blob: 5764dbc36c45b7591fa7332fe0fd1bfc53aa91c2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
#!/bin/sh /etc/rc.common
# banIP init script - ban incoming and outgoing IPs via named nftables Sets
# Copyright (c) 2018-2026 Dirk Brenken (dev@brenken.org)
# This is free software, licensed under the GNU General Public License v3.
# (s)hellcheck exceptions
# shellcheck disable=all
START=95
USE_PROCD=1
extra_command "report" "[text|json|mail|gen] Print banIP related Set statistics"
extra_command "search" "[<IPv4 address>|<IPv6 address>] Check if an element exists in a banIP Set"
extra_command "content" "[<Set name>] [true|false] Listing of all or only elements with hits of a given banIP Set"
extra_command "actual" "Print nft/monitor actuals"
ban_init="/etc/init.d/banip"
ban_service="/usr/bin/banip-service.sh"
ban_funlib="/usr/lib/banip-functions.sh"
ban_pidfile="/var/run/banIP/banIP.pid"
ban_lock="/var/run/banIP/banIP.lock"
if [ -z "${IPKG_INSTROOT}" ]; then
# check for running instance and handle boot trigger
#
case "${action}" in
"boot")
"${ban_init}" running && exit 0
;;
"stop" | "report" | "content")
"${ban_init}" running || exit 0
;;
esac
# reset pidfile if no/stale process is found,
# otherwise exit with error to prevent multiple instances
#
case "${action}" in
"boot" | "start" | "restart" | "reload" | "search")
if [ -d "${ban_lock}" ]; then
pid="$(cat "${ban_pidfile}" 2>/dev/null)"
if [ -n "${pid}" ] && kill -0 "${pid}" 2>/dev/null; then
exit 1
else
rm -rf "${ban_lock}"
fi
fi
mkdir -p "${ban_lock}"
;;
esac
. "${ban_funlib}"
fi
boot() {
rc_procd start_service boot
}
start_service() {
if "${ban_init}" enabled; then
if [ "${1}" = "refresh" ]; then
f_conf
if f_refresh; then
rm -rf "${ban_lock}"
return 0
fi
fi
f_rmpid
read -r ban_nonce _ <"/proc/uptime"
procd_open_instance "banip-service"
procd_set_param command "${ban_service}" "${action}"
procd_set_param env ban_nonce="${ban_nonce}"
procd_set_param pidfile "${ban_pidfile}"
procd_set_param nice "$(uci_get banip global ban_nicelimit "0")"
procd_set_param limits nofile="$(uci_get banip global ban_filelimit "1024")"
procd_set_param stdout 0
procd_set_param stderr 1
procd_close_instance
else
f_log "err" "banIP service autostart is disabled"
fi
}
reload_service() {
f_rmpid
rc_procd start_service reload
}
stop_service() {
"${ban_nftcmd}" delete table inet banIP >/dev/null 2>&1
f_genstatus "stopped"
f_rmpid
[ "${action}" = "stop" ] && rm -rf "${ban_lock}"
}
restart() {
stop_service
rc_procd start_service restart
}
status() {
status_service
}
status_service() {
f_getstatus
}
report() {
f_report "${1:-"text"}"
}
search() {
f_search "${1}"
rm -rf "${ban_lock}"
}
content() {
f_content "${1}" "${2:-"false"}"
}
actual() {
f_actual
}
service_triggers() {
local iface trigger delay
delay="$(uci_get banip global ban_triggerdelay "20")"
trigger="$(uci_get banip global ban_trigger)"
PROCD_RELOAD_DELAY="$((delay * 1000))"
for iface in ${trigger}; do
procd_add_interface_trigger "interface.*" "${iface}" "${ban_init}" start refresh
done
}
|
