-
Notifications
You must be signed in to change notification settings - Fork 0
/
notify_json.pl
executable file
·91 lines (62 loc) · 2.57 KB
/
notify_json.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/usr/bin/perl
use strict;
use warnings;
use JSON;
use IPC::Run qw(run);
use Data::Dumper;
my $community_host_to_blackhole = '65000:777';
# Write some debug to /tmp
open my $fl, ">>", "/tmp/selective_bgp_blackhole_traffic_diversion_api.log" or die "Could not open file for writing";
# This script executed from FastNetMon this way: ban 11.22.33.44
if (scalar @ARGV != 2) {
print {$fl} "Please specify all arguments. Got only: @ARGV\n";
die "Please specify all arguments\n";
}
my ($action, $ip_address) = @ARGV;
# action could be: ban, unban, partial_block
# Read data from stdin
my $input_attack_details = join '', <STDIN>;
# try to decode this data to json
my $attack_details = eval{ decode_json($input_attack_details); };
# report error
if ($@) {
print {$fl} "JSON decode failed: $input_attack_details\n";
die "JSON decode failed\n";
}
print {$fl} "Received notification about $ip_address with action $action\n";
print {$fl} Dumper($attack_details);
my $host_group = $attack_details->{attack_details}->{'host_group'};
my $command = '';
if ($host_group eq 'host_to_scrubbing') {
my $host_network = $attack_details->{attack_details}->{host_network};
my ($out, $err);
my $scrubbing_integration_path = '/usr/local/bin/scrubbing_services_integration';
print {$fl} "Will execute command $scrubbing_integration_path for group $host_group\n";
# Pass all stdin arguments as-is to DDoS Scrubbing integration script
my $result_of_call = run [ $scrubbing_integration_path ], \$input_attack_details, \$out, \$err;
if ($result_of_call) {
# Successfully executed it: https://metacpan.org/pod/IPC::Run#RETURN-VALUES
print {$fl} "Scrubbing integration successfully finished. Std out: $out std err: $err\n";
} else {
print {$fl} "Scrubbing integration code returned error. Std out: $out std err: $err\n";
}
} elsif ($host_group eq 'host_to_blackhole') {
if ($action eq 'ban') {
$command = "gobgp global rib add -a ipv4 $attack_details->{ip}/32 community $community_host_to_blackhole";
} elsif ($action eq 'unban') {
$command = "gobgp global rib del -a ipv4 $attack_details->{ip}/32";
} else {
die "Unknown action $action";
}
print {$fl} "Will execute command $command for group $host_group\n";
my $res = system($command);
if ($res != 0) {
print {$fl} "Command failed with code $res\n";
} else {
print {$fl} "Command executed correctly\n";
}
} else {
print {$fl} "Unknown host group $host_group. Do not apply any actions\n";
}
close $fl;
exit 0;