🌴 Sync 2026-03-05 23:51:42

fail2banop/Makefile

@@ -0,0 +1,79 @@
+#
+# Copyright (C) 2015-2016 OpenWrt.org
+# Copyright (C) 2020 jjm2473@gmail.com
+#
+# This is free software, licensed under the GNU General Public License v3.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_ARCH_FAIL2BANOP:=$(ARCH)
+
+PKG_NAME:=fail2banop
+# use PKG_SOURCE_DATE instead of PKG_VERSION for compitable
+PKG_SOURCE_DATE:=1.0.1
+PKG_RELEASE:=1
+ARCH_HEXCODE:=
+ifeq ($(ARCH),x86_64)
+ARCH_HEXCODE=8664
+else ifeq ($(ARCH),aarch64)
+ARCH_HEXCODE=aa64
+else ifeq ($(ARCH),arm)
+ARCH_HEXCODE=aa32
+else ifeq ($(ARCH),mipsel)
+ARCH_HEXCODE=1b0c
+endif
+PKG_SOURCE_VERSION:=9c34c802ea35f801932edc27839d498c4e6e9be9
+PKG_SOURCE:=$(PKG_NAME)-binary-$(PKG_SOURCE_DATE).tar.gz
+PKG_SOURCE_URL:=https://github.com/linkease/fail2ban-openwrt/releases/download/v${PKG_SOURCE_DATE}/
+PKG_HASH:=skip
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-binary-$(PKG_SOURCE_DATE)
+
+PKG_BUILD_PARALLEL:=1
+PKG_USE_MIPS16:=0
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/$(PKG_NAME)
+	SECTION:=net
+	CATEGORY:=Network
+	TITLE:=fail2banop - Auto ban ip if the login is failed
+	PKGARCH:=all
+	URL:=https://github.com/linkease/fail2ban-openwrt
+endef
+
+define Package/$(PKG_NAME)/description
+  Auto ban ip if the login is failed
+endef
+
+define Package/$(PKG_NAME)/conffiles
+/etc/config/fail2banop
+endef
+
+define Package/$(PKG_NAME)/postinst
+#!/bin/sh
+if [ -z "$${IPKG_INSTROOT}" ]; then
+	[ -f /etc/uci-defaults/fail2banop ] && /etc/uci-defaults/fail2banop && rm -f /etc/uci-defaults/fail2banop
+	exit 0
+fi
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/$(PKG_NAME)/install
+	$(INSTALL_DIR) $(1)/etc/config $(1)/etc/init.d $(1)/etc/uci-defaults $(1)/usr/sbin
+	$(INSTALL_DIR) $(1)/usr/share/nftables.d/chain-pre/input $(1)/usr/share/nftables.d/table-post
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/fail2ban_op_bin.$(PKG_ARCH_FAIL2BANOP) $(1)/usr/sbin/fail2ban_op_bin
+	$(INSTALL_CONF) ./files/fail2banop.config $(1)/etc/config/fail2banop
+	$(INSTALL_BIN) ./files/fail2banop.init $(1)/etc/init.d/fail2banop
+	$(INSTALL_BIN) ./files/fail2banop.uci-default $(1)/etc/uci-defaults/fail2banop
+	$(INSTALL_DATA) ./files/nft-hook/chain-pre/input/20-fail2banop.nft $(1)/usr/share/nftables.d/chain-pre/input/
+	$(INSTALL_DATA) ./files/nft-hook/table-post/21-fail2banop.nft $(1)/usr/share/nftables.d/table-post/
+endef
+
+$(eval $(call BuildPackage,$(PKG_NAME)))

fail2banop/files/fail2banop.config

@@ -0,0 +1,5 @@
+config fail2banop
+    option enabled '1'
+    # option window '600'
+    # option threshold '10'
+    # option ban_duration '1440'

fail2banop/files/fail2banop.init

@@ -0,0 +1,41 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+USE_PROCD=1
+NAME=fail2banop
+ 
+get_config() {
+  config_get_bool enabled $1 enabled 0
+  config_get window $1 window 600
+  config_get threshold $1 threshold 10
+  config_get ban_duration $1 ban_duration 1440
+}
+
+start_service() { 
+  config_load "$NAME"
+  config_foreach get_config "$NAME"
+  [ $enabled != 1 ] && return 1
+
+  procd_open_instance
+  procd_set_param command /usr/sbin/fail2ban_op_bin \
+    --window="$window" \
+    --threshold="$threshold" \
+    --ban-duration="$ban_duration"
+  procd_set_param stderr 1
+  procd_set_param respawn
+  procd_close_instance
+}
+
+stop_service() {
+  nft flush set inet fw4 fail2banop4
+  nft flush set inet fw4 fail2banop6
+}
+
+service_triggers() {
+  procd_add_reload_trigger "$NAME"
+}
+
+
+reload_service() {
+	restart
+}

fail2banop/files/fail2banop.uci-default

@@ -0,0 +1,26 @@
+#!/bin/sh
+[ ! -f "/usr/share/ucitrack/luci-app-fail2banop.json" ] && {
+    cat > /usr/share/ucitrack/luci-app-fail2banop.json << EEOF
+{
+    "config": "fail2banop",
+    "init": "fail2banop"
+}
+EEOF
+}
+
+uci -q batch <<-EOF >/dev/null
+	delete ucitrack.@fail2banop[-1]
+	add ucitrack fail2banop
+	set ucitrack.@fail2banop[-1].init=fail2banop
+	commit ucitrack
+EOF
+
+# Check if fail2ban chain exists in nftables, reload firewall if not
+if ! nft -t list chain inet fw4 input 2>/dev/null | grep -qF 'ip saddr @fail2banop4 drop'; then
+	/etc/init.d/firewall reload
+fi
+
+/etc/init.d/fail2banop enable
+
+exit 0
+

fail2banop/files/nft-hook/chain-pre/input/20-fail2banop.nft

@@ -0,0 +1,2 @@
+ip saddr @fail2banop4 drop
+ip6 saddr @fail2banop6 drop

fail2banop/files/nft-hook/table-post/21-fail2banop.nft

@@ -0,0 +1,2 @@
+set fail2banop4 { type ipv4_addr; }
+set fail2banop6 { type ipv6_addr; }