linux/ddos-mitigator
1
0
Fork 0
Code Issues Pull requests Releases 5 Wiki Activity

Support a list of countries to ban.

Browse source
This commit is contained in:
Manuel Friedli 2020-09-15 14:06:54 +02:00
parent 131f847d6a
commit 7328bbac8f
1 changed files with 36 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
ddos-mitigator.sh
View file

@ -80,22 +80,28 @@ function print_help() {
Usage: $(basename $0) -d FILE [OPTION...] Usage: $(basename $0) -d FILE [OPTION...]
${bold}Mandatory options:${reset} ${bold}Mandatory options:${reset}
-d, --database=FILE The path to the GeoIP2 database file (must be either -d, --database=FILE The path to the GeoIP2 database file (must
country or city database). be either country or city database).
${bold}Optional options:${reset} ${bold}Optional options:${reset}
-a, --auto[=LIMIT] Enable the autopilot for automatically banning IP -a, --auto[=LIMIT] Enable the autopilot for automatically
addresses of the desired country (see also -c option). banning IP addresses of the desired
When LIMIT is given, only auto-ban IP addresses with at countries (see also -c option).
least LIMIT current connections. When LIMIT is given, only auto-ban IP
addresses with at least LIMIT current
connections.
When LIMIT is omitted, assume LIMIT=1. When LIMIT is omitted, assume LIMIT=1.
-c, --country=COUNTRY The country-code to block; defaults to 'CN' (China). -c, --country=COUNTRY[,COUNTRY...] The country-codes to block as a list of
comma-separated values; defaults to 'CN'
(China).
-j, --jail=JAIL Specify the JAIL to use for banning the IP addresses. -j, --jail=JAIL Specify the JAIL to use for banning the IP
addresses.
Defaults to 'apache-auth'. Defaults to 'apache-auth'.
-n, --netmask=SIZE SIZE defines the subnet size in bytes to be analyzed. -n, --netmask=SIZE SIZE defines the subnet size in bytes to
be analyzed.
Valid values are: Valid values are:
- 1 or 8 for class A networks (X.0.0.0/8) - 1 or 8 for class A networks (X.0.0.0/8)
- 2 or 16 for class B networks (X.X.0.0/16) - 2 or 16 for class B networks (X.X.0.0/16)
@ -174,7 +180,11 @@ function parse_command_line_args() {
shift shift
;; ;;
'-c'|'--country') '-c'|'--country')
bancountry="$2" IFS=',' read -ra bancountries <<< "$2"
if [[ -z ${bancountries[@]// } ]] ; then
echo "Invalid argument for parameter 'country': '$2'. Invoke with --help for help." >&2
exit 1
fi
shift shift
;; ;;
'-d'|'--database') '-d'|'--database')
@ -320,16 +330,16 @@ function process_file () {
set_highlight_color "${count}" set_highlight_color "${count}"
country="$("${curdir}/geoip-lookup.py" -f "${database}" "${addronly}")" country="$("${curdir}/geoip-lookup.py" -f "${database}" "${addronly}")"
if [[ autopilot -eq 0 ]] ; then if [[ autopilot -eq 0 ]] ; then
echo "Country: '${country}'" echo "Country: '${yellow}${country}${reset}'"
fi fi
echo -n "Address ${bold}$((nline++)) of ${nlines}${reset}: \ echo -n "Address ${bold}$((nline++)) of ${nlines}${reset}: \
Found '${blue}${addrwithsuffix}${reset}' ${hilite}${count}${reset} times." Found '${blue}${addrwithsuffix}${reset}' ${hilite}${count}${reset} times."
if [[ ${autopilot} -eq 0 ]] ; then if [[ ${autopilot} -eq 0 ]] ; then
echo -n "Ban [y/N/s=No, and skip remaining]? " echo -n " Ban [y/N/s=No, and skip remaining]? "
read banaction read banaction
else else
if [[ "${country}" == "${bancountry}" ]] ; then if [[ " ${bancountries[@]} " =~ " ${country} " ]] ; then
if [[ $count -ge $autopilot ]] ; then if [[ $count -ge $autopilot ]] ; then
echo -en "\n${red}Autopilot active. ${reset}" echo -en "\n${red}Autopilot active. ${reset}"
banaction=y banaction=y
@ -356,11 +366,11 @@ skipping remaining addresses."
;; ;;
"y" | "Y" ) "y" | "Y" )
echo "Adding '${blue}${addrwithsuffix}${reset}' to \ echo "Adding '${blue}${addrwithsuffix}${reset}' to \
banlist." banlist (country=${yellow}${country}${reset})."
echo "${addrwithsuffix}" >> "${banlist}" echo "${addrwithsuffix}" >> "${banlist}"
;; ;;
"n" | "N" | * ) "n" | "N" | * )
echo "Not banning '${blue}${addrwithsuffix}${reset}' (country='${country}')." echo "Not banning '${blue}${addrwithsuffix}${reset}' (country=${yellow}${country}${reset})."
;; ;;
esac esac
# Here goes: Pipe the file contents via filedescriptor 3. # Here goes: Pipe the file contents via filedescriptor 3.
@ -392,7 +402,7 @@ touch "${banlist}"
autopilot=0 autopilot=0
netmask=0 netmask=0
jail="apache-auth" jail="apache-auth"
bancountry="CN" bancountries=("CN")
database= database=
port=443 port=443