mirror/openwrt-packages
1
0
Fork 0
mirror of https://git.openwrt.org/feed/packages.git synced 2024-06-20 07:38:40 +02:00
Code Releases Activity

banip: update 0.7.10

Browse Source 
* switch to unencrypted http downloads for ipdeny.com due to persistant certificate issues
* compact json generator code (tested with report files > 2MB)
* various code cleanups and optimizations

Signed-off-by: Dirk Brenken <dev@brenken.org>
This commit is contained in:
Dirk Brenken 2021-08-29 17:16:59 +02:00
parent d27edd5fff
commit 8ac0103cbd
No known key found for this signature in database
GPG Key ID: 9D71CD547BFAE684
8 changed files with 697 additions and 1113 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/banip/Makefile
View File

@ -6,8 +6,8 @@
include $(TOPDIR)/rules.mk include $(TOPDIR)/rules.mk
PKG_NAME:=banip PKG_NAME:=banip
PKG_VERSION:=0.7.9 PKG_VERSION:=0.7.10
PKG_RELEASE:=2 PKG_RELEASE:=1
PKG_LICENSE:=GPL-3.0-or-later PKG_LICENSE:=GPL-3.0-or-later
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org> PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>

139
net/banip/files/banip.dns
View File

@ -1,122 +1,67 @@
#!/bin/sh #!/bin/sh
# helper script to resolve domains for adding to banIP-related IPSets # helper script to resolve domains for adding to banIP-related IPSets
# written by Dirk Brenken (dev@brenken.org) # Copyright (c) 2020-2021 Dirk Brenken (dev@brenken.org)
#
# This is free software, licensed under the GNU General Public License v3. # This is free software, licensed under the GNU General Public License v3.
#
# (s)hellcheck exceptions # (s)hellcheck exceptions
# shellcheck disable=1091,2030,2031,2034,2039,2086,2129,2140,2143,2154,2181,2183,2188 # shellcheck disable=1091,3040
export LC_ALL=C export LC_ALL=C
export PATH="/usr/sbin:/usr/bin:/sbin:/bin" export PATH="/usr/sbin:/usr/bin:/sbin:/bin"
set -o pipefail set -o pipefail
if [ -r "/lib/functions.sh" ] . "/lib/functions.sh"
then
. "/lib/functions.sh" ban_action="${1}"
ban_debug="$(uci_get banip global ban_debug "0")" ban_src_name="${2}"
ban_tmpbase="$(uci_get banip global ban_tmpbase "/tmp")" ban_src_file="${3}"
ban_backupdir="$(uci_get banip global ban_backupdir "${ban_tmpbase}/banIP-Backup")" ban_tmpbase="$(uci_get banip global ban_tmpbase "/tmp")"
ban_proto4_enabled="$(uci_get banip global ban_proto4_enabled "0")" ban_backupdir="$(uci_get banip global ban_backupdir "${ban_tmpbase}/banIP-Backup")"
ban_proto6_enabled="$(uci_get banip global ban_proto6_enabled "0")" ban_proto4_enabled="$(uci_get banip global ban_proto4_enabled "0")"
else ban_proto6_enabled="$(uci_get banip global ban_proto6_enabled "0")"
exit 1
fi
ban_ver="${1}"
ban_action="${2}"
ban_src_name="${3}"
ban_src_file="${4}"
ban_ipset_cmd="$(command -v ipset)" ban_ipset_cmd="$(command -v ipset)"
ban_lookup_cmd="$(command -v nslookup)" ban_lookup_cmd="$(command -v nslookup)"
ban_logger_cmd="$(command -v logger)" ban_logger_cmd="$(command -v logger)"
ban_rc=1
f_log() if [ "${ban_action}" = "start" ] || [ "${ban_action}" = "refresh" ]; then
{ for proto in "4" "6"; do
local class="${1}" log_msg="${2}" if { [ "${proto}" = "4" ] && [ "${ban_proto4_enabled}" = "1" ]; } ||
{ [ "${proto}" = "6" ] && [ "${ban_proto6_enabled}" = "1" ]; }; then
if [ -n "${log_msg}" ] && { [ "${class}" != "debug" ] || [ "${ban_debug}" = "1" ]; } gzip -df "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}.gz" 2>/dev/null
then
if [ -x "${ban_logger_cmd}" ]
then
"${ban_logger_cmd}" -p "${class}" -t "banIP-${ban_ver%-*}[${$}]" "${log_msg}"
else
printf "%s %s %s\n" "${class}" "banIP-${ban_ver%-*}[${$}]" "${log_msg}"
fi
fi
}
if [ "${ban_action}" = "start" ] || [ "${ban_action}" = "refresh" ]
then
for proto in "4" "6"
do
if [ -s "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}.gz" ]
then
gzip -df "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}.gz"
if [ "${?}" = "0" ]
then
ban_rc=0
else
ban_rc=1
break
fi
fi fi
done done
fi fi
if [ "${ban_rc}" = "1" ] if { [ "${ban_proto4_enabled}" = "1" ] && [ ! -s "${ban_backupdir}/banIP.${ban_src_name}_addon_4" ]; } ||
then { [ "${ban_proto6_enabled}" = "1" ] && [ ! -s "${ban_backupdir}/banIP.${ban_src_name}_addon_6" ]; }; then
> "${ban_backupdir}/banIP.${ban_src_name}_addon_4" [ -s "${ban_backupdir}/banIP.${ban_src_name}_addon_4" ] && : > "${ban_backupdir}/banIP.${ban_src_name}_addon_4"
> "${ban_backupdir}/banIP.${ban_src_name}_addon_6" [ -s "${ban_backupdir}/banIP.${ban_src_name}_addon_6" ] && : > "${ban_backupdir}/banIP.${ban_src_name}_addon_6"
while read -r domain while read -r domain; do
do result="$(
update_ips="" "${ban_lookup_cmd}" "${domain}" 2>/dev/null
result="$("${ban_lookup_cmd}" "${domain}" 2>/dev/null; printf "%s" "${?}")" printf "%s" "${?}"
if [ "$(printf "%s" "${result}" | tail -1)" = "0" ] )"
then if [ "$(printf "%s" "${result}" | tail -1)" = "0" ]; then
ips="$(printf "%s" "${result}" | awk '/^Address[ 0-9]*: /{ORS=" ";print $NF}')" ips="$(printf "%s" "${result}" | awk '/^Address[ 0-9]*: /{ORS=" ";print $NF}')"
for ip in ${ips} for ip in ${ips}; do
do for proto in "4" "6"; do
for proto in "4" "6" if { [ "${proto}" = "4" ] && [ "${ban_proto4_enabled}" = "1" ] && [ -n "$("${ban_ipset_cmd}" -q -n list "${ban_src_name}_${proto}")" ] &&
do [ -n "$(printf "%s" "${ip}" | awk '/^(([0-9]{1,3}\.){3}[0-9]{1,3}(\/[0-9]{1,2})?)([[:space:]]|$)/{print $1}')" ]; } ||
if { [ "${proto}" = "4" ] && [ "${ban_proto4_enabled}" = "1" ] && \ { [ "${proto}" = "6" ] && [ "${ban_proto6_enabled}" = "1" ] && [ -n "$("${ban_ipset_cmd}" -q -n list "${ban_src_name}_${proto}")" ] &&
[ -n "$("${ban_ipset_cmd}" -q -n list "${ban_src_name}_${proto}")" ] && \ [ -n "$(printf "%s" "${ip}" | awk '/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{print $1}')" ]; }; then
[ -n "$(printf "%s" "${ip}" | awk '/^(([0-9]{1,3}\.){3}[0-9]{1,3}(\/[0-9]{1,2})?)([[:space:]]|$)/{print $1}')" ]; } || \ printf "%s\n" "add ${ban_src_name}_${proto} ${ip}" >>"${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}"
{ [ "${proto}" = "6" ] && [ "${ban_proto6_enabled}" = "1" ] && \
[ -n "$("${ban_ipset_cmd}" -q -n list "${ban_src_name}_${proto}")" ] && \
[ -z "$(printf "%s" "${ip}" | awk '/^(([0-9]{1,3}\.){3}[0-9]{1,3}(\/[0-9]{1,2})?)([[:space:]]|$)/{print $1}')" ]; }
then
printf "%s\n" "add ${ban_src_name}_${proto} ${ip}" >> "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}"
if [ -z "${update_ips}" ]
then
update_ips="${ip}"
else
update_ips="${update_ips}, ${ip}"
fi
fi fi
done done
done done
if [ -n "${update_ips}" ]
then
ban_rc=0
f_log "debug" "dns_imp ::: source '${ban_src_name}' supplemented by '${domain}' (${update_ips})"
fi
fi fi
done < "${ban_src_file}" done <"${ban_src_file}"
fi fi
if [ "${ban_rc}" = "0" ] for proto in "4" "6"; do
then if [ -n "$("${ban_ipset_cmd}" -q -n list "${ban_src_name}_${proto}")" ] && [ -s "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}" ]; then
for proto in "4" "6" "${ban_ipset_cmd}" -q -! restore <"${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}"
do gzip -f "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}"
if [ -n "$("${ban_ipset_cmd}" -q -n list "${ban_src_name}_${proto}")" ] && [ -s "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}" ] fi
then done
"${ban_ipset_cmd}" -q -! restore < "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}" "${ban_logger_cmd}" -p "info" -t "banIP-resolve [${$}]" "banIP domain import for source '${ban_src_name}' has been finished" 2>/dev/null
gzip -f "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}"
fi
rm -f "${ban_backupdir}/banIP.${ban_src_name}_addon_${proto}"
done
fi
f_log "info" "banIP domain import for source '${ban_src_name}' has been finished with rc '${ban_rc}'"
rm -f "${ban_src_file}" rm -f "${ban_src_file}"
exit "${ban_rc}"

14
net/banip/files/banip.hotplug
View File

@ -1,14 +1,10 @@
#!/bin/sh #!/bin/sh
# # firewall hotplug script for banIP
ban_pidfile="/var/run/banip.pid" # Copyright (c) 2019-2021 Dirk Brenken (dev@brenken.org)
ban_enabled="$(/etc/init.d/banip enabled; printf "%u" "${?}")" # This is free software, licensed under the GNU General Public License v3.
if [ "${ban_enabled}" = "0" ] && [ "${ACTION}" = "add" ] && [ -n "${INTERFACE}" ] if /etc/init.d/banip enabled && [ "${ACTION}" = "add" ] && [ -n "${INTERFACE}" ]; then
then if [ ! -s "/var/run/banip.pid" ] && uci_get banip global ban_ifaces | grep -q "${INTERFACE}"; then
ban_ifaces="$(uci_get banip global ban_ifaces)"
if [ ! -s "${ban_pidfile}" ] && [ -n "$(printf "%s\n" "${ban_ifaces}" | grep -F "${INTERFACE}")" ]
then
/etc/init.d/banip refresh /etc/init.d/banip refresh
fi fi
fi fi
exit 0

200
net/banip/files/banip.init
View File

@ -1,16 +1,14 @@
#!/bin/sh /etc/rc.common #!/bin/sh /etc/rc.common
# written by Dirk Brenken (dev@brenken.org) # Copyright (c) 2018-2021 Dirk Brenken (dev@brenken.org)
#
# This is free software, licensed under the GNU General Public License v3. # This is free software, licensed under the GNU General Public License v3.
#
# (s)hellcheck exceptions # (s)hellcheck exceptions
# shellcheck disable=1091,2030,2031,2034,2039,2086,2129,2140,2143,2154,2181,2183,2188 # shellcheck disable=1091,2034,3043,3057,3060
START=30 START=30
USE_PROCD=1 USE_PROCD=1
if [ -n "$(type -t extra_command)" ] if type extra_command >/dev/null 2>&1; then
then
extra_command "refresh" "Refresh ipsets without new list downloads" extra_command "refresh" "Refresh ipsets without new list downloads"
extra_command "suspend" "Suspend banIP processing" extra_command "suspend" "Suspend banIP processing"
extra_command "resume" "Resume banIP processing" extra_command "resume" "Resume banIP processing"
@ -18,7 +16,6 @@ then
extra_command "report" "[<cli>|<mail>|<gen>|<json>] Print banIP related IPset statistics" extra_command "report" "[<cli>|<mail>|<gen>|<json>] Print banIP related IPset statistics"
extra_command "list" "[<add>|<add_asn>|<add_country>|<remove>|<remove_asn>|<remove_country>] <source(s)> List/Edit available sources" extra_command "list" "[<add>|<add_asn>|<add_country>|<remove>|<remove_asn>|<remove_country>] <source(s)> List/Edit available sources"
extra_command "timer" "[<add> <tasks> <hour> [<minute>] [<weekday>]]|[<remove> <line no.>] List/Edit cron update intervals" extra_command "timer" "[<add> <tasks> <hour> [<minute>] [<weekday>]]|[<remove> <line no.>] List/Edit cron update intervals"
extra_command "version" "Print version information"
else else
EXTRA_COMMANDS="status refresh suspend resume query report list timer version" EXTRA_COMMANDS="status refresh suspend resume query report list timer version"
EXTRA_HELP=" status Service status EXTRA_HELP=" status Service status
@ -28,34 +25,28 @@ else
query <IP> Query active banIP IPSets for a specific IP address query <IP> Query active banIP IPSets for a specific IP address
report [<cli>|<mail>|<gen>|<json>] Print banIP related IPset statistics report [<cli>|<mail>|<gen>|<json>] Print banIP related IPset statistics
list [<add>|<add_asn>|<add_country>|<remove>|<remove_asn>|<remove_country>] <source(s)> List/Edit available sources list [<add>|<add_asn>|<add_country>|<remove>|<remove_asn>|<remove_country>] <source(s)> List/Edit available sources
timer [<add> <tasks> <hour> [<minute>] [<weekday>]]|[<remove> <line no.>] List/Edit cron update intervals timer [<add> <tasks> <hour> [<minute>] [<weekday>]]|[<remove> <line no.>] List/Edit cron update intervals"
version Print version information"
fi fi
ban_init="/etc/init.d/banip" ban_init="/etc/init.d/banip"
ban_script="/usr/bin/banip.sh" ban_script="/usr/bin/banip.sh"
ban_pidfile="/var/run/banip.pid" ban_pidfile="/var/run/banip.pid"
if [ -s "${ban_pidfile}" ] && { [ "${action}" = "start" ] || [ "${action}" = "stop" ] || \ if [ -s "${ban_pidfile}" ] && { [ "${action}" = "start" ] || [ "${action}" = "stop" ] ||
[ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "refresh" ] || \ [ "${action}" = "restart" ] || [ "${action}" = "reload" ] || [ "${action}" = "refresh" ] ||
[ "${action}" = "suspend" ] || [ "${action}" = "resume" ] || [ "${action}" = "query" ] || \ [ "${action}" = "suspend" ] || [ "${action}" = "resume" ] || [ "${action}" = "query" ] ||
{ [ "${action}" = "list" ] && [ -n "${1}" ]; } || { [ "${action}" = "report" ] && [ "${1}" != "json" ]; }; } { [ "${action}" = "list" ] && [ -n "${1}" ]; } || { [ "${action}" = "report" ] && [ "${1}" != "json" ]; }; }; then
then
exit 0 exit 0
fi fi
boot() boot() {
{ : >"${ban_pidfile}"
> "${ban_pidfile}"
rc_procd start_service rc_procd start_service
} }
start_service() start_service() {
{ if "${ban_init}" enabled; then
if [ "$("${ban_init}" enabled; printf "%u" ${?})" = "0" ] if [ "${action}" = "boot" ]; then
then
if [ "${action}" = "boot" ]
then
return 0 return 0
fi fi
procd_open_instance "banip" procd_open_instance "banip"
@ -68,102 +59,84 @@ start_service()
fi fi
} }
version() version() {
{
rc_procd "${ban_script}" version rc_procd "${ban_script}" version
} }
refresh() refresh() {
{
rc_procd start_service refresh rc_procd start_service refresh
} }
reload_service() reload_service() {
{
rc_procd start_service reload rc_procd start_service reload
} }
stop_service() stop_service() {
{
rc_procd "${ban_script}" stop rc_procd "${ban_script}" stop
} }
restart() restart() {
{
rc_procd start_service restart rc_procd start_service restart
} }
suspend() suspend() {
{
rc_procd start_service suspend rc_procd start_service suspend
} }
resume() resume() {
{
rc_procd start_service resume rc_procd start_service resume
} }
query() query() {
{
rc_procd "${ban_script}" query "${1}" rc_procd "${ban_script}" query "${1}"
} }
list() list() {
{ local src_archive src_file src_enabled key name enabled focus descurl url_4 rule_4 url_6 rule_6 action="${1}"
local src_archive src_file src_enabled key name enabled focus url_4 rule_4 url_6 rule_6 action="${1}"
if [ "${action%_*}" = "add" ] || [ "${action%_*}" = "remove" ] if [ "${action%_*}" = "add" ] || [ "${action%_*}" = "remove" ]; then
then
shift shift
for name in "${@}" for name in "${@}"; do
do
case "${action}" in case "${action}" in
"add") "add")
if [ -z "$(uci_get banip global ban_sources | grep -Fo "${name}")" ] if ! uci_get banip global ban_sources | grep -q "${name}"; then
then
uci_add_list banip global ban_sources "${name}" uci_add_list banip global ban_sources "${name}"
printf "%s\n" "::: banIP source '${name}' added to config" printf "%s\n" "::: banIP source '${name}' added to config"
fi fi
;; ;;
"remove") "remove")
if [ -n "$(uci_get banip global ban_sources | grep -Fo "${name}")" ] if uci_get banip global ban_sources | grep -q "${name}"; then
then
uci_remove_list banip global ban_sources "${name}" uci_remove_list banip global ban_sources "${name}"
printf "%s\n" "::: banIP source '${name}' removed from config" printf "%s\n" "::: banIP source '${name}' removed from config"
fi fi
;; ;;
"add_asn") "add_asn")
if [ -z "$(uci_get banip global ban_asns | grep -Fo "${name}")" ] if ! uci_get banip global ban_asns | grep -q "${name}"; then
then
uci_add_list banip global ban_asns "${name}" uci_add_list banip global ban_asns "${name}"
printf "%s\n" "::: banIP asn '${name}' added to config" printf "%s\n" "::: banIP asn '${name}' added to config"
fi fi
;; ;;
"remove_asn") "remove_asn")
if [ -n "$(uci_get banip global ban_asns | grep -Fo "${name}")" ] if uci_get banip global ban_asns | grep -q "${name}"; then
then
uci_remove_list banip global ban_asns "${name}" uci_remove_list banip global ban_asns "${name}"
printf "%s\n" "::: banIP asn '${name}' removed from config" printf "%s\n" "::: banIP asn '${name}' removed from config"
fi fi
;; ;;
"add_country") "add_country")
if [ -z "$(uci_get banip global ban_countries | grep -Fo "${name}")" ] if ! uci_get banip global ban_countries | grep -q "${name}"; then
then
uci_add_list banip global ban_countries "${name}" uci_add_list banip global ban_countries "${name}"
printf "%s\n" "::: banIP country '${name}' added to config" printf "%s\n" "::: banIP country '${name}' added to config"
fi fi
;; ;;
"remove_country") "remove_country")
if [ -n "$(uci_get banip global ban_countries | grep -Fo "${name}")" ] if uci_get banip global ban_countries | grep -q "${name}"; then
then
uci_remove_list banip global ban_countries "${name}" uci_remove_list banip global ban_countries "${name}"
printf "%s\n" "::: banIP country '${name}' removed from config" printf "%s\n" "::: banIP country '${name}' removed from config"
fi fi
;; ;;
esac esac
done done
if [ -n "$(uci -q changes banip)" ] if [ -n "$(uci -q changes banip)" ]; then
then
uci_commit banip uci_commit banip
"${ban_init}" start "${ban_init}" start
fi fi
@ -171,24 +144,21 @@ list()
src_archive="$(uci_get banip global ban_srcarc "/etc/banip/banip.sources.gz")" src_archive="$(uci_get banip global ban_srcarc "/etc/banip/banip.sources.gz")"
src_file="$(uci_get banip global ban_srcfile "/tmp/ban_sources.json")" src_file="$(uci_get banip global ban_srcfile "/tmp/ban_sources.json")"
src_enabled="$(uci -q show banip.global.ban_sources)" src_enabled="$(uci -q show banip.global.ban_sources)"
if [ -r "${src_archive}" ] if [ -r "${src_archive}" ]; then
then zcat "${src_archive}" >"${src_file}"
zcat "${src_archive}" > "${src_file}"
else else
printf "%s\n" "::: banIP source archive '${src_archive}' not found" printf "%s\n" "::: banIP source archive '${src_archive}' not found"
fi fi
if [ -r "${src_file}" ] if [ -r "${src_file}" ]; then
then
src_enabled="${src_enabled#*=}" src_enabled="${src_enabled#*=}"
src_enabled="${src_enabled//\'}" src_enabled="${src_enabled//\'/}"
printf "%s\n" "::: Available banIP sources" printf "%s\n" "::: Available banIP sources"
printf "%s\n" ":::" printf "%s\n" ":::"
printf "%-25s%-10s%-36s%s\n" " Name" "Enabled" "Focus" "Info URL" printf "%-25s%-10s%-36s%s\n" " Name" "Enabled" "Focus" "Info URL"
printf "%s\n" " ---------------------------------------------------------------------------" printf "%s\n" " ---------------------------------------------------------------------------"
json_load_file "${src_file}" json_load_file "${src_file}"
json_get_keys keylist json_get_keys keylist
for key in ${keylist} for key in ${keylist}; do
do
json_select "${key}" json_select "${key}"
json_get_var focus "focus" json_get_var focus "focus"
json_get_var descurl "descurl" json_get_var descurl "descurl"
@ -196,15 +166,13 @@ list()
json_get_var rule_4 "rule_4" json_get_var rule_4 "rule_4"
json_get_var url_6 "url_6" json_get_var url_6 "url_6"
json_get_var rule_6 "rule_6" json_get_var rule_6 "rule_6"
if { [ -n "${url_4}" ] && [ -n "${rule_4}" ]; } || { [ -n "${url_6}" ] && [ -n "${rule_6}" ]; } if { [ -n "${url_4}" ] && [ -n "${rule_4}" ]; } || { [ -n "${url_6}" ] && [ -n "${rule_6}" ]; }; then
then if printf "%s" "${src_enabled}" | grep -q "${key}"; then
if [ -n "$(printf "%s" "${src_enabled}" | grep -Fo "${key}")" ]
then
enabled="x" enabled="x"
else else
enabled=" " enabled=" "
fi fi
src_enabled="${src_enabled/${key}}" src_enabled="${src_enabled/${key}/}"
printf " + %-21s%-10s%-36s%s\n" "${key:0:20}" "${enabled}" "${focus:0:35}" "${descurl:0:50}" printf " + %-21s%-10s%-36s%s\n" "${key:0:20}" "${enabled}" "${focus:0:35}" "${descurl:0:50}"
else else
src_enabled="${src_enabled} ${key}" src_enabled="${src_enabled} ${key}"
@ -217,13 +185,11 @@ list()
printf " * %s\n" "Configured ASNs: ${asn_list// /, }" printf " * %s\n" "Configured ASNs: ${asn_list// /, }"
printf " * %s\n" "Configured Countries: ${country_list// /, }" printf " * %s\n" "Configured Countries: ${country_list// /, }"
if [ -n "${src_enabled// }" ] if [ -n "${src_enabled// /}" ]; then
then
printf "%s\n" " ---------------------------------------------------------------------------" printf "%s\n" " ---------------------------------------------------------------------------"
printf "%s\n" " Sources without valid configuration" printf "%s\n" " Sources without valid configuration"
printf "%s\n" " ---------------------------------------------------------------------------" printf "%s\n" " ---------------------------------------------------------------------------"
for key in ${src_enabled} for key in ${src_enabled}; do
do
printf " - %s\n" "${key:0:20}" printf " - %s\n" "${key:0:20}"
done done
fi fi
@ -233,41 +199,34 @@ list()
fi fi
} }
status() status() {
{
status_service status_service
} }
status_service() status_service() {
{ local key keylist type value index_value values rtfile
local key keylist value index_value values rtfile
rtfile="$(uci_get banip global ban_rtfile "/tmp/ban_runtime.json")" rtfile="$(uci_get banip global ban_rtfile "/tmp/ban_runtime.json")"
json_load_file "${rtfile}" >/dev/null 2>&1 json_load_file "${rtfile}" >/dev/null 2>&1
json_get_keys keylist json_get_keys keylist
if [ -n "${keylist}" ] if [ -n "${keylist}" ]; then
then
printf "%s\n" "::: banIP runtime information" printf "%s\n" "::: banIP runtime information"
for key in ${keylist} for key in ${keylist}; do
do
json_get_var value "${key}" >/dev/null 2>&1 json_get_var value "${key}" >/dev/null 2>&1
if [ "${key%_*}" = "active" ] if [ "${key%_*}" = "active" ]; then
then
printf " + %-15s : " "${key}" printf " + %-15s : " "${key}"
json_select "${key}" >/dev/null 2>&1 json_select "${key}" >/dev/null 2>&1
values="" values=""
index=1 index=1
while json_get_type type "${index}" && [ "${type}" = "object" ] while json_get_type type "${index}" && [ "${type}" = "object" ]; do
do
json_get_values index_value "${index}" >/dev/null 2>&1 json_get_values index_value "${index}" >/dev/null 2>&1
if [ "${index}" = "1" ] if [ "${index}" = "1" ]; then
then
values="${index_value}" values="${index_value}"
else else
values="${values}, ${index_value}" values="${values}, ${index_value}"
fi fi
index=$((index+1)) index=$((index + 1))
done done
values="$(printf "%s" "${values}" | awk '{NR=1;max=98;if(length($0)>max+1)while($0){if(NR==1){print substr($0,1,max)}else{printf"%-22s%s\n","",substr($0,1,max)}{$0=substr($0,max+1);NR=NR+1}}else print}')" values="$(printf "%s" "${values}" | awk '{NR=1;max=98;if(length($0)>max+1)while($0){if(NR==1){print substr($0,1,max)}else{printf"%-22s%s\n","",substr($0,1,max)}{$0=substr($0,max+1);NR=NR+1}}else print}')"
printf "%s\n" "${values:-"-"}" printf "%s\n" "${values:-"-"}"
@ -281,64 +240,53 @@ status_service()
fi fi
} }
report() report() {
{
rc_procd "${ban_script}" report "${1:-"cli"}" rc_procd "${ban_script}" report "${1:-"cli"}"
} }
timer() timer() {
{
local cron_file cron_content cron_lineno action="${1:-"list"}" cron_tasks="${2}" hour="${3}" minute="${4:-0}" weekday="${5:-"*"}" local cron_file cron_content cron_lineno action="${1:-"list"}" cron_tasks="${2}" hour="${3}" minute="${4:-0}" weekday="${5:-"*"}"
cron_file="/etc/crontabs/root" cron_file="/etc/crontabs/root"
if [ -s "${cron_file}" ] && [ "${action}" = "list" ] if [ -s "${cron_file}" ] && [ "${action}" = "list" ]; then
then
awk '{print NR "> " $0}' "${cron_file}" awk '{print NR "> " $0}' "${cron_file}"
elif [ "${action}" = "add" ] elif [ "${action}" = "add" ]; then
then
hour="${hour//[[:alpha:]]/}" hour="${hour//[[:alpha:]]/}"
minute="${minute//[[:alpha:]]/}" minute="${minute//[[:alpha:]]/}"
if [ -n "${cron_tasks}" ] && [ -n "${hour}" ] && [ -n "${minute}" ] && [ -n "${weekday}" ] && \ if [ -n "${cron_tasks}" ] && [ -n "${hour}" ] && [ -n "${minute}" ] && [ -n "${weekday}" ] &&
[ "${hour}" -ge 0 ] && [ "${hour}" -le 23 ] && \ [ "${hour}" -ge 0 ] && [ "${hour}" -le 23 ] &&
[ "${minute}" -ge 0 ] && [ "${minute}" -le 59 ] [ "${minute}" -ge 0 ] && [ "${minute}" -le 59 ]; then
then printf "%02d %02d %s\n" "${minute}" "${hour}" "* * ${weekday} ${ban_init} ${cron_tasks}" >>"${cron_file}"
printf "%02d %02d %s\n" "${minute}" "${hour}" "* * ${weekday} ${ban_init} ${cron_tasks}" >> "${cron_file}"
/etc/init.d/cron restart /etc/init.d/cron restart
fi fi
elif [ -s "${cron_file}" ] && [ "${action}" = "remove" ] elif [ -s "${cron_file}" ] && [ "${action}" = "remove" ]; then
then
cron_tasks="${cron_tasks//[[:alpha:]]/}" cron_tasks="${cron_tasks//[[:alpha:]]/}"
cron_lineno="$(awk 'END{print NR}' "${cron_file}")" cron_lineno="$(awk 'END{print NR}' "${cron_file}")"
cron_content="$(awk '{print $0}' "${cron_file}")" cron_content="$(awk '{print $0}' "${cron_file}")"
if [ "${cron_tasks:-"0"}" -le "${cron_lineno:-"1"}" ] && [ -n "${cron_content}" ] if [ "${cron_tasks:-"0"}" -le "${cron_lineno:-"1"}" ] && [ -n "${cron_content}" ]; then
then printf "%s\n" "${cron_content}" | awk "NR!~/^${cron_tasks}$/" >"${cron_file}"
printf "%s\n" "${cron_content}" | awk "NR!~/^${cron_tasks}$/" > "${cron_file}"
/etc/init.d/cron restart /etc/init.d/cron restart
fi fi
fi fi
} }
service_triggers() service_triggers() {
{
local iface delay local iface delay
iface="$(uci_get banip global ban_trigger)" iface="$(uci_get banip global ban_trigger)"
delay="$(uci_get banip global ban_triggerdelay "5")" delay="$(uci_get banip global ban_triggerdelay "5")"
PROCD_RELOAD_DELAY=$((delay*1000)) PROCD_RELOAD_DELAY=$((delay * 1000))
if [ -z "${iface}" ] if [ -z "${iface}" ]; then
then
. "/lib/functions/network.sh" . "/lib/functions/network.sh"
network_find_wan iface network_find_wan iface
if [ -n "${iface}" ] if [ -n "${iface}" ]; then
then
uci_set banip global ban_trigger "${iface}" uci_set banip global ban_trigger "${iface}"
uci_commit "banip" uci_commit "banip"
fi fi
fi fi
if [ -n "${iface}" ] if [ -n "${iface}" ]; then
then
procd_add_interface_trigger "interface.*.up" "${iface}" "${ban_init}" "start" procd_add_interface_trigger "interface.*.up" "${iface}" "${ban_init}" "start"
fi fi
procd_add_reload_trigger "banip" procd_add_reload_trigger "banip"

70
net/banip/files/banip.mail
View File

@ -1,52 +1,35 @@
#!/bin/sh #!/bin/sh
# send mail script for banIP notifications # send mail script for banIP notifications
# written by Dirk Brenken (dev@brenken.org) # Copyright (c) 2020-2021 Dirk Brenken (dev@brenken.org)
#
# This is free software, licensed under the GNU General Public License v3. # This is free software, licensed under the GNU General Public License v3.
#
# (s)hellcheck exceptions # (s)hellcheck exceptions
# shellcheck disable=1091,2030,2031,2034,2039,2086,2129,2140,2143,2154,2181,2183,2188 # shellcheck disable=1091,3040
# Please note: you have to setup the package 'msmtp' before using this script
export LC_ALL=C export LC_ALL=C
export PATH="/usr/sbin:/usr/bin:/sbin:/bin" export PATH="/usr/sbin:/usr/bin:/sbin:/bin"
set -o pipefail set -o pipefail
if [ -r "/lib/functions.sh" ] . "/lib/functions.sh"
then ban_debug="$(uci_get banip global ban_debug "0")"
. "/lib/functions.sh" ban_loglimit="$(uci_get banip global ban_loglimit "100")"
ban_debug="$(uci_get banip global ban_debug "0")" ban_mailsender="$(uci_get banip global ban_mailsender "no-reply@banIP")"
ban_loglimit="$(uci_get banip global ban_loglimit "100")" ban_mailreceiver="$(uci_get banip global ban_mailreceiver)"
ban_mailsender="$(uci_get banip global ban_mailsender "no-reply@banIP")" ban_mailtopic="$(uci_get banip global ban_mailtopic "banIP notification")"
ban_mailreceiver="$(uci_get banip global ban_mailreceiver)" ban_mailprofile="$(uci_get banip global ban_mailprofile "ban_notify")"
ban_mailtopic="$(uci_get banip global ban_mailtopic "banIP notification")"
ban_mailprofile="$(uci_get banip global ban_mailprofile "ban_notify")"
fi
ban_ver="${1}"
ban_mail="$(command -v msmtp)" ban_mail="$(command -v msmtp)"
ban_logger="$(command -v logger)" ban_logger="$(command -v logger)"
ban_logread="$(command -v logread)" ban_logread="$(command -v logread)"
ban_rc=1
f_log() if [ -z "${ban_mailreceiver}" ]; then
{
local class="${1}" log_msg="${2}"
if [ -x "${ban_logger}" ]
then
"${ban_logger}" -p "${class}" -t "banIP-${ban_ver%-*}[${$}]" "${log_msg}"
else
printf "%s %s %s\n" "${class}" "banIP-${ban_ver%-*}[${$}]" "${log_msg}"
fi
}
if [ -z "${ban_mailreceiver}" ]
then
f_log "err" "please set the mail receiver with the 'ban_mailreceiver' option" f_log "err" "please set the mail receiver with the 'ban_mailreceiver' option"
exit ${ban_rc} exit 1
fi fi
if [ "${ban_debug}" = "1" ] if [ "${ban_debug}" = "1" ]; then
then
msmtp_debug="--debug" msmtp_debug="--debug"
fi fi
@ -54,9 +37,12 @@ ban_mailhead="From: ${ban_mailsender}\nTo: ${ban_mailreceiver}\nSubject: ${ban_m
# info preparation # info preparation
# #
sys_info="$(strings /etc/banner 2>/dev/null)" sys_info="$(
strings /etc/banner 2>/dev/null
ubus call system board | awk 'BEGIN{FS="[{}\"]"}{if($2=="kernel"||$2=="hostname"||$2=="system"||$2=="model"||$2=="description")printf " + %-12s: %s\n",$2,$4}'
)"
ban_info="$(/etc/init.d/banip "status" 2>/dev/null)" ban_info="$(/etc/init.d/banip "status" 2>/dev/null)"
rep_info="${2}" rep_info="${1}"
log_info="$("${ban_logread}" -l "${ban_loglimit}" -e "banIP-" 2>/dev/null | awk '{NR=1;max=120;if(length($0)>max+1)while($0){if(NR==1){print substr($0,1,max)}else{print substr($0,1,max)}{$0=substr($0,max+1);NR=NR+1}}else print}')" log_info="$("${ban_logread}" -l "${ban_loglimit}" -e "banIP-" 2>/dev/null | awk '{NR=1;max=120;if(length($0)>max+1)while($0){if(NR==1){print substr($0,1,max)}else{print substr($0,1,max)}{$0=substr($0,max+1);NR=NR+1}}else print}')"
# mail body # mail body
@ -64,8 +50,7 @@ log_info="$("${ban_logread}" -l "${ban_loglimit}" -e "banIP-" 2>/dev/null | awk
ban_mailtext="<html><body><pre style='display:block;font-family:monospace;font-size:1rem;padding:20;background-color:#f3eee5;white-space:pre'>" ban_mailtext="<html><body><pre style='display:block;font-family:monospace;font-size:1rem;padding:20;background-color:#f3eee5;white-space:pre'>"
ban_mailtext="${ban_mailtext}\n<strong>++\n++ System Information ++\n++</strong>\n${sys_info}" ban_mailtext="${ban_mailtext}\n<strong>++\n++ System Information ++\n++</strong>\n${sys_info}"
ban_mailtext="${ban_mailtext}\n\n<strong>++\n++ banIP Status ++\n++</strong>\n${ban_info}" ban_mailtext="${ban_mailtext}\n\n<strong>++\n++ banIP Status ++\n++</strong>\n${ban_info}"
if [ -n "${rep_info}" ] if [ -n "${rep_info}" ]; then
then
ban_mailtext="${ban_mailtext}\n\n<strong>++\n++ banIP Report ++\n++</strong>\n${rep_info}" ban_mailtext="${ban_mailtext}\n\n<strong>++\n++ banIP Report ++\n++</strong>\n${rep_info}"
fi fi
ban_mailtext="${ban_mailtext}\n\n<strong>++\n++ Logfile Information ++\n++</strong>\n${log_info}" ban_mailtext="${ban_mailtext}\n\n<strong>++\n++ Logfile Information ++\n++</strong>\n${log_info}"
@ -73,12 +58,5 @@ ban_mailtext="${ban_mailtext}</pre></body></html>"
# send mail # send mail
# #
if [ -x "${ban_mail}" ] printf "%b" "${ban_mailhead}${ban_mailtext}" 2>/dev/null | "${ban_mail}" ${msmtp_debug} -a "${ban_mailprofile}" "${ban_mailreceiver}" >/dev/null 2>&1
then "${ban_logger}" -p "info" -t "banIP-mail [${$}]" "mail sent to '${ban_mailreceiver}' with rc '${?}'" 2>/dev/null
printf "%b" "${ban_mailhead}${ban_mailtext}" 2>/dev/null | "${ban_mail}" ${msmtp_debug} -a "${ban_mailprofile}" "${ban_mailreceiver}" >/dev/null 2>&1
ban_rc=${?}
f_log "info" "mail sent to '${ban_mailreceiver}' with rc '${ban_rc}'"
else
f_log "err" "msmtp mail daemon not found"
fi
exit ${ban_rc}

42
net/banip/files/banip.service
View File

@ -1,36 +1,28 @@
#!/bin/sh #!/bin/sh
# log service to trace failed ssh/luci logins and conditionally refresh banIP # log service to trace suspicious logins and conditionally refresh banIP
# written by Dirk Brenken (dev@brenken.org) # Copyright (c) 2019-2021 Dirk Brenken (dev@brenken.org)
#
# This is free software, licensed under the GNU General Public License v3. # This is free software, licensed under the GNU General Public License v3.
#
# (s)hellcheck exceptions # (s)hellcheck exceptions
# shellcheck disable=1091,2030,2031,2034,2039,2086,2129,2140,2143,2154,2181,2183,2188 # shellcheck disable=3040
export LC_ALL=C export LC_ALL=C
export PATH="/usr/sbin:/usr/bin:/sbin:/bin" export PATH="/usr/sbin:/usr/bin:/sbin:/bin"
set -o pipefail set -o pipefail
ban_ver="${1}"
ban_search="${2}"
ban_logger="$(command -v logger)"
ban_logread="$(command -v logread)"
f_log() ban_search="${1}"
{ ban_logger_cmd="$(command -v logger)"
local class="${1}" log_msg="${2}" ban_logread_cmd="$(command -v logread)"
if [ -x "${ban_logger}" ] if [ -x "${ban_logread_cmd}" ]; then
then "${ban_logger_cmd}" -p "info" -t "banIP-service [${$}]" "log/banIP service started" 2>/dev/null
"${ban_logger}" -p "${class}" -t "banIP-${ban_ver%-*}[${$}]" "${log_msg}" "${ban_logread_cmd}" -f |
else {
printf "%s %s %s\n" "${class}" "banIP-${ban_ver%-*}[${$}]" "${log_msg}" grep -qE "${ban_search}" && {
fi /etc/init.d/banip refresh
} exit 0
}
if [ -x "${ban_logread}" ] }
then
f_log "info" "log/banIP service started"
"${ban_logread}" -f | { grep -qE "${ban_search}"; [ "${?}" = "0" ] && { /etc/init.d/banip refresh; exit 0; }; }
else else
f_log "err" "can't start log/banIP service" "${ban_logger_cmd}" -p "err" -t "banIP-service [${$}]" "can't start log/banIP service" 2>/dev/null
fi fi

1335
net/banip/files/banip.sh
View File

File diff suppressed because it is too large Load Diff

6
net/banip/files/banip.sources
View File

@ -16,12 +16,12 @@
"descurl": "https://team-cymru.com" "descurl": "https://team-cymru.com"
}, },
"country": { "country": {
"url_4": "https://www.ipdeny.com/ipblocks/data/aggregated/", "url_4": "http://www.ipdeny.com/ipblocks/data/aggregated/",
"url_6": "https://www.ipdeny.com/ipv6/ipaddresses/aggregated/", "url_6": "http://www.ipdeny.com/ipv6/ipaddresses/aggregated/",
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]|$)/{print \"add country_4 \"$1}", "rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]|$)/{print \"add country_4 \"$1}",
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{print \"add country_6 \"$1}", "rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{print \"add country_6 \"$1}",
"focus": "Country blocks", "focus": "Country blocks",
"descurl": "https://www.ipdeny.com/ipblocks" "descurl": "http://www.ipdeny.com/ipblocks"
}, },
"darklist": { "darklist": {
"url_4": "https://darklist.de/raw.php", "url_4": "https://darklist.de/raw.php",