mirror
/
openwrt-packages
mirror of https://git.openwrt.org/feed/packages.git
1
0
Fork 0
Code Releases Activity

banip: release 0.9.0-1 

* supports allowing / blocking of certain VLAN forwards in segregated network environments,
   set 'ban_vlanallow', ''ban_vlanblock' accordingly
* simplified the code/JSON to generate/parse the banIP status
* enclose nft related devices in quotation marks , e.g. to handle devices which starts with a number '10g-1'
* made the new vlan options available to LuCI (separate commit)

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 1c14eb6d8c)
This commit is contained in:
Dirk Brenken 2023-07-16 07:32:24 +02:00
parent d31c3263c3
commit c59b975f2f
No known key found for this signature in database
GPG Key ID: 9D71CD547BFAE684
3 changed files with 80 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/banip/Makefile
View File

@ -5,8 +5,8 @@
include $(TOPDIR)/rules.mk include $(TOPDIR)/rules.mk
PKG_NAME:=banip PKG_NAME:=banip
PKG_VERSION:=0.8.9 PKG_VERSION:=0.9.0
PKG_RELEASE:=4 PKG_RELEASE:=1
PKG_LICENSE:=GPL-3.0-or-later PKG_LICENSE:=GPL-3.0-or-later
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org> PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>

21
net/banip/files/README.md
View File

@ -88,6 +88,7 @@ IP address blocking is commonly used to protect against brute force attacks, pre
* Procd network interface trigger support * Procd network interface trigger support
* Add new or edit existing banIP feeds on your own with the LuCI integrated custom feed editor * Add new or edit existing banIP feeds on your own with the LuCI integrated custom feed editor
* Supports external allowlist URLs to reference additional IPv4/IPv6 feeds * Supports external allowlist URLs to reference additional IPv4/IPv6 feeds
* Supports allowing / blocking of certain VLAN forwards
## Prerequisites ## Prerequisites
* **[OpenWrt](https://openwrt.org)**, latest stable release or a snapshot with nft/firewall 4 and logd/logread support * **[OpenWrt](https://openwrt.org)**, latest stable release or a snapshot with nft/firewall 4 and logd/logread support
@ -159,6 +160,8 @@ Available commands:
| ban_ifv4 | list | - / autodetect | logical wan IPv4 interfaces, e.g. 'wan' | | ban_ifv4 | list | - / autodetect | logical wan IPv4 interfaces, e.g. 'wan' |
| ban_ifv6 | list | - / autodetect | logical wan IPv6 interfaces, e.g. 'wan6' | | ban_ifv6 | list | - / autodetect | logical wan IPv6 interfaces, e.g. 'wan6' |
| ban_dev | list | - / autodetect | wan device(s), e.g. 'eth2' | | ban_dev | list | - / autodetect | wan device(s), e.g. 'eth2' |
| ban_vlanallow | list | - | always allow certain VLAN forwards, e.g. br-lan.20 |
| ban_vlanblock | list | - | always block certain VLAN forwards, e.g. br-lan.10 |
| ban_trigger | list | - | logical startup trigger interface(s), e.g. 'wan' | | ban_trigger | list | - | logical startup trigger interface(s), e.g. 'wan' |
| ban_triggerdelay | option | 10 | trigger timeout before banIP processing begins | | ban_triggerdelay | option | 10 | trigger timeout before banIP processing begins |
| ban_triggeraction | option | start | trigger action on ifup events, e.g. start, restart or reload | | ban_triggeraction | option | start | trigger action on ifup events, e.g. start, restart or reload |
@ -230,19 +233,19 @@ Available commands:
**banIP runtime information** **banIP runtime information**
``` ```
root@blackhole:~# /etc/init.d/banip status root@blackhole:/etc/config$ /etc/init.d/banip status
::: banIP runtime information ::: banIP runtime information
+ status : active (nft: ✔, monitor: ✔) + status : active (nft: ✔, monitor: ✔)
+ version : 0.8.8-1 + version : 0.9.0-1
+ element_count : 104449 + element_count : 111094
+ active_feeds : allowlistv4MAC, allowlistv6MAC, allowlistv4, allowlistv6, cinsscorev4, deblv4, countryv6, countryv4, deblv6, dropv6, dropv4, dohv6, dohv4, edropv4, threatviewv4, firehol1v4, ipthreatv4, urlvirv4, blocklistv4MAC, blocklistv6MAC, blocklistv4, blocklistv6 + active_feeds : allowlistv4MAC, allowlistv6MAC, allowlistv4, allowlistv6, cinsscorev4, deblv4, countryv6, countryv4, deblv6, dropv6, dropv4, dohv6, dohv4, threatviewv4, firehol1v4, ipthreatv4, firehol2v4, urlvirv4, urlhausv4, blocklistv4MAC, blocklistv6MAC, blocklistv4, blocklistv6
+ active_devices : br-wan ::: wan, wan6 + active_devices : wan: br-wan, 10g-1 / wan-if: wan, wan6 / vlan-allow: - / vlan-block: -
+ active_uplink : 91.63.198.120, 2a12:810c:0:80:a20d:52c3:5cf:f4f + active_uplink : 91.63.198.120, 2a12:810c:0:80:a20d:52c3:5cf:f4f
+ nft_info : priority: -200, policy: performance, loglevel: warn, expiry: - + nft_info : priority: -200, policy: performance, loglevel: warn, expiry: -
+ run_info : base: /mnt/data/banIP, backup: /mnt/data/banIP/backup, report: /mnt/data/banIP/report, custom feed: ✘ + run_info : base: /mnt/data/banIP, backup: /mnt/data/banIP/backup, report: /mnt/data/banIP/report
+ run_flags : auto: ✔, proto (4/6): ✔/✔, log (wan-inp/wan-fwd/lan-fwd): ✔/✔/✔, dedup: ✔, split: ✘, allowed only: ✘ + run_flags : auto: ✔, proto (4/6): ✔/✔, log (wan-inp/wan-fwd/lan-fwd): ✔/✔/✔, dedup: ✔, split: ✘, custom feed: ✘, allowed only: ✘
+ last_run : action: restart, duration: 0m 19s, date: 2023-06-21 06:45:52 + last_run : action: reload, fetch: curl, duration: 0m 36s, date: 2023-07-16 06:59:28
+ system_info : cores: 4, memory: 1634, device: Bananapi BPI-R3, OpenWrt SNAPSHOT r23398-c4be106f4d + system_info : cores: 4, memory: 1663, device: Bananapi BPI-R3, OpenWrt SNAPSHOT r23565-8fb0c196e8
``` ```
**banIP search information** **banIP search information**

133
net/banip/files/banip-functions.sh
View File

@ -73,6 +73,8 @@ ban_protov6="0"
ban_ifv4="" ban_ifv4=""
ban_ifv6="" ban_ifv6=""
ban_dev="" ban_dev=""
ban_vlanallow=""
ban_vlanblock=""
ban_uplink="" ban_uplink=""
ban_fetchcmd="" ban_fetchcmd=""
ban_fetchparm="" ban_fetchparm=""
@ -224,7 +226,7 @@ f_log() {
# load config # load config
# #
f_conf() { f_conf() {
unset ban_dev ban_ifv4 ban_ifv6 ban_feed ban_allowurl ban_blockinput ban_blockforwardwan ban_blockforwardlan ban_logterm ban_country ban_asn unset ban_dev ban_vlanallow ban_vlanblock ban_ifv4 ban_ifv6 ban_feed ban_allowurl ban_blockinput ban_blockforwardwan ban_blockforwardlan ban_logterm ban_country ban_asn
config_cb() { config_cb() {
option_cb() { option_cb() {
local option="${1}" local option="${1}"
@ -235,15 +237,21 @@ f_conf() {
local option="${1}" local option="${1}"
local value="${2}" local value="${2}"
case "${option}" in case "${option}" in
"ban_dev")
eval "${option}=\"$(printf "%s" "${ban_dev}")${value} \""
;;
"ban_ifv4") "ban_ifv4")
eval "${option}=\"$(printf "%s" "${ban_ifv4}")${value} \"" eval "${option}=\"$(printf "%s" "${ban_ifv4}")${value} \""
;; ;;
"ban_ifv6") "ban_ifv6")
eval "${option}=\"$(printf "%s" "${ban_ifv6}")${value} \"" eval "${option}=\"$(printf "%s" "${ban_ifv6}")${value} \""
;; ;;
"ban_dev")
eval "${option}=\"$(printf "%s" "${ban_dev}")${value} \""
;;
"ban_vlanallow")
eval "${option}=\"$(printf "%s" "${ban_vlanallow}")${value} \""
;;
"ban_vlanblock")
eval "${option}=\"$(printf "%s" "${ban_vlanblock}")${value} \""
;;
"ban_trigger") "ban_trigger")
eval "${option}=\"$(printf "%s" "${ban_trigger}")${value} \"" eval "${option}=\"$(printf "%s" "${ban_trigger}")${value} \""
;; ;;
@ -435,7 +443,7 @@ f_getdev() {
ban_dev="${ban_dev%%?}" ban_dev="${ban_dev%%?}"
[ -z "${ban_dev}" ] && f_log "err" "no wan devices" [ -z "${ban_dev}" ] && f_log "err" "no wan devices"
f_log "debug" "f_getdev ::: auto/update: ${ban_autodetect}/${update}, devices: ${ban_dev}, cnt: ${cnt}" f_log "debug" "f_getdev ::: auto/update: ${ban_autodetect}/${update}, wan_devices: ${ban_dev}, cnt: ${cnt}"
} }
# get local uplink # get local uplink
@ -534,7 +542,11 @@ f_etag() {
# build initial nft file with base table, chains and rules # build initial nft file with base table, chains and rules
# #
f_nftinit() { f_nftinit() {
local feed_log feed_rc file="${1}" local wan_dev vlan_allow vlan_block feed_log feed_rc file="${1}"
wan_dev="$(printf "%s" "${ban_dev}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
[ -n "${ban_vlanallow}" ] && vlan_allow="$(printf "%s" "${ban_vlanallow%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
[ -n "${ban_vlanblock}" ] && vlan_block="$(printf "%s" "${ban_vlanblock%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
{ {
# nft header (tables and chains) # nft header (tables and chains)
@ -551,7 +563,7 @@ f_nftinit() {
# default wan-input rules # default wan-input rules
# #
printf "%s\n" "add rule inet banIP wan-input ct state established,related counter accept" printf "%s\n" "add rule inet banIP wan-input ct state established,related counter accept"
printf "%s\n" "add rule inet banIP wan-input iifname != { ${ban_dev// /, } } counter accept" printf "%s\n" "add rule inet banIP wan-input iifname != { ${wan_dev} } counter accept"
printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 udp sport 67-68 udp dport 67-68 counter accept" printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 udp sport 67-68 udp dport 67-68 counter accept"
printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 udp sport 547 udp dport 546 counter accept" printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 udp sport 547 udp dport 546 counter accept"
printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 icmp type { echo-request } limit rate 1000/second counter accept" printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 icmp type { echo-request } limit rate 1000/second counter accept"
@ -562,12 +574,14 @@ f_nftinit() {
# default wan-forward rules # default wan-forward rules
# #
printf "%s\n" "add rule inet banIP wan-forward ct state established,related counter accept" printf "%s\n" "add rule inet banIP wan-forward ct state established,related counter accept"
printf "%s\n" "add rule inet banIP wan-forward iifname != { ${ban_dev// /, } } counter accept" printf "%s\n" "add rule inet banIP wan-forward iifname != { ${wan_dev} } counter accept"
# default lan-forward rules # default lan-forward rules
# #
printf "%s\n" "add rule inet banIP lan-forward ct state established,related counter accept" printf "%s\n" "add rule inet banIP lan-forward ct state established,related counter accept"
printf "%s\n" "add rule inet banIP lan-forward oifname != { ${ban_dev// /, } } counter accept" printf "%s\n" "add rule inet banIP lan-forward oifname != { ${wan_dev} } counter accept"
[ -n "${vlan_allow}" ] && printf "%s\n" "add rule inet banIP lan-forward iifname { ${vlan_allow} } counter accept"
[ -n "${vlan_block}" ] && printf "%s\n" "add rule inet banIP lan-forward iifname { ${vlan_block} } counter reject"
} >"${file}" } >"${file}"
# load initial banIP table within nft (atomic load) # load initial banIP table within nft (atomic load)
@ -575,7 +589,7 @@ f_nftinit() {
feed_log="$("${ban_nftcmd}" -f "${file}" 2>&1)" feed_log="$("${ban_nftcmd}" -f "${file}" 2>&1)"
feed_rc="${?}" feed_rc="${?}"
f_log "debug" "f_nftinit ::: devices: ${ban_dev}, priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}" f_log "debug" "f_nftinit ::: wan_dev: ${wan_dev}, vlan_allow: ${vlan_allow:-"-"}, vlan_block: ${vlan_block:-"-"}, priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
return "${feed_rc}" return "${feed_rc}"
} }
@ -1035,7 +1049,7 @@ f_genstatus() {
cnt_elements="$((cnt_elements + $("${ban_nftcmd}" -j list set inet banIP "${item}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)))" cnt_elements="$((cnt_elements + $("${ban_nftcmd}" -j list set inet banIP "${item}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)))"
done done
fi fi
runtime="action: ${ban_action:-"-"}, duration: ${duration:-"-"}, date: $(date "+%Y-%m-%d %H:%M:%S")" runtime="action: ${ban_action:-"-"}, fetch: ${ban_fetchcmd##*/}, duration: ${duration:-"-"}, date: $(date "+%Y-%m-%d %H:%M:%S")"
fi fi
[ -s "${ban_customfeedfile}" ] && custom_feed="1" [ -s "${ban_customfeedfile}" ] && custom_feed="1"
[ "${ban_splitsize:-"0"}" -gt "0" ] && split="1" [ "${ban_splitsize:-"0"}" -gt "0" ] && split="1"
@ -1048,33 +1062,37 @@ f_genstatus() {
json_add_string "element_count" "${cnt_elements}" json_add_string "element_count" "${cnt_elements}"
json_add_array "active_feeds" json_add_array "active_feeds"
for object in ${table_sets:-"-"}; do for object in ${table_sets:-"-"}; do
json_add_object json_add_string "${object}" "${object}"
json_add_string "feed" "${object}"
json_close_object
done done
json_close_array json_close_array
json_add_array "active_devices" json_add_array "wan_devices"
for object in ${ban_dev:-"-"}; do for object in ${ban_dev:-"-"}; do
json_add_object json_add_string "${object}" "${object}"
json_add_string "device" "${object}"
json_close_object
done done
json_close_array
json_add_array "wan_interfaces"
for object in ${ban_ifv4:-"-"} ${ban_ifv6:-"-"}; do for object in ${ban_ifv4:-"-"} ${ban_ifv6:-"-"}; do
json_add_object json_add_string "${object}" "${object}"
json_add_string "interface" "${object}" done
json_close_object json_close_array
json_add_array "vlan_allow"
for object in ${ban_vlanallow:-"-"}; do
json_add_string "${object}" "${object}"
done
json_close_array
json_add_array "vlan_block"
for object in ${ban_vlanblock:-"-"}; do
json_add_string "${object}" "${object}"
done done
json_close_array json_close_array
json_add_array "active_uplink" json_add_array "active_uplink"
for object in ${ban_uplink:-"-"}; do for object in ${ban_uplink:-"-"}; do
json_add_object json_add_string "${object}" "${object}"
json_add_string "uplink" "${object}"
json_close_object
done done
json_close_array json_close_array
json_add_string "nft_info" "priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, expiry: ${ban_nftexpiry:-"-"}" json_add_string "nft_info" "priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, expiry: ${ban_nftexpiry:-"-"}"
json_add_string "run_info" "base: ${ban_basedir}, backup: ${ban_backupdir}, report: ${ban_reportdir}, custom feed: $(f_char ${custom_feed})" json_add_string "run_info" "base: ${ban_basedir}, backup: ${ban_backupdir}, report: ${ban_reportdir}"
json_add_string "run_flags" "auto: $(f_char ${ban_autodetect}), proto (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (wan-inp/wan-fwd/lan-fwd): $(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), dedup: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), allowed only: $(f_char ${ban_allowlistonly})" json_add_string "run_flags" "auto: $(f_char ${ban_autodetect}), proto (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (wan-inp/wan-fwd/lan-fwd): $(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), dedup: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), custom feed: $(f_char ${custom_feed}), allowed only: $(f_char ${ban_allowlistonly})"
json_add_string "last_run" "${runtime:-"-"}" json_add_string "last_run" "${runtime:-"-"}"
json_add_string "system_info" "cores: ${ban_cores}, memory: ${ban_memory}, device: ${ban_sysver}" json_add_string "system_info" "cores: ${ban_cores}, memory: ${ban_memory}, device: ${ban_sysver}"
json_dump >"${ban_rtfile}" json_dump >"${ban_rtfile}"
@ -1083,54 +1101,35 @@ f_genstatus() {
# get status information # get status information
# #
f_getstatus() { f_getstatus() {
local key keylist type value index_key1 index_key2 index_value1 index_value2 local key keylist value values
[ -z "${ban_dev}" ] && f_conf [ -z "${ban_dev}" ] && f_conf
json_load_file "${ban_rtfile}" >/dev/null 2>&1 json_load_file "${ban_rtfile}" >/dev/null 2>&1
if json_get_keys keylist; then if json_get_keys keylist; then
printf "%s\n" "::: banIP runtime information" printf "%s\n" "::: banIP runtime information"
for key in ${keylist}; do for key in ${keylist}; do
json_get_var value "${key}" >/dev/null 2>&1 if [ "${key}" = "active_feeds" ] || [ "${key}" = "active_uplink" ]; then
if [ "${key}" = "status" ]; then json_get_values values "${key}" >/dev/null 2>&1
value="${value} ($(f_actual))" value="${values// /, }"
elif [ "${key}" = "active_devices" ]; then elif [ "${key}" = "wan_devices" ]; then
json_select "${key}" >/dev/null 2>&1 json_get_values values "${key}" >/dev/null 2>&1
index=1 value="wan: ${values// /, } / "
while json_get_type type "${index}" && [ "${type}" = "object" ]; do json_get_values values "wan_interfaces" >/dev/null 2>&1
json_get_keys index_key1 "${index}" >/dev/null 2>&1 value="${value}wan-if: ${values// /, } / "
json_get_keys index_key2 "$((index + 1))" >/dev/null 2>&1 json_get_values values "vlan_allow" >/dev/null 2>&1
json_get_values index_value1 "${index}" >/dev/null 2>&1 value="${value}vlan-allow: ${values// /, } / "
if [ "${index}" = "1" ] && [ "${index_key1// /}" = "device" ] && [ "${index_key2// /}" = "interface" ]; then json_get_values values "vlan_block" >/dev/null 2>&1
json_get_values index_value2 "$((index + 1))" >/dev/null 2>&1 value="${value}vlan-block: ${values// /, }"
value="${index_value1} ::: ${index_value2}" key="active_devices"
index="$((index + 1))" else
elif [ "${index}" = "1" ]; then json_get_var value "${key}" >/dev/null 2>&1
value="${index_value1}" if [ "${key}" = "status" ]; then
elif [ "${index}" != "1" ] && [ "${index_key1// /}" = "device" ] && [ "${index_key2// /}" = "interface" ]; then value="${value} ($(f_actual))"
json_get_values index_value2 "$((index + 1))" >/dev/null 2>&1 fi
value="${value}, ${index_value1} ::: ${index_value2}" fi
index="$((index + 1))" if [ "${key}" != "wan_interfaces" ] && [ "${key}" != "vlan_allow" ] && [ "${key}" != "vlan_block" ]; then
elif [ "${index}" != "1" ]; then printf " + %-17s : %s\n" "${key}" "${value:-"-"}"
value="${value}, ${index_value1}"
fi
index="$((index + 1))"
done
json_select ".."
elif [ "${key%_*}" = "active" ]; then
json_select "${key}" >/dev/null 2>&1
index=1
while json_get_type type "${index}" && [ "${type}" = "object" ]; do
json_get_values index_value1 "${index}" >/dev/null 2>&1
if [ "${index}" = "1" ]; then
value="${index_value1}"
else
value="${value}, ${index_value1}"
fi
index="$((index + 1))"
done
json_select ".."
fi fi
printf " + %-17s : %s\n" "${key}" "${value:-"-"}"
done done
else else
printf "%s\n" "::: no banIP runtime information available" printf "%s\n" "::: no banIP runtime information available"