From d4940563d3f3be6eae68c0ff4ebd869e2145356f Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 14 Jun 2013 08:55:25 +1000 Subject: [PATCH 1/3] ENH: regex hardening on assp --- ChangeLog | 2 ++ config/filter.d/assp.conf | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 590edfa6..a9e02d68 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released - New Features: - Enhancements: + Daniel Black + * filter.d/assp -- regex hardening ver. 0.8.10 (2013/06/12) - wanna-be-secure diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf index b1bfc082..4b8f5caf 100644 --- a/config/filter.d/assp.conf +++ b/config/filter.d/assp.conf @@ -20,9 +20,9 @@ # Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded __assp_actions = (dropping|refusing) -failregex = max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: [a-zA-Z0-9]+;$ - SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$ - Blocking - too much AUTH errors \(\d{,3}\);$ +failregex = ^ \[SSL-out\] max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$ + ^ \[SSL-out\] SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$ + ^ Blocking - too much AUTH errors \(\d{,3}\);$ # Option: ignoreregex From a447aa615d2d6114db4af582576836dea9ce78b2 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 14 Jun 2013 12:27:35 +1000 Subject: [PATCH 2/3] BF: [SSL-out] is optional in assp --- config/filter.d/assp.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf index 4b8f5caf..2b98ffc2 100644 --- a/config/filter.d/assp.conf +++ b/config/filter.d/assp.conf @@ -18,10 +18,10 @@ # Examples: Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41); # Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol; # Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded -__assp_actions = (dropping|refusing) +__assp_actions = (?:dropping|refusing) -failregex = ^ \[SSL-out\] max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$ - ^ \[SSL-out\] SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$ +failregex = ^(:? \[SSL-out\])? max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$ + ^(?: \[SSL-out\])? SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$ ^ Blocking - too much AUTH errors \(\d{,3}\);$ From 7018d81244d560d6fc0d40418f7331b8dfd609e1 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 14 Jun 2013 12:35:44 +1000 Subject: [PATCH 3/3] BF: missed a space --- config/filter.d/assp.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf index 2b98ffc2..2854d898 100644 --- a/config/filter.d/assp.conf +++ b/config/filter.d/assp.conf @@ -20,7 +20,7 @@ # Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded __assp_actions = (?:dropping|refusing) -failregex = ^(:? \[SSL-out\])? max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$ +failregex = ^(:? \[SSL-out\])? max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$ ^(?: \[SSL-out\])? SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$ ^ Blocking - too much AUTH errors \(\d{,3}\);$