dnsguard.dat

dnsguard是一种高性能DoS攻击检测和防护工具。它可以监听以太网上的ip协议数据流

#!/bin/bash

DETECT_INTERFACE="lo"
DETECT_TIME=1
DETECT_ACCESS=100
DETECT_FILTER=""

EXPIRE_TIME=300
F5_ADDRESS="192.168.10.222"
F5_USER="admin"
F5_PASSWD="admin"

function time_refresh()
{
    local old=$time

    time=$((`date "+((%w*24+%k)*60+10#%M)*60+10#%S"`))
    
    if [ $old -gt $time ]; then
	local tmp
	local s

	head_time=$((${head_time}-${TIME_CYCLE}))
	tmp="$list_time"
	list_time=""
	while [ -n "$tmp" ]; do
	    s="${tmp%%&*}";
	    tmp="${tmp#*&}";
	    list_time="${list_time}$((${s}-${TIME_CYCLE}))&"
	done
    fi
}

function list_remove()
{
    list="${list#*&}"
    list_time="${list_time#*&}"

    head="${list%%&*}"
    head="${head#memberList=}"
    if [ -z "$head" ]; then
	head_time=-1
    else
	head_time="${list_time%%&*}"
    fi
}

function list_add()
{
    local t

    if [ -n "$list" -a -z "${list##*=${1}&*}" ]; then
	return 1
    fi

    t=$((${time}+${EXPIRE_TIME}))
    list="${list}memberList=${1}&"
    list_time="${list_time}${t}&"

    if [ -z "$head" ]; then
	head="$1"
	head_time="$t"
    fi

    return 0
}

function guard_command()
{
    wget --user-agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" \
	--post-data="command=generate_classprops&className=hacker&classType=0&classTypeName=Address&${list}update=Apply" \
	--http-user="$F5_USER" --http-passwd="$F5_PASSWD" --quiet -O /dev/null \
	"https://${F5_ADDRESS}/bigipgui/bigconf.cgi"
    echo list=$list
    echo list_time=$list_time

    if [ -z "$addr" ]; then
	return
    fi

    echo conn $addr delete

    wget --user-agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" \
	--post-data="command=bigcommand&CommandType=bigpipe&CommandArgs=conn+${addr}+delete" \
	--http-user="$F5_USER" --http-passwd="$F5_PASSWD" --quiet -O /dev/null \
	"https://${F5_ADDRESS}/bigipgui/bigconf.cgi"
}

function guard() {
    local t
    local changed

    while true; do
	addr=""
	changed=1
	if [ -z "$head" ]; then
	    if ! read addr 2>/dev/null; then
		return
	    fi
	else
	    time_refresh
	    t=$((${head_time}-${time}))
	    
	    read -t $t addr 2>/dev/null;

	    time_refresh
	    if [ -z "$addr" -a $time -lt $head_time ]; then
		sleep $((${head_time}-${time}))
	    fi
	fi

	time_refresh
	while [ -n "$head" -a $time -ge $head_time ]; do
	    list_remove
	    changed=0
	done
	if [ -n "$addr" -a "${addr%% *}" = "attack" ]; then
	    addr="${addr#* }"
	    addr="${addr%% *}"
	    if list_add "$addr"; then
		changed=0
	    fi
	else
	    addr=""
	fi

	if [ $changed -eq 0 ]; then
	    guard_command
	    sleep 3
	fi
    done

    return;
}

readonly TIME_CYCLE=$((7*24*60*60))

list=""
list_time=""
head=""
head_time=-1
addr=""
time=0

../detect -i "$DETECT_INTERFACE" -t "$DETECT_TIME" \
    -a "$DETECT_ACCESS" "$DETECT_FILTER" | guard