chiefgeek
a1a17e81a1
Includes updated JS challenge scripts with Claude-User whitelist, same-site referer bypass, Blackbox-Exporter allowed bot, and all new exporters, cheat sheets, and automation scripts.
667 lines
24 KiB
Bash
Executable File
667 lines
24 KiB
Bash
Executable File
#!/bin/bash
|
|
################################################################################
|
|
# Script Name: iptables-blocklist-metrics.sh
|
|
# Version: 2.03
|
|
# Description: Prometheus exporter for iptables threat feed blocking metrics
|
|
# Author: Phil Connor
|
|
# Contact: contact@mylinux.work
|
|
# Website: https://mylinux.work
|
|
# License: MIT
|
|
#
|
|
# Changes in v2.03:
|
|
# - Fixed blocked_total metric type from counter to gauge (rolling window)
|
|
# - Fixed HTTP response headers (printf with proper \r\n termination)
|
|
# - Fixed rule-stats grep prefix-matching wrong feed (word-boundary match)
|
|
# - Cached iptables -L INPUT output once per scrape instead of per-feed
|
|
# - Removed unused get_iptables_rule_stats helper function
|
|
# - Used FEEDS_ARRAY instead of grep on config file for ipset status check
|
|
# - Removed unnecessary sync call in textfile output path
|
|
#
|
|
# Changes in v2.02:
|
|
# - Added journal data caching (single journalctl call instead of per-feed)
|
|
# - Added feeds config caching into array
|
|
# - Fixed ipset member counting to use Members: section
|
|
# - Added SCRIPT_VERSION variable for version strings
|
|
# - Added scrape timestamp metric
|
|
# - Fixed hardcoded version in info metric and HTML page
|
|
################################################################################
|
|
|
|
# Ensure PATH includes sbin (for ipset/iptables when run from cron)
|
|
export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
|
|
#
|
|
# EXPORTED METRICS:
|
|
# - iptables_blocklist_info - Exporter metadata
|
|
# - iptables_blocklist_enabled_feeds - Count of enabled feeds
|
|
# - iptables_blocklist_ipset_size - IPs per feed ipset (IPv4/v6)
|
|
# - iptables_blocklist_blocked_total - Block counts per feed (1h, 24h)
|
|
# - iptables_blocklist_effectiveness - Blocks per 1000 IPs (24h)
|
|
# - iptables_blocklist_last_update_timestamp - Feed cache file mtime
|
|
# - iptables_blocklist_cache_age_seconds - Age of feed cache files
|
|
# - iptables_blocklist_file_size_bytes - Feed parsed file sizes
|
|
# - iptables_blocklist_ip_version_ratio - IPv4 vs IPv6 distribution per feed
|
|
# - iptables_blocklist_total_unique_ips - Total unique IPs across all feeds
|
|
# - iptables_blocklist_total_rules - Total iptables rules
|
|
# - iptables_blocklist_rule_packets - Packet counts from iptables rules
|
|
# - iptables_blocklist_rule_bytes - Byte counts from iptables rules
|
|
# - iptables_blocklist_conntrack_entries - Current conntrack entries
|
|
# - iptables_blocklist_conntrack_max - Maximum conntrack entries
|
|
# - iptables_blocklist_conntrack_usage_percent - Conntrack usage percentage
|
|
# - iptables_blocklist_whitelist_size - Whitelist ipset sizes
|
|
# - iptables_blocklist_exporter_runtime_seconds - Script execution time
|
|
|
|
CONFIG_DIR="/etc/iptables-threats"
|
|
CACHE_DIR="$CONFIG_DIR/cache"
|
|
FEEDS_CONFIG="$CONFIG_DIR/feeds.conf"
|
|
IPSET_PREFIX="iptables-feed"
|
|
WHITELIST_IPSET="iptables-whitelist"
|
|
WHITELIST_IPSET_V6="iptables-whitelist-v6"
|
|
|
|
TEXTFILE_DIR="/var/lib/node_exporter"
|
|
OUTPUT_FILE=""
|
|
HTTP_MODE=false
|
|
HTTP_PORT=9419
|
|
LOCK_FILE="/var/run/iptables-blocklist-metrics.lock"
|
|
SCRIPT_VERSION="2.03"
|
|
|
|
# Global cache variables
|
|
JOURNAL_1H=""
|
|
JOURNAL_24H=""
|
|
FEEDS_ARRAY=()
|
|
|
|
show_usage() {
|
|
cat <<EOF
|
|
Usage: $0 [OPTIONS]
|
|
|
|
Export per-feed iptables threat statistics as Prometheus metrics.
|
|
|
|
MODES:
|
|
--textfile Write to node_exporter textfile collector
|
|
--http Run HTTP server on port $HTTP_PORT
|
|
|
|
OPTIONS:
|
|
-p, --port HTTP port (default: 9419)
|
|
-o, --output Output file
|
|
-h, --help Show this help
|
|
|
|
EXAMPLES:
|
|
# Write to textfile collector
|
|
$0 --textfile
|
|
|
|
# Run as HTTP server
|
|
$0 --http --port 9419
|
|
|
|
# Generate metrics to stdout
|
|
$0
|
|
|
|
EOF
|
|
exit 0
|
|
}
|
|
|
|
parse_args() {
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
-h|--help) show_usage ;;
|
|
--textfile) OUTPUT_FILE="$TEXTFILE_DIR/iptables_blocklist.prom"; shift ;;
|
|
--http) HTTP_MODE=true; shift ;;
|
|
-p|--port) HTTP_PORT="$2"; shift 2 ;;
|
|
-o|--output) OUTPUT_FILE="$2"; shift 2 ;;
|
|
*) echo "Unknown: $1"; exit 1 ;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
# Load all journal data ONCE at startup
|
|
cache_journal_data() {
|
|
JOURNAL_1H=$(timeout 10 journalctl -k --since "1 hour ago" 2>/dev/null | grep '\[THREAT' || echo "")
|
|
JOURNAL_24H=$(timeout 30 journalctl -k --since "24 hours ago" 2>/dev/null | grep '\[THREAT' || echo "")
|
|
}
|
|
|
|
# Parse feeds config ONCE into array
|
|
cache_feeds_config() {
|
|
FEEDS_ARRAY=()
|
|
if [ -f "$FEEDS_CONFIG" ]; then
|
|
while IFS='|' read -r enabled name url type description; do
|
|
[[ "$enabled" =~ ^#.*$ ]] && continue
|
|
[[ -z "$enabled" ]] && continue
|
|
FEEDS_ARRAY+=("$enabled|$name|$url|$type|$description")
|
|
done < "$FEEDS_CONFIG"
|
|
fi
|
|
}
|
|
|
|
get_ipset_size() {
|
|
local ipset_name="$1"
|
|
local count
|
|
count=$(ipset list "$ipset_name" 2>/dev/null | sed -n '/^Members:$/,$p' | tail -n +2 | wc -l)
|
|
echo "${count:-0}"
|
|
}
|
|
|
|
get_feed_blocks() {
|
|
local feed="$1"
|
|
local period="$2"
|
|
local data
|
|
|
|
case "$period" in
|
|
"1 hour ago") data="$JOURNAL_1H" ;;
|
|
"24 hours ago") data="$JOURNAL_24H" ;;
|
|
*) echo 0; return ;;
|
|
esac
|
|
|
|
if [ -z "$data" ]; then echo 0; return; fi
|
|
local count
|
|
count=$(printf '%s' "$data" | grep -c "\[THREAT:${feed}\]" 2>/dev/null)
|
|
echo "${count:-0}"
|
|
}
|
|
|
|
get_feed_blocks_v6() {
|
|
local feed="$1"
|
|
local period="$2"
|
|
local data
|
|
|
|
case "$period" in
|
|
"1 hour ago") data="$JOURNAL_1H" ;;
|
|
"24 hours ago") data="$JOURNAL_24H" ;;
|
|
*) echo 0; return ;;
|
|
esac
|
|
|
|
if [ -z "$data" ]; then echo 0; return; fi
|
|
local count
|
|
count=$(printf '%s' "$data" | grep -c "\[THREAT-v6:${feed}\]" 2>/dev/null)
|
|
echo "${count:-0}"
|
|
}
|
|
|
|
get_file_timestamp() {
|
|
[ -f "$1" ] && stat -c %Y "$1" 2>/dev/null || echo "0"
|
|
}
|
|
|
|
get_file_size() {
|
|
[ -f "$1" ] && stat -c %s "$1" 2>/dev/null || echo "0"
|
|
}
|
|
|
|
get_cache_age() {
|
|
if [ -f "$1" ]; then
|
|
echo $(($(date +%s) - $(stat -c %Y "$1" 2>/dev/null || echo 0)))
|
|
else
|
|
echo "0"
|
|
fi
|
|
}
|
|
|
|
get_total_unique_ips() {
|
|
local ip_version="$1"
|
|
local count=0
|
|
|
|
if [ "$ip_version" = "4" ]; then
|
|
count=$(cat "$CACHE_DIR/"*-v4.parsed 2>/dev/null | sort -u | wc -l 2>/dev/null)
|
|
elif [ "$ip_version" = "6" ]; then
|
|
count=$(cat "$CACHE_DIR/"*-v6.parsed 2>/dev/null | sort -u | wc -l 2>/dev/null)
|
|
fi
|
|
|
|
echo "${count:-0}"
|
|
}
|
|
|
|
get_conntrack_count() {
|
|
if [ -f /proc/sys/net/netfilter/nf_conntrack_count ]; then
|
|
cat /proc/sys/net/netfilter/nf_conntrack_count
|
|
else
|
|
echo "0"
|
|
fi
|
|
}
|
|
|
|
get_conntrack_max() {
|
|
if [ -f /proc/sys/net/netfilter/nf_conntrack_max ]; then
|
|
cat /proc/sys/net/netfilter/nf_conntrack_max
|
|
else
|
|
echo "0"
|
|
fi
|
|
}
|
|
|
|
get_ipset_memory() {
|
|
local ipset_name="$1"
|
|
local mem
|
|
mem=$(ipset list "$ipset_name" -t 2>/dev/null | grep "Size in memory:" | awk '{print $4}')
|
|
echo "${mem:-0}"
|
|
}
|
|
|
|
get_cache_disk_usage() {
|
|
if [ -d "$CACHE_DIR" ]; then
|
|
df -B1 "$CACHE_DIR" 2>/dev/null | tail -1 | awk '{print $3"|"$4"|"$5}'
|
|
else
|
|
echo "0|0|0%"
|
|
fi
|
|
}
|
|
|
|
get_total_cache_size() {
|
|
if [ -d "$CACHE_DIR" ]; then
|
|
du -sb "$CACHE_DIR" 2>/dev/null | awk '{print $1}'
|
|
else
|
|
echo "0"
|
|
fi
|
|
}
|
|
|
|
acquire_lock() {
|
|
if [ -f "$LOCK_FILE" ]; then
|
|
local pid
|
|
pid=$(cat "$LOCK_FILE" 2>/dev/null)
|
|
if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
|
|
echo "ERROR: Another instance is already running (PID: $pid)" >&2
|
|
exit 1
|
|
else
|
|
echo "Removing stale lock file" >&2
|
|
rm -f "$LOCK_FILE"
|
|
fi
|
|
fi
|
|
echo $$ > "$LOCK_FILE"
|
|
trap cleanup EXIT INT TERM
|
|
}
|
|
|
|
cleanup() {
|
|
rm -f "$LOCK_FILE"
|
|
}
|
|
|
|
generate_metrics() {
|
|
local start_time
|
|
start_time=$(date +%s)
|
|
|
|
local iptables_input_stats
|
|
iptables_input_stats=$(iptables -L INPUT -v -n -x 2>/dev/null)
|
|
|
|
cat <<EOF
|
|
# HELP iptables_blocklist_info Per-feed iptables threat blocking info
|
|
# TYPE iptables_blocklist_info gauge
|
|
iptables_blocklist_info{mode="per-feed",version="${SCRIPT_VERSION}"} 1
|
|
|
|
# HELP iptables_blocklist_enabled_feeds Total enabled feeds
|
|
# TYPE iptables_blocklist_enabled_feeds gauge
|
|
iptables_blocklist_enabled_feeds $(printf '%s\n' "${FEEDS_ARRAY[@]}" | grep -c '^1|')
|
|
|
|
# HELP iptables_blocklist_ipset_size Number of IPs per feed ipset
|
|
# TYPE iptables_blocklist_ipset_size gauge
|
|
EOF
|
|
|
|
# Only export metrics for ipsets that actually exist
|
|
for ipset_name in $(ipset list -n 2>/dev/null | grep "^${IPSET_PREFIX}-"); do
|
|
# Extract feed name and IP version
|
|
local feed_name="${ipset_name#"${IPSET_PREFIX}"-}"
|
|
local ip_version="4"
|
|
|
|
if [[ "$feed_name" =~ -v6$ ]]; then
|
|
feed_name="${feed_name%-v6}"
|
|
ip_version="6"
|
|
fi
|
|
|
|
# Get status from config
|
|
local status="disabled"
|
|
if printf '%s\n' "${FEEDS_ARRAY[@]}" | grep -q "^1|${feed_name}|" 2>/dev/null; then
|
|
status="enabled"
|
|
fi
|
|
|
|
local size
|
|
size=$(get_ipset_size "$ipset_name")
|
|
echo "iptables_blocklist_ipset_size{feed=\"$feed_name\",ip_version=\"$ip_version\",status=\"$status\"} $size"
|
|
done
|
|
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_blocked_total Blocked attempts per feed
|
|
# TYPE iptables_blocklist_blocked_total gauge
|
|
EOF
|
|
|
|
# Per-feed block counts (IPv4 and IPv6)
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
[ "$enabled" != "1" ] && continue
|
|
|
|
local blocks_1h_v4 blocks_24h_v4 blocks_1h_v6 blocks_24h_v6
|
|
blocks_1h_v4=$(get_feed_blocks "$name" "1 hour ago")
|
|
blocks_24h_v4=$(get_feed_blocks "$name" "24 hours ago")
|
|
blocks_1h_v6=$(get_feed_blocks_v6 "$name" "1 hour ago")
|
|
blocks_24h_v6=$(get_feed_blocks_v6 "$name" "24 hours ago")
|
|
|
|
echo "iptables_blocklist_blocked_total{feed=\"$name\",ip_version=\"4\",period=\"1h\"} $blocks_1h_v4"
|
|
echo "iptables_blocklist_blocked_total{feed=\"$name\",ip_version=\"4\",period=\"24h\"} $blocks_24h_v4"
|
|
echo "iptables_blocklist_blocked_total{feed=\"$name\",ip_version=\"6\",period=\"1h\"} $blocks_1h_v6"
|
|
echo "iptables_blocklist_blocked_total{feed=\"$name\",ip_version=\"6\",period=\"24h\"} $blocks_24h_v6"
|
|
done
|
|
|
|
# Feed effectiveness (blocks per 1000 IPs)
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_effectiveness Blocks per 1000 IPs in feed (24h)
|
|
# TYPE iptables_blocklist_effectiveness gauge
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
[ "$enabled" != "1" ] && continue
|
|
|
|
local ipset_size blocks_v4 blocks_v6 effectiveness_v4 effectiveness_v6
|
|
ipset_size=$(get_ipset_size "${IPSET_PREFIX}-${name}")
|
|
blocks_v4=$(get_feed_blocks "$name" "24 hours ago")
|
|
blocks_v6=$(get_feed_blocks_v6 "$name" "24 hours ago")
|
|
|
|
# Strip whitespace and ensure integers
|
|
ipset_size=$(echo "$ipset_size" | tr -d '\n' | tr -d ' ')
|
|
blocks_v4=$(echo "$blocks_v4" | tr -d '\n' | tr -d ' ')
|
|
blocks_v6=$(echo "$blocks_v6" | tr -d '\n' | tr -d ' ')
|
|
ipset_size=${ipset_size:-0}
|
|
blocks_v4=${blocks_v4:-0}
|
|
blocks_v6=${blocks_v6:-0}
|
|
|
|
if [ "$ipset_size" -gt 0 ] 2>/dev/null; then
|
|
effectiveness_v4=$(awk "BEGIN {printf \"%.2f\", ($blocks_v4 / $ipset_size) * 1000}" 2>/dev/null || echo "0")
|
|
effectiveness_v6=$(awk "BEGIN {printf \"%.2f\", ($blocks_v6 / $ipset_size) * 1000}" 2>/dev/null || echo "0")
|
|
else
|
|
effectiveness_v4="0"
|
|
effectiveness_v6="0"
|
|
fi
|
|
|
|
echo "iptables_blocklist_effectiveness{feed=\"$name\",ip_version=\"4\"} $effectiveness_v4"
|
|
echo "iptables_blocklist_effectiveness{feed=\"$name\",ip_version=\"6\"} $effectiveness_v6"
|
|
done
|
|
|
|
# Feed update/cache metrics
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_last_update_timestamp Feed cache file last modified timestamp
|
|
# TYPE iptables_blocklist_last_update_timestamp gauge
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
|
|
local v4_file="${CACHE_DIR}/${name}-v4.parsed"
|
|
local v6_file="${CACHE_DIR}/${name}-v6.parsed"
|
|
local v4_ts v6_ts
|
|
v4_ts=$(get_file_timestamp "$v4_file")
|
|
v6_ts=$(get_file_timestamp "$v6_file")
|
|
|
|
echo "iptables_blocklist_last_update_timestamp{feed=\"$name\",ip_version=\"4\"} $v4_ts"
|
|
echo "iptables_blocklist_last_update_timestamp{feed=\"$name\",ip_version=\"6\"} $v6_ts"
|
|
done
|
|
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_cache_age_seconds Age of feed cache files
|
|
# TYPE iptables_blocklist_cache_age_seconds gauge
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
|
|
local v4_file="${CACHE_DIR}/${name}-v4.parsed"
|
|
local v6_file="${CACHE_DIR}/${name}-v6.parsed"
|
|
local v4_age v6_age
|
|
v4_age=$(get_cache_age "$v4_file")
|
|
v6_age=$(get_cache_age "$v6_file")
|
|
|
|
echo "iptables_blocklist_cache_age_seconds{feed=\"$name\",ip_version=\"4\"} $v4_age"
|
|
echo "iptables_blocklist_cache_age_seconds{feed=\"$name\",ip_version=\"6\"} $v6_age"
|
|
done
|
|
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_file_size_bytes Feed parsed file sizes
|
|
# TYPE iptables_blocklist_file_size_bytes gauge
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
|
|
local v4_file="${CACHE_DIR}/${name}-v4.parsed"
|
|
local v6_file="${CACHE_DIR}/${name}-v6.parsed"
|
|
local v4_size v6_size
|
|
v4_size=$(get_file_size "$v4_file")
|
|
v6_size=$(get_file_size "$v6_file")
|
|
|
|
echo "iptables_blocklist_file_size_bytes{feed=\"$name\",ip_version=\"4\",type=\"parsed\"} $v4_size"
|
|
echo "iptables_blocklist_file_size_bytes{feed=\"$name\",ip_version=\"6\",type=\"parsed\"} $v6_size"
|
|
done
|
|
|
|
# IP version distribution ratio
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_ip_version_ratio Ratio of IPv4 to IPv6 addresses per feed
|
|
# TYPE iptables_blocklist_ip_version_ratio gauge
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
|
|
local v4_size v6_size total ratio_v4 ratio_v6
|
|
v4_size=$(get_ipset_size "${IPSET_PREFIX}-${name}")
|
|
v6_size=$(get_ipset_size "${IPSET_PREFIX}-${name}-v6")
|
|
|
|
v4_size=${v4_size:-0}
|
|
v6_size=${v6_size:-0}
|
|
total=$((v4_size + v6_size))
|
|
|
|
if [ "$total" -gt 0 ] 2>/dev/null; then
|
|
ratio_v4=$(awk "BEGIN {printf \"%.4f\", $v4_size / $total}" 2>/dev/null || echo "0")
|
|
ratio_v6=$(awk "BEGIN {printf \"%.4f\", $v6_size / $total}" 2>/dev/null || echo "0")
|
|
else
|
|
ratio_v4="0"
|
|
ratio_v6="0"
|
|
fi
|
|
|
|
echo "iptables_blocklist_ip_version_ratio{feed=\"$name\",version=\"4\"} $ratio_v4"
|
|
echo "iptables_blocklist_ip_version_ratio{feed=\"$name\",version=\"6\"} $ratio_v6"
|
|
done
|
|
|
|
# Total metrics
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_total_unique_ips Total unique IPs across all feeds
|
|
# TYPE iptables_blocklist_total_unique_ips gauge
|
|
iptables_blocklist_total_unique_ips{ip_version="4"} $(get_total_unique_ips "4")
|
|
iptables_blocklist_total_unique_ips{ip_version="6"} $(get_total_unique_ips "6")
|
|
|
|
# HELP iptables_blocklist_total_rules Total iptables rules
|
|
# TYPE iptables_blocklist_total_rules gauge
|
|
iptables_blocklist_total_rules $(iptables -S 2>/dev/null | wc -l)
|
|
|
|
# HELP iptables_blocklist_rule_packets Packet counts from iptables rules
|
|
# TYPE iptables_blocklist_rule_packets counter
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
[ "$enabled" != "1" ] && continue
|
|
|
|
local stats_log stats_drop packets_log bytes_log packets_drop bytes_drop
|
|
|
|
stats_log=$(echo "$iptables_input_stats" | grep " ${IPSET_PREFIX}-${name} " | grep LOG | head -1 | awk '{print $1"|"$2}')
|
|
stats_drop=$(echo "$iptables_input_stats" | grep " ${IPSET_PREFIX}-${name} " | grep DROP | head -1 | awk '{print $1"|"$2}')
|
|
|
|
if [ -n "$stats_log" ]; then
|
|
packets_log=$(echo "$stats_log" | cut -d'|' -f1)
|
|
bytes_log=$(echo "$stats_log" | cut -d'|' -f2)
|
|
echo "iptables_blocklist_rule_packets{feed=\"$name\",ip_version=\"4\",action=\"log\"} ${packets_log:-0}"
|
|
fi
|
|
|
|
if [ -n "$stats_drop" ]; then
|
|
packets_drop=$(echo "$stats_drop" | cut -d'|' -f1)
|
|
bytes_drop=$(echo "$stats_drop" | cut -d'|' -f2)
|
|
echo "iptables_blocklist_rule_packets{feed=\"$name\",ip_version=\"4\",action=\"drop\"} ${packets_drop:-0}"
|
|
fi
|
|
done
|
|
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_rule_bytes Byte counts from iptables rules
|
|
# TYPE iptables_blocklist_rule_bytes counter
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
[ "$enabled" != "1" ] && continue
|
|
|
|
local stats_log stats_drop packets_log bytes_log packets_drop bytes_drop
|
|
|
|
stats_log=$(echo "$iptables_input_stats" | grep " ${IPSET_PREFIX}-${name} " | grep LOG | head -1 | awk '{print $1"|"$2}')
|
|
stats_drop=$(echo "$iptables_input_stats" | grep " ${IPSET_PREFIX}-${name} " | grep DROP | head -1 | awk '{print $1"|"$2}')
|
|
|
|
if [ -n "$stats_log" ]; then
|
|
packets_log=$(echo "$stats_log" | cut -d'|' -f1)
|
|
bytes_log=$(echo "$stats_log" | cut -d'|' -f2)
|
|
echo "iptables_blocklist_rule_bytes{feed=\"$name\",ip_version=\"4\",action=\"log\"} ${bytes_log:-0}"
|
|
fi
|
|
|
|
if [ -n "$stats_drop" ]; then
|
|
packets_drop=$(echo "$stats_drop" | cut -d'|' -f1)
|
|
bytes_drop=$(echo "$stats_drop" | cut -d'|' -f2)
|
|
echo "iptables_blocklist_rule_bytes{feed=\"$name\",ip_version=\"4\",action=\"drop\"} ${bytes_drop:-0}"
|
|
fi
|
|
done
|
|
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_ipset_memory_bytes Memory used by each ipset
|
|
# TYPE iptables_blocklist_ipset_memory_bytes gauge
|
|
EOF
|
|
|
|
for feed_line in "${FEEDS_ARRAY[@]}"; do
|
|
IFS='|' read -r enabled name url type description <<< "$feed_line"
|
|
|
|
mem_v4=$(get_ipset_memory "${IPSET_PREFIX}-${name}")
|
|
mem_v6=$(get_ipset_memory "${IPSET_PREFIX}-${name}-v6")
|
|
|
|
echo "iptables_blocklist_ipset_memory_bytes{feed=\"$name\",ip_version=\"4\"} $mem_v4"
|
|
echo "iptables_blocklist_ipset_memory_bytes{feed=\"$name\",ip_version=\"6\"} $mem_v6"
|
|
done
|
|
|
|
# Conntrack metrics
|
|
local conntrack_count conntrack_max conntrack_usage
|
|
conntrack_count=$(get_conntrack_count)
|
|
conntrack_max=$(get_conntrack_max)
|
|
|
|
if [ "$conntrack_max" -gt 0 ] 2>/dev/null; then
|
|
conntrack_usage=$(awk "BEGIN {printf \"%.2f\", ($conntrack_count / $conntrack_max) * 100}" 2>/dev/null || echo "0")
|
|
else
|
|
conntrack_usage="0"
|
|
fi
|
|
|
|
# Cache disk metrics
|
|
local disk_info cache_size disk_used disk_avail disk_pct
|
|
disk_info=$(get_cache_disk_usage)
|
|
cache_size=$(get_total_cache_size)
|
|
disk_used=$(echo "$disk_info" | cut -d'|' -f1)
|
|
disk_avail=$(echo "$disk_info" | cut -d'|' -f2)
|
|
disk_pct=$(echo "$disk_info" | cut -d'|' -f3 | tr -d '%')
|
|
|
|
cat <<EOF
|
|
|
|
# HELP iptables_blocklist_conntrack_entries Current conntrack entries
|
|
# TYPE iptables_blocklist_conntrack_entries gauge
|
|
iptables_blocklist_conntrack_entries $conntrack_count
|
|
|
|
# HELP iptables_blocklist_conntrack_max Maximum conntrack entries
|
|
# TYPE iptables_blocklist_conntrack_max gauge
|
|
iptables_blocklist_conntrack_max $conntrack_max
|
|
|
|
# HELP iptables_blocklist_conntrack_usage_percent Conntrack usage percentage
|
|
# TYPE iptables_blocklist_conntrack_usage_percent gauge
|
|
iptables_blocklist_conntrack_usage_percent $conntrack_usage
|
|
|
|
# HELP iptables_blocklist_cache_disk_used_bytes Disk space used by cache partition
|
|
# TYPE iptables_blocklist_cache_disk_used_bytes gauge
|
|
iptables_blocklist_cache_disk_used_bytes $disk_used
|
|
|
|
# HELP iptables_blocklist_cache_disk_available_bytes Disk space available on cache partition
|
|
# TYPE iptables_blocklist_cache_disk_available_bytes gauge
|
|
iptables_blocklist_cache_disk_available_bytes $disk_avail
|
|
|
|
# HELP iptables_blocklist_cache_disk_usage_percent Cache partition disk usage percentage
|
|
# TYPE iptables_blocklist_cache_disk_usage_percent gauge
|
|
iptables_blocklist_cache_disk_usage_percent ${disk_pct:-0}
|
|
|
|
# HELP iptables_blocklist_cache_total_size_bytes Total size of cache directory
|
|
# TYPE iptables_blocklist_cache_total_size_bytes gauge
|
|
iptables_blocklist_cache_total_size_bytes $cache_size
|
|
|
|
# HELP iptables_blocklist_whitelist_size Whitelist ipset size
|
|
# TYPE iptables_blocklist_whitelist_size gauge
|
|
iptables_blocklist_whitelist_size{ip_version="4"} $(get_ipset_size "$WHITELIST_IPSET")
|
|
iptables_blocklist_whitelist_size{ip_version="6"} $(get_ipset_size "$WHITELIST_IPSET_V6")
|
|
|
|
# HELP iptables_blocklist_scrape_timestamp_seconds Unix timestamp of metric generation
|
|
# TYPE iptables_blocklist_scrape_timestamp_seconds gauge
|
|
iptables_blocklist_scrape_timestamp_seconds $(date +%s)
|
|
|
|
# HELP iptables_blocklist_exporter_runtime_seconds Exporter runtime in seconds
|
|
# TYPE iptables_blocklist_exporter_runtime_seconds gauge
|
|
iptables_blocklist_exporter_runtime_seconds $(($(date +%s) - start_time))
|
|
EOF
|
|
echo ""
|
|
}
|
|
|
|
run_http_server() {
|
|
echo "Starting iptables blocklist exporter on port $HTTP_PORT..."
|
|
|
|
if ! command -v nc >/dev/null 2>&1; then
|
|
echo "ERROR: netcat (nc) is required for HTTP mode"
|
|
echo "Install with: yum install nmap-ncat (RHEL/CentOS)"
|
|
echo " or: apt install netcat (Debian/Ubuntu)"
|
|
exit 1
|
|
fi
|
|
|
|
while true; do
|
|
{
|
|
read -r request
|
|
if [[ "$request" =~ ^GET\ /metrics ]]; then
|
|
printf "HTTP/1.1 200 OK\r\nContent-Type: text/plain; version=0.0.4; charset=utf-8\r\n\r\n"
|
|
cache_journal_data
|
|
cache_feeds_config
|
|
generate_metrics
|
|
else
|
|
printf "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\n\r\n"
|
|
echo "<h1>iptables Blocklist Metrics Exporter v${SCRIPT_VERSION}</h1>"
|
|
echo "<p>Per-feed threat blocking statistics</p>"
|
|
echo "<p><a href='/metrics'>Metrics</a></p>"
|
|
fi
|
|
} | nc -l -p "$HTTP_PORT" -q 1 2>/dev/null
|
|
done
|
|
}
|
|
|
|
main() {
|
|
parse_args "$@"
|
|
|
|
[ ! -d "$CONFIG_DIR" ] && { echo "ERROR: $CONFIG_DIR not found. Run iptables-blocklists.sh first" >&2; exit 1; }
|
|
|
|
# Prevent multiple instances (skip for HTTP mode as it should run continuously)
|
|
[ "$HTTP_MODE" != true ] && acquire_lock
|
|
|
|
if [ "$HTTP_MODE" = true ]; then
|
|
run_http_server
|
|
elif [ -n "$OUTPUT_FILE" ]; then
|
|
# Cache data before generating metrics
|
|
cache_journal_data
|
|
cache_feeds_config
|
|
|
|
# Ensure output directory exists
|
|
mkdir -p "$(dirname "$OUTPUT_FILE")"
|
|
|
|
# Create temp file in /tmp (not in node_exporter directory!)
|
|
# This prevents node_exporter from seeing partial writes
|
|
local temp_file
|
|
temp_file=$(mktemp /tmp/iptables_metrics.XXXXXX)
|
|
|
|
# Generate metrics to temp file
|
|
generate_metrics > "$temp_file"
|
|
|
|
# FORCE NEW INODE: Delete old file first, then move
|
|
# Some node_exporter versions cache file descriptors
|
|
rm -f "$OUTPUT_FILE"
|
|
|
|
# Move temp file to final location
|
|
mv "$temp_file" "$OUTPUT_FILE"
|
|
|
|
# Ensure node_exporter user can read it
|
|
chmod 644 "$OUTPUT_FILE"
|
|
else
|
|
cache_journal_data
|
|
cache_feeds_config
|
|
generate_metrics
|
|
fi
|
|
}
|
|
|
|
main "$@"
|