From 076b103f97bf9f00033bf0dba1ec0e49f456c790 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 27 Jan 2015 21:06:06 -0500 Subject: [PATCH 1/7] Conditionally log Ignore IP, and pass in reason (ignoreip, ignorecommand) --- fail2ban/server/filter.py | 15 +++++++++++---- fail2ban/server/jail.py | 2 +- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py index 71b08a2d..83971688 100644 --- a/fail2ban/server/filter.py +++ b/fail2ban/server/filter.py @@ -338,6 +338,10 @@ class Filter(JailThread): logSys.debug("Remove " + ip + " from ignore list") self.__ignoreIpList.remove(ip) + def logIgnoreIp(self, ip, log_ignore, ignore_source="unknown source"): + if log_ignore: + logSys.info("[%s] Ignore %s due to %s" % (self.jail.name, ip, ignore_source)) + def getIgnoreIP(self): return self.__ignoreIpList @@ -349,7 +353,7 @@ class Filter(JailThread): # @param ip IP address # @return True if IP address is in ignore list - def inIgnoreIPList(self, ip): + def inIgnoreIPList(self, ip, log_ignore=False): for i in self.__ignoreIpList: # An empty string is always false if i == "": @@ -369,16 +373,20 @@ class Filter(JailThread): # Check if IP in DNS ips = DNSUtils.dnsToIp(i) if ip in ips: + self.logIgnoreIp(ip, log_ignore, ignore_source="ignoreip by dns") return True else: continue if a == b: + self.logIgnoreIp(ip, log_ignore, ignore_source="ignoreip by addr") return True if self.__ignoreCommand: command = CommandAction.replaceTag(self.__ignoreCommand, { 'ip': ip } ) logSys.debug('ignore command: ' + command) - return CommandAction.executeCmd(command) + ret_ignore = CommandAction.executeCmd(command) + self.logIgnoreIp(ip, log_ignore and ret_ignore, ignore_source="ignorecommand") + return ret_ignore return False @@ -418,8 +426,7 @@ class Filter(JailThread): logSys.debug("Ignore line since time %s < %s - %s" % (unixTime, MyTime.time(), self.getFindTime())) break - if self.inIgnoreIPList(ip): - logSys.info("[%s] Ignore %s" % (self.jail.name, ip)) + if self.inIgnoreIPList(ip, log_ignore=True): continue logSys.info("[%s] Found %s" % (self.jail.name, ip)) ## print "D: Adding a ticket for %s" % ((ip, unixTime, [line]),) diff --git a/fail2ban/server/jail.py b/fail2ban/server/jail.py index 0271a190..c5b5e707 100644 --- a/fail2ban/server/jail.py +++ b/fail2ban/server/jail.py @@ -213,7 +213,7 @@ class Jail: if self.database is not None: for ticket in self.database.getBansMerged( jail=self, bantime=self.actions.getBanTime()): - if not self.filter.inIgnoreIPList(ticket.getIP()): + if not self.filter.inIgnoreIPList(ticket.getIP(), log_ignore=True): self.__queue.put(ticket) logSys.info("Jail '%s' started" % self.name) From f4341999cd5e5695e600e051ac7fdf0edffbb93c Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Wed, 28 Jan 2015 19:43:22 -0500 Subject: [PATCH 2/7] simplify/unify log message --- fail2ban/server/filter.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py index 83971688..9c6494f0 100644 --- a/fail2ban/server/filter.py +++ b/fail2ban/server/filter.py @@ -340,7 +340,7 @@ class Filter(JailThread): def logIgnoreIp(self, ip, log_ignore, ignore_source="unknown source"): if log_ignore: - logSys.info("[%s] Ignore %s due to %s" % (self.jail.name, ip, ignore_source)) + logSys.info("[%s] Ignore %s by %s" % (self.jail.name, ip, ignore_source)) def getIgnoreIP(self): return self.__ignoreIpList @@ -373,19 +373,19 @@ class Filter(JailThread): # Check if IP in DNS ips = DNSUtils.dnsToIp(i) if ip in ips: - self.logIgnoreIp(ip, log_ignore, ignore_source="ignoreip by dns") + self.logIgnoreIp(ip, log_ignore, ignore_source="dns") return True else: continue if a == b: - self.logIgnoreIp(ip, log_ignore, ignore_source="ignoreip by addr") + self.logIgnoreIp(ip, log_ignore, ignore_source="ip") return True if self.__ignoreCommand: command = CommandAction.replaceTag(self.__ignoreCommand, { 'ip': ip } ) logSys.debug('ignore command: ' + command) ret_ignore = CommandAction.executeCmd(command) - self.logIgnoreIp(ip, log_ignore and ret_ignore, ignore_source="ignorecommand") + self.logIgnoreIp(ip, log_ignore and ret_ignore, ignore_source="command") return ret_ignore return False From 3186df55e35f8a3f1c512dde182141da6b67c6c9 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Mon, 2 Feb 2015 21:55:44 -0500 Subject: [PATCH 3/7] add Ignore DNS and IP test cases --- fail2ban/tests/filtertestcase.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py index 47e88067..dbc3bafc 100644 --- a/fail2ban/tests/filtertestcase.py +++ b/fail2ban/tests/filtertestcase.py @@ -266,6 +266,15 @@ class IgnoreIP(LogCaptureTestCase): self.assertTrue(self.filter.inIgnoreIPList("10.0.0.1")) self.assertFalse(self.filter.inIgnoreIPList("10.0.0.0")) + def testIgnoreCauseDNS(self): + self.filter.setUseDns("true") + self.filter.addIgnoreIP("example.com") + self.assertTrue(self._is_logged("Ignore 93.184.216.34")) + + def testIgnoreCauseIP(self): + self.filter.addIgnoreIP("93.184.216.34") + self.assertTrue(self._is_logged("Ignore 93.184.216.34")) + class IgnoreIPDNS(IgnoreIP): From aa848a5f9e70aa02df355725baf1094b412eea90 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 3 Feb 2015 18:02:42 -0500 Subject: [PATCH 4/7] Combine ignore cause unitests --- fail2ban/tests/filtertestcase.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py index dbc3bafc..4807bed5 100644 --- a/fail2ban/tests/filtertestcase.py +++ b/fail2ban/tests/filtertestcase.py @@ -275,6 +275,12 @@ class IgnoreIP(LogCaptureTestCase): self.filter.addIgnoreIP("93.184.216.34") self.assertTrue(self._is_logged("Ignore 93.184.216.34")) + def testIgnoreCause(self): + ip = "93.184.216.34" + for ignore_source in ["dns", "ip", "command"]: + self.filter.logIgnoreIp(ip, True, ignore_source=ignore_source) + self.assertTrue(self._is_logged("[%s] Ignore %s by %s" % (self.jail.name, ip, ignore_source))) + class IgnoreIPDNS(IgnoreIP): From 8233f21fc22a1a5066a0a7b6b5477ab4889cc1a2 Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 3 Feb 2015 18:06:30 -0500 Subject: [PATCH 5/7] Remove duplicate unittests --- fail2ban/tests/filtertestcase.py | 9 --------- 1 file changed, 9 deletions(-) diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py index 4807bed5..23831c34 100644 --- a/fail2ban/tests/filtertestcase.py +++ b/fail2ban/tests/filtertestcase.py @@ -266,15 +266,6 @@ class IgnoreIP(LogCaptureTestCase): self.assertTrue(self.filter.inIgnoreIPList("10.0.0.1")) self.assertFalse(self.filter.inIgnoreIPList("10.0.0.0")) - def testIgnoreCauseDNS(self): - self.filter.setUseDns("true") - self.filter.addIgnoreIP("example.com") - self.assertTrue(self._is_logged("Ignore 93.184.216.34")) - - def testIgnoreCauseIP(self): - self.filter.addIgnoreIP("93.184.216.34") - self.assertTrue(self._is_logged("Ignore 93.184.216.34")) - def testIgnoreCause(self): ip = "93.184.216.34" for ignore_source in ["dns", "ip", "command"]: From c755138672637544a34675ca1e4264dd189cba5e Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 3 Feb 2015 18:11:49 -0500 Subject: [PATCH 6/7] create OK and NOK methods --- fail2ban/tests/filtertestcase.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py index 23831c34..b3aabce2 100644 --- a/fail2ban/tests/filtertestcase.py +++ b/fail2ban/tests/filtertestcase.py @@ -266,12 +266,15 @@ class IgnoreIP(LogCaptureTestCase): self.assertTrue(self.filter.inIgnoreIPList("10.0.0.1")) self.assertFalse(self.filter.inIgnoreIPList("10.0.0.0")) - def testIgnoreCause(self): + def testIgnoreCauseOK(self): ip = "93.184.216.34" for ignore_source in ["dns", "ip", "command"]: self.filter.logIgnoreIp(ip, True, ignore_source=ignore_source) self.assertTrue(self._is_logged("[%s] Ignore %s by %s" % (self.jail.name, ip, ignore_source))) + def testIgnoreCauseNOK(self): + self.filter.logIgnoreIp("example.com", False, ignore_source="NOT_LOGGED") + self.assertFalse(self._is_logged("[%s] Ignore %s by %s" % (self.jail.name, "example.com", "NO_LOGGED"))) class IgnoreIPDNS(IgnoreIP): From 50d18f68df6a2bb3326d39c9279afd0e5b96b41d Mon Sep 17 00:00:00 2001 From: Lee Clemens Date: Tue, 3 Feb 2015 18:18:09 -0500 Subject: [PATCH 7/7] fix typo (false positive test) --- fail2ban/tests/filtertestcase.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py index b3aabce2..6a796865 100644 --- a/fail2ban/tests/filtertestcase.py +++ b/fail2ban/tests/filtertestcase.py @@ -274,7 +274,7 @@ class IgnoreIP(LogCaptureTestCase): def testIgnoreCauseNOK(self): self.filter.logIgnoreIp("example.com", False, ignore_source="NOT_LOGGED") - self.assertFalse(self._is_logged("[%s] Ignore %s by %s" % (self.jail.name, "example.com", "NO_LOGGED"))) + self.assertFalse(self._is_logged("[%s] Ignore %s by %s" % (self.jail.name, "example.com", "NOT_LOGGED"))) class IgnoreIPDNS(IgnoreIP):