refactoring + golang 1.24.1

Dockerfile

@@ -1,27 +1,27 @@
 ARG IPTABLES_MODE=nft
 
 #install iptables
-FROM ubuntu:noble AS iptables
+FROM ubuntu:noble AS apt
 RUN --mount=type=cache,target=/var/lib/apt/lists,sharing=locked --mount=type=cache,target=/var/cache/apt,sharing=locked <<EOF
 apt update
 apt upgrade -y
-apt install iptables -y
+apt install iptables jq -y
 EOF
 
 #set alternative to use iptables-legacy
-FROM iptables AS iptables-legacy
+FROM apt AS iptables-legacy
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 
 #set alternative to use iptables-nft
-FROM iptables AS iptables-nft
+FROM apt AS iptables-nft
 RUN update-alternatives --set iptables /usr/sbin/iptables-nft
 RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
 
 #build crowdsec-custom-bouncer
-FROM golang:1.21.4 AS build-stage
+FROM golang:1.24.1 AS build-stage
 WORKDIR /app
-RUN git clone --depth 1 https://github.com/crowdsecurity/cs-custom-bouncer.git
+RUN git clone https://github.com/crowdsecurity/cs-custom-bouncer.git
 WORKDIR /app/cs-custom-bouncer
 RUN CGO_ENABLED=0 GOOS=linux make release
 
@@ -33,6 +33,7 @@ COPY --from=build-stage /app/cs-custom-bouncer/crowdsec-custom-bouncer \
     /usr/bin/crowdsec-custom-bouncer
 COPY --from=build-stage /app/cs-custom-bouncer/config/crowdsec-custom-bouncer.yaml \
     /crowdsec-custom-bouncer.yaml
+RUN sed -i "s/total_retries: .*/total_retries: 1/g" /crowdsec-custom-bouncer.yaml
 ADD --chmod=770 bouncer.sh /bouncer.sh
 ENV BINARY_PATH=/bouncer.sh
 LABEL me.ar2000.gitea.buildargs.iptablesmode="${IPTABLES_MODE}"

bouncer.sh

@@ -2,51 +2,85 @@
 #
 # Script to add /remove IPs to iptables
 
-[[ -n "${IPTABLES_COMMENT}" ]] && comment="-m comment --comment \"$4\"" || comment=""
+set -euo pipefail
-: ${IPTABLES_CHAIN:=INPUT}
 
-function iptableAdd () {
+main() (
-    if [[ -z "${IPTABLES_INSERT}" ]]; then
+  while read -r line; do
-        iptables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
+    # echo processAction "$(echo "$line" | jq -r '.action')" \
+    #   "$(echo "$line" | jq -r .value)" \
+    #   "$(echo "$line" | jq -r .duration)" \
+    #   "$(echo "$line" | jq -r .scenario)" |
+    #   tee bouncer.sh.out
+    processAction "$(echo "$line" | jq -r .action)" \
+      "$(echo "$line" | jq -r .value)" \
+      "$(echo "$line" | jq -r .duration)" \
+      "$(echo "$line" | jq -r .scenario)"
+  done
+  #{"duration":"-1h1m9s","origin":"CAPI","scenario":"crowdsecurity/ssh-bf","scope":"Ip","type":"ban","value":"122.117.32.192","id":22739513,"action":"del"}
+)
 
-    else
+: "${IPTABLES_CHAIN:=INPUT}"
-        iptables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
-    fi
-}
 
-function iptableDel () {
+function processAction() {
-    iptables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
-}
 
-function ip6tableAdd () {
+  if [[ -n "${IPTABLES_COMMENT}" ]]; then
-    if [[ -z "${IPTABLES_INSERT}" ]]; then
+    comment="-m comment --comment \"$4\""
-        ip6tables $comment -A $IPTABLES_CHAIN -s "$1" -j DROP
+  else
-    else
+    comment=""
-        ip6tables $comment -I $IPTABLES_CHAIN "$IPTABLES_INSERT" -s "$1" -j DROP
+  fi
-    fi
-}
 
-function ip6tableDel () {
+  #determine action
-    ip6tables $comment -D $IPTABLES_CHAIN -s "$1" -j DROP
+  if [ "$1" = "add" ]; then        #add
-}
-
-#determine action
-if [ "$1" = "add" ]; then #add
     if [[ "$2" =~ .*[.].* ]]; then #ipv4
-        echo "add $2 for $3 with $4"
+      echo "add $2 for $3 with $4"
-        iptableAdd "$2"
+      iptablesAdd "$2"
     elif [[ "$2" =~ .*[:].* ]]; then #ipv6
-        echo "IPV6 : add $2 for $3 with $4"
+      echo "IPV6 : add $2 for $3 with $4"
-        ip6tableAdd "$2"
+      ip6tableAdd "$2"
     fi
-elif [ "$1" = "del" ]; then #del
+  elif [ "$1" = "del" ]; then      #del
     if [[ "$2" =~ .*[.].* ]]; then #ipv4
-        echo "del $2 for $3 with $4"
+      echo "del $2 for $3 with $4"
-        iptableDel "$2"
+      iptablesDel "$2"
     elif [[ "$2" =~ .*[:].* ]]; then #ipv6
-        echo "IPV6 : add $2 for $3 with $4"
+      echo "IPV6 : add $2 for $3 with $4"
-        ip6tableDel "$2"
+      ip6tableDel "$2"
     fi
-else
+  else
-    echo  "unknown action"
+    echo "unknown action"
-fi
+  fi
+}
+
+function iptablesAdd() (
+  #check if the rule already exist
+  if ! iptables "$comment" -C "$IPTABLES_CHAIN" -s "$1" -j DROP; then
+    #do we insert at a $IPTABLES_INSERT position or append to the chain
+    if [[ -z "${IPTABLES_INSERT}" ]]; then
+      iptables "$comment" -A "$IPTABLES_CHAIN" -s "$1" -j DROP
+    else
+      iptables "$comment" -I "$IPTABLES_CHAIN" "$IPTABLES_INSERT" -s "$1" -j DROP
+    fi
+  fi
+)
+
+function ip6tableAdd() (
+  #check if the rule already exist
+  if ! ip6tables "$comment" -C "$IPTABLES_CHAIN" -s "$1" -j DROP; then
+    #do we insert at a $IPTABLES_INSERT position or append to the chain
+    if [[ -z "${IPTABLES_INSERT}" ]]; then
+      ip6tables "$comment" -A "$IPTABLES_CHAIN" -s "$1" -j DROP
+    else
+      ip6tables "$comment" -I "$IPTABLES_CHAIN" "$IPTABLES_INSERT" -s "$1" -j DROP
+    fi
+  fi
+)
+
+function iptablesDel() (
+  iptables "$comment" -D "$IPTABLES_CHAIN" -s "$1" -j DROP
+)
+
+function ip6tableDel() (
+  ip6tables "$comment" -D "$IPTABLES_CHAIN" -s "$1" -j DROP
+)
+
+main "$@"

publish-dev.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy-dev
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft-dev
+docker image tag gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest-dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:nft-dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:legacy-dev
+docker push gitea.ar2000.me/ar2000/crowdsec-legacy-firewall-bouncer:latest-dev