blacklist-as

#!/bin/bash
PREFIX=/usr/local/bin
ipv4_file=$PREFIX/as_tables_ipv4
ipv6_file=$PREFIX/as_tables_ipv6
conf_file=$PREFIX/as_blacklist.conf
SYSTEMS=($(sed -r "s/$(grep -Eo "#.*" $conf_file | tr '\n' '|')//g" $conf_file | grep -vE '^\s*$'))
HEADER="*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]"

ENDING="-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
COMMIT"

set -e
set -o nounset

create_tables() {
	local COUNTER=0
	local NO_ELEMS=${#SYSTEMS[@]}
	echo "$HEADER" > $ipv4_file
	echo "$HEADER" > $ipv6_file

	for CURR_SYS in "${SYSTEMS[@]}"
	do
		COUNTER=$((COUNTER + 1))

		printf "%-30s %s\n" "Procesing AS ${CURR_SYS}" "${COUNTER}/${NO_ELEMS}"
		local ALL_TMP=$(whois -h whois.radb.net -i origin $CURR_SYS)
		local TMP4=($(echo "$ALL_TMP" | grep "route:" | awk '{print $2}'))
		local TMP6=($(echo "$ALL_TMP" | grep "route6:" | awk '{print $2}'))
		
		if [ "${#TMP4[@]}" -eq "0" ] && [ "${#TMP6[@]}" -eq "0" ]; then
			echo "Current AS not found in whois database"
			continue
		fi

		for ipv4_addr in "${TMP4[@]}"; do 
			echo "-A INPUT -s $ipv4_addr -j DROP" >> $ipv4_file
			echo "-A FORWARD -s $ipv4_addr -j DROP" >> $ipv4_file
			echo "-A OUTPUT -s $ipv4_addr -j DROP" >> $ipv4_file
		done

		for ipv6_addr in "${TMP6[@]}"; do
			echo "-A INPUT -s $ipv6_addr -j DROP" >> $ipv6_file
			echo "-A FORWARD -s $ipv6_addr -j DROP" >> $ipv6_file
			echo "-A OUTPUT -s $ipv6_addr -j DROP" >> $ipv6_file
		done
	done	
	
	echo "$ENDING" >> $ipv4_file
	echo "$ENDING" >> $ipv6_file

	echo "Compressing iptables"
	xz -z $ipv4_file

	echo "Compressing ip6tables"
	xz -z $ipv6_file	
}

clean() {
	iptables -F
	ip6tables -F

	iptables -P INPUT ACCEPT
	iptables -P OUTPUT ACCEPT
	iptables -P FORWARD ACCEPT

	ip6tables -P INPUT ACCEPT
	ip6tables -P OUTPUT ACCEPT
	ip6tables -P FORWARD ACCEPT

	if [ -f ${ipv4_file}.xz ]; then
    		rm ${ipv4_file}.xz
	fi

	if [ -f ${ipv6_file}.xz ]; then
		rm ${ipv6_file}.xz
	fi

	if [ -f /usr/lib/systemd/system/blacklist-as-unit.service ]; then
		systemctl disable blacklist-as-unit.service
		rm /usr/lib/systemd/system/blacklist-as-unit.service
	fi
}

install_service(){
	if [ ! -f $PREFIX/blacklist-as-unit.service ]; then
		crash "Missing file blacklist-as-unit.service, check your installation"
	fi

	if [ ! -d /usr/lib/systemd/system ]; then
		crash "This script is not compatible with your distribution"
	fi

	cp $PREFIX/blacklist-as-unit.service /usr/lib/systemd/system/blacklist-as-unit.service
	systemctl enable blacklist-as-unit.service
}

usage() {
	echo "Usage:"
	echo " $0 option"
	echo ""
	echo "Block autonomous systems using iptables"
	echo ""
	echo "Options:"
	echo " -u, --update"
	echo " -c, --clean"
	echo " -i, --install-service"
	echo " -r, --restore"
	echo " -h, --help"
	echo " -d, --dropped-packets"
}

crash() {
	echo $1 1>&2
	exit 1
}

restore() {
	if [ ! -f ${ipv4_file}.xz ] || [ ! -f ${ipv6_file}.xz ]; then
		crash "Cannot restore because iptables files do not exist"
	fi
	xz -d --stdout ${ipv4_file}.xz | iptables-restore
	xz -d --stdout ${ipv6_file}.xz | ip6tables-restore
}

show_dropped_packets() {
 iptables -L -nv | awk '{if(($1!="Chain"&&$1!="pkts"&&$3=="DROP"&&($1!=0||$2!=0))||NR==2){print}}'
 ip6tables -L -nv | awk '{if($1!="Chain"&&$1!="pkts"&&$3=="DROP"&&($1!=0||$2!=0)){print}}'
}

if [ "$(id -u)" != "0" ]; then
   	crash "This script must be run as root"
fi

if ! type iptables > /dev/null || ! type ip6tables > /dev/null; then
	crash "Command iptables not found"
fi

if ! type xz > /dev/null; then
	crash "Command xz not found"
fi

if ! type systemctl > /dev/null; then
	crash "Command systemctl not found"
fi

if ! type whois > /dev/null; then
	crash "Command whois not found"
fi

TMP=$(getopt -o 'ucirhd' -l 'update,clean,install-service,restore,help,dropped-packets' -n "$0" -- "$@")

if [ $? -ne 0 ]; then
	crash "Error with getopt"
fi

eval set -- "$TMP"
unset TMP

while true; do
	case "$1" in
		'-u'|'--update')
			echo "Updating configuration"
			clean
			create_tables 
			restore
			exit 
		;;
		'-c'|'--clean')
			echo "Cleaning IP-Tables and removing temporary files"
			clean
			exit
		;;
		'-i'|'--install-service')
			echo "Installing service file for automatic setup of iptables"
			install_service
			exit
		;;
		'-r'|'--restore')	
			echo "called restore"
			restore
			exit
		;;
		'-h'|'--help')
			usage
			exit
		;;
		'-d'|'--dropped-packets')
			show_dropped_packets
			exit
		;;
		'--')
			usage
			echo ""
			crash "No options supplied"
			exit
		;;
		*)
			usage
			echo ""
			crash "Unknown option"
		;;

	esac
done