From 4ffc57e14f1254942c88c9d9f94e9ef791af5e5f Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 14 Dec 2013 07:11:29 +0000
Subject: [PATCH] ENH: simplify firewallcmd-new actioncheck and provide output
 samples

---
 config/action.d/firewallcmd-new.conf | 30 +++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/config/action.d/firewallcmd-new.conf b/config/action.d/firewallcmd-new.conf
index d3443e4e..7a5c03de 100644
--- a/config/action.d/firewallcmd-new.conf
+++ b/config/action.d/firewallcmd-new.conf
@@ -1,9 +1,5 @@
 # Fail2Ban configuration file
 #
-# Author: Edgar Hoch
-# Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch.
-#  It uses "firewall-cmd" instead of "iptables".
-#
 # Because of the --remove-rules in stop this action requires firewalld-0.3.8+
 
 [INCLUDES]
@@ -20,7 +16,7 @@ actionstop = firewall-cmd --direct --remove-rule ipv4 filter <chain> 0 -m state
              firewall-cmd --direct --remove-rules ipv4 filter fail2ban-<name>
              firewall-cmd --direct --remove-chain ipv4 filter fail2ban-<name>
 
-actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -Eq 'fail2ban-<name>$|fail2ban-<name> '
+actioncheck = firewall-cmd --direct --get-chains ipv4 filter | grep -Eq 'fail2ban-<name>( |$)'
 
 actionban = firewall-cmd --direct --add-rule ipv4 filter fail2ban-<name> 0 -s <ip> -j <blocktype>
 
@@ -50,3 +46,27 @@ protocol = tcp
 # Values:  [ STRING ]
 #
 chain = INPUT_direct
+
+# DEV NOTES:
+#
+# Author: Edgar Hoch
+# Copied from iptables-new.conf and modified for use with firewalld by Edgar Hoch.
+#  It uses "firewall-cmd" instead of "iptables".
+#
+# Output:
+# 
+# $ firewall-cmd --direct --add-chain ipv4 filter fail2ban-name
+# success
+# $ firewall-cmd --direct --add-rule ipv4 filter fail2ban-name 1000 -j RETURN
+# success
+# $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m state --state NEW -p tcp --dport 22 -j fail2ban-name
+# success
+# $ firewall-cmd --direct --get-chains ipv4 filter
+# fail2ban-name
+# $ firewall-cmd --direct --get-chains ipv4 filter  | od -h
+# 0000000 6166 6c69 6232 6e61 6e2d 6d61 0a65
+# $ firewall-cmd --direct --get-chains ipv4 filter | grep -Eq 'fail2ban-name( |$)' ; echo $?
+# 0
+# $ firewall-cmd -V
+# 0.3.8
+