mirror of https://github.com/fail2ban/fail2ban
Merge branch '0.10' into 0.11
sebres
commit
0824ad0d73
13
ChangeLog
13
ChangeLog
|
|
@ -79,6 +79,9 @@ ver. 0.10.5-dev-1 (20??/??/??) - development edition
|
|||
* `action.d/badips.py`: fixed start of banaction on demand (which may be IP-family related), gh-2390
|
||||
* `action.d/helpers-common.conf`: rewritten grep arguments, now options `-wF` used to match only
|
||||
whole words and fixed string (not as pattern), gh-2298
|
||||
* `filter.d/apache-auth.conf`:
|
||||
- ignore errors from mod_evasive in `normal` mode (mode-controlled now) (gh-2548);
|
||||
- extended with option `mode` - `normal` (default) and `aggressive`
|
||||
* `filter.d/sshd.conf`:
|
||||
- matches `Bad protocol version identification` in `ddos` and `aggressive` modes (gh-2404).
|
||||
- captures `Disconnecting ...: Change of username or service not allowed` (gh-2239, gh-2279)
|
||||
|
|
@ -138,6 +141,16 @@ filter = flt[logtype=short]
|
|||
attempts (failure) for IP (resp. failure-ID), see gh-2351;
|
||||
Syntax:
|
||||
- `fail2ban-client set <jail> attempt <ip> [<failure-message1> ... <failure-messageN>]`
|
||||
* `action.d/nftables.conf`:
|
||||
- isolate fail2ban rules into a dedicated table and chain (gh-2254)
|
||||
- `nftables-allports` supports multiple protocols in single rule now
|
||||
- combined nftables actions to single action `nftables`:
|
||||
* `nftables-common` is removed (replaced with single action `nftables` now)
|
||||
* `nftables-allports` is obsolete, superseded by `nftables[type=allports]`
|
||||
* `nftables-multiport` is obsolete, superseded by `nftables[type=multiport]`
|
||||
- allowed multiple protocols in `nftables[type=multiport]` action (single set with multiple rules
|
||||
in chain), following configuration in jail would replace 3 separate actions, see
|
||||
https://github.com/fail2ban/fail2ban/pull/2254#issuecomment-534684675
|
||||
* `action.d/badips.py`: option `loglevel` extended with level of summary message,
|
||||
following example configuration logging summary with NOTICE and rest with DEBUG log-levels:
|
||||
`action = badips.py[loglevel="debug, notice"]`
|
||||
|
|
|
|||
|
|
@ -6,17 +6,12 @@
|
|||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# Obsolete: superseded by nftables[type=allports]
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = nftables-common.conf
|
||||
before = nftables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: nftables_mode
|
||||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = meta l4proto <protocol>
|
||||
|
||||
[Init]
|
||||
type = allports
|
||||
|
|
|
|||
|
|
@ -1,135 +0,0 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Daniel Black
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# This is a included configuration file and includes the definitions for the nftables
|
||||
# used in all nftables based actions by default.
|
||||
#
|
||||
# The user can override the defaults in nftables-common.local
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
after = nftables-common.local
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: nftables_mode
|
||||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = <protocol> dport \{ <port> \}
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <nftables> add set <nftables_family> <nftables_table> <set_name> \{ type <nftables_type>\; \}
|
||||
<nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s <address_family> saddr @<set_name> <blocktype>
|
||||
|
||||
_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
|
||||
_nft_get_handle_id = grep -m1 '<address_family> saddr @<set_name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
|
||||
<nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
|
||||
<nftables> delete set <nftables_family> <nftables_table> <set_name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@<set_name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <nftables> add element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <nftables> delete element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: nftables_type
|
||||
# Notes.: address type to work with
|
||||
# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr
|
||||
#
|
||||
nftables_type = ipv4_addr
|
||||
|
||||
# Option: nftables_family
|
||||
# Notes.: address family to work in
|
||||
# Values: [ip | ip6 | inet] Default: inet
|
||||
#
|
||||
nftables_family = inet
|
||||
|
||||
# Option: nftables_table
|
||||
# Notes.: table in the address family to work in
|
||||
# Values: STRING Default: filter
|
||||
#
|
||||
nftables_table = filter
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the nftables chain to which the Fail2Ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: input
|
||||
chain = input
|
||||
|
||||
# Default name of the filtering set
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the nftables man page (section 8). Common values are drop
|
||||
# reject, reject with icmp type host-unreachable
|
||||
# Values: STRING
|
||||
blocktype = reject
|
||||
|
||||
# Option: nftables
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
nftables = nft
|
||||
|
||||
# Option: set_name
|
||||
# Notes.: The name of the nft set used to store banned addresses
|
||||
# Values: STRING
|
||||
set_name = f2b-<name>
|
||||
|
||||
# Option: address_family
|
||||
# Notes.: The family of the banned addresses
|
||||
# Values: [ ip | ip6 ]
|
||||
address_family = ip
|
||||
|
||||
[Init?family=inet6]
|
||||
|
||||
nftables_type = ipv6_addr
|
||||
set_name = f2b-<name>6
|
||||
address_family = ip6
|
||||
|
|
@ -6,17 +6,12 @@
|
|||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# Obsolete: superseded by nftables[type=multiport]
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = nftables-common.conf
|
||||
before = nftables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: nftables_mode
|
||||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = <protocol> dport \{ <port> \}
|
||||
|
||||
[Init]
|
||||
type = multiport
|
||||
|
|
@ -0,0 +1,184 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Daniel Black
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# This is a included configuration file and includes the definitions for the nftables
|
||||
# used in all nftables based actions by default.
|
||||
#
|
||||
# The user can override the defaults in nftables-common.local
|
||||
# Example: redirect flow to honeypot
|
||||
#
|
||||
# [Init]
|
||||
# table_family = ip
|
||||
# chain_type = nat
|
||||
# chain_hook = prerouting
|
||||
# chain_priority = -50
|
||||
# blocktype = counter redirect to 2222
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
after = nftables-common.local
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: type
|
||||
# Notes.: type of the action.
|
||||
# Values: [ multiport | allports ] Default: multiport
|
||||
#
|
||||
type = multiport
|
||||
|
||||
rule_match-custom =
|
||||
rule_match-allports = meta l4proto \{ <protocol> \}
|
||||
rule_match-multiport = $proto dport \{ <port> \}
|
||||
match = <rule_match-<type>>
|
||||
|
||||
# Option: rule_stat
|
||||
# Notes.: statement for nftables filter rule.
|
||||
# leaving it empty will block all (include udp and icmp)
|
||||
# Values: nftables statement
|
||||
#
|
||||
rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
|
||||
|
||||
# optional interator over protocol's:
|
||||
_nft_for_proto-custom-iter =
|
||||
_nft_for_proto-custom-done =
|
||||
_nft_for_proto-allports-iter =
|
||||
_nft_for_proto-allports-done =
|
||||
_nft_for_proto-multiport-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
|
||||
_nft_for_proto-multiport-done = done
|
||||
|
||||
_nft_list = <nftables> -a list chain <table_family> f2b-table f2b-chain
|
||||
_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
|
||||
|
||||
_nft_add_set = <nftables> add set <table_family> f2b-table <addr_set> \{ type <addr_type>\; \}
|
||||
<_nft_for_proto-<type>-iter>
|
||||
<nftables> add rule <table_family> f2b-table f2b-chain %(rule_stat)s
|
||||
<_nft_for_proto-<type>-done>
|
||||
_nft_del_set = (%(_nft_list)s | %(_nft_get_handle_id)s) | while read -r hdl; do
|
||||
<nftables> delete rule <table_family> f2b-table f2b-chain $hdl; done
|
||||
<nftables> delete set <table_family> f2b-table <addr_set>
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <nftables> add table <table_family> f2b-table
|
||||
<nftables> -- add chain <table_family> f2b-table f2b-chain \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
|
||||
%(_nft_add_set)s
|
||||
|
||||
# Option: actionflush
|
||||
# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action);
|
||||
# uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references)
|
||||
# Values: CMD
|
||||
#
|
||||
actionflush = (<nftables> flush set <table_family> f2b-table <addr_set> 2> /dev/null) || (
|
||||
%(_nft_del_set)s
|
||||
%(_nft_add_set)s
|
||||
)
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = %(_nft_del_set)s
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <nftables> list chain <table_family> f2b-table f2b-chain | grep -q '@<addr_set>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <nftables> add element <table_family> f2b-table <addr_set> { <ip> }
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <nftables> delete element <table_family> f2b-table <addr_set> { <ip> }
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: table_family
|
||||
# Notes.: address family to work in
|
||||
# Values: [ip | ip6 | inet] Default: inet
|
||||
table_family = inet
|
||||
|
||||
# Option: chain_type
|
||||
# Notes.: refers to the kind of chain to be created
|
||||
# Values: [filter | route | nat] Default: filter
|
||||
#
|
||||
chain_type = filter
|
||||
|
||||
# Option: chain_hook
|
||||
# Notes.: refers to the kind of chain to be created
|
||||
# Values: [ prerouting | input | forward | output | postrouting ] Default: input
|
||||
#
|
||||
chain_hook = input
|
||||
|
||||
# Option: chain_priority
|
||||
# Notes.: priority in the chain.
|
||||
# Values: NUMBER Default: -1
|
||||
#
|
||||
chain_priority = -1
|
||||
|
||||
# Option: addr_type
|
||||
# Notes.: address type to work with
|
||||
# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr
|
||||
#
|
||||
addr_type = ipv4_addr
|
||||
|
||||
# Default name of the filtering set
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the nftables man page (section 8). Common values are drop,
|
||||
# reject, reject with icmpx type host-unreachable, redirect to 2222
|
||||
# Values: STRING
|
||||
blocktype = reject
|
||||
|
||||
# Option: nftables
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
nftables = nft
|
||||
|
||||
# Option: addr_set
|
||||
# Notes.: The name of the nft set used to store banned addresses
|
||||
# Values: STRING
|
||||
addr_set = addr-set-<name>
|
||||
|
||||
# Option: addr_family
|
||||
# Notes.: The family of the banned addresses
|
||||
# Values: [ ip | ip6 ]
|
||||
addr_family = ip
|
||||
|
||||
[Init?family=inet6]
|
||||
addr_family = ip6
|
||||
addr_type = ipv6_addr
|
||||
addr_set = addr6-set-<name>
|
||||
|
|
@ -9,6 +9,16 @@ before = apache-common.conf
|
|||
|
||||
[Definition]
|
||||
|
||||
# Mode for filter: normal (default) and aggressive (allows DDoS & brute force detection of mod_evasive)
|
||||
mode = normal
|
||||
|
||||
# ignore messages of mod_evasive module:
|
||||
apache-pref-ign-normal = (?!evasive)
|
||||
# allow "denied by server configuration" from all modules:
|
||||
apache-pref-ign-aggressive =
|
||||
# mode related ignore prefix for common _apache_error_client substitution:
|
||||
apache-pref-ignore = <apache-pref-ign-<mode>>
|
||||
|
||||
prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
# auth_type = ((?:Digest|Basic): )?
|
||||
|
|
|
|||
|
|
@ -27,7 +27,9 @@ _daemon = (?:apache\d*|httpd(?:/\w+)?)
|
|||
|
||||
apache-prefix = <apache-prefix-<logging>>
|
||||
|
||||
_apache_error_client = <apache-prefix>\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
|
||||
apache-pref-ignore =
|
||||
|
||||
_apache_error_client = <apache-prefix>\[(:?error|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]
|
||||
|
||||
datepattern = {^LN-BEG}
|
||||
|
||||
|
|
|
|||
|
|
@ -134,6 +134,14 @@
|
|||
# failJSON: { "time": "2018-03-28T01:31:42", "match": true , "host": "91.49.82.139" }
|
||||
[Wed Mar 28 01:31:42.355210 2018] [ssl:error] [pid 6586] [client 91.49.82.139:58028] AH02033: No hostname was provided via SNI for a name based virtual host
|
||||
|
||||
# failJSON: { "match": false, "desc": "ignore mod_evasive errors in normal mode (gh-2548)" }
|
||||
[Thu Oct 17 18:43:40.160521 2019] [evasive20:error] [pid 22589] [client 192.0.2.1:56175] client denied by server configuration: /path/index.php, referer: https://hostname/path/
|
||||
|
||||
# filterOptions: {"mode": "aggressive"}
|
||||
|
||||
# failJSON: { "time": "2019-10-17T18:43:40", "match": true, "host": "192.0.2.1", "desc": "accept mod_evasive errors in aggressive mode (gh-2548)" }
|
||||
[Thu Oct 17 18:43:40.160521 2019] [evasive20:error] [pid 22589] [client 192.0.2.1:56175] client denied by server configuration: /path/index.php, referer: https://hostname/path/
|
||||
|
||||
# filterOptions: {"logging": "syslog"}
|
||||
|
||||
# failJSON: { "time": "2005-02-15T16:23:00", "match": true , "host": "192.0.2.1", "desc": "using syslog (ErrorLog syslog)" }
|
||||
|
|
|
|||
|
|
@ -1321,6 +1321,101 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
# 'start', 'stop' - should be found (logged) on action start/stop,
|
||||
# etc.
|
||||
testJailsActions = (
|
||||
# nftables-multiport --
|
||||
('j-w-nft-mp', 'nftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"]', {
|
||||
'ip4': ('ip ', 'ipv4_addr', 'addr-'), 'ip6': ('ip6 ', 'ipv6_addr', 'addr6-'),
|
||||
'*-start': (
|
||||
r"`nft add table inet f2b-table`",
|
||||
r"`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`",
|
||||
# iterator over protocol is same for both families:
|
||||
r"`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`",
|
||||
r"`done`",
|
||||
),
|
||||
'ip4-start': (
|
||||
r"`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain $proto dport \{ http,https \} ip saddr @addr-set-j-w-nft-mp reject`",
|
||||
),
|
||||
'ip6-start': (
|
||||
r"`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain $proto dport \{ http,https \} ip6 saddr @addr6-set-j-w-nft-mp reject`",
|
||||
),
|
||||
'flush': (
|
||||
"`(nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null) || ",
|
||||
"`(nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null) || ",
|
||||
),
|
||||
'stop': (
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr-set-j-w-nft-mp`",
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr6-set-j-w-nft-mp`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`nft add element inet f2b-table addr-set-j-w-nft-mp { 192.0.2.1 }`",
|
||||
),
|
||||
'ip4-unban': (
|
||||
r"`nft delete element inet f2b-table addr-set-j-w-nft-mp { 192.0.2.1 }`",
|
||||
),
|
||||
'ip6-ban': (
|
||||
r"`nft add element inet f2b-table addr6-set-j-w-nft-mp { 2001:db8:: }`",
|
||||
),
|
||||
'ip6-unban': (
|
||||
r"`nft delete element inet f2b-table addr6-set-j-w-nft-mp { 2001:db8:: }`",
|
||||
),
|
||||
}),
|
||||
# nft-allports --
|
||||
('j-w-nft-ap', 'nftables-allports[name=%(__name__)s, protocol="tcp,udp"]', {
|
||||
'ip4': ('ip ', 'ipv4_addr', 'addr-'), 'ip6': ('ip6 ', 'ipv6_addr', 'addr6-'),
|
||||
'*-start': (
|
||||
r"`nft add table inet f2b-table`",
|
||||
r"`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`",
|
||||
),
|
||||
'ip4-start': (
|
||||
r"`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`",
|
||||
),
|
||||
'ip6-start': (
|
||||
r"`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`",
|
||||
),
|
||||
'flush': (
|
||||
"`(nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null) || ",
|
||||
"`(nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null) || ",
|
||||
),
|
||||
'stop': (
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr-set-j-w-nft-ap`",
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr6-set-j-w-nft-ap`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"""`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`""",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"""`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`""",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`nft add element inet f2b-table addr-set-j-w-nft-ap { 192.0.2.1 }`",
|
||||
),
|
||||
'ip4-unban': (
|
||||
r"`nft delete element inet f2b-table addr-set-j-w-nft-ap { 192.0.2.1 }`",
|
||||
),
|
||||
'ip6-ban': (
|
||||
r"`nft add element inet f2b-table addr6-set-j-w-nft-ap { 2001:db8:: }`",
|
||||
),
|
||||
'ip6-unban': (
|
||||
r"`nft delete element inet f2b-table addr6-set-j-w-nft-ap { 2001:db8:: }`",
|
||||
),
|
||||
}),
|
||||
# dummy --
|
||||
('j-dummy', 'dummy[name=%(__name__)s, init="==", target="/tmp/fail2ban.dummy"]', {
|
||||
'ip4': ('family: inet4',), 'ip6': ('family: inet6',),
|
||||
|
|
@ -1905,7 +2000,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
# test ban ip4 :
|
||||
self.pruneLog('# === ban-ipv4 ===')
|
||||
action.ban(aInfos['ipv4'])
|
||||
if tests.get('ip4-start'): self.assertLogged(*tests['ip4-start'], all=True)
|
||||
if tests.get('ip4-start'): self.assertLogged(*tests.get('*-start', ())+tests['ip4-start'], all=True)
|
||||
if tests.get('ip6-start'): self.assertNotLogged(*tests['ip6-start'], all=True)
|
||||
self.assertLogged(*tests.get('ip4-check',())+tests['ip4-ban'], all=True)
|
||||
self.assertNotLogged(*tests['ip6'], all=True)
|
||||
|
|
@ -1917,7 +2012,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
# test ban ip6 :
|
||||
self.pruneLog('# === ban ipv6 ===')
|
||||
action.ban(aInfos['ipv6'])
|
||||
if tests.get('ip6-start'): self.assertLogged(*tests['ip6-start'], all=True)
|
||||
if tests.get('ip6-start'): self.assertLogged(*tests.get('*-start', ())+tests['ip6-start'], all=True)
|
||||
if tests.get('ip4-start'): self.assertNotLogged(*tests['ip4-start'], all=True)
|
||||
self.assertLogged(*tests.get('ip6-check',())+tests['ip6-ban'], all=True)
|
||||
self.assertNotLogged(*tests['ip4'], all=True)
|
||||
|
|
|
|||
Loading…
Reference in New Issue