From 057f2f3c56c7d2c8396a05bc834ab95abcba0d04 Mon Sep 17 00:00:00 2001 From: Niklas Fiekas Date: Fri, 30 Sep 2016 11:08:07 +0200 Subject: [PATCH 1/3] make the ipv6 host regex greedy Previously the regex was lazily matching ``2606:2800:220:1:248:1893:25c8:1946`` as ``2606:2800:220:1:248:1893:25c8:1``. --- fail2ban/server/failregex.py | 2 +- fail2ban/tests/files/logs/nginx-limit-req | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/fail2ban/server/failregex.py b/fail2ban/server/failregex.py index 7c512609..56dc7b14 100644 --- a/fail2ban/server/failregex.py +++ b/fail2ban/server/failregex.py @@ -77,7 +77,7 @@ class Regex: regex = regex.replace("", r); # closed r_host.append(r) # separated ipv6: - r = r"""(?P(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}?|(?<=:):))""" + r = r"""(?P(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))""" regex = regex.replace("", r); # self closed regex = regex.replace("", r); # closed r_host.append(r"""\[?%s\]?""" % (r,)); # enclose ipv6 in optional [] in host-regex diff --git a/fail2ban/tests/files/logs/nginx-limit-req b/fail2ban/tests/files/logs/nginx-limit-req index 68f1b239..9a77b45f 100644 --- a/fail2ban/tests/files/logs/nginx-limit-req +++ b/fail2ban/tests/files/logs/nginx-limit-req @@ -4,3 +4,9 @@ # failJSON: { "time": "2015-10-29T19:24:05", "match": true , "host": "192.0.2.0" } 2015/10/29 19:24:05 [error] 12684#12684: *22174 limiting requests, excess: 1.495 by zone "one", client: 192.0.2.0, server: example.com, request: "GET /index.php HTTP/1.1", host: "example.com", referrer: "https://example.com" + +# failJSON: { "time": "2016-09-30T08:36:06", "match": true, "host": "13.123.1.123" } +2016/09/30 08:36:06 [error] 22923#0: *4758725916 limiting requests, excess: 15.243 by zone "one", client: 13.123.1.123, server: example.com, request: "GET / HTTP/1.1", host: "example.com" + +# failJSON: { "time": "2016-09-30T08:36:06", "match": true, "host": "2606:2800:220:1:248:1893:25c8:1946" } +2016/09/30 08:36:06 [error] 22923#0: *4758725916 limiting requests, excess: 15.243 by zone "one", client: 2606:2800:220:1:248:1893:25c8:1946, server: example.com, request: "GET / HTTP/1.1", host: "example.com" From 06674bb98981f89c77c435a25528ce90c02670a6 Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 30 Sep 2016 12:26:31 +0200 Subject: [PATCH 2/3] use common regex for IP addresses (removed code duplication) --- fail2ban/server/failregex.py | 5 +++-- fail2ban/server/ipdns.py | 5 ++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/fail2ban/server/failregex.py b/fail2ban/server/failregex.py index 56dc7b14..7c51ddb8 100644 --- a/fail2ban/server/failregex.py +++ b/fail2ban/server/failregex.py @@ -25,6 +25,7 @@ import re import sre_constants import sys +from .ipdns import IPAddr ## # Regular expression class. @@ -72,12 +73,12 @@ class Regex: def _resolveHostTag(regex, useDns="yes"): # separated ipv4: r_host = [] - r = r"""(?:::f{4,6}:)?(?P(?:\d{1,3}\.){3}\d{1,3})""" + r = r"""(?:::f{4,6}:)?(?P%s)""" % (IPAddr.IP_4_RE,) regex = regex.replace("", r); # self closed regex = regex.replace("", r); # closed r_host.append(r) # separated ipv6: - r = r"""(?P(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))""" + r = r"""(?P%s)""" % (IPAddr.IP_6_RE,) regex = regex.replace("", r); # self closed regex = regex.replace("", r); # closed r_host.append(r"""\[?%s\]?""" % (r,)); # enclose ipv6 in optional [] in host-regex diff --git a/fail2ban/server/ipdns.py b/fail2ban/server/ipdns.py index cba08d0c..f8db6a04 100644 --- a/fail2ban/server/ipdns.py +++ b/fail2ban/server/ipdns.py @@ -124,8 +124,11 @@ class DNSUtils: class IPAddr(object): """Encapsulate functionality for IPv4 and IPv6 addresses """ + + IP_4_RE = r"""(?:\d{1,3}\.){3}\d{1,3}""" + IP_6_RE = r"""(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):)""" IP_4_6_CRE = re.compile( - r"""^(?:(?P(?:\d{1,3}\.){3}\d{1,3})|\[?(?P(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\]?)$""") + r"""^(?:(?P%s)|\[?(?P%s)\]?)$""" % (IP_4_RE, IP_6_RE)) # An IPv4 compatible IPv6 to be reused (see below) IP6_4COMPAT = None From 9bf8985e2a317bfb2acad660cebe9808e108ee70 Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 30 Sep 2016 12:31:57 +0200 Subject: [PATCH 3/3] nginx-limit-req.conf: more precise failregex (word-boundary if `` should be non-greedy for some reasons) --- config/filter.d/nginx-limit-req.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/nginx-limit-req.conf b/config/filter.d/nginx-limit-req.conf index 589d3d78..13cf75c2 100644 --- a/config/filter.d/nginx-limit-req.conf +++ b/config/filter.d/nginx-limit-req.conf @@ -39,7 +39,7 @@ ngx_limit_req_zones = [^"]+ # failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: , server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$ # Shortly, much faster and stable version of regexp: -failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: +failregex = ^\s*\[error\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: , ignoreregex =