#!/bin/sh
TMPDIR=$(mktemp -d)
BRUTES=/home/barry/brutes.txt

# IPs already blocked.
doas pfctl -t bruteforce -T show | sed 's/^   //' > $TMPDIR/x

# IPs that disconnected preauth, i.e. failed to authenticate/ testing.
grep "Disconnected" /var/log/authlog | \
    grep "preauth" | \
    grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | \
    sort -u > $TMPDIR/y

cat $TMPDIR/x $TMPDIR/y $BRUTES |sort -u |grep -v -e'^192\.168' -e'^10\.' > $TMPDIR/z

mv $TMPDIR/z $BRUTES

for ip in $(cat $BRUTES); do
    doas pfctl -t bruteforce -T add $ip
done

for ip in $(grep -i "barry" /var/log/authlog | \
        grep 'Accepted' | \
        grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | \
        sort -u ); do
    doas pfctl -t admin -T add $ip
    doas pfctl -t bruteforce -Td $ip
done

rm -rf $TMPDIR
