#!/bin/bash                                                                                        
 DEV=$1   # 定义监听网卡
 LIMIT=$2 # 定义触发阙值 
 WARN=$3 #定义报警阙值
 TIME=$4 # 定义网卡数据采集频率
 mobile_num="13xxxxxxxxxx"   # 定义接收报警短信手机号码
 LOCK="/tmp/.exchange_proxy.lock"

[ -z $DEV ] && echo "$0 ethx limit_band(kbps) warn_limit(kbps) seconds" && exit 0
[ -z $LIMIT ] && LIMIT=800000 # 800 kbps
[ -z $WARN ] && WARN=900000 # 900 kbps
[ -z $TIME ] && TIME=10 # 10s

send_fetion() {
#定义飞信报警短信接口
}

while : ; do
net_flood=`ifconfig $DEV|sed -n "8"p`
rx_before=`echo $net_flood|awk '{print $2}'|cut -c7-`

sleep $TIME

net_flood=`ifconfig $DEV|sed -n "8"p`
rx_after=`echo $net_flood|awk '{print $2}'|cut -c7-`

rx_result=$[(rx_after-rx_before)/$TIME]

over_bw=$[(rx_result-LIMIT)]
if [ $over_bw -gt 0 ];then
BOOL=`echo "$rx_result>$WARN"|bc` #判断是否为攻击
if [ $BOOL -eq 1 ];then
# 确认为攻击，执行策略并发送短信
send_fetion $mobile_num "$STR"
else
# 流量超标，发送短信，请留意
send_fetion $mobile_num "$STR"
fi
fi
sleep $TIME
done

global
    nbproc 24
    pidfile /var/run/haproxy.pid
    daemon
    quiet
    user nobody
    group nobody
    chroot /opt/haproxy
    spread-checks 2

defaults
log 127.0.0.1 local5
mode http
option forwardfor
option httplog
option dontlognull
option nolinger # reduce FIN_WAIT1
option redispatch
retries 3
option http-pretend-keepalive
option http-server-close
option accept-invalid-http-request
timeout client 15s
timeout connect 15s
timeout server 15s
timeout http-keep-alive 15s
timeout http-request 15s

stats enable
stats uri /stats
stats realm 53KF\ Proxy\ Status
stats refresh 60s
stats auth admin:adminxxx

listen Web_FB 0.0.0.0:80
option httpchk GET /alive.php HTTP/1.0

acl invalid_referer hdr_sub(referer) -i -f /opt/haproxy/etc/bad_ref.conf
acl invalid_url url_sub -i -f /opt/haproxy/etc/bad_url.conf
acl invalid_methods method -i -f /opt/haproxy/etc/bad_method.conf
block if invalid_referer || invalid_url || invalid_methods

acl dyn_host hdr(host) -i -f /opt/haproxy/etc/notcache_host.conf
acl static_req path_end -i -f /opt/haproxy/etc/allow_cache_file.conf
use_backend img_srv if static_req !dyn_host

# acl shaohy
acl geek hdr_dom(host) -i 17geek.com
use_backend geek if geek

# backend shaohy
backend geek
mode http
balance source
cookie SESSION_COOKIE insert indirect nocache
option tcpka
server geek_1 127.0.0.1:81 cookie geek_1 maxconn 10000 weight 8

backend img_srv
mode http
option tcpka
server img_srv 127.0.0.1:88 maxconn 30000 weight 8

backend h_17geek_com_1 {        
    .host="127.0.0.1";      
    .port="81";         
    .connect_timeout=300s;      
    .first_byte_timeout=300s;   
    .between_bytes_timeout=300s;    
 }                  

director geek srv {
{ .backend=h_17geek_com_1; .weight=3;}
}

sub vcl_recv {
if (req.http.host~"^(www).?17geek.com$"){
set req.backend=geek_srv;
if (req.request != "GET" && req.request != "HEAD") {
return (pipe);
}
if(req.url ~ "\.(php|jsp)($|\?)") {
return (pass);
}
else {
return (lookup);
}
}
}

#  这个脚本是从Apnic下载属于中国的IP列表，然后把属于联通，电信及其它的IP进行归类  
get_apnic(){  
FILE=$PWD/ip_apnic  
CNC_FILE=$PWD/CNC  
CTC_FILE=$PWD/CTC  
TMP=/dev/shm/ip.tmp  
rm -f $FILE  
wget http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest -O $FILE  

grep 'apnic|CN|ipv4|' $FILE | cut -f 4,5 -d'|'|sed -e 's/|/ /g' | while read ip cnt
do
echo $ip:$cnt
mask=$(cat << EOF | bc | tail -1

pow=32;
define log2(x) {
if (x<=1) return (pow);
pow--;
return(log2(x/2));
}

log2($cnt)
EOF
)

whois $ip@whois.apnic.net > $TMP.tmp
sed -n '/^inetnum/,/source/p' $TMP.tmp | awk '(/mnt-/ || /netname/)' > $TMP
NETNAME=`grep ^netname $TMP | sed -e 's/.*: \(.*\)/\1/g' | sed -e 's/-.*//g'|sed 's: ::g'`

egrep -qi "(CNC|UNICOM|WASU|NBIP|CERNET|CHINAGBN|CHINACOMM|FibrLINK|BGCTVNET|DXTNET|CRTC)" $TMP
if [ $? = 0 ];then
echo $ip/$mask >> $CNC_FILE
else
egrep -qi "(CHINATELECOM|CHINANET)" $TMP
if [ $? = 0 ];then
echo $ip/$mask >> $CTC_FILE
else
sed -n '/^route/,/source/p' $TMP.tmp | awk '(/mnt-/ || /netname/)' > $TMP
egrep -qi "(CNC|UNICOM|WASU|NBIP|CERNET|CHINAGBN|CHINACOMM|FibrLINK|BGCTVNET|DXTNET|CRTC)" $TMP
if [ $? = 0 ];then
echo $ip/$mask >> $CNC_FILE
else
egrep -qi "(CHINATELECOM|CHINANET)" $TMP
if [ $? = 0 ];then
echo $ip/$mask >> $CTC_FILE
else
echo "$ip/$mask $NETNAME" >> $PWD/OTHER
fi
fi
fi
fi
done
rm -rf $TMP $TMP.tmp
}

# 从whois信息中提取address登记人地址信息，从而判断在哪个省份
gen_zone(){
FILE=$2
[ ! -s $FILE ] && echo "$FILE file not found." && exit 0

rm -rf $FILE.zone
while read LINE;do
LINE=`echo "$LINE"|awk '{print $1}'`
echo "$LINE @ "
echo -n "$LINE @ " >> $FILE.zone
whois $LINE|egrep "address"|xargs echo >> $FILE.zone
sleep $TIME
done < $FILE
}

# 分别挑选出华东，华南，华北，西部四大区的IP地址列表
gen_area(){
FILE=$2
[ ! -s $FILE.zone ] && echo "$FILE.zone file not found." && exit 0

STRING="none"
echo $FILE|egrep -i -q "cnc"
[ $? = 0 ] && STRING="cnc"
echo $FILE|egrep -i -q "ctc"
[ $? = 0 ] && STRING="ctc"
echo $FILE|egrep -i -q "other"
[ $? = 0 ] && STRING="other"

[ $STRING = "none" ] && echo "Not cnc or ctc file" && exit 0

cp -a $FILE.zone $FILE.tmp

egrep -i "$HD_STR" $FILE.tmp > $HD_FILE.$STRING
egrep -i -v "$HD_STR" $FILE.tmp > aaa
mv aaa $FILE.tmp

egrep -i "$HN_STR" $FILE.tmp > $HN_FILE.$STRING
egrep -i -v "$HN_STR" $FILE.tmp > aaa
mv aaa $FILE.tmp

egrep -i "$XI_STR" $FILE.tmp > $XI_FILE.$STRING
egrep -i -v "$XI_STR" $FILE.tmp > aaa
mv aaa $FILE.tmp

egrep -i "$HB_STR" $FILE.tmp > $HB_FILE.$STRING
egrep -i -v "$HB_STR" $FILE.tmp > aaa
mv aaa $FILE.tmp

grep ^[0-9] $FILE.tmp |awk '{print $1}' >> $HD_FILE.$STRING
sed -r -i 's#@.*##g' *.$STRING

rm -rf $FILE.tmp
}