| 1 | 1 | simandl | package HotSaNICmod::OSdep; |
| 2 | | | |
| 3 | | | use RRDs; |
| 4 | | | use lib "../../lib"; |
| 5 | | | |
| 6 | | | sub version { |
| 7 | | | ($VERSION = '$Revision: 1.4 $') =~ s/.*(\d+\.\d+).*/$1/; |
| 8 | | | return "$^O.pm $VERSION"; |
| 9 | | | } |
| 10 | | | |
| 11 | | | sub sample { |
| 12 | | | my %args=@_; |
| 13 | | | |
| 14 | | | my $IPTABLES=$args{IPTABLES}; |
| 15 | | | |
| 16 | | | if ( (! -e "acct_int.dat") || (! -e "acct_ext.dat")) { |
| 17 | 5 | simandl | system("$IPTABLES -L acct_int_tcp -xvn > acct_int.dat"); |
| 18 | | | system("$IPTABLES -L acct_ext_tcp -xvn > acct_ext.dat"); |
| 19 | | | foreach $prt ("udp","icmp","all") { |
| 20 | | | system("$IPTABLES -L acct_int_$prt -xvn >> acct_int.dat"); |
| 21 | | | system("$IPTABLES -L acct_ext_$prt -xvn >> acct_ext.dat"); |
| 22 | | | } |
| 23 | 1 | simandl | } |
| 24 | | | |
| 25 | | | my %acct_int_old=readfile("acct_int.dat",$IPTABLES); |
| 26 | | | my %acct_ext_old=readfile("acct_ext.dat",$IPTABLES); |
| 27 | 5 | simandl | system("$IPTABLES -L acct_int_all -xvn > acct_int.dat"); |
| 28 | | | system("$IPTABLES -L acct_ext_all -xvn > acct_ext.dat"); |
| 29 | | | foreach $prt ("udp","icmp","tcp") { |
| 30 | | | system("$IPTABLES -L acct_int_$prt -xvn | sed 's/all/$prt/g' >> acct_int.dat"); |
| 31 | | | system("$IPTABLES -L acct_ext_$prt -xvn | sed 's/all/$prt/g' >> acct_ext.dat"); |
| 32 | | | } |
| 33 | 1 | simandl | my %acct_int=readfile("acct_int.dat",$IPTABLES); |
| 34 | | | my %acct_ext=readfile("acct_ext.dat",$IPTABLES); |
| 35 | | | |
| 36 | | | my $time=time; |
| 37 | | | |
| 38 | | | foreach my $nn (sort(keys(%acct_int))) { |
| 39 | | | $allin=$acct_int{$nn}[1]-$acct_int_old{$nn}[1]; |
| 40 | | | $tcpin=$acct_int{$nn}[3]-$acct_int_old{$nn}[3]; |
| 41 | | | $udpin=$acct_int{$nn}[5]-$acct_int_old{$nn}[5]; |
| 42 | | | $icmpin=$acct_int{$nn}[7]-$acct_int_old{$nn}[7]; |
| 43 | | | $allout=$acct_int{$nn}[2]-$acct_int_old{$nn}[2]; |
| 44 | | | $tcpout=$acct_int{$nn}[4]-$acct_int_old{$nn}[4]; |
| 45 | | | $udpout=$acct_int{$nn}[6]-$acct_int_old{$nn}[6]; |
| 46 | | | $icmpout=$acct_int{$nn}[8]-$acct_int_old{$nn}[8]; |
| 47 | | | updatedb($args{MODNAME},$time,"int$nn",$tcpin,$udpin,$icmpin,$tcpout,$udpout,$icmpout); |
| 48 | | | } |
| 49 | | | |
| 50 | | | foreach my $nn (sort(keys(%acct_ext))) { |
| 51 | | | $allin=$acct_ext{$nn}[1]-$acct_ext_old{$nn}[1]; |
| 52 | | | $tcpin=$acct_ext{$nn}[3]-$acct_ext_old{$nn}[3]; |
| 53 | | | $udpin=$acct_ext{$nn}[5]-$acct_ext_old{$nn}[5]; |
| 54 | | | $icmpin=$acct_ext{$nn}[7]-$acct_ext_old{$nn}[7]; |
| 55 | | | $allout=$acct_ext{$nn}[2]-$acct_ext_old{$nn}[2]; |
| 56 | | | $tcpout=$acct_ext{$nn}[4]-$acct_ext_old{$nn}[4]; |
| 57 | | | $udpout=$acct_ext{$nn}[6]-$acct_ext_old{$nn}[6]; |
| 58 | | | $icmpout=$acct_ext{$nn}[8]-$acct_ext_old{$nn}[8]; |
| 59 | | | updatedb($args{MODNAME},$time,"ext$nn",$tcpin,$udpin,$icmpin,$tcpout,$udpout,$icmpout); |
| 60 | | | } |
| 61 | | | } |
| 62 | | | |
| 63 | | | sub readfile { |
| 64 | | | my ($file,$IPTABLES)=@_; |
| 65 | | | my $ip=""; |
| 66 | | | undef my %hash; |
| 67 | | | open (FILE,$file); |
| 68 | | | while (<FILE>) { |
| 69 | | | chomp; |
| 70 | | | if (index($IPTABLES,"ipchains") >= 0 ) { ($pkt,$bytes,$target,$proto,$opt,$tosa,$tosx,$ifname,$src,$dst)=split; } |
| 71 | | | else { ($pkt,$bytes,$target,$proto,$opt,$in,$out,$src,$dst)=split; } |
| 72 | | | if ($pkt =~ /^[0-9]*$/ ) { |
| 73 | | | if ($dst eq "") { ($proto,$opt,$in,$out,$src,$dst)=($target,$proto,$opt,$in,$out,$src); } |
| 74 | | | if ($src eq "0.0.0.0/0") { $ip=$dst;$dir=1; } elsif ($dst eq "0.0.0.0/0") { $ip=$src;$dir=0; } |
| 75 | | | if ($proto eq "all") { $prt=1 }; |
| 76 | | | if ($proto eq "tcp") { $prt=3 }; |
| 77 | | | if ($proto eq "udp") { $prt=5 }; |
| 78 | | | if ($proto eq "icmp") { $prt=7 }; |
| 79 | | | if ($ip ne "") {$hash{"$ip"}[$prt+$dir]=$bytes;} |
| 80 | | | } |
| 81 | | | } |
| 82 | | | close (FILE); |
| 83 | | | return %hash; |
| 84 | | | } |
| 85 | | | |
| 86 | | | sub updatedb { |
| 87 | | | my ($MODNAME,$time,$name,$tcpin,$udpin,$icmpin,$tcpout,$udpout,$icmpout)=@_; |
| 88 | | | $name =~ s/\//_/g; |
| 89 | | | if ( !-e "rrd/$name.rrd") { system "./makerrd $name U"; } |
| 90 | | | RRDs::update "rrd/$name.rrd",$time.":".$tcpin.":".$udpin.":".$icmpin.":".$tcpout.":".$udpout.":".$icmpout; |
| 91 | | | if ($ERROR = RRDs::error) { print time," ",$MODNAME,": unable to update `$name.rrd': $ERROR\n"; } |
| 92 | | | } |
| 93 | | | |
| 94 | | | |
| 95 | | | 1; |
| 96 | | | |
