#!/bin/bash
#
# Script: mjact_fw
#
# Usage: mjact_fw -a <action (add/remove/block/unblock/list)> -i <IP>
#
# Description: A tool for managing firewalld IP whitelists and blocklists
#
# Author: Oliver Mikitiuk
#
# Changelog:
# * 26.08.2025: Oliver Mikitiuk
# - Initial write
# * 07.05.2026: Oliver Mikitiuk
# - Replaced whois.cymru.com with internal https://mojoutils.mjhst.com/whois/
# * 08.05.2026: Oliver Mikitiuk
# - Renamed blocked ipset to blocklist ipset


# Companies that should never be blocked. You can verify ownership via:
#  curl -s "https://mojoutils.mjhst.com/whois/<IP>"
WHITELISTED_COMPANIES=("MOJOHOST" "MOJHOST-EU" "CDN77" "MEDIANOVA" "Datacamp Limited")


# Ensure the "blocklist" ipset exists
setupBlockedIpset() {

    if ! ipset list "blocklist" >/dev/null 2>&1; then
        firewall-cmd --permanent --new-ipset=blocklist --type=hash:ip >/dev/null
	#firewall-cmd --permanent --add-rich-rule='rule source ipset=blocklist drop' >/dev/null
	firewall-cmd --zone=drop --add-source=ipset:blocklist --permanent >/dev/null
	firewall-cmd --reload >/dev/null
    fi
}


# Validate if the provided IP address is correct
checkValidIP() {

    if ipcalc -c "${IPADDY}" >/dev/null 2>&1; then
        return 0
    else
	echo -e "\033[1;31m[ERROR]\033[0m IP ${IPADDY} is not valid."    
        exit 1
    fi

}


# Validate CIDR range:
# - Reject if broader than the maximum allowed (max_CIDR)
# - Normalize /32 to a plain IP
checkCIDR() {
  
    local max_CIDR="${1}"

    if [[ "${IPADDY}" == */* ]]; then
        CIDR=$(echo "${IPADDY}" | awk -F'/' '{print $2}')
        CLEANIP=$(echo "${IPADDY}" | awk -F'/' '{print $1}')
        if [ "${CIDR}" -lt "${max_CIDR}"  ]; then
	    echo -e "\033[1;31m[ERROR]\033[0m CIDR range too large : /${CIDR}"
            exit 1
	#Normalize /32 to a plain IP   
        elif [ "${CIDR}" -eq 32 ]; then
            IPADDY="${CLEANIP}"
        fi
    fi
}


# Check if the IP belongs to a whitelisted company and skip blocking if true
checkWhitelistedCompany() {

    #whois_info=$(whois -h whois.cymru.com " -v ${IPADDY}" 2>/dev/null)
    whois_info=$(curl -s "https://mojoutils.mjhst.com/whois/${IPADDY}" 2>/dev/null)

    if [[ $? -ne 0 ]] || [[ -z "$whois_info" ]]; then
        echo -e "\033[1;34m[INFO]\033[0m Cannot query IP: ${IPADDY}"
	return 0
    fi

    for company in "${WHITELISTED_COMPANIES[@]}"; do
        if echo "${whois_info}" | grep -iq "${company}"; then
            echo -e "\033[1;34m[INFO]\033[0m IP ${IPADDY} belongs to ${company}, skipping block."
	    exit 1
        fi
    done

}


# Check if the IP exists in a given ipset
checkInIpset() {

    local ipset_name="${1}"	
    if ipset test "${ipset_name}" "${IPADDY}" >/dev/null 2>&1; then
        return 0	    
    else
	return 1    
    fi

}	


# Add an IP to the whitelist
ADD() { 
	
    checkValidIP
    local max_CIDR=16
    checkCIDR "${max_CIDR}"

    if checkInIpset "client"; then
        echo -e "\033[1;34m[INFO]\033[0m IP ${IPADDY} is already whitelisted."
	exit 
    fi	

    whois_info=$(curl -s "https://mojoutils.mjhst.com/whois/${IPADDY}" 2>/dev/null)

    firewall-cmd --permanent --ipset=client --add-entry="${IPADDY}" >/dev/null || { echo "[ERROR] Failed to whitelist the IP: ${IPADDY}";exit 1; }
    firewall-cmd --reload >/dev/null || { echo "[ERROR] Failed to reload firewalld"; exit 1; }

    echo -e "\033[1;32m[OK]\033[0m IP ${IPADDY} has been successfully whitelisted. [WHOIS] ${whois_info}"

}


# Remove an IP from the whitelist
REMOVE() {

    checkValidIP
    local max_CIDR=16
    checkCIDR "${max_CIDR}"

    if ! checkInIpset "client"; then
        echo -e "\033[1;34m[INFO]\033[0m IP ${IPADDY} is not whitelisted."
        exit
    fi
    
    firewall-cmd --permanent --ipset=client --remove-entry="${IPADDY}" >/dev/null || { echo "[ERROR] Failed to remove the IP: ${IPADDY}"; exit 1; }
    firewall-cmd --reload >/dev/null || { echo "[ERROR] Failed to reload firewalld"; exit 1; }

    echo -e "\033[1;32m[OK]\033[0m IP ${IPADDY} has been successfully removed."

}


# Add an IP to the blocklist
BLOCK() {

    checkValidIP
    local max_CIDR=24
    checkCIDR "${max_CIDR}"
    setupBlockedIpset

    if checkInIpset "blocklist"; then
        echo -e "\033[1;34m[INFO]\033[0m IP ${IPADDY} is already blocked."
        exit
    fi

    checkWhitelistedCompany
    if checkInIpset "client"; then
        echo -e "\033[1;34m[INFO]\033[0m IP ${IPADDY} is whitelisted, skipping block."
        exit 
    fi

    firewall-cmd --permanent --ipset=blocklist --add-entry="${IPADDY}" >/dev/null || { echo "[ERROR] Failed to block the IP: ${IPADDY}"; exit 1; }
    firewall-cmd --reload >/dev/null || { echo "[ERROR] Failed to reload firewalld"; exit 1; }

    echo -e "\033[1;32m[OK]\033[0m IP ${IPADDY} has been successfully blocked."

}    


# Remove an IP from the blocklist
UNBLOCK() {

    checkValidIP
    local max_CIDR=24
    checkCIDR "${max_CIDR}"
    setupBlockedIpset

    if ! checkInIpset "blocklist"; then
        echo -e "\033[1;34m[INFO]\033[0m IP ${IPADDY} is not blocked."
        exit
    fi

    firewall-cmd --permanent --ipset=blocklist --remove-entry="${IPADDY}" >/dev/null || { echo -e "\033[1;31m[ERROR]\033[0m Failed to unblock the IP: ${IPADDY}"; exit 1; }
    firewall-cmd --reload >/dev/null || { echo -e "\033[1;31m[ERROR]\033[0m Failed to reload firewalld"; exit 1; }

    echo -e "\033[1;32m[OK]\033[0m IP ${IPADDY} has been successfully unblocked."

}


# Show whitelisted and blocked IP addresses
LIST() {

    echo "Whitelisted IPs:"
    firewall-cmd --permanent --ipset=client --get-entries || { echo -e "\033[1;31m[ERROR]\033[0m Could not get the list of whitelisted IPs"; exit 1; }

    echo

    setupBlockedIpset
    echo "Blocked IPs:"
    firewall-cmd --permanent --ipset=blocklist --get-entries || { echo -e "\033[1;31m[ERROR]\033[0m Could not get the list of blocked IPs"; exit 1; }
    
}


# Display help/usage information
HELP () {
    echo "A tool for managing firewalld IP whitelists and blocklists"
    echo "Usage: mjact_fw -a <action (add/remove/block/unblock/list)> -i <IP>"
}


# Ensure the script is run as root
if [ "$(whoami)" != 'root' ];then
    echo -e "\033[1;31m[ERROR]\033[0m You must execute this script as the root user!"
    exit 1
fi

# Ensure the firewalld is running
if ! systemctl is-active --quiet firewalld; then
    echo -e "\033[1;31m[ERROR]\033[0m firewalld service is not active."
    exit 1
fi

if [[ "${1}" == "" ]] || [[ "${1}" == "-h" ]] || [[ "${1}" == "--help" ]]
then
    HELP
    exit
else
    while getopts ":a:i:" OPTION
        do
            case "${OPTION}" in
                a) ACTION="${OPTARG}" ;;
                i) IPADDY="${OPTARG}" ;;
		:) echo "[ERROR] Option -${OPTARG} requires an argument"; exit 1 ;;
		\?) echo "[ERROR] Unknown option: -${OPTARG}"; exit 1 ;;
            esac
       done
fi

case "${ACTION}" in
    add) ADD ;;
    remove) REMOVE ;;
    block) BLOCK ;;
    unblock) UNBLOCK ;;
    list) LIST ;;
    *) echo -e "\033[1;31m[ERROR]\033[0m Invalid action!"; exit 1 ;;
esac