Maltrail: Integrate fail2ban IP-list with firewall aliases (#2017)

security/maltrail/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		maltrail
-PLUGIN_VERSION=		1.7
+PLUGIN_VERSION=		1.8
 PLUGIN_COMMENT=		Malicious traffic detection system
 PLUGIN_DEPENDS=		maltrail
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

security/maltrail/pkg-descr

@@ -11,6 +11,10 @@ WWW: https://github.com/stamparm/maltrail
 Changelog
 ---------
 
+1.8
+
+* Add firewall alias "BlocklistMaltrail" that points to the built-in ip block list
+
 1.7
 
 * Allow sensor cron restart

security/maltrail/src/opnsense/mvc/app/controllers/OPNsense/Maltrail/Api/ServerController.php

@@ -29,9 +29,86 @@
 namespace OPNsense\Maltrail\Api;
 
 use OPNsense\Base\ApiMutableModelControllerBase;
+use OPNsense\Firewall\Alias;
 
 class ServerController extends ApiMutableModelControllerBase
 {
     protected static $internalModelClass = '\OPNsense\Maltrail\Server';
     protected static $internalModelName = 'server';
+
+    protected function setActionHook()
+    {
+        $model = $this->getModel();
+
+        // Handle addition/removal of "BlocklistMaltrail"
+        if (strval($model->addblocklistalias) == "1") {
+            $enabled = strval($model->enabled) == "1";
+            $address = trim(strval($model->listenaddress));
+
+            if ($address == "0.0.0.0") {
+                $address = "127.0.0.1";
+            } else if ($address == "::") {
+                $address = "::1";
+            }
+
+            if (strpos($address, ':') !== false) {
+                $address = "[$address]";
+            }
+
+            $address = $address . ':' . strval($model->listenport);
+
+            self::toggleBlocklistAlias(true, $enabled, $address);
+        } else {
+            self::toggleBlocklistAlias(false);
+        }
+    }
+
+    const BLOCKLIST_ALIAS_NAME = "BlocklistMaltrail";
+    const BLOCKLIST_ALIAS_DESCRIPTION = "Autogenerated alias for Maltrail's fail2ban feature";
+    const BLOCKLIST_ALIAS_UPDATE_FREQ = (1 / 24 / 60 * 5); // (1) is 24 hours | (1 / 24 / 60 * 5) is every 5 minutes
+
+    private static function toggleBlocklistAlias(bool $add, bool $enabled = false, string $addressAndPort = "")
+    {
+        $model = new Alias();
+
+        // Search for existing alias
+        $blocklist = null;
+        $blocklistIndex = null;
+        foreach ($model->aliases->alias->iterateItems() as $index => $alias) {
+            if (strval($alias->name) == self::BLOCKLIST_ALIAS_NAME) {
+                $blocklist = $alias;
+                $blocklistIndex = $index;
+                break;
+            }
+        }
+
+        // Add, update or remove the alias
+        if ($add) {
+            if ($blocklist === null) {
+                $blocklist = $model->aliases->alias->add();
+                $blocklist->name = self::BLOCKLIST_ALIAS_NAME;
+                $blocklist->description = self::BLOCKLIST_ALIAS_DESCRIPTION;
+                $blocklist->updatefreq = strval(self::BLOCKLIST_ALIAS_UPDATE_FREQ);
+            }
+
+            $url = "http://$addressAndPort/fail2ban";
+            $enabled = ($enabled ? "1" : "0");
+
+            $needsUpdate = strval($blocklist->type) != "urltable"
+                || strval($blocklist->content) != $url
+                || strval($blocklist->enabled) != $enabled;
+
+            if ($needsUpdate) {
+                $blocklist->type = "urltable";
+                $blocklist->content = $url;
+                $blocklist->enabled = $enabled;
+
+                $model->serializeToConfig();
+            }
+        } else if ($blocklistIndex !== null) {
+            if ($model->aliases->alias->del($blocklistIndex)) {
+                $model->serializeToConfig();
+            }
+        }
+    }
 }

security/maltrail/src/opnsense/mvc/app/controllers/OPNsense/Maltrail/forms/server.xml

@@ -5,6 +5,12 @@
         <type>checkbox</type>
         <help>This will activate the Maltrail server. You can use this service to also collect data from remote Maltrail sensors.</help>
     </field>
+    <field>
+        <id>server.addblocklistalias</id>
+        <label>Add Blocklist Alias</label>
+        <type>checkbox</type>
+        <help>Adds firewall alias "BlocklistMaltrail" referencing Maltrail's "/fail2ban" IP list. You can use this alias to block IPs that Maltrail detected as malicious.</help>
+    </field>
     <field>
         <id>server.listenaddress</id>
         <label>UI Listen Address</label>

security/maltrail/src/opnsense/mvc/app/models/OPNsense/Maltrail/Server.xml

@@ -1,12 +1,16 @@
 <model>
     <mount>//OPNsense/maltrail/server</mount>
     <description>Maltrail server configuration</description>
-    <version>0.0.1</version>
+    <version>0.0.2</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
             <Required>Y</Required>
         </enabled>
+        <addblocklistalias type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </addblocklistalias>
         <listenaddress type="HostnameField">
             <default>0.0.0.0</default>
             <Required>Y</Required>

security/maltrail/src/opnsense/service/templates/OPNsense/Maltrail/maltrail.conf

@@ -7,6 +7,9 @@ HTTP_ADDRESS {{ OPNsense.maltrail.server.listenaddress }}
 HTTP_PORT {{ OPNsense.maltrail.server.listenport }}
 USE_SSL false
 
+# Regular expression to be used in external /fail2ban calls for extraction of attacker source IPs
+FAIL2BAN_REGEX attacker|reputation|potential[^"]*(web scan|directory traversal|injection|remote code)|spammer|mass scanner
+
 {%   if helpers.exists('OPNsense.maltrail.server.loglistenaddress') and OPNsense.maltrail.server.loglistenaddress != '' %}
 UDP_ADDRESS {{ OPNsense.maltrail.server.loglistenaddress }}
 {%   endif %}