BlacklistIpExtractor.hpp

1. Overview

The BlacklistIpExtractor.hpp header defines the BlacklistIpExtractor utility class, a backend processing component responsible for extracting malicious or suspicious IP addresses from textual input and generating firewall-ready blacklist files.

This module is typically used to transform threat intelligence feeds, log outputs, or security reports into structured IP lists suitable for automated network filtering.

Functionally, BlacklistIpExtractor provides:

  • Parsing of unstructured or semi-structured text sources
  • Detection and validation of IPv4/IPv6 addresses
  • Filtering of malformed or duplicate entries
  • Generation of firewall-compatible blacklist files
  • Support for automated network defense workflows
  • Temporary and custom output path management

2. Dependencies and Includes

#include <string>
#include <vector>
  • <string> – line parsing and output file paths
  • <vector> – container for input text lines

3. Class Declaration and Scope

class BlacklistIpExtractor

The class is implemented as a static utility container. All methods are static, and no instances are intended to be created.

4. Public Interface

4.1 IP Extraction and Output Generator

static bool extractAndWrite(
    const std::vector<std::string>& lines,
    const std::string& outPath =
        "/tmp/bastionguard-firewall-ips.txt"
);

Processes the provided text lines, extracts valid IP addresses, and writes the resulting blacklist to the specified file path.

  • lines – input text lines containing potential IP addresses
  • outPath – destination file path for the generated blacklist
  • Return value – true on successful extraction and write, false on error

The default output path is optimized for temporary firewall rule ingestion.

5. UI Components

This component does not define graphical UI elements. It operates exclusively as a backend processing utility.

6. Internal State and Data Model

No persistent or shared state is stored in this class. All processing is performed on the input data supplied to extractAndWrite().

7. Internal Logic

A typical extraction workflow includes:

  • Iterating over input text lines
  • Applying pattern matching for IPv4 and IPv6 formats
  • Validating address ranges and syntax
  • Removing duplicate or private-network addresses
  • Normalizing output format
  • Writing sanitized results to disk

8. Integration with Firewall and Network Security

The generated blacklist files are commonly consumed by:

  • iptables / nftables automation scripts
  • Fail2Ban or similar intrusion prevention systems
  • BastionGuard network defense modules
  • External firewall management services

This enables near-real-time enforcement of network-level blocking rules.

9. Auto-Update (Scheduled Refresh)

This component does not implement scheduling. It is typically invoked by periodic jobs or update services managed elsewhere.

10. Settings Storage

Output path configuration is provided at runtime. No internal configuration persistence is handled by this class.

11. Helper Functions and Filesystem Layout

The default output file location is:

/tmp/bastionguard-firewall-ips.txt

Production deployments may redirect output to protected system directories such as:

/etc/bastionguard/firewall/

12. Runtime and Security Considerations

  • Input validation: untrusted feeds must be sanitized to prevent injection of malformed firewall rules.
  • Privilege boundaries: writing to system firewall directories may require elevated permissions.
  • Race conditions: temporary files in /tmp should be created securely to avoid symlink attacks.
  • False positives: automated extraction must be reviewed to avoid blocking legitimate infrastructure.
  • Atomic writes: output files should be written using temporary files and rename semantics when possible.
  • Auditability: generated blacklists should be logged and versioned for traceability.
Published on:
Last updated on: