[packages/fail2ban] dodaj bcond tests (domyślnie włączony); rel 10
arekm
arekm at pld-linux.org
Wed Jul 22 17:47:52 CEST 2026
commit 279289f92f85ae4043c2288c3526f7238fc3e25a
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Jul 22 16:37:19 2026 +0200
dodaj bcond tests (domyślnie włączony); rel 10
suite pilnuje 4 lokalnych łatek serwera i od razu wykrył 3 błędy: brak
banaction_allports, nginx-block-map psute przez printf '\%s' pod coreutils
i paths-pld.conf nieobecny w drzewie budowania
fail2ban-config_banaction.patch | 10 ++++---
fail2ban-nginx-block-map-printf.patch | 12 ++++++++
fail2ban-tests-config_from_git.patch | 53 +++++++++++++++++++++++++++++++++++
fail2ban.spec | 22 +++++++++++++--
4 files changed, 91 insertions(+), 6 deletions(-)
---
diff --git a/fail2ban.spec b/fail2ban.spec
index fbee22e..a0042e1 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -1,8 +1,12 @@
+#
+# Conditional build:
+%bcond_without tests # unit tests
+#
Summary: Ban IPs that make too many password failures
Summary(pl.UTF-8): Blokowanie IP powodujących zbyt dużo prób logowań z błędnym hasłem
Name: fail2ban
Version: 1.1.0
-Release: 9
+Release: 10
License: GPL
Group: Daemons
Source0: https://github.com/fail2ban/fail2ban/archive/%{version}.tar.gz
@@ -20,11 +24,17 @@ Patch5: %{name}-lag-visibility.patch
Patch6: %{name}-restore-before-filter.patch
Patch7: %{name}-gil-switchinterval.patch
Patch8: %{name}-restore-idle-gate.patch
+Patch9: %{name}-tests-config_from_git.patch
+Patch10: %{name}-nginx-block-map-printf.patch
URL: http://fail2ban.sourceforge.net/
BuildRequires: python3-devel
BuildRequires: python3-modules
BuildRequires: rpm-pythonprov
BuildRequires: rpmbuild(macros) >= 1.710
+%if %{with tests}
+BuildRequires: python3-dns
+BuildRequires: python3-pyinotify >= 0.8.3
+%endif
Requires(post,preun): /sbin/chkconfig
Requires(post,preun,postun): systemd-units >= 38
Requires: python3-dns
@@ -58,8 +68,13 @@ z sshd czy plikami logów serwera WWW Apache.
%patch -P6 -p1
%patch -P7 -p1
%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
rm setup.cfg
+# jail.conf includes it (logifiles.patch), so the config has to be complete already in the build tree
+cp -p %{SOURCE3} config/paths-pld.conf
+
sed -E -i -e '1s,#!\s*/usr/bin/env\s+python2(\s|$),#!%{__python3}\1,' -e '1s,#!\s*/usr/bin/env\s+python(\s|$),#!%{__python3}\1,' -e '1s,#!\s*/usr/bin/python(\s|$),#!%{__python3}\1,' \
bin/fail2ban-client \
bin/fail2ban-regex \
@@ -75,6 +90,10 @@ sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
%build
%py3_build
+%if %{with tests}
+%{__python3} bin/fail2ban-testcases --no-network
+%endif
+
%install
rm -rf $RPM_BUILD_ROOT
install -d $RPM_BUILD_ROOT/etc/{rc.d/init.d,logrotate.d,sysconfig} \
@@ -90,7 +109,6 @@ install -p man/*.5 $RPM_BUILD_ROOT%{_mandir}/man5
install -p %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/fail2ban
install -p %{SOURCE2} $RPM_BUILD_ROOT/etc/logrotate.d/fail2ban
-install -p %{SOURCE3} $RPM_BUILD_ROOT%{_sysconfdir}/fail2ban/paths-pld.conf
install -p %{SOURCE4} $RPM_BUILD_ROOT/etc/sysconfig/%{name}
rm -rf $RPM_BUILD_ROOT%{_defaultdocdir}/%{name}
diff --git a/fail2ban-config_banaction.patch b/fail2ban-config_banaction.patch
index 221fd2e..8174e2c 100644
--- a/fail2ban-config_banaction.patch
+++ b/fail2ban-config_banaction.patch
@@ -1,12 +1,14 @@
diff -ur fail2ban-1.1.0.org/config/jail.conf fail2ban-1.1.0/config/jail.conf
---- fail2ban-1.1.0.org/config/jail.conf 2025-02-26 15:18:36.792067480 +0100
-+++ fail2ban-1.1.0/config/jail.conf 2025-02-26 15:19:02.208002200 +0100
-@@ -205,7 +205,7 @@
+--- fail2ban-1.1.0.org/config/jail.conf 2026-07-22 16:23:19.778497016 +0200
++++ fail2ban-1.1.0/config/jail.conf 2026-07-22 16:23:33.348305917 +0200
+@@ -205,8 +205,8 @@
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
-#banaction = iptables-multiport
+-#banaction_allports = iptables-allports
+banaction = iptables-multiport
- #banaction_allports = iptables-allports
++banaction_allports = iptables-allports
# The simplest action to take: ban only
+ action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
diff --git a/fail2ban-nginx-block-map-printf.patch b/fail2ban-nginx-block-map-printf.patch
new file mode 100644
index 0000000..086c477
--- /dev/null
+++ b/fail2ban-nginx-block-map-printf.patch
@@ -0,0 +1,12 @@
+diff -ru a/config/action.d/nginx-block-map.conf b/config/action.d/nginx-block-map.conf
+--- a/config/action.d/nginx-block-map.conf 2024-04-25 23:08:13.000000000 +0200
++++ b/config/action.d/nginx-block-map.conf 2026-07-22 16:20:54.000000000 +0200
+@@ -110,7 +110,7 @@
+
+ actioncheck =
+
+-_echo_blck_row = printf '\%%s 1;\n' "<fid>"
++_echo_blck_row = printf '\\%%s 1;\n' "<fid>"
+
+ actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s
+
diff --git a/fail2ban-tests-config_from_git.patch b/fail2ban-tests-config_from_git.patch
new file mode 100644
index 0000000..0c0a078
--- /dev/null
+++ b/fail2ban-tests-config_from_git.patch
@@ -0,0 +1,53 @@
+diff -ru a/fail2ban/tests/files/logs/proxmox b/fail2ban/tests/files/logs/proxmox
+--- a/fail2ban/tests/files/logs/proxmox 1970-01-01 01:00:00.000000000 +0100
++++ b/fail2ban/tests/files/logs/proxmox 2026-07-22 16:20:54.000000000 +0200
+@@ -0,0 +1,5 @@
++# failJSON: { "time": "2005-03-08T09:37:44", "match": true , "host": "192.0.2.123" }
++Mar 8 09:37:44 HOSTNAME pvedaemon[12021]: authentication failure; rhost=192.0.2.123 user=root at pam msg=Authentication failure
++
++# failJSON: { "time": "2005-03-09T03:32:27", "match": true , "host": "192.0.2.124" }
++Mar 9 03:32:27 HOSTNAME pvedaemon[8961]: authentication failure; rhost=192.0.2.124 user=jose at pve msg=invalid credentials
+diff -ru a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py
+--- a/fail2ban/tests/servertestcase.py 2024-04-25 23:08:13.000000000 +0200
++++ b/fail2ban/tests/servertestcase.py 2026-07-22 16:20:48.000000000 +0200
+@@ -2034,32 +2034,32 @@
+ ('j-fwcmd-rr', 'firewallcmd-rich-rules[port="22:24", protocol="tcp"]', {
+ 'ip4': ("family='ipv4'", "icmp-port-unreachable",), 'ip6': ("family='ipv6'", 'icmp6-port-unreachable',),
+ 'ip4-ban': (
+- """`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`""",
++ r"""`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family=\"ipv4\" source address=\"192.0.2.1\" port port=\"$p\" protocol=\"tcp\" reject type='icmp-port-unreachable'"; done`""",
+ ),
+ 'ip4-unban': (
+- """`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`""",
++ r"""`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family=\"ipv4\" source address=\"192.0.2.1\" port port=\"$p\" protocol=\"tcp\" reject type='icmp-port-unreachable'"; done`""",
+ ),
+ 'ip6-ban': (
+- """ `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`""",
++ r""" `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family=\"ipv6\" source address=\"2001:db8::\" port port=\"$p\" protocol=\"tcp\" reject type='icmp6-port-unreachable'"; done`""",
+ ),
+ 'ip6-unban': (
+- """`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`""",
++ r"""`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family=\"ipv6\" source address=\"2001:db8::\" port port=\"$p\" protocol=\"tcp\" reject type='icmp6-port-unreachable'"; done`""",
+ ),
+ }),
+ # firewallcmd-rich-logging --
+ ('j-fwcmd-rl', 'firewallcmd-rich-logging[port="22:24", protocol="tcp"]', {
+ 'ip4': ("family='ipv4'", "icmp-port-unreachable",), 'ip6': ("family='ipv6'", 'icmp6-port-unreachable',),
+ 'ip4-ban': (
+- """`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`""",
++ r"""`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family=\"ipv4\" source address=\"192.0.2.1\" port port=\"$p\" protocol=\"tcp\" log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`""",
+ ),
+ 'ip4-unban': (
+- """`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`""",
++ r"""`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family=\"ipv4\" source address=\"192.0.2.1\" port port=\"$p\" protocol=\"tcp\" log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`""",
+ ),
+ 'ip6-ban': (
+- """ `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`""",
++ r""" `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family=\"ipv6\" source address=\"2001:db8::\" port port=\"$p\" protocol=\"tcp\" log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`""",
+ ),
+ 'ip6-unban': (
+- """`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`""",
++ r"""`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family=\"ipv6\" source address=\"2001:db8::\" port port=\"$p\" protocol=\"tcp\" log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`""",
+ ),
+ }),
+ )
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/fail2ban.git/commitdiff/74db76d97f2db8dcde983b6ec2568841c1aacf22
More information about the pld-cvs-commit
mailing list