From 618e97bce8a1ad359e191d84835f3400152acbed Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Mon, 4 Jan 2016 01:36:28 +0600 Subject: [PATCH 1/7] Add nftables actions --- config/action.d/nftables-allports.conf | 52 +++++++++++++++++++++++++ config/action.d/nftables-common.conf | 50 ++++++++++++++++++++++++ config/action.d/nftables-multiport.conf | 51 ++++++++++++++++++++++++ 3 files changed, 153 insertions(+) create mode 100644 config/action.d/nftables-allports.conf create mode 100644 config/action.d/nftables-common.conf create mode 100644 config/action.d/nftables-multiport.conf diff --git a/config/action.d/nftables-allports.conf b/config/action.d/nftables-allports.conf new file mode 100644 index 00000000..34622f65 --- /dev/null +++ b/config/action.d/nftables-allports.conf @@ -0,0 +1,52 @@ +# Fail2Ban configuration file +# +# Author: Cyril Jaquier +# Modified: Yaroslav O. Halchenko +# made active on all ports from original iptables.conf +# Modified: Alexander Belykh +# adapted for nftables +# + +[INCLUDES] + +before = nftables-common.conf + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = add set filter f2b- { type ipv4_addr\; } + insert rule filter ip protocol ip saddr @f2b- + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID + delete set filter f2b- +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = list chain filter | grep -q '@f2b-[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = add element filter f2b- { } + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = delete element filter f2b- { } + +[Init] + diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf new file mode 100644 index 00000000..a0534d35 --- /dev/null +++ b/config/action.d/nftables-common.conf @@ -0,0 +1,50 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# Modified: Alexander Belykh +# adapted for nftables +# +# This is a included configuration file and includes the definitions for the nftables +# used in all nftables based actions by default. +# +# The user can override the defaults in nftables-common.local + +[INCLUDES] + +after = nftables-common.local + +[Init] + +# Option: chain +# Notes specifies the nftables chain to which the Fail2Ban rules should be +# added +# Values: STRING Default: input +chain = input + +# Default name of the filtering set +# +name = default + +# Option: port +# Notes.: specifies port to monitor +# Values: [ NUM | STRING ] Default: +# +port = ssh + +# Option: protocol +# Notes.: internally used by config reader for interpolations. +# Values: [ tcp | udp ] Default: tcp +# +protocol = tcp + +# Option: blocktype +# Note: This is what the action does with rules. This can be any jump target +# as per the nftables man page (section 8). Common values are drop +# reject, reject with icmp type host-unreachable +# Values: STRING +blocktype = reject + +# Option: nftables +# Notes.: Actual command to be executed, including common to all calls options +# Values: STRING +nftables = nft diff --git a/config/action.d/nftables-multiport.conf b/config/action.d/nftables-multiport.conf new file mode 100644 index 00000000..ad61bf63 --- /dev/null +++ b/config/action.d/nftables-multiport.conf @@ -0,0 +1,51 @@ +# Fail2Ban configuration file +# +# Author: Cyril Jaquier +# Modified by Yaroslav Halchenko for multiport banning +# Modified: Alexander Belykh +# adapted for nftables +# + +[INCLUDES] + +before = nftables-common.conf + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = add set filter f2b- { type ipv4_addr\; } + insert rule filter dport { } ip saddr @f2b- + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID + delete set filter f2b- +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = list chain filter | grep -q '@f2b-[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = add element filter f2b- { } + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = delete element filter f2b- { } + +[Init] + From f7f91a8bd45d83fa106c2c827e91d53d1e9b75dc Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Tue, 5 Jan 2016 19:03:47 +0600 Subject: [PATCH 2/7] Refactor common code out of nftables-multiport/allports.conf --- config/action.d/nftables-allports.conf | 38 +++----------------- config/action.d/nftables-common.conf | 46 +++++++++++++++++++++++++ config/action.d/nftables-multiport.conf | 41 ++++------------------ 3 files changed, 56 insertions(+), 69 deletions(-) diff --git a/config/action.d/nftables-allports.conf b/config/action.d/nftables-allports.conf index 34622f65..afd0ca84 100644 --- a/config/action.d/nftables-allports.conf +++ b/config/action.d/nftables-allports.conf @@ -13,40 +13,10 @@ before = nftables-common.conf [Definition] -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD +# Option: nftables_mode +# Notes.: additional expressions for nftables filter rule +# Values: nftables expressions # -actionstart = add set filter f2b- { type ipv4_addr\; } - insert rule filter ip protocol ip saddr @f2b- - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID - delete set filter f2b- -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = list chain filter | grep -q '@f2b-[ \t]' - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = add element filter f2b- { } - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = delete element filter f2b- { } +nftables_mode = ip protocol [Init] - diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf index a0534d35..e65618ef 100644 --- a/config/action.d/nftables-common.conf +++ b/config/action.d/nftables-common.conf @@ -1,6 +1,9 @@ # Fail2Ban configuration file # # Author: Daniel Black +# Author: Cyril Jaquier +# Modified: Yaroslav O. Halchenko +# made active on all ports from original iptables.conf # Modified: Alexander Belykh # adapted for nftables # @@ -13,6 +16,49 @@ after = nftables-common.local +[Definition] + +# Option: nftables_mode +# Notes.: additional expressions for nftables filter rule +# Values: nftables expressions +# +nftables_mode = dport { } + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = add set filter f2b- { type ipv4_addr\; } + insert rule filter %(nftables_mode)s ip saddr @f2b- + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID + delete set filter f2b- +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = list chain filter | grep -q '@f2b-[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = add element filter f2b- { } + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = delete element filter f2b- { } + [Init] # Option: chain diff --git a/config/action.d/nftables-multiport.conf b/config/action.d/nftables-multiport.conf index ad61bf63..3c6455e2 100644 --- a/config/action.d/nftables-multiport.conf +++ b/config/action.d/nftables-multiport.conf @@ -1,7 +1,8 @@ # Fail2Ban configuration file # # Author: Cyril Jaquier -# Modified by Yaroslav Halchenko for multiport banning +# Modified: Yaroslav O. Halchenko +# made active on all ports from original iptables.conf # Modified: Alexander Belykh # adapted for nftables # @@ -12,40 +13,10 @@ before = nftables-common.conf [Definition] -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD +# Option: nftables_mode +# Notes.: additional expressions for nftables filter rule +# Values: nftables expressions # -actionstart = add set filter f2b- { type ipv4_addr\; } - insert rule filter dport { } ip saddr @f2b- - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID - delete set filter f2b- -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = list chain filter | grep -q '@f2b-[ \t]' - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = add element filter f2b- { } - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = delete element filter f2b- { } +nftables_mode = dport { } [Init] - From cb2d70d7a8a47a8f42e6c2a443b27cc150d669ba Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Tue, 5 Jan 2016 19:04:44 +0600 Subject: [PATCH 3/7] Add ChangeLog entry for new nftables actions --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8b5344be..6d42a837 100644 --- a/ChangeLog +++ b/ChangeLog @@ -37,6 +37,9 @@ ver. 0.9.4 (2015/XX/XXX) - wanna-be-released filter.d/*.local file. As extension to interpolation `%(known/parameter)s`, that does not works for filter and action init parameters + * New actions: + - nftables-multiport and nftables-allports - filtering using nftables + framework. Note: it requires a pre-existing chain for the filtering rule. * New filters: - openhab - domotic software authentication failure with the rest api and web interface (gh-1223) From 1983e155808f30eb0eb775061252e3dad1bd2b19 Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Wed, 6 Jan 2016 16:55:29 +0600 Subject: [PATCH 4/7] Add empty line between parameters in nftables-common.conf --- config/action.d/nftables-common.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf index e65618ef..534eec2f 100644 --- a/config/action.d/nftables-common.conf +++ b/config/action.d/nftables-common.conf @@ -37,6 +37,7 @@ actionstart = add set filter f2b- { type ipv4_addr\; } # actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID delete set filter f2b- + # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD From 260c30535d71c5ee1d07f843536bd4e9f6163358 Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Wed, 6 Jan 2016 17:13:30 +0600 Subject: [PATCH 5/7] Escape curly braces in nftables actions --- config/action.d/nftables-common.conf | 8 ++++---- config/action.d/nftables-multiport.conf | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf index 534eec2f..157f3c77 100644 --- a/config/action.d/nftables-common.conf +++ b/config/action.d/nftables-common.conf @@ -22,13 +22,13 @@ after = nftables-common.local # Notes.: additional expressions for nftables filter rule # Values: nftables expressions # -nftables_mode = dport { } +nftables_mode = dport \{ \} # Option: actionstart # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = add set filter f2b- { type ipv4_addr\; } +actionstart = add set filter f2b- \{ type ipv4_addr\; \} insert rule filter %(nftables_mode)s ip saddr @f2b- # Option: actionstop @@ -50,7 +50,7 @@ actioncheck = list chain filter | grep -q '@f2b-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = add element filter f2b- { } +actionban = add element filter f2b- \{ \} # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -58,7 +58,7 @@ actionban = add element filter f2b- { } # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = delete element filter f2b- { } +actionunban = delete element filter f2b- \{ \} [Init] diff --git a/config/action.d/nftables-multiport.conf b/config/action.d/nftables-multiport.conf index 3c6455e2..d1afafb3 100644 --- a/config/action.d/nftables-multiport.conf +++ b/config/action.d/nftables-multiport.conf @@ -17,6 +17,6 @@ before = nftables-common.conf # Notes.: additional expressions for nftables filter rule # Values: nftables expressions # -nftables_mode = dport { } +nftables_mode = dport \{ \} [Init] From 9779eeb986e323608207f9790556d7b9ce6816f1 Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Wed, 6 Jan 2016 17:33:14 +0600 Subject: [PATCH 6/7] Add nftables_type/family/table parameters --- config/action.d/nftables-common.conf | 32 ++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf index 157f3c77..26e35892 100644 --- a/config/action.d/nftables-common.conf +++ b/config/action.d/nftables-common.conf @@ -28,21 +28,21 @@ nftables_mode = dport \{ \} # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = add set filter f2b- \{ type ipv4_addr\; \} - insert rule filter %(nftables_mode)s ip saddr @f2b- +actionstart = add set f2b- \{ type \; \} + insert rule %(nftables_mode)s ip saddr @f2b- # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = HANDLE_ID=$( --handle --numeric list chain filter | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule filter $HANDLE_ID - delete set filter f2b- +actionstop = HANDLE_ID=$( --handle --numeric list chain | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule $HANDLE_ID + delete set f2b- # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # -actioncheck = list chain filter | grep -q '@f2b-[ \t]' +actioncheck = list chain | grep -q '@f2b-[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the @@ -50,7 +50,7 @@ actioncheck = list chain filter | grep -q '@f2b-[ \t]' # Tags: See jail.conf(5) man page # Values: CMD # -actionban = add element filter f2b- \{ \} +actionban = add element f2b- \{ \} # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -58,10 +58,28 @@ actionban = add element filter f2b- \{ \} # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = delete element filter f2b- \{ \} +actionunban = delete element f2b- \{ \} [Init] +# Option: nftables_type +# Notes.: address type to work with +# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr +# +nftables_type = ipv4_addr + +# Option: nftables_family +# Notes.: address family to work in +# Values: [ip | ip6 | inet] Default: inet +# +nftables_family = inet + +# Option: nftables_table +# Notes.: table in the address family to work in +# Values: STRING Default: filter +# +nftables_table = filter + # Option: chain # Notes specifies the nftables chain to which the Fail2Ban rules should be # added From 985e8938a4a7aa4181851ad962cfe0c6a3a8fba3 Mon Sep 17 00:00:00 2001 From: Alexander Belykh Date: Wed, 6 Jan 2016 17:39:54 +0600 Subject: [PATCH 7/7] Refactor nftables actionstop into smaller parts --- config/action.d/nftables-common.conf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config/action.d/nftables-common.conf b/config/action.d/nftables-common.conf index 26e35892..80657c5c 100644 --- a/config/action.d/nftables-common.conf +++ b/config/action.d/nftables-common.conf @@ -31,11 +31,15 @@ nftables_mode = dport \{ \} actionstart = add set f2b- \{ type \; \} insert rule %(nftables_mode)s ip saddr @f2b- +_nft_list = --handle --numeric list chain +_nft_get_handle_id = grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*' + # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = HANDLE_ID=$( --handle --numeric list chain | grep -m1 'ip saddr @f2b- # handle' | grep -oe ' handle [0-9]*'); delete rule $HANDLE_ID +actionstop = HANDLE_ID=$(%(_nft_list)s | %(_nft_get_handle_id)s) + delete rule $HANDLE_ID delete set f2b- # Option: actioncheck