Refactor common code out of nftables-multiport/allports.conf

config/action.d/nftables-allports.conf

@@ -13,40 +13,10 @@ before = nftables-common.conf
 
 [Definition]
 
-# Option:  actionstart
+# Option:  nftables_mode
-# Notes.:  command executed once at the start of Fail2Ban.
+# Notes.:  additional expressions for nftables filter rule
-# Values:  CMD
+# Values:  nftables expressions
 #
-actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
+nftables_mode = ip protocol <protocol>
-              <nftables> insert rule filter <chain> ip protocol <protocol> ip saddr @f2b-<name> <blocktype>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
-             <nftables> delete set filter f2b-<name>
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element filter f2b-<name> { <ip> }
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element filter f2b-<name> { <ip> }
 
 [Init]
-

config/action.d/nftables-common.conf

@@ -1,6 +1,9 @@
 # Fail2Ban configuration file
 #
 # Author: Daniel Black
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
@@ -13,6 +16,49 @@
 
 after = nftables-common.local
 
+[Definition]
+
+# Option:  nftables_mode
+# Notes.:  additional expressions for nftables filter rule
+# Values:  nftables expressions
+#
+nftables_mode = <protocol> dport { <port> }
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
+              <nftables> insert rule filter <chain> %(nftables_mode)s ip saddr @f2b-<name> <blocktype>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
+             <nftables> delete set filter f2b-<name>
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = <nftables> add element filter f2b-<name> { <ip> }
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = <nftables> delete element filter f2b-<name> { <ip> }
+
 [Init]
 
 # Option:  chain

config/action.d/nftables-multiport.conf

@@ -1,7 +1,8 @@
 # Fail2Ban configuration file
 #
 # Author: Cyril Jaquier
-# Modified by Yaroslav Halchenko for multiport banning
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
 # Modified: Alexander Belykh <albel727@ngs.ru>
 #                       adapted for nftables
 #
@@ -12,40 +13,10 @@ before = nftables-common.conf
 
 [Definition]
 
-# Option:  actionstart
+# Option:  nftables_mode
-# Notes.:  command executed once at the start of Fail2Ban.
+# Notes.:  additional expressions for nftables filter rule
-# Values:  CMD
+# Values:  nftables expressions
 #
-actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
+nftables_mode = <protocol> dport { <port> }
-              <nftables> insert rule filter <chain> <protocol> dport { <port> } ip saddr @f2b-<name> <blocktype>
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
-             <nftables> delete set filter f2b-<name>
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = <nftables> add element filter f2b-<name> { <ip> }
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban = <nftables> delete element filter f2b-<name> { <ip> }
 
 [Init]
-