[deconnexion, ipt, surveillance] On compte l'upload ipv6 par adresses mac à partir de la correspondance fournie par la parssage des logs du firewall par mac_ip. On affiche un avertissement si on trouve deux mac avec le même ip sur les 3 derniers jours
This commit is contained in:
Valentin Samir
parent
fee4e88908
commit
15c518cc17
3 changed files with 91 additions and 20 deletions
|
|
@ -76,15 +76,26 @@ class machines(gen_config) :
|
|||
curseur = pgsql.cursor()
|
||||
curseur.execute("DELETE FROM machines;")
|
||||
|
||||
ipv6_vu={}
|
||||
def ipv6_already_set(ipv6):
|
||||
ret = ipv6_vu.get(ipv6, False)
|
||||
ipv6_vu[ipv6] = True
|
||||
return ret
|
||||
|
||||
# ajout des entrée
|
||||
for m in machines:
|
||||
if m.proprietaire().__class__ == Club:
|
||||
curseur.execute("INSERT INTO machines (ip, type, id) VALUES (inet'%s','club',%s);"%(m.ip(),m.proprietaire().id()))
|
||||
if not ipv6_already_set(m.ipv6()):
|
||||
curseur.execute("INSERT INTO machines (ip, type, id) VALUES (inet'%s','club',%s);"%(m.ipv6(),m.proprietaire().id()))
|
||||
elif m.proprietaire().__class__ == Adherent:
|
||||
curseur.execute("INSERT INTO machines (ip, type, id) VALUES (inet'%s','adherent',%s);"%(m.ip(),m.proprietaire().id()))
|
||||
if not ipv6_already_set(m.ipv6()):
|
||||
curseur.execute("INSERT INTO machines (ip, type, id) VALUES (inet'%s','adherent',%s);"%(m.ipv6(),m.proprietaire().id()))
|
||||
elif m.proprietaire().__class__ == AssociationCrans:
|
||||
curseur.execute("INSERT INTO machines (ip, type, id) VALUES (inet'%s','crans',%s);"%(m.ip(),m.id()))
|
||||
|
||||
if not ipv6_already_set(m.ipv6()):
|
||||
curseur.execute("INSERT INTO machines (ip, type, id) VALUES (inet'%s','crans',%s);"%(m.ipv6(),m.id()))
|
||||
# on commit
|
||||
pgsql.commit()
|
||||
|
||||
|
|
|
|||
|
|
@ -440,9 +440,25 @@ def check_ip_proto(ip_proto):
|
|||
def ipv6_addr(mac, net):
|
||||
''' Renvoie l'adresse ipv6 d'auto-configuration de la mac sur le réseau '''
|
||||
mac_s = mac.split(':')
|
||||
eui = '2'+':'.join(mac_s[1:3])+'ff:fe'+':'.join(mac_s[3:5])+mac_s[5]
|
||||
eui = hex(int(mac_s[0],16) ^ 0x02)[2:] + ':'.join(mac_s[1:3]) + 'ff:fe' + ':'.join(mac_s[3:5]) + mac_s[5]
|
||||
return re.sub(':/64', eui , prefix[dprefix[net]][0])
|
||||
|
||||
def mac_addr(ipv6):
|
||||
''' Renvoie l'adresse mac de l'ipv6 d'auto-configuration '''
|
||||
ipv6_s= ipv6.split(':')[4:]
|
||||
mac=''
|
||||
if ipv6_s[1].endswith('ff') and ipv6_s[2].startswith('fe'):
|
||||
elt = "%04x" % int(ipv6_s[0], 16)
|
||||
mac += "%02x" % (int(elt[0:2],16) ^ 0x02) + ':' + elt[2:]
|
||||
elt = "%04x" % int(ipv6_s[1], 16)
|
||||
mac += ':' + elt[0:2]
|
||||
elt = "%04x" % int(ipv6_s[2], 16)
|
||||
mac += ':' + elt[2:]
|
||||
elt = "%04x" % int(ipv6_s[3], 16)
|
||||
mac += ':' + elt[0:2] + ':' + elt[2:]
|
||||
return mac
|
||||
return None
|
||||
|
||||
# TODO Fusionner les deux fonctions.
|
||||
def iface(net):
|
||||
'''Retourne l'interface réseau associée à un certain type de réseau
|
||||
|
|
|
|||
|
|
@ -21,6 +21,7 @@ import sys
|
|||
import psycopg2
|
||||
sys.path.append('/usr/scripts/gestion')
|
||||
from config import upload, virus, p2p, NETs
|
||||
import ipt
|
||||
import smtplib
|
||||
from ldap_crans import crans_ldap
|
||||
from ldap_crans import MachineWifi
|
||||
|
|
@ -95,11 +96,7 @@ def reperage_chambre(mac):
|
|||
################################################################################
|
||||
|
||||
# upload par entité (adhérent/club/machine crans)
|
||||
requete = """SELECT
|
||||
round(total) AS total, machines.type AS type, machines.id AS id
|
||||
FROM
|
||||
(
|
||||
SELECT
|
||||
upload4="""SELECT
|
||||
'upload', sum(upload)/1024/1024 AS total, ip_crans
|
||||
FROM
|
||||
upload
|
||||
|
|
@ -116,6 +113,42 @@ FROM
|
|||
)
|
||||
GROUP BY
|
||||
ip_crans
|
||||
"""
|
||||
upload6 = """SELECT
|
||||
'upload', sum(upload)/1024/1024 AS total, ip_crans
|
||||
FROM
|
||||
(
|
||||
SELECT DISTINCT * FROM
|
||||
(
|
||||
SELECT
|
||||
upload6.date, mac_ip.ip AS ip_crans, upload6.ip_ext, upload6.id, upload6.port_crans, upload6.port_ext, upload6.download, upload6.upload
|
||||
FROM mac_ip,upload6
|
||||
WHERE
|
||||
upload6.ip_crans = mac_ip.ip
|
||||
AND upload6.date > mac_ip.date
|
||||
AND upload6.date - interval '1 day' < mac_ip.date
|
||||
AND upload6.date > timestamp 'now' - interval '1 day'
|
||||
AND upload6.date < 'now'
|
||||
AND upload6.upload > upload6.download
|
||||
AND NOT EXISTS
|
||||
(
|
||||
SELECT 1
|
||||
FROM exemptes
|
||||
WHERE upload6.ip_crans <<= exemptes.ip_crans
|
||||
AND upload6.ip_ext <<= exemptes.ip_dest
|
||||
)
|
||||
) AS upload
|
||||
) AS upload
|
||||
WHERE
|
||||
upload > download
|
||||
GROUP BY
|
||||
ip_crans
|
||||
"""
|
||||
requete = """SELECT
|
||||
round(total) AS total, machines.type AS type, machines.id AS id
|
||||
FROM
|
||||
(
|
||||
(%s) UNION (%s)
|
||||
)
|
||||
AS
|
||||
upload
|
||||
|
|
@ -127,10 +160,21 @@ WHERE
|
|||
total >= 250
|
||||
GROUP BY
|
||||
total, type, id
|
||||
;"""
|
||||
;""" % (upload4, upload6)
|
||||
curseur.execute(requete)
|
||||
uploadeurs = curseur.fetchall()
|
||||
|
||||
|
||||
# On regarde s'il y a deux ipv6 identiques avec des mac non identiques
|
||||
collision_mac_ip_request = "SELECT DISTINCT (a.*) FROM mac_ip as a, mac_ip as b where a.ip=b.ip AND a.mac != b.mac AND a.date >= b.date AND a.date - b.date < interval '3 day' ORDER BY a.date;"
|
||||
curseur.execute(collision_mac_ip_request)
|
||||
collision_mac_ip = curseur.fetchall()
|
||||
|
||||
if collision_mac_ip != []:
|
||||
print "Collision d'addresses ipv6 : "
|
||||
for (date, mac, ip) in collision_mac_ip:
|
||||
print "%s %s %s" % (date, ipt.mac_addr(mac), ip)
|
||||
|
||||
# Table des avertis
|
||||
###################
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue