From 3965914f6fb1b7205640f90ff5ff5c7dd48f53d5 Mon Sep 17 00:00:00 2001
From: Ruslan Piatrovich <Ruslan.Petrovich_ext@leroymerlin.ru>
Date: Fri, 23 Aug 2024 12:30:26 +0300
Subject: [PATCH] block ips

---
 external_ips.py | 59 +++++++++++++++++++++++++++++++++++++++++++++++++
 salt/init.sls   | 44 ++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 external_ips.py
 create mode 100644 salt/init.sls

diff --git a/external_ips.py b/external_ips.py
new file mode 100644
index 0000000..bb78cdb
--- /dev/null
+++ b/external_ips.py
@@ -0,0 +1,59 @@
+import requests
+import dns.resolver
+from urllib.parse import urlparse
+
+artifactory_url = 'https://art.lmru.tech/artifactory/api/repositories'
+headers = {
+    'Content-Type': 'application/json'
+}
+
+def get_remote_repositories():
+    response = requests.get(artifactory_url, headers=headers)
+    if response.status_code == 200:
+        repositories = response.json()
+        excluded_package_types = ['yum', 'deb', 'rpm', 'apt', 'alpine']
+        remote_repositories = [
+            repo for repo in repositories 
+            if repo['type'] == 'REMOTE' and repo.get('packageType', '').lower() not in excluded_package_types
+        ]
+        return remote_repositories
+    else:
+        print("Error retrieving repository list:", response.status_code, response.text)
+        return []
+
+remote_repositories = get_remote_repositories()
+
+def extract_hostname(url):
+    parsed_url = urlparse(url)
+    return parsed_url.hostname
+
+def get_ip_addresses(hostname, iterations=20):
+    ip_addresses = set()
+    for _ in range(iterations):
+        try:
+            answers = dns.resolver.resolve(hostname, 'A')
+            for rdata in answers:
+                ip_addresses.add((hostname, rdata.to_text()))
+        except dns.resolver.NoAnswer:
+            print(f"No A records found for {hostname}")
+        except dns.resolver.NXDOMAIN:
+            print(f"Domain {hostname} does not exist")
+        except dns.exception.Timeout:
+            print(f"Timeout while resolving {hostname}")
+        except Exception as e:
+            print(f"An error occurred while resolving {hostname}: {e}")
+    return ip_addresses
+
+# Получаем уникальные пары (hostname, IP-адрес) для каждого хоста
+hostnames = {extract_hostname(repo['url']) for repo in remote_repositories}
+hostnames.add('docker.io')  # Добавляем docker.io к списку хостнеймов
+hostname_ip_pairs = set()
+for hostname in hostnames:
+    hostname_ip_pairs.update(get_ip_addresses(hostname))
+
+# Сохранение уникальных IP-адресов и их хостнеймов в файл
+with open('blocked_ips.txt', 'w') as file:
+    for hostname, ip in sorted(hostname_ip_pairs, key=lambda x: x[1]):
+        file.write(f"{ip} {hostname}\n")
+
+print("Blocked IP addresses list with hostnames successfully created.")
diff --git a/salt/init.sls b/salt/init.sls
new file mode 100644
index 0000000..7aec692
--- /dev/null
+++ b/salt/init.sls
@@ -0,0 +1,44 @@
+{% for ip in [
+    "54.67.28.63",
+    "13.56.23.197",
+    "213.180.204.183",
+    "151.101.130.132",
+    "151.101.194.132",
+    "151.101.2.132",
+    "151.101.246.132",
+    "151.101.66.132",
+    "147.75.85.69",
+    "217.196.149.55",
+    "72.32.157.246",
+    "87.238.57.227",
+    "104.16.168.120",
+    "104.16.169.120",
+    "52.85.49.108",
+    "52.85.49.128",
+    "52.85.49.20",
+    "52.85.49.85",
+    "18.198.112.44",
+    "18.198.212.80",
+    "146.59.69.202"
+] %}
+remove_ip_{{ ip.replace('.', '_') }}_output:
+  iptables.delete:
+    - table: filter
+    - chain: OUTPUT
+    - destination: {{ ip }}
+    - jump: REJECT
+
+remove_ip_{{ ip.replace('.', '_') }}_forward:
+  iptables.delete:
+    - table: filter
+    - chain: FORWARD
+    - destination: {{ ip }}
+    - jump: REJECT
+
+remove_ip_{{ ip.replace('.', '_') }}_docker_user:
+  iptables.delete:
+    - table: filter
+    - chain: DOCKER-USER
+    - destination: {{ ip }}
+    - jump: REJECT
+{% endfor %}
\ No newline at end of file