File: firewall/blacklist.sh

#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# firewall/blacklist.sh ? Gestión de lista negra
#=============================================================================
#
# Las IPs en blacklist se agregan al ipset SENTINELA_BLACKLIST
# y se dropean inmediatamente al llegar a SENTINELA_INPUT.
#=============================================================================

# shellcheck source=lib/common.sh
source "${SENTINELA_DIR}/lib/common.sh"

#=============================================================================
# Inicializar ipset BLACKLIST
#=============================================================================
blacklist_init() {
    if ! ${IPSET} list SENTINELA_BLACKLIST &>/dev/null; then
        ${IPSET} create SENTINELA_BLACKLIST hash:ip timeout "${BAN_TIME}" 2>/dev/null || {
            ${IPSET} destroy SENTINELA_BLACKLIST 2>/dev/null || true
            ${IPSET} create SENTINELA_BLACKLIST hash:ip timeout "${BAN_TIME}"
        }
        log_info "Ipset SENTINELA_BLACKLIST creado (timeout: ${BAN_TIME}s)"
    fi
}

#=============================================================================
# Banear IP (agregar a blacklist)
#=============================================================================
blacklist_add() {
    local ip="$1"
    local reason="${2:-manual}"
    local timeout="${3:-${BAN_TIME}}"

    if ! is_valid_ip "${ip}"; then
        log_error "IP inválida para blacklist: ${ip}"
        return 1
    fi

    require_root
    blacklist_init

    if ${IPSET} add SENTINELA_BLACKLIST "${ip}" timeout "${timeout}" 2>/dev/null; then
        log_ban "IP ${ip} bloqueada (${reason}, timeout: ${timeout}s)"
        return 0
    else
        log_warn "IP ${ip} ya está en blacklist o no se pudo agregar"
        return 0
    fi
}

#=============================================================================
# Desbanear IP (quitar de blacklist)
#=============================================================================
blacklist_remove() {
    local ip="$1"

    if ! is_valid_ip "${ip}"; then
        log_error "IP inválida: ${ip}"
        return 1
    fi

    require_root

    if ${IPSET} del SENTINELA_BLACKLIST "${ip}" 2>/dev/null; then
        log_info "IP ${ip} desbloqueada de blacklist"
        return 0
    else
        log_warn "IP ${ip} no está en blacklist"
        return 1
    fi
}

#=============================================================================
# Listar blacklist
#=============================================================================
blacklist_list() {
    require_root

    if ! ${IPSET} list SENTINELA_BLACKLIST &>/dev/null; then
        echo "Blacklist vacía (ipset no existe)"
        return 0
    fi

    echo "??? Blacklist (IPs bloqueadas) ???"
    echo
    echo "IP                     TIMEOUT (s)"
    echo "??????????????????????????????????????"
    ${IPSET} list SENTINELA_BLACKLIST | grep -E '^[0-9]' | while IFS= read -r line; do
        local ip timeout
        ip=$(echo "${line}" | awk '{print $1}')
        timeout=$(echo "${line}" | awk '{print $2}')
        if [[ "${timeout}" == "0" ]]; then
            echo "  ${ip}             permanente"
        else
            printf "  %-20s %s\n" "${ip}" "${timeout}"
        fi
    done

    local total
    total=$(${IPSET} list SENTINELA_BLACKLIST | grep -cE '^[0-9]' || true)
    echo
    echo "Total: ${total} IPs bloqueadas"
    echo
}

#=============================================================================
# Limpiar blacklist completa
#=============================================================================
blacklist_flush() {
    require_root

    if ${IPSET} list SENTINELA_BLACKLIST &>/dev/null; then
        ${IPSET} flush SENTINELA_BLACKLIST
        log_info "Blacklist limpiada (todas las IPs desbloqueadas)"
    fi
}