github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Fixed misunderstanding of port in (ban)action: port will be always specified in jail config ([DEFAULT] or jail)

pull/1433/head
sebres 2016-05-19 17:45:41 +02:00
parent 1ebc3facb1
commit 0fdc56546f
2 changed files with 4 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config/action.d/pf.conf
View File

@ -72,10 +72,6 @@ tablename = f2b
protocol = tcp protocol = tcp
# Option: port
# Notes.: specifies port to monitor
# Values: [ NUM | STRING ] Default:
port = ssh
# Option: actiontype # Option: actiontype
# Notes.: defines additions to the blocking rule # Notes.: defines additions to the blocking rule
@ -90,5 +86,5 @@ allports = any
# Option: multiport # Option: multiport
# Notes.: addition to block access only to specific ports # Notes.: addition to block access only to specific ports
# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>, port="%(port)s"]" # Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
multiport = any port <port> multiport = any port <port>

6
fail2ban/tests/servertestcase.py
View File

@ -1372,12 +1372,12 @@ class ServerConfigReaderTests(LogCaptureTestCase):
r"`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`", r"`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`",
), ),
}), }),
# pf default - multiport on ssh -- # pf default -- multiport on default port (tag <port> set in jail.conf, but not in this test case)
('j-w-pf', 'pf[name=%(__name__)s]', { ('j-w-pf', 'pf[name=%(__name__)s]', {
'ip4': (), 'ip6': (), 'ip4': (), 'ip6': (),
'start': ( 'start': (
'`echo "table <f2b-j-w-pf> persist counters" | pfctl -f-`', '`echo "table <f2b-j-w-pf> persist counters" | pfctl -f-`',
'`echo "block proto tcp from <f2b-j-w-pf> to any port ssh" | pfctl -f-`', '`echo "block proto tcp from <f2b-j-w-pf> to any port <port>" | pfctl -f-`',
), ),
'stop': ( 'stop': (
'`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -f-`', '`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -f-`',
@ -1411,7 +1411,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
'ip6-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 2001:db8::`",), 'ip6-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 2001:db8::`",),
}), }),
# pf allports -- # pf allports --
('j-w-pf-ap', 'pf[name=%(__name__)s,actiontype=<allports>]', { ('j-w-pf-ap', 'pf[actiontype=<allports>][name=%(__name__)s]', {
'ip4': (), 'ip6': (), 'ip4': (), 'ip6': (),
'start': ( 'start': (
'`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -f-`', '`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -f-`',