From fcbcc117d27d4a607f1a083e5e6c635eeb3c20f5 Mon Sep 17 00:00:00 2001
From: andryyy <andre.peters@debinux.de>
Date: Thu, 28 Feb 2019 20:22:16 +0100
Subject: [PATCH] [Netfilter] Detect SOGo 403 [Compose] Update Netfilter

---
 data/Dockerfiles/netfilter/server.py | 3 ++-
 docker-compose.yml                   | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/data/Dockerfiles/netfilter/server.py b/data/Dockerfiles/netfilter/server.py
index f43122ea..910679c6 100644
--- a/data/Dockerfiles/netfilter/server.py
+++ b/data/Dockerfiles/netfilter/server.py
@@ -31,7 +31,8 @@ RULES[2] = '-login: Disconnected \(auth failed, .+\): user=.*, method=.+, rip=([
 RULES[3] = '-login: Aborted login \(tried to use disallowed .+\): user=.+, rip=([0-9a-f\.:]+), lip.+'
 RULES[4] = 'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked'
 RULES[5] = 'mailcow UI: Invalid password for .+ by ([0-9a-f\.:]+)'
-#RULES[6] = '-login: Aborted login \(no auth .+\): user=.+, rip=([0-9a-f\.:]+), lip.+'
+RULES[6] = '([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+'
+#RULES[7] = '-login: Aborted login \(no auth .+\): user=.+, rip=([0-9a-f\.:]+), lip.+'
 
 bans = {}
 log = {}
diff --git a/docker-compose.yml b/docker-compose.yml
index efee7ade..46317570 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -333,7 +333,7 @@ services:
             - acme
 
     netfilter-mailcow:
-      image: mailcow/netfilter:1.22
+      image: mailcow/netfilter:1.23
       build: ./data/Dockerfiles/netfilter
       stop_grace_period: 30s
       depends_on: