From f54f6caece26851195062a88b8027ef57e918aa0 Mon Sep 17 00:00:00 2001 From: benrubson Date: Sat, 9 Jun 2018 10:19:27 +0200 Subject: [PATCH 1/3] Merge Apache SNI error / misredirect attempts rules --- config/filter.d/apache-auth.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 6b2499a2..4524d7c3 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -24,8 +24,7 @@ failregex = ^client (?:denied by server configuration|used wrong authentication ^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b ^invalid qop `(?:[^']*|.*?)' received\b ^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b - ^Hostname \S+ provided via SNI(?:, but no hostname| and hostname \S+) provided\b - ^No hostname was provided via SNI for a name based virtual host\b + ^(?:No )?[Hh]ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b ignoreregex = From 77b35b8db7e5ed2691370c44ebe502246bdb6689 Mon Sep 17 00:00:00 2001 From: Ben RUBSON Date: Tue, 14 Aug 2018 14:07:32 +0200 Subject: [PATCH 2/3] Improvement --- config/filter.d/apache-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 4524d7c3..91c89b26 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -24,7 +24,7 @@ failregex = ^client (?:denied by server configuration|used wrong authentication ^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b ^invalid qop `(?:[^']*|.*?)' received\b ^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b - ^(?:No )?[Hh]ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b + ^(?:No h|H)ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b ignoreregex = From e392f510e2af5851aacb323699f0d83c6c65bf02 Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 14 Aug 2018 15:37:23 +0200 Subject: [PATCH 3/3] fix sporadic time-related (multi-threaded) assertion errors (message was not found in the log). --- fail2ban/tests/fail2banclienttestcase.py | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/fail2ban/tests/fail2banclienttestcase.py b/fail2ban/tests/fail2banclienttestcase.py index 68bdad80..048604b1 100644 --- a/fail2ban/tests/fail2banclienttestcase.py +++ b/fail2ban/tests/fail2banclienttestcase.py @@ -903,7 +903,7 @@ class Fail2banServerTest(Fail2banClientServerBase): if unittest.F2B.log_level < logging.DEBUG: # pragma: no cover _out_file(test1log) self.execCmd(SUCCESS, startparams, "reload") - self.assertLogged("Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) # test not unbanned / banned again: self.assertNotLogged( "[test-jail1] Unban 192.0.2.1", @@ -935,7 +935,7 @@ class Fail2banServerTest(Fail2banClientServerBase): reload=" echo '[] %s: reloaded.'" % "test-action1", stop= " echo '[] %s: stopped.'" % "test-action1") self.execCmd(SUCCESS, startparams, "reload") - self.assertLogged("Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) # test not unbanned / banned again: self.assertNotLogged( "[test-jail1] Unban 192.0.2.1", @@ -1067,8 +1067,7 @@ class Fail2banServerTest(Fail2banClientServerBase): # reload jail1 without restart (without ban/unban): self.pruneLog("[test-phase 3]") self.execCmd(SUCCESS, startparams, "reload", "test-jail1") - self.assertLogged( - "Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) self.assertLogged( "Reload jail 'test-jail1'", "Jail 'test-jail1' reloaded", all=True) @@ -1082,7 +1081,7 @@ class Fail2banServerTest(Fail2banClientServerBase): self.pruneLog("[test-phase 4]") _write_jail_cfg(enabled=[1]) self.execCmd(SUCCESS, startparams, "reload") - self.assertLogged("Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) # test both jails should be reloaded: self.assertLogged( "Reload jail 'test-jail1'") @@ -1129,7 +1128,7 @@ class Fail2banServerTest(Fail2banClientServerBase): self.pruneLog("[test-phase 7]") self.execCmd(SUCCESS, startparams, "reload", "--unban") - self.assertLogged("Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) # reloads unbanned all: self.assertLogged( "Jail 'test-jail1' reloaded", @@ -1160,7 +1159,7 @@ class Fail2banServerTest(Fail2banClientServerBase): self.pruneLog("[test-phase 8a]") _write_jail_cfg(enabled=[1], backend="xxx-unknown-backend-zzz") self.execCmd(FAILED, startparams, "reload") - self.assertLogged("Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) self.assertLogged( "Restart jail 'test-jail1' (reason: 'polling' != ", "Unknown backend ", all=True) @@ -1168,18 +1167,20 @@ class Fail2banServerTest(Fail2banClientServerBase): self.pruneLog("[test-phase 8b]") _write_jail_cfg(enabled=[1]) self.execCmd(SUCCESS, startparams, "reload") - self.assertLogged("Reload finished.", all=True, wait=MID_WAITTIME) + self.assertLogged("Reload finished.", wait=MID_WAITTIME) # several small cases (cover several parts): self.pruneLog("[test-phase end-1]") # wrong jail (not-started): self.execCmd(FAILED, startparams, "--async", "reload", "test-jail2") + self.assertLogged("Reload finished.", wait=MID_WAITTIME) self.assertLogged("the jail 'test-jail2' does not exist") self.pruneLog() # unavailable jail (but exit 0), using --if-exists option: self.execCmd(SUCCESS, startparams, "--async", "reload", "--if-exists", "test-jail2") + self.assertLogged("Reload finished.", wait=MID_WAITTIME) self.assertNotLogged( "Creating new jail 'test-jail2'", "Jail 'test-jail2' started", all=True) @@ -1188,9 +1189,10 @@ class Fail2banServerTest(Fail2banClientServerBase): self.pruneLog("[test-phase end-2]") self.execCmd(SUCCESS, startparams, "--async", "reload", "--restart", "--all") + self.assertLogged("Reload finished.", wait=MID_WAITTIME) self.assertLogged( "Jail 'test-jail1' stopped", - "Jail 'test-jail1' started", all=True) + "Jail 'test-jail1' started", all=True, wait=MID_WAITTIME) # test action.d/nginx-block-map.conf -- @unittest.F2B.skip_if_cfg_missing(action="nginx-block-map")