增加Ng防护

Makefile

@@ -38,7 +38,7 @@ LIBCOMMON_LIB += ./clamav/common/cert_util.c.o ./clamav/common/actions.c.o ./cla
 
 all: libclamav_rust libclamav rhost
 
-rhost: conf.o rhost.o libiptc.o ccronexpr.o
+rhost: conf.o rhost.o libiptc.o ccronexpr.o nginx.o
 	$(CC) $(ip2region_CFLAGS) ip2region/ip2region.c
 	$(CC) $(ip2region_CFLAGS) ip2region/xdb_searcher.c
 	$(CC) $(cJSON_CFLAGS) cJSON/cJSON.c

nginx.c

@@ -0,0 +1,127 @@
+#include "nginx.h"
+#include "ip2region/ip2region.h" 
+
+#define EVENT_SIZE (sizeof(struct inotify_event))
+#define EVENT_BUF_LEN (1024 * (EVENT_SIZE + 16))
+#define INITIAL_BUFFER_SIZE 8192
+
+int IP_location(char *string) {
+    char *area = NULL;
+    char *xdb_path = "ip2region.xdb";
+    char *p = strchr(string, ' ');
+    char IP[64];
+    memset(IP, 0, 64);
+
+    if ((p - string) > 0) {
+        memmove(IP, string, p - string);
+    } else {
+        printf("Invalid IP string format.\n");
+        return -1;
+    }
+
+    if (access(xdb_path, F_OK) == -1) { // 判断 ip2region 地址定位库是否存在
+        xdb_path = "ip2region/ip2region.xdb";
+        if (access(xdb_path, F_OK) == -1) {
+            printf("ip2region.xdb DOESN'T EXIST!\n");
+            return -1;
+        }
+    }
+
+    area = ip2region(xdb_path, IP);
+    if (area == NULL) {
+        printf("ip2region解析地域错误\n");
+        return -1;
+    }
+
+    printf("IP地址:%s, %s\n", IP, area);
+
+    return 0;
+}
+
+void nginx_read_log(const char *filename) {
+    int fd = open(filename, O_RDONLY);
+    if (fd == -1) {
+        perror("open");
+        exit(EXIT_FAILURE);
+    }
+
+    // Move to the end of the file
+    if (lseek(fd, 0, SEEK_END) == -1) {
+        perror("lseek");
+        close(fd);
+        exit(EXIT_FAILURE);
+    }
+
+    int inotify_fd = inotify_init();
+    if (inotify_fd < 0) {
+        perror("inotify_init");
+        close(fd);
+        exit(EXIT_FAILURE);
+    }
+
+    int wd = inotify_add_watch(inotify_fd, filename, IN_MODIFY);
+    if (wd == -1) {
+        perror("inotify_add_watch");
+        close(inotify_fd);
+        close(fd);
+        exit(EXIT_FAILURE);
+    }
+
+    char buffer[EVENT_BUF_LEN];
+
+    // Set the file descriptor to non-blocking mode
+    int flags = fcntl(fd, F_GETFL, 0);
+    if (flags == -1) {
+        perror("fcntl F_GETFL");
+        inotify_rm_watch(inotify_fd, wd);
+        close(inotify_fd);
+        close(fd);
+        exit(EXIT_FAILURE);
+    }
+    if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
+        perror("fcntl F_SETFL");
+        inotify_rm_watch(inotify_fd, wd);
+        close(inotify_fd);
+        close(fd);
+        exit(EXIT_FAILURE);
+    }
+
+    // Initial dynamic buffer allocation
+    size_t buffer_size = INITIAL_BUFFER_SIZE;
+    char *read_buf = alloca(buffer_size);
+    if (!read_buf) {
+        perror("alloca");
+        inotify_rm_watch(inotify_fd, wd);
+        close(inotify_fd);
+        close(fd);
+        exit(EXIT_FAILURE);
+    }
+
+    while (1) {
+        int length = read(inotify_fd, buffer, EVENT_BUF_LEN);
+        if (length < 0) {
+            perror("read");
+            break;
+        }
+
+        for (int i = 0; i < length;) {
+            struct inotify_event *event = (struct inotify_event *) &buffer[i];
+            if (event->mask & IN_MODIFY) {
+                int bytes_read;
+                while ((bytes_read = read(fd, read_buf, buffer_size - 1)) > 0) {
+                    read_buf[bytes_read] = '\0';
+                    IP_location(read_buf);
+                }
+                if (bytes_read == -1 && errno != EAGAIN) {
+                    perror("read");
+                    break;
+                }
+            }
+            i += EVENT_SIZE + event->len;
+        }
+    }
+
+    inotify_rm_watch(inotify_fd, wd);
+    close(inotify_fd);
+    close(fd);
+}

nginx.h

@@ -0,0 +1,15 @@
+#ifndef NGINX_H
+#define NGINX_H
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/inotify.h>
+#include <errno.h>
+#include <fcntl.h>
+
+
+extern void nginx_read_log(const char *filename);
+
+#endif

rhost.conf

@@ -13,7 +13,7 @@ global {
     REFUSE_NUMBER = 3;                      // 拒绝攻击次数
     
     CLAMAV = 1;                             // clamav 是否扫描病毒(1开启,非1关闭)
-    CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected  --move=/opt/infected --max-filesize 1024M -l clamscan.log";
+    CLAMAV_ARG = "-r / --exclude-dir=^/sys|^/dev|^/proc|^/opt/infected|^/root|^/home|^/mnt|^/usr|^/var  --move=/opt/infected --max-filesize 1024M -l clamscan.log";
     CLAMAV_TIME = "* 7 23 * * *";          // clamav 扫描时间(Cron格式, 秒 分 时 天 月 周)
     
     
@@ -23,18 +23,17 @@ global {
     
     REGION = 1;                             // 是否启用地域白名单(1开启,非1关闭)
     IP2REGION = 1;                          // 是否使用本地 ip2region 地址定位库(1使用,非1不使用)
-    REGION_URL = "http://opendata.baidu.com/api.php?query=%s&co=&resource_id=6006&oe=utf8";       // 获取IP地域API
     REGION_LIST = "河南 郑州 上海";         // 地域列表(空格隔开)
     
     
     IS_MAIL = 0;                            // 开启邮件告警(1开启,非1关闭)
     
     
-    IS_DING_WEBHOOK = 0;                    // 开启叮叮告警(1开启,非1关闭)
+    IS_DING_WEBHOOK = 1;                    // 开启叮叮告警(1开启,非1关闭)
     PHONE = "15565979082";                  // @的人手机号
-    DING_WEBHOOK = "https://oapi.dingtalk.com/robot/send?access_token=7f069c672cb878987aa6772cca336740eece4ce36bde12b51b45e9f440e0565a";        // 钉钉WEBHOOK
+    DING_WEBHOOK = "https://oapi.dingtalk.com/robot/send?access_token=396bce0384cded025087cff3c176ea5e9afb9bd8fcaa46d6fa8c51dd172ba513";        // 钉钉WEBHOOK
 
 
-    IS_QQMAIL = 1;                          // 开启QQ邮箱告警(默认使用gomail：https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
+    IS_QQMAIL = 1;                          // 开启QQ邮箱告警(默认使用gomail: https://git.aixiao.me/aixiao/gomail.git)(1开启,非1关闭)
     RECV_MAIL = "1605227279@qq.com";        // 接收者邮箱
 }

rhost.h

@@ -107,9 +107,7 @@ void cron_free(void* p)
 #define BUILD(fmt...)  do { fprintf(stderr,"%s %s ",__DATE__,__TIME__); fprintf(stderr, ##fmt); } while(0)
 
 #define AWK " | awk -v num=%d '{a[$1]+=1;} END {for(i in a){if (a[i] >= num) {print i;}}}' "
-
 #define GE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\").$(LC_ALL=\"C\" date \"+%d\")\" /var/log/auth.log | grep failure | grep rhost"
-#define GE_12 "grep -E \"^$(LC_ALL=\"C\" date +\"%Y-%m-%d\")\" /var/log/auth.log | grep failure | grep rhost"
 #define LE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\")..$(LC_ALL=\"C\" date | awk '{print $3}')\" /var/log/auth.log | grep failure | grep rhost"
 
 #define CENTOS_GE_10 "grep -E \"^$(LC_ALL=\"C\" date \"+%h\").$(LC_ALL=\"C\" date \"+%d\")\" /var/log/secure | grep failure | grep rhost"