Hello community,
here is the log from the commit of package tallow for openSUSE:Factory checked
in at 2019-11-07 23:15:15
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/tallow (Old)
and /work/SRC/openSUSE:Factory/.tallow.new.2990 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tallow"
Thu Nov 7 23:15:15 2019 rev:5 rq:745515 version:19+git20191104.5dfb982
Changes:
--------
--- /work/SRC/openSUSE:Factory/tallow/tallow.changes 2019-08-19
20:58:43.096956631 +0200
+++ /work/SRC/openSUSE:Factory/.tallow.new.2990/tallow.changes 2019-11-07
23:15:18.492454712 +0100
@@ -1,0 +2,20 @@
+Tue Nov 05 14:41:02 UTC 2019 - ku...@suse.de
+
+- Update to version 19+git20191104.5dfb982:
+ * v19
+ * Fixed signedness.
+
+-------------------------------------------------------------------
+Tue Oct 29 10:41:22 UTC 2019 - ku...@suse.de
+
+- Update to version 18+git20191028.83201e8:
+ * v18
+ * Hide unwanted firewalld-cmd error messages.
+ * v17
+ * Add firewalld support
+ * Fix command order in tallow.conf man page
+ * Add json-c to travis.
+ * make older compilers a bit happier
+ * add dovecot as postfix auth backend parsing
+
+-------------------------------------------------------------------
Old:
----
tallow-16+git20190425.e4b3977.tar.xz
New:
----
tallow-19+git20191104.5dfb982.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ tallow.spec ++++++
--- /var/tmp/diff_new_pack.3mT2jf/_old 2019-11-07 23:15:19.172455457 +0100
+++ /var/tmp/diff_new_pack.3mT2jf/_new 2019-11-07 23:15:19.180455465 +0100
@@ -17,7 +17,7 @@
Name: tallow
-Version: 16+git20190425.e4b3977
+Version: 19+git20191104.5dfb982
Release: 0
Summary: Temporary IP address ban issuance daemon
License: GPL-3.0-or-later
++++++ _service ++++++
--- /var/tmp/diff_new_pack.3mT2jf/_old 2019-11-07 23:15:19.228455518 +0100
+++ /var/tmp/diff_new_pack.3mT2jf/_new 2019-11-07 23:15:19.232455523 +0100
@@ -1,7 +1,7 @@
<services>
<service name="tar_scm" mode="disabled">
- <param name="version">4</param>
- <param name="versionformat">16+git%cd.%h</param>
+ <param name="version">18</param>
+ <param name="versionformat">19+git%cd.%h</param>
<param name="url">git://github.com/clearlinux/tallow.git</param>
<param name="scm">git</param>
<param name="changesgenerate">enable</param>
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.3mT2jf/_old 2019-11-07 23:15:19.252455545 +0100
+++ /var/tmp/diff_new_pack.3mT2jf/_new 2019-11-07 23:15:19.256455549 +0100
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param name="url">git://github.com/clearlinux/tallow.git</param>
- <param
name="changesrevision">e4b39777048b1ccfc815189fdb51019c5e8de903</param>
+ <param
name="changesrevision">5dfb9821e328920b871f205285e9040ea20ad63d</param>
</service>
</servicedata>
\ No newline at end of file
++++++ tallow-16+git20190425.e4b3977.tar.xz ->
tallow-19+git20191104.5dfb982.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/.travis.yml
new/tallow-19+git20191104.5dfb982/.travis.yml
--- old/tallow-16+git20190425.e4b3977/.travis.yml 2019-04-25
22:23:03.000000000 +0200
+++ new/tallow-19+git20191104.5dfb982/.travis.yml 2019-11-04
23:18:38.000000000 +0100
@@ -16,6 +16,7 @@
- valgrind
- autoconf
- automake
+ - libjson-c-dev
script:
- ./configure && make && make distcheck
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/README.md
new/tallow-19+git20191104.5dfb982/README.md
--- old/tallow-16+git20190425.e4b3977/README.md 2019-04-25 22:23:03.000000000
+0200
+++ new/tallow-19+git20191104.5dfb982/README.md 2019-11-04 23:18:38.000000000
+0100
@@ -16,7 +16,9 @@
/usr/sbin/sshd. The messages are matched against rules and the IP
address is extracted from the message. For each IP address that is
extracted, the last timestamp and count is kept. Once the count exceeds
-a threshold, iptables is executed to set a IP-based blocking rule.
+a threshold, the offending IP address is added to an ipset and blocked
+with a corresponding firewall rule. It will use firewalld or
+iptables / ip6tables.
The timestamp is kept for pruning. Records are pruned from the list
if the IP address hasn't been seen by tallow for longer than the
@@ -66,4 +68,4 @@
Be very careful if you deploy tallow on systems that expect valid
users to log on from many random source addresses. If your user
-mistypes their username, they could find themselves denied access.
+mistypes their username, they could find themselves denied access.
\ No newline at end of file
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/configure.ac
new/tallow-19+git20191104.5dfb982/configure.ac
--- old/tallow-16+git20190425.e4b3977/configure.ac 2019-04-25
22:23:03.000000000 +0200
+++ new/tallow-19+git20191104.5dfb982/configure.ac 2019-11-04
23:18:38.000000000 +0100
@@ -2,7 +2,7 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ([2.64])
-AC_INIT([tallow], [16], [auke-jan.h....@intel.com])
+AC_INIT([tallow], [19], [auke-jan.h....@intel.com])
AM_INIT_AUTOMAKE([foreign -Wall -Werror -Wno-portability silent-rules
subdir-objects color-tests
no-dist-gzip dist-xz])
AC_CONFIG_FILES([Makefile])
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/data/dovecot.json
new/tallow-19+git20191104.5dfb982/data/dovecot.json
--- old/tallow-16+git20190425.e4b3977/data/dovecot.json 1970-01-01
01:00:00.000000000 +0100
+++ new/tallow-19+git20191104.5dfb982/data/dovecot.json 2019-11-04
23:18:38.000000000 +0100
@@ -0,0 +1,12 @@
+[
+ {
+ "filter": "SYSLOG_IDENTIFIER=auth",
+ "items": [
+ {
+ "ban": 50,
+ "score": 0.6,
+ "pattern": "MESSAGE=pam_unix[(]dovecot:auth[)]: authentication
failure; logname= uid=0 euid=0 tty=dovecot ruser=.*@.* rhost=([0-9a-z:.]+)"
+ }
+ ]
+ }
+]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/man/tallow.conf.5
new/tallow-19+git20191104.5dfb982/man/tallow.conf.5
--- old/tallow-16+git20190425.e4b3977/man/tallow.conf.5 2019-04-25
22:23:03.000000000 +0200
+++ new/tallow-19+git20191104.5dfb982/man/tallow.conf.5 2019-11-04
23:18:38.000000000 +0100
@@ -1,7 +1,7 @@
.\" generated with Ronn/v0.7.3
.\" http://github.com/rtomayko/ronn/tree/0.7.3
.
-.TH "TALLOW" "5" "February 2019" "" ""
+.TH "TALLOW" "5" "October 2019" "" ""
.
.SH "NAME"
\fBtallow\fR
@@ -19,7 +19,7 @@
This file is read on startup by the tallow(1) daemon, and can be used to
provide options to the tallow daemon\. If not present, tallow will operate with
built\-in defaults\.
.
.SH "OPTIONS"
-\fBipt_path\fR=\fB<string>\fR Specifies the location of the ipset(1),
iptables(1) or ip6tables(1) program\. By default, tallow will look in
"/usr/sbin" for them\.
+\fBipt_path\fR=\fB<string>\fR Specifies the location of the ipset(1) program
and iptables(1), ip6tables(1), or firewall\-cmd(1) programs\. By default,
tallow will look in "/usr/sbin" for them\.
.
.P
\fBexpires\fR=\fB<int>\fR The number of seconds that IP addresses are blocked
for\. Note that due to the implementation, IP addresses may be blocked for much
longer than this period\. If IP addresses are seen, but not blocked within this
period, they are also removed from the watch list\. Defaults to 3600s\.
@@ -34,17 +34,37 @@
\fBipv6\fR=\fB<0|1>\fR Enable or disable ipv6 (ip6tables) support\. Ipv6 is
disabled automatically on systems that do not appear to have ipv6 support and
enabled when ipv6 is present\. Use this option to explicitly disable ipv6
support if your system does not have ipv6 or is missing ip6tables\. Even with
ipv6 disabled, tallow will track and log ipv6 addresses\.
.
.P
-\fBnocreate\fR=\fB<0|1>\fR Disable the creation of iptables rules and ipset
sets\. By default, tallow will create new iptables(1) and ip6tables(1) rules
when needed automatically\. If set to \fB1\fR, \fBtallow(1)\fR will not create
any new iptables rules or ipset sets to work\. You should create them manually
before tallow starts up and remove them afterwards\. To create them manually,
you can use the following commands:
+\fBnocreate\fR=\fB<0|1>\fR Disable the creation of firewall rules and ipset
sets\. By default, tallow will create new firewall\-cmd(1) or iptables(1) and
ip6tables(1) rules when needed automatically\. If set to \fB1\fR,
\fBtallow(1)\fR will not create any new firewall DROP rules or ipset sets that
are needed work\. You should create them manually before tallow starts up and
remove them afterwards using the sets of commands below\.
+.
+.P
+Use the following commands if you\'re using iptables(1):
.
.IP "" 4
.
.nf
- iptables \-t filter \-I INPUT 1 \-m set \-\-match\-set tallow src \-j DROP
ipset create tallow hash:ip family inet timeout 3600
+ iptables \-t filter \-I INPUT 1 \-m set \-\-match\-set tallow src \-j DROP
- ip6tables \-t filter \-I INPUT 1 \-m set \-\-match\-set tallow6 src \-j DROP
ipset create tallow6 hash:ip family inet6 timeout 3600
+ ip6tables \-t filter \-I INPUT 1 \-m set \-\-match\-set tallow6 src \-j DROP
+.
+.fi
+.
+.IP "" 0
+.
+.P
+Use the following commands if you\'re using firewalld(1):
+.
+.IP "" 4
+.
+.nf
+
+ firewall\-cmd \-\-permanent \-\-new\-ipset=tallow \-\-type=hash:ip
\-\-family=inet \-\-option=timeout=3600
+ firewall\-cmd \-\-permanent \-\-direct \-\-add\-rule ipv4 filter INPUT 1 \-m
set \-\-match\-set tallow src \-j DROP
+
+ firewall\-cmd \-\-permanent \-\-new\-ipset=tallow6 \-\-type=hash:ip
\-\-family=inet6 \-\-option=timeout=3600
+ firewall\-cmd \-\-permanent \-\-direct \-\-add\-rule ipv6 filter INPUT 1 \-m
set \-\-match\-set tallow6 src \-j DROP
.
.fi
.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/man/tallow.conf.5.md
new/tallow-19+git20191104.5dfb982/man/tallow.conf.5.md
--- old/tallow-16+git20190425.e4b3977/man/tallow.conf.5.md 2019-04-25
22:23:03.000000000 +0200
+++ new/tallow-19+git20191104.5dfb982/man/tallow.conf.5.md 2019-11-04
23:18:38.000000000 +0100
@@ -20,8 +20,9 @@
## OPTIONS
`ipt_path`=`<string>`
-Specifies the location of the ipset(1), iptables(1) or ip6tables(1)
-program. By default, tallow will look in "/usr/sbin" for them.
+Specifies the location of the ipset(1) program and iptables(1),
+ip6tables(1), or firewall-cmd(1) programs. By default, tallow will
+look in "/usr/sbin" for them.
`expires`=`<int>`
The number of seconds that IP addresses are blocked for. Note that
@@ -52,20 +53,32 @@
missing ip6tables. Even with ipv6 disabled, tallow will track
and log ipv6 addresses.
-`nocreate`=`<0|1>`
-Disable the creation of iptables rules and ipset sets. By default,
-tallow will create new iptables(1) and ip6tables(1) rules when needed
-automatically. If set to `1`, `tallow(1)` will not create any new
-iptables rules or ipset sets to work. You should create them manually
-before tallow starts up and remove them afterwards. To create them
-manually, you can use the following commands:
+`nocreate`=`<0|1>` Disable the creation of firewall rules and ipset sets. By
+default, tallow will create new firewall-cmd(1) or iptables(1) and ip6tables(1)
+rules when needed automatically. If set to `1`, `tallow(1)` will not create any
+new firewall DROP rules or ipset sets that are needed work. You should create
+them manually before tallow starts up and remove them afterwards using the sets
+of commands below.
+
+Use the following commands if you're using iptables(1):
```
- iptables -t filter -I INPUT 1 -m set --match-set tallow src -j DROP
ipset create tallow hash:ip family inet timeout 3600
+ iptables -t filter -I INPUT 1 -m set --match-set tallow src -j DROP
- ip6tables -t filter -I INPUT 1 -m set --match-set tallow6 src -j DROP
ipset create tallow6 hash:ip family inet6 timeout 3600
+ ip6tables -t filter -I INPUT 1 -m set --match-set tallow6 src -j DROP
+ ```
+
+Use the following commands if you're using firewalld(1):
+
+```
+ firewall-cmd --permanent --new-ipset=tallow --type=hash:ip --family=inet
--option=timeout=3600
+ firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -m set
--match-set tallow src -j DROP
+
+ firewall-cmd --permanent --new-ipset=tallow6 --type=hash:ip --family=inet6
--option=timeout=3600
+ firewall-cmd --permanent --direct --add-rule ipv6 filter INPUT 1 -m set
--match-set tallow6 src -j DROP
+
```
## SEE ALSO
@@ -75,4 +88,3 @@
## AUTHOR
Auke Kok <auke-jan.h....@intel.com>
-
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/src/json.c
new/tallow-19+git20191104.5dfb982/src/json.c
--- old/tallow-16+git20190425.e4b3977/src/json.c 2019-04-25
22:23:03.000000000 +0200
+++ new/tallow-19+git20191104.5dfb982/src/json.c 2019-11-04
23:18:38.000000000 +0100
@@ -36,7 +36,7 @@
static int json_parse(json_object *ob)
{
- int count = 0;
+ int i, count = 0;
bool l_filter, l_ban, l_score, l_pattern = false;
json_object_object_foreach(ob, key, val) {
@@ -81,7 +81,7 @@
ob = json_object_object_get(ob, key);
int len = json_object_array_length(ob);
json_object *val;
- for (int i = 0; i < len; i++) {
+ for (i = 0; i < len; i++) {
val = json_object_array_get_idx(ob, i);
count += json_parse(val);
}
@@ -119,7 +119,7 @@
static int json_load_file(const char* file)
{
- int count = 0;
+ int i, count = 0;
char *json;
int fd;
struct stat st;
@@ -134,7 +134,7 @@
if (json_object_is_type(obj,json_type_array)) {
int len = json_object_array_length(obj);
json_object *val;
- for (int i = 0; i < len; i++) {
+ for (i = 0; i < len; i++) {
val = json_object_array_get_idx(obj, i);
count += json_parse(val);
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/tallow-16+git20190425.e4b3977/src/tallow.c
new/tallow-19+git20191104.5dfb982/src/tallow.c
--- old/tallow-16+git20190425.e4b3977/src/tallow.c 2019-04-25
22:23:03.000000000 +0200
+++ new/tallow-19+git20191104.5dfb982/src/tallow.c 2019-11-04
23:18:38.000000000 +0100
@@ -11,6 +11,8 @@
* of the License.
*/
+#define _GNU_SOURCE
+
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
@@ -66,6 +68,26 @@
__attribute__((unused)) int ret = system(cmd);
}
+static void reset_rules(void)
+{
+ /* reset all rules in case the running fw changes */
+ ext_ignore("%s/firewall-cmd --permanent --direct --remove-rule ipv4
filter INPUT 1 -m set --match-set tallow src -j DROP 2> /dev/null", ipt_path);
+ ext_ignore("%s/firewall-cmd --permanent --delete-ipset=tallow 2>
/dev/null", ipt_path);
+
+ /* delete iptables ref to set before the ipset! */
+ ext_ignore("%s/iptables -t filter -D INPUT -m set --match-set tallow
src -j DROP 2> /dev/null", ipt_path);
+ ext_ignore("%s/ipset destroy tallow 2> /dev/null", ipt_path);
+
+ if (has_ipv6) {
+ ext_ignore("%s/firewall-cmd --permanent --direct --remove-rule
ipv6 filter INPUT 1 -m set --match-set tallow6 src -j DROP 2> /dev/null",
ipt_path);
+ ext_ignore("%s/firewall-cmd --permanent --delete-ipset=tallow6
2> /dev/null", ipt_path);
+
+ /* delete iptables ref to set before the ipset! */
+ ext_ignore("%s/ip6tables -t filter -D INPUT -m set --match-set
tallow6 src -j DROP 2> /dev/null", ipt_path);
+ ext_ignore("%s/ipset destroy tallow6 2> /dev/null", ipt_path);
+ }
+}
+
static void setup(void)
{
static bool done = false;
@@ -76,31 +98,72 @@
if (nocreate)
return;
- /* init ipset and iptables */
- /* delete iptables ref to set before the ipset! */
- ext_ignore("%s/iptables -t filter -D INPUT -m set --match-set tallow
src -j DROP 2> /dev/null", ipt_path);
- ext_ignore("%s/ipset destroy tallow 2> /dev/null", ipt_path);
- if (ext("%s/ipset create tallow hash:ip family inet timeout %d",
ipt_path, expires)) {
- fprintf(stderr, "Unable to create ipv4 ipset.\n");
- exit(EXIT_FAILURE);
- }
- if (ext("%s/iptables -t filter -I INPUT 1 -m set --match-set tallow src
-j DROP", ipt_path)) {
- fprintf(stderr, "Unable to create iptables rule.\n");
+ /* firewalld */
+ char *fwd_path;
+ if (asprintf(&fwd_path, "%s/firewall-cmd", ipt_path) < 0) {
exit(EXIT_FAILURE);
}
- if (has_ipv6) {
- ext_ignore("%s/ip6tables -t filter -D INPUT -m set --match-set
tallow6 src -j DROP 2> /dev/null", ipt_path);
- ext_ignore("%s/ipset destroy tallow6 2> /dev/null", ipt_path);
- if (ext("%s/ipset create tallow6 hash:ip family inet6 timeout
%d", ipt_path, expires)) {
- fprintf(stderr, "Unable to create ipv6 ipset.\n");
+ if ((access(fwd_path, X_OK) == 0) && ext("%s/firewall-cmd --state
--quiet", ipt_path) == 0) {
+ fprintf(stdout, "firewalld is running and will be used by
tallow.\n");
+
+ reset_rules();
+
+ /* create ipv4 rule and ipset */
+ if (ext("%s/firewall-cmd --permanent --quiet --new-ipset=tallow
--type=hash:ip --family=inet --option=timeout=%d", ipt_path, expires)) {
+ fprintf(stderr, "Unable to create ipv4 ipset with
firewall-cmd.\n");
exit(EXIT_FAILURE);
}
- if (ext("%s/ip6tables -t filter -I INPUT 1 -m set --match-set
tallow6 src -j DROP", ipt_path)) {
- fprintf(stderr, "Unable to create ipt6ables rule.\n");
+ if (ext("%s/firewall-cmd --permanent --direct --quiet
--add-rule ipv4 filter INPUT 1 -m set --match-set tallow src -j DROP",
ipt_path)) {
+ fprintf(stderr, "Unable to create ipv4 firewalld
rule.\n");
exit(EXIT_FAILURE);
}
+
+ /* create ipv6 rule and ipset */
+ if (has_ipv6) {
+ if (ext("%s/firewall-cmd --permanent --quiet
--new-ipset=tallow6 --type=hash:ip --family=inet6 --option=timeout=%d",
ipt_path, expires)) {
+ fprintf(stderr, "Unable to create ipv6 ipset
with firewall-cmd.\n");
+ exit(EXIT_FAILURE);
+ }
+ if (ext("%s/firewall-cmd --permanent --direct --quiet
--add-rule ipv6 filter INPUT 1 -m set --match-set tallow6 src -j DROP ",
ipt_path)) {
+ fprintf(stderr, "Unable to create ipv6
firewalld rule.\n");
+ exit(EXIT_FAILURE);
+ }
+ }
+
+ /* reload firewalld for ipsets to load */
+ if (ext("%s/firewall-cmd --reload --quiet", ipt_path, expires))
{
+ fprintf(stderr, "Unable to reload firewalld rules.\n");
+ exit(EXIT_FAILURE);
+ }
+ } else {
+ /* iptables */
+ reset_rules();
+
+ /* create ipv4 rule and ipset */
+ if (ext("%s/ipset create tallow hash:ip family inet timeout
%d", ipt_path, expires)) {
+ fprintf(stderr, "Unable to create ipv4 ipset.\n");
+ exit(EXIT_FAILURE);
+ }
+ if (ext("%s/iptables -t filter -A INPUT -m set --match-set
tallow src -j DROP", ipt_path)) {
+ fprintf(stderr, "Unable to create iptables rule.\n");
+ exit(EXIT_FAILURE);
+ }
+
+ /* create ipv6 rule and ipset */
+ if (has_ipv6) {
+ if (ext("%s/ipset create tallow6 hash:ip family inet6
timeout %d", ipt_path, expires)) {
+ fprintf(stderr, "Unable to create ipv6
ipset.\n");
+ exit(EXIT_FAILURE);
+ }
+ if (ext("%s/ip6tables -t filter -A INPUT -m set
--match-set tallow6 src -j DROP", ipt_path)) {
+ fprintf(stderr, "Unable to create ipt6ables
rule.\n");
+ exit(EXIT_FAILURE);
+ }
+ }
}
+
+ free(fwd_path);
}
static void block(struct block_struct *s, int instant_block)
@@ -224,7 +287,7 @@
int r;
FILE *f;
int timeout = 60;
- long long int last_timestamp = 0;
+ long long unsigned int last_timestamp = 0;
json_load_patterns();
@@ -333,11 +396,13 @@
* this happens when the journal rotates - we get
replayed events
*/
if (sd_journal_get_data(j,
"_SOURCE_REALTIME_TIMESTAMP", &dt, &dl) == 0) {
- long long int lt = atoi(dt +
strlen("_SOURCE_REALTIME_TIMESTAMP="));
+ long long unsigned int lt = atoll(dt +
strlen("_SOURCE_REALTIME_TIMESTAMP="));
if (lt > last_timestamp)
last_timestamp = lt;
- else if (lt < last_timestamp)
+ else if (lt < last_timestamp) {
+ dbg("Discarding old entry: %llu -
%llu\n", lt, last_timestamp);
continue;
+ }
}
if (sd_journal_get_data(j, "MESSAGE", &d, &l) < 0) {
