f5/irule_admin_iptable.tcl at master · geoffroyrenaud/f5 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# This irule quickly manage a blacklist table to block & maintain bad ips with the irule irule_iptable.tcl

when RULE_INIT {
    # 10 min
    set static::timeout 600
}

when HTTP_REQUEST {

    set response "<html><body>\n"

    switch -glob [HTTP::path] {

        "/list*" {
            set tablename "blacklist"
            if { [HTTP::path] contains "/list" } {
                foreach key [table keys -subtable $tablename -notouch] {
                    set remain [table timeout -subtable $tablename -remaining $key]
                    set response "$response$key : $remain seconds<br/>\n"
                }
                HTTP::respond 200 content "$response</body></html>"
                return
            }
        }

        "/add*" {
            set myaddips [split [URI::query [HTTP::uri] ip] ","]
            if { [info exists myaddips] && ($myaddips != "") } {
                log local0. "ADD $myaddips"
                foreach ip $myaddips {
                    log local0. "SET BL ADD ip = $ip"
                    set response "$response BL ADD ip = $ip<br/>\n"
                    table set -subtable "blacklist" $ip "blocked" $static::timeout
                }
            }
        }

        "/del*" {
            set mydelips [split [URI::query [HTTP::uri] ip] ","]
            log local0. "DELL $mydelips"
            if {[info exists mydelips] && ($mydelips != "") } {
                foreach ip $mydelips {
                    log local0. "DEL BL ip = $ip"
                    set response "$response BL DEL ip = $ip<br/>\n"
                    table delete -subtable "blacklist" $ip
                }
            }
        }

        default {
           HTTP::respond 501 content "<html><body> invalid query </body></html>"
           return
        }
    }


    HTTP::respond 200 content "$response</body></html>"
}