From 1ebc3facb1f30c2269f45284aa9072a84be078ba Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Thu, 19 May 2016 10:34:28 -0400 Subject: [PATCH 1/2] BF: maintain previous default beh for pf -- ban a port (ssh) only --- config/action.d/pf.conf | 9 ++++----- fail2ban/tests/servertestcase.py | 27 +++++++++++++++++++++++---- 2 files changed, 27 insertions(+), 9 deletions(-) diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf index ea70d894..40f4620a 100644 --- a/config/action.d/pf.conf +++ b/config/action.d/pf.conf @@ -75,14 +75,13 @@ protocol = tcp # Option: port # Notes.: specifies port to monitor # Values: [ NUM | STRING ] Default: -# -#port = telnet +port = ssh # Option: actiontype # Notes.: defines additions to the blocking rule # Values: leave empty to block all attempts from the host -# Default: Value of the allports -actiontype = any +# Default: Value of the multiport +actiontype = # Option: allports # Notes.: default addition to block all ports @@ -91,5 +90,5 @@ allports = any # Option: multiport # Notes.: addition to block access only to specific ports -# Usage.: use in jail config: "banaction = pf[actiontype=]" +# Usage.: use in jail config: "banaction = pf[actiontype=, port="%(port)s"]" multiport = any port diff --git a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py index ac9927bb..5fbf8cd6 100644 --- a/fail2ban/tests/servertestcase.py +++ b/fail2ban/tests/servertestcase.py @@ -1370,14 +1370,14 @@ class ServerConfigReaderTests(LogCaptureTestCase): ), 'ip6-unban': ( r"`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`", - ), + ), }), - # pf allports -- + # pf default - multiport on ssh -- ('j-w-pf', 'pf[name=%(__name__)s]', { 'ip4': (), 'ip6': (), 'start': ( '`echo "table persist counters" | pfctl -f-`', - '`echo "block proto tcp from to any" | pfctl -f-`', + '`echo "block proto tcp from to any port ssh" | pfctl -f-`', ), 'stop': ( '`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -f-`', @@ -1391,7 +1391,7 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'ip6-ban': ("`pfctl -t f2b-j-w-pf -T add 2001:db8::`",), 'ip6-unban': ("`pfctl -t f2b-j-w-pf -T delete 2001:db8::`",), }), - # pf multiport -- + # pf multiport with custom port -- ('j-w-pf-mp', 'pf[actiontype=][name=%(__name__)s, port=http]', { 'ip4': (), 'ip6': (), 'start': ( @@ -1410,6 +1410,25 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'ip6-ban': ("`pfctl -t f2b-j-w-pf-mp -T add 2001:db8::`",), 'ip6-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 2001:db8::`",), }), + # pf allports -- + ('j-w-pf-ap', 'pf[name=%(__name__)s,actiontype=]', { + 'ip4': (), 'ip6': (), + 'start': ( + '`echo "table persist counters" | pfctl -f-`', + '`echo "block proto tcp from to any" | pfctl -f-`', + ), + 'stop': ( + '`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -f-`', + '`pfctl -t f2b-j-w-pf-ap -T flush`', + '`pfctl -t f2b-j-w-pf-ap -T kill`', + ), + 'ip4-check': ("`pfctl -sr | grep -q f2b-j-w-pf-ap`",), + 'ip6-check': ("`pfctl -sr | grep -q f2b-j-w-pf-ap`",), + 'ip4-ban': ("`pfctl -t f2b-j-w-pf-ap -T add 192.0.2.1`",), + 'ip4-unban': ("`pfctl -t f2b-j-w-pf-ap -T delete 192.0.2.1`",), + 'ip6-ban': ("`pfctl -t f2b-j-w-pf-ap -T add 2001:db8::`",), + 'ip6-unban': ("`pfctl -t f2b-j-w-pf-ap -T delete 2001:db8::`",), + }), # firewallcmd-multiport -- ('j-w-fwcmd-mp', 'firewallcmd-multiport[name=%(__name__)s, bantime="600", port="http,https", protocol="tcp", chain="INPUT"]', { 'ip4': (' ipv4 ', 'icmp-port-unreachable'), 'ip6': (' ipv6 ', 'icmp6-port-unreachable'), From 0fdc56546f8391760a5c7af0ef32749b76f8d091 Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 19 May 2016 17:45:41 +0200 Subject: [PATCH 2/2] Fixed misunderstanding of port in (ban)action: port will be always specified in jail config ([DEFAULT] or jail) --- config/action.d/pf.conf | 6 +----- fail2ban/tests/servertestcase.py | 6 +++--- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf index 40f4620a..b7476fa2 100644 --- a/config/action.d/pf.conf +++ b/config/action.d/pf.conf @@ -72,10 +72,6 @@ tablename = f2b protocol = tcp -# Option: port -# Notes.: specifies port to monitor -# Values: [ NUM | STRING ] Default: -port = ssh # Option: actiontype # Notes.: defines additions to the blocking rule @@ -90,5 +86,5 @@ allports = any # Option: multiport # Notes.: addition to block access only to specific ports -# Usage.: use in jail config: "banaction = pf[actiontype=, port="%(port)s"]" +# Usage.: use in jail config: "banaction = pf[actiontype=]" multiport = any port diff --git a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py index 5fbf8cd6..fabf77b9 100644 --- a/fail2ban/tests/servertestcase.py +++ b/fail2ban/tests/servertestcase.py @@ -1372,12 +1372,12 @@ class ServerConfigReaderTests(LogCaptureTestCase): r"`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`", ), }), - # pf default - multiport on ssh -- + # pf default -- multiport on default port (tag set in jail.conf, but not in this test case) ('j-w-pf', 'pf[name=%(__name__)s]', { 'ip4': (), 'ip6': (), 'start': ( '`echo "table persist counters" | pfctl -f-`', - '`echo "block proto tcp from to any port ssh" | pfctl -f-`', + '`echo "block proto tcp from to any port " | pfctl -f-`', ), 'stop': ( '`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -f-`', @@ -1411,7 +1411,7 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'ip6-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 2001:db8::`",), }), # pf allports -- - ('j-w-pf-ap', 'pf[name=%(__name__)s,actiontype=]', { + ('j-w-pf-ap', 'pf[actiontype=][name=%(__name__)s]', { 'ip4': (), 'ip6': (), 'start': ( '`echo "table persist counters" | pfctl -f-`',