search

rpthms / nft-geo-filter

Allow/deny traffic in nftables using country specific IP blocks
MIT License
98 stars 24 forks source link

Unexpected keyword argument 'capture_output' in subprocess.run() #2

Closed frankofno closed 4 years ago

frankofno commented 4 years ago

CentOS 8 distro:

NAME="CentOS Linux" VERSION="8 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="8" PLATFORM_ID="platform:el8" PRETTY_NAME="CentOS Linux 8 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:8" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-8" CENTOS_MANTISBT_PROJECT_VERSION="8" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="8"

[root@mail bin]# python3 --version Python 3.6.8

Do I have to open some ports first, so the script is working? port 80/443 are restricted to only a range of IPs at the moment.

[root@mail bin]# nft-geo-filter --table-family netdev --interface eth0 MC Traceback (most recent call last): File "/usr/local/bin/nft-geo-filter", line 406, in if gFilter.add_table() == -1: File "/usr/local/bin/nft-geo-filter", line 81, in add_table subprocess.run(nft_command.split(), capture_output=True, check=True) File "/usr/lib64/python3.6/subprocess.py", line 423, in run with Popen(*popenargs, **kwargs) as process: TypeError: init() got an unexpected keyword argument 'capture_output'

rpthms commented 4 years ago

The problem is that the capture_output argument of subprocess.run() was introduced in Python 3.7. That should be trivial to fix. I'll do that as soon as I'm free.

The script will download IP blocks from ipdeny.com so as long as you haven't blocked outgoing traffic from your server, you should be okay.

rpthms commented 4 years ago

@frankofno I've just pushed an update to the script and replaced capture_output with explicit stdout and stderr arguments. Could you try downloading the script (https://raw.githubusercontent.com/rpthms/nft-geo-filter/master/nft-geo-filter) and running it again?

frankofno commented 4 years ago

YES! you did it. 👍

Note: script is not working in the /root folder moved it to the /usr/local/bin and got an error message first. Looks like the --interface option is a must.

All good now, great work, exactly what i was lookin for :)