ff8b853a6d
* new 'ca-bundle' dependency as all https connections are now validated by default * automatically select the download utility: 'aria2', 'curl', 'uclient-fetch' with libustream-* or wget are supported * track & ban failed LuCI login attempts as well * add a small log/banIP background monitor to block SSH/LuCI brute force attacks in realtime (disabled by default) * add a config version check (please update your default config!) * made the automatic wan detection more stable * fix the IPv6 logfile parser * fix the service status message * update readme Signed-off-by: Dirk Brenken <dev@brenken.org>
94 lines
1.9 KiB
Bash
Executable file
94 lines
1.9 KiB
Bash
Executable file
#!/bin/sh /etc/rc.common
|
|
#
|
|
|
|
START=30
|
|
USE_PROCD=1
|
|
|
|
EXTRA_COMMANDS="refresh status"
|
|
EXTRA_HELP=" refresh Refresh ipsets without new list downloads
|
|
status Print runtime information"
|
|
|
|
ban_init="/etc/init.d/banip"
|
|
ban_script="/usr/bin/banip.sh"
|
|
ban_pidfile="/var/run/banip.pid"
|
|
|
|
boot()
|
|
{
|
|
ban_boot="1"
|
|
rc_procd start_service
|
|
}
|
|
|
|
start_service()
|
|
{
|
|
if [ "$("${ban_init}" enabled; printf "%u" ${?})" -eq 0 ]
|
|
then
|
|
if [ "${ban_boot}" = "1" ]
|
|
then
|
|
return 0
|
|
fi
|
|
local nice="$(uci_get banip extra ban_nice "0")"
|
|
procd_open_instance "banip"
|
|
procd_set_param command "${ban_script}" "${@}"
|
|
procd_set_param pidfile "${ban_pidfile}"
|
|
procd_set_param nice "${nice}"
|
|
procd_set_param stdout 1
|
|
procd_set_param stderr 1
|
|
procd_close_instance
|
|
fi
|
|
}
|
|
|
|
refresh()
|
|
{
|
|
[ -s "${ban_pidfile}" ] && return 1
|
|
rc_procd start_service refresh
|
|
}
|
|
|
|
reload_service()
|
|
{
|
|
rc_procd start_service reload
|
|
}
|
|
|
|
stop_service()
|
|
{
|
|
rc_procd "${ban_script}" stop
|
|
}
|
|
|
|
status_service()
|
|
{
|
|
local key keylist value
|
|
local rtfile="$(uci_get banip global ban_rtfile "/tmp/ban_runtime.json")"
|
|
|
|
json_load_file "${rtfile}" >/dev/null 2>&1
|
|
json_select data >/dev/null 2>&1
|
|
if [ "${?}" -eq 0 ]
|
|
then
|
|
printf "%s\\n" "::: banIP runtime information"
|
|
json_get_keys keylist
|
|
for key in ${keylist}
|
|
do
|
|
json_get_var value "${key}"
|
|
printf " + %-10s : %s\\n" "${key}" "${value}"
|
|
done
|
|
else
|
|
printf "%s\\n" "::: no banIP runtime information available"
|
|
fi
|
|
}
|
|
|
|
service_triggers()
|
|
{
|
|
local iface iface_list="$(uci_get banip global ban_iface)"
|
|
local delay="$(uci_get banip extra ban_triggerdelay "2")"
|
|
local type="$(uci_get banip extra ban_starttype "start")"
|
|
|
|
PROCD_RELOAD_DELAY=$((${delay}*1000))
|
|
if [ -n "${iface_list}" ]
|
|
then
|
|
for iface in ${iface_list}
|
|
do
|
|
procd_add_interface_trigger "interface.*.up" "${iface}" "${ban_init}" "${type}"
|
|
done
|
|
else
|
|
procd_add_raw_trigger "interface.*.up" ${PROCD_RELOAD_DELAY} "${ban_init}" "${type}"
|
|
fi
|
|
procd_add_reload_trigger "banip"
|
|
}
|