You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
38 lines
1.9 KiB
38 lines
1.9 KiB
diff -up fail2ban-0.10.1/config/action.d/firewallcmd-ipset.conf.ipset fail2ban-0.10.1/config/action.d/firewallcmd-ipset.conf
|
|
--- fail2ban-0.10.1/config/action.d/firewallcmd-ipset.conf.ipset 2017-10-12 05:46:46.000000000 -0600
|
|
+++ fail2ban-0.10.1/config/action.d/firewallcmd-ipset.conf 2017-12-30 12:51:29.714747457 -0700
|
|
@@ -18,7 +18,7 @@ before = firewallcmd-common.conf
|
|
|
|
[Definition]
|
|
|
|
-actionstart = ipset create <ipmset> hash:ip timeout <bantime>
|
|
+actionstart = ipset create <ipmset> hash:ip timeout <bantime><familyopt>
|
|
firewall-cmd --direct --add-rule <family> filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
|
|
|
|
actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
|
|
@@ -45,10 +45,12 @@ chain = INPUT_direct
|
|
bantime = 600
|
|
|
|
ipmset = f2b-<name>
|
|
+familyopt =
|
|
|
|
[Init?family=inet6]
|
|
|
|
ipmset = f2b-<name>6
|
|
+familyopt = <sp>family inet6
|
|
|
|
|
|
# DEV NOTES:
|
|
diff -up fail2ban-0.10.1/fail2ban/tests/servertestcase.py.ipset fail2ban-0.10.1/fail2ban/tests/servertestcase.py
|
|
--- fail2ban-0.10.1/fail2ban/tests/servertestcase.py.ipset 2017-12-30 12:51:29.714747457 -0700
|
|
+++ fail2ban-0.10.1/fail2ban/tests/servertestcase.py 2017-12-30 12:52:05.823412753 -0700
|
|
@@ -1644,7 +1644,7 @@ class ServerConfigReaderTests(LogCapture
|
|
"`firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`",
|
|
),
|
|
'ip6-start': (
|
|
- "`ipset create f2b-j-w-fwcmd-ipset6 hash:ip timeout 600`",
|
|
+ "`ipset create f2b-j-w-fwcmd-ipset6 hash:ip timeout 600 family inet6`",
|
|
"`firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`",
|
|
),
|
|
'stop': (
|