7x31/mailcow-dockerized
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Web] Allow to blacklist, whitelist and unban networks currently blocked plus minor other fixes to fail2ban logic

Browse Source
This commit is contained in:
André
2018-07-03 23:27:00 +02:00
parent 26807823b4
commit 5e590ea119
5 changed files with 93 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
data/web/inc/functions.fail2ban.inc.php
View File

@@ -1,4 +1,14 @@
<?php
function valid_network($network) {
$cidr = explode('/', $network);
if (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 32))) {
return true;
}
elseif (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 128))) {
return true;
}
return false;
}
function fail2ban($_action, $_data = null) {
global $redis;
global $lang;
@@ -42,6 +52,22 @@ function fail2ban($_action, $_data = null) {
else {
$f2b_options['blacklist'] = "";
}
$active_bans = $redis->hGetAll('F2B_ACTIVE_BANS');
$queue_unban = $redis->hGetAll('F2B_QUEUE_UNBAN');
if (is_array($active_bans)) {
foreach ($active_bans as $network => $banned_until) {
$queued_for_unban = (isset($queue_unban[$network]) && $queue_unban[$network] == 1) ? 1 : 0;
$difference = $banned_until - time();
$f2b_options['active_bans'][] = array(
'queued_for_unban' => $queued_for_unban,
'network' => $network,
'banned_until' => sprintf('%02dh %02dm %02ds', ($difference/3600), ($difference/60%60), $difference%60)
);
}
}
else {
$f2b_options['active_bans'] = "";
}
}
catch (RedisException $e) {
$_SESSION['return'] = array(
@@ -60,6 +86,33 @@ function fail2ban($_action, $_data = null) {
);
return false;
}
if (isset($_data['action']) && !empty($_data['network'])) {
$networks = (array) $_data['network'];
foreach ($networks as $network) {
if ($_data['action'] == "unban") {
if (valid_network($network)) {
$redis->hSet('F2B_QUEUE_UNBAN', $network, 1);
}
}
elseif ($_data['action'] == "whitelist") {
if (valid_network($network)) {
$redis->hSet('F2B_WHITELIST', $network, 1);
$redis->hDel('F2B_BLACKLIST', $network, 1);
$redis->hSet('F2B_QUEUE_UNBAN', $network, 1);
}
}
elseif ($_data['action'] == "blacklist") {
if (valid_network($network)) {
$redis->hSet('F2B_BLACKLIST', $network, 1);
}
}
}
$_SESSION['return'] = array(
'type' => 'success',
'msg' => sprintf($lang['success']['object_modified'], htmlspecialchars(implode(', ', $networks)))
);
return true;
}
$is_now = fail2ban('get');
if (!empty($is_now)) {
$ban_time = intval((isset($_data['ban_time'])) ? $_data['ban_time'] : $is_now['ban_time']);
@@ -93,11 +146,7 @@ function fail2ban($_action, $_data = null) {
$wl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $wl));
if (is_array($wl_array)) {
foreach ($wl_array as $wl_item) {
$cidr = explode('/', $wl_item);
if (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 32))) {
$redis->hSet('F2B_WHITELIST', $wl_item, 1);
}
elseif (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 128))) {
if (valid_network($wl_item)) {
$redis->hSet('F2B_WHITELIST', $wl_item, 1);
}
}
@@ -107,11 +156,7 @@ function fail2ban($_action, $_data = null) {
$bl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $bl));
if (is_array($bl_array)) {
foreach ($bl_array as $bl_item) {
$cidr = explode('/', $bl_item);
if (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 32))) {
$redis->hSet('F2B_BLACKLIST', $bl_item, 1);
}
elseif (filter_var($cidr[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && (!isset($cidr[1]) || ($cidr[1] >= 0 && $cidr[1] <= 128))) {
if (valid_network($bl_item)) {
$redis->hSet('F2B_BLACKLIST', $bl_item, 1);
}
}