From 90f9009959320d2663783b40ec496cb19862df1f Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 5 Sep 2016 16:08:26 +0200 Subject: [PATCH] fixes wrong date (invalid format or value) recognition if template available (+ test cases extended) --- fail2ban/server/datedetector.py | 17 ++++++++++------- fail2ban/tests/files/logs/zzz-generic-example | 16 ++++++++++++++++ 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/fail2ban/server/datedetector.py b/fail2ban/server/datedetector.py index 0c5da94b..5281fc59 100644 --- a/fail2ban/server/datedetector.py +++ b/fail2ban/server/datedetector.py @@ -224,12 +224,15 @@ class DateDetector(object): if timeMatch: template = timeMatch[1] if template is not None: - date = template.getDate(line, timeMatch[0]) - if date is not None: - if logSys.getEffectiveLevel() <= logLevel: - logSys.log(logLevel, "Got time %f for \"%r\" using template %s", - date[0], date[1].group(), template.name) - return date + try: + date = template.getDate(line, timeMatch[0]) + if date is not None: + if logSys.getEffectiveLevel() <= logLevel: + logSys.log(logLevel, "Got time %f for %r using template %s", + date[0], date[1].group(), template.name) + return date + except ValueError: + return None with self.__lock: for template in self.__templates: try: @@ -237,7 +240,7 @@ class DateDetector(object): if date is None: continue if logSys.getEffectiveLevel() <= logLevel: - logSys.log(logLevel, "Got time %f for \"%r\" using template %s", + logSys.log(logLevel, "Got time %f for %r using template %s", date[0], date[1].group(), template.name) return date except ValueError: # pragma: no cover diff --git a/fail2ban/tests/files/logs/zzz-generic-example b/fail2ban/tests/files/logs/zzz-generic-example index e3480b63..2a4fb789 100644 --- a/fail2ban/tests/files/logs/zzz-generic-example +++ b/fail2ban/tests/files/logs/zzz-generic-example @@ -29,3 +29,19 @@ Jun 21 16:55:02 machine kernel: [ 970.699396] @vserver_demo test- # -- the same as above with brackets as date ambit -- # failJSON: { "time": "2005-06-21T16:55:03", "match": true , "host": "192.0.2.3" } [Jun 21 16:55:03] machine kernel: [ 970.699396] @vserver_demo test-demo(pam_unix)[13709] [ID 255 test] F2B: failure from 192.0.2.3 + +# -- wrong time direct in journal-line (used last known date): +# failJSON: { "time": "2005-06-21T16:55:03", "match": true , "host": "192.0.2.1" } +0000-12-30 00:00:00 server test-demo[47831]: F2B: failure from 192.0.2.1 +# -- wrong time after newline in message (plist without escaped newlines): +# failJSON: { "match": false } +Jun 22 20:37:04 server test-demo[402]: writeToStorage plist={ +# failJSON: { "match": false } + absentCircleWithNoReason = 0; +# failJSON: { "match": false } + applicationDate = "0000-12-30 00:00:00 +0000"; +# failJSON: { "match": false } +} +# -- wrong time direct in journal-line (used last known date): +# failJSON: { "time": "2005-06-22T20:37:04", "match": true , "host": "192.0.2.2" } +0000-12-30 00:00:00 server test-demo[47831]: F2B: failure from 192.0.2.2