Ban an IP manually?

[Hermanverschooten]

Hi,
I was wondering if you could/would add a feauture that allows us to immediately ban an IP?
Case? I have a form that has some security if it is triggered I want to ban that IP immediately.

[akoutmos]

Hello Herman!

While we don't have that feature at the moment, that's a pretty easy thing to add to Phx2Ban. I'll add it to our roadmap and let you know when it is released :).

[PJUllrich]

@Hermanverschooten we've just released v0.2.0 which includes an API to manually ban IPv4 adresses. We haven't announced the new version yet to test it a bit first, but if you want, you can upgrade and use it from now on :)
https://ezsuite.dev/docs/phx_2_ban/Phx2Ban.html#manually_block_ip_address/1

[Hermanverschooten]

Hi, I added it to my site this morning, but it crashed immediately the first time someone tried to abuse my contact form.
All my sites run on IPv6 which makes the IP address appear as: "::ffff:84.17.48.229" for IPv4.

[PJUllrich]

Right, I've experienced the same. Sorry about that, i'm working on a fix right now.

[PJUllrich]

@Hermanverschooten I just released v0.2.1 which should fix this. could you please bump the version and try again? Thank you for your patience!

[PJUllrich]

And one more question: When you say:

All my sites run on IPv6 which makes the IP address appear as: "::ffff:84.17.48.229" for IPv4.

do you actually receive the IPv4 address of clients? So, is the IPv4 here 84.17.48.229 actually your client's IP? Because right now, we don't convert IPv6 to IPv4 in any way and won't check that IP against our list of known malicious IPs. It would be interesting to know whether that would be useful though.

[Hermanverschooten]

Yes I do receive the IPv4 address in that way, as a glorified IPv6 address.
See https://notes.networklessons.com/ipv6-ipv4-mapped-ipv6-address

[PJUllrich]

Interesting! We could remap the IPv6 back to IPv4 for you and that way it should all still work, but probably not everyone has this set up like you do. I think I'll make this a config option so that you can enable it if needed. That way, you'd profit from the 85k known malicious IP filters we added in 0.2. I'll let you know once the IPv4-to-IPv6 remapping is done :)

[Hermanverschooten]

BTW, you get this as soon as you change your site to listen on {0, 0, 0, 0, 0, 0, 0, 0} instead of {0, 0, 0, 0}.
I remember adding this to a project so I could get my IPv4 as IPv4:

  def parse_ip(%{address: {0, 0, 0, 0, 0, 65535, p1, p2}}) do
    digit1 = div(p1, 256)
    digit2 = rem(p1, 256)
    digit3 = div(p2, 256)
    digit4 = rem(p2, 256)
    {digit1, digit2, digit3, digit4}
  end

I wonder how people that are using fly.io get their ip, because I seem to remember they also use IPv6.

[Hermanverschooten]

And it works now, and apparently solves another issue I had noticed just now on another project.

[error] GenServer Phx2Ban.Rules.KnownMaliciousIp terminating                                                                                                                                                                                                                                                                                                                          
** (FunctionClauseError) no function clause matching in Phx2Ban.Rules.KnownMaliciousIp.check_request/2                                                                                     
    (phx_2_ban 0.2.0) lib/phx_2_ban/rules/known_malicious_ip.ex:67: Phx2Ban.Rules.KnownMaliciousIp.check_request({0, 0, 0, 0, 0, 65535, 32512, 1}, {:cuckoo_filter, #Reference<0.632981430.155582470.134068>, {:spinlock, #Reference<0.632981430.155582470.134068>, 1000000}, 32768, 2147483647, 4, 16, 100, #Function<0.131942963/1 in Phx2Ban.Rules.KnownMaliciousIp.hash>})
    (phx_2_ban 0.2.0) lib/phx_2_ban/rules/known_malicious_ip.ex:54: Phx2Ban.Rules.KnownMaliciousIp.handle_call/3                                                                           
    (stdlib 6.1) gen_server.erl:2381: :gen_server.try_handle_call/4                                                                                                                        
    (stdlib 6.1) gen_server.erl:2410: :gen_server.handle_msg/6                                                                                                                             
    (stdlib 6.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3                                                                                                                             
Last message (from #PID<0.350.0>): {:valid_request?, {0, 0, 0, 0, 0, 65535, 32512, 1}}                                                                                                     
State: {:cuckoo_filter, #Reference<0.632981430.155582470.134068>, {:spinlock, #Reference<0.632981430.155582470.134068>, 1000000}, 32768, 2147483647, 4, 16, 100, #Function<0.131942963/1 in Phx2Ban.Rules.KnownMaliciousIp.hash>}
Client #PID<0.350.0> is alive                                                                                                                                                              
                                                                                                                                                                                           
    (stdlib 6.1) gen.erl:260: :gen.do_call/4                                                 
    (elixir 1.17.3) lib/gen_server.ex:1125: GenServer.call/3                                 
    (phx_2_ban 0.2.0) lib/phx_2_ban/analyzer.ex:134: anonymous fn/2 in Phx2Ban.Analyzer.maybe_blocklist_ip/2                                                                               
    (elixir 1.17.3) lib/enum.ex:4343: Enum.find_value_list/3                                                                                                                               
    (phx_2_ban 0.2.0) lib/phx_2_ban/analyzer.ex:91: Phx2Ban.Analyzer.handle_conn_data/2                                                                                                    
    (phx_2_ban 0.2.0) lib/phx_2_ban/analyzer.ex:61: Phx2Ban.Analyzer.handle_cast/2                                                                                                         
    (stdlib 6.1) gen_server.erl:2371: :gen_server.try_handle_cast/3                                                                                                                        
    (stdlib 6.1) gen_server.erl:2433: :gen_server.handle_msg/6                                                                                                                             
    (stdlib 6.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3                    
[error] GenServer #PID<0.350.0> terminating                                                  
** (stop) exited in: GenServer.call(Phx2Ban.Rules.KnownMaliciousIp, {:valid_request?, {0, 0, 0, 0, 0, 65535, 32512, 1}}, 5000)                                                             
    ** (EXIT) an exception was raised:                                                                                                                                                     
        ** (FunctionClauseError) no function clause matching in Phx2Ban.Rules.KnownMaliciousIp.check_request/2                                                                             
            (phx_2_ban 0.2.0) lib/phx_2_ban/rules/known_malicious_ip.ex:67: Phx2Ban.Rules.KnownMaliciousIp.check_request({0, 0, 0, 0, 0, 65535, 32512, 1}, {:cuckoo_filter, #Reference<0.632981430.155582470.134068>, {:spinlock, #Reference<0.632981430.155582470.134068>, 1000000}, 32768, 2147483647, 4, 16, 100, #Function<0.131942963/1 in Phx2Ban.Rules.KnownMaliciousIp.hash>})
            (phx_2_ban 0.2.0) lib/phx_2_ban/rules/known_malicious_ip.ex:54: Phx2Ban.Rules.KnownMaliciousIp.handle_call/3                                                                   
            (stdlib 6.1) gen_server.erl:2381: :gen_server.try_handle_call/4                                                                                                                
            (stdlib 6.1) gen_server.erl:2410: :gen_server.handle_msg/6                                                                                                                     
            (stdlib 6.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3                                                                                                                     
    (elixir 1.17.3) lib/gen_server.ex:1128: GenServer.call/3                                                                                                                               
    (phx_2_ban 0.2.0) lib/phx_2_ban/analyzer.ex:134: anonymous fn/2 in Phx2Ban.Analyzer.maybe_blocklist_ip/2                                                                               
    (elixir 1.17.3) lib/enum.ex:4343: Enum.find_value_list/3                                                                                                                               
    (phx_2_ban 0.2.0) lib/phx_2_ban/analyzer.ex:91: Phx2Ban.Analyzer.handle_conn_data/2                                                                                                    
    (phx_2_ban 0.2.0) lib/phx_2_ban/analyzer.ex:61: Phx2Ban.Analyzer.handle_cast/2                                                                                                         
    (stdlib 6.1) gen_server.erl:2371: :gen_server.try_handle_cast/3                                                                                                                        
    (stdlib 6.1) gen_server.erl:2433: :gen_server.handle_msg/6                                                                                                                             
    (stdlib 6.1) proc_lib.erl:329: :proc_lib.init_p_do_apply/3                                                                                                                             
Last message: {:"$gen_cast", {:analyze_request, %Phx2Ban.ConnData{remote_ip: {0, 0, 0, 0, 0, 65535, 32512, 1}, method: "GET", request_path: "/phoenix/live_reload/frame", req_headers: [{"x-forwarded-proto", "https"}, {"x-forwarded-host", "faulty-tower.test"}, {"x-forwarded-for", "::1"}, {"upgrade-insecure-requests", "1"}, {"te", "trailers"}, {"sec-gpc", "1"}, {"sec-fetch-s
ite", "same-origin"}, {"sec-fetch-mode", "navigate"}, {"sec-fetch-dest", "iframe"}, {"referer", "https://faulty-tower.test/"}, {"priority", "u=4"}, {"dnt", "1"}, {"cookie", "_faulty_tower_key=SFMyNTY.g3QAAAADbQAAAAtfY3NyZl90b2tlbm0AAAAYWWUwelVSMVpzQXJfTW9rQ1pMc3ZScUZabQAAAA5saXZlX3NvY2tldF9pZG0AAAA7dXNlcnNfc2Vzc2lvbnM6TkI2cHJFdVdnWGluWnFOX0dHdTR3UkxPaU5UYVA5Q1NDMzllTmRobk
pjND1tAAAACnVzZXJfdG9rZW5tAAAAIDQeqaxLloF4p2ajfxhruMESzojU2j_Qkgt_XjXYZyXO.w4edQ-vrIxHW9ZzTBt6enM-tAyxrWssfSXadi-TurAA"}, {"accept-language", "nl-BE,nl;q=0.8,en-US;q=0.6,en;q=0.4,fr-BE;q=0.2"}, {"accept-encoding", "gzip, deflate, br, zstd"}, {"accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"}, {"user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS 
X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0"}, {"host", "faulty-tower.test"}], status: nil, host: "faulty-tower.test", req_route_exists?: false}}}                                     
State: %{allow_list: MapSet.new(["127.0.0.1"]), ignore_routes: [], all_rules: [Phx2Ban.Rules.Linux, Phx2Ban.Rules.PHP, Phx2Ban.Rules.Drupal, Phx2Ban.Rules.Wordpress, Phx2Ban.Rules.Python, Phx2Ban.Rules.Windows, Phx2Ban.Rules.KnownMaliciousIp], inspect_percentage: 100, routers: [FaultyTowerWeb.Router]}

[PJUllrich]

Wait, are these logs from before or after you deployed the fix? Because the KnownMaliciousIp rule shouldn't receive IPv6 tuples anymore... At least that's what I though I fixed :D

[Hermanverschooten]

This was before the fix. 0.2.1 is ok, sorry about the confusion.

[Hermanverschooten]

@PJUllrich Sorry to bother you again about this, it blew up again last night. I had set Phx2Ban.manually_block_ip_address(conn.remote_ip) in my controller, but that only supports IPv4 addresses, replacing it with just the conn works for both though.

  def manually_block_ip_address({_, _, _, _} = remote_ip) do
    Blocklist.manually_block_ip_address(remote_ip)
  end

maybe?

  def manually_block_ip_address(remote_ip) when is_tuple(remote_ip) do
    if :inet.is_ip_address(remote_ip) do
       Blocklist.manually_block_ip_address(remote_ip)
    else
      {:error, :invalid_ip_address}
    end
  end

[PJUllrich]

@Hermanverschooten thank you for the bug report once more :) I have a PR ready and will wait for @akoutmos to review it later. I'll ping you once it's released. Thanks again for your patience and your help with this :)