www/nginx: autoblock TTL (#3106)

www/nginx/Makefile

@@ -1,6 +1,5 @@
 PLUGIN_NAME=		nginx
-PLUGIN_VERSION=		1.29
-PLUGIN_REVISION=	1
+PLUGIN_VERSION=		1.30
 PLUGIN_COMMENT=		Nginx HTTP server and reverse proxy
 PLUGIN_DEPENDS=		nginx
 PLUGIN_MAINTAINER=	franz.fabian.94@gmail.com

www/nginx/pkg-descr

@@ -10,6 +10,10 @@ WWW: https://nginx.org/
 Plugin Changelog
 ================
 
+1.30
+
+* add support for autoblock TTL
+
 1.29
 
 * fixed a typo in the trusted tls fingerprints db creation part of setup.php

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/settings.xml

@@ -7,6 +7,13 @@
                 <type>checkbox</type>
                 <help>Enable configured services.</help>
             </field>
+            <field>
+                <id>nginx.general.ban_ttl</id>
+                <label>Autoblock TTL (minutes)</label>
+                <type>text</type>
+                <help>Set autoblock lifetime in minutes. Set to 0 for infinite.</help>
+                <advanced>true</advanced>
+            </field>
         </subtab>
         <subtab id="nginx-http-global" description="Global HTTP Settings">
              <field>

www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml

@@ -1,6 +1,6 @@
 <model>
   <mount>//OPNsense/Nginx</mount>
-  <version>1.28.0</version>
+  <version>1.30</version>
   <description>nginx web server, reverse proxy and waf</description>
   <items>
     <general>
@@ -8,6 +8,11 @@
         <default>0</default>
         <Required>Y</Required>
       </enabled>
+      <ban_ttl type="IntegerField">
+        <default>0</default>
+        <MinimumValue>0</MinimumValue>
+        <Required>Y</Required>
+      </ban_ttl>
     </general>
 
     <webgui>

www/nginx/src/opnsense/scripts/nginx/ngx_autoblock.php

@@ -259,8 +259,19 @@ $banned_ips = (function () {
     // Reading stored banned IPs from config
     $model = new Nginx();
     $alias_ips = [];
-    foreach ($model->ban->iterateItems() as $entry) {
-        $alias_ips[] = (string)$entry->ip;
+    $ban_ttl = intval((string)$model->general->ban_ttl);
+    if ($ban_ttl && ($ban_ttl > 0)) {
+        $min_timestamp = time() - 60*$ban_ttl;
+    }
+    $change_required = false;
+    foreach ($model->ban->iterateItems() as $id => $entry) {
+        if ($min_timestamp && (intval((string)$entry->time) < $min_timestamp)) {
+            // Delete expired records from config
+            $model->ban->Del($id);
+            $change_required = true;
+        } else {
+            $alias_ips[] = (string)$entry->ip;
+        }
     }
 
     // Collecting all new IPs from ban file not yet in $alias_ips.
@@ -284,8 +295,7 @@ $banned_ips = (function () {
     })();
 
     // Transfering new IPs into $alias_ips and store them permanently.
-    $new_and_alias_ips = (function () use ($model, $new_ips, $alias_ips) {
-        $change_required = false;
+    $new_and_alias_ips = (function () use ($model, $new_ips, $alias_ips, $change_required) {
 
         foreach ($new_ips as $new_ip) {
             $alias_ips[] = $new_ip;

www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf

@@ -248,7 +248,7 @@ server {
 {% endif %}
 {% if server.disable_bot_protection is not defined or server.disable_bot_protection != '1' %}
     # block based on User Agents - stuff I have found over the years in my server log
-    if ($http_user_agent ~* Python-urllib|Nmap|python-requests|libwww-perl|MJ12bot|Jorgee|fasthttp|libwww|Telesphoreo|A6-Indexer|ltx71|okhttp|ZmEu|sqlmap|LMAO/2.0|ltx71|zgrab|Ronin/2.0|Hakai/2.0) {
+    if ($http_user_agent ~* Python-urllib|Nmap|python-requests|libwww-perl|MJ12bot|Jorgee|fasthttp|libwww|Telesphoreo|A6-Indexer|ltx71|okhttp|ZmEu|sqlmap|LMAO/2.0|l9explore|l9tcpid|Masscan|zgrab|Ronin/2.0|Hakai/2.0) {
       return 418;
     }
     {# MSIE 7 cannot be blocked - used for compatibility mode - https://blogs.msdn.microsoft.com/ieinternals/2013/09/21/internet-explorer-11s-many-user-agent-strings/ #}