paramah/ossec-blacklist
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix IP regexp to support CIDR subnets and split src,dst into two separate rules

Browse Source 
sent by Pierre Gaufillet
This commit is contained in:
Pawel Krawczyk 2015-06-02 10:15:44 +01:00
parent 75cee0fdfe
commit 480715f44c
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
blacklist.sh
View File

@ -83,7 +83,7 @@ for url in $urls; do
fi fi
fi fi
sort -u <"${unsorted_blocklist}" | egrep "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >"${sorted_blocklist}" sort -u <"${unsorted_blocklist}" | egrep "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(/[0-9]{1,2})?$" >"${sorted_blocklist}"
# calculate performance parameters for the new set # calculate performance parameters for the new set
tmp_set_name="tmp_${RANDOM}" tmp_set_name="tmp_${RANDOM}"
@ -112,9 +112,11 @@ for url in $urls; do
ipset -! -q restore < "${new_set_file}" ipset -! -q restore < "${new_set_file}"
if [ "$1" = "log" ]; then if [ "$1" = "log" ]; then
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -m limit --limit 10/minute -j LOG --log-prefix "BLOCK ${set_name} " iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src -m limit --limit 10/minute -j LOG --log-prefix "BLOCK src ${set_name} "
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" dst -m limit --limit 10/minute -j LOG --log-prefix "BLOCK dst ${set_name} "
fi fi
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -j DROP iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src -j DROP
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" dst -j DROP
# clean up temp files # clean up temp files
rm "${unsorted_blocklist}" "${sorted_blocklist}" "${new_set_file}" "${headers}" rm "${unsorted_blocklist}" "${sorted_blocklist}" "${new_set_file}" "${headers}"