mirror
/
openwrt-packages
mirror of https://git.openwrt.org/feed/packages.git
1
0
Fork 0
Code Releases Activity

Merge pull request #15289 from dibdot/banip 

banip: update to 0.7.6
This commit is contained in:
Dirk Brenken 2021-03-28 21:58:31 +02:00 committed by GitHub
parent 1e0bfe608a 1235acdde6
commit 994ff9ba1f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 45 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/banip/Makefile
View File

@ -6,8 +6,8 @@
include $(TOPDIR)/rules.mk include $(TOPDIR)/rules.mk
PKG_NAME:=banip PKG_NAME:=banip
PKG_VERSION:=0.7.5 PKG_VERSION:=0.7.6
PKG_RELEASE:=4 PKG_RELEASE:=1
PKG_LICENSE:=GPL-3.0-or-later PKG_LICENSE:=GPL-3.0-or-later
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org> PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>

98
net/banip/files/banip.sh
View File

@ -12,7 +12,7 @@
export LC_ALL=C export LC_ALL=C
export PATH="/usr/sbin:/usr/bin:/sbin:/bin" export PATH="/usr/sbin:/usr/bin:/sbin:/bin"
set -o pipefail set -o pipefail
ban_ver="0.7.5" ban_ver="0.7.6"
ban_enabled="0" ban_enabled="0"
ban_mail_enabled="0" ban_mail_enabled="0"
ban_proto4_enabled="0" ban_proto4_enabled="0"
@ -536,102 +536,90 @@ f_iptrule()
# #
f_iptables() f_iptables()
{ {
local destroy="${1}" dev local ipt_cmd chain chainsets dev pos timeout="-w 5" destroy="${1}"
if [ "${ban_action}" != "refresh" ] && [ "${ban_action}" != "resume" ] if [ "${ban_action}" != "refresh" ] && [ "${ban_action}" != "resume" ]
then then
for dev in ${ban_ipdevs} for dev in ${ban_ipdevs}
do do
if [ "${src_name}" = "maclist" ] if [ ! -f "${ban_tmpfile}.${src_name}.delete" ]
then then
f_iptrule "-D" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j RETURN" > "${ban_tmpfile}.${src_name}.delete"
elif [ "${src_name%_*}" = "whitelist" ] if [ "${src_name}" = "maclist" ]
then then
f_iptrule "-D" "${ban_chain}" "-i ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j RETURN" f_iptrule "-D" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} src -j RETURN"
f_iptrule "-D" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} dst -j RETURN" elif [ "${src_name%_*}" = "whitelist" ]
else then
f_iptrule "-D" "${ban_chain}" "-i ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j ${ban_logtarget_src}" f_iptrule "-D" "${ban_chain}" "-i ${dev} -m set --match-set ${src_name} src -j RETURN"
f_iptrule "-D" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} dst -j ${ban_logtarget_dst}" f_iptrule "-D" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} dst -j RETURN"
f_iptrule "-D" "${ban_chain}" "-i ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j ${ban_logchain_src}" else
f_iptrule "-D" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} dst -j ${ban_logchain_dst}" f_iptrule "-D" "${ban_chain}" "-i ${dev} -m set --match-set ${src_name} src -j ${ban_logtarget_src}"
f_iptrule "-D" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} dst -j ${ban_logtarget_dst}"
f_iptrule "-D" "${ban_chain}" "-i ${dev} -m set --match-set ${src_name} src -j ${ban_logchain_src}"
f_iptrule "-D" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} dst -j ${ban_logchain_dst}"
fi
fi fi
done done
fi fi
if [ -z "${destroy}" ] && { [ "${cnt}" -gt "0" ] || [ "${src_name%_*}" = "blacklist" ] || [ "${src_name%_*}" = "whitelist" ]; } if [ -z "${destroy}" ] && { [ "${cnt}" -gt "0" ] || [ "${src_name%_*}" = "blacklist" ] || [ "${src_name%_*}" = "whitelist" ]; }
then then
if [ "${src_settype}" != "dst" ] if [ "${src_name##*_}" = "4" ]
then then
if [ "${src_name##*_}" = "4" ] ipt_cmd="${ban_ipt4_cmd}"
if [ ! -f "${ban_tmpfile}.${src_name##*_}.chains" ]
then then
for chain in ${ban_wan_inputchains_4} > "${ban_tmpfile}.${src_name##*_}.chains"
do chainsets="${ban_lan_inputchains_4} ${ban_wan_inputchains_4} ${ban_lan_forwardchains_4} ${ban_wan_forwardchains_4}"
f_iptrule "-I" "${chain}" "-j ${ban_chain}" for chain in ${chainsets}
done
for chain in ${ban_wan_forwardchains_4}
do do
f_iptrule "-I" "${chain}" "-j ${ban_chain}" f_iptrule "-I" "${chain}" "-j ${ban_chain}"
done done
f_iptrule "-A" "${ban_chain}" "-p udp --dport 67:68 --sport 67:68 -j RETURN" f_iptrule "-A" "${ban_chain}" "-p udp --dport 67:68 --sport 67:68 -j RETURN"
elif [ "${src_name##*_}" = "6" ] f_iptrule "-A" "${ban_chain}" "-m conntrack ! --ctstate NEW -j RETURN"
fi
elif [ "${src_name##*_}" = "6" ]
then
ipt_cmd="${ban_ipt6_cmd}"
if [ ! -f "${ban_tmpfile}.${src_name##*_}.chains" ]
then then
for chain in ${ban_wan_inputchains_6} > "${ban_tmpfile}.${src_name##*_}.chains"
do chainsets="${ban_lan_inputchains_6} ${ban_wan_inputchains_6} ${ban_lan_forwardchains_6} ${ban_wan_forwardchains_6}"
f_iptrule "-I" "${chain}" "-j ${ban_chain}" for chain in ${chainsets}
done
for chain in ${ban_wan_forwardchains_6}
do do
f_iptrule "-I" "${chain}" "-j ${ban_chain}" f_iptrule "-I" "${chain}" "-j ${ban_chain}"
done done
f_iptrule "-A" "${ban_chain}" "-p ipv6-icmp -s fe80::/10 -d fe80::/10 -j RETURN" f_iptrule "-A" "${ban_chain}" "-p ipv6-icmp -s fe80::/10 -d fe80::/10 -j RETURN"
f_iptrule "-A" "${ban_chain}" "-p udp -s fc00::/6 --sport 547 -d fc00::/6 --dport 546 -j RETURN" f_iptrule "-A" "${ban_chain}" "-p udp -s fc00::/6 --sport 547 -d fc00::/6 --dport 546 -j RETURN"
f_iptrule "-A" "${ban_chain}" "-m conntrack ! --ctstate NEW -j RETURN"
fi fi
fi
if [ "${src_settype}" != "dst" ]
then
for dev in ${ban_devs} for dev in ${ban_devs}
do do
if [ "${src_name}" = "maclist" ] if [ "${src_name}" = "maclist" ]
then then
f_iptrule "-I" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j RETURN" "1" f_iptrule "-I" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} src -j RETURN" "1"
elif [ "${src_name%_*}" = "whitelist" ] elif [ "${src_name%_*}" = "whitelist" ]
then then
f_iptrule "-I" "${ban_chain}" "-i ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j RETURN" "2" pos="$(( $("${ipt_cmd}" "${timeout}" -vnL "${ban_chain}" --line-numbers | grep -cF "RETURN")+1))"
f_iptrule "-I" "${ban_chain}" "-i ${dev} -m set --match-set ${src_name} src -j RETURN" "${pos}"
else else
f_iptrule "${action:-"-A"}" "${ban_chain}" "-i ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} src -j ${ban_target_src}" f_iptrule "${action:-"-A"}" "${ban_chain}" "-i ${dev} -m set --match-set ${src_name} src -j ${ban_target_src}"
fi fi
done done
fi fi
if [ "${src_settype}" != "src" ] if [ "${src_settype}" != "src" ]
then then
if [ "${src_name##*_}" = "4" ]
then
for chain in ${ban_lan_inputchains_4}
do
f_iptrule "-I" "${chain}" "-j ${ban_chain}"
done
for chain in ${ban_lan_forwardchains_4}
do
f_iptrule "-I" "${chain}" "-j ${ban_chain}"
done
f_iptrule "-A" "${ban_chain}" "-p udp --dport 67:68 --sport 67:68 -j RETURN"
elif [ "${src_name##*_}" = "6" ]
then
for chain in ${ban_lan_inputchains_6}
do
f_iptrule "-I" "${chain}" "-j ${ban_chain}"
done
for chain in ${ban_lan_forwardchains_6}
do
f_iptrule "-I" "${chain}" "-j ${ban_chain}"
done
f_iptrule "-A" "${ban_chain}" "-p ipv6-icmp -s fe80::/10 -d fe80::/10 -j RETURN"
f_iptrule "-A" "${ban_chain}" "-p udp -s fc00::/6 --sport 547 -d fc00::/6 --dport 546 -j RETURN"
fi
for dev in ${ban_devs} for dev in ${ban_devs}
do do
if [ "${src_name%_*}" = "whitelist" ] if [ "${src_name%_*}" = "whitelist" ]
then then
f_iptrule "-I" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} dst -j RETURN" "3" pos="$(( $("${ipt_cmd}" "${timeout}" -vnL "${ban_chain}" --line-numbers | grep -cF "RETURN")+1))"
f_iptrule "-I" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} dst -j RETURN" "${pos}"
elif [ "${src_name}" != "maclist" ] elif [ "${src_name}" != "maclist" ]
then then
f_iptrule "${action:-"-A"}" "${ban_chain}" "-o ${dev} -m conntrack --ctstate NEW -m set --match-set ${src_name} dst -j ${ban_target_dst}" f_iptrule "${action:-"-A"}" "${ban_chain}" "-o ${dev} -m set --match-set ${src_name} dst -j ${ban_target_dst}"
fi fi
done done
fi fi