From e995d5a0b6ae416b1d13091361dde7ce33668026 Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 3 Aug 2018 11:42:15 +0200 Subject: [PATCH] filter.d/freeswitch.conf: provide mode parameter, allows to avoid matching of messages like `auth challenge (REGISTER)` (see gh-2163) (currently `extra` as default to be backwards-compatible), see comments in filter how to set it to mode `normal`. --- config/filter.d/freeswitch.conf | 27 +++++++++++++++++++++++---- fail2ban/tests/files/logs/freeswitch | 5 +++++ 2 files changed, 28 insertions(+), 4 deletions(-) diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index b75ee255..0fdcf1f1 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -18,20 +18,39 @@ before = common.conf _daemon = freeswitch +# Parameter "mode": normal, ddos or extra (default, combines all) +# Usage example (for jail.local): +# [freeswitch] +# mode = normal +# # or with rewrite filter parameters of jail: +# [freeswitch-ddos] +# filter = freeswitch[mode=ddos] +# +mode = extra + # Prefix contains common prefix line (server, daemon, etc.) and 2 datetimes if used systemd backend _pref_line = ^%(__prefix_line)s(?:(?:\d+-)?\d+-\d+ \d+:\d+:\d+\.\d+)? prefregex = ^%(_pref_line)s \[WARN(?:ING)?\](?: \[SOFIA\])? \[?sofia_reg\.c:\d+\]? .+$ -failregex = ^SIP auth (?:failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip $ - ^Can't find user \[[^@]+@[^\]]+\] from $ + +cmnfailre = ^Can't find user \[[^@]+@[^\]]+\] from $ + +mdre-normal = %(cmnfailre)s + ^SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip $ + +mdre-ddos = ^SIP auth (?:failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip $ + +mdre-extra = %(cmnfailre)s + + +failregex = > ignoreregex = datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)? {^LN-BEG} - -# Author: Rupa SChomaker, soapee01, Daniel Black +# Author: Rupa SChomaker, soapee01, Daniel Black, Sergey Brester aka sebres # https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban # Thanks to Jim on mailing list of samples and guidance # diff --git a/fail2ban/tests/files/logs/freeswitch b/fail2ban/tests/files/logs/freeswitch index ee9c21d4..6a117523 100644 --- a/fail2ban/tests/files/logs/freeswitch +++ b/fail2ban/tests/files/logs/freeswitch @@ -1,5 +1,10 @@ +# filterOptions: [{}, {"mode": "ddos"}] + # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "81.94.202.251" } 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1533 SIP auth challenge (INVITE) on sofia profile 'internal' for [011448708752617@192.168.2.51] from ip 81.94.202.251 + +# filterOptions: [{}, {"mode": "normal"}] + # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "5.11.47.236" } 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1478 SIP auth failure (INVITE) on sofia profile 'internal' for [000972543480510@192.168.2.51] from ip 5.11.47.236 # failJSON: { "time": "2013-12-31T17:39:54", "match": false }