ScriptsCollection/scriptlets/ipset/ipset.sh at main · eVAL-Agency/ScriptsCollection · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
# scriptlet:_common/get_firewall.sh
# scriptlet:_common/package_install.sh
# scriptlet:bz_eval_log/log.sh

##
# Create an ipset of the requested type
#
# Will silently exit if the ipset already exists.
#
# CHANGELOG:
#   2026.09.28 - Fix for UFW on reboots for persistent ipsets
#   2026.09.15 - Minor fix for firewalld CLI syntax
#   2026.09.13 - Initial version
#
function ipset_create() {
	# Argument parsing
	local NAME=""
	local TYPE="hash:ip"
	local IS_TEMP=0
	local TIMEOUT=""
	local FIREWALL_AVAILABLE="$(get_available_firewall)"
	local TIMEOUT_CLI=""

	while [ $# -ge 1 ]; do
		case $1 in
			--name)
				shift
				NAME="$1"
				;;
			--type)
				shift
				TYPE="$1"
				;;
			--temp)
				IS_TEMP=1
				;;
			--timeout)
				shift
				TIMEOUT="$1"
				;;
		esac
		shift
	done

	if [ -z "$NAME" ] || [ -z "$TYPE" ]; then
		log_error "ipset_create: Missing required parameters!"
		return 1
	fi

	package_install_if ipset

	if [ -n "$TIMEOUT" ]; then
		TIMEOUT_CLI="timeout $TIMEOUT"
	fi

	if ! ipset --list "$NAME" >/dev/null 2>&1; then
		# Does not exist yet, create it!
		ipset create "$NAME" "$TYPE" $TIMEOUT_CLI

		if [ "$FIREWALL_AVAILABLE" == "firewalld" ]; then
			if [ $IS_TEMP -eq 0 ]; then
				firewall-cmd --permanent --new-ipset="$NAME" --type="$TYPE"
				firewall-cmd --reload
			fi
		fi
	fi

	if [ "$FIREWALL_AVAILABLE" == "ufw" ]; then
		# UFW requires some additional attention to ensure that ipset is persistent across restarts.
		if [ $IS_TEMP -eq 0 ]; then
			ipset save > /etc/ipset.save
		fi

		if [ ! -e "/etc/systemd/system/ipset-persistent.service" ]; then
			cat > "/etc/systemd/system/ipset-persistent.service" <<EOD
[Unit]
Description=Restore ipset rules
Before=network-pre.target ufw.service
Wants=network-pre.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=/bin/sh -c '[ -f /etc/ipset.save ] && ipset restore < /etc/ipset.save || true'
ExecStart=-/bin/true
ExecStopPost=/sbin/ipset save > /etc/ipset.save

[Install]
WantedBy=multi-user.target
EOD
		systemctl daemon-reload
		systemctl enable ipset-persistent.service
		fi
	fi
}


##
# Swap the contents of an ipset into another
#
# Will ensure the first exists and will auto-remove the temp list on migration
#
function ipset_swap() {
	# Argument parsing
	local ORIGINAL="$1"
	local TEMPORARY="$2"

	if [ -z "$ORIGINAL" ] || [ -z "$TEMPORARY" ]; then
		log_error "ipset_swap: Missing required parameters!"
		return 1
	fi

	package_install_if ipset
	if ! ipset --list "$ORIGINAL" >/dev/null 2>&1; then
		# Does not exist yet!
		return 1
	fi

	ipset swap "$ORIGINAL" "$TEMPORARY"
	ipset destroy "$TEMPORARY"
}