github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #1925 from sebres/0.10-fix-pf-multiport: 

action.d/pf.conf: fix multiport syntax
pull/1926/head
sebres 2017-10-17 16:09:50 +02:00
parent c6029bbef6 3c4910a3e2
commit 667f48817b
3 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -34,7 +34,14 @@ Incompatibility list (compared to v.0.9):
ver. 0.10.2-dev-1 (2017/??/??) - development edition ver. 0.10.2-dev-1 (2017/??/??) - development edition
----------- -----------
### Incompatibility list:
* The configuration for multiport jails using banaction `pf` can be incompatible after upgrade, if
ports are enclosed in curly braces `{ }` in the `jail.local` etc. This may cause a double-brackets now.
### Fixes ### Fixes
* action.d/pf.conf:
- fixed syntax error in achnor definition (documentation, see gh-1919);
- enclose ports in braces for multiport jails (see gh-1925);
### New Features ### New Features

2
config/action.d/pf.conf
View File

@ -110,5 +110,5 @@ allports = any
# Option: multiport # Option: multiport
# Notes.: addition to block access only to specific ports # Notes.: addition to block access only to specific ports
# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]" # Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
multiport = any port <port> multiport = any port {<port>}

8
fail2ban/tests/servertestcase.py
View File

@ -1503,7 +1503,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
'ip4': (), 'ip6': (), 'ip4': (), 'ip6': (),
'start': ( 'start': (
'`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`', '`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`',
'`echo "block quick proto tcp from <f2b-j-w-pf> to any port <port>" | pfctl -a f2b/j-w-pf -f-`', '`echo "block quick proto tcp from <f2b-j-w-pf> to any port {<port>}" | pfctl -a f2b/j-w-pf -f-`',
), ),
'stop': ( 'stop': (
'`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`', '`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`',
@ -1517,12 +1517,12 @@ class ServerConfigReaderTests(LogCaptureTestCase):
'ip6-ban': ("`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`",), 'ip6-ban': ("`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`",),
'ip6-unban': ("`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`",), 'ip6-unban': ("`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`",),
}), }),
# pf multiport with custom port -- # pf multiport with custom ports --
('j-w-pf-mp', 'pf[actiontype=<multiport>][name=%(__name__)s, port=http]', { ('j-w-pf-mp', 'pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"]', {
'ip4': (), 'ip6': (), 'ip4': (), 'ip6': (),
'start': ( 'start': (
'`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`', '`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`',
'`echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port http" | pfctl -a f2b/j-w-pf-mp -f-`', '`echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port {http,https}" | pfctl -a f2b/j-w-pf-mp -f-`',
), ),
'stop': ( 'stop': (
'`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`', '`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`',