paxton
/
mailcow
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

low response timeout 

add ipv6 support
add multiple record support
master
Kraeutergarten 2019-05-18 12:04:11 +02:00
parent 4cc63ceeb7
commit 51f5f66c91
2 changed files with 45 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
data/Dockerfiles/netfilter/Dockerfile
View File

@ -6,7 +6,7 @@ ENV PYTHON_IPTABLES_XTABLES_VERSION 12
ENV IPTABLES_LIBDIR /usr/lib
RUN apk add -U python2 python-dev py-pip gcc musl-dev iptables ip6tables tzdata \
&& pip2 install --upgrade python-iptables==0.13.0 redis ipaddress \
&& pip2 install --upgrade python-iptables==0.13.0 redis ipaddress dnspython \
&& apk del python-dev py2-pip gcc
COPY server.py /

53
data/Dockerfiles/netfilter/server.py
View File

@ -5,7 +5,6 @@ import os
import time
import atexit
import signal
import socket
import ipaddress
from random import randint
from threading import Thread
@ -13,6 +12,8 @@ from threading import Lock
import redis
import json
import iptc
import dns.resolver
import dns.exception
while True:
try:
@ -26,6 +27,8 @@ while True:
pubsub = r.pubsub()
resolver = dns.resolver.Resolver()
RULES = {}
RULES[1] = 'warning: .*\[([0-9a-f\.:]+)\]: SASL .+ authentication failed'
RULES[2] = '-login: Disconnected \(auth failed, .+\): user=.*, method=.+, rip=([0-9a-f\.:]+),'
@ -126,21 +129,51 @@ def ban(address):
self_network = ipaddress.ip_network(address.decode('ascii'))
if WHITELIST:
wl_hostnames=[]
wl_networks=[]
for wl_key in WHITELIST:
if not is_ip_network(wl_key):
hostname = wl_key
if is_ip_network(wl_key):
wl_networks.append(wl_key)
else:
wl_hostnames.append(wl_key)
for w1_hostname in wl_hostnames:
hostname_ips = []
for rdtype in ['A', 'AAAA']:
try:
wl_key = socket.gethostbyname(hostname)
except socket.gaierror as err:
answer = resolver.query(qname=w1_hostname, rdtype=rdtype, lifetime=1)
except dns.exception.Timeout as timout:
log['time'] = int(round(time.time()))
log['priority'] = 'info'
log['message'] = 'Hostname %s timedout on resolve' % (w1_hostname)
r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
print 'Hostname %s timedout on resolve' % (w1_hostname)
break
except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
continue
except dns.exception.DNSException as dnsexception:
log['time'] = int(round(time.time()))
log['priority'] = 'info'
log['message'] = '%s' % (dnsexception)
r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
print '%s' % (dnsexception)
continue
log['time'] = int(round(time.time()))
log['priority'] = 'info'
log['message'] = 'Hostname %s is resolved to %s' % (hostname, wl_key)
r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
print 'Hostname %s is resolved to %s' % (hostname, wl_key)
for rdata in answer:
hostname_ips.append(rdata.to_text())
wl_networks.extend(hostname_ips)
log['time'] = int(round(time.time()))
log['priority'] = 'info'
log['message'] = 'Hostname %s is resolved to %s' % (w1_hostname, hostname_ips)
r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
print 'Hostname %s is resolved to %s' % (w1_hostname, hostname_ips)
for wl_key in wl_networks:
wl_net = ipaddress.ip_network(wl_key.decode('ascii'), False)
if wl_net.overlaps(self_network):
log['time'] = int(round(time.time()))
log['priority'] = 'info'