MiscMirror/blockfast
1
0
Fork 0
mirror of https://github.com/pldubouilh/blockfast.git synced 2026-08-28 04:46:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

run iptables/ipset directly

Browse Source
This commit is contained in:
Pierre Dubouilh
2025-02-01 12:15:20 +02:00
parent 1dca57a191
commit 676bc30af8
2 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+2 -4
View File
@@ -8,7 +8,8 @@ run::
touch /tmp/clftest
touch /tmp/jsontest
touch /tmp/generictest
cargo run -- -v -s=/tmp/sshdtest -c=/tmp/clftest -j=/tmp/jsontest --generic-logpath=/tmp/generictest --generic-ip='from ([0-9a-fA-F:.]+) port' --generic-positive='Failed password'
cargo build
sudo target/debug/blockfast -v -s=/tmp/sshdtest -c=/tmp/clftest -j=/tmp/jsontest --generic-logpath=/tmp/generictest --generic-ip='from ([0-9a-fA-F:.]+) port' --generic-positive='Failed password'
ci:: test
cargo fmt --all -- --check
@@ -30,9 +31,6 @@ watch::
test::
cargo test
watch-test::
ls src/*.rs | entr -rc -- make test
release::
cargo build --target x86_64-unknown-linux-musl --release
src/jail.rs
+10 -10
View File
@@ -14,9 +14,9 @@ pub struct Jail {
remand: Mutex<HashMap<IpAddr, (u8, u64)>>,
}
fn exec(cmd: &str, err: &str) -> Result<(), Error> {
fn exec(program: &str, cmd: &str, err: &str) -> Result<(), Error> {
let sentence_sl: Vec<&str> = cmd.split_whitespace().collect();
let out = Command::new("sudo").args(sentence_sl).output()?;
let out = Command::new(program).args(sentence_sl).output()?;
let sc = out.status.code();
ensure!(sc == Some(0), "err exec {}, {:?}\n{}", cmd, out, err);
Ok(())
@@ -28,16 +28,16 @@ impl Jail {
let n = format!("blockfast_jail_{}", jailtime);
// create
let cmd = format!("ipset create -exist {} hash:ip timeout {}", n, jailtime);
exec(&cmd, ERR_MSG)?;
let cmd = format!("create -exist {} hash:ip timeout {}", n, jailtime);
exec("ipset", &cmd, ERR_MSG)?;
// setup input
let cmd = format!("iptables -I INPUT 1 -m set -j DROP --match-set {} src", n);
exec(&cmd, ERR_MSG)?;
let cmd = format!("-I INPUT 1 -m set -j DROP --match-set {} src", n);
exec("iptables", &cmd, ERR_MSG)?;
// setup fwd
let cmd = format!("iptables -I FORWARD 1 -m set -j DROP --match-set {} src", n);
exec(&cmd, ERR_MSG)?;
let cmd = format!("-I FORWARD 1 -m set -j DROP --match-set {} src", n);
exec("iptables", &cmd, ERR_MSG)?;
log!("jail setup, allowance {}, time {}s", allowance, jailtime);
Ok(Jail {
@@ -75,8 +75,8 @@ impl Jail {
};
if should_ban {
let cmd = format!("ipset add -exist {} {}", self.name, ip);
exec(&cmd, "")?;
let cmd = format!("add -exist {} {}", self.name, ip);
exec("ipset", &cmd, "")?;
return Ok(true);
}