use MIME::Lite;
use Date::Format;
use Mysql;
use Class::Date qw(:errors date localdate gmdate now -DateParse);

use Sys::Hostname::FQDN qw(
asciihostinfo
gethostinfo
inet_ntoa
inet_aton
fqdn
short
);

`rm -f /hsphere/shared/apache2/logs/evasive.log/*`;

$date = new Class::Date [$year,$month,$day,$hour,$min,$sec];
$date=now;
my $dt=$date->year."-".$date->month."-".$date->day." ".$date->hour.":".$date->min;

my $min_count = 0;
my $min_period = 180;
my $min_block = 300;
my $max_count = 10;
my $max_period = 1800;
my $max_block = 1800;
my $expire = 3600;

my $do_block = 1;
my $do_log = 1;
my $do_mail = 1;
my $email = 'куда слать';
my $hostname = short();

my $ip_to_block = shift @ARGV;
my $vhost = shift @ARGV;
my $uri = shift @ARGV;
my $args = shift @ARGV;
if ($args) { $args="?".$args; }

$vhost=short();
$uri='/';

$db = Mysql->connect("mysql.hoster.kg","antiddos", "xxxxx", "xxxxxxxx");

$time=time;

$sql="select id,time,block_time,ip from blocks where host='$vhost'";
$res = $db->query($sql);
#$res=$db->prepare($sql);

while (@arr = $res->fetchrow) {
if (($time-$arr[1])>$arr[2]) { unblock($arr[3],$arr[0]); }
}

$sql="delete from main where time < ($time - $expire) and host='$vhost'"; $res = $db->query($sql);
if ($ip_to_block) {

$sql="insert into main (ip,time,vhost,url,host) values (\"$ip_to_block\",$time,\"$vhost\",\"$uri\",'$vhost')";
$res = $db->query($sql);

$sql="select count(*) from main where time between ($time-$max_period) and $time and ip=\"$ip_to_block\" and host='$vhost'";
$res = $db->query($sql);
@arr=$res->fetchrow;
if ($arr[0]>$max_count) { block ($ip_to_block,$max_block); }
else {
$sql="select count(*) from main where time between ($time-$min_period) and $time and ip=\"$ip_to_block\" and host='$vhost'";
$res = $db->query($sql);
@arr=$res->fetchrow;
if ($arr[0]>$min_count) { block ($ip_to_block,$min_block); }
}
}

sub block {
$sql="select count(*) from blocks where ip=\"$_[0]\" and host='$vhost' ";
$res = $db->query($sql);
@arr=$res->fetchrow;

if (!$arr[0]) {
$sql="insert into blocks (ip,block_time,time,host) values (\"$_[0]\",$_[1],$time,'$vhost')";
$res = $db->query($sql);

if ($do_log) {
$cmd=`echo "$dt block $_[0] for $_[1] seconds on $vhost" >> /tmp/ddos_log`;
}

if ($do_mail) {
$t=$_[1]/60;
$data="IP: $_[0]\nURL: $vhost$uri$args\nTime: $t minutes";
$msg = MIME::Lite->new (
From =>"",
To =>$email,
Subject =>"IP-address block on $hostname",
Data =>$data
);
$msg->send;
}

if ($do_block = 1) {
$str="/sbin/iptables -I INPUT -s ".$_[0]." -j REJECT --reject-with icmp-port-unreachable";
$cmd=`$str`;
}

}
return 0;
}

sub unblock {
$sql1="delete from blocks where id=$_[1] and host='$vhost'";
$res1 = $db->query($sql1);

if ($do_log) {
$cmd=`echo "$dt unblock $_[0] on $vhost" >> /tmp/ddos_log`;
}

$str="/sbin/iptables -D INPUT -s ".$_[0]." -j REJECT --reject-with icmp-port-unreachable";
$cmd=`$str`;

return 0;
}

DROP TABLE IF EXISTS `blocks`;
/*!40101 SET @saved_cs_client = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `blocks` (
`id` bigint(11) NOT NULL AUTO_INCREMENT,
`ip` varchar(15) NOT NULL,
`time` int(11) NOT NULL,
`block_time` int(11) NOT NULL,
`host` varchar(255) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=1000 DEFAULT CHARSET=cp1251;
/*!40101 SET character_set_client = @saved_cs_client */;