Join the Nethesis Insights threat shield - #1887
Draft
gsanchietti wants to merge 3 commits into
Draft
Conversation
The log service had no way to notify anything outside banIP when it blocked an IP: the only signal was the syslog line written by f_log. Add the ban_blockhook option: if it points to an executable, f_monitor calls it once for every IP it adds to a blocklist Set, passing the address, the protocol family, the log count that triggered the block and the Set expiry. The call is fire and forget and never affects the control flow of the monitor loop, which stays single threaded: the hook is expected to queue the event and to do any real work elsewhere. Assisted-by: Claude Code:claude-opus-5[1m]
Every firewall blocks the attackers it sees on its own, and the fleet has no shared memory of them. Report what the banIP log service blocks to the Nethesis Insights server and block back the list it aggregates from the reports of all the registered firewalls. Reporting side: ts-ip points banip.global.ban_blockhook at ts-insights-hook, which only appends a JSON decision to /var/run/ns-insights, so that a burst of blocked IPs never slows down the banIP log service. ts-insights-report sends the spooled events to POST /v1/threat-events every 5 minutes, in batches of at most 500, authenticating with the subscription credentials. Only globally routable addresses leave the firewall: private, CGNAT, link-local, reserved and documentation ranges are dropped locally, along with the events older than the promotion window of the server. A failed push keeps the events in the spool and retries at the next run, the server discards the duplicated reports. Blocking side: the new nethesisinsights feed points to GET /v1/blocklist, so banIP downloads it as any other enterprise feed, with its own ETag handling and its own fallback to the last good copy. Both directions are enabled by the machine registration alone and are removed on unregistration; a uci-default takes care of the units which are already registered when the image is updated. Assisted-by: Claude Code:claude-opus-5[1m]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Firewalls block the attackers they see on their own, and the fleet never learns from them. Now the IPs blocked by the banIP log service are reported to the Nethesis Insights server, and the list it builds from the reports of all registered firewalls is blocked back locally.
banIP gained a
ban_blockhookoption for this: a script called once for every newly blocked IP. It only queues the event, a cron job sends it in batches, and only public addresses ever leave the firewall. The list comes back as a normal banIP feed (nethesisinsights).Everything is enabled by the machine registration alone, and removed on unregistration.
How to test
On a registered unit with threat shield IP enabled:
uci get banip.global.ban_blockhookreturns/usr/libexec/ts-insights-hooklogger "Exit before auth from 45.33.32.156"three times, then check the IP is innft list set inet banIP blocklist.v4and a line appeared in/var/run/ns-insights/threat-events.jsonl/usr/sbin/ts-insights-report, then check/var/run/ns-insights/last_push.jsonand the syslog line192.168.1.50: blocked locally, never reported/etc/init.d/banip reload, then/etc/init.d/banip statuslists thenethesisinsightsfeed