ENH: add filter for Counter Strike 1.6. Closes gh-347

ChangeLog

@@ -56,6 +56,8 @@ configuration before relying on it.
      according to the XARF standard (v0.2). Close gh-105
    * Support PyPy
    * Filter for stunnel
+   * Filter for Counter Strik 1.6. Thanks to onorua for logs.
+     Close gh-347
 
 - Enhancements
    * Jail names increased to 26 characters and iptables prefix reduced

MANIFEST

@@ -108,6 +108,7 @@ fail2ban/tests/files/logs/apache-noscript
 fail2ban/tests/files/logs/apache-overflows
 fail2ban/tests/files/logs/assp
 fail2ban/tests/files/logs/asterisk
+fail2ban/tests/files/logs/counter-strike
 fail2ban/tests/files/logs/courier-auth
 fail2ban/tests/files/logs/courier-smtp
 fail2ban/tests/files/logs/cyrus-imap
@@ -173,6 +174,7 @@ config/filter.d/apache-nohome.conf
 config/filter.d/apache-noscript.conf
 config/filter.d/apache-overflows.conf
 config/filter.d/nginx-http-auth.conf
+config/filter.d/counter-strike.conf
 config/filter.d/courier-auth.conf
 config/filter.d/courier-smtp.conf
 config/filter.d/cyrus-imap.conf

THANKS

@@ -66,6 +66,7 @@ Merijn Schering
 Michael C. Haller
 Michael Hanselmann
 Nick Munger
+onorua
 Patrick Börjesson
 Raphaël Marichez
 RealRancor

config/filter.d/counter-strike.conf

@@ -0,0 +1,16 @@
+# Fail2Ban filter for failure attempts in Counter Strike-1.6
+#
+#
+
+[Definition]
+
+failregex = ^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$
+
+
+[Init]
+
+datepattern = ^L %%d/%%m/%%Y - %%H:%%M:%%S
+
+
+# Author: Daniel Black
+

fail2ban/tests/files/logs/counter-strike

@@ -0,0 +1,4 @@
+# failJSON: { "time": "2014-01-01T01:25:17", "match": true, "host": "31.29.29.89" }
+L 01/01/2014 - 01:25:17: Bad Rcon: "rcon 1146003691 "284"  sv_contact "HLBrute 1.10"" from "31.29.29.89:57370"
+# failJSON: { "time": "2014-01-01T04:17:01", "match": true, "host": "105.158.241.147" }
+L 01/01/2014 - 04:17:01: Bad Rcon: "rcon 260639614 "admin"  sv_contact "HLBrute 1.10"" from "105.158.241.147:53772"