AR2000/crowdsec-legacy-firewall-bouncer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

refactoring + golang 1.24.1

Browse Source
This commit is contained in:
AR2000
2025-05-25 17:14:37 +02:00
parent ad482533fa
commit 1feac5e60d
3 changed files with 64 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Dockerfile
View File

@@ -19,9 +19,9 @@ RUN update-alternatives --set iptables /usr/sbin/iptables-nft
RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
#build crowdsec-custom-bouncer #build crowdsec-custom-bouncer
FROM golang:1.21.4 AS build-stage FROM golang:1.24.1 AS build-stage
WORKDIR /app WORKDIR /app
RUN git clone --depth 1 https://github.com/crowdsecurity/cs-custom-bouncer.git RUN git clone https://github.com/crowdsecurity/cs-custom-bouncer.git
WORKDIR /app/cs-custom-bouncer WORKDIR /app/cs-custom-bouncer
RUN CGO_ENABLED=0 GOOS=linux make release RUN CGO_ENABLED=0 GOOS=linux make release

95
bouncer.sh
View File

@@ -2,49 +2,38 @@
# #
# Script to add /remove IPs to iptables # Script to add /remove IPs to iptables
: ${IPTABLES_CHAIN:=INPUT} set -euo pipefail
function iptableAdd() { main() (
#check if the rule already exist while read -r line; do
if ! iptables $comment -C $IPTABLES_CHAIN -s "$1" -j DROP; then # echo processAction "$(echo "$line" | jq -r '.action')" \
#do we insert at a $IPTABLES_INSERT position or append to the chain # "$(echo "$line" | jq -r .value)" \
if [[ -z "${IPTABLES_INSERT}" ]]; then # "$(echo "$line" | jq -r .duration)" \
iptables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP # "$(echo "$line" | jq -r .scenario)" |
else # tee bouncer.sh.out
iptables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP processAction "$(echo "$line" | jq -r .action)" \
fi "$(echo "$line" | jq -r .value)" \
fi "$(echo "$line" | jq -r .duration)" \
} "$(echo "$line" | jq -r .scenario)"
done
#{"duration":"-1h1m9s","origin":"CAPI","scenario":"crowdsecurity/ssh-bf","scope":"Ip","type":"ban","value":"122.117.32.192","id":22739513,"action":"del"}
)
function iptableDel() { : "${IPTABLES_CHAIN:=INPUT}"
iptables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
}
function ip6tableAdd() {
#check if the rule already exist
if ! ip6tables $comment -C $IPTABLES_CHAIN -s "$1" -j DROP; then
#do we insert at a $IPTABLES_INSERT position or append to the chain
if [[ -z "${IPTABLES_INSERT}" ]]; then
ip6tables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
else
ip6tables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
fi
fi
}
function ip6tableDel() {
ip6tables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
}
function processAction() { function processAction() {
[[ -n "${IPTABLES_COMMENT}" ]] && comment="-m comment --comment \"$4\"" || comment="" if [[ -n "${IPTABLES_COMMENT}" ]]; then
comment="-m comment --comment \"$4\""
else
comment=""
fi
#determine action #determine action
if [ "$1" = "add" ]; then #add if [ "$1" = "add" ]; then #add
if [[ "$2" =~ .*[.].* ]]; then #ipv4 if [[ "$2" =~ .*[.].* ]]; then #ipv4
echo "add $2 for $3 with $4" echo "add $2 for $3 with $4"
iptableAdd "$2" iptablesAdd "$2"
elif [[ "$2" =~ .*[:].* ]]; then #ipv6 elif [[ "$2" =~ .*[:].* ]]; then #ipv6
echo "IPV6 : add $2 for $3 with $4" echo "IPV6 : add $2 for $3 with $4"
ip6tableAdd "$2" ip6tableAdd "$2"
@@ -52,7 +41,7 @@ function processAction() {
elif [ "$1" = "del" ]; then #del elif [ "$1" = "del" ]; then #del
if [[ "$2" =~ .*[.].* ]]; then #ipv4 if [[ "$2" =~ .*[.].* ]]; then #ipv4
echo "del $2 for $3 with $4" echo "del $2 for $3 with $4"
iptableDel "$2" iptablesDel "$2"
elif [[ "$2" =~ .*[:].* ]]; then #ipv6 elif [[ "$2" =~ .*[:].* ]]; then #ipv6
echo "IPV6 : add $2 for $3 with $4" echo "IPV6 : add $2 for $3 with $4"
ip6tableDel "$2" ip6tableDel "$2"
@@ -62,8 +51,36 @@ function processAction() {
fi fi
} }
while read line; do function iptablesAdd() (
echo processAction $(echo "$line" | jq -r .action) $(echo "$line" | jq -r .value) $(echo "$line" | jq -r .duration) $(echo "$line" | jq -r .scenario) | tee bouncer.sh.out #check if the rule already exist
processAction $(echo "$line" | jq -r .action) $(echo "$line" | jq -r .value) $(echo "$line" | jq -r .duration) $(echo "$line" | jq -r .scenario) if ! iptables "$comment" -C "$IPTABLES_CHAIN" -s "$1" -j DROP; then
done #do we insert at a $IPTABLES_INSERT position or append to the chain
#{"duration":"-1h1m9s","origin":"CAPI","scenario":"crowdsecurity/ssh-bf","scope":"Ip","type":"ban","value":"122.117.32.192","id":22739513,"action":"del"} if [[ -z "${IPTABLES_INSERT}" ]]; then
iptables "$comment" -A "$IPTABLES_CHAIN" -s "$1" -j DROP
else
iptables "$comment" -I "$IPTABLES_CHAIN" "$IPTABLES_INSERT" -s "$1" -j DROP
fi
fi
)
function ip6tableAdd() (
#check if the rule already exist
if ! ip6tables "$comment" -C "$IPTABLES_CHAIN" -s "$1" -j DROP; then
#do we insert at a $IPTABLES_INSERT position or append to the chain
if [[ -z "${IPTABLES_INSERT}" ]]; then
ip6tables "$comment" -A "$IPTABLES_CHAIN" -s "$1" -j DROP
else
ip6tables "$comment" -I "$IPTABLES_CHAIN" "$IPTABLES_INSERT" -s "$1" -j DROP
fi
fi
)
function iptablesDel() (
iptables "$comment" -D "$IPTABLES_CHAIN" -s "$1" -j DROP
)
function ip6tableDel() (
ip6tables "$comment" -D "$IPTABLES_CHAIN" -s "$1" -j DROP
)
main "$@"

8
publish-dev.sh
View File

@@ -1,3 +1,7 @@
#!/bin/bash #!/bin/bash
docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:dev docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy-dev
docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:dev docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft-dev
docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest-dev
docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft-dev
docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy-dev
docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest-dev