AR2000/crowdsec-legacy-firewall-bouncer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

script feed from stdin via json

Browse Source 
Squashed commit of the following:

commit ad482533fa
Author: AR2000 <ar2000@ar2000.me>
Date:   Thu Jan 16 15:33:16 2025 +0100

    add jq to container

commit 79352ec046
Author: AR2000 <ar2000@ar2000.me>
Date:   Thu Jan 16 14:55:37 2025 +0100

    stdin

commit 3100810052
Author: AR2000 <ar2000@ar2000.me>
Date:   Thu Jan 16 14:33:05 2025 +0100

    test
This commit is contained in:
AR2000
2025-01-16 15:44:56 +01:00
parent 9fbd21f958
commit 09186aedac
3 changed files with 51 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
bouncer.sh
View File

@@ -2,51 +2,68 @@
#
# Script to add /remove IPs to iptables
[[ -n "${IPTABLES_COMMENT}" ]] && comment="-m comment --comment \"$4\"" || comment=""
: ${IPTABLES_CHAIN:=INPUT}
function iptableAdd () {
function iptableAdd() {
#check if the rule already exist
if ! iptables $comment -C $IPTABLES_CHAIN -s "$1" -j DROP; then
#do we insert at a $IPTABLES_INSERT position or append to the chain
if [[ -z "${IPTABLES_INSERT}" ]]; then
iptables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
iptables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
else
iptables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
iptables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
fi
fi
}
function iptableDel () {
iptables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
function iptableDel() {
iptables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
}
function ip6tableAdd () {
function ip6tableAdd() {
#check if the rule already exist
if ! ip6tables $comment -C $IPTABLES_CHAIN -s "$1" -j DROP; then
#do we insert at a $IPTABLES_INSERT position or append to the chain
if [[ -z "${IPTABLES_INSERT}" ]]; then
ip6tables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
ip6tables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
else
ip6tables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
ip6tables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
fi
fi
}
function ip6tableDel () {
ip6tables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
function ip6tableDel() {
ip6tables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
}
#determine action
if [ "$1" = "add" ]; then #add
function processAction() {
[[ -n "${IPTABLES_COMMENT}" ]] && comment="-m comment --comment \"$4\"" || comment=""
#determine action
if [ "$1" = "add" ]; then #add
if [[ "$2" =~ .*[.].* ]]; then #ipv4
echo "add $2 for $3 with $4"
iptableAdd "$2"
echo "add $2 for $3 with $4"
iptableAdd "$2"
elif [[ "$2" =~ .*[:].* ]]; then #ipv6
echo "IPV6 : add $2 for $3 with $4"
ip6tableAdd "$2"
echo "IPV6 : add $2 for $3 with $4"
ip6tableAdd "$2"
fi
elif [ "$1" = "del" ]; then #del
elif [ "$1" = "del" ]; then #del
if [[ "$2" =~ .*[.].* ]]; then #ipv4
echo "del $2 for $3 with $4"
iptableDel "$2"
echo "del $2 for $3 with $4"
iptableDel "$2"
elif [[ "$2" =~ .*[:].* ]]; then #ipv6
echo "IPV6 : add $2 for $3 with $4"
ip6tableDel "$2"
echo "IPV6 : add $2 for $3 with $4"
ip6tableDel "$2"
fi
else
echo "unknown action"
fi
else
echo "unknown action"
fi
}
while read line; do
echo processAction $(echo "$line" | jq -r .action) $(echo "$line" | jq -r .value) $(echo "$line" | jq -r .duration) $(echo "$line" | jq -r .scenario) | tee bouncer.sh.out
processAction $(echo "$line" | jq -r .action) $(echo "$line" | jq -r .value) $(echo "$line" | jq -r .duration) $(echo "$line" | jq -r .scenario)
done
#{"duration":"-1h1m9s","origin":"CAPI","scenario":"crowdsecurity/ssh-bf","scope":"Ip","type":"ban","value":"122.117.32.192","id":22739513,"action":"del"}