diff --git a/config/filter.d/nginx-limit-req.conf b/config/filter.d/nginx-limit-req.conf index 589d3d78..13cf75c2 100644 --- a/config/filter.d/nginx-limit-req.conf +++ b/config/filter.d/nginx-limit-req.conf @@ -39,7 +39,7 @@ ngx_limit_req_zones = [^"]+ # failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: , server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$ # Shortly, much faster and stable version of regexp: -failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: +failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: , ignoreregex = diff --git a/fail2ban/server/failregex.py b/fail2ban/server/failregex.py index 7c512609..7c51ddb8 100644 --- a/fail2ban/server/failregex.py +++ b/fail2ban/server/failregex.py @@ -25,6 +25,7 @@ import re import sre_constants import sys +from .ipdns import IPAddr ## # Regular expression class. @@ -72,12 +73,12 @@ class Regex: def _resolveHostTag(regex, useDns="yes"): # separated ipv4: r_host = [] - r = r"""(?:::f{4,6}:)?(?P(?:\d{1,3}\.){3}\d{1,3})""" + r = r"""(?:::f{4,6}:)?(?P%s)""" % (IPAddr.IP_4_RE,) regex = regex.replace("", r); # self closed regex = regex.replace("", r); # closed r_host.append(r) # separated ipv6: - r = r"""(?P(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}?|(?<=:):))""" + r = r"""(?P%s)""" % (IPAddr.IP_6_RE,) regex = regex.replace("", r); # self closed regex = regex.replace("", r); # closed r_host.append(r"""\[?%s\]?""" % (r,)); # enclose ipv6 in optional [] in host-regex diff --git a/fail2ban/server/ipdns.py b/fail2ban/server/ipdns.py index cba08d0c..f8db6a04 100644 --- a/fail2ban/server/ipdns.py +++ b/fail2ban/server/ipdns.py @@ -124,8 +124,11 @@ class DNSUtils: class IPAddr(object): """Encapsulate functionality for IPv4 and IPv6 addresses """ + + IP_4_RE = r"""(?:\d{1,3}\.){3}\d{1,3}""" + IP_6_RE = r"""(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):)""" IP_4_6_CRE = re.compile( - r"""^(?:(?P(?:\d{1,3}\.){3}\d{1,3})|\[?(?P(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\]?)$""") + r"""^(?:(?P%s)|\[?(?P%s)\]?)$""" % (IP_4_RE, IP_6_RE)) # An IPv4 compatible IPv6 to be reused (see below) IP6_4COMPAT = None diff --git a/fail2ban/tests/files/logs/nginx-limit-req b/fail2ban/tests/files/logs/nginx-limit-req index 68f1b239..9a77b45f 100644 --- a/fail2ban/tests/files/logs/nginx-limit-req +++ b/fail2ban/tests/files/logs/nginx-limit-req @@ -4,3 +4,9 @@ # failJSON: { "time": "2015-10-29T19:24:05", "match": true , "host": "192.0.2.0" } 2015/10/29 19:24:05 [error] 12684#12684: *22174 limiting requests, excess: 1.495 by zone "one", client: 192.0.2.0, server: example.com, request: "GET /index.php HTTP/1.1", host: "example.com", referrer: "https://example.com" + +# failJSON: { "time": "2016-09-30T08:36:06", "match": true, "host": "13.123.1.123" } +2016/09/30 08:36:06 [error] 22923#0: *4758725916 limiting requests, excess: 15.243 by zone "one", client: 13.123.1.123, server: example.com, request: "GET / HTTP/1.1", host: "example.com" + +# failJSON: { "time": "2016-09-30T08:36:06", "match": true, "host": "2606:2800:220:1:248:1893:25c8:1946" } +2016/09/30 08:36:06 [error] 22923#0: *4758725916 limiting requests, excess: 15.243 by zone "one", client: 2606:2800:220:1:248:1893:25c8:1946, server: example.com, request: "GET / HTTP/1.1", host: "example.com"