add counters to drop sets

diff --git a/common.sh b/common.sh
index 1e40677e555815434c10762f930e8b94af3d7a95..312ecdb0c75e10ce793857cd92c41484615f1264 100644 (file)
--- a/common.sh
+++ b/common.sh
@@ -80,12 +80,13 @@ function insert_setmatch_rules(){
 
 function reload_cidr_sets(){
        local set_name="$1"
+       shift
 
        # init new temporary sets
        echo "updating set '${set_name}'"
 
-       create_set "${set_name}-tmp" hash:net
-       create_set "${set_name}6-tmp" hash:net family inet6
+       create_set "${set_name}-tmp" hash:net "$@"
+       create_set "${set_name}6-tmp" hash:net "$@" family inet6
 
        # populate them
        for sfx in '' .$(hostname -s)
@@ -126,7 +127,7 @@ function add_service_entry(){
 }
 
 function allow_services(){
-       local s proto port
+       local s
        for s in "$@"
        do
                case "${s}" in

diff --git a/sinokorea.sh b/sinokorea.sh
index b8edefd02aeeadcf8b5fd3e6151e9cd3a6ae86f4..9c63f6614affb00bf2603f88e46851ade81b7e13 100755 (executable)
--- a/sinokorea.sh
+++ b/sinokorea.sh
@@ -31,8 +31,8 @@ then
        $IPTABLES -L "${chain}"
 fi
 
-create_set sinokorea hash:net
-create_set sinokorea6 hash:net family inet6
+create_set sinokorea hash:net counters
+create_set sinokorea6 hash:net counters family inet6
 
 CURL_OPTS=''
 if [ -e "${cidr_file}" ]
@@ -42,5 +42,5 @@ fi
 (set -o pipefail; curl -sfL ${CURL_OPTS} "${badcidrs_url}" | decommentcat | awk '{print $1}' > "${cidr_file}") || die 1 "failed to fetch list"
 
 insert_setmatch_rules sinokorea -m multiport -p tcp --dports ssh,smtp -j xenophobe
-reload_cidr_sets sinokorea
+reload_cidr_sets sinokorea counters
 

diff --git a/xenophobe.sh b/xenophobe.sh
index d3edecb8fe3bddf1a4724b987094f48d4e332183..b4470cacf396d3286b10f2ba7d6e49b8f61be905 100755 (executable)
--- a/xenophobe.sh
+++ b/xenophobe.sh
@@ -16,8 +16,8 @@ then
         exit 0
 fi
 
-create_set "${set_name}" hash:net
-create_set "${set_name}6" hash:net family inet6
+create_set "${set_name}" hash:net counters
+create_set "${set_name}6" hash:net counters family inet6
 
 # create or re-init chains
 if ! $IPTABLES -L "${chain}" >/dev/null 2>&1
@@ -40,5 +40,5 @@ fi
 
 insert_setmatch_rules "${set_name}" -j "${chain}"
 
-reload_cidr_sets "${set_name}"
+reload_cidr_sets "${set_name}" counters