vbatts
/
shadowsocks
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

use list instead of string, prevent injection attack. (#1009) 

* fix issue:
https://github.com/shadowsocks/shadowsocks/issues/995
Command Execution

use list instead of string, prevent injection attack.
This commit is contained in:
Shell.Xu 2018-02-19 10:42:32 +08:00 committed by mengskysama
parent c668f44c68
commit e332ec93e9
1 changed files with 28 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
utils/autoban.py
View File

@ -24,9 +24,17 @@
from __future__ import absolute_import, division, print_function, \ from __future__ import absolute_import, division, print_function, \
with_statement with_statement
import os
import sys import sys
import socket
import argparse import argparse
import subprocess
def inet_pton(str_ip):
try:
return socket.inet_pton(socket.AF_INET, str_ip)
except socket.error:
return None
if __name__ == '__main__': if __name__ == '__main__':
parser = argparse.ArgumentParser(description='See README') parser = argparse.ArgumentParser(description='See README')
@ -37,17 +45,22 @@ if __name__ == '__main__':
ips = {} ips = {}
banned = set() banned = set()
for line in sys.stdin: for line in sys.stdin:
if 'can not parse header when' in line: if 'can not parse header when' not in line:
ip = line.split()[-1].split(':')[-2] continue
ip_str = line.split()[-1].rsplit(':', 1)[0]
ip = inet_pton(ip_str)
if ip is None:
continue
if ip not in ips: if ip not in ips:
ips[ip] = 1 ips[ip] = 1
print(ip)
sys.stdout.flush() sys.stdout.flush()
else: else:
ips[ip] += 1 ips[ip] += 1
if ip not in banned and ips[ip] >= config.count: if ip not in banned and ips[ip] >= config.count:
banned.add(ip) banned.add(ip)
cmd = 'iptables -A INPUT -s %s -j DROP' % ip print('ban ip %s' % ip_str)
print(cmd, file=sys.stderr) cmd = ['iptables', '-A', 'INPUT', '-s', ip_str, '-j', 'DROP',
'-m', 'comment', '--comment', 'autoban']
print(' '.join(cmd), file=sys.stderr)
sys.stderr.flush() sys.stderr.flush()
os.system(cmd) subprocess.call(cmd)