mirror of https://github.com/fail2ban/fail2ban
Merge pull request #2254
Nftables: isolate fail2ban rules into a dedicated table and chainpull/2550/head
Sergey G. Brester
GitHub
commit
54298fe761
|
|
@ -6,17 +6,12 @@
|
|||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# Obsolete: superseded by nftables[type=allports]
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = nftables-common.conf
|
||||
before = nftables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: nftables_mode
|
||||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = meta l4proto <protocol>
|
||||
|
||||
[Init]
|
||||
type = allports
|
||||
|
|
|
|||
|
|
@ -1,135 +0,0 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Daniel Black
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# This is a included configuration file and includes the definitions for the nftables
|
||||
# used in all nftables based actions by default.
|
||||
#
|
||||
# The user can override the defaults in nftables-common.local
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
after = nftables-common.local
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: nftables_mode
|
||||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = <protocol> dport \{ <port> \}
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <nftables> add set <nftables_family> <nftables_table> <set_name> \{ type <nftables_type>\; \}
|
||||
<nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s <address_family> saddr @<set_name> <blocktype>
|
||||
|
||||
_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
|
||||
_nft_get_handle_id = grep -m1 '<address_family> saddr @<set_name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
|
||||
<nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
|
||||
<nftables> delete set <nftables_family> <nftables_table> <set_name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@<set_name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <nftables> add element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <nftables> delete element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: nftables_type
|
||||
# Notes.: address type to work with
|
||||
# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr
|
||||
#
|
||||
nftables_type = ipv4_addr
|
||||
|
||||
# Option: nftables_family
|
||||
# Notes.: address family to work in
|
||||
# Values: [ip | ip6 | inet] Default: inet
|
||||
#
|
||||
nftables_family = inet
|
||||
|
||||
# Option: nftables_table
|
||||
# Notes.: table in the address family to work in
|
||||
# Values: STRING Default: filter
|
||||
#
|
||||
nftables_table = filter
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the nftables chain to which the Fail2Ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: input
|
||||
chain = input
|
||||
|
||||
# Default name of the filtering set
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the nftables man page (section 8). Common values are drop
|
||||
# reject, reject with icmp type host-unreachable
|
||||
# Values: STRING
|
||||
blocktype = reject
|
||||
|
||||
# Option: nftables
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
nftables = nft
|
||||
|
||||
# Option: set_name
|
||||
# Notes.: The name of the nft set used to store banned addresses
|
||||
# Values: STRING
|
||||
set_name = f2b-<name>
|
||||
|
||||
# Option: address_family
|
||||
# Notes.: The family of the banned addresses
|
||||
# Values: [ ip | ip6 ]
|
||||
address_family = ip
|
||||
|
||||
[Init?family=inet6]
|
||||
|
||||
nftables_type = ipv6_addr
|
||||
set_name = f2b-<name>6
|
||||
address_family = ip6
|
||||
|
|
@ -6,17 +6,12 @@
|
|||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# Obsolete: superseded by nftables[type=multiport]
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = nftables-common.conf
|
||||
before = nftables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: nftables_mode
|
||||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = <protocol> dport \{ <port> \}
|
||||
|
||||
[Init]
|
||||
type = multiport
|
||||
|
|
@ -0,0 +1,184 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Daniel Black
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
# Modified: Alexander Belykh <albel727@ngs.ru>
|
||||
# adapted for nftables
|
||||
#
|
||||
# This is a included configuration file and includes the definitions for the nftables
|
||||
# used in all nftables based actions by default.
|
||||
#
|
||||
# The user can override the defaults in nftables-common.local
|
||||
# Example: redirect flow to honeypot
|
||||
#
|
||||
# [Init]
|
||||
# table_family = ip
|
||||
# chain_type = nat
|
||||
# chain_hook = prerouting
|
||||
# chain_priority = -50
|
||||
# blocktype = counter redirect to 2222
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
after = nftables-common.local
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: type
|
||||
# Notes.: type of the action.
|
||||
# Values: [ multiport | allports ] Default: multiport
|
||||
#
|
||||
type = multiport
|
||||
|
||||
rule_match-custom =
|
||||
rule_match-allports = meta l4proto \{ <protocol> \}
|
||||
rule_match-multiport = $proto dport \{ <port> \}
|
||||
match = <rule_match-<type>>
|
||||
|
||||
# Option: rule_stat
|
||||
# Notes.: statement for nftables filter rule.
|
||||
# leaving it empty will block all (include udp and icmp)
|
||||
# Values: nftables statement
|
||||
#
|
||||
rule_stat = %(match)s <addr_family> saddr @<addr_set> <blocktype>
|
||||
|
||||
# optional interator over protocol's:
|
||||
_nft_for_proto-custom-iter =
|
||||
_nft_for_proto-custom-done =
|
||||
_nft_for_proto-allports-iter =
|
||||
_nft_for_proto-allports-done =
|
||||
_nft_for_proto-multiport-iter = for proto in $(echo '<protocol>' | sed 's/,/ /g'); do
|
||||
_nft_for_proto-multiport-done = done
|
||||
|
||||
_nft_list = <nftables> -a list chain <table_family> f2b-table f2b-chain
|
||||
_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
|
||||
|
||||
_nft_add_set = <nftables> add set <table_family> f2b-table <addr_set> \{ type <addr_type>\; \}
|
||||
<_nft_for_proto-<type>-iter>
|
||||
<nftables> add rule <table_family> f2b-table f2b-chain %(rule_stat)s
|
||||
<_nft_for_proto-<type>-done>
|
||||
_nft_del_set = (%(_nft_list)s | %(_nft_get_handle_id)s) | while read -r hdl; do
|
||||
<nftables> delete rule <table_family> f2b-table f2b-chain $hdl; done
|
||||
<nftables> delete set <table_family> f2b-table <addr_set>
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <nftables> add table <table_family> f2b-table
|
||||
<nftables> -- add chain <table_family> f2b-table f2b-chain \{ type <chain_type> hook <chain_hook> priority <chain_priority> \; \}
|
||||
%(_nft_add_set)s
|
||||
|
||||
# Option: actionflush
|
||||
# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action);
|
||||
# uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references)
|
||||
# Values: CMD
|
||||
#
|
||||
actionflush = (<nftables> flush set <table_family> f2b-table <addr_set> 2> /dev/null) || (
|
||||
%(_nft_del_set)s
|
||||
%(_nft_add_set)s
|
||||
)
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = %(_nft_del_set)s
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <nftables> list chain <table_family> f2b-table f2b-chain | grep -q '@<addr_set>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <nftables> add element <table_family> f2b-table <addr_set> { <ip> }
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <nftables> delete element <table_family> f2b-table <addr_set> { <ip> }
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: table_family
|
||||
# Notes.: address family to work in
|
||||
# Values: [ip | ip6 | inet] Default: inet
|
||||
table_family = inet
|
||||
|
||||
# Option: chain_type
|
||||
# Notes.: refers to the kind of chain to be created
|
||||
# Values: [filter | route | nat] Default: filter
|
||||
#
|
||||
chain_type = filter
|
||||
|
||||
# Option: chain_hook
|
||||
# Notes.: refers to the kind of chain to be created
|
||||
# Values: [ prerouting | input | forward | output | postrouting ] Default: input
|
||||
#
|
||||
chain_hook = input
|
||||
|
||||
# Option: chain_priority
|
||||
# Notes.: priority in the chain.
|
||||
# Values: NUMBER Default: -1
|
||||
#
|
||||
chain_priority = -1
|
||||
|
||||
# Option: addr_type
|
||||
# Notes.: address type to work with
|
||||
# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr
|
||||
#
|
||||
addr_type = ipv4_addr
|
||||
|
||||
# Default name of the filtering set
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the nftables man page (section 8). Common values are drop,
|
||||
# reject, reject with icmpx type host-unreachable, redirect to 2222
|
||||
# Values: STRING
|
||||
blocktype = reject
|
||||
|
||||
# Option: nftables
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
nftables = nft
|
||||
|
||||
# Option: addr_set
|
||||
# Notes.: The name of the nft set used to store banned addresses
|
||||
# Values: STRING
|
||||
addr_set = addr-set-<name>
|
||||
|
||||
# Option: addr_family
|
||||
# Notes.: The family of the banned addresses
|
||||
# Values: [ ip | ip6 ]
|
||||
addr_family = ip
|
||||
|
||||
[Init?family=inet6]
|
||||
addr_family = ip6
|
||||
addr_type = ipv6_addr
|
||||
addr_set = addr6-set-<name>
|
||||
|
|
@ -1256,6 +1256,101 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
# 'start', 'stop' - should be found (logged) on action start/stop,
|
||||
# etc.
|
||||
testJailsActions = (
|
||||
# nftables-multiport --
|
||||
('j-w-nft-mp', 'nftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"]', {
|
||||
'ip4': ('ip ', 'ipv4_addr', 'addr-'), 'ip6': ('ip6 ', 'ipv6_addr', 'addr6-'),
|
||||
'*-start': (
|
||||
r"`nft add table inet f2b-table`",
|
||||
r"`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`",
|
||||
# iterator over protocol is same for both families:
|
||||
r"`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`",
|
||||
r"`done`",
|
||||
),
|
||||
'ip4-start': (
|
||||
r"`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain $proto dport \{ http,https \} ip saddr @addr-set-j-w-nft-mp reject`",
|
||||
),
|
||||
'ip6-start': (
|
||||
r"`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain $proto dport \{ http,https \} ip6 saddr @addr6-set-j-w-nft-mp reject`",
|
||||
),
|
||||
'flush': (
|
||||
"`(nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null) || ",
|
||||
"`(nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null) || ",
|
||||
),
|
||||
'stop': (
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr-set-j-w-nft-mp`",
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr6-set-j-w-nft-mp`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`nft add element inet f2b-table addr-set-j-w-nft-mp { 192.0.2.1 }`",
|
||||
),
|
||||
'ip4-unban': (
|
||||
r"`nft delete element inet f2b-table addr-set-j-w-nft-mp { 192.0.2.1 }`",
|
||||
),
|
||||
'ip6-ban': (
|
||||
r"`nft add element inet f2b-table addr6-set-j-w-nft-mp { 2001:db8:: }`",
|
||||
),
|
||||
'ip6-unban': (
|
||||
r"`nft delete element inet f2b-table addr6-set-j-w-nft-mp { 2001:db8:: }`",
|
||||
),
|
||||
}),
|
||||
# nft-allports --
|
||||
('j-w-nft-ap', 'nftables-allports[name=%(__name__)s, protocol="tcp,udp"]', {
|
||||
'ip4': ('ip ', 'ipv4_addr', 'addr-'), 'ip6': ('ip6 ', 'ipv6_addr', 'addr6-'),
|
||||
'*-start': (
|
||||
r"`nft add table inet f2b-table`",
|
||||
r"`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`",
|
||||
),
|
||||
'ip4-start': (
|
||||
r"`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`",
|
||||
),
|
||||
'ip6-start': (
|
||||
r"`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`",
|
||||
r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`",
|
||||
),
|
||||
'flush': (
|
||||
"`(nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null) || ",
|
||||
"`(nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null) || ",
|
||||
),
|
||||
'stop': (
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr-set-j-w-nft-ap`",
|
||||
"`(nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$') | while read -r hdl; do`",
|
||||
"`nft delete rule inet f2b-table f2b-chain $hdl; done`",
|
||||
"`nft delete set inet f2b-table addr6-set-j-w-nft-ap`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"""`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`""",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"""`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`""",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`nft add element inet f2b-table addr-set-j-w-nft-ap { 192.0.2.1 }`",
|
||||
),
|
||||
'ip4-unban': (
|
||||
r"`nft delete element inet f2b-table addr-set-j-w-nft-ap { 192.0.2.1 }`",
|
||||
),
|
||||
'ip6-ban': (
|
||||
r"`nft add element inet f2b-table addr6-set-j-w-nft-ap { 2001:db8:: }`",
|
||||
),
|
||||
'ip6-unban': (
|
||||
r"`nft delete element inet f2b-table addr6-set-j-w-nft-ap { 2001:db8:: }`",
|
||||
),
|
||||
}),
|
||||
# dummy --
|
||||
('j-dummy', 'dummy[name=%(__name__)s, init="==", target="/tmp/fail2ban.dummy"]', {
|
||||
'ip4': ('family: inet4',), 'ip6': ('family: inet6',),
|
||||
|
|
@ -1847,7 +1942,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
# test ban ip4 :
|
||||
self.pruneLog('# === ban-ipv4 ===')
|
||||
action.ban(ainfo['ip4'])
|
||||
if tests.get('ip4-start'): self.assertLogged(*tests['ip4-start'], all=True)
|
||||
if tests.get('ip4-start'): self.assertLogged(*tests.get('*-start', ())+tests['ip4-start'], all=True)
|
||||
if tests.get('ip6-start'): self.assertNotLogged(*tests['ip6-start'], all=True)
|
||||
self.assertLogged(*tests.get('ip4-check',())+tests['ip4-ban'], all=True)
|
||||
self.assertNotLogged(*tests['ip6'], all=True)
|
||||
|
|
@ -1859,7 +1954,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
# test ban ip6 :
|
||||
self.pruneLog('# === ban ipv6 ===')
|
||||
action.ban(ainfo['ip6'])
|
||||
if tests.get('ip6-start'): self.assertLogged(*tests['ip6-start'], all=True)
|
||||
if tests.get('ip6-start'): self.assertLogged(*tests.get('*-start', ())+tests['ip6-start'], all=True)
|
||||
if tests.get('ip4-start'): self.assertNotLogged(*tests['ip4-start'], all=True)
|
||||
self.assertLogged(*tests.get('ip6-check',())+tests['ip6-ban'], all=True)
|
||||
self.assertNotLogged(*tests['ip4'], all=True)
|
||||
|
|
|
|||
Loading…
Reference in New Issue