Compare commits
4 Commits
baff09786b
...
d8d683b4e0
Author | SHA1 | Date |
---|---|---|
Míguel Ángel Mulero Martínez | d8d683b4e0 | |
Dirk Brenken | 2c6d5adac0 | |
Josef Schlehofer | 9d49df0dab | |
Miguel Angel Mulero Martinez | ce9db9e994 |
|
@ -1,8 +1,8 @@
|
||||||
include $(TOPDIR)/rules.mk
|
include $(TOPDIR)/rules.mk
|
||||||
|
|
||||||
PKG_NAME:=syslog-ng
|
PKG_NAME:=syslog-ng
|
||||||
PKG_VERSION:=4.6.0
|
PKG_VERSION:=4.7.1
|
||||||
PKG_RELEASE:=2
|
PKG_RELEASE:=1
|
||||||
|
|
||||||
PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
|
PKG_MAINTAINER:=Josef Schlehofer <pepe.schlehofer@gmail.com>
|
||||||
PKG_LICENSE:=LGPL-2.1-or-later GPL-2.0-or-later
|
PKG_LICENSE:=LGPL-2.1-or-later GPL-2.0-or-later
|
||||||
|
@ -11,7 +11,7 @@ PKG_CPE_ID:=cpe:/a:balabit:syslog-ng
|
||||||
|
|
||||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
||||||
PKG_SOURCE_URL:=https://github.com/syslog-ng/syslog-ng/releases/download/$(PKG_NAME)-$(PKG_VERSION)/
|
PKG_SOURCE_URL:=https://github.com/syslog-ng/syslog-ng/releases/download/$(PKG_NAME)-$(PKG_VERSION)/
|
||||||
PKG_HASH:=b69e3360dfb96a754a4e1cbead4daef37128b1152a23572356db4ab64a475d4f
|
PKG_HASH:=5477189a2d12325aa4faebfcf59f5bdd9084234732f0c3ec16dd253847dacf1c
|
||||||
|
|
||||||
PKG_BUILD_PARALLEL:=1
|
PKG_BUILD_PARALLEL:=1
|
||||||
PKG_INSTALL:=1
|
PKG_INSTALL:=1
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
# Collect all local logs into a single file /var/log/messages.
|
# Collect all local logs into a single file /var/log/messages.
|
||||||
# See https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
|
# See https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
|
||||||
|
|
||||||
@version: 4.6
|
@version: 4.7
|
||||||
@include "scl.conf"
|
@include "scl.conf"
|
||||||
|
|
||||||
options {
|
options {
|
||||||
|
|
|
@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
|
||||||
|
|
||||||
PKG_NAME:=banip
|
PKG_NAME:=banip
|
||||||
PKG_VERSION:=0.9.5
|
PKG_VERSION:=0.9.5
|
||||||
PKG_RELEASE:=2
|
PKG_RELEASE:=3
|
||||||
PKG_LICENSE:=GPL-3.0-or-later
|
PKG_LICENSE:=GPL-3.0-or-later
|
||||||
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
|
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
|
||||||
|
|
||||||
|
|
|
@ -15,7 +15,7 @@ IP address blocking is commonly used to protect against brute force attacks, pre
|
||||||
| adguard | adguard IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
|
| adguard | adguard IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
|
||||||
| adguardtrackers | adguardtracker IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
|
| adguardtrackers | adguardtracker IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
|
||||||
| antipopads | antipopads IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
|
| antipopads | antipopads IPs | | | x | tcp: 80, 443 | [Link](https://github.com/dibdot/banIP-IP-blocklists) |
|
||||||
| asn | ASN segments | | | x | tcp: 80, 443 | [Link](https://asn.ipinfo.app) |
|
| asn | ASN segments | x | x | x | | [Link](https://asn.ipinfo.app) |
|
||||||
| backscatterer | backscatterer IPs | x | x | | | [Link](https://www.uceprotect.net/en/index.php) |
|
| backscatterer | backscatterer IPs | x | x | | | [Link](https://www.uceprotect.net/en/index.php) |
|
||||||
| becyber | malicious attacker IPs | x | x | | | [Link](https://github.com/duggytuxy/malicious_ip_addresses) |
|
| becyber | malicious attacker IPs | x | x | | | [Link](https://github.com/duggytuxy/malicious_ip_addresses) |
|
||||||
| binarydefense | binary defense banlist | x | x | | | [Link](https://iplists.firehol.org/?ipset=bds_atif) |
|
| binarydefense | binary defense banlist | x | x | | | [Link](https://iplists.firehol.org/?ipset=bds_atif) |
|
||||||
|
@ -114,7 +114,7 @@ IP address blocking is commonly used to protect against brute force attacks, pre
|
||||||
* It's strongly recommended to use the LuCI frontend to easily configure all aspects of banIP, the application is located in LuCI under the 'Services' menu
|
* It's strongly recommended to use the LuCI frontend to easily configure all aspects of banIP, the application is located in LuCI under the 'Services' menu
|
||||||
* If you're using a complex network setup, e.g. special tunnel interfaces, than untick the 'Auto Detection' option under the 'General Settings' tab and set the required options manually
|
* If you're using a complex network setup, e.g. special tunnel interfaces, than untick the 'Auto Detection' option under the 'General Settings' tab and set the required options manually
|
||||||
* Start the service with '/etc/init.d/banip start' and check everything is working by running '/etc/init.d/banip status' and also check the 'Firewall Log' and 'Processing Log' tabs
|
* Start the service with '/etc/init.d/banip start' and check everything is working by running '/etc/init.d/banip status' and also check the 'Firewall Log' and 'Processing Log' tabs
|
||||||
* If you're going to configure banIP via CLI, edit the config file '/etc/config/banip' and enable the service (set ban\_enabled to '1'), then add pre-configured feeds via 'ban\_feed' (see the feed list above) and add/change other options to your needs (see the options reference below)
|
* If you're going to configure banIP via CLI, edit the config file '/etc/config/banip' and enable the service (set ban\_enabled to '1'), then add pre-configured feeds via 'ban\_feed' (see the feed list above) and add/change other options to your needs, see the options reference table below
|
||||||
|
|
||||||
## banIP CLI interface
|
## banIP CLI interface
|
||||||
* All important banIP functions are accessible via CLI.
|
* All important banIP functions are accessible via CLI.
|
||||||
|
@ -428,12 +428,12 @@ A valid JSON source object contains the following information, e.g.:
|
||||||
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
|
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
|
||||||
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
|
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
|
||||||
"descr": "tor exit nodes",
|
"descr": "tor exit nodes",
|
||||||
"flag": "tcp 80-89 443"
|
"flag": "gz tcp 80-88 udp 50000"
|
||||||
},
|
},
|
||||||
[...]
|
[...]
|
||||||
```
|
```
|
||||||
Add an unique feed name (no spaces, no special chars) and make the required changes: adapt at least the URL, the regex and the description for a new feed.
|
Add an unique feed name (no spaces, no special chars) and make the required changes: adapt at least the URL, the regex and the description for a new feed.
|
||||||
Please note: the flag field is optional, it's a space separated list of options: supported are 'gz' as an archive format, protocols 'tcp' or 'udp' with port numbers/port ranges for destination port limitations.
|
Please note: the flag field is optional, it's a space separated list of options: supported are 'gz' as an archive format, protocols 'tcp' or 'udp' with port numbers/port ranges for destination port limitations - multiple definitions are possible.
|
||||||
|
|
||||||
## Support
|
## Support
|
||||||
Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-support-thread/16985) or contact me by mail <dev@brenken.org>
|
Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-support-thread/16985) or contact me by mail <dev@brenken.org>
|
||||||
|
|
|
@ -595,24 +595,30 @@ f_etag() {
|
||||||
# build initial nft file with base table, chains and rules
|
# build initial nft file with base table, chains and rules
|
||||||
#
|
#
|
||||||
f_nftinit() {
|
f_nftinit() {
|
||||||
local wan_dev vlan_allow vlan_block log_ct log_icmp log_syn log_udp log_tcp feed_log feed_rc allow_proto allow_dport flag file="${1}"
|
local wan_dev vlan_allow vlan_block log_ct log_icmp log_syn log_udp log_tcp feed_log feed_rc flag tmp_proto tmp_port allow_dport file="${1}"
|
||||||
|
|
||||||
wan_dev="$(printf "%s" "${ban_dev}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
|
wan_dev="$(printf "%s" "${ban_dev}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
|
||||||
[ -n "${ban_vlanallow}" ] && vlan_allow="$(printf "%s" "${ban_vlanallow%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
|
[ -n "${ban_vlanallow}" ] && vlan_allow="$(printf "%s" "${ban_vlanallow%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
|
||||||
[ -n "${ban_vlanblock}" ] && vlan_block="$(printf "%s" "${ban_vlanblock%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
|
[ -n "${ban_vlanblock}" ] && vlan_block="$(printf "%s" "${ban_vlanblock%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
|
||||||
|
|
||||||
for flag in ${ban_allowflag}; do
|
for flag in ${ban_allowflag}; do
|
||||||
if [ -z "${allow_proto}" ] && { [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; }; then
|
if [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; then
|
||||||
allow_proto="${flag}"
|
if [ -z "${tmp_proto}" ]; then
|
||||||
elif [ -n "${allow_proto}" ] && [ -n "${flag//[![:digit]-]/}" ] && ! printf "%s" "${allow_dport}" | "${ban_grepcmd}" -qw "${flag}"; then
|
tmp_proto="${flag}"
|
||||||
if [ -z "${allow_dport}" ]; then
|
elif ! printf "%s" "${tmp_proto}" | "${ban_grepcmd}" -qw "${flag}"; then
|
||||||
allow_dport="${flag}"
|
tmp_proto="${tmp_proto}, ${flag}"
|
||||||
else
|
fi
|
||||||
allow_dport="${allow_dport}, ${flag}"
|
elif [ -n "${flag//[![:digit]-]/}" ]; then
|
||||||
|
if [ -z "${tmp_port}" ]; then
|
||||||
|
tmp_port="${flag}"
|
||||||
|
elif ! printf "%s" "${tmp_port}" | "${ban_grepcmd}" -qw "${flag}"; then
|
||||||
|
tmp_port="${tmp_port}, ${flag}"
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
[ -n "${allow_dport}" ] && allow_dport="${allow_proto} dport { ${allow_dport} }"
|
if [ -n "${tmp_proto}" ] && [ -n "${tmp_port}" ]; then
|
||||||
|
allow_dport="meta l4proto { ${tmp_proto} } th dport { ${tmp_port} }"
|
||||||
|
fi
|
||||||
|
|
||||||
if [ "${ban_logprerouting}" = "1" ]; then
|
if [ "${ban_logprerouting}" = "1" ]; then
|
||||||
log_icmp="log level ${ban_nftloglevel} prefix \"banIP/pre-icmp/drop: \""
|
log_icmp="log level ${ban_nftloglevel} prefix \"banIP/pre-icmp/drop: \""
|
||||||
|
@ -697,7 +703,7 @@ f_nftinit() {
|
||||||
#
|
#
|
||||||
f_down() {
|
f_down() {
|
||||||
local log_input log_forwardwan log_forwardlan start_ts end_ts tmp_raw tmp_load tmp_file split_file ruleset_raw handle rc etag_rc
|
local log_input log_forwardwan log_forwardlan start_ts end_ts tmp_raw tmp_load tmp_file split_file ruleset_raw handle rc etag_rc
|
||||||
local expr cnt_set cnt_dl restore_rc feed_direction feed_rc feed_log feed_comp feed_proto feed_dport feed_target
|
local expr cnt_set cnt_dl restore_rc feed_direction feed_rc feed_log feed_comp feed_target feed_dport tmp_proto tmp_port flag
|
||||||
local feed="${1}" proto="${2}" feed_url="${3}" feed_rule="${4}" feed_flag="${5}"
|
local feed="${1}" proto="${2}" feed_url="${3}" feed_rule="${4}" feed_flag="${5}"
|
||||||
|
|
||||||
start_ts="$(date +%s)"
|
start_ts="$(date +%s)"
|
||||||
|
@ -756,19 +762,25 @@ f_down() {
|
||||||
# prepare feed flags
|
# prepare feed flags
|
||||||
#
|
#
|
||||||
for flag in ${feed_flag}; do
|
for flag in ${feed_flag}; do
|
||||||
if [ "${flag}" = "gz" ] && ! printf "%s" "${feed_comp}" | "${ban_grepcmd}" -qw "${flag}"; then
|
if [ "${flag}" = "gz" ]; then
|
||||||
feed_comp="${flag}"
|
feed_comp="${flag}"
|
||||||
elif [ -z "${feed_proto}" ] && { [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; }; then
|
elif [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; then
|
||||||
feed_proto="${flag}"
|
if [ -z "${tmp_proto}" ]; then
|
||||||
elif [ -n "${feed_proto}" ] && [ -n "${flag//[![:digit]-]/}" ] && ! printf "%s" "${feed_dport}" | "${ban_grepcmd}" -qw "${flag}"; then
|
tmp_proto="${flag}"
|
||||||
if [ -z "${feed_dport}" ]; then
|
elif ! printf "%s" "${tmp_proto}" | "${ban_grepcmd}" -qw "${flag}"; then
|
||||||
feed_dport="${flag}"
|
tmp_proto="${tmp_proto}, ${flag}"
|
||||||
else
|
fi
|
||||||
feed_dport="${feed_dport}, ${flag}"
|
elif [ -n "${flag//[![:digit]-]/}" ]; then
|
||||||
|
if [ -z "${tmp_port}" ]; then
|
||||||
|
tmp_port="${flag}"
|
||||||
|
elif ! printf "%s" "${tmp_port}" | "${ban_grepcmd}" -qw "${flag}"; then
|
||||||
|
tmp_port="${tmp_port}, ${flag}"
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
[ -n "${feed_dport}" ] && feed_dport="${feed_proto} dport { ${feed_dport} }"
|
if [ -n "${tmp_proto}" ] && [ -n "${tmp_port}" ]; then
|
||||||
|
feed_dport="meta l4proto { ${tmp_proto} } th dport { ${tmp_port} }"
|
||||||
|
fi
|
||||||
|
|
||||||
# chain/rule maintenance
|
# chain/rule maintenance
|
||||||
#
|
#
|
||||||
|
|
|
@ -36,8 +36,7 @@
|
||||||
"url_6": "https://asn.ipinfo.app/api/text/list/",
|
"url_6": "https://asn.ipinfo.app/api/text/list/",
|
||||||
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
|
"rule_4": "/^(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?)$/{printf \"%s,\\n\",$1}",
|
||||||
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
|
"rule_6": "/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)$/{printf \"%s,\\n\",$1}",
|
||||||
"descr": "ASN IP segments",
|
"descr": "ASN IP segments"
|
||||||
"flag": "tcp 80 443"
|
|
||||||
},
|
},
|
||||||
"backscatterer":{
|
"backscatterer":{
|
||||||
"url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/ips.backscatterer.org.gz",
|
"url_4": "http://wget-mirrors.uceprotect.net/rbldnsd-all/ips.backscatterer.org.gz",
|
||||||
|
|
|
@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
|
||||||
|
|
||||||
PKG_NAME:=ddns-scripts
|
PKG_NAME:=ddns-scripts
|
||||||
PKG_VERSION:=2.8.2
|
PKG_VERSION:=2.8.2
|
||||||
PKG_RELEASE:=43
|
PKG_RELEASE:=44
|
||||||
|
|
||||||
PKG_LICENSE:=GPL-2.0
|
PKG_LICENSE:=GPL-2.0
|
||||||
|
|
||||||
|
|
|
@ -89,7 +89,7 @@ case "$1" in
|
||||||
exit 1
|
exit 1
|
||||||
;;
|
;;
|
||||||
reload)
|
reload)
|
||||||
killall -1 dynamic_dns_updater.sh 2>/dev/null
|
killall dynamic_dns_updater.sh 2>/dev/null
|
||||||
exit $?
|
exit $?
|
||||||
;;
|
;;
|
||||||
*) usage_err "unknown command - $1";;
|
*) usage_err "unknown command - $1";;
|
||||||
|
|
Loading…
Reference in New Issue