github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #3291 from ttyS4/patch-1 

nftables.conf - add support for cidr notation and address ranges
pull/3598/merge
Sergey G. Brester 2025-08-08 10:23:08 +02:00 committed by GitHub
parent 6120a731d9 dc3268ce5d
commit 77ba28bae1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
config/action.d/nftables.conf
View File

@ -55,7 +55,7 @@ _nft_for_proto-multiport-done = done
_nft_list = <nftables> -a list chain <table_family> <table> <chain> _nft_list = <nftables> -a list chain <table_family> <table> <chain>
_nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$' _nft_get_handle_id = grep -oP '@<addr_set>\s+.*\s+\Khandle\s+(\d+)$'
_nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\; \} _nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\;<addr_options> \}
<_nft_for_proto-<type>-iter> <_nft_for_proto-<type>-iter>
<nftables> add rule <table_family> <table> <chain> %(rule_stat)s <nftables> add rule <table_family> <table> <chain> %(rule_stat)s
<_nft_for_proto-<type>-done> <_nft_for_proto-<type>-done>
@ -197,6 +197,11 @@ addr_set = addr-set-<name>
# Values: [ ip | ip6 ] # Values: [ ip | ip6 ]
addr_family = ip addr_family = ip
# Option: addr_options
# Notes: Additional options for the addr-set, by default allows to store CIDR or address ranges.
# Can be set to empty value to create simple addresses set.
addr_options = <sp>flags interval\;
[Init?family=inet6] [Init?family=inet6]
addr_family = ip6 addr_family = ip6
addr_type = ipv6_addr addr_type = ipv6_addr

8
fail2ban/tests/servertestcase.py
View File

@ -1343,11 +1343,11 @@ class ServerConfigReaderTests(LogCaptureTestCase):
r"`done`", r"`done`",
), ),
'ip4-start': ( 'ip4-start': (
r"`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`", r"`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; flags interval\; \}`",
r"`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`", r"`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`",
), ),
'ip6-start': ( 'ip6-start': (
r"`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`", r"`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; flags interval\; \}`",
r"`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`", r"`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`",
), ),
'flush': ( 'flush': (
@ -1389,11 +1389,11 @@ class ServerConfigReaderTests(LogCaptureTestCase):
r"`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`", r"`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`",
), ),
'ip4-start': ( 'ip4-start': (
r"`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`", r"`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; flags interval\; \}`",
r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`", r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`",
), ),
'ip6-start': ( 'ip6-start': (
r"`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`", r"`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; flags interval\; \}`",
r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`", r"`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`",
), ),
'flush': ( 'flush': (