%%(bash)
#!/bin/sh
#
# Autoblock 20060120
# /etc/autoblock/autoblock
# Copyright 2006 by Jeff Taylor
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA


#------------------------------------------------------------
# Define file locations, etc
#------------------------------------------------------------
ETH=eth0 # Which interface to set iptables rules
LOG=/var/log/filter # Tail this file for events of interest
TailLines=8 # Lines to track for quickblocks
Quickblock=3 # How many unique IPs request same lookup

GREP=/bin/grep
IPTABLES="/usr/sbin/iptables"
DIR=`dirname $0`
RULES=$DIR/autoblock.rules
BLOCKED=/etc/blocklist
CONFDATE=`ls -l $RULES | cut -b30-45`
# ${#p[@]} will give the count of elements in array p

#------------------------------------------------------------
# Read in the config file
#------------------------------------------------------------
function GetConfig {
if [ ! -f "$RULES" ]; then
echo "Config file $RULES not found!"
exit 1
fi

BLOCKS=-1
while read LINE; do
LINE=${LINE//%#*}
CMD=`echo $LINE | cut -d\ -f1`
VAL=`echo $LINE | cut -d\ -f2-`
if [ "$LINE" ] && [ "$CMD" ] ; then
#VAL=`echo $VAL | sed -e "s/'/\\'/g"`
if [ "$VAL" == "{" ]; then
let "BLOCKS = $BLOCKS +1"
NAME[$BLOCKS]="$CMD"
elif [ "$CMD" == "}" ]; then
X=""
else
VAL=`echo $LINE | cut -d= -f2- | sed 's/^\s*//'`
case "$CMD" in
info)
INFO[$BLOCKS]="$VAL" ;;
time)
TIME[$BLOCKS]="$VAL" ;;
match)
G0=""
until [ "$VAL" == "" ]; do
G1=`echo $VAL | cut -d\| -f1`
VAL=`echo $VAL | cut -d\| -f2-`
if [ "$VAL" == "$G1" ] ; then VAL="" ; fi
if [ "$G0" != "" ] ; then G0="$G0 | " ; fi
G0="$G0$GREP \"$G1\""
done
VAL=$G0
MATCH[$BLOCKS]="$VAL" ;;
source)
SOURCE[$BLOCKS]="$VAL" ;;
mode)
MODE[$BLOCKS]="$VAL" ;;
hits)
if [ "$VAL" == "" ] ; then VAL=0 ; fi
HITS[$BLOCKS]="$VAL" ;;
hittime)
if [ "$VAL" == "" ] ; then VAL=0 ; fi
HITTIME[$BLOCKS]="$VAL" ;;
domain)
G0=`echo $VAL | cut -d= -f2 | sed 's/^ *//' | cut -d\| -f1`
G1=`echo $VAL | cut -d= -f2 | sed 's/^ *//' | cut -d\| -f2`
DOMAIN[$BLOCKS]="sed -e \"s/^.*$G0//\" -e \"s/[$G1].*//\"" ;;
esac
fi
fi
done < $RULES
}

function UpdateIP {
logIP=$1
criticalHits=$2
killDate=$3
hitsDate=$4

padIP=`echo "$logIP " | cut -b-15`
NEWDATE=`date --date +${killDate} +"%b %d %Y %H:%M"`
HITDATE=`date --date +${hitsDate} +"%b %d %Y %H:%M"`
TEST=`grep " $logIP " $BLOCKED`
fwTEST=`$IPTABLES -nL autoblock | grep " $logIP "`

if [ $criticalHits -le 1 ]; then
if [ "$TEST" ]; then
sed "/ $logIP /d" $BLOCKED > $BLOCKED.tmp
mv $BLOCKED.tmp $BLOCKED
# logger -t autoblock "Clearing $logIP"
fi
echo " $padIP $NEWDATE" >> $BLOCKED
if [ ! "$fwTEST" ]; then
$IPTABLES -A autoblock -i $ETH -s $logIP -j autoblock_drop > /dev/null 2>&1
if [ "$criticalHits" == "-1" ] ; then
logger -t autoblock "Quick-Block $logIP until $NEWDATE"
else
logger -t autoblock "Blocking $logIP until $NEWDATE"
fi
fi
#SPAM=`grep -m1 $logIP /var/log/mail`
if [ "$SPAM" ] ; then
logger -t autoblock "FOUND SPAMMER MATCH @ $logIP"
fi
else
hitCount=0
prevHits=""
if [ "$TEST" ]; then
prevHits=`echo "$TEST" | sed 's/[^#]//g'`
hitCount=`echo ${#prevHits}`
sed "/ $logIP /d" $BLOCKED > $BLOCKED.tmp
mv $BLOCKED.tmp $BLOCKED
fi
(( hitCount++ ))
if [ $hitCount -ge $criticalHits ] ; then
echo " $padIP $NEWDATE" >> $BLOCKED
if [ ! "$fwTEST" ]; then
$IPTABLES -A autoblock -i $ETH -s $logIP -j autoblock_drop > /dev/null 2>&1
# logger -t autoblock "Blocking $logIP until $NEWDATE"
logger -t autoblock "Blocking $logIP ($hitCount/$criticalHits)($NEWDATE)"
fi
#SPAM=`grep -m1 $logIP /var/log/mail`
if [ "$SPAM" ] ; then
logger -t autoblock "FOUND SPAMMER MATCH @ $logIP"
fi
else
echo "#$prevHits $padIP $HITDATE" >> $BLOCKED
#logger -t autoblock "Updating $logIP ($hitCount/$criticalHits)($HITDATE)"
fi
fi
return 0
}

GetConfig
if [ "$BLOCKS" == "-1" ]; then
echo "Nothing defined in autoblock.conf!"
exit 1
fi

# This code can be uncommented to show what was read from the config file
# for (( x=0; x<=$BLOCKS; x++ )); do
# echo "${NAME[$x]} -> ${MATCH[$x]}"
# done

#------------------------------------------------------------
# Clean up and read entries from existing list
#------------------------------------------------------------
touch $BLOCKED
$IPTABLES -F
$IPTABLES -F autoblock
$IPTABLES -F autoblock_drop

$IPTABLES -N autoblock 2> /dev/null
$IPTABLES -N autoblock_drop 2> /dev/null
$IPTABLES -A INPUT -j autoblock
# $IPTABLES -A autoblock_drop $LOGLIMIT -j LOG $LOGLEVEL --log-prefix "AutoBlocked: "
$IPTABLES -A autoblock_drop -j DROP

while read IP DATE; do
IP=`echo $IP | cut -d# -f1`
if [ "$IP" ]; then
$IPTABLES -A autoblock -i $ETH -s $IP -j autoblock_drop > /dev/null 2>&1
#echo "Added $IP to firewall"
fi
done < $BLOCKED

#------------------------------------------------------------
# Tail the kernel log file and add new entries to block
#------------------------------------------------------------
tail -n 1 -f $LOG | while read LINE; do
IP=""
for (( x=0; x<=$BLOCKS; x++ )); do
CHK=`eval "echo \"$LINE\" | ${MATCH[$x]}"`
if [ "$CHK" ]; then ### Log entry matches one of our flags
IP=`echo ${LINE#*${SOURCE[$x]}} | cut -d\ -f1`
IP=`echo $IP | cut -d\# -f1`
if [ ${#IP} -lt 7 ] ; then IP="" ; fi
if [ "$IP" ] ; then
UpdateIP "$IP" "${HITS[$x]}" "${TIME[$x]}" "${HITTIME[$x]}"
if [ "${DOMAIN[$x]}" ] ; then
Domain=`eval "echo \"$LINE\" | ${DOMAIN[$x]}"`
#logger "$IP: $Domain"
### Check if someone is pulling the same info from multiple locations
HitIP="|$IP|"
HitNum=1
for (( i=$TailLines; i>0; i-- )); do
j=$(($i-1))
TailIP[$i]=${TailIP[$j]}
TailDomain[$i]=${TailDomain[$j]}
if [ "$Domain" == "${TailDomain[$i]}" ] && [ "${TailIP[$i]}" ] ; then
if [ "`echo $HitIP | grep ${TailIP[$i]}`" == "" ] ; then
HitIP="$HitIP${TailIP[$i]}|"
HitNum=$(($HitNum+1))
# logger -t autoblock $HitIP
fi
fi
done
TailIP[1]=$IP
TailDomain[1]=$Domain

# logger -t autoblock "HitNum=$HitNum"
if [ $HitNum -ge $Quickblock ] ; then
HitIP=`echo $HitIP | cut -d\| -f2-`
xIP=""
until [ ${#HitIP} -lt 2 ]; do
xIP=`echo $HitIP | cut -d\| -f1`
HitIP=`echo $HitIP | cut -d\| -f2-`
if [ "$xIP" ] ; then
UpdateIP "$xIP" "-1" "${TIME[$x]}" "${TIME[$x]}"
fi
done
fi
fi
break # Only want a single hit on anything found in log file
fi
fi
done

CHKDATE=`ls -l $RULES | cut -b30-45`
if [ "$CONFDATE" != "$CHKDATE" ] ; then
GetConfig
CONFDATE=$CHKDATE
logger -t autoblock "$RULES has been updated"
fi
done
%%

----
CategoryDNSBlockList