TRKJ/EdgeNode
2
0
Fork 0
mirror of https://github.com/TeaOSLab/EdgeNode.git synced 2025-11-13 23:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

将nftables黑名单扩展到5个

Browse Source
This commit is contained in:
GoEdgeLab
2023-04-02 20:32:36 +08:00
parent 6852195a90
commit 85ca7337f7
1 changed files with 21 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
internal/firewalls/firewall_nftables.go
View File

@@ -5,6 +5,7 @@ package firewalls
import ( import (
"errors" "errors"
"github.com/TeaOSLab/EdgeCommon/pkg/configutils"
"github.com/TeaOSLab/EdgeNode/internal/conns" "github.com/TeaOSLab/EdgeNode/internal/conns"
teaconst "github.com/TeaOSLab/EdgeNode/internal/const" teaconst "github.com/TeaOSLab/EdgeNode/internal/const"
"github.com/TeaOSLab/EdgeNode/internal/events" "github.com/TeaOSLab/EdgeNode/internal/events"
@@ -130,8 +131,8 @@ type NFTablesFirewall struct {
allowIPv4Set *nftables.Set allowIPv4Set *nftables.Set
allowIPv6Set *nftables.Set allowIPv6Set *nftables.Set
denyIPv4Set *nftables.Set denyIPv4Sets []*nftables.Set
denyIPv6Set *nftables.Set denyIPv6Sets []*nftables.Set
firewalld *Firewalld firewalld *Firewalld
@@ -206,7 +207,7 @@ func (this *NFTablesFirewall) init() error {
// allow set // allow set
// "allow" should be always first // "allow" should be always first
for _, setAction := range []string{"allow", "deny"} { for _, setAction := range []string{"allow", "deny", "deny1", "deny2", "deny3", "deny4"} {
var setName = setAction + "_set" var setName = setAction + "_set"
set, err := table.GetSet(setName) set, err := table.GetSet(setName)
@@ -236,13 +237,13 @@ func (this *NFTablesFirewall) init() error {
if setAction == "allow" { if setAction == "allow" {
this.allowIPv4Set = set this.allowIPv4Set = set
} else { } else {
this.denyIPv4Set = set this.denyIPv4Sets = append(this.denyIPv4Sets, set)
} }
} else if tableDef.IsIPv6 { } else if tableDef.IsIPv6 {
if setAction == "allow" { if setAction == "allow" {
this.allowIPv6Set = set this.allowIPv6Set = set
} else { } else {
this.denyIPv6Set = set this.denyIPv6Sets = append(this.denyIPv6Sets, set)
} }
} }
@@ -401,20 +402,21 @@ func (this *NFTablesFirewall) DropSourceIP(ip string, timeoutSeconds int, async
// 再次尝试关闭连接 // 再次尝试关闭连接
defer conns.SharedMap.CloseIPConns(ip) defer conns.SharedMap.CloseIPConns(ip)
var ipLong = configutils.IPString2Long(ip)
if strings.Contains(ip, ":") { // ipv6 if strings.Contains(ip, ":") { // ipv6
if this.denyIPv6Set == nil { if len(this.denyIPv6Sets) == 0 {
return errors.New("ipv6 ip set is nil") return errors.New("ipv6 ip set not found")
} }
return this.denyIPv6Set.AddElement(data.To16(), &nftables.ElementOptions{ return this.denyIPv6Sets[ipLong%uint64(len(this.denyIPv6Sets))].AddElement(data.To16(), &nftables.ElementOptions{
Timeout: time.Duration(timeoutSeconds) * time.Second, Timeout: time.Duration(timeoutSeconds) * time.Second,
}, false) }, false)
} }
// ipv4 // ipv4
if this.denyIPv4Set == nil { if len(this.denyIPv4Sets) == 0 {
return errors.New("ipv4 ip set is nil") return errors.New("ipv4 ip set not found")
} }
return this.denyIPv4Set.AddElement(data.To4(), &nftables.ElementOptions{ return this.denyIPv4Sets[ipLong%uint64(len(this.denyIPv4Sets))].AddElement(data.To4(), &nftables.ElementOptions{
Timeout: time.Duration(timeoutSeconds) * time.Second, Timeout: time.Duration(timeoutSeconds) * time.Second,
}, false) }, false)
} }
@@ -426,9 +428,10 @@ func (this *NFTablesFirewall) RemoveSourceIP(ip string) error {
return errors.New("invalid ip '" + ip + "'") return errors.New("invalid ip '" + ip + "'")
} }
var ipLong = configutils.IPString2Long(ip)
if strings.Contains(ip, ":") { // ipv6 if strings.Contains(ip, ":") { // ipv6
if this.denyIPv6Set != nil { if len(this.denyIPv6Sets) > 0 {
err := this.denyIPv6Set.DeleteElement(data.To16()) err := this.denyIPv6Sets[ipLong%uint64(len(this.denyIPv6Sets))].DeleteElement(data.To16())
if err != nil { if err != nil {
return err return err
} }
@@ -445,13 +448,14 @@ func (this *NFTablesFirewall) RemoveSourceIP(ip string) error {
} }
// ipv4 // ipv4
if this.allowIPv4Set != nil { if len(this.denyIPv4Sets) > 0 {
err := this.denyIPv4Set.DeleteElement(data.To4()) err := this.denyIPv4Sets[ipLong%uint64(len(this.denyIPv4Sets))].DeleteElement(data.To4())
if err != nil { if err != nil {
return err return err
} }
}
err = this.allowIPv4Set.DeleteElement(data.To4()) if this.allowIPv4Set != nil {
err := this.allowIPv4Set.DeleteElement(data.To4())
if err != nil { if err != nil {
return err return err
} }