1
#!/bin/bash
2
# =================================================================
3
#  High-Performance, Low-Resource IP Blocklist Update Script
4
#
5
#  Designed for execution via systemd timer or cron.
6
#  This script is non-persistent and relies on being run on boot
7
#  and periodically to maintain firewall rules.
8
# =================================================================
9

10
set -o errexit   # Exit immediately if a command exits with a non-zero status.
11
set -o nounset   # Exit immediately if it tries to use an undeclared variable.
12
set -o pipefail  # The return value of a pipeline is the status of the last command to exit with a non-zero status.
13

14
# --- Configuration ---
15
readonly IPSET_NAME="chinablock"
16
readonly IP_LIST_URL="https://www.ipdeny.com/ipblocks/data/countries/cn.zone"
17
readonly TMP_FILE="/dev/shm/${IPSET_NAME}.zone"
18
readonly LOCK_FILE="/var/run/${IPSET_NAME}.lock"
19
readonly MIN_IP_COUNT=100 # Minimum expected number of IP ranges
20

21
# Efficient logging function using bash printf built-in (>= bash 4.2)
22
log() {
23
    # %-1s prints a single space. Using it to get printf to evaluate the format string.
24
    printf '%(%Y-%m-%d %H:%M:%S)T - %s\n' -1 "$1"
25
}
26

27
# Centralized error-handling function
28
die() {
29
    log "FATAL: $1" >&2
30
    exit 1
31
}
32

33
main() {
34
    # --- Prerequisite Checks ---
35
    if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
36
        die "This script must be run as root."
37
    fi
38

39
    for cmd in ipset wget iptables flock awk head tail; do
40
        if ! command -v "$cmd" &>/dev/null; then
41
            die "Required command '$cmd' is not found."
42
        fi
43
    done
44

45
    # Ensure temporary file is cleaned up on any exit
46
    trap 'rm -f "$TMP_FILE"' EXIT
47

48
    log "Starting IP blocklist update for set '$IPSET_NAME'..."
49

50
    # --- Download IP List ---
51
    log "Downloading IP list from $IP_LIST_URL..."
52
    if ! wget -q --timeout=60 --tries=3 -O "$TMP_FILE" "$IP_LIST_URL"; then
53
        die "Download failed from $IP_LIST_URL."
54
    fi
55

56
    # --- Create and Load Temporary IPSet ---
57
    local temp_ipset_name="${IPSET_NAME}_temp"
58
    ipset create "$temp_ipset_name" hash:net -exist
59
    ipset flush "$temp_ipset_name"
60

61
    log "Validating list and preparing for bulk load..."
62
    # Use a single awk pass to validate and generate restore data.
63
    # It exits with an error code if the line count is too low.
64
    # The last line of its output is the total count.
65
    local awk_output
66
    awk_output=$(awk -v set_name="$temp_ipset_name" \
67
        '{ print "add " set_name " " $1 } END { if (NR < '$MIN_IP_COUNT') exit 1; print NR }' "$TMP_FILE") \
68
        || die "IP list validation failed (expected >$MIN_IP_COUNT lines, found $(wc -l < "$TMP_FILE" | awk '{print $1}'))."
69

70
    # Pipe all but the last line (the count) to ipset restore for high-speed loading.
71
    echo "$awk_output" | head -n -1 | ipset restore || die "ipset restore command failed."
72

73
    local final_count
74
    final_count=$(echo "$awk_output" | tail -n 1)
75

76
    log "Loaded $final_count IP blocks into temporary set '$temp_ipset_name'."
77

78
    # --- Atomically Activate the New IPSet ---
79
    ipset create "$IPSET_NAME" hash:net -exist
80
    ipset swap "$temp_ipset_name" "$IPSET_NAME"
81
    ipset destroy "$temp_ipset_name"
82
    log "Successfully updated and activated ipset '$IPSET_NAME'."
83

84
    # --- Ensure IPTables Rule Exists ---
85
    # This check is crucial because the rule is lost on reboot.
86
    if ! iptables -C INPUT -m set --match-set "$IPSET_NAME" src -j DROP &>/dev/null; then
87
        log "iptables rule not found. Inserting it at the top of the INPUT chain..."
88
        # -I INPUT 1 ensures it's one of the first rules evaluated, which is critical for performance.
89
        iptables -I INPUT 1 -m set --match-set "$IPSET_NAME" src -j DROP
90
        log "iptables rule for '$IPSET_NAME' added."
91
    else
92
        log "iptables rule for '$IPSET_NAME' already exists."
93
    fi
94

95
    log "Update completed successfully."
96
}
97

98
# --- Execution Wrapper ---
99
# Use flock for robust concurrency control. The lock is held on file descriptor 200.
100
(
101
    flock -n 200 || die "Script is already running. Another instance holds the lock."
102
    main
103
) 200>"$LOCK_FILE"
104

105
exit 0