aboutsummaryrefslogtreecommitdiff
path: root/net/banip/files
Commit message (Collapse)AuthorAge
* banip: release 0.8.6-1Dirk Brenken2023-05-12
| | | | | | | | * made the fetch utility function/autodetection more bullet proof * no longer add suspicious IPs to the local blocklist when the nft set timeout has been set * restructure internal functions & small fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.5-2Dirk Brenken2023-05-08
| | | | | | * fixed a log parser regression introduced in latest 0.8.4 update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.5-1Dirk Brenken2023-05-06
| | | | | | | | | | * add support for external allowlist URLs to reference additional IPv4/IPv6 feeds, set 'ban_allowurl' accordingly * make download retries in case of an error configurable, set 'ban_fetchretry' accordingly (default 5) * small fixes * readme update * LuCI update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-5Dirk Brenken2023-05-04
| | | | | | | | * fix remaining small issues * standardize log wording * polished up for branch 23.x Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-4Dirk Brenken2023-05-04
| | | | | | | | * add housekeeping to the autoallow function, only the current uplink will be held * fix small issues * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-3Dirk Brenken2023-05-02
| | | | | | * add the option 'ban_autoallowuplink' to limit the uplink autoallow function: 'subnet' (default), 'ip' or 'disable' Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.4-2Dirk Brenken2023-04-28
| | | | | | | * fix domain lookup function (parse banIP config vars) * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.4-1Dirk Brenken2023-04-23
| | | | | | | | | | | | * add support for a custom feeds file (/etc/banip/banip.custom.feeds). Add new or edit existing banIP feeds on your own with the integrated custom feed editor (LuCI-component * add a new option 'ban_blockpolicy' to overrule the default bblock policy (block all chains), see readme for details * change the feed file format and add a new ipthreat feed, see readme * refine (debug) logging * multiple small fixes and improvements * readme update * luci update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.3-2Dirk Brenken2023-04-12
| | | | | | * more init fixes Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.3-1Dirk Brenken2023-04-06
| | | | | | | | | | * add the new init command 'lookup', to lookup the IPs of domain names in the local lists and update them * significant acceleration of the domain lookup function * multiple small fixes and improvements * readme update * luci update (separate commit) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-6Dirk Brenken2023-03-30
| | | | | | * restored some accidently removed init stuff in last commit Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-5Dirk Brenken2023-03-30
| | | | | | | | | * fixed missing version number when installed as separate package (not in build) * fixed cornercase init and mailing issues * sorted Country list by country names ascending * fixed some shellcheck findings Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-4Dirk Brenken2023-03-26
| | | | | | * fixed a race condition if the service is in a disabled state Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.8.2-3Dirk Brenken2023-03-22
| | | | | | | | | | | * raise max. timeouts from 10 to 30 seconds to stabilize the autodetection on slow hardware * made interface trigger action configurable, set 'ban_triggeraction' accordingly (default: 'start') * made E-Mail notifications configurable to receive status E-Mais with every banIP run, set 'ban_mailnotification' accordingly (default: disabled) * small fixes & optimizations * readme update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.2-2Dirk Brenken2023-03-10
| | | | | | | | | | | | * fix the auto-detection for pppoe and 6in4 tunnel interfaces * add the new 'ban_nftpolicy' option to expose the nft set policy, values: memory (default), performance * add the new 'ban_nftlogevel' option to expose the nft syslog level, values: emerg, alert, crit, err, warn (default), notice, info, debug, audit * status optimizations * logging optimizations * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.2-1Dirk Brenken2023-03-08
| | | | | | | | | * major performance improvements: clean-up/optimize all nft calls * add a new "ban_reportelements" option, to disable the (time consuming) Set element count in the report (enabled by default) * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.1-3Dirk Brenken2023-03-06
| | | | | | | | | * finalized the LuCI frontend preparation (this is the minmal version to use the forthcoming LuCI frontend) * added a Set survey, to list all elements of a certain set * changed the default logterm for asterisk * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.1-2Dirk Brenken2023-02-26
| | | | | | | | | | * add oisdbig as new feed * LuCI frontend preparation: - the json feed file points always to /etc/banip/banip.feeds (and is no longer compressed) - supply country list in /etc/banip/banip.countries * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.1-1Dirk Brenken2023-02-25
| | | | | | | | | | | | | * add missing wan-forward chain (incl. report/mail adaption) * changed options: - old: ban_blockforward, new: ban_blockforwardwan and ban_blockforwardlan - old: ban_logforward, new: ban_logforwardwan and ban_logforwardlan * add missing dhcp(v6) rules/exceptions * update readme Previously run tested by certain forum users (and by me). Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-4Dirk Brenken2023-02-21
| | | | | | * remove bogus log limit Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-3Dirk Brenken2023-02-21
| | | | | | * properly initialize the 'proto' variable in the log service Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.8.0-2Dirk Brenken2023-02-20
| | | | | | | * fix a potential race condition during initial startup (after flash) which leads to a "disabled" service Signed-off-by: Dirk Brenken <dev@brenken.org Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.8.0 (nft rewrite)Dirk Brenken2023-02-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - complete rewrite of banIP to support nftables - all sets are handled in a separate nft table/namespace 'banIP' - for incoming blocking it uses the inet input hook, for outgoing blocking it uses the inet forward hook - full IPv4 and IPv6 support - supports nft atomic set loading - supports blocking by ASN numbers and by iso country codes - 42 preconfigured external feeds are available, plus local allow- and blocklist - supports local allow- and blocklist (IPv4, IPv6, CIDR notation or domain names) - auto-add the uplink subnet to the local allowlist - provides a small background log monitor to ban unsuccessful login attempts in real-time - the logterms for the log monitor service can be freely defined via regex - auto-add unsuccessful LuCI, nginx, Asterisk or ssh login attempts to the local blocklist - fast feed processing as they are handled in parallel as background jobs - per feed it can be defined whether the input chain or the forward chain should be blocked (default: both chains) - automatic blocklist backup & restore, the backups will be used in case of download errors or during startup - automatically selects one of the following download utilities with ssl support: aria2c, curl, uclient-fetch or wget - supports a 'allowlist only' mode, this option restricts internet access from/to a small number of secure websites/IPs - provides comprehensive runtime information - provides a detailed set report - provides a set search engine for certain IPs - feed parsing by fast & flexible regex rulesets - minimal status & error logging to syslog, enable debug logging to receive more output - procd based init system support (start/stop/restart/reload/status/report/search) - procd network interface trigger support - ability to add new banIP feeds on your own - add a readme with all available options/feeds to customize your installation to your needs - a new LuCI frontend will be available in due course Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update nginx matchingOskari Rauta2021-12-03
| | | | | | | | | | | | | | | Currently banip matches nginx log entries starting with nginx[number]:... I am running a containerized nginx with alpine as base, which ends up adding log entries without [number] part.. like this: nginx:... This patch updates regex for nginx log entry search to include both versions. Signed-off-by: Oskari Rauta <oskari.rauta@gmail.com>
* banip: update 0.7.10-3Richard Gering2021-09-11
| | | | | | * Updated firehol ipset URLs Signed-off-by: Richard Gering <rg4github@dutchies.us>
* banip: update 0.7.10-2Dirk Brenken2021-09-07
| | | | | | | * optimize dns resolve function * cosmetics Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.10Dirk Brenken2021-08-29
| | | | | | | | * switch to unencrypted http downloads for ipdeny.com due to persistant certificate issues * compact json generator code (tested with report files > 2MB) * various code cleanups and optimizations Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: refine/fix nginx search patternDirk Brenken2021-06-17
| | | | | * fix issue with nginx search pattern reported in forum support thread Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.9Dirk Brenken2021-06-13
| | | | | | | * add switch 'ban_fetchinsecure' to allow insecure downloads without certificate check (disabled by default) * better explain 'ban_fetchparm' in readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.8Dirk Brenken2021-05-04
| | | | | | | * fix pid file processing of the background monitor plus child processes (bug reported in the forum) * made the enabled/disabled switch of the background monitor functional Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: fix housekeepingDirk Brenken2021-04-23
| | | | | | * fix whitelist housekeeping if you switch between normal- and 'whitelist only' mode Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.7Dirk Brenken2021-04-21
| | | | | | | * add a "whitelist only" mode, this option allows to restrict Internet access from/to a small number of secure websites/IPs, and block access from/to the rest of the Internet. Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bugfix 0.7.6-2Dirk Brenken2021-04-03
| | | | | * fix housekeeping of external list sources Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.6Dirk Brenken2021-03-28
| | | | | | | | | * rework the central iptables function to significantly reduce the code complexity and the overall number of iptables calls * check early and only once in the chain for ctstate NEW and return otherwise (thanks @ldir-EDB0) * made the whitelist ordering within the chain more flexible Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.5-4Dirk Brenken2021-03-26
| | | | | | | | * fix another IPv4/IPv6 related iptables chain creation problem * fix counter during ipset creation * fix regex for debug counters * fix ipset housekeeping for local sources Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.7.5-3Dirk Brenken2021-03-19
| | | | | * fix iptables/chain creation in setups without IPv6 support Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.5-2Dirk Brenken2021-03-15
| | | | | | | | | * refine the new dns resolving process * add a caching mechanism for the resolved IPs, the detached name lookup takes place only during 'restart' or 'reload' action, 'start' and 'refresh' actions are using an auto-generated backup instead. * update the readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bump to 0.7.5Dirk Brenken2021-03-14
| | | | | | | * black- and whitelist now supporting domain names as well - the corresponding IPs (IPv4 & IPv6) will be resolved in a detached background process and added to the IPsets Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.3Dirk Brenken2021-02-20
| | | | | | | | | * fix search string/pipe preparation for the background service * fix IPSet maxelem limitation, made it more flexible * fix potential error during resume action * add Cisco Talos IP blacklist * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update to 0.7.2Dirk Brenken2021-02-17
| | | | | | | | | | | * add scanning for suspicious nginx events * add a log counter to track the number of the failed requests or login repetitions of the same ip in the log before banning, defaults are: ssh (3), luci (3), nginx (5) * optimize the background service handling * add 'greensnow' as a new source * update readme and LuCI frontend regarding the new log count options Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: bugfixDirk Brenken2021-02-12
| | | | | * fix a stale pid file during package update Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.7.1Dirk Brenken2021-02-07
| | | | | | | * add 'ban_extrasources' to handle banIP-unrelated sets for reporting and queries * add set timeouts for local sources (maclist, whitelist, blacklist) Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: release 0.7.0Dirk Brenken2021-02-04
| | | | | | | | | | | | | | | | | | | * major rewrite * add support for multiple chains * add mac whitelisting * add support for multiple ssh daemons in parallel * add an ipset report engine * add mail notifications * add suspend/resume functions * add a cron wrapper to set an ipset related auto-timer for automatic blocklist updates * add a list wrapper to add/remove blocklist sources * add 19.x and Turris OS 5.x compatibility code * sources stored in an external compressed json file (/etc/banip/banip.sources.gz) * change Country/ASN download sources (faster/more reliable) * fix DHCPv6/icmpv6 issues Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: DHCPv6 bugfixDirk Brenken2020-12-30
| | | | | * ignore local DHCPv6 related and local icmpv6 traffic in banIP chain Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: removed logd check since logd dep has been droppedJavier Marcet2020-11-10
| | | | Signed-off-by: Javier Marcet <javier@marcet.info>
* banip: adapt openwrt rc.common changesDirk Brenken2020-11-03
| | | | | | | | | * since openwrt master has merged the depending P/R, the old extra_help/extra_commands syntax is no longer working, see #13798 for reference * removed logd dependency, see #13820 for reference Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: Added packet logging feature. Resolved shellcheck warnings.Richard Gering2020-10-24
| | | | Signed-off-by: Richard Gering <rg4github@dutchies.us>
* banip: update 0.3.11Dirk Brenken2019-11-30
| | | | | | | * fix ssh daemon autodetection * fix 'sshd' logfile parsing Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.10Dirk Brenken2019-11-15
| | | | | | | * add missing logd dependency * check if logd is enabled during runtime * some more init tweaks Signed-off-by: Dirk Brenken <dev@brenken.org>
* banip: update 0.3.9Dirk Brenken2019-11-10
| | | | | * fix 'enabled' service check Signed-off-by: Dirk Brenken <dev@brenken.org>
Powered by cgit, Themed by Ted Yin.