Null-route handling script with blacklist support

nullroute.sh

#!/bin/sh

# MIT License
#
# Copyright (c) 2018 Michele Damiano Torelli
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

BLACKLIST="/tmp/blacklist.txt"
BLACKLIST_URL="https://lists.blocklist.de/lists/all.txt"
ACTION="blackhole" # blackhole or reject
LOOPBACK_IP="127.0.0.2"

add_null_route() {
	local IP=${1}; shift;

	route -q add -net ${IP} ${LOOPBACK_IP} -${ACTION}
}

del_null_route() {
	local IP=${1}; shift;

	route -q delete ${IP}
}

show_null_routes() {
	netstat -rn | grep "SB " | awk '{print $1}'
}

count_null_routes() {
	local COUNT=$(show_null_routes | wc -l | awk '{print $1}')

	echo ${COUNT}
}

load_null_routes() {
	if [ ! -r ${BLACKLIST} ]; then
		echo "Unable to read ${BLACKLIST}"
		exit 1
	fi

	local COUNT=0

	for IP in $(cat ${BLACKLIST} | grep -Ev '^\s*$'); do
		add_null_route ${IP}
		COUNT=$((COUNT + 1))
	done

	echo "Blacklisted ${COUNT} records"  
}

dump_null_routes() {
	show_null_routes > ${BLACKLIST} && \
	echo "Blacklist dumped to ${BLACKLIST}"
}

fetch_blacklist() {
	curl -Lso ${BLACKLIST} ${BLACKLIST_URL} && \
	echo "Blacklist saved to ${BLACKLIST}"
}

flush_null_routes() {
	local COUNT=0

	for IP in $(netstat -rn | grep "SB " | awk '{print $1}'); do
		del_null_route ${IP}
		COUNT=$((COUNT + 1))
	done	

	echo "Flushed ${COUNT} records"
}

help() {
	echo "$0 [ add <cidr_address> | del <cidr_address> | show | count | load | dump | fetch | flush | update ]"
}

if [ $# -lt 1 ]; then
	help
	exit 1
fi

case ${1} in
	add)
		if [ -z ${2} ]; then
			help
			exit 1
		fi
		add_null_route ${2}
		;;
	del)
		if [ -z ${2} ]; then
			help
			exit 1
		fi
		del_null_route ${2}
		;;
	show)
		show_null_routes
		;;
	count)
		count_null_routes
		;;
	load)
		load_null_routes
		;;
	dump)
		dump_null_routes
		;;
	fetch)
		fetch_blacklist
		;;
	flush)
		flush_null_routes
		;;
	update)
		fetch_blacklist && \
		flush_null_routes && \
		load_null_routes
		;;
	*)
		help
		;;
esac