Do not use ({}) for define empty array, the correct way is :local arrayvar [:toarray ""]
I myself used that method once suggested by another user, but it backfired because, although I don't quite remember now how,
it had unwanted effects that backfired on me in programming.
IT SEEMS to work, then it messes up...
Missing a space between do and {
:foreach key,value in=$offenders do {
The script is wrong on this line:
:if ($offenders->$ipString != nil) do={
You can not compare one array field with the string "nil".
Nil is not a reserved word usable for compare something on this way.
Nil is just a string, you can write anything, and for just a coincidence work.
Instead the "nothing" keyword exist, but you can not compare two nothing or two nil....
examples code
:global test [:toarray ""]
:global isnil [:pick "" 0 1]
:global notnil ":)"
:put [:typeof $test]
:put [:typeof $isnil]
:put [:typeof $notnil]
:if ($isnil != nil) do={:put "not nil"} else={:put "is nil"}
:if ($notnil != nil) do={:put "not nil"} else={:put "is nil"}
:if ($test->$isnil != nil) do={:put "not nil"} else={:put "is nil"}
:if ($test->$notnil != nil) do={:put "not nil"} else={:put "is nil"}
:set ($test->$isnil) "is-nil"
:set ($test->$notnil) "not-nil"
:put [:typeof $test]
:put [:typeof $isnil]
:put [:typeof $notnil]
:if ($test->$isnil != nil) do={:put "not nil"} else={:put "is nil"}
:if ($test->$notnil != nil) do={:put "not nil"} else={:put "is nil"}
:put [:typeof ($test->$isnil)]
:put [:typeof ($test->$notnil)]
:if ($test->$isnil != anystring) do={:put "not nil"} else={:put "is nil"}
:if ($test->$notnil != anystring) do={:put "not nil"} else={:put "is nil"}
:if (($test->$isnil) != [:nothing]) do={:put "not nothing"} else={:put "is nothing"}
:if (($test->$notnil) != [:nothing]) do={:put "not nothing"} else={:put "is nothing"}
The correct way is with ( ) and use :typeof, and is nothing the undefined "nil" on array:
:if ([:typeof ($offenders->$ipString)] != "nothing") do={
fixed and revised code
# Created by Anton BORODA Borodyuk 2023
# v1.0.r
# fixed and revised by rextended
#
# This script adds users who end up with "parsing packet failed, possible cause: wrong password" message during
# VPN connection more then $maxTryCount times to the $listName for 7 days,
# This should be a good riddance for VPN password guessers.
#
# Losely based on Jotne && rextended 2022 v1.5 script.
:local listName "IPSEC"
:local maxTryCount 21
:local offenders [:toarray ""]
/log
:foreach i in=[find where message~"possible cause: wrong password"] do={
:local logMessage [get $i message]
:local ipString [:pick $logMessage 0 [:find $logMessage " "]]
:if ([:typeof ($offenders->$ipString)] = "nothing") do={
:set ($offenders->$ipString) 1
} else={
:set ($offenders->$ipString) (($offenders->$ipString) + 1)
}
}
/ip firewall address-list
:foreach key,value in=$offenders do={
:local tryCount [:tonum ($value)]
:if ($tryCount > $maxTryCount) do={
:local logIp [:toip $key]
:if ([:len [find where list=$listName and address=$logIp]] < 1) do={
add address=$logIp list=$listName timeout=7d
:log info "script=IPSEC_failed src_ip=$logIp why=Password guesser"
}
}
}
