Refactor common code out of nftables-multiport/allports.conf

2016-01-05 19:03:47 +06:00 · 2016-01-05 19:03:47 +06:00 · f7f91a8bd4
parent 618e97bce8
commit f7f91a8bd4
3 changed files with 56 additions and 69 deletions
--- a/config/action.d/nftables-allports.conf
+++ b/config/action.d/nftables-allports.conf
@ -13,40 +13,10 @@ before = nftables-common.conf

 [Definition]

-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
 #
-actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
-              <nftables> insert rule filter <chain> ip protocol <protocol> ip saddr @f2b-<name> <blocktype>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
-             <nftables> delete set filter f2b-<name>
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element filter f2b-<name> { <ip> }
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element filter f2b-<name> { <ip> }
+nftables_mode = ip protocol <protocol>

 [Init]
-
--- a/config/action.d/nftables-common.conf
+++ b/config/action.d/nftables-common.conf
@ -1,6 +1,9 @@
 # Fail2Ban configuration file
 #
 # Author: Daniel Black
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
@ -13,6 +16,49 @@

 after = nftables-common.local

+[Definition]
+
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = <protocol> dport { <port> }
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
+              <nftables> insert rule filter <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
+             <nftables> delete set filter f2b-<name>
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = <nftables> add element filter f2b-<name> { <ip> }
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = <nftables> delete element filter f2b-<name> { <ip> }
+
 [Init]

 # Option:  chain
--- a/config/action.d/nftables-multiport.conf
+++ b/config/action.d/nftables-multiport.conf
@ -1,7 +1,8 @@
 # Fail2Ban configuration file
 #
 # Author: Cyril Jaquier
-# Modified by Yaroslav Halchenko for multiport banning
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
@ -12,40 +13,10 @@ before = nftables-common.conf

 [Definition]

-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
 #
-actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
-              <nftables> insert rule filter <chain> <protocol> dport { <port> } ip saddr @f2b-<name> <blocktype>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
-             <nftables> delete set filter f2b-<name>
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element filter f2b-<name> { <ip> }
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element filter f2b-<name> { <ip> }
+nftables_mode = <protocol> dport { <port> }

 [Init]
-