crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

On remplit la base que lorsque l'ip src est une ip du crans

Browse source 
darcs-hash:20050926165240-6d78a-34024d15c417fa5b6b20858657d2cf7679e7712c.gz
This commit is contained in:
pessoles 2005-09-26 18:52:40 +02:00
parent 867068d8ef
commit 3fe4beb356
1 changed files with 50 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

96
surveillance/filtrage_firewall.py
View file

@ -20,7 +20,6 @@ import strptime
# Définition de constantes : # Définition de constantes :
############################ ############################
reseau = ["138.231.136.0/21", "138.231.148.0/22"] reseau = ["138.231.136.0/21", "138.231.148.0/22"]
# Ouverture de la base de données : # Ouverture de la base de données :
@ -79,50 +78,55 @@ for log in filtre :
resultat_p2p = motif_p2p.match(log) resultat_p2p = motif_p2p.match(log)
resultat_virus = motif_virus.match(log) resultat_virus = motif_virus.match(log)
resultat_flood = motif_flood.match(log) resultat_flood = motif_flood.match(log)
if resultat_p2p :
date = resultat_p2p.group(1) ip_src = resultat_p2p.group(3)
id_p2p = int(protocole_p2p[resultat_p2p.group(2)]) verif = iptools.AddrInNets (actuel["ip_src"],reseau)
ip_src = resultat_p2p.group(3)
ip_dest = resultat_p2p.group(4) if verif :
proto = int(protocole[resultat_p2p.group(5)]) #C'est à dire id pour la base if resultat_p2p :
port_src = int(resultat_p2p.group(6)) date = resultat_p2p.group(1)
port_dest = int(resultat_p2p.group(7)) id_p2p = int(protocole_p2p[resultat_p2p.group(2)])
date=strptime.syslog2pgsql(date) ip_src = resultat_p2p.group(3)
ip_dest = resultat_p2p.group(4)
proto = int(protocole[resultat_p2p.group(5)]) #C'est à dire id pour la base
port_src = int(resultat_p2p.group(6))
port_dest = int(resultat_p2p.group(7))
date=strptime.syslog2pgsql(date)
# On remplit la base : # On remplit la base :
###################### ######################
curseur = pgsql.cursor() curseur = pgsql.cursor()
requete = "INSERT INTO p2p (date,ip_src,ip_dest,id_p2p,id,port_src,port_dest) VALUES ('%s','%s','%s',%d,%d,%d,%d)" % (date,ip_src,ip_dest,id_p2p,proto,port_src,port_dest) requete = "INSERT INTO p2p (date,ip_src,ip_dest,id_p2p,id,port_src,port_dest) VALUES ('%s','%s','%s',%d,%d,%d,%d)" % (date,ip_src,ip_dest,id_p2p,proto,port_src,port_dest)
curseur.execute(requete) curseur.execute(requete)
# On teste si le log contient des virus # On teste si le log contient des virus
######################################## ########################################
elif resultat_virus : elif resultat_virus :
date = resultat_virus.group(1) date = resultat_virus.group(1)
ip_src = resultat_virus.group(3) ip_src = resultat_virus.group(3)
ip_dest = resultat_virus.group(4) ip_dest = resultat_virus.group(4)
proto = int(protocole[resultat_virus.group(5)]) #C'est à dire id pour la base proto = int(protocole[resultat_virus.group(5)]) #C'est à dire id pour la base
port_src = int(resultat_virus.group(6)) port_src = int(resultat_virus.group(6))
port_dest = int(resultat_virus.group(7)) port_dest = int(resultat_virus.group(7))
# On remplit la base : # On remplit la base :
###################### ######################
date=strptime.syslog2pgsql(date) date=strptime.syslog2pgsql(date)
curseur = pgsql.cursor() curseur = pgsql.cursor()
requete = "INSERT INTO virus (date,ip_src,ip_dest,id,port_src,port_dest) VALUES ('%s','%s','%s',%d,%d,%d)" % (date,ip_src,ip_dest,proto,port_src,port_dest) requete = "INSERT INTO virus (date,ip_src,ip_dest,id,port_src,port_dest) VALUES ('%s','%s','%s',%d,%d,%d)" % (date,ip_src,ip_dest,proto,port_src,port_dest)
curseur.execute(requete) curseur.execute(requete)
elif resultat_flood : elif resultat_flood :
date = resultat_flood.group(1) date = resultat_flood.group(1)
ip_src = resultat_flood.group(3) ip_src = resultat_flood.group(3)
ip_dest = resultat_flood.group(4) ip_dest = resultat_flood.group(4)
proto = int(protocole[resultat_flood.group(5)]) #C'est à dire id pour la base proto = int(protocole[resultat_flood.group(5)]) #C'est à dire id pour la base
port_src = int(resultat_flood.group(6)) port_src = int(resultat_flood.group(6))
port_dest = int(resultat_flood.group(7)) port_dest = int(resultat_flood.group(7))
# On remplit la base : # On remplit la base :
###################### ######################
date=strptime.syslog2pgsql(date) date=strptime.syslog2pgsql(date)
curseur = pgsql.cursor() curseur = pgsql.cursor()
requete = "INSERT INTO flood (date,ip_src,ip_dest,id,port_src,port_dest) VALUES ('%s','%s','%s',%d,%d,%d)" % (date,ip_src,ip_dest,proto,port_src,port_dest) requete = "INSERT INTO flood (date,ip_src,ip_dest,id,port_src,port_dest) VALUES ('%s','%s','%s',%d,%d,%d)" % (date,ip_src,ip_dest,proto,port_src,port_dest)
curseur.execute(requete) curseur.execute(requete)