1 d2c27298 2024-01-30 xs #!/bin/sh
 2 4dabe9d4 2025-06-05 xs # ISC License
 3 4dabe9d4 2025-06-05 xs #
 4 4dabe9d4 2025-06-05 xs # Copyright 2025 xs <xs@inda.re>
 5 4dabe9d4 2025-06-05 xs #
 6 4dabe9d4 2025-06-05 xs # Permission to use, copy, modify, and/or distribute this software for any
 7 4dabe9d4 2025-06-05 xs # purpose with or without fee is hereby granted, provided that the above
 8 4dabe9d4 2025-06-05 xs # copyright notice and this permission notice appear in all copies.
 9 4dabe9d4 2025-06-05 xs #
10 4dabe9d4 2025-06-05 xs # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
11 4dabe9d4 2025-06-05 xs # REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
12 4dabe9d4 2025-06-05 xs # FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
13 4dabe9d4 2025-06-05 xs # INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
14 4dabe9d4 2025-06-05 xs # LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
15 4dabe9d4 2025-06-05 xs # OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
16 4dabe9d4 2025-06-05 xs # PERFORMANCE OF THIS SOFTWARE.
17 3115cd3d 2024-01-30 xs 
18 d43799e5 2024-01-30 xs : "${HTTPBAN_WHITELIST:=127.0.0.1}"
19 d43799e5 2024-01-30 xs : "${HTTPBAN_LIMIT_500:=10}"
20 d43799e5 2024-01-30 xs : "${HTTPBAN_LIMIT_400:=10}"
21 d43799e5 2024-01-30 xs : "${HTTPBAN_LIMIT_300:=10}"
22 d43799e5 2024-01-30 xs : "${HTTPBAN_TABLE:=httpban}"
23 3115cd3d 2024-01-30 xs 
24 d2c27298 2024-01-30 xs alias log="logger -st http-ban"
25 bcc5ac46 2024-01-31 xs alias show="doas /sbin/pfctl -t \$HTTPBAN_TABLE -T show"
26 bcc5ac46 2024-01-31 xs alias ban="doas /sbin/pfctl -t \$HTTPBAN_TABLE -T add -f-"
27 bcc5ac46 2024-01-31 xs alias grace="doas /sbin/pfctl -t \$HTTPBAN_TABLE -T delete -f-"
28 3115cd3d 2024-01-30 xs 
29 88f3e13d 2024-01-30 xs # Filter functions returning 'count IP' based on HTTP return code
30 3115cd3d 2024-01-30 xs IN_300_HOSTS() {
31 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 300 && $(NF-1) < 400 { print $2 }' | sort | uniq -c
32 d2c27298 2024-01-30 xs }
33 3115cd3d 2024-01-30 xs 
34 3115cd3d 2024-01-30 xs IN_400_HOSTS() {
35 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 400 && $(NF-1) < 500 { print $2 }' | sort | uniq -c
36 d2c27298 2024-01-30 xs }
37 3115cd3d 2024-01-30 xs 
38 3115cd3d 2024-01-30 xs IN_500_HOSTS() {
39 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 500 && $(NF-1) < 600 { print $2 }' | sort | uniq -c
40 3115cd3d 2024-01-30 xs }
41 3115cd3d 2024-01-30 xs 
42 3115cd3d 2024-01-30 xs # Our local logs
43 d2c27298 2024-01-30 xs access() {
44 3115cd3d 2024-01-30 xs 	doas /bin/cat /var/www/logs/access.log
45 d2c27298 2024-01-30 xs 	doas /usr/bin/zcat /var/www/logs/access.log.*gz 2>/dev/null
46 d2c27298 2024-01-30 xs }
47 3115cd3d 2024-01-30 xs 
48 3115cd3d 2024-01-30 xs limit() {
49 3115cd3d 2024-01-30 xs 	awk -vtrig="${1:-10}" ' $1 >= trig { print $2 }'
50 3115cd3d 2024-01-30 xs }
51 3115cd3d 2024-01-30 xs 
52 d43799e5 2024-01-30 xs # shellcheck disable=SC2086,SC2046
53 d2c27298 2024-01-30 xs block() {
54 88f3e13d 2024-01-30 xs 	set -- $HTTPBAN_WHITELIST
55 d43799e5 2024-01-30 xs 	set -- $(for ip; do printf -- '-e %s ' "$ip"; done)
56 88f3e13d 2024-01-30 xs 	{
57 88f3e13d 2024-01-30 xs 		access | IN_500_HOSTS | limit "$HTTPBAN_LIMIT_500"
58 d43799e5 2024-01-30 xs 		access | IN_400_HOSTS | limit "$HTTPBAN_LIMIT_400"
59 88f3e13d 2024-01-30 xs 		access | IN_300_HOSTS | limit "$HTTPBAN_LIMIT_300"
60 88f3e13d 2024-01-30 xs 	} | sort | uniq | {
61 b72ca3a5 2024-01-30 xs 		if test -n "$*"; then grep -v "$@"; else cat; fi
62 78bfe33e 2024-01-30 xs 	}
63 d2c27298 2024-01-30 xs }
64 3115cd3d 2024-01-30 xs 
65 d2c27298 2024-01-30 xs umask 127
66 3115cd3d 2024-01-30 xs 
67 d2c27298 2024-01-30 xs block | sort >/tmp/http-ban.new
68 3115cd3d 2024-01-30 xs 
69 88f3e13d 2024-01-30 xs # Diff processing
70 d2c27298 2024-01-30 xs show | sort | awk '{ print $1 }' >/tmp/http-ban.current
71 d2c27298 2024-01-30 xs NEW=$(comm -23 /tmp/http-ban.new /tmp/http-ban.current)
72 d2c27298 2024-01-30 xs GRACE=$(comm -13 /tmp/http-ban.new /tmp/http-ban.current)
73 3115cd3d 2024-01-30 xs 
74 d2c27298 2024-01-30 xs rm /tmp/http-ban.*
75 3115cd3d 2024-01-30 xs 
76 d2c27298 2024-01-30 xs test -n "$NEW" -o -n "$GRACE" || exit 0
77 3115cd3d 2024-01-30 xs 
78 3115cd3d 2024-01-30 xs # There's new IP's
79 3115cd3d 2024-01-30 xs if test -n "$NEW"; then
80 3115cd3d 2024-01-30 xs 	log Banning new IPs:
81 3115cd3d 2024-01-30 xs 	log <<..
82 d2c27298 2024-01-30 xs $NEW
83 3115cd3d 2024-01-30 xs ..
84 3115cd3d 2024-01-30 xs 	ban <<..
85 d2c27298 2024-01-30 xs $NEW
86 3115cd3d 2024-01-30 xs ..
87 3115cd3d 2024-01-30 xs fi
88 3115cd3d 2024-01-30 xs 
89 3115cd3d 2024-01-30 xs # There's Old IP's not attacking anymore
90 3115cd3d 2024-01-30 xs if test -n "$GRACE"; then
91 3115cd3d 2024-01-30 xs 	log Gracing old IPs:
92 3115cd3d 2024-01-30 xs 	log <<..
93 d2c27298 2024-01-30 xs $GRACE
94 3115cd3d 2024-01-30 xs ..
95 3115cd3d 2024-01-30 xs 
96 3115cd3d 2024-01-30 xs 	grace <<..
97 3115cd3d 2024-01-30 xs $GRACE
98 3115cd3d 2024-01-30 xs ..
99 3115cd3d 2024-01-30 xs fi