mirror of
http://code.chaosnet.io:3000/sygo/ExclusionEnforcer.git
synced 2024-09-27 22:46:31 -04:00
71 lines
3.3 KiB
Python
71 lines
3.3 KiB
Python
import os
|
|
import sys
|
|
from ipaddress import ip_network, ip_address
|
|
|
|
def expand_ip_ranges(ip_ranges):
|
|
for ip_range in ip_ranges:
|
|
if '-' in ip_range: # If IP range is a hyphenated range
|
|
start_ip, end_ip = ip_range.split('-')
|
|
start_last_octet = start_ip.split('.')[-1]
|
|
end_last_octet = end_ip.split('.')[-1]
|
|
start_ip_prefix = start_ip.rsplit('.', 1)[0]
|
|
for i in range(int(start_last_octet), int(end_last_octet) + 1):
|
|
yield f"{start_ip_prefix}.{i}"
|
|
else: # If IP range is a CIDR notation
|
|
for ip in ip_network(ip_range):
|
|
yield str(ip)
|
|
|
|
def add_to_iptables(deny_list_ips, rule_name):
|
|
for ip in deny_list_ips:
|
|
os.system(f"iptables -A OUTPUT -d {ip} -j DROP -m comment --comment \"{rule_name}\"")
|
|
print(f"✅ Applied iptables rules to block outgoing traffic to deny list IPs.")
|
|
|
|
def remove_from_iptables(rule_name):
|
|
os.system(f"iptables -S | grep '\"{rule_name}\"' | sed 's/-A/-D/' | while read -r line ; do iptables $line ; done")
|
|
print(f"❌ Removed iptables rules blocking outgoing traffic to deny list IPs.")
|
|
|
|
def main(scope_file_path, deny_list_file_path, output_file_path=None, rule_name=None, remove=False):
|
|
with open(scope_file_path, 'r') as f:
|
|
scope_ips = set(line.strip() for line in f) # Load scope IPs
|
|
|
|
with open(deny_list_file_path, 'r') as f:
|
|
deny_list_ips = set(expand_ip_ranges(line.strip() for line in f)) # Load and expand deny list IPs
|
|
|
|
valid_ips = scope_ips - deny_list_ips # Compute valid IPs
|
|
|
|
if output_file_path: # Write valid IPs to output file if provided
|
|
with open(output_file_path, 'w') as f:
|
|
for ip in valid_ips:
|
|
f.write(ip + '\n')
|
|
print(f"📝 Valid IP addresses have been written to {output_file_path}.")
|
|
else: # Print valid IPs to console otherwise
|
|
for ip in valid_ips:
|
|
print(ip)
|
|
print("🖨️ Valid IP addresses have been printed to the console.")
|
|
|
|
if rule_name: # Apply/remove iptables rules if rule name is provided
|
|
if remove:
|
|
remove_from_iptables(rule_name)
|
|
else:
|
|
add_to_iptables(deny_list_ips, rule_name)
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 3:
|
|
print("Usage: python ExclusionEnforcer.py <scope_file> <deny_list_file> [output_file] [--iptables=<rule_name>] [--remove]")
|
|
print("\nArguments:")
|
|
print(" scope_file\t\tPath to the file containing the scope IPs")
|
|
print(" deny_list_file\tPath to the file containing the deny list IPs")
|
|
print(" output_file\t\t(Optional) Path to the output file")
|
|
print(" --iptables=<rule_name>\t(Optional) Apply iptables rules to block outgoing traffic to deny list IPs and tag them with a rule name")
|
|
print(" --remove\t\t(Optional) Remove iptables rules tagged with the rule name provided with --iptables")
|
|
sys.exit(1)
|
|
|
|
scope_file_path = sys.argv[1]
|
|
deny_list_file_path = sys.argv[```python
|
|
2]
|
|
output_file_path = sys.argv[3] if len(sys.argv) > 3 and not sys.argv[3].startswith('--') else None
|
|
rule_name = sys.argv[sys.argv.index('--iptables')+1] if '--iptables' in sys.argv else None
|
|
remove = True if '--remove' in sys.argv else False
|
|
|
|
main(scope_file_path, deny_list_file_path, output_file_path, rule_name, remove)
|