github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #1 from ajhoughton/master 

A few improvements to fail2ban-iptables
pull/88/head
Thanat0s 2012-11-08 13:23:38 -08:00
parent bad7e1428d af2a312222
commit 485753afc9
1 changed files with 30 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
fail2ban-iptables
View File

@ -21,31 +21,33 @@
import sys, re, subprocess import sys, re, subprocess
# Try to avoid any shell injections IPTABLES='/sbin/iptables'
def noinject(str): IP6TABLES='/sbin/ip6tables'
for banned_chr in "`&;|":
if banned_chr in str:
print "I don't like some chars in your iptables syntax"
sys.exit(2)
return True
# Main procedure # Main procedure
def main(argv): def main(argv):
pline = " ".join(argv)
regv4 = re.compile('([0-9]{1,3}\.){3}[0-9]{1,3}') regv4 = re.compile('([0-9]{1,3}\.){3}[0-9]{1,3}')
if regv4.search(argv): if regv4.search(pline):
# we are facing to a ipv4 # we are facing to a ipv4
ret = subprocess.call(["iptables", argv]) ret = subprocess.call([IPTABLES] + argv)
sys.exit(ret) sys.exit(ret)
else: else:
# if not, maybe it's a ipv6 # if not, maybe it's a ipv6
regv6 = re.compile('::[A-Fa-f0-9]{1,4}|(:[A-Fa-f0-9]{1,4}){2,}') regv6 = re.compile('::[A-Fa-f0-9]{1,4}|(:[A-Fa-f0-9]{1,4}){2,}')
if regv6.search(argv): if regv6.search(pline):
ret6 = subprocess.call(["ip6tables", argv]) ret6 = subprocess.call([IP6TABLES] + argv)
sys.exit(ret6) sys.exit(ret6)
else: else:
# if it's not a ipv6 either, we call both iptables # if it's not a ipv6 either, we call both iptables
ret = subprocess.call(["iptables", argv]) proc = subprocess.Popen([IPTABLES] + argv)
ret6 = subprocess.call(["ip6tables", argv]) proc6 = subprocess.Popen([IP6TABLES] + argv)
# Splitting the Popen and wait() calls lets us run them in
# parallel, rather than one after the other
ret = proc.wait()
ret6 = proc6.wait()
# return worst error code # return worst error code
if ret > ret6: if ret > ret6:
sys.exit(ret) sys.exit(ret)
@ -54,6 +56,4 @@ def main(argv):
# Main call, pass all variables # Main call, pass all variables
if __name__ == "__main__": if __name__ == "__main__":
pline = " ".join(sys.argv[1:]) main(sys.argv[1:])
if noinject(pline):
main(pline)