1 # banIP shared function library/include - ban incoming and outgoing IPs via named nftables Sets
2 # Copyright (c) 2018-2023 Dirk Brenken (dev@brenken.org)
3 # This is free software, licensed under the GNU General Public License v3.
5 # (s)hellcheck exceptions
6 # shellcheck disable=all
11 export PATH
="/usr/sbin:/usr/bin:/sbin:/bin"
14 ban_backupdir
="/tmp/banIP-backup"
15 ban_reportdir
="/tmp/banIP-report"
16 ban_feedfile
="/etc/banip/banip.feeds"
17 ban_customfeedfile
="/etc/banip/banip.custom.feeds"
18 ban_allowlist
="/etc/banip/banip.allowlist"
19 ban_blocklist
="/etc/banip/banip.blocklist"
20 ban_mailtemplate
="/etc/banip/banip.tpl"
21 ban_pidfile
="/var/run/banip.pid"
22 ban_rtfile
="/var/run/banip_runtime.json"
23 ban_lock
="/var/run/banip.lock"
25 ban_logreadcmd
="$(command -v logread)"
26 ban_logcmd
="$(command -v logger)"
27 ban_ubuscmd
="$(command -v ubus)"
28 ban_nftcmd
="$(command -v nft)"
29 ban_fw4cmd
="$(command -v fw4)"
30 ban_awkcmd
="$(command -v awk)"
31 ban_grepcmd
="$(command -v grep)"
32 ban_sedcmd
="$(command -v sed)"
33 ban_catcmd
="$(command -v cat)"
34 ban_zcatcmd
="$(command -v zcat)"
35 ban_lookupcmd
="$(command -v nslookup)"
36 ban_mailcmd
="$(command -v msmtp)"
37 ban_mailsender
="no-reply@banIP"
39 ban_mailtopic
="banIP notification"
40 ban_mailprofile
="ban_notify"
41 ban_mailnotifcation
="0"
42 ban_reportelements
="1"
43 ban_nftloglevel
="warn"
44 ban_nftpriority
="-200"
45 ban_nftpolicy
="memory"
58 ban_autoallowuplink
="subnet"
66 ban_blockforwardwan
=""
67 ban_blockforwardlan
=""
85 # gather system information
90 if [ -z "${ban_dev}" ]; then
91 ban_debug
="$(uci_get banip global ban_debug)"
92 ban_cores
="$(uci_get banip global ban_cores)"
94 ban_packages
="$(${ban_ubuscmd} -S call rpc-sys packagelist '{ "all
": true }' 2>/dev/null)"
95 ban_memory
="$("${ban_awkcmd}" '/^MemAvailable/{printf "%s
",int($2/1000)}' "/proc
/meminfo
" 2>/dev/null)"
96 ban_ver
="$(printf "%s
" "${ban_packages}" | jsonfilter -ql1 -e '@.packages.banip')"
97 ban_sysver
="$(${ban_ubuscmd} -S call system board 2>/dev/null | jsonfilter -ql1 -e '@.model' -e '@.release.description' |
98 "${ban_awkcmd}" 'BEGIN{RS="";FS="\n"}{printf "%s
, %s
",$1,$2}')"
99 if [ -z "${ban_cores}" ]; then
100 cpu
="$("${ban_grepcmd}" -c '^processor' /proc/cpuinfo 2>/dev/null)"
101 core
="$("${ban_grepcmd}" -cm1 '^core id' /proc/cpuinfo 2>/dev/null)"
102 [ "${cpu}" = "0" ] && cpu
="1"
103 [ "${core}" = "0" ] && core
="1"
104 ban_cores
="$((cpu * core))"
113 if [ ! -d "${dir}" ]; then
116 f_log
"debug" "f_mkdir ::: directory: ${dir}"
125 if [ ! -f "${file}" ]; then
127 f_log
"debug" "f_mkfile ::: file: ${file}"
131 # create temporary files and directories
134 f_mkdir
"${ban_basedir}"
135 ban_tmpdir
="$(mktemp -p "${ban_basedir}" -d)"
136 ban_tmpfile
="$(mktemp -p "${ban_tmpdir}" -tu)"
138 f_log
"debug" "f_tmp ::: base_dir: ${ban_basedir:-"-"}, tmp_dir: ${ban_tmpdir:-"-"}"
146 if [ -d "${dir}" ]; then
148 f_log
"debug" "f_rmdir ::: directory: ${dir}"
157 if [ "${char}" = "1" ]; then
159 elif [ "${char}" = "0" ] ||
[ -z "${char}" ]; then
162 printf "%s" "${char}"
171 string
="${string#"${string%%[![:space:]]*}"}"
172 string
="${string%"${string##*[![:space:]]}"}"
173 printf "%s" "${string}"
181 ppid
="$("${ban_catcmd}" "${ban_pidfile}" 2>/dev/null)"
182 [ -n "${ppid}" ] && pids
="$(pgrep -P "${ppid}" 2>/dev/null)" ||
return 0
183 for pid
in ${pids}; do
184 kill -INT "${pid}" >/dev
/null
2>&1
192 local class
="${1}" log_msg
="${2}"
194 if [ -n "${log_msg}" ] && { [ "${class}" != "debug" ] || [ "${ban_debug}" = "1" ]; }; then
195 if [ -x "${ban_logcmd}" ]; then
196 "${ban_logcmd}" -p "${class}" -t "banIP-${ban_ver}[${$}]" "${log_msg}"
198 printf "%s
%s
%s
\n" "${class}" "banIP-${ban_ver}[${$}]" "${log_msg}"
201 if [ "${class}" = "err
" ]; then
202 "${ban_nftcmd}" delete table inet banIP >/dev/null 2>&1
203 if [ "${ban_enabled}" = "1" ]; then
205 [ "${ban_mailnotification}" = "1" ] && [ -n "${ban_mailreceiver}" ] && [ -x "${ban_mailcmd}" ] && f_mail
207 f_genstatus "disabled
"
209 f_rmdir "${ban_tmpdir}"
219 unset ban_dev ban_ifv4 ban_ifv6 ban_feed ban_allowurl ban_blockinput ban_blockforwardwan ban_blockforwardlan ban_logterm ban_country ban_asn
224 eval "${option}=\"${value}\""
231 eval "${option}=\"$(printf "%s" "${ban_dev}")${value} \""
234 eval "${option}=\"$(printf "%s" "${ban_ifv4}")${value} \""
237 eval "${option}=\"$(printf "%s" "${ban_ifv6}")${value} \""
240 eval "${option}=\"$(printf "%s" "${ban_feed}")${value} \""
243 eval "${option}=\"$(printf "%s" "${ban_allowurl}")${value} \""
246 eval "${option}=\"$(printf "%s" "${ban_blockinput}")${value} \""
248 "ban_blockforwardwan
")
249 eval "${option}=\"$(printf "%s" "${ban_blockforwardwan}")${value} \""
251 "ban_blockforwardlan
")
252 eval "${option}=\"$(printf "%s" "${ban_blockforwardlan}")${value} \""
255 eval "${option}=\"$(printf "%s" "${ban_logterm}")${value}\\|
\""
258 eval "${option}=\"$(printf "%s" "${ban_country}")${value} \""
261 eval "${option}=\"$(printf "%s" "${ban_asn}")${value} \""
268 [ "${ban_action}" = "boot" ] && [ -z "${ban_trigger}" ] && sleep ${ban_triggerdelay}
271 # get nft/monitor actuals
276 if "${ban_nftcmd}" -t list
set inet banIP allowlistvMAC
>/dev
/null
2>&1; then
281 if pgrep
-f "logread" -P "$("${ban_catcmd}" "${ban_pidfile}" 2>/dev/null)" >/dev
/null
2>&1; then
282 monitor
="$(f_char "1")"
284 monitor
="$(f_char "0")"
286 printf "%s" "nft: ${nft}, monitor: ${monitor}"
292 local item utils insecure update
="0"
294 if { [ "${ban_fetchcmd}" = "uclient-fetch" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"libustream-'; } ||
295 { [ "${ban_fetchcmd}" = "wget" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"wget-ssl'; } ||
296 [ "${ban_fetchcmd}" = "curl" ] ||
[ "${ban_fetchcmd}" = "aria2c" ]; then
297 ban_fetchcmd
="$(command -v "${ban_fetchcmd}")"
302 if [ "${ban_autodetect}" = "1" ] && [ ! -x "${ban_fetchcmd}" ]; then
303 utils
="aria2c curl wget uclient-fetch"
304 for item
in ${utils}; do
305 if { [ "${item}" = "uclient-fetch" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"libustream-'; } ||
306 { [ "${item}" = "wget" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"wget-ssl'; } ||
307 [ "${item}" = "curl" ] ||
[ "${item}" = "aria2c" ]; then
308 ban_fetchcmd
="$(command -v "${item}")"
309 if [ -x "${ban_fetchcmd}" ]; then
311 uci_set banip global ban_fetchcmd
"${item}"
319 [ ! -x "${ban_fetchcmd}" ] && f_log
"err" "no download utility with SSL support"
320 case "${ban_fetchcmd##*/}" in
322 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--check-certificate=false"
323 ban_fetchparm
="${ban_fetchparm:-"${insecure} --timeout=20 --retry-wait=10 --max-tries=${ban_fetchretry} --max-file-not-found=${ban_fetchretry} --allow-overwrite=true --auto-file-renaming=false --log-level=warn --dir=/ -o"}"
326 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--insecure"
327 ban_fetchparm
="${ban_fetchparm:-"${insecure} --connect-timeout 20 --retry-delay 10 --retry ${ban_fetchretry} --retry-all-errors --fail --silent --show-error --location -o"}"
330 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--no-check-certificate"
331 ban_fetchparm
="${ban_fetchparm:-"${insecure} --timeout=20 -O"}"
334 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--no-check-certificate"
335 ban_fetchparm
="${ban_fetchparm:-"${insecure} --no-cache --no-cookies --timeout=20 --waitretry=10 --tries=${ban_fetchretry} --retry-connrefused --max-redirect=0 -O"}"
339 f_log
"debug" "f_getfetch ::: auto/update: ${ban_autodetect}/${update}, cmd: ${ban_fetchcmd:-"-"}, parm: ${ban_fetchparm:-"-"}"
345 local iface update
="0"
347 if [ "${ban_autodetect}" = "1" ]; then
348 if [ -z "${ban_ifv4}" ]; then
350 network_find_wan iface
351 if [ -n "${iface}" ] && "${ban_ubuscmd}" -t 10 wait_for network.interface."${iface}" >/dev
/null
2>&1; then
354 uci_set banip global ban_protov4
"1"
355 uci_add_list banip global ban_ifv4
"${iface}"
356 f_log
"info" "add IPv4 interface '${iface}' to config"
359 if [ -z "${ban_ifv6}" ]; then
361 network_find_wan6 iface
362 if [ -n "${iface}" ] && "${ban_ubuscmd}" -t 10 wait_for network.interface."${iface}" >/dev
/null
2>&1; then
365 uci_set banip global ban_protov6
"1"
366 uci_add_list banip global ban_ifv6
"${iface}"
367 f_log
"info" "add IPv6 interface '${iface}' to config"
371 if [ -n "$(uci -q changes "banip
")" ]; then
375 ban_ifv4
="${ban_ifv4%%?}"
376 ban_ifv6
="${ban_ifv6%%?}"
377 for iface
in ${ban_ifv4} ${ban_ifv6}; do
378 if ! "${ban_ubuscmd}" -t 10 wait_for network.interface.
"${iface}" >/dev
/null
2>&1; then
379 f_log
"err" "no wan interface '${iface}'"
383 [ -z "${ban_ifv4}" ] && [ -z "${ban_ifv6}" ] && f_log
"err" "no wan interfaces"
385 f_log
"debug" "f_getif ::: auto/update: ${ban_autodetect}/${update}, interfaces (4/6): ${ban_ifv4}/${ban_ifv6}, protocols (4/6): ${ban_protov4}/${ban_protov6}"
391 local dev iface update
="0" cnt
="0" cnt_max
="30"
393 if [ "${ban_autodetect}" = "1" ]; then
394 while [ "${cnt}" -lt "${cnt_max}" ] && [ -z "${ban_dev}" ]; do
396 for iface
in ${ban_ifv4} ${ban_ifv6}; do
397 network_get_device dev
"${iface}"
398 if [ -n "${dev}" ]; then
399 if printf "%s" "${dev}" |
"${ban_grepcmd}" -qE "pppoe|6in4"; then
402 if ! printf " %s " "${ban_dev}" | "${ban_grepcmd}" -q " ${dev} "; then
403 ban_dev
="${ban_dev}${dev} "
404 uci_add_list banip global ban_dev
"${dev}"
405 f_log
"info" "add device '${dev}' to config"
413 if [ -n "$(uci -q changes "banip
")" ]; then
417 ban_dev
="${ban_dev%%?}"
418 [ -z "${ban_dev}" ] && f_log
"err" "no wan devices"
420 f_log
"debug" "f_getdev ::: auto/update: ${ban_autodetect}/${update}, devices: ${ban_dev}, cnt: ${cnt}"
426 local uplink iface ip update
="0"
428 if [ "${ban_autoallowlist}" = "1" ] && [ "${ban_autoallowuplink}" != "disable" ]; then
429 for iface
in ${ban_ifv4} ${ban_ifv6}; do
431 if [ "${ban_autoallowuplink}" = "subnet" ]; then
432 network_get_subnet uplink
"${iface}"
433 elif [ "${ban_autoallowuplink}" = "ip" ]; then
434 network_get_ipaddr uplink
"${iface}"
436 if [ -n "${uplink}" ] && ! printf " %s " "${ban_uplink}" | "${ban_grepcmd}" -q " ${uplink} "; then
437 ban_uplink
="${ban_uplink}${uplink} "
439 if [ "${ban_autoallowuplink}" = "subnet" ]; then
440 network_get_subnet6 uplink
"${iface}"
441 elif [ "${ban_autoallowuplink}" = "ip" ]; then
442 network_get_ipaddr6 uplink
"${iface}"
444 if [ -n "${uplink}" ] && ! printf " %s " "${ban_uplink}" | "${ban_grepcmd}" -q " ${uplink} "; then
445 ban_uplink
="${ban_uplink}${uplink} "
448 for ip
in ${ban_uplink}; do
449 if ! "${ban_grepcmd}" -q "${ip} " "${ban_allowlist}"; then
450 if [ "${update}" = "0" ]; then
451 "${ban_sedcmd}" -i '/# uplink added on /d' "${ban_allowlist}"
453 printf "%-42s%s\n" "${ip}" "# uplink added on $(date "+%Y-
%m-
%d
%H
:%M
:%S
")" >>"${ban_allowlist}"
454 f_log
"info" "add uplink '${ip}' to local allowlist"
458 ban_uplink
="${ban_uplink%%?}"
459 elif [ "${ban_autoallowlist}" = "1" ] && [ "${ban_autoallowuplink}" = "disable" ]; then
460 "${ban_sedcmd}" -i '/# uplink added on /d' "${ban_allowlist}"
464 f_log
"debug" "f_getuplink ::: auto/update: ${ban_autoallowlist}/${update}, uplink: ${ban_uplink:-"-"}"
467 # get feed information
471 if [ -s "${ban_customfeedfile}" ]; then
472 if ! json_load_file
"${ban_customfeedfile}" >/dev
/null
2>&1; then
473 f_log
"info" "can't load banIP custom feed file"
474 if ! json_load_file
"${ban_feedfile}" >/dev
/null
2>&1; then
475 f_log
"err" "can't load banIP feed file"
478 elif ! json_load_file
"${ban_feedfile}" >/dev
/null
2>&1; then
479 f_log
"err" "can't load banIP feed file"
488 [ -s "${file}" ] && printf "%s" "elements={ $("${ban_catcmd}" "${file}" 2>/dev/null) };"
491 # build initial nft file with base table, chains and rules
494 local feed_log feed_rc
file="${1}"
497 # nft header (tables and chains)
499 printf "%s\n\n" "#!/usr/sbin/nft -f"
500 if "${ban_nftcmd}" -t list
set inet banIP allowlistvMAC
>/dev
/null
2>&1; then
501 printf "%s\n" "delete table inet banIP"
503 printf "%s\n" "add table inet banIP"
504 printf "%s\n" "add chain inet banIP wan-input { type filter hook input priority ${ban_nftpriority}; policy accept; }"
505 printf "%s\n" "add chain inet banIP wan-forward { type filter hook forward priority ${ban_nftpriority}; policy accept; }"
506 printf "%s\n" "add chain inet banIP lan-forward { type filter hook forward priority ${ban_nftpriority}; policy accept; }"
508 # default wan-input rules
510 printf "%s\n" "add rule inet banIP wan-input ct state established,related counter accept"
511 printf "%s\n" "add rule inet banIP wan-input iifname != { ${ban_dev// /, } } counter accept"
512 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 udp sport 67-68 udp dport 67-68 counter accept"
513 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 udp sport 547 udp dport 546 counter accept"
514 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 icmp type { echo-request } limit rate 1000/second counter accept"
515 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { echo-request } limit rate 1000/second counter accept"
516 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} limit rate 1000/second ip6 hoplimit 1 counter accept"
517 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} limit rate 1000/second ip6 hoplimit 255 counter accept"
519 # default wan-forward rules
521 printf "%s\n" "add rule inet banIP wan-forward ct state established,related counter accept"
522 printf "%s\n" "add rule inet banIP wan-forward iifname != { ${ban_dev// /, } } counter accept"
524 # default lan-forward rules
526 printf "%s\n" "add rule inet banIP lan-forward ct state established,related counter accept"
527 printf "%s\n" "add rule inet banIP lan-forward oifname != { ${ban_dev// /, } } counter accept"
530 # load initial banIP table within nft (atomic load)
532 feed_log
="$("${ban_nftcmd}" -f "${file}" 2>&1)"
535 f_log
"debug" "f_nftinit ::: devices: ${ban_dev}, priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
542 local log_input log_forwardwan log_forwardlan start_ts end_ts tmp_raw tmp_load tmp_file split_file ruleset_raw handle
543 local cnt_set cnt_dl restore_rc feed_direction feed_rc feed_log feed
="${1}" proto="${2}" feed_url="${3}" feed_rule="${4}" feed_flag="${5}"
545 start_ts
="$(date +%s)"
546 feed
="${feed}v${proto}"
547 tmp_load
="${ban_tmpfile}.${feed}.load"
548 tmp_raw
="${ban_tmpfile}.${feed}.raw"
549 tmp_split
="${ban_tmpfile}.${feed}.split"
550 tmp_file
="${ban_tmpfile}.${feed}.file"
551 tmp_flush
="${ban_tmpfile}.${feed}.flush"
552 tmp_nft
="${ban_tmpfile}.${feed}.nft"
553 tmp_allow
="${ban_tmpfile}.${feed%v*}"
555 [ "${ban_loginput}" = "1" ] && log_input="log level ${ban_nftloglevel} prefix \"banIP/inp-wan/drp/${feed}: \""
556 [ "${ban_logforwardwan}" = "1" ] && log_forwardwan="log level ${ban_nftloglevel} prefix \"banIP/fwd-wan/drp/${feed}: \""
557 [ "${ban_logforwardlan}" = "1" ] && log_forwardlan="log level ${ban_nftloglevel} prefix \"banIP/fwd-lan/rej/${feed}: \""
559 # set feed block direction
561 if [ "${ban_blockpolicy}" = "input" ]; then
562 if ! printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}" &&
563 ! printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}" &&
564 ! printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
565 ban_blockinput
="${ban_blockinput} ${feed%v*}"
567 elif [ "${ban_blockpolicy}" = "forwardwan" ]; then
568 if ! printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}" &&
569 ! printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}" &&
570 ! printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
571 ban_blockforwardwan
="${ban_blockforwardwan} ${feed%v*}"
573 elif [ "${ban_blockpolicy}" = "forwardlan" ]; then
574 if ! printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}" &&
575 ! printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}" &&
576 ! printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
577 ban_blockforwardlan
="${ban_blockforwardlan} ${feed%v*}"
580 if printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}"; then
581 feed_direction
="input"
583 if printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
584 feed_direction
="${feed_direction} forwardwan"
586 if printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
587 feed_direction
="${feed_direction} forwardlan"
590 # chain/rule maintenance
592 if [ "${ban_action}" = "reload" ] && "${ban_nftcmd}" -t list set inet banIP "${feed}" >/dev
/null
2>&1; then
593 ruleset_raw
="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
595 printf "%s\n" "flush set inet banIP ${feed}"
596 handle
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables
[@.rule.table
=\"banIP
\"&&@.rule.chain
=\"wan-input
\"][@.
expr[0].match.right
=\"@
${feed}\"].handle
")"
597 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP wan-input handle ${handle}"
598 handle
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables
[@.rule.table
=\"banIP
\"&&@.rule.chain
=\"wan-forward
\"][@.
expr[0].match.right
=\"@
${feed}\"].handle
")"
599 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP wan-forward handle ${handle}"
600 handle
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables
[@.rule.table
=\"banIP
\"&&@.rule.chain
=\"lan-forward
\"][@.
expr[0].match.right
=\"@
${feed}\"].handle
")"
601 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP lan-forward handle ${handle}"
605 # restore local backups during init
607 if { [ "${ban_action}" != "reload" ] || [ "${feed_url}" = "local" ]; } && [ "${feed%v*}" != "allowlist" ] && [ "${feed%v*}" != "blocklist" ]; then
608 f_restore
"${feed}" "${feed_url}" "${tmp_load}"
610 feed_rc
="${restore_rc}"
613 # prepare local allowlist
615 if [ "${feed%v*}" = "allowlist" ] && [ ! -f "${tmp_allow}" ]; then
616 "${ban_catcmd}" "${ban_allowlist}" 2>/dev/null >"${tmp_allow}"
617 for feed_url
in ${ban_allowurl}; do
618 feed_log
="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_load}" "${feed_url}" 2>&1)"
620 if [ "${feed_rc}" = "0" ] && [ -s "${tmp_load}" ]; then
621 "${ban_catcmd}" "${tmp_load}" 2>/dev/null >>"${tmp_allow}"
623 f_log
"info" "download for feed '${feed%v*}' failed (rc: ${feed_rc:-"-"}/log: ${feed_log})"
630 if [ "${feed%v*}" = "allowlist" ]; then
632 printf "%s\n\n" "#!/usr/sbin/nft -f"
633 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
634 if [ "${proto}" = "MAC" ]; then
635 "${ban_awkcmd}" '/^([0-9A-f]{2}:){5}[0-9A-f]{2}([[:space:]]|$)/{printf "%s, ",tolower($1)}' "${tmp_allow}" >"${tmp_file}"
636 printf "%s\n" "add set inet banIP ${feed} { type ether_addr; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
637 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ether saddr @${feed} counter accept"
638 elif [ "${proto}" = "4" ]; then
639 "${ban_awkcmd}" '/^(([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]|$)/{printf "%s, ",$1}' "${tmp_allow}" >"${tmp_file}"
640 printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
641 if [ -z "${feed_direction##*input*}" ]; then
642 if [ "${ban_allowlistonly}" = "1" ]; then
643 printf "%s\n" "add rule inet banIP wan-input ip saddr != @${feed} ${log_input} counter drop"
645 printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} counter accept"
648 if [ -z "${feed_direction##*forwardwan*}" ]; then
649 if [ "${ban_allowlistonly}" = "1" ]; then
650 printf "%s\n" "add rule inet banIP wan-forward ip saddr != @${feed} ${log_forwardwan} counter drop"
652 printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} counter accept"
655 if [ -z "${feed_direction##*forwardlan*}" ]; then
656 if [ "${ban_allowlistonly}" = "1" ]; then
657 printf "%s\n" "add rule inet banIP lan-forward ip daddr != @${feed} ${log_forwardlan} counter reject with icmp type admin-prohibited"
659 printf "%s\n" "add rule inet banIP lan-forward ip daddr @${feed} counter accept"
662 elif [ "${proto}" = "6" ]; then
663 "${ban_awkcmd}" '!/^([0-9A-f]{2}:){5}[0-9A-f]{2}([[:space:]]|$)/{printf "%s\n",$1}' "${tmp_allow}" |
664 "${ban_awkcmd}" '/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{printf "%s, ",tolower($1)}' >"${tmp_file}"
665 printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
666 if [ -z "${feed_direction##*input*}" ]; then
667 if [ "${ban_allowlistonly}" = "1" ]; then
668 printf "%s\n" "add rule inet banIP wan-input ip6 saddr != @${feed} ${log_input} counter drop"
670 printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} counter accept"
673 if [ -z "${feed_direction##*forwardwan*}" ]; then
674 if [ "${ban_allowlistonly}" = "1" ]; then
675 printf "%s\n" "add rule inet banIP wan-forward ip6 saddr != @${feed} ${log_forwardwan} counter drop"
677 printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} counter accept"
680 if [ -z "${feed_direction##*forwardlan*}" ]; then
681 if [ "${ban_allowlistonly}" = "1" ]; then
682 printf "%s\n" "add rule inet banIP lan-forward ip6 daddr != @${feed} ${log_forwardlan} counter reject with icmpv6 type admin-prohibited"
684 printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} counter accept"
690 elif [ "${feed%v*}" = "blocklist" ]; then
692 printf "%s\n\n" "#!/usr/sbin/nft -f"
693 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
694 if [ "${proto}" = "MAC" ]; then
695 "${ban_awkcmd}" '/^([0-9A-f]{2}:){5}[0-9A-f]{2}([[:space:]]|$)/{printf "%s, ",tolower($1)}' "${ban_blocklist}" >"${tmp_file}"
696 printf "%s\n" "add set inet banIP ${feed} { type ether_addr; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
697 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ether saddr @${feed} ${log_forwardlan} counter reject"
698 elif [ "${proto}" = "4" ]; then
699 if [ "${ban_deduplicate}" = "1" ]; then
700 "${ban_awkcmd}" '/^(([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]|$)/{printf "%s,\n",$1}' "${ban_blocklist}" >"${tmp_raw}"
701 "${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null >"${tmp_split}"
702 "${ban_awkcmd}" 'BEGIN{FS="[ ,]"}NR==FNR{member[$1];next}!($1 in member)' "${ban_tmpfile}.deduplicate" "${ban_blocklist}" 2>/dev/null >"${tmp_raw}"
703 "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >"${ban_blocklist}"
705 "${ban_awkcmd}" '/^(([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]]|$)/{printf "%s,\n",$1}' "${ban_blocklist}" >"${tmp_split}"
707 "${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}"
708 printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval, timeout; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
709 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} ${log_input} counter drop"
710 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} ${log_forwardwan} counter drop"
711 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip daddr @${feed} ${log_forwardlan} counter reject with icmp type admin-prohibited"
712 elif [ "${proto}" = "6" ]; then
713 if [ "${ban_deduplicate}" = "1" ]; then
714 "${ban_awkcmd}" '!/^([0-9A-f]{2}:){5}[0-9A-f]{2}([[:space:]]|$)/{printf "%s\n",$1}' "${ban_blocklist}" |
715 "${ban_awkcmd}" '/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{printf "%s,\n",tolower($1)}' >"${tmp_raw}"
716 "${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null >"${tmp_split}"
717 "${ban_awkcmd}" 'BEGIN{FS="[ ,]"}NR==FNR{member[$1];next}!($1 in member)' "${ban_tmpfile}.deduplicate" "${ban_blocklist}" 2>/dev/null >"${tmp_raw}"
718 "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >"${ban_blocklist}"
720 "${ban_awkcmd}" '!/^([0-9A-f]{2}:){5}[0-9A-f]{2}([[:space:]]|$)/{printf "%s\n",$1}' "${ban_blocklist}" |
721 "${ban_awkcmd}" '/^(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]]|$)/{printf "%s,\n",tolower($1)}' >"${tmp_split}"
723 "${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}"
724 printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval, timeout; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
725 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} ${log_input} counter drop"
726 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} ${log_forwardwan} counter drop"
727 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} ${log_forwardlan} counter reject with icmpv6 type admin-prohibited"
732 # handle external feeds
734 elif [ "${restore_rc}" != "0" ] && [ "${feed_url}" != "local" ]; then
735 # handle country downloads
737 if [ "${feed%v*}" = "country" ]; then
738 for country
in ${ban_country}; do
739 feed_log
="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}${country}-aggregated.zone
" 2>&1)"
741 [ "${feed_rc}" = "0" ] && "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >>"${tmp_load}"
745 # handle asn downloads
747 elif [ "${feed%v*}" = "asn" ]; then
748 for asn
in ${ban_asn}; do
749 feed_log
="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}AS${asn}" 2>&1)"
751 [ "${feed_rc}" = "0" ] && "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >>"${tmp_load}"
755 # handle compressed downloads
757 elif [ -n "${feed_flag}" ]; then
758 case "${feed_flag}" in
760 feed_log
="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}" 2>&1)"
762 if [ "${feed_rc}" = "0" ]; then
763 "${ban_zcatcmd}" "${tmp_raw}" 2>/dev/null >"${tmp_load}"
770 # handle normal downloads
773 feed_log
="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_load}" "${feed_url}" 2>&1)"
777 [ "${feed_rc}" != "0" ] && f_log "info" "download for feed '${feed}' failed (rc: ${feed_rc:-"-"}/log: ${feed_log})"
781 if [ "${restore_rc}" != "0" ] && [ "${feed_rc}" = "0" ] && [ "${feed_url}" != "local" ] && [ ! -s "${tmp_nft}" ]; then
782 f_backup
"${feed}" "${tmp_load}"
784 elif [ -z "${restore_rc}" ] && [ "${feed_rc}" != "0" ] && [ "${feed_url}" != "local" ] && [ ! -s "${tmp_nft}" ]; then
785 f_restore
"${feed}" "${feed_url}" "${tmp_load}" "${feed_rc}"
789 # build nft file with Sets and rules for regular downloads
791 if [ "${feed_rc}" = "0" ] && [ ! -s "${tmp_nft}" ]; then
794 if [ "${ban_deduplicate}" = "1" ] && [ "${feed_url}" != "local" ]; then
795 "${ban_awkcmd}" "${feed_rule}" "${tmp_load}" 2>/dev/null >"${tmp_raw}"
796 "${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null | tee -a "${ban_tmpfile}.deduplicate" >"${tmp_split}"
798 "${ban_awkcmd}" "${feed_rule}" "${tmp_load}" 2>/dev/null >"${tmp_split}"
803 if [ "${feed_rc}" = "0" ]; then
804 if [ -n "${ban_splitsize//[![:digit]]/}" ] && [ "${ban_splitsize//[![:digit]]/}" -gt "0" ]; then
805 if ! "${ban_awkcmd}" "NR%${ban_splitsize//[![:digit]]/}==1{file=\"${tmp_file}.\"++i;}{ORS=\" \";print > file}" "${tmp_split}" 2>/dev
/null
; then
806 rm -f "${tmp_file}".
*
807 f_log
"info" "can't split Set '${feed}' to size '${ban_splitsize//[![:digit]]/}'"
810 "${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}.1"
814 rm -f "${tmp_raw}" "${tmp_load}"
815 if [ "${feed_rc}" = "0" ] && [ "${proto}" = "4" ]; then
817 # nft header (IPv4 Set)
819 printf "%s\n\n" "#!/usr/sbin/nft -f"
820 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
821 printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}.1") }"
823 # input and forward rules
825 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} ${log_input} counter drop"
826 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} ${log_forwardwan} counter drop"
827 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip daddr @${feed} ${log_forwardlan} counter reject with icmp type admin-prohibited"
829 elif [ "${feed_rc}" = "0" ] && [ "${proto}" = "6" ]; then
831 # nft header (IPv6 Set)
833 printf "%s\n\n" "#!/usr/sbin/nft -f"
834 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
835 printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}.1") }"
837 # input and forward rules
839 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} ${log_input} counter drop"
840 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} ${log_forwardwan} counter drop"
841 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} ${log_forwardlan} counter reject with icmpv6 type admin-prohibited"
846 # load generated nft file in banIP table
848 if [ "${feed_rc}" = "0" ]; then
849 cnt_dl
="$("${ban_awkcmd}" 'END{printf "%d
",NR}' "${tmp_split}" 2>/dev/null)"
850 if [ "${cnt_dl:-"0"}" -gt "0" ] || [ "${feed_url}" = "local" ] || [ "${feed%v*}" = "allowlist" ] || [ "${feed%v*}" = "blocklist" ]; then
851 feed_log
="$("${ban_nftcmd}" -f "${tmp_nft}" 2>&1)"
854 # load additional split files
856 if [ "${feed_rc}" = "0" ]; then
857 for split_file
in "${tmp_file}".
*; do
858 [ ! -f "${split_file}" ] && break
859 if [ "${split_file##*.}" = "1" ]; then
860 rm -f "${split_file}"
863 if ! "${ban_nftcmd}" add element inet banIP "${feed}" "{ $("${ban_catcmd}" "${split_file}") }" >/dev
/null
2>&1; then
864 f_log
"info" "can't add split file '${split_file##*.}' to Set '${feed}'"
866 rm -f "${split_file}"
868 if [ "${ban_debug}" = "1" ] && [ "${ban_reportelements}" = "1" ]; then
869 cnt_set
="$("${ban_nftcmd}" -j list set inet banIP "${feed}" 2>/dev/null | jsonfilter -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)"
873 f_log
"info" "skip empty feed '${feed}'"
876 rm -f "${tmp_split}" "${tmp_nft}"
879 f_log
"debug" "f_down ::: name: ${feed}, cnt_dl: ${cnt_dl:-"-"}, cnt_set: ${cnt_set:-"-"}, split_size: ${ban_splitsize:-"-"}, time: $((end_ts - start_ts)), rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
885 local backup_rc feed
="${1}" feed_file
="${2}"
887 gzip -cf "${feed_file}" >"${ban_backupdir}/banIP.${feed}.gz"
890 f_log
"debug" "f_backup ::: name: ${feed}, source: ${feed_file##*/}, target: banIP.${feed}.gz, rc: ${backup_rc}"
897 local tmp_feed restore_rc
="1" feed
="${1}" feed_url="${2}" feed_file="${3}" feed_rc="${4:-"0"}"
899 [ "${feed_rc}" != "0" ] && restore_rc
="${feed_rc}"
900 [ "${feed_url}" = "local" ] && tmp_feed="${feed%v*}v4" || tmp_feed="${feed}"
901 if [ -f "${ban_backupdir}/banIP.${tmp_feed}.gz" ]; then
902 "${ban_zcatcmd}" "${ban_backupdir}/banIP.${tmp_feed}.gz" 2>/dev/null >"${feed_file}"
906 f_log
"debug" "f_restore ::: name: ${feed}, source: banIP.${tmp_feed}.gz, target: ${feed_file##*/}, in_rc: ${feed_rc}, rc: ${restore_rc}"
910 # remove disabled Sets
913 local feedlist tmp_del ruleset_raw item table_sets handle del_set feed_log feed_rc
916 json_get_keys feedlist
917 tmp_del
="${ban_tmpfile}.final.delete"
918 ruleset_raw
="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
919 table_sets
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -qe '@.nftables[@.set.table="banIP
"].set.name')"
921 printf "%s\n\n" "#!/usr/sbin/nft -f"
922 for item
in ${table_sets}; do
923 if ! printf "%s" "allowlist blocklist ${ban_feed}" | "${ban_grepcmd}" -q "${item%v*}" ||
924 ! printf "%s" "allowlist blocklist ${feedlist}" | "${ban_grepcmd}" -q "${item%v*}"; then
925 del_set
="${del_set}${item}, "
926 rm -f "${ban_backupdir}/banIP.${item}.gz"
927 printf "%s\n" "flush set inet banIP ${item}"
928 handle
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables
[@.rule.table
=\"banIP
\"&&@.rule.chain
=\"wan-input
\"][@.
expr[0].match.right
=\"@
${item}\"].handle
")"
929 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP wan-input handle ${handle}"
930 handle
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables
[@.rule.table
=\"banIP
\"&&@.rule.chain
=\"wan-forward
\"][@.
expr[0].match.right
=\"@
${item}\"].handle
")"
931 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP wan-forward handle ${handle}"
932 handle
="$(printf "%s
\n" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables
[@.rule.table
=\"banIP
\"&&@.rule.chain
=\"lan-forward
\"][@.
expr[0].match.right
=\"@
${item}\"].handle
")"
933 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP lan-forward handle ${handle}"
934 printf "%s\n\n" "delete set inet banIP ${item}"
939 if [ -n "${del_set}" ]; then
940 del_set
="${del_set%%??}"
941 feed_log
="$("${ban_nftcmd}" -f "${tmp_del}" 2>&1)"
946 f_log
"debug" "f_rmset ::: sets: ${del_set:-"-"}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
949 # generate status information
952 local object duration item table_sets cnt_elements
="0" custom
="0" split="0" status
="${1}"
954 [ -z "${ban_dev}" ] && f_conf
955 if [ "${status}" = "active" ]; then
956 if [ -n "${ban_starttime}" ]; then
957 ban_endtime
="$(date "+%s
")"
958 duration
="$(((ban_endtime - ban_starttime) / 60))m $(((ban_endtime - ban_starttime) % 60))s"
960 table_sets
="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null | jsonfilter -qe '@.nftables[@.set.table="banIP
"].set.name')"
961 if [ "${ban_reportelements}" = "1" ]; then
962 for item
in ${table_sets}; do
963 cnt_elements
="$((cnt_elements + $("${ban_nftcmd}" -j list set inet banIP "${item}" 2>/dev/null | jsonfilter -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)))"
966 runtime
="action: ${ban_action:-"-"}, duration: ${duration:-"-"}, date: $(date "+%Y-
%m-
%d
%H
:%M
:%S
")"
968 [ -s ${ban_customfeedfile} ] && custom
="1"
969 [ ${ban_splitsize:-"0"} -gt "0" ] && split="1"
973 json_load_file
"${ban_rtfile}" >/dev
/null
2>&1
974 json_add_string
"status" "${status}"
975 json_add_string
"version" "${ban_ver}"
976 json_add_string
"element_count" "${cnt_elements}"
977 json_add_array
"active_feeds"
978 for object
in ${table_sets:-"-"}; do
980 json_add_string
"feed" "${object}"
984 json_add_array
"active_devices"
985 for object
in ${ban_dev:-"-"}; do
987 json_add_string
"device" "${object}"
990 for object
in ${ban_ifv4:-"-"} ${ban_ifv6:-"-"}; do
992 json_add_string
"interface" "${object}"
996 json_add_array
"active_uplink"
997 for object
in ${ban_uplink:-"-"}; do
999 json_add_string
"uplink" "${object}"
1003 json_add_string
"nft_info" "priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, expiry: ${ban_nftexpiry:-"-"}"
1004 json_add_string
"run_info" "base: ${ban_basedir}, backup: ${ban_backupdir}, report: ${ban_reportdir}, feed/custom: ${ban_feedfile}/$(f_char ${custom})"
1005 json_add_string
"run_flags" "auto: $(f_char ${ban_autodetect}), proto (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (wan-inp/wan-fwd/lan-fwd): $(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), dedup: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), allowed only: $(f_char ${ban_allowlistonly})"
1006 json_add_string
"last_run" "${runtime:-"-"}"
1007 json_add_string
"system_info" "cores: ${ban_cores}, memory: ${ban_memory}, device: ${ban_sysver}"
1008 json_dump
>"${ban_rtfile}"
1011 # get status information
1014 local key keylist
type value index_key1 index_key2 index_value1 index_value2
1016 [ -z "${ban_dev}" ] && f_conf
1017 json_load_file
"${ban_rtfile}" >/dev
/null
2>&1
1018 if json_get_keys keylist
; then
1019 printf "%s\n" "::: banIP runtime information"
1020 for key
in ${keylist}; do
1021 json_get_var value
"${key}" >/dev
/null
2>&1
1022 if [ "${key}" = "status" ]; then
1023 value
="${value} ($(f_actual))"
1024 elif [ "${key}" = "active_devices" ]; then
1025 json_select
"${key}" >/dev
/null
2>&1
1027 while json_get_type
type "${index}" && [ "${type}" = "object" ]; do
1028 json_get_keys index_key1
"${index}" >/dev
/null
2>&1
1029 json_get_keys index_key2
"$((index + 1))" >/dev
/null
2>&1
1030 json_get_values index_value1
"${index}" >/dev
/null
2>&1
1031 if [ "${index}" = "1" ] && [ "${index_key1// /}" = "device" ] && [ "${index_key2// /}" = "interface" ]; then
1032 json_get_values index_value2
"$((index + 1))" >/dev
/null
2>&1
1033 value
="${index_value1} ::: ${index_value2}"
1034 index
="$((index + 1))"
1035 elif [ "${index}" = "1" ]; then
1036 value
="${index_value1}"
1037 elif [ "${index}" != "1" ] && [ "${index_key1// /}" = "device" ] && [ "${index_key2// /}" = "interface" ]; then
1038 json_get_values index_value2
"$((index + 1))" >/dev
/null
2>&1
1039 value
="${value}, ${index_value1} ::: ${index_value2}"
1040 index
="$((index + 1))"
1041 elif [ "${index}" != "1" ]; then
1042 value
="${value}, ${index_value1}"
1044 index
="$((index + 1))"
1047 elif [ "${key%_*}" = "active" ]; then
1048 json_select
"${key}" >/dev
/null
2>&1
1050 while json_get_type
type "${index}" && [ "${type}" = "object" ]; do
1051 json_get_values index_value1
"${index}" >/dev
/null
2>&1
1052 if [ "${index}" = "1" ]; then
1053 value
="${index_value1}"
1055 value
="${value}, ${index_value1}"
1057 index
="$((index + 1))"
1061 printf " + %-17s : %s\n" "${key}" "${value:-"-"}"
1064 printf "%s\n" "::: no banIP runtime information available"
1071 local cnt list domain lookup ip elementsv4 elementsv6 start_time end_time duration cnt_domain
="0" cnt_ip
="0" feed
="${1}"
1073 [ -z "${ban_dev}" ] && f_conf
1074 start_time
="$(date "+%s
")"
1075 if [ "${feed}" = "allowlist" ]; then
1076 list
="$("${ban_awkcmd}" '/^([[:alnum:]_-]{1,63}\.)+[[:alpha:]]+([[:space:]]|$)/{printf "%s
",tolower($1)}' "${ban_allowlist}" 2>/dev/null)"
1077 elif [ "${feed}" = "blocklist" ]; then
1078 list
="$("${ban_awkcmd}" '/^([[:alnum:]_-]{1,63}\.)+[[:alpha:]]+([[:space:]]|$)/{printf "%s
",tolower($1)}' "${ban_blocklist}" 2>/dev/null)"
1081 for domain
in ${list}; do
1082 lookup
="$("${ban_lookupcmd}" "${domain}" ${ban_resolver} 2>/dev/null | "${ban_awkcmd}" '/^Address[ 0-9]*: /{if(!seen[$NF]++)printf "%s ",$NF}' 2>/dev/null)"
1083 for ip in ${lookup}; do
1084 if [ "${ip%%.*}" = "0" ] || [ -z "${ip%%::*}" ]; then
1087 if { [ "${feed}" = "allowlist" ] && ! "${ban_grepcmd}" -q "^${ip}" "${ban_allowlist}"; } ||
1088 { [ "${feed}" = "blocklist" ] && ! "${ban_grepcmd}" -q "^${ip}" "${ban_blocklist}"; }; then
1089 if [ "${ip##*:}" = "${ip}" ]; then
1090 elementsv4="${elementsv4} ${ip},"
1092 elementsv6="${elementsv6} ${ip},"
1094 if [ "${feed}" = "allowlist" ] && [ "${ban_autoallowlist}" = "1" ]; then
1095 printf "%-42s%s\n" "${ip}" "# '${domain}' added on $(date "+%Y-%m-%d %H:%M:%S")" >>"${ban_allowlist}"
1096 elif [ "${feed}" = "blocklist" ] && [ "${ban_autoblocklist}" = "1" ]; then
1097 printf "%-42s%s\n" "${ip}" "# '${domain}' added on $(date "+%Y-%m-%d %H:%M:%S")" >>"${ban_blocklist}"
1099 cnt_ip="$((cnt_ip + 1))"
1103 cnt_domain="$((cnt_domain + 1))"
1105 if [ -n "${elementsv4}" ]; then
1106 if ! "${ban_nftcmd}" add element inet banIP "${feed}v4" "{ ${elementsv4} }" >/dev/null 2>&1; then
1107 f_log "info" "can't add lookup
file to Set
'${feed}v4'"
1110 if [ -n "${elementsv6}" ]; then
1111 if ! "${ban_nftcmd}" add element inet banIP "${feed}v6" "{ ${elementsv6} }" >/dev/null 2>&1; then
1112 f_log "info
" "can
't add lookup file to Set '${feed}v6
'"
1115 end_time="$(date "+%s")"
1116 duration="$(((end_time - start_time) / 60))m $(((end_time - start_time) % 60))s"
1118 f_log "debug" "f_lookup ::: feed: ${feed}, domains: ${cnt_domain}, IPs: ${cnt_ip}, duration: ${duration}"
1124 local report_jsn report_txt tmp_val ruleset_raw item table_sets set_cnt set_input set_forwardwan set_forwardlan set_cntinput set_cntforwardwan set_cntforwardlan output="${1}"
1125 local detail set_details jsnval timestamp autoadd_allow autoadd_block sum_sets sum_setinput sum_setforwardwan sum_setforwardlan sum_setelements sum_cntinput sum_cntforwardwan sum_cntforwardlan
1127 [ -z "${ban_dev}" ] && f_conf
1128 f_mkdir "${ban_reportdir}"
1129 report_jsn="${ban_reportdir}/ban_report.jsn"
1130 report_txt="${ban_reportdir}/ban_report.txt"
1132 # json output preparation
1134 ruleset_raw="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
1135 table_sets="$(printf "%s" "${ruleset_raw}" | jsonfilter -qe '@.nftables
[@.
set.table
="banIP"].
set.name
')"
1138 sum_setforwardwan="0"
1139 sum_setforwardlan="0"
1142 sum_cntforwardwan="0"
1143 sum_cntforwardlan="0"
1144 timestamp="$(date "+%Y-%m-%d %H:%M:%S")"
1148 printf "\t%s\n" '"sets":{'
1149 for item in ${table_sets}; do
1150 set_cntinput="$(printf "%s" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-input\"][@.expr[0].match.right=\"@${item}\"].expr[*].counter.packets")"
1151 set_cntforwardwan="$(printf "%s" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-forward\"][@.expr[0].match.right=\"@${item}\"].expr[*].counter.packets")"
1152 set_cntforwardlan="$(printf "%s" "${ruleset_raw}" | jsonfilter -l1 -qe "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[0].match.right=\"@${item}\"].expr[*].counter.packets")"
1153 if [ "${ban_reportelements}" = "1" ]; then
1154 set_cnt="$("${ban_nftcmd}" -j list set inet banIP "${item}" 2>/dev/null | jsonfilter -qe '@.nftables
[*].
set.elem
[*]' | wc -l 2>/dev/null)"
1155 sum_setelements="$((sum_setelements + set_cnt))"
1158 sum_setelements="n/a"
1160 if [ -n "${set_cntinput}" ]; then
1162 sum_setinput="$((sum_setinput + 1))"
1163 sum_cntinput="$((sum_cntinput + set_cntinput))"
1168 if [ -n "${set_cntforwardwan}" ]; then
1170 sum_setforwardwan="$((sum_setforwardwan + 1))"
1171 sum_cntforwardwan="$((sum_cntforwardwan + set_cntforwardwan))"
1174 set_cntforwardwan=""
1176 if [ -n "${set_cntforwardlan}" ]; then
1178 sum_setforwardlan="$((sum_setforwardlan + 1))"
1179 sum_cntforwardlan="$((sum_cntforwardlan + set_cntforwardlan))"
1182 set_cntforwardlan=""
1184 [ "${sum_sets}" -gt "0" ] && printf "%s\n" ","
1185 printf "\t\t%s\n" "\"${item}\":{"
1186 printf "\t\t\t%s\n" "\"cnt_elements\": \"${set_cnt}\","
1187 printf "\t\t\t%s\n" "\"cnt_input\": \"${set_cntinput}\","
1188 printf "\t\t\t%s\n" "\"input\": \"${set_input}\","
1189 printf "\t\t\t%s\n" "\"cnt_forwardwan\": \"${set_cntforwardwan}\","
1190 printf "\t\t\t%s\n" "\"wan_forward\": \"${set_forwardwan}\","
1191 printf "\t\t\t%s\n" "\"cnt_forwardlan\": \"${set_cntforwardlan}\","
1192 printf "\t\t\t%s\n" "\"lan_forward\": \"${set_forwardlan}\""
1194 sum_sets="$((sum_sets + 1))"
1196 printf "\n\t%s\n" "},"
1197 printf "\t%s\n" "\"timestamp\": \"${timestamp}\","
1198 printf "\t%s\n" "\"autoadd_allow\": \"$("${ban_grepcmd}" -c "added on ${timestamp% *}" "${ban_allowlist}")\","
1199 printf "\t%s\n" "\"autoadd_block\": \"$("${ban_grepcmd}" -c "added on ${timestamp% *}" "${ban_blocklist}")\","
1200 printf "\t%s\n" "\"sum_sets\": \"${sum_sets}\","
1201 printf "\t%s\n" "\"sum_setinput\": \"${sum_setinput}\","
1202 printf "\t%s\n" "\"sum_setforwardwan\": \"${sum_setforwardwan}\","
1203 printf "\t%s\n" "\"sum_setforwardlan\": \"${sum_setforwardlan}\","
1204 printf "\t%s\n" "\"sum_setelements\": \"${sum_setelements}\","
1205 printf "\t%s\n" "\"sum_cntinput\": \"${sum_cntinput}\","
1206 printf "\t%s\n" "\"sum_cntforwardwan\": \"${sum_cntforwardwan}\","
1207 printf "\t%s\n" "\"sum_cntforwardlan\": \"${sum_cntforwardlan}\""
1211 # text output preparation
1213 if [ "${output}" != "json" ] && [ -s "${report_jsn}" ]; then
1216 if json_load_file "${report_jsn}" >/dev/null 2>&1; then
1217 json_get_var timestamp "timestamp" >/dev/null 2>&1
1218 json_get_var autoadd_allow "autoadd_allow" >/dev/null 2>&1
1219 json_get_var autoadd_block "autoadd_block" >/dev/null 2>&1
1220 json_get_var sum_sets "sum_sets" >/dev/null 2>&1
1221 json_get_var sum_setinput "sum_setinput" >/dev/null 2>&1
1222 json_get_var sum_setforwardwan "sum_setforwardwan" >/dev/null 2>&1
1223 json_get_var sum_setforwardlan "sum_setforwardlan" >/dev/null 2>&1
1224 json_get_var sum_setelements "sum_setelements" >/dev/null 2>&1
1225 json_get_var sum_cntinput "sum_cntinput" >/dev/null 2>&1
1226 json_get_var sum_cntforwardwan "sum_cntforwardwan" >/dev/null 2>&1
1227 json_get_var sum_cntforwardlan "sum_cntforwardlan" >/dev/null 2>&1
1229 printf "%s\n%s\n%s\n" ":::" "::: banIP Set Statistics" ":::"
1230 printf "%s\n" " Timestamp: ${timestamp}"
1231 printf "%s\n" " ------------------------------"
1232 printf "%s\n" " auto-added to allowlist today: ${autoadd_allow}"
1233 printf "%s\n\n" " auto-added to blocklist today: ${autoadd_block}"
1234 json_select "sets" >/dev/null 2>&1
1235 json_get_keys table_sets >/dev/null 2>&1
1236 if [ -n "${table_sets}" ]; then
1237 printf "%-25s%-15s%-24s%-24s%s\n" " Set" "| Elements" "| WAN-Input (packets)" "| WAN-Forward (packets)" "| LAN-Forward (packets)"
1238 printf "%s\n" " ---------------------+--------------+-----------------------+-----------------------+------------------------"
1239 for item in ${table_sets}; do
1240 printf " %-21s" "${item}"
1241 json_select "${item}"
1242 json_get_keys set_details
1243 for detail in ${set_details}; do
1244 json_get_var jsnval "${detail}" >/dev/null 2>&1
1247 printf "%-15s" "| ${jsnval}"
1249 "cnt_input" | "cnt_forwardwan" | "cnt_forwardlan")
1250 [ -n "${jsnval}" ] && tmp_val=": ${jsnval}"
1253 printf "%-24s" "| ${jsnval}${tmp_val}"
1261 printf "%s\n" " ---------------------+--------------+-----------------------+-----------------------+------------------------"
1262 printf "%-25s%-15s%-24s%-24s%s\n" " ${sum_sets}" "| ${sum_setelements}" "| ${sum_setinput} (${sum_cntinput})" "| ${sum_setforwardwan} (${sum_cntforwardwan})" "| ${sum_setforwardlan} (${sum_cntforwardlan})"
1268 # output channel (text|json|mail)
1272 [ -s "${report_txt}" ] && "${ban_catcmd}" "${report_txt}"
1275 [ -s "${report_jsn}" ] && "${ban_catcmd}" "${report_jsn}"
1278 [ -n "${ban_mailreceiver}" ] && [ -x "${ban_mailcmd}" ] && f_mail
1281 rm -f "${report_txt}"
1287 local item table_sets ip proto hold cnt result_flag="/var/run/banIP.search" input="${1}"
1289 if [ -n "${input}" ]; then
1290 ip="$(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9]{1,3}\\.){3}[0-9]{1,3})+"}{printf "%s",RT}')"
1291 [ -n "${ip}" ] && proto="v4
"
1292 if [ -z "${proto}" ]; then
1293 ip="$
(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="([A-Fa-f0-9]{1,4}::?){3,7}[A-Fa-f0-9]{1,4}"}{printf "%s",RT
}')"
1294 [ -n "${ip}" ] && proto="v6"
1297 if [ -n "${proto}" ]; then
1298 table_sets="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null | jsonfilter -qe "@.nftables[@.set.table=\"banIP\"&&@.set.type=\"ip${proto}_addr\"].set.name")"
1300 printf "%s\n%s\n%s\n" ":::" "::: no valid search input" ":::"
1303 printf "%s\n%s\n%s\n" ":::" "::: banIP Search" ":::"
1304 printf " %s\n" "Looking for IP '${ip}' on $(date "+%Y-%m-%d %H:%M:%S")"
1305 printf " %s\n" "---"
1307 for item in ${table_sets}; do
1308 if [ -f "${result_flag}" ]; then
1309 rm -f "${result_flag}"
1313 if "${ban_nftcmd}" get element inet banIP "${item}" "{ ${ip} }" >/dev/null 2>&1; then
1314 printf " %s\n" "IP found in Set '${item}'"
1318 hold="$((cnt % ban_cores))"
1319 [ "${hold}" = "0" ] && wait
1323 printf " %s\n" "IP not found"
1329 local set_elements input="${1}"
1331 if [ -z "${input}" ]; then
1332 printf "%s\n%s\n%s\n" ":::" "::: no valid survey input" ":::"
1335 set_elements="$("${ban_nftcmd}" -j list set inet banIP "${input}" 2>/dev/null | jsonfilter -qe '@.nftables
[*].
set.elem
[*]')"
1336 printf "%s\n%s\n%s\n" ":::" "::: banIP Survey" ":::"
1337 printf " %s\n" "List of elements in the Set '${input}' on $(date "+%Y-%m-%d %H:%M:%S")"
1338 printf " %s\n" "---"
1339 [ -n "${set_elements}" ] && printf "%s\n" "${set_elements}" || printf " %s\n" "empty Set"
1347 # load mail template
1349 if [ -r "${ban_mailtemplate}" ]; then
1350 . "${ban_mailtemplate}"
1352 f_log "info" "no mail template"
1354 [ -z "${mail_text}" ] && f_log "info" "no mail content"
1355 [ "${ban_debug}" = "1" ] && msmtp_debug="--debug"
1359 ban_mailhead="From: ${ban_mailsender}\nTo: ${ban_mailreceiver}\nSubject: ${ban_mailtopic}\nReply-to: ${ban_mailsender}\nMime-Version: 1.0\nContent-Type: text/html;charset=utf-8\nContent-Disposition: inline\n\n"
1360 printf "%b" "${ban_mailhead}${mail_text}" | "${ban_mailcmd}" --timeout=10 ${msmtp_debug} -a "${ban_mailprofile}" "${ban_mailreceiver}" >/dev/null 2>&1
1361 f_log "info" "send status mail (${?})"
1363 f_log "debug" "f_mail ::: notification: ${ban_mailnotification}, template: ${ban_mailtemplate}, profile: ${ban_mailprofile}, receiver: ${ban_mailreceiver}, rc: ${?}"
1369 local nft_expiry line proto ip log_raw log_count
1371 if [ -x "${ban_logreadcmd}" ] && [ -n "${ban_logterm%%??}" ] && [ "${ban_loglimit}" != "0" ]; then
1372 f_log "info" "start detached banIP log service"
1373 [ -n "${ban_nftexpiry}" ] && nft_expiry="timeout $(printf "%s" "${ban_nftexpiry}" | "${ban_grepcmd}" -oE "([0-9]+[d|h|m|s])+$")"
1374 # read log continuously with given logterms
1376 "${ban_logreadcmd}" -fe "${ban_logterm%%??}" 2>/dev/null |
1377 while read -r line; do
1381 ip="$(printf "%s" "${line}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9]{1,3}\\.){3}[0-9]{1,3})+"}{if(!seen[RT]++)printf "%s ",RT}')"
1382 ip="$
(f_trim
"${ip}")"
1384 [ -n "${ip}" ] && proto="v4
"
1385 if [ -z "${proto}" ]; then
1388 ip="$
(printf "%s" "${line}" | "${ban_awkcmd}" 'BEGIN{RS="([A-Fa-f0-9]{1,4}::?){3,7}[A-Fa-f0-9]{1,4}"}{if(!seen
[RT
]++)printf "%s ",RT
}')"
1389 ip="$(f_trim "${ip}")"
1391 [ -n "${ip}" ] && proto="v6"
1393 if [ -n "${proto}" ] && ! "${ban_nftcmd}" get element inet banIP blocklist"${proto}" "{ ${ip} }" >/dev/null 2>&1; then
1394 f_log "info" "suspicious IP${proto} '${ip}'"
1395 log_raw="$("${ban_logreadcmd}" -l "${ban_loglimit}" 2>/dev/null)"
1396 log_count="$(printf "%s\n" "${log_raw}" | "${ban_grepcmd}" -c "suspicious IP${proto} '${ip}'")"
1397 if [ "${log_count}" -ge "${ban_logcount}" ]; then
1398 if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" "{ ${ip} ${nft_expiry} }" >/dev
/null
2>&1; then
1399 f_log
"info" "add IP${proto} '${ip}' (expiry: ${ban_nftexpiry:-"-"}) to blocklist${proto} set"
1400 if [ -z "${ban_nftexpiry}" ] && [ "${ban_autoblocklist}" = "1" ] && ! "${ban_grepcmd}" -q "^${ip}" "${ban_blocklist}"; then
1401 printf "%-42s%s\n" "${ip}" "# added on $(date "+%Y-
%m-
%d
%H
:%M
:%S
")" >>"${ban_blocklist}"
1402 f_log
"info" "add IP${proto} '${ip}' to local blocklist"
1409 # start detached no-op service loop
1412 f_log
"info" "start detached no-op banIP service"
1421 if [ -r "/lib/functions.sh" ] && [ -r "/lib/functions/network.sh" ] && [ -r "/usr/share/libubox/jshn.sh" ]; then
1422 .
"/lib/functions.sh"
1423 .
"/lib/functions/network.sh"
1424 .
"/usr/share/libubox/jshn.sh"
1426 rm -rf "${ban_lock}"
1430 # check banIP availability
1433 if [ "${ban_action}" != "stop" ]; then
1434 [ ! -d "/etc/banip" ] && f_log
"err" "no banIP config directory"
1435 [ ! -r "/etc/config/banip" ] && f_log
"err" "no banIP config"
1436 [ "$(uci_get banip global ban_enabled)" = "0" ] && f_log
"err" "banIP is disabled"