fail2ban-rs 1.2.1

A pure-Rust fail2ban replacement. Single static binary, fast two-phase matching, nftables/iptables firewall backends.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

use super::FilterTemplate;

pub const FILTER: FilterTemplate = FilterTemplate {
    name: "nsd",
    description: "NSD authoritative DNS rate limit blocks and refused transfers",
    log_path: "/var/log/nsd.log",
    date_format: "epoch",
    patterns: &[
        r"nsd\[\d+\]: info: ratelimit block .* query <HOST>",
        r"nsd\[\d+\]:.*from client <HOST> refused",
    ],
};

#[cfg(test)]
mod tests {
    use crate::detect::filters::test_util::assert_filter_matches;

    #[test]
    fn nsd_ratelimit_block() {
        assert_filter_matches(
            "nsd",
            "[1387288694] nsd[7745]: info: ratelimit block example.com. type any target 192.0.2.0/24 query 192.0.2.105 TYPE255",
            "192.0.2.105",
        );
    }
}