diff mbox series

[2/2] ipblocklist-sources: Update to include the Abuse.ch Botnet C2 ip blocklist

Message ID 20240624151039.51194-2-adolf.belka@ipfire.org
State Staged
Commit e9e78d2aff0a90d4551e20c7d7d5e01aa8d6ef1a
Headers
Series [1/2] ipblocklist-sources: Update to include the 3CORESec ip blocklists |

Commit Message

Adolf Belka June 24, 2024, 3:10 p.m. UTC 
  - Blocklist addition was discussed and agreed at IPFire dev conf call in June 2024.
- Tested on vm system.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/ipblocklist/sources | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Comments

Charles Brown July 3, 2024, 12:59 p.m. UTC | #1 
Hi Adolf & Stefan,

I noticed some indentation inconsistencies in this ipblocklist sources 
fie -- some old, some new with this commit.
Here is my (perhaps naive) attempt to patch the indentation issues.
---

diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index 1cef06dd1..eefd1a8d5 100644
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -36,14 +36,15 @@

  package IPblocklist::List;

-our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats 
Blocklist',
+our %sources = (
+             'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats 
Blocklist',
                                      'url'      => 
'https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt',
                                      'info'     => 
'https://doc.emergingthreats.net/bin/view/Main/EmergingFirewallRules',
                                      'parser'   => 'ip-or-net-list',
                                      'rate'     => '1h',
                                      'category' => 'composite',
                                      'disable'  => 
['FEODO_RECOMMENDED', 'FEODO_IP', 'FEODO_AGGRESSIVE', 'SPAMHAUS_DROP', 
'DSHIELD'] },
-             'EMERGING_COMPROMISED' => { 'name' => 'Emerging Threats 
Compromised IPs',
+        'EMERGING_COMPROMISED' => { 'name' => 'Emerging Threats 
Compromised IPs',
                                      'url'      => 
'https://rules.emergingthreats.net/blockrules/compromised-ips.txt',
                                      'info'     => 
'https://doc.emergingthreats.net/bin/view/Main/CompromisedHost',
                                      'parser'   => 'ip-or-net-list',
@@ -74,7 +75,7 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 
'Emerging Threats Blocklis
                                      'rate'     => '5m',
                                      'category' => 'c and c',
                                      'disable'  => 'FEODO_RECOMMENDED' },
-             'FEODO_AGGRESSIVE' => { 'name'     => 'Feodo Trojan IP 
Blocklist (Aggressive)',
+            'FEODO_AGGRESSIVE' => { 'name'     => 'Feodo Trojan IP 
Blocklist (Aggressive)',
                                      'url'      => 
'https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.txt',
                                      'info'     => 
'https://feodotracker.abuse.ch/blocklist',
                                      'parser'   => 'ip-or-net-list',
@@ -126,27 +127,27 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     
=> 'Emerging Threats Blocklis
                                      'rate'     => '30m',
                                      'category' => 'attacker' },
               '3CORESEC_SSH'    => { 'name'     => '3CORESec SSH 
Activity Blocklist',
-                    'url'      => 
'https://blacklist.3coresec.net/lists/ssh.txt',
-                    'info'     => 'https://blacklist.3coresec.net',
-                    'parser'   => 'ip-or-net-list',
-                    'rate'     => '1d',
-                    'category' => 'attacker' },
+                                    'url'      => 
'https://blacklist.3coresec.net/lists/ssh.txt',
+                                    'info'     => 
'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
               '3CORESEC_SCAN'   => { 'name'     => '3CORESec Scan and 
IDS Blocklist',
-                    'url'      => 
'https://blacklist.3coresec.net/lists/misc.txt',
-                    'info'     => 'https://blacklist.3coresec.net',
-                    'parser'   => 'ip-or-net-list',
-                    'rate'     => '1d',
-                    'category' => 'reputation' },
-         '3CORESEC_WEB'    => { 'name'     => '3CORESec Web Server 
Activity Blocklist',
-                    'url'      => 
'https://blacklist.3coresec.net/lists/http.txt',
-                    'info'     => 'https://blacklist.3coresec.net',
-                    'parser'   => 'ip-or-net-list',
-                    'rate'     => '1d',
-                    'category' => 'attacker' },
-         'ABUSECH_BOTNETC2'  => { 'name'   => 'ABUSE.ch Botnet C2 IP 
Blocklist',
-                      'url'    => 
'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt',
-                      'info'   => 
'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv',
-                      'parser' => 'ip-or-net-list',
-                      'rate'   => '5m',
-                      'category'   => 'reputation' }
+                                    'url'      => 
'https://blacklist.3coresec.net/lists/misc.txt',
+                                    'info'     => 
'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'reputation' },
+          '3CORESEC_WEB'       => { 'name'     => '3CORESec Web Server 
Activity Blocklist',
+                                    'url'      => 
'https://blacklist.3coresec.net/lists/http.txt',
+                                    'info'     => 
'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
+          'ABUSECH_BOTNETC2'   => { 'name'   => 'ABUSE.ch Botnet C2 IP 
Blocklist',
+                                    'url'    => 
'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt',
+                                    'info'   => 
'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv',
+                                    'parser' => 'ip-or-net-list',
+                                    'rate'   => '5m',
+                                    'category'   => 'reputation' }
             );
Charles Brown July 3, 2024, 1:03 p.m. UTC | #2 
Ugh,  obviously I do not know how to get my mail client to send this 
without making a mess of the patch text 🙁
Charles Brown July 3, 2024, 2:06 p.m. UTC | #3 
Okay, if this doesn't work, I'll stop bother you with this 🙂
---
diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index 1cef06dd1..eefd1a8d5 100644
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -36,14 +36,15 @@

  package IPblocklist::List;

-our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklist',
+our %sources = (
+             'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklist',
                                      'url'      => 'https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt',
                                      'info'     => 'https://doc.emergingthreats.net/bin/view/Main/EmergingFirewallRules',
                                      'parser'   => 'ip-or-net-list',
                                      'rate'     => '1h',
                                      'category' => 'composite',
                                      'disable'  => ['FEODO_RECOMMENDED', 'FEODO_IP', 'FEODO_AGGRESSIVE', 'SPAMHAUS_DROP', 'DSHIELD'] },
-             'EMERGING_COMPROMISED' => { 'name' => 'Emerging Threats Compromised IPs',
+        'EMERGING_COMPROMISED' => { 'name' => 'Emerging Threats Compromised IPs',
                                      'url'      => 'https://rules.emergingthreats.net/blockrules/compromised-ips.txt',
                                      'info'     => 'https://doc.emergingthreats.net/bin/view/Main/CompromisedHost',
                                      'parser'   => 'ip-or-net-list',
@@ -74,7 +75,7 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
                                      'rate'     => '5m',
                                      'category' => 'c and c',
                                      'disable'  => 'FEODO_RECOMMENDED' },
-             'FEODO_AGGRESSIVE' => { 'name'     => 'Feodo Trojan IP Blocklist (Aggressive)',
+            'FEODO_AGGRESSIVE' => { 'name'     => 'Feodo Trojan IP Blocklist (Aggressive)',
                                      'url'      => 'https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.txt',
                                      'info'     => 'https://feodotracker.abuse.ch/blocklist',
                                      'parser'   => 'ip-or-net-list',
@@ -126,27 +127,27 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
                                      'rate'     => '30m',
                                      'category' => 'attacker' },
               '3CORESEC_SSH'    => { 'name'     => '3CORESec SSH Activity Blocklist',
-                    'url'      => 'https://blacklist.3coresec.net/lists/ssh.txt',
-                    'info'     => 'https://blacklist.3coresec.net',
-                    'parser'   => 'ip-or-net-list',
-                    'rate'     => '1d',
-                    'category' => 'attacker' },
+                                    'url'      => 'https://blacklist.3coresec.net/lists/ssh.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
               '3CORESEC_SCAN'   => { 'name'     => '3CORESec Scan and IDS Blocklist',
-                    'url'      => 'https://blacklist.3coresec.net/lists/misc.txt',
-                    'info'     => 'https://blacklist.3coresec.net',
-                    'parser'   => 'ip-or-net-list',
-                    'rate'     => '1d',
-                    'category' => 'reputation' },
-         '3CORESEC_WEB'    => { 'name'     => '3CORESec Web Server Activity Blocklist',
-                    'url'      => 'https://blacklist.3coresec.net/lists/http.txt',
-                    'info'     => 'https://blacklist.3coresec.net',
-                    'parser'   => 'ip-or-net-list',
-                    'rate'     => '1d',
-                    'category' => 'attacker' },
-         'ABUSECH_BOTNETC2'  => { 'name'   => 'ABUSE.ch Botnet C2 IP Blocklist',
-                      'url'    => 'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt',
-                      'info'   => 'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv',
-                      'parser' => 'ip-or-net-list',
-                      'rate'   => '5m',
-                      'category'   => 'reputation' }
+                                    'url'      => 'https://blacklist.3coresec.net/lists/misc.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'reputation' },
+          '3CORESEC_WEB'       => { 'name'     => '3CORESec Web Server Activity Blocklist',
+                                    'url'      => 'https://blacklist.3coresec.net/lists/http.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
+          'ABUSECH_BOTNETC2'   => { 'name'   => 'ABUSE.ch Botnet C2 IP Blocklist',
+                                    'url'    => 'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt',
+                                    'info'   => 'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv',
+                                    'parser' => 'ip-or-net-list',
+                                    'rate'   => '5m',
+                                    'category'   => 'reputation' }
             );
diff mbox series

Patch

diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index 69f964dd9..1cef06dd1 100644
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -142,5 +142,11 @@  our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
 					 'info'     => 'https://blacklist.3coresec.net',
 					 'parser'   => 'ip-or-net-list',
 					 'rate'     => '1d',
-					 'category' => 'attacker' }
+					 'category' => 'attacker' },
+	      'ABUSECH_BOTNETC2'  => { 'name'	=> 'ABUSE.ch Botnet C2 IP Blocklist',
+					   'url'	=> 'https://sslbl.abuse.ch/blacklist/sslipblacklist.txt',
+					   'info'	=> 'https://sslbl.abuse.ch/blacklist#botnet-c2-ips-csv',
+					   'parser'	=> 'ip-or-net-list',
+					   'rate'	=> '5m',
+					   'category'	=> 'reputation' }
            );