banip: new package to block incoming & outgoing ip addresses

a new script based package called "banIP" to block
incoming & outgoing ip adresses/subnets via ipset.

Features:
* a shell script which uses ipset and iptables
  to ban a large number of IP addresses
  published in various IP blacklists (bogon, firehol etc.)
* support blocking by ASN numbers
* support blocking by iso country codes
* support local white & blacklist (IPv4, IPv6 & CIDR notation)
* auto-add unsuccessful ssh login attempts to local blacklist
* auto-add the uplink subnet to local whitelist
* per source configuration of SRC (incoming) and DST (outgoing)
* supports IPv4 & IPv6

Strong LuCI support:
* easy interface to track & change all aspects of your ipset
  configuration on the fly
* integrated IPSet-Lookup
* integrated RIPE-Lookup
* Log-Viewer & online configuration of white- & blacklist

LuCI-Screenshots will follow in the second post.
Forum discussion:
https://forum.openwrt.org/t/banip-new-project-needs-testers-feedback/16985

Signed-off-by: Dirk Brenken <dev@brenken.org>

net/banip/files/README.md

@@ -0,0 +1,75 @@
+# banIP - ban incoming and/or outgoing ip adresses via ipsets
+
+## Description
+IP address blocking is commonly used to protect against brute force attacks, prevent disruptive or unautherized address(es) from access or it can be used to restrict access to or from a particular geographic area — for example.  
+
+## Main Features
+* support many IP blocklist sources (free for private usage, for commercial use please check their individual licenses):
+* zero-conf like automatic installation & setup, usually no manual changes needed
+* supports six different download utilities: uclient-fetch, wget, curl, aria2c, wget-nossl, busybox-wget
+* Really fast downloads & list processing as they are handled in parallel as background jobs in a configurable 'Download Queue'
+* provides 'http only' mode without installed ssl library for all non-SSL blocklist sources
+* full IPv4 and IPv6 support
+* ipsets (one per source) are used to ban a large number of IP addresses
+* supports blocking by ASN numbers
+* supports blocking by iso country codes
+* supports local white & blacklist (IPv4, IPv6 & CIDR notation), located by default in /etc/banip/banip.whitelist and /etc/banip/banip.blacklist
+* auto-add unsuccessful ssh login attempts to local blacklist
+* auto-add the uplink subnet to local whitelist
+* per source configuration of SRC (incoming) and DST (outgoing)
+* integrated IPSet-Lookup
+* integrated RIPE-Lookup
+* blocklist source parsing by fast & flexible regex rulesets
+* minimal status & error logging to syslog, enable debug logging to receive more output
+* procd based init system support (start/stop/restart/reload/status)
+* procd network interface trigger support
+* output comprehensive runtime information via LuCI or via 'status' init command
+* strong LuCI support
+* optional: add new banIP sources on your own
+
+## Prerequisites
+* [OpenWrt](https://openwrt.org), tested with the stable release series (18.06) and with the latest snapshot
+* a download utility:
+    * to support all blocklist sources a full version (with ssl support) of 'wget', 'uclient-fetch' with one of the 'libustream-*' ssl libraries, 'aria2c' or 'curl' is required
+    * for limited devices with real memory constraints, banIP provides also a 'http only' option and supports wget-nossl and uclient-fetch (without libustream-ssl) as well
+
+## Installation & Usage
+* install 'banip' (_opkg install banip_)
+* at minimum configure the needed IP blocklist sources, the download utility and enable the banIP service in _/etc/config/banip_
+* control the banip service manually with _/etc/init.d/banip_ start/stop/restart/reload/status or use the LuCI frontend
+
+## LuCI banIP companion package
+* it's recommended to use the provided LuCI frontend to control all aspects of banIP
+* install 'luci-app-banip' (_opkg install luci-app-banip_)
+* the application is located in LuCI under 'Services' menu
+
+## Examples
+**receive banIP runtime information:**
+
+<pre><code>
+/etc/init.d/banip status
+::: banIP runtime information
+  + status     : enabled
+  + version    : 0.0.5
+  + fetch_info : /bin/uclient-fetch (libustream-ssl)
+  + ipset_info : 3 IPSets with overall 29510 IPs/Prefixes
+  + last_run   : 08.11.2018 15:03:50
+  + system     : GL-AR750S, OpenWrt SNAPSHOT r8419-860de2e1aa
+</code></pre>
+  
+**cronjob for a regular block list update (/etc/crontabs/root):**
+
+<pre><code>
+0 06 * * *    /etc/init.d/banip reload
+</code></pre>
+  
+
+## Support
+Please join the banIP discussion in this [forum thread](https://forum.openwrt.org/t/banip-new-project-needs-testers-feedback/16985) or contact me by mail <dev@brenken.org>  
+
+## Removal
+* stop all banIP related services with _/etc/init.d/banip stop_
+* optional: remove the banip package (_opkg remove banip_)
+
+Have fun!  
+Dirk