4 changed files with 229 additions and 422 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -1,5 +0,0 @@
-root = true
-
-[*.sh]
-indent_size = 4
-indent_style = tab
--- a/ddos-mitigator.conf
+++ b/ddos-mitigator.conf
@ -1,30 +0,0 @@
-# Example configuration file for ddos-mitigator.sh.
-# PLEASE TAKE CARE not to put any whitespace around the '=' signs, as this file is directly sourced by the script
-# file and this needs to conform to the BASH syntax. Also, make sure to declare the COUNTRIES variable with the
-# correct array syntax: COUNTRIES=("AA" "BB" "CC"), or to comment it out altogether.
-
-# The path to the GeoIP2 database file (must be either country or city database). This parameter is mandatory. If it is
-# not specified here, it must be given on the command line (through the -d option).
-DATABASE_FILE="/path/to/geoip/country-or-city-database.mmdb"
-
-# Enable the autopilot for automatically banning IP addresses of the desired countries (see also COUNTRIES option).
-# Only ban IP addresses with at least AUTOPILOT current connections. If the value is not specified or 0, don't
-# automatically ban IP addresses, but run in interactive mode.
-AUTOPILOT="0"
-
-# Defines the subnet size in bytes to be analyzed. Valid values are:
-# -  8 for class A networks (X.0.0.0/8)
-# - 16 for class B networks (X.X.0.0/16)
-# - 24 for class C networks (X.X.X.0/24)
-# - 32 for class D networks (X.X.X.X/32)
-# If not specified, run in interactive mode and prompt for the netmask size.
-NETMASK="8"
-
-# The country-codes to block as an array. Defaults to "CN" (China).
-#COUNTRIES=("CN" "HK" "TW")
-
-# Specify the JAIL to use for banning the IP addresses. Defaults to 'apache-auth'.
-#JAIL="apache-auth"
-
-# The desired port to monitor. Defaults to 443 (https).
-#PORT="443"
--- a/ddos-mitigator.sh
+++ b/ddos-mitigator.sh
@ -1,17 +1,21 @@
 #!/bin/sh
+################################################################################
+################################################################################
+########### FIXME: This text is outdated and needs to be rewritten.  ###########
+################################################################################
+################################################################################
+
 ################################################################################
 #                                                                              #
 # Try and prevent apache overloads by banning IP addresses that have (too)     #
 # many open connections.                                                       #
-# This script uses ss to determine the connections to a configurable port      #
-# on the host machine and provides automated GeoIP information retrieval based #
-# the address or the /24-, /16- or /8-subnet thereof. A GeoIP city- or country #
-# database must be installed separately and is provided to the script via a    #
-# command line parameter.                                                      #
-# Addresses (or subnets) are presented to the user in order of descending      #
-# connection count. For each address (or subnet), the user can choose to ban   #
-# or ignore it. Addresses (or subnets) chosen to be banned will be blocked by  #
-# a configurable jail of fail2ban.                                             #
+# This script uses netstat to determine the connections to the HTTPS port of   #
+# the host machine and provides automated whois information retrieval based on #
+# the address or the /24-, /16- or /8-subnet thereof. Addresses (or subnets)   #
+# are presented to the user in order of descending connection count. For each  #
+# address (or subnet), the user can choose to ban or ignore it. Addresses (or  #
+# subnets) chosen to be banned will be blocked by the apache-badbots jail of   #
+# fail2ban.                                                                    #
 # Author: Manuel Friedli, <manuel@fritteli.ch>                                 #
 # This script is licenced under the GNU General Public Licence, version 3 or   #
 # later.                                                                       #
@ -26,32 +30,17 @@
 #   - net-analyzer/fail2ban (`fail2ban-client`)                                #
 #   - sys-apps/coreutils (`cut`, `id`, `sort`, `touch`, `tr`, `uniq`)          #
 #   - sys-apps/grep (`grep`)                                                   #
-#   - sys-apps/iproute2 (`ss`)                                                 #
 #   - sys-apps/moreutils (`sponge`)                                            #
+#   - sys-apps/net_tools (`netstat`)                                           #
 #   - sys-apps/util-linux (`getopt`)                                           #
 #                                                                              #
 ################################################################################

-# Store the start time; this enables us to output the total runtime at the end.
-start="$(date +%s)"
+# Set the host's own IP address. So far, only an IPv4 address is supported.
+MY_IP="94.199.214.20"

-# Dependencies of this script. Simple array with the following structure:
-# (command package [...])
-dependencies=(
-	"sudo" "app-admin/sudo"
-	"python" "dev-lang/python:3.8"
-	"fail2ban-client" "net-analyzer/fail2ban"
-	"cut" "sys-apps/coreutils"
-	"id" "sys-apps/coreutils"
-	"sort" "sys-apps/coreutils"
-	"touch" "sys-apps/coreutils"
-	"tr" "sys-apps/coreutils"
-	"uniq" "sys-apps/coreutils"
-	"grep" "sys-apps/grep"
-	"ss" "sys-apps/iproute2"
-	"sponge" "sys-apps/moreutils"
-	"getopt" "sys-apps/util-linux"
-)
+# After this point, no editing is required.
+start=$(date +%s)

 # These suffixes must be appended to the respective addresses and subnets.
 suffix8="/8"
@ -72,40 +61,18 @@ bold="$(printf '\033[1m')"
 reset="$(printf '\033[0m')"

 # Clean up when the script exits.
-trap 'sudo -k 2>/dev/null >&2; rm -r ${tmpdir}' EXIT
+trap 'sudo -k; rm -r ${tmpdir}' EXIT

-function is_installed() {
-	which "${1}" 2>/dev/null >&2
-	return $?
-}
+function check_installed() {
+	local command="$1"
+	local package="$2"
+	which "${command}" 2>/dev/null >&2
+	local result=$?

-function print_missing_dependency() {
-	local command="${1}"
-	local package="${2}"
-
-	echo "${red}Command ${bold}${command}${reset}${red} not found.${reset} Please install package ${blue}${package}${reset}." >&2
-}
-
-function check_dependencies() {
-	local arraylength=${#dependencies[@]}
-	local res=
-	local command=
-	local package=
-	# 0: true, all installed; 1: false, at least one command/package missing
-	local all_installed=0
-
-	for ((i = 0; i < ${arraylength}; i += 2)); do
-		command="${dependencies[$i]}"
-		package="${dependencies[$i + 1]}"
-		is_installed "${command}" "${package}"
-		res=$?
-		if [[ ${res} -ne 0 ]]; then
-			print_missing_dependency "${command}" "${package}"
-			all_installed=1
+	if [[ "${result}" -ne 0 ]] ; then
+		echo "${red}Command ${bold}${command}${reset}${red} not found.${reset} Please install package ${blue}${package}${reset}."
+		exit 1
 	fi
-	done
-
-	return ${all_installed}
 }

 function print_help() {
@ -129,20 +96,6 @@ Usage: $(basename $0) -d FILE [OPTION...]
                                      comma-separated values; defaults to 'CN'
                                      (China).

-  -e, --dependencies                  Check if all required dependencies are
-                                      installed. If all dependencies are found,
-                                      the program terminates with exit code 0.
-                                      Otherwise, missing dependencies are
-                                      printed to stderr and the program
-                                      terminates with exit code 1.
-
-  -f, --config-file=FILENAME          Specify the full path to the configuration
-                                      file. If omitted, all options are read
-                                      from the command line.
-                                      Any parameter specified on the command
-                                      line takes precedence over configuration
-                                      option read from the file.
-
  -j, --jail=JAIL                     Specify the JAIL to use for banning the IP
                                      addresses.
                                      Defaults to 'apache-auth'.
@ -178,11 +131,11 @@ function exec_as_root() {

 function filter() {
 	# list of current connections
-	file="${1}"
+	file="$1"
 	# subnet extension, e.g. ".0.0"
-	ext="${2}"
+	ext="$2"
 	# subnet suffix, e.g. "/16"
-	suffix="${3}"
+	suffix="$3"
 	rm -f "${filtered}"
 	touch "${filtered}"

@ -198,48 +151,8 @@ function filter() {
 	mv "${filtered}" "${file}"
 }

-function set_default_values() {
-	if [[ -z "${autopilot}" ]]; then
-		autopilot=0
-	fi
-	if [[ -z "${bancountries}" ]]; then
-		bancountries=("CN")
-	fi
-	if [[ -z "${jail}" ]]; then
-		jail="apache-auth"
-	fi
-	if [[ -z "${netmask}" ]]; then
-		netmask=0
-	fi
-	if [[ -z "${port}" ]]; then
-		port=443
-	fi
-}
-
-function parse_config_file() {
-	source "${configfile}"
-	if [[ -z "${autopilot}" ]]; then
-		autopilot="${AUTOPILOT}"
-	fi
-	if [[ -z "${bancountries}" ]]; then
-		bancountries=(${COUNTRIES[@]})
-	fi
-	if [[ -z "${database}" ]]; then
-		database="${DATABASE_FILE}"
-	fi
-	if [[ -z "${jail}" ]]; then
-		jail="${JAIL}"
-	fi
-	if [[ -z "${netmask}" ]]; then
-		netmask="${NETMASK}"
-	fi
-	if [[ -z "${port}" ]]; then
-		port="${PORT}"
-	fi
-}
-
 function parse_command_line_args() {
-	TEMP=$(getopt -o 'a::,c:,d:,e,f:,j:,n:,p:,h' -l 'auto::,country:,database:,dependencies,config-file:,jail:,netmask:,port:,help' -- "$@")
+	TEMP=$(getopt -o 'a::,c:,d:,j:,n:,p:,h' -l 'auto::,country:,database:,jail:,netmask:,port:,help' -- "$@")

 	if [ $? -ne 0 ] ; then
 		echo 'Error parsing command line options. Terminating. Invoke with --help for help.' >&2
@ -250,12 +163,16 @@ function parse_command_line_args() {
 	unset TEMP

 	while true ; do
-		case "${1}" in
+		case "$1" in
 			'-a'|'--auto')
-			case "${2}" in
+				case "$2" in
 					'')
 						autopilot=1
 					;;
+					*[!0-9]*)
+						echo "Invalid argument for parameter 'auto': '$2'. Invoke with --help for help." >&2
+						exit 1
+					;;
 					*)
 						autopilot="$2"
 					;;
@ -263,47 +180,44 @@ function parse_command_line_args() {
 				shift
 			;;
 			'-c'|'--country')
-			IFS=',' read -ra bancountries <<<"${2}"
+				IFS=',' read -ra bancountries <<< "$2"
+				if [[ -z ${bancountries[@]// } ]] ; then
+					echo "Invalid argument for parameter 'country': '$2'. Invoke with --help for help." >&2
+					exit 1
+				fi
 				shift
 			;;
 			'-d'|'--database')
-			database="${2}"
-			shift
-			;;
-		'-e' | '--dependencies')
-			check_dependencies
-			exit $?
-			;;
-		'-f' | '--config-file')
-			configfile="${2}"
+				database="$2"
 				shift
 			;;
 			'-j'|'--jail')
-			jail="${2}"
+				jail="$2"
 				shift
 			;;
 			'-n'|'--netmask')
-			case "${2}" in
-			'1')
+				case "$2" in
+					'1'|'8')
 						netmask=8
 					;;
-			'2')
+					'2'|'16')
 						netmask=16
 					;;
-			'3')
+					'3'|'24')
 						netmask=24
 					;;
-			'4')
+					'4'|'32')
 						netmask=32
 					;;
 					*)
-				netmask="${2}"
+						echo "Invalid argument for parameter 'netmask': '$2'. Invoke with --help for help." >&2
+						exit 1
 					;;
 				esac
 				shift
 			;;
 			'-p'|'--port')
-			port="${2}"
+				port="$2"
 				shift
 			;;
 			'-h'|'--help')
@ -315,88 +229,22 @@ function parse_command_line_args() {
 				break
 			;;
 			*)
-			echo "Unknown error on command line argument '${1}'. Terminating." >&2
+				echo "Unknown error on command line argument '$1'. Terminating." >&2
 				exit 1
 			;;
 		esac
 		shift
 	done

-	# If the config file option is set, parse the config file.
-	if [[ ! -z ${configfile+x} ]]; then
-		if [[ ! -f "${configfile}" || ! -r "${configfile}" ]]; then
-			echo "Can not read configuration file '${2}'. Invoke with --help for help." >&2
-			exit 1
-		fi
-
-		parse_config_file
-	fi
-
-	# Here, we set the default values for all options that have not been set yet.
-	set_default_values
-}
-
-function validate_parameter_values() {
-	# GeoIP-Database
 	if [[ -z "${database}" ]] ; then
 	  echo "No GeoIP database specified. Invoke with --help for more information." >&2
 		exit 1
 	fi

-	if [[ ! -f "${database}" || ! -r "${database}" ]]; then
+	if [[ ! -r "${database}" ]] ; then
 	  echo "Database '${database}' is not accessible." >&2
 		exit 1
 	fi
-
-	# Autopilot
-	case "${autopilot}" in
-	*[!0-9]*)
-		echo "Invalid value for parameter 'auto' / 'AUTOPILOT': '${autopilot}'." >&2
-		echo "Invoke with --help for help." >&2
-		exit 1
-		;;
-	esac
-
-	# Countries
-	if [[ -z ${bancountries[@]// /} ]]; then
-		echo "Invalid value for parameter 'country' / 'COUNTRIES': '${bancountries[*]}'." >&2
-		echo "Invoke with --help for help." >&2
-		exit 1
-	fi
-
-	# Jail
-	if [[ -z "${jail}" ]]; then
-		echo "Invalid value for parameter 'jail' / 'JAIL': '${jail}'." >&2
-		echo "Invoke with --help for help." >&2
-		exit 1
-	fi
-
-	# Netmask
-	case "${netmask}" in
-	'0' | '8' | '16' | '24' | '32')
-		# Everything OK.
-		;;
-	*)
-		echo "Invalid value for parameter 'netmask': '${2}'." >&2
-		echo "Invoke with --help for help." >&2
-		exit 1
-		;;
-	esac
-
-	# Port
-	case "${port}" in
-	*[!0-9]*)
-		echo "Invalid value for parameter 'port' / 'PORT': '${autopilot}'." >&2
-		echo "Invoke with --help for help." >&2
-		exit 1
-		;;
-	esac
-	if [[ ${port} -lt 0 || ${port} -gt 65535 ]]; then
-		echo "Invalid value for parameter 'port' / 'PORT': '${autopilot}'." >&2
-		echo "Value must be between 0 ... 65535 (inclusive)." >&2
-		echo "Invoke with --help for help." >&2
-		exit 1
-	fi
 }

 ################################################################################
@ -406,13 +254,13 @@ function validate_parameter_values() {
 # color to the next happen at different values.
 ################################################################################
 function set_highlight_color() {
-	local count=${1}
+	local count=$1
 	case "${choice}" in
 		"1" )
 		# /32: 0 <= green < 3 <= yellow < 5 <= red
-		if [ ${count} -ge 5 ]; then
+			if [ $count -ge 5 ] ; then
 				hilite="${red}"
-		elif [ ${count} -ge 3 ]; then
+			elif [ $count -ge 3 ] ; then
 				hilite="${yellow}"
 			else
 				hilite="${green}"
@ -420,9 +268,9 @@ function set_highlight_color() {
 		;;
 		"2" )
 		# /24: 0 <= green < 7 <= yellow < 13 <= red
-		if [ ${count} -ge 13 ]; then
+			if [ $count -ge 13 ] ; then
 				hilite="${red}"
-		elif [ ${count} -ge 7 ]; then
+			elif [ $count -ge 7 ] ; then
 				hilite="${yellow}"
 			else
 				hilite="${green}"
@ -430,9 +278,9 @@ function set_highlight_color() {
 		;;
 		"3" )
 		# /16: 0 <= green < 13 <= yellow < 25 <= red
-		if [ ${count} -ge 25 ]; then
+			if [ $count -ge 25 ] ; then
 				hilite="${red}"
-		elif [ ${count} -ge 13 ]; then
+			elif [ $count -ge 13 ] ; then
 				hilite="${yellow}"
 			else
 				hilite="${green}"
@ -440,9 +288,9 @@ function set_highlight_color() {
 		;;
 		"4" )
 		# /8: 0 <= green < 21 <= yellow < 49 <= red
-		if [ ${count} -ge 49 ]; then
+			if [ $count -ge 49 ] ; then
 				hilite="${red}"
-		elif [ ${count} -ge 21 ]; then
+			elif [ $count -ge 21 ] ; then
 				hilite="${yellow}"
 			else
 				hilite="${green}"
@ -481,7 +329,7 @@ function process_file() {
 		addrwithsuffix="${addronly}${suffix}"
 		set_highlight_color "${count}"
 		country="$("${curdir}/geoip-lookup.py" -f "${database}" "${addronly}")"
-		if [[ ${autopilot} -eq 0 ]]; then
+		if [[ autopilot -eq 0 ]] ; then
 			echo "Country: '${yellow}${country}${reset}'"
 		fi
 		echo -n "Address ${bold}$((nline++)) of ${nlines}${reset}: \
@ -492,7 +340,7 @@ Found '${blue}${addrwithsuffix}${reset}' ${hilite}${count}${reset} times."
 			read banaction
 		else
 			if [[ " ${bancountries[@]} " =~ " ${country} " ]] ; then
-				if [[ ${count} -ge ${autopilot} ]]; then
+				if [[ $count -ge $autopilot ]] ; then
 					echo -en "\n${red}Autopilot active. ${reset}"
 					banaction=y
 				else
@ -500,7 +348,7 @@ Found '${blue}${addrwithsuffix}${reset}' ${hilite}${count}${reset} times."
 					return
 				fi
 			else
-				if [[ ${count} -ge ${autopilot} ]]; then
+				if [[ $count -ge $autopilot ]] ; then
 					echo -en "\n${green}Autopilot active. ${reset}"
 					banaction=n
 				else
@ -532,7 +380,7 @@ banlist (country=${yellow}${country}${reset})."

 # Create a temp directory, chdir into it and create the (initially empty)
 # banlist file.
-tmpdir="$(mktemp -d)"
+tmpdir=$(mktemp -d)

 # Set up all file paths
 curdir="$(dirname "$0")"
@ -545,40 +393,45 @@ file24="${tmpdir}/sorted-http-24.txt"
 file32="${tmpdir}/sorted-http-32.txt"
 # This file will contain the addresses to be banned.
 banlist="${tmpdir}/banlist.txt"
+# This file contains the output of the last invocation of whois
+whoisoutput="${tmpdir}/whois.txt"

 touch "${banlist}"

 # Parse the command line options
-autopilot=
-netmask=
-jail=
-bancountries=
+autopilot=0
+netmask=0
+jail="apache-auth"
+bancountries=("CN")
 database=
-port=
+port=443

 parse_command_line_args "$@"
-validate_parameter_values

-check_dependencies
-dependencies_ok=$?
-if [[ ${dependencies_ok} -ne 0 ]]; then
-	exit ${dependencies_ok}
-fi
+check_installed "sudo" "app-admin/sudo"
+check_installed "python" "dev-lang/python:3.8"
+check_installed "fail2ban-client" "net-analyzer/fail2ban"
+check_installed "cut" "sys-apps/coreutils"
+check_installed "id" "sys-apps/coreutils"
+check_installed "sort" "sys-apps/coreutils"
+check_installed "touch" "sys-apps/coreutils"
+check_installed "tr" "sys-apps/coreutils"
+check_installed "uniq" "sys-apps/coreutils"
+check_installed "grep" "sys-apps/grep"
+check_installed "sponge" "sys-apps/moreutils"
+check_installed "netstat" "sys-apps/net_tools"
+check_installed "getopt" "sys-apps/util-linux"

 # List already banned addresses in the chosen jail
 banned="$(exec_as_root fail2ban-client get "${jail}" banip)"

 # Determine the current connections to the desired port; store the raw data in
 # $fileraw.
-connections=$(ss -HOn state established "( sport = :${port} )" | tr -s '[:blank:]' | cut -d' ' -f5)
-
-# IPv6-mapped-IPv4: [::ffff:192.168.0.1]:443
-echo "${connections}" | grep '^\[::ffff:' - | cut -d: -f4 | cut -d] -f1 | grep -v '^$' >"${fileraw}"
-# Pure IPv4: 192.168.0.1:443
-echo "${connections}" | grep -v '^\[' - | cut -d: -f1 | grep -v '^$' >>"${fileraw}"
+netstat -nt | grep "${MY_IP}:${port}" | tr -s '[:blank:]' | cut -d' ' -f5 \
+  | cut -d: -f1 | sort > "${fileraw}"

 # Group and sort the data into the subnet-specific files.
-sort "${fileraw}" >"${file32}"
+cp "${fileraw}" "${file32}"
 cut -d. -f1-3 "${fileraw}" | sort > "${file24}"
 cut -d. -f1-2 "${fileraw}" | sort > "${file16}"
 cut -d. -f1 "${fileraw}" | sort > "${file8}"
@ -667,6 +520,6 @@ while read -r addrwithsuffix; do
 	exec_as_root fail2ban-client set "${jail}" banip "${addrwithsuffix}"
 done < "${banlist}"

-end="$(date +%s)"
+end=$(date +%s)

 echo "${green}All done in $((end - start)) seconds!${reset}"
--- a/geoip-lookup.py
+++ b/geoip-lookup.py
@ -1,24 +1,16 @@
-#!/usr/bin/python
+#!/usr/bin/python3.8

-import argparse
+import getopt
 import sys

 try:
    import geoip2.database
-    import geoip2.errors
 except ImportError:
    print(
-        "Required modules geoip2.database and geoip2.errors not found. On Gentoo Linux, please install dev-python/geoip2 from the 'fritteli' overlay.",
+        "Required module geoip2.database not found. On Gentoo Linux, please install dev-python/geoip2 from the 'fritteli' overlay.",
        file=sys.stderr)
    exit(1)

-try:
-    import maxminddb.errors
-except ImportError:
-    print(
-        "Required module maxminddb.errors not found. On Gentoo Linux, please install dev-python/maxminddb from the 'fritteli' overlay.",
-        file=sys.stderr)
-    exit(1)

 class LookupException(Exception):
    """
@ -55,14 +47,6 @@ def get_county_code(ipaddress, dbfile):
            raise LookupException("Unsupported DB type: " + dbtype)

        return country.iso_code
-    except FileNotFoundError as e:
-        raise LookupException(e.args)
-    except maxminddb.errors.InvalidDatabaseError as e:
-        raise LookupException(e.args)
-    except geoip2.errors.AddressNotFoundError as e:
-        raise LookupException(e.args)
-    except ValueError as e:
-        raise LookupException(e.args)
    finally:
        if reader:
            reader.close()
@ -76,12 +60,21 @@ def parse_command_line(argv):
    :return:
    """
    dbfile = None
-    parser = argparse.ArgumentParser(description='Get the country code from an IP address')
-    parser.add_argument('-f', dest='dbfile', required=True, help="Path to the GeoIP2 database file")
-    parser.add_argument('address', help="The IP address to check")
-    args = parser.parse_args()
+    try:
+        opts, args = getopt.getopt(argv, "f:")
+    except getopt.GetoptError as e:
+        raise LookupException("Error parsing command line") from e
+
+    for opt, arg in opts:
+        if opt == "-f":
+            dbfile = arg
+        else:
+            raise LookupException("Unknown command line argument")
+
+    if len(args) == 0:
+        raise LookupException("No address given on command line")
+    return dbfile, args[0]

-    return args.dbfile, args.address

 def main(argv):
    """
@ -90,18 +83,14 @@ def main(argv):
    :param argv: Format: "-f /path/to/database.mmdb ip.v4.add.ress"
    :return:
    """
-    try:
    (dbfile, ipaddress) = parse_command_line(argv)
    code = get_county_code(ipaddress, dbfile)
    print(code)
-    except LookupException as e:
-        print(e.args, file=sys.stderr)
-        print("Unknown")


 if __name__ == '__main__':
    try:
        main(sys.argv[1:])
    except BaseException as e:
-        print("Unknown")
+        print("Usage: geoip-lookup.py -f /path/to/geoip2-database.mmdb 192.168.1.1", file=sys.stderr)
        raise e