From b54290affbd50822f43a04dd50b75d27fef40084 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 4 Feb 2009 15:38:11 -0500 Subject: [PATCH 1/2] BF: anchoring regex for IP with " *$" at the end + adjust regexp for to forbid matching IPs encoded in the hostname (like 1.2.3.4.xxx.yyyyy.zzz) prior doing actual DNS lookup. It is quite important and actually security hazard: DoS is easy to perform... Since now we don't do \S matching in regexp, in the development branches we should also allow for unicode characters by adding 're.U' to HOST's regexp --- server/failregex.py | 2 +- server/filter.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/server/failregex.py b/server/failregex.py index 8536300b..91778003 100644 --- a/server/failregex.py +++ b/server/failregex.py @@ -44,7 +44,7 @@ class Regex: self._matchCache = None # Perform shortcuts expansions. # Replace "" with default regular expression for host. - regex = regex.replace("", "(?:::f{4,6}:)?(?P\S+)") + regex = regex.replace("", "(?:::f{4,6}:)?(?P[\w\-.^_]+)") if regex.lstrip() == '': raise RegexException("Cannot add empty regex") try: diff --git a/server/filter.py b/server/filter.py index 457bb031..6bd27ffd 100644 --- a/server/filter.py +++ b/server/filter.py @@ -492,7 +492,7 @@ import socket, struct class DNSUtils: - IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}") + IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}$") #@staticmethod def dnsToIp(dns): From 441318eba905a146b69f845d30c4c36228e181ab Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 4 Feb 2009 15:38:37 -0500 Subject: [PATCH 2/2] NF: adding unittests for previous commit --- fail2ban-testcases | 1 + testcases/filtertestcase.py | 14 +++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/fail2ban-testcases b/fail2ban-testcases index b241bcb7..0836afee 100755 --- a/fail2ban-testcases +++ b/fail2ban-testcases @@ -57,6 +57,7 @@ tests = unittest.TestSuite() tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP)) tests.addTest(unittest.makeSuite(filtertestcase.LogFile)) tests.addTest(unittest.makeSuite(filtertestcase.GetFailures)) +tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests)) # Server #tests.addTest(unittest.makeSuite(servertestcase.StartStop)) #tests.addTest(unittest.makeSuite(servertestcase.Transmitter)) diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py index 66765ea9..7d11c66f 100644 --- a/testcases/filtertestcase.py +++ b/testcases/filtertestcase.py @@ -26,7 +26,7 @@ __license__ = "GPL" import unittest from server.filterpoll import FilterPoll -from server.filter import FileFilter +from server.filter import FileFilter, DNSUtils from server.failmanager import FailManager from server.failmanager import FailManagerEmpty @@ -195,3 +195,15 @@ class GetFailures(unittest.TestCase): self.__filter.getFailures(GetFailures.FILENAME_02) self.assertRaises(FailManagerEmpty, self.__filter.failManager.toBan) + +class DNSUtilsTests(unittest.TestCase): + + def testTextToIp(self): + bogus = [ + 'doh1.2.3.4.buga.xxxxx.yyy', + '1.2.3.4.buga.xxxxx.yyy', + ] + """Really bogus addresses which should have no matches""" + for s in bogus: + res = DNSUtils.textToIp(s) + self.assertEqual(res, [])