fix tag

.gitignore

@@ -0,0 +1 @@
+.vscode/

Dockerfile

@@ -1,24 +1,31 @@
 ARG IPTABLES_MODE=nft
 
-FROM ubuntu:noble AS iptables
+#install iptables
+FROM ubuntu:noble AS apt
 RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked --mount=type=cache,target=/var/cache/apt,sharing=locked <<EOF
 apt update
 apt upgrade -y
-apt install iptables -y
+apt install iptables jq -y
 EOF
 
-FROM iptables AS iptables-legacy
+#set alternative to use iptables-legacy
+FROM apt AS iptables-legacy
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
+RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
-FROM iptables AS iptables-nft
+#set alternative to use iptables-nft
+FROM apt AS iptables-nft
 RUN update-alternatives --set iptables /usr/sbin/iptables-nft
+RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
 
-FROM golang:1.21.4 AS build-stage
+#build crowdsec-custom-bouncer
+FROM golang:1.24 AS build-stage
 WORKDIR /app
-RUN git clone --depth 1 https://github.com/crowdsecurity/cs-custom-bouncer.git
+RUN git clone https://github.com/crowdsecurity/cs-custom-bouncer.git
 WORKDIR /app/cs-custom-bouncer
 RUN CGO_ENABLED=0 GOOS=linux make release
 
+#build the final image
 FROM iptables-${IPTABLES_MODE} AS crowdsec-custom-bouncer
 ARG IPTABLES_MODE=nft
 RUN mkdir -p /etc/crowdsec/bouncers
@@ -26,7 +33,8 @@ COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
     /usr/bin/crowdsec-custom-bouncer
 COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
     /crowdsec-custom-bouncer.yaml
+RUN sed -i "s/total_retries: .*/total_retries: 1/g" /crowdsec-custom-bouncer.yaml
 ADD --chmod=770 bouncer.sh /bouncer.sh
-#prometheus port
+ENV BINARY_PATH=/bouncer.sh
 LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"
 CMD ["/usr/bin/crowdsec-custom-bouncer", "-c", "/crowdsec-custom-bouncer.yaml"]

README.md

@@ -0,0 +1,43 @@
+# crowdsec-legacy-firrewall-bouncer
+A Crowdsec firewall bouncer based on [crowdsec-custom-bouncer](https://github.com/crowdsecurity/cs-custom-bouncer) aimed at systems without support for `ipset`.
+
+## Tags :
+- [gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest](https://gitea.ar2000.me/AR2000/-/packages/container/crowdsec-legacy-firewall-bouncer/latest) : `iptables-legacy`
+- [gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy](https://gitea.ar2000.me/AR2000/-/packages/container/crowdsec-legacy-firewall-bouncer/legacy) : `iptables-legacy`
+- [gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft](https://gitea.ar2000.me/AR2000/-/packages/container/crowdsec-legacy-firewall-bouncer/nft) : `iptables-nft`
+
+## Environment variables :
+- `IPTABLES_COMMENT` : if set, iptables will load the `comment` module and use the reason argument passed by [crowdsec-custom-bouncer](https://github.com/crowdsecurity/cs-custom-bouncer) as the comment
+- `IPTABLES_INSERT` : insert new firewall rules at a fixed position
+- `API_KEY` : crowdsec api key
+- `IPTABLES_CHAIN` : chain to use
+
+## Configuration :
+Set your custom configuration in the `crowdsec-custom-bouncer.yaml.local` file and mount it as a volume at the root of the container. See [Overriding values](https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration/#overriding-values) or [bouncers/custom](https://docs.crowdsec.net/u/bouncers/custom) for information about the configuration.
+
+### Example configuration :
+```yaml
+log_mode: stdout
+scenarios_containing: ["ssh"]
+origins: ["cscli", "crowdsec"]
+supported_decisions_types:
+  - ban
+```
+
+## Docker compose :
+```yaml
+services:
+    cs-firewall-bouncer:
+        image: gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy
+        restart: unless-stopped
+        environment:
+            - IPTABLES_INSERT=3
+            - IPTABLES_COMMENT=true
+        cap_add:
+            # allow modification of host's iptable
+            - NET_ADMIN
+            - NET_RAW
+        network_mode: "host"
+        volumes:
+            - ./crowdsec-custom-bouncer.yaml.local:/crowdsec-custom-bouncer.yaml.local #load custom config values
+```

bouncer.sh

@@ -2,55 +2,85 @@
 #
 # Script to add /remove IPs to iptables
 
-[[ -z "${IPTABLES_COMMENT}" ]] && commment="-m comment --comment $4" || comment=""
+set -euo pipefail
 
-function iptableAdd () {
-    if [[ -z "${IPTABLES_INSERT}" ]]; then
-        iptables $comment -A INPUT -s $1 -j DROP
-        iptables $comment -A DOCKER-USER -s $1 -j DROP
-    else
-        iptables $comment -I INPUT $IPTABLES_INSERT -s $1 -j DROP
-        iptables $comment -I DOCKER-USER $IPTABLES_INSERT -s $1 -j DROP
-    fi
-}
+main() (
+  while read -r line; do
+    # echo processAction "$(echo "$line" | jq -r '.action')" \
+    #   "$(echo "$line" | jq -r .value)" \
+    #   "$(echo "$line" | jq -r .duration)" \
+    #   "$(echo "$line" | jq -r .scenario)" |
+    #   tee bouncer.sh.out
+    processAction "$(echo "$line" | jq -r .action)" \
+      "$(echo "$line" | jq -r .value)" \
+      "$(echo "$line" | jq -r .duration)" \
+      "$(echo "$line" | jq -r .scenario)"
+  done
+  #{"duration":"-1h1m9s","origin":"CAPI","scenario":"crowdsecurity/ssh-bf","scope":"Ip","type":"ban","value":"122.117.32.192","id":22739513,"action":"del"}
+)
 
-function iptableDel () {
-    iptables $comment -D INPUT -s $1 -j DROP
-    iptables $comment -D DOCKER-USER -s $1 -j DROP
-}
+: "${IPTABLES_CHAIN:=INPUT}"
 
-function ip6tableAdd () {
-    if [[ -z "${IPTABLES_INSERT}" ]]; then
-        ip6tables $comment -A INPUT -s $1 -j DROP
-        ip6tables $comment -A DOCKER-USER -s $1 -j DROP
-    else
-        ip6tables $comment -I INPUT $IPTABLES_INSERT -s $1 -j DROP
-        ip6tables $comment -I DOCKER-USER $IPTABLES_INSERT -s $1 -j DROP
-    fi
-}
+function processAction() {
 
-function ip6tableDel () {
-    ip6tables $comment -D INPUT -s $1 -j DROP
-    ip6tables $comment -D DOCKER-USER -s $1 -j DROP
-}
+  if [[ -n "${IPTABLES_COMMENT}" ]]; then
+    comment="-m comment --comment \"$4\""
+  else
+    comment=""
+  fi
 
-#determine action
-if [ "$1" = "add" ]; then #add
+  #determine action
+  if [ "$1" = "add" ]; then        #add
     if [[ "$2" =~ .*[.].* ]]; then #ipv4
-        echo "add $2 for $3 with $4"
-        iptableAdd $2
+      echo "add $2 for $3 with $4"
+      iptablesAdd "$2"
     elif [[ "$2" =~ .*[:].* ]]; then #ipv6
-        echo "IPV6 : add $2 for $3 with $4"
-        ip6tableAdd $2
+      echo "IPV6 : add $2 for $3 with $4"
+      ip6tableAdd "$2"
     fi
-elif [ "$1" = "del" ]; then #del
+  elif [ "$1" = "del" ]; then      #del
     if [[ "$2" =~ .*[.].* ]]; then #ipv4
-        echo "del $2 for $3 with $4"
-        iptableDel $2
+      echo "del $2 for $3 with $4"
+      iptablesDel "$2"
     elif [[ "$2" =~ .*[:].* ]]; then #ipv6
-        echo "IPV6 : add $2 for $3 with $4"
-        ip6tableDel $2
+      echo "IPV6 : add $2 for $3 with $4"
+      ip6tableDel "$2"
     fi
-else
-    echo  "unknon action"
-fi
+  else
+    echo "unknown action"
+  fi
+}
+
+function iptablesAdd() (
+  #check if the rule already exist
+  if ! iptables "$comment" -C "$IPTABLES_CHAIN" -s "$1" -j DROP; then
+    #do we insert at a $IPTABLES_INSERT position or append to the chain
+    if [[ -z "${IPTABLES_INSERT}" ]]; then
+      iptables "$comment" -A "$IPTABLES_CHAIN" -s "$1" -j DROP
+    else
+      iptables "$comment" -I "$IPTABLES_CHAIN" "$IPTABLES_INSERT" -s "$1" -j DROP
+    fi
+  fi
+)
+
+function ip6tableAdd() (
+  #check if the rule already exist
+  if ! ip6tables "$comment" -C "$IPTABLES_CHAIN" -s "$1" -j DROP; then
+    #do we insert at a $IPTABLES_INSERT position or append to the chain
+    if [[ -z "${IPTABLES_INSERT}" ]]; then
+      ip6tables "$comment" -A "$IPTABLES_CHAIN" -s "$1" -j DROP
+    else
+      ip6tables "$comment" -I "$IPTABLES_CHAIN" "$IPTABLES_INSERT" -s "$1" -j DROP
+    fi
+  fi
+)
+
+function iptablesDel() (
+  iptables "$comment" -D "$IPTABLES_CHAIN" -s "$1" -j DROP
+)
+
+function ip6tableDel() (
+  ip6tables "$comment" -D "$IPTABLES_CHAIN" -s "$1" -j DROP
+)
+
+main "$@"

build.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+docker build --build-arg IPTABLES_MODE=nft -t gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft .
+docker build --build-arg IPTABLES_MODE=legacy -t gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy .
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest

publish-dev.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy-dev
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft-dev
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft-dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy-dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:dev

publish.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest