From f0214b3d36ea08b318c52a2d51fce50bf9ec0cce Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 20 Apr 2021 18:13:40 +0200 Subject: [PATCH 1/3] filter.d/sendmail-reject.conf: fixed regex to consider "Connection rate limit exceeded" with different combination of arguments --- config/filter.d/sendmail-reject.conf | 4 ++-- fail2ban/tests/files/logs/sendmail-reject | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/config/filter.d/sendmail-reject.conf b/config/filter.d/sendmail-reject.conf index e8b766c5..966d880c 100644 --- a/config/filter.d/sendmail-reject.conf +++ b/config/filter.d/sendmail-reject.conf @@ -21,12 +21,12 @@ before = common.conf _daemon = (?:(sm-(mta|acceptingconnections)|sendmail)) __prefix_line = %(known/__prefix_line)s(?:\w{14,20}: )? -addr = (?:IPv6:|) +addr = (?:(?:IPv6:)?|) prefregex = ^%(__prefix_line)s.+$ cmnfailre = ^ruleset=check_rcpt, arg1=(?P<\S+@\S+>), relay=(\S+ )?\[%(addr)s\](?: \(may be forged\))?, reject=(550 5\.7\.1 (?P=email)\.\.\. Relaying denied\. (IP name possibly forged \[(\d+\.){3}\d+\]|Proper authentication required\.|IP name lookup failed \[(\d+\.){3}\d+\])|553 5\.1\.8 (?P=email)\.\.\. Domain of sender address \S+ does not exist|550 5\.[71]\.1 (?P=email)\.\.\. (Rejected: .*|User unknown))$ - ^ruleset=check_relay, arg1=(?P\S+), arg2=%(addr)s, relay=((?P=dom) )?\[(\d+\.){3}\d+\](?: \(may be forged\))?, reject=421 4\.3\.2 (Connection rate limit exceeded\.|Too many open connections\.)$ + ^ruleset=check_relay(?:, arg\d+=\S*)*, relay=(\S+ )?\[%(addr)s\](?: \(may be forged\))?, reject=421 4\.3\.2 (Connection rate limit exceeded\.|Too many open connections\.)$ ^rejecting commands from (\S* )?\[%(addr)s\] due to pre-greeting traffic after \d+ seconds$ ^(?:\S+ )?\[%(addr)s\]: (?:(?i)expn|vrfy) \S+ \[rejected\]$ ^<[^@]+@[^>]+>\.\.\. No such user here$ diff --git a/fail2ban/tests/files/logs/sendmail-reject b/fail2ban/tests/files/logs/sendmail-reject index 99c1877c..ed3143a8 100644 --- a/fail2ban/tests/files/logs/sendmail-reject +++ b/fail2ban/tests/files/logs/sendmail-reject @@ -40,6 +40,9 @@ Feb 27 15:49:07 batman sm-mta[88390]: ruleset=check_relay, arg1=189-30-205-74.pa # failJSON: { "time": "2005-02-19T18:01:50", "match": true , "host": "196.213.73.146" } Feb 19 18:01:50 batman sm-mta[78152]: ruleset=check_relay, arg1=[196.213.73.146], arg2=196.213.73.146, relay=[196.213.73.146], reject=421 4.3.2 Connection rate limit exceeded. +# failJSON: { "time": "2005-02-19T20:17:12", "match": true , "host": "192.0.2.123" } +Feb 19 20:17:12 server sm-mta[201892]: ruleset=check_relay, arg1=[192.0.2.123], arg2=192.0.2.123, relay=host.example.com [192.0.2.123] (may be forged), reject=421 4.3.2 Connection rate limit exceeded. + # failJSON: { "time": "2005-02-27T10:53:06", "match": true , "host": "209.15.212.253" } Feb 27 10:53:06 batman sm-mta[44307]: s1R9r60D044307: rejecting commands from [209.15.212.253] due to pre-greeting traffic after 0 seconds # failJSON: { "time": "2005-02-27T10:53:07", "match": true , "host": "1.2.3.4" } From d3f5d2d52b1e1b1577dbf29e931fbdbe59f56109 Mon Sep 17 00:00:00 2001 From: sebres Date: Wed, 21 Apr 2021 11:50:07 +0200 Subject: [PATCH 2/3] documentation (interpolation tags) --- man/jail.conf.5 | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/man/jail.conf.5 b/man/jail.conf.5 index 788fad2b..5f29161d 100644 --- a/man/jail.conf.5 +++ b/man/jail.conf.5 @@ -481,13 +481,29 @@ is the regex (\fBreg\fRular \fBex\fRpression) that will match failed attempts. T .IP \fI\fR - regex for IPv4 addresses. .IP -\fI\fR - regex for IPv6 addresses (also IP enclosed in brackets). +\fI\fR - regex for IPv6 addresses. .IP \fI\fR - regex to match hostnames. .IP \fI\fR - helper regex to match CIDR (simple integer form of net-mask). .IP \fI\fR - regex to match sub-net adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional). +.IP +\fI...\fR - free regex capturing group targeting identifier used for ban (instead of IP address or hostname). +.IP +\fI...\fR - free regex capturing named group stored in ticket, which can be used in action. +.nf +For example \fI[^@]+\fR matches and stores a user name, that can be used in action with interpolation tag \fI\fR. +.IP +\fI...\fR - free regex capturing alternative named group stored in ticket. +.nf +For example first found matched value defined in regex as \fI\fR, \fI\fR or \fI\fR would be stored as (if direct match is not found or empty). +.PP +Every of abovementioned tags can be specified in \fBprefregex\fR and in \fBfailregex\fR, thereby if specified in both, the value matched in \fBfailregex\fR overwrites a value matched in \fBprefregex\fR. +.TQ +All standard tags like IP4 or IP6 can be also specified with custom regex using \fI...\fR syntax, for example \fI(?:ip4:\\S+|ip6:\\S+)\fR. +.TQ +Tags \fI\fR, \fI\fR and \fI\fR would also match the IP address enclosed in square brackets. .PP \fBNOTE:\fR the \fBfailregex\fR will be applied to the remaining part of message after \fBprefregex\fR processing (if specified), which in turn takes place after \fBdatepattern\fR processing (whereby the string of timestamp matching the best pattern, cut out from the message). .PP From 319cfefac2b57c9ca7c9e4ce91b252dd7e20cfee Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 27 Apr 2021 13:34:22 +0200 Subject: [PATCH 3/3] fix travis build (unsupported pythons and pypy versions), update 3.10 in GH actions --- .github/workflows/main.yml | 2 +- .travis.yml | 10 +--------- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 262448c2..4ea0e7eb 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-20.04 strategy: matrix: - python-version: [2.7, 3.5, 3.6, 3.7, 3.8, 3.9, '3.10.0-alpha.5', pypy2, pypy3] + python-version: [2.7, 3.5, 3.6, 3.7, 3.8, 3.9, '3.10.0-beta.1', pypy2, pypy3] fail-fast: false # Steps represent a sequence of tasks that will be executed as part of the job steps: diff --git a/.travis.yml b/.travis.yml index 064b678b..398c120a 100644 --- a/.travis.yml +++ b/.travis.yml @@ -10,16 +10,8 @@ dist: xenial matrix: fast_finish: true include: - - python: 2.6 - dist: trusty # required for Python 2.6 - python: 2.7 - dist: trusty # required for packages like gamin - name: 2.7 (trusty) - - python: 2.7 - name: 2.7 (xenial) - - python: pypy - - python: 3.3 - dist: trusty + #- python: pypy - python: 3.4 - python: 3.5 - python: 3.6