OpenBSDAms
/
ard
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add protect function, and check if IP is in the protected pf table

This commit is contained in:
mischa 2023-05-08 08:19:52 +00:00
parent 178ebd8a07
commit eb7b9c0cd1
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
ard.pl
View File

@ -124,10 +124,11 @@ sub http_child {
my ($first, $token, $hostname) = split(/\//, $r->uri->as_string);
$hostname = (!defined($hostname) ? $token : lc($hostname));
my $fqdn = "${hostname}.${domain}";
my $protected = system("pfctl -qt protected -T test $client_ip 2> /dev/null");
if ($ip->overlaps($ipv4_range) or $ip->overlaps($ipv6_range)) {
if ($token eq 'token') {
if ($token eq 'token' and $protected) {
my $token = sha1_hex(int(rand(32)));
open my $fh_token, '>', "${workdir}/tokens/${token}";
print $fh_token "$client_ip\n";
@ -136,7 +137,14 @@ sub http_child {
_log("$client_ip $token");
_http_response($c, {content_type => 'text/plain'}, "$token");
} elsif (-e "${workdir}/tokens/$token" and ($hostname =~ /^[a-zA-Z0-9-]{1,20}$/)) {
} elsif ($token eq 'protect') {
my $protect = qx(pfctl -t protected -T add $client_ip 2>&1);
chomp $protect;
_log("$client_ip $token $protect");
_http_response($c, {content_type => 'text/plain'}, "Received [$client_ip -> protect] $protect");
} elsif (-e "${workdir}/tokens/$token" and ($hostname =~ /^[a-zA-Z0-9-]{1,20}$/) and $protected) {
open my $fh, '>', "${workdir}/records/${client_ip}";
if ($ip->overlaps($ipv4_range)) {
@ -155,7 +163,7 @@ sub http_child {
_http_error($c, RC_REQUEST_TIMEOUT);
} else {
_log("$client_ip RC_BAD_REQUEST $hostname");
_log("$client_ip RC_BAD_REQUEST $hostname ($protected)");
_http_error($c, RC_BAD_REQUEST);
}