1 d2c27298 2024-01-30 xs #!/bin/sh
 2 3115cd3d 2024-01-30 xs 
 3 d2c27298 2024-01-30 xs QUICK_WHITELIST=192.168.10.10
 4 3115cd3d 2024-01-30 xs 
 5 d2c27298 2024-01-30 xs alias log="logger -st http-ban"
 6 d2c27298 2024-01-30 xs alias show="doas /sbin/pfctl -t players -T show"
 7 d2c27298 2024-01-30 xs alias ban="doas /sbin/pfctl -t players -T add -f-"
 8 d2c27298 2024-01-30 xs alias grace="doas /sbin/pfctl -t players -T delete -f-"
 9 3115cd3d 2024-01-30 xs 
10 3115cd3d 2024-01-30 xs # Filter functions returning 'count	IP' based on HTTP return code
11 3115cd3d 2024-01-30 xs IN_300_HOSTS() {
12 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 300 && $(NF-1) < 400 { print $2 }' | sort | uniq -c
13 d2c27298 2024-01-30 xs }
14 3115cd3d 2024-01-30 xs 
15 3115cd3d 2024-01-30 xs IN_400_HOSTS() {
16 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 400 && $(NF-1) < 500 { print $2 }' | sort | uniq -c
17 d2c27298 2024-01-30 xs }
18 3115cd3d 2024-01-30 xs 
19 3115cd3d 2024-01-30 xs IN_500_HOSTS() {
20 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 500 && $(NF-1) < 600 { print $2 }' | sort | uniq -c
21 3115cd3d 2024-01-30 xs }
22 3115cd3d 2024-01-30 xs 
23 3115cd3d 2024-01-30 xs # Our local logs
24 d2c27298 2024-01-30 xs access() {
25 d2c27298 2024-01-30 xs 	last_access
26 3115cd3d 2024-01-30 xs 	doas /bin/cat /var/www/logs/access.log
27 d2c27298 2024-01-30 xs 	doas /usr/bin/zcat /var/www/logs/access.log.*gz 2>/dev/null
28 d2c27298 2024-01-30 xs }
29 3115cd3d 2024-01-30 xs 
30 d2c27298 2024-01-30 xs apply_whitelist() {
31 3115cd3d 2024-01-30 xs 	GF=$(for ip in $(printf %s\\n $QUICK_WHITELIST); do printf -- '-ve %s\n' "$ip"; done)
32 d2c27298 2024-01-30 xs 	GF=${GF:-'.*'}
33 d2c27298 2024-01-30 xs 	grep $GF
34 d2c27298 2024-01-30 xs }
35 3115cd3d 2024-01-30 xs 
36 3115cd3d 2024-01-30 xs limit() {
37 3115cd3d 2024-01-30 xs 	awk -vtrig="${1:-10}" ' $1 >= trig { print $2 }'
38 3115cd3d 2024-01-30 xs }
39 3115cd3d 2024-01-30 xs 
40 3115cd3d 2024-01-30 xs pre_block() {
41 3115cd3d 2024-01-30 xs 	access | IN_500_HOSTS | limit 1
42 3115cd3d 2024-01-30 xs 	access | IN_400_HOSTS | limit 3 
43 3115cd3d 2024-01-30 xs 	access | IN_300_HOSTS | limit 3
44 3115cd3d 2024-01-30 xs }
45 3115cd3d 2024-01-30 xs 
46 d2c27298 2024-01-30 xs block() {
47 d2c27298 2024-01-30 xs 	pre_block | sort | uniq | apply_whitelist 
48 d2c27298 2024-01-30 xs }
49 3115cd3d 2024-01-30 xs 
50 d2c27298 2024-01-30 xs umask 127
51 3115cd3d 2024-01-30 xs 
52 d2c27298 2024-01-30 xs block | sort >/tmp/http-ban.new
53 3115cd3d 2024-01-30 xs 
54 d2c27298 2024-01-30 xs show | sort | awk '{ print $1 }' >/tmp/http-ban.current
55 3115cd3d 2024-01-30 xs 
56 d2c27298 2024-01-30 xs DIFF=$(comm /tmp/http-ban.new /tmp/http-ban.current)
57 d2c27298 2024-01-30 xs NEW=$(comm -23 /tmp/http-ban.new /tmp/http-ban.current)
58 d2c27298 2024-01-30 xs GRACE=$(comm -13 /tmp/http-ban.new /tmp/http-ban.current)
59 3115cd3d 2024-01-30 xs 
60 d2c27298 2024-01-30 xs rm /tmp/http-ban.*
61 3115cd3d 2024-01-30 xs 
62 d2c27298 2024-01-30 xs test -n "$NEW" -o -n "$GRACE" || exit 0
63 3115cd3d 2024-01-30 xs 
64 3115cd3d 2024-01-30 xs # There's new IP's
65 3115cd3d 2024-01-30 xs if test -n "$NEW"; then
66 3115cd3d 2024-01-30 xs 	log Banning new IPs:
67 3115cd3d 2024-01-30 xs 	log <<..
68 d2c27298 2024-01-30 xs $NEW
69 3115cd3d 2024-01-30 xs ..
70 3115cd3d 2024-01-30 xs 	ban <<..
71 d2c27298 2024-01-30 xs $NEW
72 3115cd3d 2024-01-30 xs ..
73 3115cd3d 2024-01-30 xs fi
74 3115cd3d 2024-01-30 xs 
75 3115cd3d 2024-01-30 xs # There's Old IP's not attacking anymore
76 3115cd3d 2024-01-30 xs if test -n "$GRACE"; then
77 3115cd3d 2024-01-30 xs 	log Gracing old IPs:
78 3115cd3d 2024-01-30 xs 	log <<..
79 d2c27298 2024-01-30 xs $GRACE
80 3115cd3d 2024-01-30 xs ..
81 3115cd3d 2024-01-30 xs 
82 3115cd3d 2024-01-30 xs 	grace <<..
83 3115cd3d 2024-01-30 xs $GRACE
84 3115cd3d 2024-01-30 xs ..
85 3115cd3d 2024-01-30 xs fi