|
Lines 11-16
Link Here
|
| 11 |
# Default is "NO" |
11 |
# Default is "NO" |
| 12 |
# crowdsec_firewall_config (str): Set the bouncer config path. |
12 |
# crowdsec_firewall_config (str): Set the bouncer config path. |
| 13 |
# Default is "%%ETCDIR%%/crowdsec-firewall-bouncer.yaml" |
13 |
# Default is "%%ETCDIR%%/crowdsec-firewall-bouncer.yaml" |
|
|
14 |
# crowdsec_firewall_name (str): Name of the bouncer to register. |
| 15 |
# Default is dynamically generated. |
| 14 |
# crowdsec_firewall_flags (str): extra flags to run bouncer. |
16 |
# crowdsec_firewall_flags (str): extra flags to run bouncer. |
| 15 |
# Default is "" |
17 |
# Default is "" |
| 16 |
|
18 |
|
|
Lines 20-58
name=crowdsec_firewall
Link Here
|
| 20 |
desc="Crowdsec Firewall" |
22 |
desc="Crowdsec Firewall" |
| 21 |
rcvar=crowdsec_firewall_enable |
23 |
rcvar=crowdsec_firewall_enable |
| 22 |
|
24 |
|
| 23 |
load_rc_config $name |
25 |
load_rc_config "$name" |
| 24 |
|
26 |
|
| 25 |
: "${crowdsec_firewall_enable:=NO}" |
27 |
: "${crowdsec_firewall_enable:=NO}" |
| 26 |
: "${crowdsec_firewall_config:=%%ETCDIR%%/crowdsec-firewall-bouncer.yaml}" |
28 |
: "${crowdsec_firewall_config:=%%ETCDIR%%/crowdsec-firewall-bouncer.yaml}" |
|
|
29 |
: "${crowdsec_firewall_name:=cs-firewall-bouncer-$(date +%s)}" |
| 27 |
: "${crowdsec_firewall_flags:=}" |
30 |
: "${crowdsec_firewall_flags:=}" |
| 28 |
|
31 |
|
| 29 |
pidfile=/var/run/${name}.pid |
32 |
pidfile=/var/run/${name}.pid |
| 30 |
required_files="$crowdsec_firewall_config" |
33 |
required_files="$crowdsec_firewall_config" |
| 31 |
command="%%PREFIX%%/bin/crowdsec-firewall-bouncer" |
34 |
command="%%PREFIX%%/bin/crowdsec-firewall-bouncer" |
| 32 |
start_cmd="${name}_start" |
35 |
start_cmd="${name}_start" |
|
|
36 |
stop_cmd="${name}_stop" |
| 33 |
start_precmd="${name}_precmd" |
37 |
start_precmd="${name}_precmd" |
|
|
38 |
configtest_cmd="${name}_configtest" |
| 39 |
extra_commands="configtest" |
| 34 |
|
40 |
|
| 35 |
crowdsec_firewall_precmd() { |
41 |
crowdsec_firewall_precmd() { |
| 36 |
CSCLI=%%PREFIX%%/bin/cscli |
42 |
CSCLI=%%PREFIX%%/bin/cscli |
| 37 |
orig_line="api_key: \${API_KEY}" |
43 |
# there might be quotes |
|
|
44 |
orig_line="api_key: .*\${API_KEY}.*" |
| 38 |
# IF the bouncer is not configured |
45 |
# IF the bouncer is not configured |
| 39 |
if grep -q "^${orig_line}" "${crowdsec_firewall_config}"; then |
46 |
if grep -q "^${orig_line}" "${crowdsec_firewall_config}"; then |
| 40 |
BOUNCER="cs-firewall-bouncer-$(date +%s)" |
|
|
| 41 |
# AND crowdsec is installed.. |
47 |
# AND crowdsec is installed.. |
| 42 |
if command -v "$CSCLI" >/dev/null; then |
48 |
if command -v "$CSCLI" >/dev/null; then |
| 43 |
# THEN, register it to the local API |
49 |
# THEN, register it to the local API |
| 44 |
API_KEY=$($CSCLI bouncers add "${BOUNCER}" -o raw) |
50 |
API_KEY=$($CSCLI bouncers add "${crowdsec_firewall_name}" -o raw) |
| 45 |
if [ -n "$API_KEY" ]; then |
51 |
if [ -n "$API_KEY" ]; then |
| 46 |
sed -i "" "s/^${orig_line}/api_key: ${API_KEY} # ${BOUNCER}/" "${crowdsec_firewall_config}" |
52 |
sed -i "" "s|^${orig_line}|api_key: ${API_KEY} # ${crowdsec_firewall_name}|" "${crowdsec_firewall_config}" |
| 47 |
echo "Registered: ${BOUNCER}" |
53 |
echo "Registered: ${crowdsec_firewall_name}" |
| 48 |
fi |
54 |
fi |
| 49 |
fi |
55 |
fi |
| 50 |
fi |
56 |
fi |
| 51 |
} |
57 |
} |
| 52 |
|
58 |
|
|
|
59 |
crowdsec_firewall_stop() |
| 60 |
{ |
| 61 |
if [ ! -f "$pidfile" ]; then |
| 62 |
echo "${name} is not running." |
| 63 |
return |
| 64 |
fi |
| 65 |
pid=$(cat "$pidfile") |
| 66 |
if kill -0 "$pid" >/dev/null 2>&1; then |
| 67 |
echo "Stopping ${name}." |
| 68 |
kill -s TERM "$pid" >/dev/null 2>&1 |
| 69 |
# shellcheck disable=SC2034 |
| 70 |
for i in $(seq 1 20); do |
| 71 |
sleep 1 |
| 72 |
if ! kill -0 "$pid" >/dev/null 2>&1; then |
| 73 |
rm -f "$pidfile" |
| 74 |
return |
| 75 |
fi |
| 76 |
done |
| 77 |
echo "Timeout, terminating ${name} with SIGKILL." |
| 78 |
kill -s KILL "$pid" >/dev/null 2>&1 |
| 79 |
rm -f "$pidfile" |
| 80 |
else |
| 81 |
echo "${name} is not running." |
| 82 |
fi |
| 83 |
} |
| 84 |
|
| 53 |
crowdsec_firewall_start() { |
85 |
crowdsec_firewall_start() { |
| 54 |
/usr/sbin/daemon -f -p ${pidfile} -t "${desc}" -- \ |
86 |
/usr/sbin/daemon -f -p "$pidfile" -t "$desc" -- \ |
| 55 |
${command} -c "${crowdsec_firewall_config}" ${crowdsec_firewall_flags} |
87 |
"$command" -c "$crowdsec_firewall_config" ${crowdsec_firewall_flags} |
|
|
88 |
} |
| 89 |
|
| 90 |
crowdsec_firewall_configtest() |
| 91 |
{ |
| 92 |
echo "Performing sanity check on ${name} configuration." |
| 93 |
if "$command" -c "$crowdsec_firewall_config" -t; then |
| 94 |
echo "Configuration test OK" |
| 95 |
fi |
| 56 |
} |
96 |
} |
| 57 |
|
97 |
|
| 58 |
run_rc_command "$1" |
98 |
run_rc_command "$1" |