paramah/ossec-blacklist
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

handle compressed content from blocklist.de

Browse Source
This commit is contained in:
Pawel Krawczyk 2015-01-09 13:00:46 +00:00
parent 3d8e2052c3
commit bb1c726836
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
blacklist.sh
View File

@ -69,10 +69,18 @@ for url in $urls; do
unsorted_blocklist=$(mktemp) unsorted_blocklist=$(mktemp)
sorted_blocklist=$(mktemp) sorted_blocklist=$(mktemp)
new_set_file=$(mktemp) new_set_file=$(mktemp)
headers=$(mktemp)
# download the blocklist # download the blocklist
set_name=$(echo "$url" | awk -F/ '{print $3;}') # set name is derived from source URL hostname set_name=$(echo "$url" | awk -F/ '{print $3;}') # set name is derived from source URL hostname
curl -s ${COMPRESS_OPT} -k "$url" >"${unsorted_blocklist}" curl -v -s ${COMPRESS_OPT} -k "$url" >"${unsorted_blocklist}" 2>"${headers}"
# this is required for blocklist.de that sends compressed content if asked for it or not
if grep -qi 'content-encoding: gzip' ${headers }; then
mv "${unsorted_blocklist}" "${unsorted_blocklist}.gz"
gzip -d "${unsorted_blocklist}"
fi
sort -u <"${unsorted_blocklist}" | egrep "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >"${sorted_blocklist}" sort -u <"${unsorted_blocklist}" | egrep "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >"${sorted_blocklist}"
# calculate performance parameters for the new set # calculate performance parameters for the new set
@ -105,7 +113,7 @@ for url in $urls; do
iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -j DROP iptables -A ${blocklist_chain_name} -m set --match-set "${set_name}" src,dst -j DROP
# clean up temp files # clean up temp files
rm "${unsorted_blocklist}" "${sorted_blocklist}" "${new_set_file}" rm "${unsorted_blocklist}" "${sorted_blocklist}" "${new_set_file}" "${headers}"
done done