RemoveOldBlockedIps.csx

using System;
using System.Configuration;

public static void Run(TimerInfo myTimer, TraceWriter log)
{
    log.Info($"C# Timer trigger function executed at: {DateTime.Now}");
    RemoveIpBlocks(log).Wait();
}

static async Task RemoveIpBlocks(TraceWriter log)
{
  var zoneId = ConfigurationManager.AppSettings["ZoneId"];
  var xAuthEmail = ConfigurationManager.AppSettings["X-Auth-Email"];
  var xAuthKey = ConfigurationManager.AppSettings["X-Auth-Key"];

  var path = $"/client/v4/zones/{zoneId}/firewall/access_rules/rules?per_page=100";
  using (var client = new HttpClient())
  {
    client.BaseAddress = new Uri("https://api.cloudflare.com");
    client.DefaultRequestHeaders.Accept.Clear();
    client.DefaultRequestHeaders.Add("X-Auth-Email", xAuthEmail);
    client.DefaultRequestHeaders.Add("X-Auth-Key", xAuthKey);

    var response = await client.GetAsync(path);
    if (response.IsSuccessStatusCode)
    {
      var firewallRules = await response.Content.ReadAsAsync<dynamic>();
      foreach (var firewallRule in firewallRules.result)
      {
        var notes = firewallRule.notes.ToString();
        if (notes.StartsWith("rate-limit-abuse-"))
        {
          var dateString = notes.Replace("rate-limit-abuse-", string.Empty);
          var ruleCreated = DateTime.Parse(dateString);
          var ruleDescription = $"IP {firewallRule.configuration.value} added on {ruleCreated.ToString("s")} -";

          // Delete rules that were created more than a day ago
          if (ruleCreated < DateTime.UtcNow.AddDays(-1))
          {
            path = $"/client/v4/zones/{zoneId}/firewall/access_rules/rules/{firewallRule.id}";
            await client.DeleteAsync(path);
            log.Info($"{ruleDescription} deleted");
          }
          else
          {
            log.Info($"{ruleDescription} not old enough");
          }
        }
      }
    }
  }
}