The change is to support the 'fail2ban' feature. Instead of
blocking IPs by server itself, server just add malicious IPs
to specified sets of nftables. So admin can configure rules
to deal with those IPs.
Notes: cap_net_admin capability is required.
Example configuration:
# nft add table ip fail2ban
# nft add chain ip fail2ban input { type filter hook input priority 0 \; }
# nft add set ip fail2ban badips { type ipv4_addr \; flags dynamic, timeout \; timeout 1h \; }
# nft add rule ip fail2ban input ip saddr @badips drop
# ss-server -c config.json --nftables-sets badips
There is a race condition between shadowsocks-libev.service and
systemd-resolved.service after reboot/on boot. The shadowsocks
service tries to start before the dns service is started properly
and fails showing the corresponding errors in the logs.
Use pkg-config to retrieve the dependencies of netfilter_conntrack
and avoid the following build failure when building statically:
configure:13096: /data/buildroot-test/instance-1/output-1/host/bin/x86_64-linux-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -static -I/data/buildroot-test/instance-1/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/include -DPCRE_STATIC -pthread -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -static -L/data/buildroot-test/instance-1/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/lib conftest.c -lnetfilter_conntrack -lnfnetlink -lev -lcares -lsodium -lmbedcrypto -lpcre >&5
/data/buildroot-test/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/x86_64-buildroot-linux-uclibc/8.3.0/../../../../x86_64-buildroot-linux-uclibc/bin/ld: /data/buildroot-test/instance-1/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/lib/libnetfilter_conntrack.a(api.o): in function `nfct_fill_hdr.constprop.4':
api.c:(.text+0x3f): undefined reference to `mnl_nlmsg_put_header'
Fixes:
- http://autobuild.buildroot.org/results/6cad497a7ab941a0ee3fd7007defc81e30cdcbe0
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
- This is very useful in advanced scenarios such as ss-redir or chaining of servers using TPROXY
to avoid bufferbloat-like performance degradation due to default large buffers of OS.
Gilles Depeyrot
Aven
Max Lv
lixingcong
abner_bob
dependabot[bot]
Maxim Shpak
Fabrice Fontaine
t0nyt4ng
Jared Pyzynski
Roger Shimizu
Not Sure
Max Lv
SamHurwitz
Morlay
John
Max Lv
babarosaM33
zfl9
DDoSolitary
Bill Zhong
ipcjs-rog-ubuntu