Skip to content

Commit 571ea48

Browse files
cdavid14pavel-odintsov
cdavid14
authored and
pavel-odintsov
committed
Juniper Implementation (#747)
1 parent 12ac8ce commit 571ea48

File tree

5 files changed

+207
-0
lines changed

5 files changed

+207
-0
lines changed

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "src/juniper_plugin/netconf"]
2+
path = src/juniper_plugin/netconf
3+
url = https://github.com/Juniper/netconf-php.git

‎src/juniper_plugin/README.md

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
Juniper FastNetMon plug-in
2+
===========
3+
4+
Overview
5+
--------
6+
Connects to a Juniper router and adds or removes a blackhole rule for an attack by IP address.
7+
8+
The actions can be modified such as adding a firewall rule.
9+
10+
This script uses the Juniper NETCONF PHP API. More information about this can be found at the following URL:
11+
* https://github.com/Juniper/netconf-php
12+
13+
Installation
14+
------------
15+
16+
#### Prerequisite
17+
You must have a user and netconf enabled on your Juniper
18+
19+
to enable netconf go to your cli and type:
20+
```
21+
user@host> configure
22+
user@host# set netconf ssh
23+
```
24+
if you wish to change netconf port instead of
25+
```
26+
user@host# set netconf ssh
27+
```
28+
use
29+
```
30+
user@host# set netconf ssh port <number>
31+
```
32+
33+
Install php to your server:
34+
```
35+
sudo apt-get install php-cli php
36+
```
37+
38+
#### Process
39+
1. Configure the router in the ```fastnetmon_juniper.php``` file
40+
```
41+
$cfg['hostname'] = "10.0.0.1"; // Juniper IP
42+
$cfg['port'] = 880; //NETCONF Port
43+
$cfg['username'] = "user"; //user
44+
$cfg['password'] = "password"; //pass
45+
```
46+
2. Change the ```notify_about_attack.sh``` with the new to run the PHP script
47+
48+
This is the first buggy version, you are welcome to add more features.
49+
50+
3. Set executable bit ```sudo chmod +x /etc/fastnetmon/scripts/notify_about_attack.sh```
51+
52+
4. For FastNetMon Advanced, please disable details:
53+
54+
```
55+
sudo fcli set main notify_script_pass_details disable
56+
sudo fcli commit
57+
```
58+
59+
Changelog
60+
---------
61+
v1.0 - 5 Dec 18 - Initial version
62+
63+
Author: Christian David <[email protected]>
64+
65+
Based on Mikrotik Plugin by Maximiliano Dobladez <[email protected]>

‎src/juniper_plugin/fastnetmon_juniper.php

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
#!/usr/bin/php
2+
<?php
3+
/*****************************
4+
*
5+
* Juniper PHP Integration for Fastnetmon
6+
*
7+
* This script connect to Juniper Router and add or remove a blackhole's rule for the IP attack
8+
*
9+
* Author: Christian David <[email protected]>
10+
*
11+
* Credits for the Netconf API By Juniper/netconf-php <https://github.com/Juniper/netconf-php>
12+
* Script based on Mikrotik Plugin by Maximiliano Dobladez <[email protected]>
13+
*
14+
* Made based on a MX5 CLI and not tested yet, please feedback-us in Issues on github
15+
*
16+
* LICENSE: GPLv2 GNU GENERAL PUBLIC LICENSE
17+
*
18+
*
19+
* v1.0 - 5 Dec 18 - initial version
20+
******************************/
21+
22+
define( "_VER", '1.0' );
23+
24+
$date = date("Y-m-d H:i:s", time());
25+
26+
// You need to enable NETCONF on your juniper
27+
// https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/netconf-ssh-connection-establishing.html#task-netconf-service-over-ssh-enabling
28+
$cfg['hostname'] = "10.0.0.1"; // Juniper IP
29+
$cfg['port'] = 880; //NETCONF Port
30+
$cfg['username'] = "user"; //user
31+
$cfg['password'] = "password"; //pass
32+
33+
/*
34+
PARAMS(
35+
$argv[1] = STRING (IP)
36+
$argv[2] = STRING (ATTACK DIRECTION)
37+
$argv[3] = STRING (PPS)
38+
$argv[4] = STRING (ACTION = BAN OR UNBAN)
39+
)
40+
*/
41+
$IP_ATTACK = $argv[ 1 ];
42+
$DIRECTION_ATTACK = $argv[ 2 ];
43+
$POWER_ATTACK = $argv[ 3 ];
44+
$ACTION_ATTACK = $argv[ 4 ];
45+
if ( $argc <= 4 ) {
46+
$msg .= "Juniper API Integration for FastNetMon - Ver: " . _VER . "\n";
47+
$msg .= "missing arguments";
48+
$msg .= "php fastnetmon_juniper.php [IP] [data_direction] [pps_as_string] [action] \n";
49+
echo $msg;
50+
exit( 1 );
51+
}
52+
//NOTE help
53+
if ( $argv[ 1 ] == "help" ) {
54+
$msg = "Juniper API Integration for FastNetMon - Ver: " . _VER;
55+
echo $msg;
56+
exit( 1 );
57+
}
58+
59+
require_once "netconf/netconf/Device.php";
60+
$conn = new Device($cfg);
61+
switch($ACTION_ATTACK){
62+
case 'ban':
63+
try{
64+
$desc = 'FastNetMon Guard: IP '. $IP_ATTACK .' unblocked because '. $DIRECTION_ATTACK .' attack with power '. $POWER_ATTACK .' pps | at '.$fecha_now;
65+
$conn->connect(); //Try conect or catch NetconfException (Wrong username, Timeout, Device not found, etc)
66+
$locked = $conn->lock_config(); //Equivalent of "configure exclusive" on Juniper CLI
67+
if($locked){
68+
//Community 65535:666 = BLACKHOLE
69+
$conn->load_set_configuration("set routing-options static route {$IP_ATTACK} community 65535:666 discard");
70+
$conn->commit();
71+
}
72+
$conn->unlock(); //Unlock the CLI
73+
$conn->close(); //Close the connection
74+
_log($desc);
75+
76+
}
77+
catch(NetconfException $e){
78+
$msg = "Couldn't connect to " . $cfg['hostname'] . '\nLOG: '.$e;
79+
_log( $msg );
80+
echo $msg;
81+
exit( 1 );
82+
}
83+
break;
84+
case 'unban':
85+
try{
86+
$desc = 'FastNetMon Guard: IP '. $IP_ATTACK .' remove from blacklist.';
87+
$conn->connect(); //Try conect or catch NetconfException (Wrong username, Timeout, Device not found, etc)
88+
$locked = $conn->lock_config(); //Equivalent of "configure exclusive" on Juniper CLI
89+
if($locked){
90+
$conn->load_set_configuration("delete routing-options static route {$IP_ATTACK}/32");
91+
$conn->commit();
92+
}
93+
$conn->unlock(); //Unlock the CLI
94+
$conn->close(); //Close the connection
95+
_log($desc);
96+
}
97+
catch(NetconfException $e){
98+
$msg = "Couldn't connect to " . $cfg['hostname'] . '\nLOG: '.$e;
99+
_log( $msg );
100+
echo $msg;
101+
exit( 1 );
102+
}
103+
break;
104+
default:
105+
$msg = "Juniper API Integration for FastNetMon - Ver: " . _VER;
106+
echo $msg;
107+
exit( 1 );
108+
break;
109+
}
110+
/**
111+
* [_log Write a log file]
112+
* @param [type] $msg [text to log]
113+
* @return [type]
114+
*/
115+
function _log( $msg ) {
116+
$FILE_LOG_TMP = "/tmp/fastnetmon_api_juniper.log";
117+
if ( !file_exists( $FILE_LOG_TMP ) ) exec( "echo `date` \"- [FASTNETMON] - " . $msg . " \" > " . $FILE_LOG_TMP );
118+
else exec( "echo `date` \"- [FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP );
119+
120+
}
121+
?>

‎src/juniper_plugin/netconf

Submodule netconf added at 652a8b6

‎src/juniper_plugin/notify_about_attack.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Fastnetmon: Juniper plugin
4+
#
5+
# Author: - [email protected] - http://maxid.com.ar
6+
# Modified by Christian David <[email protected]> for juniper implementation
7+
#
8+
# This script will get following params:
9+
# $1 client_ip_as_string
10+
# $2 data_direction
11+
# $3 pps_as_string
12+
# $4 action (ban or unban)
13+
14+
15+
php -f /opt/fastnetmon/fastnetmon_juniper.php $1 $2 $3 $4
16+
exit 0
17+

0 commit comments

Comments
 (0)