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
112 my $merr = $3; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
113 if ($merr =~ /^File does not exist: (.+)$/) { |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
114 my $tmp = $1; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
115 if ($tmp =~ /\/mss2|\/pma|admin|sql|\/roundcube|\/webmail|\/bin|\/mail|xampp|zen|mailto:|appserv|cube|round|_vti_bin|wiki/i) { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
116 check_add_hit($mip, $mdate, "CGI vuln scan", $tmp, $settings{"CHK_KNOWN_CGI"}); |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
117 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
118 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
119 } |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
120 # (3) Match Apache common logging format GET requests here |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
121 elsif (/(\d+\.\d+\.\d+\.\d+)\s+-\s+-\s+\[(.+?)\]\s+\"GET (\S*?) HTTP\//) { |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
122 my $mdate = $2; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
123 my $mip = $1; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
124 my $merr = $3; |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
125 |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
126 # (3.1) Simple match for generic PHP XSS vulnerability scans |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
127 # NOTICE! If your site genuinely uses (checked) PHP parameters with |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
128 # URIs, you should set CHK_GOOD_HOSTS to match your hostname(s)/IP(s) |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
129 # used in the URIs. |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
130 if ($merr =~ /\.php\?\S*?=http:\/\/([^\/]+)/) { |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
131 if (!check_hosts($settings{"CHK_GOOD_HOSTS"}, $1)) { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
132 check_add_hit($mip, $mdate, "PHP XSS", $merr, $settings{"CHK_PHP_XSS"}); |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
133 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
134 } |
4
b2c7c76b3529
Added scanning feature for SSH root login attempts with failed passwords.
Matti Hamalainen <ccr@tnsp.org>
parents:
3
diff
changeset
|
135 # (3.2) Try to match proxy scanning attempts |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
136 elsif ($merr =~ /^http:\/\/([^\/]+)/) { |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
137 if (!check_hosts($settings{"CHK_GOOD_HOSTS"}, $1)) { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
138 check_add_hit($mip, $mdate, "Proxy scan", $merr, $settings{"CHK_PROXY_SCAN"}); |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
139 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
140 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
141 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
142 } |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
143 |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
144 |
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
145 ############################################################################# |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
146 ### Status output functionality |
2
3da95f3082d9
Misc. variable name cleanups.
Matti Hamalainen <ccr@tnsp.org>
parents:
0
diff
changeset
|
147 ############################################################################# |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
148 sub urlencode($) |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
149 { |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
150 my $value = $_[0]; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
151 $value =~ s/([^a-zA-Z_0-9 ])/"%" . uc(sprintf "%lx" , unpack("C", $1))/eg; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
152 $value =~ tr/ /+/; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
153 return $value; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
154 } |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
155 |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
156 my %entities = ( |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
157 "<" => "lt", |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
158 ">" => "gt", |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
159 "&" => "amp", |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
160 ); |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
161 |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
162 sub htmlentities($) |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
163 { |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
164 my $value = $_[0]; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
165 # $value =~ s/([keys %entities])/"&".$entities{$1}.";"/eg; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
166 foreach my $val (keys %entities) { |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
167 $value =~ s/$val/\&$entities{$val}\;/g; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
168 } |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
169 return $value; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
170 } |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
171 |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
172 sub printH($$$$) |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
173 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
174 my $fh = $_[1]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
175 if ($_[0]) { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
176 print $fh "<h".$_[2].">".$_[3]."</h".$_[2].">\n"; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
177 } else { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
178 my $c = ($_[2] <= 1) ? "=" : "-"; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
179 print $fh $_[3]."\n". $c x length($_[3]) ."\n"; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
180 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
181 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
182 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
183 sub printTD($$$) |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
184 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
185 my $fh = $_[1]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
186 if ($_[0]) { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
187 print $fh "<td>".$_[2]."</td>"; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
188 } else { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
189 print $fh $_[2]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
190 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
191 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
192 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
193 sub printP($$$) |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
194 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
195 my $fh = $_[1]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
196 if ($_[0]) { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
197 print $fh "<p>\n".$_[2]."</p>\n"; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
198 } else { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
199 print $fh $_[2]."\n"; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
200 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
201 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
202 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
203 sub printElem |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
204 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
205 my $fh = $_[1]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
206 if ($_[0]) { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
207 print $fh $_[2]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
208 } elsif (defined($_[3])) { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
209 print $fh $_[3]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
210 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
211 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
212 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
213 sub bb($) |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
214 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
215 return $_[0] ? "<b>" : ""; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
216 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
217 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
218 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
219 sub eb($) |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
220 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
221 return $_[0] ? "</b>" : ""; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
222 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
223 |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
224 sub pe($$) |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
225 { |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
226 return $_[0] ? "<$_[1]>" : ""; |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
227 } |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
228 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
229 sub getLink($$) |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
230 { |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
231 if ($settings{"WHOIS_URL"} ne "") { |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
232 return $_[0] ? "<a href=\"".$settings{"WHOIS_URL"}.$_[1]. |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
233 "\">".htmlentities($_[1])."</a>" : $_[1]; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
234 } else { |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
235 return $_[0]; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
236 } |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
237 } |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
238 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
239 sub printTable1($$$$$) |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
240 { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
241 my ($m, $f, $table, $keys, $func) = @_; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
242 my $ntotal = 0; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
243 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
244 printElem($m, $f, |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
245 "<table class=\"detailed\">\n". |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
246 "<tr><th>Hits</th><th>IP-address</th><th>First hit</th><th>Latest hit</th><th>Reason(s)</th></tr>\n", |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
247 |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
248 "Hits | IP-address | First hit | Latest hit | Reason(s)\n" |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
249 ); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
250 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
251 foreach my $mip (sort { $func->($table, $a, $b) } keys %{$keys}) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
252 printElem($m, $f, " <tr>"); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
253 printTD($m, $f, sprintf(bb($m)."%-10d".eb($m), $table->{$mip}{"hits"})); |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
254 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
255 printTD($m, $f, sprintf("%-15s", getLink($m, $mip))); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
256 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
257 printTD($m, $f, scalar localtime($table->{$mip}{"date1"})); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
258 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
259 printTD($m, $f, scalar localtime($table->{$mip}{"date2"})); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
260 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
261 my @reasons = (); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
262 foreach my $class (sort keys %{$table->{$mip}{"reason"}}) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
263 my $msgs; |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
264 if ($class ne "IPTABLES") { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
265 if ($reportmode) { |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
266 my @tmp = reverse(@{$table->{$mip}{"reason"}{$class}{"msg"}}); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
267 if ($#tmp > 5) { $#tmp = 5; } |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
268 foreach (@tmp) { $_ = htmlentities($_); } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
269 $msgs = join(" ".bb($m)."|".eb($m)." ", @tmp); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
270 } else { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
271 $msgs = $table->{$mip}{"reason"}{$class}{"msg"}; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
272 } |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
273 push(@reasons, bb($m).$class.eb($m)." #".$table->{$mip}{"reason"}{$class}{"hits"}. |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
274 " ( ".$msgs." )"); |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
275 } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
276 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
277 printTD($m, $f, join(", ", @reasons)); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
278 printElem($m, $f, "</tr>\n", "\n"); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
279 $ntotal++; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
280 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
281 printElem($m, $f, "</table>\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
282 printP($m, $f, bb($m).$ntotal.eb($m)." entries total.\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
283 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
284 |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
285 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
286 sub printTable2($$$$$) |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
287 { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
288 my ($m, $f, $table, $keys, $func) = @_; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
289 my $nhits = 0; |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
290 my $str = "<th>IP-address</th><th>Hits</th><th>Latest hit</th><th>Class</th>"; |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
291 my $str2 = "IP-address | Hits | Latest hit | Class "; |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
292 |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
293 printElem($m, $f, |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
294 "<table class=\"summary\">\n<tr>". $str."<th> </th>".$str ."</tr>\n", |
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
295 $str2." || ".$str2."\n"); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
296 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
297 my $printEntry = sub { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
298 printTD($m, $f, sprintf("%-15s", getLink($m, $_[0]))); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
299 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
300 printTD($m, $f, sprintf("%-8d ", $table->{$_[0]}{"hits"})); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
301 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
302 printTD($m, $f, scalar localtime($table->{$_[0]}{"date2"})); |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
303 printElem(!$m, $f, " | "); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
304 my $tmp = join(", ", sort keys %{$table->{$_[0]}{"reason"}}); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
305 printTD($m, $f, sprintf("%-30s", $tmp)); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
306 $nhits += $table->{$_[0]}{"hits"}; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
307 }; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
308 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
309 my @mkeys = sort { $func->($table, $a, $b) } keys %{$keys}; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
310 my $nkeys = scalar @mkeys; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
311 my $kmax = $nkeys / 2; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
312 for (my $i = 0; $i <= $kmax; $i++) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
313 printElem($m, $f, " <tr>"); |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
314 if ($i < $kmax) { |
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
315 $printEntry->($mkeys[$i]); |
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
316 printElem($m, $f, "<th> </th>", " || "); |
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
317 } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
318 if ($i + $kmax + 1 < $nkeys) { $printEntry->($mkeys[$i + $kmax + 1]); } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
319 printElem($m, $f, "</tr>\n", "\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
320 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
321 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
322 printElem($m, $f, "</table>\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
323 printP($m, $f, bb($m).$nkeys.eb($m)." entries total, ".bb($m).$nhits.eb($m)." hits total.\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
324 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
325 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
326 sub cmp_ips($$$) |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
327 { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
328 my @ipa = split(/\./, $_[1]); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
329 my @ipb = split(/\./, $_[2]); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
330 for (my $i = 0; $i < 4; $i++) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
331 return -1 if ($ipa[$i] > $ipb[$i]); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
332 return 1 if ($ipa[$i] < $ipb[$i]); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
333 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
334 return 0; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
335 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
336 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
337 sub cmp_hits($$$) |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
338 { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
339 return $_[0]->{$_[2]}{"hits"} <=> $_[0]->{$_[1]}{"hits"}; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
340 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
341 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
342 |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
343 sub generate_status($$) |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
344 { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
345 my $filename = shift; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
346 my $m = shift; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
347 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
348 return unless ($filename ne ""); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
349 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
350 open(STATUS, ">", $filename) or die("Could not open '".$filename."'!\n"); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
351 my $f = \*STATUS; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
352 my $mtime = scalar localtime(); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
353 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
354 printElem($m, $f, " |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
355 <html> |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
356 <head> |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
357 <title>Maltfilter status report</title> |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
358 "); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
359 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
360 printElem($m, $f, "<link href=\"".$settings{"STATUS_FILE_CSS"}."\" rel=\"stylesheet\" type=\"text/css\" />") |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
361 if ($settings{"STATUS_FILE_CSS"}); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
362 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
363 printElem($m, $f, " |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
364 </head> |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
365 <body> |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
366 "); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
367 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
368 printH($m, $f, 1, "Maltfilter v$progversion status report"); |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
369 my $val = $settings{"WEEDPERIOD"}; |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
370 my $period; |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
371 |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
372 if ($val > 30 * 24) { |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
373 $period = sprintf("%1.1f months", $val / (30.0 * 24.0)); |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
374 } elsif ($val > 24 * 7) { |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
375 $period = sprintf("%1.1f weeks", $val / 24); |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
376 } elsif ($val > 24) { |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
377 $period = sprintf("%d days", $val / 24); |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
378 } else { |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
379 $period = sprintf("%d hours", $val); |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
380 } |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
381 |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
382 printP($m, $f, |
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
383 "Generated ".bb($m).$mtime.eb($m).". Data computed from ". |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
384 ($reportmode ? "complete logfile scan" : "a period of last $period").".\n"); |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
385 printP($m, $f, "The hit classes marked as 'IPTABLES' are a pseudo-class meaning an\n". |
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
386 "blocked IP that was in Netfilter before Maltfilter was started.\n"); |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
387 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
388 printH($m, $f, 2, "Currently blocked entries"); |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
389 printP($m, $f, "List of IPs that are currently blocked (or would be, if this is\n". |
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
390 "a report-only mode)."); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
391 printTable1($m, $f, \%statlist, \%blocklist, \&cmp_hits); |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
392 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
393 printH($m, $f, 2, "Summary of non-ignored entries"); |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
394 printP($m, $f, "List of 'hits' of suspicious activity noticed by Maltfilter, but not\n". |
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
395 "necessarily acted upon. Sorted by descending IP address.\n"); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
396 printTable2($m, $f, \%statlist, \%statlist, \&cmp_ips); |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
397 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
398 printH($m, $f, 2, "Ignored entries"); |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
399 printP($m, $f, "List of hits that were ignored (not acted upon), because the test was disabled.\n"); |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
400 printTable1($m, $f, \%ignorelist, \%ignorelist, \&cmp_hits); |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
401 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
402 printElem($m, $f, "</body>\n</html>\n"); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
403 close(STATUS); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
404 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
405 |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
406 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
407 ############################################################################# |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
408 ### Entry management / handling functions |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
409 ############################################################################# |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
410 ### Check if given IP or host exists in array |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
411 sub check_hosts_array($$) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
412 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
413 my $chk_host = $_[1]; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
414 my $chk_ip = new Net::IP($chk_host); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
415 foreach my $host (@{$_[0]}) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
416 if ($chk_host eq $host) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
417 return 1; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
418 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
419 my $ip = new Net::IP($host); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
420 if (defined($chk_ip) && defined($ip)) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
421 if ($chk_ip->binip() eq $ip->binip()) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
422 return 1; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
423 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
424 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
425 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
426 return 0; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
427 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
428 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
429 ### Check IP/host against | separated list of IPs/hosts |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
430 sub check_hosts($$) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
431 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
432 my @tmp = split(/\s*\|\s*/, $_[0]); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
433 return check_hosts_array(\@tmp, $_[1]); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
434 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
435 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
436 ### Execute iptables |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
437 sub exec_iptables(@) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
438 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
439 my @args = ($settings{"IPTABLES"}, @_); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
440 if ($settings{"DRY_RUN"}) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
441 mlog(3, ":: ".join(" ", @args)."\n"); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
442 } else { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
443 system(@args) == 0 or print join(" ", @args)." failed: $?\n"; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
444 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
445 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
446 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
447 ### Get current Netfilter INPUT table entries that match |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
448 ### entry types we manage, e.g. blocklist |
20
429b42047d04
Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents:
18
diff
changeset
|
449 sub update_blocklist() |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
450 { |
17
fe220b5a975a
Cleanups, add configuration for WHOIS linking.
Matti Hamalainen <ccr@tnsp.org>
parents:
16
diff
changeset
|
451 $ENV{"PATH"} = ""; |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
452 open(STATUS, $settings{"IPTABLES"}." -v -n -L INPUT |") or |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
453 die("Could not execute ".$settings{"IPTABLES"}."\n"); |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
454 my %newlist = (); |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
455 undef(%newlist); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
456 while (<STATUS>) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
457 chomp; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
458 if (/^\s*(\d+)\s+\d+\s+$settings{"ACTION"}\s+all\s+--\s+\*\s+\*\s+(\d+\.\d+\.\d+\.\d+)\s+0\.0\.0\.0\/0\s*$/) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
459 my $mip = $2; |
20
429b42047d04
Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents:
18
diff
changeset
|
460 my $mdate = time(); |
429b42047d04
Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents:
18
diff
changeset
|
461 if (!defined($blocklist{$mip})) { |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
462 mlog(2, "* $mip appeared in iptables.\n"); |
20
429b42047d04
Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents:
18
diff
changeset
|
463 $blocklist{$2} = $mdate; |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
464 } |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
465 $newlist{$2} = $mdate; |
24
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
466 update_entry(\%statlist, $mip, -1, "IPTABLES", ""); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
467 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
468 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
469 close(STATUS); |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
470 |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
471 foreach my $mip (keys %blocklist) { |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
472 if (!defined($newlist{$mip})) { |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
473 mlog(2, "* $mip removed from iptables.\n"); |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
474 delete($blocklist{$mip}); |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
475 } |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
476 } |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
477 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
478 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
479 ### Check if given timestamp is _newer_ than weedperiod threshold. |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
480 ### Returns false if timestamp is over weed period, e.g. needs weeding. |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
481 sub check_time($) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
482 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
483 return ($_[0] >= time() - ($settings{"WEEDPERIOD"} * 60 * 60)); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
484 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
485 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
486 ### Weed out old entries |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
487 sub weed_do($) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
488 { |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
489 my $mtime = $blocklist{$_[0]}; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
490 mlog(2, "* Weeding $_[0] (".($mtime >= 0 ? scalar localtime($mtime) : $mtime)."\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
491 exec_iptables("-D", "INPUT", "-s", $_[0], "-d", "0.0.0.0/0", "-j", $settings{"ACTION"}); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
492 delete($blocklist{$_[0]}); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
493 delete($statlist{$_[0]}); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
494 delete($ignorelist{$_[0]}); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
495 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
496 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
497 sub weed_entries() |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
498 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
499 # Don't weed in report mode. |
18
b0017a324040
Cleanups; Disable weeding in report mode again; Don't display redundant IPTABLES reasons in blocklist report.
Matti Hamalainen <ccr@tnsp.org>
parents:
17
diff
changeset
|
500 return if ($reportmode); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
501 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
502 my @mips = keys %blocklist; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
503 foreach my $mip (@mips) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
504 if (defined($blocklist{$mip})) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
505 if ($blocklist{$mip} >= 0) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
506 weed_do($mip) unless check_time($blocklist{$mip}); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
507 } else { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
508 weed_do($mip); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
509 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
510 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
511 } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
512 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
513 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
514 ### Update one entry of |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
515 sub update_entry($$$$$) |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
516 { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
517 my ($struct, $mip, $mdate, $mclass, $mreason) = @_; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
518 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
519 my $cnt = $struct->{$mip}{"hits"}++; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
520 $struct->{$mip}{"reason"}{$mclass}{"hits"}++; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
521 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
522 if ($reportmode) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
523 push(@{$struct->{$mip}{"reason"}{$mclass}{"msg"}}, $mreason); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
524 } else { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
525 $struct->{$mip}{"reason"}{$mclass}{"msg"} = $mreason; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
526 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
527 |
24
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
528 if ($mdate > 0) { |
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
529 if (!defined($struct->{$mip}{"date1"})) { |
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
530 $struct->{$mip}{"date1"} = $mdate; |
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
531 } |
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
532 $struct->{$mip}{"date2"} = $mdate; |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
533 |
24
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
534 if (!defined($struct->{$mip}{"reason"}{$mclass}{"date2"})) { |
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
535 $struct->{$mip}{"reason"}{$mclass}{"date2"} = $mdate; |
f22cfa761753
Update_blocklist() was setting timestamp of latest hit, this is incorrect as
Matti Hamalainen <ccr@tnsp.org>
parents:
23
diff
changeset
|
536 } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
537 $struct->{$mip}{"reason"}{$mclass}{"date2"} = $mdate; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
538 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
539 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
540 return $cnt; |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
541 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
542 |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
543 ### Check if given "try count" exceeds treshold and if entry |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
544 ### is NOT in Netfilter already, then add it if so. |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
545 sub check_add_hit($$$$$) |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
546 { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
547 my $mip = $_[0]; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
548 my $mdate = str2time($_[1]); |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
549 my $mclass = $_[2]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
550 my $mreason = $_[3]; |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
551 my $mcond = $_[4]; |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
552 my $cnt; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
553 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
554 if (check_hosts_array(\@noblock_ips, $mip)) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
555 mlog(3, "Hit to NOBLOCK_IPS($mip): [$mclass] $mreason\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
556 return; |
13
fc053b001027
Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents:
11
diff
changeset
|
557 } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
558 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
559 # If condition is true, we add to regular statlist |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
560 if ($mcond) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
561 $cnt = update_entry(\%statlist, $mip, $mdate, $mclass, $mreason); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
562 } else { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
563 # This is an ignored hit (for disabled test), add to ignorelist |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
564 update_entry(\%ignorelist, $mip, $mdate, $mclass, $mreason); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
565 return; |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
566 } |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
567 |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
568 # Check if we have exceeded treshold etc. |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
569 if ($cnt >= $settings{"TRESHOLD"} && check_time($mdate)) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
570 # Add to blocklist, unless already there. |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
571 if (!defined($blocklist{$mip})) { |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
572 mlog(1, "* Adding $mip ($mdate): [$mclass] $mreason\n"); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
573 exec_iptables("-I", "INPUT", "1", "-s", $mip, "-j", $settings{"ACTION"}); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
574 } |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
575 # Update date of last hit |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
576 $blocklist{$mip} = $mdate; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
577 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
578 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
579 |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
580 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
581 ############################################################################# |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
582 ### Main helper functions |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
583 ############################################################################# |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
584 ### Print log entry |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
585 sub mlog |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
586 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
587 my $level = shift; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
588 my $msg = shift; |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
589 if ($LOGFILE) { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
590 print $LOGFILE "[".scalar localtime()."] ".$msg if ($settings{"VERBOSITY"} > $level); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
591 } elsif ($settings{"DRY_RUN"}) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
592 print STDERR $msg if ($settings{"VERBOSITY"} > $level); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
593 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
594 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
595 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
596 ### Initialize |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
597 sub malt_init |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
598 { |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
599 mlog(0, "Updating initial blocklist from netfilter.\n"); |
20
429b42047d04
Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents:
18
diff
changeset
|
600 update_blocklist(); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
601 |
3 | 602 foreach my $filename (@scanfiles) { |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
603 local *INFILE; |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
604 mlog(0, "Parsing ".$filename." ...\n"); |
3 | 605 open(INFILE, "<", $filename) or die("Could not open '".$filename."'!\n"); |
606 $filehandles{$filename} = *INFILE; | |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
607 while (<INFILE>) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
608 chomp; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
609 check_log_line($_); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
610 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
611 } |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
612 |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
613 mlog(0, "Weeding old entries.\n"); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
614 weed_entries(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
615 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
616 |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
617 ### Quick cleanup (not complete shutdown) |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
618 sub malt_cleanup |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
619 { |
3 | 620 foreach my $filename (keys %filehandles) { |
621 close($filehandles{$filename}); | |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
622 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
623 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
624 |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
625 sub malt_finish |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
626 { |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
627 # Unlink pid-file |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
628 if ($pid_file ne "" && -e $pid_file) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
629 unlink $pid_file; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
630 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
631 # Close logfile |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
632 close($LOGFILE) if (defined($LOGFILE)); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
633 undef($LOGFILE); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
634 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
635 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
636 ### Signal handlers |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
637 sub malt_int |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
638 { |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
639 mlog(-1, "\nCaught Interrupt (^C), aborting.\n"); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
640 malt_cleanup(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
641 malt_finish(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
642 exit(1); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
643 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
644 |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
645 sub malt_term |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
646 { |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
647 mlog(-1, "Received TERM, quitting.\n"); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
648 malt_cleanup(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
649 malt_finish(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
650 exit(1); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
651 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
652 |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
653 sub malt_hup |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
654 { |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
655 mlog(-1, "Received HUP, reinitializing.\n"); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
656 malt_cleanup(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
657 malt_init(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
658 mlog(-1, "Reinitialization finished, resuming scanning.\n"); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
659 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
660 |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
661 ### Main scanning function |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
662 sub malt_scan |
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
663 { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
664 mlog(1, "Entering main scanning loop.\n"); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
665 my $counter = -1; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
666 while (1) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
667 my %filepos = (); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
668 foreach my $filename (keys %filehandles) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
669 for ($filepos{$filename} = tell($filehandles{$filename}); $_ = <$filehandles{$filename}>; $filepos{$filename} = tell($filehandles{$filename})) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
670 chomp; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
671 check_log_line($_); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
672 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
673 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
674 if ($counter < 0 || $counter++ >= 30) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
675 # Every once in a while, update known IP list from iptables |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
676 # (in case entries have appeared there from "outside") |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
677 # and perform weeding of old entries. |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
678 $counter = 0; |
20
429b42047d04
Fix blocklist entry updating.
Matti Hamalainen <ccr@tnsp.org>
parents:
18
diff
changeset
|
679 update_blocklist(); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
680 weed_entries(); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
681 generate_status($settings{"STATUS_FILE_PLAIN"}, 0); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
682 generate_status($settings{"STATUS_FILE_HTML"}, 1); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
683 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
684 sleep(5); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
685 foreach my $filename (keys %filehandles) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
686 seek($filehandles{$filename}, $filepos{$filename}, 0); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
687 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
688 } |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
689 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
690 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
691 ### Read one configuration file |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
692 sub malt_read_config($) |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
693 { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
694 my $filename = $_[0]; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
695 my $errors = 0; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
696 my $line = 0; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
697 |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
698 open(CONFFILE, "<", $filename) or die("Could not open configuration '".$filename."'!\n"); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
699 while (<CONFFILE>) { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
700 $line++; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
701 chomp; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
702 if (/(^\s*#|^\s*$)/) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
703 # Ignore comments and empty lines |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
704 } elsif (/^\s*\"?([a-zA-Z0-9_]+)\"?\s*=>?\s*(\d+),?\s*$/) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
705 my $key = uc($1); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
706 my $value = $2; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
707 if (defined($settings{$key})) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
708 $settings{$key} = $value; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
709 } else { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
710 print STDERR "[$filename:$line] Unknown setting '$key' = $value\n"; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
711 $errors = 1; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
712 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
713 } elsif (/^\s*\"?([a-zA-Z0-9_]+)\"?\s*=>?\s*\"(.*?)\",?\s*$/) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
714 my $key = uc($1); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
715 my $value = $2; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
716 if ($key eq "SCANFILE") { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
717 push(@scanfiles_def, $value); |
8 | 718 } elsif ($key eq "NOBLOCK_IPS") { |
7 | 719 push(@noblock_ips_def, $value); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
720 } elsif (defined($settings{$key})) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
721 $settings{$key} = $value; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
722 } else { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
723 print STDERR "[$filename:$line] Unknown setting '$key' = '$value'\n"; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
724 $errors = 1; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
725 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
726 } else { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
727 print STDERR "[$filename:$line] Syntax error: $_\n"; |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
728 $errors = 1; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
729 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
730 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
731 close(CONFFILE); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
732 return $errors; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
733 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
734 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
735 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
736 ############################################################################# |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
737 ### |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
738 ### Main program |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
739 ### |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
740 ############################################################################# |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
741 # Setup signal handlers |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
742 $SIG{'INT'} = 'malt_int'; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
743 $SIG{'TERM'} = 'malt_term'; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
744 $SIG{'HUP'} = 'malt_hup'; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
745 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
746 # Print banner and help if no arguments |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
747 my $argc = $#ARGV + 1; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
748 if ($argc < 1) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
749 print $progbanner. |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
750 "\n". |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
751 "Usage: maltfilter <pid filename> [config filename] [config filename...]\n". |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
752 " maltfilter -f [config filename] [config filename...]\n". |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
753 "-f turns on the full report mode.\n"; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
754 exit; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
755 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
756 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
757 # Test pid file existence unless report mode |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
758 $pid_file = shift; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
759 if ($pid_file eq "-f") { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
760 $reportmode = 1; |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
761 } else { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
762 die("'$pid_file' already exists, not starting.\n". |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
763 "If the daemon is NOT running, remove the pid-file and re-start.\n") |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
764 if (-e $pid_file); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
765 } |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
766 |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
767 # Read configuration files |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
768 if (defined(my $filename = shift)) { |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
769 # Let user define his/her own logfiles to scan |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
770 @scanfiles_def = (); |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
771 undef(@scanfiles_def); |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
772 die("Errors in configuration file '$filename', bailing out.\n") |
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
773 unless (malt_read_config($filename) == 0); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
774 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
775 |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
776 # Force dry run mode if we are reporting only |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
777 if ($reportmode) { |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
778 $settings{"DRY_RUN"} = 1; |
23
cb0a4b747cf0
Handle importing of current netfilter entries differently.
Matti Hamalainen <ccr@tnsp.org>
parents:
21
diff
changeset
|
779 # $settings{"VERBOSITY"} = 1; |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
780 } |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
781 |
7 | 782 # Clean up certain arrays duplicate entries |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
783 my %saw = (); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
784 @scanfiles = grep(!$saw{$_}++, @scanfiles_def); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
785 |
16
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
786 %saw = (); |
87c0cdc048f5
Many changes and cleanups. Works again.
Matti Hamalainen <ccr@tnsp.org>
parents:
15
diff
changeset
|
787 @noblock_ips = grep(!$saw{$_}++, @noblock_ips_def); |
7 | 788 undef(%saw); |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
789 |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
790 # Open logfile |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
791 if ($settings{"DRY_RUN"}) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
792 print $progbanner. |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
793 "*********************************************\n". |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
794 "* NOTICE! DRY-RUN MODE ENABLED! No changes *\n". |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
795 "* will actually get committed to netfilter! *\n". |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
796 "*********************************************\n"; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
797 } elsif ($settings{"LOGFILE"} ne "") { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
798 open($LOGFILE, ">>", $settings{"LOGFILE"}) or die("Could not open logfile '".$settings{"LOGFILE"}."' for writing!\n"); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
799 mlog(-1, "Log started\n"); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
800 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
801 |
7 | 802 # Test existence of iptables |
803 if (! -e $settings{"IPTABLES"} || ! -x $settings{"IPTABLES"}) { | |
804 my $msg = "iptables binary does not exist or is not executable: ".$settings{"IPTABLES"}."\n"; | |
805 mlog(-1, $msg); | |
806 die($msg); | |
807 } | |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
808 |
8 | 809 mlog(-1, "Not blocking following IPs: ".join(", ", @noblock_ips)."\n"); |
810 | |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
811 # Initialize |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
812 malt_init(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
813 |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
814 # Fork to background, unless dry-running |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
815 if ($settings{"DRY_RUN"}) { |
15
b05d0f0ff106
Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents:
13
diff
changeset
|
816 if ($reportmode) { |
11
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
817 mlog(-1, "Outputting report files.\n"); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
818 generate_status($settings{"STATUS_FILE_PLAIN"}, 0); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
819 generate_status($settings{"STATUS_FILE_HTML"}, 1); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
820 malt_cleanup(); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
821 } else { |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
822 malt_scan(); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
823 malt_cleanup(); |
26c2cc5077aa
Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents:
8
diff
changeset
|
824 } |
0
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
825 } else { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
826 if (my $pid = fork) { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
827 open(PIDFILE, ">", $pid_file) or die("Could not open pid file '".$pid_file."' for writing!\n"); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
828 print PIDFILE "$pid\n"; |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
829 close(PIDFILE); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
830 } else { |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
831 malt_scan(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
832 malt_cleanup(); |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
833 } |
fec14263801d
Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff
changeset
|
834 } |