initial commit

Dockerfile

@@ -0,0 +1,32 @@
+ARG IPTABLES_MODE=nft
+
+FROM ubuntu:noble AS iptables
+RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked --mount=type=cache,target=/var/cache/apt,sharing=locked <<EOF
+apt update
+apt upgrade -y
+apt install iptables -y
+EOF
+
+FROM iptables AS iptables-legacy
+RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
+
+FROM iptables AS iptables-nft
+RUN update-alternatives --set iptables /usr/sbin/iptables-nft
+
+FROM golang:1.21.4 AS build-stage
+WORKDIR /app
+RUN git clone --depth 1 https://github.com/crowdsecurity/cs-custom-bouncer.git
+WORKDIR /app/cs-custom-bouncer
+RUN CGO_ENABLED=0 GOOS=linux make release
+
+FROM iptables-${IPTABLES_MODE} AS crowdsec-custom-bouncer
+ARG IPTABLES_MODE=nft
+RUN mkdir -p /etc/crowdsec/bouncers
+COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
+    /usr/bin/crowdsec-custom-bouncer
+COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
+    /crowdsec-custom-bouncer.yaml
+ADD --chmod=770 bouncer.sh /bouncer.sh
+#prometheus port
+LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"
+CMD ["/usr/bin/crowdsec-custom-bouncer", "-c", "/crowdsec-custom-bouncer.yaml"]

bouncer.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+#
+# Script to add /remove IPs to iptables
+
+[[ -z "${IPTABLES_COMMENT}" ]] && commment="-m comment --comment $4" || comment=""
+
+function iptableAdd () {
+    if [[ -z "${IPTABLES_INSERT}" ]]; then
+        iptables $comment -A INPUT -s $1 -j DROP
+        iptables $comment -A DOCKER-USER -s $1 -j DROP
+    else
+        iptables $comment -I INPUT $IPTABLES_INSERT -s $1 -j DROP
+        iptables $comment -I DOCKER-USER $IPTABLES_INSERT -s $1 -j DROP
+    fi
+}
+
+function iptableDel () {
+    iptables $comment -D INPUT -s $1 -j DROP
+    iptables $comment -D DOCKER-USER -s $1 -j DROP
+}
+
+function ip6tableAdd () {
+    if [[ -z "${IPTABLES_INSERT}" ]]; then
+        ip6tables $comment -A INPUT -s $1 -j DROP
+        ip6tables $comment -A DOCKER-USER -s $1 -j DROP
+    else
+        ip6tables $comment -I INPUT $IPTABLES_INSERT -s $1 -j DROP
+        ip6tables $comment -I DOCKER-USER $IPTABLES_INSERT -s $1 -j DROP
+    fi
+}
+
+function ip6tableDel () {
+    ip6tables $comment -D INPUT -s $1 -j DROP
+    ip6tables $comment -D DOCKER-USER -s $1 -j DROP
+}
+
+#determine action
+if [ "$1" = "add" ]; then #add
+    if [[ "$2" =~ .*[.].* ]]; then #ipv4
+        echo "add $2 for $3 with $4"
+        iptableAdd $2
+    elif [[ "$2" =~ .*[:].* ]]; then #ipv6
+        echo "IPV6 : add $2 for $3 with $4"
+        ip6tableAdd $2
+    fi
+elif [ "$1" = "del" ]; then #del
+    if [[ "$2" =~ .*[.].* ]]; then #ipv4
+        echo "del $2 for $3 with $4"
+        iptableDel $2
+    elif [[ "$2" =~ .*[:].* ]]; then #ipv6
+        echo "IPV6 : add $2 for $3 with $4"
+        ip6tableDel $2
+    fi
+else
+    echo  "unknon action"
+fi