From 5d451bc4d6e5d18f583df56c9899c04eb8fd084e Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 18 Aug 2013 22:19:31 +1000 Subject: [PATCH 1/3] ENH: add refused zone tranfer to named-refused filter. closes #323 --- ChangeLog | 2 ++ THANKS | 1 + config/filter.d/named-refused.conf | 1 + testcases/files/logs/named-refused | 2 ++ 4 files changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 51539e8c..ccb56b67 100644 --- a/ChangeLog +++ b/ChangeLog @@ -61,6 +61,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests Steven Hiscocks * filter.d/dovecot - Addition of session, time values and possible blank user + Zurd and Daniel Black + * filter/named-refused - added refused on zone transfer ver. 0.8.10 (2013/06/12) - wanna-be-secure ----------- diff --git a/THANKS b/THANKS index b853c0dc..76c9f000 100644 --- a/THANKS +++ b/THANKS @@ -56,3 +56,4 @@ Yaroslav Halchenko ykimon Yehuda Katz zugeschmiert +Zurd diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf index 1cdc626e..e30afee7 100644 --- a/config/filter.d/named-refused.conf +++ b/config/filter.d/named-refused.conf @@ -26,6 +26,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)? # Values: TEXT # failregex = %(__line_prefix)sclient #\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$ + %(__line_prefix)sclient #\S+: zone transfer '\S+/AXFR/\w+' denied\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused index 6f6092e2..7a77919f 100644 --- a/testcases/files/logs/named-refused +++ b/testcases/files/logs/named-refused @@ -10,3 +10,5 @@ Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shi Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied # failJSON: { "time": "2005-07-24T14:23:36", "match": true , "host": "62.109.4.89" } Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied +# failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" } +11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied From 444e989dd5f6995197065b6654ea14d1f14d3523 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 18 Aug 2013 22:49:59 +1000 Subject: [PATCH 2/3] TST: another zone transfer refused example for file named-refused --- testcases/files/logs/named-refused | 3 +++ 1 file changed, 3 insertions(+) diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused index 7a77919f..6746e72a 100644 --- a/testcases/files/logs/named-refused +++ b/testcases/files/logs/named-refused @@ -12,3 +12,6 @@ Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mie Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied # failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" } 11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied +# failJSON: { "time": "2005-08-17T08:20:22", "match": true , "host": "223.252.23.219" } +Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone transfer 'openquery.eu/AXFR/IN' denied + From 4f39d2b1fdf8feaa2abf67fb40b68eca7aeeaa85 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sun, 18 Aug 2013 23:04:53 +1000 Subject: [PATCH 3/3] TST: fix failJson year --- testcases/files/logs/named-refused | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused index 6746e72a..04b0e34f 100644 --- a/testcases/files/logs/named-refused +++ b/testcases/files/logs/named-refused @@ -12,6 +12,6 @@ Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mie Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied # failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" } 11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied -# failJSON: { "time": "2005-08-17T08:20:22", "match": true , "host": "223.252.23.219" } +# failJSON: { "time": "2004-08-17T08:20:22", "match": true , "host": "223.252.23.219" } Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone transfer 'openquery.eu/AXFR/IN' denied