The functionality allows you to manage a list of automatically blocked IP addresses for all Filters within a single Mikiri WAF cluster (CID).
The ban and timestamp values are set by the Filter. The data is stored in Memcached for 60 seconds and is returned in accordance with the cluster of the license key. Data from all keys of the cluster is merged into one response. Duplicates (the records with the same set of ip + block + host) are excluded: the record with the largest sum of ttl + timestamp is returned.
Settings are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Request example:
curl http://api.example.com:8080/bansync/v1/get_bansync --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
If there is no data, null is returned in the ban field.
{
"status": "success",
"ban": [
{
"ip": string,
"ttl": integer,
"block": boolean,
"host": string,
"timestamp": integer
},
...
]
}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
ip - the IP address;
ttl - the block duration in seconds;
block - with the value true the IP address is blocked, with the value false the blocking is lifted;
host - a host (domain name), access to which is blocked for the IP address. The value null means that access to any host is blocked for the IP address;
timestamp - the date when the IP address was added to the list in the Unix Timestamp format.
Response example:
{
"status": "success",
"ban": [
{
"ip": "127.0.0.1",
"ttl": 30,
"block": true,
"host": "example.com",
"timestamp": 1234567890
},
{
"ip": "127.0.0.2",
"ttl": 30,
"block": true,
"host": "a.example.com",
"timestamp": 1234567891
},
{
"ip": "127.0.0.3",
"ttl": 30,
"block": true,
"host": null,
"timestamp": 1234567892
}
]
}
Request example:
curl http://api.example.com:8080/bansync/v1/del_bansync --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"ip": "127.0.0.1"
}'
ip - the IP address to delete is in IPv4/IPv6 format. It is allowed to use * to delete all IP addresses.
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}