banip: update 0.1.2
* add more IPv4 & IPv6 consistency checks * various cleanups Signed-off-by: Dirk Brenken <dev@brenken.org>
This commit is contained in:
Dirk Brenken
parent
6fb18c99f1
commit
21f5f357e0
2 changed files with 82 additions and 66 deletions
|
|
@ -6,7 +6,7 @@
|
|||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=banip
|
||||
PKG_VERSION:=0.1.1
|
||||
PKG_VERSION:=0.1.2
|
||||
PKG_RELEASE:=1
|
||||
PKG_LICENSE:=GPL-3.0+
|
||||
PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
#
|
||||
LC_ALL=C
|
||||
PATH="/usr/sbin:/usr/bin:/sbin:/bin"
|
||||
ban_ver="0.1.1"
|
||||
ban_ver="0.1.2"
|
||||
ban_sysver="unknown"
|
||||
ban_enabled=0
|
||||
ban_automatic="1"
|
||||
|
|
@ -254,20 +254,26 @@ f_iptrule()
|
|||
|
||||
if [ "${src_name##*_}" = "6" ]
|
||||
then
|
||||
rc="$("${ban_ipt6}" "${timeout}" -C ${rule} 2>/dev/null; printf '%u' ${?})"
|
||||
|
||||
if ([ ${rc} -ne 0 ] && ([ "${action}" = "-A" ] || [ "${action}" = "-I" ])) \
|
||||
|| ([ ${rc} -eq 0 ] && [ "${action}" = "-D" ])
|
||||
if [ -x "${ban_ipt6}" ]
|
||||
then
|
||||
"${ban_ipt6}" "${timeout}" "${action}" ${rule}
|
||||
rc="$("${ban_ipt6}" "${timeout}" -C ${rule} 2>/dev/null; printf '%u' ${?})"
|
||||
|
||||
if { [ ${rc} -ne 0 ] && { [ "${action}" = "-A" ] || [ "${action}" = "-I" ]; } } || \
|
||||
{ [ ${rc} -eq 0 ] && [ "${action}" = "-D" ]; }
|
||||
then
|
||||
"${ban_ipt6}" "${timeout}" "${action}" ${rule}
|
||||
fi
|
||||
fi
|
||||
else
|
||||
rc="$("${ban_ipt}" "${timeout}" -C ${rule} 2>/dev/null; printf '%u' ${?})"
|
||||
|
||||
if ([ ${rc} -ne 0 ] && ([ "${action}" = "-A" ] || [ "${action}" = "-I" ])) \
|
||||
|| ([ ${rc} -eq 0 ] && [ "${action}" = "-D" ])
|
||||
if [ -x "${ban_ipt}" ]
|
||||
then
|
||||
"${ban_ipt}" "${timeout}" "${action}" ${rule}
|
||||
rc="$("${ban_ipt}" "${timeout}" -C ${rule} 2>/dev/null; printf '%u' ${?})"
|
||||
|
||||
if { [ ${rc} -ne 0 ] && { [ "${action}" = "-A" ] || [ "${action}" = "-I" ]; } } || \
|
||||
{ [ ${rc} -eq 0 ] && [ "${action}" = "-D" ]; }
|
||||
then
|
||||
"${ban_ipt}" "${timeout}" "${action}" ${rule}
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
|
@ -319,7 +325,7 @@ f_iptadd()
|
|||
done
|
||||
fi
|
||||
else
|
||||
if [ -n "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipset}" ] && [ -n "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipset}" destroy "${src_name}"
|
||||
fi
|
||||
|
|
@ -366,30 +372,31 @@ f_ipset()
|
|||
f_log "debug" "f_ipset ::: name: ${src_name:-"-"}, mode: ${mode:-"-"}"
|
||||
;;
|
||||
initial)
|
||||
if [ -z "$("${ban_ipt}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipt}" ] && [ -z "$("${ban_ipt}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipt}" "${timeout}" -N "${ban_chain}"
|
||||
elif [ -x "${ban_ipt}" ]
|
||||
then
|
||||
src_name="ruleset"
|
||||
ruleset="${ban_wan_input_chain:-"input_wan_rule"} ${ban_wan_forward_chain:-"forwarding_wan_rule"} ${ban_lan_input_chain:-"input_lan_rule"} ${ban_lan_forward_chain:-"forwarding_lan_rule"}"
|
||||
for rule in ${ruleset}
|
||||
do
|
||||
f_iptrule "-D" "${rule} -j ${ban_chain}"
|
||||
done
|
||||
fi
|
||||
|
||||
if [ -z "$("${ban_ipt6}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipt6}" ] && [ -z "$("${ban_ipt6}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipt6}" "${timeout}" -N "${ban_chain}"
|
||||
elif [ -x "${ban_ipt6}" ]
|
||||
then
|
||||
src_name="ruleset_6"
|
||||
ruleset_6="${ban_wan_input_chain_6:-"input_wan_rule"} ${ban_wan_forward_chain_6:-"forwarding_wan_rule"} ${ban_lan_input_chain_6:-"input_lan_rule"} ${ban_lan_forward_chain_6:-"forwarding_lan_rule"}"
|
||||
for rule in ${ruleset_6}
|
||||
do
|
||||
f_iptrule "-D" "${rule} -j ${ban_chain}"
|
||||
done
|
||||
fi
|
||||
|
||||
src_name="ruleset"
|
||||
ruleset="${ban_wan_input_chain:-"input_wan_rule"} ${ban_wan_forward_chain:-"forwarding_wan_rule"} ${ban_lan_input_chain:-"input_lan_rule"} ${ban_lan_forward_chain:-"forwarding_lan_rule"}"
|
||||
for rule in ${ruleset}
|
||||
do
|
||||
f_iptrule "-D" "${rule} -j ${ban_chain}"
|
||||
done
|
||||
|
||||
src_name="ruleset_6"
|
||||
ruleset_6="${ban_wan_input_chain_6:-"input_wan_rule"} ${ban_wan_forward_chain_6:-"forwarding_wan_rule"} ${ban_lan_input_chain_6:-"input_lan_rule"} ${ban_lan_forward_chain_6:-"forwarding_lan_rule"}"
|
||||
for rule in ${ruleset_6}
|
||||
do
|
||||
f_iptrule "-D" "${rule} -j ${ban_chain}"
|
||||
done
|
||||
|
||||
f_log "debug" "f_ipset ::: name: -, mode: ${mode:-"-"}, chain: ${ban_chain:-"-"}, ruleset: ${ruleset}, ruleset_6: ${ruleset_6}"
|
||||
;;
|
||||
create)
|
||||
|
|
@ -400,7 +407,7 @@ f_ipset()
|
|||
|
||||
if [ ${cnt} -gt 0 ]
|
||||
then
|
||||
if [ -z "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipset}" ] && [ -z "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipset}" create "${src_name}" hash:"${src_settype}" hashsize "${size}" maxelem 262144 family "${src_setipv}" counters
|
||||
else
|
||||
|
|
@ -413,10 +420,10 @@ f_ipset()
|
|||
fi
|
||||
f_iptadd
|
||||
end_ts="$(date +%s)"
|
||||
f_log "debug" "f_ipset ::: name: ${src_name:-"-"}, mode: ${mode:-"-"}, settype: ${src_settype:-"-"}, setipv: "${src_setipv}", ruletype: ${src_ruletype:-"-"}, count(sum/ip/cidr): ${cnt:-0}/${cnt_ip:-0}/${cnt_cidr:-0}, time(s): $(( end_ts - start_ts ))"
|
||||
f_log "debug" "f_ipset ::: name: ${src_name:-"-"}, mode: ${mode:-"-"}, settype: ${src_settype:-"-"}, setipv: ${src_setipv:-"-"}, ruletype: ${src_ruletype:-"-"}, count(sum/ip/cidr): ${cnt:-0}/${cnt_ip:-0}/${cnt_cidr:-0}, time(s): $(( end_ts - start_ts ))"
|
||||
;;
|
||||
refresh)
|
||||
if [ -n "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipset}" ] && [ -n "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipset}" save "${src_name}" > "${tmp_file}"
|
||||
if [ -s "${tmp_file}" ]
|
||||
|
|
@ -435,23 +442,24 @@ f_ipset()
|
|||
flush)
|
||||
f_iptadd "remove"
|
||||
|
||||
if [ -n "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipset}" ] && [ -n "$("${ban_ipset}" -n list "${src_name}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipset}" flush "${src_name}"
|
||||
"${ban_ipset}" destroy "${src_name}"
|
||||
fi
|
||||
|
||||
f_log "debug" "f_ipset ::: name: ${src_name:-"-"}, mode: ${mode:-"-"}"
|
||||
;;
|
||||
destroy)
|
||||
if [ -n "$("${ban_ipt}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipt}" ] && [ -x "${ban_ipt_save}" ] && [ -x "${ban_ipt_restore}" ] && \
|
||||
[ -n "$("${ban_ipt}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipt_save}" | grep -v -- "-j ${ban_chain}" | "${ban_ipt_restore}"
|
||||
"${ban_ipt}" "${timeout}" -F "${ban_chain}"
|
||||
"${ban_ipt}" "${timeout}" -X "${ban_chain}"
|
||||
fi
|
||||
|
||||
if [ -n "$("${ban_ipt6}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipt6}" ] && [ -x "${ban_ipt6_save}" ] && [ -x "${ban_ipt6_restore}" ] && \
|
||||
[ -n "$("${ban_ipt6}" "${timeout}" -nL "${ban_chain}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipt6_save}" | grep -v -- "-j ${ban_chain}" | "${ban_ipt6_restore}"
|
||||
"${ban_ipt6}" "${timeout}" -F "${ban_chain}"
|
||||
|
|
@ -460,12 +468,11 @@ f_ipset()
|
|||
|
||||
for source in ${ban_sources}
|
||||
do
|
||||
if [ -n "$("${ban_ipset}" -n list "${source}" 2>/dev/null)" ]
|
||||
if [ -x "${ban_ipset}" ] && [ -n "$("${ban_ipset}" -n list "${source}" 2>/dev/null)" ]
|
||||
then
|
||||
"${ban_ipset}" destroy "${source}"
|
||||
fi
|
||||
done
|
||||
|
||||
f_log "debug" "f_ipset ::: name: ${src_name:-"-"}, mode: ${mode:-"-"}"
|
||||
;;
|
||||
esac
|
||||
|
|
@ -477,7 +484,7 @@ f_log()
|
|||
{
|
||||
local class="${1}" log_msg="${2}"
|
||||
|
||||
if [ -n "${log_msg}" ] && ([ "${class}" != "debug" ] || [ ${ban_debug} -eq 1 ])
|
||||
if [ -n "${log_msg}" ] && { [ "${class}" != "debug" ] || [ ${ban_debug} -eq 1 ]; }
|
||||
then
|
||||
logger -p "${class}" -t "banIP-[${ban_ver}]" "${log_msg}"
|
||||
if [ "${class}" = "err" ]
|
||||
|
|
@ -496,11 +503,11 @@ f_log()
|
|||
#
|
||||
f_main()
|
||||
{
|
||||
local start_ts end_ts ip tmp_raw tmp_cnt tmp_setcnt tmp_load tmp_file entry list suffix mem_total mem_free cnt=1
|
||||
local pid pid_list start_ts end_ts ip tmp_raw tmp_cnt tmp_load tmp_file mem_total mem_free cnt=1
|
||||
local src_name src_on src_url src_rset src_setipv src_settype src_ruletype src_cat src_log src_addon
|
||||
local pid pid_list log_content="$(logread -e "dropbear")"
|
||||
local wan_input wan_forward lan_input lan_forward target_src target_dst
|
||||
local wan_input wan_forward lan_input lan_forward target_src target_dst log_content
|
||||
|
||||
log_content="$(logread -e "dropbear")"
|
||||
mem_total="$(awk '/^MemTotal/ {print int($2/1000)}' "/proc/meminfo" 2>/dev/null)"
|
||||
mem_free="$(awk '/^MemFree/ {print int($2/1000)}' "/proc/meminfo" 2>/dev/null)"
|
||||
f_log "debug" "f_main ::: fetch_util: ${ban_fetchinfo:-"-"}, fetch_parm: ${ban_fetchparm:-"-"}, interface(s): ${ban_iface:-"-"}, device(s): ${ban_dev:-"-"}, all_devices: ${ban_dev_all:-"-"}, backup: ${ban_backup:-"-"}, backup_boot: ${ban_backupboot:-"-"}, backup_dir: ${ban_backupdir:-"-"}, mem_total: ${mem_total:-0}, mem_free: ${mem_free:-0}, max_queue: ${ban_maxqueue}"
|
||||
|
|
@ -511,29 +518,36 @@ f_main()
|
|||
#
|
||||
for src_name in ${ban_sources}
|
||||
do
|
||||
unset src_on
|
||||
if [ "${src_name##*_}" = "6" ]
|
||||
then
|
||||
src_on="$(eval printf '%s' \"\${ban_src_on_6_${src_name%_6*}\}\")"
|
||||
src_url="$(eval printf '%s' \"\${ban_src_6_${src_name%_6*}\}\")"
|
||||
src_rset="$(eval printf '%s' \"\${ban_src_rset_6_${src_name%_6*}\}\")"
|
||||
src_setipv="inet6"
|
||||
wan_input="${ban_wan_input_chain_6:-"input_wan_rule"}"
|
||||
wan_forward="${ban_wan_forward_chain_6:-"forwarding_wan_rule"}"
|
||||
lan_input="${ban_lan_input_chain_6:-"input_lan_rule"}"
|
||||
lan_forward="${ban_lan_forward_chain_6:-"forwarding_lan_rule"}"
|
||||
target_src="${ban_target_src_6:-"DROP"}"
|
||||
target_dst="${ban_target_dst_6:-"REJECT"}"
|
||||
if [ -x "${ban_ipt6}" ]
|
||||
then
|
||||
src_on="$(eval printf '%s' \"\${ban_src_on_6_${src_name%_6*}\}\")"
|
||||
src_url="$(eval printf '%s' \"\${ban_src_6_${src_name%_6*}\}\")"
|
||||
src_rset="$(eval printf '%s' \"\${ban_src_rset_6_${src_name%_6*}\}\")"
|
||||
src_setipv="inet6"
|
||||
wan_input="${ban_wan_input_chain_6:-"input_wan_rule"}"
|
||||
wan_forward="${ban_wan_forward_chain_6:-"forwarding_wan_rule"}"
|
||||
lan_input="${ban_lan_input_chain_6:-"input_lan_rule"}"
|
||||
lan_forward="${ban_lan_forward_chain_6:-"forwarding_lan_rule"}"
|
||||
target_src="${ban_target_src_6:-"DROP"}"
|
||||
target_dst="${ban_target_dst_6:-"REJECT"}"
|
||||
fi
|
||||
else
|
||||
src_on="$(eval printf '%s' \"\${ban_src_on_${src_name}\}\")"
|
||||
src_url="$(eval printf '%s' \"\${ban_src_${src_name}\}\")"
|
||||
src_rset="$(eval printf '%s' \"\${ban_src_rset_${src_name}\}\")"
|
||||
src_setipv="inet"
|
||||
wan_input="${ban_wan_input_chain:-"input_wan_rule"}"
|
||||
wan_forward="${ban_wan_forward_chain:-"forwarding_wan_rule"}"
|
||||
lan_input="${ban_lan_input_chain:-"input_lan_rule"}"
|
||||
lan_forward="${ban_lan_forward_chain:-"forwarding_lan_rule"}"
|
||||
target_src="${ban_target_src:-"DROP"}"
|
||||
target_dst="${ban_target_dst:-"REJECT"}"
|
||||
if [ -x "${ban_ipt}" ]
|
||||
then
|
||||
src_on="$(eval printf '%s' \"\${ban_src_on_${src_name}\}\")"
|
||||
src_url="$(eval printf '%s' \"\${ban_src_${src_name}\}\")"
|
||||
src_rset="$(eval printf '%s' \"\${ban_src_rset_${src_name}\}\")"
|
||||
src_setipv="inet"
|
||||
wan_input="${ban_wan_input_chain:-"input_wan_rule"}"
|
||||
wan_forward="${ban_wan_forward_chain:-"forwarding_wan_rule"}"
|
||||
lan_input="${ban_lan_input_chain:-"input_lan_rule"}"
|
||||
lan_forward="${ban_lan_forward_chain:-"forwarding_lan_rule"}"
|
||||
target_src="${ban_target_src:-"DROP"}"
|
||||
target_dst="${ban_target_dst:-"REJECT"}"
|
||||
fi
|
||||
fi
|
||||
src_settype="$(eval printf '%s' \"\${ban_src_settype_${src_name%_6*}\}\")"
|
||||
src_ruletype="$(eval printf '%s' \"\${ban_src_ruletype_${src_name%_6*}\}\")"
|
||||
|
|
@ -549,8 +563,8 @@ f_main()
|
|||
#
|
||||
f_log "debug" "f_main ::: name: ${src_name}, src_on: ${src_on:-"-"}"
|
||||
|
||||
if [ "${src_on}" != "1" ] || [ -z "${src_url}" ] || [ -z "${src_rset}" ] ||\
|
||||
[ -z "${src_settype}" ] || [ -z "${src_ruletype}" ]
|
||||
if [ -z "${src_on}" ] || [ "${src_on}" != "1" ] || [ -z "${src_url}" ] || \
|
||||
[ -z "${src_rset}" ] || [ -z "${src_settype}" ] || [ -z "${src_ruletype}" ]
|
||||
then
|
||||
f_ipset flush
|
||||
f_ipset remove
|
||||
|
|
@ -722,8 +736,10 @@ f_main()
|
|||
#
|
||||
f_jsnup()
|
||||
{
|
||||
local rundate="$(/bin/date "+%d.%m.%Y %H:%M:%S")" mode="normal mode" status="${1:-"enabled"}"
|
||||
local rundate mode status="${1:-"enabled"}"
|
||||
|
||||
rundate="$(/bin/date "+%d.%m.%Y %H:%M:%S")"
|
||||
mode="normal mode"
|
||||
ban_cntinfo="${ban_setcnt} IPSets with overall ${ban_cnt} IPs/Prefixes"
|
||||
|
||||
if [ ${ban_backupboot} -eq 1 ]
|
||||
|
|
|
|||
Loading…
Reference in a new issue