MiscMirror/blockfast
1
0
Fork 0
mirror of https://github.com/pldubouilh/blockfast.git synced 2026-08-28 04:46:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

run iptables/ipset directly

Browse Source
This commit is contained in:
Pierre Dubouilh
2025-02-01 12:15:20 +02:00
parent 1dca57a191
commit 676bc30af8
2 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+2 -4
View File
@@ -8,7 +8,8 @@ run::
touch /tmp/clftest touch /tmp/clftest
touch /tmp/jsontest touch /tmp/jsontest
touch /tmp/generictest touch /tmp/generictest
cargo run -- -v -s=/tmp/sshdtest -c=/tmp/clftest -j=/tmp/jsontest --generic-logpath=/tmp/generictest --generic-ip='from ([0-9a-fA-F:.]+) port' --generic-positive='Failed password' cargo build
sudo target/debug/blockfast -v -s=/tmp/sshdtest -c=/tmp/clftest -j=/tmp/jsontest --generic-logpath=/tmp/generictest --generic-ip='from ([0-9a-fA-F:.]+) port' --generic-positive='Failed password'
ci:: test ci:: test
cargo fmt --all -- --check cargo fmt --all -- --check
@@ -30,9 +31,6 @@ watch::
test:: test::
cargo test cargo test
watch-test::
ls src/*.rs | entr -rc -- make test
release:: release::
cargo build --target x86_64-unknown-linux-musl --release cargo build --target x86_64-unknown-linux-musl --release
src/jail.rs
+10 -10
View File
@@ -14,9 +14,9 @@ pub struct Jail {
remand: Mutex<HashMap<IpAddr, (u8, u64)>>, remand: Mutex<HashMap<IpAddr, (u8, u64)>>,
} }
fn exec(cmd: &str, err: &str) -> Result<(), Error> { fn exec(program: &str, cmd: &str, err: &str) -> Result<(), Error> {
let sentence_sl: Vec<&str> = cmd.split_whitespace().collect(); let sentence_sl: Vec<&str> = cmd.split_whitespace().collect();
let out = Command::new("sudo").args(sentence_sl).output()?; let out = Command::new(program).args(sentence_sl).output()?;
let sc = out.status.code(); let sc = out.status.code();
ensure!(sc == Some(0), "err exec {}, {:?}\n{}", cmd, out, err); ensure!(sc == Some(0), "err exec {}, {:?}\n{}", cmd, out, err);
Ok(()) Ok(())
@@ -28,16 +28,16 @@ impl Jail {
let n = format!("blockfast_jail_{}", jailtime); let n = format!("blockfast_jail_{}", jailtime);
// create // create
let cmd = format!("ipset create -exist {} hash:ip timeout {}", n, jailtime); let cmd = format!("create -exist {} hash:ip timeout {}", n, jailtime);
exec(&cmd, ERR_MSG)?; exec("ipset", &cmd, ERR_MSG)?;
// setup input // setup input
let cmd = format!("iptables -I INPUT 1 -m set -j DROP --match-set {} src", n); let cmd = format!("-I INPUT 1 -m set -j DROP --match-set {} src", n);
exec(&cmd, ERR_MSG)?; exec("iptables", &cmd, ERR_MSG)?;
// setup fwd // setup fwd
let cmd = format!("iptables -I FORWARD 1 -m set -j DROP --match-set {} src", n); let cmd = format!("-I FORWARD 1 -m set -j DROP --match-set {} src", n);
exec(&cmd, ERR_MSG)?; exec("iptables", &cmd, ERR_MSG)?;
log!("jail setup, allowance {}, time {}s", allowance, jailtime); log!("jail setup, allowance {}, time {}s", allowance, jailtime);
Ok(Jail { Ok(Jail {
@@ -75,8 +75,8 @@ impl Jail {
}; };
if should_ban { if should_ban {
let cmd = format!("ipset add -exist {} {}", self.name, ip); let cmd = format!("add -exist {} {}", self.name, ip);
exec(&cmd, "")?; exec("ipset", &cmd, "")?;
return Ok(true); return Ok(true);
} }