github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
4,814 Commits
32 Branches
229 Tags
18 MiB
Commit Graph

4814 Commits (654fda8a50f65c6b329d75cbac91a50aa5a8a8f5)

Author SHA1 Message Date
sebres 4efcc29384 coverage of new multi-line handling within fail2ban-regex 2017-02-22 22:20:19 +01:00
sebres 35efca5941 Better multi-line handling introduced: single-line parsing with caching of needed failure information to process in further lines. 
Many times faster and fewer CPU-hungry because of parsing with `maxlines=1`, so without line buffering (scrolling of the buffer-window).
Combination of tags `<F-MLFID>` and `<F-NOFAIL>` can be used now to process multi-line logs using single-line expressions:
- tag `<F-MLFID>`: used to identify resp. store failure info for groups of log-lines with the same identifier (e. g. combined failure-info for the same conn-id by `<F-MLFID>(?:conn-id)</F-MLFID>`, see sshd.conf for example)
- tag `<F-NOFAIL>`: used as mark for no-failure (helper to accumulate common failure-info);
filter.d/sshd.conf: [sshd], [sshd-ddos], [sshd-aggressive] optimized with pre-filtering using new option `prefregex` and new multi-line handling.
 2017-02-22 22:19:43 +01:00
sebres 8bcaeb9022 amend to 4ff8d051f49808ac769709c5aff8591fcd79040a: fixed fail2ban-regex with journalmatch using systemd-journal 2017-02-21 17:07:37 +01:00
sebres 22afdbd536 Several filters optimized with pre-filtering using new option `prefregex` 2017-02-21 15:54:59 +01:00
sebres 2fad50b6e8 Precedence of `prefregex` higher as `failregex` should be in head of the convert-stream; 
Allow using failure-id (`<HOST>`) within `prefregex` (by common prefix for all expressions specified with `failregex`)
 2017-02-21 15:54:25 +01:00
sebres 4ff8d051f4 Introduced new filter option `prefregex` for pre-filtering using single regular expression; 
Some filters extended with user name;
[filter.d/pam-generic.conf]: grave fix injection on user name to host fixed;
test-cases in testSampleRegexsFactory can now check the captured groups (using additionally fields in failJSON structure)
 2017-02-20 16:54:17 +01:00
sebres 9d15a792a5 amend to fe06ffca71e9054b21b93237c40c0c53478a19df: small optimization using already known IP family 2017-02-20 16:46:45 +01:00
sebres fe06ffca71 Fix retrieving of IPv6 address with dnsToIp on some systems (default returns AF_INET family only), fix network test-cases. 2017-02-20 12:17:28 +01:00
sebres 61c8cd11b8 Exposes filter group captures in actions (non-recursive interpolation of tags `<F-...>`); 
Closes gh-1110
 2017-02-20 11:36:08 +01:00
sebres 6d878f3a43 try to provide filter captures (already in ticket data) to the actions as interpolation options (closes gh-1110) 2017-02-17 23:47:41 +01:00
Serg G. Brester 2fa18a74c4 Merge branch 'master' into master 2017-02-17 09:06:09 +01:00
sebres a8c0cec4ac small amend with several fixes and test coverage 2017-02-16 22:13:56 +01:00
sebres 9ebf70cd6a Safer, more stable and faster replaceTag interpolation (switched from cycle over all tags to re.sub with callable) 2017-02-16 18:28:59 +01:00
sebres a6318b159b substituteRecursiveTags optimization + moved in helpers facilities (because currently used commonly in server and in client) 2017-02-16 16:01:10 +01:00
sebres 3fae8a7e43 amend to fc315be4ea88c3619f984542b21c95820f53d87b: parse and interpolate all options in section "Definition" (section "Init" no more needed), 
because of better performance with this solution;
 2017-02-16 14:53:57 +01:00
sebres 4bf09bf297 provides new tag `<ip-rev>` for PTR reversed representation of IP address; 
[action.d/complain.conf] fixed using this new tag;
 2017-02-16 13:38:20 +01:00
sebres fc315be4ea try to parse and interpolate all options in section "Definition" (section "Init" no more needed) 2017-02-16 13:32:56 +01:00
Serg G. Brester 7f63809afb Merge branch '0.10' into patch-1 2017-02-15 20:33:36 +01:00
Serg G. Brester 2d12349eac Update servertestcase.py 
Make the test-case gh-1685 compliant
 2017-02-15 20:30:48 +01:00
sebres fa20b0aff2 Merge branch 'py-3.6-compat' into 0.10-full 2017-02-15 19:18:35 +01:00
sebres abd80696ab Merge branch 'py-3.6-compat' into 0.10 2017-02-15 19:09:20 +01:00
sebres cf53a834f7 python-3.6 compatibility: 
- dynamical string replacement within call of regexp.sub fixed with lambda-replacement (otherwise "sre_constants.error: bad escape \s at position");
- optional arguments (3.6 has more agrs by calling of SMTPServer.process_message);
- implicit convert byte to string, because python3.6 fails on binary data (test_smtp).
 2017-02-15 19:05:45 +01:00
sebres 01db0b5028 small performance fix after merge with 0.10 
(cherry picked from commit 8e2711681c)
 2017-02-15 19:04:24 +01:00
sebres 63f7916886 fix test cases by testing with multi-threaded execution (wait for threaded execution done) 
(cherry picked from commit 1ec6782f32)

# Conflicts:
#	fail2ban/tests/observertestcase.py (not yet available in 0.10)
 2017-02-15 18:58:40 +01:00
sebres a4ec017d1c Merge branch '0.10' into 0.10-full 2017-02-15 09:26:01 +01:00
sebres f35aa6d258 coverage: added python3.6 2017-02-15 08:46:27 +01:00
sebres 40837754c9 python3.6 compatibility fix 2017-02-15 08:45:15 +01:00
Christoph Theis 861ce4177c #1689: Make lowest rule number in action.d/bsd-ipfw.conf configurable 2017-02-14 18:31:42 +01:00
Felix Yan 68d829c1dd
Add a path configuration for Arch Linux 2017-02-14 18:43:01 +08:00
Jan Grewe 58c68b75f0 Remove double-quotes from email addresses 2017-02-08 14:16:13 +01:00
Jan Grewe 1bcf0de7c1 Update complain.conf 2017-02-07 21:39:46 +01:00
Serg G. Brester ac7be38dbe Merge pull request #1686 from Slamdunk/postfix-rbl-554-SMTP 
Postfix RBL: 554 & SMTP
 2017-02-07 15:37:18 +01:00
Filippo Tessarotto 607568f5da Postfix RBL: 554 & SMTP 2017-02-07 15:26:06 +01:00
Jan Grewe 901eeff53d Make Abusix lookup compatible with Dash 2017-02-06 22:04:36 +01:00
sebres 8c54675750 fix sporadic time related errors after fail2ban restart resp. reload jail: 
- ValueError: need more than N values to unpack
- empty banip from restoreCurrentBans, etc.
 2017-01-23 11:45:29 +01:00
sebres 0636b3247d observer fix: wait it becomes idle in reload test case (complete writing of failures to database); 2017-01-23 09:52:04 +01:00
sebres 8e2711681c small performance fix after merge with 0.10 2017-01-23 09:51:52 +01:00
sebres 99634638ba Merge branch '0.10' into 0.10-full 2017-01-23 09:51:36 +01:00
sebres 96d404f0fb Merge branch 'master' into 0.10 2017-01-23 09:27:40 +01:00
sebres c4dc698d98 evil symlink removed: does not supported by some file systems (e. g. development over net share) 2017-01-23 09:26:05 +01:00
sebres 1823571e0f Merge branch 'ssh-filter-new-regexp' into 0.10 2017-01-23 08:58:43 +01:00
sebres c4d56ea84a Merge branch 'ssh-filter-new-regexp' 2017-01-23 08:58:03 +01:00
sebres 9d06f0ee40 sshd-amend: optional space after port part 2017-01-23 08:56:47 +01:00
sebres e8a1556562 Merge remote-tracking branch 'master' into 0.10 
# Conflicts:
#	fail2ban/tests/samplestestcase.py
 2017-01-21 16:59:41 +01:00
Serg G. Brester 3ccb026840 Merge pull request #1209 from sebres/ssh-filter-new-regexp 
sshd-aggressive (new ssh rules added (gh-864) and code review...)
 2017-01-21 16:29:42 +01:00
sebres 54a8c681ce suhosin.conf: removed greedy match 2017-01-21 16:26:07 +01:00
sebres 8aa9516d50 sshd.conf: fixed expression "received disconnect ... auth fail" - optional space after port part (gh-1652) 2017-01-21 16:18:03 +01:00
sebres c8f473110c change log update after rebase 2017-01-21 15:59:27 +01:00
sebres 3276bd6d54 sshd: additionally aggressive filter rules - no matching cipher resp. no matching key exchange method (gh-1545, gh-1117) 2017-01-21 15:57:05 +01:00
sebres 628789f9a9 sshd: conditional parameter "mode" for sshd jail (normal, ddos, aggressive) 
filter sshd-ddos and new filter sshd-aggressive are both derivation of sshd-filter
 2017-01-21 15:54:49 +01:00