#!/bin/sh
### BEGIN INIT INFO
# Provides:          fail2ban
# Required-Start:    $local_fs $remote_fs
# Required-Stop:     $local_fs $remote_fs
# Should-Start:      $time $network $syslog $named iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm ufw
# Should-Stop:       $network $syslog $named iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm ufw
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start/stop fail2ban
# Description:       Start/stop fail2ban, a daemon scanning the log files and
#                    banning potential attackers.
### END INIT INFO

# Author: Aaron Isotton <aaron@isotton.com>
# Modified: by Yaroslav Halchenko <debian@onerussian.com>
#  reindented + minor corrections + to work on sarge without modifications
# Modified: by Glenn Aaldering <glenn@openvideo.nl>
#  added exit codes for status command
# Modified: by Juan Karlo de Guzman <jkarlodg@gmail.com>
#  corrected the DAEMON's path and the SOCKFILE
#  rename this file: (sudo) mv /etc/init.d/fail2ban.init /etc/init.d/fail2ban
#  same with the logrotate file: (sudo) mv /etc/logrotate.d/fail2ban.logrotate /etc/logrotate.d/fail2ban
#
PATH="/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin"
DESC="Authentication failure monitor"
NAME="fail2ban"

# fail2ban-client is not a daemon itself but starts a daemon and
# loads its with configuration
DAEMON="/usr/bin/$NAME-client"
SCRIPTNAME="/etc/init.d/$NAME"

# Ad-hoc way to parse out socket file name
SOCKFILE="$(grep -h '^[^#]*socket *=' "/etc/$NAME/$NAME.conf" "/etc/$NAME/$NAME.local" 2>/dev/null \
	| tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g')"
[ -z "$SOCKFILE" ] && SOCKFILE="/var/run/fail2ban.sock"

# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0

# Run as root by default.
FAIL2BAN_USER="root"

# Read configuration variable file if it is present
[ -r "/etc/default/$NAME" ] && . "/etc/default/$NAME"
DAEMON_ARGS="$FAIL2BAN_OPTS"

# Load the VERBOSE setting and other rcS variables
[ -f /etc/default/rcS ] && . /etc/default/rcS

# Predefine what can be missing from lsb source later on -- necessary to run
# on sarge. Just present it in a bit more compact way from what was shipped
log_daemon_msg()
{
	[ -z "$1" ] && return 1
	echo -n "$1:"
	[ -z "$2" ] || echo -n " $2"
}

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
# Actually has to (>=2.0-7) present in sarge. log_daemon_msg is predefined
#  so we must be ok
. /lib/lsb/init-functions

#
# Shortcut function for abnormal init script interruption
#
report_bug()
{
	echo "$*"
	echo "Please submit a bug report to Debian BTS (reportbug fail2ban)"
	exit 1
}

#
# Helper function to check if socket is present, which is often left after
# abnormal exit of fail2ban and needs to be removed
#
check_socket()
{
	# Return
	#       0 if socket is present and readable
	#       1 if socket file is not present
	#       2 if socket file is present but not readable
	#       3 if socket file is present but is not a socket
	[ -e "$SOCKFILE" ] || return 1
	[ -r "$SOCKFILE" ] || return 2
	[ -S "$SOCKFILE" ] || return 3
	return 0
}

#
# Function that starts the daemon/service
#
do_start()
{
	# Return
	#       0 if daemon has been started
	#       1 if daemon was already running
	#       2 if daemon could not be started
	do_status && return 1

	if [ -e "$SOCKFILE" ]; then
		log_failure_msg "Socket file $SOCKFILE is present"
		[ "$1" = force-start ] \
			&& log_success_msg "Starting anyway as requested" \
			|| return 2
		DAEMON_ARGS="$DAEMON_ARGS -x"
	fi

	# Assure that /var/run/fail2ban exists
	[ -d /var/run/fail2ban ] || mkdir -p /var/run/fail2ban

	if [ "$FAIL2BAN_USER" != root ]; then
		# Make the socket directory, IP lists and fail2ban log
		# files writable by fail2ban
		chown "$FAIL2BAN_USER" /var/run/fail2ban
		# Create the logfile if it doesn't exist
		touch /var/log/fail2ban.log
		chown "$FAIL2BAN_USER" /var/log/fail2ban.log
		find /proc/net/xt_recent -name "fail2ban-*" -exec chown "$FAIL2BAN_USER" "{}" ";"
	fi

	# $DAEMON_ARGS need to be expanded possibly with multiple or no options
	# shellcheck disable=SC2086
	start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec "$DAEMON" -- \
		$DAEMON_ARGS start >/dev/null \
		|| return 2

	return 0
}


#
# Function that checks the status of fail2ban and returns
# corresponding code
#
do_status()
{
	$DAEMON ping >/dev/null 2>&1
	return "$?"
}

#
# Function that stops the daemon/service
#
do_stop()
{
	# Return
	#       0 if daemon has been stopped
	#       1 if daemon was already stopped
	#       2 if daemon could not be stopped
	#       other if a failure occurred
	$DAEMON status >/dev/null 2>&1 || return 1
	$DAEMON stop >/dev/null || return 2

	# now we need actually to wait a bit since it might take time
	# for server to react on client's stop request. Especially
	# important for restart command on slow boxes
	count=1
	while do_status && [ "$count" -lt 60 ]; do
		sleep 1
		count="$((count + 1))"
	done
	[ "$count" -lt 60 ] || return 3 # failed to stop

	return 0
}

#
# Function to reload configuration
#
do_reload()
{
	"$DAEMON" reload >/dev/null && return 0 || return 1
	return 0
}

# yoh:
# shortcut function to don't duplicate case statements and to don't use
# bashisms (arrays). Fixes #368218
#
log_end_msg_wrapper()
{
	if [ "$1" != 0 ] && [ "$1" != "$2" ]; then
		value="1"
	else
		value="0"
	fi
	if [ "$3" != no ]; then
		log_end_msg "$value"
	fi
	if [ "$value" != 0 ]; then
		exit "$1"
	fi
}

command="$1"
case "$command" in
	start|force-start)
		[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
		do_start "$command"
		log_end_msg_wrapper "$?" 255 "$VERBOSE"
		;;

	stop)
		[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
		do_stop
		log_end_msg_wrapper "$?" 255 "$VERBOSE"
		;;

	restart|force-reload)
		log_daemon_msg "Restarting $DESC" "$NAME"
		do_stop
		case "$?" in
			0|1)
				do_start
				log_end_msg_wrapper "$?" 0 always
				;;
			*)
				# Failed to stop
				log_end_msg 1
				;;
		esac
		;;

	reload)
		log_daemon_msg "Reloading $DESC" "$NAME"
		do_reload
		log_end_msg "$?"
		;;

	status)
		log_daemon_msg "Status of $DESC"
		do_status
		case "$?" in
			0)
				log_success_msg " $NAME is running"
				;;
			255)
				check_socket
				case "$?" in
					1)
						log_failure_msg " $NAME is not running" && exit 3
						;;
					0)
						log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3
						;;
					2)
						log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3
						;;
					3)
						log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3
						;;
					*)
						report_bug "Unknown return code from $NAME:check_socket." && exit 4
						;;
				esac
				;;
			*)
				report_bug "Unknown $NAME status code" && exit 4
				;;
		esac
		;;
	*)
		echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" 1>&2
		exit 3
		;;
esac

: