Merge pull request #335 from grooverdan/gh-333-bind

ENH: filter.d/named-refused.conf - BIND 9.9.3 regex changes. Closes gh-333

ChangeLog

@@ -61,6 +61,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
+   * filter.d/named-refused.conf - BIND 9.9.3 regex changes
   Daniel Black & Sebastian Arcus
    * filter.d/asterisk -- more regexes
   Yaroslav Halchenko

config/filter.d/named-refused.conf

@@ -21,15 +21,11 @@ __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)
 # this can be optional (for instance if we match named native log files)
 __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
-            %(__line_prefix)sclient <HOST>#\S+: zone transfer '\S+/AXFR/\w+' denied\s*$
 
-# Option:  ignoreregex
+# note - (\.\d+)? is a really ugly catch of the microseconds not captured in
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# in the date detector
-# Values:  TEXT
 #
-ignoreregex = 
+failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
+            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
+            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
+

testcases/files/logs/named-refused

@@ -14,4 +14,12 @@ Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query
 11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied
 # failJSON: { "time": "2004-08-17T08:20:22", "match": true , "host": "223.252.23.219" }
 Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone transfer 'openquery.eu/AXFR/IN' denied
+# https://github.com/fail2ban/fail2ban/issues/333
+# BIND9 ver: BIND 9.9.3-rpz2+rl.13208.13-P2-RedHat-9.9.3-4.P2.el6 (Extended Support Version)
+# failJSON: { "time": "2013-08-23T10:32:56", "match": true , "host": "82.207.95.42" }
+23-Aug-2013 10:32:56.621 client 82.207.95.42#40278 (redginseng.com.ua): query (cache) 'redginseng.com.ua/A/IN' denied
 
+# failJSON: { "time": "2013-08-27T17:49:45", "match": true , "host": "59.167.242.100" }
+27-Aug-2013 17:49:45.330 client 59.167.242.100#44281 (watt.kiev.ua): zone transfer 'watt.kiev.ua/AXFR/IN' denied
+# failJSON: { "time": "2004-08-27T16:58:31", "match": true , "host": "176.9.92.38" }
+Aug 27 16:58:31 vhost1-ua named[29206]: client 176.9.92.38#42592 (simmarket.com.ua): bad zone transfer request: 'simmarket.com.ua/IN': non-authoritative zone (NOTAUTH)