1 # banIP shared function library/include - ban incoming and outgoing IPs via named nftables Sets
2 # Copyright (c) 2018-2024 Dirk Brenken (dev@brenken.org)
3 # This is free software, licensed under the GNU General Public License v3.
5 # (s)hellcheck exceptions
6 # shellcheck disable=all
11 export PATH
="/usr/sbin:/usr/bin:/sbin:/bin"
16 ban_backupdir
="/tmp/banIP-backup"
17 ban_reportdir
="/tmp/banIP-report"
18 ban_feedfile
="/etc/banip/banip.feeds"
19 ban_countryfile
="/etc/banip/banip.countries"
20 ban_customfeedfile
="/etc/banip/banip.custom.feeds"
21 ban_allowlist
="/etc/banip/banip.allowlist"
22 ban_blocklist
="/etc/banip/banip.blocklist"
23 ban_mailtemplate
="/etc/banip/banip.tpl"
24 ban_pidfile
="/var/run/banip.pid"
25 ban_rtfile
="/var/run/banip_runtime.json"
26 ban_rdapfile
="/var/run/banip_rdap.json"
27 ban_rdapurl
="https://rdap.db.ripe.net/ip/"
28 ban_lock
="/var/run/banip.lock"
29 ban_logreadfile
="/var/log/messages"
31 ban_mailsender
="no-reply@banIP"
33 ban_mailtopic
="banIP notification"
34 ban_mailprofile
="ban_notify"
35 ban_mailnotification
="0"
36 ban_reportelements
="1"
39 ban_nftloglevel
="warn"
40 ban_nftpriority
="-100"
41 ban_nftpolicy
="memory"
60 ban_autoallowuplink
="subnet"
62 ban_autoblocksubnet
="0"
70 ban_blockforwardwan
=""
71 ban_blockforwardlan
=""
94 # gather system information
99 if [ -z "${ban_dev}" ]; then
100 ban_debug
="$(uci_get banip global ban_debug)"
101 ban_cores
="$(uci_get banip global ban_cores)"
103 ban_packages
="$("${ban_ubuscmd}" -S call rpc-sys packagelist '{ "all
": true }' 2>/dev/null)"
104 ban_memory
="$("${ban_awkcmd}" '/^MemAvailable/{printf "%s
",int($2/1000)}' "/proc
/meminfo
" 2>/dev/null)"
105 ban_ver
="$(printf "%s
" "${ban_packages}" | "${ban_jsoncmd}" -ql1 -e '@.packages.banip')"
106 ban_sysver
="$("${ban_ubuscmd}" -S call system board 2>/dev/null | "${ban_jsoncmd}" -ql1 -e '@.model' -e '@.release.description' |
107 "${ban_awkcmd}" 'BEGIN{RS="";FS="\n"}{printf "%s
, %s
",$1,$2}')"
108 if [ -z "${ban_cores}" ]; then
109 cpu
="$("${ban_grepcmd}" -c '^processor' /proc/cpuinfo 2>/dev/null)"
110 core
="$("${ban_grepcmd}" -cm1 '^core id' /proc/cpuinfo 2>/dev/null)"
111 [ "${cpu}" = "0" ] && cpu
="1"
112 [ "${core}" = "0" ] && core
="1"
113 ban_cores
="$((cpu * core))"
114 [ "${ban_cores}" -gt "16" ] && ban_cores
="16"
121 local cmd pri_cmd
="${1}" sec_cmd
="${2}"
123 cmd
="$(command -v "${pri_cmd}" 2>/dev/null)"
124 if [ ! -x "${cmd}" ]; then
125 if [ -n "${sec_cmd}" ]; then
126 [ "${sec_cmd}" = "true" ] && return
127 cmd
="$(command -v "${sec_cmd}" 2>/dev/null)"
129 if [ -x "${cmd}" ]; then
132 f_log
"emerg" "command '${pri_cmd:-"-"}'/'${sec_cmd:-"-"}' not found"
144 if [ ! -d "${dir}" ]; then
147 f_log
"debug" "f_mkdir ::: directory: ${dir}"
156 if [ ! -f "${file}" ]; then
158 f_log
"debug" "f_mkfile ::: file: ${file}"
162 # create temporary files and directories
165 f_mkdir
"${ban_basedir}"
166 ban_tmpdir
="$(mktemp -p "${ban_basedir}" -d)"
167 ban_tmpfile
="$(mktemp -p "${ban_tmpdir}" -tu)"
169 f_log
"debug" "f_tmp ::: base_dir: ${ban_basedir:-"-"}, tmp_dir: ${ban_tmpdir:-"-"}"
177 if [ -d "${dir}" ]; then
179 f_log
"debug" "f_rmdir ::: directory: ${dir}"
188 if [ "${char}" = "1" ]; then
190 elif [ "${char}" = "0" ] ||
[ -z "${char}" ]; then
193 printf "%s" "${char}"
202 string
="${string#"${string%%[![:space:]]*}"}"
203 string
="${string%"${string##*[![:space:]]}"}"
204 printf "%s" "${string}"
212 ppid
="$("${ban_catcmd}" "${ban_pidfile}" 2>/dev/null)"
213 if [ -n "${ppid}" ]; then
214 pids
="$("${ban_pgrepcmd}" -P "${ppid}" 2>/dev/null)"
215 for pid
in ${pids}; do
216 pids
="${pids} $("${ban_pgrepcmd}" -P "${pid}" 2>/dev
/null
)"
218 for pid in ${pids}; do
219 kill -INT "${pid}" >/dev/null 2>&1
222 : >"${ban_rdapfile}" >"${ban_pidfile}"
228 local class="${1}" log_msg="${2}"
230 if [ -n "${log_msg}" ] && { [ "${class}" != "debug" ] || [ "${ban_debug}" = "1" ]; }; then
231 if [ -x "${ban_logcmd}" ]; then
232 "${ban_logcmd}" -p "${class}" -t "banIP-${ban_ver}[${$}]" "${log_msg}"
234 printf "%s %s %s\n" "${class}" "banIP-${ban_ver}[${$}]" "${log_msg}"
237 if [ "${class}" = "err" ] ||
[ "${class}" = "emerg" ]; then
238 if [ "${class}" = "err" ]; then
239 "${ban_nftcmd}" delete table inet banIP
>/dev
/null
2>&1
240 if [ "$(uci_get banip global ban_enabled)" = "1" ]; then
242 [ "${ban_mailnotification}" = "1" ] && [ -n "${ban_mailreceiver}" ] && [ -x "${ban_mailcmd}" ] && f_mail
244 f_genstatus
"disabled"
247 f_rmdir
"${ban_tmpdir}"
257 local rir ccode region country
259 unset ban_dev ban_vlanallow ban_vlanblock ban_ifv4 ban_ifv6 ban_feed ban_allowurl ban_blockinput ban_blockforwardwan ban_blockforwardlan ban_logterm ban_region ban_country ban_asn
264 eval "${option}=\"${value}\""
271 eval "${option}=\"$(printf "%s" "${ban_ifv4}")${value} \""
274 eval "${option}=\"$(printf "%s" "${ban_ifv6}")${value} \""
277 eval "${option}=\"$(printf "%s" "${ban_dev}")${value} \""
280 eval "${option}=\"$(printf "%s" "${ban_vlanallow}")${value} \""
283 eval "${option}=\"$(printf "%s" "${ban_vlanblock}")${value} \""
286 eval "${option}=\"$(printf "%s" "${ban_trigger}")${value} \""
289 eval "${option}=\"$(printf "%s" "${ban_feed}")${value} \""
292 eval "${option}=\"$(printf "%s" "${ban_allowurl}")${value} \""
295 eval "${option}=\"$(printf "%s" "${ban_blockinput}")${value} \""
297 "ban_blockforwardwan")
298 eval "${option}=\"$(printf "%s" "${ban_blockforwardwan}")${value} \""
300 "ban_blockforwardlan")
301 eval "${option}=\"$(printf "%s" "${ban_blockforwardlan}")${value} \""
304 eval "${option}=\"$(printf "%s" "${ban_logterm}")${value}\\|\""
307 eval "${option}=\"$(printf "%s" "${ban_region}")${value} \""
310 eval "${option}=\"$(printf "%s" "${ban_country}")${value} \""
313 eval "${option}=\"$(printf "%s" "${ban_asn}")${value} \""
319 [ -f "${ban_logreadfile}" ] && ban_logreadcmd
="$(command -v tail)" || ban_logreadcmd
="$(command -v logread)"
321 for rir
in ${ban_region}; do
322 while read -r ccode region country
; do
323 if [ "${rir}" = "${region}" ] && ! printf "%s" "${ban_country}" | "${ban_grepcmd}" -qw "${ccode}"; then
324 ban_country
="${ban_country} ${ccode}"
326 done < "${ban_countryfile}"
330 # get nft/monitor actuals
333 local nft monitor ppid pids pid
335 if "${ban_nftcmd}" -t list
set inet banIP allowlistv4MAC
>/dev
/null
2>&1; then
341 ppid
="$("${ban_catcmd}" "${ban_pidfile}" 2>/dev/null)"
342 if [ -n "${ppid}" ]; then
343 pids
="$("${ban_pgrepcmd}" -P "${ppid}" 2>/dev/null)"
344 for pid
in ${pids}; do
345 if "${ban_pgrepcmd}" -f "${ban_logreadcmd##*/}" -P "${pid}" >/dev
/null
2>&1; then
346 monitor
="$(f_char "1")"
349 monitor
="$(f_char "0")"
353 monitor
="$(f_char "0")"
355 printf "%s" "nft: ${nft}, monitor: ${monitor}"
361 local item utils insecure update
="0"
363 if { [ "${ban_fetchcmd}" = "uclient-fetch" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"libustream-'; } ||
364 { [ "${ban_fetchcmd}" = "wget" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"wget-ssl'; } ||
365 [ "${ban_fetchcmd}" = "curl" ] ||
[ "${ban_fetchcmd}" = "aria2c" ]; then
366 ban_fetchcmd
="$(f_cmd "${ban_fetchcmd}" "true
")"
369 if [ "${ban_autodetect}" = "1" ] && [ ! -x "${ban_fetchcmd}" ]; then
370 utils
="aria2c curl wget uclient-fetch"
371 for item
in ${utils}; do
372 if { [ "${item}" = "uclient-fetch" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"libustream-'; } ||
373 { [ "${item}" = "wget" ] && printf "%s" "${ban_packages}" | "${ban_grepcmd}" -q '"wget-ssl'; } ||
374 [ "${item}" = "curl" ] ||
[ "${item}" = "aria2c" ]; then
375 ban_fetchcmd
="$(command -v "${item}")"
376 if [ -x "${ban_fetchcmd}" ]; then
378 uci_set banip global ban_fetchcmd
"${item}"
386 [ ! -x "${ban_fetchcmd}" ] && f_log
"err" "no download utility with SSL support"
387 case "${ban_fetchcmd##*/}" in
389 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--check-certificate=false"
390 ban_fetchparm
="${ban_fetchparm:-"${insecure} --timeout=20 --retry-wait=10 --max-tries=${ban_fetchretry} --max-file-not-found=${ban_fetchretry} --allow-overwrite=true --auto-file-renaming=false --log-level=warn --dir=/ -o"}"
391 ban_rdapparm
="--timeout=5 --allow-overwrite=true --auto-file-renaming=false --dir=/ -o"
392 ban_etagparm
="--timeout=5 --allow-overwrite=true --auto-file-renaming=false --dir=/ --dry-run --log -"
395 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--insecure"
396 ban_fetchparm
="${ban_fetchparm:-"${insecure} --connect-timeout 20 --retry-delay 10 --retry ${ban_fetchretry} --retry-max-time $((ban_fetchretry * 20)) --retry-all-errors --fail --silent --show-error --location -o"}"
397 ban_rdapparm
="--connect-timeout 5 --silent --location -o"
398 ban_etagparm
="--connect-timeout 5 --silent --location --head"
401 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--no-check-certificate"
402 ban_fetchparm
="${ban_fetchparm:-"${insecure} --no-cache --no-cookies --timeout=20 --waitretry=10 --tries=${ban_fetchretry} --retry-connrefused -O"}"
403 ban_rdapparm
="--timeout=5 -O"
404 ban_etagparm
="--timeout=5 --spider --server-response"
407 [ "${ban_fetchinsecure}" = "1" ] && insecure
="--no-check-certificate"
408 ban_fetchparm
="${ban_fetchparm:-"${insecure} --timeout=20 -O"}"
409 ban_rdapparm
="--timeout=5 -O"
413 f_log
"debug" "f_getfetch ::: auto/update: ${ban_autodetect}/${update}, cmd: ${ban_fetchcmd:-"-"}, fetch_parm: ${ban_fetchparm:-"-"}, rdap_parm: ${ban_rdapparm:-"-"}, etag_parm: ${ban_etagparm:-"-"}"
419 local iface iface_del update
="0"
421 if [ "${ban_autodetect}" = "1" ]; then
423 network_find_wan iface
424 if [ -n "${iface}" ] && [ "${iface}" != "$(f_trim "${ban_ifv4}")" ] && "${ban_ubuscmd}" -t 10 wait_for network.interface."${iface}" >/dev
/null
2>&1; then
425 for iface_del
in ${ban_ifv4}; do
426 uci_remove_list banip global ban_ifv4
"${iface_del}"
427 f_log
"info" "remove IPv4 interface '${iface_del}' from config"
431 uci_set banip global ban_protov4
"1"
432 uci_add_list banip global ban_ifv4
"${iface}"
433 f_log
"info" "add IPv4 interface '${iface}' to config"
435 network_find_wan6 iface
436 if [ -n "${iface}" ] && [ "${iface}" != "$(f_trim "${ban_ifv6}")" ] && "${ban_ubuscmd}" -t 10 wait_for network.interface."${iface}" >/dev
/null
2>&1; then
437 for iface_del
in ${ban_ifv6}; do
438 uci_remove_list banip global ban_ifv6
"${iface_del}"
439 f_log
"info" "remove IPv6 interface '${iface_del}' from config"
443 uci_set banip global ban_protov6
"1"
444 uci_add_list banip global ban_ifv6
"${iface}"
445 f_log
"info" "add IPv6 interface '${iface}' to config"
448 if [ -n "$(uci -q changes "banip
")" ]; then
452 for iface
in ${ban_ifv4} ${ban_ifv6}; do
453 if ! "${ban_ubuscmd}" -t 10 wait_for network.interface.
"${iface}" >/dev
/null
2>&1; then
454 f_log
"err" "no wan interface '${iface}'"
458 ban_ifv4
="$(f_trim "${ban_ifv4}")"
459 ban_ifv6
="$(f_trim "${ban_ifv6}")"
460 [ -z "${ban_ifv4}" ] && [ -z "${ban_ifv6}" ] && f_log
"err" "no wan interfaces"
462 f_log
"debug" "f_getif ::: auto/update: ${ban_autodetect}/${update}, interfaces (4/6): ${ban_ifv4}/${ban_ifv6}, protocols (4/6): ${ban_protov4}/${ban_protov6}"
468 local dev dev_del iface update
="0"
470 if [ "${ban_autodetect}" = "1" ]; then
473 for iface
in ${ban_ifv4} ${ban_ifv6}; do
474 network_get_device dev
"${iface}"
475 if [ -n "${dev}" ]; then
476 dev_del
="${dev_del/${dev} / }"
477 if ! printf " %s " "${ban_dev}" | "${ban_grepcmd}" -q " ${dev} "; then
478 ban_dev
="${ban_dev}${dev} "
479 uci_add_list banip global ban_dev
"${dev}"
480 f_log
"info" "add device '${dev}' to config"
484 for dev
in ${dev_del}; do
485 ban_dev
="${ban_dev/${dev} / }"
486 uci_remove_list banip global ban_dev
"${dev}"
487 f_log
"info" "remove device '${dev}' from config"
490 if [ -n "$(uci -q changes "banip
")" ]; then
494 ban_dev
="$(f_trim "${ban_dev}")"
495 [ -z "${ban_dev}" ] && f_log
"err" "no wan devices"
497 f_log
"debug" "f_getdev ::: auto/update: ${ban_autodetect}/${update}, wan_devices: ${ban_dev}"
503 local uplink iface ip update
="0"
505 if [ "${ban_autoallowlist}" = "1" ] && [ "${ban_autoallowuplink}" != "disable" ]; then
506 for iface
in ${ban_ifv4} ${ban_ifv6}; do
508 if [ "${ban_autoallowuplink}" = "subnet" ]; then
509 network_get_subnet uplink
"${iface}"
510 elif [ "${ban_autoallowuplink}" = "ip" ]; then
511 network_get_ipaddr uplink
"${iface}"
513 if [ -n "${uplink}" ] && ! printf " %s " "${ban_uplink}" | "${ban_grepcmd}" -q " ${uplink} "; then
514 ban_uplink
="${ban_uplink}${uplink} "
516 if [ "${ban_autoallowuplink}" = "subnet" ]; then
517 network_get_subnet6 uplink
"${iface}"
518 elif [ "${ban_autoallowuplink}" = "ip" ]; then
519 network_get_ipaddr6 uplink
"${iface}"
521 if [ -n "${uplink}" ] && ! printf " %s " "${ban_uplink}" | "${ban_grepcmd}" -q " ${uplink} "; then
522 ban_uplink
="${ban_uplink}${uplink} "
525 for ip
in ${ban_uplink}; do
526 if ! "${ban_grepcmd}" -q "${ip} " "${ban_allowlist}"; then
527 if [ "${update}" = "0" ]; then
528 "${ban_sedcmd}" -i "/# uplink added on /d" "${ban_allowlist}"
530 printf "%-42s%s\n" "${ip}" "# uplink added on $(date "+%Y-
%m-
%d
%H
:%M
:%S
")" >>"${ban_allowlist}"
531 f_log
"info" "add uplink '${ip}' to local allowlist"
535 ban_uplink
="$(f_trim "${ban_uplink}")"
536 elif [ "${ban_autoallowlist}" = "1" ] && [ "${ban_autoallowuplink}" = "disable" ]; then
537 "${ban_sedcmd}" -i "/# uplink added on /d" "${ban_allowlist}"
541 f_log
"debug" "f_getuplink ::: auto/update: ${ban_autoallowlist}/${update}, uplink: ${ban_uplink:-"-"}"
544 # get feed information
548 if [ -s "${ban_customfeedfile}" ]; then
549 if json_load_file
"${ban_customfeedfile}" >/dev
/null
2>&1; then
552 f_log
"info" "can't load banIP custom feed file"
555 if [ -s "${ban_feedfile}" ] && json_load_file
"${ban_feedfile}" >/dev
/null
2>&1; then
558 f_log
"err" "can't load banIP feed file"
567 [ -s "${file}" ] && printf "%s" "elements={ $("${ban_catcmd}" "${file}" 2>/dev/null) };"
570 # handle etag http header
573 local http_head http_code etag_id etag_rc out_rc
="4" feed
="${1}" feed_url="${2}" feed_suffix="${3}"
575 if [ -n "${ban_etagparm}" ]; then
576 [ ! -f "${ban_backupdir}/banIP.etag" ] && : >"${ban_backupdir}/banIP.etag"
577 http_head
="$("${ban_fetchcmd}" ${ban_etagparm} "${feed_url}" 2>&1)"
578 http_code
="$(printf "%s
" "${http_head}" | "${ban_awkcmd}" 'tolower($0)~/^http\/[0123\.]+ /{printf "%s",$2}')"
579 etag_id="$(printf "%s" "${http_head}" | "${ban_awkcmd}" 'tolower($0)~/^[[:space:]]*etag: /{gsub("\"","");printf "%s",$2}')"
582 if [ "${http_code}" = "404" ] || { [ "${etag_rc}" = "0" ] && [ -n "${etag_id}" ] && "${ban_grepcmd}" -q "^${feed}${feed_suffix}[[:space:]]\+${etag_id}\$" "${ban_backupdir}/banIP.etag"; }; then
584 elif [ "${etag_rc}" = "0" ] && [ -n "${etag_id}" ] && ! "${ban_grepcmd}" -q "^${feed}${feed_suffix}[[:space:]]\+${etag_id}\$" "${ban_backupdir}/banIP.etag"; then
585 "${ban_sedcmd}" -i "/^${feed}${feed_suffix}/d" "${ban_backupdir}/banIP.etag"
586 printf "%-20s%s\n" "${feed}${feed_suffix}" "${etag_id}" >>"${ban_backupdir}/banIP.etag"
591 f_log
"debug" "f_etag ::: feed: ${feed}, suffix: ${feed_suffix:-"-"}, http_code: ${http_code:-"-"}, etag_id: ${etag_id:-"-"} , etag_rc: ${etag_rc:-"-"}, rc: ${out_rc}"
595 # build initial nft file with base table, chains and rules
598 local wan_dev vlan_allow vlan_block log_ct log_icmp log_syn log_udp log_tcp feed_log feed_rc allow_proto allow_dport flag
file="${1}"
600 wan_dev
="$(printf "%s
" "${ban_dev}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
601 [ -n "${ban_vlanallow}" ] && vlan_allow="$(printf "%s" "${ban_vlanallow%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
602 [ -n "${ban_vlanblock}" ] && vlan_block="$(printf "%s" "${ban_vlanblock%%?}" | "${ban_sedcmd}" 's/^/\"/;s/$/\"/;s/ /\", \"/g')"
604 for flag
in ${ban_allowflag}; do
605 if [ -z "${allow_proto}" ] && { [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; }; then
606 allow_proto="${flag}"
607 elif [ -n "${allow_proto}" ] && [ -n "${flag//[![:digit]-]/}" ] && ! printf "%s" "${allow_dport}" | "${ban_grepcmd}" -qw "${flag}"; then
608 if [ -z "${allow_dport}" ]; then
609 allow_dport="${flag}"
611 allow_dport="${allow_dport}, ${flag}"
615 [ -n "${allow_dport}" ] && allow_dport="${allow_proto} dport { ${allow_dport} }"
617 if [ "${ban_logprerouting}" = "1" ]; then
618 log_icmp="log level
${ban_nftloglevel} prefix
\"banIP
/pre-icmp
/drop
: \""
619 log_syn="log level
${ban_nftloglevel} prefix
\"banIP
/pre-syn
/drop
: \""
620 log_udp="log level
${ban_nftloglevel} prefix
\"banIP
/pre-udp
/drop
: \""
621 log_tcp="log level
${ban_nftloglevel} prefix
\"banIP
/pre-tcp
/drop
: \""
622 log_ct="log level
${ban_nftloglevel} prefix
\"banIP
/pre-ct
/drop
: \""
626 # nft header (tables and chains)
628 printf "%s
\n\n" "#!/usr/sbin/nft -f"
629 if "${ban_nftcmd}" -t list
set inet banIP allowlistv4MAC
>/dev
/null
2>&1; then
630 printf "%s\n" "delete table inet banIP"
632 printf "%s\n" "add table inet banIP"
633 printf "%s\n" "add counter inet banIP cnt-icmpflood"
634 printf "%s\n" "add counter inet banIP cnt-udpflood"
635 printf "%s\n" "add counter inet banIP cnt-synflood"
636 printf "%s\n" "add counter inet banIP cnt-tcpinvalid"
637 printf "%s\n" "add counter inet banIP cnt-ctinvalid"
638 printf "%s\n" "add chain inet banIP pre-routing { type filter hook prerouting priority -150; policy accept; }"
639 printf "%s\n" "add chain inet banIP wan-input { type filter hook input priority ${ban_nftpriority}; policy accept; }"
640 printf "%s\n" "add chain inet banIP wan-forward { type filter hook forward priority ${ban_nftpriority}; policy accept; }"
641 printf "%s\n" "add chain inet banIP lan-forward { type filter hook forward priority ${ban_nftpriority}; policy accept; }"
642 printf "%s\n" "add chain inet banIP reject-chain"
644 # default reject chain rules
646 printf "%s\n" "add rule inet banIP reject-chain meta l4proto tcp reject with tcp reset"
647 printf "%s\n" "add rule inet banIP reject-chain reject"
649 # default pre-routing rules
651 printf "%s\n" "add rule inet banIP pre-routing iifname != { ${wan_dev} } counter accept"
652 printf "%s\n" "add rule inet banIP pre-routing ct state invalid ${log_ct} counter name cnt-ctinvalid drop"
653 printf "%s\n" "add rule inet banIP pre-routing ip protocol icmp limit rate over ${ban_icmplimit}/second ${log_icmp} counter name cnt-icmpflood drop"
654 printf "%s\n" "add rule inet banIP pre-routing ip6 nexthdr icmpv6 limit rate over ${ban_icmplimit}/second ${log_icmp} counter name cnt-icmpflood drop"
655 printf "%s\n" "add rule inet banIP pre-routing meta l4proto udp ct state new limit rate over ${ban_udplimit}/second ${log_udp} counter name cnt-udpflood drop"
656 printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn|rst|ack) == syn limit rate over ${ban_synlimit}/second ${log_syn} counter name cnt-synflood drop"
657 printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn) == (fin|syn) ${log_tcp} counter name cnt-tcpinvalid drop"
658 printf "%s\n" "add rule inet banIP pre-routing tcp flags & (syn|rst) == (syn|rst) ${log_tcp} counter name cnt-tcpinvalid drop"
659 printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) ${log_tcp} counter name cnt-tcpinvalid drop"
660 printf "%s\n" "add rule inet banIP pre-routing tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) ${log_tcp} counter name cnt-tcpinvalid drop"
662 # default wan-input rules
664 printf "%s\n" "add rule inet banIP wan-input iifname != { ${wan_dev} } counter accept"
665 printf "%s\n" "add rule inet banIP wan-input ct state established,related counter accept"
666 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv4 udp sport 67-68 udp dport 67-68 counter accept"
667 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 udp sport 547 udp dport 546 counter accept"
668 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} ip6 hoplimit 1 counter accept"
669 printf "%s\n" "add rule inet banIP wan-input meta nfproto ipv6 icmpv6 type { nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert} ip6 hoplimit 255 counter accept"
670 [ -n "${allow_dport}" ] && printf "%s\n" "add rule inet banIP wan-input ${allow_dport} counter accept"
672 # default wan-forward rules
674 printf "%s\n" "add rule inet banIP wan-forward iifname != { ${wan_dev} } counter accept"
675 printf "%s\n" "add rule inet banIP wan-forward ct state established,related counter accept"
676 [ -n "${allow_dport}" ] && printf "%s\n" "add rule inet banIP wan-forward ${allow_dport} counter accept"
678 # default lan-forward rules
680 printf "%s\n" "add rule inet banIP lan-forward oifname != { ${wan_dev} } counter accept"
681 printf "%s\n" "add rule inet banIP lan-forward ct state established,related counter accept"
682 [ -n "${vlan_allow}" ] && printf "%s\n" "add rule inet banIP lan-forward iifname { ${vlan_allow} } counter accept"
683 [ -n "${vlan_block}" ] && printf "%s\n" "add rule inet banIP lan-forward iifname { ${vlan_block} } counter goto reject-chain"
686 # load initial banIP table within nft (atomic load)
688 feed_log
="$("${ban_nftcmd}" -f "${file}" 2>&1)"
691 f_log
"debug" "f_nftinit ::: wan_dev: ${wan_dev}, vlan_allow: ${vlan_allow:-"-"}, vlan_block: ${vlan_block:-"-"}, allowed_dports: ${allow_dport:-"-"}, priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
699 local log_input log_forwardwan log_forwardlan start_ts end_ts tmp_raw tmp_load tmp_file split_file ruleset_raw handle rc etag_rc
700 local expr cnt_set cnt_dl restore_rc feed_direction feed_rc feed_log feed_comp feed_proto feed_dport feed_target
701 local feed
="${1}" proto="${2}" feed_url="${3}" feed_rule="${4}" feed_flag="${5}"
703 start_ts
="$(date +%s)"
704 feed
="${feed}v${proto}"
705 tmp_load
="${ban_tmpfile}.${feed}.load"
706 tmp_raw
="${ban_tmpfile}.${feed}.raw"
707 tmp_split
="${ban_tmpfile}.${feed}.split"
708 tmp_file
="${ban_tmpfile}.${feed}.file"
709 tmp_flush
="${ban_tmpfile}.${feed}.flush"
710 tmp_nft
="${ban_tmpfile}.${feed}.nft"
711 tmp_allow
="${ban_tmpfile}.${feed%v*}"
713 [ "${ban_loginput}" = "1" ] && log_input="log level ${ban_nftloglevel} prefix \"banIP/inp-wan/${ban_blocktype}/${feed}: \""
714 [ "${ban_logforwardwan}" = "1" ] && log_forwardwan="log level ${ban_nftloglevel} prefix \"banIP/fwd-wan/${ban_blocktype}/${feed}: \""
715 [ "${ban_logforwardlan}" = "1" ] && log_forwardlan="log level ${ban_nftloglevel} prefix \"banIP/fwd-lan/reject/${feed}: \""
719 if [ "${ban_blocktype}" = "reject" ]; then
720 feed_target
="goto reject-chain"
725 # set feed block direction
727 if [ "${ban_blockpolicy}" = "input" ]; then
728 if ! printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}" &&
729 ! printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}" &&
730 ! printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
731 ban_blockinput
="${ban_blockinput} ${feed%v*}"
733 elif [ "${ban_blockpolicy}" = "forwardwan" ]; then
734 if ! printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}" &&
735 ! printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}" &&
736 ! printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
737 ban_blockforwardwan
="${ban_blockforwardwan} ${feed%v*}"
739 elif [ "${ban_blockpolicy}" = "forwardlan" ]; then
740 if ! printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}" &&
741 ! printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}" &&
742 ! printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
743 ban_blockforwardlan
="${ban_blockforwardlan} ${feed%v*}"
746 if printf "%s" "${ban_blockinput}" | "${ban_grepcmd}" -q "${feed%v*}"; then
747 feed_direction
="input"
749 if printf "%s" "${ban_blockforwardwan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
750 feed_direction
="${feed_direction} forwardwan"
752 if printf "%s" "${ban_blockforwardlan}" | "${ban_grepcmd}" -q "${feed%v*}"; then
753 feed_direction
="${feed_direction} forwardlan"
758 for flag
in ${feed_flag}; do
759 if [ "${flag}" = "gz" ] && ! printf "%s" "${feed_comp}" | "${ban_grepcmd}" -qw "${flag}"; then
761 elif [ -z "${feed_proto}" ] && { [ "${flag}" = "tcp" ] || [ "${flag}" = "udp" ]; }; then
763 elif [ -n "${feed_proto}" ] && [ -n "${flag//[![:digit]-]/}" ] && ! printf "%s" "${feed_dport}" | "${ban_grepcmd}" -qw "${flag}"; then
764 if [ -z "${feed_dport}" ]; then
767 feed_dport="${feed_dport}, ${flag}"
771 [ -n "${feed_dport}" ] && feed_dport="${feed_proto} dport { ${feed_dport} }"
773 # chain/rule maintenance
775 if [ "${ban_action}" = "reload" ] && "${ban_nftcmd}" -t list set inet banIP "${feed}" >/dev/null 2>&1; then
776 ruleset_raw="$
("${ban_nftcmd}" -tj list ruleset
2>/dev
/null
)"
778 printf "%s
\n" "flush
set inet banIP
${feed}"
780 handle="$
(printf "%s\n" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-input\"][@.expr[${expr}].match.right=\"@${feed}\"].handle")"
781 [ -n "${handle}" ] && printf "%s
\n" "delete rule inet banIP wan-input handle
${handle}"
782 handle="$
(printf "%s\n" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-forward\"][@.expr[${expr}].match.right=\"@${feed}\"].handle")"
783 [ -n "${handle}" ] && printf "%s
\n" "delete rule inet banIP wan-forward handle
${handle}"
784 handle="$
(printf "%s\n" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${feed}\"].handle")"
785 [ -n "${handle}" ] && printf "%s
\n" "delete rule inet banIP lan-forward handle
${handle}"
790 # restore local backups
792 if [ "${feed%v*}" != "blocklist
" ]; then
793 if [ -n "${ban_etagparm}" ] && [ "${ban_action}" = "reload" ] && [ "${feed_url}" != "local" ] && [ "${feed%v*}" != "allowlist
" ]; then
795 if [ "${feed%v*}" = "country
" ]; then
796 for country in ${ban_country}; do
797 f_etag "${feed}" "${feed_url}${country}-aggregated.zone" ".${country}"
799 [ "${rc}" = "4" ] && break
800 etag_rc="$
((etag_rc
+ rc
))"
802 elif [ "${feed%v*}" = "asn
" ]; then
803 for asn in ${ban_asn}; do
804 f_etag "${feed}" "${feed_url}AS${asn}" ".${asn}"
806 [ "${rc}" = "4" ] && break
807 etag_rc="$
((etag_rc
+ rc
))"
810 f_etag "${feed}" "${feed_url}"
814 if [ "${etag_rc}" = "0" ] || [ "${ban_action}" != "reload" ] || [ "${feed_url}" = "local" ]; then
815 if [ "${feed%v*}" = "allowlist
" ] && [ ! -f "${tmp_allow}" ]; then
816 f_restore "allowlist
" "-" "${tmp_allow}" "${etag_rc}"
818 f_restore "${feed}" "${feed_url}" "${tmp_load}" "${etag_rc}"
821 feed_rc="${restore_rc}"
825 # prepare local/remote allowlist
827 if [ "${feed%v*}" = "allowlist
" ] && [ ! -f "${tmp_allow}" ]; then
828 "${ban_catcmd}" "${ban_allowlist}" 2>/dev/null >"${tmp_allow}"
830 for feed_url in ${ban_allowurl}; do
831 feed_log="$
("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_load}" "${feed_url}" 2>&1)"
833 if [ "${feed_rc}" = "0" ] && [ -s "${tmp_load}" ]; then
834 "${ban_catcmd}" "${tmp_load}" 2>/dev/null >>"${tmp_allow}"
836 f_log "info
" "download
for feed
'${feed%v*}' failed (rc: ${feed_rc:-"-"}/log: ${feed_log})"
841 if [ "${feed_rc}" = "0" ]; then
842 f_backup "allowlist" "${tmp_allow}"
843 elif [ -z "${restore_rc}" ] && [ "${feed_rc}" != "0" ]; then
844 f_restore "allowlist" "-" "${tmp_allow}" "${feed_rc}"
851 if [ "${feed%v*}" = "allowlist" ]; then
853 printf "%s\n\n" "#!/usr/sbin/nft -f"
854 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
855 if [ "${proto}" = "4MAC" ]; then
856 "${ban_awkcmd}" '/^([0-9A-f]{2}:){5}[0-9A-f]{2}(\/([0-9]|[1-3][0-9]|4[0-8]))?([[:space:]]+([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?[[:space:]]*$|[[:space:]]+$|$)/{if(!$2)$2="0.0.0.0/0";if(!seen[$1]++)printf "%s . %s, ",tolower($1),$2}' "${tmp_allow}" >"${tmp_file}"
857 printf "%s\n" "add set inet banIP ${feed} { type ether_addr . ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
858 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ether saddr . ip saddr @${feed} counter accept"
859 elif [ "${proto}" = "6MAC" ]; then
860 "${ban_awkcmd}" '/^([0-9A-f]{2}:){5}[0-9A-f]{2}(\/([0-9]|[1-3][0-9]|4[0-8]))?([[:space:]]+([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?[[:space:]]*$|[[:space:]]+$|$)/{if(!$2)$2="::/0";if(!seen[$1]++)printf "%s . %s, ",tolower($1),$2}' "${tmp_allow}" >"${tmp_file}"
861 printf "%s\n" "add set inet banIP ${feed} { type ether_addr . ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
862 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ether saddr . ip6 saddr @${feed} counter accept"
863 elif [ "${proto}" = "4" ]; then
864 "${ban_awkcmd}" '/^(([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]].*|$)/{printf "%s, ",$1}' "${tmp_allow}" >"${tmp_file}"
865 printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
866 if [ -z "${feed_direction##*input*}" ]; then
867 if [ "${ban_allowlistonly}" = "1" ]; then
868 printf "%s\n" "add rule inet banIP wan-input ip saddr != @${feed} ${log_input} counter ${feed_target}"
870 printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} counter accept"
873 if [ -z "${feed_direction##*forwardwan*}" ]; then
874 if [ "${ban_allowlistonly}" = "1" ]; then
875 printf "%s\n" "add rule inet banIP wan-forward ip saddr != @${feed} ${log_forwardwan} counter ${feed_target}"
877 printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} counter accept"
880 if [ -z "${feed_direction##*forwardlan*}" ]; then
881 if [ "${ban_allowlistonly}" = "1" ]; then
882 printf "%s\n" "add rule inet banIP lan-forward ip daddr != @${feed} ${log_forwardlan} counter goto reject-chain"
884 printf "%s\n" "add rule inet banIP lan-forward ip daddr @${feed} counter accept"
887 elif [ "${proto}" = "6" ]; then
888 "${ban_awkcmd}" '!/^
([0-9A-f]{2}:){5}[0-9A-f]{2}.
*/{printf "%s\n",$1}' "${tmp_allow}" |
889 "${ban_awkcmd}" '/^
(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?
(\
/(1?
[0-2][0-8]|
[0-9][0-9]))?
)([[:space
:]].
*|$
)/{printf "%s, ",tolower
($1)}' >"${tmp_file}"
890 printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
891 if [ -z "${feed_direction##*input*}" ]; then
892 if [ "${ban_allowlistonly}" = "1" ]; then
893 printf "%s\n" "add rule inet banIP wan-input ip6 saddr != @${feed} ${log_input} counter ${feed_target}"
895 printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} counter accept"
898 if [ -z "${feed_direction##*forwardwan*}" ]; then
899 if [ "${ban_allowlistonly}" = "1" ]; then
900 printf "%s\n" "add rule inet banIP wan-forward ip6 saddr != @${feed} ${log_forwardwan} counter ${feed_target}"
902 printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} counter accept"
905 if [ -z "${feed_direction##*forwardlan*}" ]; then
906 if [ "${ban_allowlistonly}" = "1" ]; then
907 printf "%s\n" "add rule inet banIP lan-forward ip6 daddr != @${feed} ${log_forwardlan} counter ${feed_target}"
909 printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} counter accept"
914 : >"${tmp_flush}" >"${tmp_raw}" >"${tmp_file}"
916 elif [ "${feed%v*}" = "blocklist" ]; then
918 printf "%s\n\n" "#!/usr/sbin/nft -f"
919 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
920 if [ "${proto}" = "4MAC" ]; then
921 "${ban_awkcmd}" '/^([0-9A-f]{2}:){5}[0-9A-f]{2}(\/([0-9]|[1-3][0-9]|4[0-8]))?([[:space:]]+([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?[[:space:]]*$|[[:space:]]+$|$)/{if(!$2)$2="0.0.0.0/0";if(!seen[$1]++)printf "%s . %s, ",tolower($1),$2}' "${ban_blocklist}" >"${tmp_file}"
922 printf "%s\n" "add set inet banIP ${feed} { type ether_addr . ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
923 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ether saddr . ip saddr @${feed} counter goto reject-chain"
924 elif [ "${proto}" = "6MAC" ]; then
925 "${ban_awkcmd}" '/^([0-9A-f]{2}:){5}[0-9A-f]{2}(\/([0-9]|[1-3][0-9]|4[0-8]))?([[:space:]]+([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\/(1?[0-2][0-8]|[0-9][0-9]))?[[:space:]]*$|[[:space:]]+$|$)/{if(!$2)$2="::/0";if(!seen[$1]++)printf "%s . %s, ",tolower($1),$2}' "${ban_blocklist}" >"${tmp_file}"
926 printf "%s\n" "add set inet banIP ${feed} { type ether_addr . ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
927 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ether saddr . ip6 saddr @${feed} counter goto reject-chain"
928 elif [ "${proto}" = "4" ]; then
929 if [ "${ban_deduplicate}" = "1" ]; then
930 "${ban_awkcmd}" '/^(([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]].*|$)/{printf "%s,\n",$1}' "${ban_blocklist}" >"${tmp_raw}"
931 "${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null >"${tmp_split}"
932 "${ban_awkcmd}" 'BEGIN{FS="[ ,]"}NR==FNR{member[$1];next}!($1 in member)' "${ban_tmpfile}.deduplicate" "${ban_blocklist}" 2>/dev/null >"${tmp_raw}"
933 "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >"${ban_blocklist}"
935 "${ban_awkcmd}" '/^(([0-9]{1,3}\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\/(1?[0-9]|2?[0-9]|3?[0-2]))?)([[:space:]].*|$)/{printf "%s,\n",$1}' "${ban_blocklist}" >"${tmp_split}"
937 "${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}"
938 printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval, timeout; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
939 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip saddr @${feed} ${log_input} counter ${feed_target}"
940 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip saddr @${feed} ${log_forwardwan} counter ${feed_target}"
941 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip daddr @${feed} ${log_forwardlan} counter goto reject-chain"
942 elif [ "${proto}" = "6" ]; then
943 if [ "${ban_deduplicate}" = "1" ]; then
944 "${ban_awkcmd}" '!/^
([0-9A-f]{2}:){5}[0-9A-f]{2}.
*/{printf "%s\n",$1}' "${ban_blocklist}" |
945 "${ban_awkcmd}" '/^
(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?
(\
/(1?
[0-2][0-8]|
[0-9][0-9]))?
)([[:space
:]].
*|$
)/{printf "%s,\n",tolower
($1)}' >"${tmp_raw}"
946 "${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null >"${tmp_split}"
947 "${ban_awkcmd}" 'BEGIN{FS="[ ,]"}NR==FNR{member[$1];next}!($1 in member)' "${ban_tmpfile}.deduplicate" "${ban_blocklist}" 2>/dev/null >"${tmp_raw}"
948 "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >"${ban_blocklist}"
950 "${ban_awkcmd}" '!/^
([0-9A-f]{2}:){5}[0-9A-f]{2}.
*/{printf "%s\n",$1}' "${ban_blocklist}" |
951 "${ban_awkcmd}" '/^
(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?
(\
/(1?
[0-2][0-8]|
[0-9][0-9]))?
)([[:space
:]].
*|$
)/{printf "%s,\n",tolower
($1)}' >"${tmp_split}"
953 "${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}"
954 printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval, timeout; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}") }"
955 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ip6 saddr @${feed} ${log_input} counter ${feed_target}"
956 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ip6 saddr @${feed} ${log_forwardwan} counter ${feed_target}"
957 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ip6 daddr @${feed} ${log_forwardlan} counter goto reject-chain"
960 : >"${tmp_flush}" >"${tmp_raw}" >"${tmp_file}"
963 # handle external feeds
965 elif [ "${restore_rc}" != "0" ] && [ "${feed_url}" != "local" ]; then
966 # handle country downloads
968 if [ "${feed%v*}" = "country" ]; then
969 for country in ${ban_country}; do
970 feed_log="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}${country}-aggregated.zone" 2>&1)"
972 [ "${feed_rc}" = "0" ] && "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >>"${tmp_load}"
976 # handle asn downloads
978 elif [ "${feed%v*}" = "asn" ]; then
979 for asn in ${ban_asn}; do
980 feed_log="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}AS${asn}" 2>&1)"
982 [ "${feed_rc}" = "0" ] && "${ban_catcmd}" "${tmp_raw}" 2>/dev/null >>"${tmp_load}"
986 # handle compressed downloads
988 elif [ "${feed_comp}" = "gz" ]; then
989 feed_log="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_raw}" "${feed_url}" 2>&1)"
991 [ "${feed_rc}" = "0" ] && "${ban_zcatcmd}" "${tmp_raw}" 2>/dev/null >"${tmp_load}"
994 # handle normal downloads
997 feed_log="$("${ban_fetchcmd}" ${ban_fetchparm} "${tmp_load}" "${feed_url}" 2>&1)"
1001 [ "${feed_rc}" != "0" ] && f_log "info" "download for feed '${feed}' failed (rc: ${feed_rc:-"-"}/log: ${feed_log})"
1005 if [ "${restore_rc}" != "0" ] && [ "${feed_rc}" = "0" ] && [ "${feed_url}" != "local" ] && [ ! -s "${tmp_nft}" ]; then
1006 f_backup "${feed}" "${tmp_load}"
1008 elif [ -z "${restore_rc}" ] && [ "${feed_rc}" != "0" ] && [ "${feed_url}" != "local" ] && [ ! -s "${tmp_nft}" ]; then
1009 f_restore "${feed}" "${feed_url}" "${tmp_load}" "${feed_rc}"
1013 # build nft file with Sets and rules for regular downloads
1015 if [ "${feed_rc}" = "0" ] && [ ! -s "${tmp_nft}" ]; then
1018 if [ "${ban_deduplicate}" = "1" ] && [ "${feed_url}" != "local" ]; then
1019 "${ban_awkcmd}" '{sub("\r$", ""); print}' "${tmp_load}" 2>/dev/null | "${ban_awkcmd}" "${feed_rule}" 2>/dev/null >"${tmp_raw}"
1020 "${ban_awkcmd}" 'NR==FNR{member[$0];next}!($0 in member)' "${ban_tmpfile}.deduplicate" "${tmp_raw}" 2>/dev/null | tee -a "${ban_tmpfile}.deduplicate" >"${tmp_split}"
1022 "${ban_awkcmd}" '{sub("\r$", ""); print}' "${tmp_load}" 2>/dev/null | "${ban_awkcmd}" "${feed_rule}" 2>/dev/null >"${tmp_split}"
1028 if [ "${feed_rc}" = "0" ]; then
1029 if [ -n "${ban_splitsize//[![:digit]]/}" ] && [ "${ban_splitsize//[![:digit]]/}" -gt "512" ]; then
1030 if ! "${ban_awkcmd}" "NR%${ban_splitsize//[![:digit]]/}==1{file=\"${tmp_file}.\"++i;}{ORS=\" \";print > file}" "${tmp_split}" 2>/dev/null; then
1031 f_log "info" "can't
split Set
'${feed}' to size
'${ban_splitsize//[![:digit]]/}'"
1032 rm -f "${tmp_file}".*
1035 "${ban_awkcmd}" '{ORS=" ";print}' "${tmp_split}" 2>/dev/null >"${tmp_file}.1"
1039 : >"${tmp_raw}" >"${tmp_load}"
1041 if [ "${feed_rc}" = "0" ] && [ "${proto}" = "4" ]; then
1043 # nft header (IPv4 Set)
1045 printf "%s
\n\n" "#!/usr/sbin/nft -f"
1046 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
1047 printf "%s\n" "add set inet banIP ${feed} { type ipv4_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}.1") }"
1049 # input and forward rules
1051 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip saddr @${feed} ${log_input} counter ${feed_target}"
1052 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip saddr @${feed} ${log_forwardwan} counter ${feed_target}"
1053 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ${feed_dport} ip daddr @${feed} ${log_forwardlan} counter goto reject-chain"
1055 elif [ "${feed_rc}" = "0" ] && [ "${proto}" = "6" ]; then
1057 # nft header (IPv6 Set)
1059 printf "%s\n\n" "#!/usr/sbin/nft -f"
1060 [ -s "${tmp_flush}" ] && "${ban_catcmd}" "${tmp_flush}"
1061 printf "%s\n" "add set inet banIP ${feed} { type ipv6_addr; flags interval; auto-merge; policy ${ban_nftpolicy}; $(f_getelements "${tmp_file}.1") }"
1063 # input and forward rules
1065 [ -z "${feed_direction##*input*}" ] && printf "%s\n" "add rule inet banIP wan-input ${feed_dport} ip6 saddr @${feed} ${log_input} counter ${feed_target}"
1066 [ -z "${feed_direction##*forwardwan*}" ] && printf "%s\n" "add rule inet banIP wan-forward ${feed_dport} ip6 saddr @${feed} ${log_forwardwan} counter ${feed_target}"
1067 [ -z "${feed_direction##*forwardlan*}" ] && printf "%s\n" "add rule inet banIP lan-forward ${feed_dport} ip6 daddr @${feed} ${log_forwardlan} counter goto reject-chain"
1070 : >"${tmp_flush}" >"${tmp_file}.1"
1073 # load generated nft file in banIP table
1075 if [ "${feed_rc}" = "0" ]; then
1076 if [ "${feed%v*}" = "allowlist" ]; then
1077 cnt_dl
="$("${ban_awkcmd}" 'END{printf "%d
",NR}' "${tmp_allow}" 2>/dev/null)"
1079 cnt_dl
="$("${ban_awkcmd}" 'END{printf "%d
",NR}' "${tmp_split}" 2>/dev/null)"
1082 if [ "${cnt_dl:-"0"}" -gt "0" ] || [ "${feed_url}" = "local" ] || [ "${feed%v*}" = "allowlist" ] || [ "${feed%v*}" = "blocklist" ]; then
1083 feed_log
="$("${ban_nftcmd}" -f "${tmp_nft}" 2>&1)"
1086 # load additional split files
1088 if [ "${feed_rc}" = "0" ]; then
1089 for split_file
in "${tmp_file}".
*; do
1090 [ ! -s "${split_file}" ] && continue
1091 "${ban_sedcmd}" -i "1 i #!/usr/sbin/nft -f\nadd element inet banIP "${feed}" { " "${split_file}"
1092 printf "%s\n" "}" >> "${split_file}"
1093 if ! "${ban_nftcmd}" -f "${split_file}" >/dev
/null
2>&1; then
1094 f_log
"info" "can't add split file '${split_file##*.}' to Set '${feed}'"
1098 if [ "${ban_debug}" = "1" ] && [ "${ban_reportelements}" = "1" ]; then
1099 cnt_set
="$("${ban_nftcmd}" -j list set inet banIP "${feed}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)"
1103 f_log
"info" "skip empty feed '${feed}'"
1107 end_ts
="$(date +%s)"
1109 f_log
"debug" "f_down ::: feed: ${feed}, cnt_dl: ${cnt_dl:-"-"}, cnt_set: ${cnt_set:-"-"}, split_size: ${ban_splitsize:-"-"}, time: $((end_ts - start_ts)), rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
1115 local backup_rc
="4" feed
="${1}" feed_file
="${2}"
1117 if [ -s "${feed_file}" ]; then
1118 gzip -cf "${feed_file}" >"${ban_backupdir}/banIP.${feed}.gz"
1122 f_log
"debug" "f_backup ::: feed: ${feed}, file: banIP.${feed}.gz, rc: ${backup_rc}"
1123 return "${backup_rc}"
1129 local tmp_feed restore_rc
="4" feed
="${1}" feed_url="${2}" feed_file="${3}" in_rc="${4}"
1131 [ "${feed_url}" = "local" ] && tmp_feed="${feed%v*}v4" || tmp_feed="${feed}"
1132 if [ -s "${ban_backupdir}/banIP.${tmp_feed}.gz" ]; then
1133 "${ban_zcatcmd}" "${ban_backupdir}/banIP.${tmp_feed}.gz" 2>/dev/null >"${feed_file}"
1137 f_log
"debug" "f_restore ::: feed: ${feed}, file: banIP.${tmp_feed}.gz, in_rc: ${in_rc:-"-"}, rc: ${restore_rc}"
1138 return "${restore_rc}"
1141 # remove disabled Sets
1144 local expr feedlist tmp_del ruleset_raw item table_sets handle del_set feed_log feed_rc
1147 json_get_keys feedlist
1148 tmp_del
="${ban_tmpfile}.final.delete"
1149 ruleset_raw
="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
1150 table_sets
="$(printf "%s
\n" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP
"&&@.set.family="inet
"].set.name')"
1152 printf "%s\n\n" "#!/usr/sbin/nft -f"
1153 for item
in ${table_sets}; do
1154 if ! printf "%s" "allowlist blocklist ${ban_feed}" | "${ban_grepcmd}" -q "${item%v*}" ||
1155 ! printf "%s" "allowlist blocklist ${feedlist}" | "${ban_grepcmd}" -q "${item%v*}"; then
1156 del_set
="${del_set}${item}, "
1157 rm -f "${ban_backupdir}/banIP.${item}.gz"
1158 printf "%s\n" "flush set inet banIP ${item}"
1160 handle
="$(printf "%s
\n" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-input\"][@.expr[${expr}].match.right=\"@${item}\"].handle
")"
1161 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP wan-input handle ${handle}"
1162 handle
="$(printf "%s
\n" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].handle
")"
1163 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP wan-forward handle ${handle}"
1164 handle
="$(printf "%s
\n" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].handle
")"
1165 [ -n "${handle}" ] && printf "%s\n" "delete rule inet banIP lan-forward handle ${handle}"
1167 printf "%s\n\n" "delete set inet banIP ${item}"
1172 if [ -n "${del_set}" ]; then
1173 del_set
="$(f_trim "${del_set}")"
1174 feed_log
="$("${ban_nftcmd}" -f "${tmp_del}" 2>&1)"
1179 f_log
"debug" "f_rmset ::: sets: ${del_set:-"-"}, rc: ${feed_rc:-"-"}, log: ${feed_log:-"-"}"
1182 # generate status information
1185 local object end_time duration table_sets cnt_elements
="0" custom_feed
="0" split="0" status
="${1}"
1187 [ -z "${ban_dev}" ] && f_conf
1188 if [ "${status}" = "active" ]; then
1189 if [ -n "${ban_starttime}" ] && [ "${ban_action}" != "boot" ]; then
1190 end_time
="$(date "+%s
")"
1191 duration
="$(((end_time - ban_starttime) / 60))m $(((end_time - ban_starttime) % 60))s"
1193 table_sets
="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP
"&&@.set.family="inet
"].set.name')"
1194 if [ "${ban_reportelements}" = "1" ]; then
1195 for object
in ${table_sets}; do
1196 cnt_elements
="$((cnt_elements + $("${ban_nftcmd}" -j list set inet banIP "${object}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' | wc -l 2>/dev/null)))"
1199 runtime
="action: ${ban_action:-"-"}, log: ${ban_logreadcmd##*/}, fetch: ${ban_fetchcmd##*/}, duration: ${duration:-"-"}, date: $(date "+%Y-
%m-
%d
%H
:%M
:%S
")"
1201 [ -s "${ban_customfeedfile}" ] && custom_feed
="1"
1202 [ "${ban_splitsize:-"0"}" -gt "0" ] && split="1"
1206 json_load_file
"${ban_rtfile}" >/dev
/null
2>&1
1207 json_add_string
"status" "${status}"
1208 json_add_string
"version" "${ban_ver}"
1209 json_add_string
"element_count" "${cnt_elements}"
1210 json_add_array
"active_feeds"
1211 for object
in ${table_sets:-"-"}; do
1212 json_add_string
"${object}" "${object}"
1215 json_add_array
"wan_devices"
1216 for object
in ${ban_dev:-"-"}; do
1217 json_add_string
"${object}" "${object}"
1220 json_add_array
"wan_interfaces"
1221 for object
in ${ban_ifv4:-"-"} ${ban_ifv6:-"-"}; do
1222 json_add_string
"${object}" "${object}"
1225 json_add_array
"vlan_allow"
1226 for object
in ${ban_vlanallow:-"-"}; do
1227 json_add_string
"${object}" "${object}"
1230 json_add_array
"vlan_block"
1231 for object
in ${ban_vlanblock:-"-"}; do
1232 json_add_string
"${object}" "${object}"
1235 json_add_array
"active_uplink"
1236 for object
in ${ban_uplink:-"-"}; do
1237 json_add_string
"${object}" "${object}"
1240 json_add_string
"nft_info" "priority: ${ban_nftpriority}, policy: ${ban_nftpolicy}, loglevel: ${ban_nftloglevel}, expiry: ${ban_nftexpiry:-"-"}"
1241 json_add_string
"run_info" "base: ${ban_basedir}, backup: ${ban_backupdir}, report: ${ban_reportdir}"
1242 json_add_string
"run_flags" "auto: $(f_char ${ban_autodetect}), proto (4/6): $(f_char ${ban_protov4})/$(f_char ${ban_protov6}), log (pre/inp/fwd/lan): $(f_char ${ban_logprerouting})/$(f_char ${ban_loginput})/$(f_char ${ban_logforwardwan})/$(f_char ${ban_logforwardlan}), dedup: $(f_char ${ban_deduplicate}), split: $(f_char ${split}), custom feed: $(f_char ${custom_feed}), allowed only: $(f_char ${ban_allowlistonly})"
1243 json_add_string
"last_run" "${runtime:-"-"}"
1244 json_add_string
"system_info" "cores: ${ban_cores}, memory: ${ban_memory}, device: ${ban_sysver}"
1245 json_dump
>"${ban_rtfile}"
1248 # get status information
1251 local key keylist value values
1253 [ -z "${ban_dev}" ] && f_conf
1254 json_load_file
"${ban_rtfile}" >/dev
/null
2>&1
1255 if json_get_keys keylist
; then
1256 printf "%s\n" "::: banIP runtime information"
1257 for key
in ${keylist}; do
1258 if [ "${key}" = "active_feeds" ] ||
[ "${key}" = "active_uplink" ]; then
1259 json_get_values values
"${key}" >/dev
/null
2>&1
1260 value
="${values// /, }"
1261 elif [ "${key}" = "wan_devices" ]; then
1262 json_get_values values
"${key}" >/dev
/null
2>&1
1263 value
="wan: ${values// /, } / "
1264 json_get_values values
"wan_interfaces" >/dev
/null
2>&1
1265 value
="${value}wan-if: ${values// /, } / "
1266 json_get_values values
"vlan_allow" >/dev
/null
2>&1
1267 value
="${value}vlan-allow: ${values// /, } / "
1268 json_get_values values
"vlan_block" >/dev
/null
2>&1
1269 value
="${value}vlan-block: ${values// /, }"
1270 key
="active_devices"
1272 json_get_var value
"${key}" >/dev
/null
2>&1
1273 if [ "${key}" = "status" ]; then
1274 value
="${value} ($(f_actual))"
1277 if [ "${key}" != "wan_interfaces" ] && [ "${key}" != "vlan_allow" ] && [ "${key}" != "vlan_block" ]; then
1278 printf " + %-17s : %s\n" "${key}" "${value:-"-"}"
1282 printf "%s\n" "::: no banIP runtime information available"
1289 local cnt list domain lookup ip elementsv4 elementsv6 start_time end_time duration cnt_domain
="0" cnt_ip
="0" feed
="${1}"
1291 [ -z "${ban_dev}" ] && f_conf
1292 start_time
="$(date "+%s
")"
1293 if [ "${feed}" = "allowlist" ]; then
1294 list
="$("${ban_awkcmd}" '/^([[:alnum:]_-]{1,63}\.)+[[:alpha:]]+([[:space:]]|$)/{printf "%s
",tolower($1)}' "${ban_allowlist}" 2>/dev/null)"
1295 elif [ "${feed}" = "blocklist" ]; then
1296 list
="$("${ban_awkcmd}" '/^([[:alnum:]_-]{1,63}\.)+[[:alpha:]]+([[:space:]]|$)/{printf "%s
",tolower($1)}' "${ban_blocklist}" 2>/dev/null)"
1299 for domain
in ${list}; do
1300 lookup
="$("${ban_lookupcmd}" "${domain}" ${ban_resolver} 2>/dev/null | "${ban_awkcmd}" '/^Address[ 0-9]*: /{if(!seen[$NF]++)printf "%s ",$NF}' 2>/dev/null)"
1301 for ip in ${lookup}; do
1302 if [ "${ip%%.*}" = "0" ] || [ -z "${ip%%::*}" ]; then
1305 if { [ "${feed}" = "allowlist" ] && ! "${ban_grepcmd}" -q "^${ip}" "${ban_allowlist}"; } ||
1306 { [ "${feed}" = "blocklist" ] && ! "${ban_grepcmd}" -q "^${ip}" "${ban_blocklist}"; }; then
1307 if [ "${ip##*:}" = "${ip}" ]; then
1308 elementsv4="${elementsv4} ${ip},"
1310 elementsv6="${elementsv6} ${ip},"
1312 if [ "${feed}" = "allowlist" ] && [ "${ban_autoallowlist}" = "1" ]; then
1313 printf "%-42s%s\n" "${ip}" "# '${domain}' added on $(date "+%Y-%m-%d %H:%M:%S")" >>"${ban_allowlist}"
1314 elif [ "${feed}" = "blocklist" ] && [ "${ban_autoblocklist}" = "1" ]; then
1315 printf "%-42s%s\n" "${ip}" "# '${domain}' added on $(date "+%Y-%m-%d %H:%M:%S")" >>"${ban_blocklist}"
1317 cnt_ip="$((cnt_ip + 1))"
1321 cnt_domain="$((cnt_domain + 1))"
1323 if [ -n "${elementsv4}" ]; then
1324 if ! "${ban_nftcmd}" add element inet banIP "${feed}v4" { ${elementsv4} } >/dev/null 2>&1; then
1325 f_log "info" "can't add lookup
file to Set
'${feed}v4'"
1328 if [ -n "${elementsv6}" ]; then
1329 if ! "${ban_nftcmd}" add element inet banIP "${feed}v6" { ${elementsv6} } >/dev
/null
2>&1; then
1330 f_log
"info" "can't add lookup file to Set '${feed}v6'"
1333 end_time
="$(date "+%s
")"
1334 duration
="$(((end_time - start_time) / 60))m $(((end_time - start_time) % 60))s"
1336 f_log
"debug" "f_lookup ::: feed: ${feed}, domains: ${cnt_domain}, IPs: ${cnt_ip}, duration: ${duration}"
1342 local report_jsn report_txt tmp_val ruleset_raw item table_sets set_cnt set_input set_forwardwan set_forwardlan set_cntinput set_cntforwardwan set_cntforwardlan set_proto set_dport set_details
1343 local expr detail jsnval timestamp autoadd_allow autoadd_block sum_sets sum_setinput sum_setforwardwan sum_setforwardlan sum_setelements sum_cntinput sum_cntforwardwan sum_cntforwardlan
1344 local sum_synflood sum_udpflood sum_icmpflood sum_ctinvalid sum_tcpinvalid output
="${1}"
1345 [ -z "${ban_dev}" ] && f_conf
1346 f_mkdir
"${ban_reportdir}"
1347 report_jsn
="${ban_reportdir}/ban_report.jsn"
1348 report_txt
="${ban_reportdir}/ban_report.txt"
1350 # json output preparation
1352 ruleset_raw
="$("${ban_nftcmd}" -tj list ruleset 2>/dev/null)"
1353 table_sets
="$(printf "%s
" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.set.table="banIP
"&&@.set.family="inet
"].set.name')"
1356 sum_setforwardwan
="0"
1357 sum_setforwardlan
="0"
1360 sum_cntforwardwan
="0"
1361 sum_cntforwardlan
="0"
1362 sum_synflood
="$(printf "%s
" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-synflood
"].*.packets')"
1363 sum_udpflood
="$(printf "%s
" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-udpflood
"].*.packets')"
1364 sum_icmpflood
="$(printf "%s
" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-icmpflood
"].*.packets')"
1365 sum_ctinvalid
="$(printf "%s
" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-ctinvalid
"].*.packets')"
1366 sum_tcpinvalid
="$(printf "%s
" "${ruleset_raw}" | "${ban_jsoncmd}" -qe '@.nftables[@.counter.name="cnt-tcpinvalid
"].*.packets')"
1367 timestamp
="$(date "+%Y-
%m-
%d
%H
:%M
:%S
")"
1371 printf "\t%s\n" '"sets":{'
1372 for item
in ${table_sets}; do
1374 set_cntforwardwan
=""
1375 set_cntforwardlan
=""
1379 [ -z "${set_cntinput}" ] && set_cntinput="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-input\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].counter.packets")"
1380 [ "${expr}" = "1" ] && [ -z "${set_dport}" ] && set_dport="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-input\"][@.expr[${expr}].match.right=\"@${item}\"].
expr[*].match.right.
set")"
1381 [ "${expr}" = "1" ] && [ -z "${set_proto}" ] && set_proto="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-input\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].match.left.payload.protocol")"
1382 [ -z "${set_cntforwardwan}" ] && set_cntforwardwan="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].
expr[*].counter.packets
")"
1383 [ "${expr}" = "1" ] && [ -z "${set_dport}" ] && set_dport="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].match.right.set")"
1384 [ "${expr}" = "1" ] && [ -z "${set_proto}" ] && set_proto="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"wan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].
expr[*].match.left.payload.protocol
")"
1385 [ -z "${set_cntforwardlan}" ] && set_cntforwardlan="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].counter.packets")"
1386 [ "${expr}" = "1" ] && [ -z "${set_dport}" ] && set_dport="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].
expr[*].match.right.
set")"
1387 [ "${expr}" = "1" ] && [ -z "${set_proto}" ] && set_proto="$(printf "%s" "${ruleset_raw}" | "${ban_jsoncmd}" -ql1 -e "@.nftables[@.rule.table=\"banIP\"&&@.rule.chain=\"lan-forward\"][@.expr[${expr}].match.right=\"@${item}\"].expr[*].match.left.payload.protocol")"
1389 if [ "${ban_reportelements}" = "1" ]; then
1390 set_cnt="$
("${ban_nftcmd}" -j list set inet banIP "${item}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]' |
wc -l 2>/dev
/null
)"
1391 sum_setelements="$
((sum_setelements
+ set_cnt
))"
1394 sum_setelements="n
/a
"
1396 if [ -n "${set_dport}" ]; then
1397 set_dport="${set_dport//[\{\}\":]/}"
1398 set_dport="${set_dport#\[ *}"
1399 set_dport="${set_dport%* \]}"
1400 set_dport="${set_proto}: $
(f_trim
"${set_dport}")"
1402 if [ -n "${set_cntinput}" ]; then
1404 sum_setinput="$
((sum_setinput
+ 1))"
1405 sum_cntinput="$
((sum_cntinput
+ set_cntinput
))"
1410 if [ -n "${set_cntforwardwan}" ]; then
1412 sum_setforwardwan="$
((sum_setforwardwan
+ 1))"
1413 sum_cntforwardwan="$
((sum_cntforwardwan
+ set_cntforwardwan
))"
1416 set_cntforwardwan=""
1418 if [ -n "${set_cntforwardlan}" ]; then
1420 sum_setforwardlan="$
((sum_setforwardlan
+ 1))"
1421 sum_cntforwardlan="$
((sum_cntforwardlan
+ set_cntforwardlan
))"
1424 set_cntforwardlan=""
1426 [ "${sum_sets}" -gt "0" ] && printf "%s
\n" ","
1427 printf "\t\t%s
\n" "\"${item}\":{"
1428 printf "\t\t\t%s
\n" "\"cnt_elements
\": \"${set_cnt}\","
1429 printf "\t\t\t%s
\n" "\"cnt_input
\": \"${set_cntinput}\","
1430 printf "\t\t\t%s
\n" "\"input
\": \"${set_input}\","
1431 printf "\t\t\t%s
\n" "\"cnt_forwardwan
\": \"${set_cntforwardwan}\","
1432 printf "\t\t\t%s
\n" "\"wan_forward
\": \"${set_forwardwan}\","
1433 printf "\t\t\t%s
\n" "\"cnt_forwardlan
\": \"${set_cntforwardlan}\","
1434 printf "\t\t\t%s
\n" "\"lan_forward
\": \"${set_forwardlan}\"",
1435 printf "\t\t\t%s
\n" "\"port
\": \"${set_dport:-"-"}\""
1437 sum_sets="$
((sum_sets
+ 1))"
1439 printf "\n\t%s
\n" "},"
1440 printf "\t%s
\n" "\"timestamp
\": \"${timestamp}\","
1441 printf "\t%s
\n" "\"autoadd_allow
\": \"$
("${ban_grepcmd}" -c "added on ${timestamp% *}" "${ban_allowlist}")\","
1442 printf "\t%s
\n" "\"autoadd_block
\": \"$
("${ban_grepcmd}" -c "added on ${timestamp% *}" "${ban_blocklist}")\","
1443 printf "\t%s
\n" "\"sum_synflood
\": \"${sum_synflood}\","
1444 printf "\t%s
\n" "\"sum_udpflood
\": \"${sum_udpflood}\","
1445 printf "\t%s
\n" "\"sum_icmpflood
\": \"${sum_icmpflood}\","
1446 printf "\t%s
\n" "\"sum_ctinvalid
\": \"${sum_ctinvalid}\","
1447 printf "\t%s
\n" "\"sum_tcpinvalid
\": \"${sum_tcpinvalid}\","
1448 printf "\t%s
\n" "\"sum_sets
\": \"${sum_sets}\","
1449 printf "\t%s
\n" "\"sum_setinput
\": \"${sum_setinput}\","
1450 printf "\t%s
\n" "\"sum_setforwardwan
\": \"${sum_setforwardwan}\","
1451 printf "\t%s
\n" "\"sum_setforwardlan
\": \"${sum_setforwardlan}\","
1452 printf "\t%s
\n" "\"sum_setelements
\": \"${sum_setelements}\","
1453 printf "\t%s
\n" "\"sum_cntinput
\": \"${sum_cntinput}\","
1454 printf "\t%s
\n" "\"sum_cntforwardwan
\": \"${sum_cntforwardwan}\","
1455 printf "\t%s
\n" "\"sum_cntforwardlan
\": \"${sum_cntforwardlan}\""
1459 # text output preparation
1461 if [ "${output}" != "json
" ] && [ -s "${report_jsn}" ]; then
1464 if json_load_file "${report_jsn}" >/dev/null 2>&1; then
1465 json_get_var timestamp "timestamp
" >/dev/null 2>&1
1466 json_get_var autoadd_allow "autoadd_allow
" >/dev/null 2>&1
1467 json_get_var autoadd_block "autoadd_block
" >/dev/null 2>&1
1468 json_get_var sum_synflood "sum_synflood
" >/dev/null 2>&1
1469 json_get_var sum_udpflood "sum_udpflood
" >/dev/null 2>&1
1470 json_get_var sum_icmpflood "sum_icmpflood
" >/dev/null 2>&1
1471 json_get_var sum_ctinvalid "sum_ctinvalid
" >/dev/null 2>&1
1472 json_get_var sum_tcpinvalid "sum_tcpinvalid
" >/dev/null 2>&1
1473 json_get_var sum_sets "sum_sets
" >/dev/null 2>&1
1474 json_get_var sum_setinput "sum_setinput
" >/dev/null 2>&1
1475 json_get_var sum_setforwardwan "sum_setforwardwan
" >/dev/null 2>&1
1476 json_get_var sum_setforwardlan "sum_setforwardlan
" >/dev/null 2>&1
1477 json_get_var sum_setelements "sum_setelements
" >/dev/null 2>&1
1478 json_get_var sum_cntinput "sum_cntinput
" >/dev/null 2>&1
1479 json_get_var sum_cntforwardwan "sum_cntforwardwan
" >/dev/null 2>&1
1480 json_get_var sum_cntforwardlan "sum_cntforwardlan
" >/dev/null 2>&1
1482 printf "%s
\n%s
\n%s
\n" ":::" "::: banIP Set Statistics
" ":::"
1483 printf "%s
\n" " Timestamp
: ${timestamp}"
1484 printf "%s
\n" " ------------------------------"
1485 printf "%s
\n" " blocked syn-flood packets
: ${sum_synflood}"
1486 printf "%s
\n" " blocked udp-flood packets
: ${sum_udpflood}"
1487 printf "%s
\n" " blocked icmp-flood packets
: ${sum_icmpflood}"
1488 printf "%s
\n" " blocked invalid ct packets
: ${sum_ctinvalid}"
1489 printf "%s
\n" " blocked invalid tcp packets
: ${sum_tcpinvalid}"
1490 printf "%s
\n" " ----------"
1491 printf "%s
\n" " auto-added IPs to allowlist
: ${autoadd_allow}"
1492 printf "%s
\n\n" " auto-added IPs to blocklist
: ${autoadd_block}"
1493 json_select "sets
" >/dev/null 2>&1
1494 json_get_keys table_sets >/dev/null 2>&1
1495 if [ -n "${table_sets}" ]; then
1496 printf "%-25s%-15s%-24s%-24s%-24s%s
\n" " Set
" "| Elements
" "| WAN-Input
(packets
)" "| WAN-Forward
(packets
)" "| LAN-Forward
(packets
)" "| Port
/Protocol Limit
"
1497 printf "%s
\n" " ---------------------+--------------+-----------------------+-----------------------+-----------------------+------------------------"
1498 for item in ${table_sets}; do
1499 printf " %-21s" "${item}"
1500 json_select "${item}"
1501 json_get_keys set_details
1502 for detail in ${set_details}; do
1503 json_get_var jsnval "${detail}" >/dev/null 2>&1
1506 printf "%-15s" "|
${jsnval}"
1508 "cnt_input
" | "cnt_forwardwan
" | "cnt_forwardlan
")
1509 [ -n "${jsnval}" ] && tmp_val=": ${jsnval}"
1512 printf "%-24s" "|
${jsnval}${tmp_val}"
1520 printf "%s
\n" " ---------------------+--------------+-----------------------+-----------------------+-----------------------+------------------------"
1521 printf "%-25s%-15s%-24s%-24s%s
\n" " ${sum_sets}" "| ${sum_setelements}" "| ${sum_setinput} (${sum_cntinput})" "| ${sum_setforwardwan} (${sum_cntforwardwan})" "| ${sum_setforwardlan} (${sum_cntforwardlan})"
1527 # output channel (text|json|mail)
1531 [ -s "${report_txt}" ] && "${ban_catcmd}" "${report_txt}"
1534 [ -s "${report_jsn}" ] && "${ban_catcmd}" "${report_jsn}"
1537 [ -n "${ban_mailreceiver}" ] && [ -x "${ban_mailcmd}" ] && f_mail
1540 rm -f "${report_txt}"
1546 local item table_sets ip proto hold cnt result_flag="/var
/run
/banIP.search
" input="${1}"
1548 if [ -n "${input}" ]; then
1549 ip="$
(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9]{1,3}\\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])(\\/(1?[0-9]|2?[0-9]|3?[0-2]))?[[:space:]]*$)"}{printf "%s",RT
}')"
1550 [ -n "${ip}" ] && proto="v4"
1551 if [ -z "${proto}" ]; then
1552 ip="$(printf "%s" "${input}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9A-f]{0,4}:){1,7}[0-9A-f]{0,4}:?(\\/(1?[0-2][0-8]|[0-9][0-9]))?)([[:space:]].*|$)"}{printf "%s",RT}')"
1553 [ -n "${ip}" ] && proto="v6
"
1556 if [ -n "${proto}" ]; then
1557 table_sets="$
("${ban_nftcmd}" -tj list ruleset 2>/dev/null | "${ban_jsoncmd}" -qe "@.nftables[@.set.table=\"banIP\"&&@.set.type=\"ip${proto}_addr\"].set.name")"
1559 printf "%s
\n%s
\n%s
\n" ":::" "::: no valid search input
" ":::"
1562 printf "%s
\n%s
\n%s
\n" ":::" "::: banIP Search
" ":::"
1563 printf " %s
\n" "Looking
for IP
'${ip}' on $
(date "+%Y-%m-%d %H:%M:%S")"
1564 printf " %s
\n" "---"
1566 for item in ${table_sets}; do
1567 [ -f "${result_flag}" ] && break
1569 if "${ban_nftcmd}" get element inet banIP "${item}" "{ ${ip} }" >/dev/null 2>&1; then
1570 printf " %s
\n" "IP found
in Set
'${item}'"
1574 hold="$
((cnt
% ban_cores
))"
1575 [ "${hold}" = "0" ] && wait
1579 [ -f "${result_flag}" ] && rm -f "${result_flag}" || printf " %s
\n" "IP not found
"
1585 local set_elements input="${1}"
1587 if [ -z "${input}" ]; then
1588 printf "%s
\n%s
\n%s
\n" ":::" "::: no valid survey input
" ":::"
1591 set_elements="$
("${ban_nftcmd}" -j list set inet banIP "${input}" 2>/dev/null | "${ban_jsoncmd}" -qe '@.nftables[*].set.elem[*]')"
1592 printf "%s
\n%s
\n%s
\n" ":::" "::: banIP Survey
" ":::"
1593 printf " %s
\n" "List of elements
in the Set
'${input}' on $
(date "+%Y-%m-%d %H:%M:%S")"
1594 printf " %s
\n" "---"
1595 [ -n "${set_elements}" ] && printf "%s
\n" "${set_elements}" || printf " %s
\n" "empty Set
"
1603 # load mail template
1605 if [ -r "${ban_mailtemplate}" ]; then
1606 . "${ban_mailtemplate}"
1608 f_log "info
" "no
mail template
"
1610 [ -z "${mail_text}" ] && f_log "info
" "no
mail content
"
1611 [ "${ban_debug}" = "1" ] && msmtp_debug="--debug"
1615 ban_mailhead="From
: ${ban_mailsender}\nTo: ${ban_mailreceiver}\nSubject: ${ban_mailtopic}\nReply-to: ${ban_mailsender}\nMime
-Version: 1.0\nContent
-Type: text
/html
;charset
=utf-8
\nContent
-Disposition: inline
\n\n"
1616 printf "%b
" "${ban_mailhead}${mail_text}" | "${ban_mailcmd}" --timeout=10 ${msmtp_debug} -a "${ban_mailprofile}" "${ban_mailreceiver}" >/dev/null 2>&1
1617 f_log "info
" "send status
mail (${?})"
1619 f_log "debug
" "f_mail
::: notification
: ${ban_mailnotification}, template: ${ban_mailtemplate}, profile: ${ban_mailprofile}, receiver: ${ban_mailreceiver}, rc: ${?}"
1625 local daemon logread_cmd loglimit_cmd nft_expiry line proto ip log_raw log_count rdap_log rdap_rc rdap_prefix rdap_length rdap_info
1627 if [ -f "${ban_logreadfile}" ]; then
1628 logread_cmd="${ban_logreadcmd} -qf ${ban_logreadfile} 2>/dev/null | ${ban_grepcmd} -e \"${ban_logterm%%??}\" 2>/dev
/null
"
1629 loglimit_cmd="${ban_logreadcmd} -qn ${ban_loglimit} ${ban_logreadfile} 2>/dev
/null
"
1630 elif printf "%s
" "${ban_packages}" | "${ban_grepcmd}" -q '"logd
'; then
1631 logread_cmd="${ban_logreadcmd} -fe \"${ban_logterm%%??}\" 2>/dev/null"
1632 loglimit_cmd="${ban_logreadcmd} -l ${ban_loglimit} 2>/dev/null"
1635 if [ -x "${ban_logreadcmd}" ] && [ -n "${logread_cmd}" ] && [ -n "${loglimit_cmd}" ] && [ -n "${ban_logterm%%??}" ] && [ "${ban_loglimit}" != "0" ]; then
1636 f_log "info" "start detached banIP log service (${ban_logreadcmd})"
1637 [ -n "${ban_nftexpiry}" ] && nft_expiry="timeout $(printf "%s" "${ban_nftexpiry}" | "${ban_grepcmd}" -oE "([0-9]+[d|h|m|s])+$")"
1638 eval "${logread_cmd}" |
1639 while read -r line; do
1641 : >"${ban_rdapfile}"
1642 if [ -z "${daemon}" ]; then
1643 daemon="$(printf "%s" "${line}" | "${ban_awkcmd}" 'BEGIN{RS="dropbear"}{if(!seen[RT]++)printf "%s",RT}')"
1644 [ -z "${daemon}" ] && daemon="sshd
"
1646 ip="$
(printf "%s" "${line}" | "${ban_awkcmd}" 'BEGIN{RS="(([0-9]{1,3}\\.){3}[0-9]{1,3})+"}{if(!seen
[RT
]++)printf "%s ",RT
}')"
1647 ip="$(f_trim "${ip}")"
1649 [ -n "${ip}" ] && proto="v4"
1650 if [ -z "${proto}" ]; then
1651 if [ "${daemon}" = "dropbear" ]; then
1652 ip="$(printf "%s" "${line}" | "${ban_awkcmd}" 'BEGIN{RS="([A-Fa-f0-9]{1,4}::?){3,7}([A-Fa-f0-9]:?)+"}{if(!seen[RT]++)printf "%s ",RT}')"
1655 ip="$
(printf "%s" "${line}" | "${ban_awkcmd}" 'BEGIN{RS="([A-Fa-f0-9]{1,4}::?){3,7}[A-Fa-f0-9]{1,4}"}{if(!seen
[RT
]++)printf "%s ",RT
}')"
1657 ip="$(f_trim "${ip}")"
1659 [ -n "${ip}" ] && proto="v6"
1661 if [ -n "${proto}" ] && ! "${ban_nftcmd}" get element inet banIP allowlist"${proto}" "{ ${ip} }" >/dev/null 2>&1 && ! "${ban_nftcmd}" get element inet banIP blocklist"${proto}" "{ ${ip} }" >/dev/null 2>&1; then
1662 f_log "info" "suspicious IP '${ip}'"
1663 log_raw="$(eval ${loglimit_cmd})"
1664 log_count="$(printf "%s\n" "${log_raw}" | "${ban_grepcmd}" -c "suspicious IP '${ip}'")"
1665 if [ "${log_count}" -ge "${ban_logcount}" ]; then
1666 if [ "${ban_autoblocksubnet}" = "1" ]; then
1667 rdap_log
="$("${ban_fetchcmd}" ${ban_rdapparm} "${ban_rdapfile}" "${ban_rdapurl}${ip}" 2>&1)"
1669 if [ "${rdap_rc}" = "0" ] && [ -s "${ban_rdapfile}" ]; then
1670 [ "${proto}" = "v4" ] && rdap_prefix
="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*.v4prefix')"
1671 [ "${proto}" = "v6" ] && rdap_prefix
="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*.v6prefix')"
1672 rdap_length
="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.cidr0_cidrs.*.length')"
1673 rdap_info
="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.country' -qe '@.notices[@.title="Source
"].description[1]' | awk 'BEGIN{RS="";FS="\n"}{printf "%s
, %s
",$1,$2}')"
1674 [ -z "${rdap_info}" ] && rdap_info="$(jsonfilter -l1 -i "${ban_rdapfile}" -qe '@.notices[0].links[0].value' | awk 'BEGIN{FS="[/.]"}{printf"%s
, %s
","n
/a
",toupper($4)}')"
1675 if [ -n "${rdap_prefix}" ] && [ -n "${rdap_length}" ]; then
1676 if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" { ${rdap_prefix}/${rdap_length} ${nft_expiry} } >/dev/null 2>&1; then
1677 f_log "info
" "add IP range
'${rdap_prefix}/${rdap_length}' (source: ${rdap_info:-"n/a"} ::: expiry: ${ban_nftexpiry:-"-"}) to blocklist${proto} set"
1681 f_log "info" "rdap request failed (rc: ${rdap_rc:-"-"}/log: ${rdap_log})"
1684 if [ "${ban_autoblocksubnet}" = "0" ] || [ "${rdap_rc}" != "0" ] || [ ! -s "${ban_rdapfile}" ] || [ -z "${rdap_prefix}" ] || [ -z "${rdap_length}" ]; then
1685 if "${ban_nftcmd}" add element inet banIP "blocklist${proto}" { ${ip} ${nft_expiry} } >/dev/null 2>&1; then
1686 f_log "info" "add IP '${ip}' (expiry: ${ban_nftexpiry:-"-"}) to blocklist${proto} set"
1689 if [ -z "${ban_nftexpiry}" ] && [ "${ban_autoblocklist}" = "1" ] && ! "${ban_grepcmd}" -q "^${ip}" "${ban_blocklist}"; then
1690 printf "%-42s%s
\n" "${ip}" "# added on $(date "+%Y-%m-%d %H:%M:%S")" >>"${ban_blocklist}"
1691 f_log
"info" "add IP '${ip}' to local blocklist"
1697 f_log
"info" "start detached no-op banIP service"
1704 if [ -r "/lib/functions.sh" ] && [ -r "/lib/functions/network.sh" ] && [ -r "/usr/share/libubox/jshn.sh" ]; then
1705 .
"/lib/functions.sh"
1706 .
"/lib/functions/network.sh"
1707 .
"/usr/share/libubox/jshn.sh"
1709 f_log
"emerg" "system libraries not found"
1712 # initial system calls
1714 ban_awkcmd
="$(f_cmd gawk awk)"
1715 ban_catcmd
="$(f_cmd cat)"
1716 ban_fw4cmd
="$(f_cmd fw4)"
1717 ban_grepcmd
="$(f_cmd grep)"
1718 ban_jsoncmd
="$(f_cmd jsonfilter)"
1719 ban_logcmd
="$(f_cmd logger)"
1720 ban_lookupcmd
="$(f_cmd nslookup)"
1721 ban_mailcmd
="$(f_cmd msmtp true)"
1722 ban_nftcmd
="$(f_cmd nft)"
1723 ban_pgrepcmd
="$(f_cmd pgrep)"
1724 ban_sedcmd
="$(f_cmd sed)"
1725 ban_ubuscmd
="$(f_cmd ubus)"
1726 ban_zcatcmd
="$(f_cmd zcat)"
1728 if [ "${ban_action}" != "stop" ]; then
1729 [ ! -d "/etc/banip" ] && f_log
"err" "no banIP config directory"
1730 [ ! -r "/etc/config/banip" ] && f_log
"err" "no banIP config"
1731 [ "$(uci_get banip global ban_enabled)" = "0" ] && f_log
"err" "banIP is disabled"