FEATURE: Enhanced firewall blacklisting to make it more flexible

It will now support config option 'firewall_blacklist_send_to'.  If set
it will send all blacklisted IP addresses to this chain (iptables -j).
If this option is not set, it will default to DROP.

1 files changed, 13 insertions, 1 deletions

diff --git a/plugin/firewall/eurephiafw.c b/plugin/firewall/eurephiafw.c
index fd3aa5e..1aba1c7 100644
--- a/plugin/firewall/eurephiafw.c
+++ b/plugin/firewall/eurephiafw.c
@@ -142,6 +142,16 @@ void eFW_StartFirewall(eurephiaCTX *ctx) {
 
                 // Create value space for blacklisted IP addresses
                 ctx->fwcfg->blacklisted = eCreate_value_space(ctx, 20);
+
+                // Setup where to send the blacklisted IP addresses - default is to drop them.
+                ctx->fwcfg->fwblacklist_sendto = eGet_value(ctx->dbc->config, "firewall_blacklist_send_to");
+                if( ctx->fwcfg->fwblacklist_sendto == NULL ) {
+                        ctx->fwcfg->fwblacklist_sendto = strdup("DROP\0");
+                        eurephia_log(ctx, LOG_INFO, 2,"Blacklisted IP addresses will be dropped immediately");
+                } else {
+                        eurephia_log(ctx, LOG_INFO, 2,"Blacklisted IP addresses will be sent to '%s'",
+                                     ctx->fwcfg->fwblacklist_sendto);
+                }
         }
 
         eurephia_log(ctx, LOG_INFO, 3, "Starting eurephia firewall interface");
@@ -297,6 +307,8 @@ void eFW_StopFirewall(eurephiaCTX *ctx) {
         // Send acknowledge back
         sem_post(ctx->fwcfg->thrdata.semp_master);
 
+        // Clean up and exit
+        free_nullsafe(ctx->fwcfg->fwblacklist_sendto);
         eFree_values(ctx, ctx->fwcfg->blacklisted);
         free_nullsafe((*ctx->fwcfg).thrdata.fw_command);
         free_nullsafe(ctx->fwcfg);
@@ -337,7 +349,7 @@ int eFW_UpdateFirewall(eurephiaCTX *ctx, int mode,
 
                 // Check if IP address is already registered as blacklisted
                 if( (blchk = eGet_value(ctx->fwcfg->blacklisted, addr)) == NULL ) {
-                        snprintf(buf, 1024, "B %s %s", addr, fwdest);
+                        snprintf(buf, 1024, "B %s %s %s", addr, fwdest, ctx->fwcfg->fwblacklist_sendto);
                         mq_send((*ctx->fwcfg).thrdata.msgq, buf, strlen(buf)+1, 1);
                         eAdd_value(ctx, ctx->fwcfg->blacklisted, addr, fwdest);
                 } else {