mirror of https://github.com/fail2ban/fail2ban
Merge pull request #1894 from sbraz/nftables-ipv6
Fix nftables actions for IPv6 addresses, fixes #1893pull/1904/head
commit
6140a0f2d4
|
@ -54,6 +54,7 @@ ver. 0.10.1-dev-1 (2016/??/??) - development edition
|
|||
human readable representation (opposite to `-d`);
|
||||
|
||||
### Enhancements
|
||||
* nftables actions are IPv6-capable now (gh-1893)
|
||||
* filter.d/dovecot.conf: introduced mode `aggressive` for cases like "disconnected before auth was ready" (gh-1880)
|
||||
|
||||
|
||||
|
|
|
@ -17,6 +17,6 @@ before = nftables-common.conf
|
|||
# Notes.: additional expressions for nftables filter rule
|
||||
# Values: nftables expressions
|
||||
#
|
||||
nftables_mode = ip protocol <protocol>
|
||||
nftables_mode = meta l4proto <protocol>
|
||||
|
||||
[Init]
|
||||
|
|
|
@ -28,11 +28,11 @@ nftables_mode = <protocol> dport \{ <port> \}
|
|||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <nftables> add set <nftables_family> <nftables_table> f2b-<name> \{ type <nftables_type>\; \}
|
||||
<nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
|
||||
actionstart = <nftables> add set <nftables_family> <nftables_table> <set_name> \{ type <nftables_type>\; \}
|
||||
<nftables> insert rule <nftables_family> <nftables_table> <chain> %(nftables_mode)s <address_family> saddr @<set_name> <blocktype>
|
||||
|
||||
_nft_list = <nftables> --handle --numeric list chain <nftables_family> <nftables_table> <chain>
|
||||
_nft_get_handle_id = grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
|
||||
_nft_get_handle_id = grep -m1 '<address_family> saddr @<set_name> <blocktype> # handle' | grep -oe ' handle [0-9]*'
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
|
@ -40,13 +40,13 @@ _nft_get_handle_id = grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep
|
|||
#
|
||||
actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s)
|
||||
<nftables> delete rule <nftables_family> <nftables_table> <chain> $HANDLE_ID
|
||||
<nftables> delete set <nftables_family> <nftables_table> f2b-<name>
|
||||
<nftables> delete set <nftables_family> <nftables_table> <set_name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@f2b-<name>[ \t]'
|
||||
actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> | grep -q '@<set_name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
|
@ -54,7 +54,7 @@ actioncheck = <nftables> list chain <nftables_family> <nftables_table> <chain> |
|
|||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <nftables> add element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
|
||||
actionban = <nftables> add element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
|
@ -62,7 +62,7 @@ actionban = <nftables> add element <nftables_family> <nftables_table> f2b-<name>
|
|||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <nftables> delete element <nftables_family> <nftables_table> f2b-<name> \{ <ip> \}
|
||||
actionunban = <nftables> delete element <nftables_family> <nftables_table> <set_name> \{ <ip> \}
|
||||
|
||||
[Init]
|
||||
|
||||
|
@ -117,3 +117,19 @@ blocktype = reject
|
|||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
nftables = nft
|
||||
|
||||
# Option: set_name
|
||||
# Notes.: The name of the nft set used to store banned addresses
|
||||
# Values: STRING
|
||||
set_name = f2b-<name>
|
||||
|
||||
# Option: address_family
|
||||
# Notes.: The family of the banned addresses
|
||||
# Values: [ ip | ip6 ]
|
||||
address_family = ip
|
||||
|
||||
[Init?family=inet6]
|
||||
|
||||
nftables_type = ipv6_addr
|
||||
set_name = f2b-<name>6
|
||||
address_family = ip6
|
||||
|
|
Loading…
Reference in New Issue