upg fai2ban python-setuptools qt5-base wget

mv fail2ban from jobcomm to jobextra
This commit is contained in:
joborun linux 2023-05-22 03:48:31 +03:00
parent 8dd28e7455
commit 6123782804
10 changed files with 278 additions and 12 deletions

79
fail2ban/PKGBUILD Normal file
View File

@ -0,0 +1,79 @@
#!/usr/bin/bash
# JOBoRun : Jwm OpenBox Obarun RUNit
# Maintainer : Joe Bo Run <joborun@disroot.org>
# PkgSource : url="https://gittea.disroot.org/joborun-pkg/jobextra/$pkgname"
# Website : https://pozol.eu
#-----------------------------------------| DESCRIPTION |---------------------------------------
pkgname=fail2ban
pkgver=1.0.2
pkgrel=04
pkgdesc='Bans IPs after too many failed authentication attempts'
url='https://www.fail2ban.org/'
depends=('python-pyinotify' 'whois' 'sqlite')
makedepends=('python-setuptools')
optdepends=(
'firewalld: for a firewall backend'
'ipset: for a firewall backend'
'iptables: for a firewall backend'
'nftables: for a firewall backend'
)
checkdepends=('python-coverage')
backup=(etc/fail2ban/fail2ban.conf
etc/fail2ban/jail.conf
etc/logrotate.d/fail2ban)
source=("$pkgname-$pkgver.tar.gz::https://github.com/fail2ban/$pkgname/archive/$pkgver.tar.gz")
# "$pkgname-dovecot-regex.patch::https://github.com/fail2ban/fail2ban/commit/ca2b94c5229b.patch")
prepare() {
cd $pkgname-$pkgver
sed -i 's|self.install_dir|"/usr/bin"|' setup.py
sed -i 's/^before = paths-debian.conf/before = paths-arch.conf/' config/jail.conf
# # https://github.com/fail2ban/fail2ban/issues/3370
# patch -Np1 -i ../$pkgname-dovecot-regex.patch || [[ $pkgver == 1.0.1 ]]
}
build() {
cd $pkgname-$pkgver
./fail2ban-2to3
python setup.py build
}
package() {
cd $pkgname-$pkgver
python setup.py install --root "$pkgdir" --optimize=1
# install -Dm644 build/fail2ban.service \
# "$pkgdir"/usr/lib/systemd/system/$pkgname.service
install -Dm644 files/fail2ban-tmpfiles.conf \
"$pkgdir"/usr/lib/tmpfiles.d/$pkgname.conf
install -Dm644 files/fail2ban-logrotate \
"$pkgdir"/etc/logrotate.d/fail2ban
install -Dm644 files/bash-completion \
"$pkgdir"/usr/share/bash-completion/completions/fail2ban
# fix sendmail location
sed -i 's/sbin/bin/g' "$pkgdir"/etc/fail2ban/action.d/sendmail*.conf
install -Dm644 man/fail2ban.1 "$pkgdir"/usr/share/man/man1/fail2ban.1
install -Dm644 man/fail2ban-client.1 \
"$pkgdir"/usr/share/man/man1/fail2ban-client.1
install -Dm644 man/fail2ban-regex.1 \
"$pkgdir"/usr/share/man/man1/fail2ban-regex.1
install -Dm644 man/fail2ban-server.1 \
"$pkgdir"/usr/share/man/man1/fail2ban-server.1
install -Dm644 man/jail.conf.5 "$pkgdir"/usr/share/man/man5/jail.conf.5
rm -r "$pkgdir/run"
}
#---- arch license gpg-key & sha256sums ----
arch=(x86_64)
license=('GPL')
sha256sums=(ae8b0b41f27a7be12d40488789d6c258029b23a01168e3c0d347ee80b325ac23) # fail2ban-1.0.2.tar.gz
## eac9b3223cce7a4dd02db8ee4a66a0ff74cee7d055868c8fa9383eb39c25804b fail2ban-1.0.2-04-x86_64.pkg.tar.lz

69
fail2ban/PKGBUILD-arch Normal file
View File

@ -0,0 +1,69 @@
# Maintainer: Felix Yan <felixonmars@archlinux.org>
# Maintainer: Daniel M. Capella <polyzen@archlinux.org>
# Contributor: Bartłomiej Piotrowski <bpiotrowski@archlinux.org>
# Contributor: Geoffroy Carrier <geoffroy.carrier@koon.fr>
# Contributor: michalzxc
# Contributor: nbags <neilbags@gmail.com>
pkgname=fail2ban
pkgver=1.0.2
pkgrel=3
pkgdesc='Bans IPs after too many failed authentication attempts'
url='https://www.fail2ban.org/'
license=('GPL')
arch=('any')
depends=('python-pyinotify' 'whois' 'sqlite' 'python-systemd')
makedepends=('python-setuptools')
optdepends=(
'firewalld: for a firewall backend'
'ipset: for a firewall backend'
'iptables: for a firewall backend'
'nftables: for a firewall backend'
)
backup=(
'etc/fail2ban/fail2ban.conf'
'etc/fail2ban/jail.conf'
'etc/logrotate.d/fail2ban'
)
source=("$pkgname-$pkgver.tar.gz::https://github.com/fail2ban/$pkgname/archive/$pkgver.tar.gz")
sha512sums=('688a84361b5794e1658f53d2d200ce752fe1e3320ddb1742c32c4b4b82a79ace16ae464e7ea3eeb94a0e862bcac73c2d3a0e61dd7b28e179a4c857f950d74dbb')
prepare() {
cd $pkgname-$pkgver
sed -i 's|self.install_dir|"/usr/bin"|' setup.py
sed -i 's/^before = paths-debian.conf/before = paths-arch.conf/' config/jail.conf
}
build() {
cd $pkgname-$pkgver
./fail2ban-2to3
python setup.py build
}
package() {
cd $pkgname-$pkgver
python setup.py install --root "$pkgdir" --optimize=1
install -Dm644 build/fail2ban.service \
"$pkgdir"/usr/lib/systemd/system/$pkgname.service
install -Dm644 files/fail2ban-tmpfiles.conf \
"$pkgdir"/usr/lib/tmpfiles.d/$pkgname.conf
install -Dm644 files/fail2ban-logrotate \
"$pkgdir"/etc/logrotate.d/fail2ban
install -Dm644 files/bash-completion \
"$pkgdir"/usr/share/bash-completion/completions/fail2ban
# fix sendmail location
sed -i 's/sbin/bin/g' "$pkgdir"/etc/fail2ban/action.d/sendmail*.conf
install -Dm644 man/fail2ban.1 "$pkgdir"/usr/share/man/man1/fail2ban.1
install -Dm644 man/fail2ban-client.1 \
"$pkgdir"/usr/share/man/man1/fail2ban-client.1
install -Dm644 man/fail2ban-regex.1 \
"$pkgdir"/usr/share/man/man1/fail2ban-regex.1
install -Dm644 man/fail2ban-server.1 \
"$pkgdir"/usr/share/man/man1/fail2ban-server.1
install -Dm644 man/jail.conf.5 "$pkgdir"/usr/share/man/man5/jail.conf.5
rm -r "$pkgdir/run"
}

1
fail2ban/clean Normal file
View File

@ -0,0 +1 @@
rm -rf {src,pkg,fail2ban*tar.gz}

6
fail2ban/deps Normal file
View File

@ -0,0 +1,6 @@
python-pyinotify
whois
python-setuptools
python-typing_extensions

View File

@ -0,0 +1,99 @@
From ca2b94c5229bd474f612b57b67d796252a4aab7a Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Tue, 4 Oct 2022 14:03:07 +0200
Subject: [PATCH] fixes gh-3370: resolve extremely long search by repeated
apply of non-greedy RE `(?:: (?:[^\(]+|\w+\([^\)]*\))+)?` with following
branches (it may be extremely slow up to infinite search depending on
message); added new regression tests amend to gh-3210: fixes regression and
matches new format in aggressive mode too
---
ChangeLog | 4 ++++
config/filter.d/dovecot.conf | 8 +++++---
fail2ban/tests/files/logs/dovecot | 22 ++++++++++++++++++++++
3 files changed, 31 insertions(+), 3 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index fc4beade6e..04401ea866 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,10 @@ ver. 1.0.2-dev-1 (20??/??/??) - development nightly edition
-----------
### Fixes
+* `filter.d/dovecot.conf`:
+ - fixes regression introduced in gh-3210: resolve extremely long search by repeated apply of non-greedy RE-part
+ with following branches (it may be extremely slow up to infinite search depending on message), gh-3370
+ - fixes regression and matches new format in aggressive mode too (amend to gh-3210)
### New Features and Enhancements
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 0415ecb40a..dc3ebbcd42 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -7,19 +7,21 @@ before = common.conf
[Definition]
+_daemon = (?:dovecot(?:-auth)?|auth)
+
_auth_worker = (?:dovecot: )?auth(?:-worker)?
_auth_worker_info = (?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
-_daemon = (?:dovecot(?:-auth)?|auth)
+_bypass_reject_reason = (?:: (?:\w+\([^\):]*\) \w+|[^\(]+))*
prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$
failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
- ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?:: (?:[^\(]+|\w+\([^\)]*\))+)? \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+ ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \([Pp]assword mismatch\?\)|Permission denied)\s*$
^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch)
<mdre-<mode>>
-mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)(?::(?: [^ \(]+)+)? \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
+mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
mdre-normal =
diff --git a/fail2ban/tests/files/logs/dovecot b/fail2ban/tests/files/logs/dovecot
index 75934c37bb..0e33296129 100644
--- a/fail2ban/tests/files/logs/dovecot
+++ b/fail2ban/tests/files/logs/dovecot
@@ -115,6 +115,17 @@ Aug 28 06:38:51 s166-62-100-187 dovecot: imap-login: Disconnected (auth failed,
# failJSON: { "time": "2004-08-28T06:38:52", "match": true , "host": "192.0.2.4", "desc": "open parenthesis in optional part between Disconnected and (auth failed ...), gh-3210" }
Aug 28 06:38:52 s166-62-100-187 dovecot: imap-login: Disconnected: Connection closed: read(size=1003) failed: Connection reset by peer (auth failed, 1 attempts in 0 secs): user=<test@example.com>, rip=192.0.2.4, lip=127.0.0.19, session=<Lsz0Oo7WXti3b7xe>
+# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer
+# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
+# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
+# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
+# failJSON: { "time": "2004-08-29T01:49:33", "match": false , "desc": "avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
+
# failJSON: { "time": "2004-08-29T03:17:18", "match": true , "host": "192.0.2.133" }
Aug 29 03:17:18 server dovecot: submission-login: Client has quit the connection (auth failed, 1 attempts in 2 secs): user=<user1>, method=LOGIN, rip=192.0.2.133, lip=0.0.0.0
# failJSON: { "time": "2004-08-29T03:53:52", "match": true , "host": "192.0.2.169" }
@@ -128,6 +139,17 @@ Aug 29 15:33:53 server dovecot: managesieve-login: Disconnected: Too many invali
# filterOptions: [{"mode": "aggressive"}]
+# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: read(size=1026) failed: Connection reset by peer
+# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
+# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Too many invalid commands. (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
+# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[459]: managesieve-login: Disconnected: Connection closed: read(size=1007) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1
+# failJSON: { "time": "2004-08-29T01:49:33", "match": true , "host": "192.0.2.5", "desc": "matches in aggressive mode, avoid slow RE, gh-3370" }
+Aug 29 01:49:33 server dovecot[472]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=192.0.2.5, lip=127.0.0.1, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
+
# failJSON: { "time": "2004-08-29T16:06:58", "match": true , "host": "192.0.2.5" }
Aug 29 16:06:58 s166-62-100-187 dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=192.0.2.5, lip=192.168.1.2, TLS handshaking: SSL_accept() syscall failed: Connection reset by peer
# failJSON: { "time": "2004-08-31T16:15:10", "match": true , "host": "192.0.2.6" }

6
fail2ban/time Normal file
View File

@ -0,0 +1,6 @@
real 0m21.100s
user 0m17.638s
sys 0m1.189s

View File

@ -6,8 +6,8 @@
#-----------------------------------------| DESCRIPTION |---------------------------------------
pkgname=python-setuptools
pkgver=67.7.0
_commit=f11f8b16e28ef2e21c1f454d8925b2c512d32d37
pkgver=67.7.1
_commit=53e282429043af3ed96c1684cf81b62e0471c711
pkgrel=01
epoch=1
pkgdesc="Easily download, build, install, upgrade, and uninstall Python packages"
@ -118,4 +118,5 @@ sha256sums=(SKIP
06e2f68aebedbaeb0b0fe923eae686568910cc3355b33bf619db9266eef83efb) # system-validate-pyproject.patch
# a2bc8b9d470c13b4cb682ab3943e80ab2841aae98f7c3d9ba1f089408f96aa91) # add-dependency.patch
## 5abf40d5ed03b7747486ce63ff087248afa15434a1ec01e4f7d1dc4bea142e05 python-setuptools-1:67.7.0-01-x86_64.pkg.tar.lz
## 90e0ea025f33447a2ace143000e7ad9303de5ca8242fdd434550d9f5f98e324e python-setuptools-1:67.7.1-01-x86_64.pkg.tar.lz
90e0ea025f33447a2ace143000e7ad9303de5ca8242fdd434550d9f5f98e324e python-setuptools-1:67.7.1-01-x86_64.pkg.tar.lz

View File

@ -8,8 +8,8 @@
pkgbase=qt5-base
pkgname=(qt5-base qt5-xcb-private-headers)
_basever=5.15.9
pkgver=5.15.9+kde+r151
_commit=84152777a48af444a902bbf4df8b38146171c20d
pkgver=5.15.9+kde+r152
_commit=2103f2487f709dd9546c503820d9ad509e9a63b3
pkgrel=01
url='https://www.qt.io'
pkgdesc='A cross-platform application and UI framework'
@ -125,5 +125,5 @@ sha256sums=(SKIP
5411edbe215c24b30448fac69bd0ba7c882f545e8cf05027b2b6e2227abc5e78 # qmake-cflags.patch
4abc22150fa3e06b2fdcec32146abc9be4e316692aa4d5bd5aa53b4b726783fa) # qmake-config.patch
## fd32c5951b7d2e5092441b4801d0ebd377b6eca69cdd47866b212ae28ab1221a qt5-base-5.15.9+kde+r151-01-x86_64.pkg.tar.lz
## 9da1f2876955f236ce44ac8d793bc145bffc29aeaeb9be1e8728c03c46200f66 qt5-xcb-private-headers-5.15.9+kde+r151-01-x86_64.pkg.tar.lz
## 44302eceec6031ee9f3d1360a7208754c4a1c5d3c2bbd0b355e668efe0f51a77 qt5-base-5.15.9+kde+r152-01-x86_64.pkg.tar.lz
## a7c0ebfca4bd34535605b684ef5c83f1371f314f593c8baed8342761db3e3194 qt5-xcb-private-headers-5.15.9+kde+r152-01-x86_64.pkg.tar.lz

View File

@ -6,11 +6,10 @@
#-----------------------------------------| DESCRIPTION |---------------------------------------
pkgname=wget
pkgver=1.21.3
pkgver=1.21.4
pkgrel=01
pkgdesc='Network utility to retrieve files from the Web'
url='https://www.gnu.org/software/wget/wget.html'
arch=('x86_64')
groups=( jobbot )
depends=('glibc' 'zlib' 'gnutls' 'libidn2' 'libidn2.so' 'util-linux-libs' 'libuuid.so'
'libpsl' 'libpsl.so' 'pcre2' 'nettle' 'libnettle.so')
@ -51,7 +50,9 @@ package() {
make DESTDIR="${pkgdir}" install
}
#---- license gpg-key sha256sums ----
#---- arch license gpg-key & sha256sums ----
arch=(x86_64)
license=('GPL3')
@ -61,5 +62,7 @@ validpgpkeys=(
'1CB27DBC98614B2D5841646D08302DB6A2670428' # Tim Rühsen <tim.ruehsen@gmx.de>
)
sha256sums=(dbd2fb5e47149d4752d0eaa0dac68cc49cf20d46df4f8e326ffc8f18b2af4ea5 # wget-1.21.3.tar.lz
afcbccfb7ef4afaf738fc1ac02501cf4e160178654bf435dec2d3b0f14b082ee) # wget-1.21.3.tar.lz.sig
sha256sums=(3683619a5f50edcbccb1720a79006fa37bf9b9a255a8c5b48048bc3c7a874bd9 # wget-1.21.4.tar.lz
129794aa354cb8f058992725eef85b922b9bae084b382ae2b5a430f0a60b7c39) # wget-1.21.4.tar.lz.sig
## 4062f77d8fd3527e262018804e916b703d9b6a6e551865fbafbe5e086d22eceb wget-1.21.4-01-x86_64.pkg.tar.lz

View File

@ -1,3 +1,5 @@
perl-http-daemon
perl-io-socket-ssl
python