[fail2ban/f19] Include post-release patch for apache-auth filter

Adam Tkac atkac at fedoraproject.org
Tue Dec 3 15:19:52 UTC 2013 

commit 594618426a28507baddee0313989d76b77d3b241
Author: Adam Tkac <vonsch at gmail.com>
Date:   Tue Dec 3 14:10:47 2013 +0100

    Include post-release patch for apache-auth filter
    
    Signed-off-by: Adam Tkac <vonsch at gmail.com>

 ...ilters-using-error-log-weren-t-matched-wh.patch |   99 ++++++++++++++++++++
 fail2ban.spec                                      |    7 +-
 2 files changed, 105 insertions(+), 1 deletions(-)
---
diff --git a/0001-BF-apache-filters-using-error-log-weren-t-matched-wh.patch b/0001-BF-apache-filters-using-error-log-weren-t-matched-wh.patch
new file mode 100644
index 0000000..e30916c
--- /dev/null
+++ b/0001-BF-apache-filters-using-error-log-weren-t-matched-wh.patch
@@ -0,0 +1,99 @@
+From 284f811c912af2f683c7eb150011337912516934 Mon Sep 17 00:00:00 2001
+From: Daniel Black <grooverdan at users.sourceforge.net>
+Date: Tue, 19 Nov 2013 10:27:55 +1100
+Subject: [PATCH] BF: apache filters using error log weren't matched when
+ referer existed in HTTP header
+
+---
+ config/filter.d/apache-auth.conf      | 26 ++++++++++++++------------
+ config/filter.d/apache-noscript.conf  |  4 ++--
+ config/filter.d/apache-overflows.conf |  2 +-
+ testcases/files/logs/apache-auth      |  3 +++
+ 6 files changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
+index 3df91c1..f421348 100644
+--- a/config/filter.d/apache-auth.conf
++++ b/config/filter.d/apache-auth.conf
+@@ -10,19 +10,19 @@ before = apache-common.conf
+ [Definition]
+ 
+ 
+-failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*\s*$
+-            ^%(_apache_error_client)s (AH01617: )?user .* authentication failure for "\S*": Password Mismatch$
+-            ^%(_apache_error_client)s (AH01618: )?user .* not found(: )?\S*\s*$
+-            ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*\s*$
++failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
++            ^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$
+             ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
+-            ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$
+-            ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
+-            ^%(_apache_error_client)s (AH01631: )?user .*: authorization failure for "\S*":\s*$
+-            ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+\s*$
+-            ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*' but expected `.+'\s*$
+-            ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*' received: \S*\s*$
+-            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*$
+-            ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .* received - user attempted time travel\s*$
++            ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*?: password mismatch: \S*(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*?' in realm `.+' (not found|denied by provider): \S*(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01631: )?user .*?: authorization failure for "\S*":(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*?' received: \S*(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*?' received: \S*(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$
+ 
+ ignoreregex = 
+ 
+@@ -50,5 +50,7 @@ ignoreregex =
+ #     ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
+ #     ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
+ #
++# referer is always in error log messages if it exists added as per the log_error_core function in server/log.c
++# 
+ # Author: Cyril Jaquier
+ # Major edits by Daniel Black
+diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
+index f3c6246..7ea257b 100644
+--- a/config/filter.d/apache-noscript.conf
++++ b/config/filter.d/apache-noscript.conf
+@@ -9,8 +9,8 @@ before = apache-common.conf
+ 
+ [Definition]
+ 
+-failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)\s*$
+-            ^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$
++failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
++            ^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
+ 
+ ignoreregex = 
+ 
+diff --git a/config/filter.d/apache-overflows.conf b/config/filter.d/apache-overflows.conf
+index 9255152..74e44b8 100644
+--- a/config/filter.d/apache-overflows.conf
++++ b/config/filter.d/apache-overflows.conf
+@@ -8,7 +8,7 @@ before = apache-common.conf
+ 
+ [Definition]
+ 
+-failregex = ^%(_apache_error_client)s ((AH0013[456]: )?Invalid (method|URI) in request .*( - possible attempt to establish SSL connection on non-SSL port)?|(AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string: .*|AH00566: request failed: invalid characters in URI)$
++failregex = ^%(_apache_error_client)s ((AH0013[456]: )?Invalid (method|URI) in request .*( - possible attempt to establish SSL connection on non-SSL port)?|(AH00565: )?request failed: URI too long \(longer than \d+\)|request failed: erroneous characters after protocol string: .*|AH00566: request failed: invalid characters in URI)(, referer: \S+)?$
+ 
+ ignoreregex =
+ 
+diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
+index d6c40ac..787d160 100644
+--- a/testcases/files/logs/apache-auth
++++ b/testcases/files/logs/apache-auth
+@@ -115,3 +115,6 @@
+ 
+ # failJSON: { "time": "2013-06-01T02:17:42", "match": true , "host": "192.168.0.2" }
+ [Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found
++
++# failJSON: { "time": "2013-11-18T22:39:33", "match": true , "host": "91.49.82.139" }
++[Mon Nov 18 22:39:33 2013] [error] [client 91.49.82.139] user gg not found: /, referer: http://sj.hopto.org/management.html
+-- 
+1.8.3.1
+
diff --git a/fail2ban.spec b/fail2ban.spec
index 0f34d7a..73c695d 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -1,7 +1,7 @@
 Summary: Ban IPs that make too many password failures
 Name: fail2ban
 Version: 0.8.11
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+
 Group: System Environment/Daemons
 URL: http://fail2ban.sourceforge.net/
@@ -10,6 +10,7 @@ Source1: fail2ban-logrotate
 Patch0: fail2ban-0.8.3-init.patch
 Patch1: fail2ban-0.8.7.1-sshd.patch
 Patch6: fail2ban-log2syslog.patch
+Patch7: 0001-BF-apache-filters-using-error-log-weren-t-matched-wh.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 BuildRequires: python-devel >= 2.3
 # For testcases
@@ -45,6 +46,7 @@ and shorewall respectively.
 %patch0 -p1 -b .init
 %patch1 -p1 -b .sshd
 %patch6 -p1 -b .log2syslog
+%patch7 -p1 -b .apache-authfix
 
 %build
 python setup.py build
@@ -126,6 +128,9 @@ fi
 %dir %{_localstatedir}/lib/fail2ban/
 
 %changelog
+* Tue Dec 03 2013 Adam Tkac <vonsch at gmail.com> - 0.8.11-2
+- include post-release patch for apache-auth filter
+
 * Mon Nov 25 2013 Adam Tkac <vonsch at gmail.com> - 0.8.11-1
 - update to 0.8.11 (#1034355)
 - drop part of the fail2ban-0.8.3-init.patch (merged)

More information about the scm-commits mailing list