#!/usr/bin/perl
#
# Script: country_block
#
# Usage: $0 --prep
# - $0 <country_code>
#
# Description: A script to block countries with an update option
#
# Author: Ernest E. Teem III
#
# 2021-09-08: Keith Muska
#   Patch - software77.net is dead.  fs01 now pulls a CSV Database from db-ip.com, and this script pulls from fs01
#

$geofile = "/tmp/IpToCountry.csv";
$blockfile = $ENV{"HOME"} . "/.countryblock";

if ($ARGV[0] eq "-h" || $ARGV[0] eq "--help") {
	&show_help;
	exit(0);
}

if ($ARGV[0] eq "--prep") {
	`wget fs01.mojohost.com/files/country_block/IpToCountry.csv.gz -O $geofile.gz`;
	`gunzip $geofile.gz`;
	exit(1);
}

if ($ARGV[0] eq "--addblock") {
	$cntry = $ARGV[1];
	chomp($cntry);

	$flag = 0;
	open(FH, "$blockfile");
		while ($line = <FH>) {
			chomp($line);
			if ($cntry eq $line) {
				$flag = 1;
			} 
		}
	close(FH);

	if ($flag == 1) {
		print "That Country Is Already Listed In The DB\n";
		exit;
	}

	open(FH, ">>$blockfile");
		print FH "$cntry\n";
	close(FH);
	print "Done.\n";
	exit(1);
}

if ($ARGV[0] eq "--rmblock") {
	$cntry = $ARGV[1];
	chomp($cntry);

	open(FH, "$blockfile");
		while ($line = <FH>) {
			chomp($line);
			push @blocklist, $line;
		}
	close(FH);

	$flag = 0;
	open(FH, ">$blockfile");
		foreach $line (@blocklist) {
			if ($line eq $cntry) {
				$flag = 1;
			} else {
				print FH "$line\n";
			}
		}
	close(FH);

	if ($flag == 0) {
		print "That Country Was Not Found In The DB\n";
		exit(1);
	} else {
		print "Country Removed From DB\n";
	}
}

if ($ARGV[0] eq "--lsblocks") {
	if (! -e $blockfile) {
		print "No Persistent Blocks!\n";
		exit(1);
	}

	open(FH, "$blockfile");
		while ($line = <FH>) {
			chomp($line);
			push @blocklist, $line;
		}
	close(FH);

	$max = @blocklist;
	if ($max < 1) {
		print "No Persistent Blocks!\n";
		exit(1);
	}

	foreach $block (@blocklist) {
		print "Blocking: $block\n";
	}

	exit(0);
}

if ($ARGV[0] eq "--updateblocks") {

	if (! -e $blockfile) {
		print "No Block File Found! Exiting Without Removing Current Blocks\n";
		exit(1);
	}

	open(FH, "$blockfile");
		while ($line = <FH>) {
			chomp($line);
			push @blocklist, $line;
		}
	close(FH);

	$max = @blocklist;
	if ($max < 1) {
		print "No Persistent Blocks In The Block File! Exiting Without Removing Current Blocks!\n";
		exit(1);
	}

	if (-e $geofile) {
		unlink $geofile;
	}

	`wget fs01.mojohost.com/files/country_block/IpToCountry.csv.gz -O $geofile.gz`;
        `gunzip $geofile.gz`;

	&clear_all_reject_routes;

	foreach $block (@blocklist) {
		&get_country_route_deny($block);
	}
	
	exit(0);
}

if ($ARGV[0] eq "--codes") {
	&get_country_codes;
	exit(1);
}

if ($ARGV[0] eq "--host") {
	$cnt = $ARGV[1];
	&get_all_country($cnt);
	exit(0);
}

if ($ARGV[0] eq "--clearall") {
	&clear_all_reject_routes;
	exit(0);
}

if ($ARGV[0] eq "--clearcountry") {
	$cntry = $ARGV[1];
	&clear_routes_by_country($cntry);
	exit(0);
}

if (! -e "$geofile") {
	print "Missing IpToCountry DB.  Please run: $0 --prep\n";
	exit(1);
}


$cnt = $ARGV[0];

if ($cnt eq "") {
	&show_help;
	exit(0);
}

&get_country_route_deny($cnt);

exit(0);

sub get_country_route_deny
{
	$cntry = shift;
	open GF, "<$geofile";
		while (<GF>) {
			s/\n//g;
			($start, $end, $CC) = split(/,/, $_);
			if (uc($CC) eq uc($cntry)) {
				@list = &cidrfy($start, $end);

				foreach $item (@list) {
					($ip, $cidr) = split(/\//, $item);
					if ($cidr eq "32") {
						`route add -host $item reject`;
					} else {
						`route add -net $item reject`;
					}
				}
			}
		}
	close(GF);
}

sub clear_all_reject_routes
{
	$raw = `route -n`;
	@parts = split(/\n/, $raw);

	foreach $part (@parts) {
		chomp($part);
		if ($part !~ /Destination/) {
			($dest, $gw, $mask, $flag, $met, $ref, $use, $iface) = split(/\s+/, $part);

			$cidr = &cidr_from_netmask($mask);

			if ($flag eq "!" || $flag eq "!H") {
				if ($mask eq "255.255.255.255") {
					`route del -host $dest/$cidr reject`;
				} else {
					`route del -net $dest/$cidr reject`;
				}
			}
		}
	}
}

sub clear_routes_by_country
{
	$cntry = shift;
	open GF, "<$geofile";
		while (<GF>) {
			s/\n//g;
			($start, $end, $CC) = split(/,/, $_);
			if (uc($CC) eq uc($cntry)) {
				@list = &cidrfy($start, $end);

				foreach $item (@list) {
					($ip, $cidr) = split(/\//, $item);
					if ($cidr eq "32") {
						`route del -host $item reject`;
					} else {
						`route del -net $item reject`;
					}
				}
			}
		}
	close(GF);

}

sub get_country_codes
{
	$cntry = shift;
        open GF, "<$geofile";
		while (<GF>) {
			s/\n//g;
			($start, $end, $CC) = split(/,/, $_);
			$codes{$CC} = $CC;
		}
	close(GF);

	foreach $cntry (keys %codes) {
		print $codes{$cntry} . "\n";
	}

}

sub get_all_country
{
	$cntry = shift;
        open GF, "<$geofile";
		while (<GF>) {
			s/\n//g;
			($start, $end, $CC) = split(/,/, $_);
			if (uc($CC) eq uc($cntry)) {
				@list = &cidrfy($start, $end);
				foreach $item (@list) {
					$masked = &calc_netmask($item);
					print "ALL: $masked\n";
				}

			}
		}
	close(GF);

}
sub ipstr_to_int 
{
    my ( $s ) = @_;
    my @z = split( /\./, $s );
    return( ($z[0] << 24) + ($z[1] << 16) + ($z[2] << 8) + $z[3] );
}
 
sub int_to_ipstr 
{
    my ( $i ) = @_;
    my $s = sprintf( 
        "%d.%d.%d.%d", ($i>>24)&0xFF, ($i>>16)&0xFF, ($i>>8)&0xFF, $i & 0xFF
    );
    return( $s );
}

sub cidrfy
{
my @ip_masks = (
    0x00000000
    ,0x80000000,0xc0000000,0xe0000000,0xf0000000
    ,0xf8000000,0xfc000000,0xfe000000,0xff000000
    ,0xff800000,0xffc00000,0xffe00000,0xfff00000
    ,0xfff80000,0xfffc0000,0xfffe0000,0xffff0000
    ,0xffff8000,0xffffc000,0xffffe000,0xfffff000
    ,0xfffff800,0xfffffc00,0xfffffe00,0xffffff00
    ,0xffffff80,0xffffffc0,0xffffffe0,0xfffffff0
    ,0xfffffff8,0xfffffffc,0xfffffffe,0xffffffff
);
 
my @ip_ranges = (
    4294967296
    ,2147483648,1073741824,536870912,268435456
    ,134217728,67108864,33554432,16777216
    ,8388608,4194304,2097152,1048576
    ,524288,262144,131072,65536
    ,32768,16384,8192,4096
    ,2048,1024,512,256
    ,128,64,32,16
    ,8,4,2,1
);

    my ($ip_from, $ip_to) = @_;
 
    my ( $int_ip_from ) = ipstr_to_int( $ip_from );
    my ( $int_ip_to ) = ipstr_to_int( $ip_to );
     
    my @results = (); # holding variable for results
     
    my $int_ip_next = $int_ip_from;
    while ( $int_ip_next <= $int_ip_to ) {
        my $netmask_bits = 31; # we could start at 32 but pointless
        while ( $netmask_bits > 0 ) {
            my $mask = $ip_masks[$netmask_bits];
            last if ( $int_ip_next != ( $int_ip_next & $mask ) );
             
            my $this_block_ip_to = $int_ip_next + $ip_ranges[$netmask_bits] - 1;
            last if ( $this_block_ip_to > $int_ip_to );
             
            $netmask_bits--;
        }
         
        $netmask_bits++;
         
        push( @results, int_to_ipstr( $int_ip_next ) . "/$netmask_bits" );
        $int_ip_next += $ip_ranges[$netmask_bits];
    }
     
    return( @results );

}


sub find_ip
{
	my $ip = ip_to_number($_[0]);
	my ($start, $end, $found);
	my ($CC, $NETBLOCK, $NUM_IP, $NUMERIC, $OCT, $HEX);

	$found = 0;
	open GF, "<$geofile";
	while (<GF>){
		s/\n//g;
		($start, $end, $CC) = split /,/, $_;
		if (($ip >= $start) and ($ip <= $end)){
			$found = 1;
			$NETBLOCK = $start . ' - ' . $end;
			$NUM_IP = comify($end - $start + 1);
			$NUMERIC = comify($start) . ' - ' . comify($end);
			$OCT = sprintf ('%o', $start) . ' - ' . sprintf ('%o', $end);
			$HEX = uc(sprintf ('%x', $start) . ' - ' . sprintf ('%x', $end));
			last;
		}
	}

}


sub number_to_ip($){ # Number => IP
	my $ip = shift;
	my (@octets,$i);

	$ip =~ /\n/g;
	for($i = 3; $i >= 0; $i--) {
		$octets[$i] = ($ip & 0xFF);
		$ip >>= 8;
	}

	return join('.', @octets);
}


sub ip_to_number($){ # IP => Number
	my $ip = shift;
	my (@octets, $ip_num);

	$ip =~ s/\n//g;
	@octets = split /\./, $ip;
	$ip_num = 0;
	foreach (@octets) {
		$ip_num <<= 8;
		$ip_num |= $_;
	}

	return $ip_num;
}

sub cidr_from_netmask
{
	$conv{"32"} = "255.255.255.255";
        $conv{"31"} = "255.255.255.254"; 
        $conv{"30"} = "255.255.255.252"; 
	$conv{"29"} = "255.255.255.248"; 
	$conv{"28"} = "255.255.255.240"; 
	$conv{"27"} = "255.255.255.224"; 
	$conv{"26"} = "255.255.255.192"; 
	$conv{"25"} = "255.255.255.128"; 
	$conv{"24"} = "255.255.255.0"; 
	$conv{"23"} = "255.255.254.0"; 
	$conv{"22"} = "255.255.252.0"; 
	$conv{"21"} = "255.255.248.0"; 
	$conv{"20"} = "255.255.240.0"; 
	$conv{"19"} = "255.255.224.0"; 
	$conv{"18"} = "255.255.192.0"; 
	$conv{"17"} = "255.255.128.0"; 
	$conv{"16"} = "255.255.0.0"; 
	$conv{"15"} = "255.254.0.0"; 
	$conv{"14"} = "255.252.0.0"; 
	$conv{"13"} = "255.248.0.0"; 
	$conv{"12"} = "255.240.0.0"; 
	$conv{"11"} = "255.224.0.0"; 
	$conv{"10"} = "255.192.0.0"; 
	$conv{"9"}  = "255.128.0.0"; 
	$conv{"8"}  = "255.0.0.0"; 
	$conv{"7"}  = "254.0.0.0"; 
	$conv{"6"}  = "252.0.0.0"; 
	$conv{"5"}  = "248.0.0.0"; 
	$conv{"4"}  = "240.0.0.0"; 
	$conv{"3"}  = "224.0.0.0"; 
	$conv{"2"}  = "192.0.0.0"; 
	$conv{"1"}  = "128.0.0.0"; 
	$conv{"0"}  = "0.0.0.0"; 

	$subnet = shift;
	keys %conv;
	while (my($key, $value) = each %conv) {
		if ($value eq $subnet) {
			return $key;
		}
	}
}

sub calc_netmask 
{
	$conv{"32"} = "255.255.255.255";
        $conv{"31"} = "255.255.255.254"; 
        $conv{"30"} = "255.255.255.252"; 
	$conv{"29"} = "255.255.255.248"; 
	$conv{"28"} = "255.255.255.240"; 
	$conv{"27"} = "255.255.255.224"; 
	$conv{"26"} = "255.255.255.192"; 
	$conv{"25"} = "255.255.255.128"; 
	$conv{"24"} = "255.255.255.0"; 
	$conv{"23"} = "255.255.254.0"; 
	$conv{"22"} = "255.255.252.0"; 
	$conv{"21"} = "255.255.248.0"; 
	$conv{"20"} = "255.255.240.0"; 
	$conv{"19"} = "255.255.224.0"; 
	$conv{"18"} = "255.255.192.0"; 
	$conv{"17"} = "255.255.128.0"; 
	$conv{"16"} = "255.255.0.0"; 
	$conv{"15"} = "255.254.0.0"; 
	$conv{"14"} = "255.252.0.0"; 
	$conv{"13"} = "255.248.0.0"; 
	$conv{"12"} = "255.240.0.0"; 
	$conv{"11"} = "255.224.0.0"; 
	$conv{"10"} = "255.192.0.0"; 
	$conv{"9"}  = "255.128.0.0"; 
	$conv{"8"}  = "255.0.0.0"; 
	$conv{"7"}  = "254.0.0.0"; 
	$conv{"6"}  = "252.0.0.0"; 
	$conv{"5"}  = "248.0.0.0"; 
	$conv{"4"}  = "240.0.0.0"; 
	$conv{"3"}  = "224.0.0.0"; 
	$conv{"2"}  = "192.0.0.0"; 
	$conv{"1"}  = "128.0.0.0"; 
	$conv{"0"}  = "0.0.0.0"; 

	$subnet = shift;
	($ip, $mask) = split(/\//, $subnet);
	$mask =~ s/\///gi;

	return "$ip/" . $conv{$mask};

}

sub show_help
{
	print "CountryBlock Help:\n";
	print "Purpose: To Block IP Addresses Of Countries\n";
	print "How It Works: By Adding a route reject for the IP / Range\n\n";
	print "Usage (Block China):\n";
	print "\t$0 CN\n\n";
	print "Flags:\n";
	print "\t--prep\t\tDownloads And Prepares The IP - Country Database Mapping\n";
	print "\t\t\tExample: $0 --prep\n\n";
	print "\t--codes\t\tList All Of The Countries, And Their Country Codes\n";
	print "\t\t\tExample: $0 --codes\n\n";
	print "\t--host\t\tPrints All The IP Ranges In A Format For Pasting Into Hosts.Deny\n";
	print "\t\t\tExample (China): $0 --host CN\n\n";
	print "\t--clearall\tRemoves All Blocked Countries\n";
	print "\t\t\tExample: $0 --clearall\n\n";
	print "\t--clearcountry\tRemoves A Specific Country From Being Blocked\n";
	print "\t\t\tExample (China): $0 --clearcountry CN\n\n";
	print "\t--updateblocks\tRemoves Blocks, Updates the IP - Country Database, And Reblocks Countries Added With --addblock\n";
	print "\t\t\tExample: $0 --updateblocks\n\n";
	print "\t--addblock\tAdds Block To CountryBlock Database (ie: Which Countries Will Be Blocked Upon Update)\n";
	print "\t\t\tExample: $0 --addblock CN\n\n";
	print "\t--rmblock\tRemoves Block From CountryBlock Database (ie: Don't Reblock Upon Update)\n";
	print "\t\t\tExample: $0 --rmblock CN\n\n";
	print "\t--lsblocks\tLists Blocks In The CountryBlock Database (ie: Those That Will Be Blocked Upon Update)\n";
	print "\t\t\tExample: $0 --lsblocks\n\n";
	print "** Note Just Blocking With: $0 <code> Will Not Get Updated, And Will Be Removed Upon Update **\n";
	print "** To Persistent Block: $0 --addblock CN && $0 CN **\n\n";
	print "Example Session:\n";
	print "$0 --prep\n";
	print "$0 --addblock CN\n";
	print "$0 CN\n\n";
	print "Add Something Like This To Cron: 15 0 * * 0 root $0 --updateblocks\n\n";
}