Add third_party/pexpect

third_party/pexpect/examples/topip.py

+#!/usr/bin/env python
+
+''' This runs netstat on a local or remote server. It calculates some simple
+statistical information on the number of external inet connections. It groups
+by IP address. This can be used to detect if one IP address is taking up an
+excessive number of connections. It can also send an email alert if a given IP
+address exceeds a threshold between runs of the script. This script can be used
+as a drop-in Munin plugin or it can be used stand-alone from cron. I used this
+on a busy web server that would sometimes get hit with denial of service
+attacks. This made it easy to see if a script was opening many multiple
+connections. A typical browser would open fewer than 10 connections at once.
+A script might open over 100 simultaneous connections.
+
+./topip.py [-s server_hostname] [-u username] [-p password]
+        {-a from_addr,to_addr} {-n N} {-v} {--ipv6}
+
+    -s : hostname of the remote server to login to.
+    -u : username to user for login.
+    -p : password to user for login.
+    -n : print stddev for the the number of the top 'N' ipaddresses.
+    -v : verbose - print stats and list of top ipaddresses.
+    -a : send alert if stddev goes over 20.
+    -l : to log message to /var/log/topip.log
+    --ipv6 : this parses netstat output that includes ipv6 format.
+        Note that this actually only works with ipv4 addresses, but for
+        versions of netstat that print in ipv6 format.
+    --stdev=N : Where N is an integer. This sets the trigger point
+        for alerts and logs. Default is to trigger if the
+        max value is over 5 standard deviations.
+
+Example:
+
+    This will print stats for the top IP addresses connected to the given host:
+
+        ./topip.py -s www.example.com -u mylogin -p mypassword -n 10 -v
+
+    This will send an alert email if the maxip goes over the stddev trigger
+    value and the the current top ip is the same as the last top ip
+    (/tmp/topip.last):
+
+        ./topip.py -s www.example.com -u mylogin -p mypassword \\
+                -n 10 -v -a alert@example.com,user@example.com
+
+    This will print the connection stats for the localhost in Munin format:
+
+        ./topip.py
+
+PEXPECT LICENSE
+
+    This license is approved by the OSI and FSF as GPL-compatible.
+        http://opensource.org/licenses/isc-license.txt
+
+    Copyright (c) 2012, Noah Spurrier <noah@noah.org>
+    PERMISSION TO USE, COPY, MODIFY, AND/OR DISTRIBUTE THIS SOFTWARE FOR ANY
+    PURPOSE WITH OR WITHOUT FEE IS HEREBY GRANTED, PROVIDED THAT THE ABOVE
+    COPYRIGHT NOTICE AND THIS PERMISSION NOTICE APPEAR IN ALL COPIES.
+    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+'''
+
+from __future__ import absolute_import
+from __future__ import print_function
+from __future__ import unicode_literals
+
+# See http://pexpect.sourceforge.net/
+import pexpect
+import pxssh
+import os
+import sys
+import time
+import getopt
+import pickle
+import getpass
+import smtplib
+from pprint import pprint
+
+
+try:
+    raw_input
+except NameError:
+    raw_input = input
+
+
+TOPIP_LOG_FILE = '/var/log/topip.log'
+TOPIP_LAST_RUN_STATS = '/var/run/topip.last'
+
+def exit_with_usage():
+
+    print(globals()['__doc__'])
+    os._exit(1)
+
+def stats(r):
+
+    '''This returns a dict of the median, average, standard deviation,
+    min and max of the given sequence.
+
+    >>> from topip import stats
+    >>> print stats([5,6,8,9])
+    {'med': 8, 'max': 9, 'avg': 7.0, 'stddev': 1.5811388300841898, 'min': 5}
+    >>> print stats([1000,1006,1008,1014])
+    {'med': 1008, 'max': 1014, 'avg': 1007.0, 'stddev': 5.0, 'min': 1000}
+    >>> print stats([1,3,4,5,18,16,4,3,3,5,13])
+    {'med': 4, 'max': 18, 'avg': 6.8181818181818183, 'stddev': 5.6216817577237475, 'min': 1}
+    >>> print stats([1,3,4,5,18,16,4,3,3,5,13,14,5,6,7,8,7,6,6,7,5,6,4,14,7])
+    {'med': 6, 'max': 18, 'avg': 7.0800000000000001, 'stddev': 4.3259218670706474, 'min': 1}
+    '''
+
+    total = sum(r)
+    avg = float(total)/float(len(r))
+    sdsq = sum([(i-avg)**2 for i in r])
+    s = sorted(list(r))
+    return dict(list(zip(['med', 'avg', 'stddev', 'min', 'max'],
+        (s[len(s)//2], avg, (sdsq/len(r))**.5, min(r), max(r)))))
+
+def send_alert (message, subject, addr_from, addr_to, smtp_server='localhost'):
+
+    '''This sends an email alert.
+    '''
+
+    message = ( 'From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n'
+            % (addr_from, addr_to, subject) + message )
+    server = smtplib.SMTP(smtp_server)
+    server.sendmail(addr_from, addr_to, message)
+    server.quit()
+
+def main():
+
+    # Parse the options, arguments, etc.
+    try:
+        optlist, args = getopt.getopt(sys.argv[1:],
+                'h?valqs:u:p:n:', ['help','h','?','ipv6','stddev='])
+    except Exception as e:
+        print(str(e))
+        exit_with_usage()
+    options = dict(optlist)
+
+    munin_flag = False
+    if len(args) > 0:
+        if args[0] == 'config':
+            print('graph_title Netstat Connections per IP')
+            print('graph_vlabel Socket connections per IP')
+            print('connections_max.label max')
+            print('connections_max.info Maximum number of connections per IP')
+            print('connections_avg.label avg')
+            print('connections_avg.info Average number of connections per IP')
+            print('connections_stddev.label stddev')
+            print('connections_stddev.info Standard deviation')
+            return 0
+        elif args[0] != '':
+            print(args, len(args))
+            return 0
+            exit_with_usage()
+    if [elem for elem in options if elem in ['-h','--h','-?','--?','--help']]:
+        print('Help:')
+        exit_with_usage()
+    if '-s' in options:
+        hostname = options['-s']
+    else:
+        # if host was not specified then assume localhost munin plugin.
+        munin_flag = True
+        hostname = 'localhost'
+    # If localhost then don't ask for username/password.
+    if hostname != 'localhost' and hostname != '127.0.0.1':
+        if '-u' in options:
+            username = options['-u']
+        else:
+            username = raw_input('username: ')
+        if '-p' in options:
+            password = options['-p']
+        else:
+            password = getpass.getpass('password: ')
+        use_localhost = False
+    else:
+        use_localhost = True
+
+    if '-l' in options:
+        log_flag = True
+    else:
+        log_flag = False
+    if '-n' in options:
+        average_n = int(options['-n'])
+    else:
+        average_n = None
+    if '-v' in options:
+        verbose = True
+    else:
+        verbose = False
+    if '-a' in options:
+        alert_flag = True
+        (alert_addr_from, alert_addr_to) = tuple(options['-a'].split(','))
+    else:
+        alert_flag = False
+    if '--ipv6' in options:
+        ipv6_flag = True
+    else:
+        ipv6_flag = False
+    if '--stddev' in options:
+        stddev_trigger = float(options['--stddev'])
+    else:
+        stddev_trigger = 5
+
+    if ipv6_flag:
+        netstat_pattern = '(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+::ffff:(\S+):(\S+)\s+.*?\r'
+    else:
+        netstat_pattern = '(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(?:::ffff:)*(\S+):(\S+)\s+.*?\r'
+        #netstat_pattern = '(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+):(\S+)\s+.*?\r'
+
+    # run netstat (either locally or via SSH).
+    if use_localhost:
+        p = pexpect.spawn('netstat -n -t')
+        PROMPT = pexpect.TIMEOUT
+    else:
+        p = pxssh.pxssh()
+        p.login(hostname, username, password)
+        p.sendline('netstat -n -t')
+        PROMPT = p.PROMPT
+
+    # For each matching netstat_pattern put the ip address in the list.
+    ip_list = {}
+    try:
+        while 1:
+            i = p.expect([PROMPT, netstat_pattern])
+            if i == 0:
+                break
+            k = p.match.groups()[4].decode('utf-8')
+            if k in ip_list:
+                ip_list[k] = ip_list[k] + 1
+            else:
+                ip_list[k] = 1
+    except:
+        pass
+
+    # remove a few common, uninteresting addresses from the dictionary.
+    ip_list = dict([ (key,value) for key,value in ip_list.items() if '192.168.' not in key])
+    ip_list = dict([ (key,value) for key,value in ip_list.items() if '127.0.0.1' not in key])
+
+    ip_list = list(ip_list.items())
+    if len(ip_list) < 1:
+        if verbose: print('Warning: no networks connections worth looking at.')
+        return 0
+    ip_list.sort(key=lambda x:x[1])
+
+    # generate some stats for the ip addresses found.
+    if average_n is not None and average_n <= 1:
+        average_n = None
+    # Reminder: the * unary operator treats the list elements as arguments.
+    zipped = zip(*ip_list[0:average_n])
+    s = stats(list(zipped)[1])
+    s['maxip'] = ip_list[0]
+
+    # print munin-style or verbose results for the stats.
+    if munin_flag:
+        print('connections_max.value', s['max'])
+        print('connections_avg.value', s['avg'])
+        print('connections_stddev.value', s['stddev'])
+        return 0
+    if verbose:
+        pprint (s)
+        print()
+        pprint (ip_list[0:average_n])
+
+    # load the stats from the last run.
+    try:
+        last_stats = pickle.load(file(TOPIP_LAST_RUN_STATS))
+    except:
+        last_stats = {'maxip':None}
+
+    if ( s['maxip'][1] > (s['stddev'] * stddev_trigger)
+            and s['maxip']==last_stats['maxip'] ):
+        if verbose: print('The maxip has been above trigger for two consecutive samples.')
+        if alert_flag:
+            if verbose: print('SENDING ALERT EMAIL')
+            send_alert(str(s), 'ALERT on %s'
+                    % hostname, alert_addr_from, alert_addr_to)
+        if log_flag:
+            if verbose: print('LOGGING THIS EVENT')
+            fout = file(TOPIP_LOG_FILE,'a')
+            #dts = time.strftime('%Y:%m:%d:%H:%M:%S', time.localtime())
+            dts = time.asctime()
+            fout.write ('%s - %d connections from %s\n'
+                    % (dts,s['maxip'][1],str(s['maxip'][0])))
+            fout.close()
+
+    # save state to TOPIP_LAST_RUN_STATS
+    try:
+        pickle.dump(s, file(TOPIP_LAST_RUN_STATS,'w'))
+        os.chmod (TOPIP_LAST_RUN_STATS, 0o664)
+    except:
+        pass
+    # p.logout()
+
+if __name__ == '__main__':
+    main()