ability to add your IPs to blocklist/whitelist

add https://github.com/legiz-ru/sb-rule-sets/raw/main/ru-bundle.lst button

app/bot.php

@@ -12,6 +12,7 @@ class Bot
     public $dns;
     public $mtu;
     public $logs;
+    public $reg;
 
     public function __construct($key, $i18n)
     {
@@ -35,6 +36,22 @@ class Bot
             'upstream_access',
             'xray',
         ];
+        $this->reg = '~' . implode('|', [
+            'GET /ws(?:.+)? HTTP',
+            'GET /adguard/(?:.+)? HTTP',
+            'GET /webapp(?:.+)? HTTP',
+            'GET /pac(?:.+)? HTTP',
+            'GET \.well-known(?:.+)? HTTP',
+            'GET /v2ray(?:.+)? HTTP',
+            'GET /dns-query(?:.+)? HTTP',
+            'GET / HTTP',
+            'GET /tlgrm(?:.+)? HTTP',
+            'GET /jsoneditor.min.css HTTP',
+            'GET /jsoneditor.min.js HTTP',
+            'GET /jquery-3.7.1.min.js HTTP',
+            'GET /img/jsoneditor-icons.svg HTTP',
+            'GET /favicon.ico HTTP',
+        ]) . '~';
     }
 
     public function input()
@@ -152,6 +169,9 @@ class Bot
             case preg_match('~^/searchLogs (.+)$~', $this->input['message'], $m):
                 $this->searchLogs($m[1]);
                 break;
+            case preg_match('~^/searchLogs (.+?)(?:\s(.+?))?(?:\s(.+?))?(?:\s(.+?))?$~', $this->input['callback'], $m):
+                $this->searchLogs($m[1], $m[2], $m[3], $m[4]);
+                break;
             case preg_match('~^/switchSilence$~', $this->input['callback'], $m):
                 $this->switchSilence();
                 break;
@@ -167,9 +187,8 @@ class Bot
             case preg_match('~^/ports$~', $this->input['callback'], $m):
                 $this->ports();
                 break;
-            case preg_match('~^/ip$~', $this->input['message'], $m):
-            case preg_match('~^/analysisIp$~', $this->input['callback'], $m):
-                $this->analysisIp();
+            case preg_match('~^/analysisIp(?:\s(\d+))?$~', $this->input['callback'], $m):
+                $this->analysisIp($m[1] ?: 0);
                 break;
             case preg_match('~^/ipMenu$~', $this->input['callback'], $m):
                 $this->ipMenu();
@@ -189,10 +208,13 @@ class Bot
             case preg_match('~^/searchIp (.+)$~', $this->input['callback'], $m):
                 $this->searchIp($m[1]);
                 break;
-            case preg_match('~^/denyIp (.+?)(?:\s(\d)\s(\d+?)\s(\d))?$~', $this->input['callback'], $m):
+            case preg_match('~^/searchSuspiciousIp (.+)$~', $this->input['callback'], $m):
+                $this->searchSuspiciousIp($m[1]);
+                break;
+            case preg_match('~^/denyIp (.+?)(?:\s(.+?)\s(\d+?)\s(\d))?$~', $this->input['callback'], $m):
                 $this->denyIp($m[1], $m[2], $m[3], $m[4]);
                 break;
-            case preg_match('~^/whiteIp (.+?)(?:\s(\d)\s(\d+?)\s(\d))?$~', $this->input['callback'], $m):
+            case preg_match('~^/whiteIp (.+?)(?:\s(.+?)\s(\d+?)\s(\d))?$~', $this->input['callback'], $m):
                 $this->whiteIp($m[1], $m[2], $m[3], $m[4]);
                 break;
             case preg_match('~^/adgFillAllowedClients(?: (\d+))?$~', $this->input['callback'], $m):
@@ -243,6 +265,9 @@ class Bot
             case preg_match('~^/addCommunityFilter$~', $this->input['callback'], $m):
                 $this->addCommunityFilter();
                 break;
+            case preg_match('~^/addLegizFilter$~', $this->input['callback'], $m):
+                $this->addLegizFilter();
+                break;
             case preg_match('~^/pacMenu (\d+)$~', $this->input['callback'], $m):
                 $this->pacMenu($m[1]);
                 break;
@@ -1161,27 +1186,26 @@ class Bot
         try {
             $pac = $this->getPacConf();
             if (!empty($pac['autoscan'])) {
-                $r = $this->analysisIp(1);
+                $r = $this->analysisIp(return: 1);
                 require __DIR__ . '/config.php';
                 if (!empty($c['admin']) && (empty($this->time3) || ((time() - $this->time3) > $pac['autoscan_timeout']))) {
                     $this->time3 = time();
                     if (!empty($r)) {
                         foreach ($r as $k => $v) {
-                            $tmp = array_unique($v);
-                            foreach ($tmp as $i) {
-                                $t[$i]++;
+                            foreach ($v as $i) {
+                                $t[$i['title']][$k] = 1;
                             }
                         }
                         foreach ($t as $k => $v) {
-                            $text .= "\n$v $k";
+                            $text .= "\n" . count($v) . " $k";
                         }
                         if (!empty($pac['autodeny'])) {
                             $this->denyIp(array_keys($r));
                             $ban = count(array_keys($r));
                             foreach (array_keys($r) as $v) {
                                 $ips[] = [[
-                                    'text'          => "logs $v",
-                                    'callback_data' => "/searchIp $v",
+                                    'text'          => $v,
+                                    'callback_data' => "/searchLogs $v",
                                 ]];
                             }
                         }
@@ -2560,9 +2584,9 @@ DNS-over-HTTPS with IP:
             default:
                 $r = $this->send(
                     $this->input['chat'],
-                    "@{$this->input['username']} list domains separated by commas",
+                    "@{$this->input['username']} list separated by commas",
                     $this->input['message_id'],
-                    reply: 'list domains separated by commas',
+                    reply: 'list separated by commas',
                 );
                 break;
         }
@@ -2584,7 +2608,11 @@ DNS-over-HTTPS with IP:
         if (!empty($domains)) {
             $conf = $this->getPacConf();
             foreach ($domains as $k => $v) {
-                $conf[$type][in_array($type, ['rulessetlist', 'packagelist', 'processlist']) ? trim($v) : idn_to_ascii(trim($v))] = true;
+                if (in_array($type, ['white', 'deny'])) {
+                    $conf[$type][] = $v;
+                } else {
+                    $conf[$type][in_array($type, ['rulessetlist', 'packagelist', 'processlist']) ? trim($v) : idn_to_ascii(trim($v))] = true;
+                }
             }
             ksort($conf[$type]);
             $this->setPacConf($conf);
@@ -2623,6 +2651,11 @@ DNS-over-HTTPS with IP:
                 $this->xrayUpdateRules();
                 $this->xtlsrulesset();
                 break;
+            case 'white':
+            case 'deny':
+                $this->syncDeny();
+                $this->denyList(0, $type == 'white' ? 1 : 0);
+                break;
         }
     }
 
@@ -3479,6 +3512,19 @@ DNS-over-HTTPS with IP:
         $this->pacUpdate();
     }
 
+    public function addLegizFilter()
+    {
+        $pac = $this->getPacConf();
+        $l   = array_filter(array_map(fn($e) => trim($e), explode("\n", file_get_contents('https://github.com/legiz-ru/sb-rule-sets/raw/main/ru-bundle.lst'))));
+        if (!empty($l)) {
+            foreach ($l as $k => $v) {
+                $pac['includelist'][$v] = true;
+            }
+        }
+        $this->setPacConf($pac);
+        $this->pacUpdate();
+    }
+
     public function pacMenu($page = 0)
     {
         unset($_SESSION['proxylistentry']);
@@ -3562,6 +3608,12 @@ DNS-over-HTTPS with IP:
                 'callback_data' => "/addCommunityFilter",
             ],
         ];
+        $data[] = [
+            [
+                'text'          => $this->i18n('add') . ' ru-bundle',
+                'callback_data' => "/addLegizFilter",
+            ],
+        ];
         $data   = array_merge($data, $this->listPac('includelist', $page, 'pacMenu')[0]);
         $data[] = [
             [
@@ -4258,7 +4310,37 @@ DNS-over-HTTPS with IP:
         );
     }
 
-    public function analysisIp($return = false)
+    public function suspicious($regexp, $file, $ip, $title, $reverse = false)
+    {
+        if ($r = fopen($file, 'r')) {
+            while (feof($r) === false) {
+                $l = fgets($r);
+                if (preg_match('~(\d+\.\d+\.\d+\.\d+)~', $l, $m)) {
+                    if ($reverse xor preg_match($regexp, $l)) {
+                        if (is_array($ip)) {
+                            if (empty($ip[$m[1]])) {
+                                $ret[$m[1]][] = [
+                                    'title' => $title,
+                                    'log'   => $l,
+                                ];
+                            }
+                        } else {
+                            if ($ip == $m[1]) {
+                                $ret[$m[1]][] = [
+                                    'title' => $title,
+                                    'log'   => $l,
+                                ];
+                            }
+                        }
+                    }
+                }
+            }
+            fclose($r);
+        }
+        return $ret ?: [];
+    }
+
+    public function analysisIp(int $page = 0, $return = false)
     {
         $pac = $this->getPacConf();
         foreach (array_merge($pac['white'] ?: [], $pac['deny'] ?: [], [
@@ -4299,97 +4381,102 @@ DNS-over-HTTPS with IP:
             fclose($r);
         }
 
-        if ($r = fopen('/logs/upstream_access', 'r')) {
-            while (feof($r) === false) {
-                $l = fgets($r);
-                if (preg_match('~(\d+\.\d+\.\d+\.\d+).+200\s\d+\s0$~', $l, $m)) {
-                    if (empty($xr[$m[1]])) {
-                        $ip[$m[1]][] = 'possibly a Reality Degenerate';
-                    }
-                }
-            }
-            fclose($r);
-        }
-
-        $reg = [
-            'GET /ws(?:.+)? HTTP',
-            'GET /adguard/(?:.+)? HTTP',
-            'GET /webapp(?:.+)? HTTP',
-            'GET /pac(?:.+)? HTTP',
-            'GET \.well-known(?:.+)? HTTP',
-            'GET /v2ray(?:.+)? HTTP',
-            'GET /dns-query(?:.+)? HTTP',
-            'GET / HTTP',
-            'GET /tlgrm(?:.+)? HTTP',
-            'GET /jsoneditor.min.css HTTP',
-            'GET /jsoneditor.min.js HTTP',
-            'GET /jquery-3.7.1.min.js HTTP',
-            'GET /img/jsoneditor-icons.svg HTTP',
-            'GET /favicon.ico HTTP',
+        $t = [
+            $this->suspicious('~\d+\.\d+\.\d+\.\d+.+200\s\d+\s0$~', '/logs/upstream_access', $xr, 'possibly a Reality Degenerate'),
+            $this->suspicious($this->reg, '/logs/nginx_default_access', $xr, 'possibly a scanner', true),
+            $this->suspicious($this->reg, '/logs/nginx_domain_access', $xr, 'possibly a scanner', true),
         ];
 
-        if ($r = fopen('/logs/nginx_default_access', 'r')) {
-            while (feof($r) === false) {
-                $l = fgets($r);
-                if (!preg_match('~' . implode('|', $reg) . '~', $l)) {
-                    if (preg_match('~(\d+\.\d+\.\d+\.\d+)~', $l, $m)) {
-                        if (empty($xr[$m[1]])) {
-                            $ip[$m[1]][] = 'possibly a scanner';
-                        }
-                    }
-                }
+        $ip = [];
+        foreach ($t as $r) {
+            foreach ($r as $k => $v) {
+                $ip[$k] = $v;
             }
-            fclose($r);
         }
 
-        if ($r = fopen('/logs/nginx_domain_access', 'r')) {
-            while (feof($r) === false) {
-                $l = fgets($r);
-                if (!preg_match('~' . implode('|', $reg) . '~', $l)) {
-                    if (preg_match('~(\d+\.\d+\.\d+\.\d+)~', $l, $m)) {
-                        if (empty($xr[$m[1]])) {
-                            $ip[$m[1]][] = 'possibly a scanner';
-                        }
-                    }
-                }
-            }
-            fclose($r);
+        if (!empty($return)) {
+            return $ip;
         }
-
         if (!empty($ip)) {
-            if (!empty($return)) {
-                return $ip;
-            }
             foreach ($ip as $k => $v) {
-                $file .= "/searchLogs $k\n";
+                $data[] = [
+                    [
+                        'text'          => $k,
+                        'callback_data' => "/searchLogs $k analysisIp $page 0",
+                    ]
+                ];
+            }
+            $all  = (int) ceil(count($data) / $this->limit);
+            $page = min($page, $all - 1);
+            $page = $page < 0 ? $all - 1 : $page;
+            $data = array_slice($data ?: [], $page * $this->limit, $this->limit);
+            if ($all > 1) {
+                $data[] = [
+                    [
+                        'text'          => '<<',
+                        'callback_data' => "/analysisIp " . ($page - 1 >= 0 ? $page - 1 : $all - 1),
+                    ],
+                    [
+                        'text'          => '>>',
+                        'callback_data' => "/analysisIp " . ($page < $all - 1 ? $page + 1 : 0),
+                    ]
+                ];
             }
-            $this->sendFile($this->input['from'], new CURLStringFile($file, 'analyze_ip_' . date('Y_m_d_H_i_s')));
-        } else {
-            $this->answer($this->input['callback_id'], 'empty');
         }
+        $data[] = [
+            [
+                'text'          => $this->i18n('back'),
+                'callback_data' => "/ipMenu",
+            ],
+        ];
+        $this->update($this->input['from'], $this->input['message_id'], count($ip) ?: 'empty', $data);
     }
 
-    public function searchLogs($search)
+    public function searchLogs($search, $fun = false, $page = 0, $white = 0)
     {
         if (preg_match('~^\d+\.\d+\.\d+\.\d+$~', $search)) {
-            $this->send($this->input['from'], $search, button: [[
+            $info = file_get_contents("https://ipinfo.io/$search/json", context: stream_context_create(['http' => ['timeout' => 2]]));
+            $text = "$search\n<pre>$info</pre>";
+            $data[] = [
                 [
                     'text'          => $this->i18n('block'),
-                    'callback_data' => "/denyIp $search",
+                    'callback_data' => "/denyIp $search" . ($fun ? " $fun $page $white" : ''),
                 ],
                 [
                     'text'          => $this->i18n('ignore'),
-                    'callback_data' => "/whiteIp $search",
+                    'callback_data' => "/whiteIp $search" . ($fun ? " $fun $page $white" : ''),
                 ],
+            ];
+            $data[] = [
                 [
-                    'text'          => $this->i18n('logs'),
+                    'text'          => $this->i18n('all logs'),
                     'callback_data' => "/searchIp $search",
                 ],
                 [
-                    'text'          => $this->i18n('clean logs'),
+                    'text'          => $this->i18n('suspicious log'),
+                    'callback_data' => "/searchSuspiciousIp $search",
+                ],
+            ];
+            $data[] = [
+                [
+                    'text'          => $this->i18n("clean logs $search"),
                     'callback_data' => "/cleanLogs $search",
                 ],
-            ]]);
+            ];
+            if (!empty($fun)) {
+                $data[] = [
+                    [
+                        'text'          => $this->i18n('back'),
+                        'callback_data' => "/$fun $page" . ($white ? " $white" : ''),
+                    ],
+                ];
+                $this->update($this->input['from'], $this->input['message_id'], $text, button: $data);
+            } else {
+                if (empty($this->input['callback_id'])) {
+                    $this->delete($this->input['from'], $this->input['message_id']);
+                }
+                $this->send($this->input['from'], $text, button: $data);
+            }
         }
     }
 
@@ -4424,6 +4511,40 @@ DNS-over-HTTPS with IP:
         }
     }
 
+    public function searchSuspiciousIp($ip)
+    {
+        $t = [
+            $this->suspicious('~\d+\.\d+\.\d+\.\d+.+200\s\d+\s0$~', '/logs/upstream_access', $ip, 'possibly a Reality Degenerate'),
+            $this->suspicious($this->reg, '/logs/nginx_default_access', $ip, 'possibly a scanner', true),
+            $this->suspicious($this->reg, '/logs/nginx_domain_access', $ip, 'possibly a scanner', true),
+        ];
+        foreach ($t as $r) {
+            if (!empty($r)) {
+                foreach ($r as $v) {
+                    foreach ($v as $k) {
+                        $logs[$k['title']][] = $k['log'];
+                    }
+                }
+            }
+        }
+        if (!empty($logs)) {
+            foreach ($logs as $k => $v) {
+                $head= "$k:\n";
+                $t = array_chunk($v, 10);
+                foreach ($t as $j) {
+                    $text = "$head<pre>";
+                    foreach ($j as $i) {
+                        $text .= htmlspecialchars($i, ENT_HTML5, 'UTF-8');
+                    }
+                    $text .= '</pre>';
+                    $this->send($this->input['from'], $text, $this->input['message_id']);
+                }
+            }
+        } else {
+            $this->answer($this->input['callback_id'], 'empty');
+        }
+    }
+
     public function denyList($page = 0, $white = 0)
     {
         $text    = 'Menu -> IP -> ' . ($white ? 'white' : 'deny') . ' list';
@@ -4432,25 +4553,23 @@ DNS-over-HTTPS with IP:
         $page    = min($page, $all - 1);
         $page    = $page < 0 ? $all - 1 : $page;
 
+        $data[] = [
+            [
+                'text'          => $this->i18n('add'),
+                'callback_data' => "/include " . ($white ? 'white' : 'deny'),
+            ],
+        ];
         if (!empty($domains)) {
             foreach (array_slice($domains, $page * $this->limit, $this->limit) as $v) {
                 $data[] = [
                     [
-                        'text'          => $this->i18n('delete') . " $v",
+                        'text'          => $v,
+                        'callback_data' => "/searchLogs $v denyList $page $white",
+                    ],
+                    [
+                        'text'          => $this->i18n('delete'),
                         'callback_data' => "/allowIp $v $page" . ($white ? " 1" : ''),
                     ],
-                    [
-                        'text'          => $this->i18n($white ? 'block' : 'ignore'),
-                        'callback_data' => ($white ? "/denyIp" : "/whiteIp") . " $v 1 $page $white",
-                    ],
-                    [
-                        'text'          => $this->i18n('logs'),
-                        'callback_data' => "/searchIp $v",
-                    ],
-                    [
-                        'text'          => $this->i18n('clean logs'),
-                        'callback_data' => "/cleanLogs $v 1",
-                    ],
                 ];
             }
             if ($all > 1) {
@@ -4496,7 +4615,7 @@ DNS-over-HTTPS with IP:
         $this->ipMenu();
     }
 
-    public function denyIp($ip, $nodelete = false, $page = 0, $white = 0)
+    public function denyIp($ip, $fun = false, $page = 0, $white = 0)
     {
         $pac = $this->getPacConf();
         if (is_array($ip)) {
@@ -4513,16 +4632,16 @@ DNS-over-HTTPS with IP:
             }
         }
         $this->setPacConf($pac);
-        if (empty($nodelete)) {
+        if (empty($fun)) {
             $this->delete($this->input['from'], $this->input['message_id']);
         }
         $this->syncDeny();
-        if (!empty($nodelete)) {
-            $this->denyList($page, $white);
+        if (!empty($fun)) {
+            $this->{$fun}($page, $white);
         }
     }
 
-    public function whiteIp($ip, $nodelete = false, $page = 0, $white = 0)
+    public function whiteIp($ip, $fun = false, $page = 0, $white = 0)
     {
         $pac = $this->getPacConf();
         if (is_array($ip)) {
@@ -4539,12 +4658,12 @@ DNS-over-HTTPS with IP:
             }
         }
         $this->setPacConf($pac);
-        if (empty($nodelete)) {
+        if (empty($fun)) {
             $this->delete($this->input['from'], $this->input['message_id']);
         }
         $this->syncDeny();
-        if (!empty($nodelete)) {
-            $this->denyList($page, $white);
+        if (!empty($fun)) {
+            $this->{$fun}($page, $white);
         }
     }
 

version

@@ -1,3 +1,9 @@
+16.11.2024 v1.102
+- переделан раздел списка ip под управление кнопками
+- возможность добавить свои айпи в blocklist/whitelist
+15.11.2024 v1.101
+- кнопка добавления https://github.com/legiz-ru/sb-rule-sets/raw/main/ru-bundle.lst
+- переделан раздел списка ip для читаемости
 15.11.2024 v1.100
 - несколько режимов silence для сканера
 - анализ сканера скидывает файл всех найденных айпи