Start implementing ipv6 support #3631
Conversation
bin/v-add-web-domain-ipv46
Outdated
| if [ -z "$ip" -a -z "$ipv6" ]; then | ||
| get_user_ipv6 # get first available user ipv6 address as fallback, if none ip address was defined | ||
| if [ -z "$ipv6" ]; then | ||
| get_user_ip # get first available user ipv4 address as fallback, if none ipv6 user address available |
There was a problem hiding this comment.
get_user_ipv6 sets $ipv6 how ever $ip is still empty
bin/v-add-web-domain
Outdated
|
|
||
| exit | ||
| ${HESTIA}/bin/v-add-web-domain-ipv46 "$user" "$domain" "$ip" "$ipv6" "$restart" "$aliases" "$proxy_ext" |
There was a problem hiding this comment.
If $ip is not provided it should get ip from available ips
@todo: To be removed when final merge
New yarn version
bin/v-add-firewall-chain
Outdated
| @@ -47,8 +47,8 @@ fi | |||
| # Verifications # | |||
| #----------------------------------------------------------# | |||
|
|
|||
| check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL]' | |||
| #is_format_valid 'chain' 'port_ext' 'protocol' | |||
| check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL] [FAMILY] [IPTABLES] [LOCKINGOPT]' | |||
There was a problem hiding this comment.
Please make sure to add validation for this ...
There was a problem hiding this comment.
For optional parameters too?
I will show, how it is implemented with other checks. But you are right, the [IPTABLES] parameter is very dangerous. Theoretically you can define instead of iptables each other binary or script here.
There was a problem hiding this comment.
These parameters are from standard examples and scripts, proposed by fail2ban
There was a problem hiding this comment.
We need at least prevent users can't be using ' as it can be abused...
format_no_quotes should fix it ...
There was a problem hiding this comment.
No, if I implement it, then not a half solution. I make it completelly. [IPTABLES] is really very dangerous and I will check it double. [FAMILY] can be only 'inet4' or 'inet6', therefore it is very simple to check it. I rename then the variable to a better and unique one, since "family" is very common. [LOCKINGOPT] is deactivated now, since I used it wrong with quotes. But I will activate it in future and check it against '-w', since it can have actually only this option.
bin/v-add-firewall-chain
Outdated
| check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL] [FAMILY] [IPTABLES] [LOCKINGOPT]' | ||
| is_format_valid 'chain' 'port_ext' 'protocol' | ||
| check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL] [IPFAMILY] [IPTABLES] [FW_LOCKINGOPT]' | ||
| is_format_valid 'chain' 'port_ext' 'protocol' 'ipfamily' 'iptables' 'fw_lockingopt' |
There was a problem hiding this comment.
Do we really need iptables / fw_lockingopt option
I don't we will ever want to implement anything other then iptables and it should all be the same..
There was a problem hiding this comment.
Maybe for iptables6 and iptables...
There was a problem hiding this comment.
this locking option (as -w) comes from standard example of fail2ban. Therefore I pass-through it here, like it is defined in standard library of fail2ban. Unfortunatelly it works actually only in case of "add chain". I do not know, why, but that were results of my "printf test" or better to say "echo test" and play with these scripts.
The problem with this additionally option is followed: If you ignore it completelly, may be, that it will be added during call as last argument. In this case you will have iptables="iptables -w" (or something else). Therefore we need a "very last" argument after "last argument" iptables. Then you will have "clean" separation in iptables="iptables" and rest in this "lockingopt".
After it we can decide, if we want to use it, if we call iptables. Actually it is only during "add chain" and I will observe, how it works. I do not know really, why fail2ban use this option. I will read more about it
There was a problem hiding this comment.
You can find this file under /etc/fail2ban/actions.d/iptables.conf
And that is a kind of "library" for calls over this iptables-interface
There was a problem hiding this comment.
# Notes.: Option was introduced to iptables to prevent multiple instances from
# running concurrently and causing irratic behavior. -w was introduced
# in iptables 1.4.20, so might be absent on older systems
# See https://github.com/fail2ban/fail2ban/issues/1122
# Values: STRING
lockingopt = -w
# Option: iptables
# Notes.: Actual command to be executed, including common to all calls options
# Values: STRING
iptables = iptables <lockingopt>
[Init?family=inet6]
# Option: blocktype (ipv6)
# Note: This is what the action does with rules. This can be any jump target
# as per the iptables man page (section 8). Common values are DROP
# REJECT, REJECT --reject-with icmp6-port-unreachable
# Values: STRING
blocktype = REJECT --reject-with icmp6-port-unreachable
# Option: iptables (ipv6)
# Notes.: Actual command to be executed, including common to all calls options
# Values: STRING
iptables = ip6tables <lockingopt>
Additional manually changes required!
No description provided.