diff --git a/ChangeLog b/ChangeLog index e3dbd1e7..c2b6d05b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -64,6 +64,14 @@ ver. 0.10.4-dev-1 (20??/??/??) - development edition * `filter.d/dovecot.conf`: - failregex enhancement to catch sql password mismatch errors (gh-2153); - disconnected with "proxy dest auth failed" (gh-2184); +* `filter.d/freeswitch.conf`: + - provide compatibility for log-format from gh-2193: + * extended with new default date-pattern `^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)?` to cover + `YYYY-mm-dd HH:MM::SS.ms` as well as `mm-dd HH:MM::SS.ms` (so year is optional); + * more optional arguments in log-line (so accept [WARN] as well as [WARNING] and optional [SOFIA] hereafter); + - extended with mode parameter, allows to avoid matching of messages like `auth challenge (REGISTER)` + (see gh-2163) (currently `extra` as default to be backwards-compatible), see comments in filter + how to set it to mode `normal`. * `action.d/hostsdeny.conf`: fix parameter in config (dynamic parameters stating with '_' are protected and don't allowed in command-actions), see gh-2114; * decoding stability fix by wrong encoded characters like utf-8 surrogate pairs, etc (gh-2171): diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index 4759fbed..0fdcf1f1 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -18,17 +18,39 @@ before = common.conf _daemon = freeswitch +# Parameter "mode": normal, ddos or extra (default, combines all) +# Usage example (for jail.local): +# [freeswitch] +# mode = normal +# # or with rewrite filter parameters of jail: +# [freeswitch-ddos] +# filter = freeswitch[mode=ddos] +# +mode = extra + # Prefix contains common prefix line (server, daemon, etc.) and 2 datetimes if used systemd backend -_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)? +_pref_line = ^%(__prefix_line)s(?:(?:\d+-)?\d+-\d+ \d+:\d+:\d+\.\d+)? + +prefregex = ^%(_pref_line)s \[WARN(?:ING)?\](?: \[SOFIA\])? \[?sofia_reg\.c:\d+\]? .+$ + +cmnfailre = ^Can't find user \[[^@]+@[^\]]+\] from $ + +mdre-normal = %(cmnfailre)s + ^SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip $ + +mdre-ddos = ^SIP auth (?:failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip $ + +mdre-extra = %(cmnfailre)s + -failregex = %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[[^\]]*\] from ip $ - %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ Can't find user \[[^@]+@[^\]]+\] from $ +failregex = > ignoreregex = -datepattern = {^LN-BEG} +datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:\.%%f)? + {^LN-BEG} -# Author: Rupa SChomaker, soapee01, Daniel Black +# Author: Rupa SChomaker, soapee01, Daniel Black, Sergey Brester aka sebres # https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban # Thanks to Jim on mailing list of samples and guidance # diff --git a/fail2ban/tests/files/logs/freeswitch b/fail2ban/tests/files/logs/freeswitch index 2579e6f4..6a117523 100644 --- a/fail2ban/tests/files/logs/freeswitch +++ b/fail2ban/tests/files/logs/freeswitch @@ -1,5 +1,10 @@ +# filterOptions: [{}, {"mode": "ddos"}] + # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "81.94.202.251" } 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1533 SIP auth challenge (INVITE) on sofia profile 'internal' for [011448708752617@192.168.2.51] from ip 81.94.202.251 + +# filterOptions: [{}, {"mode": "normal"}] + # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "5.11.47.236" } 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1478 SIP auth failure (INVITE) on sofia profile 'internal' for [000972543480510@192.168.2.51] from ip 5.11.47.236 # failJSON: { "time": "2013-12-31T17:39:54", "match": false } @@ -13,4 +18,9 @@ # failJSON: { "time": "2016-09-25T18:57:58", "match": true, "host": "192.0.2.1", "desc": "Systemd dual time with prefix - 1st expr" } 2016-09-25T18:57:58.150982 www.srv.tld freeswitch[122921]: 2016-09-25 18:57:58.150982 [WARNING] sofia_reg.c:2889 Can't find user [201@::1] from 192.0.2.1 # failJSON: { "time": "2016-09-25T18:57:58", "match": true, "host": "192.0.2.2", "desc": "Systemd dual time with prefix - 2nd expr" } -2016-09-25T18:57:58.150982 www.srv.tld freeswitch[122921]: 2016-09-25 18:57:58.150982 [WARNING] sofia_reg.c:1720 SIP auth failure (INVITE) on sofia profile 'sipinterface_1' for [9810972597751739@::1] from ip 192.0.2.2 \ No newline at end of file +2016-09-25T18:57:58.150982 www.srv.tld freeswitch[122921]: 2016-09-25 18:57:58.150982 [WARNING] sofia_reg.c:1720 SIP auth failure (INVITE) on sofia profile 'sipinterface_1' for [9810972597751739@::1] from ip 192.0.2.2 + +# failJSON: { "time": "2005-08-03T07:56:53", "match": true, "host": "192.0.2.3", "desc": "optional year in datepattern and bit different format (gh-2193)" } +08-03 07:56:53.026292 [WARN] [SOFIA] [sofia_reg.c:4130] Can't find user [101@148.251.134.154] from 192.0.2.3 +# failJSON: { "time": "2005-08-03T08:10:21", "match": true, "host": "192.0.2.4", "desc": "optional year in datepattern and bit different format (gh-2193)" } +08-03 08:10:21.026299 [WARN] [SOFIA] [sofia_reg.c:2248] SIP auth failure (INVITE) on sofia profile 'external' for [41801148436701961@148.251.134.154] from ip 192.0.2.4