From a28e6b442e50bf17cefc886b3873ebd9a418a235 Mon Sep 17 00:00:00 2001 From: Pablo Rodriguez Fernandez Date: Tue, 13 Oct 2015 09:55:28 +0200 Subject: [PATCH] Add check in apache-fakegooglebot to protect against PTR fake record An attacker may return a PTR record which fakes a Googlebot's domain name. This modification resolves the PTR records to verify it. See "Verifying Googlebot": --- ChangeLog | 2 ++ THANKS | 1 + config/filter.d/ignorecommands/apache-fakegooglebot | 5 ++++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9e145b65..2f5a158b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,8 @@ ver. 0.9.4 (2015/XX/XXX) - wanna-be-released * Allow to split ignoreip entries by ',' as well as by ' ' (gh-1197) * Added a timeout (3 sec) to urlopen within badips.py action (Thanks M. Maraun) + * Added check against atacker's Googlebot PTR fake records + (Thanks Pablo Rodriguez Fernandez) ver. 0.9.3 (2015/08/01) - lets-all-stay-friends ---------- diff --git a/THANKS b/THANKS index 5cea437b..45674847 100644 --- a/THANKS +++ b/THANKS @@ -89,6 +89,7 @@ Mika (mkl) Nick Munger onorua Orion Poplawski +Pablo Rodriguez Fernandez Paul Marrapese Paul Traina Noel Butler diff --git a/config/filter.d/ignorecommands/apache-fakegooglebot b/config/filter.d/ignorecommands/apache-fakegooglebot index 47ef51f6..3028d86a 100755 --- a/config/filter.d/ignorecommands/apache-fakegooglebot +++ b/config/filter.d/ignorecommands/apache-fakegooglebot @@ -26,7 +26,10 @@ def is_googlebot(ip): from fail2ban.server.filter import DNSUtils host = DNSUtils.ipToName(ip) - sys.exit(0 if (host and re.match('crawl-.*\.googlebot\.com', host)) else 1) + if not host or not re.match('crawl-.*\.googlebot\.com', host): + sys.exit(1) + host_ips = DNSUtils.dnsToIp(host) + sys.exit(0 if ip in host_ips else 1) if __name__ == '__main__': is_googlebot(process_args(sys.argv))