7x31/mailcow-dockerized
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Netfilter] New ban method, allow to set blacklists

Browse Source
This commit is contained in:
André
2018-04-25 10:54:13 +02:00
parent a6810b81c6
commit 05e026db3a
14 changed files with 241 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
data/web/inc/functions.fail2ban.inc.php
View File

@@ -13,10 +13,10 @@ function fail2ban($_action, $_data = null) {
$wl = $redis->hGetAll('F2B_WHITELIST');
if (is_array($wl)) {
foreach ($wl as $key => $value) {
$tmp_data[] = $key;
$tmp_wl_data[] = $key;
}
if (isset($tmp_data)) {
$f2b_options['whitelist'] = implode(PHP_EOL, $tmp_data);
if (isset($tmp_wl_data)) {
$f2b_options['whitelist'] = implode(PHP_EOL, $tmp_wl_data);
}
else {
$f2b_options['whitelist'] = "";
@@ -25,6 +25,21 @@ function fail2ban($_action, $_data = null) {
else {
$f2b_options['whitelist'] = "";
}
$bl = $redis->hGetAll('F2B_BLACKLIST');
if (is_array($bl)) {
foreach ($bl as $key => $value) {
$tmp_bl_data[] = $key;
}
if (isset($tmp_bl_data)) {
$f2b_options['blacklist'] = implode(PHP_EOL, $tmp_bl_data);
}
else {
$f2b_options['blacklist'] = "";
}
}
else {
$f2b_options['blacklist'] = "";
}
}
catch (RedisException $e) {
$_SESSION['return'] = array(
@@ -50,6 +65,8 @@ function fail2ban($_action, $_data = null) {
$retry_window = intval((isset($_data['retry_window'])) ? $_data['retry_window'] : $is_now['retry_window']);
$netban_ipv4 = intval((isset($_data['netban_ipv4'])) ? $_data['netban_ipv4'] : $is_now['netban_ipv4']);
$netban_ipv6 = intval((isset($_data['netban_ipv6'])) ? $_data['netban_ipv6'] : $is_now['netban_ipv6']);
$wl = (isset($_data['whitelist'])) ? $_data['whitelist'] : $is_now['whitelist'];
$bl = (isset($_data['blacklist'])) ? $_data['blacklist'] : $is_now['blacklist'];
}
else {
$_SESSION['return'] = array(
@@ -58,7 +75,6 @@ function fail2ban($_action, $_data = null) {
);
return false;
}
$wl = $_data['whitelist'];
$f2b_options = array();
$f2b_options['ban_time'] = ($ban_time < 60) ? 60 : $ban_time;
$f2b_options['netban_ipv4'] = ($netban_ipv4 < 8) ? 8 : $netban_ipv4;
@@ -70,6 +86,7 @@ function fail2ban($_action, $_data = null) {
try {
$redis->Set('F2B_OPTIONS', json_encode($f2b_options));
$redis->Del('F2B_WHITELIST');
$redis->Del('F2B_BLACKLIST');
if(!empty($wl)) {
$wl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $wl));
if (is_array($wl_array)) {
@@ -84,6 +101,20 @@ function fail2ban($_action, $_data = null) {
}
}
}
if(!empty($bl)) {
$bl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $bl));
if (is_array($bl_array)) {
foreach ($bl_array as $bl_item) {
$cidr = explode('/', $bl_item);
if (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 32))) {
$redis->hSet('F2B_BLACKLIST', $bl_item, 1);
}
elseif (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 128))) {
$redis->hSet('F2B_BLACKLIST', $bl_item, 1);
}
}
}
}
}
catch (RedisException $e) {
$_SESSION['return'] = array(