net/crowdsec-firewall-bouncer/files/crowdsec-firewall-bouncer.initd

   1 #!/bin/sh /etc/rc.common
   2
   3 USE_PROCD=1
   4
   5 START=99
   6
   7 NAME=crowdsec-firewall-bouncer
   8 PROG=/usr/bin/cs-firewall-bouncer
   9 VARCONFIGDIR=/var/etc/crowdsec/bouncers
  10 VARCONFIG=/var/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
  11
  12 CONFIGURATION=crowdsec
  13
  14 TABLE="crowdsec"
  15 TABLE6="crowdsec6"
  16
  17 service_triggers() {
  18         procd_add_reload_trigger crowdsec-firewall-bouncer
  19         procd_add_config_trigger "config.change" "crowdsec" /etc/init.d/crowdsec-firewall-bouncer reload
  20 }
  21
  22 init_yaml() {
  23
  24         local section="$1"
  25
  26         local update_frequency
  27         local log_level
  28         local api_url
  29         local api_key
  30         local ipv6
  31         local deny_action
  32         local deny_log
  33         local log_prefix
  34         local log_max_size
  35         local log_max_backups
  36         local log_max_age
  37         local ipv4
  38         local input_chain_name
  39         local input6_chain_name
  40
  41         config_get update_frequency $section update_frequency '10s'
  42         config_get log_level $section log_level 'info'
  43         config_get api_url $section api_url "http://127.0.0.1:8080"
  44         config_get api_key $section api_key "API_KEY"
  45         config_get_bool ipv6 $section ipv6 '1'
  46         config_get deny_action $section deny_action "drop"
  47         config_get_bool deny_log $section deny_log '0'
  48         config_get log_prefix $section log_prefix "crowdsec: "
  49         config_get log_max_size $section log_max_size '100'
  50         config_get log_max_backups $section log_max_backups '3'
  51         config_get log_max_age $section log_max_age '30'
  52         config_get_bool ipv4 $section ipv4 '1'
  53         config_get input_chain_name $section input_chain_name "input"
  54         config_get input6_chain_name $section input6_chain_name "input"
  55
  56         # Create tmp dir & permissions if needed
  57         if [ ! -d "${VARCONFIGDIR}" ]; then
  58                 mkdir -m 0755 -p "${VARCONFIGDIR}"
  59         fi;
  60
  61         cat > $VARCONFIG <<-EOM
  62         mode: nftables
  63         pid_dir: /var/run/
  64         update_frequency: $update_frequency
  65         daemonize: true
  66         log_mode: file
  67         log_dir: /var/log/
  68         log_level: $log_level
  69         log_compression: true
  70         log_max_size: $log_max_size
  71         log_max_backups: $log_max_backups
  72         log_max_age: $log_max_age
  73         api_url: $api_url
  74         api_key: $api_key
  75         insecure_skip_verify: true
  76         disable_ipv6: boolnot($ipv6)
  77         deny_action: $deny_action
  78         deny_log: bool($deny_log)
  79         supported_decisions_type:
  80           - ban
  81         #to change log prefix
  82         deny_log_prefix: "$log_prefix"
  83         #to change the blacklists name
  84         blacklists_ipv4: crowdsec-blacklists
  85         blacklists_ipv6: crowdsec6-blacklists
  86         #type of ipset to use
  87         ipset_type: nethash
  88         #if present, insert rule in those chains
  89         iptables_chains:
  90           - INPUT
  91         #  - FORWARD
  92         #  - DOCKER-USER
  93         ## nftables
  94         nftables:
  95           ipv4:
  96             enabled: bool($ipv4)
  97             set-only: true
  98             table: $TABLE
  99             chain: $input_chain_name
 100           ipv6:
 101             enabled: bool($ipv6)
 102             set-only: true
 103             table: $TABLE6
 104             chain: $input6_chain_name
 105         # packet filter
 106         pf:
 107           # an empty disables the anchor
 108           anchor_name: ""
 109         prometheus:
 110           enabled: false
 111           listen_addr: 127.0.0.1
 112           listen_port: 60601
 113         EOM
 114
 115         sed -i "s/bool(1)/true/g" $VARCONFIG
 116         sed -i "s/bool(0)/false/g" $VARCONFIG
 117         sed -i "s/boolnot(1)/false/g" $VARCONFIG
 118         sed -i "s/boolnot(0)/true/g" $VARCONFIG
 119         sed -i "s,^\(\s*api_url\s*:\s*\).*\$,\1$api_url," $VARCONFIG
 120         sed -i "s,^\(\s*api_key\s*:\s*\).*\$,\1$api_key," $VARCONFIG
 121 }
 122
 123 init_nftables() {
 124
 125         local section="$1"
 126
 127         local priority
 128         local deny_action
 129         local deny_log
 130         local log_prefix
 131         local ipv4
 132         local ipv6
 133         local filter_input
 134         local filter_forward
 135         local input_chain_name
 136         local forward_chain_name
 137         local input6_chain_name
 138         local forward6_chain_name
 139         local interface
 140         local log_term=""
 141
 142         config_get priority $section priority "4"
 143         config_get deny_action $section deny_action "drop"
 144         config_get_bool deny_log $section deny_log '0'
 145         config_get log_prefix $section log_prefix "crowdsec: "
 146         config_get_bool ipv4 $section ipv4 '1'
 147         config_get_bool ipv6 $section ipv6 '1'
 148         config_get_bool filter_input $section filter_input '1'
 149         config_get_bool filter_forward $section filter_forward '1'
 150         config_get input_chain_name $section input_chain_name "input"
 151         config_get forward_chain_name $section forward_chain_name "forward"
 152         config_get input6_chain_name $section input6_chain_name "input"
 153         config_get forward6_chain_name $section forward6_chain_name "forward"
 154         config_get interface $section interface 'eth1'
 155
 156         if [ "$deny_log" -eq "1" ] ; then
 157                 local log_term="log prefix \"${log_prefix}\""
 158         fi
 159
 160         local interface="${interface// /, }"
 161
 162         #as of kernel 3.18 we can delete a table without need to flush it
 163         nft delete table ip crowdsec 2>/dev/null
 164         nft delete table ip6 crowdsec6 2>/dev/null
 165
 166         if [ "$ipv4" -eq "1" ] ; then
 167
 168                 nft add table ip crowdsec
 169                 nft add set ip crowdsec crowdsec-blacklists '{ type ipv4_addr; flags timeout; }'
 170
 171                 if [ "$filter_input" -eq "1" ] ; then
 172                         nft add chain ip "$TABLE" $input_chain_name "{ type filter hook input priority $priority; policy accept; }"
 173                         nft add rule ip "$TABLE" $input_chain_name iifname { $interface } ct state new ip saddr @crowdsec-blacklists ${log_term} counter $deny_action
 174                 fi
 175                 if [ "$filter_forward" -eq "1" ] ; then
 176                         nft add chain ip "$TABLE" $forward_chain_name "{ type filter hook forward priority $priority; policy accept; }"
 177                         nft add rule ip "$TABLE" $forward_chain_name iifname { $interface } ct state new ip saddr @crowdsec-blacklists ${log_term} counter $deny_action
 178                 fi
 179         fi
 180
 181         if [ "$ipv6" -eq "1" ] ; then
 182
 183                 nft add table ip6 crowdsec6
 184                 nft add set ip6 crowdsec6 crowdsec6-blacklists '{ type ipv6_addr; flags timeout; }'
 185
 186                 if [ "$filter_input" -eq "1" ] ; then
 187                         nft add chain ip6 "$TABLE6" $input6_chain_name "{ type filter hook input priority $priority; policy accept; }"
 188                         nft add rule ip6 "$TABLE6" $input6_chain_name iifname { $interface } ct state new ip6 saddr @crowdsec6-blacklists ${log_term} counter $deny_action
 189                 fi
 190                 if [ "$filter_forward" -eq "1" ] ; then
 191                         nft add chain ip6 "$TABLE6" $forward6_chain_name "{ type filter hook forward priority $priority; policy accept; }"
 192                         nft add rule ip6 "$TABLE6" $forward6_chain_name iifname { $interface } ct state new ip6 saddr @crowdsec6-blacklists ${log_term} counter $deny_action
 193                 fi
 194         fi
 195 }
 196
 197 run_bouncer() {
 198
 199         local section="$1"
 200
 201         local enabled
 202         config_get_bool enabled $section enabled 0
 203
 204         if [ "$enabled" -eq "1" ] ; then
 205
 206                 init_yaml "$section"
 207                 init_nftables "$section"
 208
 209                 procd_open_instance
 210                 procd_set_param command "$PROG" -c "$VARCONFIG"
 211                 procd_set_param stdout 1
 212                 procd_set_param stderr 1
 213                 procd_close_instance
 214         fi
 215 }
 216
 217 start_service() {
 218
 219         config_load "${CONFIGURATION}"
 220         config_foreach run_bouncer bouncer
 221 }
 222
 223 service_stopped() {
 224
 225         rm $VARCONFIG
 226
 227         nft delete table ip crowdsec 2>/dev/null
 228         nft delete table ip6 crowdsec6 2>/dev/null
 229 }
 230
 231