Do not use ({}) for define empty array, the correct way is :local arrayvar [:toarray ""]
I myself used that method once suggested by another user, but it backfired because, although I don't quite remember now how,
it had unwanted effects that backfired on me in programming.
IT SEEMS to work, then it messes up...
Missing a space between do and {
:foreach key,value in=$offenders do {
The script is wrong on this line:
:if ($offenders->$ipString != nil) do={
You can not compare one array field with the string "nil".
Nil is not a reserved word usable for compare something on this way.
Nil is just a string, you can write anything, and for just a coincidence work.
Instead the "nothing" keyword exist, but you can not compare two nothing or two nil....
examples code
:全球测试[:toarray "]:全球isnil[:选择“0 1] :global notnil ":)" :put [:typeof $test] :put [:typeof $isnil] :put [:typeof $notnil] :if ($isnil != nil) do={:put "not nil"} else={:put "is nil"} :if ($notnil != nil) do={:put "not nil"} else={:put "is nil"} :if ($test->$isnil != nil) do={:put "not nil"} else={:put "is nil"} :if ($test->$notnil != nil) do={:put "not nil"} else={:put "is nil"} :set ($test->$isnil) "is-nil" :set ($test->$notnil) "not-nil" :put [:typeof $test] :put [:typeof $isnil] :put [:typeof $notnil] :if ($test->$isnil != nil) do={:put "not nil"} else={:put "is nil"} :if ($test->$notnil != nil) do={:put "not nil"} else={:put "is nil"} :put [:typeof ($test->$isnil)] :put [:typeof ($test->$notnil)] :if ($test->$isnil != anystring) do={:put "not nil"} else={:put "is nil"} :if ($test->$notnil != anystring) do={:put "not nil"} else={:put "is nil"} :if (($test->$isnil) != [:nothing]) do={:put "not nothing"} else={:put "is nothing"} :if (($test->$notnil) != [:nothing]) do={:put "not nothing"} else={:put "is nothing"}
The correct way is with ( ) and use :typeof, and is nothing the undefined "nil" on array:
:if ([:typeof ($offenders->$ipString)] != "nothing") do={
fixed and revised code
# Created by Anton BORODA Borodyuk 2023 # v1.0.r # fixed and revised by rextended # # This script adds users who end up with "parsing packet failed, possible cause: wrong password" message during # VPN connection more then $maxTryCount times to the $listName for 7 days, # This should be a good riddance for VPN password guessers. # # Losely based on Jotne && rextended 2022 v1.5 script. :local listName "IPSEC" :local maxTryCount 21 :local offenders [:toarray ""] /log :foreach i in=[find where message~"possible cause: wrong password"] do={ :local logMessage [get $i message] :local ipString [:pick $logMessage 0 [:find $logMessage " "]] :if ([:typeof ($offenders->$ipString)] = "nothing") do={ :set ($offenders->$ipString) 1 } else={ :set ($offenders->$ipString) (($offenders->$ipString) + 1) } } /ip firewall address-list :foreach key,value in=$offenders do={ :local tryCount [:tonum ($value)] :if ($tryCount > $maxTryCount) do={ :local logIp [:toip $key] :if ([:len [find where list=$listName and address=$logIp]] < 1) do={ add address=$logIp list=$listName timeout=7d :log info "script=IPSEC_failed src_ip=$logIp why=Password guesser" } } }
