diff --git a/README.md b/README.md index dfb2dc81afb1ebc67f6492010857e22b45d2941a..bff70800f2e45e2c0061253969c94766833675cc 100644 --- a/README.md +++ b/README.md @@ -4,10 +4,12 @@ Use at your own risk :) Create an ipset based blocklist from an text file (downloaded from e.g. blocklist.de) +V1.0.2: Added a whitelist and blacklist + !!! IMPORTANT !!!! You will need to install ipset! -Then open the blocklist.pl with your favorite text Editor and specify why your binarys are located. +Then open the blocklist.pl with your favorite text Editor and specify where your binarys are located. (These can be found via "which" e.g. "which iptables") diff --git a/blacklist.txt b/blacklist.txt new file mode 100644 index 0000000000000000000000000000000000000000..982782b433bf9d7970367a98b1dfadaab5f7fc04 --- /dev/null +++ b/blacklist.txt @@ -0,0 +1,3 @@ +# IPV4 Blacklist just add ips whiteout # +# +# e.g. 3.3.3.3 diff --git a/blocklist.pl b/blocklist.pl index bab3cd3fc8d32f5fc96bc832f9acc060e8b13b4e..56ec0c4b18461bca0107ea7082b7528f882d2b6e 100755 --- a/blocklist.pl +++ b/blocklist.pl @@ -1,5 +1,6 @@ #!/usr/bin/perl -use strict; use warnings; +use strict; +use warnings; ################################################################ ###### Script to check Blocklist.de list. Block new IP ###### ###### and unblock deleted entrys ###### @@ -11,6 +12,8 @@ my $fileName = "Blocklist.txt"; my $tmpDir = "/tmp"; my $file = "$tmpDir/$fileName"; my $logFile = "/var/log/blocklist"; +my $whiteList = "whitelist.txt"; +my $blackList = "blacklist.txt"; ## binarys ## my $iptables = "/sbin/iptables"; @@ -28,8 +31,11 @@ $added = $removed = $skipped = 0; ## init arrays ## my @fileArray = (); my @ipsetArray = (); - +my @whiteListArray = (); +my @blackListArray = (); ## init hashes for faster searching +my %whiteListArray; +my $blackListArray; my %ipsetArray; my %fileArray; @@ -43,8 +49,11 @@ my @days = qw(Sun Mon Tue Wed Thu Fri Sat Sun); #****************************# logging("Starting blocklist refresh"); &iptablesCheck(); +&getWhiteListArray(); +&getBlackListArray(); &getFileArray(); &getIpsetArray(); +print &addIpsToBlocklist(); &remIpsFromBlocklist(); &cleanup(); @@ -122,7 +131,6 @@ sub getFileArray { sub getIpsetArray { $output = `$ipset list blocklist`; @ipsetArray = split("\n", $output); -# %ipsetArray = map { $_ => 1} @ipsetArray; #remove the first 6 Elements of our Array using splice (ipset header info) splice @ipsetArray, 0, 6; %ipsetArray = map { $_ => 1} split("\n", $output); @@ -130,13 +138,61 @@ sub getIpsetArray { ##### END getIpsetArray ######### +######### getWhiteListArray ###### +## puts all ips from our ## +## $whitelist into ## +## array whiteListArray ## +################################## + +sub getWhiteListArray { + open(INFO, $whiteList) or die("Could not open Whitelist."); + foreach $line (<INFO>) { + push(@whiteListArray, $line); + } + + close(INFO); + chomp(@whiteListArray); +} +##### END getWhiteListArray ##### + +######### getBlackListArray ###### +## puts all ips from our ## +## $whitelist into ## +## array blackListArray ## +################################## + +sub getBlackListArray { + open(INFO, $blackList) or die("Could not open Blacklist."); + foreach $line (<INFO>) { + push(@blackListArray, $line); + } + + close(INFO); + chomp(@blackListArray); +} +##### END getBlackListArray ##### + ######## addIpsToBlocklist ###### ## adds IPs to our blocklist ## ################################# sub addIpsToBlocklist { + foreach $line (@blackListArray) { + if ((exists $ipsetArray{"$line"}) || ($line ~~ @whiteListArray)) { + $skipped++; + } else { + if ($line eq &isIpv4($line)) { + $result = `$ipset add blocklist $line`; + $added++; + $message = "added $line"; + logging($message); + } else { + $skipped++; + } + } + } foreach $line (@fileArray) { - if (exists $ipsetArray{"$line"}) { + if ((exists $ipsetArray{"$line"}) || ($line ~~ @whiteListArray)) { $skipped++; } else { if ($line eq &isIpv4($line)) { @@ -156,8 +212,22 @@ sub addIpsToBlocklist { ## remove IPs from our blocklist ## ##################################### sub remIpsFromBlocklist { + # remove Ips that are in our whiteList + foreach $line (@whiteListArray) { + if ((exists $ipsetArray{"$line"}) && ($line ~~ @whiteListArray)) { + if ($line eq &isIpv4($line)) { + $result = `$ipset del blocklist $line`; + $message = "removed $line"; + logging($message); + $removed++; + } else { + $skipped++; + } + } + } + foreach $line (@ipsetArray) { - if (exists $fileArray{"$line"}) { + if ((exists $fileArray{"$line"}) || ($line ~~ @blackListArray)) { $skipped++; } else { if ($line eq &isIpv4($line)) { diff --git a/whitelist.txt b/whitelist.txt new file mode 100644 index 0000000000000000000000000000000000000000..74cd8f8cd00a38f168c886acff97a693fcd13119 --- /dev/null +++ b/whitelist.txt @@ -0,0 +1,3 @@ +# IPV4 Whitelist just add ips +# +# e.g. 2.2.2.2