dnsWebGuard

#!/bin/bash

url=$1
host=`echo $url | sed -E 's|https*://([^/^:]+).*+$|\1|g'`
proto=$4
srcIP=$2
dstIP=$3
dns=127.0.0.1
sPort=$5
dPort=$6
LOGFILE=/var/log/webfilter-ng
CACHEDIR=/var/cache/webfilter-ng

[ "$host" == "ENCRYPTED-SNI" ] && echo DROP && echo `date +%Y-%m-%d\ %H:%M:%S` $url $proto $srcIP:$sPort $dstIP:$dPort DROP >>$LOGFILE && exit 0

if [[ $host =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] 
then
	echo ACCEPT
        echo `date +%Y-%m-%d\ %H:%M:%S` $url $proto $srcIP:$sPort $dstIP:$dPort ACCEPT >>$LOGFILE
        exit 0
fi

#delete unused cache files that was not modified/used during last five minutes
find $CACHEDIR -cmin +5 -name "*.dns" -exec rm {} \;

ipList=`dig @${dns} +noall +answer $host | awk '($4=="A") {print $5}'`
if [ -f $CACHEDIR/$host.dns ]
then
        ipList=`cat $CACHEDIR/$host.dns`" "$ipList 
fi
echo $ipList | sed -e 's/ /\n/g' | sort | uniq  >$CACHEDIR/$host.dns
for ip in $ipList
do
    if [ "$ip" == "$dstIP" ]
    then
            echo ACCEPT
            echo `date +%Y-%m-%d\ %H:%M:%S` $url $proto $srcIP:$sPort $dstIP:$dPort ACCEPT >>$LOGFILE
            exit 0
    fi
done
echo DROP
echo `date +%Y-%m-%d\ %H:%M:%S` $url $proto $srcIP:$sPort $dstIP:$dPort DROP >>$LOGFILE
exit 0