From 0c5a9c53e1542784b7c1ab2d41463aa464f54104 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 16 Apr 2013 21:11:06 +1000
Subject: [PATCH 1/4] ENH: pf action thanks to Nick Hilliard <nick@foobar.org>.

---
 config/action.d/pf.conf | 62 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 config/action.d/pf.conf

diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf
new file mode 100644
index 00000000..d82cbb12
--- /dev/null
+++ b/config/action.d/pf.conf
@@ -0,0 +1,62 @@
+# Fail2Ban configuration file
+#
+# OpenBSD pf ban/unban
+#
+# Author: Nick Hilliard <nick@foobar.org>
+#
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+# we don't disable PF automatically either
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+# note -r option used to remove matching rule
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32
+
+[Init]
+# Option:  tablename
+# Notes.:  The pf table name.
+# Values:  [ STRING ]  Default: fail2ban
+#
+tablename = fail2ban
+

From 462dafa32f4766c0d6e8e9267adda776c9b11e9c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:38:30 +1000
Subject: [PATCH 2/4] DOC: credit for pf action. Origin:
 http://svnweb.freebsd.org/ports/head/security/py-fail2ban/files/patch-pf.conf?view=log

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c80e3b3c..00898141 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -71,6 +71,8 @@ Borreli, blotus:
    * [be06b1b] Add action for iptables-ipsets. Closes gh-102.
   Soulard Morgan
    * [f336d9f] Add filter for webmin. Closes gh-99.
+  Nick Hilliard
+   * [0c5a9c5] Add pf action.
 - Enhancements:
   Enrico Labedzki
    * [24a8d07] Added new date format for ASSP SMTP Proxy.

From aa52743f52014ae57bc705c77a33a8157df40338 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:42:10 +1000
Subject: [PATCH 3/4] DOC: add jail.conf entry for pf

---
 config/jail.conf | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 8b82d1d7..1549e6a4 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -380,3 +380,14 @@ action   = iptables-allports[name=recidive]
 bantime  = 604800  ; 1 week
 findtime = 86400   ; 1 day
 maxretry = 5
+
+# PF is a BSD based firewall
+[ssh-pf]
+
+enabled=false
+filter = sshd
+action = pf
+logpath  = /var/log/sshd.log
+maxretry=5
+
+

From f52142b5cbe95ac3122b516aa101021a168c8403 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 17:15:28 +1000
Subject: [PATCH 4/4] BF: missed MANIFEST include

---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..6dd54366 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -117,6 +117,7 @@ config/action.d/mail-buffered.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
 config/action.d/mynetwatchman.conf
+config/action.d/pf.conf
 config/action.d/sendmail.conf
 config/action.d/sendmail-buffered.conf
 config/action.d/sendmail-whois.conf