2006-09-05 21:17:35 +00:00
|
|
|
# This file is part of Fail2Ban.
|
|
|
|
#
|
|
|
|
# Fail2Ban is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
|
|
|
# Fail2Ban is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with Fail2Ban; if not, write to the Free Software
|
|
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
|
|
|
|
# Author: Cyril Jaquier
|
|
|
|
#
|
|
|
|
# $Revision: 321 $
|
|
|
|
|
|
|
|
__author__ = "Cyril Jaquier"
|
|
|
|
__version__ = "$Revision: 321 $"
|
|
|
|
__date__ = "$Date: 2006-09-04 21:19:58 +0200 (Mon, 04 Sep 2006) $"
|
|
|
|
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
|
|
|
__license__ = "GPL"
|
|
|
|
|
2006-09-10 20:43:13 +00:00
|
|
|
import time, logging
|
2006-09-05 21:17:35 +00:00
|
|
|
|
2006-09-10 20:43:13 +00:00
|
|
|
from datestrptime import DateStrptime
|
|
|
|
from datetai64n import DateTai64n
|
|
|
|
from dateepoch import DateEpoch
|
|
|
|
from threading import Lock
|
|
|
|
|
|
|
|
# Gets the instance of the logger.
|
|
|
|
logSys = logging.getLogger("fail2ban.filter.datedetector")
|
2006-09-05 21:17:35 +00:00
|
|
|
|
|
|
|
class DateDetector:
|
|
|
|
|
|
|
|
def __init__(self):
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock = Lock()
|
|
|
|
self.__templates = list()
|
2006-11-12 21:57:26 +00:00
|
|
|
self.__defTemplate = DateStrptime()
|
2006-09-05 21:17:35 +00:00
|
|
|
|
|
|
|
def addDefaultTemplate(self):
|
2006-09-10 20:43:13 +00:00
|
|
|
# standard
|
|
|
|
template = DateStrptime()
|
|
|
|
template.setName("Month Day Hour:Minute:Second")
|
|
|
|
template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
|
2006-09-05 21:17:35 +00:00
|
|
|
template.setPattern("%b %d %H:%M:%S")
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__templates.append(template)
|
2006-09-10 20:43:13 +00:00
|
|
|
# asctime
|
|
|
|
template = DateStrptime()
|
|
|
|
template.setName("Weekday Month Day Hour:Minute:Second Year")
|
2006-09-11 21:15:24 +00:00
|
|
|
template.setRegex("\S{3} \S{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}")
|
2006-09-05 21:17:35 +00:00
|
|
|
template.setPattern("%a %b %d %H:%M:%S %Y")
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__templates.append(template)
|
2006-10-19 20:26:24 +00:00
|
|
|
# simple date
|
|
|
|
template = DateStrptime()
|
|
|
|
template.setName("Year/Month/Day Hour:Minute:Second")
|
|
|
|
template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
|
|
|
|
template.setPattern("%Y/%m/%d %H:%M:%S")
|
|
|
|
self.__templates.append(template)
|
2006-10-31 22:22:40 +00:00
|
|
|
# Apache format [31/Oct/2006:09:22:55 -0000]
|
|
|
|
template = DateStrptime()
|
|
|
|
template.setName("Day/Month/Year:Hour:Minute:Second")
|
|
|
|
template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
|
|
|
|
template.setPattern("%d/%b/%Y:%H:%M:%S")
|
|
|
|
self.__templates.append(template)
|
2006-09-10 20:43:13 +00:00
|
|
|
# TAI64N
|
|
|
|
template = DateTai64n()
|
|
|
|
template.setName("TAI64N")
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__templates.append(template)
|
2006-09-10 20:43:13 +00:00
|
|
|
# Epoch
|
|
|
|
template = DateEpoch()
|
|
|
|
template.setName("Epoch")
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__templates.append(template)
|
2006-09-05 21:17:35 +00:00
|
|
|
|
2006-09-19 22:21:20 +00:00
|
|
|
def getTemplates(self):
|
|
|
|
return self.__templates
|
|
|
|
|
2006-09-05 21:17:35 +00:00
|
|
|
def setDefaultRegex(self, value):
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__defTemplate.setRegex(value)
|
2006-09-05 21:17:35 +00:00
|
|
|
|
|
|
|
def getDefaultRegex(self):
|
2006-09-19 20:38:32 +00:00
|
|
|
return self.__defTemplate.getRegex()
|
2006-09-05 21:17:35 +00:00
|
|
|
|
|
|
|
def setDefaultPattern(self, value):
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__defTemplate.setPattern(value)
|
2006-09-05 21:17:35 +00:00
|
|
|
|
|
|
|
def getDefaultPattern(self):
|
2006-09-19 20:38:32 +00:00
|
|
|
return self.__defTemplate.getPattern()
|
2006-09-05 21:17:35 +00:00
|
|
|
|
|
|
|
def matchTime(self, line):
|
2006-09-19 20:38:32 +00:00
|
|
|
if self.__defTemplate.isValid():
|
|
|
|
return self.__defTemplate.matchDate(line)
|
2006-09-05 21:17:35 +00:00
|
|
|
else:
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.acquire()
|
|
|
|
for template in self.__templates:
|
2006-09-05 21:17:35 +00:00
|
|
|
match = template.matchDate(line)
|
2006-10-24 19:40:51 +00:00
|
|
|
if not match == None:
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.release()
|
2006-09-05 21:17:35 +00:00
|
|
|
return match
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.release()
|
2006-09-05 21:17:35 +00:00
|
|
|
return None
|
|
|
|
|
|
|
|
def getTime(self, line):
|
2006-09-19 20:38:32 +00:00
|
|
|
if self.__defTemplate.isValid():
|
2006-09-05 21:17:35 +00:00
|
|
|
try:
|
2006-09-19 20:38:32 +00:00
|
|
|
date = self.__defTemplate.getDate(line)
|
2006-09-05 21:17:35 +00:00
|
|
|
return date
|
|
|
|
except ValueError:
|
|
|
|
return None
|
|
|
|
else:
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.acquire()
|
|
|
|
for template in self.__templates:
|
2006-09-05 21:17:35 +00:00
|
|
|
try:
|
|
|
|
date = template.getDate(line)
|
2006-09-10 20:43:13 +00:00
|
|
|
if date == None:
|
|
|
|
continue
|
2006-09-05 21:17:35 +00:00
|
|
|
template.incHits()
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.release()
|
2006-09-05 21:17:35 +00:00
|
|
|
return date
|
|
|
|
except ValueError:
|
|
|
|
pass
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.release()
|
2006-09-05 21:17:35 +00:00
|
|
|
return None
|
|
|
|
|
|
|
|
def getUnixTime(self, line):
|
|
|
|
date = self.getTime(line)
|
|
|
|
if date == None:
|
|
|
|
return None
|
|
|
|
else:
|
|
|
|
return time.mktime(date)
|
|
|
|
|
2006-09-10 20:43:13 +00:00
|
|
|
##
|
|
|
|
# Sort the template lists using the hits score. This method is not called
|
|
|
|
# in this object and thus should be called from time to time.
|
|
|
|
|
2006-09-05 21:17:35 +00:00
|
|
|
def sortTemplate(self):
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.acquire()
|
2006-09-10 20:43:13 +00:00
|
|
|
logSys.debug("Sorting the template list")
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__templates.sort(cmp = lambda x, y: cmp(x.getHits(), y.getHits()),
|
2006-09-05 21:17:35 +00:00
|
|
|
reverse=True)
|
2006-09-19 20:38:32 +00:00
|
|
|
self.__lock.release()
|