diff --git a/ban2mysql.pl b/ban2mysql.pl index 090089a..f4ed6d4 100644 --- a/ban2mysql.pl +++ b/ban2mysql.pl @@ -2,7 +2,7 @@ use strict; use warnings; use DBI; - +use DateTime; use Data::Printer; use File::Slurp; @@ -35,23 +35,70 @@ my @file = read_file('sys.log.1'); my $ua = Mojo::UserAgent->new(); +my %nolandforip; +my %nolandips; +my $hundred = 0; +my $first = 0; + +$nolandips{$first} = (); + for my $l ( @file ) { my ( $month, $day, $h, $m, $s, $kat, $src, $dst, $port ) = $l =~ /(.*?) (.*?) (..):(..):(..) 192.*banIP\/...-wan\/drop\/(.*?):.*SRC=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) DST=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*DPT=(\d+)/; - $ua->get("http://ip-api.com/json/$src" => {Accept => '*/*'})->result->body; - p $ua; + #$ua->get("http://ip-api.com/json/$src" => {Accept => '*/*'})->result->body; + # p $ua; my $dt = ''; if ( $month ) { $month = $month2int->{lc $month}; - $dt = "$year-$month-$day $h:$m:$s"; - p $dt; + my $mysqldt = "$year-$month-$day $h:$m:$s"; + my $dt1 = DateTime->new( + year => $year, + month => $month, + day => $day, + hour => $h, + minute => $m, + second => $s + ); - my $da = $dbh->selectrow_hashref('SELECT * FROM banip WHERE src = ? and port = ?', undef, $src, $port ); + # p $dt; + + my $da = $dbh->selectrow_hashref('SELECT * FROM banip_attacker WHERE src = ? and port = ?', undef, $src, $port ); if ( $da ) { - $dbh->do('UPDATE banip set count = count + 1, updated = ? WHERE src = ? and port = ?', undef, $dt, $src, $port ); + my ( $year2, $month2, $day2, $h2, $m2, $s2) = $da->{updated} =~ /(....)-(..)-(..) (..):(..):(..)/; + my $dt2 = DateTime->new( + year => $year2, + month => $month2, + day => $day2, + hour => $h2, + minute => $m2, + second => $s2 + ); + + my $cmp = DateTime->compare( $dt1, $dt2 ); + if ( $cmp == 1 ) { + $dbh->do('UPDATE banip_attacker set count = count + 1, updated = ? WHERE src = ? and port = ?', undef, $mysqldt, $src, $port ); + } + + if ( ! $nolandforip{$src} ) { + if ( !$da->{land} ) { + $nolandforip{$src} = 1; + + if ( $hundred == 100 ) { + $first ++; + $nolandips{$first} = (); + $hundred = 0; + } + + push @{$nolandips{$first}}, {"query"=> $src, "fields"=> "country,countryCode,query", "lang"=> "de"}; + $hundred ++; + } + } + } else { + + $dbh->do( - 'INSERT INTO banip ( + 'INSERT INTO banip_attacker ( created, updated, src, @@ -65,8 +112,8 @@ for my $l ( @file ) { ?, ?, ?)', undef, - $dt, - $dt, + $mysqldt, + $mysqldt, $src, $dst, $port, @@ -74,3 +121,17 @@ for my $l ( @file ) { } } } + +for my $ar ( keys %nolandips ) { + my $req = $ua->post("http://ip-api.com/batch" => {Accept => '*/*'} => json => $nolandips{$ar} )->result->json; + # p $req; + + for my $query ( @$req ) { + $dbh->do('UPDATE banip_attacker set land = ? WHERE src = ?', undef, $query->{country}, $query->{query} ); + } + + + + # p $nolandips{$ar}; + +}