orion pushed to rpms/fail2ban (epel8). "Rebuilt for Python 3.11"
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:03 UTC
From 3673f99947ab3587437fe955102c8cd93b06c4af Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint(a)redhat.com>
Date: Jun 15 2022 16:15:35 +0000
Subject: Rebuilt for Python 3.11
---
diff --git a/fail2ban.spec b/fail2ban.spec
index 9603304..a0a6a11 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -1,6 +1,6 @@
Name: fail2ban
Version: 0.11.2
-Release: 12%{?dist}
+Release: 13%{?dist}
Summary: Daemon to ban hosts that cause multiple authentication errors
License: GPLv2+
@@ -407,6 +407,9 @@ fi
%changelog
+* Wed Jun 15 2022 Python Maint <python-maint(a)redhat.com> - 0.11.2-13
+- Rebuilt for Python 3.11
+
* Wed May 18 2022 Orion Poplawski <orion(a)nwra.com> - 0.11.2-12
- Fix SELinux policy to allow watch on var_log_t (bz#2083923)
https://src.fedoraproject.org/rpms/fail2ban/c/3673f99947ab3587437fe955102...
1Â year
orion pushed to rpms/fail2ban (epel8). "Rebuilt for Python 3.10"
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:03 UTC
From 27db463db8e4aee76fd7a3db97a0f3dac28e9c3b Mon Sep 17 00:00:00 2001
From: Python Maint <python-maint(a)redhat.com>
Date: Jun 07 2021 09:13:15 +0000
Subject: Rebuilt for Python 3.10
---
diff --git a/fail2ban.spec b/fail2ban.spec
index 7c15cc2..4b5127d 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -1,6 +1,6 @@
Name: fail2ban
Version: 0.11.2
-Release: 6%{?dist}
+Release: 7%{?dist}
Summary: Daemon to ban hosts that cause multiple authentication errors
License: GPLv2+
@@ -397,6 +397,9 @@ fi
%changelog
+* Mon Jun 07 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-7
+- Rebuilt for Python 3.10
+
* Sun Jun 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-6
- Update selinux policy for Fedora 34+
https://src.fedoraproject.org/rpms/fail2ban/c/27db463db8e4aee76fd7a3db97a...
1Â year
orion pushed to rpms/fail2ban (epel8). "Add bash completion file"
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:04 UTC
From b4bdb39ec1b76bf18826d82d3a6fe86b1707a96f Mon Sep 17 00:00:00 2001
From: Paweł Marciniak <sunwire+git(a)gmail.com>
Date: Aug 15 2022 11:58:10 +0000
Subject: Add bash completion file
---
diff --git a/fail2ban.spec b/fail2ban.spec
index d03608d..15154d5 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -48,6 +48,7 @@ BuildRequires: sqlite
BuildRequires: systemd
BuildRequires: selinux-policy-devel
BuildRequires: make
+BuildRequires: bash-completion
# Default components
Requires: %{name}-firewalld = %{version}-%{release}
@@ -294,6 +295,10 @@ rm -r %{buildroot}%{_docdir}/%{name}
install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+#BASH completion
+COMPLETIONDIR=%{buildroot}$(pkg-config --variable=completionsdir bash-completion)
+%__mkdir_p $COMPLETIONDIR
+%__install -p -m 644 files/bash-completion $COMPLETIONDIR/fail2ban
%check
%if 0%{?rhel} && 0%{?rhel} < 8
@@ -348,6 +353,7 @@ fi
%exclude %{python3_sitelib}/fail2ban/tests
%endif
%{_unitdir}/fail2ban.service
+%{_datadir}/bash-completion/
%{_mandir}/man1/fail2ban.1*
%{_mandir}/man1/fail2ban-client.1*
%{_mandir}/man1/fail2ban-python.1*
https://src.fedoraproject.org/rpms/fail2ban/c/b4bdb39ec1b76bf18826d82d3a6...
1Â year
orion pushed to rpms/fail2ban (epel8). "Fix selinux requires for EPEL7/8"
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:04 UTC
From d94388bb16212d9063fdb4fcfc0ec3e05cfd8f6b Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion(a)nwra.com>
Date: Mar 30 2023 00:17:35 +0000
Subject: Fix selinux requires for EPEL7/8
---
diff --git a/fail2ban.spec b/fail2ban.spec
index 108f1c9..4814fb2 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -89,9 +89,10 @@ Requires: nftables
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
-
-%if 0%{?fedora} || 0%{?rhel} >= 9
+%if 0%{?fedora} || 0%{?rhel} >= 8
Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
+%else
+Requires: %{name}-selinux
%endif
%description server
https://src.fedoraproject.org/rpms/fail2ban/c/d94388bb16212d9063fdb4fcfc0...
1Â year
orion pushed to rpms/fail2ban (epel8). "Back port selinux policy for EL8"
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:04 UTC
From 5b326afa431c26d3ad384b9c02623bb8f69a0645 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion(a)nwra.com>
Date: Mar 30 2023 16:19:55 +0000
Subject: Back port selinux policy for EL8
---
diff --git a/fail2ban.te b/fail2ban.te
index 6d36a70..c8009ad 100644
--- a/fail2ban.te
+++ b/fail2ban.te
@@ -99,18 +99,40 @@ logging_read_syslog_pid(fail2ban_t)
logging_dontaudit_search_audit_logs(fail2ban_t)
logging_mmap_generic_logs(fail2ban_t)
logging_mmap_journal(fail2ban_t)
+gen_require(`
+ type var_log_t, auditd_log_t;
+ class dir { watch };
+ class file { watch };
+')
allow fail2ban_t fail2ban_log_t:file watch;
# Not in EL9 yet
#logging_watch_audit_log_files(fail2ban_t)
gen_require(`
type var_log_t, auditd_log_t;
')
-watch_files_pattern(fail2ban_t, auditd_log_t, auditd_log_t)
+# Not in EL8
+#watch_files_pattern(fail2ban_t, auditd_log_t, auditd_log_t)
+allow fail2ban_t auditd_log_t:dir search_dir_perms;
+allow fail2ban_t auditd_log_t:file { getattr watch };
#logging_watch_audit_log_dirs(fail2ban_t)
allow fail2ban_t var_log_t:dir search_dir_perms;
-watch_dirs_pattern(fail2ban_t, auditd_log_t, auditd_log_t)
-logging_watch_generic_log_dirs(fail2ban_t)
-logging_watch_journal_dir(fail2ban_t)
+
+# Not in EL8
+#watch_dirs_pattern(fail2ban_t, auditd_log_t, auditd_log_t)
+allow fail2ban_t auditd_log_t:dir search_dir_perms;
+allow fail2ban_t auditd_log_t:dir { getattr watch };
+
+# Not in EL8
+#logging_watch_generic_log_dirs(fail2ban_t)
+files_search_var(fail2ban_t)
+allow fail2ban_t var_log_t:dir { getattr watch };
+
+# Not in EL8
+#logging_watch_journal_dir(fail2ban_t)
+gen_require(`
+ type syslogd_var_run_t;
+')
+allow fail2ban_t syslogd_var_run_t:dir { getattr watch };
mta_send_mail(fail2ban_t)
https://src.fedoraproject.org/rpms/fail2ban/c/5b326afa431c26d3ad384b9c026...
1Â year
orion pushed to rpms/fail2ban (epel8). "Add patch for dovecot eating
100% CPU."
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:04 UTC
From 97585e18cb8ac4eab074108bba221293ba3a2e9d Mon Sep 17 00:00:00 2001
From: Richard Shaw <hobbes1069(a)gmail.com>
Date: Nov 02 2022 14:28:22 +0000
Subject: Add patch for dovecot eating 100% CPU.
---
diff --git a/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch
new file mode 100644
index 0000000..a00358f
--- /dev/null
+++ b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch
@@ -0,0 +1,99 @@
+From ca2b94c5229bd474f612b57b67d796252a4aab7a Mon Sep 17 00:00:00 2001
+From: sebres <serg.brester(a)sebres.de>
+Date: Tue, 4 Oct 2022 14:03:07 +0200
+Subject: [PATCH] fixes gh-3370: resolve extremely long search by repeated
+ apply of non-greedy RE `(?:: (?:[^\(]+|\w+\([^\)]*\))+)?` with following
+ branches (it may be extremely slow up to infinite search depending on
+ message); added new regression tests amend to gh-3210: fixes regression and
+ matches new format in aggressive mode too
+
+---
+ ChangeLog | 4 ++++
+ config/filter.d/dovecot.conf | 8 +++++---
+ fail2ban/tests/files/logs/dovecot | 22 ++++++++++++++++++++++
+ 3 files changed, 31 insertions(+), 3 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index fc4beade6e..04401ea866 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -11,6 +11,10 @@ ver. 1.0.2-dev-1 (20??/??/??) - development nightly edition
+ -----------
+
+ ### Fixes
++* `filter.d/dovecot.conf`:
++ - fixes regression introduced in gh-3210: resolve extremely long search by repeated apply of non-greedy RE-part
++ with following branches (it may be extremely slow up to infinite search depending on message), gh-3370
++ - fixes regression and matches new format in aggressive mode too (amend to gh-3210)
+
+ ### New Features and Enhancements
+
+diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
+index 0415ecb40a..dc3ebbcd42 100644
+--- a/config/filter.d/dovecot.conf
++++ b/config/filter.d/dovecot.conf
+@@ -7,19 +7,21 @@ before = common.conf
+
+ [Definition]
+
++_daemon = (?:dovecot(?:-auth)?|auth)
++
+ _auth_worker = (?:dovecot: )?auth(?:-worker)?
+ _auth_worker_info = (?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
+-_daemon = (?:dovecot(?:-auth)?|auth)
++_bypass_reject_reason = (?:: (?:\w+\([^\):]*\) \w+|[^\(]+))*
+
+ prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$
+
+ failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
+- ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?:: (?:[^\(]+|\w+\([^\)]*\))+)? \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
++ ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+ ^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \([Pp]assword mismatch\?\)|Permission denied)\s*$
+ ^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch)
+ <mdre-<mode>>
+
+-mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?::(?: [^ \(]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
++mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+
+ mdre-normal =
+
+diff --git a/fail2ban/tests/files/logs/dovecot b/fail2ban/tests/files/logs/dovecot
+index 75934c37bb..0e33296129 100644
+--- a/fail2ban/tests/files/logs/dovecot
++++ b/fail2ban/tests/files/logs/dovecot
+@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot: imap-login: Disconnected (auth failed,
+ # failJSON: { "time": "2004-08-28T06:38:52", "match": true , "host": "192.0.2.4", "desc": "open parenthesis in optional part between Disconnected and (auth failed ...), gh-3210" }
+ Aug 28 06:38:52 s166-62-100-187 dovecot: imap-login: Disconnected: Connection closed: read(size=1003) failed: Connection reset by peer (auth failed, 1 attempts in 0 secs): user=<test(a)example.com>, rip=192.0.2.4, lip=127.0.0.19, session=<Lsz0Oo7WXti3b7xe>
+
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
++
+ # failJSON: { "time": "2004-08-29T03:17:18", "match": true , "host": "192.0.2.133" }
+ Aug 29 03:17:18 server dovecot: submission-login: Client has quit the connection (auth failed, 1 attempts in 2 secs): user=<user1>, method=LOGIN, rip=192.0.2.133, lip=0.0.0.0
+ # failJSON: { "time": "2004-08-29T03:53:52", "match": true , "host": "192.0.2.169" }
+@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesieve-login: Disconnected: Too many invali
+
+ # filterOptions: [{"mode": "aggressive"}]
+
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
++
+ # failJSON: { "time": "2004-08-29T16:06:58", "match": true , "host": "192.0.2.5" }
+ Aug 29 16:06:58 s166-62-100-187 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.0.2.5, lip=192.168.1.2, TLS handshaking: SSL_accept() syscall failed: Connection reset by peer
+ # failJSON: { "time": "2004-08-31T16:15:10", "match": true , "host": "192.0.2.6" }
diff --git a/fail2ban.spec b/fail2ban.spec
index ab21ecf..8bada15 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -1,6 +1,6 @@
Name: fail2ban
Version: 1.0.1
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: Daemon to ban hosts that cause multiple authentication errors
License: GPLv2+
@@ -17,6 +17,8 @@ Source4: Makefile
Patch0: fail2ban-partof.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2034205
Patch1: fail2ban-python311.patch
+# Patch for dovecot jail eating 100% CPU
+Patch2: https://github.com/fail2ban/fail2ban/commit/ca2b94c5229bd474f612b57b67d79...
BuildArch: noarch
@@ -403,6 +405,9 @@ fi
%changelog
+* Wed Nov 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-2
+- Add patch for dovecot eating 100% CPU.
+
* Sun Oct 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-1
- Update to 1.0.1.
https://src.fedoraproject.org/rpms/fail2ban/c/97585e18cb8ac4eab074108bba2...
1Â year
orion pushed to rpms/fail2ban (epel8). "Merge branch 'rawhide' into epel8"
by notificationsï¼ fedoraproject.org
Notification time stamped 2023-03-31 22:34:04 UTC
From 0b591ce88f39b7e1851a187c0d67f697354fb83c Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion(a)nwra.com>
Date: Mar 30 2023 16:11:26 +0000
Subject: Merge branch 'rawhide' into epel8
---
diff --git a/.gitignore b/.gitignore
index 0df6ce0..7fbd936 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,5 @@ fail2ban-0.8.4.tar.bz2
/fail2ban-0.10.5.tar.gz
/fail2ban-0.11.1.tar.gz
/fail2ban-0.11.2.tar.gz
+/fail2ban-1.0.1.tar.gz
+/fail2ban-1.0.2.tar.gz
diff --git a/.rpmlint b/.rpmlint
deleted file mode 100644
index 05ddcce..0000000
--- a/.rpmlint
+++ /dev/null
@@ -1,8 +0,0 @@
-from Config import *
-addFilter("incoherent-logrotate-file /etc/logrotate.d/fail2ban");
-addFilter("macro-in-comment %{(name|version|release)}");
-addFilter("spelling-error .* (tcp|sendmail|shorewall|sshd)");
-# Tests
-addFilter("hidden-file-or-dir .*fail2ban/tests/files/config/apache.*/\.htpasswd");
-addFilter("htaccess-file-error .*fail2ban/tests/files/config/apache.*/\.htaccess");
-addFilter("zero-length .*fail2ban/tests/files/files/");
diff --git a/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch
new file mode 100644
index 0000000..02a9ae5
--- /dev/null
+++ b/ca2b94c5229bd474f612b57b67d796252a4aab7a.patch
@@ -0,0 +1,84 @@
+From ca2b94c5229bd474f612b57b67d796252a4aab7a Mon Sep 17 00:00:00 2001
+From: sebres <serg.brester(a)sebres.de>
+Date: Tue, 4 Oct 2022 14:03:07 +0200
+Subject: [PATCH] fixes gh-3370: resolve extremely long search by repeated
+ apply of non-greedy RE `(?:: (?:[^\(]+|\w+\([^\)]*\))+)?` with following
+ branches (it may be extremely slow up to infinite search depending on
+ message); added new regression tests amend to gh-3210: fixes regression and
+ matches new format in aggressive mode too
+
+---
+ ChangeLog | 4 ++++
+ config/filter.d/dovecot.conf | 8 +++++---
+ fail2ban/tests/files/logs/dovecot | 22 ++++++++++++++++++++++
+ 3 files changed, 31 insertions(+), 3 deletions(-)
+
+Index: fail2ban-1.0.1/config/filter.d/dovecot.conf
+===================================================================
+--- fail2ban-1.0.1.orig/config/filter.d/dovecot.conf
++++ fail2ban-1.0.1/config/filter.d/dovecot.conf
+@@ -7,19 +7,21 @@ before = common.conf
+
+ [Definition]
+
++_daemon = (?:dovecot(?:-auth)?|auth)
++
+ _auth_worker = (?:dovecot: )?auth(?:-worker)?
+ _auth_worker_info = (?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
+-_daemon = (?:dovecot(?:-auth)?|auth)
++_bypass_reject_reason = (?:: (?:\w+\([^\):]*\) \w+|[^\(]+))*
+
+ prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$
+
+ failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
+- ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?:: (?:[^\(]+|\w+\([^\)]*\))+)? \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
++ ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+ ^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \([Pp]assword mismatch\?\)|Permission denied)\s*$
+ ^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch)
+ <mdre-<mode>>
+
+-mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?::(?: [^ \(]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
++mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+
+ mdre-normal =
+
+Index: fail2ban-1.0.1/fail2ban/tests/files/logs/dovecot
+===================================================================
+--- fail2ban-1.0.1.orig/fail2ban/tests/files/logs/dovecot
++++ fail2ban-1.0.1/fail2ban/tests/files/logs/dovecot
+@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot:
+ # failJSON: { "time": "2004-08-28T06:38:52", "match": true , "host": "192.0.2.4", "desc": "open parenthesis in optional part between Disconnected and (auth failed ...), gh-3210" }
+ Aug 28 06:38:52 s166-62-100-187 dovecot: imap-login: Disconnected: Connection closed: read(size=1003) failed: Connection reset by peer (auth failed, 1 attempts in 0 secs): user=<test(a)example.com>, rip=192.0.2.4, lip=127.0.0.19, session=<Lsz0Oo7WXti3b7xe>
+
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
++
+ # failJSON: { "time": "2004-08-29T03:17:18", "match": true , "host": "192.0.2.133" }
+ Aug 29 03:17:18 server dovecot: submission-login: Client has quit the connection (auth failed, 1 attempts in 2 secs): user=<user1>, method=LOGIN, rip=192.0.2.133, lip=0.0.0.0
+ # failJSON: { "time": "2004-08-29T03:53:52", "match": true , "host": "192.0.2.169" }
+@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesi
+
+ # filterOptions: [{"mode": "aggressive"}]
+
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
++# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
++Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
++
+ # failJSON: { "time": "2004-08-29T16:06:58", "match": true , "host": "192.0.2.5" }
+ Aug 29 16:06:58 s166-62-100-187 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.0.2.5, lip=192.168.1.2, TLS handshaking: SSL_accept() syscall failed: Connection reset by peer
+ # failJSON: { "time": "2004-08-31T16:15:10", "match": true , "host": "192.0.2.6" }
diff --git a/fail2ban-python311.patch b/fail2ban-python311.patch
new file mode 100644
index 0000000..8a89af7
--- /dev/null
+++ b/fail2ban-python311.patch
@@ -0,0 +1,21 @@
+Index: fail2ban-1.0.1/fail2ban/tests/actiontestcase.py
+===================================================================
+--- fail2ban-1.0.1.orig/fail2ban/tests/actiontestcase.py
++++ fail2ban-1.0.1/fail2ban/tests/actiontestcase.py
+@@ -242,14 +242,14 @@ class CommandActionTest(LogCaptureTestCa
+ setattr(self.__action, 'ab', "<ac>")
+ setattr(self.__action, 'x?family=inet6', "")
+ # produce self-referencing properties except:
+- self.assertRaisesRegexp(ValueError, r"properties contain self referencing definitions",
++ self.assertRaisesRegex(ValueError, r"properties contain self referencing definitions",
+ lambda: self.__action.replaceTag("<a><b>",
+ self.__action._properties, conditional="family=inet4")
+ )
+ # remore self-referencing in props:
+ delattr(self.__action, 'ac')
+ # produce self-referencing query except:
+- self.assertRaisesRegexp(ValueError, r"possible self referencing definitions in query",
++ self.assertRaisesRegex(ValueError, r"possible self referencing definitions in query",
+ lambda: self.__action.replaceTag("<x"*30+">"*30,
+ self.__action._properties, conditional="family=inet6")
+ )
diff --git a/fail2ban.rpmlintrc b/fail2ban.rpmlintrc
new file mode 100644
index 0000000..05ddcce
--- /dev/null
+++ b/fail2ban.rpmlintrc
@@ -0,0 +1,8 @@
+from Config import *
+addFilter("incoherent-logrotate-file /etc/logrotate.d/fail2ban");
+addFilter("macro-in-comment %{(name|version|release)}");
+addFilter("spelling-error .* (tcp|sendmail|shorewall|sshd)");
+# Tests
+addFilter("hidden-file-or-dir .*fail2ban/tests/files/config/apache.*/\.htpasswd");
+addFilter("htaccess-file-error .*fail2ban/tests/files/config/apache.*/\.htaccess");
+addFilter("zero-length .*fail2ban/tests/files/files/");
diff --git a/fail2ban.spec b/fail2ban.spec
index 3802981..4814fb2 100644
--- a/fail2ban.spec
+++ b/fail2ban.spec
@@ -1,6 +1,6 @@
Name: fail2ban
-Version: 0.11.2
-Release: 1%{?dist}
+Version: 1.0.2
+Release: 2%{?dist}
Summary: Daemon to ban hosts that cause multiple authentication errors
License: GPLv2+
@@ -11,10 +11,16 @@ Source1: fail2ban.fc
Source2: fail2ban.if
Source3: fail2ban.te
Source4: Makefile
+
# Give up being PartOf iptables and ipset for now
# https://bugzilla.redhat.com/show_bug.cgi?id=1379141
# https://bugzilla.redhat.com/show_bug.cgi?id=1573185
Patch0: fail2ban-partof.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2034205
+Patch1: fail2ban-python311.patch
+# Patch for dovecot jail eating 100% CPU
+#Patch2: https://github.com/fail2ban/fail2ban/commit/ca2b94c5229bd474f612b57b67d79...
+
BuildArch: noarch
@@ -33,6 +39,8 @@ BuildRequires: python3-inotify
BuildRequires: sqlite
BuildRequires: systemd
BuildRequires: selinux-policy-devel
+BuildRequires: make
+BuildRequires: bash-completion
# Default components
Requires: %{name}-firewalld = %{version}-%{release}
@@ -81,9 +89,10 @@ Requires: nftables
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd
-
-%if 0%{?fedora}
+%if 0%{?fedora} || 0%{?rhel} >= 8
Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
+%else
+Requires: %{name}-selinux
%endif
%description server
@@ -148,7 +157,7 @@ This package contains Fail2Ban's testscases and scripts.
%package mail
Summary: Mail actions for Fail2Ban
Requires: %{name}-server = %{version}-%{release}
-Requires: mailx
+Requires: /usr/bin/mail
%description mail
This package installs Fail2Ban's mail actions. These are an alternative
@@ -207,6 +216,10 @@ find -type f -exec sed -i -e '1s,^#!/usr/bin/python *,#!/usr/bin/python%{python3
# SELinux sources
cp -p %SOURCE1 %SOURCE2 %SOURCE3 .
+# 2to3 has been removed from setuptools and we already use the binary in
+# %%prep.
+sed -i "/use_2to3/d" setup.py
+
%build
%if 0%{?rhel} && 0%{?rhel} < 8
@@ -216,6 +229,7 @@ cp -p %SOURCE1 %SOURCE2 %SOURCE3 .
%endif
make -f %SOURCE4
+
%install
%if 0%{?rhel} && 0%{?rhel} < 8
%py2_install
@@ -253,8 +267,8 @@ cat > %{buildroot}%{_sysconfdir}/%{name}/jail.d/00-firewalld.conf <<EOF
# the firewalld actions as the default actions. You can remove this package
# (along with the empty fail2ban meta-package) if you do not use firewalld
[DEFAULT]
-banaction = firewallcmd-rich-rules[actiontype=<multiport>]
-banaction_allports = firewallcmd-rich-rules[actiontype=<allports>]
+banaction = firewallcmd-rich-rules
+banaction_allports = firewallcmd-rich-rules
EOF
# systemd journal configuration
@@ -275,6 +289,11 @@ rm -r %{buildroot}%{_docdir}/%{name}
install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
install -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+#BASH completion
+COMPLETIONDIR=%{buildroot}$(pkg-config --variable=completionsdir bash-completion)
+%__mkdir_p $COMPLETIONDIR
+%__install -p -m 644 files/bash-completion $COMPLETIONDIR/fail2ban
+
%check
%if 0%{?rhel} && 0%{?rhel} < 8
@@ -329,13 +348,14 @@ fi
%exclude %{python3_sitelib}/fail2ban/tests
%endif
%{_unitdir}/fail2ban.service
+%{_datadir}/bash-completion/
%{_mandir}/man1/fail2ban.1*
%{_mandir}/man1/fail2ban-client.1*
%{_mandir}/man1/fail2ban-python.1*
%{_mandir}/man1/fail2ban-regex.1*
%{_mandir}/man1/fail2ban-server.1*
%{_mandir}/man5/*.5*
-%config(noreplace) %{_sysconfdir}/fail2ban
+%config(noreplace) %{_sysconfdir}/fail2ban/
%exclude %{_sysconfdir}/fail2ban/action.d/complain.conf
%exclude %{_sysconfdir}/fail2ban/action.d/hostsdeny.conf
%exclude %{_sysconfdir}/fail2ban/action.d/mail.conf
@@ -389,6 +409,58 @@ fi
%changelog
+* Thu Jan 19 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Dec 17 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.2-1
+- Update to 1.0.2.
+
+* Wed Nov 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-2
+- Add patch for dovecot eating 100% CPU.
+
+* Sun Oct 02 2022 Richard Shaw <hobbes1069(a)gmail.com> - 1.0.1-1
+- Update to 1.0.1.
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed Jun 15 2022 Python Maint <python-maint(a)redhat.com> - 0.11.2-13
+- Rebuilt for Python 3.11
+
+* Wed May 18 2022 Orion Poplawski <orion(a)nwra.com> - 0.11.2-12
+- Fix SELinux policy to allow watch on var_log_t (bz#2083923)
+
+* Fri Jan 28 2022 Orion Poplawski <orion(a)nwra.com> - 0.11.2-11
+- Require /usr/bin/mail instead of mailx
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sun Sep 26 2021 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 0.11.2-9
+- Fix CVE-2021-32749 RHBZ#1983223
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon Jun 07 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-7
+- Rebuilt for Python 3.10
+
+* Sun Jun 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-6
+- Update selinux policy for Fedora 34+
+
+* Fri Jun 04 2021 Python Maint <python-maint(a)redhat.com> - 0.11.2-5
+- Rebuilt for Python 3.10
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.11.2-4
+- Rebuilt for updated systemd-rpm-macros
+ See https://pagure.io/fesco/issue/2583.
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.11.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jan 06 2021 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-2
+- Add patch to deal with a new century in tests (2021).
+
* Tue Nov 24 2020 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-1
- Update to 0.11.2.
diff --git a/fail2ban.te b/fail2ban.te
index 302f4bc..6d36a70 100644
--- a/fail2ban.te
+++ b/fail2ban.te
@@ -88,7 +88,6 @@ files_read_etc_runtime_files(fail2ban_t)
files_list_var(fail2ban_t)
files_dontaudit_list_tmp(fail2ban_t)
-fs_list_inotifyfs(fail2ban_t)
fs_getattr_all_fs(fail2ban_t)
auth_use_nsswitch(fail2ban_t)
@@ -100,6 +99,18 @@ logging_read_syslog_pid(fail2ban_t)
logging_dontaudit_search_audit_logs(fail2ban_t)
logging_mmap_generic_logs(fail2ban_t)
logging_mmap_journal(fail2ban_t)
+allow fail2ban_t fail2ban_log_t:file watch;
+# Not in EL9 yet
+#logging_watch_audit_log_files(fail2ban_t)
+gen_require(`
+ type var_log_t, auditd_log_t;
+')
+watch_files_pattern(fail2ban_t, auditd_log_t, auditd_log_t)
+#logging_watch_audit_log_dirs(fail2ban_t)
+allow fail2ban_t var_log_t:dir search_dir_perms;
+watch_dirs_pattern(fail2ban_t, auditd_log_t, auditd_log_t)
+logging_watch_generic_log_dirs(fail2ban_t)
+logging_watch_journal_dir(fail2ban_t)
mta_send_mail(fail2ban_t)
diff --git a/sources b/sources
index d48c0ea..6655594 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (fail2ban-0.11.2.tar.gz) = 46b27abd947b00ea64106dbac563ef8afef38eec86684024d47d9a0e8c1969ff864ad6df7f4f8de2aa3eb1af6d769fb6796592d9f0e35521d5f95f17b8cade97
+SHA512 (fail2ban-1.0.2.tar.gz) = 688a84361b5794e1658f53d2d200ce752fe1e3320ddb1742c32c4b4b82a79ace16ae464e7ea3eeb94a0e862bcac73c2d3a0e61dd7b28e179a4c857f950d74dbb
https://src.fedoraproject.org/rpms/fail2ban/c/0b591ce88f39b7e1851a187c0d6...
1Â year