Skip to content

Commit 4fba8c8

Browse files
enoch85enoch85
authored
Rewrite Geoblock (use new mmdb) (#2675)
1 parent 5e7d183 commit 4fba8c8

File tree

3 files changed

+143
-93
lines changed

3 files changed

+143
-93
lines changed

‎lib.sh‎

Lines changed: 29 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,10 @@ nc_update() {
134134
NCBAD=$((NCMAJOR-2))
135135
NCNEXT="$((${CURRENTVERSION%%.*}+1))"
136136
}
137+
maxmind_geoip() {
138+
# shellcheck source=/dev/null
139+
source <(curl -sL https://shortio.hanssonit.se/t3vm7ro4CP)
140+
}
137141
# Set the hour for automatic updates. This would be 18:00 as only the hour is configurable.
138142
AUT_UPDATES_TIME="18"
139143
# Keys
@@ -149,6 +153,9 @@ HTTP_CONF="nextcloud_http_domain_self_signed.conf"
149153
# Collabora App
150154
HTTPS_CONF="$SITES_AVAILABLE/$SUBDOMAIN.conf"
151155
HTTP2_CONF="/etc/apache2/mods-available/http2.conf"
156+
# GeoBlock
157+
GEOBLOCK_MOD_CONF="/etc/apache2/conf-available/geoblock.conf"
158+
GEOBLOCK_MOD="/etc/apache2/mods-available/maxminddb.load"
152159
# PHP-FPM
153160
PHPVER=8.3
154161
PHP_FPM_DIR=/etc/php/$PHPVER/fpm
@@ -394,55 +401,31 @@ curl "https://api.metadefender.com/v4/hash/$hash" -H "apikey: $apikey"
394401
}
395402

396403
# Used in geoblock.sh
397-
download_geoip_dat() {
398-
# 1 = IP version 4 or 6
399-
# 2 = v4 or v6
400-
if site_200 https://dl.miyuru.lk/geoip/maxmind/country/maxmind"$1".dat.gz
401-
then
402-
curl_to_dir https://dl.miyuru.lk/geoip/maxmind/country maxmind"$1".dat.gz /tmp
403-
# Scan file for virus
404-
if ! metadefender-scan /tmp/maxmind"$1".dat.gz | grep '"scan_all_result_a":"No Threat Detected","current_av_result_a":"No Threat Detected"'
404+
download_geoip_mmdb() {
405+
maxmind_geoip
406+
export MwKfcYATm43NMT
407+
export i9HL69SLnp4ymy
408+
{
409+
echo "GEOIPUPDATE_ACCOUNT_ID=$MwKfcYATm43NMT"
410+
echo "GEOIPUPDATE_LICENSE_KEY=$i9HL69SLnp4ymy"
411+
echo "GEOIPUPDATE_EDITION_IDS=GeoLite2-City GeoLite2-Country"
412+
echo "GEOIPUPDATE_FREQUENCY=0"
413+
echo "GEOIPUPDATE_PRESERVE_FILE_TIMES=1"
414+
echo "GEOIPUPDATE_VERBOSE=1"
415+
} > /tmp/dockerenv
416+
unset MwKfcYATm43NMT
417+
unset i9HL69SLnp4ymy
418+
install_docker
419+
if docker run --name maxmind --env-file /tmp/dockerenv -v /usr/share/GeoIP:/usr/share/GeoIP ghcr.io/maxmind/geoipupdate
405420
then
406-
msg_box "Potential threat found in /tmp/maxmind$1.dat.gz! Please report this to $ISSUES. We will now delete the file!"
407-
rm -f /tmp/maxmind"$1".dat.gz
421+
docker rm -f maxmind
422+
rm -f /tmp/dockerenv
408423
else
409-
install_if_not gzip
410-
gzip -d /tmp/maxmind"$1".dat.gz
411-
mv /tmp/maxmind"$1".dat /usr/share/GeoIP/GeoIP"$2".dat
412-
chown root:root /usr/share/GeoIP/GeoIP"$2".dat
413-
chmod 644 /usr/share/GeoIP/GeoIP"$2".dat
414-
find "$SCRIPTS" -type f -regex "$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IP$2\.dat" -delete
415-
rm -f /usr/share/GeoIP/GeoIP.dat
416-
fi
417-
fi
418-
}
419-
420-
get_newest_dat_files() {
421-
# Check current month and year
422-
CURR_MONTH="$(date +%B)"
423-
# https://stackoverflow.com/a/12487455
424-
CURR_MONTH="${CURR_MONTH^}"
425-
CURR_YEAR="$(date +%Y)"
426-
427-
# Check latest updated
428-
if site_200 https://www.miyuru.lk/geoiplegacy
429-
then
430-
if curl -s https://www.miyuru.lk/geoiplegacy | grep -q "$CURR_MONTH $CURR_YEAR"
431-
then
432-
# DIFF local file with month from curl
433-
# This is to know if the online file is the same month as the local file
434-
LOCAL_FILE_TIMESTAMP=$(date -r /usr/share/GeoIP/GeoIPv4.dat "+%B %Y")
435-
LOCAL_FILE_TIMESTAMP="${LOCAL_FILE_TIMESTAMP^}"
436-
ONLINE_FILE_TIMESTAMP="$CURR_MONTH $CURR_YEAR"
437-
if [ "$ONLINE_FILE_TIMESTAMP" != "$LOCAL_FILE_TIMESTAMP" ]
438-
then
439-
# IPv4
440-
download_geoip_dat "4" "v4"
441-
# IPv6
442-
download_geoip_dat "6" "v6"
443-
fi
424+
docker rm -f maxmind
425+
rm -f /tmp/dockerenv
426+
msg_box "Update limit for Maxmind GeoDatabase reached! Please try again tomorrow."
427+
return 1
444428
fi
445-
fi
446429
}
447430

448431
# Check if process is runnnig: is_process_running dpkg

‎network/geoblock.sh‎

Lines changed: 99 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Geoblock can break the certificate renewal via \"Let's encrypt!\" if done too st
1111
If you have problems with \"Let's encrypt!\", please uninstall geoblock first to see if that fixes those issues!"
1212
# shellcheck source=lib.sh
1313
source /var/scripts/fetch_lib.sh
14+
# source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/geoblock-v2/lib.sh) # TODO, remove after testing
1415

1516
# Check for errors + debug code and abort if something isn't right
1617
# 1 = ON
@@ -22,41 +23,89 @@ debug_mode
2223
root_check
2324

2425
# Check if it is already configured
25-
if ! grep -q "^#Geoip-block" /etc/apache2/apache2.conf
26+
if [ ! -f "$GEOBLOCK_MOD_CONF" ] || [ ! -f "$GEOBLOCK_MOD" ]
2627
then
2728
# Ask for installing
2829
install_popup "$SCRIPT_NAME"
2930
else
3031
# Ask for removal or reinstallation
3132
reinstall_remove_menu "$SCRIPT_NAME"
32-
# Removal
33+
# Remove Apache mod config
34+
rm -f "$GEOBLOCK_MOD_CONF"
35+
# Remove old database files
3336
find /var/scripts -type f -regex \
3437
"$SCRIPTS/202[0-9]-[01][0-9]-Maxmind-Country-IPv[46]\.dat" -delete
38+
# Remove Apache2 mod
39+
if [ -f "$GEOBLOCK_MOD" ]
40+
then
41+
a2dismod maxminddb
42+
rm -f "$GEOBLOCK_MOD"
43+
rm -f /usr/lib/apache2/modules/mod_maxminddb.so
44+
fi
3545
if is_this_installed libapache2-mod-geoip
3646
then
3747
a2dismod geoip
3848
apt-get purge libapache2-mod-geoip -y
39-
rm -rf /usr/share/GeoIP
4049
fi
41-
apt-get autoremove -y
42-
sed -i "/^#Geoip-block-start/,/^#Geoip-block-end/d" /etc/apache2/apache2.conf
43-
check_command systemctl restart apache2
50+
# Remove PPA
51+
if grep ^ /etc/apt/sources.list /etc/apt/sources.list.d/* | grep maxmind-ubuntu-ppa
52+
then
53+
install_if_not ppa-purge
54+
yes | ppa-purge maxmind/ppa
55+
rm -f /etc/apt/sources.list.d/maxmind*
56+
fi
57+
# Remove Apache config
58+
if grep "Geoip-block-start" /etc/apache2/apache2.conf
59+
then
60+
sed -i "/^#Geoip-block-start/,/^#Geoip-block-end/d" /etc/apache2/apache2.conf
61+
fi
62+
if [ -f "$GEOBLOCK_MOD_CONF" ]
63+
then
64+
a2disconf geoblock
65+
rm -f "$GEOBLOCK_MOD_CONF"
66+
fi
4467
# Show successful uninstall if applicable
4568
removal_popup "$SCRIPT_NAME"
69+
# Make sure it's clean from unused packages and files
70+
apt purge libmaxminddb0* libmaxminddb-dev* mmdb-bin* apache2-dev* -y
71+
apt autoremove -y
72+
#rm -rf /usr/share/GeoIP keep these to save downloads...
73+
check_command systemctl restart apache2
4674
fi
4775

48-
# Install needed tools
49-
install_if_not libapache2-mod-geoip
76+
# Download GeoIP Databases
77+
if ! download_geoip_mmdb
78+
then
79+
exit 1
80+
fi
5081

51-
# Enable apache mod
52-
check_command a2enmod geoip rewrite
53-
check_command systemctl restart apache2
82+
##### GeoIP script (Apache Setup)
83+
# Install requirements
84+
yes | add-apt-repository ppa:maxmind/ppa
85+
install_if_not libmaxminddb0
86+
install_if_not libmaxminddb-dev
87+
install_if_not mmdb-bin
88+
install_if_not apache2-dev
5489

55-
# Download newest dat files
56-
# IPv4
57-
download_geoip_dat "4" "v4"
58-
# IPv6
59-
download_geoip_dat "6" "v6"
90+
# maxminddb_module https://github.com/maxmind/mod_maxminddb
91+
cd /tmp
92+
curl_to_dir https://github.com/maxmind/mod_maxminddb/releases/download/1.2.0/ mod_maxminddb-1.2.0.tar.gz /tmp
93+
tar -xzf mod_maxminddb-1.2.0.tar.gz
94+
cd mod_maxminddb-1.2.0
95+
if ./configure
96+
then
97+
make install
98+
if ! apachectl -M | grep -i "maxminddb"
99+
then
100+
msg_box "Couldn't install the Apache module for MaxMind. Please report this to $ISSUES"
101+
exit 1
102+
fi
103+
# Cleanup
104+
rm -rf mod_maxminddb-1.2.0 mod_maxminddb-1.2.0.tar.gz
105+
fi
106+
107+
check_command a2enmod rewrite remoteip maxminddb
108+
check_command systemctl restart apache2
60109

61110
# Restrict to countries and/or continents
62111
choice=$(whiptail --title "$TITLE" --checklist \
@@ -160,24 +209,35 @@ then
160209
mapfile -t choice <<< "$choice"
161210
fi
162211

163-
GEOIP_CONF="#Geoip-block-start - Please don't remove or change this line
164-
<IfModule mod_geoip.c>
165-
GeoIPEnable On
166-
GeoIPDBFile /usr/share/GeoIP/GeoIPv4.dat
167-
GeoIPDBFile /usr/share/GeoIP/GeoIPv6.dat
212+
# Create conff
213+
cat << GEOBLOCKCONF_CREATE > "$GEOBLOCK_MOD_CONF"
214+
<IfModule mod_maxminddb.c>
215+
MaxMindDBEnable On
216+
MaxMindDBFile DB /usr/share/GeoIP/GeoLite2-Country.mmdb
217+
218+
MaxMindDBEnv MM_CONTINENT_CODE DB/continent/code
219+
MaxMindDBEnv MM_COUNTRY_CODE DB/country/iso_code
168220
</IfModule>
169-
<Location />\n"
221+
222+
# Geoblock rules
223+
GEOBLOCKCONF_CREATE
224+
225+
# Add <Location> parameters to maxmind conf
226+
echo "<Location />" >> "$GEOBLOCK_MOD_CONF"
170227
for continent in "${choice[@]}"
171228
do
172-
GEOIP_CONF+=" SetEnvIf GEOIP_CONTINENT_CODE $continent AllowCountryOrContinent\n"
173-
GEOIP_CONF+=" SetEnvIf GEOIP_CONTINENT_CODE_V6 $continent AllowCountryOrContinent\n"
229+
echo " SetEnvIf MM_CONTINENT_CODE $continent AllowCountryOrContinent" >> "$GEOBLOCK_MOD_CONF"
174230
done
175231
for country in "${selected_options[@]}"
176232
do
177-
GEOIP_CONF+=" SetEnvIf GEOIP_COUNTRY_CODE $country AllowCountryOrContinent\n"
178-
GEOIP_CONF+=" SetEnvIf GEOIP_COUNTRY_CODE_V6 $country AllowCountryOrContinent\n"
233+
echo " SetEnvIf MM_COUNTRY_CODE $country AllowCountryOrContinent" >> "$GEOBLOCK_MOD_CONF"
179234
done
180-
GEOIP_CONF+=" Allow from env=AllowCountryOrContinent
235+
echo " Allow from env=AllowCountryOrContinent" >> "$GEOBLOCK_MOD_CONF"
236+
237+
# Add allow rules to maxmind conf
238+
cat << GEOBLOCKALLOW_CREATE >> "$GEOBLOCK_MOD_CONF"
239+
240+
# Specifically allow this
181241
Allow from 127.0.0.1/8
182242
Allow from 192.168.0.0/16
183243
Allow from 172.16.0.0/12
@@ -188,13 +248,18 @@ GEOIP_CONF+=" Allow from env=AllowCountryOrContinent
188248
Order Deny,Allow
189249
Deny from all
190250
</Location>
191-
#Geoip-block-end - Please don't remove or change this line"
192251
193-
# Write everything to the file
194-
echo -e "$GEOIP_CONF" >> /etc/apache2/apache2.conf
195-
196-
check_command systemctl restart apache2
252+
# Logs
253+
LogLevel info
254+
CustomLog "$VMLOGS/geoblock_access.log" common
255+
GEOBLOCKALLOW_CREATE
197256

198-
msg_box "GeoBlock was successfully configured"
257+
# Enable config
258+
check_command a2enconf geoblock
199259

200-
exit
260+
if check_command systemctl restart apache2
261+
then
262+
msg_box "GeoBlock was successfully configured"
263+
else
264+
msg_box "Something went wrong, please check Apache error logs."
265+
fi

‎nextcloud_update.sh‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -579,22 +579,24 @@ then
579579
mv "$ADMINERDIR"/adminer-pgsql.php "$ADMINERDIR"/adminer.php
580580
fi
581581

582-
# Get newest dat files for geoblock.sh
582+
# Get latest Maxmind databse for Geoblock
583583
if grep -q "^#Geoip-block" /etc/apache2/apache2.conf
584584
then
585-
if get_newest_dat_files
585+
if grep -c GeoIPDBFile /etc/apache2/apache2.conf
586586
then
587-
if grep -c GeoIP.dat /etc/apache2/apache2.conf
588-
then
589-
if [ ! -f /usr/share/GeoIP/GeoIPv4.dat ]
590-
then
591-
if download_geoip_dat 4 v4
592-
then
593-
sed -i "s|GeoIPDBFile /usr/share/GeoIP/GeoIP.dat|GeoIPDBFile /usr/share/GeoIP/GeoIPv4.dat|g" /etc/apache2/apache2.conf
594-
fi
595-
fi
596-
fi
597-
check_command systemctl restart apache2
587+
msg_box "We have updated GeoBlock to a new version which isn't compatible with the old one. Please reinstall with the menu script to get the latest version."
588+
notify_admin_gui \
589+
"GeoBlock needs to be reinstalled!" \
590+
"We have updated GeoBlock to a new version which isn't compatible with the old one.
591+
Please reinstall with the menu script to get the latest version.
592+
593+
sudo bash /ar/scripts/menu.sh --> Server Configuration --> GeoBlock"
594+
fi
595+
elif [ -f "$GEOBLOCK_MOD" ]
596+
then
597+
if download_geoip_mmdb
598+
then
599+
print_text_in_color "IGreen" "MaxMind database updated!"
598600
fi
599601
fi
600602

0 commit comments

Comments
 (0)