From d8e2b03a246ee34ebf0171ca3b7392c9f1e33560 Mon Sep 17 00:00:00 2001 From: sebres Date: Thu, 3 Nov 2022 11:41:21 +0100 Subject: [PATCH] `filter.d/named-refused.conf` extended (closes gh-3388): - support BIND named log categories - allow `info:` as possible error prefix too ("query (cache) denied" may occur as info) --- ChangeLog | 3 +++ config/filter.d/named-refused.conf | 7 +++++-- fail2ban/tests/files/logs/named-refused | 5 +++++ 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 04401ea8..61258d24 100644 --- a/ChangeLog +++ b/ChangeLog @@ -11,6 +11,9 @@ ver. 1.0.2-dev-1 (20??/??/??) - development nightly edition ----------- ### Fixes +* `filter.d/named-refused.conf`: + - support BIND named log categories, gh-3388 + - allow `info:` as possible error prefix too ("query (cache) denied" may occur as info) * `filter.d/dovecot.conf`: - fixes regression introduced in gh-3210: resolve extremely long search by repeated apply of non-greedy RE-part with following branches (it may be extremely slow up to infinite search depending on message), gh-3370 diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf index 6dbbbf81..798f66e6 100644 --- a/config/filter.d/named-refused.conf +++ b/config/filter.d/named-refused.conf @@ -30,11 +30,14 @@ __pid_re=(?:\[\d+\]) __daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:? __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:) +_category = (?!error|info)[\w-]+ +_category_re = (?:%(_category)s: )? + # hostname daemon_id spaces # this can be optional (for instance if we match named native log files) -__line_prefix=(?:\s*\S+ %(__daemon_combs_re)s\s+)? +__line_prefix=\s*(?:\S+ %(__daemon_combs_re)s\s+)?%(_category_re)s -prefregex = ^%(__line_prefix)s(?: error:)?\s*client(?: @\S*)? #\S+(?: \([\S.]+\))?: .+\s(?:denied|\(NOTAUTH\))\s*$ +prefregex = ^%(__line_prefix)s(?:(?:error|info):\s*)?client(?: @\S*)? #\S+(?: \([\S.]+\))?: .+\s(?:denied|\(NOTAUTH\))\s*$ failregex = ^(?:view (?:internal|external): )?query(?: \(cache\))? ^zone transfer diff --git a/fail2ban/tests/files/logs/named-refused b/fail2ban/tests/files/logs/named-refused index c06a4146..5ef42074 100644 --- a/fail2ban/tests/files/logs/named-refused +++ b/fail2ban/tests/files/logs/named-refused @@ -27,6 +27,11 @@ Aug 27 16:58:31 vhost1-ua named[29206]: client 176.9.92.38#42592 (simmarket.com. # failJSON: { "time": "2004-08-27T16:59:00", "match": true , "host": "192.0.2.1", "desc": "new log format, 9.11.0 (#2406)" } Aug 27 16:59:00 host named[28098]: client @0x7f6450002ef0 192.0.2.1#23332 (example.com): bad zone transfer request: 'test.com/IN': non-authoritative zone (NOTAUTH) +# failJSON: { "match": true , "host": "192.0.2.8", "desc": "log message with category (security), gh-3388" } +Oct 23 02:06:39 security: info: client @0x7f4e446fd6e8 192.0.2.8#53 (example.io): query (cache) 'example.io/A/IN' denied +# failJSON: { "match": true , "host": "192.0.2.237", "desc": "log message with category, gh-3388" } +Oct 23 03:35:40 update-security: error: client @0x7f4e45c07a48 192.0.2.237#55956 (example.ca): zone transfer 'example.ca/AXFR/IN' denied + # filterOptions: {"logtype": "journal"} # failJSON: { "match": true , "host": "192.0.2.1", "desc": "systemd-journal entry" }