Add whitelist feature

1 files changed, 10 insertions, 3 deletions

diff --git a/theDrain b/theDrain
index 859abcb..522a1e8 100755
--- a/theDrain
+++ b/theDrain
@@ -3,12 +3,13 @@
 # Watch for floods and blacklist
 
 # Lets  get some Variables defined
-readonly max_ho=5						# Max # of Half Open Connections
-readonly host_ip=""  						# IP addy of host machine
-readonly log_file="~/Drain.txt"					# Directory to log to.
+readonly max_ho=8						# Max # of Half Open Connections
+readonly host_ip=""				  		# IP addy of host machine
+readonly log_file="/home/user/Drain.txt"		 	# Directory to log to.
 readonly alert_to="foo@example.com"				# Who to mail Alerts to
 readonly alert_level=50						# How man Half Open before we send an e-mail
 readonly server_name="$(hostname)"				# Name of your server. For E-mail alerts, defaults to hostmane
+readonly whitelist_file="/home/user/whitelist"			# location of a list of IPs not to block 1 per live
 
 # This Function scans for half open TCP connections (Sign of a SYN flood)
 # and outputs a list of:
@@ -26,6 +27,12 @@ function blackList () {
                 echo "no value"
                 return 1
         fi
+	# Is the IP whitelisted
+	grep -q "$1" "$whitelist_file"
+	if [[ $? -eq 0 ]]; then
+		echo "$1 is Whitelisted. Not Blocking."
+		return 1
+	fi
         echo "Checking: $1"
         iptables -L INPUT -n | grep -q $1
         if [ $? == 0 ]; then