1770 lines
64 KiB
Python
1770 lines
64 KiB
Python
#!/usr/bin/env python3
|
||
"""
|
||
GeoIP Shop Blocker Manager - DACH & Eurozone Version
|
||
2-Component System: PHP blocking + Python watcher (systemd service)
|
||
Supports two geo regions:
|
||
- DACH: Germany, Austria, Switzerland (3 countries)
|
||
- Eurozone+GB: All Eurozone countries + GB + CH (22 countries)
|
||
Supports three modes:
|
||
- php+crowdsec: GeoIP blocking with CrowdSec integration
|
||
- php-only: GeoIP blocking without CrowdSec
|
||
- bot-only: Block only bots, shop remains globally accessible
|
||
|
||
v3.3.0: Added option to activate only direct shops (not behind Link11)
|
||
"""
|
||
|
||
import os
|
||
import sys
|
||
import shutil
|
||
import subprocess
|
||
import json
|
||
import time
|
||
import re
|
||
import socket
|
||
from datetime import datetime, timedelta
|
||
from pathlib import Path
|
||
|
||
# ANSI Color Codes
|
||
COLOR_GREEN = "\033[92m"
|
||
COLOR_RED = "\033[91m"
|
||
COLOR_YELLOW = "\033[93m"
|
||
COLOR_BLUE = "\033[94m"
|
||
COLOR_RESET = "\033[0m"
|
||
COLOR_BOLD = "\033[1m"
|
||
|
||
# Link11 IP
|
||
LINK11_IP = "128.65.223.106"
|
||
|
||
# Cache for DNS lookups (to avoid repeated lookups)
|
||
DNS_CACHE = {}
|
||
|
||
# Configuration
|
||
VHOSTS_DIR = "/var/www/vhosts"
|
||
BACKUP_SUFFIX = ".geoip_backup"
|
||
BLOCKING_FILE = "geoip_blocking.php"
|
||
CACHE_FILE = "geoip_ip_ranges.cache"
|
||
LOG_FILE = "geoip_blocked.log"
|
||
CROWDSEC_QUEUE_FILE = "geoip_crowdsec_queue.log"
|
||
WATCHER_SCRIPT = "/usr/local/bin/geoip_crowdsec_watcher.py"
|
||
SYSTEMD_SERVICE = "/etc/systemd/system/geoip-crowdsec-watcher.service"
|
||
ACTIVE_SHOPS_FILE = "/var/lib/crowdsec/geoip_active_shops.json"
|
||
|
||
# Minimum expected IP ranges per region (for validation)
|
||
MIN_RANGES = {
|
||
"dach": 1000, # DE+AT+CH should have at least 1000 ranges
|
||
"eurozone": 5000 # 22 countries should have at least 5000 ranges
|
||
}
|
||
|
||
# =============================================================================
|
||
# GEO REGIONS
|
||
# =============================================================================
|
||
GEO_REGIONS = {
|
||
"dach": {
|
||
"name": "DACH",
|
||
"countries": ["de", "at", "ch"],
|
||
"description": "Deutschland, Österreich, Schweiz",
|
||
"icon": "🇩🇪🇦🇹🇨🇭",
|
||
"short": "DACH"
|
||
},
|
||
"eurozone": {
|
||
"name": "Eurozone + GB",
|
||
"countries": [
|
||
"de", "at", "ch", "be", "cy", "ee", "es", "fi", "fr", "gb",
|
||
"gr", "hr", "ie", "it", "lt", "lu", "lv", "mt", "nl", "pt", "si", "sk"
|
||
],
|
||
"description": "22 Länder: DE, AT, CH, BE, CY, EE, ES, FI, FR, GB, GR, HR, IE, IT, LT, LU, LV, MT, NL, PT, SI, SK",
|
||
"icon": "🇪🇺",
|
||
"short": "EU+"
|
||
},
|
||
"none": {
|
||
"name": "Bot-Only",
|
||
"countries": [],
|
||
"description": "Nur Bot-Blocking, weltweit erreichbar",
|
||
"icon": "🤖",
|
||
"short": "BOT"
|
||
}
|
||
}
|
||
|
||
# =============================================================================
|
||
# BOT DETECTION
|
||
# =============================================================================
|
||
BOT_PATTERNS = {
|
||
'GPTBot': r'GPTBot', 'OAI-SearchBot': r'OAI-SearchBot', 'ChatGPT-User': r'ChatGPT-User',
|
||
'ClaudeBot': r'ClaudeBot', 'Claude-User': r'Claude-User', 'anthropic-ai': r'anthropic-ai',
|
||
'Googlebot': r'Googlebot', 'Google-Extended': r'Google-Extended', 'AdsBot-Google': r'AdsBot-Google',
|
||
'Bingbot': r'[Bb]ingbot', 'BingPreview': r'BingPreview', 'msnbot': r'msnbot',
|
||
'PerplexityBot': r'PerplexityBot', 'Applebot': r'Applebot', 'Amazonbot': r'Amazonbot',
|
||
'FacebookBot': r'facebookexternalhit|FacebookBot', 'Bytespider': r'Bytespider',
|
||
'DuckDuckBot': r'DuckDuckBot', 'YandexBot': r'YandexBot', 'Baiduspider': r'Baiduspider',
|
||
'AhrefsBot': r'AhrefsBot', 'SemrushBot': r'SemrushBot', 'MJ12bot': r'MJ12bot',
|
||
'DotBot': r'DotBot', 'PetalBot': r'PetalBot', 'DataForSeoBot': r'DataForSeoBot',
|
||
'LinkedInBot': r'LinkedInBot', 'Twitterbot': r'Twitterbot', 'Slackbot': r'Slackbot',
|
||
'UptimeRobot': r'UptimeRobot', 'Pingdom': r'Pingdom', 'curl': r'^curl/',
|
||
'python-requests': r'python-requests', 'Wget': r'Wget', 'Scrapy': r'Scrapy',
|
||
}
|
||
|
||
|
||
def detect_bot(user_agent):
|
||
if not user_agent or user_agent == 'Unknown':
|
||
return 'Unbekannt'
|
||
for bot_name, pattern in BOT_PATTERNS.items():
|
||
if re.search(pattern, user_agent, re.IGNORECASE):
|
||
return bot_name
|
||
return 'Unbekannt'
|
||
|
||
|
||
def check_link11(domain):
|
||
global DNS_CACHE
|
||
if domain in DNS_CACHE:
|
||
return DNS_CACHE[domain]
|
||
try:
|
||
ip = socket.gethostbyname(domain)
|
||
is_link11 = (ip == LINK11_IP)
|
||
DNS_CACHE[domain] = {'is_link11': is_link11, 'ip': ip}
|
||
return DNS_CACHE[domain]
|
||
except socket.gaierror:
|
||
DNS_CACHE[domain] = {'is_link11': False, 'ip': 'N/A'}
|
||
return DNS_CACHE[domain]
|
||
|
||
|
||
def format_shop_with_link11(shop, prefix="", show_index=None):
|
||
link11_info = check_link11(shop)
|
||
if link11_info['is_link11']:
|
||
color, suffix = COLOR_GREEN, " [Link11]"
|
||
else:
|
||
color, suffix = COLOR_RED, " [Direkt]"
|
||
if show_index is not None:
|
||
return f" [{show_index}] {color}{shop}{suffix}{COLOR_RESET}"
|
||
return f"{prefix}{color}{shop}{suffix}{COLOR_RESET}"
|
||
|
||
|
||
def get_geo_region_info(geo_region):
|
||
return GEO_REGIONS.get(geo_region, GEO_REGIONS["dach"])
|
||
|
||
|
||
def generate_php_countries_array(geo_region):
|
||
region_info = get_geo_region_info(geo_region)
|
||
return ", ".join([f"'{c}'" for c in region_info["countries"]])
|
||
|
||
|
||
def generate_php_bot_patterns():
|
||
"""Generate PHP array of bot patterns"""
|
||
patterns = []
|
||
for bot_name, pattern in BOT_PATTERNS.items():
|
||
escaped_pattern = pattern.replace("'", "\\'")
|
||
patterns.append(f"'{bot_name}' => '/{escaped_pattern}/i'")
|
||
return ",\n ".join(patterns)
|
||
|
||
|
||
# =============================================================================
|
||
# CACHE VALIDATION
|
||
# =============================================================================
|
||
|
||
def generate_and_validate_cache(httpdocs_path, geo_region):
|
||
"""Generate the IP ranges cache and validate it. Returns (success, range_count, error_message)"""
|
||
cache_file = os.path.join(httpdocs_path, CACHE_FILE)
|
||
region_info = get_geo_region_info(geo_region)
|
||
countries = region_info["countries"]
|
||
min_expected = MIN_RANGES.get(geo_region, 1000)
|
||
|
||
php_script = f'''<?php
|
||
$countries = {json.dumps(countries)};
|
||
$ranges = [];
|
||
foreach ($countries as $country) {{
|
||
$url = "https://www.ipdeny.com/ipblocks/data/aggregated/$country-aggregated.zone";
|
||
$ctx = stream_context_create(['http' => ['timeout' => 30]]);
|
||
$content = @file_get_contents($url, false, $ctx);
|
||
if ($content !== false) {{
|
||
$lines = explode("\\n", trim($content));
|
||
foreach ($lines as $line) {{
|
||
$line = trim($line);
|
||
if (!empty($line) && strpos($line, '/') !== false) {{
|
||
$ranges[] = $line;
|
||
}}
|
||
}}
|
||
}}
|
||
}}
|
||
if (count($ranges) >= {min_expected}) {{
|
||
file_put_contents("{cache_file}", serialize($ranges));
|
||
echo "OK:" . count($ranges);
|
||
}} else {{
|
||
echo "FAIL:" . count($ranges);
|
||
}}
|
||
'''
|
||
|
||
temp_php = os.path.join(httpdocs_path, '_geoip_cache_gen.php')
|
||
try:
|
||
with open(temp_php, 'w') as f:
|
||
f.write(php_script)
|
||
result = subprocess.run(['php', temp_php], capture_output=True, text=True, timeout=120)
|
||
output = result.stdout.strip()
|
||
if output.startswith('OK:'):
|
||
return True, int(output.split(':')[1]), None
|
||
elif output.startswith('FAIL:'):
|
||
return False, int(output.split(':')[1]), f"Nur {output.split(':')[1]} Ranges (min. {min_expected} erwartet)"
|
||
return False, 0, f"Unerwartete Ausgabe: {output}"
|
||
except subprocess.TimeoutExpired:
|
||
return False, 0, "Timeout beim Laden der IP-Ranges"
|
||
except Exception as e:
|
||
return False, 0, str(e)
|
||
finally:
|
||
if os.path.exists(temp_php):
|
||
os.remove(temp_php)
|
||
|
||
|
||
def validate_existing_cache(httpdocs_path, geo_region):
|
||
"""Validate existing cache. Returns (valid, range_count, error_message)"""
|
||
cache_file = os.path.join(httpdocs_path, CACHE_FILE)
|
||
min_expected = MIN_RANGES.get(geo_region, 1000)
|
||
|
||
if not os.path.exists(cache_file):
|
||
return False, 0, "Cache-Datei existiert nicht"
|
||
|
||
php_script = f'''<?php
|
||
$data = @unserialize(@file_get_contents("{cache_file}"));
|
||
if ($data === false || !is_array($data)) {{ echo "CORRUPT:0"; }}
|
||
else {{ echo "OK:" . count($data); }}
|
||
'''
|
||
try:
|
||
result = subprocess.run(['php', '-r', php_script], capture_output=True, text=True, timeout=10)
|
||
output = result.stdout.strip()
|
||
if output.startswith('OK:'):
|
||
count = int(output.split(':')[1])
|
||
if count >= min_expected:
|
||
return True, count, None
|
||
return False, count, f"Nur {count} Ranges (min. {min_expected} erwartet)"
|
||
return False, 0, "Cache-Datei ist korrupt"
|
||
except Exception as e:
|
||
return False, 0, str(e)
|
||
|
||
|
||
# =============================================================================
|
||
# PHP TEMPLATES WITH FAIL-OPEN
|
||
# =============================================================================
|
||
|
||
GEOIP_SCRIPT_TEMPLATE = '''<?php
|
||
/**
|
||
* GeoIP Blocking Script - {region_name}
|
||
* Valid until: {expiry_date}
|
||
* FAIL-OPEN: If cache is corrupt/empty, traffic is allowed through
|
||
*/
|
||
|
||
$expiry_date = strtotime('{expiry_timestamp}');
|
||
if (time() > $expiry_date) return;
|
||
|
||
$visitor_ip = $_SERVER['REMOTE_ADDR'] ?? '';
|
||
if (empty($visitor_ip)) return;
|
||
if (filter_var($visitor_ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) return;
|
||
|
||
$cache_file = __DIR__ . '/{cache_file}';
|
||
$cache_duration = 86400;
|
||
$log_file = __DIR__ . '/{log_file}';
|
||
$crowdsec_queue = __DIR__ . '/{crowdsec_queue}';
|
||
$min_ranges = {min_ranges};
|
||
$allowed_countries = [{countries_array}];
|
||
|
||
function download_allowed_ranges($countries) {{
|
||
$ranges = [];
|
||
foreach ($countries as $country) {{
|
||
$url = "https://www.ipdeny.com/ipblocks/data/aggregated/$country-aggregated.zone";
|
||
$ctx = stream_context_create(['http' => ['timeout' => 30]]);
|
||
$content = @file_get_contents($url, false, $ctx);
|
||
if ($content !== false) {{
|
||
foreach (explode("\\n", trim($content)) as $line) {{
|
||
$line = trim($line);
|
||
if (!empty($line) && strpos($line, '/') !== false) $ranges[] = $line;
|
||
}}
|
||
}}
|
||
}}
|
||
return $ranges;
|
||
}}
|
||
|
||
function ip_in_range($ip, $cidr) {{
|
||
list($subnet, $mask) = explode('/', $cidr);
|
||
$mask_long = -1 << (32 - (int)$mask);
|
||
return (ip2long($ip) & $mask_long) == (ip2long($subnet) & $mask_long);
|
||
}}
|
||
|
||
$allowed_ranges = [];
|
||
$cache_valid = false;
|
||
|
||
if (file_exists($cache_file) && (time() - filemtime($cache_file)) < $cache_duration) {{
|
||
$cached_data = @file_get_contents($cache_file);
|
||
if ($cached_data !== false) {{
|
||
$allowed_ranges = @unserialize($cached_data);
|
||
if (is_array($allowed_ranges) && count($allowed_ranges) >= $min_ranges) {{
|
||
$cache_valid = true;
|
||
}} else {{
|
||
@unlink($cache_file);
|
||
$allowed_ranges = [];
|
||
}}
|
||
}}
|
||
}}
|
||
|
||
if (!$cache_valid) {{
|
||
$allowed_ranges = download_allowed_ranges($allowed_countries);
|
||
if (is_array($allowed_ranges) && count($allowed_ranges) >= $min_ranges) {{
|
||
@file_put_contents($cache_file, serialize($allowed_ranges));
|
||
$cache_valid = true;
|
||
}} else {{
|
||
error_log("GeoIP FAIL-OPEN: Could not load valid IP ranges (got " . count($allowed_ranges) . ", need $min_ranges)");
|
||
return;
|
||
}}
|
||
}}
|
||
|
||
$is_allowed = false;
|
||
foreach ($allowed_ranges as $range) {{
|
||
if (ip_in_range($visitor_ip, $range)) {{ $is_allowed = true; break; }}
|
||
}}
|
||
|
||
if (!$is_allowed) {{
|
||
$timestamp = date('Y-m-d H:i:s');
|
||
$ua = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown';
|
||
$uri = $_SERVER['REQUEST_URI'] ?? '/';
|
||
@file_put_contents($log_file, "[$timestamp] IP: $visitor_ip | UA: $ua | URI: $uri\\n", FILE_APPEND | LOCK_EX);
|
||
@file_put_contents($crowdsec_queue, "$timestamp|$visitor_ip|{shop_name}\\n", FILE_APPEND | LOCK_EX);
|
||
header('HTTP/1.1 403 Forbidden');
|
||
exit;
|
||
}}
|
||
'''
|
||
|
||
GEOIP_SCRIPT_TEMPLATE_PHP_ONLY = '''<?php
|
||
/**
|
||
* GeoIP Blocking Script (PHP-only) - {region_name}
|
||
* Valid until: {expiry_date}
|
||
* FAIL-OPEN: If cache is corrupt/empty, traffic is allowed through
|
||
*/
|
||
|
||
$expiry_date = strtotime('{expiry_timestamp}');
|
||
if (time() > $expiry_date) return;
|
||
|
||
$visitor_ip = $_SERVER['REMOTE_ADDR'] ?? '';
|
||
if (empty($visitor_ip)) return;
|
||
if (filter_var($visitor_ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) return;
|
||
|
||
$cache_file = __DIR__ . '/{cache_file}';
|
||
$cache_duration = 86400;
|
||
$log_file = __DIR__ . '/{log_file}';
|
||
$min_ranges = {min_ranges};
|
||
$allowed_countries = [{countries_array}];
|
||
|
||
function download_allowed_ranges($countries) {{
|
||
$ranges = [];
|
||
foreach ($countries as $country) {{
|
||
$url = "https://www.ipdeny.com/ipblocks/data/aggregated/$country-aggregated.zone";
|
||
$ctx = stream_context_create(['http' => ['timeout' => 30]]);
|
||
$content = @file_get_contents($url, false, $ctx);
|
||
if ($content !== false) {{
|
||
foreach (explode("\\n", trim($content)) as $line) {{
|
||
$line = trim($line);
|
||
if (!empty($line) && strpos($line, '/') !== false) $ranges[] = $line;
|
||
}}
|
||
}}
|
||
}}
|
||
return $ranges;
|
||
}}
|
||
|
||
function ip_in_range($ip, $cidr) {{
|
||
list($subnet, $mask) = explode('/', $cidr);
|
||
$mask_long = -1 << (32 - (int)$mask);
|
||
return (ip2long($ip) & $mask_long) == (ip2long($subnet) & $mask_long);
|
||
}}
|
||
|
||
$allowed_ranges = [];
|
||
$cache_valid = false;
|
||
|
||
if (file_exists($cache_file) && (time() - filemtime($cache_file)) < $cache_duration) {{
|
||
$cached_data = @file_get_contents($cache_file);
|
||
if ($cached_data !== false) {{
|
||
$allowed_ranges = @unserialize($cached_data);
|
||
if (is_array($allowed_ranges) && count($allowed_ranges) >= $min_ranges) {{
|
||
$cache_valid = true;
|
||
}} else {{
|
||
@unlink($cache_file);
|
||
$allowed_ranges = [];
|
||
}}
|
||
}}
|
||
}}
|
||
|
||
if (!$cache_valid) {{
|
||
$allowed_ranges = download_allowed_ranges($allowed_countries);
|
||
if (is_array($allowed_ranges) && count($allowed_ranges) >= $min_ranges) {{
|
||
@file_put_contents($cache_file, serialize($allowed_ranges));
|
||
$cache_valid = true;
|
||
}} else {{
|
||
error_log("GeoIP FAIL-OPEN: Could not load valid IP ranges (got " . count($allowed_ranges) . ", need $min_ranges)");
|
||
return;
|
||
}}
|
||
}}
|
||
|
||
$is_allowed = false;
|
||
foreach ($allowed_ranges as $range) {{
|
||
if (ip_in_range($visitor_ip, $range)) {{ $is_allowed = true; break; }}
|
||
}}
|
||
|
||
if (!$is_allowed) {{
|
||
$timestamp = date('Y-m-d H:i:s');
|
||
$ua = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown';
|
||
$uri = $_SERVER['REQUEST_URI'] ?? '/';
|
||
@file_put_contents($log_file, "[$timestamp] IP: $visitor_ip | UA: $ua | URI: $uri\\n", FILE_APPEND | LOCK_EX);
|
||
header('HTTP/1.1 403 Forbidden');
|
||
exit;
|
||
}}
|
||
'''
|
||
|
||
BOT_ONLY_SCRIPT_TEMPLATE = '''<?php
|
||
/**
|
||
* Bot Blocking Script - Worldwide Access
|
||
* Valid until: {expiry_date}
|
||
* Blocks known bots/crawlers, allows all human traffic globally
|
||
*/
|
||
|
||
$expiry_date = strtotime('{expiry_timestamp}');
|
||
if (time() > $expiry_date) return;
|
||
|
||
$log_file = __DIR__ . '/{log_file}';
|
||
$crowdsec_queue = __DIR__ . '/{crowdsec_queue}';
|
||
|
||
$bot_patterns = [
|
||
{bot_patterns}
|
||
];
|
||
|
||
$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
|
||
if (empty($user_agent)) return;
|
||
|
||
$detected_bot = null;
|
||
foreach ($bot_patterns as $bot_name => $pattern) {{
|
||
if (preg_match($pattern, $user_agent)) {{
|
||
$detected_bot = $bot_name;
|
||
break;
|
||
}}
|
||
}}
|
||
|
||
if ($detected_bot !== null) {{
|
||
$timestamp = date('Y-m-d H:i:s');
|
||
$visitor_ip = $_SERVER['REMOTE_ADDR'] ?? 'Unknown';
|
||
$uri = $_SERVER['REQUEST_URI'] ?? '/';
|
||
@file_put_contents($log_file, "[$timestamp] BOT: $detected_bot | IP: $visitor_ip | UA: $user_agent | URI: $uri\\n", FILE_APPEND | LOCK_EX);
|
||
@file_put_contents($crowdsec_queue, "$timestamp|$visitor_ip|{shop_name}\\n", FILE_APPEND | LOCK_EX);
|
||
header('HTTP/1.1 403 Forbidden');
|
||
exit;
|
||
}}
|
||
'''
|
||
|
||
BOT_ONLY_SCRIPT_TEMPLATE_NO_CROWDSEC = '''<?php
|
||
/**
|
||
* Bot Blocking Script - Worldwide Access (No CrowdSec)
|
||
* Valid until: {expiry_date}
|
||
* Blocks known bots/crawlers, allows all human traffic globally
|
||
*/
|
||
|
||
$expiry_date = strtotime('{expiry_timestamp}');
|
||
if (time() > $expiry_date) return;
|
||
|
||
$log_file = __DIR__ . '/{log_file}';
|
||
|
||
$bot_patterns = [
|
||
{bot_patterns}
|
||
];
|
||
|
||
$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
|
||
if (empty($user_agent)) return;
|
||
|
||
$detected_bot = null;
|
||
foreach ($bot_patterns as $bot_name => $pattern) {{
|
||
if (preg_match($pattern, $user_agent)) {{
|
||
$detected_bot = $bot_name;
|
||
break;
|
||
}}
|
||
}}
|
||
|
||
if ($detected_bot !== null) {{
|
||
$timestamp = date('Y-m-d H:i:s');
|
||
$visitor_ip = $_SERVER['REMOTE_ADDR'] ?? 'Unknown';
|
||
$uri = $_SERVER['REQUEST_URI'] ?? '/';
|
||
@file_put_contents($log_file, "[$timestamp] BOT: $detected_bot | IP: $visitor_ip | UA: $user_agent | URI: $uri\\n", FILE_APPEND | LOCK_EX);
|
||
header('HTTP/1.1 403 Forbidden');
|
||
exit;
|
||
}}
|
||
'''
|
||
|
||
# =============================================================================
|
||
# WATCHER SERVICE
|
||
# =============================================================================
|
||
|
||
WATCHER_SCRIPT_CONTENT = '''#!/usr/bin/env python3
|
||
import os, sys, time, subprocess, json
|
||
from datetime import datetime
|
||
|
||
VHOSTS_DIR = "/var/www/vhosts"
|
||
QUEUE_FILE = "geoip_crowdsec_queue.log"
|
||
ACTIVE_SHOPS_FILE = "/var/lib/crowdsec/geoip_active_shops.json"
|
||
PROCESSED_IPS = {}
|
||
CHECK_INTERVAL = 5
|
||
|
||
def log(msg): print(f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}] {msg}", flush=True)
|
||
|
||
def get_active_shops():
|
||
if not os.path.isfile(ACTIVE_SHOPS_FILE): return {}
|
||
try:
|
||
with open(ACTIVE_SHOPS_FILE, 'r') as f: return json.load(f)
|
||
except: return {}
|
||
|
||
def add_to_crowdsec(ip, shop):
|
||
now = time.time()
|
||
if ip in PROCESSED_IPS and (now - PROCESSED_IPS[ip]) < 3600: return True
|
||
try:
|
||
result = subprocess.run(['cscli', 'decisions', 'add', '--ip', ip, '--duration', '72h', '--type', 'ban', '--reason', f'GeoIP: blocked by {shop}'], capture_output=True, text=True, timeout=10)
|
||
if result.returncode == 0:
|
||
PROCESSED_IPS[ip] = now
|
||
log(f"✅ Added {ip} to CrowdSec (from {shop})")
|
||
return True
|
||
except: pass
|
||
return False
|
||
|
||
def process_queue_file(shop_path, shop):
|
||
queue_file = os.path.join(shop_path, 'httpdocs', QUEUE_FILE)
|
||
if not os.path.isfile(queue_file): return 0
|
||
processed = 0
|
||
try:
|
||
with open(queue_file, 'r') as f: lines = f.readlines()
|
||
if not lines: return 0
|
||
for line in lines:
|
||
parts = line.strip().split('|')
|
||
if len(parts) >= 2 and add_to_crowdsec(parts[1], shop): processed += 1
|
||
if processed > 0:
|
||
with open(queue_file, 'w') as f: f.write('')
|
||
except: pass
|
||
return processed
|
||
|
||
def main():
|
||
log("🚀 GeoIP CrowdSec Watcher started")
|
||
while True:
|
||
try:
|
||
active_shops = get_active_shops()
|
||
for shop, info in active_shops.items():
|
||
# Only process shops with CrowdSec enabled
|
||
mode = info.get('mode', 'php+crowdsec')
|
||
if mode in ['php+crowdsec', 'bot+crowdsec']:
|
||
shop_path = os.path.join(VHOSTS_DIR, shop)
|
||
if os.path.isdir(shop_path): process_queue_file(shop_path, shop)
|
||
time.sleep(CHECK_INTERVAL)
|
||
except KeyboardInterrupt: break
|
||
except: time.sleep(CHECK_INTERVAL)
|
||
|
||
if __name__ == "__main__": main()
|
||
'''
|
||
|
||
SYSTEMD_SERVICE_CONTENT = '''[Unit]
|
||
Description=GeoIP CrowdSec Watcher Service
|
||
After=network.target crowdsec.service
|
||
|
||
[Service]
|
||
Type=simple
|
||
ExecStart=/usr/bin/python3 /usr/local/bin/geoip_crowdsec_watcher.py
|
||
Restart=always
|
||
RestartSec=10
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
'''
|
||
|
||
|
||
# =============================================================================
|
||
# HELPER FUNCTIONS
|
||
# =============================================================================
|
||
|
||
def run_command(cmd, capture_output=True):
|
||
try:
|
||
if capture_output:
|
||
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
|
||
return result.returncode, result.stdout, result.stderr
|
||
return subprocess.run(cmd, shell=True, timeout=30).returncode, "", ""
|
||
except Exception as e:
|
||
return -1, "", str(e)
|
||
|
||
|
||
def check_crowdsec():
|
||
code, stdout, _ = run_command("systemctl is-active crowdsec")
|
||
return code == 0 and stdout.strip() == "active"
|
||
|
||
|
||
def install_watcher_service():
|
||
print(" 📦 Installiere CrowdSec-Watcher-Service...")
|
||
with open(WATCHER_SCRIPT, 'w') as f:
|
||
f.write(WATCHER_SCRIPT_CONTENT)
|
||
os.chmod(WATCHER_SCRIPT, 0o755)
|
||
with open(SYSTEMD_SERVICE, 'w') as f:
|
||
f.write(SYSTEMD_SERVICE_CONTENT)
|
||
run_command("systemctl daemon-reload")
|
||
run_command("systemctl enable geoip-crowdsec-watcher.service")
|
||
run_command("systemctl start geoip-crowdsec-watcher.service")
|
||
time.sleep(1)
|
||
code, stdout, _ = run_command("systemctl is-active geoip-crowdsec-watcher.service")
|
||
if code == 0 and stdout.strip() == "active":
|
||
print(" ✅ Service gestartet")
|
||
return True
|
||
print(" ⚠️ Service konnte nicht gestartet werden")
|
||
return False
|
||
|
||
|
||
def uninstall_watcher_service():
|
||
print(" 📦 Deinstalliere CrowdSec-Watcher-Service...")
|
||
run_command("systemctl stop geoip-crowdsec-watcher.service")
|
||
run_command("systemctl disable geoip-crowdsec-watcher.service")
|
||
for f in [SYSTEMD_SERVICE, WATCHER_SCRIPT]:
|
||
if os.path.isfile(f):
|
||
os.remove(f)
|
||
run_command("systemctl daemon-reload")
|
||
print(" ✅ Service deinstalliert")
|
||
|
||
|
||
def add_shop_to_active(shop, mode="php+crowdsec", geo_region="dach"):
|
||
os.makedirs(os.path.dirname(ACTIVE_SHOPS_FILE), exist_ok=True)
|
||
shops = {}
|
||
if os.path.isfile(ACTIVE_SHOPS_FILE):
|
||
with open(ACTIVE_SHOPS_FILE, 'r') as f:
|
||
shops = json.load(f)
|
||
shops[shop] = {
|
||
"activated": datetime.now().isoformat(),
|
||
"expiry": (datetime.now() + timedelta(hours=72)).isoformat(),
|
||
"mode": mode,
|
||
"geo_region": geo_region
|
||
}
|
||
with open(ACTIVE_SHOPS_FILE, 'w') as f:
|
||
json.dump(shops, f, indent=2)
|
||
|
||
|
||
def get_shop_mode(shop):
|
||
if not os.path.isfile(ACTIVE_SHOPS_FILE):
|
||
return "php+crowdsec"
|
||
try:
|
||
with open(ACTIVE_SHOPS_FILE, 'r') as f:
|
||
return json.load(f).get(shop, {}).get("mode", "php+crowdsec")
|
||
except:
|
||
return "php+crowdsec"
|
||
|
||
|
||
def get_shop_geo_region(shop):
|
||
if not os.path.isfile(ACTIVE_SHOPS_FILE):
|
||
return "dach"
|
||
try:
|
||
with open(ACTIVE_SHOPS_FILE, 'r') as f:
|
||
return json.load(f).get(shop, {}).get("geo_region", "dach")
|
||
except:
|
||
return "dach"
|
||
|
||
|
||
def get_shop_activation_time(shop):
|
||
if not os.path.isfile(ACTIVE_SHOPS_FILE):
|
||
return None
|
||
try:
|
||
with open(ACTIVE_SHOPS_FILE, 'r') as f:
|
||
activated_str = json.load(f).get(shop, {}).get("activated")
|
||
return datetime.fromisoformat(activated_str) if activated_str else None
|
||
except:
|
||
return None
|
||
|
||
|
||
def format_duration(minutes):
|
||
if minutes < 60:
|
||
return f"{int(minutes)}m"
|
||
hours = minutes / 60
|
||
if hours < 24:
|
||
return f"{int(hours)}h {int(minutes % 60)}m"
|
||
return f"{int(hours / 24)}d {int(hours % 24)}h"
|
||
|
||
|
||
def remove_shop_from_active(shop):
|
||
if not os.path.isfile(ACTIVE_SHOPS_FILE):
|
||
return
|
||
with open(ACTIVE_SHOPS_FILE, 'r') as f:
|
||
shops = json.load(f)
|
||
if shop in shops:
|
||
del shops[shop]
|
||
with open(ACTIVE_SHOPS_FILE, 'w') as f:
|
||
json.dump(shops, f, indent=2)
|
||
|
||
|
||
def cleanup_crowdsec_decisions(shop):
|
||
if not check_crowdsec():
|
||
return
|
||
print(f" 🔍 Entferne CrowdSec-Decisions für {shop}...")
|
||
total_removed = 0
|
||
for _ in range(50):
|
||
code, stdout, _ = run_command(f"cscli decisions list -o raw --limit 0 | grep '{shop}'")
|
||
if code != 0 or not stdout.strip():
|
||
break
|
||
batch_count = 0
|
||
for line in stdout.strip().split('\n')[:100]:
|
||
try:
|
||
parts = line.split(',')
|
||
if len(parts) >= 3:
|
||
ip_field = parts[2].strip()
|
||
ip = ip_field.split(':', 1)[1] if ':' in ip_field else ip_field
|
||
if ip and run_command(f"cscli decisions delete --ip {ip}")[0] == 0:
|
||
batch_count += 1
|
||
except:
|
||
continue
|
||
total_removed += batch_count
|
||
if batch_count == 0:
|
||
break
|
||
print(f" ✅ {total_removed} Decisions entfernt" if total_removed else " ℹ️ Keine Decisions gefunden")
|
||
|
||
|
||
def get_available_shops():
|
||
shops = []
|
||
if not os.path.exists(VHOSTS_DIR):
|
||
return shops
|
||
for entry in os.listdir(VHOSTS_DIR):
|
||
shop_path = os.path.join(VHOSTS_DIR, entry)
|
||
if os.path.isdir(shop_path) and entry not in ['chroot', 'system', 'default']:
|
||
httpdocs = os.path.join(shop_path, 'httpdocs')
|
||
if os.path.isdir(httpdocs) and os.path.isfile(os.path.join(httpdocs, 'index.php')):
|
||
shops.append(entry)
|
||
return sorted(shops)
|
||
|
||
|
||
def get_active_shops():
|
||
active = []
|
||
for shop in get_available_shops():
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
if os.path.isfile(os.path.join(httpdocs, BLOCKING_FILE)) or os.path.isfile(os.path.join(httpdocs, f'index.php{BACKUP_SUFFIX}')):
|
||
active.append(shop)
|
||
return active
|
||
|
||
|
||
def get_crowdsec_modes():
|
||
"""Return list of modes that use CrowdSec"""
|
||
return ['php+crowdsec', 'bot+crowdsec']
|
||
|
||
|
||
def select_geo_region():
|
||
print(f"\n🌍 Wähle die Geo-Region:")
|
||
print(f" [1] {GEO_REGIONS['dach']['icon']} DACH - {GEO_REGIONS['dach']['description']}")
|
||
print(f" [2] {GEO_REGIONS['eurozone']['icon']} Eurozone+GB - {len(GEO_REGIONS['eurozone']['countries'])} Länder")
|
||
return "eurozone" if input(f"\nRegion wählen [1/2]: ").strip() == "2" else "dach"
|
||
|
||
|
||
def select_mode():
|
||
print(f"\n🔧 Wähle den Blocking-Modus:")
|
||
print(f" [1] 🌍 GeoIP + CrowdSec (IPs werden an CrowdSec gemeldet)")
|
||
print(f" [2] 🌍 Nur GeoIP (keine CrowdSec-Synchronisation)")
|
||
print(f" [3] 🤖 Nur Bot-Blocking (weltweit erreichbar, mit CrowdSec)")
|
||
print(f" [4] 🤖 Nur Bot-Blocking (weltweit erreichbar, ohne CrowdSec)")
|
||
|
||
choice = input(f"\nModus wählen [1/2/3/4]: ").strip()
|
||
if choice == "2":
|
||
return "php-only"
|
||
elif choice == "3":
|
||
return "bot+crowdsec"
|
||
elif choice == "4":
|
||
return "bot-only"
|
||
return "php+crowdsec"
|
||
|
||
|
||
def get_mode_icon(mode):
|
||
"""Return icon for mode"""
|
||
icons = {
|
||
'php+crowdsec': '🛡️',
|
||
'php-only': '📝',
|
||
'bot+crowdsec': '🤖🛡️',
|
||
'bot-only': '🤖'
|
||
}
|
||
return icons.get(mode, '❓')
|
||
|
||
|
||
def get_mode_description(mode):
|
||
"""Return description for mode"""
|
||
descriptions = {
|
||
'php+crowdsec': 'GeoIP + CrowdSec',
|
||
'php-only': 'Nur GeoIP',
|
||
'bot+crowdsec': 'Bot-Block + CrowdSec',
|
||
'bot-only': 'Nur Bot-Block'
|
||
}
|
||
return descriptions.get(mode, mode)
|
||
|
||
|
||
def is_bot_only_mode(mode):
|
||
"""Check if mode is bot-only"""
|
||
return mode in ['bot-only', 'bot+crowdsec']
|
||
|
||
|
||
def uses_crowdsec(mode):
|
||
"""Check if mode uses CrowdSec"""
|
||
return mode in ['php+crowdsec', 'bot+crowdsec']
|
||
|
||
|
||
def get_direct_shops(available_shops):
|
||
"""Return list of shops that are NOT behind Link11 (direct exposure)"""
|
||
direct_shops = []
|
||
for shop in available_shops:
|
||
link11_info = check_link11(shop)
|
||
if not link11_info['is_link11']:
|
||
direct_shops.append(shop)
|
||
return direct_shops
|
||
|
||
|
||
def get_link11_shops(available_shops):
|
||
"""Return list of shops that ARE behind Link11"""
|
||
link11_shops = []
|
||
for shop in available_shops:
|
||
link11_info = check_link11(shop)
|
||
if link11_info['is_link11']:
|
||
link11_shops.append(shop)
|
||
return link11_shops
|
||
|
||
|
||
# =============================================================================
|
||
# MAIN FUNCTIONS
|
||
# =============================================================================
|
||
|
||
def activate_blocking(shop, silent=False, mode="php+crowdsec", geo_region="dach"):
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
index_php = os.path.join(httpdocs, 'index.php')
|
||
backup_php = os.path.join(httpdocs, f'index.php{BACKUP_SUFFIX}')
|
||
blocking_file = os.path.join(httpdocs, BLOCKING_FILE)
|
||
|
||
is_bot_mode = is_bot_only_mode(mode)
|
||
|
||
if is_bot_mode:
|
||
region_info = get_geo_region_info("none")
|
||
geo_region = "none"
|
||
else:
|
||
region_info = get_geo_region_info(geo_region)
|
||
|
||
min_ranges = MIN_RANGES.get(geo_region, 1000)
|
||
|
||
if os.path.isfile(backup_php):
|
||
if not silent:
|
||
print(f"⚠️ Blocking bereits aktiv für {shop}")
|
||
return False
|
||
|
||
if not os.path.isfile(index_php):
|
||
if not silent:
|
||
print(f"❌ index.php nicht gefunden")
|
||
return False
|
||
|
||
if not silent:
|
||
print(f"\n🔧 Aktiviere {region_info['icon']} {region_info['name']} für: {shop}")
|
||
if is_bot_mode:
|
||
print(f" Modus: Nur Bot-Blocking (weltweit erreichbar)")
|
||
else:
|
||
print(f" Erlaubt: {region_info['description']}")
|
||
print(f" CrowdSec: {'Ja' if uses_crowdsec(mode) else 'Nein'}")
|
||
print("=" * 60)
|
||
|
||
# Step 1: Watcher service
|
||
if uses_crowdsec(mode):
|
||
crowdsec_shops = [s for s in get_active_shops() if uses_crowdsec(get_shop_mode(s))]
|
||
if not crowdsec_shops and check_crowdsec():
|
||
if not silent:
|
||
print("\n[1/4] Installiere CrowdSec-Watcher-Service...")
|
||
install_watcher_service()
|
||
elif not silent:
|
||
print("\n[1/4] CrowdSec-Watcher-Service bereits aktiv")
|
||
elif not silent:
|
||
print("\n[1/4] CrowdSec-Synchronisation deaktiviert")
|
||
|
||
# Step 2: PHP blocking
|
||
if not silent:
|
||
print("\n[2/4] Aktiviere PHP-Blocking...")
|
||
|
||
shutil.copy2(index_php, backup_php)
|
||
|
||
with open(index_php, 'r', encoding='utf-8') as f:
|
||
content = f.read()
|
||
|
||
lines = content.split('\n')
|
||
insert_line = 0
|
||
for i, line in enumerate(lines):
|
||
if 'declare(strict_types' in line:
|
||
insert_line = i + 1
|
||
break
|
||
elif '<?php' in line and insert_line == 0:
|
||
insert_line = i + 1
|
||
|
||
require_statement = f"require_once __DIR__ . '/{BLOCKING_FILE}';"
|
||
if require_statement not in content:
|
||
lines.insert(insert_line, require_statement)
|
||
with open(index_php, 'w', encoding='utf-8') as f:
|
||
f.write('\n'.join(lines))
|
||
|
||
expiry = datetime.now() + timedelta(hours=72)
|
||
|
||
# Select appropriate template
|
||
if is_bot_mode:
|
||
if uses_crowdsec(mode):
|
||
template = BOT_ONLY_SCRIPT_TEMPLATE
|
||
else:
|
||
template = BOT_ONLY_SCRIPT_TEMPLATE_NO_CROWDSEC
|
||
|
||
geoip_content = template.format(
|
||
expiry_date=expiry.strftime('%Y-%m-%d %H:%M:%S CET'),
|
||
expiry_timestamp=expiry.strftime('%Y-%m-%d %H:%M:%S'),
|
||
log_file=LOG_FILE,
|
||
crowdsec_queue=CROWDSEC_QUEUE_FILE,
|
||
shop_name=shop,
|
||
bot_patterns=generate_php_bot_patterns()
|
||
)
|
||
else:
|
||
countries_array = generate_php_countries_array(geo_region)
|
||
template = GEOIP_SCRIPT_TEMPLATE if uses_crowdsec(mode) else GEOIP_SCRIPT_TEMPLATE_PHP_ONLY
|
||
geoip_content = template.format(
|
||
region_name=region_info['name'],
|
||
region_description=region_info['description'],
|
||
expiry_date=expiry.strftime('%Y-%m-%d %H:%M:%S CET'),
|
||
expiry_timestamp=expiry.strftime('%Y-%m-%d %H:%M:%S'),
|
||
cache_file=CACHE_FILE,
|
||
log_file=LOG_FILE,
|
||
crowdsec_queue=CROWDSEC_QUEUE_FILE,
|
||
shop_name=shop,
|
||
countries_array=countries_array,
|
||
min_ranges=min_ranges
|
||
)
|
||
|
||
with open(blocking_file, 'w', encoding='utf-8') as f:
|
||
f.write(geoip_content)
|
||
if not silent:
|
||
print(" ✅ PHP-Blocking aktiviert")
|
||
|
||
# Step 3: Generate cache (only for GeoIP modes)
|
||
if is_bot_mode:
|
||
if not silent:
|
||
print(f"\n[3/4] Cache-Generierung nicht erforderlich (Bot-Only)")
|
||
range_count = 0
|
||
else:
|
||
if not silent:
|
||
print(f"\n[3/4] Generiere IP-Range-Cache ({len(region_info['countries'])} Länder)...")
|
||
|
||
success, range_count, error = generate_and_validate_cache(httpdocs, geo_region)
|
||
|
||
if success:
|
||
if not silent:
|
||
print(f" ✅ Cache generiert: {range_count:,} IP-Ranges")
|
||
else:
|
||
if not silent:
|
||
print(f" ⚠️ Cache-Generierung: {error}")
|
||
print(f" ℹ️ Fail-Open aktiv - Cache wird beim ersten Request neu generiert")
|
||
|
||
# Step 4: Register
|
||
if not silent:
|
||
print("\n[4/4] Registriere Shop...")
|
||
add_shop_to_active(shop, mode, geo_region)
|
||
|
||
if not silent:
|
||
print("\n" + "=" * 60)
|
||
print(f"✅ {region_info['icon']} {region_info['name']} aktiviert")
|
||
print(f" Shop: {shop}")
|
||
print(f" Modus: {get_mode_description(mode)} {get_mode_icon(mode)}")
|
||
if not is_bot_mode:
|
||
print(f" IP-Ranges: {range_count:,}")
|
||
print(f" 🛡️ Fail-Open: Bei Cache-Fehlern wird Traffic durchgelassen")
|
||
else:
|
||
print(f" 🤖 {len(BOT_PATTERNS)} Bot-Patterns aktiv")
|
||
print(f" Gültig bis: {expiry.strftime('%Y-%m-%d %H:%M:%S CET')}")
|
||
print("=" * 60)
|
||
|
||
return True
|
||
|
||
|
||
def deactivate_blocking(shop, silent=False):
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
index_php = os.path.join(httpdocs, 'index.php')
|
||
backup_php = os.path.join(httpdocs, f'index.php{BACKUP_SUFFIX}')
|
||
|
||
shop_mode = get_shop_mode(shop)
|
||
shop_geo = get_shop_geo_region(shop)
|
||
region_info = get_geo_region_info(shop_geo)
|
||
|
||
if not silent:
|
||
print(f"\n🔧 Deaktiviere {region_info['icon']} {region_info['name']} für: {shop}")
|
||
print("=" * 60)
|
||
|
||
# Restore backup
|
||
if not silent:
|
||
print("\n[1/4] PHP-Blocking entfernen...")
|
||
|
||
if os.path.isfile(backup_php):
|
||
shutil.move(backup_php, index_php)
|
||
else:
|
||
if os.path.isfile(index_php):
|
||
with open(index_php, 'r') as f:
|
||
content = f.read()
|
||
lines = [l for l in content.split('\n') if BLOCKING_FILE not in l]
|
||
with open(index_php, 'w') as f:
|
||
f.write('\n'.join(lines))
|
||
|
||
for f in [os.path.join(httpdocs, x) for x in [BLOCKING_FILE, CACHE_FILE, LOG_FILE, CROWDSEC_QUEUE_FILE]]:
|
||
if os.path.isfile(f):
|
||
os.remove(f)
|
||
|
||
if not silent:
|
||
print("\n[2/4] Deregistriere Shop...")
|
||
remove_shop_from_active(shop)
|
||
|
||
if not silent:
|
||
print("\n[3/4] CrowdSec-Decisions entfernen...")
|
||
if uses_crowdsec(shop_mode) and check_crowdsec():
|
||
cleanup_crowdsec_decisions(shop)
|
||
elif not silent:
|
||
print(" ℹ️ Keine CrowdSec-Synchronisation aktiv")
|
||
|
||
if not silent:
|
||
print("\n[4/4] Prüfe Watcher-Service...")
|
||
crowdsec_shops = [s for s in get_active_shops() if uses_crowdsec(get_shop_mode(s))]
|
||
if not crowdsec_shops:
|
||
uninstall_watcher_service()
|
||
elif not silent:
|
||
print(f" ℹ️ Service bleibt aktiv ({len(crowdsec_shops)} Shop(s))")
|
||
|
||
if not silent:
|
||
print("\n" + "=" * 60)
|
||
print(f"✅ Blocking deaktiviert für: {shop}")
|
||
print("=" * 60)
|
||
|
||
return True
|
||
|
||
|
||
def activate_all_shops():
|
||
available_shops = [s for s in get_available_shops() if s not in get_active_shops()]
|
||
|
||
if not available_shops:
|
||
print("\n⚠️ Keine Shops zum Aktivieren verfügbar")
|
||
return
|
||
|
||
print(f"\n{'=' * 60}")
|
||
print(f" Blocking für ALLE Shops aktivieren")
|
||
print(f"{'=' * 60}")
|
||
print(f"\n📋 {len(available_shops)} Shop(s):")
|
||
for shop in available_shops:
|
||
print(format_shop_with_link11(shop, prefix=" • "))
|
||
|
||
mode = select_mode()
|
||
is_bot_mode = is_bot_only_mode(mode)
|
||
|
||
if is_bot_mode:
|
||
geo_region = "none"
|
||
region_info = get_geo_region_info("none")
|
||
else:
|
||
geo_region = select_geo_region()
|
||
region_info = get_geo_region_info(geo_region)
|
||
|
||
print(f"\n⚠️ Modus: {get_mode_description(mode)} {get_mode_icon(mode)}")
|
||
if not is_bot_mode:
|
||
print(f" Region: {region_info['icon']} {region_info['name']}")
|
||
|
||
if input(f"\nFortfahren? (ja/nein): ").strip().lower() not in ['ja', 'j', 'yes', 'y']:
|
||
print("\n❌ Abgebrochen")
|
||
return
|
||
|
||
print(f"\n{'=' * 60}")
|
||
|
||
if uses_crowdsec(mode) and check_crowdsec():
|
||
if not [s for s in get_active_shops() if uses_crowdsec(get_shop_mode(s))]:
|
||
print("\n📦 Installiere CrowdSec-Watcher-Service...")
|
||
install_watcher_service()
|
||
|
||
success_count = 0
|
||
for i, shop in enumerate(available_shops, 1):
|
||
print(f"\n[{i}/{len(available_shops)}] {shop}")
|
||
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
index_php = os.path.join(httpdocs, 'index.php')
|
||
backup_php = os.path.join(httpdocs, f'index.php{BACKUP_SUFFIX}')
|
||
blocking_file = os.path.join(httpdocs, BLOCKING_FILE)
|
||
|
||
if os.path.isfile(backup_php) or not os.path.isfile(index_php):
|
||
print(f" ⚠️ Übersprungen")
|
||
continue
|
||
|
||
shutil.copy2(index_php, backup_php)
|
||
|
||
with open(index_php, 'r', encoding='utf-8') as f:
|
||
content = f.read()
|
||
lines = content.split('\n')
|
||
insert_line = 0
|
||
for idx, line in enumerate(lines):
|
||
if 'declare(strict_types' in line:
|
||
insert_line = idx + 1
|
||
break
|
||
elif '<?php' in line and insert_line == 0:
|
||
insert_line = idx + 1
|
||
|
||
require_statement = f"require_once __DIR__ . '/{BLOCKING_FILE}';"
|
||
if require_statement not in content:
|
||
lines.insert(insert_line, require_statement)
|
||
with open(index_php, 'w', encoding='utf-8') as f:
|
||
f.write('\n'.join(lines))
|
||
|
||
expiry = datetime.now() + timedelta(hours=72)
|
||
|
||
if is_bot_mode:
|
||
if uses_crowdsec(mode):
|
||
template = BOT_ONLY_SCRIPT_TEMPLATE
|
||
else:
|
||
template = BOT_ONLY_SCRIPT_TEMPLATE_NO_CROWDSEC
|
||
|
||
geoip_content = template.format(
|
||
expiry_date=expiry.strftime('%Y-%m-%d %H:%M:%S CET'),
|
||
expiry_timestamp=expiry.strftime('%Y-%m-%d %H:%M:%S'),
|
||
log_file=LOG_FILE,
|
||
crowdsec_queue=CROWDSEC_QUEUE_FILE,
|
||
shop_name=shop,
|
||
bot_patterns=generate_php_bot_patterns()
|
||
)
|
||
else:
|
||
template = GEOIP_SCRIPT_TEMPLATE if uses_crowdsec(mode) else GEOIP_SCRIPT_TEMPLATE_PHP_ONLY
|
||
geoip_content = template.format(
|
||
region_name=region_info['name'],
|
||
region_description=region_info['description'],
|
||
expiry_date=expiry.strftime('%Y-%m-%d %H:%M:%S CET'),
|
||
expiry_timestamp=expiry.strftime('%Y-%m-%d %H:%M:%S'),
|
||
cache_file=CACHE_FILE,
|
||
log_file=LOG_FILE,
|
||
crowdsec_queue=CROWDSEC_QUEUE_FILE,
|
||
shop_name=shop,
|
||
countries_array=generate_php_countries_array(geo_region),
|
||
min_ranges=MIN_RANGES.get(geo_region, 1000)
|
||
)
|
||
|
||
with open(blocking_file, 'w', encoding='utf-8') as f:
|
||
f.write(geoip_content)
|
||
|
||
if is_bot_mode:
|
||
add_shop_to_active(shop, mode, geo_region)
|
||
print(f" ✅ Aktiviert ({len(BOT_PATTERNS)} Bot-Patterns)")
|
||
else:
|
||
print(f" ⏳ Cache generieren...")
|
||
cache_ok, count, _ = generate_and_validate_cache(httpdocs, geo_region)
|
||
add_shop_to_active(shop, mode, geo_region)
|
||
print(f" ✅ Aktiviert ({count:,} Ranges)" if cache_ok else f" ⚠️ Aktiviert (Cache-Warnung)")
|
||
|
||
success_count += 1
|
||
|
||
print(f"\n{'=' * 60}")
|
||
print(f" ✅ {success_count} Shop(s) aktiviert")
|
||
if not is_bot_mode:
|
||
print(f" 🛡️ Fail-Open bei Cache-Fehlern aktiv")
|
||
print(f"{'=' * 60}")
|
||
|
||
|
||
def activate_direct_shops_only():
|
||
"""Activate blocking only for shops that are NOT behind Link11 (direct exposure)"""
|
||
available_shops = [s for s in get_available_shops() if s not in get_active_shops()]
|
||
|
||
if not available_shops:
|
||
print("\n⚠️ Keine Shops zum Aktivieren verfügbar")
|
||
return
|
||
|
||
# Filter: only shops NOT behind Link11
|
||
direct_shops = get_direct_shops(available_shops)
|
||
link11_shops = get_link11_shops(available_shops)
|
||
|
||
if not direct_shops:
|
||
print("\n⚠️ Keine direkten Shops gefunden (alle sind hinter Link11)")
|
||
if link11_shops:
|
||
print(f"\n📋 {len(link11_shops)} Shop(s) hinter Link11 (werden übersprungen):")
|
||
for shop in link11_shops:
|
||
print(f" {COLOR_GREEN}• {shop} [Link11]{COLOR_RESET}")
|
||
return
|
||
|
||
print(f"\n{'=' * 60}")
|
||
print(f" Blocking für DIREKTE Shops aktivieren (ohne Link11)")
|
||
print(f"{'=' * 60}")
|
||
print(f" {COLOR_GREEN}Grün = hinter Link11 (übersprungen){COLOR_RESET}")
|
||
print(f" {COLOR_RED}Rot = Direkt (wird aktiviert){COLOR_RESET}")
|
||
|
||
print(f"\n📋 {len(direct_shops)} direkte Shop(s) werden aktiviert:")
|
||
for shop in direct_shops:
|
||
print(f" {COLOR_RED}• {shop} [Direkt]{COLOR_RESET}")
|
||
|
||
if link11_shops:
|
||
print(f"\n⏭️ {len(link11_shops)} Shop(s) hinter Link11 werden übersprungen:")
|
||
for shop in link11_shops:
|
||
print(f" {COLOR_GREEN}• {shop} [Link11]{COLOR_RESET}")
|
||
|
||
mode = select_mode()
|
||
is_bot_mode = is_bot_only_mode(mode)
|
||
|
||
if is_bot_mode:
|
||
geo_region = "none"
|
||
region_info = get_geo_region_info("none")
|
||
else:
|
||
geo_region = select_geo_region()
|
||
region_info = get_geo_region_info(geo_region)
|
||
|
||
print(f"\n⚠️ Modus: {get_mode_description(mode)} {get_mode_icon(mode)}")
|
||
if not is_bot_mode:
|
||
print(f" Region: {region_info['icon']} {region_info['name']}")
|
||
print(f" Aktiviert: {len(direct_shops)} direkte Shop(s)")
|
||
print(f" Übersprungen: {len(link11_shops)} Link11-Shop(s)")
|
||
|
||
if input(f"\nFortfahren? (ja/nein): ").strip().lower() not in ['ja', 'j', 'yes', 'y']:
|
||
print("\n❌ Abgebrochen")
|
||
return
|
||
|
||
print(f"\n{'=' * 60}")
|
||
|
||
if uses_crowdsec(mode) and check_crowdsec():
|
||
if not [s for s in get_active_shops() if uses_crowdsec(get_shop_mode(s))]:
|
||
print("\n📦 Installiere CrowdSec-Watcher-Service...")
|
||
install_watcher_service()
|
||
|
||
success_count = 0
|
||
for i, shop in enumerate(direct_shops, 1):
|
||
print(f"\n[{i}/{len(direct_shops)}] {shop}")
|
||
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
index_php = os.path.join(httpdocs, 'index.php')
|
||
backup_php = os.path.join(httpdocs, f'index.php{BACKUP_SUFFIX}')
|
||
blocking_file = os.path.join(httpdocs, BLOCKING_FILE)
|
||
|
||
if os.path.isfile(backup_php) or not os.path.isfile(index_php):
|
||
print(f" ⚠️ Übersprungen")
|
||
continue
|
||
|
||
shutil.copy2(index_php, backup_php)
|
||
|
||
with open(index_php, 'r', encoding='utf-8') as f:
|
||
content = f.read()
|
||
lines = content.split('\n')
|
||
insert_line = 0
|
||
for idx, line in enumerate(lines):
|
||
if 'declare(strict_types' in line:
|
||
insert_line = idx + 1
|
||
break
|
||
elif '<?php' in line and insert_line == 0:
|
||
insert_line = idx + 1
|
||
|
||
require_statement = f"require_once __DIR__ . '/{BLOCKING_FILE}';"
|
||
if require_statement not in content:
|
||
lines.insert(insert_line, require_statement)
|
||
with open(index_php, 'w', encoding='utf-8') as f:
|
||
f.write('\n'.join(lines))
|
||
|
||
expiry = datetime.now() + timedelta(hours=72)
|
||
|
||
if is_bot_mode:
|
||
if uses_crowdsec(mode):
|
||
template = BOT_ONLY_SCRIPT_TEMPLATE
|
||
else:
|
||
template = BOT_ONLY_SCRIPT_TEMPLATE_NO_CROWDSEC
|
||
|
||
geoip_content = template.format(
|
||
expiry_date=expiry.strftime('%Y-%m-%d %H:%M:%S CET'),
|
||
expiry_timestamp=expiry.strftime('%Y-%m-%d %H:%M:%S'),
|
||
log_file=LOG_FILE,
|
||
crowdsec_queue=CROWDSEC_QUEUE_FILE,
|
||
shop_name=shop,
|
||
bot_patterns=generate_php_bot_patterns()
|
||
)
|
||
else:
|
||
template = GEOIP_SCRIPT_TEMPLATE if uses_crowdsec(mode) else GEOIP_SCRIPT_TEMPLATE_PHP_ONLY
|
||
geoip_content = template.format(
|
||
region_name=region_info['name'],
|
||
region_description=region_info['description'],
|
||
expiry_date=expiry.strftime('%Y-%m-%d %H:%M:%S CET'),
|
||
expiry_timestamp=expiry.strftime('%Y-%m-%d %H:%M:%S'),
|
||
cache_file=CACHE_FILE,
|
||
log_file=LOG_FILE,
|
||
crowdsec_queue=CROWDSEC_QUEUE_FILE,
|
||
shop_name=shop,
|
||
countries_array=generate_php_countries_array(geo_region),
|
||
min_ranges=MIN_RANGES.get(geo_region, 1000)
|
||
)
|
||
|
||
with open(blocking_file, 'w', encoding='utf-8') as f:
|
||
f.write(geoip_content)
|
||
|
||
if is_bot_mode:
|
||
add_shop_to_active(shop, mode, geo_region)
|
||
print(f" ✅ Aktiviert ({len(BOT_PATTERNS)} Bot-Patterns)")
|
||
else:
|
||
print(f" ⏳ Cache generieren...")
|
||
cache_ok, count, _ = generate_and_validate_cache(httpdocs, geo_region)
|
||
add_shop_to_active(shop, mode, geo_region)
|
||
print(f" ✅ Aktiviert ({count:,} Ranges)" if cache_ok else f" ⚠️ Aktiviert (Cache-Warnung)")
|
||
|
||
success_count += 1
|
||
|
||
print(f"\n{'=' * 60}")
|
||
print(f" ✅ {success_count} direkte Shop(s) aktiviert")
|
||
print(f" ⏭️ {len(link11_shops)} Link11-Shop(s) übersprungen")
|
||
if not is_bot_mode:
|
||
print(f" 🛡️ Fail-Open bei Cache-Fehlern aktiv")
|
||
print(f"{'=' * 60}")
|
||
|
||
|
||
def deactivate_all_shops():
|
||
active_shops = get_active_shops()
|
||
|
||
if not active_shops:
|
||
print("\n⚠️ Keine aktiven Shops")
|
||
return
|
||
|
||
print(f"\n{'=' * 60}")
|
||
print(f" Blocking für ALLE deaktivieren")
|
||
print(f"{'=' * 60}")
|
||
print(f"\n📋 {len(active_shops)} Shop(s):")
|
||
for shop in active_shops:
|
||
region_info = get_geo_region_info(get_shop_geo_region(shop))
|
||
mode_icon = get_mode_icon(get_shop_mode(shop))
|
||
print(f" • {format_shop_with_link11(shop)} {region_info['icon']} {mode_icon}")
|
||
|
||
if input(f"\nFortfahren? (ja/nein): ").strip().lower() not in ['ja', 'j', 'yes', 'y']:
|
||
print("\n❌ Abgebrochen")
|
||
return
|
||
|
||
for i, shop in enumerate(active_shops, 1):
|
||
print(f"\n[{i}/{len(active_shops)}] {shop}")
|
||
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
backup_php = os.path.join(httpdocs, f'index.php{BACKUP_SUFFIX}')
|
||
index_php = os.path.join(httpdocs, 'index.php')
|
||
|
||
if os.path.isfile(backup_php):
|
||
shutil.move(backup_php, index_php)
|
||
|
||
for f in [os.path.join(httpdocs, x) for x in [BLOCKING_FILE, CACHE_FILE, LOG_FILE, CROWDSEC_QUEUE_FILE]]:
|
||
if os.path.isfile(f):
|
||
os.remove(f)
|
||
|
||
remove_shop_from_active(shop)
|
||
if check_crowdsec():
|
||
cleanup_crowdsec_decisions(shop)
|
||
print(f" ✅ Deaktiviert")
|
||
|
||
uninstall_watcher_service()
|
||
print(f"\n{'=' * 60}")
|
||
print(f" ✅ Alle Shops deaktiviert")
|
||
print(f"{'=' * 60}")
|
||
|
||
|
||
def get_shop_log_stats(shop):
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
log_file = os.path.join(httpdocs, LOG_FILE)
|
||
php_blocks = 0
|
||
ips = {}
|
||
bots = {} # Track bot statistics
|
||
|
||
shop_mode = get_shop_mode(shop)
|
||
is_bot_mode = is_bot_only_mode(shop_mode)
|
||
|
||
if os.path.isfile(log_file):
|
||
with open(log_file, 'r') as f:
|
||
for line in f:
|
||
php_blocks += 1
|
||
ip, ua = None, 'Unknown'
|
||
detected_bot = None
|
||
|
||
# Parse bot-only format: BOT: botname | IP: ...
|
||
if 'BOT: ' in line:
|
||
try:
|
||
detected_bot = line.split('BOT: ')[1].split(' |')[0].strip()
|
||
except:
|
||
pass
|
||
|
||
if 'IP: ' in line:
|
||
try:
|
||
ip = line.split('IP: ')[1].split(' |')[0].strip()
|
||
except:
|
||
pass
|
||
if 'UA: ' in line:
|
||
try:
|
||
ua = line.split('UA: ')[1].split(' |')[0].strip()
|
||
except:
|
||
pass
|
||
|
||
if ip:
|
||
if ip not in ips:
|
||
ips[ip] = {'count': 0, 'ua': ua}
|
||
ips[ip]['count'] += 1
|
||
if ua != 'Unknown' and ips[ip]['ua'] == 'Unknown':
|
||
ips[ip]['ua'] = ua
|
||
|
||
# Track bot statistics
|
||
if detected_bot:
|
||
bots[detected_bot] = bots.get(detected_bot, 0) + 1
|
||
elif ua and ua != 'Unknown':
|
||
bot_name = detect_bot(ua)
|
||
if bot_name != 'Unbekannt':
|
||
bots[bot_name] = bots.get(bot_name, 0) + 1
|
||
|
||
return php_blocks, ips, bots, get_shop_activation_time(shop)
|
||
|
||
|
||
def show_logs(shop):
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
log_file = os.path.join(httpdocs, LOG_FILE)
|
||
shop_mode = get_shop_mode(shop)
|
||
shop_geo = get_shop_geo_region(shop)
|
||
region_info = get_geo_region_info(shop_geo)
|
||
is_bot_mode = is_bot_only_mode(shop_mode)
|
||
|
||
blocks, ips, bots, activation_time = get_shop_log_stats(shop)
|
||
|
||
if activation_time:
|
||
runtime = (datetime.now() - activation_time).total_seconds() / 60
|
||
req_min = blocks / runtime if runtime > 0 else 0
|
||
else:
|
||
runtime, req_min = 0, 0
|
||
|
||
print(f"\n{'═' * 70}")
|
||
print(f"📊 {shop} | {region_info['icon']} {region_info['name']} {get_mode_icon(shop_mode)}")
|
||
print(f"{'═' * 70}")
|
||
print(f"⏱️ Laufzeit: {format_duration(runtime)}")
|
||
print(f"📈 Blocks: {blocks} ({req_min:.1f} req/min)")
|
||
|
||
if not is_bot_mode:
|
||
valid, count, err = validate_existing_cache(httpdocs, shop_geo)
|
||
print(f"✅ Cache: {count:,} Ranges" if valid else f"⚠️ Cache: {err}")
|
||
else:
|
||
print(f"🤖 Bot-Patterns: {len(BOT_PATTERNS)} aktiv")
|
||
|
||
# Show bot statistics for bot-only mode
|
||
if bots:
|
||
print(f"\n🤖 Bot-Statistik:")
|
||
for bot_name, count in sorted(bots.items(), key=lambda x: x[1], reverse=True)[:10]:
|
||
bar = "█" * min(count // 5, 20) if count > 0 else "█"
|
||
print(f" {bot_name}: {count}x {bar}")
|
||
|
||
if os.path.isfile(log_file):
|
||
print(f"\n📝 Letzte 30 Blocks:")
|
||
with open(log_file, 'r') as f:
|
||
for line in f.readlines()[-30:]:
|
||
print(line.rstrip())
|
||
|
||
if ips:
|
||
print(f"\n🔥 Top 10 IPs:")
|
||
for ip, data in sorted(ips.items(), key=lambda x: x[1]['count'], reverse=True)[:10]:
|
||
bot = detect_bot(data['ua'])
|
||
print(f" {ip} ({bot}): {data['count']}x")
|
||
|
||
|
||
def show_all_logs():
|
||
"""Show combined logs for all active shops"""
|
||
active_shops = get_active_shops()
|
||
|
||
if not active_shops:
|
||
print("\n⚠️ Keine aktiven Shops")
|
||
return
|
||
|
||
print(f"\n{'═' * 70}")
|
||
print(" 📊 GESAMTÜBERSICHT ALLER SHOPS")
|
||
print(f"{'═' * 70}")
|
||
print(f" {COLOR_GREEN}Grün = hinter Link11{COLOR_RESET} | {COLOR_RED}Rot = Direkt{COLOR_RESET}")
|
||
|
||
total_php_blocks = 0
|
||
shop_php_stats = {} # shop -> {'blocks': N, 'runtime_minutes': float, 'req_min': float, 'ips': {}, 'bots': {}}
|
||
all_ips = {} # ip -> {'count': N, 'ua': user_agent, 'shops': {shop: count}}
|
||
all_bots = {} # bot_name -> count
|
||
total_minutes = 0
|
||
|
||
# Collect PHP stats
|
||
for shop in active_shops:
|
||
blocks, ips, bots, activation_time = get_shop_log_stats(shop)
|
||
total_php_blocks += blocks
|
||
|
||
# Calculate runtime and req/min
|
||
if activation_time:
|
||
runtime_minutes = (datetime.now() - activation_time).total_seconds() / 60
|
||
req_min = blocks / runtime_minutes if runtime_minutes > 0 else 0
|
||
else:
|
||
runtime_minutes = 0
|
||
req_min = 0
|
||
|
||
shop_php_stats[shop] = {
|
||
'blocks': blocks,
|
||
'runtime_minutes': runtime_minutes,
|
||
'req_min': req_min,
|
||
'ips': ips,
|
||
'bots': bots
|
||
}
|
||
|
||
if runtime_minutes > total_minutes:
|
||
total_minutes = runtime_minutes
|
||
|
||
for ip, data in ips.items():
|
||
if ip not in all_ips:
|
||
all_ips[ip] = {'count': 0, 'ua': data['ua'], 'shops': {}}
|
||
all_ips[ip]['count'] += data['count']
|
||
all_ips[ip]['shops'][shop] = data['count']
|
||
if data['ua'] != 'Unknown' and all_ips[ip]['ua'] == 'Unknown':
|
||
all_ips[ip]['ua'] = data['ua']
|
||
|
||
for bot_name, count in bots.items():
|
||
all_bots[bot_name] = all_bots.get(bot_name, 0) + count
|
||
|
||
# Calculate total req/min
|
||
total_req_min = total_php_blocks / total_minutes if total_minutes > 0 else 0
|
||
|
||
# Get CrowdSec stats
|
||
crowdsec_stats = {}
|
||
if check_crowdsec():
|
||
code, stdout, _ = run_command("cscli decisions list -o raw --limit 0")
|
||
if code == 0 and stdout:
|
||
for line in stdout.strip().split('\n')[1:]:
|
||
for shop in active_shops:
|
||
if shop in line:
|
||
crowdsec_stats[shop] = crowdsec_stats.get(shop, 0) + 1
|
||
break
|
||
total_crowdsec = sum(crowdsec_stats.values())
|
||
|
||
# Display PHP blocks with req/min and top IP per shop
|
||
print(f"\n📝 Blocks gesamt: {total_php_blocks} (⌀ {total_req_min:.1f} req/min, Laufzeit: {format_duration(total_minutes)})")
|
||
if shop_php_stats:
|
||
for shop in sorted(shop_php_stats.keys()):
|
||
stats = shop_php_stats[shop]
|
||
count = stats['blocks']
|
||
req_min = stats['req_min']
|
||
runtime = stats['runtime_minutes']
|
||
bar = "█" * min(int(req_min * 2), 20) if req_min > 0 else ""
|
||
runtime_str = format_duration(runtime) if runtime > 0 else "?"
|
||
|
||
# Get geo region icon and mode icon
|
||
geo_region = get_shop_geo_region(shop)
|
||
region_info = get_geo_region_info(geo_region)
|
||
geo_icon = region_info['icon']
|
||
mode_icon = get_mode_icon(get_shop_mode(shop))
|
||
|
||
# Color shop name based on Link11 status
|
||
link11_info = check_link11(shop)
|
||
if link11_info['is_link11']:
|
||
shop_colored = f"{COLOR_GREEN}{shop}{COLOR_RESET}"
|
||
else:
|
||
shop_colored = f"{COLOR_RED}{shop}{COLOR_RESET}"
|
||
|
||
print(f" ├─ {shop_colored} {geo_icon} {mode_icon}: {count} ({req_min:.1f} req/min, seit {runtime_str}) {bar}")
|
||
|
||
# Show top IP for this shop
|
||
shop_ips = stats['ips']
|
||
if shop_ips and count > 0:
|
||
top_ip = max(shop_ips.items(), key=lambda x: x[1]['count'])
|
||
top_ip_addr = top_ip[0]
|
||
top_ip_count = top_ip[1]['count']
|
||
top_ip_ua = top_ip[1]['ua']
|
||
top_ip_bot = detect_bot(top_ip_ua)
|
||
top_ip_req_min = top_ip_count / runtime if runtime > 0 else 0
|
||
|
||
if top_ip_bot == 'Unbekannt':
|
||
display_name = (top_ip_ua[:40] + '...') if len(top_ip_ua) > 43 else top_ip_ua
|
||
else:
|
||
display_name = top_ip_bot
|
||
|
||
print(f" │ └─➤ Top: {top_ip_addr} ({display_name}) - {top_ip_count}x, {top_ip_req_min:.1f} req/min")
|
||
|
||
# Display CrowdSec bans
|
||
print(f"\n🛡️ CrowdSec-Bans gesamt: {total_crowdsec}")
|
||
if crowdsec_stats:
|
||
for shop in sorted(crowdsec_stats.keys()):
|
||
count = crowdsec_stats[shop]
|
||
bar = "█" * min(count // 10, 20) if count > 0 else ""
|
||
|
||
geo_region = get_shop_geo_region(shop)
|
||
region_info = get_geo_region_info(geo_region)
|
||
geo_icon = region_info['icon']
|
||
mode_icon = get_mode_icon(get_shop_mode(shop))
|
||
|
||
link11_info = check_link11(shop)
|
||
if link11_info['is_link11']:
|
||
shop_colored = f"{COLOR_GREEN}{shop}{COLOR_RESET}"
|
||
else:
|
||
shop_colored = f"{COLOR_RED}{shop}{COLOR_RESET}"
|
||
|
||
print(f" ├─ {shop_colored} {geo_icon} {mode_icon}: {count} {bar}")
|
||
elif check_crowdsec():
|
||
print(" └─ Keine aktiven Bans")
|
||
else:
|
||
print(" └─ CrowdSec nicht verfügbar")
|
||
|
||
# Display bot statistics
|
||
if all_bots:
|
||
print(f"\n🤖 Bot-Statistik (alle Shops):")
|
||
for bot_name, count in sorted(all_bots.items(), key=lambda x: x[1], reverse=True)[:15]:
|
||
bar = "█" * min(count // 5, 20) if count > 0 else "█"
|
||
print(f" {bot_name}: {count}x {bar}")
|
||
|
||
# Top 50 blocked IPs with bot detection, req/min, and top shop
|
||
if all_ips:
|
||
print(f"\n🔥 Top 50 blockierte IPs (alle Shops):")
|
||
sorted_ips = sorted(all_ips.items(), key=lambda x: x[1]['count'], reverse=True)[:50]
|
||
for ip, data in sorted_ips:
|
||
count = data['count']
|
||
ua = data['ua']
|
||
bot_name = detect_bot(ua)
|
||
shops_data = data['shops']
|
||
|
||
# Calculate req/min for this IP
|
||
ip_req_min = count / total_minutes if total_minutes > 0 else 0
|
||
|
||
# Find top shop for this IP
|
||
if shops_data:
|
||
top_shop = max(shops_data.items(), key=lambda x: x[1])
|
||
top_shop_name = top_shop[0]
|
||
top_shop_count = top_shop[1]
|
||
if len(top_shop_name) > 25:
|
||
top_shop_short = top_shop_name[:22] + '...'
|
||
else:
|
||
top_shop_short = top_shop_name
|
||
|
||
link11_info = check_link11(top_shop_name)
|
||
if link11_info['is_link11']:
|
||
top_shop_display = f"{COLOR_GREEN}{top_shop_short}{COLOR_RESET}"
|
||
else:
|
||
top_shop_display = f"{COLOR_RED}{top_shop_short}{COLOR_RESET}"
|
||
else:
|
||
top_shop_display = "?"
|
||
top_shop_count = 0
|
||
|
||
if bot_name == 'Unbekannt':
|
||
display_name = (ua[:35] + '...') if len(ua) > 38 else ua
|
||
if display_name == 'Unknown':
|
||
display_name = 'Unbekannt'
|
||
else:
|
||
display_name = bot_name
|
||
|
||
bar = "█" * min(count // 5, 20) if count > 0 else "█"
|
||
print(f" {ip} ({display_name}): {count} ({ip_req_min:.1f} req/min) → {top_shop_display} [{top_shop_count}x] {bar}")
|
||
|
||
print(f"\n{'═' * 70}")
|
||
input("\nDrücke Enter um fortzufahren...")
|
||
|
||
|
||
def main():
|
||
print("\n" + "=" * 60)
|
||
print(" GeoIP Shop Blocker Manager v3.3.0")
|
||
print(" 🇩🇪🇦🇹🇨🇭 DACH | 🇪🇺 Eurozone+GB | 🤖 Bot-Only")
|
||
print(" 🛡️ Mit Cache-Validierung und Fail-Open")
|
||
print("=" * 60)
|
||
|
||
print(f" {'✅' if check_crowdsec() else '⚠️ '} CrowdSec")
|
||
code, stdout, _ = run_command("systemctl is-active geoip-crowdsec-watcher.service")
|
||
print(f" {'✅' if code == 0 and stdout.strip() == 'active' else '⚠️ '} Watcher-Service")
|
||
|
||
while True:
|
||
print("\n" + "-" * 40)
|
||
print("[1] Aktivieren (einzeln)")
|
||
print("[2] Deaktivieren (einzeln)")
|
||
print("[3] Logs anzeigen")
|
||
print("[4] Status")
|
||
print("-" * 40)
|
||
print("[5] 🚀 ALLE aktivieren")
|
||
print("[6] 🛑 ALLE deaktivieren")
|
||
print(f"[7] {COLOR_RED}🎯 Nur DIREKTE aktivieren (ohne Link11){COLOR_RESET}")
|
||
print("-" * 40)
|
||
print("[0] Beenden")
|
||
|
||
choice = input("\nWähle: ").strip()
|
||
|
||
if choice == "1":
|
||
available = [s for s in get_available_shops() if s not in get_active_shops()]
|
||
if not available:
|
||
print("\n⚠️ Keine Shops verfügbar")
|
||
continue
|
||
print("\n📋 Verfügbare Shops:")
|
||
for i, shop in enumerate(available, 1):
|
||
print(format_shop_with_link11(shop, show_index=i))
|
||
try:
|
||
idx = int(input("\nShop wählen: ").strip()) - 1
|
||
if 0 <= idx < len(available):
|
||
mode = select_mode()
|
||
is_bot_mode = is_bot_only_mode(mode)
|
||
|
||
if is_bot_mode:
|
||
geo = "none"
|
||
region_info = get_geo_region_info("none")
|
||
else:
|
||
geo = select_geo_region()
|
||
region_info = get_geo_region_info(geo)
|
||
|
||
confirm_msg = f"\n{region_info['icon']} {get_mode_description(mode)} aktivieren für '{available[idx]}'? (ja/nein): "
|
||
if input(confirm_msg).lower() in ['ja', 'j']:
|
||
activate_blocking(available[idx], mode=mode, geo_region=geo)
|
||
except:
|
||
print("❌ Ungültig")
|
||
|
||
elif choice == "2":
|
||
active = get_active_shops()
|
||
if not active:
|
||
print("\n⚠️ Keine aktiven Shops")
|
||
continue
|
||
print("\n📋 Aktive Shops:")
|
||
for i, shop in enumerate(active, 1):
|
||
region_info = get_geo_region_info(get_shop_geo_region(shop))
|
||
mode_icon = get_mode_icon(get_shop_mode(shop))
|
||
print(f" [{i}] {format_shop_with_link11(shop)} {region_info['icon']} {mode_icon}")
|
||
try:
|
||
idx = int(input("\nShop wählen: ").strip()) - 1
|
||
if 0 <= idx < len(active):
|
||
if input(f"\nDeaktivieren für '{active[idx]}'? (ja/nein): ").lower() in ['ja', 'j']:
|
||
deactivate_blocking(active[idx])
|
||
except:
|
||
print("❌ Ungültig")
|
||
|
||
elif choice == "3":
|
||
active = get_active_shops()
|
||
if not active:
|
||
print("\n⚠️ Keine aktiven Shops")
|
||
continue
|
||
print("\n📋 Logs für:")
|
||
print(" [0] 📊 ALLE")
|
||
for i, shop in enumerate(active, 1):
|
||
region_info = get_geo_region_info(get_shop_geo_region(shop))
|
||
mode_icon = get_mode_icon(get_shop_mode(shop))
|
||
print(f" [{i}] {format_shop_with_link11(shop)} {region_info['icon']} {mode_icon}")
|
||
try:
|
||
idx = int(input("\nWähle: ").strip())
|
||
if idx == 0:
|
||
show_all_logs()
|
||
elif 1 <= idx <= len(active):
|
||
show_logs(active[idx - 1])
|
||
except:
|
||
print("❌ Ungültig")
|
||
|
||
elif choice == "4":
|
||
shops = get_available_shops()
|
||
active = get_active_shops()
|
||
print(f"\n📊 {len(active)}/{len(shops)} Shops aktiv")
|
||
for shop in active:
|
||
region_info = get_geo_region_info(get_shop_geo_region(shop))
|
||
shop_mode = get_shop_mode(shop)
|
||
mode_icon = get_mode_icon(shop_mode)
|
||
is_bot_mode = is_bot_only_mode(shop_mode)
|
||
blocks, _, bots, activation_time = get_shop_log_stats(shop)
|
||
runtime = (datetime.now() - activation_time).total_seconds() / 60 if activation_time else 0
|
||
|
||
httpdocs = os.path.join(VHOSTS_DIR, shop, 'httpdocs')
|
||
|
||
print(f" {format_shop_with_link11(shop)} {region_info['icon']} {mode_icon}")
|
||
|
||
if is_bot_mode:
|
||
print(f" {blocks} blocks, {format_duration(runtime)}, {len(BOT_PATTERNS)} Bot-Patterns")
|
||
else:
|
||
valid, count, _ = validate_existing_cache(httpdocs, get_shop_geo_region(shop))
|
||
cache_str = f"✅{count:,}" if valid else "⚠️"
|
||
print(f" {blocks} blocks, {format_duration(runtime)}, Cache: {cache_str}")
|
||
|
||
elif choice == "5":
|
||
activate_all_shops()
|
||
|
||
elif choice == "6":
|
||
deactivate_all_shops()
|
||
|
||
elif choice == "7":
|
||
activate_direct_shops_only()
|
||
|
||
elif choice == "0":
|
||
print("\n👋 Auf Wiedersehen!")
|
||
break
|
||
|
||
|
||
if __name__ == "__main__":
|
||
if os.geteuid() != 0:
|
||
print("❌ Als root ausführen!")
|
||
sys.exit(1)
|
||
try:
|
||
main()
|
||
except KeyboardInterrupt:
|
||
print("\n\n👋 Abgebrochen")
|
||
sys.exit(0) |