mirrors
/
Monitorix
mirror of https://github.com/mikaku/Monitorix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

added the new option 'ip_default_table' to define in which table Monitorix ill put all iptables rules for network traffic accounting monitoring

This commit is contained in:
Jordi Sanfeliu 2014-06-26 11:50:17 +02:00
parent 0a1657378e
commit 8b1ec8d4ec
5 changed files with 38 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
lib/Monitorix.pm
View File

@ -302,6 +302,7 @@ sub get_ati_data {
# flushes out all Monitorix iptables/ipfw rules
sub flush_accounting_rules {
my ($config, $debug) = @_;
my $table = $config->{ip_default_table};
if($config->{os} eq "Linux") {
my $num = 0;
@ -309,7 +310,7 @@ sub flush_accounting_rules {
logger("Flushing out iptables rules.") if $debug;
{
my @names;
if(open(IN, "iptables -nxvL INPUT --line-numbers |")) {
if(open(IN, "iptables -t $table -nxvL INPUT --line-numbers |")) {
my @rules;
while(<IN>) {
my ($rule, undef, undef, $name) = split(' ', $_);
@ -321,11 +322,11 @@ sub flush_accounting_rules {
close(IN);
@rules = reverse(@rules);
foreach(@rules) {
system("iptables -D INPUT $_");
system("iptables -t $table -D INPUT $_");
$num++;
}
}
if(open(IN, "iptables -nxvL OUTPUT --line-numbers |")) {
if(open(IN, "iptables -t $table -nxvL OUTPUT --line-numbers |")) {
my @rules;
while(<IN>) {
my ($rule, undef, undef, $name) = split(' ', $_);
@ -336,7 +337,7 @@ sub flush_accounting_rules {
close(IN);
@rules = reverse(@rules);
foreach(@rules) {
system("iptables -D OUTPUT $_");
system("iptables -t $table -D OUTPUT $_");
$num++;
}
}
@ -344,7 +345,7 @@ sub flush_accounting_rules {
system("iptables -X $_");
}
}
if(open(IN, "iptables -nxvL FORWARD --line-numbers |")) {
if(open(IN, "iptables -t $table -nxvL FORWARD --line-numbers |")) {
my @rules;
my @names;
while(<IN>) {
@ -357,12 +358,12 @@ sub flush_accounting_rules {
close(IN);
@rules = reverse(@rules);
foreach(@rules) {
system("iptables -D FORWARD $_");
system("iptables -t $table -D FORWARD $_");
$num++;
}
foreach(@names) {
system("iptables -F $_");
system("iptables -X $_");
system("iptables -t $table -F $_");
system("iptables -t $table -X $_");
}
}
logger("$num iptables rules have been flushed.") if $debug;

13
lib/nginx.pm
View File

@ -44,6 +44,8 @@ sub nginx_init {
my @max;
my @last;
my $table = $config->{ip_default_table};
if(-e $rrd) {
$info = RRDs::info($rrd);
for my $key (keys %$info) {
@ -114,9 +116,9 @@ sub nginx_init {
}
if($config->{os} eq "Linux") {
system("iptables -N monitorix_nginx_IN 2>/dev/null");
system("iptables -I INPUT -p tcp --sport 1024:65535 --dport $nginx->{port} -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j monitorix_nginx_IN -c 0 0");
system("iptables -I OUTPUT -p tcp --sport $nginx->{port} --dport 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j monitorix_nginx_IN -c 0 0");
system("iptables -t $table -N monitorix_nginx_IN 2>/dev/null");
system("iptables -t $table -I INPUT -p tcp --sport 1024:65535 --dport $nginx->{port} -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j monitorix_nginx_IN -c 0 0");
system("iptables -t $table -I OUTPUT -p tcp --sport $nginx->{port} --dport 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j monitorix_nginx_IN -c 0 0");
}
if(grep {$_ eq $config->{os}} ("FreeBSD", "OpenBSD", "NetBSD")) {
system("ipfw delete $nginx->{rule} 2>/dev/null");
@ -135,6 +137,7 @@ sub nginx_update {
my $rrd = $config->{base_lib} . $package . ".rrd";
my $nginx = $config->{nginx};
my $table = $config->{ip_default_table};
my $reqs = 0;
my $tot = 0;
my $reads = 0;
@ -182,7 +185,7 @@ sub nginx_update {
if($config->{os} eq "Linux") {
my $val;
open(IN, "iptables -nxvL INPUT |");
open(IN, "iptables -t $table -nxvL INPUT |");
while(<IN>) {
if(/ monitorix_nginx_IN /) {
(undef, $val) = split(' ', $_);
@ -195,7 +198,7 @@ sub nginx_update {
}
}
close(IN);
open(IN, "iptables -nxvL OUTPUT |");
open(IN, "iptables -t $table -nxvL OUTPUT |");
while(<IN>) {
if(/ monitorix_nginx_IN /) {
(undef, $val) = split(' ', $_);

19
lib/port.pm
View File

@ -45,6 +45,8 @@ sub port_init {
my @max;
my @last;
my $table = $config->{ip_default_table};
if(-e $rrd) {
$info = RRDs::info($rrd);
for my $key (keys %$info) {
@ -140,14 +142,14 @@ sub port_init {
my $p = trim(lc((split(',', $port->{desc}->{$pl[$n]}))[1])) || "all";
my $conn = trim(lc((split(',', $port->{desc}->{$pl[$n]}))[2]));
if($conn eq "in" || $conn eq "in/out") {
system("iptables -N monitorix_IN_$n 2>/dev/null");
system("iptables -I INPUT -p $p --sport 1024:65535 --dport $np -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j monitorix_IN_$n -c 0 0");
system("iptables -I OUTPUT -p $p --sport $np --dport 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j monitorix_IN_$n -c 0 0");
system("iptables -t $table -N monitorix_IN_$n 2>/dev/null");
system("iptables -t $table -I INPUT -p $p --sport 1024:65535 --dport $np -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j monitorix_IN_$n -c 0 0");
system("iptables -t $table -I OUTPUT -p $p --sport $np --dport 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j monitorix_IN_$n -c 0 0");
}
if($conn eq "out" || $conn eq "in/out") {
system("iptables -N monitorix_OUT_$n 2>/dev/null");
system("iptables -I INPUT -p $p --sport $np --dport 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j monitorix_OUT_$n -c 0 0");
system("iptables -I OUTPUT -p $p --sport 1024:65535 --dport $np -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j monitorix_OUT_$n -c 0 0");
system("iptables -t $table -N monitorix_OUT_$n 2>/dev/null");
system("iptables -t $table -I INPUT -p $p --sport $np --dport 1024:65535 -m conntrack --ctstate ESTABLISHED,RELATED -j monitorix_OUT_$n -c 0 0");
system("iptables -t $table -I OUTPUT -p $p --sport 1024:65535 --dport $np -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j monitorix_OUT_$n -c 0 0");
}
if($conn ne "in" && $conn ne "out" && $conn ne "in/out") {
logger("$myself: Invalid connection type '$conn'; must be 'in', 'out' or 'in/out'.");
@ -186,12 +188,13 @@ sub port_update {
my @i_out;
my @o_in;
my @o_out;
my $table = $config->{ip_default_table};
my $n;
my $rrdata = "N";
if($config->{os} eq "Linux") {
open(IN, "iptables -nxvL INPUT |");
open(IN, "iptables -t $table -nxvL INPUT |");
while(<IN>) {
for($n = 0; $n < $port->{max}; $n++) {
$i_in[$n] = 0 unless $i_in[$n];
@ -215,7 +218,7 @@ sub port_update {
}
}
close(IN);
open(IN, "iptables -nxvL OUTPUT |");
open(IN, "iptables -t $table -nxvL OUTPUT |");
while(<IN>) {
for($n = 0; $n < $port->{max}; $n++) {
$o_out[$n] = 0 unless $o_out[$n];

15
lib/traffacct.pm
View File

@ -47,6 +47,8 @@ sub traffacct_init {
my @max;
my @last;
my $table = $config->{ip_default_table};
if(!grep {$_ eq $config->{os}} ("Linux")) {
logger("$myself is not supported yet by your operating system ($config->{os}.");
return;
@ -144,14 +146,14 @@ sub traffacct_init {
$ip = inet_ntoa((gethostbyname($name))[4]);
$ip = $ip . "/32";
}
open(IN, "iptables -nxvL monitorix_daily_$name 2>/dev/null |");
open(IN, "iptables -t $table -nxvL monitorix_daily_$name 2>/dev/null |");
my @data = <IN>;
close(IN);
if(!scalar(@data)) {
system("iptables -N monitorix_daily_$name");
system("iptables -I FORWARD -j monitorix_daily_$name");
system("iptables -A monitorix_daily_$name -s $ip -d 0/0 -o $config->{net}->{gateway}");
system("iptables -A monitorix_daily_$name -s 0/0 -d $ip -i $config->{net}->{gateway}");
system("iptables -t $table -N monitorix_daily_$name");
system("iptables -t $table -I FORWARD -j monitorix_daily_$name");
system("iptables -t $table -A monitorix_daily_$name -s $ip -d 0/0 -o $config->{net}->{gateway}");
system("iptables -t $table -A monitorix_daily_$name -s 0/0 -d $ip -i $config->{net}->{gateway}");
}
}
}
@ -177,6 +179,7 @@ sub traffacct_update {
my $rrd = $config->{base_lib} . $package . ".rrd";
my $traffacct = $config->{traffacct};
my $table = $config->{ip_default_table};
my @in;
my @out;
@ -198,7 +201,7 @@ sub traffacct_update {
$ip = inet_ntoa((gethostbyname($name))[4]);
}
$ip =~ s/\/\d+//;
open(IN, "iptables -nxvL monitorix_daily_$name |");
open(IN, "iptables -t $table -nxvL monitorix_daily_$name |");
$in[$n] = 0 unless $in[$n];
$out[$n] = 0 unless $out[$n];
while(<IN>) {

1
monitorix
View File

@ -530,6 +530,7 @@ if(open(OUT, "> " . $config{base_dir} . "/cgi/monitorix.conf.path")) {
logger("Unable to create the file '$config{base_dir}/cgi/monitorix.conf.path'. $!");
}
$config{ip_default_table} = "filter" if !$config{ip_default_table};
flush_accounting_rules(\%config, $options{d});
logger("Initializing graphs.");