script feed from stdin via json

Squashed commit of the following:

commit ad482533fa
Author: AR2000 <ar2000@ar2000.me>
Date:   Thu Jan 16 15:33:16 2025 +0100

    add jq to container

commit 79352ec046
Author: AR2000 <ar2000@ar2000.me>
Date:   Thu Jan 16 14:55:37 2025 +0100

    stdin

commit 3100810052
Author: AR2000 <ar2000@ar2000.me>
Date:   Thu Jan 16 14:33:05 2025 +0100

    test

Dockerfile

@@ -1,20 +1,20 @@
 ARG IPTABLES_MODE=nft
 
 #install iptables
-FROM ubuntu:noble AS iptables
+FROM ubuntu:noble AS apt
 RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked --mount=type=cache,target=/var/cache/apt,sharing=locked <<EOF
 apt update
 apt upgrade -y
-apt install iptables -y
+apt install iptables jq -y
 EOF
 
 #set alternative to use iptables-legacy
-FROM iptables AS iptables-legacy
+FROM apt AS iptables-legacy
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
 #set alternative to use iptables-nft
-FROM iptables AS iptables-nft
+FROM apt AS iptables-nft
 RUN update-alternatives --set iptables /usr/sbin/iptables-nft
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
 
@@ -33,6 +33,7 @@ COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
     /usr/bin/crowdsec-custom-bouncer
 COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
     /crowdsec-custom-bouncer.yaml
+RUN sed -i "s/total_retries: .*/total_retries: 1/g" /crowdsec-custom-bouncer.yaml
 ADD --chmod=770 bouncer.sh /bouncer.sh
 ENV BINARY_PATH=/bouncer.sh
 LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"

bouncer.sh

@@ -2,51 +2,68 @@
 #
 # Script to add /remove IPs to iptables
 
-[[ -n "${IPTABLES_COMMENT}" ]] && comment="-m comment --comment \"$4\"" || comment=""
 : ${IPTABLES_CHAIN:=INPUT}
 
-function iptableAdd () {
+function iptableAdd() {
+  #check if the rule already exist
+  if ! iptables $comment -C $IPTABLES_CHAIN -s "$1" -j DROP; then
+    #do we insert at a $IPTABLES_INSERT position or append to the chain
     if [[ -z "${IPTABLES_INSERT}" ]]; then
-        iptables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
+      iptables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
-
     else
-        iptables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
+      iptables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
     fi
+  fi
 }
 
-function iptableDel () {
+function iptableDel() {
-    iptables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
+  iptables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
 }
 
-function ip6tableAdd () {
+function ip6tableAdd() {
+  #check if the rule already exist
+  if ! ip6tables $comment -C $IPTABLES_CHAIN -s "$1" -j DROP; then
+    #do we insert at a $IPTABLES_INSERT position or append to the chain
     if [[ -z "${IPTABLES_INSERT}" ]]; then
-        ip6tables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
+      ip6tables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
     else
-        ip6tables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
+      ip6tables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
     fi
+  fi
 }
 
-function ip6tableDel () {
+function ip6tableDel() {
-    ip6tables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
+  ip6tables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
 }
 
-#determine action
+function processAction() {
-if [ "$1" = "add" ]; then #add
+
+  [[ -n "${IPTABLES_COMMENT}" ]] && comment="-m comment --comment \"$4\"" || comment=""
+
+  #determine action
+  if [ "$1" = "add" ]; then        #add
     if [[ "$2" =~ .*[.].* ]]; then #ipv4
-        echo "add $2 for $3 with $4"
+      echo "add $2 for $3 with $4"
-        iptableAdd "$2"
+      iptableAdd "$2"
     elif [[ "$2" =~ .*[:].* ]]; then #ipv6
-        echo "IPV6 : add $2 for $3 with $4"
+      echo "IPV6 : add $2 for $3 with $4"
-        ip6tableAdd "$2"
+      ip6tableAdd "$2"
     fi
-elif [ "$1" = "del" ]; then #del
+  elif [ "$1" = "del" ]; then      #del
     if [[ "$2" =~ .*[.].* ]]; then #ipv4
-        echo "del $2 for $3 with $4"
+      echo "del $2 for $3 with $4"
-        iptableDel "$2"
+      iptableDel "$2"
     elif [[ "$2" =~ .*[:].* ]]; then #ipv6
-        echo "IPV6 : add $2 for $3 with $4"
+      echo "IPV6 : add $2 for $3 with $4"
-        ip6tableDel "$2"
+      ip6tableDel "$2"
     fi
-else
+  else
-    echo  "unknown action"
+    echo "unknown action"
-fi
+  fi
+}
+
+while read line; do
+  echo processAction $(echo "$line" | jq -r .action) $(echo "$line" | jq -r .value) $(echo "$line" | jq -r .duration) $(echo "$line" | jq -r .scenario) | tee bouncer.sh.out
+  processAction $(echo "$line" | jq -r .action) $(echo "$line" | jq -r .value) $(echo "$line" | jq -r .duration) $(echo "$line" | jq -r .scenario)
+done
+#{"duration":"-1h1m9s","origin":"CAPI","scenario":"crowdsecurity/ssh-bf","scope":"Ip","type":"ban","value":"122.117.32.192","id":22739513,"action":"del"}

publish-dev.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:dev