hint blocked IPs about missing UA

[nominatim.git] / utils / cron_banip.py

diff --git a/utils/cron_banip.py b/utils/cron_banip.py
index ad32b852f5159fdca5f3f4b7620434abadd5d01b..17268bc15a48f0d49b90108442a6d9eca9c0b9ea 100755 (executable)
--- a/utils/cron_banip.py
+++ b/utils/cron_banip.py
@@ -52,6 +52,9 @@ LOGFILE= BASEDIR + '/log/restricted_ip.log'
 WHITELIST = ''
 # space-separated list of IPs manually blocked
 BLACKLIST = ''
+# user-agents that should be blocked from bulk mode
+# (matched with startswith)
+UA_BLOCKLIST = ()
 
 # time before a automatically blocked IP is allowed back
 BLOCKCOOLOFF_PERIOD='1 hour'
@@ -114,14 +117,14 @@ if len(prevbulks) > MAX_BULK_IPS:
 
 # get the new block candidates
 cur.execute("""
-  SELECT ipaddress, max(count) FROM
+  SELECT ipaddress, max(count), max(ua) FROM
    ((SELECT * FROM
-     (SELECT ipaddress, sum(case when endtime is null then 1 else 1+1.5*date_part('epoch',endtime-starttime) end) as count FROM new_query_log
+     (SELECT ipaddress, sum(case when endtime is null then 1 else 1+1.5*date_part('epoch',endtime-starttime) end) as count, substring(max(useragent) from 1 for 30) as ua FROM new_query_log
       WHERE starttime > now() - interval '1 hour' GROUP BY ipaddress) as i
    WHERE count > %s)
    UNION
-   (SELECT ipaddress, count * 3 FROM
-     (SELECT ipaddress, sum(case when endtime is null then 1 else 1+1.5*date_part('epoch',endtime-starttime) end) as count FROM new_query_log 
+   (SELECT ipaddress, count * 3, ua FROM
+     (SELECT ipaddress, sum(case when endtime is null then 1 else 1+1.5*date_part('epoch',endtime-starttime) end) as count, substring(max(useragent) from 1 for 30) as ua FROM new_query_log 
       WHERE starttime > now() - interval '10 min' GROUP BY ipaddress) as i
    WHERE count > %s)) as o
   GROUP BY ipaddress
@@ -129,12 +132,22 @@ cur.execute("""
 
 bulkips = {}
 emergencyblocks = []
+useragentblocks = []
 
 for c in cur:
     if c[0] not in WHITELIST and c[0] not in BLACKLIST:
-        if c[1] > BLOCK_UPPER and c[0] not in prevbulks:
+        # check for user agents that receive an immediate block
+        missing_agent = not c[2]
+        if not missing_agent:
+            for ua in UA_BLOCKLIST:
+                if c[2].startswith(ua):
+                    missing_agent = True
+                    break
+        if (missing_agent or c[1] > BLOCK_UPPER) and c[0] not in prevblocks:
             newblocks.add(c[0])
-            if c[0] not in prevblocks:
+            if missing_agent:
+                useragentblocks.append(c[0])
+            else:
                 emergencyblocks.append(c[0])
         else:
             bulkips[c[0]] = c[1]
@@ -217,6 +230,8 @@ if bulkips:
     fd.write(logstr % ('new bulks:', ', '.join(bulkips.keys())))
 if emergencyblocks:
     fd.write(logstr % ('dir.block:', ', '.join(emergencyblocks)))
+if useragentblocks:
+    fd.write(logstr % (' ua block:', ', '.join(useragentblocks)))
 if newlyblocked:
     fd.write(logstr % ('new block:', ', '.join(newlyblocked)))
 fd.close()