Two new firewalld actions #1367

TorontoMedia · 2016-03-17T04:52:53Z

Added two new firewalld actions for a cleaner iptables layout and also fixed firewallcmd allports and multiport.

codecov-io · 2016-03-17T05:00:14Z

Current coverage is `89.84%`

Merging #1367 into master will not affect coverage as of d37d02d

@@            master   #1367   diff @@
======================================
  Files           68      68       
  Stmts         7191    7191       
  Branches       995     995       
  Methods          0       0       
======================================
  Hit           6461    6461       
  Partial        147     147       
  Missed         583     583

Review entire Coverage Diff as of d37d02d

Powered by Codecov. Updated on successful CI builds.

sebres · 2016-03-21T08:51:30Z

config/action.d/firewallcmd-allports.conf

 # Example actioncheck: firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-recidive$'

 actioncheck = firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-<name>$'

-actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j <blocktype>
+actionban = firewall-cmd --direct --add-rule ipv4 filter f2b-<name> 0 -s <ip> -j REJECT


and also fixed firewallcmd allports and multiport.

??? What was fixed here?

Block type can also be specified in Init block as default, and can be rewritten in jail or in includes (if expected):

[Init] blocktype = REJECT

BTW, I do not understand why following test does not fail by this action (

fail2ban/fail2ban/tests/clientreadertestcase.py

Line 652 in 5d0d96a

# Test for presence of blocktype (in relation to gh-232)

)

Sorry that was a mistake. I wasn't synced with eed1a0d and was testing dependencies and copied the wrong file since I have three versions of fail2ban in my environment(gcm, xmpp, i18n).

coveralls · 2016-03-21T12:11:12Z

Coverage decreased (-0.7%) to 90.877% when pulling dd5e643 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-21T12:14:09Z

Coverage decreased (-0.7%) to 90.877% when pulling dd5e643 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-21T12:32:20Z

Coverage decreased (-0.7%) to 90.905% when pulling 7ef4449 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-21T12:37:04Z

Coverage remained the same at 91.601% when pulling 7ef4449 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-21T13:08:10Z

Coverage remained the same at 91.601% when pulling 6b3912f on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-21T13:11:59Z

Coverage remained the same at 91.601% when pulling 6b3912f on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

yarikoptic · 2016-03-22T07:17:19Z

config/action.d/firewallcmd-allports.conf

@@ -29,10 +25,9 @@ actionunban = firewall-cmd --direct --remove-rule ipv4 filter f2b-<name> 0 -s <i

 [Init]

-# Default name of the chain
-#
 name = default


It is a default name for the fail2ban chain ;-)

I'll fix that. I don't know why I got the input chain mixed up with the f2b chains.

coveralls · 2016-03-22T13:48:26Z

Coverage remained the same at 91.601% when pulling 2861c8e on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-22T14:30:01Z

Coverage remained the same at 91.601% when pulling c82a91b on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-22T14:38:32Z

Coverage remained the same at 91.601% when pulling 307352e on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-22T14:42:09Z

Coverage remained the same at 91.601% when pulling 307352e on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

TorontoMedia · 2016-03-22T14:47:13Z

Sorry about all the commits my grammar is terrible today.

If someone could write something that executes the command for every port if a comma delimiter is used between ports that would be awesome. Since these new rich actions are limited to a single port or a range of ports.

sebres · 2016-03-22T16:52:17Z

If someone could write something that executes the command for every port if a comma delimiter is used between ports that would be awesome.

Something like this (should work in default shell):

ports="80,8080,88,8088" ; for p in $(echo $ports | tr "," " "); do echo execute command for port "$p"; done

or this (bash -c '...'):

ports="80,8080,88,8088" ; for p in ${ports//,/ }; do echo execute command for port "$p"; done

TorontoMedia · 2016-03-22T19:40:41Z

I'm sorry but could you please give me an example that works in the config file since I can't for the life of me get it working in the config. I can only echo the commands in terminal but nothing is executed... My bash knowledge is poor.

sebres · 2016-03-23T08:14:38Z

Python seems to have a bug in ConfigParser with spaces in front of semicolon (I think it's a bug, because imho the comments should begin with new line...)

>>> s = '[def]\ntest1=1; 2\ntest2=3 ;-) 4\n'; print(s); p = ConfigParser.ConfigParser(); p.readfp(StringIO.StringIO(s)); p.items('def')
[def]
test1=1; 2
test2=3 ;-) 4

[('test1', '1; 2'), ('test2', '3')]

No way to escape, we can prospective extend our config reader to replace something like <SEMCOL> with ;. But atm it can be used still without leading space...

So either remove leading space for each ; or make a new sh-file (as executable) and put it in config... Below is an example for functioning config entry:

>>> s = '[def]\nactionban = ports="<port>"; for p in $(echo $ports | tr "," " "); do ban <HOST> --port "$p"; done\n'; print(s); p = ConfigParser.ConfigParser(); p.readfp(StringIO.StringIO(s)); p.items('def')

[def]
actionban = ports="<port>"; for p in $(echo $ports | tr "," " "); do ban <HOST> --port "$p"; done

[('actionban', 'ports="<port>"; for p in $(echo $ports | tr "," " "); do ban <HOST> --port "$p"; done')]

TorontoMedia · 2016-03-24T20:06:48Z

I was able to get it working and it's awesome. Thank you. This is now ready to be committed if you guys want to.

coveralls · 2016-03-24T20:08:41Z

Coverage remained the same at 91.601% when pulling 4689da5 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-24T20:12:26Z

Coverage remained the same at 91.601% when pulling 4f8aa45 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

coveralls · 2016-03-24T20:17:10Z

Coverage remained the same at 91.601% when pulling ed20d28 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

TorontoMedia · 2016-03-24T20:17:27Z

Sorry I'm done editing them now.

coveralls · 2016-03-24T21:24:42Z

Coverage remained the same at 91.601% when pulling 8e24915 on TorontoMedia:rich-actions into bfac42e on fail2ban:master.

sebres · 2016-03-25T14:01:22Z

👍

TorontoMedia · 2016-03-25T14:30:59Z

I have a question regarding "state" should we not be banning established connections too. Since blocking new connections works for a stateless connection but what about an established connection that has passed the queue and authentication and is now generating fail logs?

Also I just noticed firewallcmd-new has changed to multiports so besides the action check it is identical to my firewallcmd-multiport.

sebres · 2016-03-25T16:32:22Z

Too many irrelevant commits, so I've rebased it onto current master (as single commit)...
(at the same time put away indifferent changes like styles, comments, white spaces etc.)

Use git commit -amend next time if you have amend changes...

@sebres

ver. 0.9.5 (2016/07/15) - old-not-obsolete ----------- 0.9.x line is no longer heavily developed. If you are interested in new features (e.g. IPv6 support), please consider 0.10 branch and its releases. * `filter.d/monit.conf` - Extended failregex with new monit "access denied" version (fail2bangh-1355) - failregex of previous monit version merged as single expression * `filter.d/postfix.conf`, `filter.d/postfix-sasl.conf` - Extended failregex daemon part, matching also `postfix/smtps/smtpd` now (fail2bangh-1391) * Fixed a grave bug within tags substitutions because of incorrect detection of recursion in case of multiple inline substitutions of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks the actual list of the already substituted tags (per tag instead of single list) * `filter.d/common.conf` - Unexpected extra regex-space in generic `__prefix_line` (fail2bangh-1405) - All optional spaces normalized in `common.conf`, test covered now - Generic `__prefix_line` extended with optional brackets for the date ambit (fail2bangh-1421), added new parameter `__date_ambit` * `gentoo-initd` fixed `--pidfile` bug: `--pidfile` is option of `start-stop-daemon`, not argument of fail2ban (see fail2bangh-1434) * `filter.d/asterisk.conf` - Fixed security log support for PJSIP and Asterisk 13+ (fail2bangh-1456) - Improved log support for PJSIP and Asterisk 13+ with different callID (fail2bangh-1458) * New Actions: - `action.d/firewallcmd-rich-rules` and `action.d/firewallcmd-rich-logging` (fail2bangh-1367) * New filters: - slapd - ban hosts, that were failed to connect with invalid credentials: error code 49 (fail2bangh-1478) * Extreme speedup of all sqlite database operations (fail2bangh-1436), by using of following sqlite options: - (synchronous = OFF) write data through OS without syncing - (journal_mode = MEMORY) use memory for the transaction logging - (temp_store = MEMORY) temporary tables and indices are kept in memory * journald journalmatch for pure-ftpd (fail2bangh-1362) * Added additional regex filter for dovecot ldap authentication failures (fail2bangh-1370) * `filter.d/exim*conf` - Added additional regexes (fail2bangh-1371) - Made port entry optional * tag '0.9.5': (70 commits) DOC: preparations for 0.9.5 release Added missing files to MANIFEST another variant of regex add trailing anchor to failregex DOC: Reformatted ChangeLog into legit Markdown (Closes fail2ban#962) DOC: tuned up ChangeLog entries for 0.9.5 add PR id to ChangeLog improved failregex according to @sebres recomendations Improved changes of fail2bangh-1458: `[^']*` after callid was wrong, changed to `[^\)]*`; regexp anchored at the end; almost the same regex grouped to one; Improve PJSIP log support for asterisk 13+ with different callID (Squash fail2bangh-1458) Change the asterisk pjsip filter to don't take the callId part Add optional part between "Request" and "from" Listed all log message from asterisk * add `__prefix_line` to regex * fix time in log file add info to log file added sample log lines for slapd adding openldap slapd filter badip timeout option introduced, set to 30 seconds in our test cases (fail2ban#1463) DOC: changelog for recent exim filters tune up Asterisk pjsip (fail2ban#1456) BF: finalize that sample log line for exim4 amend for new option of `usedns=raw` - forgotten validation fix inside setUseDns RF: for consistency use (?:XXX)? instead of (?:|XXX) ...

ver. 0.9.5 (2016/07/15) - old-not-obsolete ----------- 0.9.x line is no longer heavily developed. If you are interested in new features (e.g. IPv6 support), please consider 0.10 branch and its releases. * `filter.d/monit.conf` - Extended failregex with new monit "access denied" version (gh-1355) - failregex of previous monit version merged as single expression * `filter.d/postfix.conf`, `filter.d/postfix-sasl.conf` - Extended failregex daemon part, matching also `postfix/smtps/smtpd` now (gh-1391) * Fixed a grave bug within tags substitutions because of incorrect detection of recursion in case of multiple inline substitutions of the same tag (affected actions: `bsd-ipfw`, etc). Now tracks the actual list of the already substituted tags (per tag instead of single list) * `filter.d/common.conf` - Unexpected extra regex-space in generic `__prefix_line` (gh-1405) - All optional spaces normalized in `common.conf`, test covered now - Generic `__prefix_line` extended with optional brackets for the date ambit (gh-1421), added new parameter `__date_ambit` * `gentoo-initd` fixed `--pidfile` bug: `--pidfile` is option of `start-stop-daemon`, not argument of fail2ban (see gh-1434) * `filter.d/asterisk.conf` - Fixed security log support for PJSIP and Asterisk 13+ (gh-1456) - Improved log support for PJSIP and Asterisk 13+ with different callID (gh-1458) * New Actions: - `action.d/firewallcmd-rich-rules` and `action.d/firewallcmd-rich-logging` (gh-1367) * New filters: - slapd - ban hosts, that were failed to connect with invalid credentials: error code 49 (gh-1478) * Extreme speedup of all sqlite database operations (gh-1436), by using of following sqlite options: - (synchronous = OFF) write data through OS without syncing - (journal_mode = MEMORY) use memory for the transaction logging - (temp_store = MEMORY) temporary tables and indices are kept in memory * journald journalmatch for pure-ftpd (gh-1362) * Added additional regex filter for dovecot ldap authentication failures (gh-1370) * `filter.d/exim*conf` - Added additional regexes (gh-1371) - Made port entry optional * tag '0.9.5': Added missing files to MANIFEST BF: do not rely on long relative path to upstairs config - symlink common.conf

TorontoMedia added 7 commits March 17, 2016 00:33

Update firewallcmd-allports.conf

4e8974c

Update firewallcmd-multiport.conf

c9efc1a

Create firewallcmd-rich-logging.conf

1fd29f6

Create firewallcmd-rich-rules.conf

f6e3482

Update firewallcmd-rich-logging.conf

d8e5626

Update ChangeLog

100821e

Update ChangeLog

30cb656

TorontoMedia added 3 commits March 17, 2016 08:40

Update firewallcmd-rich-logging.conf

a211f23

Update firewallcmd-rich-rules.conf

bdbb50c

Update firewallcmd-rich-logging.conf

cf0f002

sebres reviewed Mar 21, 2016
View reviewed changes

TorontoMedia added 2 commits March 21, 2016 08:02

Update firewallcmd-allports.conf

d62fe2b

Update firewallcmd-multiport.conf

dd5e643

TorontoMedia added 2 commits March 21, 2016 08:25

Update firewallcmd-rich-rules.conf

46d7d3a

Update firewallcmd-rich-logging.conf

7ef4449

TorontoMedia added 2 commits March 21, 2016 09:00

Update firewallcmd-rich-rules.conf

a88dd88

Update firewallcmd-rich-logging.conf

6b3912f

yarikoptic reviewed Mar 22, 2016
View reviewed changes

Update firewallcmd-rich-logging.conf

2861c8e

TorontoMedia added 2 commits March 22, 2016 10:30

Update firewallcmd-rich-logging.conf

9bbdba0

Update firewallcmd-rich-rules.conf

307352e

TorontoMedia added 3 commits March 24, 2016 16:01

Update firewallcmd-rich-rules.conf

4689da5

Update firewallcmd-rich-logging.conf

7ff3f08

Update firewallcmd-rich-rules.conf

4f8aa45

TorontoMedia added 2 commits March 24, 2016 16:09

Update firewallcmd-rich-logging.conf

9444010

Update firewallcmd-rich-rules.conf

ed20d28

TorontoMedia added 2 commits March 24, 2016 16:13

Update firewallcmd-rich-rules.conf

bb6283e

Update firewallcmd-rich-logging.conf

221fef2

Update firewallcmd-rich-logging.conf

8e24915

sebres closed this in 3d23921 Mar 25, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Two new firewalld actions #1367

Two new firewalld actions #1367

TorontoMedia commented Mar 17, 2016

codecov-io commented Mar 17, 2016

sebres Mar 21, 2016

TorontoMedia Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

yarikoptic Mar 22, 2016

TorontoMedia Mar 22, 2016

coveralls commented Mar 22, 2016

coveralls commented Mar 22, 2016

coveralls commented Mar 22, 2016

coveralls commented Mar 22, 2016

TorontoMedia commented Mar 22, 2016

sebres commented Mar 22, 2016

TorontoMedia commented Mar 22, 2016

sebres commented Mar 23, 2016

TorontoMedia commented Mar 24, 2016

coveralls commented Mar 24, 2016

coveralls commented Mar 24, 2016

coveralls commented Mar 24, 2016

TorontoMedia commented Mar 24, 2016

coveralls commented Mar 24, 2016

sebres commented Mar 25, 2016

TorontoMedia commented Mar 25, 2016

sebres commented Mar 25, 2016

Two new firewalld actions #1367

Two new firewalld actions #1367

Conversation

TorontoMedia commented Mar 17, 2016

codecov-io commented Mar 17, 2016

Current coverage is 89.84%

sebres Mar 21, 2016

Choose a reason for hiding this comment

TorontoMedia Mar 21, 2016

Choose a reason for hiding this comment

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

coveralls commented Mar 21, 2016

yarikoptic Mar 22, 2016

Choose a reason for hiding this comment

TorontoMedia Mar 22, 2016

Choose a reason for hiding this comment

coveralls commented Mar 22, 2016

coveralls commented Mar 22, 2016

coveralls commented Mar 22, 2016

coveralls commented Mar 22, 2016

TorontoMedia commented Mar 22, 2016

sebres commented Mar 22, 2016

TorontoMedia commented Mar 22, 2016

sebres commented Mar 23, 2016

TorontoMedia commented Mar 24, 2016

coveralls commented Mar 24, 2016

coveralls commented Mar 24, 2016

coveralls commented Mar 24, 2016

TorontoMedia commented Mar 24, 2016

coveralls commented Mar 24, 2016

sebres commented Mar 25, 2016

TorontoMedia commented Mar 25, 2016

sebres commented Mar 25, 2016

Current coverage is `89.84%`