action.d/*-ipset*.conf: several ipset actions fixed (no timeout per default anymore), so no discrepancy between ipset and fail2ban (removal from ipset will be managed by fail2ban only)

2020-04-25 14:52:38 +02:00 · 2020-04-25 14:52:38 +02:00 · 87a1a2f1a1
parent 6b90ca820f
commit 87a1a2f1a1
4 changed files with 61 additions and 31 deletions
--- a/config/action.d/firewallcmd-ipset.conf
+++ b/config/action.d/firewallcmd-ipset.conf
@ -18,7 +18,7 @@ before = firewallcmd-common.conf

 [Definition]

-actionstart = ipset create <ipmset> hash:ip timeout <bantime><familyopt>
+actionstart = ipset create <ipmset> hash:ip timeout <default-timeout> <familyopt>
              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>

 actionflush = ipset flush <ipmset>
@ -27,7 +27,7 @@ actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <acti
             <actionflush>
             ipset destroy <ipmset>

-actionban = ipset add <ipmset> <ip> timeout <bantime> -exist
+actionban = ipset add <ipmset> <ip> timeout <timeout> -exist

 actionunban = ipset del <ipmset> <ip> -exist

@ -40,11 +40,19 @@ actionunban = ipset del <ipmset> <ip> -exist
 #
 chain = INPUT_direct

-# Option: bantime
-# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
-# Values:  [ NUM ]  Default: 600
+# Option: default-timeout
+# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
+default-timeout = 0

-bantime = 600
+# Option: timeout
+# Notes:  specifies ticket timeout (handled ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
+timeout = 0
+
+# expresion to caclulate timeout from bantime, example:
+# banaction = %(known/banaction)s[timeout='<timeout-bantime>']
+timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)

 # Option: actiontype
 # Notes.: defines additions to the blocking rule
@ -69,7 +77,7 @@ familyopt =
 [Init?family=inet6]

 ipmset = f2b-<name>6
-familyopt = <sp>family inet6
+familyopt = family inet6


 # DEV NOTES:
--- a/config/action.d/iptables-ipset-proto6-allports.conf
+++ b/config/action.d/iptables-ipset-proto6-allports.conf
@ -26,7 +26,7 @@ before = iptables-common.conf
 # Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <bantime><familyopt>
+actionstart = ipset create <ipmset> hash:ip timeout <default-timeout> <familyopt>
              <iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype>

 # Option:  actionflush
@ -49,7 +49,7 @@ actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <bantime> -exist
+actionban = ipset add <ipmset> <ip> timeout <timeout> -exist

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@ -61,11 +61,19 @@ actionunban = ipset del <ipmset> <ip> -exist

 [Init]

-# Option: bantime
-# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
-# Values:  [ NUM ]  Default: 600
-#
-bantime = 600
+# Option: default-timeout
+# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
+default-timeout = 0
+
+# Option: timeout
+# Notes:  specifies ticket timeout (handled ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
+timeout = 0
+
+# expresion to caclulate timeout from bantime, example:
+# banaction = %(known/banaction)s[timeout='<timeout-bantime>']
+timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)

 ipmset = f2b-<name>
 familyopt =
@ -74,4 +82,4 @@ familyopt =
 [Init?family=inet6]

 ipmset = f2b-<name>6
-familyopt = <sp>family inet6
+familyopt = family inet6
--- a/config/action.d/iptables-ipset-proto6.conf
+++ b/config/action.d/iptables-ipset-proto6.conf
@ -26,7 +26,7 @@ before = iptables-common.conf
 # Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
 # Values:  CMD
 #
-actionstart = ipset create <ipmset> hash:ip timeout <bantime><familyopt>
+actionstart = ipset create <ipmset> hash:ip timeout <default-timeout> <familyopt>
              <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>

 # Option:  actionflush
@ -49,7 +49,7 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add <ipmset> <ip> timeout <bantime> -exist
+actionban = ipset add <ipmset> <ip> timeout <timeout> -exist

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@ -61,11 +61,19 @@ actionunban = ipset del <ipmset> <ip> -exist

 [Init]

-# Option: bantime
-# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
-# Values:  [ NUM ]  Default: 600
-#
-bantime = 600
+# Option: default-timeout
+# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
+default-timeout = 0
+
+# Option: timeout
+# Notes:  specifies ticket timeout (handled ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
+timeout = 0
+
+# expresion to caclulate timeout from bantime, example:
+# banaction = %(known/banaction)s[timeout='<timeout-bantime>']
+timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)

 ipmset = f2b-<name>
 familyopt =
@ -74,4 +82,4 @@ familyopt =
 [Init?family=inet6]

 ipmset = f2b-<name>6
-familyopt = <sp>family inet6
+familyopt = family inet6
--- a/config/action.d/shorewall-ipset-proto6.conf
+++ b/config/action.d/shorewall-ipset-proto6.conf
@ -51,7 +51,7 @@
 # Values:  CMD
 #
 actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
-              then ipset -quiet -exist create f2b-<name> hash:ip timeout <bantime>;
+              then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-timeout>;
              fi

 # Option:  actionstop
@ -66,7 +66,7 @@ actionstop = ipset flush f2b-<name>
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
+actionban = ipset add f2b-<name> <ip> timeout <timeout> -exist

 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@ -76,10 +76,16 @@ actionban = ipset add f2b-<name> <ip> timeout <bantime> -exist
 #
 actionunban = ipset del f2b-<name> <ip> -exist

-[Init]
+# Option: default-timeout
+# Notes:  specifies default timeout in seconds (handled default ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (no timeout, managed by fail2ban by unban)
+default-timeout = 0

-# Option: bantime
-# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
-# Values:  [ NUM ]  Default: 600
-#
-bantime = 600
+# Option: timeout
+# Notes:  specifies ticket timeout (handled ipset timeout only)
+# Values:  [ NUM ]  Default: 0 (managed by fail2ban by unban)
+timeout = 0
+
+# expresion to caclulate timeout from bantime, example:
+# banaction = %(known/banaction)s[timeout='<timeout-bantime>']
+timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)