commit 544ebba97367ac0708c673326ef4e11f8459baad · pyrox.dev/nixpkgs

nixos/doc/manual/release-notes/rl-2305.section.md

···

       257
       257
        
       

     

       258
       258
        
       - To enable the HTTP3 (QUIC) protocol for a nginx virtual host, set the `quic` attribute on it to true, e.g. `services.nginx.virtualHosts.<name>.quic = true;`.

     

       259
       259
        
       

     

       260
       260
       +
       - In `services.fail2ban`, `bantime-increment.<name>` options now default to `null` (except `bantime-increment.enable`) and are used to set the corresponding option in `jail.local` only if not `null`. Also, enforce that `bantime-increment.formula` and `bantime-increment.multipliers` are not both specified.

     

       261
       261
       +
       

     

       260
       262
        
       - The default Asterisk package was changed to v20 from v19. Asterisk versions 16 and 19 have been dropped due to being EOL. You may need to update /var/lib/asterisk to match the template files in `${asterisk-20}/var/lib/asterisk`.

     

       261
       263
        
       

     

       262
       264
        
       - conntrack helper autodetection has been removed from kernels 6.0 and up upstream, and an assertion was added to ensure things don't silently stop working. Migrate your configuration to assign helpers explicitly or use an older LTS kernel branch as a temporary workaround.

+38 -31

nixos/modules/services/security/fail2ban.nix

···

       118
       118
        
               default = false;

     

       119
       119
        
               type = types.bool;

     

       120
       120
        
               description = lib.mdDoc ''

     

       121
       121
       -
                 Allows to use database for searching of previously banned ip's to increase

     

       122
       122
       -
                 a default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...

     

       121
       121
       +
                 "bantime.increment" allows to use database for searching of previously banned ip's to increase

     

       122
       122
       +
                 a default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32 ...

     

       123
       123
        
               '';

     

       124
       124
        
             };

     

       125
       125
        
       

     

       126
       126
        
             bantime-increment.rndtime = mkOption {

     

       127
       127
       -
               default = "4m";

     

       128
       128
       -
               type = types.str;

     

       127
       127
       +
               default = null;

     

       128
       128
       +
               type = types.nullOr types.str;

     

       129
       129
        
               example = "8m";

     

       130
       130
        
               description = lib.mdDoc ''

     

       131
       131
       -
                 "bantime-increment.rndtime" is the max number of seconds using for mixing with random time

     

       131
       131
       +
                 "bantime.rndtime" is the max number of seconds using for mixing with random time

     

       132
       132
        
                 to prevent "clever" botnets calculate exact time IP can be unbanned again

     

       133
       133
        
               '';

     

       134
       134
        
             };

     

       135
       135
        
       

     

       136
       136
        
             bantime-increment.maxtime = mkOption {

     

       137
       137
       -
               default = "10h";

     

       138
       138
       -
               type = types.str;

     

       137
       137
       +
               default = null;

     

       138
       138
       +
               type = types.nullOr types.str;

     

       139
       139
        
               example = "48h";

     

       140
       140
        
               description = lib.mdDoc ''

     

       141
       141
       -
                 "bantime-increment.maxtime" is the max number of seconds using the ban time can reach (don't grows further)

     

       141
       141
       +
                 "bantime.maxtime" is the max number of seconds using the ban time can reach (don't grows further)

     

       142
       142
        
               '';

     

       143
       143
        
             };

     

       144
       144
        
       

     

       145
       145
        
             bantime-increment.factor = mkOption {

     

       146
       146
       -
               default = "1";

     

       147
       147
       -
               type = types.str;

     

       146
       146
       +
               default = null;

     

       147
       147
       +
               type = types.nullOr types.str;

     

       148
       148
        
               example = "4";

     

       149
       149
        
               description = lib.mdDoc ''

     

       150
       150
       -
                 "bantime-increment.factor" is a coefficient to calculate exponent growing of the formula or common multiplier,

     

       150
       150
       +
                 "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier,

     

       151
       151
        
                 default value of factor is 1 and with default value of formula, the ban time grows by 1, 2, 4, 8, 16 ...

     

       152
       152
        
               '';

     

       153
       153
        
             };

     

       154
       154
        
       

     

       155
       155
        
             bantime-increment.formula = mkOption {

     

       156
       156
       -
               default = "ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor";

     

       157
       157
       -
               type = types.str;

     

       156
       156
       +
               default = null;

     

       157
       157
       +
               type = types.nullOr types.str;

     

       158
       158
        
               example = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";

     

       159
       159
        
               description = lib.mdDoc ''

     

       160
       160
       -
                 "bantime-increment.formula" used by default to calculate next value of ban time, default value bellow,

     

       161
       161
       -
                 the same ban time growing will be reached by multipliers 1, 2, 4, 8, 16, 32...

     

       160
       160
       +
                 "bantime.formula" used by default to calculate next value of ban time, default value bellow,

     

       161
       161
       +
                 the same ban time growing will be reached by multipliers 1, 2, 4, 8, 16, 32 ...

     

       162
       162
        
               '';

     

       163
       163
        
             };

     

       164
       164
        
       

     

       165
       165
        
             bantime-increment.multipliers = mkOption {

     

       166
       166
       -
               default = "1 2 4 8 16 32 64";

     

       167
       167
       -
               type = types.str;

     

       168
       168
       -
               example = "2 4 16 128";

     

       166
       166
       +
               default = null;

     

       167
       167
       +
               type = types.nullOr types.str;

     

       168
       168
       +
               example = "1 2 4 8 16 32 64";

     

       169
       169
        
               description = lib.mdDoc ''

     

       170
       170
       -
                 "bantime-increment.multipliers" used to calculate next value of ban time instead of formula, corresponding

     

       170
       170
       +
                 "bantime.multipliers" used to calculate next value of ban time instead of formula, corresponding

     

       171
       171
        
                 previously ban count and given "bantime.factor" (for multipliers default is 1);

     

       172
       172
        
                 following example grows ban time by 1, 2, 4, 8, 16 ... and if last ban count greater as multipliers count,

     

       173
       173
        
                 always used last multiplier (64 in example), for factor '1' and original ban time 600 - 10.6 hours

     
···

       175
       175
        
             };

     

       176
       176
        
       

     

       177
       177
        
             bantime-increment.overalljails = mkOption {

     

       178
       178
       -
               default = false;

     

       179
       179
       -
               type = types.bool;

     

       178
       178
       +
               default = null;

     

       179
       179
       +
               type = types.nullOr types.bool;

     

       180
       180
        
               example = true;

     

       181
       181
        
               description = lib.mdDoc ''

     

       182
       182
       -
                 "bantime-increment.overalljails"  (if true) specifies the search of IP in the database will be executed

     

       182
       182
       +
                 "bantime.overalljails" (if true) specifies the search of IP in the database will be executed

     

       183
       183
        
                 cross over all jails, if false (default), only current jail of the ban IP will be searched

     

       184
       184
        
               '';

     

       185
       185
        
             };

     
···

       276
       276
        
         ###### implementation

     

       277
       277
        
       

     

       278
       278
        
         config = mkIf cfg.enable {

     

       279
       279
       +
           assertions = [

     

       280
       280
       +
             {

     

       281
       281
       +
               assertion = (cfg.bantime-increment.formula == null || cfg.bantime-increment.multipliers == null);

     

       282
       282
       +
               message = ''

     

       283
       283
       +
                 Options `services.fail2ban.bantime-increment.formula` and `services.fail2ban.bantime-increment.multipliers` cannot be both specified.

     

       284
       284
       +
               '';

     

       285
       285
       +
             }

     

       286
       286
       +
           ];

     

       279
       287
        
       

     

       280
       288
        
           warnings = mkIf (config.networking.firewall.enable == false && config.networking.nftables.enable == false) [

     

       281
       289
        
             "fail2ban can not be used without a firewall"

     
···

       330
       338
        
           # Add some reasonable default jails.  The special "DEFAULT" jail

     

       331
       339
        
           # sets default values for all other jails.

     

       332
       340
        
           services.fail2ban.jails.DEFAULT = ''

     

       333
       333
       -
             ${optionalString cfg.bantime-increment.enable ''

     

       334
       334
       -
               # Bantime incremental

     

       335
       335
       -
               bantime.increment    = ${boolToString cfg.bantime-increment.enable}

     

       336
       336
       -
               bantime.maxtime      = ${cfg.bantime-increment.maxtime}

     

       337
       337
       -
               bantime.factor       = ${cfg.bantime-increment.factor}

     

       338
       338
       -
               bantime.formula      = ${cfg.bantime-increment.formula}

     

       339
       339
       -
               bantime.multipliers  = ${cfg.bantime-increment.multipliers}

     

       340
       340
       -
               bantime.overalljails = ${boolToString cfg.bantime-increment.overalljails}

     

       341
       341
       -
             ''}

     

       341
       341
       +
             # Bantime increment options

     

       342
       342
       +
             bantime.increment = ${boolToString cfg.bantime-increment.enable}

     

       343
       343
       +
             ${optionalString (cfg.bantime-increment.rndtime != null) "bantime.rndtime = ${cfg.bantime-increment.rndtime}"}

     

       344
       344
       +
             ${optionalString (cfg.bantime-increment.maxtime != null) "bantime.maxtime = ${cfg.bantime-increment.maxtime}"}

     

       345
       345
       +
             ${optionalString (cfg.bantime-increment.factor != null) "bantime.factor = ${cfg.bantime-increment.factor}"}

     

       346
       346
       +
             ${optionalString (cfg.bantime-increment.formula != null) "bantime.formula = ${cfg.bantime-increment.formula}"}

     

       347
       347
       +
             ${optionalString (cfg.bantime-increment.multipliers != null) "bantime.multipliers = ${cfg.bantime-increment.multipliers}"}

     

       348
       348
       +
             ${optionalString (cfg.bantime-increment.overalljails != null) "bantime.overalljails = ${boolToString cfg.bantime-increment.overalljails}"}

     

       342
       349
        
             # Miscellaneous options

     

       343
       350
        
             ignoreip    = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}

     

       344
       351
        
             ${optionalString (cfg.bantime != null) ''