From 3e1328c83b2d6fe9b444df1b13a74738a3c78123 Mon Sep 17 00:00:00 2001
From: Alexander Koeppe <format_c@online.de>
Date: Sun, 15 May 2016 22:30:07 +0200
Subject: [PATCH 1/4] split PF config files between all- and multi port

---
 config/action.d/pf-allports.conf              | 73 +++++++++++++++++++
 .../action.d/{pf.conf => pf-multiport.conf}   |  6 --
 2 files changed, 73 insertions(+), 6 deletions(-)
 create mode 100644 config/action.d/pf-allports.conf
 rename config/action.d/{pf.conf => pf-multiport.conf} (95%)

diff --git a/config/action.d/pf-allports.conf b/config/action.d/pf-allports.conf
new file mode 100644
index 00000000..e77bea43
--- /dev/null
+++ b/config/action.d/pf-allports.conf
@@ -0,0 +1,73 @@
+# Fail2Ban configuration file
+#
+# OpenBSD pf ban/unban
+#
+# Author: Nick Hilliard <nick@foobar.org>
+# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
+#
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+# we don't enable PF automatically; to enable run pfctl -e 
+# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
+actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
+              echo "block proto <protocol> from <<tablename>-<name>> to any" | pfctl -f-
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+# we only disable PF rules we've installed prior
+actionstop = pfctl -sr 2>/dev/null | grep -v <tablename>-<name> | pfctl -f-
+             pfctl -t <tablename>-<name> -T flush
+             pfctl -t <tablename>-<name> -T kill
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = pfctl -sr | grep -q <tablename>-<name>
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = pfctl -t <tablename>-<name> -T add <ip>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+# note -r option used to remove matching rule
+actionunban = pfctl -t <tablename>-<name> -T delete <ip>
+
+[Init]
+# Option:  tablename
+# Notes.:  The pf table name.
+# Values:  [ STRING ]
+#
+tablename = f2b
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
+#
+protocol = tcp
+
diff --git a/config/action.d/pf.conf b/config/action.d/pf-multiport.conf
similarity index 95%
rename from config/action.d/pf.conf
rename to config/action.d/pf-multiport.conf
index effd080c..6814a9f3 100644
--- a/config/action.d/pf.conf
+++ b/config/action.d/pf-multiport.conf
@@ -71,9 +71,3 @@ tablename = f2b
 #
 protocol = tcp
 
-# Option:  port
-# Notes.:  the port to block, defaults to any
-# Values:  [ STRING ]
-#
-port = any
-

From e74047ae49807a59d06ccfcc48350c2cab35c59a Mon Sep 17 00:00:00 2001
From: Alexander Koeppe <format_c@online.de>
Date: Tue, 17 May 2016 16:27:48 +0200
Subject: [PATCH 2/4] revert to common config for PF covering multi and
 allports

---
 config/action.d/pf-multiport.conf             | 73 -------------------
 config/action.d/{pf-allports.conf => pf.conf} | 11 ++-
 2 files changed, 10 insertions(+), 74 deletions(-)
 delete mode 100644 config/action.d/pf-multiport.conf
 rename config/action.d/{pf-allports.conf => pf.conf} (91%)

diff --git a/config/action.d/pf-multiport.conf b/config/action.d/pf-multiport.conf
deleted file mode 100644
index 6814a9f3..00000000
--- a/config/action.d/pf-multiport.conf
+++ /dev/null
@@ -1,73 +0,0 @@
-# Fail2Ban configuration file
-#
-# OpenBSD pf ban/unban
-#
-# Author: Nick Hilliard <nick@foobar.org>
-# Modified by: Alexander Koeppe making PF work seamless and with IPv4 and IPv6
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-# we don't enable PF automatically; to enable run pfctl -e 
-# or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
-actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
-              echo "block proto <protocol> from <<tablename>-<name>> to any port <port>" | pfctl -f-
-
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-# we only disable PF rules we've installed prior
-actionstop = pfctl -sr 2>/dev/null | grep -v <tablename>-<name> | pfctl -f-
-             pfctl -t <tablename>-<name> -T flush
-             pfctl -t <tablename>-<name> -T kill
-
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck = pfctl -sr | grep -q <tablename>-<name>
-
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-actionban = pfctl -t <tablename>-<name> -T add <ip>
-
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
-# Values:  CMD
-#
-# note -r option used to remove matching rule
-actionunban = pfctl -t <tablename>-<name> -T delete <ip>
-
-[Init]
-# Option:  tablename
-# Notes.:  The pf table name.
-# Values:  [ STRING ]
-#
-tablename = f2b
-
-# Option:  protocol
-# Notes.:  internally used by config reader for interpolations.
-# Values:  [ tcp | udp | icmp | ipv6-icmp ] Default: tcp
-#
-protocol = tcp
-
diff --git a/config/action.d/pf-allports.conf b/config/action.d/pf.conf
similarity index 91%
rename from config/action.d/pf-allports.conf
rename to config/action.d/pf.conf
index e77bea43..10b0f328 100644
--- a/config/action.d/pf-allports.conf
+++ b/config/action.d/pf.conf
@@ -16,7 +16,7 @@
 # we don't enable PF automatically; to enable run pfctl -e 
 # or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
 actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
-              echo "block proto <protocol> from <<tablename>-<name>> to any" | pfctl -f-
+              echo "block proto <protocol> from <<tablename>-<name>> to any <actionoptions>" | pfctl -f-
 
 
 # Option:  actionstop
@@ -71,3 +71,12 @@ tablename = f2b
 #
 protocol = tcp
 
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = telnet
+
+actionoptions = 
+multiport = port <port>

From 1e7fd26f5f42fb9eba0fce8bfc54e8e128bae3e7 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Tue, 17 May 2016 20:51:12 +0200
Subject: [PATCH 3/4] rename `actionoptions` to `actiontype` in pf-action
 (multiport) + fixed test cases

---
 config/action.d/pf.conf          |  6 +++---
 fail2ban/tests/servertestcase.py | 23 +++++++++++++++++++++--
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf
index 10b0f328..1312538e 100644
--- a/config/action.d/pf.conf
+++ b/config/action.d/pf.conf
@@ -16,7 +16,7 @@
 # we don't enable PF automatically; to enable run pfctl -e 
 # or add `pf_enable="YES"` to /etc/rc.conf (tested on FreeBSD)
 actionstart = echo "table <<tablename>-<name>> persist counters" | pfctl -f- 
-              echo "block proto <protocol> from <<tablename>-<name>> to any <actionoptions>" | pfctl -f-
+              echo "block proto <protocol> from <<tablename>-<name>> to any<actiontype>" | pfctl -f-
 
 
 # Option:  actionstop
@@ -78,5 +78,5 @@ protocol = tcp
 #
 port = telnet
 
-actionoptions = 
-multiport = port <port>
+actiontype = 
+multiport = <sp>port <port>
diff --git a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py
index 1809933c..ac9927bb 100644
--- a/fail2ban/tests/servertestcase.py
+++ b/fail2ban/tests/servertestcase.py
@@ -1372,12 +1372,12 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 						r"`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`",
 					),					
 				}),
-				# pf --
+				# pf allports --
 				('j-w-pf', 'pf[name=%(__name__)s]', {
 					'ip4': (), 'ip6': (),
 					'start': (
 						'`echo "table <f2b-j-w-pf> persist counters" | pfctl -f-`',
-						'`echo "block proto tcp from <f2b-j-w-pf> to any port any" | pfctl -f-`',
+						'`echo "block proto tcp from <f2b-j-w-pf> to any" | pfctl -f-`',
 					),
 					'stop': (
 						'`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -f-`',
@@ -1391,6 +1391,25 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 					'ip6-ban':   ("`pfctl -t f2b-j-w-pf -T add 2001:db8::`",),
 					'ip6-unban': ("`pfctl -t f2b-j-w-pf -T delete 2001:db8::`",),
 				}),
+				# pf multiport --
+				('j-w-pf-mp', 'pf[actiontype=<multiport>][name=%(__name__)s, port=http]', {
+					'ip4': (), 'ip6': (),
+					'start': (
+						'`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -f-`',
+						'`echo "block proto tcp from <f2b-j-w-pf-mp> to any port http" | pfctl -f-`',
+					),
+					'stop': (
+						'`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -f-`',
+						'`pfctl -t f2b-j-w-pf-mp -T flush`',
+						'`pfctl -t f2b-j-w-pf-mp -T kill`',
+					),
+					'ip4-check': ("`pfctl -sr | grep -q f2b-j-w-pf-mp`",),
+					'ip6-check': ("`pfctl -sr | grep -q f2b-j-w-pf-mp`",),
+					'ip4-ban':   ("`pfctl -t f2b-j-w-pf-mp -T add 192.0.2.1`",),
+					'ip4-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 192.0.2.1`",),
+					'ip6-ban':   ("`pfctl -t f2b-j-w-pf-mp -T add 2001:db8::`",),
+					'ip6-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 2001:db8::`",),
+				}),
 				# firewallcmd-multiport --
 				('j-w-fwcmd-mp', 'firewallcmd-multiport[name=%(__name__)s, bantime="600", port="http,https", protocol="tcp", chain="INPUT"]', {
 					'ip4': (' ipv4 ', 'icmp-port-unreachable'), 'ip6': (' ipv6 ', 'icmp6-port-unreachable'),

From b5e031f3c3d35d75ea2821ef6a57b191c7796964 Mon Sep 17 00:00:00 2001
From: Alexander Koeppe <format_c@online.de>
Date: Tue, 17 May 2016 21:19:34 +0200
Subject: [PATCH 4/4] some documentation for multiport use in pf.conf

---
 config/action.d/pf.conf | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf
index 1312538e..5710eb8e 100644
--- a/config/action.d/pf.conf
+++ b/config/action.d/pf.conf
@@ -78,5 +78,12 @@ protocol = tcp
 #
 port = telnet
 
+# Option: actiontype
+# Notes.: defines additions to the blocking rule
+# Values: leave empty to block all attempts from the host
 actiontype = 
+
+# Option: multiport
+# Notes.: addition to block access only to specific ports
+# Usage.: use in jail config: "banaction = pf[actiontype=<multiport>]"
 multiport = <sp>port <port>