lytsing's Blog

最近公司服务器被hack,怀疑的ip每次都登录ip138.com查询，很麻烦，想起维护新糊涂的时候，曾经写个小程序统计用户ip地址来源。ip数据库是纯真版，代码是参考别人的，忘了是谁写的，我就只修改了main函数。

/**
 * file: ip_from.cpp
 * @date: 2007.4.20
 *
 */

#include <cstdio>
#include <cstdlib>
#include <string>
#include <sstream>
#include <iostream>
#include <iomanip>
#include <ios>
#include <fstream>
#include <vector>
#include <iterator>
#include <stdexcept>
#include <algorithm>
using namespace std;

typedef unsigned int IP_TYPE;

const int  IP_SIZE = 4;
const int  OFFSET_SIZE = 3;
const int  INDEX_RECORD_SIZE = IP_SIZE + OFFSET_SIZE;

class IpLocater {
private:
    FILE* dbfile;
    int   first_index;
    int   last_index;
    enum  { REDIRECT_MODE_1 = 0x01, REDIRECT_MODE_2 = 0x02 };
protected:

public:
    IpLocater(const string dbfilename = "QQWry.Dat")
    {
        dbfile = fopen(dbfilename.c_str(),"rb");
        if (!dbfile) {
            printf("can not open the ip db file %s\n", dbfilename.c_str());
            exit(0);
        }

        fread(&first_index, sizeof(int), 1, dbfile);
        fread(&last_index, sizeof(int), 1, dbfile);
    }
    ~IpLocater(){
        fclose(dbfile);
    }

    int getRecordCount() const {
        return (last_index - first_index ) / INDEX_RECORD_SIZE + 1;
    }
    
    string readString(const int offset = 0){
        if (offset) {
            fseek(dbfile, offset, SEEK_SET);
        }

        char ch = fgetc(dbfile);
        ostringstream sstr ;
        while (ch != 0 && ch != EOF) {
            sstr << ch;
            ch = fgetc(dbfile);
        }
        return sstr.str();
    }

    inline int readInt3(const int offset = 0 ) {
        if (offset) {
            fseek(dbfile,offset,SEEK_SET);
        }
    
        int result = 0;
        fread(&result, sizeof(char), 3, dbfile);
        return result;
    }

    string readAreaAddr(const int offset = 0) {
        if (offset) {
            fseek(dbfile, offset, SEEK_SET);
        }
        char b = fgetc(dbfile);
        if (b == REDIRECT_MODE_1 || b == REDIRECT_MODE_2) {
            int areaOffset = 0;
            fread(&areaOffset, 1, 3, dbfile);
            if (areaOffset) {
                return readString(areaOffset);
            } else {
                return "Unkown";
            }
        } else {
            fseek(dbfile, -1, SEEK_CUR);
            return readString();
        }
    }

    unsigned int readLastIp(const int offset) {
        fseek(dbfile, offset, SEEK_SET);
        unsigned int ip = 0;
        fread(&ip, sizeof(unsigned int), 1, dbfile);
        return ip;
    }

    string readFullAddr(const int offset, int ip = 0) {
        string address = "";

        fseek(dbfile, offset + 4, SEEK_SET);

        char ch = fgetc(dbfile);
        if (ch == REDIRECT_MODE_1) {
            int countryOffset = 0;
            fread(&countryOffset,sizeof(char),3,dbfile);
            
            fseek(dbfile, countryOffset, SEEK_SET);
            char byte = fgetc(dbfile);
            if (byte == REDIRECT_MODE_2 ) {
                int p = 0;
                fread(&p, 1, 3, dbfile);
                address = readString(p);
                fseek(dbfile, countryOffset + 4, SEEK_SET);
            } else {
                address = readString(countryOffset);
            }
            address += readAreaAddr(); // current position
        } else if (ch == REDIRECT_MODE_2) {
            int p = 0;
            fread(&p, 1, 3, dbfile);
            address = readString(p);
            address += readAreaAddr(offset + 8);
        } else {
            fseek(dbfile, -1, SEEK_CUR);
            address = readString();
            address += readAreaAddr();
        }

        return address;
    }

    void printAddr(int first = 0, int count = 100){
        int record_count  = getRecordCount();
        for (int i = first; i< first+count && i<record_count; i++)
        {
            fseek(dbfile,i*INDEX_RECORD_SIZE+first_index,SEEK_SET);
            unsigned int ip = 0;
            fread(&ip,sizeof(unsigned int),1,dbfile);
            int offset = 0;
            fread(&offset,1,OFFSET_SIZE,dbfile);
            cout << ip2string(ip) << "-" << ip2string(readLastIp(offset))
                << readFullAddr(offset) << endl;
        }
    }

    int find(unsigned int ip,int left ,int right) {
        if (right - left == 1) {
            return left;
        } else {
            int middle = (left + right) / 2;
            
            int offset = first_index + middle * INDEX_RECORD_SIZE;
            fseek(dbfile,offset,SEEK_SET);
            unsigned int new_ip = 0;
            fread(&new_ip,sizeof(unsigned int),1,dbfile);
            
            if (ip >= new_ip) {
                return find(ip,middle,right);
            } else {
                return find(ip,left,middle);
            }
        }
    }

    string getIpAddr( unsigned int ip){
        int index = find(ip,0, getRecordCount() - 1 );
        int index_offset = first_index + index * INDEX_RECORD_SIZE + 4;
        int addr_offset = 0;
        fseek(dbfile,index_offset,SEEK_SET);
        fread(&addr_offset,1,3,dbfile);
        string address = readFullAddr( addr_offset,ip );
        return address;
    }
    
    string ip2string( unsigned int ip) const{
        ostringstream sstr;
        sstr << ((ip & 0xff000000)>>24) ;
        sstr << "." << ((ip & 0xff0000)>>16);
        sstr << "." << ((ip & 0xff00)>>8);
        sstr << "." << (ip & 0xff);
        return sstr.str();
    }

    unsigned int string2ip(const string ipstr)const{
        string str = ipstr;
        unsigned int ip = 0;
        int p = 0;
        p = str.find(".");
        ip += atoi(str.substr(0,p).c_str());
        ip <<= 8;
        str = str.substr(p+1,str.length());
        p = str.find(".");
        ip += atoi(str.substr(0,p).c_str());
        ip <<= 8;
        str = str.substr(p+1,str.length());
        p = str.find(".");
        ip += atoi(str.substr(0,p).c_str());
        ip <<= 8;
        ip += atoi(str.substr(p+1,str.length()).c_str());
        return ip;
    }

    string getIpAddr(string ip){

        return getIpAddr( string2ip( ip ) );
    }
};

int main(int argc, char* argv[])
{
    IpLocater locater("/var/opt/QQWry.Dat");
#if 0   
    if (argc > 1) {
        string ip = argv[1];
        cout << locater.getIpAddr(ip) << endl;
    } else {
        string str;
        while (cin >> str) {
            cout << locater.getIpAddr(str) << endl;
        }
    }
#endif

    long counter = 0;

    if (argc > 1) {
        string file_name = argv[1];
        ifstream infile(file_name.c_str(), ios::in);

        if (!infile) {
            cerr << "oops: unable to open log file"
                << file_name << '\n';
            return -1;
        }

        string tmp;
        vector<string> vect;

        try {
            while (getline(infile, tmp, '\n'))
                vect.push_back(tmp.substr(0, tmp.find(' ')));
        } catch (exception& e) {
            cout << e.what() << '\n';
        }

        sort(vect.begin(), vect.end());
        vector<string>::iterator it = unique(vect.begin(), vect.end());
        typedef vector<string>::const_iterator iter;
        streamsize prec = cout.precision();

        for (iter i = vect.begin(); i != it; ++i) {
            ++counter;
            cout << setprecision(18) << *i << '\t';
            cout << setprecision(prec) << locater.getIpAddr(*i) << endl;
        }
    } else {
        string str;
        while (cin >> str) {
            cout << locater.getIpAddr(str) << endl;
        }
    }

    cout << "Today the web access ip total is: " << counter << endl;

    return 0;
}

编译:
g++ -Wall -o ip_from ip_from.cpp

代码写死了，记得ip纯真数据库放在 /var/opt/QQWry.Dat 主要用来分析apache的日志。

newytht:~/bin$ cat stat_ip_from

#!/bin/sh

now=`date +"%Y%m%d"`
log_file="/usr/local/apache2/logs/access_log.$now"

if [ -f $log_file ]; then
	ipnum=`./ip_from '  < /usr/local/apache2/logs/access_log.$now ;
	echo "$ipnum"  >> /home/bbs/0Announce/bbslist/ip_stat_from
fi