mirror of
https://github.com/openwrt/packages.git
synced 2025-10-08 00:07:59 +00:00
80768dfdae
* change the chain structure: only two regular chains contain the generated banIP sets. “_inbound” covers the base chains WAN-Input and WAN-Forward, ‘_outbound’ covers the base chain LAN-Forward. * pre-configure the default chains for every feed in the banip.feeds json file, no longer blocks selected feeds in all chains by default * it's now possible to split country and asn Sets by country or asn (disabled by default) * support Set counters to report easily suspicious IPs per Set (disabled by default) * make it possible, to opt out certain chains from the deduplication process * the element search now returns all matches (and not only the first one) * the report engine now includes statistics about the Inbound & Outbound chains and the Set counters (optional) * save the temp. files of possible nft loading errors in "/tmp/banIP-errors" by default for easier debugging * various code improvements * remove ssbl feed (deprecated) * add two new vpn feeds * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
37 lines
1.1 KiB
Bash
37 lines
1.1 KiB
Bash
#!/bin/sh
|
|
# banIP cgi remote logging script - ban incoming and outgoing IPs via named nftables Sets
|
|
# Copyright (c) 2018-2025 Dirk Brenken (dev@brenken.org)
|
|
# This is free software, licensed under the GNU General Public License v3.
|
|
|
|
# (s)hellcheck exceptions
|
|
# shellcheck disable=all
|
|
|
|
# handle post/get requests
|
|
#
|
|
post_string="$(cat)"
|
|
request="${post_string//[^[:alnum:]=\.\:]/}"
|
|
[ -z "${request}" ] && request="${QUERY_STRING//[^[:alnum:]=\.\:]/}"
|
|
|
|
request_decode() {
|
|
local key value token
|
|
|
|
key="${request%=*}"
|
|
value="${request#*=}"
|
|
token="$(uci -q get banip.global.ban_remotetoken)"
|
|
|
|
if [ -n "${key}" ] && [ -n "${value}" ] && [ "${key}" = "${token}" ] && /etc/init.d/banip running; then
|
|
[ -r "/usr/lib/banip-functions.sh" ] && { . "/usr/lib/banip-functions.sh"; f_conf; }
|
|
if [ "${ban_remotelog}" = "1" ] && [ -x "${ban_logreadcmd}" ] && [ -n "${ban_logterm%%??}" ] && [ "${ban_loglimit}" != "0" ]; then
|
|
f_log "info" "received a suspicious remote IP '${value}'"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
cat <<EOF
|
|
Status: 202 Accepted
|
|
Content-Type: text/plain; charset=UTF-8
|
|
|
|
EOF
|
|
|
|
request_decode
|