chillcog/UFW-AbuseIPDB-Reporter
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixes

Browse Source
This commit is contained in:
Sefinek committed 2025-04-10 02:05:41 +02:00
1 parent b22897af80
commit 17a2760f8b
2 files changed
+8 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

index.js
+7 -11
View File
@@ -29,7 +29,7 @@ const reportToAbuseIPDb = async (logData, categories, comment) => {
log(0, `Reported ${logData.srcIp} [${logData.dpt}/${logData.proto}]; ID: ${logData.id}; Categories: ${categories}; Abuse: ${res.data.abuseConfidenceScore}%`); log(0, `Reported ${logData.srcIp} [${logData.dpt}/${logData.proto}]; ID: ${logData.id}; Categories: ${categories}; Abuse: ${res.data.abuseConfidenceScore}%`);
return true; return true;
} catch (err) { } catch (err) {
log(2, `Failed to report ${logData.srcIp} [${logData.dpt}/${logData.proto}]; ID: ${logData.id}; ${err.message}\n${JSON.stringify(err.response.data?.errors || err.response.data)}`); log(2, `Failed to report ${logData.srcIp} [${logData.dpt}/${logData.proto}]; ID: ${logData.id}; ${err.message}\n${JSON.stringify(err.response.data?.errors || err.response.data)}`, 0);
return false; return false;
} }
}; };
@@ -40,7 +40,7 @@ const toNumber = (str, regex) => {
}; };
const processLogLine = async (line, test = false) => { const processLogLine = async (line, test = false) => {
if (!line.includes('[UFW BLOCK]')) return log(0, `Ignoring invalid line: ${line}`); if (!line.includes('[UFW BLOCK]')) return log(1, `Ignoring invalid line: ${line}`, 1);
const logData = { const logData = {
date: parseTimestamp(line), // Log timestamp date: parseTimestamp(line), // Log timestamp
@@ -65,21 +65,17 @@ const processLogLine = async (line, test = false) => {
}; };
const { srcIp, proto, dpt } = logData; const { srcIp, proto, dpt } = logData;
if (!srcIp) { if (!srcIp) return log(2, `Missing SRC in the log line: ${line}`, 1);
return log(2, `Missing SRC in the log line: ${line}`);
}
const ips = getServerIPs(); const ips = getServerIPs();
if (!Array.isArray(ips)) { if (!Array.isArray(ips)) return log(2, 'For some reason, \'ips\' is not an array', 1);
return log(2, 'For some reason, \'ips\' is not an array');
}
if (ips.includes(srcIp)) { if (ips.includes(srcIp)) {
return log(0, `Ignoring own IP address! PROTO=${proto?.toLowerCase()} SRC=${srcIp} DPT=${dpt} ID=${logData.id}`); return log(0, `Ignoring own IP address! PROTO=${proto?.toLowerCase()} SRC=${srcIp} DPT=${dpt} ID=${logData.id}`, 1);
} }
if (isLocalIP(srcIp)) { if (isLocalIP(srcIp)) {
return log(0, `Ignoring local IP address! PROTO=${proto?.toLowerCase()} SRC=${srcIp} DPT=${dpt} ID=${logData.id}`); return log(0, `Ignoring local IP address! PROTO=${proto?.toLowerCase()} SRC=${srcIp} DPT=${dpt} ID=${logData.id}`, 1);
} }
// Report MUST NOT be of an attack where the source address is likely spoofed i.e. SYN floods and UDP floods. // Report MUST NOT be of an attack where the source address is likely spoofed i.e. SYN floods and UDP floods.
@@ -142,7 +138,7 @@ const processLogLine = async (line, test = false) => {
const stats = fs.statSync(path); const stats = fs.statSync(path);
if (stats.size < fileOffset) { if (stats.size < fileOffset) {
fileOffset = 0; fileOffset = 0;
log(1, 'The file has been truncated, and the offset has been reset'); log(1, 'The file has been truncated, and the offset has been reset', 1);
} }
fs.createReadStream(path, { start: fileOffset, encoding: 'utf8' }).on('data', chunk => { fs.createReadStream(path, { start: fileOffset, encoding: 'utf8' }).on('data', chunk => {
scripts
+1 -1
Submodule scripts updated: 4582f3ce9d...46096e9790.