1 d2c27298 2024-01-30 xs #!/bin/sh
 2 3115cd3d 2024-01-30 xs 
 3 6f397d55 2024-01-30 xs # WARNING!
 4 6f397d55 2024-01-30 xs # Export this variable properly to avoid locking you out
 5 6f397d55 2024-01-30 xs : ${QUICK_WHITELIST:=127.0.0.1}
 6 3115cd3d 2024-01-30 xs 
 7 d2c27298 2024-01-30 xs alias log="logger -st http-ban"
 8 d2c27298 2024-01-30 xs alias show="doas /sbin/pfctl -t players -T show"
 9 d2c27298 2024-01-30 xs alias ban="doas /sbin/pfctl -t players -T add -f-"
10 d2c27298 2024-01-30 xs alias grace="doas /sbin/pfctl -t players -T delete -f-"
11 3115cd3d 2024-01-30 xs 
12 3115cd3d 2024-01-30 xs # Filter functions returning 'count	IP' based on HTTP return code
13 3115cd3d 2024-01-30 xs IN_300_HOSTS() {
14 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 300 && $(NF-1) < 400 { print $2 }' | sort | uniq -c
15 d2c27298 2024-01-30 xs }
16 3115cd3d 2024-01-30 xs 
17 3115cd3d 2024-01-30 xs IN_400_HOSTS() {
18 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 400 && $(NF-1) < 500 { print $2 }' | sort | uniq -c
19 d2c27298 2024-01-30 xs }
20 3115cd3d 2024-01-30 xs 
21 3115cd3d 2024-01-30 xs IN_500_HOSTS() {
22 3115cd3d 2024-01-30 xs 	awk '$(NF-1) >= 500 && $(NF-1) < 600 { print $2 }' | sort | uniq -c
23 3115cd3d 2024-01-30 xs }
24 3115cd3d 2024-01-30 xs 
25 3115cd3d 2024-01-30 xs # Our local logs
26 d2c27298 2024-01-30 xs access() {
27 3115cd3d 2024-01-30 xs 	doas /bin/cat /var/www/logs/access.log
28 d2c27298 2024-01-30 xs 	doas /usr/bin/zcat /var/www/logs/access.log.*gz 2>/dev/null
29 d2c27298 2024-01-30 xs }
30 3115cd3d 2024-01-30 xs 
31 d2c27298 2024-01-30 xs apply_whitelist() {
32 3115cd3d 2024-01-30 xs 	GF=$(for ip in $(printf %s\\n $QUICK_WHITELIST); do printf -- '-ve %s\n' "$ip"; done)
33 d2c27298 2024-01-30 xs 	GF=${GF:-'.*'}
34 d2c27298 2024-01-30 xs 	grep $GF
35 d2c27298 2024-01-30 xs }
36 3115cd3d 2024-01-30 xs 
37 3115cd3d 2024-01-30 xs limit() {
38 3115cd3d 2024-01-30 xs 	awk -vtrig="${1:-10}" ' $1 >= trig { print $2 }'
39 3115cd3d 2024-01-30 xs }
40 3115cd3d 2024-01-30 xs 
41 3115cd3d 2024-01-30 xs pre_block() {
42 3115cd3d 2024-01-30 xs 	access | IN_500_HOSTS | limit 1
43 3115cd3d 2024-01-30 xs 	access | IN_400_HOSTS | limit 3 
44 3115cd3d 2024-01-30 xs 	access | IN_300_HOSTS | limit 3
45 3115cd3d 2024-01-30 xs }
46 3115cd3d 2024-01-30 xs 
47 d2c27298 2024-01-30 xs block() {
48 d2c27298 2024-01-30 xs 	pre_block | sort | uniq | apply_whitelist 
49 d2c27298 2024-01-30 xs }
50 3115cd3d 2024-01-30 xs 
51 d2c27298 2024-01-30 xs umask 127
52 3115cd3d 2024-01-30 xs 
53 d2c27298 2024-01-30 xs block | sort >/tmp/http-ban.new
54 3115cd3d 2024-01-30 xs 
55 d2c27298 2024-01-30 xs show | sort | awk '{ print $1 }' >/tmp/http-ban.current
56 3115cd3d 2024-01-30 xs 
57 d2c27298 2024-01-30 xs DIFF=$(comm /tmp/http-ban.new /tmp/http-ban.current)
58 d2c27298 2024-01-30 xs NEW=$(comm -23 /tmp/http-ban.new /tmp/http-ban.current)
59 d2c27298 2024-01-30 xs GRACE=$(comm -13 /tmp/http-ban.new /tmp/http-ban.current)
60 3115cd3d 2024-01-30 xs 
61 d2c27298 2024-01-30 xs rm /tmp/http-ban.*
62 3115cd3d 2024-01-30 xs 
63 d2c27298 2024-01-30 xs test -n "$NEW" -o -n "$GRACE" || exit 0
64 3115cd3d 2024-01-30 xs 
65 3115cd3d 2024-01-30 xs # There's new IP's
66 3115cd3d 2024-01-30 xs if test -n "$NEW"; then
67 3115cd3d 2024-01-30 xs 	log Banning new IPs:
68 3115cd3d 2024-01-30 xs 	log <<..
69 d2c27298 2024-01-30 xs $NEW
70 3115cd3d 2024-01-30 xs ..
71 3115cd3d 2024-01-30 xs 	ban <<..
72 d2c27298 2024-01-30 xs $NEW
73 3115cd3d 2024-01-30 xs ..
74 3115cd3d 2024-01-30 xs fi
75 3115cd3d 2024-01-30 xs 
76 3115cd3d 2024-01-30 xs # There's Old IP's not attacking anymore
77 3115cd3d 2024-01-30 xs if test -n "$GRACE"; then
78 3115cd3d 2024-01-30 xs 	log Gracing old IPs:
79 3115cd3d 2024-01-30 xs 	log <<..
80 d2c27298 2024-01-30 xs $GRACE
81 3115cd3d 2024-01-30 xs ..
82 3115cd3d 2024-01-30 xs 
83 3115cd3d 2024-01-30 xs 	grace <<..
84 3115cd3d 2024-01-30 xs $GRACE
85 3115cd3d 2024-01-30 xs ..
86 3115cd3d 2024-01-30 xs fi