2011-10-07 19:47:50 +00:00
|
|
|
# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
|
|
|
|
# vi: set ft=python sts=4 ts=4 sw=4 noet :
|
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
# This file is part of Fail2Ban.
|
|
|
|
#
|
|
|
|
# Fail2Ban is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
|
|
|
# Fail2Ban is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with Fail2Ban; if not, write to the Free Software
|
2011-11-21 12:20:20 +00:00
|
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
2006-06-26 20:05:00 +00:00
|
|
|
|
2013-05-03 03:25:43 +00:00
|
|
|
__author__ = "Cyril Jaquier and Fail2Ban Contributors"
|
|
|
|
__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
|
2006-06-26 20:05:00 +00:00
|
|
|
__license__ = "GPL"
|
|
|
|
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
import sys
|
|
|
|
|
2012-11-05 22:02:11 +00:00
|
|
|
from failmanager import FailManagerEmpty
|
2006-06-26 20:05:00 +00:00
|
|
|
from failmanager import FailManager
|
2007-12-17 20:04:29 +00:00
|
|
|
from ticket import FailTicket
|
2006-06-26 20:05:00 +00:00
|
|
|
from jailthread import JailThread
|
2006-09-05 21:16:28 +00:00
|
|
|
from datedetector import DateDetector
|
2006-10-18 22:30:57 +00:00
|
|
|
from mytime import MyTime
|
2007-12-16 18:05:07 +00:00
|
|
|
from failregex import FailRegex, Regex, RegexException
|
2013-10-21 13:15:13 +00:00
|
|
|
from action import Action
|
2006-09-05 21:16:28 +00:00
|
|
|
|
2013-10-21 13:15:13 +00:00
|
|
|
import logging, re, os, fcntl, time, shlex, subprocess
|
2006-06-26 20:05:00 +00:00
|
|
|
|
|
|
|
# Gets the instance of the logger.
|
|
|
|
logSys = logging.getLogger("fail2ban.filter")
|
|
|
|
|
|
|
|
##
|
|
|
|
# Log reader class.
|
|
|
|
#
|
|
|
|
# This class reads a log file and detects login failures or anything else
|
2013-03-10 22:05:33 +00:00
|
|
|
# that matches a given regular expression. This class is instantiated by
|
2006-06-26 20:05:00 +00:00
|
|
|
# a Jail object.
|
|
|
|
|
|
|
|
class Filter(JailThread):
|
|
|
|
|
|
|
|
##
|
|
|
|
# Constructor.
|
|
|
|
#
|
|
|
|
# Initialize the filter object with default values.
|
|
|
|
# @param jail the jail object
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2012-06-16 03:43:11 +00:00
|
|
|
def __init__(self, jail, useDns='warn'):
|
2006-10-24 19:40:51 +00:00
|
|
|
JailThread.__init__(self)
|
2006-06-26 20:05:00 +00:00
|
|
|
## The jail which contains this filter.
|
|
|
|
self.jail = jail
|
|
|
|
## The failures manager.
|
|
|
|
self.failManager = FailManager()
|
2006-12-23 16:31:00 +00:00
|
|
|
## The regular expression list matching the failures.
|
|
|
|
self.__failRegex = list()
|
|
|
|
## The regular expression list with expressions to ignore.
|
|
|
|
self.__ignoreRegex = list()
|
2012-01-13 04:23:41 +00:00
|
|
|
## Use DNS setting
|
2012-06-16 03:43:11 +00:00
|
|
|
self.setUseDns(useDns)
|
2006-06-26 20:05:00 +00:00
|
|
|
## The amount of time to look back.
|
2006-09-21 20:55:45 +00:00
|
|
|
self.__findTime = 6000
|
2006-06-26 20:05:00 +00:00
|
|
|
## The ignore IP list.
|
2006-09-21 20:55:45 +00:00
|
|
|
self.__ignoreIpList = []
|
2013-10-21 13:15:13 +00:00
|
|
|
## External command
|
|
|
|
self.__ignoreCommand = False
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-09-05 21:16:28 +00:00
|
|
|
self.dateDetector = DateDetector()
|
|
|
|
self.dateDetector.addDefaultTemplate()
|
2012-02-11 02:59:26 +00:00
|
|
|
logSys.debug("Created %s" % self)
|
2006-06-26 20:05:00 +00:00
|
|
|
|
2006-09-14 22:05:32 +00:00
|
|
|
|
2012-02-11 02:59:26 +00:00
|
|
|
def __repr__(self):
|
|
|
|
return "%s(%r)" % (self.__class__.__name__, self.jail)
|
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
2006-12-23 16:31:00 +00:00
|
|
|
# Add a regular expression which matches the failure.
|
2006-06-26 20:05:00 +00:00
|
|
|
#
|
|
|
|
# The regular expression can also match any other pattern than failures
|
|
|
|
# and thus can be used for many purporse.
|
|
|
|
# @param value the regular expression
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-12-23 16:31:00 +00:00
|
|
|
def addFailRegex(self, value):
|
2006-10-31 22:24:34 +00:00
|
|
|
try:
|
2006-12-23 16:31:00 +00:00
|
|
|
regex = FailRegex(value)
|
|
|
|
self.__failRegex.append(regex)
|
|
|
|
except RegexException, e:
|
|
|
|
logSys.error(e)
|
2013-03-10 14:55:39 +00:00
|
|
|
raise e
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-12-23 16:31:00 +00:00
|
|
|
|
|
|
|
def delFailRegex(self, index):
|
|
|
|
try:
|
|
|
|
del self.__failRegex[index]
|
|
|
|
except IndexError:
|
|
|
|
logSys.error("Cannot remove regular expression. Index %d is not "
|
|
|
|
"valid" % index)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Get the regular expression which matches the failure.
|
|
|
|
#
|
|
|
|
# @return the regular expression
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def getFailRegex(self):
|
2006-12-23 16:31:00 +00:00
|
|
|
failRegex = list()
|
|
|
|
for regex in self.__failRegex:
|
|
|
|
failRegex.append(regex.getRegex())
|
|
|
|
return failRegex
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-11-12 14:52:36 +00:00
|
|
|
##
|
2006-12-23 16:31:00 +00:00
|
|
|
# Add the regular expression which matches the failure.
|
2006-11-12 14:52:36 +00:00
|
|
|
#
|
|
|
|
# The regular expression can also match any other pattern than failures
|
2013-03-10 22:05:33 +00:00
|
|
|
# and thus can be used for many purpose.
|
2006-11-12 14:52:36 +00:00
|
|
|
# @param value the regular expression
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-12-23 16:31:00 +00:00
|
|
|
def addIgnoreRegex(self, value):
|
2006-11-12 14:52:36 +00:00
|
|
|
try:
|
2006-12-23 16:31:00 +00:00
|
|
|
regex = Regex(value)
|
|
|
|
self.__ignoreRegex.append(regex)
|
|
|
|
except RegexException, e:
|
|
|
|
logSys.error(e)
|
2013-03-10 14:55:39 +00:00
|
|
|
raise e
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-12-23 16:31:00 +00:00
|
|
|
def delIgnoreRegex(self, index):
|
|
|
|
try:
|
|
|
|
del self.__ignoreRegex[index]
|
|
|
|
except IndexError:
|
|
|
|
logSys.error("Cannot remove regular expression. Index %d is not "
|
|
|
|
"valid" % index)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-11-12 14:52:36 +00:00
|
|
|
##
|
|
|
|
# Get the regular expression which matches the failure.
|
|
|
|
#
|
|
|
|
# @return the regular expression
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-11-12 14:52:36 +00:00
|
|
|
def getIgnoreRegex(self):
|
2006-12-23 16:31:00 +00:00
|
|
|
ignoreRegex = list()
|
|
|
|
for regex in self.__ignoreRegex:
|
|
|
|
ignoreRegex.append(regex.getRegex())
|
|
|
|
return ignoreRegex
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2012-01-13 04:23:41 +00:00
|
|
|
##
|
|
|
|
# Set the Use DNS mode
|
|
|
|
# @param value the usedns mode
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2012-01-13 04:23:41 +00:00
|
|
|
def setUseDns(self, value):
|
2012-06-16 03:43:11 +00:00
|
|
|
if isinstance(value, bool):
|
|
|
|
value = {True: 'yes', False: 'no'}[value]
|
|
|
|
value = value.lower() # must be a string by now
|
|
|
|
if not (value in ('yes', 'no', 'warn')):
|
|
|
|
logSys.error("Incorrect value %r specified for usedns. "
|
|
|
|
"Using safe 'no'" % (value,))
|
|
|
|
value = 'no'
|
2012-02-11 02:59:26 +00:00
|
|
|
logSys.debug("Setting usedns = %s for %s" % (value, self))
|
2012-01-13 04:23:41 +00:00
|
|
|
self.__useDns = value
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2012-01-13 04:23:41 +00:00
|
|
|
##
|
|
|
|
# Get the usedns mode
|
|
|
|
# @return the usedns mode
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2012-01-13 04:23:41 +00:00
|
|
|
def getUseDns(self):
|
|
|
|
return self.__useDns
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Set the time needed to find a failure.
|
|
|
|
#
|
|
|
|
# This value tells the filter how long it has to take failures into
|
|
|
|
# account.
|
|
|
|
# @param value the time
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def setFindTime(self, value):
|
2006-09-21 20:55:45 +00:00
|
|
|
self.__findTime = value
|
2006-11-18 15:15:58 +00:00
|
|
|
self.failManager.setMaxTime(value)
|
2006-06-26 20:05:00 +00:00
|
|
|
logSys.info("Set findtime = %s" % value)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Get the time needed to find a failure.
|
|
|
|
#
|
|
|
|
# @return the time
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def getFindTime(self):
|
2006-09-21 20:55:45 +00:00
|
|
|
return self.__findTime
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Set the maximum retry value.
|
|
|
|
#
|
|
|
|
# @param value the retry value
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def setMaxRetry(self, value):
|
|
|
|
self.failManager.setMaxRetry(value)
|
|
|
|
logSys.info("Set maxRetry = %s" % value)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Get the maximum retry value.
|
|
|
|
#
|
|
|
|
# @return the retry value
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def getMaxRetry(self):
|
|
|
|
return self.failManager.getMaxRetry()
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Main loop.
|
|
|
|
#
|
|
|
|
# This function is the main loop of the thread. It checks if the
|
|
|
|
# file has been modified and looks for failures.
|
|
|
|
# @return True when the thread exits nicely
|
|
|
|
|
2013-03-10 04:18:42 +00:00
|
|
|
def run(self): # pragma: no cover
|
2006-09-14 22:05:32 +00:00
|
|
|
raise Exception("run() is abstract")
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2013-10-21 13:15:13 +00:00
|
|
|
##
|
|
|
|
# Set external command, for ignoredips
|
|
|
|
#
|
|
|
|
|
|
|
|
def setIgnoreCommand(self, command):
|
|
|
|
self.__ignoreCommand = command
|
|
|
|
|
|
|
|
##
|
|
|
|
# Get external command, for ignoredips
|
|
|
|
#
|
|
|
|
|
|
|
|
def getIgnoreCommand(self):
|
|
|
|
return self.__ignoreCommand
|
|
|
|
|
2009-08-30 18:26:15 +00:00
|
|
|
##
|
|
|
|
# Ban an IP - http://blogs.buanzo.com.ar/2009/04/fail2ban-patch-ban-ip-address-manually.html
|
|
|
|
# Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
|
|
|
|
#
|
|
|
|
# to enable banip fail2ban-client BAN command
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2009-08-30 18:26:15 +00:00
|
|
|
def addBannedIP(self, ip):
|
2013-12-04 11:27:23 +00:00
|
|
|
if self.inIgnoreIPList(ip):
|
2013-12-09 12:07:42 +00:00
|
|
|
logSys.warning('Requested to manually ban an ignored IP %s. User knows best. Proceeding to ban it.' % ip)
|
2013-12-04 11:27:23 +00:00
|
|
|
|
2012-11-06 01:09:15 +00:00
|
|
|
unixTime = MyTime.time()
|
2012-05-01 21:13:21 +00:00
|
|
|
for i in xrange(self.failManager.getMaxRetry()):
|
|
|
|
self.failManager.addFailure(FailTicket(ip, unixTime))
|
|
|
|
|
2012-11-05 22:02:11 +00:00
|
|
|
# Perform the banning of the IP now.
|
2013-03-10 04:18:42 +00:00
|
|
|
try: # pragma: no branch - exception is the only way out
|
2012-11-05 22:02:11 +00:00
|
|
|
while True:
|
|
|
|
ticket = self.failManager.toBan()
|
|
|
|
self.jail.putFailTicket(ticket)
|
|
|
|
except FailManagerEmpty:
|
|
|
|
self.failManager.cleanup(MyTime.time())
|
|
|
|
|
2009-08-30 18:26:15 +00:00
|
|
|
return ip
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
2006-09-27 20:32:30 +00:00
|
|
|
# Add an IP/DNS to the ignore list.
|
2006-06-26 20:05:00 +00:00
|
|
|
#
|
|
|
|
# IP addresses in the ignore list are not taken into account
|
2006-09-27 20:32:30 +00:00
|
|
|
# when finding failures. CIDR mask and DNS are also accepted.
|
2006-06-26 20:05:00 +00:00
|
|
|
# @param ip IP address to ignore
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def addIgnoreIP(self, ip):
|
2006-09-27 20:32:30 +00:00
|
|
|
logSys.debug("Add " + ip + " to ignore list")
|
|
|
|
self.__ignoreIpList.append(ip)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-09-17 22:01:14 +00:00
|
|
|
def delIgnoreIP(self, ip):
|
|
|
|
logSys.debug("Remove " + ip + " from ignore list")
|
2006-09-21 20:55:45 +00:00
|
|
|
self.__ignoreIpList.remove(ip)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-09-17 22:01:14 +00:00
|
|
|
def getIgnoreIP(self):
|
2006-09-21 20:55:45 +00:00
|
|
|
return self.__ignoreIpList
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
2006-09-27 20:32:30 +00:00
|
|
|
# Check if IP address/DNS is in the ignore list.
|
2006-06-26 20:05:00 +00:00
|
|
|
#
|
2006-09-27 20:32:30 +00:00
|
|
|
# Check if the given IP address matches an IP address/DNS or a CIDR
|
2006-06-26 20:05:00 +00:00
|
|
|
# mask in the ignore list.
|
|
|
|
# @param ip IP address
|
|
|
|
# @return True if IP address is in ignore list
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
def inIgnoreIPList(self, ip):
|
2006-09-21 20:55:45 +00:00
|
|
|
for i in self.__ignoreIpList:
|
2006-09-27 20:32:30 +00:00
|
|
|
# An empty string is always false
|
|
|
|
if i == "":
|
2007-11-26 23:15:27 +00:00
|
|
|
continue
|
2006-06-26 20:05:00 +00:00
|
|
|
s = i.split('/', 1)
|
|
|
|
# IP address without CIDR mask
|
|
|
|
if len(s) == 1:
|
|
|
|
s.insert(1, '32')
|
|
|
|
s[1] = long(s[1])
|
|
|
|
try:
|
2006-08-20 20:39:45 +00:00
|
|
|
a = DNSUtils.cidr(s[0], s[1])
|
|
|
|
b = DNSUtils.cidr(ip, s[1])
|
2006-06-26 20:05:00 +00:00
|
|
|
except Exception:
|
2006-09-27 20:32:30 +00:00
|
|
|
# Check if IP in DNS
|
|
|
|
ips = DNSUtils.dnsToIp(i)
|
|
|
|
if ip in ips:
|
|
|
|
return True
|
|
|
|
else:
|
2007-11-26 23:15:27 +00:00
|
|
|
continue
|
2006-06-26 20:05:00 +00:00
|
|
|
if a == b:
|
|
|
|
return True
|
2013-10-21 13:15:13 +00:00
|
|
|
|
|
|
|
if self.__ignoreCommand:
|
|
|
|
command = Action.replaceTag(self.__ignoreCommand, { 'ip': ip } )
|
|
|
|
logSys.debug('ignore command: ' + command)
|
|
|
|
return Action.executeCmd(command)
|
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
return False
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
|
2013-07-15 21:16:40 +00:00
|
|
|
def processLine(self, line, returnRawHost=False, checkAllRegex=False):
|
2012-06-29 16:58:53 +00:00
|
|
|
"""Split the time portion from log msg and return findFailures on them
|
|
|
|
"""
|
2007-12-26 11:46:22 +00:00
|
|
|
try:
|
|
|
|
# Decode line to UTF-8
|
|
|
|
l = line.decode('utf-8')
|
|
|
|
except UnicodeDecodeError:
|
2008-01-14 23:12:21 +00:00
|
|
|
l = line
|
2013-05-08 16:07:26 +00:00
|
|
|
l = l.rstrip('\r\n')
|
2013-06-14 02:56:36 +00:00
|
|
|
|
2013-07-09 16:47:41 +00:00
|
|
|
logSys.log(7, "Working on line %r", l)
|
2008-01-14 23:12:21 +00:00
|
|
|
timeMatch = self.dateDetector.matchTime(l)
|
2008-08-12 22:40:07 +00:00
|
|
|
if timeMatch:
|
|
|
|
# Lets split into time part and log part of the line
|
|
|
|
timeLine = timeMatch.group()
|
|
|
|
# Lets leave the beginning in as well, so if there is no
|
|
|
|
# anchore at the beginning of the time regexp, we don't
|
|
|
|
# at least allow injection. Should be harmless otherwise
|
|
|
|
logLine = l[:timeMatch.start()] + l[timeMatch.end():]
|
|
|
|
else:
|
|
|
|
timeLine = l
|
|
|
|
logLine = l
|
2013-09-22 03:20:17 +00:00
|
|
|
return logLine, self.findFailure(timeLine, logLine, returnRawHost, checkAllRegex)
|
2008-03-04 00:17:56 +00:00
|
|
|
|
|
|
|
def processLineAndAdd(self, line):
|
2012-06-29 16:58:53 +00:00
|
|
|
"""Processes the line for failures and populates failManager
|
|
|
|
"""
|
2013-09-22 03:20:17 +00:00
|
|
|
for element in self.processLine(line)[1]:
|
2013-07-15 21:16:40 +00:00
|
|
|
failregex = element[0]
|
|
|
|
ip = element[1]
|
|
|
|
unixTime = element[2]
|
2010-09-21 17:52:44 +00:00
|
|
|
logSys.debug("Processing line with time:%s and ip:%s"
|
|
|
|
% (unixTime, ip))
|
2008-03-04 00:17:56 +00:00
|
|
|
if unixTime < MyTime.time() - self.getFindTime():
|
2010-09-21 17:52:44 +00:00
|
|
|
logSys.debug("Ignore line since time %s < %s - %s"
|
|
|
|
% (unixTime, MyTime.time(), self.getFindTime()))
|
2007-12-26 11:46:22 +00:00
|
|
|
break
|
|
|
|
if self.inIgnoreIPList(ip):
|
2008-03-04 00:17:56 +00:00
|
|
|
logSys.debug("Ignore %s" % ip)
|
2007-12-26 11:46:22 +00:00
|
|
|
continue
|
2008-03-04 00:17:56 +00:00
|
|
|
logSys.debug("Found %s" % ip)
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
## print "D: Adding a ticket for %s" % ((ip, unixTime, [line]),)
|
2011-10-05 14:44:35 +00:00
|
|
|
self.failManager.addFailure(FailTicket(ip, unixTime, [line]))
|
2007-12-26 11:46:22 +00:00
|
|
|
|
|
|
|
##
|
|
|
|
# Returns true if the line should be ignored.
|
|
|
|
#
|
|
|
|
# Uses ignoreregex.
|
|
|
|
# @param line: the line
|
|
|
|
# @return: a boolean
|
|
|
|
|
|
|
|
def ignoreLine(self, line):
|
2013-07-15 21:16:40 +00:00
|
|
|
for ignoreRegexIndex, ignoreRegex in enumerate(self.__ignoreRegex):
|
2007-12-26 11:46:22 +00:00
|
|
|
ignoreRegex.search(line)
|
|
|
|
if ignoreRegex.hasMatched():
|
2013-07-15 21:16:40 +00:00
|
|
|
return ignoreRegexIndex
|
|
|
|
return None
|
2007-12-26 11:46:22 +00:00
|
|
|
|
|
|
|
##
|
|
|
|
# Finds the failure in a line given split into time and log parts.
|
|
|
|
#
|
|
|
|
# Uses the failregex pattern to find it and timeregex in order
|
|
|
|
# to find the logging time.
|
|
|
|
# @return a dict with IP and timestamp.
|
|
|
|
|
2013-07-15 21:16:40 +00:00
|
|
|
def findFailure(self, timeLine, logLine,
|
|
|
|
returnRawHost=False, checkAllRegex=False):
|
2013-07-09 16:47:41 +00:00
|
|
|
logSys.log(5, "Date: %r, message: %r", timeLine, logLine)
|
2007-12-26 11:46:22 +00:00
|
|
|
failList = list()
|
|
|
|
# Checks if we must ignore this line.
|
2013-07-15 21:16:40 +00:00
|
|
|
if self.ignoreLine(logLine) is not None:
|
2007-12-26 11:46:22 +00:00
|
|
|
# The ignoreregex matched. Return.
|
2013-07-09 16:47:41 +00:00
|
|
|
logSys.log(7, "Matched ignoreregex and was ignored")
|
2007-12-26 11:46:22 +00:00
|
|
|
return failList
|
2013-07-15 21:16:40 +00:00
|
|
|
date = self.dateDetector.getUnixTime(timeLine)
|
2007-12-26 11:46:22 +00:00
|
|
|
# Iterates over all the regular expressions.
|
2013-07-15 21:16:40 +00:00
|
|
|
for failRegexIndex, failRegex in enumerate(self.__failRegex):
|
2007-12-26 11:46:22 +00:00
|
|
|
failRegex.search(logLine)
|
|
|
|
if failRegex.hasMatched():
|
|
|
|
# The failregex matched.
|
2013-07-09 16:47:41 +00:00
|
|
|
logSys.log(7, "Matched %s", failRegex)
|
2013-05-03 03:25:43 +00:00
|
|
|
if date is None:
|
2012-06-29 16:58:53 +00:00
|
|
|
logSys.debug("Found a match for %r but no valid date/time "
|
|
|
|
"found for %r. Please file a detailed issue on"
|
|
|
|
" https://github.com/fail2ban/fail2ban/issues "
|
|
|
|
"in order to get support for this format."
|
|
|
|
% (logLine, timeLine))
|
2007-12-26 11:46:22 +00:00
|
|
|
else:
|
|
|
|
try:
|
|
|
|
host = failRegex.getHost()
|
2013-07-13 22:03:01 +00:00
|
|
|
if returnRawHost:
|
2013-07-15 21:16:40 +00:00
|
|
|
failList.append([failRegexIndex, host, date])
|
|
|
|
if not checkAllRegex:
|
|
|
|
break
|
|
|
|
else:
|
|
|
|
ipMatch = DNSUtils.textToIp(host, self.__useDns)
|
|
|
|
if ipMatch:
|
|
|
|
for ip in ipMatch:
|
|
|
|
failList.append([failRegexIndex, ip, date])
|
|
|
|
if not checkAllRegex:
|
|
|
|
break
|
2013-03-10 04:18:42 +00:00
|
|
|
except RegexException, e: # pragma: no cover - unsure if reachable
|
2007-12-26 11:46:22 +00:00
|
|
|
logSys.error(e)
|
|
|
|
return failList
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
|
|
|
|
##
|
|
|
|
# Get the status of the filter.
|
|
|
|
#
|
|
|
|
# Get some informations about the filter state such as the total
|
|
|
|
# number of failures.
|
|
|
|
# @return a list with tuple
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
def status(self):
|
2012-06-29 16:58:53 +00:00
|
|
|
ret = [("Currently failed", self.failManager.size()),
|
|
|
|
("Total failed", self.failManager.getFailTotal())]
|
2007-12-26 11:46:22 +00:00
|
|
|
return ret
|
|
|
|
|
|
|
|
|
|
|
|
class FileFilter(Filter):
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2012-06-16 03:43:11 +00:00
|
|
|
def __init__(self, jail, **kwargs):
|
|
|
|
Filter.__init__(self, jail, **kwargs)
|
2007-12-26 11:46:22 +00:00
|
|
|
## The log file path.
|
|
|
|
self.__logPath = []
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
##
|
|
|
|
# Add a log file path
|
|
|
|
#
|
|
|
|
# @param path log file path
|
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def addLogPath(self, path, tail = False):
|
2012-07-19 21:26:09 +00:00
|
|
|
if self.containsLogPath(path):
|
|
|
|
logSys.error(path + " already exists")
|
|
|
|
else:
|
|
|
|
container = FileContainer(path, tail)
|
|
|
|
self.__logPath.append(container)
|
|
|
|
logSys.info("Added logfile = %s" % path)
|
|
|
|
self._addLogPath(path) # backend specific
|
|
|
|
|
|
|
|
def _addLogPath(self, path):
|
|
|
|
# nothing to do by default
|
2013-03-10 22:05:33 +00:00
|
|
|
# to be overridden by backends
|
2012-07-19 21:26:09 +00:00
|
|
|
pass
|
|
|
|
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
##
|
|
|
|
# Delete a log path
|
|
|
|
#
|
|
|
|
# @param path the log file to delete
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
def delLogPath(self, path):
|
2008-01-14 23:12:21 +00:00
|
|
|
for log in self.__logPath:
|
|
|
|
if log.getFileName() == path:
|
|
|
|
self.__logPath.remove(log)
|
2012-07-19 21:26:09 +00:00
|
|
|
logSys.info("Removed logfile = %s" % path)
|
|
|
|
self._delLogPath(path)
|
2008-01-14 23:12:21 +00:00
|
|
|
return
|
2007-12-26 11:46:22 +00:00
|
|
|
|
2013-12-10 23:46:52 +00:00
|
|
|
def _delLogPath(self, path): # pragma: no cover - overwritten function
|
2012-07-19 21:26:09 +00:00
|
|
|
# nothing to do by default
|
2013-03-10 22:05:33 +00:00
|
|
|
# to be overridden by backends
|
2012-07-19 21:26:09 +00:00
|
|
|
pass
|
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
##
|
|
|
|
# Get the log file path
|
|
|
|
#
|
|
|
|
# @return log file path
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
def getLogPath(self):
|
|
|
|
return self.__logPath
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
##
|
|
|
|
# Check whether path is already monitored.
|
|
|
|
#
|
|
|
|
# @param path The path
|
|
|
|
# @return True if the path is already monitored else False
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-26 11:46:22 +00:00
|
|
|
def containsLogPath(self, path):
|
2008-01-14 23:12:21 +00:00
|
|
|
for log in self.__logPath:
|
|
|
|
if log.getFileName() == path:
|
|
|
|
return True
|
2006-09-20 22:39:16 +00:00
|
|
|
return False
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def getFileContainer(self, path):
|
|
|
|
for log in self.__logPath:
|
|
|
|
if log.getFileName() == path:
|
|
|
|
return log
|
|
|
|
return None
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
##
|
|
|
|
# Gets all the failure in the log file.
|
|
|
|
#
|
|
|
|
# Gets all the failure in the log file which are newer than
|
2006-10-18 22:30:57 +00:00
|
|
|
# MyTime.time()-self.findTime. When a failure is detected, a FailTicket
|
2006-06-26 20:05:00 +00:00
|
|
|
# is created and is added to the FailManager.
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2006-09-19 21:22:27 +00:00
|
|
|
def getFailures(self, filename):
|
2008-01-14 23:12:21 +00:00
|
|
|
container = self.getFileContainer(filename)
|
2013-05-03 03:25:43 +00:00
|
|
|
if container is None:
|
2006-09-20 22:39:16 +00:00
|
|
|
logSys.error("Unable to get failures in " + filename)
|
|
|
|
return False
|
2008-01-14 23:12:21 +00:00
|
|
|
# Try to open log file.
|
|
|
|
try:
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
has_content = container.open()
|
2013-03-10 04:29:27 +00:00
|
|
|
# see http://python.org/dev/peps/pep-3151/
|
|
|
|
except IOError, e:
|
2008-01-14 23:12:21 +00:00
|
|
|
logSys.error("Unable to open %s" % filename)
|
|
|
|
logSys.exception(e)
|
|
|
|
return False
|
2013-03-10 04:29:27 +00:00
|
|
|
except OSError, e: # pragma: no cover - requires race condition to tigger this
|
|
|
|
logSys.error("Error opening %s" % filename)
|
|
|
|
logSys.exception(e)
|
|
|
|
return False
|
2013-03-10 06:10:40 +00:00
|
|
|
except OSError, e: # pragma: no cover - Requires implemention error in FileContainer to generate
|
|
|
|
logSys.error("Internal errror in FileContainer open method - please report as a bug to https://github.com/fail2ban/fail2ban/issues")
|
|
|
|
logSys.exception(e)
|
|
|
|
return False
|
2012-06-29 16:58:53 +00:00
|
|
|
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
# yoh: has_content is just a bool, so do not expect it to
|
|
|
|
# change -- loop is exited upon break, and is not entered at
|
|
|
|
# all if upon container opening that one was empty. If we
|
|
|
|
# start reading tested to be empty container -- race condition
|
|
|
|
# might occur leading at least to tests failures.
|
|
|
|
while has_content:
|
2012-07-19 05:10:59 +00:00
|
|
|
line = container.readline()
|
|
|
|
if (line == "") or not self._isActive():
|
|
|
|
# The jail reached the bottom or has been stopped
|
2006-10-30 22:48:52 +00:00
|
|
|
break
|
2008-03-04 00:17:56 +00:00
|
|
|
self.processLineAndAdd(line)
|
2008-01-14 23:12:21 +00:00
|
|
|
container.close()
|
2006-09-20 22:39:16 +00:00
|
|
|
return True
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def status(self):
|
|
|
|
ret = Filter.status(self)
|
|
|
|
path = [m.getFileName() for m in self.getLogPath()]
|
|
|
|
ret.append(("File list", path))
|
|
|
|
return ret
|
|
|
|
|
|
|
|
##
|
|
|
|
# FileContainer class.
|
|
|
|
#
|
|
|
|
# This class manages a file handler and takes care of log rotation detection.
|
|
|
|
# In order to detect log rotation, the hash (MD5) of the first line of the file
|
|
|
|
# is computed and compared to the previous hash of this line.
|
|
|
|
|
2011-11-18 19:38:24 +00:00
|
|
|
try:
|
|
|
|
import hashlib
|
|
|
|
md5sum = hashlib.md5
|
2013-03-10 04:18:42 +00:00
|
|
|
except ImportError: # pragma: no cover
|
2011-11-18 19:38:24 +00:00
|
|
|
# hashlib was introduced in Python 2.5. For compatibility with those
|
|
|
|
# elderly Pythons, import from md5
|
|
|
|
import md5
|
|
|
|
md5sum = md5.new
|
2008-01-14 23:12:21 +00:00
|
|
|
|
|
|
|
class FileContainer:
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def __init__(self, filename, tail = False):
|
|
|
|
self.__filename = filename
|
|
|
|
self.__tail = tail
|
|
|
|
self.__handler = None
|
|
|
|
# Try to open the file. Raises an exception if an error occured.
|
|
|
|
handler = open(filename)
|
2009-09-01 21:21:30 +00:00
|
|
|
stats = os.fstat(handler.fileno())
|
|
|
|
self.__ino = stats.st_ino
|
2008-01-14 23:12:21 +00:00
|
|
|
try:
|
|
|
|
firstLine = handler.readline()
|
|
|
|
# Computes the MD5 of the first line.
|
2011-11-18 19:38:24 +00:00
|
|
|
self.__hash = md5sum(firstLine).digest()
|
2008-01-14 23:12:21 +00:00
|
|
|
# Start at the beginning of file if tail mode is off.
|
|
|
|
if tail:
|
|
|
|
handler.seek(0, 2)
|
|
|
|
self.__pos = handler.tell()
|
|
|
|
else:
|
|
|
|
self.__pos = 0
|
|
|
|
finally:
|
|
|
|
handler.close()
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def getFileName(self):
|
|
|
|
return self.__filename
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2013-12-11 02:07:08 +00:00
|
|
|
def getPos(self):
|
|
|
|
return self.__pos
|
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def open(self):
|
|
|
|
self.__handler = open(self.__filename)
|
2009-12-15 22:57:54 +00:00
|
|
|
# Set the file descriptor to be FD_CLOEXEC
|
|
|
|
fd = self.__handler.fileno()
|
2013-04-02 17:11:59 +00:00
|
|
|
flags = fcntl.fcntl(fd, fcntl.F_GETFD)
|
|
|
|
fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
# Stat the file before even attempting to read it
|
|
|
|
stats = os.fstat(self.__handler.fileno())
|
|
|
|
if not stats.st_size:
|
|
|
|
# yoh: so it is still an empty file -- nothing should be
|
|
|
|
# read from it yet
|
|
|
|
# print "D: no content -- return"
|
|
|
|
return False
|
2008-01-14 23:12:21 +00:00
|
|
|
firstLine = self.__handler.readline()
|
|
|
|
# Computes the MD5 of the first line.
|
2011-11-18 19:38:24 +00:00
|
|
|
myHash = md5sum(firstLine).digest()
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
## print "D: fn=%s hashes=%s/%s inos=%s/%s pos=%s rotate=%s" % (
|
|
|
|
## self.__filename, self.__hash, myHash, stats.st_ino, self.__ino, self.__pos,
|
|
|
|
## self.__hash != myHash or self.__ino != stats.st_ino)
|
|
|
|
## sys.stdout.flush()
|
2009-09-01 21:21:30 +00:00
|
|
|
# Compare hash and inode
|
|
|
|
if self.__hash != myHash or self.__ino != stats.st_ino:
|
2013-03-02 00:57:56 +00:00
|
|
|
logSys.debug("Log rotation detected for %s" % self.__filename)
|
2008-01-14 23:12:21 +00:00
|
|
|
self.__hash = myHash
|
2009-09-01 21:21:30 +00:00
|
|
|
self.__ino = stats.st_ino
|
2008-01-14 23:12:21 +00:00
|
|
|
self.__pos = 0
|
|
|
|
# Sets the file pointer to the last position.
|
|
|
|
self.__handler.seek(self.__pos)
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
return True
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def readline(self):
|
2013-05-03 03:25:43 +00:00
|
|
|
if self.__handler is None:
|
2008-01-14 23:12:21 +00:00
|
|
|
return ""
|
|
|
|
return self.__handler.readline()
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2008-01-14 23:12:21 +00:00
|
|
|
def close(self):
|
2013-05-03 03:25:43 +00:00
|
|
|
if not self.__handler is None:
|
2008-01-14 23:12:21 +00:00
|
|
|
# Saves the last position.
|
|
|
|
self.__pos = self.__handler.tell()
|
|
|
|
# Closes the file.
|
|
|
|
self.__handler.close()
|
|
|
|
self.__handler = None
|
BF: race condition -- file should not be read unless it is not empty
Previous code would store md5sum of an empty line as the one
identifying the monitored file. That file then was read and possibly
failures were found. Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.
The History
-----------
In rare cases various tests failed somewhat consistently. Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.
Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
"Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.
----------------------------------------------------------------------
N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest(). Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.
N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
2013-07-03 03:37:23 +00:00
|
|
|
## print "D: Closed %s with pos %d" % (handler, self.__pos)
|
|
|
|
## sys.stdout.flush()
|
2008-01-14 23:12:21 +00:00
|
|
|
|
2006-06-26 20:05:00 +00:00
|
|
|
|
2006-08-20 20:39:45 +00:00
|
|
|
|
|
|
|
##
|
|
|
|
# Utils class for DNS and IP handling.
|
|
|
|
#
|
|
|
|
# This class contains only static methods used to handle DNS and IP
|
|
|
|
# addresses.
|
|
|
|
|
|
|
|
import socket, struct
|
|
|
|
|
|
|
|
class DNSUtils:
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2009-02-08 17:31:24 +00:00
|
|
|
IP_CRE = re.compile("^(?:\d{1,3}\.){3}\d{1,3}$")
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2006-08-20 20:39:45 +00:00
|
|
|
def dnsToIp(dns):
|
|
|
|
""" Convert a DNS into an IP address using the Python socket module.
|
|
|
|
Thanks to Kevin Drapel.
|
|
|
|
"""
|
|
|
|
try:
|
|
|
|
return socket.gethostbyname_ex(dns)[2]
|
2013-07-03 03:51:06 +00:00
|
|
|
except socket.error, e:
|
|
|
|
logSys.warn("Unable to find a corresponding IP address for %s: %s"
|
|
|
|
% (dns, e))
|
2006-08-20 20:39:45 +00:00
|
|
|
return list()
|
2007-12-16 21:38:04 +00:00
|
|
|
dnsToIp = staticmethod(dnsToIp)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2006-08-20 20:39:45 +00:00
|
|
|
def searchIP(text):
|
|
|
|
""" Search if an IP address if directly available and return
|
|
|
|
it.
|
|
|
|
"""
|
2006-09-27 20:32:30 +00:00
|
|
|
match = DNSUtils.IP_CRE.match(text)
|
2006-08-20 20:39:45 +00:00
|
|
|
if match:
|
|
|
|
return match
|
|
|
|
else:
|
|
|
|
return None
|
2007-12-16 21:38:04 +00:00
|
|
|
searchIP = staticmethod(searchIP)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2006-10-24 19:40:51 +00:00
|
|
|
def isValidIP(string):
|
2006-08-20 20:39:45 +00:00
|
|
|
""" Return true if str is a valid IP
|
|
|
|
"""
|
2006-10-24 19:40:51 +00:00
|
|
|
s = string.split('/', 1)
|
2006-08-20 20:39:45 +00:00
|
|
|
try:
|
|
|
|
socket.inet_aton(s[0])
|
|
|
|
return True
|
|
|
|
except socket.error:
|
|
|
|
return False
|
2007-12-16 21:38:04 +00:00
|
|
|
isValidIP = staticmethod(isValidIP)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2012-01-13 04:23:41 +00:00
|
|
|
def textToIp(text, useDns):
|
2006-08-20 20:39:45 +00:00
|
|
|
""" Return the IP of DNS found in a given text.
|
|
|
|
"""
|
2012-06-16 03:43:11 +00:00
|
|
|
ipList = list()
|
|
|
|
# Search for plain IP
|
|
|
|
plainIP = DNSUtils.searchIP(text)
|
|
|
|
if not plainIP is None:
|
|
|
|
plainIPStr = plainIP.group(0)
|
|
|
|
if DNSUtils.isValidIP(plainIPStr):
|
|
|
|
ipList.append(plainIPStr)
|
|
|
|
|
|
|
|
# If we are allowed to resolve -- give it a try if nothing was found
|
|
|
|
if useDns in ("yes", "warn") and not ipList:
|
|
|
|
# Try to get IP from possible DNS
|
|
|
|
ip = DNSUtils.dnsToIp(text)
|
|
|
|
ipList.extend(ip)
|
|
|
|
if ip and useDns == "warn":
|
2012-12-12 10:59:01 +00:00
|
|
|
logSys.warning("Determined IP using DNS Lookup: %s = %s",
|
2012-06-16 03:43:11 +00:00
|
|
|
text, ipList)
|
|
|
|
|
|
|
|
return ipList
|
2007-12-16 21:38:04 +00:00
|
|
|
textToIp = staticmethod(textToIp)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2006-08-20 20:39:45 +00:00
|
|
|
def cidr(i, n):
|
|
|
|
""" Convert an IP address string with a CIDR mask into a 32-bit
|
|
|
|
integer.
|
|
|
|
"""
|
|
|
|
# 32-bit IPv4 address mask
|
|
|
|
MASK = 0xFFFFFFFFL
|
|
|
|
return ~(MASK >> n) & MASK & DNSUtils.addr2bin(i)
|
2007-12-16 21:38:04 +00:00
|
|
|
cidr = staticmethod(cidr)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2006-10-24 19:40:51 +00:00
|
|
|
def addr2bin(string):
|
2006-08-20 20:39:45 +00:00
|
|
|
""" Convert a string IPv4 address into an unsigned integer.
|
|
|
|
"""
|
2006-10-24 19:40:51 +00:00
|
|
|
return struct.unpack("!L", socket.inet_aton(string))[0]
|
2007-12-16 21:38:04 +00:00
|
|
|
addr2bin = staticmethod(addr2bin)
|
2012-06-29 16:58:53 +00:00
|
|
|
|
2007-12-16 21:38:04 +00:00
|
|
|
#@staticmethod
|
2006-08-20 20:39:45 +00:00
|
|
|
def bin2addr(addr):
|
|
|
|
""" Convert a numeric IPv4 address into string n.n.n.n form.
|
|
|
|
"""
|
|
|
|
return socket.inet_ntoa(struct.pack("!L", addr))
|
2007-12-16 21:38:04 +00:00
|
|
|
bin2addr = staticmethod(bin2addr)
|