From 618e97bce8a1ad359e191d84835f3400152acbed Mon Sep 17 00:00:00 2001
From: Alexander Belykh <albel727@ngs.ru>
Date: Mon, 4 Jan 2016 01:36:28 +0600
Subject: [PATCH] Add nftables actions

---
 config/action.d/nftables-allports.conf  | 52 +++++++++++++++++++++++++
 config/action.d/nftables-common.conf    | 50 ++++++++++++++++++++++++
 config/action.d/nftables-multiport.conf | 51 ++++++++++++++++++++++++
 3 files changed, 153 insertions(+)
 create mode 100644 config/action.d/nftables-allports.conf
 create mode 100644 config/action.d/nftables-common.conf
 create mode 100644 config/action.d/nftables-multiport.conf

diff --git a/config/action.d/nftables-allports.conf b/config/action.d/nftables-allports.conf
new file mode 100644
index 00000000..34622f65
--- /dev/null
+++ b/config/action.d/nftables-allports.conf
@@ -0,0 +1,52 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+# Modified: Alexander Belykh <albel727@ngs.ru>
+#                       adapted for nftables
+#
+
+[INCLUDES]
+
+before = nftables-common.conf
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
+              <nftables> insert rule filter <chain> ip protocol <protocol> ip saddr @f2b-<name> <blocktype>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
+             <nftables> delete set filter f2b-<name>
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = <nftables> add element filter f2b-<name> { <ip> }
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = <nftables> delete element filter f2b-<name> { <ip> }
+
+[Init]
+
diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf
new file mode 100644
index 00000000..a0534d35
--- /dev/null
+++ b/config/action.d/nftables-common.conf
@@ -0,0 +1,50 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+# Modified: Alexander Belykh <albel727@ngs.ru>
+#                       adapted for nftables
+#
+# This is a included configuration file and includes the definitions for the nftables
+# used in all nftables based actions by default.
+#
+# The user can override the defaults in nftables-common.local
+
+[INCLUDES]
+
+after = nftables-common.local
+
+[Init]
+
+# Option:  chain
+# Notes    specifies the nftables chain to which the Fail2Ban rules should be
+#          added
+# Values:  STRING  Default: input
+chain = input
+
+# Default name of the filtering set
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp ] Default: tcp
+#
+protocol = tcp
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the nftables man page (section 8). Common values are drop
+#          reject, reject with icmp type host-unreachable
+# Values:  STRING
+blocktype = reject
+
+# Option:  nftables
+# Notes.:  Actual command to be executed, including common to all calls options
+# Values:  STRING
+nftables = nft
diff --git a/config/action.d/nftables-multiport.conf b/config/action.d/nftables-multiport.conf
new file mode 100644
index 00000000..ad61bf63
--- /dev/null
+++ b/config/action.d/nftables-multiport.conf
@@ -0,0 +1,51 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified by Yaroslav Halchenko for multiport banning
+# Modified: Alexander Belykh <albel727@ngs.ru>
+#                       adapted for nftables
+#
+
+[INCLUDES]
+
+before = nftables-common.conf
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = <nftables> add set filter f2b-<name> { type ipv4_addr\; }
+              <nftables> insert rule filter <chain> <protocol> dport { <port> } ip saddr @f2b-<name> <blocktype>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = HANDLE_ID=$(<nftables> --handle --numeric list chain filter <chain> | grep -m1 'ip saddr @f2b-<name> <blocktype> # handle' | grep -oe ' handle [0-9]*'); <nftables> delete rule filter <chain> $HANDLE_ID
+             <nftables> delete set filter f2b-<name>
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = <nftables> list chain filter <chain> | grep -q '@f2b-<name>[ \t]'
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionban = <nftables> add element filter f2b-<name> { <ip> }
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = <nftables> delete element filter f2b-<name> { <ip> }
+
+[Init]
+