github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

action.d/pf.conf: compatibility fix - recognizes that parameter `port` specified as empty, with or without braces (should be more backwards compatible to 0.9 now).

pull/2027/head
sebres 2018-01-18 14:05:22 +01:00
parent ed22ddbbbb
commit f69e28adfc
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
config/action.d/pf.conf
View File

@ -27,6 +27,7 @@
# to your main pf ruleset, where "namei" are the names of the jails # to your main pf ruleset, where "namei" are the names of the jails
# which invoke this action # which invoke this action
actionstart = echo "table <<tablename>-<name>> persist counters" | <pfctl> -f- actionstart = echo "table <<tablename>-<name>> persist counters" | <pfctl> -f-
port="<port>"; if [ "$port" != "" ] && case "$port" in \{*) false;; esac; then port="{$port}"; fi
echo "<block> proto <protocol> from <<tablename>-<name>> to <actiontype>" | <pfctl> -f- echo "<block> proto <protocol> from <<tablename>-<name>> to <actiontype>" | <pfctl> -f-
# Option: start_on_demand - to start action on demand # Option: start_on_demand - to start action on demand
@ -119,5 +120,5 @@ allports = any
# Option: multiport # Option: multiport
# Notes.: addition to block access only to specific ports # Notes.: addition to block access only to specific ports
# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]" # Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
multiport = any port {<port>} multiport = any port $port

6
fail2ban/tests/servertestcase.py
View File

@ -1503,7 +1503,8 @@ class ServerConfigReaderTests(LogCaptureTestCase):
'ip4': (), 'ip6': (), 'ip4': (), 'ip6': (),
'start': ( 'start': (
'`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`', '`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`',
'`echo "block quick proto tcp from <f2b-j-w-pf> to any port {<port>}" | pfctl -a f2b/j-w-pf -f-`', 'port="<port>"',
'`echo "block quick proto tcp from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`',
), ),
'flush': ( 'flush': (
'`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`', '`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`',
@ -1525,7 +1526,8 @@ class ServerConfigReaderTests(LogCaptureTestCase):
'ip4': (), 'ip6': (), 'ip4': (), 'ip6': (),
'start': ( 'start': (
'`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`', '`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`',
'`echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port {http,https}" | pfctl -a f2b/j-w-pf-mp -f-`', 'port="http,https"',
'`echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`',
), ),
'flush': ( 'flush': (
'`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`', '`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`',