I have hacked together a php script, to get a list of ip addresses that use lower NRS version as your own like 0.5.x etc.
With this list I use iptables/ipset to block these ip addresses.
If there is a other way, pls let me know.
I use "getPeers" and then foreach with "getPeer&peer=x.x.x.x". Is there a faster way?
Here is the php code if someone like it:
<?php
// Your own Node address to check (pls modify to you needs!)
$NodeAddress = "192.168.1.22";
// Maximun different Versions from own Version
$DiffVersions = 3;
// ------------------------------------------------------------------------
$NodeInfo = array();
$NodeInfo = json_decode( send( "https://$NodeAddress:7876/nxt?requestType=getState" ) , true );
$NodeInfo['version'] = explode('.', $NodeInfo['version'], 3);
$NodeInfo['version'][2] = str_pad($NodeInfo['version'][2], 2 ,'0', STR_PAD_LEFT);
$NodeInfo['version'] = implode("", $NodeInfo['version']);
$NodeInfo['version'] = intval($NodeInfo['version']);
$MyVersion = $NodeInfo['version'];
$DiffVersion = $MyVersion - $DiffVersions;
echo "My version is $MyVersion\n";
echo "Minimum Version is set to $DiffVersion\n";
$Peers = array();
$Peers = json_decode( send( "https://$NodeAddress:7876/nxt?requestType=getPeers" ) , true );
$i = 0;
foreach ($Peers['peers'] as $value){
$IP = $value;
$Peer = array();
$Peer = json_decode( send( "https://$NodeAddress:7876/nxt?requestType=getPeer&peer={$value}" ) , true );
if ( $Peer['version'] == "" ) {
//print "{$Peer['version']} #:{$i} - No Version\n";
}
else {
$Peer['version'] = explode('.', $Peer['version'], 3);
$Peer['version'][2] = str_pad($Peer['version'][2], 2 ,'0', STR_PAD_LEFT);
$Peer['version'] = implode("", $Peer['version']);
$Peer['version'] = intval($Peer['version']);
if( $Peer['version'] < $DiffVersion && $Peer['application'] = 'NRS') {
print "{$Peer['version']} #:{$i} - Version is smaller $DiffVersion\n";
$datei = fopen("bad_ips.txt","a+");
fwrite($datei, "$IP\n");
fclose($datei);
}
}
$i++;
}
function send( $url = NULL )
{
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, FALSE);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; PHP client; '.php_uname('s').'; PHP/'.phpversion().')');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
$result = curl_exec($ch);
curl_close($ch);
return $result;
}
exit();
?>
And here is the iptables script for my RasPI:
#!/bin/bash
if [ `id -u` != "0" ] ; then
echo "You must be root to execute this script!"
exit 1
fi
DEV=wlan0
IPT=/sbin/iptables
cdhome/pi/nxt/
# restore old ipset rules
ipset restore </home/pi/nxt/ipset-rules.txt
# add every ip in bad_ips.txt to the ipset rule
for i in `cathome/pi/nxt/bad_ips.txt`; do sudo ipset add banned_hosts $i ; done
# activate and drop everything from the ipset
$IPT -A INPUT -m set -j DROP --match-set banned_hosts src
# save the current ipset rules
ipset save >/home/pi/nxt/ipset-rules.txt
And here is my traffic shaping script for my RasPI to save bandwidth(homeconnection):
#!/bin/bash
if [ `id -u` != "0" ] ; then
echo "You must be root to execute this script!"
exit 1
fi
DEV=wlan0
IPT=/sbin/iptables
TC=/sbin/tc
$IPT -t mangle -F
$TC qdisc del dev $DEV ingress >dev/null 2>&1
$TC qdisc del dev $DEV root >dev/null 2>&1
$TC qdisc del dev lo root >dev/null 2>&1
$TC qdisc add dev $DEV root handle 1:0 htb default 12 r2q 6
$TC class add dev $DEV parent 1:0 classid 1:1 htb rate 6000kbit ceil 100Mbit
$TC class add dev $DEV parent 1:1 classid 1:10 htb rate 5000kbit ceil 98Mbit prio 0
$TC class add dev $DEV parent 1:1 classid 1:11 htb rate 5000kbit ceil 98Mbit prio 1
$TC class add dev $DEV parent 1:1 classid 1:12 htb rate 5000kbit ceil 98Mbit prio 2
$TC class add dev $DEV parent 1:1 classid 1:13 htb rate 1000kbit ceil 2000kbit prio 3
$IPT -A POSTROUTING -t mangle -o $DEV -p tcp -m length --length :64 -j MARK --set-mark 10
$IPT -A POSTROUTING -t mangle -o $DEV -p udp --dport 53 -j MARK --set-mark 10
$IPT -A POSTROUTING -t mangle -o $DEV -p tcp --dport 22 -j MARK --set-mark 11
$IPT -A POSTROUTING -t mangle -o $DEV -p tcp --sport 22 -j MARK --set-mark 11
$IPT -A POSTROUTING -t mangle -o $DEV -p tcp --dport 7874 -j MARK --set-mark 13
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 11 fw flowid 1:11
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 13 fw flowid 1:13
$TC qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
$TC qdisc add dev $DEV parent 1:11 handle 11: sfq perturb 10
$TC qdisc add dev $DEV parent 1:12 handle 12: sfq perturb 10
$TC qdisc add dev $DEV parent 1:13 handle 13: sfq perturb 10
My new RasPI NRS start script for verson 0.8.x (pls update the one in wiki!):
#!/bin/bash
### BEGIN INIT INFO
# Provides: NXTserver
# Required-Start: $local_fs $remote_fs $network $syslog $named $sshd
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start/stop NXT server
### END INIT INFO
if [ `id -u` != "0" ] && [ "$1" = "start" -o "$1" = "stop" ] ; then
echo "You must be root to start/stop nxt."
exit 1
fi
# Settings
nxtdir=/home/pi/nxt
nxt=nxt.jar
java=/usr/bin/java
nxtpid=/var/run/nxt.pid
nxtlog=/home/pi/nxt/nxt.log
nxtuser=pi
nxtgroup=pi
nxtnice=19
timeout=700
maxmem=120
# end Settings
# check for exist files and dirs
test -d $nxtdir || exit 0
test -f $nxtdir/$nxt || exit 0
test -f $java || exit 0
# make sure $nxtdir is ours!
chown -R $nxtuser:$nxtgroup $nxtdir
.lib/lsb/init-functions
function status {
start-stop-daemon -T --pidfile "$nxtpid" && echo "NXT server is started." \
|| { echo "NXT server is stopped." ; return 1; }
return 0;
}
case "$1" in
start)
log_daemon_msg "Starting NXT server..." "" || true
# check if server is running
if [ -e $nxtpid ]; then
pid=`cat $nxtpid`
var=`ps -p$pid | wc -l`
if [ $var -lt "2" ]; then
# clear logfile
echo -n > $nxtlog
else
echo -n " NXT server is already running!"
log_end_msg 0 || true
exit 0
fi
fi
# Enable Debug for more info when starting NXT
if cat $nxtdir/conf/nxt.properties | grep -q "nxt.debug="; then
if cat $nxtdir/conf/nxt.properties | grep -q "nxt.debug=true"; then
# Debug is enabled, nothing todo...
echo -n ""
elif cat $nxtdir/conf/nxt.properties | grep -q "nxt.debug=false"; then
echo nxt.debug=true >> $nxtdir/conf/nxt.properties
fi
else
echo nxt.debug=true >> $nxtdir/conf/nxt.properties
fi
# n minute timeout.
sleep $timeout &
timerPid=$!
# check log file and generate status-msg; will be killed when server is started or timeout hit
tail -q -n0 -F --pid=$timerPid $nxtlog 2>dev/null | while read line; do
if echo $line | grep -q "Scanning blockchain"; then
echo -n " Scanning blockchain"
elif echo $line | grep -q "processed block"; then
echo -n "."
fi
if echo $line | grep -q "started successfully."; then
echo -n "NXT server started successfully."
log_end_msg 0 || true
# stop the timer..
kill $timerPid >dev/null 2>&1
$nxtdir/traffic_shaper.sh >dev/null 2>&1
fi
done &
# start server
if start-stop-daemon --start --name nxt --nicelevel $nxtnice --chuid $nxtuser:$nxtgroup --pidfile $nxtpid -m --chdir $nxtdir --exec $java >> $nxtlog 2>&1 -- -Xmx"$maxmem"m -cp $nxt:lib/*:conf nxt.Nxt >> $nxtlog 2>&1 & then
# wait for the timer to expire (or be killed)
wait %sleep >dev/null 2>&1
else
log_end_msg 1 || true
fi
;;
stop)
log_daemon_msg "Stopping NXT server..." || true
# check if server is running
if start-stop-daemon --stop --pidfile $nxtpid >dev/null 2>&1; then
while status >dev/null; do
sleep 1;
done
echo -n " NXT server stopped."
log_end_msg 0 || true
rm $nxtpid >dev/null 2>&1
else
echo -n " NXT server is not running!"
log_end_msg 0 || true
exit 0
fi
;;
restart)
$0 stop
sleep 1
$0 start
;;
status)
status
;;
*)
echo "usage:`basename $0` start | stop | restart | status"
exit 1
;;
esac
If anyone find something badly wrong, pls tell me! I'm not a php, linux or iptables expert, but I try to do my best
Greets,
eb
