forked from trick77/ipset-blacklist
-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathnft-blacklist.sh
executable file
·142 lines (124 loc) · 5.77 KB
/
nft-blacklist.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
#!/usr/bin/env bash
#
# usage nft-blacklist.sh <configuration file>
# eg: nft-blacklist.sh /etc/nft-blacklist/nft-blacklist.conf
#
SET_NAME_PREFIX=blacklist
SET_NAME_V4="${SET_NAME_PREFIX}_v4"
SET_NAME_V6="${SET_NAME_PREFIX}_v6"
IPV4_REGEX="(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:/[0-9]{1,2})?"
IPV6_REGEX="(?:(?:[0-9a-f]{1,4}:){7,7}[0-9a-f]{1,4}|\
(?:[0-9a-f]{1,4}:){1,7}:|\
(?:[0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|\
(?:[0-9a-f]{1,4}:){1,5}(?::[0-9a-f]{1,4}){1,2}|\
(?:[0-9a-f]{1,4}:){1,4}(?::[0-9a-f]{1,4}){1,3}|\
(?:[0-9a-f]{1,4}:){1,3}(?::[0-9a-f]{1,4}){1,4}|\
(?:[0-9a-f]{1,4}:){1,2}(?::[0-9a-f]{1,4}){1,5}|\
[0-9a-f]{1,4}:(?:(?::[0-9a-f]{1,4}){1,6})|\
:(?:(?::[0-9a-f]{1,4}){1,7}|:)|\
::(?:[f]{4}(?::0{1,4})?:)?\
(?:(25[0-5]|(?:2[0-4]|1?[0-9])?[0-9])\.){3,3}\
(?:25[0-5]|(?:2[0-4]|1?[0-9])?[0-9])|\
(?:[0-9a-f]{1,4}:){1,4}:\
(?:(?:25[0-5]|(?:2[0-4]|1?[0-9])?[0-9])\.){3,3}\
(?:25[0-5]|(?:2[0-4]|1?[0-9])?[0-9]))\
(?:/[0-9]{1,3})?"
function exists() { command -v "$1" >/dev/null 2>&1 ; }
function count_entries() { wc -l "$1" | cut -d' ' -f1 ; }
if [[ -z "$1" ]]; then
echo "Error: please specify a configuration file, e.g. $0 /etc/nft-blacklist/nft-blacklist.conf"
exit 1
fi
# shellcheck source=nft-blacklist.conf
if ! source "$1"; then
echo "Error: can't load configuration file $1"
exit 1
fi
if ! exists curl && exists egrep && exists grep && exists sed && exists sort && exists wc && exists date ; then
echo >&2 "Error: searching PATH fails to find executables among: curl egrep grep sed sort wc date"
exit 1
fi
# download cidr-merger from https://github.com/zhanhb/cidr-merger/releases
DO_OPTIMIZE_CIDR=no
if exists cidr-merger ; then
DO_OPTIMIZE_CIDR=yes
else
echo >&2 "Warning: cidr-marger is not available, please download it from https://github.com/zhanhb/cidr-merger/releases to avoid issues with nft"
fi
if [[ ! -d $(dirname "$IP_BLACKLIST_FILE") || ! -d $(dirname "$IP6_BLACKLIST_FILE") || ! -d $(dirname "$RULESET_FILE") ]]; then
echo >&2 "Error: missing directory(s): $(dirname "$IP_BLACKLIST_FILE" "$IP6_BLACKLIST_FILE" "$RULESET_FILE" | sort -u)"
exit 1
fi
[[ ${VERBOSE:-no} == yes ]] && echo -n "Processing blacklist sources: "
IP_BLACKLIST_TMP_FILE=$(mktemp)
IP6_BLACKLIST_TMP_FILE=$(mktemp)
for url in "${BLACKLISTS[@]}"; do
IP_TMP_FILE=$(mktemp)
(( HTTP_RC=$(curl -L -A "nft-blacklist/1.0 (https://github.com/leshniak/nft-blacklist)" --connect-timeout 10 --max-time 10 -o "$IP_TMP_FILE" -s -w "%{http_code}" "$url") ))
if (( HTTP_RC == 200 || HTTP_RC == 302 || HTTP_RC == 0 )); then # "0" because file:/// returns 000
command grep -Po "^$IPV4_REGEX" "$IP_TMP_FILE" | sed -r 's/^0*([0-9]+)\.0*([0-9]+)\.0*([0-9]+)\.0*([0-9]+)$/\1.\2.\3.\4/' >> "$IP_BLACKLIST_TMP_FILE"
command grep -Pio "^$IPV6_REGEX" "$IP_TMP_FILE" >> "$IP6_BLACKLIST_TMP_FILE"
[[ ${VERBOSE:-yes} == yes ]] && echo -n "."
elif (( HTTP_RC == 503 )); then
echo -e "\\nUnavailable (${HTTP_RC}): $url"
else
echo >&2 -e "\\nWarning: curl returned HTTP response code $HTTP_RC for URL $url"
fi
rm -f "$IP_TMP_FILE"
done
[[ ${VERBOSE:-no} == yes ]] && echo -e "\\n"
# sort -nu does not work as expected
sed -r -e '/^(0\.0\.0\.0|10\.|127\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|22[4-9]\.|23[0-9]\.)/d' "$IP_BLACKLIST_TMP_FILE" | sort -n | sort -mu >| "$IP_BLACKLIST_FILE"
sed -r -e '/^([0:]+\/0|fe80:)/Id' "$IP6_BLACKLIST_TMP_FILE" | sort -d | sort -mu >| "$IP6_BLACKLIST_FILE"
if [[ ${DO_OPTIMIZE_CIDR} == yes ]]; then
[[ ${VERBOSE:-no} == yes ]] && echo -e "Optimizing entries...\\nFound: $(count_entries "$IP_BLACKLIST_FILE") IPv4, $(count_entries "$IP6_BLACKLIST_FILE") IPv6"
cidr-merger -o "$IP_BLACKLIST_TMP_FILE" -o "$IP6_BLACKLIST_TMP_FILE" "$IP_BLACKLIST_FILE" "$IP6_BLACKLIST_FILE"
[[ ${VERBOSE:-no} == yes ]] && echo -e "Saved: $(count_entries "$IP_BLACKLIST_TMP_FILE") IPv4, $(count_entries "$IP6_BLACKLIST_TMP_FILE") IPv6\\n"
cp "$IP_BLACKLIST_TMP_FILE" "$IP_BLACKLIST_FILE"
cp "$IP6_BLACKLIST_TMP_FILE" "$IP6_BLACKLIST_FILE"
fi
rm -f "$IP_BLACKLIST_TMP_FILE" "$IP6_BLACKLIST_TMP_FILE"
cat >| "$RULESET_FILE" <<EOF
#
# Created by nft-blacklist (https://github.com/leshniak/nft-blacklist) at $(date -uIseconds)
# Blacklisted entries: $(count_entries "$IP_BLACKLIST_FILE") IPv4, $(count_entries "$IP6_BLACKLIST_FILE") IPv6
#
# Based on:
$(printf "# - %s\n" "${BLACKLISTS[@]}")
#
add table inet $TABLE
add counter inet $TABLE $SET_NAME_V4
add counter inet $TABLE $SET_NAME_V6
add set inet $TABLE $SET_NAME_V4 { type ipv4_addr; flags interval; }
flush set inet $TABLE $SET_NAME_V4
add set inet $TABLE $SET_NAME_V6 { type ipv6_addr; flags interval; }
flush set inet $TABLE $SET_NAME_V6
add chain inet $TABLE input { type filter hook input priority filter - 1; policy accept; }
flush chain inet $TABLE input
add rule inet $TABLE input iif "lo" accept
add rule inet $TABLE input meta pkttype { broadcast, multicast } accept\
$([[ ! -z "$IP_WHITELIST" ]] && echo -e "\\nadd rule inet $TABLE input ip saddr { $IP_WHITELIST } accept")\
$([[ ! -z "$IP6_WHITELIST" ]] && echo -e "\\nadd rule inet $TABLE input ip6 saddr { $IP6_WHITELIST } accept")
add rule inet $TABLE input ip saddr @$SET_NAME_V4 counter name $SET_NAME_V4 drop
add rule inet $TABLE input ip6 saddr @$SET_NAME_V6 counter name $SET_NAME_V6 drop
EOF
if [[ -s "$IP_BLACKLIST_FILE" ]]; then
cat >> "$RULESET_FILE" <<EOF
add element inet $TABLE $SET_NAME_V4 {
$(sed -rn -e '/^[#$;]/d' -e "s/^([0-9./]+).*/ \\1,/p" "$IP_BLACKLIST_FILE")
}
EOF
fi
if [[ -s "$IP6_BLACKLIST_FILE" ]]; then
cat >> "$RULESET_FILE" <<EOF
add element inet $TABLE $SET_NAME_V6 {
$(sed -rn -e '/^[#$;]/d' -e "s/^(([0-9a-f:.]+:+[0-9a-f]*)+(\/[0-9]{1,3})?).*/ \\1,/Ip" "$IP6_BLACKLIST_FILE")
}
EOF
fi
if [[ ${APPLY_RULESET:-yes} == yes ]]; then
[[ ${VERBOSE:-no} == yes ]] && echo "Applying ruleset..."
nft -f "$RULESET_FILE" || exit 1
fi
[[ ${VERBOSE:-no} == yes ]] && echo "Done!"
exit 0