#!/bin/bash

# numero limite de servidores (conexoes HTTPS)
limitServersHttps=8

# main()

makeBlacklist() {

# dados Shorewall
SHOREWALL="/sbin/shorewall"
blacklistFile="/etc/shorewall/blacklist"

# arquivos temporarios
tempFile1="/tmp/stopUltraSurf_1.tmp"
tempFile2="/tmp/stopUltraSurf_2.tmp"

cat "$blacklistFile" | grep -v '^#\|^$' > "$tempFile2"

for ip in $1
do

    echo "$ip      tcp      https" >> "$tempFile2"

done

cat > "$tempFile1" << EOF

#ADDRESS/SUBNET      PROTOCOL   PORT
EOF

cat "$tempFile2" | sort | uniq >> "$tempFile1"

cat >> "$tempFile1" << EOF
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
EOF

if ! diff -q $tempFile1 $blacklistFile > /dev/null
then
    cat $tempFile1 > $blacklistFile
    
    $SHOREWALL refresh 2>&1 > /dev/null

fi

# remove arquivos temporarios
rm -f $tempFile1 $tempFile2 ; exit 0

} # end of makeBlacklist()

tempFile0="/tmp/stopUltraSurf_0.tmp"

# captura os octetos referentes a rede local (ex.: 192.168.0 )
myNet=$(  host $(hostname)               \
   | awk '{ print $4 }'            \
   | awk -F"." '{OFS="."} { print $1, $2, $3 }' )

# processa todos os endereços IP da rede local, exceto o IP do servidor
for ip in $(echo ${myNet}.{2..254})
do

    iptstate -s "$ip" -D 443 -1    \
    | tail -n +4        \
    | awk '{ print $2 }'    \
    | sort          \
    | uniq          \
    > $tempFile0

    if [ $(cat "$tempFile0" | wc -l) -ge $limitServersHttps ]
    then

   while read line
   do
       
       if host $(echo "$line" | cut -d: -f1) | grep -qi 'dynamic\|adsl'
       then
      ipHosts="$ipHosts $ip" ; break
      
       fi
    
        done < "$tempFile0"
    
    fi
    
done

# remove arquivo temporario
rm -f "$tempFile0"

# gera novo arquivo blacklist se houver IP violando a regra
[ -z "$ipHosts" ] || makeBlacklist "$ipHosts"