From 8c38907016ceb9d0a366ac9fa026e3f3ffbf6b44 Mon Sep 17 00:00:00 2001
From: Alan Jenkins <alan.christopher.jenkins@gmail.com>
Date: Fri, 13 Jul 2012 20:19:30 +0100
Subject: [PATCH 001/544] Misconfigured DNS should not ban *successful* ssh
 logins

Noticed while looking at the source (to see the point of ssh-ddos).

POSSIBLE BREAK-IN ATTEMPT - sounds scary?  But keep reading
the message.  It's not a login failure.  It's a warning about
reverse-DNS.  The login can still succeed, and if it _does_ fail,
that will be logged as normal.

<exhibit n="1">
Jul  9 05:43:00 brick sshd[18971]: Address 200.41.233.234 maps to host234.advance.com.
ar, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jul  9 05:43:00 brick sshd[18971]: Invalid user html from 200.41.233.234
</exhibit>

The problem (in my mind) is that some users are stuck with bad dns.
The warning won't stop them from logging in.  I'm pretty sure they can't
even see it.  But when they exceed a threshold number of logins -
which could be all successful logins - fail2ban will trigger.

fail2ban shouldn't adding additional checks to successful logins
 - it goes against the name fail2ban :)
 - the first X "POSSIBLE BREAK-IN ATTEMPT"s would be permitted anyway
 - if you want to ban bad DNS, the right way is PARANOID in /etc/hosts.deny

I've checked the source of OpenSSH, and this will only affect the
reverse-DNS error.  (I won't be offended if you want to check
for yourself though ;)

<exhibit n="2">
$ grep -r -h -C1 'ATTEMPT' openssh-5.5p1/
                logit("reverse mapping checking getaddrinfo for %.700s "
                    "[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name, ntop);
                return xstrdup(ntop);
--
                logit("Address %.100s maps to %.600s, but this does not "
                    "map back to the address - POSSIBLE BREAK-IN ATTEMPT!",
                    ntop, name);
$
</exhibit>
---
 config/filter.d/sshd.conf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index e838cecc..4a3db7cc 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -32,7 +32,6 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
             ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
-            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
 
 # Option:  ignoreregex

From 9510619b7b89f9adb3ad44f3f5377d3abd43bcbf Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 1 Nov 2012 15:24:32 -0400
Subject: [PATCH 002/544] ENH: minor -- print out why skipping a backend while
 testing

---
 fail2ban-testcases | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 0160781d..ea95e9c5 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -142,14 +142,14 @@ filters = [FilterPoll]					  # always available
 try:
 	from server.filtergamin import FilterGamin
 	filters.append(FilterGamin)
-except:
-	pass
+except Exception, e:
+	print "I: Skipping gamin backend testing. Got exception '%s'" % e
 
 try:
 	from server.filterpyinotify import FilterPyinotify
 	filters.append(FilterPyinotify)
-except:
-	pass
+except Exception, e:
+	print "I: Skipping pyinotify backend testing. Got exception '%s'" % e
 
 for Filter_ in filters:
 	tests.addTest(unittest.makeSuite(

From 5becaf8ef2b8cd37d65de8079ce38d5e2c05be6d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 1 Nov 2012 15:34:20 -0400
Subject: [PATCH 003/544] BF: (python 2.[45]) store backends names in a list to
 use .index later on (Closes gh-83)

.index() got into tuple's API only in 2.6
---
 fail2ban-testcases          | 1 +
 server/jail.py              | 4 +++-
 testcases/filtertestcase.py | 8 ++++++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index ea95e9c5..cc616c0e 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -125,6 +125,7 @@ tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFileMonitor))
 tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
 tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
+tests.addTest(unittest.makeSuite(filtertestcase.JailTests))
 
 # DateDetector
 tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
diff --git a/server/jail.py b/server/jail.py
index 4ab83db4..dee64e7f 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -33,7 +33,9 @@ logSys = logging.getLogger("fail2ban.jail")
 class Jail:
 
 	#Known backends. Each backend should have corresponding __initBackend method
-	_BACKENDS = ('pyinotify', 'gamin', 'polling')
+	# yoh: stored in a list instead of a tuple since only
+	#      list had .index until 2.6
+	_BACKENDS = ['pyinotify', 'gamin', 'polling']
 
 	def __init__(self, name, backend = "auto"):
 		self.__name = name
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index eade537f..c10fa78d 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -28,6 +28,7 @@ import sys
 import time
 import tempfile
 
+from server.jail import Jail
 from server.filterpoll import FilterPoll
 from server.filter import FileFilter, DNSUtils
 from server.failmanager import FailManager
@@ -626,3 +627,10 @@ class DNSUtilsTests(unittest.TestCase):
 				self.assertEqual(res, ['192.0.43.10'])
 			else:
 				self.assertEqual(res, [])
+
+class JailTests(unittest.TestCase):
+
+	def testSetBackend_gh83(self):
+		# smoke test
+		jail = Jail('test', backend='polling') # Must not fail to initiate
+

From 09355663f7a3c0409e08efdebf98b1bbf47d1d9c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 16:54:19 -0500
Subject: [PATCH 004/544] BF: (python 2.4) -- access to staticmethod should go
 via Class

TODO: get away from using all those staticmethods in f2b
---
 server/action.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/action.py b/server/action.py
index 387c115c..bd750337 100644
--- a/server/action.py
+++ b/server/action.py
@@ -255,7 +255,7 @@ class Action:
 			if tag == 'matches':
 				# That one needs to be escaped since its content is
 				# out of our control
-				value = escapeTag(value)
+				value = Action.escapeTag(value)
 			string = string.replace('<' + tag + '>', value)
 		# New line
 		string = string.replace("<br>", '\n')

From 8e64c281dd178e29a6ef50928f4552757043e05b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 20:09:15 -0500
Subject: [PATCH 005/544] BF: in code we should use MyTime wrapper instead of
 time module directly

to allow for some tests to work correctly
---
 server/filter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/filter.py b/server/filter.py
index d69f02aa..f71a0a06 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -220,7 +220,7 @@ class Filter(JailThread):
 	# to enable banip fail2ban-client BAN command
 
 	def addBannedIP(self, ip):
-		unixTime = time.time()
+		unixTime = MyTime.time()
 		for i in xrange(self.failManager.getMaxRetry()):
 			self.failManager.addFailure(FailTicket(ip, unixTime))
 

From 6288ec27577cb5ddeab9151b5a72c3803cf1041c Mon Sep 17 00:00:00 2001
From: David Engeset <froggywwu@gmail.com>
Date: Mon, 5 Nov 2012 15:07:33 -0800
Subject: [PATCH 006/544] Added in command option to unban and IP, just like
 using 'banip'.  Command looks like: fail2ban-client set <jail name> unbanip
 <ip>

---
 server/actions.py     | 13 +++++++++++++
 server/banmanager.py  | 26 +++++++++++++++++++++++++-
 server/server.py      |  3 +++
 server/transmitter.py |  3 +++
 4 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/server/actions.py b/server/actions.py
index f936de18..79783395 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -120,6 +120,19 @@ class Actions(JailThread):
 	def getBanTime(self):
 		return self.__banManager.getBanTime()
 	
+	##
+	# Remove a banned IP now, rather than waiting for it to expire, even if set to never expire.
+	#
+	# @return the IP string or 'None' if not unbanned.
+	def removeBannedIP(self, ip):
+		# Find the ticket with the IP.
+		ticket = self.__banManager.getTicketByIP(ip)
+		if ticket != False:
+			# Unban the IP.
+			self.__unBan(ticket)
+			return ip
+		return 'None'
+
 	##
 	# Main loop.
 	#
diff --git a/server/banmanager.py b/server/banmanager.py
index 214916b7..e9c81214 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -208,7 +208,7 @@ class BanManager:
 			return unBanList
 		finally:
 			self.__lock.release()
-	
+
 	##
 	# Flush the ban list.
 	#
@@ -223,3 +223,27 @@ class BanManager:
 			return uBList
 		finally:
 			self.__lock.release()
+
+	##
+	# Gets the ticket for the specified IP.
+	#
+	# @return the ticket for the IP or False.
+	def getTicketByIP(self, ip):
+		try:
+			ipticket = False
+			self.__lock.acquire()
+
+			# Find the ticket the IP goes with.
+			for ticket in self.__banList:
+				if ticket.getIP() == ip:
+					ipticket = ticket
+					break
+
+			unBanList = [ipticket]
+			# Remove the ticket from the ban list.
+			self.__banList = [ticket for ticket in self.__banList
+							  if ticket not in unBanList]
+
+			return ipticket
+		finally:
+			self.__lock.release()
diff --git a/server/server.py b/server/server.py
index b734f82a..d9532be2 100644
--- a/server/server.py
+++ b/server/server.py
@@ -241,6 +241,9 @@ class Server:
 	def setBanIP(self, name, value):
 		return self.__jails.getFilter(name).addBannedIP(value)
 		
+	def setUnbanIP(self, name, value):
+		return self.__jails.getAction(name).removeBannedIP(value)
+		
 	def getBanTime(self, name):
 		return self.__jails.getAction(name).getBanTime()
 	
diff --git a/server/transmitter.py b/server/transmitter.py
index a618a1a1..23b609a1 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -175,6 +175,9 @@ class Transmitter:
 		elif command[1] == "banip":
 			value = command[2]
 			return self.__server.setBanIP(name,value)
+		elif command[1] == "unbanip":
+			value = command[2]
+			return self.__server.setUnbanIP(name,value)
 		elif command[1] == "addaction":
 			value = command[2]
 			self.__server.addAction(name, value)

From f14c7ae401376ad984dde151cf7b3fd6cf5081a1 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 20:37:06 -0500
Subject: [PATCH 007/544] ENH: refactored previous commit to make it more
 Pythonic (With prev commit closes gh-86, gh-81)

---
 server/actions.py    |  2 +-
 server/banmanager.py | 18 ++++++------------
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index 79783395..3461e672 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -127,7 +127,7 @@ class Actions(JailThread):
 	def removeBannedIP(self, ip):
 		# Find the ticket with the IP.
 		ticket = self.__banManager.getTicketByIP(ip)
-		if ticket != False:
+		if ticket is not None:
 			# Unban the IP.
 			self.__unBan(ticket)
 			return ip
diff --git a/server/banmanager.py b/server/banmanager.py
index e9c81214..596dc4e9 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -230,20 +230,14 @@ class BanManager:
 	# @return the ticket for the IP or False.
 	def getTicketByIP(self, ip):
 		try:
-			ipticket = False
 			self.__lock.acquire()
 
-			# Find the ticket the IP goes with.
-			for ticket in self.__banList:
+			# Find the ticket the IP goes with and return it
+			for i, ticket in enumerate(self.__banList):
 				if ticket.getIP() == ip:
-					ipticket = ticket
-					break
-
-			unBanList = [ipticket]
-			# Remove the ticket from the ban list.
-			self.__banList = [ticket for ticket in self.__banList
-							  if ticket not in unBanList]
-
-			return ipticket
+					# Return the ticket after removing (popping)
+					# if from the ban list.
+					return self.__banList.pop(i)
 		finally:
 			self.__lock.release()
+		return None						  # if none found

From 2d672d1c81ae5bdeaf9e5a03f8574f9b397925c7 Mon Sep 17 00:00:00 2001
From: David Engeset <froggywwu@gmail.com>
Date: Mon, 5 Nov 2012 14:02:11 -0800
Subject: [PATCH 008/544] Added in while loop to process the Fail Manager after
 the requested banned IP was added to its queue.  This solves the issue of
 needing to touch the log file that is being monitored to get the IP to be
 banned accordingly.  Added in import of FailManagerEmpty exception class.

---
 server/filter.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server/filter.py b/server/filter.py
index f71a0a06..b37e37e6 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -27,6 +27,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
+from failmanager import FailManagerEmpty
 from failmanager import FailManager
 from ticket import FailTicket
 from jailthread import JailThread
@@ -224,6 +225,14 @@ class Filter(JailThread):
 		for i in xrange(self.failManager.getMaxRetry()):
 			self.failManager.addFailure(FailTicket(ip, unixTime))
 
+		# Perform the banning of the IP now.
+		try:
+			while True:
+				ticket = self.failManager.toBan()
+				self.jail.putFailTicket(ticket)
+		except FailManagerEmpty:
+			self.failManager.cleanup(MyTime.time())
+
 		return ip
 
 	##

From b773ed617bf73f01ec4757d37caf63df30760b3c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 21:12:03 -0500
Subject: [PATCH 009/544] DOC: minor "fixes" in DEVELOP

---
 DEVELOP | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index 025b58b4..7a6a7b9b 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -58,18 +58,20 @@ one)::
  RF-Note   just a note which might be useful to address while doing RF
 
  JailThread -> Filter -> FileFilter -> {FilterPoll, FilterPyinotify, ...}
-         |     |         * FileContainer
-         |     + FailManager
-         |     + DateDetector
-         \- -> Actions
-               * Actions
-               + BanManager
-
+               |         * FileContainer
+               + FailManager
+               + DateDetector
+			   + Jail (provided in __init__) which contains this Filter
+                 (used for passing tickets from FailManager to Jail's __queue)
  Server
    + Jails
       * Jail
-        + Filter
+        + Filter  (in __filter)
         * tickets (in __queue)
+        + Actions (in __action)
+          * Action
+          + BanManager
+
 
 failmanager.py
 ~~~~~~~~~~~~~~
@@ -147,7 +149,7 @@ one way or another provide
 		except FailManagerEmpty:
 			self.failManager.cleanup(MyTime.time())
 
-thus channeling "ban tickets" from their failManager to a
+thus channeling "ban tickets" from their failManager to the
 corresponding jail.
 
 action.py

From 1e12c220e6828f9dd8d4530eb9a3abe843d7155e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 21:22:33 -0500
Subject: [PATCH 010/544] minor: added a note on now "negative" log entries on
 "POSSIBLE BREAK-IN ATTEMPT"

---
 testcases/files/logs/sshd | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index 639aaf0b..8e6c1273 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -22,6 +22,7 @@ Feb 25 14:34:11 belka sshd[31607]: User root from ferrari.inescn.pt not allowed
 Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)
 
 #7 added exclamation mark to BREAK-IN
+#  Now should be a negative since we decided not to catch those
 Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT
 Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
 

From f52ba9923a1ad44274792f08e9d4ad0ce8dd4c3e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 21:30:07 -0500
Subject: [PATCH 011/544] ENH: downgrade "already banned" from WARN to INFO
 level (Closes gh-79)

Most of the time it is a benign latency effect so nothing to warn about.
---
 server/actions.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/actions.py b/server/actions.py
index 3461e672..94344dce 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -181,7 +181,7 @@ class Actions(JailThread):
 					action.execActionBan(aInfo)
 				return True
 			else:
-				logSys.warn("[%s] %s already banned" % (self.jail.getName(), 
+				logSys.info("[%s] %s already banned" % (self.jail.getName(),
 														str(aInfo["ip"])))
 		return False
 	

From 63237a785ec6bfa00f5e3ec0117c86297bc5b4b4 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 5 Nov 2012 21:50:49 -0500
Subject: [PATCH 012/544] DOC: forgotten --help entry for " unban "

---
 common/protocol.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/common/protocol.py b/common/protocol.py
index db2b07eb..2f8ffa6c 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -64,6 +64,7 @@ protocol = [
 ["set <JAIL> bantime <TIME>", "sets the number of seconds <TIME> a host will be banned for <JAIL>"], 
 ["set <JAIL> usedns <VALUE>", "sets the usedns mode for <JAIL>"],
 ["set <JAIL> banip <IP>", "manually Ban <IP> for <JAIL>"], 
+["set <JAIL> unbanip <IP>", "manually Unban <IP> in <JAIL>"], 
 ["set <JAIL> maxretry <RETRY>", "sets the number of failures <RETRY> before banning the host for <JAIL>"], 
 ["set <JAIL> addaction <ACT>", "adds a new action named <NAME> for <JAIL>"], 
 ["set <JAIL> delaction <ACT>", "removes the action <NAME> from <JAIL>"], 

From b159eabb517e97781ef2a45ab14a0ff9b9376b9a Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 6 Nov 2012 13:14:42 -0500
Subject: [PATCH 013/544] BF: do not enable pyinotify backend if pyinotify is
 too old (Closes gh-80)

---
 server/filterpyinotify.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py
index 008f9303..fdc7256e 100644
--- a/server/filterpyinotify.py
+++ b/server/filterpyinotify.py
@@ -23,12 +23,18 @@ __author__ = "Cyril Jaquier, Lee Clemens, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Lee Clemens, 2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
+from distutils.version import LooseVersion
+
 from failmanager import FailManagerEmpty
 from filter import FileFilter
 from mytime import MyTime
 
 import time, logging, pyinotify
 
+if not hasattr(pyinotify, '__version__') \
+  or LooseVersion(pyinotify.__version__) < '0.8.3':
+  raise ImportError("Fail2Ban requires pyinotify >= 0.8.3")
+
 from os.path import dirname, sep as pathsep
 
 # Gets the instance of the logger.

From da626b51cc64c4b7c1c172112b0dec1d577431ea Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 6 Nov 2012 14:00:27 -0500
Subject: [PATCH 014/544] NF: rudimentary .travis.yml for travis-ci.org service

---
 .travis.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 .travis.yml

diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 00000000..3e781b60
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,15 @@
+# vim ft=yaml
+# travis-ci.org definition for Fail2Ban build (based on nipy configuration)
+#
+# We pretend to be erlang because we need can't use the python support in
+# travis-ci; it uses virtualenvs, they do not have numpy, scipy, matplotlib,
+# and it is impractical to build them
+language: erlang
+env:
+    - PYTHON=python PYSUF=''
+    # - PYTHON=python3 PYSUF=3 : python3-numpy not currently available
+install:
+    - sudo apt-get install $PYTHON-pyinotify
+    - sudo apt-get install $PYTHON-gamin
+script:
+    - ./fail2ban-testcases

From ef2ea965c8b2a028270629b907039167bf4c3f13 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 6 Nov 2012 14:12:35 -0500
Subject: [PATCH 015/544] ENH: travis -- try to run tests against all available
 python versions

---
 .travis.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 3e781b60..4c552d04 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,6 @@ env:
     - PYTHON=python PYSUF=''
     # - PYTHON=python3 PYSUF=3 : python3-numpy not currently available
 install:
-    - sudo apt-get install $PYTHON-pyinotify
-    - sudo apt-get install $PYTHON-gamin
+    - sudo apt-get install $PYTHON-all $PYTHON-pyinotify $PYTHON-gamin
 script:
-    - ./fail2ban-testcases
+    - set -e; for p in `pyversions -s`; do echo "I: $p"; $p ./fail2ban-testcases; done

From 39172a99c55375ef21488ecd3cd8cbbcb98e87dc Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 6 Nov 2012 14:26:15 -0500
Subject: [PATCH 016/544] BF: added a little shell script to excercise tests
 against all available Python versions

also report Python version inside fail2ban-testcases
---
 .travis.yml            |  4 ++--
 fail2ban-testcases     |  3 ++-
 fail2ban-testcases-all | 18 ++++++++++++++++++
 3 files changed, 22 insertions(+), 3 deletions(-)
 create mode 100755 fail2ban-testcases-all

diff --git a/.travis.yml b/.travis.yml
index 4c552d04..c70b749b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,6 @@ env:
     - PYTHON=python PYSUF=''
     # - PYTHON=python3 PYSUF=3 : python3-numpy not currently available
 install:
-    - sudo apt-get install $PYTHON-all $PYTHON-pyinotify $PYTHON-gamin
+    - sudo apt-get install $PYTHON-all $PYTHON-all-dbg $PYTHON-pyinotify $PYTHON-gamin
 script:
-    - set -e; for p in `pyversions -s`; do echo "I: $p"; $p ./fail2ban-testcases; done
+    - ./failban-testcases-all
diff --git a/fail2ban-testcases b/fail2ban-testcases
index cc616c0e..58ad7887 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -100,7 +100,8 @@ logSys.addHandler(stdout)
 # Let know the version
 #
 if not opts.log_level or opts.log_level != 'fatal':
-	print "Fail2ban " + version + " test suite. Please wait..."
+	print "Fail2ban %s test suite. Python %s. Please wait..." \
+	    % (version, str(sys.version).replace('\n', ''))
 
 
 #
diff --git a/fail2ban-testcases-all b/fail2ban-testcases-all
new file mode 100755
index 00000000..8d4157ea
--- /dev/null
+++ b/fail2ban-testcases-all
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Simple helper script to exercise unittests using all available
+# (under /usr/bin and /usr/local/bin python2.*)
+
+set -eu
+
+failed=
+for python in /usr/{,local/}bin/python2.[0-9]{,.*}{,-dbg}
+do
+	[ -e "$python" ] || continue
+	echo "Testing using $python"
+	$python ./fail2ban-testcases || failed+=" $python"
+done
+
+if [ ! -z "$failed" ]; then
+	echo "E: Failed with $failed"
+	exit 1
+fi

From 29aef9381a7822091be57470cf66261466ef23e6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 6 Nov 2012 21:48:44 -0500
Subject: [PATCH 017/544] BF: typo

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c70b749b..80dcedb6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,4 +11,4 @@ env:
 install:
     - sudo apt-get install $PYTHON-all $PYTHON-all-dbg $PYTHON-pyinotify $PYTHON-gamin
 script:
-    - ./failban-testcases-all
+    - ./fail2ban-testcases-all

From efc4fd5f0b5d0012e67b7ea52d860a65a7cf6d08 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 6 Nov 2012 22:05:41 -0500
Subject: [PATCH 018/544] ENH: trying to go native travis-ci python way to take
 advantage of virtualenv's with older pythons

---
 .travis.yml | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 80dcedb6..e655e7c1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,14 +1,11 @@
 # vim ft=yaml
-# travis-ci.org definition for Fail2Ban build (based on nipy configuration)
-#
-# We pretend to be erlang because we need can't use the python support in
-# travis-ci; it uses virtualenvs, they do not have numpy, scipy, matplotlib,
-# and it is impractical to build them
-language: erlang
-env:
-    - PYTHON=python PYSUF=''
-    # - PYTHON=python3 PYSUF=3 : python3-numpy not currently available
+# travis-ci.org definition for Fail2Ban build
+language: python
+python:
+  - "2.5"
+  - "2.6"
+  - "2.7"
 install:
-    - sudo apt-get install $PYTHON-all $PYTHON-all-dbg $PYTHON-pyinotify $PYTHON-gamin
+  - "pip install pyinotify"
 script:
-    - ./fail2ban-testcases-all
+    - python ./fail2ban-testcases

From f10537941ba82060ad4c9e59f210d2433854e759 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 7 Nov 2012 11:33:17 -0500
Subject: [PATCH 019/544] ENH: To help with gh-87 added hints into the log on
 some failure return codes (e.g. 0x7f00 for this one)

---
 server/action.py            | 17 ++++++++++++++++-
 testcases/actiontestcase.py | 36 +++++++++++++++++++++++++++++++++---
 2 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/server/action.py b/server/action.py
index bd750337..f2614b33 100644
--- a/server/action.py
+++ b/server/action.py
@@ -37,6 +37,17 @@ logSys = logging.getLogger("fail2ban.actions.action")
 # Create a lock for running system commands
 _cmd_lock = threading.Lock()
 
+# Some hints on common abnormal exit codes
+_RETCODE_HINTS = {
+	0x7f00: '"Command not found".  Make sure that all commands in %(realCmd)r '
+	        'are in the PATH of fail2ban-server process '
+			'(grep -a PATH= /proc/`pidof -x fail2ban-server`/environ). '
+			'You may want to start '
+			'"fail2ban-server -f" separately, initiate it with '
+			'"fail2ban-client reload" in another shell session and observe if '
+			'additional informative error messages appear in the terminals.'
+	}
+
 ##
 # Execute commands.
 #
@@ -330,7 +341,11 @@ class Action:
 					logSys.debug("%s returned successfully" % realCmd)
 					return True
 				else:
-					logSys.error("%s returned %x" % (realCmd, retcode))
+					msg = _RETCODE_HINTS.get(retcode, None)
+ 					logSys.error("%s returned %x" % (realCmd, retcode))
+					if msg:
+						logSys.info("HINT on %x: %s"
+									% (retcode, msg % locals()))
 			except OSError, e:
 				logSys.error("%s failed with %s" % (realCmd, e))
 		finally:
diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index 9f89cfe6..b8292c27 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -28,7 +28,9 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import unittest, time
+import logging, sys
 from server.action import Action
+from StringIO import StringIO
 
 class ExecuteAction(unittest.TestCase):
 
@@ -36,15 +38,43 @@ class ExecuteAction(unittest.TestCase):
 		"""Call before every test case."""
 		self.__action = Action("Test")
 
+		# For extended testing of what gets output into logging
+		# system, we will redirect it to a string
+		logSys = logging.getLogger("fail2ban")
+
+		# Keep old settings
+		self._old_level = logSys.level
+		self._old_handlers = logSys.handlers
+		# Let's log everything into a string
+		self._log = StringIO()
+		logSys.handlers = [logging.StreamHandler(self._log)]
+		logSys.setLevel(getattr(logging, 'DEBUG'))
+
 	def tearDown(self):
 		"""Call after every test case."""
+		# print "O: >>%s<<" % self._log.getvalue()
+		logSys = logging.getLogger("fail2ban")
+		logSys.handlers = self._old_handlers
+		logSys.level = self._old_level
 		self.__action.execActionStop()
-	
+
+	def _is_logged(self, s):
+		return s in self._log.getvalue()
+
 	def testExecuteActionBan(self):
 		self.__action.setActionStart("touch /tmp/fail2ban.test")
 		self.__action.setActionStop("rm -f /tmp/fail2ban.test")
 		self.__action.setActionBan("echo -n")
 		self.__action.setActionCheck("[ -e /tmp/fail2ban.test ]")
-		
+
+		self.assertFalse(self._is_logged('returned'))
+		# no action was actually executed yet
+
 		self.assertTrue(self.__action.execActionBan(None))
-		
+		self.assertTrue(self._is_logged('Invariant check failed'))
+		self.assertTrue(self._is_logged('returned successfully'))
+
+
+	def testExecuteIncorrectCmd(self):
+		Action.executeCmd('/bin/ls >/dev/null\nbogusXXX now 2>/dev/null')
+		self.assertTrue(self._is_logged('HINT on 7f00: "Command not found"'))

From 348239cf141ea403a4582d542ada652377f84218 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 7 Nov 2012 11:34:20 -0500
Subject: [PATCH 020/544] ENH: fail2ban-testcases-all -- pass cmdline options
 to fail2ban-testcases

---
 fail2ban-testcases-all | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-testcases-all b/fail2ban-testcases-all
index 8d4157ea..fd33dce4 100755
--- a/fail2ban-testcases-all
+++ b/fail2ban-testcases-all
@@ -9,7 +9,7 @@ for python in /usr/{,local/}bin/python2.[0-9]{,.*}{,-dbg}
 do
 	[ -e "$python" ] || continue
 	echo "Testing using $python"
-	$python ./fail2ban-testcases || failed+=" $python"
+	$python ./fail2ban-testcases "$@" || failed+=" $python"
 done
 
 if [ ! -z "$failed" ]; then

From 9e7a3b7a0454bc79e02b1bf1cda5454e840253bd Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 9 Nov 2012 08:57:33 -0500
Subject: [PATCH 021/544] ENH: until we make it proper module -- adjust
 sys.path only if system-wide run

---
 fail2ban-client | 4 +++-
 fail2ban-regex  | 4 +++-
 fail2ban-server | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 66b90333..780efcfd 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -33,7 +33,9 @@ import getopt, time, shlex, socket
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
+if os.path.abspath(__file__).startswith('/usr/'):
+	# makes sense to use system-wide library iff -client is also under /usr/
+	sys.path.insert(1, "/usr/share/fail2ban")
 
 # Now we can import our modules
 from common.version import version
diff --git a/fail2ban-regex b/fail2ban-regex
index 0d634b70..fb083c21 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -29,7 +29,9 @@ import getopt, sys, time, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
+if os.path.abspath(__file__).startswith('/usr/'):
+	# makes sense to use system-wide library iff -regex is also under /usr/
+    sys.path.insert(1, "/usr/share/fail2ban")
 
 from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
diff --git a/fail2ban-server b/fail2ban-server
index f6f1dac4..dab2d24e 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -32,7 +32,9 @@ import getopt, sys, logging
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-sys.path.insert(1, "/usr/share/fail2ban")
+if os.path.abspath(__file__).startswith('/usr/'):
+	# makes sense to use system-wide library iff -server is also under /usr/
+	sys.path.insert(1, "/usr/share/fail2ban")
 
 from common.version import version
 from server.server import Server

From 03b31398aac4ff4edab992b5c3969712bb35858b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 9 Nov 2012 08:58:19 -0500
Subject: [PATCH 022/544] ENH: BF (forgotten import) for prev commit + removed
 duplicate Author, adjusted __ fields for that in fail2ban-* scripts

---
 fail2ban-client    |  8 +-------
 fail2ban-regex     | 10 ++--------
 fail2ban-server    | 10 ++--------
 fail2ban-testcases |  6 +-----
 setup.py           |  6 ------
 5 files changed, 6 insertions(+), 34 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 780efcfd..1d8eb15e 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -18,13 +18,7 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -71,7 +65,7 @@ class Fail2banClient:
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
diff --git a/fail2ban-regex b/fail2ban-regex
index fb083c21..3900c909 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -15,14 +15,8 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
 import getopt, sys, time, logging, os
diff --git a/fail2ban-server b/fail2ban-server
index dab2d24e..bd86e6cd 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -18,17 +18,11 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import getopt, sys, logging
+import getopt, sys, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
@@ -63,7 +57,7 @@ class Fail2banServer:
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
+		print "Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors"
 		print "Copyright of modifications held by their respective authors."
 		print "Licensed under the GNU General Public License v2 (GPL)."
 		print
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 58ad7887..aaf78525 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -20,12 +20,8 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012- Yaroslav Halchenko"
 __license__ = "GPL"
 
 
diff --git a/setup.py b/setup.py
index 8cb17133..53b03f0f 100755
--- a/setup.py
+++ b/setup.py
@@ -18,13 +18,7 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 

From 37a2e59d69df0bb5f46087db693b0f3cc82249bf Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 26 Nov 2012 12:01:42 -0500
Subject: [PATCH 023/544] BF: guarantee that IP is stored as a base,
 non-unicode str (Closes gh-91)

Otherwise it might lead to spurious characters dumped into the
terminal at few places, unless casted upon every use in the logs.  To
prevent those issues in the source, store IP as a basic string if it
is a string at all
---
 server/actions.py                |  4 ++--
 server/ticket.py                 |  5 ++++-
 testcases/failmanagertestcase.py | 11 ++++++-----
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index 94344dce..4d021a71 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -176,13 +176,13 @@ class Actions(JailThread):
 			aInfo["time"] = bTicket.getTime()
 			aInfo["matches"] = "".join(bTicket.getMatches())
 			if self.__banManager.addBanTicket(bTicket):
-				logSys.warn("[%s] Ban %s" % (self.jail.getName(), str(aInfo["ip"])))
+				logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
 				for action in self.__actions:
 					action.execActionBan(aInfo)
 				return True
 			else:
 				logSys.info("[%s] %s already banned" % (self.jail.getName(),
-														str(aInfo["ip"])))
+														aInfo["ip"]))
 		return False
 	
 	##
diff --git a/server/ticket.py b/server/ticket.py
index 644d3cd1..c03761c1 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -42,7 +42,7 @@ class Ticket:
 		@param matches (log) lines caused the ticket
 		"""
 
-		self.__ip = ip
+		self.setIP(ip)
 		self.__time = time
 		self.__attempt = 0
 		self.__file = None
@@ -54,6 +54,9 @@ class Ticket:
 	
 
 	def setIP(self, value):
+		if isinstance(value, basestring):
+			# guarantee using regular str instead of unicode for the IP
+			value = str(value)
 		self.__ip = value
 	
 	def getIP(self):
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index e5e0ccca..ffee4ff1 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -35,11 +35,11 @@ class AddFailure(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
-		self.__items = [['193.168.0.128', 1167605999.0],
-					    ['193.168.0.128', 1167605999.0],
-					    ['193.168.0.128', 1167605999.0],
-					    ['193.168.0.128', 1167605999.0],
-					    ['193.168.0.128', 1167605999.0],
+		self.__items = [[u'193.168.0.128', 1167605999.0],
+					    [u'193.168.0.128', 1167605999.0],
+					    [u'193.168.0.128', 1167605999.0],
+					    [u'193.168.0.128', 1167605999.0],
+					    [u'193.168.0.128', 1167605999.0],
 					    ['87.142.124.10', 1167605999.0],
 					    ['87.142.124.10', 1167605999.0],
 					    ['87.142.124.10', 1167605999.0],
@@ -80,6 +80,7 @@ class AddFailure(unittest.TestCase):
 		#ticket = FailTicket('193.168.0.128', None)
 		ticket = self.__failManager.toBan()
 		self.assertEqual(ticket.getIP(), "193.168.0.128")
+		self.assertTrue(isinstance(ticket.getIP(), str))
 	
 	def testbanNOK(self):
 		self.__failManager.setMaxRetry(10)

From 51a3be2d7951366cc4af8d84ac56666cab9a3688 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 5 Dec 2012 22:50:36 -0500
Subject: [PATCH 024/544] Getting ready for 0.8.8 release (changelog, version
 boost)

---
 ChangeLog         | 34 +++++++++++++++++++++++++++++++++-
 README            |  6 +++---
 common/version.py |  4 ++--
 3 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index fd4a14ca..eabd6e81 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,9 +4,41 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.7.1)                                            2012/07/31
+Fail2Ban (version 0.8.8)                                              2012/12/06
 ================================================================================
 
+ver. 0.8.8 (2012/12/06) - stable
+----------
+- Fixes:
+  Alan Jenkins
+   * [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid
+     banning due to misconfigured DNS. Close gh-64
+  Yaroslav Halchenko
+   * [83109bc] IMPORTANT: escape the content of <matches> (if used in
+     custom action files) since its value could contain arbitrary
+     symbols.  Thanks for discovery go to the NBS System security
+     team
+   * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Close gh-83
+   * [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3
+   * [37a2e59] store IP as a base, non-unicode str to avoid spurious messages
+     in the console. Close gh-91
+- New features:
+  David Engeset
+   * [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching
+     the log file to take 'banip' or 'unbanip' in effect. Close gh-81, gh-86
+  Yaroslav Halchenko
+- Enhancements:
+   * [2d66f31] replaced uninformative "Invalid command" message with warning log
+     exception why command actually failed
+   * [958a1b0] improved failregex to "support" auth.backend = "htdigest"
+   * [9e7a3b7] until we make it proper module -- adjusted sys.path only if
+     system-wide run
+   * [f52ba99] downgraded "already banned" from WARN to INFO level. Closes gh-79
+   * [f105379] added hints into the log on some failure return codes (e.g. 0x7f00
+     for this gh-87)
+   * Various others: travis-ci integration, script to run tests
+     against all available Python versions, etc
+
 ver. 0.8.7.1 (2012/07/31) - stable
 ----------
 
diff --git a/README b/README
index bc365482..db97aa8b 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.7)                                              2012/07/31
+Fail2Ban (version 0.8.8)                                              2012/07/31
 ================================================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
@@ -31,8 +31,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.8.7.tar.bz2
-> cd fail2ban-0.8.7
+> tar xvfj fail2ban-0.8.8.tar.bz2
+> cd fail2ban-0.8.8
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
diff --git a/common/version.py b/common/version.py
index d2fefcc2..2a1c0d0b 100644
--- a/common/version.py
+++ b/common/version.py
@@ -21,8 +21,8 @@
 # 
 # $Revision$
 
-__author__ = "Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
-version = "0.8.7.1"
+version = "0.8.8"

From fc27e00290af3b455118054fec13a1bdf154ede2 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 7 Dec 2012 15:17:08 -0500
Subject: [PATCH 025/544] ENH: tune up sshd-ddos to use common.conf and allow
 training spaces

---
 config/filter.d/sshd-ddos.conf | 12 +++++++++---
 testcases/files/logs/sshd-ddos |  2 ++
 2 files changed, 11 insertions(+), 3 deletions(-)
 create mode 100644 testcases/files/logs/sshd-ddos

diff --git a/config/filter.d/sshd-ddos.conf b/config/filter.d/sshd-ddos.conf
index 4f4b6fa2..266594ba 100644
--- a/config/filter.d/sshd-ddos.conf
+++ b/config/filter.d/sshd-ddos.conf
@@ -2,11 +2,17 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
-#
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
 
 [Definition]
 
+_daemon = sshd
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -14,7 +20,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
+failregex = ^%(__prefix_line)sDid not receive identification string from <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/sshd-ddos b/testcases/files/logs/sshd-ddos
new file mode 100644
index 00000000..d71c6bb2
--- /dev/null
+++ b/testcases/files/logs/sshd-ddos
@@ -0,0 +1,2 @@
+# http://forums.powervps.com/showthread.php?t=1667
+Jun 7 01:10:56 host sshd[5937]: Did not receive identification string from 69.61.56.114

From 7ede1e85187764caec77512146f69c76f0621d28 Mon Sep 17 00:00:00 2001
From: hamilton5 <ham5@tehwebz.net>
Date: Mon, 10 Dec 2012 19:17:04 -0500
Subject: [PATCH 026/544] Update config/filter.d/dovecot.conf

added failregex line for debian and centos per
http://www.fail2ban.org/wiki/index.php/Talk:Dovecot
---
 config/filter.d/dovecot.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 153b9bb0..f37dc892 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -15,6 +15,7 @@
 # Values:  TEXT
 #
 failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
+            pam.*dovecot.*(?:authentication failure).*rhost=(?:::f{4,6}:)?(?P<host>\S*) 
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From e040c6d8a3bfa62d358083300119c259cd44dcd0 Mon Sep 17 00:00:00 2001
From: hamilton5 <ham5@tehwebz.net>
Date: Tue, 11 Dec 2012 03:26:14 -0500
Subject: [PATCH 027/544] Update config/filter.d/dovecot.conf

site actually needs updated because of <HOST> alias
per Notes above.
---
 config/filter.d/dovecot.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index f37dc892..acbae3a8 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -15,7 +15,7 @@
 # Values:  TEXT
 #
 failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
-            pam.*dovecot.*(?:authentication failure).*rhost=(?:::f{4,6}:)?(?P<host>\S*) 
+            pam.*dovecot.*(?:authentication failure).*rhost=<HOST> 
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From c534c1d03d7d4cf59941fd6b7cc7b1dee62d5cd1 Mon Sep 17 00:00:00 2001
From: hamilton5 <ham5@tehwebz.net>
Date: Tue, 11 Dec 2012 11:05:22 -0500
Subject: [PATCH 028/544] Update testcases/files/logs/dovecot

---
 testcases/files/logs/dovecot | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index b975e808..a469d892 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -1 +1,6 @@
-@400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
+@400000004c91b044077a9e94
+  imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
+
+@e040c6d8a3bfa62d358083300119c259cd44dcd0
+  dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
+  dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.224  user=root

From 7bd977e2df2877614b9eb0547d58b5fb537b1074 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 11 Dec 2012 10:59:01 -0500
Subject: [PATCH 029/544] ENH: fail2ban-testscases -- allow to specify regexps
 for tests to be ran

Eventually we will switch to use nose or py.test -- for now this
homebrew solution could be used to run selected suites only
---
 fail2ban-testcases | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index aaf78525..0ee2c53c 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -42,7 +42,7 @@ from optparse import OptionParser, Option
 def get_opt_parser():
 	# use module docstring for help output
 	p = OptionParser(
-				usage="%s [OPTIONS]\n" % sys.argv[0] + __doc__,
+				usage="%s [OPTIONS] [regexps]\n" % sys.argv[0] + __doc__,
 				version="%prog " + version)
 
 	p.add_options([
@@ -56,8 +56,7 @@ def get_opt_parser():
 	return p
 
 parser = get_opt_parser()
-(opts, files) = parser.parse_args()
-assert(not len(files))
+(opts, regexps) = parser.parse_args()
 
 #
 # Logging
@@ -103,7 +102,20 @@ if not opts.log_level or opts.log_level != 'fatal':
 #
 # Gather the tests
 #
-tests = unittest.TestSuite()
+if not len(regexps):
+	tests = unittest.TestSuite()
+else:
+	import re
+	class FilteredTestSuite(unittest.TestSuite):
+		_regexps = [re.compile(r) for r in regexps]
+		def addTest(self, suite):
+			suite_str = str(suite)
+			for r in self._regexps:
+				if r.search(suite_str):
+					super(FilteredTestSuite, self).addTest(suite)
+					return
+
+	tests = FilteredTestSuite()
 
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))

From 2b6366656f15d63985a2a5b7d5a73c2364de1132 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 11 Dec 2012 11:04:40 -0500
Subject: [PATCH 030/544] BF: make sorting of date templates stable

Before, it would first do stable sort followed with explicit reverse.
Now reverse is given as an argument to sort, and it results in actually
preserving the order in case of e.g. no sorting needed
---
 server/datedetector.py            | 5 +++--
 testcases/datedetectortestcase.py | 8 ++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 7301ec91..5b1f3c6c 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -194,7 +194,8 @@ class DateDetector:
 		self.__lock.acquire()
 		try:
 			logSys.debug("Sorting the template list")
-			self.__templates.sort(lambda x, y: cmp(x.getHits(), y.getHits()))
-			self.__templates.reverse()
+			self.__templates.sort(lambda x, y: cmp(x.getHits(), y.getHits()), reverse=True)
+			t = self.__templates[0]
+			logSys.debug("Winning template: %s with %d hits" % (t.getName(), t.getHits()))
 		finally:
 			self.__lock.release()
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 1f73cd1e..d6946144 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -78,6 +78,14 @@ class DateDetectorTest(unittest.TestCase):
 			self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
 			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 
+	def testStableSortTemplate(self):
+		old_names = [x.getName() for x in self.__datedetector.getTemplates()]
+		self.__datedetector.sortTemplate()
+		# If there were no hits -- sorting should not change the order
+		for old_name, n in zip(old_names, self.__datedetector.getTemplates()):
+			self.assertEqual(old_name, n.getName()) # "Sort must be stable"
+
+		
 #	def testDefaultTempate(self):
 #		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 #		self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")

From d1625253eb2d8d8c3ce2df984b95c9be3ad71dcc Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 11 Dec 2012 11:06:03 -0500
Subject: [PATCH 031/544] ENH: debug msgs on which template was taken (+ use
 "is" for None comparisons)

---
 server/datedetector.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 5b1f3c6c..f0ba2635 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -77,7 +77,7 @@ class DateDetector:
 			# previous one but with year given by 2 digits
 			# (See http://bugs.debian.org/537610)
 			template = DateStrptime()
-			template.setName("Day/Month/Year Hour:Minute:Second")
+			template.setName("Day/Month/Year2 Hour:Minute:Second")
 			template.setRegex("\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%y %H:%M:%S")
 			self.__templates.append(template)
@@ -158,7 +158,8 @@ class DateDetector:
 		try:
 			for template in self.__templates:
 				match = template.matchDate(line)
-				if not match == None:
+				if not match is None:
+					logSys.debug("Matched time template %s" % template.getName())
 					return match
 			return None
 		finally:
@@ -170,8 +171,9 @@ class DateDetector:
 			for template in self.__templates:
 				try:
 					date = template.getDate(line)
-					if date == None:
+					if date is None:
 						continue
+					logSys.debug("Got time using template %s" % template.getName())
 					return date
 				except ValueError:
 					pass

From 67145d8b78a557931e8d8cb1d5b61a92748ac10b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 11 Dec 2012 11:13:36 -0500
Subject: [PATCH 032/544] ENH: assure that all date templates have unique names

---
 server/datedetector.py            | 44 ++++++++++++++++++-------------
 testcases/datedetectortestcase.py |  5 +++-
 2 files changed, 30 insertions(+), 19 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index f0ba2635..c013d551 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -40,6 +40,14 @@ class DateDetector:
 	def __init__(self):
 		self.__lock = Lock()
 		self.__templates = list()
+		self.__known_names = set()
+
+	def _appendTemplate(self, template):
+		name = template.getName()
+		if name in self.__known_names:
+			raise ValueError("There is already a template with name %s" % name)
+		self.__known_names.add(name)
+		self.__templates.append(template)
 	
 	def addDefaultTemplate(self):
 		self.__lock.acquire()
@@ -49,104 +57,104 @@ class DateDetector:
 			template.setName("MONTH Day Hour:Minute:Second")
 			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%b %d %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# asctime
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second Year")
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
 			template.setPattern("%a %b %d %H:%M:%S %Y")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# asctime without year
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second")
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%a %b %d %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# simple date
 			template = DateStrptime()
 			template.setName("Year/Month/Day Hour:Minute:Second")
 			template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y/%m/%d %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# simple date too (from x11vnc)
 			template = DateStrptime()
 			template.setName("Day/Month/Year Hour:Minute:Second")
 			template.setRegex("\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%Y %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# previous one but with year given by 2 digits
 			# (See http://bugs.debian.org/537610)
 			template = DateStrptime()
 			template.setName("Day/Month/Year2 Hour:Minute:Second")
 			template.setRegex("\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%y %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# Apache format [31/Oct/2006:09:22:55 -0000]
 			template = DateStrptime()
 			template.setName("Day/MONTH/Year:Hour:Minute:Second")
 			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%b/%Y:%H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# CPanel 05/20/2008:01:57:39
 			template = DateStrptime()
 			template.setName("Month/Day/Year:Hour:Minute:Second")
 			template.setRegex("\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%m/%d/%Y:%H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# Exim 2006-12-21 06:43:20
 			template = DateStrptime()
 			template.setName("Year-Month-Day Hour:Minute:Second")
 			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# custom for syslog-ng 2006.12.21 06:43:20
 			template = DateStrptime()
 			template.setName("Year.Month.Day Hour:Minute:Second")
 			template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y.%m.%d %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# named 26-Jul-2007 15:20:52.252 
 			template = DateStrptime()
 			template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]")
 			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d-%b-%Y %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# 17-07-2008 17:23:25
 			template = DateStrptime()
 			template.setName("Day-Month-Year Hour:Minute:Second")
 			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d-%m-%Y %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# 01-27-2012 16:22:44.252
 			template = DateStrptime()
 			template.setName("Month-Day-Year Hour:Minute:Second[.Millisecond]")
 			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%m-%d-%Y %H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# TAI64N
 			template = DateTai64n()
 			template.setName("TAI64N")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# Epoch
 			template = DateEpoch()
 			template.setName("Epoch")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# ISO 8601
 			template = DateISO8601()
 			template.setName("ISO 8601")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# Only time information in the log
 			template = DateStrptime()
 			template.setName("Hour:Minute:Second")
 			template.setRegex("^\d{2}:\d{2}:\d{2}")
 			template.setPattern("%H:%M:%S")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 			# <09/16/08@05:03:30>
 			template = DateStrptime()
 			template.setName("<Month/Day/Year@Hour:Minute:Second>")
 			template.setRegex("^<\d{2}/\d{2}/\d{2}@\d{2}:\d{2}:\d{2}>")
 			template.setPattern("<%m/%d/%y@%H:%M:%S>")
-			self.__templates.append(template)
+			self._appendTemplate(template)
 		finally:
 			self.__lock.release()
 	
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index d6946144..34ce22ce 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -85,7 +85,10 @@ class DateDetectorTest(unittest.TestCase):
 		for old_name, n in zip(old_names, self.__datedetector.getTemplates()):
 			self.assertEqual(old_name, n.getName()) # "Sort must be stable"
 
-		
+	def testAllUniqueTemplateNames(self):
+		self.assertRaises(ValueError, self.__datedetector._appendTemplate,
+						  self.__datedetector.getTemplates()[0])
+
 #	def testDefaultTempate(self):
 #		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 #		self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")

From ccc62ddbf353dedcc90f18469f6e7ebe9db4e565 Mon Sep 17 00:00:00 2001
From: hamilton5 <ham5@tehwebz.net>
Date: Tue, 11 Dec 2012 12:05:01 -0500
Subject: [PATCH 033/544] Update testcases/files/logs/dovecot

---
 testcases/files/logs/dovecot | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index a469d892..f76c1bce 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -1,6 +1,4 @@
-@400000004c91b044077a9e94
-  imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
+@400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
 
-@e040c6d8a3bfa62d358083300119c259cd44dcd0
-  dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
-  dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.224  user=root
+@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
+@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.224  user=root

From 266cdc29a6bf5aafc7d35f000a5254f416231c73 Mon Sep 17 00:00:00 2001
From: hamilton5 <ham5@tehwebz.net>
Date: Tue, 11 Dec 2012 12:09:28 -0500
Subject: [PATCH 034/544] Update config/filter.d/dovecot.conf

even tho not on the fail2ban site..
suggested to not be greedy by yarikoptic
---
 config/filter.d/dovecot.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index acbae3a8..42c5ef33 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -15,7 +15,7 @@
 # Values:  TEXT
 #
 failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
-            pam.*dovecot.*(?:authentication failure).*rhost=<HOST> 
+            pam.*dovecot.*(?:authentication failure).*rhost=<HOST>(?:\s+user=.*)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From b95dc592b92ea136da314b2849c756cb4b2b7f3c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 12 Dec 2012 21:43:27 +1100
Subject: [PATCH 035/544] ignore build directory and compiled python bits

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index b25c15b8..6a0d5e64 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
 *~
+build
+*.pyc

From fd7929863b1c33e8e212e4b85175c968378b8325 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 12 Dec 2012 21:59:01 +1100
Subject: [PATCH 036/544] name -> IP is a normal DNS lookup not a reverse

---
 server/filter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/filter.py b/server/filter.py
index b37e37e6..fb79fcbe 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -639,7 +639,7 @@ class DNSUtils:
 			ip = DNSUtils.dnsToIp(text)
 			ipList.extend(ip)
 			if ip and useDns == "warn":
-				logSys.warning("Determined IP using DNS Reverse Lookup: %s = %s",
+				logSys.warning("Determined IP using DNS Lookup: %s = %s",
 					text, ipList)
 
 		return ipList

From 68c1defb76a50bdc0ad3600519df3f446eaab72b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 12 Dec 2012 09:16:27 -0500
Subject: [PATCH 037/544] ENH: added dovecot example from Daniel Black +
 example with DoS attempt via injected rhost

---
 testcases/files/logs/dovecot | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index f76c1bce..434acade 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -1,4 +1,8 @@
 @400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
 
 @e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
+# Above example with injected rhost into ruser -- should not match for 1.2.3.4
+@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=rhost=1.2.3.4 rhost=192.0.43.10
 @e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.224  user=root
+
+Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193

From 3969e3f77b6fccf6d308c42c9182f9d58f2ee406 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 12 Dec 2012 09:16:52 -0500
Subject: [PATCH 038/544] ENH: dovecot.conf - require space(s) before rip/rhost
 log entry

---
 config/filter.d/dovecot.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 42c5ef33..18451e42 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -14,8 +14,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
-            pam.*dovecot.*(?:authentication failure).*rhost=<HOST>(?:\s+user=.*)?\s*$
+failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*\s+rip=(?P<host>\S*),.*
+            pam.*dovecot.*(?:authentication failure).*\s+rhost=<HOST>(?:\s+user=.*)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From dc67b24270a972b7097fc039692f557330d859a6 Mon Sep 17 00:00:00 2001
From: pigsyn <soulard.morgan@gmail.com>
Date: Wed, 12 Dec 2012 23:07:39 +0100
Subject: [PATCH 039/544] Update config/filter.d/webmin-auth.conf

Added a trailing '.*$' to each regex so they can find expressions in targeted log files.
---
 config/filter.d/webmin-auth.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf
index 70997e01..fc0b7760 100644
--- a/config/filter.d/webmin-auth.conf
+++ b/config/filter.d/webmin-auth.conf
@@ -18,8 +18,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = webmin.* Non-existent login as .+ from <HOST>$
-            webmin.* Invalid login as .+ from <HOST>$
+failregex = webmin.* Non-existent login as .+ from <HOST>.*$
+            webmin.* Invalid login as .+ from <HOST>.*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From f336d9f8765e8e6eafb9c683caeffaa5a4c5c34d Mon Sep 17 00:00:00 2001
From: pigsyn <soulard.morgan@gmail.com>
Date: Thu, 13 Dec 2012 08:14:49 +0100
Subject: [PATCH 040/544] Update config/filter.d/webmin-auth.conf

Added '\s*$' to the regular expression to match the space written by webmin logs at line-endings
---
 config/filter.d/webmin-auth.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf
index fc0b7760..b1df45dc 100644
--- a/config/filter.d/webmin-auth.conf
+++ b/config/filter.d/webmin-auth.conf
@@ -18,8 +18,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = webmin.* Non-existent login as .+ from <HOST>.*$
-            webmin.* Invalid login as .+ from <HOST>.*$
+failregex = webmin.* Non-existent login as .+ from <HOST>\s*$
+            webmin.* Invalid login as .+ from <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 38dd1506cc631f0ee5900a4e01b1c615d4e2716e Mon Sep 17 00:00:00 2001
From: pigsyn <soulard.morgan@gmail.com>
Date: Wed, 12 Dec 2012 23:25:31 -0800
Subject: [PATCH 041/544] Sample Webmin logs

---
 testcases/files/logs/Webmin | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 testcases/files/logs/Webmin

diff --git a/testcases/files/logs/Webmin b/testcases/files/logs/Webmin
new file mode 100644
index 00000000..4be0f1c4
--- /dev/null
+++ b/testcases/files/logs/Webmin
@@ -0,0 +1,7 @@
+# Webmin authentication failures from /var/log/auth.log
+
+#1 User exists, bad password
+Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230 
+
+#2 User does not exists
+Dec 12 23:14:19 sb1 webmin[22134]: Non-existent login as robert from 188.40.105.142 

From 123d457924f814d17c29398bad909002283a6805 Mon Sep 17 00:00:00 2001
From: pigsyn <soulard.morgan@gmail.com>
Date: Thu, 13 Dec 2012 08:33:07 +0100
Subject: [PATCH 042/544] Update testcases/files/logs/Webmin

---
 testcases/files/logs/Webmin | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/files/logs/Webmin b/testcases/files/logs/Webmin
index 4be0f1c4..86d3f321 100644
--- a/testcases/files/logs/Webmin
+++ b/testcases/files/logs/Webmin
@@ -1,4 +1,4 @@
-# Webmin authentication failures from /var/log/auth.log
+#Webmin authentication failures from /var/log/auth.log
 
 #1 User exists, bad password
 Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230 

From 21e966e4bb291142bc83494fc479e8895f0ff474 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Dec 2012 08:24:02 -0500
Subject: [PATCH 043/544] example logs should carry the same name as the filter
 they are devised for

---
 testcases/files/logs/{Webmin => webmin-auth} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename testcases/files/logs/{Webmin => webmin-auth} (100%)

diff --git a/testcases/files/logs/Webmin b/testcases/files/logs/webmin-auth
similarity index 100%
rename from testcases/files/logs/Webmin
rename to testcases/files/logs/webmin-auth

From 05af52e833bca96d3d67cb30378e51856ad3458e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 24 Dec 2012 11:05:44 -0500
Subject: [PATCH 044/544] ENH: fail2ban-regex -- __str__ for RegexStat +
 modeline

---
 fail2ban-regex | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fail2ban-regex b/fail2ban-regex
index 3900c909..a42ed96d 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+#
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -42,6 +45,10 @@ class RegexStat:
 		self.__stats = 0
 		self.__failregex = failregex
 		self.__ipList = list()
+
+	def __str__(self):
+		return "%s(%r) %d failed: %s" \
+		  % (self.__class__, self.__failregex, self.__stats, self.__ipList)
 	
 	def inc(self):
 		self.__stats += 1

From abd5984234dec44efe1f98c05d124501a60bb146 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 11 Dec 2012 22:22:51 +1100
Subject: [PATCH 045/544] base ipset support

---
 config/action.d/iptables-ipset-proto4.conf | 58 +++++++++++++++++++
 config/action.d/iptables-ipset-proto6.conf | 65 ++++++++++++++++++++++
 2 files changed, 123 insertions(+)
 create mode 100644 config/action.d/iptables-ipset-proto4.conf
 create mode 100644 config/action.d/iptables-ipset-proto6.conf

diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf
new file mode 100644
index 00000000..21401ad7
--- /dev/null
+++ b/config/action.d/iptables-ipset-proto4.conf
@@ -0,0 +1,58 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# Tested against protocol 4 (ipset v4.2)
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = ipset --create fail2ban-<name> iphash
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+             ipset --flush fail2ban-<name>
+             ipset --destroy fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip> -exist
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <ip>
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf
new file mode 100644
index 00000000..084f8738
--- /dev/null
+++ b/config/action.d/iptables-ipset-proto6.conf
@@ -0,0 +1,65 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# Tested against protocol 6 (ipset v6.14)
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = ipset create fail2ban-<name> hash:ip timeout <bantime>
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+             ipset flush fail2ban-<name>
+             ipset destroy fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionban = ipset add fail2ban-<name> <ip> -exist
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionunban = ipset del fail2ban-<name> <ip> -exist
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default: ssh
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option: bantime
+# Notes:  specifies the bantime in seconds (handled internally rather than by fail2ban)
+# Values:  [ NUM ]  Default: 600
+
+bantime = 600
+
+

From 9221886df69091f07a0feaff6e617749b804b452 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 11 Dec 2012 23:58:48 +1100
Subject: [PATCH 046/544] more documentation and optimisations/fixes based on
 testing

---
 config/action.d/iptables-ipset-proto4.conf | 19 ++++++++++++++++---
 config/action.d/iptables-ipset-proto6.conf | 19 ++++++++++++++++---
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf
index 21401ad7..f7d03f67 100644
--- a/config/action.d/iptables-ipset-proto4.conf
+++ b/config/action.d/iptables-ipset-proto4.conf
@@ -2,8 +2,21 @@
 #
 # Author: Daniel Black
 #
-# Tested against protocol 4 (ipset v4.2)
+# This is for ipset protocol 4 (ipset v4.2). If you have a later version
+# of ipset try to use the iptables-ipset-proto6.conf as it does some things
+# nicer.
+# 
+# This requires the program ipset which is normally in package called ipset.
 #
+# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
+#
+# If you are running on an older kernel you make need to patch in external
+# modules.
+#
+# On Debian machines this can be done with:
+#
+# apt-get install ipset xtables-addons-source 
+# module-assistant auto-install xtables-addons
 
 [Definition]
 
@@ -28,7 +41,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip> -exist
+actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -40,7 +53,7 @@ actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <
 
 [Init]
 
-# Defaut name of the chain
+# Defaut name of the ipset
 #
 name = default
 
diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf
index 084f8738..3352d63d 100644
--- a/config/action.d/iptables-ipset-proto6.conf
+++ b/config/action.d/iptables-ipset-proto6.conf
@@ -2,8 +2,21 @@
 #
 # Author: Daniel Black
 #
-# Tested against protocol 6 (ipset v6.14)
+# This is for ipset protocol 6 (and hopefully later) (ipset v6.14).
+# Use ipset -V to see the protocol and version. Version 4 should use
+# iptables-ipset-proto4.conf.
 #
+# This requires the program ipset which is normally in package called ipset.
+#
+# IPset was a feature introduced in the linux kernel 2.6.39 and 3.0.0 kernels.
+#
+# If you are running on an older kernel you make need to patch in external
+# modules.
+#
+# On Debian machines this can be done with:
+#
+# apt-get install ipset xtables-addons-source 
+# module-assistant auto-install xtables-addons
 
 [Definition]
 
@@ -28,7 +41,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionban = ipset add fail2ban-<name> <ip> -exist
+actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -40,7 +53,7 @@ actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
-# Defaut name of the chain
+# Defaut name of the ipset
 #
 name = default
 

From da0ba8ab4cbba68cdf570419d5c14704485e4a96 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 31 Dec 2012 14:38:51 +1100
Subject: [PATCH 047/544] ENH: add example jail for ipset

---
 config/jail.conf | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index ff0287a2..3f2425b4 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -101,6 +101,26 @@ action      = hostsdeny
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log
 
+# Here we use a combination of Netfilter/Iptables and IPsets
+# for storing large volumes of banned IPs
+#
+# IPset comes in two versions. See ipset -V for which one to use
+# requires the ipset package and kernel support.
+[ssh-iptables-ipset4]
+
+enabled  = false
+filter   = sshd
+action   = iptables-ipset-proto4[name=SSH, port=ssh, protocol=tcp]
+logpath  = /var/log/sshd.log
+maxretry = 5
+
+[ssh-iptables-ipset6]
+enabled  = false
+filter   = sshd
+action   = iptables-ipset-proto6[name=SSH, port=ssh, protocol=tcp, bantime=600]
+logpath  = /var/log/sshd.log
+maxretry = 5
+
 # This jail demonstrates the use of wildcards in "logpath".
 # Moreover, it is possible to give other files on a new line.
 

From f9b78ba92798da40509c5743c1d15e13d6a7f3ec Mon Sep 17 00:00:00 2001
From: Michael Gebetsroither <michael@mgeb.org>
Date: Thu, 3 Jan 2013 18:46:31 +0100
Subject: [PATCH 048/544] add support for blocking through blackhole routes

---
 config/action.d/route.conf | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 config/action.d/route.conf

diff --git a/config/action.d/route.conf b/config/action.d/route.conf
new file mode 100644
index 00000000..2d11c700
--- /dev/null
+++ b/config/action.d/route.conf
@@ -0,0 +1,19 @@
+# Fail2Ban configuration file
+#
+# Author: Michael Gebetsroither
+#
+# This is for blocking whole hosts through blackhole routes.
+#
+# PRO:
+#   - Works on all kernel versions and as no compatibility problems (back to debian lenny and WAY further).
+#   - It's FAST for very large numbers of blocked ips.
+#   - It's FAST because it Blocks traffic before it enters common iptables chains used for filtering.
+#   - It's per host, ideal as action against ssh password bruteforcing to block further attack attempts.
+#   - No additional software required beside iproute/iproute2
+#
+# CON:
+#   - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts
+
+[Definition]
+actionban   = ip route add blackhole <ip>
+actionunban = ip route del blackhole <ip>

From 03433f79cd52a87c3fd7309e7fe9967076bbb866 Mon Sep 17 00:00:00 2001
From: Michael Gebetsroither <michael@mgeb.org>
Date: Fri, 4 Jan 2013 16:09:04 +0100
Subject: [PATCH 049/544] add example jail.conf for blocking through blackhole
 routes for ssh

---
 config/jail.conf | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 3f2425b4..fb9f9ca0 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -101,6 +101,17 @@ action      = hostsdeny
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log
 
+# Here we use blackhole routes for not requiring any additional kernel support
+# to store large volumes of banned IPs
+
+[ssh-route]
+
+enabled = false
+filter = sshd
+action = route
+logpath = /var/log/sshd.log
+maxretry = 5
+
 # Here we use a combination of Netfilter/Iptables and IPsets
 # for storing large volumes of banned IPs
 #

From 8f0c533d644bfb2316661d2b204658950d0ab37c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 4 Jan 2013 10:55:14 -0500
Subject: [PATCH 050/544] DOC: Mention that logrotate configuration needs to be
 adjusted if logtarget is changed (Closes: #697333)

---
 config/fail2ban.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index a8e2eb9a..f2f1b215 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -24,6 +24,10 @@ loglevel = 3
 # Option:  logtarget
 # Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
 #          Only one log target can be specified.
+#          If you change logtarget from the default value and you are
+#          using logrotate -- also adjust or disable rotation in the
+#          corresponding configuration file
+#          (e.g. /etc/logrotate.d/fail2ban on Debian systems)
 # Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
 logtarget = /var/log/fail2ban.log

From 3ce53e87984d7abc84ea4d34ded985e31f29d830 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 4 Jan 2013 15:22:18 -0500
Subject: [PATCH 051/544] ENH: Added login authenticator failed regexp for exim
 filter

---
 config/filter.d/exim.conf | 1 +
 testcases/files/logs/exim | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 testcases/files/logs/exim

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index a25ef3db..8bf4fc5f 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -15,6 +15,7 @@
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+             login authenticator failed for .* \[<HOST>\]: 535 Incorrect authentication data \(set_id=.*\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
new file mode 100644
index 00000000..dd507379
--- /dev/null
+++ b/testcases/files/logs/exim
@@ -0,0 +1,2 @@
+# From IRC 2013-01-04
+2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)

From b3d8ba146b52478262d0637b8bab06cb6cb6aa20 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 4 Jan 2013 10:55:14 -0500
Subject: [PATCH 052/544] DOC: Mention that logrotate configuration needs to be
 adjusted if logtarget is changed (Closes: #697333)

---
 config/fail2ban.conf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index a8e2eb9a..f2f1b215 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -24,6 +24,10 @@ loglevel = 3
 # Option:  logtarget
 # Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
 #          Only one log target can be specified.
+#          If you change logtarget from the default value and you are
+#          using logrotate -- also adjust or disable rotation in the
+#          corresponding configuration file
+#          (e.g. /etc/logrotate.d/fail2ban on Debian systems)
 # Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
 logtarget = /var/log/fail2ban.log

From 9a392928132efccc5f93ba0e2e4717e781d826c3 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 4 Jan 2013 15:22:18 -0500
Subject: [PATCH 053/544] ENH: Added login authenticator failed regexp for exim
 filter

---
 config/filter.d/exim.conf | 1 +
 testcases/files/logs/exim | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 testcases/files/logs/exim

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index a25ef3db..8bf4fc5f 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -15,6 +15,7 @@
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
+             login authenticator failed for .* \[<HOST>\]: 535 Incorrect authentication data \(set_id=.*\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
new file mode 100644
index 00000000..dd507379
--- /dev/null
+++ b/testcases/files/logs/exim
@@ -0,0 +1,2 @@
+# From IRC 2013-01-04
+2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)

From bb7628591c124309774d5f4787d2a4f07cf6b906 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@cora.nwra.com>
Date: Fri, 18 Jan 2013 14:44:49 -0700
Subject: [PATCH 054/544] Update config/filter.d/sshd.conf

Do not trigger sshd bans on pam_unix authentication failures, this will trigger on successful logins on systems that use non-pam_unix authentication (sssd, ldap, etc.).
---
 config/filter.d/sshd.conf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 88615957..e4339c78 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -30,7 +30,6 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
-            ^%(__prefix_line)s(?:pam_unix\(sshd:auth\):\s)?authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
 

From 96eb8986cc732c8a021e6a9f31d8505b976782b9 Mon Sep 17 00:00:00 2001
From: blotus <sebastien@blot.me>
Date: Fri, 25 Jan 2013 13:37:22 +0100
Subject: [PATCH 055/544] Escape ' and " in matches tag

---
 server/action.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/action.py b/server/action.py
index f2614b33..35974c70 100644
--- a/server/action.py
+++ b/server/action.py
@@ -243,7 +243,7 @@ class Action:
 		return Action.executeCmd(stopCmd)
 
 	def escapeTag(tag):
-		for c in '\\#&;`|*?~<>^()[]{}$\n':
+		for c in '\\#&;`|*?~<>^()[]{}$\n\'"':
 			if c in tag:
 				tag = tag.replace(c, '\\' + c)
 		return tag

From fdd9dfb4b5c543ba31f1c21b67f26ce1d9decfe9 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Fri, 25 Jan 2013 12:56:00 -0700
Subject: [PATCH 056/544] Initial support for --no-network option for
 fail2ban-testcases

---
 fail2ban-testcases | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 0ee2c53c..20d3b226 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -53,6 +53,12 @@ def get_opt_parser():
 			   help="Log level for the logger to use during running tests"),
 		])
 
+	p.add_options([
+		Option('-n', "--no-network", action="store_true",
+			   dest="no_network",
+			   help="Do not run tests that require the network"),
+		])
+
 	return p
 
 parser = get_opt_parser()
@@ -90,6 +96,8 @@ else:
 	stdout.setFormatter(logging.Formatter(' %(message)s'))
 logSys.addHandler(stdout)
 
+if opts.no_network is None:
+    opts.no_network = False
 
 #
 # Let know the version
@@ -129,11 +137,13 @@ tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
 
 # Filter
-tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
+if not opts.no_network:
+    tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFileMonitor))
-tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
-tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
+if not opts.no_network:
+    tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+    tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
 tests.addTest(unittest.makeSuite(filtertestcase.JailTests))
 
 # DateDetector

From 6b2e76ba7fce1841411183a72a2c75b6826c4b4c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 25 Jan 2013 16:01:35 -0500
Subject: [PATCH 057/544] BF: pyinotify - use bitwise op on masks and do not
 try tracking newly created directories

---
 server/filterpyinotify.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py
index fdc7256e..a2eea9d7 100644
--- a/server/filterpyinotify.py
+++ b/server/filterpyinotify.py
@@ -65,7 +65,11 @@ class FilterPyinotify(FileFilter):
 
 	def callback(self, event):
 		path = event.pathname
-		if event.mask == pyinotify.IN_CREATE:
+		if event.mask & pyinotify.IN_CREATE:
+			# skip directories altogether
+			if event.mask & pyinotify.IN_ISDIR:
+				logSys.debug("Ignoring creation of directory %s" % path)
+				return
 			# check if that is a file we care about
 			if not path in self.__watches:
 				logSys.debug("Ignoring creation of %s we do not monitor" % path)

From 431489c9b94c001200ae8ec15935a3d75d972940 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Fri, 25 Jan 2013 14:19:10 -0700
Subject: [PATCH 058/544] Remove unneeded setting of opts.no_network

---
 fail2ban-testcases | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 20d3b226..99fefd57 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -96,9 +96,6 @@ else:
 	stdout.setFormatter(logging.Formatter(' %(message)s'))
 logSys.addHandler(stdout)
 
-if opts.no_network is None:
-    opts.no_network = False
-
 #
 # Let know the version
 #

From acab23bdfe12a2fa76d1d30e55a1daeb4ffa909f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 28 Jan 2013 09:46:50 -0500
Subject: [PATCH 059/544] RF: move exceptions used by both client and server
 into common/exceptions.py

this prevents importing of server while operating with client only
---
 client/beautifier.py | 14 ++++----------
 common/exceptions.py | 36 ++++++++++++++++++++++++++++++++++++
 server/jails.py      | 17 +++--------------
 3 files changed, 43 insertions(+), 24 deletions(-)
 create mode 100644 common/exceptions.py

diff --git a/client/beautifier.py b/client/beautifier.py
index a75655e7..7e48016c 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -17,20 +17,14 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
 __license__ = "GPL"
 
-from server.jails import UnknownJailException
-from server.jails import DuplicateJailException
 import logging
 
+from common.exceptions import UnknownJailException, DuplicateJailException
+
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client.config")
 
diff --git a/common/exceptions.py b/common/exceptions.py
new file mode 100644
index 00000000..7e933544
--- /dev/null
+++ b/common/exceptions.py
@@ -0,0 +1,36 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+"""Fail2Ban exceptions used by both client and server
+
+"""
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
+__license__ = "GPL"
+
+#
+# Jails
+#
+class DuplicateJailException(Exception):
+	pass
+
+class UnknownJailException(Exception):
+	pass
+
+
+
diff --git a/server/jails.py b/server/jails.py
index 3be38f70..4bf5f971 100644
--- a/server/jails.py
+++ b/server/jails.py
@@ -17,16 +17,11 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
 __license__ = "GPL"
 
+from common.exceptions import DuplicateJailException, UnknownJailException
 
 from jail import Jail
 from threading import Lock
@@ -160,9 +155,3 @@ class Jails:
 		finally:
 			self.__lock.release()
 
-
-class DuplicateJailException(Exception):
-	pass
-
-class UnknownJailException(Exception):
-	pass

From d561a4c2bbc336db70d5923cf630813bc51dc3ee Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 28 Jan 2013 09:54:08 -0500
Subject: [PATCH 060/544] BF: do not rely on scripts being under /usr -- might
 differ eg on Fedora -- rely on import of common.version (Closes gh-112)

This is also not ideal, since if there happens to be some systemwide common.version -- we are doomed

but otherwise, we cannot keep extending comparison check to /bin, /sbin whatelse
---
 fail2ban-client | 9 +++++----
 fail2ban-regex  | 9 +++++----
 fail2ban-server | 7 ++++---
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 1d8eb15e..13d018e6 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -27,12 +27,13 @@ import getopt, time, shlex, socket
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-if os.path.abspath(__file__).startswith('/usr/'):
-	# makes sense to use system-wide library iff -client is also under /usr/
+try:
+	from common.version import version
+except ImportError, e:
 	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version
 
-# Now we can import our modules
-from common.version import version
+# Now we can import the rest of modules
 from common.protocol import printFormatted
 from client.csocket import CSocket
 from client.configurator import Configurator
diff --git a/fail2ban-regex b/fail2ban-regex
index a42ed96d..f9bc72c1 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -26,13 +26,14 @@ import getopt, sys, time, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-if os.path.abspath(__file__).startswith('/usr/'):
-	# makes sense to use system-wide library iff -regex is also under /usr/
-    sys.path.insert(1, "/usr/share/fail2ban")
+try:
+	from common.version import version
+except ImportError, e:
+	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version
 
 from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
-from common.version import version
 from server.filter import Filter
 from server.failregex import RegexException
 
diff --git a/fail2ban-server b/fail2ban-server
index bd86e6cd..0f3410c9 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -26,11 +26,12 @@ import getopt, sys, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-if os.path.abspath(__file__).startswith('/usr/'):
-	# makes sense to use system-wide library iff -server is also under /usr/
+try:
+	from common.version import version
+except ImportError, e:
 	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version
 
-from common.version import version
 from server.server import Server
 
 # Gets the instance of the logger.

From bf5f46c3d597c3914ba8fa138e172aa5db10ede2 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Wed, 30 Jan 2013 19:57:03 +0000
Subject: [PATCH 061/544] Warn if config file present but unreadable

---
 client/configreader.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/client/configreader.py b/client/configreader.py
index 063484e8..e435b254 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -59,6 +59,16 @@ class ConfigReader(SafeConfigParserWithIncludes):
 		bConf = basename + ".conf"
 		bLocal = basename + ".local"
 		if os.path.exists(bConf) or os.path.exists(bLocal):
+			if not os.access(bConf, os.R_OK) and not os.access(bLocal, os.R_OK):
+				logSys.warning(
+					"Unable to read either \"%s\" or \"%s\"" % (bConf, bLocal))
+				return False
+			elif os.path.exists(bConf) and not os.access(bConf, os.R_OK):
+				logSys.warning(
+					"\"%s\" read, but unable to read \"%s\"" % (bLocal, bConf))
+			elif os.path.exists(bLocal) and not os.access(bLocal, os.R_OK):
+				logSys.warning(
+					"\"%s\" read, but unable to read \"%s\"" % (bConf, bLocal))
 			SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
 			return True
 		else:

From 9c2e0cbbc86569108fd729c9710e42b96b1c03fa Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Thu, 31 Jan 2013 18:36:23 +0000
Subject: [PATCH 062/544] Fix up for warning/error for inaccessible config
 files

---
 client/configreader.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/configreader.py b/client/configreader.py
index e435b254..4e783ebb 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -60,8 +60,13 @@ class ConfigReader(SafeConfigParserWithIncludes):
 		bLocal = basename + ".local"
 		if os.path.exists(bConf) or os.path.exists(bLocal):
 			if not os.access(bConf, os.R_OK) and not os.access(bLocal, os.R_OK):
-				logSys.warning(
-					"Unable to read either \"%s\" or \"%s\"" % (bConf, bLocal))
+				if os.path.exists(bConf) and not os.path.exists(bLocal):
+					logSys.error("Unable to read \"%s\" " % bConf)
+				elif os.path.exists(bLocal) and not os.path.exists(bConf):
+					logSys.error("Unable to read \"%s\" " % bLocal)
+				else:
+					logSys.error(
+						"Unable to read \"%s\" and \"%s\"" % (bConf, bLocal))
 				return False
 			elif os.path.exists(bConf) and not os.access(bConf, os.R_OK):
 				logSys.warning(

From 5f2d3832f780ef229c06b6cb64e443393e32df1d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 31 Jan 2013 14:39:59 -0500
Subject: [PATCH 063/544] NF: roundcube-auth filter (to close Debian #699442,
 needing debian/jail.conf section)

---
 config/filter.d/roundcube-auth.conf | 22 ++++++++++++++++++++++
 config/jail.conf                    |  9 +++++++++
 testcases/files/logs/roundcube-auth |  1 +
 3 files changed, 32 insertions(+)
 create mode 100644 config/filter.d/roundcube-auth.conf
 create mode 100644 testcases/files/logs/roundcube-auth

diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf
new file mode 100644
index 00000000..41766e31
--- /dev/null
+++ b/config/filter.d/roundcube-auth.conf
@@ -0,0 +1,22 @@
+# Fail2Ban configuration file for roundcube web server
+#
+# Author: Teodor Micu & Yaroslav Halchenko
+#
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = FAILED login for .*. from <HOST>\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
diff --git a/config/jail.conf b/config/jail.conf
index 3f2425b4..1817ebd5 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -192,6 +192,15 @@ action   = shorewall
            sendmail[name=Postfix, dest=you@example.com]
 logpath  = /var/log/apache2/error_log
 
+# Monitor roundcube server
+
+[roundcube-iptables]
+
+enabled  = false
+filter   = roundcube-auth
+action   = iptables[name=RoundCube, port="http,https"]
+logpath  = /var/log/roundcube/userlogins
+
 # Ban attackers that try to use PHP's URL-fopen() functionality
 # through GET/POST variables. - Experimental, with more than a year
 # of usage in production environments.
diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth
new file mode 100644
index 00000000..d16f7266
--- /dev/null
+++ b/testcases/files/logs/roundcube-auth
@@ -0,0 +1 @@
+[22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10

From f8983872ad4297ddb3017f4818edd08892dd2129 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 1 Feb 2013 16:07:00 -0500
Subject: [PATCH 064/544] BF: return str(host) to avoid spurious characters in
 the logs (Close gh-113)

thanks to opoplawski@github
---
 server/failregex.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/failregex.py b/server/failregex.py
index 8ce9597a..b194d472 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -130,4 +130,4 @@ class FailRegex(Regex):
 			s = self._matchCache.string
 			r = self._matchCache.re
 			raise RegexException("No 'host' found in '%s' using '%s'" % (s, r))
-		return host
+		return str(host)

From 52f952e6454d12fbe31dbd53bf2220c8b7658610 Mon Sep 17 00:00:00 2001
From: ArndRa <ArndRaphael.Brandes@gmx.de>
Date: Mon, 11 Feb 2013 17:14:29 +0100
Subject: [PATCH 065/544] Update config/jail.conf

Update to use the new sogo-auth filter
---
 config/jail.conf | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 1817ebd5..215e5b9a 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -201,6 +201,20 @@ filter   = roundcube-auth
 action   = iptables[name=RoundCube, port="http,https"]
 logpath  = /var/log/roundcube/userlogins
 
+
+# Monitor SOGo groupware server
+
+[sogo-iptables]
+
+enabled  = false
+filter   = sogo-auth
+port     = http, https
+# without proxy this would be:
+# port    = 20000
+
+action   = iptables[name=SOGo, port="http,https"]
+logpath  = /var/log/sogo/sogo.log
+
 # Ban attackers that try to use PHP's URL-fopen() functionality
 # through GET/POST variables. - Experimental, with more than a year
 # of usage in production environments.

From 35bf84abadfc633e33a36bdcb32586f652fdadf3 Mon Sep 17 00:00:00 2001
From: ArndRa <ArndRaphael.Brandes@gmx.de>
Date: Mon, 11 Feb 2013 08:19:48 -0800
Subject: [PATCH 066/544] Create sogo-auth.conf

Regexp works with SOGo 2.0.5 or newer, following new feature implemented here: http://www.sogo.nu/bugs/view.php?id=2229
---
 config/filter.d/sogo-auth.conf | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 config/filter.d/sogo-auth.conf

diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf
new file mode 100644
index 00000000..e4d29c23
--- /dev/null
+++ b/config/filter.d/sogo-auth.conf
@@ -0,0 +1,19 @@
+# /etc/fail2ban/filter.d/sogo.conf
+#
+# Fail2Ban configuration file
+# By Arnd Brandes
+# SOGo
+#
+
+[Definition]
+# Option: failregex
+# Filter Ban in /var/log/sogo/sogo.log
+# Note: the error log may contain multiple hosts, whereas the first one 
+# is the client and all others are poxys. We match the first one, only
+
+failregex = Login from '<HOST>.*' for user '.*' might not have worked
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#

From 6004fe7a9449caf2aeb135cb3b7e76efa52b2ad7 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 11 Feb 2013 16:17:52 -0500
Subject: [PATCH 067/544] just trailing spaces in setup.py

---
 setup.py | 50 +++++++++++++++++++++++++-------------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/setup.py b/setup.py
index 53b03f0f..37086227 100755
--- a/setup.py
+++ b/setup.py
@@ -36,33 +36,33 @@ to reject the IP address or executes user defined
 commands.'''
 
 setup(
-	name = "fail2ban", 
-	version = version, 
-	description = "Ban IPs that make too many password failure", 
-	long_description = longdesc, 
-	author = "Cyril Jaquier", 
-	author_email = "cyril.jaquier@fail2ban.org", 
-	url = "http://www.fail2ban.org", 
-	license = "GPL", 
-	platforms = "Posix", 
+	name = "fail2ban",
+	version = version,
+	description = "Ban IPs that make too many password failure",
+	long_description = longdesc,
+	author = "Cyril Jaquier",
+	author_email = "cyril.jaquier@fail2ban.org",
+	url = "http://www.fail2ban.org",
+	license = "GPL",
+	platforms = "Posix",
 	scripts =	[
-					'fail2ban-client', 
-					'fail2ban-server', 
+					'fail2ban-client',
+					'fail2ban-server',
 					'fail2ban-regex'
-				], 
+				],
 	packages =	[
-					'common', 
-					'client', 
+					'common',
+					'client',
 					'server'
-				], 
+				],
 	data_files =	[
-						('/etc/fail2ban', 
+						('/etc/fail2ban',
 							glob("config/*.conf")
-						), 
-						('/etc/fail2ban/filter.d', 
+						),
+						('/etc/fail2ban/filter.d',
 							glob("config/filter.d/*.conf")
-						), 
-						('/etc/fail2ban/action.d', 
+						),
+						('/etc/fail2ban/action.d',
 							glob("config/action.d/*.conf")
 						),
 						('/var/run/fail2ban',
@@ -78,20 +78,20 @@ elements =	{
 				"/etc/":
 					[
 						"fail2ban.conf"
-					], 
+					],
 				"/usr/bin/":
 					[
 						"fail2ban.py"
-					], 
+					],
 				"/usr/lib/fail2ban/firewall/":
 					[
-						"iptables.py", 
-						"ipfwadm.py", 
+						"iptables.py",
+						"ipfwadm.py",
 						"ipfw.py"
 					],
 				"/usr/lib/fail2ban/":
 					[
-						"version.py", 
+						"version.py",
 						"protocol.py"
 					]
 			}

From 6cd358ee95dbeef5a07af25ee028df5cfe543731 Mon Sep 17 00:00:00 2001
From: ArndRa <ArndRaphael.Brandes@gmx.de>
Date: Tue, 12 Feb 2013 10:45:37 +0100
Subject: [PATCH 068/544] Update config/filter.d/sogo-auth.conf

Comment line in the top altered to fit file name. My local file was named differently...
---
 config/filter.d/sogo-auth.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf
index e4d29c23..6a1abd3f 100644
--- a/config/filter.d/sogo-auth.conf
+++ b/config/filter.d/sogo-auth.conf
@@ -1,4 +1,4 @@
-# /etc/fail2ban/filter.d/sogo.conf
+# /etc/fail2ban/filter.d/sogo-auth.conf
 #
 # Fail2Ban configuration file
 # By Arnd Brandes

From 8cf006827e6f7def17aef82f7a792f66747be8ca Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 12 Feb 2013 08:48:05 -0500
Subject: [PATCH 069/544] BF: remove path from grep call in
 sendmail-whois-lines.conf Closes: gh-118

---
 config/action.d/sendmail-whois-lines.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index d1e6e40f..b84440d0 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -57,7 +57,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
             Here are more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Lines containing IP:<ip> in <logpath>\n
-            `/bin/grep '\<<ip>\>' <logpath>`\n\n
+            `grep '\<<ip>\>' <logpath>`\n\n
             Regards,\n
             Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
 

From 47b1ee39d8e5e918afaea40f361b3932a2b8616e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 17 Feb 2013 12:37:34 +1100
Subject: [PATCH 070/544] add blocking type

---
 config/action.d/route.conf | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/config/action.d/route.conf b/config/action.d/route.conf
index 2d11c700..ec940b74 100644
--- a/config/action.d/route.conf
+++ b/config/action.d/route.conf
@@ -15,5 +15,11 @@
 #   - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts
 
 [Definition]
-actionban   = ip route add blackhole <ip>
-actionunban = ip route del blackhole <ip>
+actionban   = ip route add <type> <ip>
+actionunban = ip route del <type> <ip>
+
+# Type of blocking
+#
+# Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
+
+type = blackhole

From 9ba27353b62bb20ae8aaeed45a274483ad67bd83 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 17 Feb 2013 17:03:23 -0500
Subject: [PATCH 071/544] NF: allow customization configuration under
 corresponding .d directories (Closes gh-114)

Additional changes:
  ENH: make basedir for Config's a kwarg to the constructor
  ENH: improved analysis/reporting on presence/accessibility of config
       files.  Got carried away and forgot about existing  work done by
	   Steven Hiscocks in the gh-115 -- will merge it in the next
       commit for the fair ack of his work

Now for any X.conf configuration file we have following ways to
provide customizations

  X.local -- read after .conf (kept for backward compatibility)
  X.d/ -- directory to contain additional .conf files, sorted
               alphabetically, e.g
  X.d/01_enable.conf       - to enable the jail
  X.d/02_custom_port.conf  - to change the port

X could be a 'jail' or 'fail2ban' or any other configuration file in
fail2ban.

Mention that all files still must contain the corresponding sections
(most of the time duplicating it across all of them).
---
 client/actionreader.py            |  4 +-
 client/configreader.py            | 70 ++++++++++++++++--------
 client/fail2banreader.py          |  4 +-
 client/filterreader.py            |  4 +-
 client/jailreader.py              | 11 ++--
 client/jailsreader.py             | 10 ++--
 fail2ban-testcases                |  4 +-
 testcases/clientreadertestcase.py | 89 ++++++++++++++++++++++++++++---
 8 files changed, 150 insertions(+), 46 deletions(-)

diff --git a/client/actionreader.py b/client/actionreader.py
index 581a1b3c..9ad1ef28 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -35,8 +35,8 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class ActionReader(ConfigReader):
 	
-	def __init__(self, action, name):
-		ConfigReader.__init__(self)
+	def __init__(self, action, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__file = action[0]
 		self.__cInfo = action[1]
 		self.__name = name
diff --git a/client/configreader.py b/client/configreader.py
index 063484e8..79c5b47b 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -27,7 +27,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import logging, os
+import glob, logging, os
 from configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError
 
@@ -35,36 +35,64 @@ from ConfigParser import NoOptionError, NoSectionError
 logSys = logging.getLogger("fail2ban.client.config")
 
 class ConfigReader(SafeConfigParserWithIncludes):
+
+	DEFAULT_BASEDIR = '/etc/fail2ban'
 	
-	BASE_DIRECTORY = "/etc/fail2ban/"
-	
-	def __init__(self):
+	def __init__(self, basedir=None):
 		SafeConfigParserWithIncludes.__init__(self)
+		self.setBaseDir(basedir)
 		self.__opts = None
 	
-	#@staticmethod
-	def setBaseDir(folderName):
-		path = folderName.rstrip('/')
-		ConfigReader.BASE_DIRECTORY = path + '/'
-	setBaseDir = staticmethod(setBaseDir)
-		
-	#@staticmethod
-	def getBaseDir():
-		return ConfigReader.BASE_DIRECTORY
-	getBaseDir = staticmethod(getBaseDir)
+	def setBaseDir(self, basedir):
+		if basedir is None:
+			basedir = ConfigReader.DEFAULT_BASEDIR	# stock system location
+		if not (os.path.exists(basedir) and os.access(basedir, os.R_OK | os.X_OK)):
+			raise ValueError("Base configuration directory %s either does not exist "
+							 "or is not accessible" % basedir)
+		self._basedir = basedir.rstrip('/')
+	
+	def getBaseDir(self):
+		return self._basedir
 	
 	def read(self, filename):
-		basename = ConfigReader.BASE_DIRECTORY + filename
+		basename = os.path.join(self._basedir, filename)
 		logSys.debug("Reading " + basename)
-		bConf = basename + ".conf"
-		bLocal = basename + ".local"
-		if os.path.exists(bConf) or os.path.exists(bLocal):
-			SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
+		config_files = [ basename + ".conf",
+						 basename + ".local" ]
+
+		# choose only existing ones
+		config_files = filter(os.path.exists, config_files)
+
+		# possible further customizations under a .conf.d directory
+		config_dir = basename + '.d'
+		if os.path.exists(config_dir):
+			if os.path.isdir(config_dir) and os.access(config_dir, os.X_OK | os.R_OK):
+				# files must carry .conf suffix as well
+				config_files += sorted(glob.glob('%s/*.conf' % config_dir))
+			else:
+				logSys.warn("%s exists but not a directory or not accessible"
+							 % config_dir)
+
+		# check if files are accessible, warn if any is not accessible
+		# and remove it from the list
+		config_files_accessible = []
+		for f in config_files:
+			if os.access(f, os.R_OK):
+				config_files_accessible.append(f)
+			else:
+				logSys.warn("%s exists but not accessible - skipping" % f)
+
+		if len(config_files_accessible):
+			# at least one config exists and accessible
+			SafeConfigParserWithIncludes.read(self, config_files_accessible)
 			return True
 		else:
-			logSys.error(bConf + " and " + bLocal + " do not exist")
+			logSys.error("Found no accessible config files for %r " % filename
+						 + (["",
+							 "among existing ones: " + ', '.join(config_files)][bool(len(config_files))]))
+
 			return False
-	
+
 	##
 	# Read the options.
 	#
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index ee097bd6..7115ec79 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -35,8 +35,8 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class Fail2banReader(ConfigReader):
 	
-	def __init__(self):
-		ConfigReader.__init__(self)
+	def __init__(self, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 	
 	def read(self):
 		ConfigReader.read(self, "fail2ban")
diff --git a/client/filterreader.py b/client/filterreader.py
index b7a72f9c..7dba3579 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -35,8 +35,8 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class FilterReader(ConfigReader):
 	
-	def __init__(self, fileName, name):
-		ConfigReader.__init__(self)
+	def __init__(self, fileName, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__file = fileName
 		self.__name = name
 	
diff --git a/client/jailreader.py b/client/jailreader.py
index f66dc010..ec73ce46 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -40,8 +40,8 @@ class JailReader(ConfigReader):
 	
 	actionCRE = re.compile("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$")
 	
-	def __init__(self, name):
-		ConfigReader.__init__(self)
+	def __init__(self, name, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__name = name
 		self.__filter = None
 		self.__actions = list()
@@ -53,7 +53,7 @@ class JailReader(ConfigReader):
 		return self.__name
 	
 	def read(self):
-		ConfigReader.read(self, "jail")
+		return ConfigReader.read(self, "jail")
 	
 	def isEnabled(self):
 		return self.__opts["enabled"]
@@ -75,7 +75,8 @@ class JailReader(ConfigReader):
 		
 		if self.isEnabled():
 			# Read filter
-			self.__filter = FilterReader(self.__opts["filter"], self.__name)
+			self.__filter = FilterReader(self.__opts["filter"], self.__name,
+										 basedir=self.getBaseDir())
 			ret = self.__filter.read()
 			if ret:
 				self.__filter.getOptions(self.__opts)
@@ -87,7 +88,7 @@ class JailReader(ConfigReader):
 			for act in self.__opts["action"].split('\n'):
 				try:
 					splitAct = JailReader.splitAction(act)
-					action = ActionReader(splitAct, self.__name)
+					action = ActionReader(splitAct, self.__name, basedir=self.getBaseDir())
 					ret = action.read()
 					if ret:
 						action.getOptions(self.__opts)
diff --git a/client/jailsreader.py b/client/jailsreader.py
index bedc5a3c..e1b8efa3 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -36,12 +36,12 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class JailsReader(ConfigReader):
 	
-	def __init__(self):
-		ConfigReader.__init__(self)
+	def __init__(self, **kwargs):
+		ConfigReader.__init__(self, **kwargs)
 		self.__jails = list()
 	
 	def read(self):
-		ConfigReader.read(self, "jail")
+		return ConfigReader.read(self, "jail")
 	
 	def getOptions(self, section = None):
 		opts = []
@@ -49,7 +49,7 @@ class JailsReader(ConfigReader):
 
 		if section:
 			# Get the options of a specific jail.
-			jail = JailReader(section)
+			jail = JailReader(section, basedir=self.getBaseDir())
 			jail.read()
 			ret = jail.getOptions()
 			if ret:
@@ -62,7 +62,7 @@ class JailsReader(ConfigReader):
 		else:
 			# Get the options of all jails.
 			for sec in self.sections():
-				jail = JailReader(sec)
+				jail = JailReader(sec, basedir=self.getBaseDir())
 				jail.read()
 				ret = jail.getOptions()
 				if ret:
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 99fefd57..ff94cfad 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -130,8 +130,10 @@ tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 # BanManager
 tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
-# ClientReader
+# ClientReaders
+tests.addTest(unittest.makeSuite(clientreadertestcase.ConfigReaderTest))
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
+tests.addTest(unittest.makeSuite(clientreadertestcase.JailsReaderTest))
 
 # Filter
 if not opts.no_network:
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 83121345..55fb010d 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -27,20 +27,93 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest
+import os, shutil, tempfile, unittest
+from client.configreader import ConfigReader
 from client.jailreader import JailReader
+from client.jailsreader import JailsReader
 
-class JailReaderTest(unittest.TestCase):
+class ConfigReaderTest(unittest.TestCase):
 
 	def setUp(self):
 		"""Call before every test case."""
+		self.d = tempfile.mkdtemp(prefix="f2b-temp")
+		self.c = ConfigReader(basedir=self.d)
+
 
 	def tearDown(self):
 		"""Call after every test case."""
+		shutil.rmtree(self.d)
+
+	def _write(self, fname, value):
+		# verify if we don't need to create .d directory
+		if os.path.sep in fname:
+			d = os.path.dirname(fname)
+			d_ = os.path.join(self.d, d)
+			if not os.path.exists(d_):
+				os.makedirs(d_)
+		open("%s/%s" % (self.d, fname), "w").write("""
+[section]
+option = %s
+""" % value)
+
+	def _remove(self, fname):
+		os.unlink("%s/%s" % (self.d, fname))
+		self.assertTrue(self.c.read('c'))	# we still should have some
+
+
+	def _getoption(self):
+		self.assertTrue(self.c.read('c'))	# we got some now
+		return self.c.getOptions('section', [("int", 'option')])['option']
+
+	def testOptionalDotDDir(self):
+		self.assertFalse(self.c.read('c'))	# nothing is there yet
+		self._write("c.conf", "1")
+		self.assertEqual(self._getoption(), 1)
+		self._write("c.conf", "2")		# overwrite
+		self.assertEqual(self._getoption(), 2)
+		self._write("c.local", "3")		# add override in .local
+		self.assertEqual(self._getoption(), 3)
+		self._write("c.d/98.conf", "998") # add 1st override in .d/
+		self.assertEqual(self._getoption(), 998)
+		self._write("c.d/90.conf", "990") # add previously sorted override in .d/
+		self.assertEqual(self._getoption(), 998) #  should stay the same
+		self._write("c.d/99.conf", "999") # now override in a way without sorting we possibly get a failure
+		self.assertEqual(self._getoption(), 999)
+		self._remove("c.d/99.conf")
+		self.assertEqual(self._getoption(), 998)
+		self._remove("c.d/98.conf")
+		self.assertEqual(self._getoption(), 990)
+		self._remove("c.d/90.conf")
+		self.assertEqual(self._getoption(), 3)
+		self._remove("c.conf")			#  we allow to stay without .conf
+		self.assertEqual(self._getoption(), 3)
+		self._write("c.conf", "1")
+		self._remove("c.local")
+		self.assertEqual(self._getoption(), 1)
+
+
+class JailReaderTest(unittest.TestCase):
+
+	def testStockSSHJail(self):
+		jail = JailReader('ssh-iptables', basedir='config') # we are running tests from root project dir atm
+		self.assertTrue(jail.read())
+		self.assertTrue(jail.getOptions())
+		self.assertFalse(jail.isEnabled())
+		self.assertEqual(jail.getName(), 'ssh-iptables')
+
+
+class JailsReaderTest(unittest.TestCase):
+
+	def testProvidingBadBasedir(self):
+		if not os.path.exists('/XXX'):
+			self.assertRaises(ValueError, JailsReader, basedir='/XXX')
+
+	def testReadStockJailConf(self):
+		jails = JailsReader(basedir='config') # we are running tests from root project dir atm
+		self.assertTrue(jails.read())		  # opens fine
+		self.assertTrue(jails.getOptions())	  # reads fine
+		comm_commands = jails.convert()
+		# by default None of the jails is enabled and we get no
+		# commands to communicate to the server
+		self.assertEqual(comm_commands, [])
 
-	def testSplitAction(self):
-		action = "mail-whois[name=SSH]"
-		expected = ['mail-whois', {'name': 'SSH'}]
-		result = JailReader.splitAction(action)
-		self.assertEquals(expected, result)
-		

From ce3ab34dd8bc0181fbb68c7fc8b9ed18e35cf5f3 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 17 Feb 2013 22:14:01 +0000
Subject: [PATCH 072/544] Added ability to specify PID file

---
 client/fail2banreader.py |  3 ++-
 config/fail2ban.conf     |  7 +++++++
 fail2ban-client          | 18 ++++++++++++++----
 fail2ban-server          | 10 ++++++++--
 server/server.py         | 12 +++++-------
 5 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index ee097bd6..6954b3bf 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -42,7 +42,8 @@ class Fail2banReader(ConfigReader):
 		ConfigReader.read(self, "fail2ban")
 	
 	def getEarlyOptions(self):
-		opts = [["string", "socket", "/tmp/fail2ban.sock"]]
+		opts = [["string", "socket", "/tmp/fail2ban.sock"],
+				["string", "pidfile", "/var/run/fail2ban/fail2ban.pid"]]
 		return ConfigReader.getOptions(self, "Definition", opts)
 	
 	def getOptions(self):
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index f2f1b215..e759513b 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -40,3 +40,10 @@ logtarget = /var/log/fail2ban.log
 #
 socket = /var/run/fail2ban/fail2ban.sock
 
+# Option: pidfile
+# Notes.: Set the PID file. This is used to store the process ID of the
+#         fail2ban server.
+# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
+#
+pidfile = /var/run/fail2ban/fail2ban.pid
+
diff --git a/fail2ban-client b/fail2ban-client
index 13d018e6..595144ef 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -62,6 +62,7 @@ class Fail2banClient:
 		self.__conf["verbose"] = 1
 		self.__conf["interactive"] = False
 		self.__conf["socket"] = None
+		self.__conf["pidfile"] = None
 		
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -84,6 +85,7 @@ class Fail2banClient:
 		print "Options:"
 		print "    -c <DIR>                configuration directory"
 		print "    -s <FILE>               socket path"
+		print "    -p <FILE>               pidfile path"
 		print "    -d                      dump configuration. For debugging"
 		print "    -i                      interactive mode"
 		print "    -v                      increase verbosity"
@@ -119,6 +121,8 @@ class Fail2banClient:
 				self.__conf["conf"] = opt[1]
 			elif opt[0] == "-s":
 				self.__conf["socket"] = opt[1]
+			elif opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
 			elif opt[0] == "-d":
 				self.__conf["dump"] = True
 			elif opt[0] == "-v":
@@ -183,6 +187,7 @@ class Fail2banClient:
 					return False
 				# Start the server
 				self.__startServerAsync(self.__conf["socket"],
+										self.__conf["pidfile"],
 										self.__conf["force"])
 				try:
 					# Wait for the server to start
@@ -231,7 +236,7 @@ class Fail2banClient:
 	#
 	# Start the Fail2ban server in daemon mode.
 	
-	def __startServerAsync(self, socket, force = False):
+	def __startServerAsync(self, socket, pidfile, force = False):
 		# Forks the current process.
 		pid = os.fork()
 		if pid == 0:
@@ -242,6 +247,9 @@ class Fail2banClient:
 			# Set the socket path.
 			args.append("-s")
 			args.append(socket)
+			# Set the pidfile
+			args.append("-p")
+			args.append(pidfile)
 			# Force the execution if needed.
 			if force:
 				args.append("-x")
@@ -297,7 +305,7 @@ class Fail2banClient:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'hc:s:xdviqV'
+			cmdOpts = 'hc:s:p:xdviqV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -328,9 +336,11 @@ class Fail2banClient:
 		
 		# Set socket path
 		self.__configurator.readEarly()
-		socket = self.__configurator.getEarlyOptions()
+		conf = self.__configurator.getEarlyOptions()
 		if self.__conf["socket"] == None:
-			self.__conf["socket"] = socket["socket"]
+			self.__conf["socket"] = conf["socket"]
+		if self.__conf["pidfile"] == None:
+			self.__conf["pidfile"] = conf["pidfile"]
 		logSys.info("Using socket file " + self.__conf["socket"])
 
 		if self.__conf["dump"]:
diff --git a/fail2ban-server b/fail2ban-server
index 0f3410c9..81db58bd 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -54,6 +54,7 @@ class Fail2banServer:
 		self.__conf["background"] = True
 		self.__conf["force"] = False
 		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
+		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
 	
 	def dispVersion(self):
 		print "Fail2Ban v" + version
@@ -81,6 +82,7 @@ class Fail2banServer:
 		print "    -b                   start in background"
 		print "    -f                   start in foreground"
 		print "    -s <FILE>            socket path"
+		print "    -p <FILE>            pidfile path"
 		print "    -x                   force execution of the server (remove socket file)"
 		print "    -h, --help           display this help message"
 		print "    -V, --version        print the version"
@@ -97,6 +99,8 @@ class Fail2banServer:
 				self.__conf["background"] = False
 			if opt[0] == "-s":
 				self.__conf["socket"] = opt[1]
+			if opt[0] == "-p":
+				self.__conf["pidfile"] = opt[1]
 			if opt[0] == "-x":
 				self.__conf["force"] = True
 			if opt[0] in ["-h", "--help"]:
@@ -112,7 +116,7 @@ class Fail2banServer:
 		
 		# Reads the command line options.
 		try:
-			cmdOpts = 'bfs:xhV'
+			cmdOpts = 'bfs:p:xhV'
 			cmdLongOpts = ['help', 'version']
 			optList, args = getopt.getopt(self.__argv[1:], cmdOpts, cmdLongOpts)
 		except getopt.GetoptError:
@@ -123,7 +127,9 @@ class Fail2banServer:
 		
 		try:
 			self.__server = Server(self.__conf["background"])
-			self.__server.start(self.__conf["socket"], self.__conf["force"])
+			self.__server.start(self.__conf["socket"],
+								self.__conf["pidfile"],
+								self.__conf["force"])
 			return True
 		except Exception, e:
 			logSys.exception(e)
diff --git a/server/server.py b/server/server.py
index d9532be2..3889c491 100644
--- a/server/server.py
+++ b/server/server.py
@@ -40,8 +40,6 @@ logSys = logging.getLogger("fail2ban.server")
 
 class Server:
 	
-	PID_FILE = "/var/run/fail2ban/fail2ban.pid"
-
 	def __init__(self, daemon = False):
 		self.__loggingLock = Lock()
 		self.__lock = RLock()
@@ -59,7 +57,7 @@ class Server:
 		logSys.debug("Caught signal %d. Exiting" % signum)
 		self.quit()
 	
-	def start(self, sock, force = False):
+	def start(self, sock, pidfile, force = False):
 		logSys.info("Starting Fail2ban v" + version.version)
 		
 		# Install signal handlers
@@ -79,8 +77,8 @@ class Server:
 		
 		# Creates a PID file.
 		try:
-			logSys.debug("Creating PID file %s" % Server.PID_FILE)
-			pidFile = open(Server.PID_FILE, 'w')
+			logSys.debug("Creating PID file %s" % pidfile)
+			pidFile = open(pidfile, 'w')
 			pidFile.write("%s\n" % os.getpid())
 			pidFile.close()
 		except IOError, e:
@@ -94,8 +92,8 @@ class Server:
 			logSys.error("Could not start server: %s", e)
 		# Removes the PID file.
 		try:
-			logSys.debug("Remove PID file %s" % Server.PID_FILE)
-			os.remove(Server.PID_FILE)
+			logSys.debug("Remove PID file %s" % pidfile)
+			os.remove(pidfile)
 		except OSError, e:
 			logSys.error("Unable to remove PID file: %s" % e)
 		logSys.info("Exiting Fail2ban")

From 2312b1d950826bebcedc0fef937afa9fb76f0602 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 17 Feb 2013 17:19:09 -0500
Subject: [PATCH 073/544] ENH: made log messages while parsing files more
 informative + test for inaccessible file (Closes: gh-24)

---
 client/configreader.py            |  4 ++--
 testcases/clientreadertestcase.py | 14 +++++++++++---
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/client/configreader.py b/client/configreader.py
index 79c5b47b..e1a2b69f 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -56,7 +56,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 	
 	def read(self, filename):
 		basename = os.path.join(self._basedir, filename)
-		logSys.debug("Reading " + basename)
+		logSys.debug("Reading configs for %s under %s "  % (basename, self._basedir))
 		config_files = [ basename + ".conf",
 						 basename + ".local" ]
 
@@ -88,7 +88,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 			return True
 		else:
 			logSys.error("Found no accessible config files for %r " % filename
-						 + (["",
+						 + (["under %s" % self.getBaseDir(),
 							 "among existing ones: " + ', '.join(config_files)][bool(len(config_files))]))
 
 			return False
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 55fb010d..389220ee 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -39,7 +39,6 @@ class ConfigReaderTest(unittest.TestCase):
 		self.d = tempfile.mkdtemp(prefix="f2b-temp")
 		self.c = ConfigReader(basedir=self.d)
 
-
 	def tearDown(self):
 		"""Call after every test case."""
 		shutil.rmtree(self.d)
@@ -61,10 +60,19 @@ option = %s
 		self.assertTrue(self.c.read('c'))	# we still should have some
 
 
-	def _getoption(self):
-		self.assertTrue(self.c.read('c'))	# we got some now
+	def _getoption(self, f='c'):
+		self.assertTrue(self.c.read(f))	# we got some now
 		return self.c.getOptions('section', [("int", 'option')])['option']
 
+
+	def testInaccessibleFile(self):
+		f = os.path.join(self.d, "d.conf")  # inaccessible file
+		self._write('d.conf', 0)
+		self.assertEqual(self._getoption('d'), 0)
+		os.chmod(f, 0)
+		self.assertFalse(self.c.read('d'))	# should not be readable BUT present
+
+
 	def testOptionalDotDDir(self):
 		self.assertFalse(self.c.read('c'))	# nothing is there yet
 		self._write("c.conf", "1")

From ec3080cba599832506723f1492de1150d19d2ca5 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 17 Feb 2013 17:21:03 -0500
Subject: [PATCH 074/544] Reincarnated removed (by mistake) test for
 SplitAction

---
 testcases/clientreadertestcase.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 389220ee..d581a81f 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -109,6 +109,11 @@ class JailReaderTest(unittest.TestCase):
 		self.assertFalse(jail.isEnabled())
 		self.assertEqual(jail.getName(), 'ssh-iptables')
 
+	def testSplitAction(self):
+		action = "mail-whois[name=SSH]"
+		expected = ['mail-whois', {'name': 'SSH'}]
+		result = JailReader.splitAction(action)
+		self.assertEquals(expected, result)
 
 class JailsReaderTest(unittest.TestCase):
 

From 294f073741dbfa49f43a9114322bb113f433eb47 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 17 Feb 2013 22:42:24 +0000
Subject: [PATCH 075/544] Typo in default pidfile in fail2ban.conf

---
 config/fail2ban.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index e759513b..1888eddb 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -43,7 +43,7 @@ socket = /var/run/fail2ban/fail2ban.sock
 # Option: pidfile
 # Notes.: Set the PID file. This is used to store the process ID of the
 #         fail2ban server.
-# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
+# Values: FILE  Default:  /var/run/fail2ban/fail2ban.pid
 #
 pidfile = /var/run/fail2ban/fail2ban.pid
 

From 40c5a2d996ac16f0690c2a8b8f0b95979277d4ee Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 18 Feb 2013 23:08:44 -0500
Subject: [PATCH 076/544] ENH: adding more of diagnostic messages into -client
 while starting the daemon

---
 fail2ban-client | 37 +++++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 595144ef..7ee4a47c 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -134,11 +134,11 @@ class Fail2banClient:
 			elif opt[0] == "-i":
 				self.__conf["interactive"] = True
 			elif opt[0] in ["-h", "--help"]:
-	 			self.dispUsage()
-	 			sys.exit(0)
-	 		elif opt[0] in ["-V", "--version"]:
-	 			self.dispVersion()
-	 			sys.exit(0)
+				self.dispUsage()
+				sys.exit(0)
+			elif opt[0] in ["-V", "--version"]:
+				self.dispVersion()
+				sys.exit(0)
 	
 	def __ping(self):
 		return self.__processCmd([["ping"]], False)
@@ -185,6 +185,18 @@ class Fail2banClient:
 				# Do not continue if configuration is not 100% valid
 				if not ret:
 					return False
+				# verify that directory for the socket file exists
+				socket_dir = os.path.dirname(self.__conf["socket"])
+				if not os.path.exists(socket_dir):
+					logSys.error(
+						"There is no directory %s to contain the socket file %s."
+						% (socket_dir, self.__conf["socket"]))
+					return False
+				if not os.access(socket_dir, os.W_OK | os.X_OK):
+					logSys.error(
+						"Directory %s exists but not accessible for writing"
+						% (socket_dir,))
+					return False
 				# Start the server
 				self.__startServerAsync(self.__conf["socket"],
 										self.__conf["pidfile"],
@@ -196,10 +208,10 @@ class Fail2banClient:
 					self.__processCmd(self.__stream, False)
 					return True
 				except ServerExecutionException:
-					logSys.error("Could not start server. Maybe an old " +
-								 "socket file is still present. Try to " +
-								 "remove " + self.__conf["socket"] + ". If " +
-								 "you used fail2ban-client to start the " +
+					logSys.error("Could not start server. Maybe an old "
+								 "socket file is still present. Try to "
+								 "remove " + self.__conf["socket"] + ". If "
+								 "you used fail2ban-client to start the "
 								 "server, adding the -x option will do it")
 					return False
 		elif len(cmd) == 1 and cmd[0] == "reload":
@@ -256,16 +268,17 @@ class Fail2banClient:
 			try:
 				# Use the current directory.
 				exe = os.path.abspath(os.path.join(sys.path[0], self.SERVER))
+				logSys.debug("Starting %r with args %r" % (exe, args))
 				os.execv(exe, args)
 			except OSError:
 				try:
 					# Use the PATH env.
+					logSys.warning("Initial start attempt failed.  Starting %r with the same args" % (self.SERVER,))
 					os.execvp(self.SERVER, args)
 				except OSError:
-					print "Could not find %s" % self.SERVER
+					logSys.error("Could not start %s" % self.SERVER)
 					os.exit(-1)
-						
-			
+	
 	def __waitOnServer(self):
 		# Wait for the server to start
 		cnt = 0

From 088e40c48192caed3a0c415e09211cd08c7c85d0 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Wed, 20 Feb 2013 23:14:42 +0000
Subject: [PATCH 077/544] Rewrite and enable server testcase for Transmitter

---
 fail2ban-testcases          |   2 +-
 testcases/servertestcase.py | 449 ++++++++++++++++++++++++++++++------
 2 files changed, 381 insertions(+), 70 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 99fefd57..d2bbfed1 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -124,7 +124,7 @@ else:
 
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
-#tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
 tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
 # FailManager
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 54eac444..47d4ef0b 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -27,7 +27,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest, socket, time
+import unittest, socket, time, tempfile, os
 from server.server import Server
 
 class StartStop(unittest.TestCase):
@@ -55,76 +55,387 @@ class Transmitter(unittest.TestCase):
 	def setUp(self):
 		"""Call before every test case."""
 		self.__server = Server()
+		self.__transm = self.__server._Server__transm
+		self.__server.setLogTarget("/dev/null")
 		self.__server.setLogLevel(0)
-		self.__server.start(False)
+		sock_fd, sock_name = tempfile.mkstemp('fail2ban.sock', 'transmitter')
+		os.close(sock_fd)
+		pidfile_fd, pidfile_name = tempfile.mkstemp(
+			'fail2ban.pid', 'transmitter')
+		os.close(pidfile_fd)
+		self.__server.start(sock_name, pidfile_name, force=False)
+		self.jailName = "TestJail1"
+		self.__server.addJail(self.jailName, "auto")
 
 	def tearDown(self):
 		"""Call after every test case."""
 		self.__server.quit()
-	
-	def testSetActionOK(self):
-		name = "TestCase"
-		cmdList = [["add", name],
-				   ["set", name, "actionstart", "Action Start"],
-				   ["set", name, "actionstop", "Action Stop"],
-				   ["set", name, "actioncheck", "Action Check"],
-				   ["set", name, "actionban", "Action Ban"],
-				   ["set", name, "actionunban", "Action Unban"],
-				   ["quit"]]
-		
-		outList = [(0, name),
-				   (0, 'Action Start'),
-				   (0, 'Action Stop'),
-				   (0, 'Action Check'),
-				   (0, 'Action Ban'),
-				   (0, 'Action Unban'),
-				   (0, None)]
-		
-		cnt = 0
-		for cmd in cmdList:
-			self.assertEqual(self.__server.transm.proceed(cmd), outList[cnt])
-			cnt += 1
-	
-	def testSetActionNOK(self):
-		name = "TestCase"
-		cmdList = [["addd", name],
-				   ["set", name, "test"],
-				   ["prout prout", "Stop"],
-				   ["fail2ban", "sucks"],
-				   ["set"],
-				   ["_/&%", "@*+%&"],
-				   [" quit"]]
-		
-		outList = [1,
-				   1,
-				   1,
-				   1,
-				   1,
-				   1,
-				   1]
-		
-		cnt = 0
-		for cmd in cmdList:
-			msg = self.__server.transm.proceed(cmd)
-			self.assertEqual(msg[0], outList[cnt])
-			cnt += 1
-	
-	def testJail(self):
-		name = "TestCase"
-		cmdList = [["add", name],
-				   ["set", name, "logpath", "testcases/files/testcase01.log"],
-				   ["set", name, "timeregex", "\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}"],
-				   ["set", name, "timepattern", "%b %d %H:%M:%S"],
-				   ["set", name, "failregex", "Authentication failure"],
-				   ["start", name],
-				   ["stop", name],
-				   ["quit"]]
-				  
-		for cmd in cmdList:
-			self.__server.transm.proceed(cmd)
-			if cmd == ["start", name]:
-				time.sleep(2)
-				jail = self.__server.jails[name]
-				self.assertEqual(jail.getFilter().failManager.size(), 0)
-				self.assertEqual(jail.getAction().banManager.size(), 2)
-		
+
+	def setGetTest(self, cmd, inValue, outValue=None, jail=None):
+		setCmd = ["set", cmd, inValue]
+		getCmd = ["get", cmd]
+		if jail is not None:
+			setCmd.insert(1, jail)
+			getCmd.insert(1, jail)
+		if outValue is None:
+			outValue = inValue
+
+		self.assertEqual(self.__transm.proceed(setCmd), (0, outValue))
+		self.assertEqual(self.__transm.proceed(getCmd), (0, outValue))
+
+	def setGetTestNOK(self, cmd, inValue, jail=None):
+		setCmd = ["set", cmd, inValue]
+		getCmd = ["get", cmd]
+		if jail is not None:
+			setCmd.insert(1, jail)
+			getCmd.insert(1, jail)
+
+		# Get initial value before trying invalid value
+		initValue = self.__transm.proceed(getCmd)[1]
+		self.assertEqual(self.__transm.proceed(setCmd)[0], 1)
+		# Check after failed set that value is same as previous
+		self.assertEqual(self.__transm.proceed(getCmd), (0, initValue))
+
+	def jailAddDelTest(self, cmd, values, jail):
+		cmdAdd = "add" + cmd
+		cmdDel = "del" + cmd
+
+		self.assertEqual(
+			self.__transm.proceed(["get", jail, cmd]), (0, []))
+		for n, value in enumerate(values):
+			self.assertEqual(
+				self.__transm.proceed(["set", jail, cmdAdd, value]),
+				(0, values[:n+1]))
+			self.assertEqual(
+				self.__transm.proceed(["get", jail, cmd]),
+				(0, values[:n+1]))
+		for n, value in enumerate(values):
+			self.assertEqual(
+				self.__transm.proceed(["set", jail, cmdDel, value]),
+				(0, values[n+1:]))
+			self.assertEqual(
+				self.__transm.proceed(["get", jail, cmd]),
+				(0, values[n+1:]))
+
+	def jailAddDelRegexTest(self, cmd, inValues, outValues, jail):
+		cmdAdd = "add" + cmd
+		cmdDel = "del" + cmd
+
+		if outValues is None:
+			outValues = inValues
+
+		self.assertEqual(
+			self.__transm.proceed(["get", jail, cmd]), (0, []))
+		for n, value in enumerate(inValues):
+			self.assertEqual(
+				self.__transm.proceed(["set", jail, cmdAdd, value]),
+				(0, outValues[:n+1]))
+			self.assertEqual(
+				self.__transm.proceed(["get", jail, cmd]),
+				(0, outValues[:n+1]))
+		for n, value in enumerate(inValues):
+			self.assertEqual(
+				self.__transm.proceed(["set", jail, cmdDel, 0]), # First item
+				(0, outValues[n+1:]))
+			self.assertEqual(
+				self.__transm.proceed(["get", jail, cmd]),
+				(0, outValues[n+1:]))
+
+	def testPing(self):
+		self.assertEqual(self.__transm.proceed(["ping"]), (0, "pong"))
+
+	def testSleep(self):
+		t0 = time.time()
+		self.assertEqual(self.__transm.proceed(["sleep", "1"]), (0, None))
+		t1 = time.time()
+		# Approx 1 second delay
+		self.assertAlmostEqual(t1 - t0, 1, places=2)
+
+	def testLogTarget(self):
+		logTargets = []
+		for _ in xrange(3):
+			tmpFile = tempfile.mkstemp("fail2ban", "transmitter")
+			logTargets.append(tmpFile[1])
+			os.close(tmpFile[0])
+		for logTarget in logTargets:
+			self.setGetTest("logtarget", logTarget)
+
+		# If path is invalid, do not change logtarget
+		value = "/this/path/should/not/exist"
+		self.assertEqual(
+			self.__transm.proceed(["set", "logtarget", value]),
+			(0, logTarget)) #NOTE: Shouldn't this return 1
+		self.assertEqual(
+			self.__transm.proceed(["get", "logtarget"]), (0, logTargets[-1]))
+
+		self.__transm.proceed(["set", "/dev/null"])
+		for logTarget in logTargets:
+			os.remove(logTarget)
+
+	def testLogLevel(self):
+		self.setGetTest("loglevel", "4", 4)
+		self.setGetTest("loglevel", "2", 2)
+		self.setGetTest("loglevel", "-1", -1)
+		self.setGetTestNOK("loglevel", "Bird")
+
+	def testAddJail(self):
+		jail2 = "TestJail2"
+		jail3 = "TestJail3"
+		jail4 = "TestJail4"
+		self.assertEqual(
+			self.__transm.proceed(["add", jail2, "polling"]), (0, jail2))
+		self.assertEqual(self.__transm.proceed(["add", jail3]), (0, jail3))
+		self.assertEqual(
+			self.__transm.proceed(["add", jail4, "invalid backend"])[0], 1)
+		self.assertEqual(
+			self.__transm.proceed(["add", jail4, "auto"]), (0, jail4))
+		# Duplicate Jail
+		self.assertEqual(
+			self.__transm.proceed(["add", self.jailName, "polling"])[0], 1)
+		# All name is reserved
+		self.assertEqual(
+			self.__transm.proceed(["add", "all", "polling"])[0], 1)
+
+	def testJailIdle(self):
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "idle", "on"]),
+			(0, True))
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "idle", "off"]),
+			(0, False))
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "idle", "CAT"])[0],
+			0) #NOTE: Should this return 1
+
+	def testJailFindTime(self):
+		self.setGetTest("findtime", "120", 120, jail=self.jailName)
+		self.setGetTest("findtime", "60", 60, jail=self.jailName)
+		self.setGetTest("findtime", "-60", -60, jail=self.jailName)
+		self.setGetTestNOK("findtime", "Dog", jail=self.jailName)
+
+	def testJailBanTime(self):
+		self.setGetTest("bantime", "600", 600, jail=self.jailName)
+		self.setGetTest("bantime", "50", 50, jail=self.jailName)
+		self.setGetTest("bantime", "-50", -50, jail=self.jailName)
+		self.setGetTestNOK("bantime", "Cat", jail=self.jailName)
+
+	def testJailUseDNS(self):
+		self.setGetTest("usedns", "yes", jail=self.jailName)
+		self.setGetTest("usedns", "warn", jail=self.jailName)
+		self.setGetTest("usedns", "no", jail=self.jailName)
+
+		# Safe default should be "no"
+		value = "Fish"
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "usedns", value]),
+			(0, "no"))
+
+	def testJailBanIP(self):
+		self.__server.startJail(self.jailName) # Jail must be started
+
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "banip", "127.0.0.1"]),
+			(0, "127.0.0.1"))
+		time.sleep(1) # Give chance to ban
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "banip", "Badger"]),
+			(0, "Badger")) #NOTE: Is IP address validated? Is DNS Lookup done?
+		time.sleep(1) # Give chance to ban
+		# Unban IP
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "unbanip", "127.0.0.1"]),
+			(0, "127.0.0.1"))
+		# Unban IP which isn't banned
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "unbanip", "192.168.1.1"]),
+			(0, "None")) #NOTE: Should this return 1?
+
+	def testJailMaxRetry(self):
+		self.setGetTest("maxretry", "5", 5, jail=self.jailName)
+		self.setGetTest("maxretry", "2", 2, jail=self.jailName)
+		self.setGetTest("maxretry", "-2", -2, jail=self.jailName)
+		self.setGetTestNOK("maxretry", "Duck", jail=self.jailName)
+
+	def testJailLogPath(self):
+		self.jailAddDelTest(
+			"logpath",
+			[
+				"testcases/files/testcase01.log",
+				"testcases/files/testcase02.log",
+				"testcases/files/testcase03.log",
+			],
+			self.jailName
+		)
+		# Try duplicates
+		value = "testcases/files/testcase04.log"
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "addlogpath", value]),
+			(0, [value]))
+		# Will silently ignore duplicate
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "addlogpath", value]),
+			(0, [value]))
+		self.assertEqual(
+			self.__transm.proceed(["get", self.jailName, "logpath"]),
+			(0, [value]))
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "dellogpath", value]),
+			(0, []))
+
+		# Invalid file
+		value = "this_file_shouldn't_exist"
+		result = self.__transm.proceed(
+			["set", self.jailName, "addlogpath", value])
+		self.assertTrue(isinstance(result[1], IOError))
+
+	def testJailIgnoreIP(self):
+		self.jailAddDelTest(
+			"ignoreip",
+			[
+				"127.0.0.1",
+				"192.168.1.1",
+				"8.8.8.8",
+			],
+			self.jailName
+		)
+
+		# Try duplicates
+		value = "127.0.0.1"
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "addignoreip", value]),
+			(0, [value]))
+		# Will allow duplicate
+		#NOTE: Should duplicates be allowed, or silent ignore like logpath?
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "addignoreip", value]),
+			(0, [value, value]))
+		self.assertEqual(
+			self.__transm.proceed(["get", self.jailName, "ignoreip"]),
+			(0, [value, value]))
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "delignoreip", value]),
+			(0, [value]))
+
+	def testJailRegex(self):
+		self.jailAddDelRegexTest("failregex",
+			[
+				"user john at <HOST>",
+				"Admin user login from <HOST>",
+				"failed attempt from <HOST> again",
+			],
+			[
+				"user john at (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)",
+				"Admin user login from (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)",
+				"failed attempt from (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) again",
+			],
+			self.jailName
+		)
+
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "addfailregex", "No host regex"]),
+			(0, [])) #NOTE: Shouldn't this return 1?
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "addfailregex", 654])[0],
+			1)
+
+	def testJailIgnoreRegex(self):
+		self.jailAddDelRegexTest("ignoreregex",
+			[
+				"user john",
+				"Admin user login from <HOST>",
+				"Dont match me!",
+			],
+			[
+				"user john",
+				"Admin user login from (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)",
+				"Dont match me!",
+			],
+			self.jailName
+		)
+
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "addignoreregex", 50])[0],
+			1)
+
+	def testStatus(self):
+		jails = [self.jailName]
+		self.assertEqual(self.__transm.proceed(["status"]),
+			(0, [('Number of jail', len(jails)), ('Jail list', ", ".join(jails))]))
+		self.__server.addJail("TestJail2", "auto")
+		jails.append("TestJail2")
+		self.assertEqual(self.__transm.proceed(["status"]),
+			(0, [('Number of jail', len(jails)), ('Jail list', ", ".join(jails))]))
+
+	def testJailStatus(self):
+		self.assertEqual(self.__transm.proceed(["status", self.jailName]),
+			(0,
+				[
+					('filter', [
+						('Currently failed', 0),
+						('Total failed', 0),
+						('File list', [])]
+					),
+					('action', [
+						('Currently banned', 0),
+						('Total banned', 0),
+						('IP list', [])]
+					)
+				]
+			)
+		)
+
+	def testAction(self):
+		action = "TestCaseAction"
+		cmdList = [
+			"actionstart",
+			"actionstop",
+			"actioncheck",
+			"actionban",
+			"actionunban",
+		]
+		cmdValueList = [
+			"Action Start",
+			"Action Stop",
+			"Action Check",
+			"Action Ban",
+			"Action Unban",
+		]
+
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "addaction", action]),
+			(0, action))
+		for cmd, value in zip(cmdList, cmdValueList):
+			self.assertEqual(
+				self.__transm.proceed(
+					["set", self.jailName, cmd, action, value]),
+				(0, value))
+		for cmd, value in zip(cmdList, cmdValueList):
+			self.assertEqual(
+				self.__transm.proceed(["get", self.jailName, cmd, action]),
+				(0, value))
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "setcinfo", action, "KEY", "VALUE"]),
+			(0, "VALUE"))
+		#TODO: Implement below in server.transmitter?
+		"""
+		self.assertEqual(
+			self.__transm.proceed(
+				["get", self.jailName, "cinfo", action, "KEY"]),
+			(0, "VALUE"))
+		"""
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "delcinfo", action, "KEY"]),
+			(0, None))
+		#FIXME: This is broken in server.transmitter (value not defined)
+		"""
+		self.assertEqual(
+			self.__transm.proceed(["set", self.jailName, "delaction", action]),
+			(0, None))
+		"""

From b6a68f5138c12e5f1374d76ac76f8f43bc814bfc Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Wed, 20 Feb 2013 23:24:46 +0000
Subject: [PATCH 078/544] Fix for missing value in transmitter delaction

---
 server/transmitter.py       | 1 +
 testcases/servertestcase.py | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/server/transmitter.py b/server/transmitter.py
index 23b609a1..3bd7fb14 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -183,6 +183,7 @@ class Transmitter:
 			self.__server.addAction(name, value)
 			return self.__server.getLastAction(name).getName()
 		elif command[1] == "delaction":
+			value = command[2]
 			self.__server.delAction(name, value)
 			return None
 		elif command[1] == "setcinfo":
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 47d4ef0b..0b33a96f 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -433,9 +433,10 @@ class Transmitter(unittest.TestCase):
 			self.__transm.proceed(
 				["set", self.jailName, "delcinfo", action, "KEY"]),
 			(0, None))
-		#FIXME: This is broken in server.transmitter (value not defined)
-		"""
 		self.assertEqual(
 			self.__transm.proceed(["set", self.jailName, "delaction", action]),
 			(0, None))
-		"""
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "delaction", "Doesn't exist"]),
+			(0, None)) #NOTE: Should this return 1?

From b36835f6f061efded70c747539a1da2d66b9d270 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Wed, 20 Feb 2013 23:33:39 +0000
Subject: [PATCH 079/544] Added transmitter get cinfo option for action

---
 common/protocol.py          | 1 +
 server/transmitter.py       | 4 ++++
 testcases/servertestcase.py | 7 ++++---
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/common/protocol.py b/common/protocol.py
index 2f8ffa6c..99a2fe09 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -90,6 +90,7 @@ protocol = [
 ["get <JAIL> actioncheck <ACT>", "gets the check command for the action <ACT> for <JAIL>"],
 ["get <JAIL> actionban <ACT>", "gets the ban command for the action <ACT> for <JAIL>"],
 ["get <JAIL> actionunban <ACT>", "gets the unban command for the action <ACT> for <JAIL>"],
+["get <JAIL> cinfo <ACT> <KEY>", "gets the value for <KEY> for the action <ACT> for <JAIL>"],
 ]
 
 ##
diff --git a/server/transmitter.py b/server/transmitter.py
index 3bd7fb14..a02b94a2 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -266,6 +266,10 @@ class Transmitter:
 		elif command[1] == "actionunban":
 			act = command[2]
 			return self.__server.getActionUnban(name, act)
+		elif command[1] == "cinfo":
+			act = command[2]
+			key = command[3]
+			return self.__server.getCInfo(name, act, key)
 		raise Exception("Invalid command (no get action or not yet implemented)")
 	
 	def status(self, command):
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 0b33a96f..00f56b81 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -422,13 +422,14 @@ class Transmitter(unittest.TestCase):
 			self.__transm.proceed(
 				["set", self.jailName, "setcinfo", action, "KEY", "VALUE"]),
 			(0, "VALUE"))
-		#TODO: Implement below in server.transmitter?
-		"""
 		self.assertEqual(
 			self.__transm.proceed(
 				["get", self.jailName, "cinfo", action, "KEY"]),
 			(0, "VALUE"))
-		"""
+		self.assertEqual(
+			self.__transm.proceed(
+				["get", self.jailName, "cinfo", action, "InvalidKey"])[0],
+			1)
 		self.assertEqual(
 			self.__transm.proceed(
 				["set", self.jailName, "delcinfo", action, "KEY"]),

From 012264dce169b8ae9a18a599371bcb9685ec3570 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 21 Feb 2013 20:58:27 -0500
Subject: [PATCH 080/544] BF: safeguard closing of log handlers + close in
 reverse order

otherwise there might be "stuck" handler in the queue. and closing
exceptions can occur -- even stock logging guards in recent versions
---
 server/server.py | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/server/server.py b/server/server.py
index 3889c491..dea303db 100644
--- a/server/server.py
+++ b/server/server.py
@@ -367,11 +367,20 @@ class Server:
 					logSys.error("Unable to log to " + target)
 					logSys.info("Logging to previous target " + self.__logTarget)
 					return False
-			# Removes previous handlers
-			for handler in logging.getLogger("fail2ban").handlers:
-				# Closes the handler.
+			# Removes previous handlers -- in reverse order since removeHandler
+			# alter the list in-place and that can confuses the iterable
+			for handler in logging.getLogger("fail2ban").handlers[::-1]:
+				# Remove the handler.
 				logging.getLogger("fail2ban").removeHandler(handler)
-				handler.close()
+				# And try to close -- it might be closed already
+				try:
+					handler.flush()
+					handler.close()
+				except ValueError:
+					if sys.version_info >= (2,6):
+						raise
+					# is known to be thrown after logging was shutdown once
+					# with older Pythons -- seems to be safe to ignore there
 			# tell the handler to use this format
 			hdlr.setFormatter(formatter)
 			logging.getLogger("fail2ban").addHandler(hdlr)

From 154aa38e3f8174baee6593c3022c53f25b8aa364 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 21 Feb 2013 20:59:46 -0500
Subject: [PATCH 081/544] BF: do not shutdown logging until all jails stop --
 so move into Server.quit()

Together with previous commit it should resolve failures with the server tests on python < 2.6
---
 server/server.py | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/server/server.py b/server/server.py
index dea303db..0e1b6c97 100644
--- a/server/server.py
+++ b/server/server.py
@@ -97,12 +97,6 @@ class Server:
 		except OSError, e:
 			logSys.error("Unable to remove PID file: %s" % e)
 		logSys.info("Exiting Fail2ban")
-		# Shutdowns the logging.
-		try:
-			self.__loggingLock.acquire()
-			logging.shutdown()
-		finally:
-			self.__loggingLock.release()
 	
 	def quit(self):
 		# Stop communication first because if jail's unban action
@@ -112,8 +106,17 @@ class Server:
 		# are exiting)
 		# See https://github.com/fail2ban/fail2ban/issues/7
 		self.__asyncServer.stop()
+
 		# Now stop all the jails
 		self.stopAllJail()
+
+		# Only now shutdown the logging.
+		try:
+			self.__loggingLock.acquire()
+			logging.shutdown()
+		finally:
+			self.__loggingLock.release()
+
 	
 	def addJail(self, name, backend):
 		self.__jails.add(name, backend)

From 59c35bc44a175a672e084bc30511dfa3436ff052 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 1 Mar 2013 19:57:56 -0500
Subject: [PATCH 082/544] Downgrade log rotation detection message to DEBUG
 level from INFO. Closes: gh-129

This message useful only when debugging problems so it is more reasonable
to have it suppressed otherwise
---
 server/filter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/filter.py b/server/filter.py
index fb79fcbe..5b2b85e0 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -550,7 +550,7 @@ class FileContainer:
 		stats = os.fstat(self.__handler.fileno())
 		# Compare hash and inode
 		if self.__hash != myHash or self.__ino != stats.st_ino:
-			logSys.info("Log rotation detected for %s" % self.__filename)
+			logSys.debug("Log rotation detected for %s" % self.__filename)
 			self.__hash = myHash
 			self.__ino = stats.st_ino
 			self.__pos = 0

From d17b415371d14f00c9b24fc3672733b6666fe345 Mon Sep 17 00:00:00 2001
From: sebres <info@sebres.de>
Date: Tue, 5 Mar 2013 00:02:39 +0100
Subject: [PATCH 083/544] invalid date recognition, irregular because of
 sorting template list (sometimes not reproducible by fail2ban-regex, cause
 will be not sorted)

date in following log line (from nginx) will be wrong detected:
2012/10/11 02:37:17 [error] 18434#0: *947 user "test" was not found in "/www/...", client: 192.168.1.5, ...

sometimes it is [correct] - 2012/10/11 (%Y/%m/%d) = 1349919861.71
sometimes it is [invalid] -   12/10/11 (%d/%m/%y) = 1349915838.06
and older as now - 1800 seconds (therefore will be not found)

solution: regular expression fixed, cause date in log used always after non symbol (\W) character, so r"\d{2}/\d{2}/\d{2}" will be r"(?<!\w)\d{2}/\d{2}/\d{2}".
---
 server/datedetector.py | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index c013d551..6e484449 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -55,80 +55,80 @@ class DateDetector:
 			# standard
 			template = DateStrptime()
 			template.setName("MONTH Day Hour:Minute:Second")
-			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%b %d %H:%M:%S")
 			self._appendTemplate(template)
 			# asctime
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second Year")
-			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
+			template.setRegex("(?<!\w)\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
 			template.setPattern("%a %b %d %H:%M:%S %Y")
 			self._appendTemplate(template)
 			# asctime without year
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second")
-			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%a %b %d %H:%M:%S")
 			self._appendTemplate(template)
 			# simple date
 			template = DateStrptime()
 			template.setName("Year/Month/Day Hour:Minute:Second")
-			template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y/%m/%d %H:%M:%S")
 			self._appendTemplate(template)
 			# simple date too (from x11vnc)
 			template = DateStrptime()
 			template.setName("Day/Month/Year Hour:Minute:Second")
-			template.setRegex("\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# previous one but with year given by 2 digits
 			# (See http://bugs.debian.org/537610)
 			template = DateStrptime()
 			template.setName("Day/Month/Year2 Hour:Minute:Second")
-			template.setRegex("\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%y %H:%M:%S")
 			self._appendTemplate(template)
 			# Apache format [31/Oct/2006:09:22:55 -0000]
 			template = DateStrptime()
 			template.setName("Day/MONTH/Year:Hour:Minute:Second")
-			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%b/%Y:%H:%M:%S")
 			self._appendTemplate(template)
 			# CPanel 05/20/2008:01:57:39
 			template = DateStrptime()
 			template.setName("Month/Day/Year:Hour:Minute:Second")
-			template.setRegex("\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%m/%d/%Y:%H:%M:%S")
 			self._appendTemplate(template)
 			# Exim 2006-12-21 06:43:20
 			template = DateStrptime()
 			template.setName("Year-Month-Day Hour:Minute:Second")
-			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
 			self._appendTemplate(template)
 			# custom for syslog-ng 2006.12.21 06:43:20
 			template = DateStrptime()
 			template.setName("Year.Month.Day Hour:Minute:Second")
-			template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y.%m.%d %H:%M:%S")
 			self._appendTemplate(template)
 			# named 26-Jul-2007 15:20:52.252 
 			template = DateStrptime()
 			template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]")
-			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d-%b-%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# 17-07-2008 17:23:25
 			template = DateStrptime()
 			template.setName("Day-Month-Year Hour:Minute:Second")
-			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d-%m-%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# 01-27-2012 16:22:44.252
 			template = DateStrptime()
 			template.setName("Month-Day-Year Hour:Minute:Second[.Millisecond]")
-			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("(?<!\w)\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%m-%d-%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# TAI64N

From 6e774275161712e80fa99708395958239cd1bbd6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 7 Mar 2013 13:03:49 -0500
Subject: [PATCH 084/544] refresh generated manpages (since 0.8.2 state)

---
 man/fail2ban-client.1 | 39 +++++++++++++++++++++++++--------------
 man/fail2ban-regex.1  | 13 ++++++++-----
 man/fail2ban-server.1 | 13 ++++++++-----
 3 files changed, 41 insertions(+), 24 deletions(-)

diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 1bbddf09..431e690f 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-CLIENT "1" "March 2008" "fail2ban-client v0.8.2" "User Commands"
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
+.TH FAIL2BAN-CLIENT "1" "March 2013" "fail2ban-client v0.8.8" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR] \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.8.2 reads log file that contains password failure report
+Fail2Ban v0.8.8 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -16,6 +16,9 @@ configuration directory
 \fB\-s\fR <FILE>
 socket path
 .TP
+\fB\-p\fR <FILE>
+pidfile path
+.TP
 \fB\-d\fR
 dump configuration. For debugging
 .TP
@@ -110,7 +113,7 @@ adds <FILE> to the monitoring list
 of <JAIL>
 .TP
 \fBset <JAIL> dellogpath <FILE>\fR
-removes <FILE> to the monitoring
+removes <FILE> from the monitoring
 list of <JAIL>
 .TP
 \fBset <JAIL> addfailregex <REGEX>\fR
@@ -140,6 +143,15 @@ back for <JAIL>
 sets the number of seconds <TIME>
 a host will be banned for <JAIL>
 .TP
+\fBset <JAIL> usedns <VALUE>\fR
+sets the usedns mode for <JAIL>
+.TP
+\fBset <JAIL> banip <IP>\fR
+manually Ban <IP> for <JAIL>
+.TP
+\fBset <JAIL> unbanip <IP>\fR
+manually Unban <IP> in <JAIL>
+.TP
 \fBset <JAIL> maxretry <RETRY>\fR
 sets the number of failures
 <RETRY> before banning the host
@@ -191,14 +203,6 @@ files for <JAIL>
 gets the list of ignored IP
 addresses for <JAIL>
 .TP
-\fBget <JAIL> timeregex\fR
-gets the regular expression used
-for the time detection for <JAIL>
-.TP
-\fBget <JAIL> timepattern\fR
-gets the pattern used for the time
-detection for <JAIL>
-.TP
 \fBget <JAIL> failregex\fR
 gets the list of regular
 expressions which matches the
@@ -218,6 +222,9 @@ will look back for failures for
 gets the time a host is banned for
 <JAIL>
 .TP
+\fBget <JAIL> usedns\fR
+gets the usedns setting for <JAIL>
+.TP
 \fBget <JAIL> maxretry\fR
 gets the number of failures
 allowed for <JAIL>
@@ -245,15 +252,19 @@ action <ACT> for <JAIL>
 \fBget <JAIL> actionunban <ACT>\fR
 gets the unban command for the
 action <ACT> for <JAIL>
+.TP
+\fBget <JAIL> cinfo <ACT> <KEY>\fR
+gets the value for <KEY> for the
+action <ACT> for <JAIL>
 .SH FILES
 \fI/etc/fail2ban/*\fR
 .SH AUTHOR
 Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
 .SH "REPORTING BUGS"
-Report bugs on https://github.com/fail2ban/fail2ban/issues
+Report bugs to https://github.com/fail2ban/fail2ban/issues
 .SH COPYRIGHT
-Copyright \(co 2004-2008 Cyril Jaquier
+Copyright \(co 2004\-2008 Cyril Jaquier, 2008\- Fail2Ban Contributors
 .br
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index 0dac089d..09b9d6b0 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-REGEX "1" "March 2008" "fail2ban-regex v0.8.2" "User Commands"
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
+.TH FAIL2BAN-REGEX "1" "March 2013" "fail2ban-regex v0.8.8" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 [\fIOPTIONS\fR] \fI<LOG> <REGEX> \fR[\fIIGNOREREGEX\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.2 reads log file that contains password failure report
+Fail2Ban v0.8.8 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
@@ -17,6 +17,9 @@ display this help message
 .TP
 \fB\-V\fR, \fB\-\-version\fR
 print the version
+.TP
+\fB\-v\fR, \fB\-\-verbose\fR
+verbose output
 .SH LOG
 .TP
 \fBstring\fR
@@ -42,9 +45,9 @@ path to a filter file (filter.d/sshd.conf)
 Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
 .SH "REPORTING BUGS"
-Report bugs on https://github.com/fail2ban/fail2ban/issues
+Report bugs to https://github.com/fail2ban/fail2ban/issues
 .SH COPYRIGHT
-Copyright \(co 2004-2008 Cyril Jaquier
+Copyright \(co 2004\-2008 Cyril Jaquier
 .br
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 5f4f15b7..3f6b013f 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.36.
-.TH FAIL2BAN-SERVER "1" "March 2008" "fail2ban-server v0.8.2" "User Commands"
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
+.TH FAIL2BAN-SERVER "1" "March 2013" "fail2ban-server v0.8.8" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.2 reads log file that contains password failure report
+Fail2Ban v0.8.8 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with
@@ -23,6 +23,9 @@ start in foreground
 \fB\-s\fR <FILE>
 socket path
 .TP
+\fB\-p\fR <FILE>
+pidfile path
+.TP
 \fB\-x\fR
 force execution of the server (remove socket file)
 .TP
@@ -35,9 +38,9 @@ print the version
 Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
 Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
 .SH "REPORTING BUGS"
-Report bugs on https://github.com/fail2ban/fail2ban/issues
+Report bugs to https://github.com/fail2ban/fail2ban/issues
 .SH COPYRIGHT
-Copyright \(co 2004-2008 Cyril Jaquier
+Copyright \(co 2004\-2008 Cyril Jaquier, 2008\- Fail2Ban Contributors
 .br
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).

From 00ad4d56a775ed802588bf08efe5c0ec2d824a0f Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 15:18:09 +1100
Subject: [PATCH 085/544] FSF address changes missing from previous

---
 README             | 4 ++--
 files/cacti/README | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/README b/README
index db97aa8b..e926509e 100644
--- a/README
+++ b/README
@@ -91,5 +91,5 @@ WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 PARTICULAR PURPOSE. See the GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License along with
-Fail2Ban; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
-Suite 330, Boston, MA  02111-1307  USA
+Fail2Ban; if not, write to the Free Software Foundation, Inc., 51 Franklin
+Street, Fifth Floor, Boston, MA 02110, USA
diff --git a/files/cacti/README b/files/cacti/README
index 80c97ce9..73ceb3bd 100644
--- a/files/cacti/README
+++ b/files/cacti/README
@@ -49,5 +49,5 @@ details.
 
 You should have received a copy of the GNU General Public
 License along with Fail2Ban; if not, write to the Free
-Software Foundation, Inc., 59 Temple Place, Suite 330,
-Boston, MA  02111-1307  USA
+Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+Boston, MA 02110, USA

From 3665e6dc445bb8108b1a3f4ed18113a7729459e3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 15:18:42 +1100
Subject: [PATCH 086/544] Add development documentation and framework for code
 coverage measurement

---
 .coveragerc                 |   4 ++
 .gitignore                  |   3 +
 DEVELOP                     | 122 +++++++++++++++++++++++++++++++++---
 MANIFEST                    |   2 +
 fail2ban-client             |   2 +-
 fail2ban-testcases          |  22 +++----
 server/asyncserver.py       |   2 +-
 server/filter.py            |   8 +--
 testcases/filtertestcase.py |   6 +-
 9 files changed, 144 insertions(+), 27 deletions(-)
 create mode 100644 .coveragerc

diff --git a/.coveragerc b/.coveragerc
new file mode 100644
index 00000000..3bffd79a
--- /dev/null
+++ b/.coveragerc
@@ -0,0 +1,4 @@
+
+[run]
+branch = True
+omit = /usr*
diff --git a/.gitignore b/.gitignore
index 6a0d5e64..1e3b2ec4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
 *~
 build
+dist
 *.pyc
+htmlcov
+.coverage
diff --git a/DEVELOP b/DEVELOP
index 7a6a7b9b..bce9e64e 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -24,14 +24,96 @@ Request feature. You can find more details on the Fail2Ban wiki
 Testing
 =======
 
-Existing tests can be run by executing `fail2ban-testcases`.
+Existing tests can be run by executing `fail2ban-testcases`. This has options
+like --log-level that will probably be useful. `fail2ban-testcases --help` for
+full options.
+
+Test cases should cover all usual cases, all exception cases and all inside
+/ outside boundary conditions.
+
+Test cases should cover all branches. The coverage tool will help identify
+missing branches. Also see http://nedbatchelder.com/code/coverage/branch.html
+for more details.
+
+Install the package python-coverage to visualise your test coverage. Run the
+following:
+
+coverage run fail2ban-testcases
+coverage html
+
+Then look at htmlcov/index.html and see how much coverage your test cases
+exert over the codebase. Full coverage is a good thing however it may not be
+complete. Try to ensure tests cover as many independant paths through the
+code.
+
+Manual Execution. To run in a development environment do:
+
+./fail2ban-client -c config/ -s /tmp/f2b.sock -i start
+
+some quick commands:
+
+status
+add test pyinotify
+status test
+set test addaction iptables
+set test actionban iptables echo <ip> <cidr> >> /tmp/ban
+set test actionunban iptables echo <ip> <cidr> >> /tmp/unban
+get test actionban iptables
+get test actionunban iptables
+set test banip 192.168.2.2
+status test
+
 
-Documentation about creating tests (when tests are required and some guidelines
-for creating good tests) will be added soon.
 
 Coding Standards
-================
-Coming Soon.
+================ 
+
+Style
+-----
+
+Please use tabs for now. Keep to 80 columns, at least for readable text.
+
+Tests
+-----
+
+Add tests. They should test all the code you add in a meaning way.
+
+Coverage
+--------
+
+Test coverage should always increase as you add code.
+
+You may use "# pragma: no cover" in the code for branches of code that support
+older versions on python. For all other uses of "pragma: no cover" or
+"pragma: no branch" document the reason why its not covered. "I haven't written
+a test case" isn't a sufficient reason.
+
+Documentation
+-------------
+
+Ensure this documentation is up to date after changes. Also ensure that the man
+pages still are accurage. Ensure that there is sufficient documentation for 
+your new features to be used.
+
+Bugs
+----
+
+Remove them and don't add any more.
+
+Git
+---
+
+Use the following tags in your commit messages:
+
+'ENH:' for enhancements
+'BF:' for bug fixes
+'DOC:' for documenation fixes
+
+Adding Actions
+--------------
+
+If you add an action.d/*.conf file also add a example in config/jail.conf
+with enabled=false and maxretry=5 for ssh.
 
 
 Design
@@ -127,12 +209,14 @@ FileContainer
   .__pos
     Keeps the position pointer
 
+
+dnsutils.py
+~~~~~~~~~~~
+
 DNSUtils
 
   Utility class for DNS and IP handling
 
-  RF-Note: convert to functions within a separate submodule
-
 
 filter*.py
 ~~~~~~~~~~
@@ -156,3 +240,27 @@ action.py
 ~~~~~~~~~
 
 Takes care about executing start/check/ban/unban/stop commands
+
+
+Releasing
+=========
+
+Ensure the version is correct in ./common/version.py
+
+# update man pages
+(cd man ; ./generate-man )
+
+git commit -m 'update man pages for release' man/*
+
+python setup.py check
+python setup.py sdist
+python setup.py bdist_rpm
+python setup.py upload
+
+Run the following and update the wiki with output:
+
+python -c 'import common.protocol; common.protocol.printWiki()'
+
+email users and development list of release
+
+TODO notifing distributors etc.
diff --git a/MANIFEST b/MANIFEST
index eef145b6..bedfe560 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -3,6 +3,8 @@ ChangeLog
 TODO
 THANKS
 COPYING
+DEVELOP
+doc/run-rootless.txt
 fail2ban-client
 fail2ban-server
 fail2ban-testcases
diff --git a/fail2ban-client b/fail2ban-client
index 7ee4a47c..ed211e62 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -418,7 +418,7 @@ class Fail2banClient:
 class ServerExecutionException(Exception):
 	pass
 
-if __name__ == "__main__":
+if __name__ == "__main__": # pragma: no cover - can't test main
 	client = Fail2banClient()
 	# Exit with correct return value
 	if client.start(sys.argv):
diff --git a/fail2ban-testcases b/fail2ban-testcases
index d2bbfed1..ed341385 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -77,10 +77,10 @@ verbosity = {'debug': 3,
 			 'fatal': 0,
 			 None: 1}[opts.log_level]
 
-if opts.log_level is not None:
+if opts.log_level is not None: # pragma: no cover
 	# so we had explicit settings
 	logSys.setLevel(getattr(logging, opts.log_level.upper()))
-else:
+else: # pragma: no cover
 	# suppress the logging but it would leave unittests' progress dots
 	# ticking, unless like with '-l fatal' which would be silent
 	# unless error occurs
@@ -89,9 +89,9 @@ else:
 # Add the default logging handler
 stdout = logging.StreamHandler(sys.stdout)
 # Custom log format for the verbose tests runs
-if verbosity > 1:
+if verbosity > 1: # pragma: no cover
 	stdout.setFormatter(logging.Formatter(' %(asctime)-15s %(thread)s %(message)s'))
-else:
+else: # pragma: no cover
 	# just prefix with the space
 	stdout.setFormatter(logging.Formatter(' %(message)s'))
 logSys.addHandler(stdout)
@@ -99,7 +99,7 @@ logSys.addHandler(stdout)
 #
 # Let know the version
 #
-if not opts.log_level or opts.log_level != 'fatal':
+if not opts.log_level or opts.log_level != 'fatal': # pragma: no cover
 	print "Fail2ban %s test suite. Python %s. Please wait..." \
 	    % (version, str(sys.version).replace('\n', ''))
 
@@ -107,9 +107,9 @@ if not opts.log_level or opts.log_level != 'fatal':
 #
 # Gather the tests
 #
-if not len(regexps):
+if not len(regexps): # pragma: no cover
 	tests = unittest.TestSuite()
-else:
+else: # pragma: no cover
 	import re
 	class FilteredTestSuite(unittest.TestSuite):
 		_regexps = [re.compile(r) for r in regexps]
@@ -159,13 +159,13 @@ filters = [FilterPoll]					  # always available
 try:
 	from server.filtergamin import FilterGamin
 	filters.append(FilterGamin)
-except Exception, e:
+except Exception, e: # pragma: no cover
 	print "I: Skipping gamin backend testing. Got exception '%s'" % e
 
 try:
 	from server.filterpyinotify import FilterPyinotify
 	filters.append(FilterPyinotify)
-except Exception, e:
+except Exception, e: # pragma: no cover
 	print "I: Skipping pyinotify backend testing. Got exception '%s'" % e
 
 for Filter_ in filters:
@@ -189,7 +189,7 @@ try:
 
 	tests_results = testRunner.run(tests)
 
-finally:
+finally: # pragma: no cover
 	# Just for the sake of it reset the TZ
 	# yoh: move all this into setup/teardown methods within tests
 	os.environ.pop('TZ')
@@ -197,5 +197,5 @@ finally:
 		os.environ['TZ'] = old_TZ
 	time.tzset()
 
-if not tests_results.wasSuccessful():
+if not tests_results.wasSuccessful(): # pragma: no cover
 	sys.exit(1)
diff --git a/server/asyncserver.py b/server/asyncserver.py
index 64ec8f39..66b2b53f 100644
--- a/server/asyncserver.py
+++ b/server/asyncserver.py
@@ -142,7 +142,7 @@ class AsyncServer(asyncore.dispatcher):
 		if sys.version_info >= (2, 6): # if python 2.6 or greater...
 			logSys.debug("Detected Python 2.6 or greater. asyncore.loop() not using poll")
 			asyncore.loop(use_poll = False) # fixes the "Unexpected communication problem" issue on Python 2.6 and 3.0
-		else:
+		else: # pragma: no cover
 			logSys.debug("NOT Python 2.6/3.* - asyncore.loop() using poll")
 			asyncore.loop(use_poll = True)
 	
diff --git a/server/filter.py b/server/filter.py
index 5b2b85e0..fb292573 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -211,7 +211,7 @@ class Filter(JailThread):
 	# file has been modified and looks for failures.
 	# @return True when the thread exits nicely
 
-	def run(self):
+	def run(self): # pragma: no cover
 		raise Exception("run() is abstract")
 
 	##
@@ -226,7 +226,7 @@ class Filter(JailThread):
 			self.failManager.addFailure(FailTicket(ip, unixTime))
 
 		# Perform the banning of the IP now.
-		try:
+		try: # pragma: no branch - exception is the only way out
 			while True:
 				ticket = self.failManager.toBan()
 				self.jail.putFailTicket(ticket)
@@ -373,7 +373,7 @@ class Filter(JailThread):
 								failList.append([ip, date])
 							# We matched a regex, it is enough to stop.
 							break
-					except RegexException, e:
+					except RegexException, e: # pragma: no cover - unsure if reachable
 						logSys.error(e)
 		return failList
 
@@ -507,7 +507,7 @@ class FileFilter(Filter):
 try:
 	import hashlib
 	md5sum = hashlib.md5
-except ImportError:
+except ImportError: # pragma: no cover
 	# hashlib was introduced in Python 2.5.  For compatibility with those
 	# elderly Pythons, import from md5
 	import md5
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index c10fa78d..a036f804 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -99,11 +99,11 @@ def _copy_lines_between_files(fin, fout, n=None, skip=0, mode='a', terminal_line
 
 	Returns open fout
 	"""
-	if sys.version_info[:2] <= (2,4):
+	if sys.version_info[:2] <= (2,4): # pragma: no cover
 		# on old Python st_mtime is int, so we should give at least 1 sec so
 		# polling filter could detect the change
 		time.sleep(1)
-	if isinstance(fin, str):
+	if isinstance(fin, str): # pragma: no branch - only used with str in test cases
 		fin = open(fin, 'r')
 	if isinstance(fout, str):
 		fout = open(fout, mode)
@@ -353,7 +353,7 @@ def get_monitor_failures_testcase(Filter_):
 			_killfile(self.file, self.name)
 			pass
 
-		def __str__(self):
+		def __str__(self): # pragma: no cover - will only show up if unexpected exception is thrown
 			return "MonitorFailures%s(%s)" \
 			  % (Filter_, hasattr(self, 'name') and self.name or 'tempfile')
 

From c8c7b0b9845f240b0e1ecaabc84def4c0a74b86e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 15:29:27 +1100
Subject: [PATCH 087/544] BF: general Exception catch was excessive. Only
 IOError and OSError are possible and has different meanings

---
 server/filter.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/filter.py b/server/filter.py
index 5b2b85e0..ceda1377 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -477,10 +477,15 @@ class FileFilter(Filter):
 		# Try to open log file.
 		try:
 			container.open()
-		except Exception, e:
+		# see http://python.org/dev/peps/pep-3151/
+		except IOError, e:
 			logSys.error("Unable to open %s" % filename)
 			logSys.exception(e)
 			return False
+		except OSError, e: # pragma: no cover - requires race condition to tigger this
+			logSys.error("Error opening %s" % filename)
+			logSys.exception(e)
+			return False
 
 		while True:
 			line = container.readline()

From f0610c01d57976abba855c62d61bfaa78130bc4a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 7 Feb 2013 21:50:28 +1100
Subject: [PATCH 088/544] BF: allow more than single word for command
 action[start,stop,ban,unban,check] and for setcinfo too

---
 server/transmitter.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/server/transmitter.py b/server/transmitter.py
index a02b94a2..3f880c07 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -189,7 +189,7 @@ class Transmitter:
 		elif command[1] == "setcinfo":
 			act = command[2]
 			key = command[3]
-			value = command[4]
+			value = " ".join(command[4:])
 			self.__server.setCInfo(name, act, key, value)
 			return self.__server.getCInfo(name, act, key)
 		elif command[1] == "delcinfo":
@@ -199,27 +199,27 @@ class Transmitter:
 			return None
 		elif command[1] == "actionstart":
 			act = command[2]
-			value = command[3]
+			value = " ".join(command[3:])
 			self.__server.setActionStart(name, act, value)
 			return self.__server.getActionStart(name, act)
 		elif command[1] == "actionstop":
 			act = command[2]
-			value = command[3]
+			value = " ".join(command[3:])
 			self.__server.setActionStop(name, act, value)
 			return self.__server.getActionStop(name, act)
 		elif command[1] == "actioncheck":
 			act = command[2]
-			value = command[3]
+			value = " ".join(command[3:])
 			self.__server.setActionCheck(name, act, value)
 			return self.__server.getActionCheck(name, act)
 		elif command[1] == "actionban":
 			act = command[2]
-			value = command[3]
+			value = " ".join(command[3:])
 			self.__server.setActionBan(name, act, value)
 			return self.__server.getActionBan(name, act)
 		elif command[1] == "actionunban":
 			act = command[2]
-			value = command[3]
+			value = " ".join(command[3:])
 			self.__server.setActionUnban(name, act, value)
 			return self.__server.getActionUnban(name, act)
 		raise Exception("Invalid command (no set action or not yet implemented)")

From 7cd6dab7f01869a3647cc5fe5a30a6d3af0b19da Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 7 Feb 2013 20:25:59 +1100
Subject: [PATCH 089/544] ENH: add help command

---
 common/protocol.py | 1 +
 fail2ban-client    | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/common/protocol.py b/common/protocol.py
index 99a2fe09..1083a94b 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -40,6 +40,7 @@ protocol = [
 ["stop", "stops all jails and terminate the server"], 
 ["status", "gets the current status of the server"], 
 ["ping", "tests if the server is alive"], 
+["help", "return this output"], 
 ['', "LOGGING", ""],
 ["set loglevel <LEVEL>", "sets logging level to <LEVEL>. 0 is minimal, 4 is debug"], 
 ["get loglevel", "gets the logging level"], 
diff --git a/fail2ban-client b/fail2ban-client
index 7ee4a47c..76c18c04 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -380,7 +380,9 @@ class Fail2banClient:
 						if cmd == "exit" or cmd == "quit":
 							# Exit
 							return True
-						if not cmd == "":
+						if cmd == "help":
+							self.dispUsage()
+						elif not cmd == "":
 							self.__processCommand(shlex.split(cmd))
 			except (EOFError, KeyboardInterrupt):
 				print

From a0f088be256a0f0c84a44c309d71779a5ca11e19 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 16:28:45 +1100
Subject: [PATCH 090/544] ENH: typo + head -1 has been deprecated for 10+
 years.

---
 config/action.d/dshield.conf       | 4 ++--
 config/action.d/mynetwatchman.conf | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf
index 177329b2..c0d87987 100644
--- a/config/action.d/dshield.conf
+++ b/config/action.d/dshield.conf
@@ -124,13 +124,13 @@ port = ???
 userid = 0
 
 # Option:  myip
-# Notes.:  TThe target IP for the attack (your public IP). Should be provided
+# Notes.:  The target IP for the attack (your public IP). Should be provided
 #          either in the jail config or in a .local file unless your PUBLIC IP
 #          is the first IP assigned to eth0
 # Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
 #          which in most cases will be a private IP, and therefore incorrect
 #
-myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
+myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
 
 # Option:  protocol
 # Notes.:  The protocol over which the attack is happening
diff --git a/config/action.d/mynetwatchman.conf b/config/action.d/mynetwatchman.conf
index d4f8de1a..3ae3e6db 100644
--- a/config/action.d/mynetwatchman.conf
+++ b/config/action.d/mynetwatchman.conf
@@ -102,13 +102,13 @@ mnwlogin =
 mnwpass =
 
 # Option:  myip
-# Notes.:  TThe target IP for the attack (your public IP). Should be overridden
+# Notes.:  The target IP for the attack (your public IP). Should be overridden
 #          either in the jail config or in a .local file unless your PUBLIC IP
 #          is the first IP assigned to eth0
 # Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
 #          which in most cases will be a private IP, and therefore incorrect
 #
-myip = `ip -4 addr show dev eth0 | grep inet | head -1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
+myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
 
 # Option:  protocol
 # Notes.:  The protocol over which the attack is happening

From 23bbc60b1ccebb71df499aadbab2e19f8c38737f Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 17:10:40 +1100
Subject: [PATCH 091/544] do catch all exception

---
 server/filter.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server/filter.py b/server/filter.py
index ceda1377..35da1953 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -486,6 +486,10 @@ class FileFilter(Filter):
 			logSys.error("Error opening %s" % filename)
 			logSys.exception(e)
 			return False
+		except OSError, e: # pragma: no cover - Requires implemention error in FileContainer to generate
+			logSys.error("Internal errror in FileContainer open method - please report as a bug to https://github.com/fail2ban/fail2ban/issues")
+			logSys.exception(e)
+			return False
 
 		while True:
 			line = container.readline()

From 8b91b58e2dc1fe59eebc41937d7cffaa2e26f2f3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 17:33:16 +1100
Subject: [PATCH 092/544] add corresponding ChangeLog entry

---
 DEVELOP | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index bce9e64e..25369830 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -247,6 +247,8 @@ Releasing
 
 Ensure the version is correct in ./common/version.py
 
+Add/finalize the corresponding entry in the ChangeLog
+
 # update man pages
 (cd man ; ./generate-man )
 

From d0d89b43217ff889269b7c1f87a6b3af147e4993 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 10 Mar 2013 17:33:32 +1100
Subject: [PATCH 093/544] TODO: test filters/examples files

---
 TODO | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/TODO b/TODO
index fc43dc2c..933134e9 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,9 @@ Legend:
 # partially done
 * done
 
+- Run tests though all filters/examples files - (see sshd example file) as unit
+  test
+
 - Removed relative imports
 
 - Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/

From 4bbbc0787225a54d556924c1126419c2b0a8f35c Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 10 Mar 2013 14:55:39 +0000
Subject: [PATCH 094/544] Added additional Transmitter tests, and some
 associated fixes

This includes some tweaks such that errors are raised for certain
commands
---
 server/actions.py           |  7 ++--
 server/filter.py            |  2 ++
 server/transmitter.py       | 10 ++++--
 testcases/servertestcase.py | 66 ++++++++++++++++++++++++++++++-------
 4 files changed, 67 insertions(+), 18 deletions(-)

diff --git a/server/actions.py b/server/actions.py
index 4d021a71..ddcc83d6 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -77,7 +77,8 @@ class Actions(JailThread):
 		for action in self.__actions:
 			if action.getName() == name:
 				self.__actions.remove(action)
-				break
+				return
+		raise KeyError("Invalid Action name: %s" % name)
 	
 	##
 	# Returns an action.
@@ -91,7 +92,7 @@ class Actions(JailThread):
 		for action in self.__actions:
 			if action.getName() == name:
 				return action
-		raise KeyError
+		raise KeyError("Invalid Action name")
 	
 	##
 	# Returns the last defined action.
@@ -131,7 +132,7 @@ class Actions(JailThread):
 			# Unban the IP.
 			self.__unBan(ticket)
 			return ip
-		return 'None'
+		raise ValueError("IP %s is not banned" % ip)
 
 	##
 	# Main loop.
diff --git a/server/filter.py b/server/filter.py
index fb292573..dc82d7aa 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -93,6 +93,7 @@ class Filter(JailThread):
 			self.__failRegex.append(regex)
 		except RegexException, e:
 			logSys.error(e)
+			raise e
 
 
 	def delFailRegex(self, index):
@@ -126,6 +127,7 @@ class Filter(JailThread):
 			self.__ignoreRegex.append(regex)
 		except RegexException, e:
 			logSys.error(e)
+			raise e 
 
 	def delIgnoreRegex(self, index):
 		try:
diff --git a/server/transmitter.py b/server/transmitter.py
index a02b94a2..c9033010 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -112,14 +112,18 @@ class Transmitter:
 			return self.__server.getLogLevel()
 		elif name == "logtarget":
 			value = command[1]
-			self.__server.setLogTarget(value)
-			return self.__server.getLogTarget()
+			if self.__server.setLogTarget(value):
+				return self.__server.getLogTarget()
+			else:
+				raise Exception("Failed to change log target")
 		# Jail
 		elif command[1] == "idle":
 			if command[2] == "on":
 				self.__server.setIdleJail(name, True)
 			elif command[2] == "off":
 				self.__server.setIdleJail(name, False)
+			else:
+				raise Exception("Invalid idle option, must be 'yes' or 'no'")
 			return self.__server.getIdleJail(name)
 		# Filter
 		elif command[1] == "addignoreip":
@@ -275,7 +279,7 @@ class Transmitter:
 	def status(self, command):
 		if len(command) == 0:
 			return self.__server.status()
-		else:
+		elif len(command) == 1:
 			name = command[0]
 			return self.__server.statusJail(name)
 		raise Exception("Invalid command (no status)")
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 00f56b81..4268df38 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -29,6 +29,7 @@ __license__ = "GPL"
 
 import unittest, socket, time, tempfile, os
 from server.server import Server
+from common.exceptions import UnknownJailException
 
 class StartStop(unittest.TestCase):
 
@@ -141,6 +142,9 @@ class Transmitter(unittest.TestCase):
 				self.__transm.proceed(["get", jail, cmd]),
 				(0, outValues[n+1:]))
 
+	def testStopServer(self):
+		self.assertEqual(self.__transm.proceed(["stop"]), (0, None))
+
 	def testPing(self):
 		self.assertEqual(self.__transm.proceed(["ping"]), (0, "pong"))
 
@@ -162,11 +166,7 @@ class Transmitter(unittest.TestCase):
 
 		# If path is invalid, do not change logtarget
 		value = "/this/path/should/not/exist"
-		self.assertEqual(
-			self.__transm.proceed(["set", "logtarget", value]),
-			(0, logTarget)) #NOTE: Shouldn't this return 1
-		self.assertEqual(
-			self.__transm.proceed(["get", "logtarget"]), (0, logTargets[-1]))
+		self.setGetTestNOK("logtarget", value)
 
 		self.__transm.proceed(["set", "/dev/null"])
 		for logTarget in logTargets:
@@ -196,6 +196,28 @@ class Transmitter(unittest.TestCase):
 		self.assertEqual(
 			self.__transm.proceed(["add", "all", "polling"])[0], 1)
 
+	def testStartStopJail(self):
+		self.assertEqual(
+			self.__transm.proceed(["start", self.jailName]), (0, None))
+		time.sleep(1)
+		self.assertEqual(
+			self.__transm.proceed(["stop", self.jailName]), (0, None))
+		self.assertRaises(
+			UnknownJailException, self.__server.isAlive, self.jailName)
+
+	def testStartStopAllJail(self):
+		self.__server.addJail("TestJail2", "auto")
+		self.assertEqual(
+			self.__transm.proceed(["start", self.jailName]), (0, None))
+		self.assertEqual(
+			self.__transm.proceed(["start", "TestJail2"]), (0, None))
+		self.assertEqual(self.__transm.proceed(["stop", "all"]), (0, None))
+		time.sleep(1)
+		self.assertRaises(
+			UnknownJailException, self.__server.isAlive, self.jailName)
+		self.assertRaises(
+			UnknownJailException, self.__server.isAlive, "TestJail2")
+
 	def testJailIdle(self):
 		self.assertEqual(
 			self.__transm.proceed(["set", self.jailName, "idle", "on"]),
@@ -205,7 +227,7 @@ class Transmitter(unittest.TestCase):
 			(0, False))
 		self.assertEqual(
 			self.__transm.proceed(["set", self.jailName, "idle", "CAT"])[0],
-			0) #NOTE: Should this return 1
+			1)
 
 	def testJailFindTime(self):
 		self.setGetTest("findtime", "120", 120, jail=self.jailName)
@@ -249,8 +271,7 @@ class Transmitter(unittest.TestCase):
 		# Unban IP which isn't banned
 		self.assertEqual(
 			self.__transm.proceed(
-				["set", self.jailName, "unbanip", "192.168.1.1"]),
-			(0, "None")) #NOTE: Should this return 1?
+				["set", self.jailName, "unbanip", "192.168.1.1"])[0],1)
 
 	def testJailMaxRetry(self):
 		self.setGetTest("maxretry", "5", 5, jail=self.jailName)
@@ -335,8 +356,8 @@ class Transmitter(unittest.TestCase):
 
 		self.assertEqual(
 			self.__transm.proceed(
-				["set", self.jailName, "addfailregex", "No host regex"]),
-			(0, [])) #NOTE: Shouldn't this return 1?
+				["set", self.jailName, "addfailregex", "No host regex"])[0],
+			1)
 		self.assertEqual(
 			self.__transm.proceed(
 				["set", self.jailName, "addfailregex", 654])[0],
@@ -357,6 +378,10 @@ class Transmitter(unittest.TestCase):
 			self.jailName
 		)
 
+		self.assertEqual(
+			self.__transm.proceed(
+				["set", self.jailName, "addignoreregex", "Invalid [regex"])[0],
+			1)
 		self.assertEqual(
 			self.__transm.proceed(
 				["set", self.jailName, "addignoreregex", 50])[0],
@@ -409,6 +434,9 @@ class Transmitter(unittest.TestCase):
 		self.assertEqual(
 			self.__transm.proceed(["set", self.jailName, "addaction", action]),
 			(0, action))
+		self.assertEqual(
+			self.__transm.proceed(["get", self.jailName, "addaction", action]),
+			(0, action))
 		for cmd, value in zip(cmdList, cmdValueList):
 			self.assertEqual(
 				self.__transm.proceed(
@@ -439,5 +467,19 @@ class Transmitter(unittest.TestCase):
 			(0, None))
 		self.assertEqual(
 			self.__transm.proceed(
-				["set", self.jailName, "delaction", "Doesn't exist"]),
-			(0, None)) #NOTE: Should this return 1?
+				["set", self.jailName, "delaction", "Doesn't exist"])[0],1)
+
+	def testNOK(self):
+		self.assertEqual(self.__transm.proceed(["INVALID", "COMMAND"])[0],1)
+
+	def testSetNOK(self):
+		self.assertEqual(
+			self.__transm.proceed(["set", "INVALID", "COMMAND"])[0],1)
+
+	def testGetNOK(self):
+		self.assertEqual(
+			self.__transm.proceed(["get", "INVALID", "COMMAND"])[0],1)
+
+	def testStatusNOK(self):
+		self.assertEqual(
+			self.__transm.proceed(["status", "INVALID", "COMMAND"])[0],1)

From a2b29b4875455662b48b2f9f3537bc17445a887d Mon Sep 17 00:00:00 2001
From: Pascal Borreli <pascal@borreli.com>
Date: Sun, 10 Mar 2013 22:05:33 +0000
Subject: [PATCH 095/544] Fixed typos

---
 DEVELOP                                      |  6 +++---
 config/action.d/dshield.conf                 |  2 +-
 config/action.d/iptables-allports.conf       |  2 +-
 config/action.d/iptables-ipset-proto4.conf   |  2 +-
 config/action.d/iptables-ipset-proto6.conf   |  2 +-
 config/action.d/iptables-multiport-log.conf  |  2 +-
 config/action.d/iptables-multiport.conf      |  2 +-
 config/action.d/iptables-new.conf            |  2 +-
 config/action.d/iptables-xt_recent-echo.conf |  4 ++--
 config/action.d/iptables.conf                |  2 +-
 config/action.d/mail-whois-lines.conf        |  2 +-
 config/action.d/mail-whois.conf              |  2 +-
 config/action.d/mail.conf                    |  2 +-
 config/action.d/sendmail-buffered.conf       |  2 +-
 config/action.d/sendmail-whois-lines.conf    |  2 +-
 config/action.d/sendmail-whois.conf          |  2 +-
 config/action.d/sendmail.conf                |  2 +-
 config/filter.d/apache-badbots.conf          |  2 +-
 config/jail.conf                             |  2 +-
 doc/run-rootless.txt                         | 14 +++++++-------
 fail2ban-client                              |  2 +-
 server/action.py                             |  4 ++--
 server/filter.py                             |  8 ++++----
 server/filterpoll.py                         |  2 +-
 24 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index 25369830..cddf4456 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -92,7 +92,7 @@ Documentation
 -------------
 
 Ensure this documentation is up to date after changes. Also ensure that the man
-pages still are accurage. Ensure that there is sufficient documentation for 
+pages still are accurate. Ensure that there is sufficient documentation for
 your new features to be used.
 
 Bugs
@@ -107,7 +107,7 @@ Use the following tags in your commit messages:
 
 'ENH:' for enhancements
 'BF:' for bug fixes
-'DOC:' for documenation fixes
+'DOC:' for documentation fixes
 
 Adding Actions
 --------------
@@ -265,4 +265,4 @@ python -c 'import common.protocol; common.protocol.printWiki()'
 
 email users and development list of release
 
-TODO notifing distributors etc.
+TODO notifying distributors etc.
diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf
index 177329b2..fea8f196 100644
--- a/config/action.d/dshield.conf
+++ b/config/action.d/dshield.conf
@@ -116,7 +116,7 @@ actionunban = if [ -f <tmpfile>.first ]; then
 port = ???
 
 # Option:  userid
-# Notes.:  Your DSheild user ID. Should be provided either in the jail config or
+# Notes.:  Your DShield user ID. Should be provided either in the jail config or
 #          in a .local file.
 #          Register at https://secure.dshield.org/register.html
 # Values:  [ NUM ]  Default: 0
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
index f534fee9..c7f76c83 100644
--- a/config/action.d/iptables-allports.conf
+++ b/config/action.d/iptables-allports.conf
@@ -53,7 +53,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf
index f7d03f67..665d35cf 100644
--- a/config/action.d/iptables-ipset-proto4.conf
+++ b/config/action.d/iptables-ipset-proto4.conf
@@ -53,7 +53,7 @@ actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <
 
 [Init]
 
-# Defaut name of the ipset
+# Default name of the ipset
 #
 name = default
 
diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf
index 3352d63d..e4ceb0d0 100644
--- a/config/action.d/iptables-ipset-proto6.conf
+++ b/config/action.d/iptables-ipset-proto6.conf
@@ -53,7 +53,7 @@ actionunban = ipset del fail2ban-<name> <ip> -exist
 
 [Init]
 
-# Defaut name of the ipset
+# Default name of the ipset
 #
 name = default
 
diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf
index 9cdc4bab..0f4947dd 100644
--- a/config/action.d/iptables-multiport-log.conf
+++ b/config/action.d/iptables-multiport-log.conf
@@ -61,7 +61,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf
index d062f74d..8b15ad86 100644
--- a/config/action.d/iptables-multiport.conf
+++ b/config/action.d/iptables-multiport.conf
@@ -51,7 +51,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf
index 92bd9a55..64f54582 100644
--- a/config/action.d/iptables-new.conf
+++ b/config/action.d/iptables-new.conf
@@ -53,7 +53,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf
index f3ac80b5..170fef07 100644
--- a/config/action.d/iptables-xt_recent-echo.conf
+++ b/config/action.d/iptables-xt_recent-echo.conf
@@ -11,7 +11,7 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-# Changing iptables rules requires root priviledges. If fail2ban is
+# Changing iptables rules requires root privileges. If fail2ban is
 # configured to run as root, firewall setup can be performed by
 # fail2ban automatically. However, if fail2ban is configured to run as
 # a normal user, the configuration must be done by some other means
@@ -65,7 +65,7 @@ actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index a846f971..083065fc 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -51,7 +51,7 @@ actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
index 6d3343b6..1ace68f6 100644
--- a/config/action.d/mail-whois-lines.conf
+++ b/config/action.d/mail-whois-lines.conf
@@ -62,7 +62,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 9e6ec88e..1581c42c 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -59,7 +59,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 01f22ff8..02946b43 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -57,7 +57,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index 25a23b78..80f71374 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -83,7 +83,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index b84440d0..dfbf9ff8 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -73,7 +73,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
index 363c3398..e6a15fb5 100644
--- a/config/action.d/sendmail-whois.conf
+++ b/config/action.d/sendmail-whois.conf
@@ -71,7 +71,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
index bdc2a3b6..5bb75575 100644
--- a/config/action.d/sendmail.conf
+++ b/config/action.d/sendmail.conf
@@ -69,7 +69,7 @@ actionunban =
 
 [Init]
 
-# Defaut name of the chain
+# Default name of the chain
 #
 name = default
 
diff --git a/config/filter.d/apache-badbots.conf b/config/filter.d/apache-badbots.conf
index 1d70bb0e..1c60676d 100644
--- a/config/filter.d/apache-badbots.conf
+++ b/config/filter.d/apache-badbots.conf
@@ -16,7 +16,7 @@ badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|Da
 # Option:  failregex
 # Notes.:  Regexp to catch known spambots and software alike. Please verify
 #          that it is your intent to block IPs which were driven by
-#          abovementioned bots.
+#          above mentioned bots.
 # Values:  TEXT
 #
 failregex = ^<HOST> -.*"(GET|POST).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
diff --git a/config/jail.conf b/config/jail.conf
index a0093f68..8bb1a6b6 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -241,7 +241,7 @@ logpath = /var/log/lighttpd/error.log
 maxretry = 2
 
 # Same as above for mod_auth
-# It catches wrong authentifications
+# It catches wrong authentications
 
 [lighttpd-auth]
 
diff --git a/doc/run-rootless.txt b/doc/run-rootless.txt
index 85a8f766..5edf6ef6 100644
--- a/doc/run-rootless.txt
+++ b/doc/run-rootless.txt
@@ -1,7 +1,7 @@
-Fail2ban normally requires root priviledges to insert iptables rules
+Fail2ban normally requires root privileges to insert iptables rules
 through calls to /sbin/iptables and also to read the logfiles.
-Fail2ban can run as an unpriviledged user provided that those two
-capabilites are preserved. The idea is to run fail2ban as a normal
+Fail2ban can run as an unprivileged user provided that those two
+capabilities are preserved. The idea is to run fail2ban as a normal
 user (e.g. fail2ban) who belongs to a group which is allowed to read
 logfiles. The user should also be allowed to write to
 /proc/net/xt_recent/fail2ban-<name> (name is specified in the iptables
@@ -20,14 +20,14 @@ Another way to use xt_recent is by inserting the rules by writing to
 action. Files in /proc/net/xt_recent/ are protected by normal
 filesystem rules, so can be chown'ed and chmod'ed to be writable by a
 certain user. After the necessary iptables rules are inserted (which
-requires root priviledges), blacklisting can be perfomed by an
-unpriviledged user.
+requires root privileges), blacklisting can be performed by an
+unprivileged user.
 
 Using fail2ban with xt_recent allows smarter filtering than normal
 iptables rules with the xt_recent module can provide.
 
 The disadvantage is that fail2ban cannot perform the setup by itself,
-which would require the priviledge to call /sbin/iptables, and it must
+which would require the privilege to call /sbin/iptables, and it must
 be done through other means.
 
 The primary advantage is obvious: it's generally better to run
@@ -46,7 +46,7 @@ some user and thus allow delisting IPs by helper administrators
 without the ability to mess up other iptables rules.
 
 The xt_recent-echo jail can be used under the root user without
-further configuration. To run not as root, futher setup is necessary:
+further configuration. To run not as root, further setup is necessary:
 
 - Create user:
 
diff --git a/fail2ban-client b/fail2ban-client
index ed211e62..b832450e 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -297,7 +297,7 @@ class Fail2banClient:
 					delta = -1
 				elif pos < 2:
 					delta = 1
-			# The server has 30 secondes to start.
+			# The server has 30 seconds to start.
 			if cnt >= 300:
 				if self.__conf["verbose"] > 1:
 					sys.stdout.write('\n')
diff --git a/server/action.py b/server/action.py
index 35974c70..5fde3ae1 100644
--- a/server/action.py
+++ b/server/action.py
@@ -277,8 +277,8 @@ class Action:
 	# Executes a command with preliminary checks and substitutions.
 	#
 	# Before executing any commands, executes the "check" command first
-	# in order to check if prerequirements are met. If this check fails,
-	# it tries to restore a sane environnement before executing the real
+	# in order to check if pre-requirements are met. If this check fails,
+	# it tries to restore a sane environment before executing the real
 	# command.
 	# Replaces "aInfo" and "cInfo" in the query too.
 	#
diff --git a/server/filter.py b/server/filter.py
index fb292573..64a6c5e5 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -44,7 +44,7 @@ logSys = logging.getLogger("fail2ban.filter")
 # Log reader class.
 #
 # This class reads a log file and detects login failures or anything else
-# that matches a given regular expression. This class is instanciated by
+# that matches a given regular expression. This class is instantiated by
 # a Jail object.
 
 class Filter(JailThread):
@@ -117,7 +117,7 @@ class Filter(JailThread):
 	# Add the regular expression which matches the failure.
 	#
 	# The regular expression can also match any other pattern than failures
-	# and thus can be used for many purporse.
+	# and thus can be used for many purpose.
 	# @param value the regular expression
 
 	def addIgnoreRegex(self, value):
@@ -414,7 +414,7 @@ class FileFilter(Filter):
 
 	def _addLogPath(self, path):
 		# nothing to do by default
-		# to be overriden by backends
+		# to be overridden by backends
 		pass
 
 
@@ -433,7 +433,7 @@ class FileFilter(Filter):
 
 	def _delLogPath(self, path):
 		# nothing to do by default
-		# to be overriden by backends
+		# to be overridden by backends
 		pass
 
 	##
diff --git a/server/filterpoll.py b/server/filterpoll.py
index 0719545a..f0e23ac1 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -39,7 +39,7 @@ logSys = logging.getLogger("fail2ban.filter")
 # Log reader class.
 #
 # This class reads a log file and detects login failures or anything else
-# that matches a given regular expression. This class is instanciated by
+# that matches a given regular expression. This class is instantiated by
 # a Jail object.
 
 class FilterPoll(FileFilter):

From cabbc0fd96c71e34c65b64febdac019681055c7a Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 10 Mar 2013 21:21:27 -0400
Subject: [PATCH 096/544] DOC: added a note that coverage script is
 python-coverage on Debian systems

---
 DEVELOP | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/DEVELOP b/DEVELOP
index cddf4456..09bf7277 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -36,7 +36,8 @@ missing branches. Also see http://nedbatchelder.com/code/coverage/branch.html
 for more details.
 
 Install the package python-coverage to visualise your test coverage. Run the
-following:
+following (note: on Debian-based systems, the script is called
+`python-coverage`):
 
 coverage run fail2ban-testcases
 coverage html

From b6bb2f88c1dbb111647269590d80d95f72c81c3e Mon Sep 17 00:00:00 2001
From: sebres <sergey.brester@W7-DEHBG0189.wincor-nixdorf.com>
Date: Mon, 11 Mar 2013 13:52:31 +0100
Subject: [PATCH 097/544] invalid date recognition, irregular because of
 sorting template list, now via setRegex

---
 server/datedetector.py | 26 +++++++++++++-------------
 server/datetemplate.py |  7 +++++--
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 6e484449..c013d551 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -55,80 +55,80 @@ class DateDetector:
 			# standard
 			template = DateStrptime()
 			template.setName("MONTH Day Hour:Minute:Second")
-			template.setRegex("(?<!\w)\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%b %d %H:%M:%S")
 			self._appendTemplate(template)
 			# asctime
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second Year")
-			template.setRegex("(?<!\w)\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
+			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")
 			template.setPattern("%a %b %d %H:%M:%S %Y")
 			self._appendTemplate(template)
 			# asctime without year
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second")
-			template.setRegex("(?<!\w)\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%a %b %d %H:%M:%S")
 			self._appendTemplate(template)
 			# simple date
 			template = DateStrptime()
 			template.setName("Year/Month/Day Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y/%m/%d %H:%M:%S")
 			self._appendTemplate(template)
 			# simple date too (from x11vnc)
 			template = DateStrptime()
 			template.setName("Day/Month/Year Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# previous one but with year given by 2 digits
 			# (See http://bugs.debian.org/537610)
 			template = DateStrptime()
 			template.setName("Day/Month/Year2 Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%y %H:%M:%S")
 			self._appendTemplate(template)
 			# Apache format [31/Oct/2006:09:22:55 -0000]
 			template = DateStrptime()
 			template.setName("Day/MONTH/Year:Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%b/%Y:%H:%M:%S")
 			self._appendTemplate(template)
 			# CPanel 05/20/2008:01:57:39
 			template = DateStrptime()
 			template.setName("Month/Day/Year:Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
 			template.setPattern("%m/%d/%Y:%H:%M:%S")
 			self._appendTemplate(template)
 			# Exim 2006-12-21 06:43:20
 			template = DateStrptime()
 			template.setName("Year-Month-Day Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
 			self._appendTemplate(template)
 			# custom for syslog-ng 2006.12.21 06:43:20
 			template = DateStrptime()
 			template.setName("Year.Month.Day Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y.%m.%d %H:%M:%S")
 			self._appendTemplate(template)
 			# named 26-Jul-2007 15:20:52.252 
 			template = DateStrptime()
 			template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]")
-			template.setRegex("(?<!\w)\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d-%b-%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# 17-07-2008 17:23:25
 			template = DateStrptime()
 			template.setName("Day-Month-Year Hour:Minute:Second")
-			template.setRegex("(?<!\w)\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d-%m-%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# 01-27-2012 16:22:44.252
 			template = DateStrptime()
 			template.setName("Month-Day-Year Hour:Minute:Second[.Millisecond]")
-			template.setRegex("(?<!\w)\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
+			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%m-%d-%Y %H:%M:%S")
 			self._appendTemplate(template)
 			# TAI64N
diff --git a/server/datetemplate.py b/server/datetemplate.py
index f663862e..a25a42ea 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -50,8 +50,11 @@ class DateTemplate:
 	def getName(self):
 		return self.__name
 	
-	def setRegex(self, regex):
-		self.__regex = regex.strip()
+	def setRegex(self, regex, wordBegin = True):
+		regex = regex.strip()
+		if (wordBegin and not re.search(r'^\^', regex)):
+			regex = r'\b' + regex
+		self.__regex = regex
 		self.__cRegex = re.compile(regex)
 		
 	def getRegex(self):

From d4362859ef6ac1142340c19473c5fa1f9117b58b Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Mon, 11 Mar 2013 17:22:57 +0000
Subject: [PATCH 098/544] Added testcase for csocket and asyncserver

---
 fail2ban-testcases          |  3 ++
 testcases/sockettestcase.py | 82 +++++++++++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+)
 create mode 100644 testcases/sockettestcase.py

diff --git a/fail2ban-testcases b/fail2ban-testcases
index ed341385..2ab59f6a 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -35,6 +35,7 @@ from testcases import filtertestcase
 from testcases import servertestcase
 from testcases import datedetectortestcase
 from testcases import actiontestcase
+from testcases import sockettestcase
 from server.mytime import MyTime
 
 from optparse import OptionParser, Option
@@ -132,6 +133,8 @@ tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
 tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
 # ClientReader
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
+# CSocket and AsyncServer
+tests.addTest(unittest.makeSuite(sockettestcase.Socket))
 
 # Filter
 if not opts.no_network:
diff --git a/testcases/sockettestcase.py b/testcases/sockettestcase.py
new file mode 100644
index 00000000..b7258c0f
--- /dev/null
+++ b/testcases/sockettestcase.py
@@ -0,0 +1,82 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Author: Cyril Jaquier
+# 
+# $Revision$
+
+__author__ = "Cyril Jaquier"
+__version__ = "$Revision$"
+__date__ = "$Date$"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__license__ = "GPL"
+
+import unittest, time, tempfile, os, threading
+from server.asyncserver import AsyncServer, AsyncServerException
+from client.csocket import CSocket
+
+class Socket(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.server = AsyncServer(self)
+		sock_fd, sock_name = tempfile.mkstemp('fail2ban.sock', 'socket')
+		os.close(sock_fd)
+		os.remove(sock_name)
+		self.sock_name = sock_name
+
+	def tearDown(self):
+		"""Call after every test case."""
+
+	@staticmethod
+	def proceed(message):
+		"""Test transmitter proceed method which just returns first arg"""
+		return message
+
+	def testSocket(self):
+		serverThread = threading.Thread(
+			target=self.server.start, args=(self.sock_name, False))
+		serverThread.daemon = True
+		serverThread.start()
+		time.sleep(1)
+
+		client = CSocket(self.sock_name)
+		testMessage = ["A", "test", "message"]
+		self.assertEqual(client.send(testMessage), testMessage)
+
+		self.server.stop()
+		serverThread.join(1)
+		self.assertFalse(os.path.exists(self.sock_name))
+
+	def testSocketForce(self):
+		open(self.sock_name, 'w').close() # Create sock file
+		# Try to start without force
+		self.assertRaises(
+			AsyncServerException, self.server.start, self.sock_name, False)
+
+		# Try agin with force set
+		serverThread = threading.Thread(
+			target=self.server.start, args=(self.sock_name, True))
+		serverThread.daemon = True
+		serverThread.start()
+		time.sleep(1)
+
+		self.server.stop()
+		serverThread.join(1)
+		self.assertFalse(os.path.exists(self.sock_name))

From 5087b410542daae8d13dd93829e273df08be6ba5 Mon Sep 17 00:00:00 2001
From: blotus <sebastien@blot.me>
Date: Fri, 25 Jan 2013 13:37:22 +0100
Subject: [PATCH 099/544] Escape ' and " in matches tag

---
 server/action.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/action.py b/server/action.py
index f2614b33..35974c70 100644
--- a/server/action.py
+++ b/server/action.py
@@ -243,7 +243,7 @@ class Action:
 		return Action.executeCmd(stopCmd)
 
 	def escapeTag(tag):
-		for c in '\\#&;`|*?~<>^()[]{}$\n':
+		for c in '\\#&;`|*?~<>^()[]{}$\n\'"':
 			if c in tag:
 				tag = tag.replace(c, '\\' + c)
 		return tag

From 3b0800459b0a21f5c2c55ccd2981198768cea18d Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Fri, 25 Jan 2013 12:56:00 -0700
Subject: [PATCH 100/544] Initial support for --no-network option for
 fail2ban-testcases

---
 fail2ban-testcases | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 0ee2c53c..20d3b226 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -53,6 +53,12 @@ def get_opt_parser():
 			   help="Log level for the logger to use during running tests"),
 		])
 
+	p.add_options([
+		Option('-n', "--no-network", action="store_true",
+			   dest="no_network",
+			   help="Do not run tests that require the network"),
+		])
+
 	return p
 
 parser = get_opt_parser()
@@ -90,6 +96,8 @@ else:
 	stdout.setFormatter(logging.Formatter(' %(message)s'))
 logSys.addHandler(stdout)
 
+if opts.no_network is None:
+    opts.no_network = False
 
 #
 # Let know the version
@@ -129,11 +137,13 @@ tests.addTest(unittest.makeSuite(banmanagertestcase.AddFailure))
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
 
 # Filter
-tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
+if not opts.no_network:
+    tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFileMonitor))
-tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
-tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
+if not opts.no_network:
+    tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+    tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
 tests.addTest(unittest.makeSuite(filtertestcase.JailTests))
 
 # DateDetector

From e4aedfdc00aa4b0a70d244ebc7670c51a4f946f5 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 25 Jan 2013 16:01:35 -0500
Subject: [PATCH 101/544] BF: pyinotify - use bitwise op on masks and do not
 try tracking newly created directories

---
 server/filterpyinotify.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py
index fdc7256e..a2eea9d7 100644
--- a/server/filterpyinotify.py
+++ b/server/filterpyinotify.py
@@ -65,7 +65,11 @@ class FilterPyinotify(FileFilter):
 
 	def callback(self, event):
 		path = event.pathname
-		if event.mask == pyinotify.IN_CREATE:
+		if event.mask & pyinotify.IN_CREATE:
+			# skip directories altogether
+			if event.mask & pyinotify.IN_ISDIR:
+				logSys.debug("Ignoring creation of directory %s" % path)
+				return
 			# check if that is a file we care about
 			if not path in self.__watches:
 				logSys.debug("Ignoring creation of %s we do not monitor" % path)

From 9055d925f26a338232a6e017548a68ca9d9d489f Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Fri, 25 Jan 2013 14:19:10 -0700
Subject: [PATCH 102/544] Remove unneeded setting of opts.no_network

---
 fail2ban-testcases | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 20d3b226..99fefd57 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -96,9 +96,6 @@ else:
 	stdout.setFormatter(logging.Formatter(' %(message)s'))
 logSys.addHandler(stdout)
 
-if opts.no_network is None:
-    opts.no_network = False
-
 #
 # Let know the version
 #

From 7fc83196b960e663f073b8e554708c1183a0c34f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 28 Jan 2013 09:46:50 -0500
Subject: [PATCH 103/544] RF: move exceptions used by both client and server
 into common/exceptions.py

this prevents importing of server while operating with client only
---
 client/beautifier.py | 14 ++++----------
 common/exceptions.py | 36 ++++++++++++++++++++++++++++++++++++
 server/jails.py      | 17 +++--------------
 3 files changed, 43 insertions(+), 24 deletions(-)
 create mode 100644 common/exceptions.py

diff --git a/client/beautifier.py b/client/beautifier.py
index a75655e7..7e48016c 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -17,20 +17,14 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
 __license__ = "GPL"
 
-from server.jails import UnknownJailException
-from server.jails import DuplicateJailException
 import logging
 
+from common.exceptions import UnknownJailException, DuplicateJailException
+
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.client.config")
 
diff --git a/common/exceptions.py b/common/exceptions.py
new file mode 100644
index 00000000..7e933544
--- /dev/null
+++ b/common/exceptions.py
@@ -0,0 +1,36 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+"""Fail2Ban exceptions used by both client and server
+
+"""
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
+__license__ = "GPL"
+
+#
+# Jails
+#
+class DuplicateJailException(Exception):
+	pass
+
+class UnknownJailException(Exception):
+	pass
+
+
+
diff --git a/server/jails.py b/server/jails.py
index 3be38f70..4bf5f971 100644
--- a/server/jails.py
+++ b/server/jails.py
@@ -17,16 +17,11 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2013- Yaroslav Halchenko"
 __license__ = "GPL"
 
+from common.exceptions import DuplicateJailException, UnknownJailException
 
 from jail import Jail
 from threading import Lock
@@ -160,9 +155,3 @@ class Jails:
 		finally:
 			self.__lock.release()
 
-
-class DuplicateJailException(Exception):
-	pass
-
-class UnknownJailException(Exception):
-	pass

From 1eb23cf8afc9481ffcd2f393a291e8c9c6817608 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 28 Jan 2013 09:54:08 -0500
Subject: [PATCH 104/544] BF: do not rely on scripts being under /usr -- might
 differ eg on Fedora -- rely on import of common.version (Closes gh-112)

This is also not ideal, since if there happens to be some systemwide common.version -- we are doomed

but otherwise, we cannot keep extending comparison check to /bin, /sbin whatelse
---
 fail2ban-client | 9 +++++----
 fail2ban-regex  | 9 +++++----
 fail2ban-server | 7 ++++---
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 1d8eb15e..13d018e6 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -27,12 +27,13 @@ import getopt, time, shlex, socket
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-if os.path.abspath(__file__).startswith('/usr/'):
-	# makes sense to use system-wide library iff -client is also under /usr/
+try:
+	from common.version import version
+except ImportError, e:
 	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version
 
-# Now we can import our modules
-from common.version import version
+# Now we can import the rest of modules
 from common.protocol import printFormatted
 from client.csocket import CSocket
 from client.configurator import Configurator
diff --git a/fail2ban-regex b/fail2ban-regex
index a42ed96d..f9bc72c1 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -26,13 +26,14 @@ import getopt, sys, time, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-if os.path.abspath(__file__).startswith('/usr/'):
-	# makes sense to use system-wide library iff -regex is also under /usr/
-    sys.path.insert(1, "/usr/share/fail2ban")
+try:
+	from common.version import version
+except ImportError, e:
+	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version
 
 from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
-from common.version import version
 from server.filter import Filter
 from server.failregex import RegexException
 
diff --git a/fail2ban-server b/fail2ban-server
index bd86e6cd..0f3410c9 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -26,11 +26,12 @@ import getopt, sys, logging, os
 
 # Inserts our own modules path first in the list
 # fix for bug #343821
-if os.path.abspath(__file__).startswith('/usr/'):
-	# makes sense to use system-wide library iff -server is also under /usr/
+try:
+	from common.version import version
+except ImportError, e:
 	sys.path.insert(1, "/usr/share/fail2ban")
+	from common.version import version
 
-from common.version import version
 from server.server import Server
 
 # Gets the instance of the logger.

From ed386dfe0779067daa4f76f38a0234aeaa50292f Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Fri, 15 Mar 2013 14:37:11 -0600
Subject: [PATCH 105/544] Add systemd unit file and tmpfiles.d configuration
 files

---
 files/fail2ban-tmpfiles.conf |  1 +
 files/fail2ban.service       | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 files/fail2ban-tmpfiles.conf
 create mode 100644 files/fail2ban.service

diff --git a/files/fail2ban-tmpfiles.conf b/files/fail2ban-tmpfiles.conf
new file mode 100644
index 00000000..3fd783f3
--- /dev/null
+++ b/files/fail2ban-tmpfiles.conf
@@ -0,0 +1 @@
+D /var/run/fail2ban 0755 root root -
\ No newline at end of file
diff --git a/files/fail2ban.service b/files/fail2ban.service
new file mode 100644
index 00000000..35d7fc88
--- /dev/null
+++ b/files/fail2ban.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Fail2ban Service
+
+[Service]
+Type=forking
+ExecStart=/usr/bin/fail2ban-client -x start
+ExecStop=/usr/bin/fail2ban-client stop
+ExecReload=/usr/bin/fail2ban-client reload
+Restart=always
+
+[Install]
+WantedBy=network.target

From 2a57a17c860399818e10e18ec62ef765a7cc28d4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 16 Mar 2013 13:51:23 +1100
Subject: [PATCH 106/544] completed items from TODO list

---
 TODO | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/TODO b/TODO
index 933134e9..61bdc093 100644
--- a/TODO
+++ b/TODO
@@ -16,9 +16,9 @@ Legend:
 - Run tests though all filters/examples files - (see sshd example file) as unit
   test
 
-- Removed relative imports
+* Removed relative imports
 
-- Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
+* Cleanup fail2ban-client and fail2ban-server. Move code to server/ and client/
 
 - Add timeout to external commands (signal alarm, watchdog thread, etc)
 

From a5928cc3cfe558f9731a32015ffbae6619a61fbb Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 16 Mar 2013 13:52:18 +1100
Subject: [PATCH 107/544] ENH: packaging information for RPM builds

---
 setup.cfg | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/setup.cfg b/setup.cfg
index cdc25b29..53e7276a 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -3,3 +3,11 @@ install-purelib=/usr/share/fail2ban
 
 [sdist]
 formats=bztar
+
+[bdist_rpm]
+release = 1
+packager = Yaroslav Halchenko <debian@onerussian.com>
+doc_files = DEVELOP
+            README
+            THANKS
+            doc/run-rootless.txt

From 10d4aa16820accaedb313871dd56376142cf7f8c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 16 Mar 2013 13:53:12 +1100
Subject: [PATCH 108/544] BF: remove non-existant files from setup.py. ENH: add
 documentation

---
 setup.py | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/setup.py b/setup.py
index 37086227..784999a2 100755
--- a/setup.py
+++ b/setup.py
@@ -67,6 +67,9 @@ setup(
 						),
 						('/var/run/fail2ban',
 							''
+						),
+						('/usr/share/doc/fail2ban',
+							['README', 'DEVELOP', 'doc/run-rootless.txt']
 						)
 					]
 )
@@ -82,13 +85,7 @@ elements =	{
 				"/usr/bin/":
 					[
 						"fail2ban.py"
-					],
-				"/usr/lib/fail2ban/firewall/":
-					[
-						"iptables.py",
-						"ipfwadm.py",
-						"ipfw.py"
-					],
+					], 
 				"/usr/lib/fail2ban/":
 					[
 						"version.py",

From c6ac9c2e353ded2d081f6cc93359188293c057f4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 16 Mar 2013 13:53:51 +1100
Subject: [PATCH 109/544] ENH: git ignore failed patch reminants

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 1e3b2ec4..c2e979e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@ dist
 *.pyc
 htmlcov
 .coverage
+*.orig
+*.rej

From 3aeb1a9f4e9094b9882b7f7daddbf687161968f6 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 16 Mar 2013 13:57:42 +1100
Subject: [PATCH 110/544] ENH: jail.conf man page

---
 man/jail.conf.5 | 145 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 man/jail.conf.5

diff --git a/man/jail.conf.5 b/man/jail.conf.5
new file mode 100644
index 00000000..7a841f7d
--- /dev/null
+++ b/man/jail.conf.5
@@ -0,0 +1,145 @@
+.TH JAIL.CONF.5 "fail2ban" "jail.conf(5)"
+.SH NAME
+jail.conf \- configuration for the fail2ban server
+.SH SYNOPSIS
+.B jail.conf / jail.local
+
+.B action.d/*.conf action.d/*.local
+
+.B filter.d/*.conf filter.d/*.local
+.SH DESCRIPTION
+Fail2ban has three configuration file types. Action files are the commands for banning and unbanning IP address,
+Filter files tell fail2ban how authentication failures occur, and Jail configurations that map the two together.
+
+There are *.conf files that are distributed by fail2ban and *.local file that contain user overwritten files. 
+It is recommend that *.conf files are not changed. *.local files are where users overwrite their default settings.
+For instance if you require the default [ssh-iptables-ipset] jail create a jail.local with The jail.conf file is
+ the configuration for the fail2ban server. Only overwride the settings you need to change and the rest come from 
+the default *.conf file.
+
+[ssh-iptables-ipset]
+
+enabled = true
+
+.SH DEFAULT
+The following options are applicable to all jails. Their meaning is in the default jail.conf file.
+.TP
+\fBignoreip\fR 
+.TP
+\fBbantime\fR
+.TP
+\fBfindtime\fR
+.TP
+\fBmaxretry\fR
+.TP
+\fBbackend\fR
+.TP
+\fBusedns\fR
+.TP
+.SH ACTION FILES
+Action files specify which commands are executed to ban an IP address. They are located in /etc/fail2ban/action.d.
+
+Like jail.conf files if you desire local changes create a [actionname].local file in the /etc/fail2ban/action.d directory 
+and override the required settings.
+
+The action files are ini files that have two sections, \fBdefination\fR and \fBinit\fR . 
+
+The [init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail.
+
+The commands are specified in the [defination] section as below..
+
+The commands are executed through a system shell so shell redirection and process control is allowed. The commands should
+return 0 to indicate success which will prevent fail2ban attempting to retry (up to \fBmaxretry\fR times to ban the IP again.
+
+The following action parameters are in the [defination] section.
+.TP
+\fBactionstart\fR
+This is the commands that are executed when the jail starts.
+.TP
+\fBactionstop\fR
+This is the commands that are executed when the jail stops.
+.TP
+\fBactioncheck\fR
+This is the command that is before each other action. It checks to see if the environment is ok.
+.TP
+\fBactionban\fR
+This is the command that bans the IP address.
+.TP
+\fBactionunban\fR
+This is the command that unbans the IP address after \fBbantime\fR.
+
+Tags are in <>. All the elements of [init] are tags that are replaced in all action commands. Tags can be added by the
+\fBfail2ban-client\fR using the setctag command.
+
+More that one command is allowed. Each command needs to be on a new line and indented with whitespace with no blank lines. The following defines
+two commands to be executed.
+
+actionban = iptables -I fail2ban-<name> --source <ip> -j DROP
+
+    echo ip=<ip>, match=<match>, time=<time> >> /var/log/fail2ban.log
+
+The following tags are also substituted in the actionban, actionunban and actioncheck (when called before actionban/actionunban).
+.TP
+\fBip\fR
+An IPv4 ip address to be banned. e.g. 192.168.0.2
+.TP
+.TP
+\fBfailures\fR
+The number of times the failure occurred in the log file. e.g. 3
+.TP
+\fBtime\fR
+The unix time of the ban. e.g. 1357508484
+.TP
+\fBmatches\fR
+The concatinated string of the log file lines of the matches that generated the ban.
+
+.SH FILTER FILES
+
+Filter definations are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
+
+These are used to identify failed authenicate attempts in logs and to extract the host IP address or hostname.
+
+Like action files, filter files are ini files. The main section is the [Definition] section.
+
+There are two filter definations used in the [defination] section, failregex and ignoreregex.
+Other definations are allowed and can be used to substitue into other definations with %(defnname). For example.
+
+baduseragents = IE|wget
+
+failregex = useragent=%(baduseragents)
+
+The \fBfailregex\fR and \fBignoreregex\fR have the following meanings:
+
+.TP
+\fBfailregex\fR
+is the regex that will match failed attempts. The tag <HOST> is used as part of the regex and is itself a regex
+for IPv4 addresses and hostnames. fail2ban will work out which one of these it actually is.
+
+.TP
+\fBignoreregex\fR
+is the regex that will be ignored by fail2ban, even if failregex matches.
+
+.PP
+Filters can also have a section called [INCLUDES]. This is used to read other configuration files.
+
+.TP
+\fBbefore\fR
+indicates that this file is read before the [defination] section.
+
+.TP
+\fBafter\fR
+indicates that this file is read after the [defination] section.
+
+.SH AUTHOR
+Fail2ban Written by Cyril Jaquier <cyril.jaquier@fail2ban.org> with many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
+Manual page written by Daniel Black.
+.SH "REPORTING BUGS"
+Report bugs to https://github.com/fail2ban/fail2ban/issues
+.SH COPYRIGHT
+Copyright \(co 2013 Daniel Black
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-server(1)

From 3cffb0c9e03ddd95695a9d8e66a9f03e4bba5875 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 16 Mar 2013 16:18:59 +1100
Subject: [PATCH 111/544] ENH: add test case for testing socket

---
 testcases/servertestcase.py | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 4268df38..9b649a99 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -27,7 +27,7 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest, socket, time, tempfile, os
+import unittest, socket, time, tempfile, os, stat
 from server.server import Server
 from common.exceptions import UnknownJailException
 
@@ -59,12 +59,12 @@ class Transmitter(unittest.TestCase):
 		self.__transm = self.__server._Server__transm
 		self.__server.setLogTarget("/dev/null")
 		self.__server.setLogLevel(0)
-		sock_fd, sock_name = tempfile.mkstemp('fail2ban.sock', 'transmitter')
+		sock_fd, self.__sock_name = tempfile.mkstemp('fail2ban.sock', 'transmitter')
 		os.close(sock_fd)
-		pidfile_fd, pidfile_name = tempfile.mkstemp(
+		pidfile_fd, self.__pidfile_name = tempfile.mkstemp(
 			'fail2ban.pid', 'transmitter')
 		os.close(pidfile_fd)
-		self.__server.start(sock_name, pidfile_name, force=False)
+		self.__server.start(self.__sock_name, self.__pidfile_name, force=False)
 		self.jailName = "TestJail1"
 		self.__server.addJail(self.jailName, "auto")
 
@@ -142,6 +142,22 @@ class Transmitter(unittest.TestCase):
 				self.__transm.proceed(["get", jail, cmd]),
 				(0, outValues[n+1:]))
 
+	def testSocket(self):
+		ss = os.stat(self.__sock_name)
+		self.assertIsNot(stat.S_ISSOCK(ss.st_mode), 0)
+
+	# pid removal is done in server.start
+	# unsure if this was intended
+	#def testPid(self):
+	#	pidfile = self.__pidfile_name
+	#	sp = os.stat(pidfile)
+	#	self.assertIsNot(stat.S_ISREG(sp.st_mode), 0)
+	#	self.assertEquals(stat.S_IMODE(sp.st_mode), stat.S_IRUSR | stat.S_IWUSR)
+	#	
+	#	p = open(pidfile,'r')
+	#	self.assertTrue(int(p.read()))
+	#	p.close()
+
 	def testStopServer(self):
 		self.assertEqual(self.__transm.proceed(["stop"]), (0, None))
 

From 883892a683f59432d5491372e778a40ba5dc9fc7 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 16 Mar 2013 17:55:22 +0000
Subject: [PATCH 112/544] Additional date/time formats for datedetector
 testcases

Also made a note that some workarounds for certain date/time formats
may cause week/year day to be incorrect. This does not affect
functionality of fail2ban so no urgency to fix.
---
 server/datetemplate.py            |  3 +++
 testcases/datedetectortestcase.py | 24 +++++++++++++++++-------
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/server/datetemplate.py b/server/datetemplate.py
index f663862e..9efa2128 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -158,6 +158,7 @@ class DateStrptime(DateTemplate):
 							"pattern" % (opattern, e))
 			if date[0] < 2000:
 				# There is probably no year field in the logs
+				# NOTE: Possibly makes week/year day incorrect
 				date[0] = MyTime.gmtime()[0]
 				# Bug fix for #1241756
 				# If the date is greater than the current time, we suppose
@@ -166,10 +167,12 @@ class DateStrptime(DateTemplate):
 					logSys.debug(
 						u"Correcting deduced year from %d to %d since %f > %f" %
 						(date[0], date[0]-1, time.mktime(date), MyTime.time()))
+					# NOTE: Possibly makes week/year day incorrect
 					date[0] -= 1
 				elif date[1] == 1 and date[2] == 1:
 					# If it is Jan 1st, it is either really Jan 1st or there
 					# is neither month nor day in the log.
+					# NOTE: Possibly makes week/year day incorrect
 					date[1] = MyTime.gmtime()[1]
 					date[2] = MyTime.gmtime()[2]
 		return date
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 34ce22ce..524ff175 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -46,35 +46,45 @@ class DateDetectorTest(unittest.TestCase):
 		date = [2006, 1, 23, 21, 59, 59, 0, 23, 0]
 		dateUnix = 1138049999.0
 		
-		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 	
 	def testGetTime(self):
 		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
-		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		date = [2005, 1, 23, 21, 59, 59, 6, 23, -1]
 		dateUnix = 1106513999.0
 	
-		self.assertEqual(self.__datedetector.getTime(log), date)
+		self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 
 	def testVariousTimes(self):
 		"""Test detection of various common date/time formats f2b should understand
 		"""
-		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		date = [2005, 1, 23, 21, 59, 59, 6, 23, -1]
 		dateUnix = 1106513999.0
 
 		for sdate in (
 			"Jan 23 21:59:59",
+			"Sun Jan 23 21:59:59 2005",
+			"Sun Jan 23 21:59:59",
+			"2005/01/23 21:59:59",
 			"2005.01.23 21:59:59",
 			"23/01/2005 21:59:59",
+			"23/01/05 21:59:59",
+			"23/Jan/2005:21:59:59",
+			"01/23/2005:21:59:59",
+			"2005-01-23 21:59:59",
+			"23-Jan-2005 21:59:59",
+			"23-01-2005 21:59:59",
 			"01-23-2005 21:59:59.252", # reported on f2b, causes Feb29 fix to break
+			#"@4000000041f41e5f00000000", # TAI64N
+			"2005-01-23T21:59:59.252Z", #ISO 8601
+			"2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ
+			"<01/23/05@21:59:59>",
 			):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude
 
-			# TODO (Yarik is confused): figure out why for above it is
-			#      "1" as day of the week which would be Tue, although it
-			#      was Sun
 			self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
 			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 

From 86d48a854f5b8da05a07372365c84139c74cce8b Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 16 Mar 2013 18:18:27 +0000
Subject: [PATCH 113/544] Correct datedetector testcases for TAI64N format

---
 testcases/datedetectortestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 524ff175..d31ed568 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -77,7 +77,7 @@ class DateDetectorTest(unittest.TestCase):
 			"23-Jan-2005 21:59:59",
 			"23-01-2005 21:59:59",
 			"01-23-2005 21:59:59.252", # reported on f2b, causes Feb29 fix to break
-			#"@4000000041f41e5f00000000", # TAI64N
+			"@4000000041f4104f00000000", # TAI64N
 			"2005-01-23T21:59:59.252Z", #ISO 8601
 			"2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ
 			"<01/23/05@21:59:59>",

From 67544d1dd677667c394da6dfb53a120755081144 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 17 Mar 2013 10:52:49 +1100
Subject: [PATCH 114/544] DOC: tags are documented in the jail.conf(5) man page

---
 config/action.d/complain.conf                | 9 ++-------
 config/action.d/dshield.conf                 | 9 ++-------
 config/action.d/dummy.conf                   | 8 ++------
 config/action.d/hostsdeny.conf               | 8 ++------
 config/action.d/ipfilter.conf                | 8 ++------
 config/action.d/ipfw.conf                    | 8 ++------
 config/action.d/iptables-allports.conf       | 8 ++------
 config/action.d/iptables-ipset-proto4.conf   | 4 ++--
 config/action.d/iptables-ipset-proto6.conf   | 4 ++--
 config/action.d/iptables-multiport-log.conf  | 8 ++------
 config/action.d/iptables-multiport.conf      | 8 ++------
 config/action.d/iptables-new.conf            | 8 ++------
 config/action.d/iptables-xt_recent-echo.conf | 8 ++------
 config/action.d/iptables.conf                | 8 ++------
 config/action.d/mail-buffered.conf           | 8 ++------
 config/action.d/mail-whois-lines.conf        | 9 ++-------
 config/action.d/mail-whois.conf              | 8 ++------
 config/action.d/mail.conf                    | 8 ++------
 config/action.d/mynetwatchman.conf           | 8 ++------
 config/action.d/sendmail-buffered.conf       | 8 ++------
 config/action.d/sendmail-whois-lines.conf    | 8 ++------
 config/action.d/sendmail-whois.conf          | 8 ++------
 config/action.d/sendmail.conf                | 8 ++------
 config/action.d/shorewall.conf               | 8 ++------
 24 files changed, 48 insertions(+), 139 deletions(-)

diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf
index 6677ec49..4c2de92b 100644
--- a/config/action.d/complain.conf
+++ b/config/action.d/complain.conf
@@ -52,10 +52,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'`
@@ -67,9 +64,7 @@ actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban =
diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf
index c581af1c..151db28f 100644
--- a/config/action.d/dshield.conf
+++ b/config/action.d/dshield.conf
@@ -54,9 +54,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 # See http://www.dshield.org/specs.html for more on report format/notes
@@ -91,9 +89,7 @@ actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = if [ -f <tmpfile>.first ]; then
@@ -159,7 +155,6 @@ minreportinterval = 3600
 #          submit the batch, even if we haven't reached <lines> yet. Note that
 #          this is only checked on each ban/unban, and that we always send
 #          anything in the buffer on shutdown. Must be greater than
-#          <minreportinterval>.
 # Values:  [ NUM ]  Default: 21600 (6 hours)
 #
 maxbufferage = 21600
diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 12ceefed..ea59881a 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -29,9 +29,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
@@ -39,9 +37,7 @@ actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = printf %%b "-<ip>\n" >> /tmp/fail2ban.dummy
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 8c98420a..b04f2adb 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -28,9 +28,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = IP=<ip> &&
@@ -39,9 +37,7 @@ actionban = IP=<ip> &&
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
diff --git a/config/action.d/ipfilter.conf b/config/action.d/ipfilter.conf
index 991d9e58..d77de9bf 100644
--- a/config/action.d/ipfilter.conf
+++ b/config/action.d/ipfilter.conf
@@ -34,9 +34,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
@@ -45,9 +43,7 @@ actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 # note -r option used to remove matching rule
diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
index 6fd12c19..62612307 100644
--- a/config/action.d/ipfw.conf
+++ b/config/action.d/ipfw.conf
@@ -32,9 +32,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = ipfw add deny tcp from <ip> to <localhost> <port>
@@ -43,9 +41,7 @@ actionban = ipfw add deny tcp from <ip> to <localhost> <port>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
index c7f76c83..a02ba63d 100644
--- a/config/action.d/iptables-allports.conf
+++ b/config/action.d/iptables-allports.conf
@@ -34,9 +34,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
@@ -44,9 +42,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf
index 665d35cf..4221dd8d 100644
--- a/config/action.d/iptables-ipset-proto4.conf
+++ b/config/action.d/iptables-ipset-proto4.conf
@@ -38,7 +38,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <ip>
@@ -46,7 +46,7 @@ actionban = ipset --test fail2ban-<name> <ip> ||  ipset --add fail2ban-<name> <i
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = ipset --test fail2ban-<name> <ip> && ipset --del fail2ban-<name> <ip>
diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf
index e4ceb0d0..d90acd44 100644
--- a/config/action.d/iptables-ipset-proto6.conf
+++ b/config/action.d/iptables-ipset-proto6.conf
@@ -38,7 +38,7 @@ actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
@@ -46,7 +46,7 @@ actionban = ipset add fail2ban-<name> <ip> timeout <bantime> -exist
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = ipset del fail2ban-<name> <ip> -exist
diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf
index 0f4947dd..49958013 100644
--- a/config/action.d/iptables-multiport-log.conf
+++ b/config/action.d/iptables-multiport-log.conf
@@ -42,9 +42,7 @@ actioncheck = iptables -n -L fail2ban-<name>-log >/dev/null
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
@@ -52,9 +50,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j fail2ban-<name>-log
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j fail2ban-<name>-log
diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf
index 8b15ad86..ab0ee8de 100644
--- a/config/action.d/iptables-multiport.conf
+++ b/config/action.d/iptables-multiport.conf
@@ -32,9 +32,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
@@ -42,9 +40,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf
index 64f54582..12f398c7 100644
--- a/config/action.d/iptables-new.conf
+++ b/config/action.d/iptables-new.conf
@@ -34,9 +34,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
@@ -44,9 +42,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf
index 170fef07..887311be 100644
--- a/config/action.d/iptables-xt_recent-echo.conf
+++ b/config/action.d/iptables-xt_recent-echo.conf
@@ -46,9 +46,7 @@ actioncheck = test -e /proc/net/xt_recent/fail2ban-<name>
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
@@ -56,9 +54,7 @@ actionban = echo +<ip> > /proc/net/xt_recent/fail2ban-<name>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = echo -<ip> > /proc/net/xt_recent/fail2ban-<name>
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index 083065fc..a3412f6b 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -32,9 +32,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
@@ -42,9 +40,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index 6fd51d23..94a60e3b 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -43,9 +43,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
@@ -62,9 +60,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
index 1ace68f6..2120432e 100644
--- a/config/action.d/mail-whois-lines.conf
+++ b/config/action.d/mail-whois-lines.conf
@@ -34,10 +34,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <failtime>  unix timestamp of the last failure
-#          <bantime>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Hi,\n
@@ -53,9 +50,7 @@ actionban = printf %%b "Hi,\n
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <bantime>  unix timestamp of the ban time
-#          <unbantime>  unix timestamp of the unban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 1581c42c..3293c7a2 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -34,9 +34,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Hi,\n
@@ -50,9 +48,7 @@ actionban = printf %%b "Hi,\n
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index 02946b43..f9942e10 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -34,9 +34,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Hi,\n
@@ -48,9 +46,7 @@ actionban = printf %%b "Hi,\n
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/mynetwatchman.conf b/config/action.d/mynetwatchman.conf
index 3ae3e6db..06f16db6 100644
--- a/config/action.d/mynetwatchman.conf
+++ b/config/action.d/mynetwatchman.conf
@@ -49,9 +49,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 #
@@ -71,9 +69,7 @@ actionban = MNWLOGIN=`perl -e '$s=shift;$s=~s/([\W])/"%%".uc(sprintf("%%2.2x",or
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban =
diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index 80f71374..ce4479e8 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -52,9 +52,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
@@ -74,9 +72,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index dfbf9ff8..a4b53b97 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -42,9 +42,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
@@ -64,9 +62,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
index e6a15fb5..f63fd36f 100644
--- a/config/action.d/sendmail-whois.conf
+++ b/config/action.d/sendmail-whois.conf
@@ -42,9 +42,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
@@ -62,9 +60,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
index 5bb75575..569b3bfa 100644
--- a/config/action.d/sendmail.conf
+++ b/config/action.d/sendmail.conf
@@ -42,9 +42,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
@@ -60,9 +58,7 @@ actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = 
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index 4bb6f4dc..aca3a256 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -36,9 +36,7 @@ actioncheck =
 # Option:  actionban
 # Notes.:  command executed when banning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionban = shorewall drop <ip>
@@ -46,9 +44,7 @@ actionban = shorewall drop <ip>
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
-# Tags:    <ip>  IP address
-#          <failures>  number of failures
-#          <time>  unix timestamp of the ban time
+# Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
 actionunban = shorewall allow <ip>

From 936a29f7a6e73f51628d687085f9e66ddebbc6eb Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 17 Mar 2013 12:31:29 +1100
Subject: [PATCH 115/544] BF: add missing items from MANIFEST, used by python
 setup.py sdist

---
 MANIFEST | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index bedfe560..21c7a03f 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -42,6 +42,7 @@ server/banmanager.py
 server/datetemplate.py
 server/mytime.py
 server/failregex.py
+testcases/files/testcase-usedns.log
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
@@ -57,6 +58,7 @@ testcases/files/testcase04.log
 setup.py
 setup.cfg
 common/__init__.py
+common/exceptions.py
 common/helpers.py
 common/version.py
 common/protocol.py
@@ -88,6 +90,17 @@ config/filter.d/vsftpd.conf
 config/filter.d/webmin-auth.conf
 config/filter.d/wuftpd.conf
 config/filter.d/xinetd-fail.conf
+config/filter.d/asterisk.conf
+config/filter.d/dovecot.conf
+config/filter.d/dropbear.conf
+config/filter.d/lighttpd-auth.conf
+config/filter.d/recidive.conf
+config/filter.d/roundcube-auth.conf
+config/action.d/dummy.conf
+config/action.d/iptables-ipset-proto4.conf
+config/action.d/iptables-ipset-proto6.conf
+config/action.d/iptables-xt_recent-echo.conf
+config/action.d/route.conf
 config/action.d/complain.conf
 config/action.d/dshield.conf
 config/action.d/hostsdeny.conf
@@ -110,6 +123,7 @@ config/action.d/sendmail-whois-lines.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
+man/jail.conf.5
 man/fail2ban-client.h2m
 man/fail2ban-server.1
 man/fail2ban-server.h2m

From 43b8a66482a89392067c7271d423954fea8d7eb7 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 17 Mar 2013 09:18:14 +0000
Subject: [PATCH 116/544] Update MANIFEST with and author of
 testcases/sockettestcase.py

---
 MANIFEST                    | 1 +
 testcases/sockettestcase.py | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/MANIFEST b/MANIFEST
index bedfe560..d3890034 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -50,6 +50,7 @@ testcases/__init__.py
 testcases/datedetectortestcase.py
 testcases/actiontestcase.py
 testcases/servertestcase.py
+testcases/sockettestcase.py
 testcases/files/testcase01.log
 testcases/files/testcase02.log
 testcases/files/testcase03.log
diff --git a/testcases/sockettestcase.py b/testcases/sockettestcase.py
index b7258c0f..4cd5a687 100644
--- a/testcases/sockettestcase.py
+++ b/testcases/sockettestcase.py
@@ -17,14 +17,14 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
+# Author: Steven Hiscocks
 # 
 # $Revision$
 
-__author__ = "Cyril Jaquier"
+__author__ = "Steven Hiscocks"
 __version__ = "$Revision$"
 __date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 
 import unittest, time, tempfile, os, threading

From 99bf14851fc003b44177b2318d254adda41ec6bd Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 22 Mar 2013 09:20:21 -0400
Subject: [PATCH 117/544] BF+TST: Introduce delay before stopping all jails in
 testStartStopAllJail. fixes #146

---
 testcases/servertestcase.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 4268df38..144e1b01 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -211,6 +211,10 @@ class Transmitter(unittest.TestCase):
 			self.__transm.proceed(["start", self.jailName]), (0, None))
 		self.assertEqual(
 			self.__transm.proceed(["start", "TestJail2"]), (0, None))
+		# yoh: workaround for gh-146.  I still think that there is some
+		#      race condition and missing locking somewhere, but for now
+		#      giving it a small delay reliably helps to proceed with tests
+		time.sleep(0.1)
 		self.assertEqual(self.__transm.proceed(["stop", "all"]), (0, None))
 		time.sleep(1)
 		self.assertRaises(

From 989fc06a420a6f8f356c13d9a68a3173dcd39889 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 22 Mar 2013 09:26:33 -0400
Subject: [PATCH 118/544] DOC: DEVELOP -- mention TST commit tag, adjust
 formatting in Releasing

---
 DEVELOP | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index 09bf7277..623aee12 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -44,7 +44,7 @@ coverage html
 
 Then look at htmlcov/index.html and see how much coverage your test cases
 exert over the codebase. Full coverage is a good thing however it may not be
-complete. Try to ensure tests cover as many independant paths through the
+complete. Try to ensure tests cover as many independent paths through the
 code.
 
 Manual Execution. To run in a development environment do:
@@ -67,7 +67,7 @@ status test
 
 
 Coding Standards
-================ 
+================
 
 Style
 -----
@@ -106,9 +106,12 @@ Git
 
 Use the following tags in your commit messages:
 
-'ENH:' for enhancements
 'BF:' for bug fixes
 'DOC:' for documentation fixes
+'ENH:' for enhancements
+'TST:' for commits concerning tests only (thus not touching the main code-base)
+
+Multiple tags could be joined with +, e.g. "BF+TST:".
 
 Adding Actions
 --------------
@@ -246,24 +249,30 @@ Takes care about executing start/check/ban/unban/stop commands
 Releasing
 =========
 
-Ensure the version is correct in ./common/version.py
+# Ensure the version is correct in ./common/version.py
 
-Add/finalize the corresponding entry in the ChangeLog
+# Add/finalize the corresponding entry in the ChangeLog
 
-# update man pages
-(cd man ; ./generate-man )
+# Update man pages
 
-git commit -m 'update man pages for release' man/*
+  (cd man ; ./generate-man )
+  git commit -m 'update man pages for release' man/*
 
-python setup.py check
-python setup.py sdist
-python setup.py bdist_rpm
-python setup.py upload
+# Make sure the tests pass
 
-Run the following and update the wiki with output:
+  ./fail2ban-testcases-all
 
-python -c 'import common.protocol; common.protocol.printWiki()'
+# Prepare/upload source and rpm binary distributions
 
-email users and development list of release
+  python setup.py check
+  python setup.py sdist
+  python setup.py bdist_rpm
+  python setup.py upload
+
+# Run the following and update the wiki with output:
+
+  python -c 'import common.protocol; common.protocol.printWiki()'
+
+# Email users and development list of release
 
 TODO notifying distributors etc.

From ec87e3edbd7ac07d2bea1d60db6627cfc531f8e7 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 22 Mar 2013 21:15:37 +0000
Subject: [PATCH 119/544] TST: Break out server testcases that modify logging
 settings

---
 fail2ban-testcases          |   3 +
 testcases/servertestcase.py | 229 ++++++++++++++++++++----------------
 2 files changed, 128 insertions(+), 104 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 2ab59f6a..7efe183f 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -175,6 +175,9 @@ for Filter_ in filters:
 	tests.addTest(unittest.makeSuite(
 		filtertestcase.get_monitor_failures_testcase(Filter_)))
 
+# Server test for logging elements which break logging used to support
+# testcases analysis
+tests.addTest(unittest.makeSuite(servertestcase.TransmitterLogging))
 
 #
 # Run the tests
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 144e1b01..ffb057a9 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -50,27 +50,29 @@ class StartStop(unittest.TestCase):
 		time.sleep(1)
 		self.__server.stopJail(name)
 
+class TestServer(Server):
+	def setLogLevel(self, *args, **kwargs):
+		pass
+	def setLogTarget(self, *args, **kwargs):
+		pass
 
-class Transmitter(unittest.TestCase):
+class TransmitterBase(unittest.TestCase):
 	
 	def setUp(self):
 		"""Call before every test case."""
-		self.__server = Server()
-		self.__transm = self.__server._Server__transm
-		self.__server.setLogTarget("/dev/null")
-		self.__server.setLogLevel(0)
+		self.transm = self.server._Server__transm
 		sock_fd, sock_name = tempfile.mkstemp('fail2ban.sock', 'transmitter')
 		os.close(sock_fd)
 		pidfile_fd, pidfile_name = tempfile.mkstemp(
 			'fail2ban.pid', 'transmitter')
 		os.close(pidfile_fd)
-		self.__server.start(sock_name, pidfile_name, force=False)
+		self.server.start(sock_name, pidfile_name, force=False)
 		self.jailName = "TestJail1"
-		self.__server.addJail(self.jailName, "auto")
+		self.server.addJail(self.jailName, "auto")
 
 	def tearDown(self):
 		"""Call after every test case."""
-		self.__server.quit()
+		self.server.quit()
 
 	def setGetTest(self, cmd, inValue, outValue=None, jail=None):
 		setCmd = ["set", cmd, inValue]
@@ -81,8 +83,8 @@ class Transmitter(unittest.TestCase):
 		if outValue is None:
 			outValue = inValue
 
-		self.assertEqual(self.__transm.proceed(setCmd), (0, outValue))
-		self.assertEqual(self.__transm.proceed(getCmd), (0, outValue))
+		self.assertEqual(self.transm.proceed(setCmd), (0, outValue))
+		self.assertEqual(self.transm.proceed(getCmd), (0, outValue))
 
 	def setGetTestNOK(self, cmd, inValue, jail=None):
 		setCmd = ["set", cmd, inValue]
@@ -92,30 +94,30 @@ class Transmitter(unittest.TestCase):
 			getCmd.insert(1, jail)
 
 		# Get initial value before trying invalid value
-		initValue = self.__transm.proceed(getCmd)[1]
-		self.assertEqual(self.__transm.proceed(setCmd)[0], 1)
+		initValue = self.transm.proceed(getCmd)[1]
+		self.assertEqual(self.transm.proceed(setCmd)[0], 1)
 		# Check after failed set that value is same as previous
-		self.assertEqual(self.__transm.proceed(getCmd), (0, initValue))
+		self.assertEqual(self.transm.proceed(getCmd), (0, initValue))
 
 	def jailAddDelTest(self, cmd, values, jail):
 		cmdAdd = "add" + cmd
 		cmdDel = "del" + cmd
 
 		self.assertEqual(
-			self.__transm.proceed(["get", jail, cmd]), (0, []))
+			self.transm.proceed(["get", jail, cmd]), (0, []))
 		for n, value in enumerate(values):
 			self.assertEqual(
-				self.__transm.proceed(["set", jail, cmdAdd, value]),
+				self.transm.proceed(["set", jail, cmdAdd, value]),
 				(0, values[:n+1]))
 			self.assertEqual(
-				self.__transm.proceed(["get", jail, cmd]),
+				self.transm.proceed(["get", jail, cmd]),
 				(0, values[:n+1]))
 		for n, value in enumerate(values):
 			self.assertEqual(
-				self.__transm.proceed(["set", jail, cmdDel, value]),
+				self.transm.proceed(["set", jail, cmdDel, value]),
 				(0, values[n+1:]))
 			self.assertEqual(
-				self.__transm.proceed(["get", jail, cmd]),
+				self.transm.proceed(["get", jail, cmd]),
 				(0, values[n+1:]))
 
 	def jailAddDelRegexTest(self, cmd, inValues, outValues, jail):
@@ -126,111 +128,94 @@ class Transmitter(unittest.TestCase):
 			outValues = inValues
 
 		self.assertEqual(
-			self.__transm.proceed(["get", jail, cmd]), (0, []))
+			self.transm.proceed(["get", jail, cmd]), (0, []))
 		for n, value in enumerate(inValues):
 			self.assertEqual(
-				self.__transm.proceed(["set", jail, cmdAdd, value]),
+				self.transm.proceed(["set", jail, cmdAdd, value]),
 				(0, outValues[:n+1]))
 			self.assertEqual(
-				self.__transm.proceed(["get", jail, cmd]),
+				self.transm.proceed(["get", jail, cmd]),
 				(0, outValues[:n+1]))
 		for n, value in enumerate(inValues):
 			self.assertEqual(
-				self.__transm.proceed(["set", jail, cmdDel, 0]), # First item
+				self.transm.proceed(["set", jail, cmdDel, 0]), # First item
 				(0, outValues[n+1:]))
 			self.assertEqual(
-				self.__transm.proceed(["get", jail, cmd]),
+				self.transm.proceed(["get", jail, cmd]),
 				(0, outValues[n+1:]))
 
+class Transmitter(TransmitterBase):
+
+	def setUp(self):
+		self.server = TestServer()
+		super(Transmitter, self).setUp()
+
 	def testStopServer(self):
-		self.assertEqual(self.__transm.proceed(["stop"]), (0, None))
+		self.assertEqual(self.transm.proceed(["stop"]), (0, None))
 
 	def testPing(self):
-		self.assertEqual(self.__transm.proceed(["ping"]), (0, "pong"))
+		self.assertEqual(self.transm.proceed(["ping"]), (0, "pong"))
 
 	def testSleep(self):
 		t0 = time.time()
-		self.assertEqual(self.__transm.proceed(["sleep", "1"]), (0, None))
+		self.assertEqual(self.transm.proceed(["sleep", "1"]), (0, None))
 		t1 = time.time()
 		# Approx 1 second delay
 		self.assertAlmostEqual(t1 - t0, 1, places=2)
 
-	def testLogTarget(self):
-		logTargets = []
-		for _ in xrange(3):
-			tmpFile = tempfile.mkstemp("fail2ban", "transmitter")
-			logTargets.append(tmpFile[1])
-			os.close(tmpFile[0])
-		for logTarget in logTargets:
-			self.setGetTest("logtarget", logTarget)
-
-		# If path is invalid, do not change logtarget
-		value = "/this/path/should/not/exist"
-		self.setGetTestNOK("logtarget", value)
-
-		self.__transm.proceed(["set", "/dev/null"])
-		for logTarget in logTargets:
-			os.remove(logTarget)
-
-	def testLogLevel(self):
-		self.setGetTest("loglevel", "4", 4)
-		self.setGetTest("loglevel", "2", 2)
-		self.setGetTest("loglevel", "-1", -1)
-		self.setGetTestNOK("loglevel", "Bird")
-
 	def testAddJail(self):
 		jail2 = "TestJail2"
 		jail3 = "TestJail3"
 		jail4 = "TestJail4"
 		self.assertEqual(
-			self.__transm.proceed(["add", jail2, "polling"]), (0, jail2))
-		self.assertEqual(self.__transm.proceed(["add", jail3]), (0, jail3))
+			self.transm.proceed(["add", jail2, "polling"]), (0, jail2))
+		self.assertEqual(self.transm.proceed(["add", jail3]), (0, jail3))
 		self.assertEqual(
-			self.__transm.proceed(["add", jail4, "invalid backend"])[0], 1)
+			self.transm.proceed(["add", jail4, "invalid backend"])[0], 1)
 		self.assertEqual(
-			self.__transm.proceed(["add", jail4, "auto"]), (0, jail4))
+			self.transm.proceed(["add", jail4, "auto"]), (0, jail4))
 		# Duplicate Jail
 		self.assertEqual(
-			self.__transm.proceed(["add", self.jailName, "polling"])[0], 1)
+			self.transm.proceed(["add", self.jailName, "polling"])[0], 1)
 		# All name is reserved
 		self.assertEqual(
-			self.__transm.proceed(["add", "all", "polling"])[0], 1)
+			self.transm.proceed(["add", "all", "polling"])[0], 1)
 
 	def testStartStopJail(self):
 		self.assertEqual(
-			self.__transm.proceed(["start", self.jailName]), (0, None))
+			self.transm.proceed(["start", self.jailName]), (0, None))
 		time.sleep(1)
 		self.assertEqual(
-			self.__transm.proceed(["stop", self.jailName]), (0, None))
+			self.transm.proceed(["stop", self.jailName]), (0, None))
 		self.assertRaises(
-			UnknownJailException, self.__server.isAlive, self.jailName)
+			UnknownJailException, self.server.isAlive, self.jailName)
 
 	def testStartStopAllJail(self):
-		self.__server.addJail("TestJail2", "auto")
+		self.server.addJail("TestJail2", "auto")
 		self.assertEqual(
-			self.__transm.proceed(["start", self.jailName]), (0, None))
+			self.transm.proceed(["start", self.jailName]), (0, None))
 		self.assertEqual(
-			self.__transm.proceed(["start", "TestJail2"]), (0, None))
+			self.transm.proceed(["start", "TestJail2"]), (0, None))
 		# yoh: workaround for gh-146.  I still think that there is some
 		#      race condition and missing locking somewhere, but for now
 		#      giving it a small delay reliably helps to proceed with tests
 		time.sleep(0.1)
-		self.assertEqual(self.__transm.proceed(["stop", "all"]), (0, None))
+		self.assertEqual(self.transm.proceed(["stop", "all"]), (0, None))
 		time.sleep(1)
 		self.assertRaises(
-			UnknownJailException, self.__server.isAlive, self.jailName)
+			UnknownJailException, self.server.isAlive, self.jailName)
 		self.assertRaises(
-			UnknownJailException, self.__server.isAlive, "TestJail2")
+			UnknownJailException, self.server.isAlive, "TestJail2")
 
 	def testJailIdle(self):
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "idle", "on"]),
+			self.transm.proceed(["set", self.jailName, "idle", "on"]),
 			(0, True))
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "idle", "off"]),
+			self.transm.proceed(["set", self.jailName, "idle", "off"]),
 			(0, False))
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "idle", "CAT"])[0],
+			self.transm.proceed(["set", self.jailName, "idle", "CAT"])[0],
 			1)
 
 	def testJailFindTime(self):
@@ -253,28 +238,28 @@ class Transmitter(unittest.TestCase):
 		# Safe default should be "no"
 		value = "Fish"
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "usedns", value]),
+			self.transm.proceed(["set", self.jailName, "usedns", value]),
 			(0, "no"))
 
 	def testJailBanIP(self):
-		self.__server.startJail(self.jailName) # Jail must be started
+		self.server.startJail(self.jailName) # Jail must be started
 
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "banip", "127.0.0.1"]),
+			self.transm.proceed(["set", self.jailName, "banip", "127.0.0.1"]),
 			(0, "127.0.0.1"))
 		time.sleep(1) # Give chance to ban
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "banip", "Badger"]),
+			self.transm.proceed(["set", self.jailName, "banip", "Badger"]),
 			(0, "Badger")) #NOTE: Is IP address validated? Is DNS Lookup done?
 		time.sleep(1) # Give chance to ban
 		# Unban IP
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "unbanip", "127.0.0.1"]),
 			(0, "127.0.0.1"))
 		# Unban IP which isn't banned
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "unbanip", "192.168.1.1"])[0],1)
 
 	def testJailMaxRetry(self):
@@ -296,22 +281,22 @@ class Transmitter(unittest.TestCase):
 		# Try duplicates
 		value = "testcases/files/testcase04.log"
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "addlogpath", value]),
+			self.transm.proceed(["set", self.jailName, "addlogpath", value]),
 			(0, [value]))
 		# Will silently ignore duplicate
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "addlogpath", value]),
+			self.transm.proceed(["set", self.jailName, "addlogpath", value]),
 			(0, [value]))
 		self.assertEqual(
-			self.__transm.proceed(["get", self.jailName, "logpath"]),
+			self.transm.proceed(["get", self.jailName, "logpath"]),
 			(0, [value]))
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "dellogpath", value]),
+			self.transm.proceed(["set", self.jailName, "dellogpath", value]),
 			(0, []))
 
 		# Invalid file
 		value = "this_file_shouldn't_exist"
-		result = self.__transm.proceed(
+		result = self.transm.proceed(
 			["set", self.jailName, "addlogpath", value])
 		self.assertTrue(isinstance(result[1], IOError))
 
@@ -329,18 +314,18 @@ class Transmitter(unittest.TestCase):
 		# Try duplicates
 		value = "127.0.0.1"
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "addignoreip", value]),
+			self.transm.proceed(["set", self.jailName, "addignoreip", value]),
 			(0, [value]))
 		# Will allow duplicate
 		#NOTE: Should duplicates be allowed, or silent ignore like logpath?
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "addignoreip", value]),
+			self.transm.proceed(["set", self.jailName, "addignoreip", value]),
 			(0, [value, value]))
 		self.assertEqual(
-			self.__transm.proceed(["get", self.jailName, "ignoreip"]),
+			self.transm.proceed(["get", self.jailName, "ignoreip"]),
 			(0, [value, value]))
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "delignoreip", value]),
+			self.transm.proceed(["set", self.jailName, "delignoreip", value]),
 			(0, [value]))
 
 	def testJailRegex(self):
@@ -359,11 +344,11 @@ class Transmitter(unittest.TestCase):
 		)
 
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "addfailregex", "No host regex"])[0],
 			1)
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "addfailregex", 654])[0],
 			1)
 
@@ -383,25 +368,25 @@ class Transmitter(unittest.TestCase):
 		)
 
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "addignoreregex", "Invalid [regex"])[0],
 			1)
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "addignoreregex", 50])[0],
 			1)
 
 	def testStatus(self):
 		jails = [self.jailName]
-		self.assertEqual(self.__transm.proceed(["status"]),
+		self.assertEqual(self.transm.proceed(["status"]),
 			(0, [('Number of jail', len(jails)), ('Jail list', ", ".join(jails))]))
-		self.__server.addJail("TestJail2", "auto")
+		self.server.addJail("TestJail2", "auto")
 		jails.append("TestJail2")
-		self.assertEqual(self.__transm.proceed(["status"]),
+		self.assertEqual(self.transm.proceed(["status"]),
 			(0, [('Number of jail', len(jails)), ('Jail list', ", ".join(jails))]))
 
 	def testJailStatus(self):
-		self.assertEqual(self.__transm.proceed(["status", self.jailName]),
+		self.assertEqual(self.transm.proceed(["status", self.jailName]),
 			(0,
 				[
 					('filter', [
@@ -436,54 +421,90 @@ class Transmitter(unittest.TestCase):
 		]
 
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "addaction", action]),
+			self.transm.proceed(["set", self.jailName, "addaction", action]),
 			(0, action))
 		self.assertEqual(
-			self.__transm.proceed(["get", self.jailName, "addaction", action]),
+			self.transm.proceed(["get", self.jailName, "addaction", action]),
 			(0, action))
 		for cmd, value in zip(cmdList, cmdValueList):
 			self.assertEqual(
-				self.__transm.proceed(
+				self.transm.proceed(
 					["set", self.jailName, cmd, action, value]),
 				(0, value))
 		for cmd, value in zip(cmdList, cmdValueList):
 			self.assertEqual(
-				self.__transm.proceed(["get", self.jailName, cmd, action]),
+				self.transm.proceed(["get", self.jailName, cmd, action]),
 				(0, value))
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "setcinfo", action, "KEY", "VALUE"]),
 			(0, "VALUE"))
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["get", self.jailName, "cinfo", action, "KEY"]),
 			(0, "VALUE"))
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["get", self.jailName, "cinfo", action, "InvalidKey"])[0],
 			1)
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "delcinfo", action, "KEY"]),
 			(0, None))
 		self.assertEqual(
-			self.__transm.proceed(["set", self.jailName, "delaction", action]),
+			self.transm.proceed(["set", self.jailName, "delaction", action]),
 			(0, None))
 		self.assertEqual(
-			self.__transm.proceed(
+			self.transm.proceed(
 				["set", self.jailName, "delaction", "Doesn't exist"])[0],1)
 
 	def testNOK(self):
-		self.assertEqual(self.__transm.proceed(["INVALID", "COMMAND"])[0],1)
+		self.assertEqual(self.transm.proceed(["INVALID", "COMMAND"])[0],1)
 
 	def testSetNOK(self):
 		self.assertEqual(
-			self.__transm.proceed(["set", "INVALID", "COMMAND"])[0],1)
+			self.transm.proceed(["set", "INVALID", "COMMAND"])[0],1)
 
 	def testGetNOK(self):
 		self.assertEqual(
-			self.__transm.proceed(["get", "INVALID", "COMMAND"])[0],1)
+			self.transm.proceed(["get", "INVALID", "COMMAND"])[0],1)
 
 	def testStatusNOK(self):
 		self.assertEqual(
-			self.__transm.proceed(["status", "INVALID", "COMMAND"])[0],1)
+			self.transm.proceed(["status", "INVALID", "COMMAND"])[0],1)
+
+class TransmitterLogging(TransmitterBase):
+
+	def setUp(self):
+		self.server = Server()
+		self.server.setLogTarget("/dev/null")
+		self.server.setLogLevel(0)
+		super(TransmitterLogging, self).setUp()
+
+	def testLogTarget(self):
+		logTargets = []
+		for _ in xrange(3):
+			tmpFile = tempfile.mkstemp("fail2ban", "transmitter")
+			logTargets.append(tmpFile[1])
+			os.close(tmpFile[0])
+		for logTarget in logTargets:
+			self.setGetTest("logtarget", logTarget)
+
+		# If path is invalid, do not change logtarget
+		value = "/this/path/should/not/exist"
+		self.setGetTestNOK("logtarget", value)
+
+		self.transm.proceed(["set", "/dev/null"])
+		for logTarget in logTargets:
+			os.remove(logTarget)
+
+		self.setGetTest("logtarget", "STDOUT")
+		self.setGetTest("logtarget", "STDERR")
+		self.setGetTest("logtarget", "SYSLOG")
+
+	def testLogLevel(self):
+		self.setGetTest("loglevel", "4", 4)
+		self.setGetTest("loglevel", "2", 2)
+		self.setGetTest("loglevel", "-1", -1)
+		self.setGetTest("loglevel", "0", 0)
+		self.setGetTestNOK("loglevel", "Bird")

From 7a442f079f9afdce2192aace6858329e16094589 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 22 Mar 2013 21:19:31 +0000
Subject: [PATCH 120/544] BF: When changing log target with python2.{4,5}
 handle KeyError

---
 server/server.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/server.py b/server/server.py
index 0e1b6c97..a0824f1d 100644
--- a/server/server.py
+++ b/server/server.py
@@ -379,7 +379,7 @@ class Server:
 				try:
 					handler.flush()
 					handler.close()
-				except ValueError:
+				except (ValueError, KeyError):
 					if sys.version_info >= (2,6):
 						raise
 					# is known to be thrown after logging was shutdown once

From 8ce986e9f9b27225619b8e4224c20739441d576a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 23 Mar 2013 09:15:55 +1100
Subject: [PATCH 121/544] DOC: punishment claimed

---
 setup.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.cfg b/setup.cfg
index 53e7276a..03fa6dab 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -6,7 +6,7 @@ formats=bztar
 
 [bdist_rpm]
 release = 1
-packager = Yaroslav Halchenko <debian@onerussian.com>
+packager = Yaroslav Halchenko <debian@onerussian.com>, Daniel Black <daniel.subs@internode.on.net>
 doc_files = DEVELOP
             README
             THANKS

From 847c474b11ed91b8c3b3ef415a74cec6902d27f5 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 23 Mar 2013 09:17:40 +1100
Subject: [PATCH 122/544] DOC: init -> Init, defination -> Defination. Improved
 intro

---
 man/jail.conf.5 | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/man/jail.conf.5 b/man/jail.conf.5
index 7a841f7d..c2c096d6 100644
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@@ -12,14 +12,20 @@ Fail2ban has three configuration file types. Action files are the commands for b
 Filter files tell fail2ban how authentication failures occur, and Jail configurations that map the two together.
 
 There are *.conf files that are distributed by fail2ban and *.local file that contain user overwritten files. 
-It is recommend that *.conf files are not changed. *.local files are where users overwrite their default settings.
-For instance if you require the default [ssh-iptables-ipset] jail create a jail.local with The jail.conf file is
- the configuration for the fail2ban server. Only overwride the settings you need to change and the rest come from 
-the default *.conf file.
+It is recommended that *.conf files are not changed. *.local files are where users overwrite their default settings.
+For instance if you require the default [ssh-iptables-ipset] jail create a jail.local to extend jail.conf (
+the configuration for the fail2ban server). The jail.local file will be the following if you only need to enable
+it:
 
+.TP
+\fBjail.local\fR
 [ssh-iptables-ipset]
 
 enabled = true
+.TP
+
+Only overwride the settings you need to change and the rest of the configuration comes from the corresponding
+*.conf file.
 
 .SH DEFAULT
 The following options are applicable to all jails. Their meaning is in the default jail.conf file.
@@ -42,16 +48,16 @@ Action files specify which commands are executed to ban an IP address. They are
 Like jail.conf files if you desire local changes create a [actionname].local file in the /etc/fail2ban/action.d directory 
 and override the required settings.
 
-The action files are ini files that have two sections, \fBdefination\fR and \fBinit\fR . 
+The action files are ini files that have two sections, \fBDefination\fR and \fBInit\fR . 
 
-The [init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail.
+The [Init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail.
 
-The commands are specified in the [defination] section as below..
+The commands are specified in the [Defination] section as below..
 
 The commands are executed through a system shell so shell redirection and process control is allowed. The commands should
 return 0 to indicate success which will prevent fail2ban attempting to retry (up to \fBmaxretry\fR times to ban the IP again.
 
-The following action parameters are in the [defination] section.
+The following action parameters are in the [Defination] section.
 .TP
 \fBactionstart\fR
 This is the commands that are executed when the jail starts.
@@ -68,7 +74,7 @@ This is the command that bans the IP address.
 \fBactionunban\fR
 This is the command that unbans the IP address after \fBbantime\fR.
 
-Tags are in <>. All the elements of [init] are tags that are replaced in all action commands. Tags can be added by the
+Tags are in <>. All the elements of [Init] are tags that are replaced in all action commands. Tags can be added by the
 \fBfail2ban-client\fR using the setctag command.
 
 More that one command is allowed. Each command needs to be on a new line and indented with whitespace with no blank lines. The following defines
@@ -101,7 +107,7 @@ These are used to identify failed authenicate attempts in logs and to extract th
 
 Like action files, filter files are ini files. The main section is the [Definition] section.
 
-There are two filter definations used in the [defination] section, failregex and ignoreregex.
+There are two filter definations used in the [Defination] section, failregex and ignoreregex.
 Other definations are allowed and can be used to substitue into other definations with %(defnname). For example.
 
 baduseragents = IE|wget
@@ -124,11 +130,11 @@ Filters can also have a section called [INCLUDES]. This is used to read other co
 
 .TP
 \fBbefore\fR
-indicates that this file is read before the [defination] section.
+indicates that this file is read before the [Defination] section.
 
 .TP
 \fBafter\fR
-indicates that this file is read after the [defination] section.
+indicates that this file is read after the [Defination] section.
 
 .SH AUTHOR
 Fail2ban Written by Cyril Jaquier <cyril.jaquier@fail2ban.org> with many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.

From 996e23455c941f02910d65eea7eef2fcaccde76d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 22 Mar 2013 20:56:45 -0400
Subject: [PATCH 123/544] DOC: reverted unneeded stripping of DoW + added
 comments for why [:6]

---
 testcases/datedetectortestcase.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index d31ed568..a2946587 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -45,15 +45,18 @@ class DateDetectorTest(unittest.TestCase):
 		log = "1138049999 [sshd] error: PAM: Authentication failure"
 		date = [2006, 1, 23, 21, 59, 59, 0, 23, 0]
 		dateUnix = 1138049999.0
-		
-		self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
+
+		self.assertEqual(self.__datedetector.getTime(log), date)
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 	
 	def testGetTime(self):
 		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
 		date = [2005, 1, 23, 21, 59, 59, 6, 23, -1]
 		dateUnix = 1106513999.0
-	
+		# yoh: testing only up to 6 elements, since the day of the week
+		#      is not correctly determined atm, since year is not present
+		#      in the log entry.  Since this doesn't effect the operation
+		#      of fail2ban -- we just ignore incorrect day of the week
 		self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 
@@ -85,6 +88,7 @@ class DateDetectorTest(unittest.TestCase):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude
 
+			# yoh: on [:6] see in above test
 			self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
 			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 

From b5cbee9e654a36cd4fdd12b77d81c47d8c383c13 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 23 Mar 2013 20:12:31 +1100
Subject: [PATCH 124/544] DOC: add fail2ban.1 manual page

---
 MANIFEST       |  1 +
 man/fail2ban.1 | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 man/fail2ban.1

diff --git a/MANIFEST b/MANIFEST
index 21c7a03f..d64b8073 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -123,6 +123,7 @@ config/action.d/sendmail-whois-lines.conf
 config/action.d/shorewall.conf
 config/fail2ban.conf
 man/fail2ban-client.1
+man/fail2ban.1
 man/jail.conf.5
 man/fail2ban-client.h2m
 man/fail2ban-server.1
diff --git a/man/fail2ban.1 b/man/fail2ban.1
new file mode 100644
index 00000000..1198c07c
--- /dev/null
+++ b/man/fail2ban.1
@@ -0,0 +1,36 @@
+.TH FAIL2BAN "1"
+.SH NAME
+fail2ban \- a set of server and client programs to limit brute force authentication attempts.
+.SH DESCRIPTION
+Fail2Ban consists of a client, server and some configuration files to achieve limiting 
+brute force of authenitcation attempts.
+
+The server program is \fBfail2ban-server\fR which is configured from the configuration files. The
+fail2ban-server can also be configured using the \fBfail2ban-client\fR. 
+
+For details on the configuration of fail2ban see the jail.conf(5) manual page.
+
+For details on the configuration of fail2ban-server see the fail2ban-server(1) manual page.
+
+For details on the configuration of fail2ban-client see the fail2ban-client(1) manual page.
+
+For testing regular expressions assocated with filter using the fail2ban-regex program may be of
+use and its manual page is fail2ban-regex(1).
+
+.SH FILES
+\fI/etc/fail2ban/*\fR
+.SH AUTHOR
+Manual page written by Daniel Black
+.SH "REPORTING BUGS"
+Report bugs to https://github.com/fail2ban/fail2ban/issues
+.SH COPYRIGHT
+Copyright \(co 2013
+.br
+Copyright of modifications held by their respective authors.
+Licensed under the GNU General Public License v2 (GPL).
+.SH "SEE ALSO"
+.br 
+fail2ban-server(1)
+fail2ban-client(1)
+jail.conf(5)
+fail2ban-regex(1)

From ab16246619369ca90d71d6db6bf5ce3a89b917c0 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 23 Mar 2013 20:19:05 +1100
Subject: [PATCH 125/544] DOC: Defin{a,i}tion

---
 man/jail.conf.5 | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/man/jail.conf.5 b/man/jail.conf.5
index c2c096d6..38c29bbf 100644
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@@ -48,16 +48,16 @@ Action files specify which commands are executed to ban an IP address. They are
 Like jail.conf files if you desire local changes create a [actionname].local file in the /etc/fail2ban/action.d directory 
 and override the required settings.
 
-The action files are ini files that have two sections, \fBDefination\fR and \fBInit\fR . 
+The action files are ini files that have two sections, \fBDefinition\fR and \fBInit\fR . 
 
 The [Init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail.
 
-The commands are specified in the [Defination] section as below..
+The commands are specified in the [Definition] section as below..
 
 The commands are executed through a system shell so shell redirection and process control is allowed. The commands should
 return 0 to indicate success which will prevent fail2ban attempting to retry (up to \fBmaxretry\fR times to ban the IP again.
 
-The following action parameters are in the [Defination] section.
+The following action parameters are in the [Definition] section.
 .TP
 \fBactionstart\fR
 This is the commands that are executed when the jail starts.
@@ -101,14 +101,14 @@ The concatinated string of the log file lines of the matches that generated the
 
 .SH FILTER FILES
 
-Filter definations are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
+Filter definitions are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
 
 These are used to identify failed authenicate attempts in logs and to extract the host IP address or hostname.
 
 Like action files, filter files are ini files. The main section is the [Definition] section.
 
-There are two filter definations used in the [Defination] section, failregex and ignoreregex.
-Other definations are allowed and can be used to substitue into other definations with %(defnname). For example.
+There are two filter definitions used in the [Definition] section, failregex and ignoreregex.
+Other definitions are allowed and can be used to substitue into other definitions with %(defnname). For example.
 
 baduseragents = IE|wget
 
@@ -130,11 +130,11 @@ Filters can also have a section called [INCLUDES]. This is used to read other co
 
 .TP
 \fBbefore\fR
-indicates that this file is read before the [Defination] section.
+indicates that this file is read before the [Definition] section.
 
 .TP
 \fBafter\fR
-indicates that this file is read after the [Defination] section.
+indicates that this file is read after the [Definition] section.
 
 .SH AUTHOR
 Fail2ban Written by Cyril Jaquier <cyril.jaquier@fail2ban.org> with many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.

From 6f804f92596174fa3bcd76a3759d04458fe0638a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 23 Mar 2013 21:04:03 +1100
Subject: [PATCH 126/544] BF: defer testSocket for later

---
 testcases/servertestcase.py | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 9b649a99..857dc45b 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -142,22 +142,6 @@ class Transmitter(unittest.TestCase):
 				self.__transm.proceed(["get", jail, cmd]),
 				(0, outValues[n+1:]))
 
-	def testSocket(self):
-		ss = os.stat(self.__sock_name)
-		self.assertIsNot(stat.S_ISSOCK(ss.st_mode), 0)
-
-	# pid removal is done in server.start
-	# unsure if this was intended
-	#def testPid(self):
-	#	pidfile = self.__pidfile_name
-	#	sp = os.stat(pidfile)
-	#	self.assertIsNot(stat.S_ISREG(sp.st_mode), 0)
-	#	self.assertEquals(stat.S_IMODE(sp.st_mode), stat.S_IRUSR | stat.S_IWUSR)
-	#	
-	#	p = open(pidfile,'r')
-	#	self.assertTrue(int(p.read()))
-	#	p.close()
-
 	def testStopServer(self):
 		self.assertEqual(self.__transm.proceed(["stop"]), (0, None))
 

From e6ae8872c68871e7f06f31426dff7dd341ad3abf Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 23 Mar 2013 21:31:09 +1100
Subject: [PATCH 127/544] PKG: change email that I want in RPMs

---
 setup.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.cfg b/setup.cfg
index 03fa6dab..74c22b25 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -6,7 +6,7 @@ formats=bztar
 
 [bdist_rpm]
 release = 1
-packager = Yaroslav Halchenko <debian@onerussian.com>, Daniel Black <daniel.subs@internode.on.net>
+packager = Yaroslav Halchenko <debian@onerussian.com>, Daniel Black <grooverdan@users.sourceforge.net>
 doc_files = DEVELOP
             README
             THANKS

From 29d0df58be4eba2cf7e241eb57a4d311dcff682a Mon Sep 17 00:00:00 2001
From: Artur Penttinen <artur.penttinen@gmail.com>
Date: Sun, 24 Mar 2013 16:52:58 +0200
Subject: [PATCH 128/544] Added support for MySQL logfiles

---
 config/filter.d/mysqld.conf | 32 ++++++++++++++++++++++++++++++++
 config/jail.conf            | 13 +++++++++++++
 server/datedetector.py      |  6 ++++++
 3 files changed, 51 insertions(+)
 create mode 100644 config/filter.d/mysqld.conf

diff --git a/config/filter.d/mysqld.conf b/config/filter.d/mysqld.conf
new file mode 100644
index 00000000..bc9164ce
--- /dev/null
+++ b/config/filter.d/mysqld.conf
@@ -0,0 +1,32 @@
+# Fail2Ban configuration file
+#
+# Author: Artur Penttinen
+#
+# $Revision$
+#
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
+[Definition]
+
+#_daemon = mysqld
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
+failregex = Access denied for user '\w+'@'<HOST>'
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
diff --git a/config/jail.conf b/config/jail.conf
index 8bb1a6b6..d56de5d0 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -331,6 +331,19 @@ action   = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp]
 logpath  = /var/log/asterisk/messages
 maxretry = 10
 
+# For log wrong MySQL access add to /etc/my.cnf:
+# log-error=/var/log/mysqld.log
+# log-warning = 2
+[mysqld-iptables]
+
+enabled  = false
+filter   = mysqld
+action   = iptables[name=mysql, port=3306, protocol=tcp]
+           sendmail-whois[name=MySQL, dest=root, sender=fail2ban@example.com]
+logpath  = /var/log/mysqld.log
+maxretry = 5
+
+
 # Jail for more extended banning of persistent abusers
 # !!! WARNING !!!
 #   Make sure that your loglevel specified in fail2ban.conf/.local
diff --git a/server/datedetector.py b/server/datedetector.py
index c013d551..a54e072d 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -155,6 +155,12 @@ class DateDetector:
 			template.setRegex("^<\d{2}/\d{2}/\d{2}@\d{2}:\d{2}:\d{2}>")
 			template.setPattern("<%m/%d/%y@%H:%M:%S>")
 			self._appendTemplate(template)
+			# MySQL: 130322 11:46:11
+			template = DateStrptime()
+			template.setName("MonthDayYear Hour:Minute:Second")
+			template.setRegex("^\d{2}\d{2}\d{2} +\d{1,2}:\d{2}:\d{2}")
+			template.setPattern("%y%m%d %H:%M:%S")
+			self._appendTemplate(template)
 		finally:
 			self.__lock.release()
 	

From 6eb262fea684359709e985920d1879556ca47918 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 24 Mar 2013 22:12:52 -0400
Subject: [PATCH 129/544] My improvements to manpages

---
 man/fail2ban.1  | 30 ++++++++++------
 man/jail.conf.5 | 95 ++++++++++++++++++++++++-------------------------
 2 files changed, 66 insertions(+), 59 deletions(-)

diff --git a/man/fail2ban.1 b/man/fail2ban.1
index 1198c07c..9af9ec54 100644
--- a/man/fail2ban.1
+++ b/man/fail2ban.1
@@ -2,25 +2,33 @@
 .SH NAME
 fail2ban \- a set of server and client programs to limit brute force authentication attempts.
 .SH DESCRIPTION
-Fail2Ban consists of a client, server and some configuration files to achieve limiting 
-brute force of authenitcation attempts.
+Fail2Ban consists of a client, server and configuration files to limit
+brute force authentication attempts.
 
-The server program is \fBfail2ban-server\fR which is configured from the configuration files. The
-fail2ban-server can also be configured using the \fBfail2ban-client\fR. 
+The server program \fBfail2ban-server\fR is responsible for monitoring
+log files and issuing ban/unban commands.  It gets configured through
+a simple protocol by \fBfail2ban-client\fR, which can also read
+configuration files and issue corresponding configuration commands to
+the server.
 
-For details on the configuration of fail2ban see the jail.conf(5) manual page.
+For details on the configuration of fail2ban see the jail.conf(5)
+manual page.  A jail (as specified in jail.conf) couples filters and
+actions definitions for any given list of files to get monitored.
 
-For details on the configuration of fail2ban-server see the fail2ban-server(1) manual page.
+For details on the command-line options of fail2ban-server see the
+fail2ban-server(1) manual page.
 
-For details on the configuration of fail2ban-client see the fail2ban-client(1) manual page.
+For details on the command-line options and commands for configuring
+the server via fail2ban-client see the fail2ban-client(1) manual page.
 
-For testing regular expressions assocated with filter using the fail2ban-regex program may be of
-use and its manual page is fail2ban-regex(1).
+For testing regular expressions specified in a filter using the
+fail2ban-regex program may be of use and its manual page is
+fail2ban-regex(1).
 
 .SH FILES
 \fI/etc/fail2ban/*\fR
 .SH AUTHOR
-Manual page written by Daniel Black
+Manual page written by Daniel Black and Yaroslav Halchenko
 .SH "REPORTING BUGS"
 Report bugs to https://github.com/fail2ban/fail2ban/issues
 .SH COPYRIGHT
@@ -32,5 +40,5 @@ Licensed under the GNU General Public License v2 (GPL).
 .br 
 fail2ban-server(1)
 fail2ban-client(1)
-jail.conf(5)
 fail2ban-regex(1)
+jail.conf(5)
diff --git a/man/jail.conf.5 b/man/jail.conf.5
index 38c29bbf..8f38c14b 100644
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@@ -8,13 +8,13 @@ jail.conf \- configuration for the fail2ban server
 
 .B filter.d/*.conf filter.d/*.local
 .SH DESCRIPTION
-Fail2ban has three configuration file types. Action files are the commands for banning and unbanning IP address,
-Filter files tell fail2ban how authentication failures occur, and Jail configurations that map the two together.
+Fail2ban has three configuration file types. Action files are the commands for banning and unbanning of IP address,
+Filter files tell fail2ban how to detect authentication failures, and Jail configurations combine filters with actions into jails.
 
-There are *.conf files that are distributed by fail2ban and *.local file that contain user overwritten files. 
-It is recommended that *.conf files are not changed. *.local files are where users overwrite their default settings.
-For instance if you require the default [ssh-iptables-ipset] jail create a jail.local to extend jail.conf (
-the configuration for the fail2ban server). The jail.local file will be the following if you only need to enable
+There are *.conf files that are distributed by fail2ban and *.local file that contain user customizations.
+It is recommended that *.conf files should remain unchanged.  If needed, customizations should be provided in *.local files.
+For instance, if you would like to customize the [ssh-iptables-ipset] jail, create a jail.local to extend jail.conf
+(the configuration for the fail2ban server).  The jail.local file will be the following if you only need to enable
 it:
 
 .TP
@@ -22,13 +22,13 @@ it:
 [ssh-iptables-ipset]
 
 enabled = true
-.TP
 
-Only overwride the settings you need to change and the rest of the configuration comes from the corresponding
+.PP
+Override only the settings you need to change and the rest of the configuration will come from the corresponding
 *.conf file.
 
 .SH DEFAULT
-The following options are applicable to all jails. Their meaning is in the default jail.conf file.
+The following options are applicable to all jails. Their meaning is described in the default jail.conf file.
 .TP
 \fBignoreip\fR 
 .TP
@@ -41,55 +41,53 @@ The following options are applicable to all jails. Their meaning is in the defau
 \fBbackend\fR
 .TP
 \fBusedns\fR
-.TP
-.SH ACTION FILES
-Action files specify which commands are executed to ban an IP address. They are located in /etc/fail2ban/action.d.
 
-Like jail.conf files if you desire local changes create a [actionname].local file in the /etc/fail2ban/action.d directory 
+
+.SH "ACTION FILES"
+Action files specify which commands are executed to ban and unban an IP address. They are located under /etc/fail2ban/action.d.
+
+Like with jail.conf files, if you desire local changes create an [actionname].local file in the /etc/fail2ban/action.d directory
 and override the required settings.
 
-The action files are ini files that have two sections, \fBDefinition\fR and \fBInit\fR . 
+Action files are ini files that have two sections, \fBDefinition\fR and \fBInit\fR . 
 
-The [Init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail.
+The [Init] section allows for action-specific settings. In jail.conf/jail.local these can be overwritten for a particular jail as options to the jail.
 
-The commands are specified in the [Definition] section as below..
-
-The commands are executed through a system shell so shell redirection and process control is allowed. The commands should
-return 0 to indicate success which will prevent fail2ban attempting to retry (up to \fBmaxretry\fR times to ban the IP again.
-
-The following action parameters are in the [Definition] section.
+The following commands can be present in the [Definition] section.
 .TP
 \fBactionstart\fR
-This is the commands that are executed when the jail starts.
+command(s) executed when the jail starts.
 .TP
 \fBactionstop\fR
-This is the commands that are executed when the jail stops.
+command(s) executed when the jail stops.
 .TP
 \fBactioncheck\fR
-This is the command that is before each other action. It checks to see if the environment is ok.
+the command ran before any other action. It aims to verify if the environment is still ok.
 .TP
 \fBactionban\fR
-This is the command that bans the IP address.
+command(s) that bans the IP address after \fBmaxretry\fR log lines matches within last \fBfindtime\fR seconds.
 .TP
 \fBactionunban\fR
-This is the command that unbans the IP address after \fBbantime\fR.
+command(s) that unbans the IP address after \fBbantime\fR.
 
-Tags are in <>. All the elements of [Init] are tags that are replaced in all action commands. Tags can be added by the
+Commands specified in the [Definition] section are executed through a system shell so shell redirection and process control is allowed. The commands should
+return 0, otherwise error would be logged.  Moreover if \fBactioncheck\fR exits with non-0 status, it is taken as indication that firewall status has changed and fail2ban needs to reinitialize itself (i.e. issue \fBactionstop\fR and \fBactionstart\fR commands).
+
+Tags are enclosed in <>.  All the elements of [Init] are tags that are replaced in all action commands.  Tags can be added by the
 \fBfail2ban-client\fR using the setctag command.
 
-More that one command is allowed. Each command needs to be on a new line and indented with whitespace with no blank lines. The following defines
+More than a single command is allowed to be specified. Each command needs to be on a separate line and indented with whitespaces without blank lines. The following example defines
 two commands to be executed.
 
-actionban = iptables -I fail2ban-<name> --source <ip> -j DROP
+ actionban = iptables -I fail2ban-<name> --source <ip> -j DROP
+             echo ip=<ip>, match=<match>, time=<time> >> /var/log/fail2ban.log
 
-    echo ip=<ip>, match=<match>, time=<time> >> /var/log/fail2ban.log
-
-The following tags are also substituted in the actionban, actionunban and actioncheck (when called before actionban/actionunban).
+.SS "Action Tags"
+The following tags are substituted in the actionban, actionunban and actioncheck (when called before actionban/actionunban) commands.
 .TP
 \fBip\fR
 An IPv4 ip address to be banned. e.g. 192.168.0.2
 .TP
-.TP
 \fBfailures\fR
 The number of times the failure occurred in the log file. e.g. 3
 .TP
@@ -97,33 +95,32 @@ The number of times the failure occurred in the log file. e.g. 3
 The unix time of the ban. e.g. 1357508484
 .TP
 \fBmatches\fR
-The concatinated string of the log file lines of the matches that generated the ban.
+The concatenated string of the log file lines of the matches that generated the ban. Many characters interpreted by shell get escaped.
 
 .SH FILTER FILES
 
 Filter definitions are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
 
-These are used to identify failed authenicate attempts in logs and to extract the host IP address or hostname.
+These are used to identify failed authentication attempts in logs and to extract the host IP address (or hostname if \fBusedns\fR is \fBtrue\fR).
 
 Like action files, filter files are ini files. The main section is the [Definition] section.
 
-There are two filter definitions used in the [Definition] section, failregex and ignoreregex.
-Other definitions are allowed and can be used to substitue into other definitions with %(defnname). For example.
-
-baduseragents = IE|wget
-
-failregex = useragent=%(baduseragents)
-
-The \fBfailregex\fR and \fBignoreregex\fR have the following meanings:
+There are two filter definitions used in the [Definition] section:
 
 .TP
 \fBfailregex\fR
-is the regex that will match failed attempts. The tag <HOST> is used as part of the regex and is itself a regex
+is the regex (\fBreg\fRular \fBex\fRpression) that will match failed attempts. The tag <HOST> is used as part of the regex and is itself a regex
 for IPv4 addresses and hostnames. fail2ban will work out which one of these it actually is.
 
 .TP
 \fBignoreregex\fR
-is the regex that will be ignored by fail2ban, even if failregex matches.
+is the regex to identify log entries that should be ignored by fail2ban, even if they match failregex.
+
+
+Using Python "string interpolation" mechanisms, other definitions are allowed and can later be used within other definitions as %(defnname)s. For example.
+
+ baduseragents = IE|wget
+ failregex = useragent=%(baduseragents)s
 
 .PP
 Filters can also have a section called [INCLUDES]. This is used to read other configuration files.
@@ -137,8 +134,10 @@ indicates that this file is read before the [Definition] section.
 indicates that this file is read after the [Definition] section.
 
 .SH AUTHOR
-Fail2ban Written by Cyril Jaquier <cyril.jaquier@fail2ban.org> with many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
-Manual page written by Daniel Black.
+Fail2ban was originally written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
+At the moment it is maintained and further developed by Yaroslav O. Halchenko <debian@onerussian.com> and a number of contributors.  See \fBTHANKS\fR file shipped with Fail2Ban for a full list.
+.
+Manual page written by Daniel Black and Yaroslav Halchenko.
 .SH "REPORTING BUGS"
 Report bugs to https://github.com/fail2ban/fail2ban/issues
 .SH COPYRIGHT
@@ -147,5 +146,5 @@ Copyright \(co 2013 Daniel Black
 Copyright of modifications held by their respective authors.
 Licensed under the GNU General Public License v2 (GPL).
 .SH "SEE ALSO"
-.br 
+.br
 fail2ban-server(1)

From c0915e5c7bda6a9ed9b46295f44ed9e0117e10a2 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 24 Mar 2013 22:13:16 -0400
Subject: [PATCH 130/544] Added Daniel and Steven to THANKS

---
 THANKS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/THANKS b/THANKS
index ff20d07d..f207d71e 100644
--- a/THANKS
+++ b/THANKS
@@ -13,6 +13,7 @@ Christian Rauch
 Christoph Haas
 Christos Psonis
 Daniel B. Cid
+Daniel Black
 David Nutter
 Eric Gerbier
 Guillaume Delvit
@@ -38,6 +39,7 @@ Robert Edeker
 Russell Odom
 Sireyessire
 Stephen Gildea
+Steven Hiscocks
 Tom Pike
 Tyler
 Vaclav Misek

From bba3fd85688a95b5c6bd95ae7c7fec6a524d47f8 Mon Sep 17 00:00:00 2001
From: ArndRa <ArndRaphael.Brandes@gmx.de>
Date: Mon, 25 Mar 2013 08:43:13 +0100
Subject: [PATCH 131/544] Update sogo-auth.conf

included hint by user  yarikoptic
---
 config/filter.d/sogo-auth.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf
index 6a1abd3f..6054c589 100644
--- a/config/filter.d/sogo-auth.conf
+++ b/config/filter.d/sogo-auth.conf
@@ -17,3 +17,4 @@ failregex = Login from '<HOST>.*' for user '.*' might not have worked
 # Notes.: regex to ignore. If this regex matches, the line is ignored.
 # Values: TEXT
 #
+ignoreregex = 

From ebb6e5f4eba5be26af46e9abc6eb84f238126389 Mon Sep 17 00:00:00 2001
From: ArndRa <ArndRaphael.Brandes@gmx.de>
Date: Mon, 25 Mar 2013 09:11:51 +0100
Subject: [PATCH 132/544] An example of failed logins against sogo

---
 testcases/files/logs/sogo-auth | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 testcases/files/logs/sogo-auth

diff --git a/testcases/files/logs/sogo-auth b/testcases/files/logs/sogo-auth
new file mode 100644
index 00000000..6dbe7356
--- /dev/null
+++ b/testcases/files/logs/sogo-auth
@@ -0,0 +1,15 @@
+Mar 24 08:58:32 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87c3008> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=hack0r,ou=users,dc=mail,dc=example,dc=org"; }
+Mar 24 08:58:32 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'hack0r' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+173.194.44.31 - - [24/Mar/2013:08:58:32 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/38 0.311 - - 2M
+Mar 24 08:58:40 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87bb8d8> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=kiddy,ou=users,dc=mail,dc=example,dc=org"; }
+Mar 24 08:58:40 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'kiddy' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+173.194.44.31 - - [24/Mar/2013:08:58:40 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/37 0.007 - - 32K
+Mar 24 08:58:50 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87c27f8> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=plsBanMe,ou=users,dc=mail,dc=example,dc=org"; }
+Mar 24 08:58:50 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'plsBanMe' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+173.194.44.31 - - [24/Mar/2013:08:58:50 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/40 0.008 - - 0
+Mar 24 08:58:59 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87be830> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=root,ou=users,dc=mail,dc=example,dc=org"; }
+Mar 24 08:58:59 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'root' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+173.194.44.31 - - [24/Mar/2013:08:58:59 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/36 0.007 - - 0
+Mar 24 08:59:04 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87bc088> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=admin,ou=users,dc=mail,dc=example,dc=org"; }
+Mar 24 08:59:04 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'admin' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+173.194.44.31 - - [24/Mar/2013:08:59:04 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/37 0.007 - - 0

From edc0eb2a9c4518ca8e458564fd4429c2d4c4a115 Mon Sep 17 00:00:00 2001
From: Artur Penttinen <artur.penttinen@gmail.com>
Date: Mon, 25 Mar 2013 16:00:07 +0200
Subject: [PATCH 133/544] Added testcase for MySQL date format to
 testcases/datedetectortestcase.py and example of MySQL log file.

---
 testcases/datedetectortestcase.py |  1 +
 testcases/files/logs/mysqld.log   | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 testcases/files/logs/mysqld.log

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 34ce22ce..5784387d 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -68,6 +68,7 @@ class DateDetectorTest(unittest.TestCase):
 			"2005.01.23 21:59:59",
 			"23/01/2005 21:59:59",
 			"01-23-2005 21:59:59.252", # reported on f2b, causes Feb29 fix to break
+			"050123 21:59:59", # MySQL
 			):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude
diff --git a/testcases/files/logs/mysqld.log b/testcases/files/logs/mysqld.log
new file mode 100644
index 00000000..8dfd6338
--- /dev/null
+++ b/testcases/files/logs/mysqld.log
@@ -0,0 +1,17 @@
+130323 21:14:28 [Warning] Access denied for user 'root'@'192.168.1.34' (using password: NO)
+130324  0:04:00 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: NO)
+130324  0:04:02 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:05 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:07 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:09 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:11 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:13 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:16 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  0:04:18 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
+130324  8:24:09 [Warning] Access denied for user 'root'@'220.95.238.171' (using password: NO)
+130324 17:56:13 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: NO)
+130324 17:56:14 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES)
+130324 17:56:15 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES)
+130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO)
+130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)
+130324 19:01:41 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)

From 3b4084d4711019f53450401f11d2607064c6d8bb Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 10:41:13 -0400
Subject: [PATCH 134/544] BF: fixing up for handling of TAI64N timestamps and
 adding some unittest for prev commit (not effective much though)

---
 server/datetemplate.py            |  5 +++--
 testcases/datedetectortestcase.py | 21 +++++++++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/server/datetemplate.py b/server/datetemplate.py
index 8e2cb7e1..51b8bb1e 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -50,7 +50,7 @@ class DateTemplate:
 	def getName(self):
 		return self.__name
 	
-	def setRegex(self, regex, wordBegin = True):
+	def setRegex(self, regex, wordBegin=True):
 		regex = regex.strip()
 		if (wordBegin and not re.search(r'^\^', regex)):
 			regex = r'\b' + regex
@@ -186,7 +186,8 @@ class DateTai64n(DateTemplate):
 	def __init__(self):
 		DateTemplate.__init__(self)
 		# We already know the format for TAI64N
-		self.setRegex("@[0-9a-f]{24}")
+		# yoh: we should not add an additional front anchor
+		self.setRegex("@[0-9a-f]{24}", wordBegin=False)
 	
 	def getDate(self, line):
 		date = None
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index a2946587..64af1fab 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -103,6 +103,27 @@ class DateDetectorTest(unittest.TestCase):
 		self.assertRaises(ValueError, self.__datedetector._appendTemplate,
 						  self.__datedetector.getTemplates()[0])
 
+	def testFullYearMatch_gh130(self):
+		# see https://github.com/fail2ban/fail2ban/pull/130
+		# yoh: unfortunately this test is not really effective to reproduce the
+		#      situation but left in place to assure consistent behavior
+		m1 = [2012, 10, 11, 2, 37, 17]
+		self.assertEqual(
+			self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')[:6],
+			m1)
+		self.__datedetector.sortTemplate()
+		# confuse it with year being at the end
+		for i in xrange(10):
+			self.assertEqual(
+				self.__datedetector.getTime('11/10/2012 02:37:17 [error] 18434#0')[:6],
+				m1)
+		self.__datedetector.sortTemplate()
+		# and now back to the original
+		self.assertEqual(
+			self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')[:6],
+			m1)
+
+
 #	def testDefaultTempate(self):
 #		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 #		self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")

From 007827fac6b7ce3146da5ce11c6d81dd332514d6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 11:03:55 -0400
Subject: [PATCH 135/544] ENH: increase timeout to 20 sec from 10 sec in
 assert_correct_last_attempt

This is done with a hope to resolve randomly failing tests on travis-ci
and thus fixing the #103
---
 testcases/filtertestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index a036f804..5833e296 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -379,7 +379,7 @@ def get_monitor_failures_testcase(Filter_):
 			return not self.isFilled(delay)
 
 		def assert_correct_last_attempt(self, failures, count=None):
-			self.assertTrue(self.isFilled(10)) # give Filter a chance to react
+			self.assertTrue(self.isFilled(20)) # give Filter a chance to react
 			_assert_correct_last_attempt(self, self.jail, failures, count=count)
 
 

From ca474eb4887aa5d136840b9437b9a547a3a10ca0 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 12:05:10 -0400
Subject: [PATCH 136/544] DOC: Added suggested by @beilber description of .d/ +
 added I formatting to all filenames

---
 man/jail.conf.5 | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/man/jail.conf.5 b/man/jail.conf.5
index 8f38c14b..10bcef7f 100644
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@@ -2,11 +2,11 @@
 .SH NAME
 jail.conf \- configuration for the fail2ban server
 .SH SYNOPSIS
-.B jail.conf / jail.local
+.I jail.conf / jail.local
 
-.B action.d/*.conf action.d/*.local
+.I action.d/*.conf action.d/*.local
 
-.B filter.d/*.conf filter.d/*.local
+.I filter.d/*.conf filter.d/*.local
 .SH DESCRIPTION
 Fail2ban has three configuration file types. Action files are the commands for banning and unbanning of IP address,
 Filter files tell fail2ban how to detect authentication failures, and Jail configurations combine filters with actions into jails.
@@ -18,7 +18,7 @@ For instance, if you would like to customize the [ssh-iptables-ipset] jail, crea
 it:
 
 .TP
-\fBjail.local\fR
+\fIjail.local\fR
 [ssh-iptables-ipset]
 
 enabled = true
@@ -27,8 +27,26 @@ enabled = true
 Override only the settings you need to change and the rest of the configuration will come from the corresponding
 *.conf file.
 
+\fI*.d/\fR
+.RS
+In addition to .local, for any .conf file there can be a corresponding
+.d directory to contain additional .conf files that will be read after the
+appropriate .local file.  Last parsed file will take precidence over
+identical entries, parsed alphabetically, e.g.
+
+.RS
+\fIjail.d/01_enable.conf\fR - to enable a specific jail
+.RE
+.RS
+\fIjail.d/02_custom_port.conf\fR - containing specific configuration entry to change the port of the jail specified in the configuration
+.RE
+.RS
+\fIfail2ban.d/01_custom_log.conf\fR - containing specific configuration entry to use a different log path.
+.RE
+.RE
+
 .SH DEFAULT
-The following options are applicable to all jails. Their meaning is described in the default jail.conf file.
+The following options are applicable to all jails. Their meaning is described in the default \fIjail.conf\fR file.
 .TP
 \fBignoreip\fR 
 .TP
@@ -44,14 +62,14 @@ The following options are applicable to all jails. Their meaning is described in
 
 
 .SH "ACTION FILES"
-Action files specify which commands are executed to ban and unban an IP address. They are located under /etc/fail2ban/action.d.
+Action files specify which commands are executed to ban and unban an IP address. They are located under \fI/etc/fail2ban/action.d\fR.
 
-Like with jail.conf files, if you desire local changes create an [actionname].local file in the /etc/fail2ban/action.d directory
+Like with jail.conf files, if you desire local changes create an \fI[actionname].local\fR file in the \fI/etc/fail2ban/action.d\fR directory
 and override the required settings.
 
 Action files are ini files that have two sections, \fBDefinition\fR and \fBInit\fR . 
 
-The [Init] section allows for action-specific settings. In jail.conf/jail.local these can be overwritten for a particular jail as options to the jail.
+The [Init] section allows for action-specific settings. In \fIjail.conf/jail.local\fR these can be overwritten for a particular jail as options to the jail.
 
 The following commands can be present in the [Definition] section.
 .TP
@@ -99,7 +117,7 @@ The concatenated string of the log file lines of the matches that generated the
 
 .SH FILTER FILES
 
-Filter definitions are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
+Filter definitions are those in \fI/etc/fail2ban/filter.d/*.conf\fR and \fIfilter.d/*.local\fR.
 
 These are used to identify failed authentication attempts in logs and to extract the host IP address (or hostname if \fBusedns\fR is \fBtrue\fR).
 

From e6983b4f9b476e174995b9814260e9e1c5c4d6c5 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 12:45:08 -0400
Subject: [PATCH 137/544] BF: Remove custom __str__ for MonitorFailures and
 just adjust __name__ of the generated class

Also to guarantee unique file names across tests -- append incremental
numeric suffix.

This should prevent unittest from not reporting specific unittest method names,
thus complicating the analysis of failures
---
 testcases/filtertestcase.py | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 5833e296..88cbf382 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -324,11 +324,15 @@ def get_monitor_failures_testcase(Filter_):
 	"""Generator of TestCase's for different filters/backends
 	"""
 
+	_, testclass_name = tempfile.mkstemp('fail2ban', 'monitorfailures')
+
 	class MonitorFailures(unittest.TestCase):
+		count = 0
 		def setUp(self):
 			"""Call before every test case."""
 			self.filter = self.name = 'NA'
-			_, self.name = tempfile.mkstemp('fail2ban', 'monitorfailures')
+			self.name = '%s-%d' % (testclass_name, self.count)
+			MonitorFailures.count += 1 # so we have unique filenames across tests
 			self.file = open(self.name, 'a')
 			self.jail = DummyJail()
 			self.filter = Filter_(self.jail)
@@ -351,12 +355,9 @@ def get_monitor_failures_testcase(Filter_):
 			self.filter.join()		  # wait for the thread to terminate
 			#print "D: KILLING THE FILE"
 			_killfile(self.file, self.name)
+			#time.sleep(0.2)			  # Give FS time to ack the removal
 			pass
 
-		def __str__(self): # pragma: no cover - will only show up if unexpected exception is thrown
-			return "MonitorFailures%s(%s)" \
-			  % (Filter_, hasattr(self, 'name') and self.name or 'tempfile')
-
 		def isFilled(self, delay=2.):
 			"""Wait up to `delay` sec to assure that it was modified or not
 			"""
@@ -488,7 +489,8 @@ def get_monitor_failures_testcase(Filter_):
 			# yoh: not sure why count here is not 9... TODO
 			self.assert_correct_last_attempt(GetFailures.FAILURES_01)#, count=9)
 
-
+	MonitorFailures.__name__ = "MonitorFailures<%s>(%s)" \
+			  % (Filter_.__name__, testclass_name) # 'tempfile')
 	return MonitorFailures
 
 

From 5ea2ab14e6bc848e7782d4f8e3ee23ed8a0aa708 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 14:42:44 -0400
Subject: [PATCH 138/544] ENH: elaborated debug log message about already
 detected failures

Now it should be evaluated only if logging mode is debug or "lower", and also
should happen not only on initial detections but for every added failure.
It also reports counts per each IP now
---
 server/failmanager.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/server/failmanager.py b/server/failmanager.py
index 82c2ed6f..93a3a351 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -105,8 +105,15 @@ class FailManager:
 				fData.setLastReset(unixTime)
 				fData.setLastTime(unixTime)
 				self.__failList[ip] = fData
-			logSys.debug("Currently have failures from %d IPs: %s"
-						 % (len(self.__failList), self.__failList.keys()))
+
+			if logSys.getEffectiveLevel() <= logging.DEBUG:
+				# yoh: Since composing this list might be somewhat time consuming
+				# in case of having many active failures, it should be ran only
+				# if debug level is "low" enough
+				failures_summary = ', '.join(['%s:%d' % (k, v.getRetry())
+											  for k,v in  self.__failList.iteritems()])
+				logSys.debug("Currently have failures from %d IPs (IP:count): %s"
+							 % (len(self.__failList), failures_summary))
 			self.__failTotal += 1
 		finally:
 			self.__lock.release()

From f72bc13111ebfdee95ece936d95fcae961748826 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 16:33:02 -0400
Subject: [PATCH 139/544] BF: allow to wait longer for FilterPoll in
 test_move_file

---
 testcases/filtertestcase.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 88cbf382..4aef2c9d 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -432,9 +432,10 @@ def get_monitor_failures_testcase(Filter_):
 			# if we move file into a new location while it has been open already
 			self.file = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
 												  n=14, mode='w')
-			self.assertTrue(self.isEmpty(2))
+			# Poll might need more time
+			self.assertTrue(self.isEmpty(2 + int(isinstance(self.filter, FilterPoll))*4))
 			self.assertRaises(FailManagerEmpty, self.filter.failManager.toBan)
-			self.assertEqual(self.filter.failManager.getFailTotal(), 2) # Fails with Poll from time to time
+			self.assertEqual(self.filter.failManager.getFailTotal(), 2)
 
 			# move aside, but leaving the handle still open...
 			os.rename(self.name, self.name + '.bak')

From c29553354b9527722ce3ee87bfe60ebf6268682d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 17:11:03 -0400
Subject: [PATCH 140/544] ENH: FailManager -- improve log message to report
 total # of detected failures as well

---
 server/failmanager.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/failmanager.py b/server/failmanager.py
index 93a3a351..02f16ce3 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -106,15 +106,16 @@ class FailManager:
 				fData.setLastTime(unixTime)
 				self.__failList[ip] = fData
 
+			self.__failTotal += 1
+
 			if logSys.getEffectiveLevel() <= logging.DEBUG:
 				# yoh: Since composing this list might be somewhat time consuming
 				# in case of having many active failures, it should be ran only
 				# if debug level is "low" enough
 				failures_summary = ', '.join(['%s:%d' % (k, v.getRetry())
 											  for k,v in  self.__failList.iteritems()])
-				logSys.debug("Currently have failures from %d IPs (IP:count): %s"
-							 % (len(self.__failList), failures_summary))
-			self.__failTotal += 1
+				logSys.debug("Total # of detected failures: %d. Current failures from %d IPs (IP:count): %s"
+							 % (self.__failTotal, len(self.__failList), failures_summary))
 		finally:
 			self.__lock.release()
 	

From 52af29a08044d77d727d68fa17494c08fb48c1d7 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 21:28:58 -0400
Subject: [PATCH 141/544] ENH: adding ability to incorporate tracebacks into
 log lines while running tests

---
 fail2ban-testcases |  23 ++++++++---
 testcases/utils.py | 101 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 119 insertions(+), 5 deletions(-)
 create mode 100644 testcases/utils.py

diff --git a/fail2ban-testcases b/fail2ban-testcases
index d6b25b91..e00cc908 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -36,6 +36,8 @@ from testcases import servertestcase
 from testcases import datedetectortestcase
 from testcases import actiontestcase
 from testcases import sockettestcase
+
+from testcases.utils import FormatterWithTraceBack
 from server.mytime import MyTime
 
 from optparse import OptionParser, Option
@@ -52,12 +54,14 @@ def get_opt_parser():
 			   choices=('debug', 'info', 'warn', 'error', 'fatal'),
 			   default=None,
 			   help="Log level for the logger to use during running tests"),
-		])
-
-	p.add_options([
 		Option('-n', "--no-network", action="store_true",
 			   dest="no_network",
 			   help="Do not run tests that require the network"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
+
 		])
 
 	return p
@@ -89,12 +93,21 @@ else: # pragma: no cover
 
 # Add the default logging handler
 stdout = logging.StreamHandler(sys.stdout)
+
+fmt = ' %(message)s'
+
+if opts.log_traceback:
+	Formatter = FormatterWithTraceBack
+	fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+else:
+	Formatter = logging.Formatter
+
 # Custom log format for the verbose tests runs
 if verbosity > 1: # pragma: no cover
-	stdout.setFormatter(logging.Formatter(' %(asctime)-15s %(thread)s %(message)s'))
+	stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
 else: # pragma: no cover
 	# just prefix with the space
-	stdout.setFormatter(logging.Formatter(' %(message)s'))
+	stdout.setFormatter(Formatter(fmt))
 logSys.addHandler(stdout)
 
 #
diff --git a/testcases/utils.py b/testcases/utils.py
new file mode 100644
index 00000000..6b894193
--- /dev/null
+++ b/testcases/utils.py
@@ -0,0 +1,101 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+
+__author__ = "Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2013 Yaroslav Halchenko"
+__license__ = "GPL"
+
+import logging, os, re, traceback
+from os.path import basename, dirname
+
+#
+# Following "traceback" functions are adopted from PyMVPA distributed
+# under MIT/Expat and copyright by PyMVPA developers (i.e. me and
+# Michael).  Hereby I re-license derivative work on these pieces under GPL
+# to stay in line with the main Fail2Ban license
+#
+def mbasename(s):
+	"""Custom function to include directory name if filename is too common
+
+	Also strip .py at the end
+	"""
+	base = basename(s)
+	if base.endswith('.py'):
+		base = base[:-3]
+	if base in set(['base', '__init__']):
+		base = basename(dirname(s)) + '.' + base
+	return base
+
+class TraceBack(object):
+	"""Customized traceback to be included in debug messages
+	"""
+
+	def __init__(self, compress=False):
+		"""Initialize TrackBack metric
+
+		Parameters
+		----------
+		compress : bool
+		  if True then prefix common with previous invocation gets
+		  replaced with ...
+		"""
+		self.__prev = ""
+		self.__compress = compress
+
+	def __call__(self):
+		ftb = traceback.extract_stack(limit=100)[:-2]
+		entries = [[mbasename(x[0]), str(x[1])] for x in ftb]
+		entries = [ e for e in entries
+					if not e[0] in ['unittest', 'logging.__init__' ]]
+
+		# lets make it more consize
+		entries_out = [entries[0]]
+		for entry in entries[1:]:
+			if entry[0] == entries_out[-1][0]:
+				entries_out[-1][1] += ',%s' % entry[1]
+			else:
+				entries_out.append(entry)
+		sftb = '>'.join(['%s:%s' % (mbasename(x[0]),
+									x[1]) for x in entries_out])
+		if self.__compress:
+			# lets remove part which is common with previous invocation
+			prev_next = sftb
+			common_prefix = os.path.commonprefix((self.__prev, sftb))
+			common_prefix2 = re.sub('>[^>]*$', '', common_prefix)
+
+			if common_prefix2 != "":
+				sftb = '...' + sftb[len(common_prefix2):]
+			self.__prev = prev_next
+
+		return sftb
+
+class FormatterWithTraceBack(logging.Formatter):
+	"""Custom formatter which expands %(tb) and %(tbc) with tracebacks
+
+	TODO: might need locking in case of compressed tracebacks
+	"""
+	def __init__(self, fmt, *args, **kwargs):
+		logging.Formatter.__init__(self, fmt=fmt, *args, **kwargs)
+		compress = '%(tbc)s' in fmt
+		self._tb = TraceBack(compress=compress)
+
+	def format(self, record):
+		record.tbc = record.tb = self._tb()
+		return logging.Formatter.format(self, record)

From ba042c6e3a847afc2ec4d6def0d70e3ad8f34793 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 21:29:39 -0400
Subject: [PATCH 142/544] ENH: move pyinotify callback debug message into
 callback + delay string interpolations

---
 server/filterpyinotify.py | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py
index a2eea9d7..e86498b0 100644
--- a/server/filterpyinotify.py
+++ b/server/filterpyinotify.py
@@ -63,16 +63,17 @@ class FilterPyinotify(FileFilter):
 		logSys.debug("Created FilterPyinotify")
 
 
-	def callback(self, event):
+	def callback(self, event, origin=''):
+		logSys.debug("%sCallback for Event: %s", origin, event)
 		path = event.pathname
 		if event.mask & pyinotify.IN_CREATE:
 			# skip directories altogether
 			if event.mask & pyinotify.IN_ISDIR:
-				logSys.debug("Ignoring creation of directory %s" % path)
+				logSys.debug("Ignoring creation of directory %s", path)
 				return
 			# check if that is a file we care about
 			if not path in self.__watches:
-				logSys.debug("Ignoring creation of %s we do not monitor" % path)
+				logSys.debug("Ignoring creation of %s we do not monitor", path)
 				return
 			else:
 				# we need to substitute the watcher with a new one, so first
@@ -104,8 +105,8 @@ class FilterPyinotify(FileFilter):
 	def _addFileWatcher(self, path):
 		wd = self.__monitor.add_watch(path, pyinotify.IN_MODIFY)
 		self.__watches.update(wd)
-		logSys.debug("Added file watcher for %s" % path)
-		# process the file since we did get even 
+		logSys.debug("Added file watcher for %s", path)
+		# process the file since we did get even
 		self._process_file(path)
 
 
@@ -114,7 +115,7 @@ class FilterPyinotify(FileFilter):
 		wd = self.__monitor.rm_watch(wdInt)
 		if wd[wdInt]:
 			del self.__watches[path]
-			logSys.debug("Removed file watcher for %s" % path)
+			logSys.debug("Removed file watcher for %s", path)
 			return True
 		else:
 			return False
@@ -130,7 +131,7 @@ class FilterPyinotify(FileFilter):
 			# we need to watch also  the directory for IN_CREATE
 			self.__watches.update(
 				self.__monitor.add_watch(path_dir, pyinotify.IN_CREATE))
-			logSys.debug("Added monitor for the parent directory %s" % path_dir)
+			logSys.debug("Added monitor for the parent directory %s", path_dir)
 
 		self._addFileWatcher(path)
 
@@ -151,7 +152,7 @@ class FilterPyinotify(FileFilter):
 			# since there is no other monitored file under this directory
 			wdInt = self.__watches.pop(path_dir)
 			_ = self.__monitor.rm_watch(wdInt)
-			logSys.debug("Removed monitor for the parent directory %s" % path_dir)
+			logSys.debug("Removed monitor for the parent directory %s", path_dir)
 
 
 	##
@@ -165,7 +166,7 @@ class FilterPyinotify(FileFilter):
 		self.__notifier = pyinotify.ThreadedNotifier(self.__monitor,
 			ProcessPyinotify(self))
 		self.__notifier.start()
-		logSys.debug("pyinotifier started for %s." % self.jail.getName())
+		logSys.debug("pyinotifier started for %s.", self.jail.getName())
 		# TODO: verify that there is nothing really to be done for
 		#       idle jails
 		return True
@@ -201,5 +202,4 @@ class ProcessPyinotify(pyinotify.ProcessEvent):
 
 	# just need default, since using mask on watch to limit events
 	def process_default(self, event):
-		logSys.debug("Callback for Event: %s" % event)
-		self.__FileFilter.callback(event)
+		self.__FileFilter.callback(event, origin='Default ')

From 7064a411c2d6b2993bf05904c9e7447d747674bc Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 22:36:23 -0400
Subject: [PATCH 143/544] ENH: _copy_lines_between_files -- read all needed,
 and only then write/flush at once

I think this is the one which should resolve
https://github.com/fail2ban/fail2ban/issues/103
---
 testcases/filtertestcase.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 4aef2c9d..a20a932d 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -105,20 +105,23 @@ def _copy_lines_between_files(fin, fout, n=None, skip=0, mode='a', terminal_line
 		time.sleep(1)
 	if isinstance(fin, str): # pragma: no branch - only used with str in test cases
 		fin = open(fin, 'r')
-	if isinstance(fout, str):
-		fout = open(fout, mode)
 	# Skip
 	for i in xrange(skip):
 		_ = fin.readline()
-	# Read/Write
+	# Read
 	i = 0
+	lines = []
 	while n is None or i < n:
 		l = fin.readline()
 		if terminal_line is not None and l == terminal_line:
 			break
-		fout.write(l)
-		fout.flush()
+		lines.append(l)
 		i += 1
+	# Write: all at once and flush
+	if isinstance(fout, str):
+		fout = open(fout, mode)
+	fout.write('\n'.join(lines))
+	fout.flush()
 	# to give other threads possibly some time to crunch
 	time.sleep(0.1)
 	return fout

From 2fb053643e620ea75e06ac72425eeee9d3055c1c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 25 Mar 2013 23:59:42 -0400
Subject: [PATCH 144/544] ENH: minor -- add default value into the warning if
 option had none provided

---
 client/configreader.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/configreader.py b/client/configreader.py
index e1a2b69f..9028df48 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -122,8 +122,8 @@ class ConfigReader(SafeConfigParserWithIncludes):
 				values[option[1]] = option[2]
 			except NoOptionError:
 				if not option[2] == None:
-					logSys.warn("'%s' not defined in '%s'. Using default value"
-								% (option[1], sec))
+					logSys.warn("'%s' not defined in '%s'. Using default one: %r"
+								% (option[1], sec, option[2]))
 					values[option[1]] = option[2]
 			except ValueError:
 				logSys.warn("Wrong value for '" + option[1] + "' in '" + sec +

From 8fe4e11b6744c21d06fc7457b9997377a6325a94 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 26 Mar 2013 00:01:12 -0400
Subject: [PATCH 145/544] ENH: allow to force enable all jails (for testing),
 do not crash for jails without actions (just warn)

also a bit more explicit handling of regexp groups in splitAction
---
 client/jailreader.py  | 27 ++++++++++++++++++++-------
 client/jailsreader.py | 14 +++++++++++---
 2 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index ec73ce46..ad69bfa0 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -40,10 +40,11 @@ class JailReader(ConfigReader):
 	
 	actionCRE = re.compile("^((?:\w|-|_|\.)+)(?:\[(.*)\])?$")
 	
-	def __init__(self, name, **kwargs):
+	def __init__(self, name, force_enable=False, **kwargs):
 		ConfigReader.__init__(self, **kwargs)
 		self.__name = name
 		self.__filter = None
+		self.__force_enable = force_enable
 		self.__actions = list()
 	
 	def setName(self, value):
@@ -56,7 +57,7 @@ class JailReader(ConfigReader):
 		return ConfigReader.read(self, "jail")
 	
 	def isEnabled(self):
-		return self.__opts["enabled"]
+		return self.__force_enable or self.__opts["enabled"]
 	
 	def getOptions(self):
 		opts = [["bool", "enabled", "false"],
@@ -87,6 +88,8 @@ class JailReader(ConfigReader):
 			# Read action
 			for act in self.__opts["action"].split('\n'):
 				try:
+					if not act:			  # skip empty actions
+						continue
 					splitAct = JailReader.splitAction(act)
 					action = ActionReader(splitAct, self.__name, basedir=self.getBaseDir())
 					ret = action.read()
@@ -97,8 +100,10 @@ class JailReader(ConfigReader):
 						raise AttributeError("Unable to read action")
 				except Exception, e:
 					logSys.error("Error in action definition " + act)
-					logSys.debug(e)
+					logSys.debug("Caught exception: %s" % (e,))
 					return False
+			if not len(self.__actions):
+				logSys.warn("No actions were defined for %s" % self.__name)
 		return True
 	
 	def convert(self):
@@ -143,12 +148,20 @@ class JailReader(ConfigReader):
 	def splitAction(action):
 		m = JailReader.actionCRE.match(action)
 		d = dict()
-		if not m.group(2) == None:
+		mgroups = m.groups()
+		if len(mgroups) == 2:
+			action_name, action_opts = mgroups
+		elif len(mgroups) == 1:
+			action_name, action_opts = mgroups[0], None
+		else:
+			raise ValueError("While reading action %s we should have got up to "
+							 "2 groups. Got: %r" % (action, mgroups))
+		if not action_opts is None:
 			# Huge bad hack :( This method really sucks. TODO Reimplement it.
 			actions = ""
 			escapeChar = None
 			allowComma = False
-			for c in m.group(2):
+			for c in action_opts:
 				if c in ('"', "'") and not allowComma:
 					# Start
 					escapeChar = c
@@ -173,6 +186,6 @@ class JailReader(ConfigReader):
 				try:
 					d[p[0].strip()] = p[1].strip()
 				except IndexError:
-					logSys.error("Invalid argument %s in '%s'" % (p, m.group(2)))
-		return [m.group(1), d]
+					logSys.error("Invalid argument %s in '%s'" % (p, action_opts))
+		return [action_name, d]
 	splitAction = staticmethod(splitAction)
diff --git a/client/jailsreader.py b/client/jailsreader.py
index e1b8efa3..91e178d6 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -36,9 +36,17 @@ logSys = logging.getLogger("fail2ban.client.config")
 
 class JailsReader(ConfigReader):
 	
-	def __init__(self, **kwargs):
+	def __init__(self, force_enable=False, **kwargs):
+		"""
+		Parameters
+		----------
+		force_enable : bool, optional
+		  Passed to JailReader to force enable the jails.
+		  It is for internal use
+		"""
 		ConfigReader.__init__(self, **kwargs)
 		self.__jails = list()
+		self.__force_enable = force_enable
 	
 	def read(self):
 		return ConfigReader.read(self, "jail")
@@ -49,7 +57,7 @@ class JailsReader(ConfigReader):
 
 		if section:
 			# Get the options of a specific jail.
-			jail = JailReader(section, basedir=self.getBaseDir())
+			jail = JailReader(section, basedir=self.getBaseDir(), force_enable=self.__force_enable)
 			jail.read()
 			ret = jail.getOptions()
 			if ret:
@@ -62,7 +70,7 @@ class JailsReader(ConfigReader):
 		else:
 			# Get the options of all jails.
 			for sec in self.sections():
-				jail = JailReader(sec, basedir=self.getBaseDir())
+				jail = JailReader(sec, basedir=self.getBaseDir(), force_enable=self.__force_enable)
 				jail.read()
 				ret = jail.getOptions()
 				if ret:

From c06b7abb4685474e5e5fb4c04b7d639514973d1f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 26 Mar 2013 00:01:56 -0400
Subject: [PATCH 146/544] TST: basic testing of reading the shipped jail.conf
 (forcing all jails to be enabled)

---
 testcases/clientreadertestcase.py | 32 +++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index d581a81f..28eb6b09 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -17,14 +17,8 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
 import os, shutil, tempfile, unittest
@@ -130,3 +124,25 @@ class JailsReaderTest(unittest.TestCase):
 		# commands to communicate to the server
 		self.assertEqual(comm_commands, [])
 
+	def testReadStockJailConfForceEnabled(self):
+		# more of a smoke test to make sure that no obvious surprises
+		# on users' systems when enabling shipped jails
+		jails = JailsReader(basedir='config', force_enable=True) # we are running tests from root project dir atm
+		self.assertTrue(jails.read())		  # opens fine
+		self.assertTrue(jails.getOptions())	  # reads fine
+		comm_commands = jails.convert()
+
+		# by default we have lots of jails ;)
+		self.assertTrue(len(comm_commands))
+
+		# and we know even some of them by heart
+		for j in ['ssh-iptables', 'recidive']:
+			# by default we have 'auto' backend ATM
+			self.assertTrue(['add', j, 'auto'] in comm_commands)
+			# and warn on useDNS
+			self.assertTrue(['set', j, 'usedns', 'warn'] in comm_commands)
+			self.assertTrue(['start', j] in comm_commands)
+		# last commands should be the 'start' commands
+		self.assertEqual(comm_commands[-1][0], 'start')
+		# TODO: make sure that all of the jails have actions assigned,
+		#       otherwise it makes little to no sense

From 91d5736c125a0d9db0a688e928bc17db2afaec82 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 26 Mar 2013 09:40:04 -0400
Subject: [PATCH 147/544] ENH: postfix filter -- react also on (450 4.7.1) with
 empty from/to. fixes #126

---
 config/filter.d/postfix.conf | 1 +
 testcases/files/logs/postfix | 3 +++
 2 files changed, 4 insertions(+)
 create mode 100644 testcases/files/logs/postfix

diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index 8db7faee..d2dc4a0c 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -15,6 +15,7 @@
 # Values:  TEXT
 #
 failregex = reject: RCPT from (.*)\[<HOST>\]: 554
+            reject: RCPT from (.*)\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/postfix b/testcases/files/logs/postfix
new file mode 100644
index 00000000..28ff95a4
--- /dev/null
+++ b/testcases/files/logs/postfix
@@ -0,0 +1,3 @@
+# per https://github.com/fail2ban/fail2ban/issues/125
+# and https://github.com/fail2ban/fail2ban/issues/126
+Feb 21 09:21:54 xxx postfix/smtpd[14398]: NOQUEUE: reject: RCPT from example.com[192.0.43.10]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=

From d7d5228964baf589270f7f1ecdb83bcda0d6dac1 Mon Sep 17 00:00:00 2001
From: Erwan Ben Souiden <erwan@aleikoum.net>
Date: Tue, 26 Mar 2013 15:55:26 +0100
Subject: [PATCH 148/544] Replace the check_fail2ban script by a new one which
 respects the Nagios specs (like status, output, perfdata, help...). Also add
 a README which includes the content of f2ban.txt (which is now removed)

---
 files/nagios/README         | 104 ++++++++++
 files/nagios/check_fail2ban | 404 ++++++++++++++++++++++++++++--------
 files/nagios/f2ban.txt      |  18 --
 3 files changed, 426 insertions(+), 100 deletions(-)
 create mode 100644 files/nagios/README
 delete mode 100644 files/nagios/f2ban.txt

diff --git a/files/nagios/README b/files/nagios/README
new file mode 100644
index 00000000..99ffc4e0
--- /dev/null
+++ b/files/nagios/README
@@ -0,0 +1,104 @@
+Description
+-----------
+This plugin checks if the fail2ban server is running and how many IPs are currently banned.
+You can use this plugin to monitor all the jails or just a specific jail.
+
+
+How to use
+----------
+Just have to run the following command:
+    $ ./check_fail2ban_activity --help
+ 
+If you need to use this script with NRPE you just have to do the 
+following steps:
+
+1 allow your user to run the script with the sudo rights. Just add
+  something like that in your /etc/sudoers (use visudo) :
+        nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban_activity
+
+2 then just add this kind of line in your NRPE config file :
+  command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban_activity
+
+3 don't forget to restart your NRPE daemon
+   
+/!\ be careful to let no one able to update the check_fail2ban_activity ;)
+------------------------------------------------------------------------------
+
+
+Notes (from f2ban.txt)
+-----
+It seems that Fail2ban is currently not working, please login and check
+
+HELP:
+
+1.) stop the Service
+/etc/init.d/fail2ban stop
+
+2.) delete the socket if available
+rm /tmp/fail2ban.sock
+
+3.) start the Service 
+/etc/init.d/fail2ban start
+
+4.) check if fail2ban is working
+fail2ban-client ping
+Answer should be "pong"
+
+5.) if the answer is not "pong" run away or  CRY FOR HELP ;-)
+
+
+Help
+----
+
+Usage: /<path-to>/check_fail2ban_activity [-p] [-D "CHECK FAIL2BAN ACTIVITY"] [-v] [-c 2] [-w 1] [-s /<path-to>/socket] [-P /usr/bin/fail2ban-client]
+
+Options:
+ -h, --help
+    Print detailed help screen
+ -V, --version
+    Print version information
+ -D, --display=STRING
+    To modify the output display 
+    default is "CHECK FAIL2BAN ACTIVITY"
+ -P, --path-fail2ban_client=STRING
+    Specify the path to the tw_cli binary
+    default value is /usr/bin/fail2ban-client
+ -c, --critical=INT
+    Specify a critical threshold
+    default is 2
+ -w, --warning=INT
+    Specify a warning threshold
+    default is 1
+ -s, --socket=STRING
+    Specify a socket path
+    default is unset
+ -p, --perfdata
+    If you want to activate the perfdata output
+ -v, --verbose
+    Show details for command-line debugging (Nagios may truncate the output)
+
+
+Example
+-------
+
+# for a specific jail
+$ ./check_fail2ban_activity --verbose -p -j ssh -w 1 -c 5 -P /usr/bin/fail2ban-client
+DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
+DEBUG : /usr/bin/fail2ban-client exists and is executable
+DEBUG : final fail2ban command: /usr/bin/fail2ban-client
+DEBUG : warning threshold : 1, critical threshold : 5
+DEBUG : it seems the connection with the fail2ban server is ok
+CHECK FAIL2BAN ACTIVITY - OK - 0 current banned IP(s) for the specific jail ssh | currentBannedIP=0
+
+# for all the current jails
+$ ./check_fail2ban_activity --verbose -p -w 1 -c 5 -P /usr/bin/fail2ban-client
+DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
+DEBUG : /usr/bin/fail2ban-client exists and is executable
+DEBUG : final fail2ban command: /usr/bin/fail2ban-client
+DEBUG : warning threshold : 1, critical threshold : 5
+DEBUG : it seems the connection with the fail2ban server is ok
+DEBUG : jails list: apache, ssh-ddos, ssh
+DEBUG : the jail apache has currently 0 banned IPs
+DEBUG : the jail ssh-ddos has currently 0 banned IPs
+DEBUG : the jail ssh has currently 0 banned IPs
+CHECK FAIL2BAN ACTIVITY - OK - 3 detected jails with 0 current banned IP(s) | currentBannedIP=0
diff --git a/files/nagios/check_fail2ban b/files/nagios/check_fail2ban
index 2b38e8a9..01ff2dae 100755
--- a/files/nagios/check_fail2ban
+++ b/files/nagios/check_fail2ban
@@ -1,105 +1,345 @@
-#!/bin/bash
+#!/usr/bin/perl
+
+#  -------------------------------------------------------
+#             -=- <check_fail2ban_activity> -=-
+#  -------------------------------------------------------
 #
-# Usage: ./check_fail2ban
-###############################################################################################
-# Description: 
-#		This plugin will check the status of Fail2ban.  
+#  Description : This plugin checks if the fail2ban server is running 
+#  and how many IPs are currently banned.
+#  
 #
-# Created:      2008-10-25 (Sebastian Mueller)
+# inspired by the work of Sebastian Mueller - http://www.elchtest.eu
+# 
 #
-# Changes:      2008-10-26 fixed some issues (Sebastian Mueller)
-# Changes:      2009-01-25 add the second check, when server is not replying and the
-#		process is hang-up (Sebastian Mueller)
+#  Version : 0.1
+#  -------------------------------------------------------
+#  In :
+#     - see the How to use section
 #
-# please visit my website http://www.elchtest.eu or my personal WIKI http://wiki.elchtest.eu
+#  Out :
+#     - only print on the standard output 
 #
-################################################################################################
-# if you have any questions, send a mail to linux@krabbe-offline.de 
+#  Features :
+#     - perfdata output
+#     - works with only a specific jail
 #
-# this script is for my personal use. read the script before running/using it!!!
+#  Fix Me/Todo :
+#     - too many things ;) but let me know what do you think about it
 #
+# ####################################################################
+
+# ####################################################################
+# GPL v3
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# ####################################################################
+
+# ####################################################################
+# How to use :
+# ------------
 #
-# YOU HAVE BEEN WARNED. THIS MAY DESTROY YOUR MACHINE. I ACCEPT NO RESPONSIBILITY.
-###############################################################################################
+# Just have to run the following command:
+#       $ ./check_fail2ban_activity --help
+# 
+# If you need to use this script with NRPE you just have to do the 
+# following steps:
+#
+# 1 allow your user to run the script with the sudo rights. Just add
+#   something like that in your /etc/sudoers (use visudo) :
+#     nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban_activity
+#
+# 2 then just add this kind of line in your NRPE config file :
+#   command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban_activity
+#
+# 3 don't forget to restart your NRPE daemon
+#
+#	
+# /!\ be careful to let no one able to update the check_fail2ban_activity ;)
+# ------------------------------------------------------------------------------
+#
+# ####################################################################
+
+# ####################################################################
+# Changelog :
+# -----------
+#
+# --------------------------------------------------------------------
+#   Date:12/03/2013   Version:0.1     Author:Erwan Ben Souiden
+#   >> creation
+# ####################################################################
+
+# ####################################################################
+#            Don't touch anything under this line!
+#        You shall not pass - Gandalf is watching you
+# ####################################################################
+
+use strict;
+use warnings;
+use Getopt::Long qw(:config no_ignore_case);
+
+# Generic variables
+# -----------------
+my $version = '0.1';
+my $author = 'Erwan Labynocle Ben Souiden';
+my $a_mail = 'erwan@aleikoum.net';
+my $script_name = 'check_fail2ban_activity';
+my $verbose_value = 0;
+my $version_value = 0;
+my $more_value = 0;
+my $help_value = 0;
+my $perfdata_value = 0;
+my %ERRORS=('OK'=>0,'WARNING'=>1,'CRITICAL'=>2,'UNKNOWN'=>3,'DEPENDENT'=>4);
+
+# Plugin default variables
+# ------------------------
+my $display = 'CHECK FAIL2BAN ACTIVITY';
+my ($critical,$warning) = (2,1);
+my $fail2ban_client_path = '/usr/bin/fail2ban-client';
+my $fail2ban_socket = '';
+my $jail_specific = '';
+
+GetOptions (
+    'P=s' => \ $fail2ban_client_path,
+    'path-fail2ban_client=s' => \ $fail2ban_client_path,
+    'j=s' => \ $jail_specific,
+    'jail=s' => \ $jail_specific,
+    'w=i' => \ $warning,
+    'warning=i' => \ $warning,
+    'socket=s' => \ $fail2ban_socket,
+    'S=s' => \ $fail2ban_socket,
+    'c=i' => \ $critical,
+    'critical=i' => \ $critical,
+    'V' => \ $version_value,
+    'version' => \ $version_value,
+    'h' => \ $help_value,
+    'H' => \ $help_value,
+    'help' => \ $help_value,
+    'display=s' => \ $display,
+    'D=s' => \ $display,
+    'perfdata' => \ $perfdata_value,
+    'p' => \ $perfdata_value,
+    'v' => \ $verbose_value,
+    'verbose' => \ $verbose_value
+);
+
+print_usage() if ($help_value);
+print_version() if ($version_value);
 
 
-SECOND_CHECK=0 
-STATE_OK=0
-STATE_CRITICAL=2
-
-######################################################################
-# Read the Status from fail2ban-client 
-######################################################################
-check_processes_fail2ban()
-{
-        
-  F2B=`sudo -u root fail2ban-client ping | awk -F " " '{print $3}'`
-  exit_fail2ban=0
-
-  if  [[ $F2B = "pong" ]]; then
-   exit_fail2ban=$STATE_OK
- else
- exit_fail2ban=$STATE_CRITICAL
- fi
+# Syntax check of your specified options
+# --------------------------------------
 
+print "DEBUG : fail2ban_client_path: $fail2ban_client_path\n" if ($verbose_value);
+if (($fail2ban_client_path eq "")) {
+    print $display.'- one or more following arguments are missing: fail2ban_client_path'."\n";
+    exit $ERRORS{"UNKNOWN"};
 }
-######################################################################
-# first check in the Background, PID will be killed when no response
-# after 10 seconds, might be possible, otherwise the script will be
-# present in your memory all the time
-######################################################################
 
-check_processes_fail2ban &
-pid=$!
+if(! -x $fail2ban_client_path) {
+    print $display.' - '.$fail2ban_client_path.' is not executable by you'."\n";
+    exit $ERRORS{"UNKNOWN"};
+}
+print "DEBUG : $fail2ban_client_path exists and is executable\n" if ($verbose_value);
 
-typeset -i i=0
-while ps $pid >/dev/null
-do
- sleep 1
- i=$i+1
-if [ $i -ge 10 ]
- then
- kill $pid 
-   SECOND_CHECK=1
-   exit_fail2ban=$STATE_CRITICAL
-   break
-fi
-done
+my $fail2ban_cmd = $fail2ban_client_path;
+$fail2ban_cmd .= " -s $fail2ban_socket" if ($fail2ban_socket);
 
-######################################################################
-# when the Server response (does not mean the FAIL2BAN is working)
-# in the first step, then it will run again and test the Service 
-# and provide the real status
-######################################################################
+print "DEBUG : final fail2ban command: $fail2ban_cmd\n" if ($verbose_value);
+
+print "DEBUG : warning threshold : $warning, critical threshold : $critical\n" if ($verbose_value);
+if (($critical < 0) or ($warning < 0) or ($critical < $warning)) {
+    print $display.' - the thresholds must be integers and the critical threshold higher or equal than the warning threshold'."\n";
+    exit $ERRORS{"UNKNOWN"};
+}
+
+# Core script
+# -----------
+my ($how_many_jail,$how_many_banned,$return_print,$plugstate) = (0,0,"","OK");
 
 
-if [ $SECOND_CHECK -eq 0  ]; then
-  check_processes_fail2ban
- elif [ $SECOND_CHECK -eq 1 ]; then
-  exit_fail2ban=$STATE_CRITICAL
-fi
+### Test the connection to the fail2ban server
+my @command_output = `$fail2ban_cmd ping`;
+my $return_code = $?;
+if ($return_code) {
+    print $display.'CRITICAL - non-zero exit code during testing fail2ban-client ping, check if the server is running and if you have the good permissions';
+    exit $ERRORS{"CRITICAL"};
+}
+else {
+    print "DEBUG : it seems the connection with the fail2ban server is ok\n" if ($verbose_value);
+}
 
 
+### Only if you specify one jail
+if ($jail_specific) {
+    my $current_ban_number = currently_ban("$fail2ban_cmd","$jail_specific");
+    if ($current_ban_number == -1) {
+        print $display.' - CRITICAL - impossible to retrieve info about the jail '.$jail_specific;
+        exit $ERRORS{"CRITICAL"};
+    }
+    else {
+        $how_many_banned = int($current_ban_number);
+        $return_print = $how_many_banned.' current banned IP(s) for the specific jail '.$jail_specific;
+    }
+}
+### To analyze all the jail
+else {
+    # Retrieve the jails list
+    my @jail_list = obtain_jail_list("$fail2ban_cmd");
+    if ($jail_list[0] eq "-1") {
+        print $display.' - CRITICAL - impossible to retrieve the jail list'."\n";
+        exit $ERRORS{"CRITICAL"};
+    }
 
-######################################################################
-# Main Menu
-######################################################################
+    foreach (@jail_list) {
+        $how_many_jail ++;
+
+        my $jail_name = $_;
+        $jail_name =~ tr/ //ds;
+
+        my $current_ban_number = currently_ban("$fail2ban_cmd","$jail_name");
+        if ($current_ban_number == -1) {
+            print "DEBUG : problem to parse the current banned IPs for jail $jail_name\n" if ($verbose_value);
+        }
+        else {
+            print "DEBUG : the jail $jail_name has currently $current_ban_number banned IPs\n" if ($verbose_value);
+            $how_many_banned += int($current_ban_number);
+        }
+    }
+    $return_print = $how_many_jail.' detected jails with '.$how_many_banned.' current banned IP(s)';
+}
+
+### Final
+$plugstate = "CRITICAL" if ($how_many_banned >= $critical);
+$plugstate = "WARNING" if (($how_many_banned >= $warning) && ($how_many_banned < $critical));
+
+$return_print = $display." - ".$plugstate." - ".$return_print;
+$return_print .= " | currentBannedIP=$how_many_banned" if ($perfdata_value);
+
+print $return_print;
+exit $ERRORS{"$plugstate"};
 
 
-final_exit=$exit_fail2ban
-if [ $final_exit -eq 0  ]; then
-  echo "SYSTEM OK - Fail2ban is working normally"
-  exitstatus=$STATE_OK
-elif [ $final_exit -ne "0" ]; then
-  echo "SYSTEM WARNING - Fail2Ban is not working"
-######################################################################
-# If don't have a Nagios Server for monitoring, remove the comment and
-# add your Mail Address. You can check it with a Cron Job once an hour.
-# put a txt file on your server and describe how to fix the issue, this 
-# could be attached to the mail.
-######################################################################
-#  mutt -s "FAIL2BAN NOT WORKING" your@example.com < /home/f2ban.txt
+# ####################################################################
+# function 1 : display the help
+# -----------------------------
+sub print_usage {
+    print <<EOT;
+$script_name version $version by $author
 
-  exitstatus=$STATE_CRITICAL
-fi
-exit $exitstatus
+This plugin checks if the fail2ban server is running and how many IPs are currently banned.
+You can use this plugin to monitor all the jails or just a specific jail.
+
+Usage: /<path-to>/$script_name [-p] [-D "$display"] [-v] [-c 2] [-w 1] [-s /<path-to>/socket] [-P /usr/bin/fail2ban-client]
+
+Options:
+ -h, --help
+    Print detailed help screen
+ -V, --version
+    Print version information
+ -D, --display=STRING
+    To modify the output display 
+    default is "CHECK FAIL2BAN ACTIVITY"
+ -P, --path-fail2ban_client=STRING
+    Specify the path to the tw_cli binary
+    default value is /usr/bin/fail2ban-client
+ -c, --critical=INT
+    Specify a critical threshold
+    default is 2
+ -w, --warning=INT
+    Specify a warning threshold
+    default is 1
+ -s, --socket=STRING
+    Specify a socket path
+    default is unset
+ -p, --perfdata
+    If you want to activate the perfdata output
+ -v, --verbose
+    Show details for command-line debugging (Nagios may truncate the output)
+    
+Send email to $a_mail if you have questions
+regarding use of this software. To submit patches or suggest improvements,
+send email to $a_mail
+This plugin has been created by $author
+
+Hope you will enjoy it ;)
+
+Remember :
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+EOT
+    exit $ERRORS{"UNKNOWN"};
+}
+
+# function 2 : display version information
+# ----------------------------------------
+sub print_version {
+    print <<EOT;
+$script_name version $version
+EOT
+    exit $ERRORS{"UNKNOWN"};
+}
+
+# function 3 : return the jail list
+# ---------------------------------
+sub obtain_jail_list {
+    my ($fail2ban_client_path) = @_;
+
+    my @command_output = `$fail2ban_client_path status`;
+    my $return_code = $?;
+    if ($return_code) {
+        return -1;
+    }
+    
+    my @jail_list;
+    foreach (@command_output) {
+        if ($_=~/^.*Jail list:\t+(.*)/) {
+            print "DEBUG : jails list: $1\n" if ($verbose_value);
+            @jail_list = split(/,/, $1);
+        }
+    }
+    
+    return @jail_list;
+}
+
+# function 4 : return how many IP are currently ban for a given jail
+# ------------------------------------------------------------------
+sub currently_ban {
+    my ($fail2ban_client_path,$jail_name) = @_;
+
+    my @command_output = `$fail2ban_client_path status $jail_name`;
+    my $return_code = $?;
+    if ($return_code) {
+        return -1;
+    }
+
+    foreach (@command_output) {
+        if ($_=~/^.*Currently banned:\t+(.*)/) {
+            my $current_count = $1;
+            $current_count =~ tr/ //ds;
+            return $current_count;
+        }
+    }
+    return -1;
+}
diff --git a/files/nagios/f2ban.txt b/files/nagios/f2ban.txt
deleted file mode 100644
index 0f048ff7..00000000
--- a/files/nagios/f2ban.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-It seems that Fail2ban is currently not working, please login and check
-
-HELP:
-
-1.) stop the Service
-/etc/init.d/fail2ban stop
-
-2.) delete the socket if available
-rm /tmp/fail2ban.sock
-
-3.) start the Service 
-/etc/init.d/fail2ban start
-
-4.) check if fail2ban is working
-fail2ban-client ping
-Answer should be "pong"
-
-5.) if the answer is not "pong" run away or  CRY FOR HELP ;-) 

From c4d92fba716d8c9d97f2e989103b66e575e7585f Mon Sep 17 00:00:00 2001
From: Erwan Ben Souiden <erwan@aleikoum.net>
Date: Tue, 26 Mar 2013 16:08:05 +0100
Subject: [PATCH 149/544] fix the script name to check_fail2ban everywhere

---
 files/nagios/README         | 14 +++++++-------
 files/nagios/check_fail2ban | 12 ++++++------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/files/nagios/README b/files/nagios/README
index 99ffc4e0..28e84495 100644
--- a/files/nagios/README
+++ b/files/nagios/README
@@ -7,21 +7,21 @@ You can use this plugin to monitor all the jails or just a specific jail.
 How to use
 ----------
 Just have to run the following command:
-    $ ./check_fail2ban_activity --help
+    $ ./check_fail2ban --help
  
 If you need to use this script with NRPE you just have to do the 
 following steps:
 
 1 allow your user to run the script with the sudo rights. Just add
   something like that in your /etc/sudoers (use visudo) :
-        nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban_activity
+        nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban
 
 2 then just add this kind of line in your NRPE config file :
-  command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban_activity
+  command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban
 
 3 don't forget to restart your NRPE daemon
    
-/!\ be careful to let no one able to update the check_fail2ban_activity ;)
+/!\ be careful to let no one able to update the check_fail2ban ;)
 ------------------------------------------------------------------------------
 
 
@@ -50,7 +50,7 @@ Answer should be "pong"
 Help
 ----
 
-Usage: /<path-to>/check_fail2ban_activity [-p] [-D "CHECK FAIL2BAN ACTIVITY"] [-v] [-c 2] [-w 1] [-s /<path-to>/socket] [-P /usr/bin/fail2ban-client]
+Usage: /<path-to>/check_fail2ban [-p] [-D "CHECK FAIL2BAN ACTIVITY"] [-v] [-c 2] [-w 1] [-s /<path-to>/socket] [-P /usr/bin/fail2ban-client]
 
 Options:
  -h, --help
@@ -82,7 +82,7 @@ Example
 -------
 
 # for a specific jail
-$ ./check_fail2ban_activity --verbose -p -j ssh -w 1 -c 5 -P /usr/bin/fail2ban-client
+$ ./check_fail2ban --verbose -p -j ssh -w 1 -c 5 -P /usr/bin/fail2ban-client
 DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
 DEBUG : /usr/bin/fail2ban-client exists and is executable
 DEBUG : final fail2ban command: /usr/bin/fail2ban-client
@@ -91,7 +91,7 @@ DEBUG : it seems the connection with the fail2ban server is ok
 CHECK FAIL2BAN ACTIVITY - OK - 0 current banned IP(s) for the specific jail ssh | currentBannedIP=0
 
 # for all the current jails
-$ ./check_fail2ban_activity --verbose -p -w 1 -c 5 -P /usr/bin/fail2ban-client
+$ ./check_fail2ban --verbose -p -w 1 -c 5 -P /usr/bin/fail2ban-client
 DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
 DEBUG : /usr/bin/fail2ban-client exists and is executable
 DEBUG : final fail2ban command: /usr/bin/fail2ban-client
diff --git a/files/nagios/check_fail2ban b/files/nagios/check_fail2ban
index 01ff2dae..148c92d5 100755
--- a/files/nagios/check_fail2ban
+++ b/files/nagios/check_fail2ban
@@ -1,7 +1,7 @@
 #!/usr/bin/perl
 
 #  -------------------------------------------------------
-#             -=- <check_fail2ban_activity> -=-
+#             -=- <check_fail2ban> -=-
 #  -------------------------------------------------------
 #
 #  Description : This plugin checks if the fail2ban server is running 
@@ -49,22 +49,22 @@
 # ------------
 #
 # Just have to run the following command:
-#       $ ./check_fail2ban_activity --help
+#       $ ./check_fail2ban --help
 # 
 # If you need to use this script with NRPE you just have to do the 
 # following steps:
 #
 # 1 allow your user to run the script with the sudo rights. Just add
 #   something like that in your /etc/sudoers (use visudo) :
-#     nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban_activity
+#     nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban
 #
 # 2 then just add this kind of line in your NRPE config file :
-#   command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban_activity
+#   command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban
 #
 # 3 don't forget to restart your NRPE daemon
 #
 #	
-# /!\ be careful to let no one able to update the check_fail2ban_activity ;)
+# /!\ be careful to let no one able to update the check_fail2ban ;)
 # ------------------------------------------------------------------------------
 #
 # ####################################################################
@@ -92,7 +92,7 @@ use Getopt::Long qw(:config no_ignore_case);
 my $version = '0.1';
 my $author = 'Erwan Labynocle Ben Souiden';
 my $a_mail = 'erwan@aleikoum.net';
-my $script_name = 'check_fail2ban_activity';
+my $script_name = 'check_fail2ban';
 my $verbose_value = 0;
 my $version_value = 0;
 my $more_value = 0;

From 72b06479a58c3c3961e0bc5d4812271662bf946e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 27 Mar 2013 11:08:33 -0400
Subject: [PATCH 150/544] ENH: Slight tune ups for fresh SOGo filter + comment
 into the sample log file

---
 config/filter.d/sogo-auth.conf | 2 +-
 testcases/files/logs/sogo-auth | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf
index 6054c589..3e238419 100644
--- a/config/filter.d/sogo-auth.conf
+++ b/config/filter.d/sogo-auth.conf
@@ -11,7 +11,7 @@
 # Note: the error log may contain multiple hosts, whereas the first one 
 # is the client and all others are poxys. We match the first one, only
 
-failregex = Login from '<HOST>.*' for user '.*' might not have worked
+failregex = Login from '<HOST>' for user '.*' might not have worked( - password policy: \d*  grace: -?\d*  expire: -?\d*  bound: -?\d*)?\s*$
 
 # Option: ignoreregex
 # Notes.: regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/sogo-auth b/testcases/files/logs/sogo-auth
index 6dbe7356..e4fb9409 100644
--- a/testcases/files/logs/sogo-auth
+++ b/testcases/files/logs/sogo-auth
@@ -1,3 +1,6 @@
+# yoh: Kept original apache log lines as well, just in case they might come useful
+#      for (testing) multiline regular expressions which would further constraint
+#      SOGo log lines
 Mar 24 08:58:32 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87c3008> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=hack0r,ou=users,dc=mail,dc=example,dc=org"; }
 Mar 24 08:58:32 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'hack0r' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
 173.194.44.31 - - [24/Mar/2013:08:58:32 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/38 0.311 - - 2M
@@ -12,4 +15,3 @@ Mar 24 08:58:59 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user
 173.194.44.31 - - [24/Mar/2013:08:58:59 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/36 0.007 - - 0
 Mar 24 08:59:04 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87bc088> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=admin,ou=users,dc=mail,dc=example,dc=org"; }
 Mar 24 08:59:04 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'admin' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
-173.194.44.31 - - [24/Mar/2013:08:59:04 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/37 0.007 - - 0

From f643e2e907ddb47d565896cc7bec6cfccf79517d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 27 Mar 2013 11:51:07 -0400
Subject: [PATCH 151/544] non-static (get|set)BaseDir for Configurator. fixes
 #160

ConfigReader's (get|set)BaseDir are no longer static as a result of
.d/ support RFing
---
 client/configurator.py            | 20 ++++++++++++--------
 testcases/clientreadertestcase.py | 19 +++++++++++++++++++
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/client/configurator.py b/client/configurator.py
index 0baff2d8..2097fd54 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -43,15 +43,19 @@ class Configurator:
 		self.__fail2ban = Fail2banReader()
 		self.__jails = JailsReader()
 	
-	#@staticmethod
-	def setBaseDir(folderName):
-		ConfigReader.setBaseDir(folderName)
-	setBaseDir = staticmethod(setBaseDir)
+	def setBaseDir(self, folderName):
+		self.__fail2ban.setBaseDir(folderName)
+		self.__jails.setBaseDir(folderName)
 	
-	#@staticmethod
-	def getBaseDir():
-		return ConfigReader.getBaseDir()
-	getBaseDir = staticmethod(getBaseDir)
+	def getBaseDir(self):
+		fail2ban_basedir = self.__fail2ban.getBaseDir()
+		jails_basedir = self.__jails.getBaseDir()
+		if fail2ban_basedir != jails_basedir:
+			logSys.error("fail2ban.conf and jails.conf readers have differing "
+						 "basedirs: %r and %r. "
+						 "Returning the one for fail2ban.conf"
+						 % (fail2ban_basedir, jails_basedir))
+		return fail2ban_basedir
 	
 	def readEarly(self):
 		self.__fail2ban.read()
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 28eb6b09..3e606785 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -25,6 +25,7 @@ import os, shutil, tempfile, unittest
 from client.configreader import ConfigReader
 from client.jailreader import JailReader
 from client.jailsreader import JailsReader
+from client.configurator import Configurator
 
 class ConfigReaderTest(unittest.TestCase):
 
@@ -146,3 +147,21 @@ class JailsReaderTest(unittest.TestCase):
 		self.assertEqual(comm_commands[-1][0], 'start')
 		# TODO: make sure that all of the jails have actions assigned,
 		#       otherwise it makes little to no sense
+
+	def testConfigurator(self):
+		configurator = Configurator()
+		configurator.setBaseDir('config')
+		self.assertEqual(configurator.getBaseDir(), 'config')
+
+		configurator.readEarly()
+		opts = configurator.getEarlyOptions()
+		# our current default settings
+		self.assertEqual(opts['socket'], '/var/run/fail2ban/fail2ban.sock')
+		self.assertEqual(opts['pidfile'], '/var/run/fail2ban/fail2ban.pid')
+
+		# and if we force change configurator's fail2ban's baseDir
+		# there should be an error message (test visually ;) --
+		# otherwise just a code smoke test)
+		configurator._Configurator__jails.setBaseDir('/tmp')
+		self.assertEqual(configurator._Configurator__jails.getBaseDir(), '/tmp')
+		self.assertEqual(configurator.getBaseDir(), 'config')

From 4b11f071ed3f3a3f066e9680ec0b4a2ad3c1822e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 27 Mar 2013 12:02:19 -0400
Subject: [PATCH 152/544] DOC: minor fix ups of manpages. fixes #159

---
 man/fail2ban.1  | 2 +-
 man/jail.conf.5 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/man/fail2ban.1 b/man/fail2ban.1
index 9af9ec54..8f93dbc7 100644
--- a/man/fail2ban.1
+++ b/man/fail2ban.1
@@ -1,4 +1,4 @@
-.TH FAIL2BAN "1"
+.TH FAIL2BAN "1" "March 2013" "Fail2Ban"
 .SH NAME
 fail2ban \- a set of server and client programs to limit brute force authentication attempts.
 .SH DESCRIPTION
diff --git a/man/jail.conf.5 b/man/jail.conf.5
index 10bcef7f..552b0ac0 100644
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@@ -1,4 +1,4 @@
-.TH JAIL.CONF.5 "fail2ban" "jail.conf(5)"
+.TH JAIL.CONF "5" "March 2013" "Fail2Ban" "Fail2Ban Configuration"
 .SH NAME
 jail.conf \- configuration for the fail2ban server
 .SH SYNOPSIS
@@ -30,7 +30,7 @@ Override only the settings you need to change and the rest of the configuration
 \fI*.d/\fR
 .RS
 In addition to .local, for any .conf file there can be a corresponding
-.d directory to contain additional .conf files that will be read after the
+\fI.d/\fR directory to contain additional .conf files that will be read after the
 appropriate .local file.  Last parsed file will take precidence over
 identical entries, parsed alphabetically, e.g.
 

From ab044b75ea0ad89e44ae075d24162ff9d5c07284 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 27 Mar 2013 12:22:39 -0400
Subject: [PATCH 153/544] BF: delay check for the existence of config directory
 until read()

---
 client/configreader.py            | 6 +++---
 testcases/clientreadertestcase.py | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/client/configreader.py b/client/configreader.py
index 9028df48..243c843c 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -46,15 +46,15 @@ class ConfigReader(SafeConfigParserWithIncludes):
 	def setBaseDir(self, basedir):
 		if basedir is None:
 			basedir = ConfigReader.DEFAULT_BASEDIR	# stock system location
-		if not (os.path.exists(basedir) and os.access(basedir, os.R_OK | os.X_OK)):
-			raise ValueError("Base configuration directory %s either does not exist "
-							 "or is not accessible" % basedir)
 		self._basedir = basedir.rstrip('/')
 	
 	def getBaseDir(self):
 		return self._basedir
 	
 	def read(self, filename):
+		if not (os.path.exists(self._basedir) and os.access(self._basedir, os.R_OK | os.X_OK)):
+			raise ValueError("Base configuration directory %s either does not exist "
+							 "or is not accessible" % self._basedir)
 		basename = os.path.join(self._basedir, filename)
 		logSys.debug("Reading configs for %s under %s "  % (basename, self._basedir))
 		config_files = [ basename + ".conf",
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 3e606785..fad16f04 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -114,7 +114,8 @@ class JailsReaderTest(unittest.TestCase):
 
 	def testProvidingBadBasedir(self):
 		if not os.path.exists('/XXX'):
-			self.assertRaises(ValueError, JailsReader, basedir='/XXX')
+			reader = JailsReader(basedir='/XXX')
+			self.assertRaises(ValueError, reader.read)
 
 	def testReadStockJailConf(self):
 		jails = JailsReader(basedir='config') # we are running tests from root project dir atm

From bf4d4af1d42e9acc50f8f70ae34d13ecaeee4dc6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 27 Mar 2013 15:11:49 -0400
Subject: [PATCH 154/544] ENH(BF?): overload open() (for buffering) within
 filtertestcase to guarantee atomic writing

This is with the hope to further resolve random tests failures
( primarily on fast travis-ci systems ;) )
---
 testcases/filtertestcase.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index a20a932d..ae0e6525 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -22,6 +22,7 @@
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier; 2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
+from __builtin__ import open as fopen
 import unittest
 import os
 import sys
@@ -38,6 +39,20 @@ from server.failmanager import FailManagerEmpty
 # Useful helpers
 #
 
+# yoh: per Steven Hiscocks's insight while troubleshooting
+# https://github.com/fail2ban/fail2ban/issues/103#issuecomment-15542836
+# adding a sufficiently large buffer might help to guarantee that
+# writes happen atomically.
+def open(*args):
+	"""Overload built in open so we could assure sufficiently large buffer
+
+	Explicit .flush would be needed to assure that changes leave the buffer
+	"""
+	if len(args) == 2:
+		# ~50kB buffer should be sufficient for all tests here.
+		args = args + (50000,)
+	return fopen(*args)
+
 def _killfile(f, name):
 	try:
 		f.close()

From ef3f2b7e999ea4a02890e55e03f03d608d929699 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 27 Mar 2013 23:40:50 -0400
Subject: [PATCH 155/544] TST: be more aggressive in cleanup of temp files +
 use mktemp instead of mkstemp

---
 testcases/filtertestcase.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index ae0e6525..788c9e9d 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -63,6 +63,11 @@ def _killfile(f, name):
 	except:
 		pass
 
+	# there might as well be the .bak file
+	if os.path.exists(name + '.bak'):
+		_killfile(None, name + '.bak')
+
+
 def _sleep_4_poll():
 	"""PollFilter relies on file timestamps - so we might need to
 	sleep to guarantee that they differ
@@ -342,7 +347,9 @@ def get_monitor_failures_testcase(Filter_):
 	"""Generator of TestCase's for different filters/backends
 	"""
 
-	_, testclass_name = tempfile.mkstemp('fail2ban', 'monitorfailures')
+	# add Filter_'s name so we could easily identify bad cows
+	testclass_name = tempfile.mktemp(
+		'fail2ban', 'monitorfailures_%s' % (Filter_.__name__,))
 
 	class MonitorFailures(unittest.TestCase):
 		count = 0

From 7cf509378cadd949c9bd76ed650955efe877d1fa Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 28 Mar 2013 11:36:18 -0400
Subject: [PATCH 156/544] DOC: minor change -- refer to the fail2ban manpage

---
 README | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/README b/README
index e926509e..cab683f5 100644
--- a/README
+++ b/README
@@ -51,10 +51,12 @@ call fail2ban-server directly.
 Configuration:
 --------------
 
-You can configure Fail2ban using the files in /etc/fail2ban. It is possible to
-configure the server using commands sent to it by fail2ban-client. The available
-commands are described in the man page of fail2ban-client. Please refer to it or
-to the website: http://www.fail2ban.org
+You can configure Fail2Ban using the files in /etc/fail2ban. It is
+possible to configure the server using commands sent to it by
+fail2ban-client. The available commands are described in the
+fail2ban-client(1) manpage.  Also see fail2ban(1) manpage for further
+references and find even more documentation on the website:
+http://www.fail2ban.org
 
 Contact:
 --------

From ffbbb9f8a38fca86b08c1d3f7c2a44749e5c1114 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 29 Mar 2013 12:31:50 -0400
Subject: [PATCH 157/544] ENH: deleted trailing spaces in fail2ban- cmdline
 tools

Now it was already a mix, and Cyril is not working on this code any
longer so no need to maintain this convention.
---
 fail2ban-client | 46 +++++++++++++++++++++++-----------------------
 fail2ban-regex  | 28 ++++++++++++++--------------
 fail2ban-server | 18 +++++++++---------
 3 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 061208dd..d8147f02 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -63,7 +63,7 @@ class Fail2banClient:
 		self.__conf["interactive"] = False
 		self.__conf["socket"] = None
 		self.__conf["pidfile"] = None
-		
+
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
@@ -73,7 +73,7 @@ class Fail2banClient:
 		print
 		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	
+
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
@@ -95,17 +95,17 @@ class Fail2banClient:
 		print "    -V, --version           print the version"
 		print
 		print "Command:"
-		
+
 		# Prints the protocol
 		printFormatted()
-		
+
 		print
 		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
-	
+
 	def dispInteractive(self):
 		print "Fail2Ban v" + version + " reads log file that contains password failure report"
 		print "and bans the corresponding IP addresses using firewall rules."
-		print 
+		print
 
 	def __sigTERMhandler(self, signum, frame):
 		# Print a new line because we probably come from wait
@@ -139,10 +139,10 @@ class Fail2banClient:
 			elif opt[0] in ["-V", "--version"]:
 				self.dispVersion()
 				sys.exit(0)
-	
+
 	def __ping(self):
 		return self.__processCmd([["ping"]], False)
-	
+
 	def __processCmd(self, cmd, showRet = True):
 		beautifier = Beautifier()
 		for c in cmd:
@@ -167,7 +167,7 @@ class Fail2banClient:
 					logSys.error(e)
 				return False
 		return True
-		
+
 	##
 	# Process a command line.
 	#
@@ -241,13 +241,13 @@ class Fail2banClient:
 				return False
 		else:
 			return self.__processCmd([cmd])
-	
-	
+
+
 	##
 	# Start Fail2Ban server.
 	#
 	# Start the Fail2ban server in daemon mode.
-	
+
 	def __startServerAsync(self, socket, pidfile, force = False):
 		# Forks the current process.
 		pid = os.fork()
@@ -278,7 +278,7 @@ class Fail2banClient:
 				except OSError:
 					logSys.error("Could not start %s" % self.SERVER)
 					os.exit(-1)
-	
+
 	def __waitOnServer(self):
 		# Wait for the server to start
 		cnt = 0
@@ -306,16 +306,16 @@ class Fail2banClient:
 			cnt += 1
 		if self.__conf["verbose"] > 1:
 			sys.stdout.write('\n')
-			
-	
+
+
 	def start(self, argv):
 		# Command line options
 		self.__argv = argv
-		
+
 		# Install signal handlers
 		signal.signal(signal.SIGTERM, self.__sigTERMhandler)
 		signal.signal(signal.SIGINT, self.__sigTERMhandler)
-		
+
 		# Reads the command line options.
 		try:
 			cmdOpts = 'hc:s:p:xdviqV'
@@ -324,9 +324,9 @@ class Fail2banClient:
 		except getopt.GetoptError:
 			self.dispUsage()
 			return False
-			
+
 		self.__getCmdLineOptions(optList)
-		
+
 		verbose = self.__conf["verbose"]
 		if verbose <= 0:
 			logSys.setLevel(logging.ERROR)
@@ -346,7 +346,7 @@ class Fail2banClient:
 
 		# Set the configuration path
 		self.__configurator.setBaseDir(self.__conf["conf"])
-		
+
 		# Set socket path
 		self.__configurator.readEarly()
 		conf = self.__configurator.getEarlyOptions()
@@ -360,7 +360,7 @@ class Fail2banClient:
 			ret = self.__readConfig()
 			self.dumpConfig(self.__stream)
 			return ret
-		
+
 		# Interactive mode
 		if self.__conf["interactive"]:
 			try:
@@ -401,14 +401,14 @@ class Fail2banClient:
 		self.__configurator.convertToProtocol()
 		self.__stream = self.__configurator.getConfigStream()
 		return ret
-	
+
 	def __readJailConfig(self, jail):
 		self.__configurator.readAll()
 		ret = self.__configurator.getOptions(jail)
 		self.__configurator.convertToProtocol()
 		self.__stream = self.__configurator.getConfigStream()
 		return ret
-	
+
 	#@staticmethod
 	def dumpConfig(cmd):
 		for c in cmd:
diff --git a/fail2ban-regex b/fail2ban-regex
index f9bc72c1..a0a90b05 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -50,24 +50,24 @@ class RegexStat:
 	def __str__(self):
 		return "%s(%r) %d failed: %s" \
 		  % (self.__class__, self.__failregex, self.__stats, self.__ipList)
-	
+
 	def inc(self):
 		self.__stats += 1
-	
+
 	def getStats(self):
 		return self.__stats
 
 	def getFailRegex(self):
 		return self.__failregex
-	
+
 	def appendIP(self, value):
 		self.__ipList.extend(value)
-	
+
 	def getIPList(self):
 		return self.__ipList
 
 class Fail2banRegex:
-	
+
 	test = None
 
 	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
@@ -87,7 +87,7 @@ class Fail2banRegex:
 		self.__logging_level = self.__verbose and logging.DEBUG or logging.WARN
 		logging.getLogger("fail2ban").addHandler(self.__hdlr)
 		logging.getLogger("fail2ban").setLevel(logging.ERROR)
-	
+
 	#@staticmethod
 	def dispVersion():
 		print "Fail2Ban v" + version
@@ -99,7 +99,7 @@ class Fail2banRegex:
 		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
 	dispVersion = staticmethod(dispVersion)
-	
+
 	#@staticmethod
 	def dispUsage():
 		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
@@ -128,7 +128,7 @@ class Fail2banRegex:
 		print
 		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
 	dispUsage = staticmethod(dispUsage)
-	
+
 	def getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
@@ -204,7 +204,7 @@ class Fail2banRegex:
 			print "Use regex line : " + stripReg
 			self.__failregex = [RegexStat(value)]
 		return True
-	
+
 	def testIgnoreRegex(self, line):
 		found = False
 		for regex in self.__ignoreregex:
@@ -221,7 +221,7 @@ class Fail2banRegex:
 			finally:
 				self.__filter.delIgnoreRegex(0)
 				logging.getLogger("fail2ban").setLevel(self.__logging_level)
-	
+
 	def testRegex(self, line):
 		found = False
 		for regex in self.__ignoreregex:
@@ -251,7 +251,7 @@ class Fail2banRegex:
 				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
 		for regex in self.__ignoreregex:
 					self.__filter.delIgnoreRegex(0)
-	
+
 	def printStats(self):
 		print
 		print "Results"
@@ -300,20 +300,20 @@ class Fail2banRegex:
 						print "    %s (%s)%s" % (
 							ip[0], timeString, ip[2] and " (already matched)" or "")
 			print
-			
+
 			print "Date template hits:"
 			for template in self.__filter.dateDetector.getTemplates():
 				if self.__verbose or template.getHits():
 					print `template.getHits()` + " hit(s): " + template.getName()
 			print
-			
+
 			print "Success, the total number of match is " + str(total)
 			print
 			print "However, look at the above section 'Running tests' which could contain important"
 			print "information."
 			return True
 
-			
+
 if __name__ == "__main__":
 	fail2banRegex = Fail2banRegex()
 	# Reads the command line options.
diff --git a/fail2ban-server b/fail2ban-server
index 81db58bd..404a1ced 100755
--- a/fail2ban-server
+++ b/fail2ban-server
@@ -46,7 +46,7 @@ logSys = logging.getLogger("fail2ban")
 # Its first goal was to protect a SSH server.
 
 class Fail2banServer:
-	
+
 	def __init__(self):
 		self.__server = None
 		self.__argv = None
@@ -55,7 +55,7 @@ class Fail2banServer:
 		self.__conf["force"] = False
 		self.__conf["socket"] = "/var/run/fail2ban/fail2ban.sock"
 		self.__conf["pidfile"] = "/var/run/fail2ban/fail2ban.pid"
-	
+
 	def dispVersion(self):
 		print "Fail2Ban v" + version
 		print
@@ -65,7 +65,7 @@ class Fail2banServer:
 		print
 		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
 		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	
+
 	def dispUsage(self):
 		""" Prints Fail2Ban command line options and exits
 		"""
@@ -88,7 +88,7 @@ class Fail2banServer:
 		print "    -V, --version        print the version"
 		print
 		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
-	
+
 	def __getCmdLineOptions(self, optList):
 		""" Gets the command line options
 		"""
@@ -109,11 +109,11 @@ class Fail2banServer:
 			if opt[0] in ["-V", "--version"]:
 	 			self.dispVersion()
 				sys.exit(0)
-		
+
 	def start(self, argv):
 		# Command line options
 		self.__argv = argv
-		
+
 		# Reads the command line options.
 		try:
 			cmdOpts = 'bfs:p:xhV'
@@ -122,9 +122,9 @@ class Fail2banServer:
 		except getopt.GetoptError:
 			self.dispUsage()
 			sys.exit(-1)
-			
+
 		self.__getCmdLineOptions(optList)
-		
+
 		try:
 			self.__server = Server(self.__conf["background"])
 			self.__server.start(self.__conf["socket"],
@@ -135,7 +135,7 @@ class Fail2banServer:
 			logSys.exception(e)
 			self.__server.quit()
 			return False
-		
+
 if __name__ == "__main__":
 	server = Fail2banServer()
 	if server.start(sys.argv):

From b3251fca7934c107c552ccc23618aa9647b679cc Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 29 Mar 2013 17:16:19 +0000
Subject: [PATCH 158/544] TST: Add support for coveralls for python 2.6 and
 python 2.7

---
 .travis.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index e655e7c1..2095446a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,6 +6,9 @@ python:
   - "2.6"
   - "2.7"
 install:
-  - "pip install pyinotify"
+  - pip install pyinotify
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then pip install coveralls; fi
 script:
-    - python ./fail2ban-testcases
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage python ./fail2ban-testcases; else python ./fail2ban-testcases; fi
+after_script:
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coveralls; fi

From 92d26e68972c291b085f0f0d85be3b35a02a44b6 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 29 Mar 2013 17:22:48 +0000
Subject: [PATCH 159/544] TST+BF: Fix incorrect commands for coveralls support

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 2095446a..b3de1358 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,8 +7,8 @@ python:
   - "2.7"
 install:
   - pip install pyinotify
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then pip install coveralls; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then pip install -q coveralls; fi
 script:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage python ./fail2ban-testcases; else python ./fail2ban-testcases; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage run fail2ban-testcases; else python ./fail2ban-testcases; fi
 after_script:
   - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coveralls; fi

From e7184e70f638720e37b18277544474082826fe78 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 29 Mar 2013 14:59:52 -0400
Subject: [PATCH 160/544] ENH: increase waiting to 4 sec for gamin/pyinotify

This will be the last gesture from me for the bloody tests:
https://travis-ci.org/kwirk/fail2ban/jobs/5904668
---
 testcases/filtertestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 788c9e9d..927cb2fe 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -458,7 +458,7 @@ def get_monitor_failures_testcase(Filter_):
 			self.file = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
 												  n=14, mode='w')
 			# Poll might need more time
-			self.assertTrue(self.isEmpty(2 + int(isinstance(self.filter, FilterPoll))*4))
+			self.assertTrue(self.isEmpty(4 + int(isinstance(self.filter, FilterPoll))*2))
 			self.assertRaises(FailManagerEmpty, self.filter.failManager.toBan)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 2)
 

From e0e116cb361c4c27d4956fadf9bf8ba9afc23fec Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 29 Mar 2013 19:09:55 +0000
Subject: [PATCH 161/544] TST: coverage ignore Travis CI python virtual
 environments

---
 .coveragerc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.coveragerc b/.coveragerc
index 3bffd79a..17fb730b 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -1,4 +1,4 @@
 
 [run]
 branch = True
-omit = /usr*
+omit = /usr* /home/travis/virtualenv/*

From 33a31e096a1af6b5adbd3a4d2fd9524eb86e5496 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 29 Mar 2013 15:32:43 -0400
Subject: [PATCH 162/544] RF+TST: bring inBanList back from private to
 protected and enabled its rudimentary unittests

---
 server/banmanager.py            | 4 ++--
 testcases/banmanagertestcase.py | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/server/banmanager.py b/server/banmanager.py
index 596dc4e9..1143f791 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -148,7 +148,7 @@ class BanManager:
 	def addBanTicket(self, ticket):
 		try:
 			self.__lock.acquire()
-			if not self.__inBanList(ticket):
+			if not self._inBanList(ticket):
 				self.__banList.append(ticket)
 				self.__banTotal += 1
 				return True
@@ -177,7 +177,7 @@ class BanManager:
 	# @param ticket the ticket
 	# @return True if a ticket already exists
 	
-	def __inBanList(self, ticket):
+	def _inBanList(self, ticket):
 		for i in self.__banList:
 			if ticket.getIP() == i.getIP():
 				return True
diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
index 7d389eed..6d0ce55a 100644
--- a/testcases/banmanagertestcase.py
+++ b/testcases/banmanagertestcase.py
@@ -49,11 +49,11 @@ class AddFailure(unittest.TestCase):
 		self.assertFalse(self.__banManager.addBanTicket(self.__ticket))
 		self.assertEqual(self.__banManager.size(), 1)
 		
-	def _testInListOK(self):
+	def testInListOK(self):
 		ticket = BanTicket('193.168.0.128', 1167605999.0)
-		self.assertTrue(self.__banManager.inBanList(ticket))
+		self.assertTrue(self.__banManager._inBanList(ticket))
 	
-	def _testInListNOK(self):
+	def testInListNOK(self):
 		ticket = BanTicket('111.111.1.111', 1167605999.0)
-		self.assertFalse(self.__banManager.inBanList(ticket))
+		self.assertFalse(self.__banManager._inBanList(ticket))
 		

From 0002fb4ca3913cc598403163c3fb5db13ad3cf78 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 29 Mar 2013 20:14:13 +0000
Subject: [PATCH 163/544] TST+BF: Use separate coveragerc for Travis CI

Should now ignore server/filtergamin.py as gamin is not tested. Also
ignores Travis CI python virtual environments
---
 .coveragerc        | 2 +-
 .travis.yml        | 2 +-
 .travis_coveragerc | 7 +++++++
 3 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 .travis_coveragerc

diff --git a/.coveragerc b/.coveragerc
index 17fb730b..3bffd79a 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -1,4 +1,4 @@
 
 [run]
 branch = True
-omit = /usr* /home/travis/virtualenv/*
+omit = /usr*
diff --git a/.travis.yml b/.travis.yml
index b3de1358..773c5f0b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,6 @@ install:
   - pip install pyinotify
   - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then pip install -q coveralls; fi
 script:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage run fail2ban-testcases; else python ./fail2ban-testcases; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
 after_script:
   - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coveralls; fi
diff --git a/.travis_coveragerc b/.travis_coveragerc
new file mode 100644
index 00000000..4d4b7ebd
--- /dev/null
+++ b/.travis_coveragerc
@@ -0,0 +1,7 @@
+
+[run]
+branch = True
+omit =
+    /usr/*
+    /home/travis/virtualenv/*
+    server/filtergamin.py

From b0a08b9790726312d1a4fa7ce7b4cf5d1592651b Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 30 Mar 2013 18:17:01 +0000
Subject: [PATCH 164/544] TST: Add gamin support for Travis CI

---
 .travis.yml        | 3 +++
 .travis_coveragerc | 1 -
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 773c5f0b..75b7ce4d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,8 +5,11 @@ python:
   - "2.5"
   - "2.6"
   - "2.7"
+before_install:
+  - sudo apt-get update -qq
 install:
   - pip install pyinotify
+  - sudo apt-get install -qq python-gamin
   - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then pip install -q coveralls; fi
 script:
   - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
diff --git a/.travis_coveragerc b/.travis_coveragerc
index 4d4b7ebd..ac4a15d5 100644
--- a/.travis_coveragerc
+++ b/.travis_coveragerc
@@ -4,4 +4,3 @@ branch = True
 omit =
     /usr/*
     /home/travis/virtualenv/*
-    server/filtergamin.py

From 44736035bda2f34d5a91cb9e1f1f3475902bd1e3 Mon Sep 17 00:00:00 2001
From: Erwan Ben Souiden <erwan@aleikoum.net>
Date: Tue, 2 Apr 2013 09:49:44 +0200
Subject: [PATCH 165/544] change the license to GPLv2 + adapat text

---
 files/nagios/check_fail2ban | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/files/nagios/check_fail2ban b/files/nagios/check_fail2ban
index 148c92d5..77a63393 100755
--- a/files/nagios/check_fail2ban
+++ b/files/nagios/check_fail2ban
@@ -29,19 +29,20 @@
 # ####################################################################
 
 # ####################################################################
-# GPL v3
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-
+# GPL v2
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 # ####################################################################
 
 # ####################################################################
@@ -274,10 +275,10 @@ This plugin has been created by $author
 Hope you will enjoy it ;)
 
 Remember :
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
+    This program is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License
+    as published by the Free Software Foundation; either version 2
+    of the License, or (at your option) any later version.
 
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -285,8 +286,8 @@ Remember :
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 EOT
     exit $ERRORS{"UNKNOWN"};

From 39667ff6f7f8a5803368c4b75ab2a11c8c8e81d3 Mon Sep 17 00:00:00 2001
From: Nicolas Collignon <nicolas.collignon@synacktiv.com>
Date: Tue, 2 Apr 2013 19:11:59 +0200
Subject: [PATCH 166/544] FD_CLOEXEC support

 * 001-fail2ban-server-socket-close-on-exec-no-leak.diff

Add code that marks server and client sockets with FD_CLOEXEC flags.
Avoid leaking file descriptors to processes spawned when handling
fail2ban actions (ex: iptables).

Unix sockets managed by fail2ban-server don't need to be passed to any
child process. Fail2ban already uses the FD_CLOEXEC flags in the filter
code.

This patch also avoids giving iptables access to fail2ban UNIX socket in
a SELinux environment (A sane SELinux policy should trigger an audit
event because "iptables" will be given read/write access to the fail2ban
control socket).

Some random references related to this bug:
 http://sourceforge.net/tracker/?func=detail&atid=689044&aid=2086568&group_id=121032
 http://www.redhat.com/archives/fedora-selinux-list/2009-June/msg00124.html
 http://forums.fedoraforum.org/showthread.php?t=234230

 * 002-fail2ban-filters-close-on-exec-typo-fix.diff

There is a typo in the fail2ban server/filter.py source code. The
FD_CLOEXEC is correctly set but additional *random* flags are also set.
It has no side-effect as long as the fd doesn't match a valid flag :)
"fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC)" <== the 3rd
parameter should be flags, not a file descriptor.

 * 003-fail2ban-gamin-socket-close-on-exec-no-leak.diff

Add code that marks the Gamin monitor file descriptor with FD_CLOEXEC
flags. Avoid leaking file descriptors to processes spawned when handling
fail2ban actions (ex: iptables).

---

File descriptors in action process before patches:
dr-x------ 2 root root  0 .
dr-xr-xr-x 8 root root  0 ..
lr-x------ 1 root root 64 0 -> /dev/null        <== OK
l-wx------ 1 root root 64 1 -> /tmp/test.log    <== used by test action
lrwx------ 1 root root 64 2 -> /dev/null        <== OK
lrwx------ 1 root root 64 3 -> socket:[116361]  <== NOK (fail2ban.sock leak)
lr-x------ 1 root root 64 4 -> /proc/20090/fd   <== used by test action
l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK
lrwx------ 1 root root 64 6 -> socket:[115608]  <== NOK (gamin sock leak)

File descriptors in action process after patches:
dr-x------ 2 root root  0 .
dr-xr-xr-x 8 root root  0 ..
lr-x------ 1 root root 64 0 -> /dev/null        <== OK
l-wx------ 1 root root 64 1 -> /tmp/test.log    <== used by test action
lrwx------ 1 root root 64 2 -> /dev/null        <== OK
lr-x------ 1 root root 64 3 -> /proc/18284/fd   <== used by test action
l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK
---
 server/asyncserver.py | 16 +++++++++++++++-
 server/filter.py      |  3 ++-
 server/filtergamin.py |  5 ++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/server/asyncserver.py b/server/asyncserver.py
index 66b2b53f..35167a6b 100644
--- a/server/asyncserver.py
+++ b/server/asyncserver.py
@@ -29,7 +29,7 @@ __license__ = "GPL"
 
 from pickle import dumps, loads, HIGHEST_PROTOCOL
 from common import helpers
-import asyncore, asynchat, socket, os, logging, sys, traceback
+import asyncore, asynchat, socket, os, logging, sys, traceback, fcntl
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.server")
@@ -107,6 +107,7 @@ class AsyncServer(asyncore.dispatcher):
 		except TypeError:
 			logSys.warning("Type error")
 			return
+		AsyncServer.__markCloseOnExec(conn)
 		# Creates an instance of the handler class to handle the
 		# request/response on the incoming connection.
 		RequestHandler(conn, self.__transmitter)
@@ -134,6 +135,7 @@ class AsyncServer(asyncore.dispatcher):
 			self.bind(sock)
 		except Exception:
 			raise AsyncServerException("Unable to bind socket %s" % self.__sock)
+		AsyncServer.__markCloseOnExec(self.socket)
 		self.listen(1)
 		# Sets the init flag.
 		self.__init = True
@@ -159,6 +161,18 @@ class AsyncServer(asyncore.dispatcher):
 			os.remove(self.__sock)
 		logSys.debug("Socket shutdown")
 
+	##
+	# Marks socket as close-on-exec to avoid leaking file descriptors when
+	# running actions involving command execution.
+
+	# @param sock: socket file.
+	
+	#@staticmethod
+	def __markCloseOnExec(sock):
+		fd = sock.fileno()
+		flags = fcntl.fcntl(fd, fcntl.F_GETFD)
+		fcntl.fcntl(fd, fcntl.F_SETFD, flags|fcntl.FD_CLOEXEC)
+	__markCloseOnExec = staticmethod(__markCloseOnExec)
 
 ##
 # AsyncServerException is used to wrap communication exceptions.
diff --git a/server/filter.py b/server/filter.py
index f842c269..88a5d861 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -554,7 +554,8 @@ class FileContainer:
 		self.__handler = open(self.__filename)
 		# Set the file descriptor to be FD_CLOEXEC
 		fd = self.__handler.fileno()
-		fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC)
+		flags = fcntl.fcntl(fd, fcntl.F_GETFD)
+		fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
 		firstLine = self.__handler.readline()
 		# Computes the MD5 of the first line.
 		myHash = md5sum(firstLine).digest()
diff --git a/server/filtergamin.py b/server/filtergamin.py
index cff5aa54..196396c5 100644
--- a/server/filtergamin.py
+++ b/server/filtergamin.py
@@ -27,7 +27,7 @@ from failmanager import FailManagerEmpty
 from filter import FileFilter
 from mytime import MyTime
 
-import time, logging, gamin
+import time, logging, gamin, fcntl
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
@@ -52,6 +52,9 @@ class FilterGamin(FileFilter):
 		self.__modified = False
 		# Gamin monitor
 		self.monitor = gamin.WatchMonitor()
+		fd = self.monitor.get_fd()
+		flags = fcntl.fcntl(fd, fcntl.F_GETFD)
+		fcntl.fcntl(fd, fcntl.F_SETFD, flags|fcntl.FD_CLOEXEC)
 		logSys.debug("Created FilterGamin")
 
 

From 47c54ba293448c73fd3c9928d41472d1264128fa Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 6 Apr 2013 11:08:07 +0100
Subject: [PATCH 167/544] TST: Add gamin testing for and only coveralls
 coverage for python2.7

---
 .travis.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 75b7ce4d..8da3e0bb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,9 +9,10 @@ before_install:
   - sudo apt-get update -qq
 install:
   - pip install pyinotify
-  - sudo apt-get install -qq python-gamin
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then pip install -q coveralls; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then sudo apt-get install -qq python-gamin; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then pip install -q coveralls; fi
 script:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then export PYTHONPATH="$PYTHONPATH:/usr/share/pyshared:/usr/lib/pyshared/python2.7"; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
 after_script:
-  - if [[ $TRAVIS_PYTHON_VERSION == 2.[6-7] ]]; then coveralls; fi
+  - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coveralls; fi

From ffaa9697eeab80f40df7d2fd449cb619d55e0a84 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 9 Apr 2013 17:59:45 -0400
Subject: [PATCH 168/544] Adjusting previous PR (MySQL logs) according to my
 comments

---
 config/filter.d/mysqld.conf     |  9 ++++-----
 testcases/files/logs/mysqld.log | 11 -----------
 2 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/config/filter.d/mysqld.conf b/config/filter.d/mysqld.conf
index bc9164ce..197c8232 100644
--- a/config/filter.d/mysqld.conf
+++ b/config/filter.d/mysqld.conf
@@ -1,8 +1,7 @@
-# Fail2Ban configuration file
+# Fail2Ban configuration file for unsuccesfull MySQL authentication attempts
 #
-# Author: Artur Penttinen
-#
-# $Revision$
+# Authors: Artur Penttinen
+#          Yaroslav O. Halchenko
 #
 
 [INCLUDES]
@@ -23,7 +22,7 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 # 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
-failregex = Access denied for user '\w+'@'<HOST>'
+failregex = Access denied for user '\w+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/mysqld.log b/testcases/files/logs/mysqld.log
index 8dfd6338..b3a73078 100644
--- a/testcases/files/logs/mysqld.log
+++ b/testcases/files/logs/mysqld.log
@@ -1,17 +1,6 @@
-130323 21:14:28 [Warning] Access denied for user 'root'@'192.168.1.34' (using password: NO)
 130324  0:04:00 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: NO)
-130324  0:04:02 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:05 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:07 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:09 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:11 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:13 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:16 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
-130324  0:04:18 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES)
 130324  8:24:09 [Warning] Access denied for user 'root'@'220.95.238.171' (using password: NO)
 130324 17:56:13 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: NO)
 130324 17:56:14 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES)
-130324 17:56:15 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES)
 130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO)
 130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)
-130324 19:01:41 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)

From 99a5d78e3766cd8cf247a047611cfb293426af82 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 9 Apr 2013 18:03:34 -0400
Subject: [PATCH 169/544] ENH: for consistency (and future expansion ;)) --
 rename to mysqld-auth

---
 config/filter.d/{mysqld.conf => mysqld-auth.conf} | 0
 config/jail.conf                                  | 4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename config/filter.d/{mysqld.conf => mysqld-auth.conf} (100%)

diff --git a/config/filter.d/mysqld.conf b/config/filter.d/mysqld-auth.conf
similarity index 100%
rename from config/filter.d/mysqld.conf
rename to config/filter.d/mysqld-auth.conf
diff --git a/config/jail.conf b/config/jail.conf
index 4c1528f1..4399d0bd 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -345,13 +345,13 @@ action   = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp]
 logpath  = /var/log/asterisk/messages
 maxretry = 10
 
-# For log wrong MySQL access add to /etc/my.cnf:
+# To log wrong MySQL access attempts add to /etc/my.cnf:
 # log-error=/var/log/mysqld.log
 # log-warning = 2
 [mysqld-iptables]
 
 enabled  = false
-filter   = mysqld
+filter   = mysqld-auth
 action   = iptables[name=mysql, port=3306, protocol=tcp]
            sendmail-whois[name=MySQL, dest=root, sender=fail2ban@example.com]
 logpath  = /var/log/mysqld.log

From ffe48741e333baac89c63d3e5944020baf16acff Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sat, 13 Apr 2013 22:20:57 -0400
Subject: [PATCH 170/544] DOC: thanks @kwirk for spotting the typos in
 exception message

---
 server/transmitter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/transmitter.py b/server/transmitter.py
index dc121f93..b54fbb93 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -123,7 +123,7 @@ class Transmitter:
 			elif command[2] == "off":
 				self.__server.setIdleJail(name, False)
 			else:
-				raise Exception("Invalid idle option, must be 'yes' or 'no'")
+				raise Exception("Invalid idle option, must be 'on' or 'off'")
 			return self.__server.getIdleJail(name)
 		# Filter
 		elif command[1] == "addignoreip":

From 28e9acf86a954f87ab5a89e25ed805594b6c5cd4 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Apr 2013 15:55:18 +0100
Subject: [PATCH 171/544] TST: no cover additions to server, primarily daemon
 creation

---
 server/server.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/server.py b/server/server.py
index a0824f1d..5f1a52c1 100644
--- a/server/server.py
+++ b/server/server.py
@@ -66,7 +66,7 @@ class Server:
 		
 		# First set the mask to only allow access to owner
 		os.umask(0077)
-		if self.__daemon:
+		if self.__daemon: # pragma: no cover
 			logSys.info("Starting in daemon mode")
 			ret = self.__createDaemon()
 			if ret:
@@ -379,7 +379,7 @@ class Server:
 				try:
 					handler.flush()
 					handler.close()
-				except (ValueError, KeyError):
+				except (ValueError, KeyError): # pragma: no cover
 					if sys.version_info >= (2,6):
 						raise
 					# is known to be thrown after logging was shutdown once
@@ -404,7 +404,7 @@ class Server:
 		finally:
 			self.__loggingLock.release()
 	
-	def __createDaemon(self):
+	def __createDaemon(self): # pragma: no cover
 		""" Detach a process from the controlling terminal and run it in the
 			background as a daemon.
 		

From d259e903a3cc9f284db389824c6446ada64dce93 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Apr 2013 15:56:14 +0100
Subject: [PATCH 172/544] TST: Coverage for coveralls.io should only be run on
 success

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8da3e0bb..2d091754 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,5 +14,5 @@ install:
 script:
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then export PYTHONPATH="$PYTHONPATH:/usr/share/pyshared:/usr/lib/pyshared/python2.7"; fi
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coverage run --rcfile=.travis_coveragerc fail2ban-testcases; else python ./fail2ban-testcases; fi
-after_script:
+after_success:
   - if [[ $TRAVIS_PYTHON_VERSION == 2.7 ]]; then coveralls; fi

From 3d6791fe3e20b9125b999ead87f6dbc91aa24486 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Apr 2013 15:57:37 +0100
Subject: [PATCH 173/544] ENH: Minor change to action for consistency of
 execStart/Stop

---
 server/action.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/server/action.py b/server/action.py
index 5fde3ae1..ce9651e8 100644
--- a/server/action.py
+++ b/server/action.py
@@ -297,10 +297,8 @@ class Action:
 		if not Action.executeCmd(checkCmd):
 			logSys.error("Invariant check failed. Trying to restore a sane" +
 						 " environment")
-			stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
-			Action.executeCmd(stopCmd)
-			startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
-			Action.executeCmd(startCmd)
+			self.execActionStop()
+			self.execActionStart()
 			if not Action.executeCmd(checkCmd):
 				logSys.fatal("Unable to restore environment")
 				return False

From 4c4b60f4b4c5b959b36ca5fe5636bc60e0aa057c Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Apr 2013 15:58:35 +0100
Subject: [PATCH 174/544] TST: Add tag replace and escape test for actions

---
 testcases/actiontestcase.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index b8292c27..50ae2816 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -61,6 +61,23 @@ class ExecuteAction(unittest.TestCase):
 	def _is_logged(self, s):
 		return s in self._log.getvalue()
 
+	def testReplaceTag(self):
+		aInfo = {
+			'HOST': "192.0.2.0",
+			'ABC': "123",
+			'xyz': "890",
+		}
+		self.assertEqual(
+			self.__action.replaceTag("Text <HOST> text", aInfo),
+			"Text 192.0.2.0 text")
+		self.assertEqual(
+			self.__action.replaceTag("Text <xyz> text <ABC> ABC", aInfo),
+			"Text 890 text 123 ABC")
+		self.assertEqual(
+			self.__action.replaceTag("<matches>",
+				{'matches': "some >char< should \< be[ escap}ed&"}),
+			r"some \>char\< should \\\< be\[ escap\}ed\&")
+
 	def testExecuteActionBan(self):
 		self.__action.setActionStart("touch /tmp/fail2ban.test")
 		self.__action.setActionStop("rm -f /tmp/fail2ban.test")

From 94956bee84a0ceb0895fe24a863b87fa1590fae6 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Apr 2013 15:59:05 +0100
Subject: [PATCH 175/544] TST: test all valid loglevels in server testcases

---
 testcases/servertestcase.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index ffb057a9..1b6eb8d3 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -504,7 +504,9 @@ class TransmitterLogging(TransmitterBase):
 
 	def testLogLevel(self):
 		self.setGetTest("loglevel", "4", 4)
+		self.setGetTest("loglevel", "3", 3)
 		self.setGetTest("loglevel", "2", 2)
+		self.setGetTest("loglevel", "1", 1)
 		self.setGetTest("loglevel", "-1", -1)
 		self.setGetTest("loglevel", "0", 0)
 		self.setGetTestNOK("loglevel", "Bird")

From 32d10e904aef5b5981c6b6abe19bee4690d17c0c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 17 Apr 2013 00:03:36 +1000
Subject: [PATCH 176/544] ENH: more openssh fail messages from openssh source
 code (CVS 20121205)

---
 config/filter.d/sshd.conf | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index e4339c78..07b2dd57 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -24,13 +24,16 @@ _daemon = sshd
 # Values:  TEXT
 #
 failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            ^%(__prefix_line)sDid not receive identification string from <HOST>$
             ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
-            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
+            ^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
 
 # Option:  ignoreregex

From b8e823bd4ef335833893869fa246ca124307acb4 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 16 Apr 2013 23:44:38 -0400
Subject: [PATCH 177/544] DOC: initiated changelog (but not juice left to
 actually fill it up ;-))

---
 ChangeLog | 13 +++++++++++++
 DEVELOP   |  4 ++++
 2 files changed, 17 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index eabd6e81..12678936 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,19 @@
 Fail2Ban (version 0.8.8)                                              2012/12/06
 ================================================================================
 
+ver. 0.8.9 (2013/04/XXX) - wanna-be-stable
+----------
+
+This release incorporates 144 (XXX) non-merge commits from 14
+contributors (sorted by number of commits): Yaroslav Halchenko, Daniel
+Black, Steven Hiscocks, ArndRa, hamilton5, pigsyn, Erwan Ben Souiden,
+Michael Gebetsroither, Orion Poplawski, Artur Penttinen, sebres,
+Nicolas Collignon, Pascal Borreli, blotus:
+
+- Fixes:
+- New features:
+- Enhancements:
+
 ver. 0.8.8 (2012/12/06) - stable
 ----------
 - Fixes:
diff --git a/DEVELOP b/DEVELOP
index 623aee12..a31bf04a 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -253,6 +253,10 @@ Releasing
 
 # Add/finalize the corresponding entry in the ChangeLog
 
+  To generate a list of committers use e.g.
+
+  git shortlog -sn 0.8.8.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
+
 # Update man pages
 
   (cd man ; ./generate-man )

From 6f4dad46f0c2a6505594c6c13ed298ef501decba Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 17 Apr 2013 10:07:01 -0400
Subject: [PATCH 178/544] DOC: slight tune ups to README (we are no longer
 compatible with python 2.3 ;) )

---
 README | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/README b/README
index cab683f5..2016e9e1 100644
--- a/README
+++ b/README
@@ -13,13 +13,13 @@ rules can be defined by the user. Fail2Ban can read multiple log files such as
 sshd or Apache web server ones.
 
 This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
-are available on the project website: http://www.fail2ban.org
+are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
 
 Installation:
 -------------
 
 Required:
-   >=python-2.3 (http://www.python.org)
+   >=python-2.4 (http://www.python.org)
 
 Optional:
    pyinotify:
@@ -38,42 +38,43 @@ To install, just do:
 This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
 placed into /usr/bin.
 
-It is possible that Fail2ban is already packaged for your distribution. In this
-case, you should use it.
+It is possible that Fail2ban is already packaged for your distribution.  In
+this case, you should use it.
 
 Fail2Ban should be correctly installed now. Just type:
 
 > fail2ban-client -h
 
-to see if everything is alright. You should always use fail2ban-client and never
-call fail2ban-server directly.
+to see if everything is alright. You should always use fail2ban-client and
+never call fail2ban-server directly.
 
 Configuration:
 --------------
 
-You can configure Fail2Ban using the files in /etc/fail2ban. It is
-possible to configure the server using commands sent to it by
-fail2ban-client. The available commands are described in the
-fail2ban-client(1) manpage.  Also see fail2ban(1) manpage for further
-references and find even more documentation on the website:
-http://www.fail2ban.org
+You can configure Fail2Ban using the files in /etc/fail2ban. It is possible to
+configure the server using commands sent to it by fail2ban-client. The
+available commands are described in the fail2ban-client(1) manpage.  Also see
+fail2ban(1) manpage for further references and find even more documentation on
+the website: http://www.fail2ban.org
 
 Contact:
 --------
 
 Website: http://www.fail2ban.org
 
-You need some new features, you found bugs: visit
-https://github.com/fail2ban/fail2ban/issues
+You need some new features, you found bugs?
+visit https://github.com/fail2ban/fail2ban/issues
 and if your issue is not yet known -- file a bug report.
 
-If you would like to troubleshoot or discuss: join the mailing list
+You would like to troubleshoot or discuss?
+join the mailing list
 https://lists.sourceforge.net/lists/listinfo/fail2ban-users
 
-If you just appreciate this program: send kudos to the original author
-(Cyril Jaquier: <cyril.jaquier@fail2ban.org>) or the mailing list
+You just appreciate this program:
+send kudos to the original author (Cyril Jaquier <cyril.jaquier@fail2ban.org>)
+or better to the mailing list
 https://lists.sourceforge.net/lists/listinfo/fail2ban-users
-
+since Fail2Ban is "community-driven" for years now.
 
 Thanks:
 -------

From ddebcab9aae68bb1b93d11bddb63c8c54bec4186 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Wed, 17 Apr 2013 09:27:06 -0600
Subject: [PATCH 179/544] Add After, PIDFile, and change WantedBy to
 multi-user.target in fail2ban.server

---
 files/fail2ban.service | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/files/fail2ban.service b/files/fail2ban.service
index 35d7fc88..9c44042b 100644
--- a/files/fail2ban.service
+++ b/files/fail2ban.service
@@ -1,12 +1,14 @@
 [Unit]
 Description=Fail2ban Service
+After=syslog.target network.target
 
 [Service]
 Type=forking
 ExecStart=/usr/bin/fail2ban-client -x start
 ExecStop=/usr/bin/fail2ban-client stop
 ExecReload=/usr/bin/fail2ban-client reload
+PIDFile=/var/run/fail2ban/fail2ban.pid
 Restart=always
 
 [Install]
-WantedBy=network.target
+WantedBy=multi-user.target

From 76c08cebe9944a297327e30928abdd10e332733d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 17 Apr 2013 11:54:45 -0400
Subject: [PATCH 180/544] DOC: a plugin to thanks for the community support

---
 ChangeLog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 12678936..c571d772 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,10 @@ Nicolas Collignon, Pascal Borreli, blotus:
 - New features:
 - Enhancements:
 
+Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
+Hendrikx and other TBN heroes supporting users on fail2ban-users
+mailing list and IRC.
+
 ver. 0.8.8 (2012/12/06) - stable
 ----------
 - Fixes:

From 41b9f7b6ac4a60d411c58fd5f1305d7539fb104a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 04:38:03 +1000
Subject: [PATCH 181/544] BF:  filter.d/sshd "Did not receive identification
 string" relates to an exploit so document this in sshd-ddos.conf but leave it
 out of authentication based blocks in sshd.conf

---
 config/filter.d/sshd-ddos.conf | 7 +++++++
 config/filter.d/sshd.conf      | 1 -
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/sshd-ddos.conf b/config/filter.d/sshd-ddos.conf
index 266594ba..58698ced 100644
--- a/config/filter.d/sshd-ddos.conf
+++ b/config/filter.d/sshd-ddos.conf
@@ -2,6 +2,13 @@
 #
 # Author: Yaroslav Halchenko
 #
+# The regex here also relates to a exploit:
+#
+#  http://www.securityfocus.com/bid/17958/exploit
+#  The example code here shows the pushing of the exploit straight after
+#  reading the server version. This is where the client version string normally
+#  pushed. As such the server will read this unparsible information as
+#  "Did not receive identification string".
 
 [INCLUDES]
 
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 07b2dd57..b4e645c4 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -24,7 +24,6 @@ _daemon = sshd
 # Values:  TEXT
 #
 failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
-            ^%(__prefix_line)sDid not receive identification string from <HOST>$
             ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
             ^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$

From 1331e15ac375426fef89928b5ea5d62a724c6380 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 04:48:51 +1000
Subject: [PATCH 182/544] DOC: guidance for pull requests

---
 DEVELOP | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index a31bf04a..124f4c01 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -21,6 +21,18 @@ would like to add to Fail2Ban, the best way to do so it to use the GitHub Pull
 Request feature. You can find more details on the Fail2Ban wiki
 (http://www.fail2ban.org/wiki/index.php/Get_Involved)
 
+Pull Requests
+=============
+
+When submitting pull requests on GitHub we ask you to:
+* Clearly describe the problem you're solving;
+* Don't introduce regressions that will make it hard for systems adminstrators 
+  to update;
+* Include test cases (see below);
+* Include sample logs (if relevant);
+* Include a change to the relevant section of the ChangeLog; and
+* Include yourself in THANKS if not already there.
+
 Testing
 =======
 

From d1c8b5795233d0a035a027381b68b62913ba57dd Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 04:52:21 +1000
Subject: [PATCH 183/544] DOC: ChangeLog versions and dates for Releasing

---
 DEVELOP | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index 124f4c01..438599a4 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -269,6 +269,10 @@ Releasing
 
   git shortlog -sn 0.8.8.. | sed -e 's,^[ 0-9\t]*,,g' | tr '\n' '\|' | sed -e 's:|:, :g'
 
+  Ensure the top of the ChangeLog has the right version and current date.
+
+  Ensure the top entry of the ChangeLog has the right version and current date.
+
 # Update man pages
 
   (cd man ; ./generate-man )

From 6b260ab974efd2881cdb555966bafbeb26066263 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 04:53:17 +1000
Subject: [PATCH 184/544] DOC: version/date of release

---
 ChangeLog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index c571d772..f119d310 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,7 +4,7 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.8)                                              2012/12/06
+Fail2Ban (version 0.8.9)                                              2013/04/XX
 ================================================================================
 
 ver. 0.8.9 (2013/04/XXX) - wanna-be-stable

From 60fa4b5d7c5748bd3f56e0339e86c7718ece153a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 05:08:45 +1000
Subject: [PATCH 185/544] DOC: begining of ChangeLog

---
 ChangeLog | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index f119d310..dce5ed6c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,7 +17,13 @@ Michael Gebetsroither, Orion Poplawski, Artur Penttinen, sebres,
 Nicolas Collignon, Pascal Borreli, blotus:
 
 - Fixes:
+  Yaroslav Halchenko
+	* [6f4dad46] Documentation python-2.4 is the minimium version.
 - New features:
+  Yaroslav Halchenko
+	* [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
+	  to provide additional flexibility to system adminstrators. Thanks to
+		beilber for the idea. Close gh-114.
 - Enhancements:
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom

From dc2f42b24dfc43fb660f2402601aeef21cac9b7e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 06:57:35 +1000
Subject: [PATCH 186/544] DOC: ChangeLog - current HEAD back to ce3ab34

---
 ChangeLog | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index dce5ed6c..3e366378 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,12 +19,67 @@ Nicolas Collignon, Pascal Borreli, blotus:
 - Fixes:
   Yaroslav Halchenko
 	* [6f4dad46] Documentation python-2.4 is the minimium version.
+	* [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on
+	  Fedora. Closes gh-112. Thanks to Camusensei for the bug report. 
+	* [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for
+	  insight. Closes gh-103.
+	* [ab044b75] delay check for the existence of config directory until read.
+	* [3b4084d4] fixing up for handling of TAI64N timestamps.
+	* [154aa38e] do not shutdown logging until all jails stop.
+  Orion Poplawski
+	* [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking
+	  newly created directories.
+	Nicolas Collignon
+	* [39667ff6] Avoid leaking file descriptors. Closes gh-167.
+	Sergey Brester
+	* [b6bb2f88 and d17b4153] invalid date recognition, irregular because of
+	  sorting template list.
+  Steven Hiscocks
+	* [7a442f07] When changing log target with python2.{4,5} handle KeyError.
+	  Closes gh-147, gh-148.
+	* [b6a68f51] Fix delaction on server side. Close gh-124.
+  Daniel Black
+	* [f0610c01] Allow more that a one word command when changing and Action via
+ 		the fail2ban-client. Closes gh-134.
 - New features:
   Yaroslav Halchenko
 	* [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
 	  to provide additional flexibility to system adminstrators. Thanks to
 		beilber for the idea. Close gh-114.
 - Enhancements:
+  Steven Hiscocks
+  * [c6bd8fc] Add Apache Tomcat date format. Close gh-176.
+  * [4d80fad] Add Guacmole filter. Close gh-176.
+	* [3d6791f] Ensure restart of Actions after a check fails occurs
+	  consistently. Closes gh-172.
+  * [MANY] Improvements to test cases, travis, and code coverage (coveralls).
+	* [b36835f] Add get cinfo to fail2ban-client. Close gh-124.
+	* [ce3ab34] Added ability to specify PID file.
+	Orion Poplawski
+	* [ddebcab] Enhance fail2ban.service defination dependancies and Pidfile.
+	  Closes gh-142.
+	Artur Penttinen
+	* [29d0df5] Add mysqld filter. Closes gh-152.
+	Erwan Ben Souiden
+	* [d7d5228] add nagios integration documentation and script to ensure
+	  fail2ban is running. Closes gh-166.
+	ArndRaphael Brandes
+	* [bba3fd8] Add Sogo filter. Closes gh-117
+  Yaroslav Halchenko
+	* [MANY] Lots of improvements to log messages and test cases.
+	* [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
+	  Closes gh-126. Bug report by Michael Heuberger.
+	* [40c5a2d] adding more of diagnostic messages into -client while starting
+	  the daemon.
+	Daniel Black
+	* [3aeb1a9] Add jail.conf manual page. close gh-143.
+	* [7cd6dab] Added help command to fail2ban-client. close gh-134.
+	* [c8c7b0b,23bbc60] Better logging of log file read errors. close gh-134.
+	* [3665e6d] Added code coverage to development process.
+	Pascal Borreli
+	* [a2b29b4] Fixed lots of typos in config files and documentation.
+	Michael Gebetsriother
+	* [f9b78ba] Add action route to block at routing level.
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users

From 3e0e0482aef1451c9a991ac1879900333c4e8d4e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 07:07:05 +1000
Subject: [PATCH 187/544] DOC: post release ChangeLog entry

---
 DEVELOP | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index 438599a4..03edebbc 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -296,3 +296,13 @@ Releasing
 # Email users and development list of release
 
 TODO notifying distributors etc.
+
+Post Release:
+
+Add the following to the top of the ChangeLog
+
+ver. 0.8.9 (2013/XX/XXX) - wanna-be-stable
+- Fixes
+- New Features
+- Enhancements
+

From 0a57b6183606d5904109cf8a7009d668acd73e44 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 07:09:07 +1000
Subject: [PATCH 188/544] DOC: developers please rebase and use a single commit

---
 DEVELOP | 1 +
 1 file changed, 1 insertion(+)

diff --git a/DEVELOP b/DEVELOP
index 03edebbc..3e8e430a 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -28,6 +28,7 @@ When submitting pull requests on GitHub we ask you to:
 * Clearly describe the problem you're solving;
 * Don't introduce regressions that will make it hard for systems adminstrators 
   to update;
+* If adding a major feature rebase your changes on master and get to a single commit;
 * Include test cases (see below);
 * Include sample logs (if relevant);
 * Include a change to the relevant section of the ChangeLog; and

From d4b5e8ec30600d4966e8bfbfb4368b873a403974 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 08:45:20 +1000
Subject: [PATCH 189/544] DOC: credit man page edits

---
 ChangeLog | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 3e366378..23f46aef 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -66,13 +66,14 @@ Nicolas Collignon, Pascal Borreli, blotus:
 	ArndRaphael Brandes
 	* [bba3fd8] Add Sogo filter. Closes gh-117
   Yaroslav Halchenko
-	* [MANY] Lots of improvements to log messages and test cases.
+	* [MANY] Lots of improvements to log messages, man pages and test cases.
 	* [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
 	  Closes gh-126. Bug report by Michael Heuberger.
 	* [40c5a2d] adding more of diagnostic messages into -client while starting
 	  the daemon.
 	Daniel Black
 	* [3aeb1a9] Add jail.conf manual page. close gh-143.
+	* [MANY] man page edits.
 	* [7cd6dab] Added help command to fail2ban-client. close gh-134.
 	* [c8c7b0b,23bbc60] Better logging of log file read errors. close gh-134.
 	* [3665e6d] Added code coverage to development process.

From ed123ea403f735fceeddbc6973958a55d4fec49e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 11:34:44 +1000
Subject: [PATCH 190/544] DOC: tomcat and Guacmole are next release

---
 ChangeLog | 2 --
 1 file changed, 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 23f46aef..fbdf2d48 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -48,8 +48,6 @@ Nicolas Collignon, Pascal Borreli, blotus:
 		beilber for the idea. Close gh-114.
 - Enhancements:
   Steven Hiscocks
-  * [c6bd8fc] Add Apache Tomcat date format. Close gh-176.
-  * [4d80fad] Add Guacmole filter. Close gh-176.
 	* [3d6791f] Ensure restart of Actions after a check fails occurs
 	  consistently. Closes gh-172.
   * [MANY] Improvements to test cases, travis, and code coverage (coveralls).

From 5413f9b3a18eccc120c547e2f3027205e1463567 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 11:36:37 +1000
Subject: [PATCH 191/544] DOC: move new actions and filters to New Features in
 ChangeLog

---
 ChangeLog | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index fbdf2d48..25b1ad20 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -46,6 +46,15 @@ Nicolas Collignon, Pascal Borreli, blotus:
 	* [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
 	  to provide additional flexibility to system adminstrators. Thanks to
 		beilber for the idea. Close gh-114.
+	Erwan Ben Souiden
+	* [d7d5228] add nagios integration documentation and script to ensure
+	  fail2ban is running. Closes gh-166.
+	Artur Penttinen
+	* [29d0df5] Add mysqld filter. Closes gh-152.
+	ArndRaphael Brandes
+	* [bba3fd8] Add Sogo filter. Closes gh-117
+	Michael Gebetsriother
+	* [f9b78ba] Add action route to block at routing level.
 - Enhancements:
   Steven Hiscocks
 	* [3d6791f] Ensure restart of Actions after a check fails occurs
@@ -56,13 +65,6 @@ Nicolas Collignon, Pascal Borreli, blotus:
 	Orion Poplawski
 	* [ddebcab] Enhance fail2ban.service defination dependancies and Pidfile.
 	  Closes gh-142.
-	Artur Penttinen
-	* [29d0df5] Add mysqld filter. Closes gh-152.
-	Erwan Ben Souiden
-	* [d7d5228] add nagios integration documentation and script to ensure
-	  fail2ban is running. Closes gh-166.
-	ArndRaphael Brandes
-	* [bba3fd8] Add Sogo filter. Closes gh-117
   Yaroslav Halchenko
 	* [MANY] Lots of improvements to log messages, man pages and test cases.
 	* [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
@@ -77,8 +79,6 @@ Nicolas Collignon, Pascal Borreli, blotus:
 	* [3665e6d] Added code coverage to development process.
 	Pascal Borreli
 	* [a2b29b4] Fixed lots of typos in config files and documentation.
-	Michael Gebetsriother
-	* [f9b78ba] Add action route to block at routing level.
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users

From e5e01187175dafac23d61da640cd2e7639820505 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Apr 2013 12:13:26 +1000
Subject: [PATCH 192/544] DOC: more ChangeLog entries all the way back to 0.8.8

---
 ChangeLog | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 25b1ad20..eb7e2cfd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -41,11 +41,14 @@ Nicolas Collignon, Pascal Borreli, blotus:
   Daniel Black
 	* [f0610c01] Allow more that a one word command when changing and Action via
  		the fail2ban-client. Closes gh-134.
+  blotus
+	* [96eb8986] ' and " should also be escaped in action tags Closes gh-109
 - New features:
   Yaroslav Halchenko
 	* [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
 	  to provide additional flexibility to system adminstrators. Thanks to
 		beilber for the idea. Close gh-114.
+	* [3ce53e87] Add exim filter.
 	Erwan Ben Souiden
 	* [d7d5228] add nagios integration documentation and script to ensure
 	  fail2ban is running. Closes gh-166.
@@ -55,6 +58,12 @@ Nicolas Collignon, Pascal Borreli, blotus:
 	* [bba3fd8] Add Sogo filter. Closes gh-117
 	Michael Gebetsriother
 	* [f9b78ba] Add action route to block at routing level.
+	Teodor Micu & Yaroslav Halchenko
+	* [5f2d383] Add roundcube auth filter. Close Debian bug #699442.
+  Daniel Black
+	* [be06b1b] Add action for iptables-ipsets. Close gh-102.
+	Soulard Morgan
+	* [f336d9f] Add filter for webmin. Close gh-99
 - Enhancements:
   Steven Hiscocks
 	* [3d6791f] Ensure restart of Actions after a check fails occurs
@@ -79,6 +88,8 @@ Nicolas Collignon, Pascal Borreli, blotus:
 	* [3665e6d] Added code coverage to development process.
 	Pascal Borreli
 	* [a2b29b4] Fixed lots of typos in config files and documentation.
+	hamilton5
+	* [7ede1e8] Update dovecot filter config
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users

From de98e3dabd2b9a1b728955fe4e7727aac2c8407b Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Sun, 21 Apr 2013 07:29:48 +0800
Subject: [PATCH 193/544] change sed to perl for Solaris

---
 config/action.d/hostsdeny.conf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index b04f2adb..db36aa29 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -40,7 +40,11 @@ actionban = IP=<ip> &&
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
+# Original:
+#actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
+
+# -i is not supported under Solaris 10/OpenSolaris
+actionunban = IP=<ip> && perl -ne "print unless (/^ALL:\s$IP/)" -i <file>
 
 [Init]
 

From 10fcfb925dde8da606a7e2f841159675528cedb9 Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Sun, 21 Apr 2013 07:30:21 +0800
Subject: [PATCH 194/544] Extra patterns for Solaris

---
 config/filter.d/sshd.conf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index e4339c78..2c104073 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -27,11 +27,13 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro
             ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
             ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
+            ^%(__prefix_line)s\[.*\] Failed keyboard-interactive for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
+            ^%(__prefix_line)s\[.*\] Received disconnect from <HOST>.* Bye\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 578a8998c63f8133421668d2648a623e9ac8fd6a Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Sun, 21 Apr 2013 07:30:52 +0800
Subject: [PATCH 195/544] create socket/pid dir if needed

Also remove any lingering sockets
---
 files/solaris-svc-fail2ban | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 mode change 100644 => 100755 files/solaris-svc-fail2ban

diff --git a/files/solaris-svc-fail2ban b/files/solaris-svc-fail2ban
old mode 100644
new mode 100755
index 9f75f9f6..e397474b
--- a/files/solaris-svc-fail2ban
+++ b/files/solaris-svc-fail2ban
@@ -17,8 +17,26 @@ fi
 
 ENV="/usr/bin/env -i LANG=C PATH=/usr/local/bin:/usr/bin:/bin:/opt/sfw/bin:/usr/sfw/bin"
 
+# get socket/pid conf and check dir exists
+# sock and pid default dirs are currently the same
+# mkdir if it doesn't exist
+SOCK_FILE=$(sed "/^\#/d" "$F2B_CONF" | grep "socket"  | tail -1 | cut -d "=" -f2-)
+SOCK_DIR=$(dirname $SOCK_FILE)
+if [ -n "$SOCK_DIR" ]; then
+	if [ ! -d "$SOCK_DIR" ]; then
+		mkdir "$SOCK_DIR" || exit 1
+	fi
+fi
+
 case $1 in
 	start)
+		# remove any lingering sockets
+		# don't quote the var for the -e test
+		if [ -n "$SOCK_FILE" ]; then
+			if [ -e $SOCK_FILE ]; then
+				rm -f $SOCK_FILE || exit 1
+			fi
+		fi
 		[ -f /etc/fail2ban.conf ] || touch /etc/fail2ban.conf
 		echo "Starting fail2ban-server with $F2B_CONF"
 		eval $ENV /usr/local/bin/fail2ban-client start &

From 686f43caacf080eccbb5e1f7272975babd3fcd52 Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Sun, 21 Apr 2013 07:31:27 +0800
Subject: [PATCH 196/544] Readme for config on Solaris

---
 README.Solaris | 106 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 README.Solaris

diff --git a/README.Solaris b/README.Solaris
new file mode 100644
index 00000000..b8883e7f
--- /dev/null
+++ b/README.Solaris
@@ -0,0 +1,106 @@
+# vim:tw=80:ft=txt
+
+README FOR SOLARIS INSTALLATIONS
+
+By Roy Sigurd Karlsbakk <roy@karlsbakk.net>
+
+ABOUT
+
+This readme is meant for those wanting to install fail2ban on Solaris 10,
+OpenSolaris, OpenIndiana etc. To some degree it may as well be useful for
+users of older Solaris versions and Nexenta, but don't rely on it.
+
+READ ME FIRST
+
+If I use the term Solaris, I am talking about any Solaris dialect, that is, the
+official Sun/Oracle ones or derivates. If I describe an OS as
+"OpenSolaris-based", it means it's either OpenSolaris, OpenIndiana or one of the
+other, but /not/ the Nexenta family, since this only uses the OpenSolaris/
+IllumOS kernel and not the userland. If I say Solaris 10, I mean Solaris 10 and
+perhaps, if you're lucky and have some good gods on your side, it may also apply
+to Solaris 9 or even 8 and hopefully in the new Solaris 11 whenever that may be
+released. Quoted lines of code, settings et cetera are indented with two spaces.
+This does _not_ mean you should use that indentation, especially in config files
+where they can be harmful. Optional settings are prefixed with OPT: while
+required settings are prefixed with REQ:. If no prefix is found, regard it as a
+required setting.
+
+INSTALLATION ON SOLARIS
+
+The installation is straight forward on Solaris as well as on linux/bsd/etc.
+./setup.py install installs the general packages in /usr/bin on OpenSolaris-
+based distros or (at least on this box) under /usr/sfw/bin on Solaris 10. In
+the files/ directory you will find the file solaris-fail2ban.xml containing the
+Solaris service. To install this, run the following command as root (or with
+sudo):
+
+  svccfg import files/solaris-fail2ban.xml
+
+This should normally without giving an error. If you get an error, deal with it,
+and please post any relevant info (or fixes?) to the fail2ban mailing list.
+Next install the service handler - copy the script in and allow it to be executed:
+
+  cp files/solaris-svc-fail2ban /lib/svc/method/svc-fail2ban
+  chmod +x /lib/svc/method/svc-fail2ban
+
+CONFIGURE SYSLOG
+
+For some reason, a default Solaris installation does not log ssh login attempts,
+and since fail2ban works by monitoring logs, enabling this logging is rather
+important for it to work. To enable this, edit /etc/syslog.conf and add a line
+at the end:
+
+  auth.info					/var/adm/auth.log
+
+Save the file and exit, and run
+
+  touch /var/adm/auth.log
+
+The Solaris system logger will _not_ create a non-existing file. Now, restart
+the system logger.
+
+  svcadm restart system-log
+
+Try to ssh into localhost with ssh asdf@localhost and enter an invalid password.
+Make sure this is logged in the above file. When done, you may configure
+fail2ban.
+
+FAIL2BAN CONFIGURATION
+
+OPT: Edit /etc/fail2ban/fail2ban.conf and change logtarget to /var/adm/fail2ban.log
+REQ: Edit /etc/fail2ban/jail.conf and move down to the [ssh-tcpwrapper] section.
+     Here, set enabled = true and logpath = /var/adm/auth.log. Set the sendmail
+     dest address to something useful or drop the line to stop it spamming you.
+
+START (OR RESTART) FAIL2BAN
+
+Enable the fail2ban service with
+
+  svcadm enable fail2ban
+
+When done, check that all services are running well
+
+  svcs -xv
+
+GOTCHAS AND FIXMES
+
+* It seems the installation may be starting fail2ban automatically. If this is
+  done, fail2ban will not start, but no errors will be returned from svcs
+  (above). Check if it's running with 'ps -ef | grep fail2ban' and manually kill
+  the PID if it is. Re-enable fail2ban and try again
+
+    svcadm disable fail2ban
+    svcadm enable fail2ban
+
+* If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode
+  chcek /var/svc/log/network-fail2ban:default.log for clues. 
+  Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban
+  You may need to:
+
+  sudo mkdir /var/run/fail2ban
+
+* Fail2ban adds lines like these to /etc/hosts.deny:
+
+    ALL: 1.2.3.4
+
+  wouldn't it be better to just block sshd?

From 274227bdfa613bafe026496e554f0167f7cacaf8 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sat, 20 Apr 2013 19:40:56 -0400
Subject: [PATCH 197/544] DOC: tune up formatting (spaces) and prelude for the
 changelog entry

---
 ChangeLog | 145 ++++++++++++++++++++++++++++--------------------------
 1 file changed, 74 insertions(+), 71 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index eb7e2cfd..e60eb12f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,86 +10,89 @@ Fail2Ban (version 0.8.9)                                              2013/04/XX
 ver. 0.8.9 (2013/04/XXX) - wanna-be-stable
 ----------
 
-This release incorporates 144 (XXX) non-merge commits from 14
-contributors (sorted by number of commits): Yaroslav Halchenko, Daniel
-Black, Steven Hiscocks, ArndRa, hamilton5, pigsyn, Erwan Ben Souiden,
-Michael Gebetsroither, Orion Poplawski, Artur Penttinen, sebres,
-Nicolas Collignon, Pascal Borreli, blotus:
+Although primarily a bugfix release, it incorporates many new
+enhancements, few new features, but more importantly -- quite extended
+tests battery with current 94% coverage.  This release incorporates
+more than a 100 of non-merge commits from 14 contributors (sorted by
+number of commits): Yaroslav Halchenko, Daniel Black, Steven Hiscocks,
+ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither,
+Orion Poplawski, Artur Penttinen, sebres, Nicolas Collignon, Pascal
+Borreli, blotus:
 
 - Fixes:
   Yaroslav Halchenko
-	* [6f4dad46] Documentation python-2.4 is the minimium version.
-	* [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on
-	  Fedora. Closes gh-112. Thanks to Camusensei for the bug report. 
-	* [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for
-	  insight. Closes gh-103.
-	* [ab044b75] delay check for the existence of config directory until read.
-	* [3b4084d4] fixing up for handling of TAI64N timestamps.
-	* [154aa38e] do not shutdown logging until all jails stop.
+   * [6f4dad46] Documentation python-2.4 is the minimium version.
+   * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on
+     Fedora. Closes gh-112. Thanks to Camusensei for the bug report.
+   * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for
+     insight. Closes gh-103.
+   * [ab044b75] delay check for the existence of config directory until read.
+   * [3b4084d4] fixing up for handling of TAI64N timestamps.
+   * [154aa38e] do not shutdown logging until all jails stop.
   Orion Poplawski
-	* [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking
-	  newly created directories.
-	Nicolas Collignon
-	* [39667ff6] Avoid leaking file descriptors. Closes gh-167.
-	Sergey Brester
-	* [b6bb2f88 and d17b4153] invalid date recognition, irregular because of
-	  sorting template list.
+   * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking
+     newly created directories.
+  Nicolas Collignon
+   * [39667ff6] Avoid leaking file descriptors. Closes gh-167.
+  Sergey Brester
+   * [b6bb2f88 and d17b4153] invalid date recognition, irregular because of
+     sorting template list.
   Steven Hiscocks
-	* [7a442f07] When changing log target with python2.{4,5} handle KeyError.
-	  Closes gh-147, gh-148.
-	* [b6a68f51] Fix delaction on server side. Close gh-124.
+   * [7a442f07] When changing log target with python2.{4,5} handle KeyError.
+     Closes gh-147, gh-148.
+   * [b6a68f51] Fix delaction on server side. Closes gh-124.
   Daniel Black
-	* [f0610c01] Allow more that a one word command when changing and Action via
- 		the fail2ban-client. Closes gh-134.
+   * [f0610c01] Allow more that a one word command when changing and Action via
+     the fail2ban-client. Closes gh-134.
   blotus
-	* [96eb8986] ' and " should also be escaped in action tags Closes gh-109
+   * [96eb8986] ' and " should also be escaped in action tags Closes gh-109
 - New features:
   Yaroslav Halchenko
-	* [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
-	  to provide additional flexibility to system adminstrators. Thanks to
-		beilber for the idea. Close gh-114.
-	* [3ce53e87] Add exim filter.
-	Erwan Ben Souiden
-	* [d7d5228] add nagios integration documentation and script to ensure
-	  fail2ban is running. Closes gh-166.
-	Artur Penttinen
-	* [29d0df5] Add mysqld filter. Closes gh-152.
-	ArndRaphael Brandes
-	* [bba3fd8] Add Sogo filter. Closes gh-117
-	Michael Gebetsriother
-	* [f9b78ba] Add action route to block at routing level.
-	Teodor Micu & Yaroslav Halchenko
-	* [5f2d383] Add roundcube auth filter. Close Debian bug #699442.
+   * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}
+     to provide additional flexibility to system adminstrators. Thanks to
+     beilber for the idea. Closes gh-114.
+   * [3ce53e87] Add exim filter.
+  Erwan Ben Souiden
+   * [d7d5228] add nagios integration documentation and script to ensure
+     fail2ban is running. Closes gh-166.
+  Artur Penttinen
+   * [29d0df5] Add mysqld filter. Closes gh-152.
+  ArndRaphael Brandes
+   * [bba3fd8] Add Sogo filter. Closes gh-117.
+  Michael Gebetsriother
+   * [f9b78ba] Add action route to block at routing level.
+  Teodor Micu & Yaroslav Halchenko
+   * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442.
   Daniel Black
-	* [be06b1b] Add action for iptables-ipsets. Close gh-102.
-	Soulard Morgan
-	* [f336d9f] Add filter for webmin. Close gh-99
+   * [be06b1b] Add action for iptables-ipsets. Closes gh-102.
+  Soulard Morgan
+   * [f336d9f] Add filter for webmin. Closes gh-99.
 - Enhancements:
   Steven Hiscocks
-	* [3d6791f] Ensure restart of Actions after a check fails occurs
-	  consistently. Closes gh-172.
-  * [MANY] Improvements to test cases, travis, and code coverage (coveralls).
-	* [b36835f] Add get cinfo to fail2ban-client. Close gh-124.
-	* [ce3ab34] Added ability to specify PID file.
-	Orion Poplawski
-	* [ddebcab] Enhance fail2ban.service defination dependancies and Pidfile.
-	  Closes gh-142.
+   * [3d6791f] Ensure restart of Actions after a check fails occurs
+     consistently. Closes gh-172.
+   * [MANY] Improvements to test cases, travis, and code coverage (coveralls).
+   * [b36835f] Add get cinfo to fail2ban-client. Closes gh-124.
+   * [ce3ab34] Added ability to specify PID file.
+  Orion Poplawski
+   * [ddebcab] Enhance fail2ban.service definition dependencies and Pidfile.
+     Closes gh-142.
   Yaroslav Halchenko
-	* [MANY] Lots of improvements to log messages, man pages and test cases.
-	* [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
-	  Closes gh-126. Bug report by Michael Heuberger.
-	* [40c5a2d] adding more of diagnostic messages into -client while starting
-	  the daemon.
-	Daniel Black
-	* [3aeb1a9] Add jail.conf manual page. close gh-143.
-	* [MANY] man page edits.
-	* [7cd6dab] Added help command to fail2ban-client. close gh-134.
-	* [c8c7b0b,23bbc60] Better logging of log file read errors. close gh-134.
-	* [3665e6d] Added code coverage to development process.
-	Pascal Borreli
-	* [a2b29b4] Fixed lots of typos in config files and documentation.
-	hamilton5
-	* [7ede1e8] Update dovecot filter config
+   * [MANY] Lots of improvements to log messages, man pages and test cases.
+   * [91d5736] Postfix filter improvements - empty helo, from and rcpt to.
+     Closes gh-126. Bug report by Michael Heuberger.
+   * [40c5a2d] adding more of diagnostic messages into -client while starting
+     the daemon.
+  Daniel Black
+   * [3aeb1a9] Add jail.conf manual page. Closes gh-143.
+   * [MANY] man page edits.
+   * [7cd6dab] Added help command to fail2ban-client.
+   * [c8c7b0b,23bbc60] Better logging of log file read errors.
+   * [3665e6d] Added code coverage to development process.
+  Pascal Borreli
+   * [a2b29b4] Fixed lots of typos in config files and documentation.
+  hamilton5
+   * [7ede1e8] Update dovecot filter config.
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users
@@ -100,20 +103,20 @@ ver. 0.8.8 (2012/12/06) - stable
 - Fixes:
   Alan Jenkins
    * [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid
-     banning due to misconfigured DNS. Close gh-64
+     banning due to misconfigured DNS. Closes gh-64
   Yaroslav Halchenko
    * [83109bc] IMPORTANT: escape the content of <matches> (if used in
      custom action files) since its value could contain arbitrary
      symbols.  Thanks for discovery go to the NBS System security
      team
-   * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Close gh-83
+   * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Closes gh-83
    * [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3
    * [37a2e59] store IP as a base, non-unicode str to avoid spurious messages
-     in the console. Close gh-91
+     in the console. Closes gh-91
 - New features:
   David Engeset
    * [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching
-     the log file to take 'banip' or 'unbanip' in effect. Close gh-81, gh-86
+     the log file to take 'banip' or 'unbanip' in effect. Closes gh-81, gh-86
   Yaroslav Halchenko
 - Enhancements:
    * [2d66f31] replaced uninformative "Invalid command" message with warning log

From 22f04677b6929406a45aba2873eaab55aa3d1588 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 23 Apr 2013 13:56:51 -0400
Subject: [PATCH 198/544] BF: usedns deals with forward (not reverse) DNS
 lookups (thanks Steven Hiscocks)

---
 config/jail.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/jail.conf b/config/jail.conf
index 4399d0bd..7569cd2f 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -46,10 +46,10 @@ maxretry = 3
 backend = auto
 
 # "usedns" specifies if jails should trust hostnames in logs,
-#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs
+#   warn when DNS lookups are performed, or ignore all hostnames in logs
 #
-# yes:   if a hostname is encountered, a reverse DNS lookup will be performed.
-# warn:  if a hostname is encountered, a reverse DNS lookup will be performed, 
+# yes:   if a hostname is encountered, a DNS lookup will be performed.
+# warn:  if a hostname is encountered, a DNS lookup will be performed,
 #        but it will be logged as a warning.
 # no:    if a hostname is encountered, will not be used for banning,
 #        but it will be logged as info.

From 61949b4ff7b5cb9a11b8b912a0e83524c77af830 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 24 Apr 2013 23:23:31 -0400
Subject: [PATCH 199/544] Moving README into a markup README.md for github's
 goodnesses

---
 README => README.md | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename README => README.md (100%)

diff --git a/README b/README.md
similarity index 100%
rename from README
rename to README.md

From ce912bb11cc8de476586a4ce6ef19432de0f6c3f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 25 Apr 2013 01:07:39 -0300
Subject: [PATCH 200/544] updated README.md to hyperlink, add travis and
 coversall

for some reason coversall says 'unknown' -- may be it requires a paid account for the badges?
---
 README.md | 62 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 32 insertions(+), 30 deletions(-)

diff --git a/README.md b/README.md
index 2016e9e1..04f8b349 100644
--- a/README.md
+++ b/README.md
@@ -2,10 +2,9 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
+                       v0.8.8                  2012/07/31
 
-================================================================================
-Fail2Ban (version 0.8.8)                                              2012/07/31
-================================================================================
+## Fail2Ban: ban hosts that cause multiple authentication errors 
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
 password failures. It updates firewall rules to reject the IP address. These
@@ -18,32 +17,29 @@ are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
 Installation:
 -------------
 
+**It is possible that Fail2ban is already packaged for your distribution.  In
+this case, you should use it instead.**
+
 Required:
-   >=python-2.4 (http://www.python.org)
+- [Python >= 2.4](http://www.python.org)
 
 Optional:
-   pyinotify:
-      >=linux-2.6.13
-      >=python-2.4
-      >=pyinotify-0.8.3 (https://github.com/seb-m/pyinotify)
-   Gamin:
-      >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin)
+- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
+  - Linux >= 2.6.13
+- [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
 
 To install, just do:
 
-> tar xvfj fail2ban-0.8.8.tar.bz2
-> cd fail2ban-0.8.8
-> python setup.py install
+    tar xvfj fail2ban-0.8.8.tar.bz2
+    cd fail2ban-0.8.8
+    python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
-placed into /usr/bin.
-
-It is possible that Fail2ban is already packaged for your distribution.  In
-this case, you should use it.
+placed into /usr/bin, and configuration under /etc/fail2ban.
 
 Fail2Ban should be correctly installed now. Just type:
 
-> fail2ban-client -h
+    fail2ban-client -h
 
 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
@@ -57,29 +53,35 @@ available commands are described in the fail2ban-client(1) manpage.  Also see
 fail2ban(1) manpage for further references and find even more documentation on
 the website: http://www.fail2ban.org
 
+Code status:
+------------
+
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)
+
+* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
+
 Contact:
 --------
 
-Website: http://www.fail2ban.org
-
-You need some new features, you found bugs?
-visit https://github.com/fail2ban/fail2ban/issues
+### You need some new features, you found bugs?
+visit [Issues](https://github.com/fail2ban/fail2ban/issues)
 and if your issue is not yet known -- file a bug report.
 
-You would like to troubleshoot or discuss?
-join the mailing list
-https://lists.sourceforge.net/lists/listinfo/fail2ban-users
+### You would like to troubleshoot or discuss?
+join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 
-You just appreciate this program:
-send kudos to the original author (Cyril Jaquier <cyril.jaquier@fail2ban.org>)
-or better to the mailing list
-https://lists.sourceforge.net/lists/listinfo/fail2ban-users
+### You would like to contribute (new filters/actions/code/documentation)?
+send a pull request
+
+### You just appreciate this program:
+send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>)
+or better to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.
 
 Thanks:
 -------
 
-See THANKS file.
+See [THANKS](https://github.com/fail2ban/fail2ban/blob/master/THANKS) file.
 
 License:
 --------

From c5287e3d9cb0d5336b471f9647bd7e369327fc97 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 26 Apr 2013 22:51:26 -0400
Subject: [PATCH 201/544] BF: Rename mentioning of README to README.md (Fixes
 #187)

---
 MANIFEST  | 2 +-
 setup.cfg | 2 +-
 setup.py  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/MANIFEST b/MANIFEST
index 28063b83..364c0b08 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1,4 +1,4 @@
-README
+README.md
 ChangeLog
 TODO
 THANKS
diff --git a/setup.cfg b/setup.cfg
index 74c22b25..02cd5d5d 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -8,6 +8,6 @@ formats=bztar
 release = 1
 packager = Yaroslav Halchenko <debian@onerussian.com>, Daniel Black <grooverdan@users.sourceforge.net>
 doc_files = DEVELOP
-            README
+            README.md
             THANKS
             doc/run-rootless.txt
diff --git a/setup.py b/setup.py
index 784999a2..1b6268bf 100755
--- a/setup.py
+++ b/setup.py
@@ -69,7 +69,7 @@ setup(
 							''
 						),
 						('/usr/share/doc/fail2ban',
-							['README', 'DEVELOP', 'doc/run-rootless.txt']
+							['README.md', 'DEVELOP', 'doc/run-rootless.txt']
 						)
 					]
 )

From a0bb5163df7abcb634af41aeb26442e0aead857a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Apr 2013 09:23:41 +1000
Subject: [PATCH 202/544] DOC: changelog entry for enhanced ssh filter

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index e60eb12f..f1d912c4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -89,6 +89,7 @@ Borreli, blotus:
    * [7cd6dab] Added help command to fail2ban-client.
    * [c8c7b0b,23bbc60] Better logging of log file read errors.
    * [3665e6d] Added code coverage to development process.
+   * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source.
   Pascal Borreli
    * [a2b29b4] Fixed lots of typos in config files and documentation.
   hamilton5

From 63870341d8a136e0f49aac882a15cbb9e782d18c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Apr 2013 10:44:05 +1000
Subject: [PATCH 203/544] DOC: release documentation and distributor contacts

---
 DEVELOP | 37 +++++++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index 3e8e430a..a00a7ac6 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -262,6 +262,38 @@ Takes care about executing start/check/ban/unban/stop commands
 Releasing
 =========
 
+# Check distribution patches and see if they can be included
+
+  * https://apps.fedoraproject.org/packages/fail2ban/sources
+  * http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
+  * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
+  * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
+  * http://sophie.zarb.org/sources/fail2ban (Mageia)
+
+# Check distribution outstanding bugs
+
+  * https://github.com/fail2ban/fail2ban/issues?sort=updated&state=open
+  * http://bugs.debian.org/cgi-bin/pkgreport.cgi?dist=unstable;package=fail2ban
+  * http://bugs.sabayon.org/buglist.cgi?quicksearch=net-analyzer%2Ffail2ban
+  * https://bugs.gentoo.org/buglist.cgi?query_format=advanced&short_desc=fail2ban&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=IN_PROGRESS&short_desc_type=allwords
+  * https://bugzilla.redhat.com/buglist.cgi?query_format=advanced&bug_status=NEW&bug_status=ASSIGNED&component=fail2ban&classification=Red%20Hat&classification=Fedora
+  * http://www.freebsd.org/cgi/query-pr-summary.cgi?text=fail2ban
+
+# Provide a release sample to distributors
+
+  * Debian: Yaroslav Halchenko <debian@onerussian.com>
+            http://packages.qa.debian.org/f/fail2ban.html
+  * FreeBSD: Christoph Theis theis@gmx.at>, Nick Hilliard <nick@foobar.org>
+            http://svnweb.freebsd.org/ports/head/security/py-fail2ban/Makefile?view=markup
+  * Fedora: Axel Thimm <Axel.Thimm@atrpms.net>
+            https://apps.fedoraproject.org/packages/fail2ban
+  * Gentoo: netmon@gentoo.org
+            http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
+  * openSUSE: Stephan Kulow <coolo@suse.com>
+            https://build.opensuse.org/package/users?package=fail2ban&project=openSUSE%3AFactory
+
+# Wait for feedback from distributors
+
 # Ensure the version is correct in ./common/version.py
 
 # Add/finalize the corresponding entry in the ChangeLog
@@ -296,9 +328,10 @@ Releasing
 
 # Email users and development list of release
 
-TODO notifying distributors etc.
+# notify distributors
 
-Post Release:
+Post Release
+============
 
 Add the following to the top of the ChangeLog
 

From 0ac8746d0566427c7c1bb3dddb6e7eb82e0ff809 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Apr 2013 11:03:44 +1000
Subject: [PATCH 204/544] ENH: Account for views in named filter. By Romain
 Riviere in gentoo bug #259458

---
 config/filter.d/named-refused.conf | 2 +-
 testcases/files/logs/named-refused | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index ebf7681a..64f7d685 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -26,7 +26,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = %(__line_prefix)sclient <HOST>#.+: query(?: \(cache\))? '.*' denied\s*$
+failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 6608ae2f..130e7417 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -3,3 +3,4 @@ Jul 24 14:16:56 raid5 named[3935]: client 62.123.164.113#32768: query 'ricreig.c
 Jul 24 14:17:13 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'geo-mueller.de/NS/IN' denied
 Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shivaree.de/NS/IN' denied
 Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied
+Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied

From f2f523407653d634a49ab2b3d60dd1839621ee41 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Apr 2013 11:05:07 +1000
Subject: [PATCH 205/544] DOC: ChangeLog for named-refused entry

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index e60eb12f..cec4a833 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -93,6 +93,8 @@ Borreli, blotus:
    * [a2b29b4] Fixed lots of typos in config files and documentation.
   hamilton5
    * [7ede1e8] Update dovecot filter config.
+	Romain Riviere
+	 * [0ac8746] Enhance named-refused filter for views.
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users

From 6a4605a675303d95449f6d7b99f71cded67970d4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Apr 2013 11:26:03 +1000
Subject: [PATCH 206/544] DOC: document <br> tag

---
 man/jail.conf.5 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/man/jail.conf.5 b/man/jail.conf.5
index 552b0ac0..8f281ce4 100644
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@@ -92,7 +92,7 @@ Commands specified in the [Definition] section are executed through a system she
 return 0, otherwise error would be logged.  Moreover if \fBactioncheck\fR exits with non-0 status, it is taken as indication that firewall status has changed and fail2ban needs to reinitialize itself (i.e. issue \fBactionstop\fR and \fBactionstart\fR commands).
 
 Tags are enclosed in <>.  All the elements of [Init] are tags that are replaced in all action commands.  Tags can be added by the
-\fBfail2ban-client\fR using the setctag command.
+\fBfail2ban-client\fR using the setctag command. \fB<br>\fR is a tag that is always a new line (\\n).
 
 More than a single command is allowed to be specified. Each command needs to be on a separate line and indented with whitespaces without blank lines. The following example defines
 two commands to be executed.

From 1d9abd1b39e2db7322986418436bf6849267edad Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Apr 2013 12:37:16 +1000
Subject: [PATCH 207/544] ENH: allow recursive tag substitution in action
 files.

---
 server/action.py            | 35 ++++++++++++++++++++++++++++++++++-
 testcases/actiontestcase.py | 21 +++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/server/action.py b/server/action.py
index ce9651e8..3221f150 100644
--- a/server/action.py
+++ b/server/action.py
@@ -28,7 +28,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging, os
-import threading
+import threading, re
 #from subprocess import call
 
 # Gets the instance of the logger.
@@ -143,6 +143,9 @@ class Action:
 	# @return True if the command succeeded
 	
 	def execActionStart(self):
+		if self.__cInfo:
+			if not Action.substituteRecursiveTags(self.__cInfo):
+				return False
 		startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 		return Action.executeCmd(startCmd)
 	
@@ -242,6 +245,36 @@ class Action:
 		stopCmd = Action.replaceTag(self.__actionStop, self.__cInfo)
 		return Action.executeCmd(stopCmd)
 
+	##
+	# Sort out tag definations within other tags
+	#
+	# so:		becomes:
+	# a = 3		a = 3
+	# b = <a>_3	b = 3_3
+	# @param	tags, a dictionary
+	# @returns	tags altered or False if there is a recursive defination
+	#@staticmethod
+	def substituteRecursiveTags(tags):
+		t = re.compile(r'<([^ >]+)>')
+		for tag, value in tags.iteritems():
+			value = str(value)
+			m = t.search(value)
+			while m:
+				if m.group(1) == tag:
+					# recursive definations are bad
+					return False
+				else:
+					if tags.has_key(m.group(1)):
+						value = value[0:m.start()] + tags[m.group(1)] + value[m.end():]
+						m = t.search(value, m.start())
+					else:
+						# TODO missing tag? to abort or not? there is the <STDIN> case maybe
+						m = t.search(value, m.start() + 1)
+			tags[tag] = value
+		return tags
+	substituteRecursiveTags = staticmethod(substituteRecursiveTags)
+
+	#@staticmethod
 	def escapeTag(tag):
 		for c in '\\#&;`|*?~<>^()[]{}$\n\'"':
 			if c in tag:
diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index 50ae2816..281cb0b6 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -61,6 +61,27 @@ class ExecuteAction(unittest.TestCase):
 	def _is_logged(self, s):
 		return s in self._log.getvalue()
 
+	def testSubstituteRecursiveTags(self):
+		aInfo = {
+			'HOST': "192.0.2.0",
+			'ABC': "123 <HOST>",
+			'xyz': "890 <ABC>",
+		}
+		# Recursion is bad
+		self.assertFalse(Action.substituteRecursiveTags({'A': '<A>'}))
+		self.assertFalse(Action.substituteRecursiveTags({'A': '<B>', 'B': '<A>'}))
+		self.assertFalse(Action.substituteRecursiveTags({'A': '<B>', 'B': '<C>', 'C': '<A>'}))
+		# missing tags are ok
+		self.assertEquals(Action.substituteRecursiveTags({'A': '<C>'}), {'A': '<C>'})
+		self.assertEquals(Action.substituteRecursiveTags({'A': '<C> <D> <X>','X':'fun'}), {'A': '<C> <D> fun', 'X':'fun'})
+		self.assertEquals(Action.substituteRecursiveTags({'A': '<C> <B>', 'B': 'cool'}), {'A': '<C> cool', 'B': 'cool'})
+		# rest is just cool
+		self.assertEquals(Action.substituteRecursiveTags(aInfo),
+								{ 'HOST': "192.0.2.0",
+									'ABC': '123 192.0.2.0',
+									'xyz': '890 123 192.0.2.0',
+								})
+
 	def testReplaceTag(self):
 		aInfo = {
 			'HOST': "192.0.2.0",

From e5474e57aa9cdef95e9b2425de8c8eaf867c4a78 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Apr 2013 12:38:42 +1000
Subject: [PATCH 208/544] DOC: ChangeLog for recursive tag substition

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index fde414f4..3240e8f3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -90,6 +90,8 @@ Borreli, blotus:
    * [c8c7b0b,23bbc60] Better logging of log file read errors.
    * [3665e6d] Added code coverage to development process.
    * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source.
+   * [1d9abd1] Action files can have tags in defination that refer to other
+     tags.
   Pascal Borreli
    * [a2b29b4] Fixed lots of typos in config files and documentation.
   hamilton5

From 945ad3d9e65348a78318ca026dfcb5b31dbe736e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Apr 2013 14:10:23 +1000
Subject: [PATCH 209/544] BF: ensure dates in email are in the C locale. Thanks
 iGeorgeX

---
 config/action.d/sendmail-whois-lines.conf | 6 +++---
 config/action.d/sendmail-whois.conf       | 6 +++---
 config/action.d/sendmail.conf             | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index a4b53b97..30cd84b8 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: Fail2Ban <<sender>>
               To: <dest>\n
               Hi,\n
@@ -25,7 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
-             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -46,7 +46,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
-            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
index f63fd36f..6b7b9383 100644
--- a/config/action.d/sendmail-whois.conf
+++ b/config/action.d/sendmail-whois.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: Fail2Ban <<sender>>
               To: <dest>\n
               Hi,\n
@@ -25,7 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
-             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -46,7 +46,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
-            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
index 569b3bfa..db619a87 100644
--- a/config/action.d/sendmail.conf
+++ b/config/action.d/sendmail.conf
@@ -12,7 +12,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: Fail2Ban <<sender>>
               To: <dest>\n
               Hi,\n
@@ -25,7 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
-             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -46,7 +46,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
-            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
+            Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n

From f91ad7e8788d44a37a88bd3960bde77625bed442 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Apr 2013 14:12:15 +1000
Subject: [PATCH 210/544] DOC: credits for gh-70 fix

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index fde414f4..53de74c6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -44,6 +44,8 @@ Borreli, blotus:
   Daniel Black
    * [f0610c01] Allow more that a one word command when changing and Action via
      the fail2ban-client. Closes gh-134.
+	 * [945ad3d9] Fix dates on email actions to work in different locals. Closes
+	   gh-70. Thanks to iGeorgeX for the idea.
   blotus
    * [96eb8986] ' and " should also be escaped in action tags Closes gh-109
 - New features:

From 2403f395e9ed62dcac004fe7915c84c4fc660608 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Apr 2013 15:33:45 +1000
Subject: [PATCH 211/544] ENH: remove stats of config files and use results of
 SafeConfigParserWithIncludes.read to facilitate meaningful error messages

---
 client/configreader.py | 36 ++++++++++++++----------------------
 1 file changed, 14 insertions(+), 22 deletions(-)

diff --git a/client/configreader.py b/client/configreader.py
index 243c843c..44ebdd3d 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -52,9 +52,9 @@ class ConfigReader(SafeConfigParserWithIncludes):
 		return self._basedir
 	
 	def read(self, filename):
-		if not (os.path.exists(self._basedir) and os.access(self._basedir, os.R_OK | os.X_OK)):
-			raise ValueError("Base configuration directory %s either does not exist "
-							 "or is not accessible" % self._basedir)
+		if not os.path.exists(self._basedir):
+			raise ValueError("Base configuration directory %s does not exist "
+							  % self._basedir)
 		basename = os.path.join(self._basedir, filename)
 		logSys.debug("Reading configs for %s under %s "  % (basename, self._basedir))
 		config_files = [ basename + ".conf",
@@ -65,27 +65,19 @@ class ConfigReader(SafeConfigParserWithIncludes):
 
 		# possible further customizations under a .conf.d directory
 		config_dir = basename + '.d'
-		if os.path.exists(config_dir):
-			if os.path.isdir(config_dir) and os.access(config_dir, os.X_OK | os.R_OK):
-				# files must carry .conf suffix as well
-				config_files += sorted(glob.glob('%s/*.conf' % config_dir))
-			else:
-				logSys.warn("%s exists but not a directory or not accessible"
-							 % config_dir)
+		config_files += sorted(glob.glob('%s/*.conf' % config_dir))
 
-		# check if files are accessible, warn if any is not accessible
-		# and remove it from the list
-		config_files_accessible = []
-		for f in config_files:
-			if os.access(f, os.R_OK):
-				config_files_accessible.append(f)
-			else:
-				logSys.warn("%s exists but not accessible - skipping" % f)
-
-		if len(config_files_accessible):
+		if len(config_files):
 			# at least one config exists and accessible
-			SafeConfigParserWithIncludes.read(self, config_files_accessible)
-			return True
+			logSys.debug("Reading config files: " + ', '.join(config_files))
+			config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
+			missed = [ cf for cf in config_files if cf not in config_files_read ]
+			logSys.error("Error reading files: " + ', '.join(missed))
+			if config_files_read:
+				return True
+			logSys.error("Found no accessible config files for %r under %s" %
+						 ( filename, self.getBaseDir() ))
+			return False
 		else:
 			logSys.error("Found no accessible config files for %r " % filename
 						 + (["under %s" % self.getBaseDir(),

From f21566049c9e64215dd10091e5d7a999bbffb7cc Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 29 Apr 2013 13:54:14 -0400
Subject: [PATCH 212/544] BF: pyinotify backend should also handle IN_MOVED_TO
 events

---
 server/filterpyinotify.py   |  4 ++--
 testcases/filtertestcase.py | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py
index e86498b0..4c270d2e 100644
--- a/server/filterpyinotify.py
+++ b/server/filterpyinotify.py
@@ -66,7 +66,7 @@ class FilterPyinotify(FileFilter):
 	def callback(self, event, origin=''):
 		logSys.debug("%sCallback for Event: %s", origin, event)
 		path = event.pathname
-		if event.mask & pyinotify.IN_CREATE:
+		if event.mask & ( pyinotify.IN_CREATE | pyinotify.IN_MOVED_TO ):
 			# skip directories altogether
 			if event.mask & pyinotify.IN_ISDIR:
 				logSys.debug("Ignoring creation of directory %s", path)
@@ -130,7 +130,7 @@ class FilterPyinotify(FileFilter):
 		if not (path_dir in self.__watches):
 			# we need to watch also  the directory for IN_CREATE
 			self.__watches.update(
-				self.__monitor.add_watch(path_dir, pyinotify.IN_CREATE))
+				self.__monitor.add_watch(path_dir, pyinotify.IN_CREATE | pyinotify.IN_MOVED_TO))
 			logSys.debug("Added monitor for the parent directory %s", path_dir)
 
 		self._addFileWatcher(path)
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 927cb2fe..00946f90 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -475,6 +475,40 @@ def get_monitor_failures_testcase(Filter_):
 			self.assertEqual(self.filter.failManager.getFailTotal(), 6)
 
 
+		def _test_move_into_file(self, interim_kill=False):
+			# if we move a new file into the location of an old (monitored) file
+			self.file1 = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
+												  n=100)
+			# make sure that it is monitored first
+			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
+			self.assertEqual(self.filter.failManager.getFailTotal(), 3)
+
+			if interim_kill:
+				_killfile(None, self.name)
+				time.sleep(0.2)				  # let them know
+
+			# now create a new one to override old one
+			self.file = _copy_lines_between_files(GetFailures.FILENAME_01,
+												   self.name + '.new', n=100)
+			os.rename(self.name + '.new', self.name)
+			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
+			self.assertEqual(self.filter.failManager.getFailTotal(), 6)
+
+			# and to make sure that it now monitored for changes
+			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, n=100)
+			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
+			self.assertEqual(self.filter.failManager.getFailTotal(), 9)
+
+
+		def test_move_into_file(self):
+			self._test_move_into_file(interim_kill=False)
+
+		def test_move_into_file_after_removed(self):
+			# exactly as above test + remove file explicitly
+			# to test against possible drop-out of the file from monitoring
+		    self._test_move_into_file(interim_kill=True)
+
+
 		def test_new_bogus_file(self):
 			# to make sure that watching whole directory does not effect
 			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, n=100)

From 4f59e14616d0ecf9eee3f5589a5464a89cf9885d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 29 Apr 2013 14:00:25 -0400
Subject: [PATCH 213/544] Changelog entry for the previous commit and some
 untabify

---
 ChangeLog | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 53de74c6..a1b3d61c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,6 +29,8 @@ Borreli, blotus:
    * [ab044b75] delay check for the existence of config directory until read.
    * [3b4084d4] fixing up for handling of TAI64N timestamps.
    * [154aa38e] do not shutdown logging until all jails stop.
+   * [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes gh-184.
+     Thanks to Jon Foster for report and troubleshooting.
   Orion Poplawski
    * [e4aedfdc00] pyinotify - use bitwise op on masks and do not try tracking
      newly created directories.
@@ -44,8 +46,8 @@ Borreli, blotus:
   Daniel Black
    * [f0610c01] Allow more that a one word command when changing and Action via
      the fail2ban-client. Closes gh-134.
-	 * [945ad3d9] Fix dates on email actions to work in different locals. Closes
-	   gh-70. Thanks to iGeorgeX for the idea.
+   * [945ad3d9] Fix dates on email actions to work in different locals. Closes
+     gh-70. Thanks to iGeorgeX for the idea.
   blotus
    * [96eb8986] ' and " should also be escaped in action tags Closes gh-109
 - New features:
@@ -96,8 +98,8 @@ Borreli, blotus:
    * [a2b29b4] Fixed lots of typos in config files and documentation.
   hamilton5
    * [7ede1e8] Update dovecot filter config.
-	Romain Riviere
-	 * [0ac8746] Enhance named-refused filter for views.
+  Romain Riviere
+   * [0ac8746] Enhance named-refused filter for views.
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users

From b7795addd0958919fed3ee6b4c0f2a993e31cbd4 Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Tue, 30 Apr 2013 04:10:32 +0800
Subject: [PATCH 214/544] ENH: actionunban back to a sed command

per https://github.com/fail2ban/fail2ban/pull/182#discussion_r3999128
---
 config/action.d/hostsdeny.conf | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index db36aa29..6f324e1e 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -40,11 +40,7 @@ actionban = IP=<ip> &&
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-# Original:
-#actionunban = IP=<ip> && sed -i.old /ALL:\ $IP/d <file>
-
-# -i is not supported under Solaris 10/OpenSolaris
-actionunban = IP=<ip> && perl -ne "print unless (/^ALL:\s$IP/)" -i <file>
+actionunban = IP=<ip> && sed  /ALL:\ $IP/d <file> > <file>.new && mv <file>.new <file>
 
 [Init]
 

From d2a953756802bd7cf63f5f5f792371f52f5cba8c Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Tue, 30 Apr 2013 04:14:36 +0800
Subject: [PATCH 215/544] ENH: extra daemon info regex

for matching log lines like:
Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed
keyboard-interactive for james from 205.186.180.30 port 54520 ssh2

this matches  [ID 800047 auth.info]
---
 config/filter.d/common.conf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index 18bf41c5..d13b6adb 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -28,6 +28,10 @@ __pid_re = (?:\[\d+\])
 # EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
 __daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
 
+# extra daemon info
+# EXAMPLE: [ID 800047 auth.info]
+__daemon_extra_re = (?:\[ID \d+ \S+\])
+
 # Combinations of daemon name and PID
 # EXAMPLES: sshd[31607], pop(pam_unix)[4920]
 __daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
@@ -43,5 +47,5 @@ __hostname = \S+
 #
 #       [hostname] [vserver tag] daemon_id spaces
 # this can be optional (for instance if we match named native log files)
-__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
+__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s%(__daemon_extra_re)s?\s*
 

From 3367dbd987dada35438e0583bf0836133368bbf9 Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Tue, 30 Apr 2013 04:23:13 +0800
Subject: [PATCH 216/544] ENH: fail message matching for OpenSolaris and OS X

- OpenSolaris keyboard message matched by new regex 3
- Removed Bye Bye regex per
https://github.com/fail2ban/fail2ban/issues/175#issuecomment-16538036
- PAM auth failure or error and first char case-insensitive, can also
have chars after the hostname. e.g.

Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM:
authentication error for james from 205.186.180.101 via 192.168.1.201
---
 config/filter.d/sshd.conf | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 2c104073..8d98c675 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -23,17 +23,15 @@ _daemon = sshd
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA](?:uthentication) (?:failure|error) for .* from <HOST>.*$
             ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
-            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
+            ^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
-            ^%(__prefix_line)s\[.*\] Failed keyboard-interactive for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
             ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
-            ^%(__prefix_line)s\[.*\] Received disconnect from <HOST>.* Bye\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 018913db6a840c1502df5630afcf371be0053ba1 Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Tue, 30 Apr 2013 04:24:56 +0800
Subject: [PATCH 217/544] ENH+TST: ssh failure messages for OpenSolaris and OS
 X

---
 testcases/files/logs/sshd | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index 8e6c1273..e3e5c67e 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -29,5 +29,25 @@ Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but
 #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47
 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers
 
-# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020
+#9 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020
+# should this be removed? regex was removed in https://github.com/fail2ban/fail2ban/commit/bb7628591c124309774d5f4787d2a4f07cf6b906
 Nov  8 11:19:38 bar sshd[25427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.6
+
+#10 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182
+Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.55 port 42742 ssh2
+Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
+
+#11 OSX syslog error
+Apr 29 14:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from dusky via 192.168.1.201
+Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from n29.c07.mtsvc.net via 192.168.1.201
+Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.35 port 42742 ssh2
+Apr 29 20:12:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.22 port 54520 ssh2
+Apr 29 20:13:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for james from 205.186.180.42 port 54520 ssh2
+Apr 29 20:14:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for <invalid username> from 205.186.180.44 port 42742 ssh2
+Apr 30 01:42:12 Jamess-iMac.local sshd[2554]: Failed keyboard-interactive/pam for invalid user jamedds from 205.186.180.77 port 33723 ssh2
+Apr 29 12:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication failure for james from 205.186.180.88 via 192.168.1.201
+Apr 29 13:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication failure for james from 205.186.180.99 via 192.168.1.201
+Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error for james from 205.186.180.100 via 192.168.1.201
+Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201
+Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102
+Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103
\ No newline at end of file

From 86a5de040ba9bcee897fe5c2b1aaa0a0a695eb7c Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Tue, 30 Apr 2013 04:35:36 +0800
Subject: [PATCH 218/544] ENH: Use .local config files for logtarget and jail

Per: https://github.com/fail2ban/fail2ban/pull/182#discussion_r3886353
---
 README.Solaris | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/README.Solaris b/README.Solaris
index b8883e7f..b03a31a1 100644
--- a/README.Solaris
+++ b/README.Solaris
@@ -67,10 +67,24 @@ fail2ban.
 
 FAIL2BAN CONFIGURATION
 
-OPT: Edit /etc/fail2ban/fail2ban.conf and change logtarget to /var/adm/fail2ban.log
-REQ: Edit /etc/fail2ban/jail.conf and move down to the [ssh-tcpwrapper] section.
-     Here, set enabled = true and logpath = /var/adm/auth.log. Set the sendmail
-     dest address to something useful or drop the line to stop it spamming you.
+OPT: Create /etc/fail2ban/fail2ban.local containing:
+
+logtarget = /var/adm/fail2ban.log
+
+
+REQ: Create /etc/fail2ban/jail.local containing:
+
+[ssh-tcpwrapper]
+
+enabled     = true
+filter      = sshd
+action      = hostsdeny
+              sendmail-whois[name=SSH, dest=you@example.com]
+ignoreregex = for myuser from
+logpath     = /var/adm/auth.log
+
+Set the sendmail dest address to something useful or drop the line to stop it spamming you.
+Set 'myuser' to your username to avoid banning yourself or drop it.
 
 START (OR RESTART) FAIL2BAN
 

From 0c2900e458f642ae2772526700c0888a187084bd Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Tue, 30 Apr 2013 05:41:29 +0800
Subject: [PATCH 219/544] BF: fail2ban.local needs section headers

---
 README.Solaris | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/README.Solaris b/README.Solaris
index b03a31a1..49056062 100644
--- a/README.Solaris
+++ b/README.Solaris
@@ -69,6 +69,27 @@ FAIL2BAN CONFIGURATION
 
 OPT: Create /etc/fail2ban/fail2ban.local containing:
 
+# Fail2Ban main configuration file
+#
+# Comments: use '#' for comment lines and ';' for inline comments
+#
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in fail2ban.local file, e.g.:
+#
+# [Definition]
+# loglevel = 4
+#
+[Definition]
+
+# Option:  logtarget
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#          Only one log target can be specified.
+#          If you change logtarget from the default value and you are
+#          using logrotate -- also adjust or disable rotation in the
+#          corresponding configuration file
+#          (e.g. /etc/logrotate.d/fail2ban on Debian systems)
+# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
 logtarget = /var/adm/fail2ban.log
 
 

From d28f3fa285c0a8edd134052057a1c526bfaf3985 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 30 Apr 2013 08:07:21 +1000
Subject: [PATCH 220/544] DOC: s/defination/definition/g learn to spell

---
 ChangeLog        | 2 +-
 server/action.py | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 3240e8f3..6e00364b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -90,7 +90,7 @@ Borreli, blotus:
    * [c8c7b0b,23bbc60] Better logging of log file read errors.
    * [3665e6d] Added code coverage to development process.
    * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source.
-   * [1d9abd1] Action files can have tags in defination that refer to other
+   * [1d9abd1] Action files can have tags in definition that refer to other
      tags.
   Pascal Borreli
    * [a2b29b4] Fixed lots of typos in config files and documentation.
diff --git a/server/action.py b/server/action.py
index 3221f150..22a96fa2 100644
--- a/server/action.py
+++ b/server/action.py
@@ -246,13 +246,13 @@ class Action:
 		return Action.executeCmd(stopCmd)
 
 	##
-	# Sort out tag definations within other tags
+	# Sort out tag definitions within other tags
 	#
 	# so:		becomes:
 	# a = 3		a = 3
 	# b = <a>_3	b = 3_3
 	# @param	tags, a dictionary
-	# @returns	tags altered or False if there is a recursive defination
+	# @returns	tags altered or False if there is a recursive definition
 	#@staticmethod
 	def substituteRecursiveTags(tags):
 		t = re.compile(r'<([^ >]+)>')
@@ -261,7 +261,7 @@ class Action:
 			m = t.search(value)
 			while m:
 				if m.group(1) == tag:
-					# recursive definations are bad
+					# recursive definitions are bad
 					return False
 				else:
 					if tags.has_key(m.group(1)):

From d7862266d6bbab8dac3ca6d9941bc118d42325cd Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 30 Apr 2013 08:14:50 +1000
Subject: [PATCH 221/544] DOC: missing cinfo tags are ok. Log error for self
 referencing definitions

---
 server/action.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/action.py b/server/action.py
index 22a96fa2..c2f1455b 100644
--- a/server/action.py
+++ b/server/action.py
@@ -145,6 +145,7 @@ class Action:
 	def execActionStart(self):
 		if self.__cInfo:
 			if not Action.substituteRecursiveTags(self.__cInfo):
+				logSys.error("Cinfo/definitions contain self referencing definitions and cannot be resolved")
 				return False
 		startCmd = Action.replaceTag(self.__actionStart, self.__cInfo)
 		return Action.executeCmd(startCmd)
@@ -268,7 +269,9 @@ class Action:
 						value = value[0:m.start()] + tags[m.group(1)] + value[m.end():]
 						m = t.search(value, m.start())
 					else:
-						# TODO missing tag? to abort or not? there is the <STDIN> case maybe
+						# Missing tags are ok so we just continue on searching.
+						# cInfo can contain aInfo elements like <HOST> and valid shell
+						# constructs like <STDIN>.
 						m = t.search(value, m.start() + 1)
 			tags[tag] = value
 		return tags

From 98aa0e23eb6c20ecac7e8e7533b08333fceda879 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 30 Apr 2013 08:19:11 +1000
Subject: [PATCH 222/544] BF: log error only if there were missed config files
 that couldn't be read

---
 client/configreader.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/client/configreader.py b/client/configreader.py
index 44ebdd3d..5d52d6ad 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -72,7 +72,8 @@ class ConfigReader(SafeConfigParserWithIncludes):
 			logSys.debug("Reading config files: " + ', '.join(config_files))
 			config_files_read = SafeConfigParserWithIncludes.read(self, config_files)
 			missed = [ cf for cf in config_files if cf not in config_files_read ]
-			logSys.error("Error reading files: " + ', '.join(missed))
+			if missed:
+				logSys.error("Could not read config files: " + ', '.join(missed))
 			if config_files_read:
 				return True
 			logSys.error("Found no accessible config files for %r under %s" %

From 8e63d4c6da41b8ed4c0423ae907445bd8ca5f03a Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 2 May 2013 23:25:43 -0400
Subject: [PATCH 223/544] ENH: "is None" instead of "== None" + tune ups in
 headers

is None is generally faster than == and from looking at those places
should be adequate.

Also while at those files removed unneded duplicate author listing +
expanded copyright/authors with myself where applicable
---
 client/beautifier.py   |  4 ++--
 client/configreader.py |  4 ++--
 fail2ban-client        |  4 ++--
 server/action.py       | 12 +++---------
 server/datedetector.py | 13 ++-----------
 server/datetemplate.py |  2 +-
 server/failregex.py    |  8 +-------
 server/filter.py       | 18 ++++++------------
 server/mytime.py       | 12 +++---------
 server/server.py       |  2 +-
 10 files changed, 23 insertions(+), 56 deletions(-)

diff --git a/client/beautifier.py b/client/beautifier.py
index 7e48016c..8e690656 100644
--- a/client/beautifier.py
+++ b/client/beautifier.py
@@ -56,10 +56,10 @@ class Beautifier:
 				msg = "Jail started"
 			elif inC[0] == "stop":
 				if len(inC) == 1:
-					if response == None:
+					if response is None:
 						msg = "Shutdown successful"
 				else:
-					if response == None:
+					if response is None:
 						msg = "Jail stopped"
 			elif inC[0] == "add":
 				msg = "Added jail " + response
diff --git a/client/configreader.py b/client/configreader.py
index 243c843c..e4b5ce07 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -113,7 +113,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 					v = self.getint(sec, option[1])
 				else:
 					v = self.get(sec, option[1])
-				if not pOptions == None and option[1] in pOptions:
+				if not pOptions is None and option[1] in pOptions:
 					continue
 				values[option[1]] = v
 			except NoSectionError, e:
@@ -121,7 +121,7 @@ class ConfigReader(SafeConfigParserWithIncludes):
 				logSys.error(e)
 				values[option[1]] = option[2]
 			except NoOptionError:
-				if not option[2] == None:
+				if not option[2] is None:
 					logSys.warn("'%s' not defined in '%s'. Using default one: %r"
 								% (option[1], sec, option[2]))
 					values[option[1]] = option[2]
diff --git a/fail2ban-client b/fail2ban-client
index d8147f02..de8519f4 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -350,9 +350,9 @@ class Fail2banClient:
 		# Set socket path
 		self.__configurator.readEarly()
 		conf = self.__configurator.getEarlyOptions()
-		if self.__conf["socket"] == None:
+		if self.__conf["socket"] is None:
 			self.__conf["socket"] = conf["socket"]
-		if self.__conf["pidfile"] == None:
+		if self.__conf["pidfile"] is None:
 			self.__conf["pidfile"] = conf["pidfile"]
 		logSys.info("Using socket file " + self.__conf["socket"])
 
diff --git a/server/action.py b/server/action.py
index ce9651e8..ca2cd332 100644
--- a/server/action.py
+++ b/server/action.py
@@ -17,14 +17,8 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier and Fail2Ban Contributors"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
 import logging, os
@@ -304,7 +298,7 @@ class Action:
 				return False
 
 		# Replace tags
-		if not aInfo == None:
+		if not aInfo is None:
 			realCmd = Action.replaceTag(cmd, aInfo)
 		else:
 			realCmd = cmd
diff --git a/server/datedetector.py b/server/datedetector.py
index a54e072d..65ee7abf 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -17,13 +17,7 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
+__author__ = "Cyril Jaquier and Fail2Ban Contributors"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -197,10 +191,7 @@ class DateDetector:
 
 	def getUnixTime(self, line):
 		date = self.getTime(line)
-		if date == None:
-			return None
-		else:
-			return time.mktime(date)
+		return date and time.mktime(date)
 
 	##
 	# Sort the template lists using the hits score. This method is not called
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 51b8bb1e..6d7a9f23 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -65,7 +65,7 @@ class DateTemplate:
 	
 	def matchDate(self, line):
 		dateMatch = self.__cRegex.search(line)
-		if not dateMatch == None:
+		if not dateMatch is None:
 			self.__hits += 1
 		return dateMatch
 	
diff --git a/server/failregex.py b/server/failregex.py
index b194d472..957c77db 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -17,13 +17,7 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -125,7 +119,7 @@ class FailRegex(Regex):
 	
 	def getHost(self):
 		host = self._matchCache.group("host")
-		if host == None:
+		if host is None:
 			# Gets a few information.
 			s = self._matchCache.string
 			r = self._matchCache.re
diff --git a/server/filter.py b/server/filter.py
index 88a5d861..754a2a08 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -17,14 +17,8 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-#
-# $Revision$
-
-__author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
+__author__ = "Cyril Jaquier and Fail2Ban Contributors"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
 from failmanager import FailManagerEmpty
@@ -360,7 +354,7 @@ class Filter(JailThread):
 			if failRegex.hasMatched():
 				# The failregex matched.
 				date = self.dateDetector.getUnixTime(timeLine)
-				if date == None:
+				if date is None:
 					logSys.debug("Found a match for %r but no valid date/time "
 								 "found for %r. Please file a detailed issue on"
 								 " https://github.com/fail2ban/fail2ban/issues "
@@ -473,7 +467,7 @@ class FileFilter(Filter):
 
 	def getFailures(self, filename):
 		container = self.getFileContainer(filename)
-		if container == None:
+		if container is None:
 			logSys.error("Unable to get failures in " + filename)
 			return False
 		# Try to open log file.
@@ -570,12 +564,12 @@ class FileContainer:
 		self.__handler.seek(self.__pos)
 
 	def readline(self):
-		if self.__handler == None:
+		if self.__handler is None:
 			return ""
 		return self.__handler.readline()
 
 	def close(self):
-		if not self.__handler == None:
+		if not self.__handler is None:
 			# Saves the last position.
 			self.__pos = self.__handler.tell()
 			# Closes the file.
diff --git a/server/mytime.py b/server/mytime.py
index 286f3d2c..8ae85184 100644
--- a/server/mytime.py
+++ b/server/mytime.py
@@ -17,13 +17,7 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# 
-# $Revision$
-
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -61,7 +55,7 @@ class MyTime:
 	
 	#@staticmethod
 	def time():
-		if MyTime.myTime == None:
+		if MyTime.myTime is None:
 			return time.time()
 		else:
 			return MyTime.myTime
@@ -74,14 +68,14 @@ class MyTime:
 	
 	#@staticmethod
 	def gmtime():
-		if MyTime.myTime == None:
+		if MyTime.myTime is None:
 			return time.gmtime()
 		else:
 			return time.gmtime(MyTime.myTime)
 	gmtime = staticmethod(gmtime)
 
 	def localtime(x=None):
-		if MyTime.myTime == None or x is not None:
+		if MyTime.myTime is None or x is not None:
 			return time.localtime(x)
 		else:
 			return time.localtime(MyTime.myTime)
diff --git a/server/server.py b/server/server.py
index 5f1a52c1..d46ab9b3 100644
--- a/server/server.py
+++ b/server/server.py
@@ -388,7 +388,7 @@ class Server:
 			hdlr.setFormatter(formatter)
 			logging.getLogger("fail2ban").addHandler(hdlr)
 			# Does not display this message at startup.
-			if not self.__logTarget == None:
+			if not self.__logTarget is None:
 				logSys.info("Changed logging target to %s for Fail2ban v%s" %
 						(target, version.version))
 			# Sets the logging target.

From 8b7b213e3d71bd7e651566b86e042d91ed126179 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 3 May 2013 00:12:51 -0400
Subject: [PATCH 224/544] Forgotten Changelog entry for "is None" changes

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index f4191431..cf6a1c1e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -87,6 +87,7 @@ Borreli, blotus:
      Closes gh-126. Bug report by Michael Heuberger.
    * [40c5a2d] adding more of diagnostic messages into -client while starting
      the daemon.
+   * [8e63d4c] Compare against None with 'is' instead of '=='.
   Daniel Black
    * [3aeb1a9] Add jail.conf manual page. Closes gh-143.
    * [MANY] man page edits.

From 24a8d07c20da396dac0cc2f26f0ab4a14c236cef Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Sun, 28 Apr 2013 10:44:31 +0200
Subject: [PATCH 225/544] added new date format support for ASSP SMTP Proxy

---
 ChangeLog                         |  6 ++++--
 THANKS                            |  1 +
 TODO                              |  2 ++
 config/filter.d/assp.conf         | 33 +++++++++++++++++++++++++++++++
 config/jail.conf                  |  7 +++++++
 server/datedetector.py            |  7 ++++++-
 server/datetemplate.py            | 12 +++++++++++
 testcases/datedetectortestcase.py |  1 +
 testcases/files/logs/assp         | 13 ++++++++++++
 9 files changed, 79 insertions(+), 3 deletions(-)
 create mode 100644 config/filter.d/assp.conf
 create mode 100644 testcases/files/logs/assp

diff --git a/ChangeLog b/ChangeLog
index fde414f4..0224431f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,10 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.9)                                              2013/04/XX
+Fail2Ban (version 0.8.9)                                              2013/04/28
 ================================================================================
 
-ver. 0.8.9 (2013/04/XXX) - wanna-be-stable
+ver. 0.8.9 (2013/04/28) - wanna-be-stable
 ----------
 
 Although primarily a bugfix release, it incorporates many new
@@ -68,6 +68,8 @@ Borreli, blotus:
   Soulard Morgan
    * [f336d9f] Add filter for webmin. Closes gh-99.
 - Enhancements:
+  Enrico Labedzki
+   * [???????] Added Datew format for ASSP SMTP Proxy.
   Steven Hiscocks
    * [3d6791f] Ensure restart of Actions after a check fails occurs
      consistently. Closes gh-172.
diff --git a/THANKS b/THANKS
index f207d71e..9545d43a 100644
--- a/THANKS
+++ b/THANKS
@@ -16,6 +16,7 @@ Daniel B. Cid
 Daniel Black
 David Nutter
 Eric Gerbier
+Enrico Labedzki
 Guillaume Delvit
 Hanno 'Rince' Wagner
 Iain Lea
diff --git a/TODO b/TODO
index 61bdc093..33263d3e 100644
--- a/TODO
+++ b/TODO
@@ -13,6 +13,8 @@ Legend:
 # partially done
 * done
 
+- more detailed explaination in DEVELOP for new developers (eg. howto build this HEX numbers in ChangeLog)
+
 - Run tests though all filters/examples files - (see sshd example file) as unit
   test
 
diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf
new file mode 100644
index 00000000..055fb9fe
--- /dev/null
+++ b/config/filter.d/assp.conf
@@ -0,0 +1,33 @@
+# Fail2Ban configuration file
+# for Anti-Spam SMTP Proxy Server also known as ASSP
+#    Honmepage:   http://www.magicvillage.de/~Fritz_Borgstedt/assp/0003D91C-8000001C/
+#    ProjektSite: http://sourceforge.net/projects/assp/?source=directory
+#
+# Author: Enrico Labedzki (enrico.labedzki@deiwos.de)
+#
+
+[Definition] 
+
+# Option:  failregex
+# Notes.:  regex to match the SMTP failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>\S+)
+# Values:  TEXT
+#
+# Examples: Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
+#           Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+#           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
+__assp_actions = (dropping|refusing)
+
+failregex = <HOST> max sender authentication errors \(\d+\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: [a-zA-Z0-9]+;$
+			<HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
+			Blocking <HOST> - too much AUTH errors \(\d+\);$
+
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
+
diff --git a/config/jail.conf b/config/jail.conf
index 7569cd2f..86425b9c 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -89,6 +89,13 @@ action   = iptables[name=sasl, port=smtp, protocol=tcp]
            sendmail-whois[name=sasl, dest=you@example.com]
 logpath  = /var/log/mail.log
 
+# ASSP SMTP Proxy Jail
+[assp]
+enabled  = false
+port     = 25,465,587
+filter   = assp
+logpath  = /root/path/to/assp/logs/maillog.txt
+
 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
 # used to avoid banning the user "myuser".
 
diff --git a/server/datedetector.py b/server/datedetector.py
index a54e072d..8ebdc949 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -29,7 +29,7 @@ __license__ = "GPL"
 
 import time, logging
 
-from datetemplate import DateStrptime, DateTai64n, DateEpoch, DateISO8601
+from datetemplate import DateStrptime, DateTai64n, DateEpoch, DateISO8601, DateASSPlike
 from threading import Lock
 
 # Gets the instance of the logger.
@@ -161,6 +161,11 @@ class DateDetector:
 			template.setRegex("^\d{2}\d{2}\d{2} +\d{1,2}:\d{2}:\d{2}")
 			template.setPattern("%y%m%d %H:%M:%S")
 			self._appendTemplate(template)
+			# ASSP: Apr-27-13 02:33:06
+			template = DateASSPlike()
+			template.setName("ASSP like date format")
+			template.setRegex("^[a-zA-Z]{3}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+			self._appendTemplate(template)
 		finally:
 			self.__lock.release()
 	
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 51b8bb1e..55f6d7e4 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -218,3 +218,15 @@ class DateISO8601(DateTemplate):
 			value = dateMatch.group()
 			date = list(iso8601.parse_date(value).timetuple())
 		return date
+
+
+class DateASSPlike(DateTemplate):
+
+	def __init__(self):
+		DateTemplate.__init__(self)
+
+	def getDate(self, line):
+		# there is no need to parse the date.
+		# ASSP doesn't buffer the log output.
+		return MyTime.gmtime()
+
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 7c3c7140..3bf7bf0f 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -85,6 +85,7 @@ class DateDetectorTest(unittest.TestCase):
 			"2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ
 			"<01/23/05@21:59:59>",
 			"050123 21:59:59", # MySQL
+			"Apr-27-13 01:27:45", # ASSP like
 			):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude
diff --git a/testcases/files/logs/assp b/testcases/files/logs/assp
new file mode 100644
index 00000000..99363001
--- /dev/null
+++ b/testcases/files/logs/assp
@@ -0,0 +1,13 @@
+Apr-07-13 07:08:36 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+Apr-07-13 07:08:36 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+Apr-07-13 07:10:37 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+Apr-07-13 07:12:37 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+Apr-07-13 07:14:36 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+Apr-27-13 02:25:09 Blocking 217.194.197.97 - too much AUTH errors (8);
+Apr-27-13 02:25:09 Blocking 217.194.197.97 - too much AUTH errors (9);
+Apr-27-13 02:25:09 Blocking 217.194.197.97 - too much AUTH errors (10);
+Apr-27-13 02:25:10 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+Apr-27-13 02:25:10 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+Apr-27-13 02:25:10 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+Apr-27-13 02:25:11 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+

From ba8f012637b2b6d6ddb211d379dffc4834ff0152 Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Sun, 28 Apr 2013 22:18:55 +0200
Subject: [PATCH 226/544] fixed little things

---
 ChangeLog              |  6 +++---
 server/datedetector.py |  1 +
 server/datetemplate.py | 15 ++++++++++++---
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 0224431f..47f213bd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,10 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.9)                                              2013/04/28
+Fail2Ban (version 0.8.9)                                              2013/04/XX
 ================================================================================
 
-ver. 0.8.9 (2013/04/28) - wanna-be-stable
+ver. 0.8.9 (2013/04/XX) - wanna-be-stable
 ----------
 
 Although primarily a bugfix release, it incorporates many new
@@ -69,7 +69,7 @@ Borreli, blotus:
    * [f336d9f] Add filter for webmin. Closes gh-99.
 - Enhancements:
   Enrico Labedzki
-   * [???????] Added Datew format for ASSP SMTP Proxy.
+   * [1524b07] Added Datew format for ASSP SMTP Proxy.
   Steven Hiscocks
    * [3d6791f] Ensure restart of Actions after a check fails occurs
      consistently. Closes gh-172.
diff --git a/server/datedetector.py b/server/datedetector.py
index 8ebdc949..33270105 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -165,6 +165,7 @@ class DateDetector:
 			template = DateASSPlike()
 			template.setName("ASSP like date format")
 			template.setRegex("^[a-zA-Z]{3}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%b-%d-%y %H:%M:%S")
 			self._appendTemplate(template)
 		finally:
 			self.__lock.release()
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 55f6d7e4..dccd6419 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -224,9 +224,18 @@ class DateASSPlike(DateTemplate):
 
 	def __init__(self):
 		DateTemplate.__init__(self)
+		self.__pattern = ""
+
+	def setPattern(self, pattern):
+		self.__pattern = pattern.strip()
+
+	def getPattern(self):
+		return self.__pattern
 
 	def getDate(self, line):
-		# there is no need to parse the date.
-		# ASSP doesn't buffer the log output.
-		return MyTime.gmtime()
+		date = None
+		dateMatch = self.matchDate(line)
+		if dateMatch:
+			date = list(time.strptime(dateMatch.group(), self.getPattern()))
+		return date
 

From 9185c070ebdf8d0c20a8ec0868c0092ce0996338 Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Wed, 1 May 2013 02:25:05 +0200
Subject: [PATCH 227/544] changed from DateASSPlike class to DateStrptime

---
 server/datedetector.py |  6 +++---
 server/datetemplate.py | 19 -------------------
 2 files changed, 3 insertions(+), 22 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 33270105..8ece81fb 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -29,7 +29,7 @@ __license__ = "GPL"
 
 import time, logging
 
-from datetemplate import DateStrptime, DateTai64n, DateEpoch, DateISO8601, DateASSPlike
+from datetemplate import DateStrptime, DateTai64n, DateEpoch, DateISO8601
 from threading import Lock
 
 # Gets the instance of the logger.
@@ -162,8 +162,8 @@ class DateDetector:
 			template.setPattern("%y%m%d %H:%M:%S")
 			self._appendTemplate(template)
 			# ASSP: Apr-27-13 02:33:06
-			template = DateASSPlike()
-			template.setName("ASSP like date format")
+			template = DateStrptime()
+			template.setName("Month-Day-Year Hour:Minute:Second")
 			template.setRegex("^[a-zA-Z]{3}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%b-%d-%y %H:%M:%S")
 			self._appendTemplate(template)
diff --git a/server/datetemplate.py b/server/datetemplate.py
index dccd6419..01492755 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -220,22 +220,3 @@ class DateISO8601(DateTemplate):
 		return date
 
 
-class DateASSPlike(DateTemplate):
-
-	def __init__(self):
-		DateTemplate.__init__(self)
-		self.__pattern = ""
-
-	def setPattern(self, pattern):
-		self.__pattern = pattern.strip()
-
-	def getPattern(self):
-		return self.__pattern
-
-	def getDate(self, line):
-		date = None
-		dateMatch = self.matchDate(line)
-		if dateMatch:
-			date = list(time.strptime(dateMatch.group(), self.getPattern()))
-		return date
-

From 07aee8cd335f56b43f65188815fd98d94254c4fa Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Wed, 1 May 2013 02:35:46 +0200
Subject: [PATCH 228/544] as daniel desires

---
 config/jail.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/jail.conf b/config/jail.conf
index 86425b9c..8b82d1d7 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -92,8 +92,8 @@ logpath  = /var/log/mail.log
 # ASSP SMTP Proxy Jail
 [assp]
 enabled  = false
-port     = 25,465,587
 filter   = assp
+action = iptables-multiport[name=assp,port="25,465,587"]
 logpath  = /root/path/to/assp/logs/maillog.txt
 
 # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is

From e27385e87304951478d3b3c88dafc1a7a593f838 Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Wed, 1 May 2013 03:42:13 +0200
Subject: [PATCH 229/544] as yaroslav wishes

---
 server/datetemplate.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/server/datetemplate.py b/server/datetemplate.py
index 01492755..d404cf68 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -219,4 +219,3 @@ class DateISO8601(DateTemplate):
 			date = list(iso8601.parse_date(value).timetuple())
 		return date
 
-

From 36b0d78ff88aa9d4558fd24d9ea1859d8063c3e7 Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Wed, 1 May 2013 04:51:56 +0200
Subject: [PATCH 230/544] tight control of the filter for ASSP

---
 config/filter.d/assp.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf
index 055fb9fe..b1bfc082 100644
--- a/config/filter.d/assp.conf
+++ b/config/filter.d/assp.conf
@@ -20,9 +20,9 @@
 #           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
 __assp_actions = (dropping|refusing)
 
-failregex = <HOST> max sender authentication errors \(\d+\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: [a-zA-Z0-9]+;$
+failregex = <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: [a-zA-Z0-9]+;$
 			<HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
-			Blocking <HOST> - too much AUTH errors \(\d+\);$
+			Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
 
 
 # Option:  ignoreregex

From fd01649a61065b41abc8490a4c04074e36ee7c13 Mon Sep 17 00:00:00 2001
From: Enrico Labedzki <enrico.labedzki@deiwos.de>
Date: Thu, 2 May 2013 06:19:39 +0200
Subject: [PATCH 231/544] fixed test date thx to steven

---
 testcases/datedetectortestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 3bf7bf0f..a3d90f22 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -85,7 +85,7 @@ class DateDetectorTest(unittest.TestCase):
 			"2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ
 			"<01/23/05@21:59:59>",
 			"050123 21:59:59", # MySQL
-			"Apr-27-13 01:27:45", # ASSP like
+			"Jan-23-05 21:59:59", # ASSP like
 			):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude

From 617fe6cb02d387c9eabe22267794c4eb7b3147f9 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 3 May 2013 01:03:53 -0400
Subject: [PATCH 232/544] Slight tune up of changelog entry (treeish change due
 to squashing)

---
 ChangeLog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index f19130c4..c80e3b3c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -73,7 +73,7 @@ Borreli, blotus:
    * [f336d9f] Add filter for webmin. Closes gh-99.
 - Enhancements:
   Enrico Labedzki
-   * [1524b07] Added Datew format for ASSP SMTP Proxy.
+   * [24a8d07] Added new date format for ASSP SMTP Proxy.
   Steven Hiscocks
    * [3d6791f] Ensure restart of Actions after a check fails occurs
      consistently. Closes gh-172.

From 495f2dd877d0f1db6260af46a1e162dbea956cf6 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:03:38 +1000
Subject: [PATCH 233/544] DOC: purge of svn tags

---
 client/__init__.py                           | 1 -
 client/actionreader.py                       | 1 -
 client/configparserinc.py                    | 1 -
 client/configreader.py                       | 1 -
 client/configurator.py                       | 1 -
 client/csocket.py                            | 1 -
 client/fail2banreader.py                     | 1 -
 client/filterreader.py                       | 1 -
 client/jailreader.py                         | 1 -
 client/jailsreader.py                        | 1 -
 common/__init__.py                           | 1 -
 common/helpers.py                            | 1 -
 common/protocol.py                           | 1 -
 common/version.py                            | 1 -
 config/action.d/dshield.conf                 | 1 -
 config/action.d/dummy.conf                   | 1 -
 config/action.d/hostsdeny.conf               | 1 -
 config/action.d/ipfw.conf                    | 1 -
 config/action.d/iptables-allports.conf       | 1 -
 config/action.d/iptables-multiport-log.conf  | 1 -
 config/action.d/iptables-multiport.conf      | 1 -
 config/action.d/iptables-new.conf            | 1 -
 config/action.d/iptables-xt_recent-echo.conf | 1 -
 config/action.d/iptables.conf                | 1 -
 config/action.d/mail-buffered.conf           | 1 -
 config/action.d/mail-whois-lines.conf        | 1 -
 config/action.d/mail-whois.conf              | 1 -
 config/action.d/mail.conf                    | 1 -
 config/action.d/mynetwatchman.conf           | 1 -
 config/action.d/sendmail-buffered.conf       | 1 -
 config/action.d/sendmail-whois-lines.conf    | 1 -
 config/action.d/sendmail-whois.conf          | 1 -
 config/action.d/sendmail.conf                | 1 -
 config/action.d/shorewall.conf               | 1 -
 config/filter.d/apache-auth.conf             | 1 -
 config/filter.d/apache-badbots.conf          | 1 -
 config/filter.d/apache-nohome.conf           | 1 -
 config/filter.d/apache-noscript.conf         | 1 -
 config/filter.d/apache-overflows.conf        | 1 -
 config/filter.d/asterisk.conf                | 1 -
 config/filter.d/common.conf                  | 1 -
 config/filter.d/courierlogin.conf            | 1 -
 config/filter.d/couriersmtp.conf             | 1 -
 config/filter.d/cyrus-imap.conf              | 1 -
 config/filter.d/dovecot.conf                 | 1 -
 config/filter.d/dropbear.conf                | 1 -
 config/filter.d/exim.conf                    | 1 -
 config/filter.d/gssftpd.conf                 | 1 -
 config/filter.d/named-refused.conf           | 1 -
 config/filter.d/pam-generic.conf             | 1 -
 config/filter.d/postfix.conf                 | 1 -
 config/filter.d/proftpd.conf                 | 1 -
 config/filter.d/pure-ftpd.conf               | 1 -
 config/filter.d/qmail.conf                   | 1 -
 config/filter.d/sasl.conf                    | 1 -
 config/filter.d/sieve.conf                   | 1 -
 config/filter.d/sshd.conf                    | 1 -
 config/filter.d/vsftpd.conf                  | 1 -
 config/filter.d/webmin-auth.conf             | 1 -
 config/filter.d/wuftpd.conf                  | 1 -
 config/filter.d/xinetd-fail.conf             | 1 -
 files/cacti/fail2ban_stats.sh                | 1 -
 files/gentoo-initd                           | 1 -
 server/__init__.py                           | 3 ---
 server/actions.py                            | 3 ---
 server/asyncserver.py                        | 3 ---
 server/banmanager.py                         | 3 ---
 server/datetemplate.py                       | 3 ---
 server/faildata.py                           | 3 ---
 server/failmanager.py                        | 3 ---
 server/filterpoll.py                         | 2 --
 server/jailthread.py                         | 3 ---
 server/server.py                             | 3 ---
 server/ticket.py                             | 3 ---
 server/transmitter.py                        | 3 ---
 testcases/__init__.py                        | 1 -
 testcases/actiontestcase.py                  | 1 -
 testcases/banmanagertestcase.py              | 1 -
 testcases/datedetectortestcase.py            | 1 -
 testcases/failmanagertestcase.py             | 1 -
 testcases/servertestcase.py                  | 1 -
 testcases/sockettestcase.py                  | 1 -
 82 files changed, 105 deletions(-)

diff --git a/client/__init__.py b/client/__init__.py
index c448827b..3de9058c 100644
--- a/client/__init__.py
+++ b/client/__init__.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/actionreader.py b/client/actionreader.py
index 9ad1ef28..c1a64245 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/configparserinc.py b/client/configparserinc.py
index 7ac8b4a5..df5af1ac 100644
--- a/client/configparserinc.py
+++ b/client/configparserinc.py
@@ -19,7 +19,6 @@
 
 # Author: Yaroslav Halchenko
 # Modified: Cyril Jaquier
-# $Revision$
 
 __author__ = 'Yaroslav Halhenko'
 __revision__ = '$Revision$'
diff --git a/client/configreader.py b/client/configreader.py
index 4b4a391b..9fb6b3eb 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/configurator.py b/client/configurator.py
index 2097fd54..fc588558 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/csocket.py b/client/csocket.py
index 6e014e23..c6f318f2 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index c8f42976..026076fa 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/filterreader.py b/client/filterreader.py
index 7dba3579..b8c47558 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/jailreader.py b/client/jailreader.py
index ad69bfa0..d6f678ee 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/client/jailsreader.py b/client/jailsreader.py
index 91e178d6..f87794dd 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/common/__init__.py b/common/__init__.py
index c448827b..3de9058c 100644
--- a/common/__init__.py
+++ b/common/__init__.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/common/helpers.py b/common/helpers.py
index 6115b971..3c830138 100644
--- a/common/helpers.py
+++ b/common/helpers.py
@@ -20,7 +20,6 @@
 # Author: Cyril Jaquier
 # Author: Arturo 'Buanzo' Busleiman
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/common/protocol.py b/common/protocol.py
index 1083a94b..ccd44398 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/common/version.py b/common/version.py
index 2a1c0d0b..df3b97c3 100644
--- a/common/version.py
+++ b/common/version.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf
index 151db28f..ca68e638 100644
--- a/config/action.d/dshield.conf
+++ b/config/action.d/dshield.conf
@@ -25,7 +25,6 @@
 # configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
 # configure how often the buffer is flushed).
 #
-# $Revision$
 
 [Definition]
 
diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index ea59881a..20507c0b 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index b04f2adb..f73c6ec4 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
index 62612307..3a56415d 100644
--- a/config/action.d/ipfw.conf
+++ b/config/action.d/ipfw.conf
@@ -3,7 +3,6 @@
 # Author: Nick Munger
 # Modified by: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
index a02ba63d..50f49d82 100644
--- a/config/action.d/iptables-allports.conf
+++ b/config/action.d/iptables-allports.conf
@@ -4,7 +4,6 @@
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 # 			made active on all ports from original iptables.conf
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf
index 49958013..b79983fc 100644
--- a/config/action.d/iptables-multiport-log.conf
+++ b/config/action.d/iptables-multiport-log.conf
@@ -7,7 +7,6 @@
 # make "fail2ban-<name>-log" chain to log and drop
 # insert a jump to fail2ban-<name> from -I <chain> if proto/port match
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf
index ab0ee8de..f799289f 100644
--- a/config/action.d/iptables-multiport.conf
+++ b/config/action.d/iptables-multiport.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 # Modified by Yaroslav Halchenko for multiport banning
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf
index 12f398c7..f22916e1 100644
--- a/config/action.d/iptables-new.conf
+++ b/config/action.d/iptables-new.conf
@@ -4,7 +4,6 @@
 # Copied from iptables.conf and modified by Yaroslav Halchenko 
 #  to fullfill the needs of bugreporter dbts#350746.
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf
index 887311be..4fb397a2 100644
--- a/config/action.d/iptables-xt_recent-echo.conf
+++ b/config/action.d/iptables-xt_recent-echo.conf
@@ -2,7 +2,6 @@
 #
 # Author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
 #
-# $Revision: 1 $
 #
 
 [Definition]
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index a3412f6b..662b41c0 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index 94a60e3b..7ff17cf2 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
index 2120432e..d30e266d 100644
--- a/config/action.d/mail-whois-lines.conf
+++ b/config/action.d/mail-whois-lines.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 # Modified-By: Yaroslav Halchenko to include grepping on IP over log files
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index 3293c7a2..f58ae535 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index f9942e10..f9a54979 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/mynetwatchman.conf b/config/action.d/mynetwatchman.conf
index 06f16db6..5245a4e3 100644
--- a/config/action.d/mynetwatchman.conf
+++ b/config/action.d/mynetwatchman.conf
@@ -24,7 +24,6 @@
 # Another useful configuration value is <getcmd>, if you don't have wget
 # installed (an example config for curl is given below)
 #
-# $Revision$
 
 [Definition]
 
diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index ce4479e8..bec1e91c 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index 30cd84b8..bc5074c6 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
index 6b7b9383..0d1fd97e 100644
--- a/config/action.d/sendmail-whois.conf
+++ b/config/action.d/sendmail-whois.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
index db619a87..8054050d 100644
--- a/config/action.d/sendmail.conf
+++ b/config/action.d/sendmail.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index aca3a256..31c1dce5 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 # The default Shorewall configuration is with "BLACKLISTNEWONLY=Yes" (see
 # file /etc/shorewall/shorewall.conf). This means that when Fail2ban adds a
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 962fb2e3..66f6a1d6 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/apache-badbots.conf b/config/filter.d/apache-badbots.conf
index 1c60676d..f9c79472 100644
--- a/config/filter.d/apache-badbots.conf
+++ b/config/filter.d/apache-badbots.conf
@@ -5,7 +5,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/apache-nohome.conf b/config/filter.d/apache-nohome.conf
index b6a00005..6e738c68 100644
--- a/config/filter.d/apache-nohome.conf
+++ b/config/filter.d/apache-nohome.conf
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav O. Halchenko <debian@onerussian.com>
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 4746fbfb..5b48cb32 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/apache-overflows.conf b/config/filter.d/apache-overflows.conf
index 4567f7da..e25b79a4 100644
--- a/config/filter.d/apache-overflows.conf
+++ b/config/filter.d/apache-overflows.conf
@@ -2,7 +2,6 @@
 #
 # Author: Tim Connors
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 73947a67..9ed69804 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -2,7 +2,6 @@
 #
 # Author: Xavier Devlamynck
 #
-# $Revision$
 #
 
 
diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index 18bf41c5..52b644cf 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -3,7 +3,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [INCLUDES]
diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index b8710ac3..20731e5d 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -3,7 +3,6 @@
 # Author: Christoph Haas
 # Modified by: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index f0d696ff..6c0cf5ff 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/cyrus-imap.conf b/config/filter.d/cyrus-imap.conf
index 3a8734ee..758f75de 100644
--- a/config/filter.d/cyrus-imap.conf
+++ b/config/filter.d/cyrus-imap.conf
@@ -2,7 +2,6 @@
 #
 # Author: Jan Wagner <waja@cyconet.org>
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 18451e42..d7fb6e6d 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -2,7 +2,6 @@
 #
 # Author: Martin Waschbuesch
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/dropbear.conf b/config/filter.d/dropbear.conf
index 1309cc41..c822d08c 100644
--- a/config/filter.d/dropbear.conf
+++ b/config/filter.d/dropbear.conf
@@ -3,7 +3,6 @@
 # Author: Francis Russell
 #         Zak B. Elep
 #
-# $Revision$
 #
 # More information: http://bugs.debian.org/546913
 
diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 8bf4fc5f..b846e992 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/gssftpd.conf b/config/filter.d/gssftpd.conf
index 8c166309..e6c2e84a 100644
--- a/config/filter.d/gssftpd.conf
+++ b/config/filter.d/gssftpd.conf
@@ -2,7 +2,6 @@
 #
 # Author: Kevin Zembower (copied from wsftpd.conf)
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index 64f7d685..1cdc626e 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -4,7 +4,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/pam-generic.conf b/config/filter.d/pam-generic.conf
index 702f8ab0..eaeb122f 100644
--- a/config/filter.d/pam-generic.conf
+++ b/config/filter.d/pam-generic.conf
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index d2dc4a0c..f92c3619 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 55a15da9..f28e2d4b 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/pure-ftpd.conf b/config/filter.d/pure-ftpd.conf
index 8066ae00..de46461d 100644
--- a/config/filter.d/pure-ftpd.conf
+++ b/config/filter.d/pure-ftpd.conf
@@ -3,7 +3,6 @@
 # Author: Cyril Jaquier
 # Modified: Yaroslav Halchenko for pure-ftpd
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf
index 4d7acd6f..04feb2b7 100644
--- a/config/filter.d/qmail.conf
+++ b/config/filter.d/qmail.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index 4be847ee..6c4aeba7 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/sieve.conf b/config/filter.d/sieve.conf
index 00e9daf1..866b4228 100644
--- a/config/filter.d/sieve.conf
+++ b/config/filter.d/sieve.conf
@@ -2,7 +2,6 @@
 #
 # Author: Jan Wagner <waja@cyconet.org>
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index b4e645c4..4138a9c4 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [INCLUDES]
diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf
index 4fc25777..259e2c82 100644
--- a/config/filter.d/vsftpd.conf
+++ b/config/filter.d/vsftpd.conf
@@ -2,7 +2,6 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/webmin-auth.conf b/config/filter.d/webmin-auth.conf
index b1df45dc..67f6e73f 100644
--- a/config/filter.d/webmin-auth.conf
+++ b/config/filter.d/webmin-auth.conf
@@ -3,7 +3,6 @@
 # Author: Cyril Jaquier
 # Rule by : Delvit Guillaume
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
index 6f266fb5..3351d258 100644
--- a/config/filter.d/wuftpd.conf
+++ b/config/filter.d/wuftpd.conf
@@ -2,7 +2,6 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/config/filter.d/xinetd-fail.conf b/config/filter.d/xinetd-fail.conf
index e1c1e108..4ff5bfde 100644
--- a/config/filter.d/xinetd-fail.conf
+++ b/config/filter.d/xinetd-fail.conf
@@ -2,7 +2,6 @@
 #
 # Author: Guido Bozzetto
 #
-# $Revision$
 #
 
 [Definition]
diff --git a/files/cacti/fail2ban_stats.sh b/files/cacti/fail2ban_stats.sh
index 4d29854f..2c2e368a 100644
--- a/files/cacti/fail2ban_stats.sh
+++ b/files/cacti/fail2ban_stats.sh
@@ -25,7 +25,6 @@
 #
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 FAIL2BAN="fail2ban-client"
 
diff --git a/files/gentoo-initd b/files/gentoo-initd
index 4f4486ca..b56d4bdb 100755
--- a/files/gentoo-initd
+++ b/files/gentoo-initd
@@ -17,7 +17,6 @@
 #
 # Author: Sireyessire, Cyril Jaquier
 #
-# $Revision$
 
 extra_started_commands="reload showlog"
 
diff --git a/server/__init__.py b/server/__init__.py
index c448827b..2b76f4b6 100644
--- a/server/__init__.py
+++ b/server/__init__.py
@@ -19,10 +19,7 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
diff --git a/server/actions.py b/server/actions.py
index ddcc83d6..4f538b7b 100644
--- a/server/actions.py
+++ b/server/actions.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/asyncserver.py b/server/asyncserver.py
index 35167a6b..87f91633 100644
--- a/server/asyncserver.py
+++ b/server/asyncserver.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/banmanager.py b/server/banmanager.py
index 1143f791..88a01ea2 100644
--- a/server/banmanager.py
+++ b/server/banmanager.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/datetemplate.py b/server/datetemplate.py
index c35e58c2..8c49aa15 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/faildata.py b/server/faildata.py
index 1f0bda04..3d943434 100644
--- a/server/faildata.py
+++ b/server/faildata.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/failmanager.py b/server/failmanager.py
index 02f16ce3..57d7fced 100644
--- a/server/failmanager.py
+++ b/server/failmanager.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/filterpoll.py b/server/filterpoll.py
index f0e23ac1..8a6a88e7 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -21,8 +21,6 @@
 #
 
 __author__ = "Cyril Jaquier, Yaroslav Halchenko"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier; 2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
diff --git a/server/jailthread.py b/server/jailthread.py
index 343ea7e2..11d1a82b 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/server.py b/server/server.py
index d46ab9b3..a8cf1c2f 100644
--- a/server/server.py
+++ b/server/server.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/ticket.py b/server/ticket.py
index c03761c1..8826f26b 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/server/transmitter.py b/server/transmitter.py
index b54fbb93..deaf9adf 100644
--- a/server/transmitter.py
+++ b/server/transmitter.py
@@ -19,11 +19,8 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/__init__.py b/testcases/__init__.py
index c448827b..3de9058c 100644
--- a/testcases/__init__.py
+++ b/testcases/__init__.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index 281cb0b6..73f40549 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
index 6d0ce55a..58651573 100644
--- a/testcases/banmanagertestcase.py
+++ b/testcases/banmanagertestcase.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index a3d90f22..4b38fb12 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index ffee4ff1..de23219c 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 1b6eb8d3..9a285553 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -19,7 +19,6 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision$
 
 __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
diff --git a/testcases/sockettestcase.py b/testcases/sockettestcase.py
index 4cd5a687..cd13c772 100644
--- a/testcases/sockettestcase.py
+++ b/testcases/sockettestcase.py
@@ -19,7 +19,6 @@
 
 # Author: Steven Hiscocks
 # 
-# $Revision$
 
 __author__ = "Steven Hiscocks"
 __version__ = "$Revision$"

From b3bd877d23e578e12791c6db4ca9fd82108d75c3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 30 Apr 2013 07:48:01 +1000
Subject: [PATCH 234/544] BF: change common.conf to handle formats of syslog -v
 and syslog -vv in BSD

---
 config/filter.d/common.conf | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index 18bf41c5..a5fe1176 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -41,7 +41,10 @@ __hostname = \S+
 #
 # Common line prefixes (beginnings) which could be used in filters
 #
-#       [hostname] [vserver tag] daemon_id spaces
-# this can be optional (for instance if we match named native log files)
-__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
-
+#      [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
+# 
+# bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or
+# <auth.info> appearing before the host as per testcases/files/logs/bsd/*.
+#
+# This can be optional (for instance if we match named native log files)
+__prefix_line = \s*(<[^.]+.[^.]+>)?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*

From cde710803367b8529cde6093232ca1151d20ddd7 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Apr 2013 13:47:33 +1000
Subject: [PATCH 235/544] DOC: bsd syslog files thanks to Nick Hilliard

---
 testcases/files/logs/bsd/syslog-plain.txt |  3 +++
 testcases/files/logs/bsd/syslog-v.txt     | 10 ++++++++++
 testcases/files/logs/bsd/syslog-vv.txt    |  5 +++++
 3 files changed, 18 insertions(+)
 create mode 100644 testcases/files/logs/bsd/syslog-plain.txt
 create mode 100644 testcases/files/logs/bsd/syslog-v.txt
 create mode 100644 testcases/files/logs/bsd/syslog-vv.txt

diff --git a/testcases/files/logs/bsd/syslog-plain.txt b/testcases/files/logs/bsd/syslog-plain.txt
new file mode 100644
index 00000000..7dcecb2e
--- /dev/null
+++ b/testcases/files/logs/bsd/syslog-plain.txt
@@ -0,0 +1,3 @@
+Apr  2 17:52:55 pancake sshd[55657]: Invalid user oracle from 192.0.2.100
+Apr  2 17:53:01 pancake sshd[55657]: error: PAM: authentication error for illegal user oracle from test.example.com
+Apr  2 17:53:01 pancake sshd[55657]: Failed keyboard-interactive/pam for invalid user oracle from 192.0.2.100 port 48856 ssh2
diff --git a/testcases/files/logs/bsd/syslog-v.txt b/testcases/files/logs/bsd/syslog-v.txt
new file mode 100644
index 00000000..319582ba
--- /dev/null
+++ b/testcases/files/logs/bsd/syslog-v.txt
@@ -0,0 +1,10 @@
+Apr  2 17:51:27 <4.3> pancake sshd[55624]: error: PAM: authentication error for nick from test.example.com
+Apr  2 17:51:32 <4.6> pancake sshd[55628]: Invalid user r00t from 192.0.2.100
+Apr  2 17:51:33 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com
+Apr  2 17:51:33 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2
+Apr  2 17:51:34 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com
+Apr  2 17:51:34 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2
+Apr  2 17:51:36 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com
+Apr  2 17:51:36 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2
+Apr  2 17:52:06 <4.6> pancake sshd[55647]: Invalid user oracle from 192.0.2.100
+Apr  2 17:52:07 <4.3> pancake sshd[55647]: error: PAM: authentication error for illegal user oracle from test.example.com
diff --git a/testcases/files/logs/bsd/syslog-vv.txt b/testcases/files/logs/bsd/syslog-vv.txt
new file mode 100644
index 00000000..74143226
--- /dev/null
+++ b/testcases/files/logs/bsd/syslog-vv.txt
@@ -0,0 +1,5 @@
+Mar 19 23:48:18 <auth.info> pancake sshd[55517]: Invalid user r00t from 183.60.159.20
+Mar 19 23:48:20 <auth.info> pancake sshd[55519]: Invalid user r00t from 183.60.159.20
+Mar 19 23:50:03 <auth.info> pancake sshd[55604]: Invalid user http from 183.60.159.20
+Mar 19 23:50:05 <auth.info> pancake sshd[55606]: Invalid user kylix from 183.60.159.20
+Mar 19 23:50:08 <auth.info> pancake sshd[55608]: Invalid user nagios from 183.60.159.20

From ebfab512bc7618365ea8eaf64f4039ea709c6f5b Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:15:26 +1000
Subject: [PATCH 236/544] DOC: credits for bsd log

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c80e3b3c..24a88587 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -50,6 +50,8 @@ Borreli, blotus:
      gh-70. Thanks to iGeorgeX for the idea.
   blotus
    * [96eb8986] ' and " should also be escaped in action tags Closes gh-109
+  Christoph Theis, Nick Hilliard, Daniel Black
+   * [b3bd877d,cde71080] Make syslog -v and syslog -vv formats work on FreeBSD
 - New features:
   Yaroslav Halchenko
    * [9ba27353] Add support for jail.d/{confilefile} and fail2ban.d/{configfile}

From 40c56b10a0f91a84377ccecc38ecdfc01cdeafdc Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 30 Apr 2013 23:27:16 +1000
Subject: [PATCH 237/544] EHN: enhance sshd filter for bsd.

---
 config/filter.d/sshd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index b4e645c4..f9d9c050 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -23,7 +23,7 @@ _daemon = sshd
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
             ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
             ^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$

From be725ae5c39ab7dfb7c73e7f112806bb5ef473de Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:19:44 +1000
Subject: [PATCH 238/544] DOC: credits for BSD ssh filter changes

---
 ChangeLog | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index c80e3b3c..b10931be 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -96,7 +96,8 @@ Borreli, blotus:
    * [7cd6dab] Added help command to fail2ban-client.
    * [c8c7b0b,23bbc60] Better logging of log file read errors.
    * [3665e6d] Added code coverage to development process.
-   * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source.
+   * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh
+	   source. Also include BSD changes.
    * [1d9abd1] Action files can have tags in definition that refer to other
      tags.
   Pascal Borreli

From b6d0e8ad9c7b688e8bc4dd375bdc897293a21320 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:31:45 +1000
Subject: [PATCH 239/544] ENH: add ipfw rule for bsd using the tables.

---
 config/action.d/bsd-ipfw.conf | 82 +++++++++++++++++++++++++++++++++++
 config/jail.conf              | 13 ++++++
 2 files changed, 95 insertions(+)
 create mode 100644 config/action.d/bsd-ipfw.conf

diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf
new file mode 100644
index 00000000..33f176e4
--- /dev/null
+++ b/config/action.d/bsd-ipfw.conf
@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Ken Menzel
+#              Daniel Black (start/stop)
+#              Fabian Wenk (many ideas as per fail2ban users list)
+#
+# Ensure firewall_enable="YES" in the top of /etc/rc.conf
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num deny <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop =  [ -f <startstatefile> ] && ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+# requires an ipfw rule like "deny ip from table(1) to me"
+actionban = ipfw table <table> add <ip>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    See jail.conf(5) man page
+# Values:  CMD
+#
+actionunban = ipfw table <table> delete <ip>
+
+[Init]
+# Option:  table
+# Notes:   The ipfw table to use. If a ipfw rule using this table already exists,
+#          this action will not create a ipfw rule to block it and the following
+#          options will have no effect.
+# Values:  NUM
+table = 1
+
+# Option:  port
+# Notes.:  Specifies port to monitor. Blank indicate block all ports.
+# Values:  [ NUM | STRING ]
+#
+port = 
+
+# Option:  startstatefile
+# Notes:   A file to indicate that the table rule that was added. Ensure it is unique per table.
+# Values:  STRING
+startstatefile = /var/run/fail2ban/ipfw-started-table_<table>
+
+# Option:  action
+# Notes:   This is the action to take for automaticly created rules. See the 
+#          ACTION defination at the top of man ipfw for allowed values.
+#          "deny" and "unreach port" are probably the useful.
+# Values:  STRING
+action = deny
+
+# Option: block
+# Notes:  This is how much to block.
+#         Can be "ip", "tcp", "udp" or various other options.
+# Values: STRING
+block = ip
diff --git a/config/jail.conf b/config/jail.conf
index 8b82d1d7..17c4dfe9 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -139,6 +139,19 @@ action   = iptables-ipset-proto6[name=SSH, port=ssh, protocol=tcp, bantime=600]
 logpath  = /var/log/sshd.log
 maxretry = 5
 
+# bsd-ipfw is ipfw used by BSD. It uses ipfw tables.
+# table number must be unique.
+# 
+# This will create a deny rule for that table ONLY if a rule 
+# for the table doesn't ready exist.
+#
+[ssh-bsd-ipfw]
+enabled  = false
+filter   = sshd
+action   = bsd-ipfw[port=ssh,table=1]
+logpath  = /var/log/auth.log
+maxretry = 5
+
 # This jail demonstrates the use of wildcards in "logpath".
 # Moreover, it is possible to give other files on a new line.
 

From f402609f19fcbf2467adbe9d64766fa9107aad30 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:32:11 +1000
Subject: [PATCH 240/544] DOC: credits for bsd-ipfw

---
 ChangeLog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c80e3b3c..35c706cc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -69,6 +69,9 @@ Borreli, blotus:
    * [5f2d383] Add roundcube auth filter. Closes Debian bug #699442.
   Daniel Black
    * [be06b1b] Add action for iptables-ipsets. Closes gh-102.
+  Nick Munger, Ken Menzel, Daniel Black, Christoph Theis & Fabian Wenk
+   * [b6d0e8a] Add and enhance the bsd-ipfw action from
+     FreeBSD ports.
   Soulard Morgan
    * [f336d9f] Add filter for webmin. Closes gh-99.
 - Enhancements:

From 0c5a9c53e1542784b7c1ab2d41463aa464f54104 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 16 Apr 2013 21:11:06 +1000
Subject: [PATCH 241/544] ENH: pf action thanks to Nick Hilliard
 <nick@foobar.org>.

---
 config/action.d/pf.conf | 62 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 config/action.d/pf.conf

diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf
new file mode 100644
index 00000000..d82cbb12
--- /dev/null
+++ b/config/action.d/pf.conf
@@ -0,0 +1,62 @@
+# Fail2Ban configuration file
+#
+# OpenBSD pf ban/unban
+#
+# Author: Nick Hilliard <nick@foobar.org>
+#
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+# we don't enable PF automatically, as it will be enabled elsewhere
+actionstart = 
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+# we don't disable PF automatically either
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = /sbin/pfctl -t <tablename> -T add <ip>/32
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+# note -r option used to remove matching rule
+actionunban = /sbin/pfctl -t <tablename> -T delete <ip>/32
+
+[Init]
+# Option:  tablename
+# Notes.:  The pf table name.
+# Values:  [ STRING ]  Default: fail2ban
+#
+tablename = fail2ban
+

From 462dafa32f4766c0d6e8e9267adda776c9b11e9c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:38:30 +1000
Subject: [PATCH 242/544] DOC: credit for pf action. Origin:
 http://svnweb.freebsd.org/ports/head/security/py-fail2ban/files/patch-pf.conf?view=log

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c80e3b3c..00898141 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -71,6 +71,8 @@ Borreli, blotus:
    * [be06b1b] Add action for iptables-ipsets. Closes gh-102.
   Soulard Morgan
    * [f336d9f] Add filter for webmin. Closes gh-99.
+  Nick Hilliard
+   * [0c5a9c5] Add pf action.
 - Enhancements:
   Enrico Labedzki
    * [24a8d07] Added new date format for ASSP SMTP Proxy.

From aa52743f52014ae57bc705c77a33a8157df40338 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:42:10 +1000
Subject: [PATCH 243/544] DOC: add jail.conf entry for pf

---
 config/jail.conf | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 8b82d1d7..1549e6a4 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -380,3 +380,14 @@ action   = iptables-allports[name=recidive]
 bantime  = 604800  ; 1 week
 findtime = 86400   ; 1 day
 maxretry = 5
+
+# PF is a BSD based firewall
+[ssh-pf]
+
+enabled=false
+filter = sshd
+action = pf
+logpath  = /var/log/sshd.log
+maxretry=5
+
+

From 28f5d7b980a7f256b9e8640a5eca471e658c136c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 1 May 2013 00:15:46 +1000
Subject: [PATCH 244/544] ENH: opensuse script from opensuse:
 https://build.opensuse.org/package/view_file?expand=1&file=fail2ban.init&package=fail2ban&project=openSUSE%3AFactory

---
 files/suse-initd | 181 +++++++++++++++++++++++++----------------------
 1 file changed, 96 insertions(+), 85 deletions(-)
 mode change 100755 => 100644 files/suse-initd

diff --git a/files/suse-initd b/files/suse-initd
old mode 100755
new mode 100644
index 1dec63e2..b53fa540
--- a/files/suse-initd
+++ b/files/suse-initd
@@ -1,103 +1,114 @@
 #!/bin/sh
 #
-# /etc/init.d/fail2ban
-#   and its symbolic link
-# /usr/sbin/rcfail2ban
-#
 ### BEGIN INIT INFO
 # Provides:          fail2ban
-# Required-Start:    $syslog $remote_fs sendmail
-# Required-Stop:     $syslog $remote_fs
-# Should-Stop: $time ypbind sendmail
+# Required-Start:    $syslog $remote_fs $local_fs
+# Should-Start:      $time $network iptables
+# Required-Stop:     $syslog $remote_fs $local_fs
+# Should-Stop:       $time $network iptables
 # Default-Start:     3 5
 # Default-Stop:      0 1 2 6
-# Description:       startup Fail2Ban
+# Pidfile:           /var/run/fail2ban/fail2ban.pid
+# Short-Description: Bans IPs with too many authentication failures
+# Description:       Start fail2ban to scan logfiles and ban IP addresses
+#      which make too many logfiles failures, and/or sent e-mails about
 ### END INIT INFO
-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/sbin:/usr/bin:/bin
-FAIL2BAN_BIN=/usr/local/bin/fail2ban-client
-FAIL2BAN_SERVER=/usr/local/bin/fail2ban-server
-FAIL2BAN_SOCKET=/var/run/fail2ban/fail2ban.sock
-test -x $FAIL2BAN_BIN || { echo "$FAIL2BAN_BIN not installed";
-        if [ "$1" = "stop" ]; then exit 0;
-        else exit 5; fi; }
 
-# Check for existence of needed config file and read it
-FAIL2BAN_CONFIG=/etc/fail2ban/fail2ban.conf
-test -r $FAIL2BAN_CONFIG || { echo "$FAIL2BAN_CONFIG not existing";
-        if [ "$1" = "stop" ]; then exit 0;
-        else exit 6; fi; }
+# Check for missing binaries (stale symlinks should not happen)
+FAIL2BAN_CLI=/usr/bin/fail2ban-client
+test -x $FAIL2BAN_CLI || { echo "$FAIL2BAN_CLI not installed";
+	if [ "$1" = "stop" ]; then exit 0;
+	else exit 5; fi; }
+FAIL2BAN_SRV=/usr/bin/fail2ban-server
+test -x $FAIL2BAN_SRV || { echo "$FAIL2BAN_SRV not installed";
+	if [ "$1" = "stop" ]; then exit 0;
+	else exit 5; fi; }
+
+FAIL2BAN_CONFIG="/etc/sysconfig/fail2ban"
+FAIL2BAN_SOCKET_DIR="/var/run/fail2ban"
+FAIL2BAN_SOCKET="$FAIL2BAN_SOCKET_DIR/fail2ban.sock"
+FAIL2BAN_PID="$FAIL2BAN_SOCKET_DIR/fail2ban.pid"
+
+if [ -e $FAIL2BAN_CONFIG ]; then
+	. $FAIL2BAN_CONFIG
+fi
 
 . /etc/rc.status
-
-# Reset status of this service
 rc_reset
 
 case "$1" in
     start)
-        echo -n "Starting Fail2Ban "
-        # a cleanup workaround, since /etc/init.d/boot.local removes only. 
-        # regular files, and not sockets 
-        if test -e $FAIL2BAN_SOCKET; then
-            if ! lsof -n $FAIL2BAN_SOCKET &>/dev/null; then
-                rm $FAIL2BAN_SOCKET
-            fi
-        fi
-        /sbin/startproc $FAIL2BAN_BIN start &>/dev/null
-        rc_status -v
-        ;;
-    stop)
-        echo -n "Shutting down Fail2ban "
-        /sbin/startproc $FAIL2BAN_BIN -q stop
-        rc_status -v
-        ;;
-    try-restart|condrestart)
-        if test "$1" = "condrestart"; then
-                echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
-        fi
-        $0 status
-        if test $? = 0; then
-                $0 restart
-        else
-                rc_reset        # Not running is not a failure.
-        fi
-        rc_status
-        ;;
-    restart)
-        $0 stop
-        echo -n "-wait a minute "
-        i=60
-        while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do
-                sleep 1
-                i=$[$i-1]
-                echo -n "."
-        done
-        echo "."
-        $0 start
+	echo -n "Starting fail2ban "
 
-        # Remember status and be quiet
-        rc_status
-        ;;
-    force-reload)
-        echo -n "Reload service Fail2ban "
-        /sbin/startproc $FAIL2BAN_BIN -q reload
-        rc_status -v
-        ;;
-    reload)
-        echo -n "Reload service Fail2ban "
-        /sbin/startproc $FAIL2BAN_BIN -q reload
-        rc_status -v
-        ;;
+	if [ ! -d $FAIL2BAN_SOCKET_DIR ]; then
+		mkdir -p $FAIL2BAN_SOCKET_DIR
+	fi
+
+	if [ -e $FAIL2BAN_SOCKET ]; then
+		if ! lsof -n $FAIL2BAN_SOCKET &>/dev/null; then
+			rm $FAIL2BAN_SOCKET
+		fi
+	fi
+	$FAIL2BAN_CLI -x -q $FAIL2BAN_OPTIONS start &>/dev/null 2>&1
+
+	rc_status -v
+	;;
+    stop)
+	echo -n "Shutting down fail2ban "
+	## Stop daemon with built-in functionality 'stop'
+	/sbin/startproc -w $FAIL2BAN_CLI -q stop > /dev/null 2>&1
+
+	if [ -f $FAIL2BAN_SOCKET ]
+         then
+         echo "$FAIL2BAN_SOCKET  not removed .. removing .." 
+         rm $FAIL2BAN_SOCKET
+        fi
+        if [ -f $FAIL2BAN_PID ]
+         then
+         echo "$FAIL2BAN_PID  not removed .. removing .." 
+         rm $FAIL2BAN_PID
+        fi
+
+
+	rc_status -v
+	;;
+    try-restart|condrestart)
+	$0 status
+	if test $? = 0; then
+		$0 restart
+	else
+		rc_reset	# Not running is not a failure.
+	fi
+	rc_status
+	;;
+    restart)
+	$0 stop
+	i=60
+	while [ -e $FAIL2BAN_SOCKET ] && [ $i -gt 0 ]; do
+		sleep 1
+		i=$[$i-1]
+		echo -n "."
+	done
+	$0 start
+
+	rc_status
+	;;
+    reload|force-reload)
+	echo -n "Reload service Fail2ban "
+	/sbin/startproc $FAIL2BAN_CLI -q reload > /dev/null 2>&1
+
+	rc_status -v
+	;;
     status)
-        echo -n "Checking for service Fail2ban "
-        /sbin/checkproc $FAIL2BAN_SERVER
-        rc_status -v
-        ;;
-    probe)
-        test /etc/fail2ban/fail2ban.conf -nt /var/run/fail2ban.pid && echo reload
-        ;;
+	echo -n "Checking for service fail2ban "
+	/sbin/checkproc $FAIL2BAN_SRV
+
+	rc_status -v
+	;;
     *)
-        echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
-        exit 1
-        ;;
+	echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
+	exit 1
+	;;
 esac
-rc_exit
\ No newline at end of file
+rc_exit
+

From 13c154198fc3941e8f318c6c8d602df09d2cfbb2 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 16:56:30 +1000
Subject: [PATCH 245/544] ENH: since it seems the default is to use file based
 logging, $syslog is in Should-{Start|Stop} like Debian
 https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.init

---
 files/suse-initd | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/files/suse-initd b/files/suse-initd
index b53fa540..09c25687 100644
--- a/files/suse-initd
+++ b/files/suse-initd
@@ -2,10 +2,10 @@
 #
 ### BEGIN INIT INFO
 # Provides:          fail2ban
-# Required-Start:    $syslog $remote_fs $local_fs
-# Should-Start:      $time $network iptables
-# Required-Stop:     $syslog $remote_fs $local_fs
-# Should-Stop:       $time $network iptables
+# Required-Start:    $remote_fs $local_fs
+# Should-Start:      $syslog $time $network iptables
+# Required-Stop:     $remote_fs $local_fs
+# Should-Stop:       $syslog $time $network iptables
 # Default-Start:     3 5
 # Default-Stop:      0 1 2 6
 # Pidfile:           /var/run/fail2ban/fail2ban.pid

From 503602b3326551f34f55cedf7cbed45b1d53e183 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Apr 2013 17:11:18 +1000
Subject: [PATCH 246/544] TST: test case for <br> tags in action

---
 testcases/actiontestcase.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index 281cb0b6..14484c05 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -88,6 +88,9 @@ class ExecuteAction(unittest.TestCase):
 			'ABC': "123",
 			'xyz': "890",
 		}
+		self.assertEqual(
+			self.__action.replaceTag("Text<br>text", aInfo),
+			"Text\ntext")
 		self.assertEqual(
 			self.__action.replaceTag("Text <HOST> text", aInfo),
 			"Text 192.0.2.0 text")

From ea25ed7cb07f6fc6a57ffb6f069fb5f5dfc41170 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 30 Apr 2013 23:52:38 +1000
Subject: [PATCH 247/544] DOC: macports distribution of fail2ban

---
 DEVELOP | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index a00a7ac6..6ccb162e 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -269,6 +269,7 @@ Releasing
   * http://svnweb.freebsd.org/ports/head/security/py-fail2ban/
   * https://build.opensuse.org/package/show?package=fail2ban&project=openSUSE%3AFactory
   * http://sophie.zarb.org/sources/fail2ban (Mageia)
+  * https://trac.macports.org/browser/trunk/dports/security/fail2ban
 
 # Check distribution outstanding bugs
 
@@ -291,6 +292,8 @@ Releasing
             http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/metadata.xml?view=markup
   * openSUSE: Stephan Kulow <coolo@suse.com>
             https://build.opensuse.org/package/users?package=fail2ban&project=openSUSE%3AFactory
+  * Mac Ports: @Malbrouck on github (gh-49)
+            https://trac.macports.org/browser/trunk/dports/security/fail2ban/Portfile
 
 # Wait for feedback from distributors
 

From c12813836becfa239bb38316ddbbadc283fedf42 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 17:05:28 +1000
Subject: [PATCH 248/544] ENH: some form of logrotate based on what distros are
 doing

---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..5eb71080 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -139,6 +139,7 @@ files/macosx-initd
 files/solaris-fail2ban.xml
 files/solaris-svc-fail2ban
 files/suse-initd
+files/fail2ban-logrotate
 files/cacti/fail2ban_stats.sh
 files/cacti/cacti_host_template_fail2ban.xml
 files/cacti/README

From 8a17a70d250b515f01ec6091d5e71e27fed0a878 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 17:12:55 +1000
Subject: [PATCH 249/544] BF: missed MANIFEST include

---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..0a0cbbce 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -97,6 +97,7 @@ config/filter.d/dropbear.conf
 config/filter.d/lighttpd-auth.conf
 config/filter.d/recidive.conf
 config/filter.d/roundcube-auth.conf
+config/action.d/bsd-ipfw.conf
 config/action.d/dummy.conf
 config/action.d/iptables-ipset-proto4.conf
 config/action.d/iptables-ipset-proto6.conf

From 54c2bf3dfb71b164f5b6a1abe2e6e480499502fa Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 17:14:20 +1000
Subject: [PATCH 250/544] BF: missed MANIFEST include

---
 MANIFEST | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..05eb35b1 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -43,6 +43,9 @@ server/datetemplate.py
 server/mytime.py
 server/failregex.py
 testcases/files/testcase-usedns.log
+testcases/files/logs/bsd/syslog-plain.txt
+testcases/files/logs/bsd/syslog-v.txt
+testcases/files/logs/bsd/syslog-vv.txt
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py

From f52142b5cbe95ac3122b516aa101021a168c8403 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 17:15:28 +1000
Subject: [PATCH 251/544] BF: missed MANIFEST include

---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..6dd54366 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -117,6 +117,7 @@ config/action.d/mail-buffered.conf
 config/action.d/mail-whois.conf
 config/action.d/mail-whois-lines.conf
 config/action.d/mynetwatchman.conf
+config/action.d/pf.conf
 config/action.d/sendmail.conf
 config/action.d/sendmail-buffered.conf
 config/action.d/sendmail-whois.conf

From 8b8c720d073a8e978e35dfbc965da4e16f401777 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 3 May 2013 17:16:42 +1000
Subject: [PATCH 252/544] ENH: logrotate file

---
 files/fail2ban-logrotate | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 files/fail2ban-logrotate

diff --git a/files/fail2ban-logrotate b/files/fail2ban-logrotate
new file mode 100644
index 00000000..67c6364a
--- /dev/null
+++ b/files/fail2ban-logrotate
@@ -0,0 +1,18 @@
+#
+# Gentoo:
+# http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/files/fail2ban-logrotate?view=markup
+#
+# Debian:
+# https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.logrotate
+#
+# Fedora view:
+#  http://pkgs.fedoraproject.org/cgit/fail2ban.git/tree/fail2ban-logrotate
+
+/var/log/fail2ban.log {
+    rotate 7
+    missingok
+    compress
+    postrotate
+      /usr/bin/fail2ban-client set logtarget /var/log/fail2ban.log 1>/dev/null || true
+    endscript
+}

From 932bd102fe4ce101013d58da6f1894555239fd58 Mon Sep 17 00:00:00 2001
From: jamesstout <stoutyhk@gmail.com>
Date: Sat, 4 May 2013 18:38:05 +0800
Subject: [PATCH 253/544] ENH: Removed unused log line

removed #9 per
https://github.com/fail2ban/fail2ban/pull/182#discussion_r4068885
---
 testcases/files/logs/sshd | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index e3e5c67e..12d01022 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -13,7 +13,6 @@ Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4
 #4
 Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
 
-
 #5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
 Mar  3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers
 Feb 25 14:34:11 belka sshd[31607]: User root from ferrari.inescn.pt not allowed because not listed in AllowUsers
@@ -29,15 +28,11 @@ Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but
 #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47
 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers
 
-#9 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648020
-# should this be removed? regex was removed in https://github.com/fail2ban/fail2ban/commit/bb7628591c124309774d5f4787d2a4f07cf6b906
-Nov  8 11:19:38 bar sshd[25427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.6
-
-#10 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182
+#9 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182
 Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.55 port 42742 ssh2
 Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
 
-#11 OSX syslog error
+#10 OSX syslog error
 Apr 29 14:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from dusky via 192.168.1.201
 Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from n29.c07.mtsvc.net via 192.168.1.201
 Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.35 port 42742 ssh2

From 3b4a7b7926234fce415372d3d5b1d5ba43e5c4a5 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 5 May 2013 15:43:18 +1000
Subject: [PATCH 254/544] ENH: add blocktype to all relevant actions. Also
 default the rejection to a ICMP reject rather than a drop

---
 config/action.d/ipfilter.conf                |  9 +++++++--
 config/action.d/ipfw.conf                    | 10 +++++++++-
 config/action.d/iptables-allports.conf       | 11 +++++++++--
 config/action.d/iptables-ipset-proto4.conf   | 10 ++++++++--
 config/action.d/iptables-ipset-proto6.conf   |  6 ++++++
 config/action.d/iptables-multiport-log.conf  |  9 ++++++++-
 config/action.d/iptables-multiport.conf      | 11 +++++++++--
 config/action.d/iptables-new.conf            | 11 +++++++++--
 config/action.d/iptables-xt_recent-echo.conf |  9 ++++++++-
 config/action.d/iptables.conf                | 12 ++++++++++--
 config/action.d/route.conf                   | 13 ++++++-------
 config/action.d/shorewall.conf               |  8 +++++++-
 12 files changed, 96 insertions(+), 23 deletions(-)

diff --git a/config/action.d/ipfilter.conf b/config/action.d/ipfilter.conf
index d77de9bf..61420e38 100644
--- a/config/action.d/ipfilter.conf
+++ b/config/action.d/ipfilter.conf
@@ -37,7 +37,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
+actionban = echo block <blocktype> in quick from <ip>/32 | /sbin/ipf -f -
 
 
 # Option:  actionunban
@@ -47,7 +47,12 @@ actionban = echo block in quick from <ip>/32 | /sbin/ipf -f -
 # Values:  CMD
 #
 # note -r option used to remove matching rule
-actionunban = echo block in quick from <ip>/32 | /sbin/ipf -r -f -
+actionunban = echo block <blocktype> in quick from <ip>/32 | /sbin/ipf -r -f -
 
 [Init]
 
+# Option: Blocktype
+# Notes : This is the return-icmp[return-code] mentioned in the ipf man page section 5. Keep this quoted to prevent
+#         Shell expansion. This should be blank (unquoted) to drop the packet.
+# Values: STRING
+blocktype = "return-icmp(port-unr)"
diff --git a/config/action.d/ipfw.conf b/config/action.d/ipfw.conf
index 62612307..bf4dd43f 100644
--- a/config/action.d/ipfw.conf
+++ b/config/action.d/ipfw.conf
@@ -35,7 +35,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = ipfw add deny tcp from <ip> to <localhost> <port>
+actionban = ipfw add <blocktype> tcp from <ip> to <localhost> <port>
 
 
 # Option:  actionunban
@@ -59,3 +59,11 @@ port = ssh
 # Values:  IP
 #
 localhost = 127.0.0.1
+
+
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 5 ipfw
+#          Common values: deny, unreach port, reset
+# Values:  STRING
+#
+blocktype = unreach port
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
index a02ba63d..66ad0178 100644
--- a/config/action.d/iptables-allports.conf
+++ b/config/action.d/iptables-allports.conf
@@ -37,7 +37,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -45,7 +45,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
@@ -64,3 +64,10 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf
index 4221dd8d..0999bca0 100644
--- a/config/action.d/iptables-ipset-proto4.conf
+++ b/config/action.d/iptables-ipset-proto4.conf
@@ -25,13 +25,13 @@
 # Values:  CMD
 #
 actionstart = ipset --create fail2ban-<name> iphash
-              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+              iptables -I INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j DROP
+actionstop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -m set --match-set fail2ban-<name> src -j <blocktype>
              ipset --flush fail2ban-<name>
              ipset --destroy fail2ban-<name>
 
@@ -69,3 +69,9 @@ port = ssh
 #
 protocol = tcp
 
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf
index d90acd44..95ff27c9 100644
--- a/config/action.d/iptables-ipset-proto6.conf
+++ b/config/action.d/iptables-ipset-proto6.conf
@@ -76,3 +76,9 @@ protocol = tcp
 bantime = 600
 
 
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf
index 49958013..5ae93861 100644
--- a/config/action.d/iptables-multiport-log.conf
+++ b/config/action.d/iptables-multiport-log.conf
@@ -21,7 +21,7 @@ actionstart = iptables -N fail2ban-<name>
               iptables -I <chain> 1 -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
               iptables -N fail2ban-<name>-log
               iptables -I fail2ban-<name>-log -j LOG --log-prefix "$(expr fail2ban-<name> : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2
-              iptables -A fail2ban-<name>-log -j DROP
+              iptables -A fail2ban-<name>-log -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -78,3 +78,10 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf
index ab0ee8de..b7827451 100644
--- a/config/action.d/iptables-multiport.conf
+++ b/config/action.d/iptables-multiport.conf
@@ -35,7 +35,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -43,7 +43,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
@@ -68,3 +68,10 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf
index 12f398c7..f5467ee2 100644
--- a/config/action.d/iptables-new.conf
+++ b/config/action.d/iptables-new.conf
@@ -37,7 +37,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -45,7 +45,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
@@ -70,3 +70,10 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf
index 887311be..e7d7182f 100644
--- a/config/action.d/iptables-xt_recent-echo.conf
+++ b/config/action.d/iptables-xt_recent-echo.conf
@@ -29,7 +29,7 @@
 #    own rules. The 3600 second timeout is independent and acts as a
 #    safeguard in case the fail2ban process dies unexpectedly. The
 #    shorter of the two timeouts actually matters.
-actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j DROP
+actionstart = iptables -I INPUT -m recent --update --seconds 3600 --name fail2ban-<name> -j <blocktype>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -70,3 +70,10 @@ name = default
 # Values:  [ tcp | udp | icmp | all ] Default: tcp
 #
 protocol = tcp
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index a3412f6b..be4b880c 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -35,7 +35,7 @@ actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]'
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -43,7 +43,7 @@ actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
 
 [Init]
 
@@ -68,3 +68,11 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
+
+Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
+
diff --git a/config/action.d/route.conf b/config/action.d/route.conf
index ec940b74..9e3164cd 100644
--- a/config/action.d/route.conf
+++ b/config/action.d/route.conf
@@ -15,11 +15,10 @@
 #   - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts
 
 [Definition]
-actionban   = ip route add <type> <ip>
-actionunban = ip route del <type> <ip>
+actionban   = ip route add <blocktype> <ip>
+actionunban = ip route del <blocktype> <ip>
 
-# Type of blocking
-#
-# Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
-
-type = blackhole
+# Option:  blocktype
+# Note:    Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
+# Values:  STRING
+blocktype = prohibit
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index aca3a256..7e0cee25 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -39,7 +39,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = shorewall drop <ip>
+actionban = shorewall <blocktype> <ip>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -48,3 +48,9 @@ actionban = shorewall drop <ip>
 # Values:  CMD
 #
 actionunban = shorewall allow <ip>
+
+# Option:  blocktype
+# Note:    This is what the action does with rules.
+#          See man page of shorewall for options that include drop, logdrop, reject, or logreject
+# Values:  STRING
+blocktype = reject

From 92dff6d645b26ce35c09689e654c2a4c6fb656c9 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Mon, 6 May 2013 20:17:26 +0100
Subject: [PATCH 255/544] DOC: Added bash-completion script

---
 files/bash-completion | 152 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 152 insertions(+)
 create mode 100644 files/bash-completion

diff --git a/files/bash-completion b/files/bash-completion
new file mode 100644
index 00000000..25ccbc30
--- /dev/null
+++ b/files/bash-completion
@@ -0,0 +1,152 @@
+# fail2ban bash-completion                                 -*- shell-script -*-
+#
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__sudo () {
+    sudo -n "$@" 2>/dev/null || return 0
+}
+__fail2ban_jails () {
+    __sudo "$1" status | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g'
+}
+
+_fail2ban () {
+    local cur prev words cword
+    _init_completion || return 
+
+    case $prev in
+        -V|--version|-h|--help)
+            return 0 # No further completion valid
+            ;;
+        -c)
+            _filedir -d # Directories
+            return 0
+            ;;
+        -s|-p)
+            _filedir # Files
+            return 0
+            ;;
+        *)
+            if [[ "$cur" == "-"* ]];then
+                COMPREPLY=( $( compgen -W \
+                    "$( _parse_help "$1" --help 2>/dev/null) -V" \
+                     -- "$cur") )
+                return 0
+            fi
+            ;;
+    esac
+
+    if [[ "$1" == *"fail2ban-regex" ]];then
+        _filedir
+        return 0
+    elif [[ "$1" == *"fail2ban-client" ]];then
+        local cmd jail
+        case $prev in
+            "$1")
+                COMPREPLY=( $( compgen -W \
+                    "$( "$1" --help 2>/dev/null | awk '/^    [a-z]+/{print $1}')" \
+                    -- "$cur") )
+                return 0
+                ;;
+            start|reload|stop|status)
+                COMPREPLY=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) )
+                return 0
+                ;;
+            set|get)
+                COMPREPLY=( $( compgen -W \
+                    "$( "$1" --help 2>/dev/null | awk '/^    '$prev' [^<]/{print $2}')" \
+                    -- "$cur") )
+                COMPREPLY+=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) )
+                return 0
+                ;;
+            *)
+                if [[ "${words[$cword-2]}" == "add" ]];then
+                    COMPREPLY=( $( compgen -W "auto polling gamin pyinotify" -- "$cur" ) )
+                    return 0
+                elif [[ "${words[$cword-2]}" == "set" ||  "${words[$cword-2]}" == "get" ]];then
+                    cmd="${words[cword-2]}"
+                    # Handle in section below
+                elif [[ "${words[$cword-3]}" == "set" || "${words[$cword-3]}" == "get" ]];then
+                    cmd="${words[$cword-3]}"
+                    jail="${words[$cword-2]}"
+                    # Handle in section below
+                fi
+            ;;
+        esac
+
+        if [[ -z "$jail" && -n "$cmd" ]];then
+            case $prev in
+                loglevel)
+                    if [[ "$cmd" == "set" ]];then
+                        COMPREPLY=( $( compgen -W "0 1 2 3 4" -- "$cur" ) )
+                    fi
+                    return 0
+                    ;;
+                logtarget)
+                    if [[ "$cmd" == "set" ]];then
+                        COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG" -- "$cur" ) )
+                        _filedir # And files
+                    fi
+                    return 0
+                    ;;
+                *) # Jail name
+                    COMPREPLY=( $( compgen -W \
+                        "$( "$1" --help 2>/dev/null | awk '/^    '${cmd}' <JAIL>/{print $3}')" \
+                        -- "$cur") )
+                    return 0
+                    ;;
+            esac
+        elif [[ -n "$jail" && "$cmd" == "set" ]];then
+            case $prev in
+                addlogpath)
+                    _filedir
+                    return 0
+                    ;;
+                dellogpath|delignoreip)
+                    COMPREPLY=( $( compgen -W \
+                        "$( __sudo "$1" get "$jail" "${prev/del/}" | awk -F- '{print $2}')" \
+                    -- "$cur" ) )
+                    if [[ -z "$COMPREPLY" && "$prev" == "dellogpath" ]];then
+                        _filedir
+                    fi
+                    return 0
+                    ;;
+                delfailregex|delignoregex)
+                    COMPREPLY=( $( compgen -W \
+                        "$( __sudo "$1" get "$jail" "${prev/del/}" | awk -F"[][]" '{print $2}')" \
+                    -- "$cur" ) )
+                    return 0
+                    ;;
+                unbanip)
+                    COMPREPLY=( $( compgen -W \
+                        "$( __sudo "$1" status "$jail" | awk -F"\t+" '/IP list:/{print $2}')" \
+                    -- "$cur" ) )
+                    return 0
+                    ;;
+                idle)
+                    COMPREPLY=( $( compgen -W "on off" -- "$cur" ) )
+                    return 0
+                    ;;
+                usedns)
+                    COMPREPLY=( $( compgen -W "yes no warn" -- "$cur" ) )
+                    return 0
+                    ;;
+            esac
+        fi
+
+    fi # fail2ban-client
+} &&
+complete -F _fail2ban fail2ban-client fail2ban-server fail2ban-regex

From 95726b3976500b3d51d74ea24f0cb4640c79aaed Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Mon, 6 May 2013 20:37:58 +0100
Subject: [PATCH 256/544] DOC: Drop sudo from bash-completion

---
 files/bash-completion | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/files/bash-completion b/files/bash-completion
index 25ccbc30..7a42bd1e 100644
--- a/files/bash-completion
+++ b/files/bash-completion
@@ -16,11 +16,8 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-__sudo () {
-    sudo -n "$@" 2>/dev/null || return 0
-}
 __fail2ban_jails () {
-    __sudo "$1" status | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g'
+    "$1" status 2>/dev/null | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g'
 }
 
 _fail2ban () {
@@ -117,7 +114,7 @@ _fail2ban () {
                     ;;
                 dellogpath|delignoreip)
                     COMPREPLY=( $( compgen -W \
-                        "$( __sudo "$1" get "$jail" "${prev/del/}" | awk -F- '{print $2}')" \
+                        "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F- '{print $2}')" \
                     -- "$cur" ) )
                     if [[ -z "$COMPREPLY" && "$prev" == "dellogpath" ]];then
                         _filedir
@@ -126,13 +123,13 @@ _fail2ban () {
                     ;;
                 delfailregex|delignoregex)
                     COMPREPLY=( $( compgen -W \
-                        "$( __sudo "$1" get "$jail" "${prev/del/}" | awk -F"[][]" '{print $2}')" \
+                        "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F"[][]" '{print $2}')" \
                     -- "$cur" ) )
                     return 0
                     ;;
                 unbanip)
                     COMPREPLY=( $( compgen -W \
-                        "$( __sudo "$1" status "$jail" | awk -F"\t+" '/IP list:/{print $2}')" \
+                        "$( "$1" status "$jail" 2>/dev/null | awk -F"\t+" '/IP list:/{print $2}')" \
                     -- "$cur" ) )
                     return 0
                     ;;

From e7cb0f8b8c2bb401ee7cb21f0033c3e4d5d84350 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 7 May 2013 12:22:49 -0400
Subject: [PATCH 257/544] ENH: filter.d/sshd.conf -- allow for trailing "via
 IP" in logs

---
 config/filter.d/sshd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 6269f804..18ac6668 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -22,7 +22,7 @@ _daemon = sshd
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>\s*$
+failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$
             ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
             ^%(__prefix_line)sFailed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$

From ffcac2cceebd954dda1586fcff4d2e01bc58d19e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 7 May 2013 12:26:13 -0400
Subject: [PATCH 258/544] ENH: logs/sshd -- use example.com as the resolved
 hostname in sample log lines

---
 testcases/files/logs/sshd | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index 12d01022..3293126c 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -1,6 +1,6 @@
 #1
 Jun 21 16:47:48 digital-mlhhyiqscv sshd[13709]: error: PAM: Authentication failure for myhlj1374 from 192.030.0.6
-May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from www.onerussian.com
+May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from example.com
 
 #2
 Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.69 port 50273 ssh2
@@ -15,7 +15,7 @@ Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
 
 #5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
 Mar  3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers
-Feb 25 14:34:11 belka sshd[31607]: User root from ferrari.inescn.pt not allowed because not listed in AllowUsers
+Feb 25 14:34:11 belka sshd[31607]: User root from example.com not allowed because not listed in AllowUsers
 
 #6 ew filter introduced thanks to report Guido Bozzetto <reportbug@G-B.it>
 Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)
@@ -33,8 +33,7 @@ Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interac
 Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
 
 #10 OSX syslog error
-Apr 29 14:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from dusky via 192.168.1.201
-Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from n29.c07.mtsvc.net via 192.168.1.201
+Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from example.com via 192.168.1.201
 Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.35 port 42742 ssh2
 Apr 29 20:12:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.22 port 54520 ssh2
 Apr 29 20:13:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for james from 205.186.180.42 port 54520 ssh2
@@ -45,4 +44,4 @@ Apr 29 13:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication failur
 Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error for james from 205.186.180.100 via 192.168.1.201
 Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201
 Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102
-Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103
\ No newline at end of file
+Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103

From 5e1d8b07e82eb7633d31bbb4bd446e753ff37128 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 7 May 2013 12:30:05 -0400
Subject: [PATCH 259/544] ENH: logs/sshd -- have ":" after [daemon] (other uses
 are uncommon)

See https://github.com/fail2ban/fail2ban/issues/216\#issuecomment-17535577
for the analysis
---
 testcases/files/logs/sshd | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index 3293126c..5dab1606 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -14,7 +14,8 @@ Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4
 Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
 
 #5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
-Mar  3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers
+# yoh: added ':' after [sshd] since the case without is not really common any more
+Mar  3 00:17:22 [sshd]: User root from 211.188.220.49 not allowed because not listed in AllowUsers
 Feb 25 14:34:11 belka sshd[31607]: User root from example.com not allowed because not listed in AllowUsers
 
 #6 ew filter introduced thanks to report Guido Bozzetto <reportbug@G-B.it>

From de563476197d2d6a15082801d3d49daa8d7bc9a9 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 8 May 2013 06:32:27 +1000
Subject: [PATCH 260/544] ENH: separate out regex and escape a .

---
 config/filter.d/common.conf | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index a5fe1176..4bd519b3 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -38,6 +38,9 @@ __kernel_prefix = kernel: \[\d+\.\d+\]
 
 __hostname = \S+
 
+
+__bsd_syslog_verbose = (<[^.]+\.[^.]+>)
+
 #
 # Common line prefixes (beginnings) which could be used in filters
 #
@@ -47,4 +50,4 @@ __hostname = \S+
 # <auth.info> appearing before the host as per testcases/files/logs/bsd/*.
 #
 # This can be optional (for instance if we match named native log files)
-__prefix_line = \s*(<[^.]+.[^.]+>)?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
+__prefix_line = \s*%(__bsd_syslog_verbose)s?\s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*

From c7fd7779664dda7247840485277315193f999102 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 8 May 2013 07:31:31 +1000
Subject: [PATCH 261/544] BF: default type to unreachable

---
 config/action.d/route.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/route.conf b/config/action.d/route.conf
index 9e3164cd..bb4ec8e1 100644
--- a/config/action.d/route.conf
+++ b/config/action.d/route.conf
@@ -21,4 +21,4 @@ actionunban = ip route del <blocktype> <ip>
 # Option:  blocktype
 # Note:    Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
 # Values:  STRING
-blocktype = prohibit
+blocktype = unreachable

From 9c03ee6d9ebc31bb1d00be8c747379c06cfde278 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 8 May 2013 07:52:08 +1000
Subject: [PATCH 262/544] ENH: consolidate where blocktype is defined for
 iptables rules

---
 MANIFEST                                     |  1 +
 config/action.d/iptables-allports.conf       | 12 +++++------
 config/action.d/iptables-blocktype.conf      | 22 ++++++++++++++++++++
 config/action.d/iptables-ipset-proto4.conf   | 11 ++++------
 config/action.d/iptables-ipset-proto6.conf   | 13 +++++-------
 config/action.d/iptables-multiport-log.conf  | 11 ++++------
 config/action.d/iptables-multiport.conf      | 11 ++++------
 config/action.d/iptables-new.conf            | 12 +++++------
 config/action.d/iptables-xt_recent-echo.conf | 12 +++++------
 config/action.d/iptables.conf                | 12 ++++-------
 10 files changed, 59 insertions(+), 58 deletions(-)
 create mode 100644 config/action.d/iptables-blocktype.conf

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..999a6a95 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -98,6 +98,7 @@ config/filter.d/lighttpd-auth.conf
 config/filter.d/recidive.conf
 config/filter.d/roundcube-auth.conf
 config/action.d/dummy.conf
+config/action.d/iptables-blocktype.conf
 config/action.d/iptables-ipset-proto4.conf
 config/action.d/iptables-ipset-proto6.conf
 config/action.d/iptables-xt_recent-echo.conf
diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf
index 66ad0178..17c75dda 100644
--- a/config/action.d/iptables-allports.conf
+++ b/config/action.d/iptables-allports.conf
@@ -7,6 +7,11 @@
 # $Revision$
 #
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
 [Definition]
 
 # Option:  actionstart
@@ -64,10 +69,3 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-blocktype.conf b/config/action.d/iptables-blocktype.conf
new file mode 100644
index 00000000..c505e49c
--- /dev/null
+++ b/config/action.d/iptables-blocktype.conf
@@ -0,0 +1,22 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# This is a included configuration file and includes the defination for the blocktype
+# used in all iptables based actions by default.
+#
+# The user can override the default in iptables-blocktype.local
+
+[INCLUDES]
+
+after = iptables-blocktype.local
+
+[Init]
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+blocktype = REJECT --reject-with icmp-port-unreachable
+
diff --git a/config/action.d/iptables-ipset-proto4.conf b/config/action.d/iptables-ipset-proto4.conf
index 0999bca0..3ed778f9 100644
--- a/config/action.d/iptables-ipset-proto4.conf
+++ b/config/action.d/iptables-ipset-proto4.conf
@@ -18,6 +18,10 @@
 # apt-get install ipset xtables-addons-source 
 # module-assistant auto-install xtables-addons
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -68,10 +72,3 @@ port = ssh
 # Values:  [ tcp | udp | icmp | all ] Default: tcp
 #
 protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-ipset-proto6.conf b/config/action.d/iptables-ipset-proto6.conf
index 95ff27c9..3cf9b140 100644
--- a/config/action.d/iptables-ipset-proto6.conf
+++ b/config/action.d/iptables-ipset-proto6.conf
@@ -18,6 +18,11 @@
 # apt-get install ipset xtables-addons-source 
 # module-assistant auto-install xtables-addons
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
 [Definition]
 
 # Option:  actionstart
@@ -74,11 +79,3 @@ protocol = tcp
 # Values:  [ NUM ]  Default: 600
 
 bantime = 600
-
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf
index 5ae93861..add57338 100644
--- a/config/action.d/iptables-multiport-log.conf
+++ b/config/action.d/iptables-multiport-log.conf
@@ -10,6 +10,10 @@
 # $Revision$
 #
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -78,10 +82,3 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf
index b7827451..e5ae97f0 100644
--- a/config/action.d/iptables-multiport.conf
+++ b/config/action.d/iptables-multiport.conf
@@ -5,6 +5,10 @@
 # $Revision$
 #
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -68,10 +72,3 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf
index f5467ee2..c8664a22 100644
--- a/config/action.d/iptables-new.conf
+++ b/config/action.d/iptables-new.conf
@@ -7,6 +7,11 @@
 # $Revision$
 #
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
 [Definition]
 
 # Option:  actionstart
@@ -70,10 +75,3 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables-xt_recent-echo.conf b/config/action.d/iptables-xt_recent-echo.conf
index e7d7182f..1094839d 100644
--- a/config/action.d/iptables-xt_recent-echo.conf
+++ b/config/action.d/iptables-xt_recent-echo.conf
@@ -5,6 +5,11 @@
 # $Revision: 1 $
 #
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
+
 [Definition]
 
 # Option:  actionstart
@@ -70,10 +75,3 @@ name = default
 # Values:  [ tcp | udp | icmp | all ] Default: tcp
 #
 protocol = tcp
-
-# Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf
index be4b880c..2368cbdc 100644
--- a/config/action.d/iptables.conf
+++ b/config/action.d/iptables.conf
@@ -5,6 +5,10 @@
 # $Revision$
 #
 
+[INCLUDES]
+
+before = iptables-blocktype.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -68,11 +72,3 @@ protocol = tcp
 #          added
 # Values:  STRING  Default: INPUT
 chain = INPUT
-
-Option:  blocktype
-# Note:    This is what the action does with rules. This can be any jump target
-#          as per the iptables man page (section 8). Common values are DROP
-#          REJECT, REJECT --reject-with icmp-port-unreachable
-# Values:  STRING
-blocktype = REJECT --reject-with icmp-port-unreachable
-

From ac1944ac6d12a24c88b0c723ea7a8bd0225bc750 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 8 May 2013 08:21:17 +1000
Subject: [PATCH 263/544] DOC: ChangeLog for default action type change

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c80e3b3c..ae55bb2c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -99,6 +99,8 @@ Borreli, blotus:
    * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source.
    * [1d9abd1] Action files can have tags in definition that refer to other
      tags.
+   * [10886e7,cec5da2,adb991a] Change actions to response with ICMP port
+     unreachable rather than just a drop of the packet.
   Pascal Borreli
    * [a2b29b4] Fixed lots of typos in config files and documentation.
   hamilton5

From b3f11df317ac199a62fbd577d93ae6452a780692 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 8 May 2013 08:27:38 +1000
Subject: [PATCH 264/544] BF: add bash-completion to MANIFEST

---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index 364c0b08..a9375268 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -144,3 +144,4 @@ files/cacti/cacti_host_template_fail2ban.xml
 files/cacti/README
 files/nagios/check_fail2ban
 files/nagios/f2ban.txt
+files/bash-completion

From 63b9e4f358250e7f5b04fac4aa53aad3ec1b7f31 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 10:10:04 -0400
Subject: [PATCH 265/544] Changelog entries for the latest merges

---
 ChangeLog | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index b10931be..899f9d30 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -71,6 +71,8 @@ Borreli, blotus:
    * [be06b1b] Add action for iptables-ipsets. Closes gh-102.
   Soulard Morgan
    * [f336d9f] Add filter for webmin. Closes gh-99.
+  Steven Hiscocks
+   * [..746c7d9] bash interactive shell completions for fail2ban-*'s
 - Enhancements:
   Enrico Labedzki
    * [24a8d07] Added new date format for ASSP SMTP Proxy.
@@ -106,6 +108,11 @@ Borreli, blotus:
    * [7ede1e8] Update dovecot filter config.
   Romain Riviere
    * [0ac8746] Enhance named-refused filter for views.
+  James Stout
+   * [..2143cdf] Solaris support enhancements:
+     - README.Solaris
+     - failregex'es tune ups (sshd.conf)
+     - hostsdeny: do not rely on support of '-i' in sed
 
 Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
 Hendrikx and other TBN heroes supporting users on fail2ban-users

From 11031d5ec9268cece9138ad7ed8304a4ad1576fe Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 10:15:18 -0400
Subject: [PATCH 266/544] DOC: Slight tune ups to ChangeLog -- we must release!

---
 ChangeLog | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 899f9d30..9aedd52a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,23 +7,27 @@
 Fail2Ban (version 0.8.9)                                              2013/04/XX
 ================================================================================
 
-ver. 0.8.9 (2013/04/XX) - wanna-be-stable
+ver. 0.8.9 (2013/05/XX) - wanna-be-stable
 ----------
 
-Although primarily a bugfix release, it incorporates many new
-enhancements, few new features, but more importantly -- quite extended
-tests battery with current 94% coverage.  This release incorporates
-more than a 100 of non-merge commits from 14 contributors (sorted by
-number of commits): Yaroslav Halchenko, Daniel Black, Steven Hiscocks,
-ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither,
-Orion Poplawski, Artur Penttinen, sebres, Nicolas Collignon, Pascal
-Borreli, blotus:
+Originally targeted as a bugfix release, it incorporated many new
+enhancements, few new features, and more importantly -- quite extended
+tests battery with current 94% coverage.
 
-- Fixes:
-  Yaroslav Halchenko
-   * [6f4dad46] Documentation python-2.4 is the minimium version.
-   * [1eb23cf8] do not rely on scripts being under /usr -- might differ eg on
-     Fedora. Closes gh-112. Thanks to Camusensei for the bug report.
+This release introduces over 200 of non-merge commits from 16
+contributors (sorted by number of commits): Yaroslav Halchenko, Daniel
+Black, Steven Hiscocks, James Stout, Orion Poplawski, Enrico Labedzki,
+ArndRa, hamilton5, pigsyn, Erwan Ben Souiden, Michael Gebetsroither,
+Artur Penttinen, blotus, sebres, Nicolas Collignon, Pascal Borreli.
+
+Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
+Hendrikx, Yehuda Katz and other TBN heroes supporting users on
+fail2ban-users mailing list and IRC.
+
+- Fixes: Yaroslav Halchenko
+   * [6f4dad46] python-2.4 is the minimal version.
+   * [1eb23cf8] do not rely on scripts being under /usr -- might differ e.g.
+     on Fedora. Closes gh-112. Thanks to Camusensei for the bug report.
    * [bf4d4af1] Changes for atomic writes. Thanks to Steven Hiscocks for
      insight. Closes gh-103.
    * [ab044b75] delay check for the existence of config directory until read.
@@ -99,7 +103,7 @@ Borreli, blotus:
    * [c8c7b0b,23bbc60] Better logging of log file read errors.
    * [3665e6d] Added code coverage to development process.
    * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh
-	   source. Also include BSD changes.
+     source. Also include BSD changes.
    * [1d9abd1] Action files can have tags in definition that refer to other
      tags.
   Pascal Borreli
@@ -114,10 +118,6 @@ Borreli, blotus:
      - failregex'es tune ups (sshd.conf)
      - hostsdeny: do not rely on support of '-i' in sed
 
-Special Kudos also go to Fabian Wenk, Arturo 'Buanzo' Busleiman, Tom
-Hendrikx and other TBN heroes supporting users on fail2ban-users
-mailing list and IRC.
-
 ver. 0.8.8 (2012/12/06) - stable
 ----------
 - Fixes:

From 571cadd80c3dea4ea3b32c3c5b3d6dd36d898581 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 10:30:38 -0400
Subject: [PATCH 267/544] ENH: Use real (resolving) example.com instead of
 test.example.com

---
 testcases/files/logs/bsd/syslog-plain.txt |  2 +-
 testcases/files/logs/bsd/syslog-v.txt     | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/testcases/files/logs/bsd/syslog-plain.txt b/testcases/files/logs/bsd/syslog-plain.txt
index 7dcecb2e..575d8b89 100644
--- a/testcases/files/logs/bsd/syslog-plain.txt
+++ b/testcases/files/logs/bsd/syslog-plain.txt
@@ -1,3 +1,3 @@
 Apr  2 17:52:55 pancake sshd[55657]: Invalid user oracle from 192.0.2.100
-Apr  2 17:53:01 pancake sshd[55657]: error: PAM: authentication error for illegal user oracle from test.example.com
+Apr  2 17:53:01 pancake sshd[55657]: error: PAM: authentication error for illegal user oracle from example.com
 Apr  2 17:53:01 pancake sshd[55657]: Failed keyboard-interactive/pam for invalid user oracle from 192.0.2.100 port 48856 ssh2
diff --git a/testcases/files/logs/bsd/syslog-v.txt b/testcases/files/logs/bsd/syslog-v.txt
index 319582ba..a8db3d77 100644
--- a/testcases/files/logs/bsd/syslog-v.txt
+++ b/testcases/files/logs/bsd/syslog-v.txt
@@ -1,10 +1,10 @@
-Apr  2 17:51:27 <4.3> pancake sshd[55624]: error: PAM: authentication error for nick from test.example.com
+Apr  2 17:51:27 <4.3> pancake sshd[55624]: error: PAM: authentication error for nick from example.com
 Apr  2 17:51:32 <4.6> pancake sshd[55628]: Invalid user r00t from 192.0.2.100
-Apr  2 17:51:33 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com
+Apr  2 17:51:33 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from example.com
 Apr  2 17:51:33 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2
-Apr  2 17:51:34 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com
+Apr  2 17:51:34 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from example.com
 Apr  2 17:51:34 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2
-Apr  2 17:51:36 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from test.example.com
+Apr  2 17:51:36 <4.3> pancake sshd[55628]: error: PAM: authentication error for illegal user r00t from example.com
 Apr  2 17:51:36 <4.6> pancake sshd[55628]: Failed keyboard-interactive/pam for invalid user r00t from 192.0.2.100 port 46050 ssh2
 Apr  2 17:52:06 <4.6> pancake sshd[55647]: Invalid user oracle from 192.0.2.100
-Apr  2 17:52:07 <4.3> pancake sshd[55647]: error: PAM: authentication error for illegal user oracle from test.example.com
+Apr  2 17:52:07 <4.3> pancake sshd[55647]: error: PAM: authentication error for illegal user oracle from example.com

From 6fef85ff2d0be4e33b8e99d4012c42d25258ef27 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 12:07:26 -0400
Subject: [PATCH 268/544] ENH: strip CR and LF while analyzing the lines
 (processLine) (Close #202)

This should allow to resolve issues with logs written in MS-DOS fashion,
e.g. with daemontools

See https://github.com/fail2ban/fail2ban/issues/202\#issuecomment-17393613
---
 server/filter.py            |  1 +
 testcases/filtertestcase.py | 28 +++++++++++++++++++++++-----
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 754a2a08..90530f92 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -290,6 +290,7 @@ class Filter(JailThread):
 			l = line.decode('utf-8')
 		except UnicodeDecodeError:
 			l = line
+		l = l.rstrip('\r\n')
 		timeMatch = self.dateDetector.matchTime(l)
 		if timeMatch:
 			# Lets split into time part and log part of the line
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 00946f90..ce142bfd 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -579,11 +579,29 @@ class GetFailures(unittest.TestCase):
 
 
 
-	def testGetFailures01(self):
-		self.filter.addLogPath(GetFailures.FILENAME_01)
-		self.filter.addFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>")
-		self.filter.getFailures(GetFailures.FILENAME_01)
-		_assert_correct_last_attempt(self, self.filter, GetFailures.FAILURES_01)
+	def testGetFailures01(self, filename=None, failures=None):
+		filename = filename or GetFailures.FILENAME_01
+		failures = failures or GetFailures.FAILURES_01
+
+		self.filter.addLogPath(filename)
+		self.filter.addFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>$")
+		self.filter.getFailures(filename)
+		_assert_correct_last_attempt(self, self.filter,  failures)
+
+	def testCRLFFailures01(self):
+		# We first adjust logfile/failures to end with CR+LF
+		fname = tempfile.mktemp(prefix='tmp_fail2ban', suffix='crlf')
+		f = open(fname, 'w')
+		for l in open(GetFailures.FILENAME_01).readlines():
+			f.write('%s\r\n' % l.rstrip('\n'))
+		f.close()
+
+		# now see if we should be getting the "same" failures
+		self.testGetFailures01(filename=fname,
+							   failures=GetFailures.FAILURES_01[:3] +
+							   ([x.rstrip('\n') + '\r\n' for x in
+								 GetFailures.FAILURES_01[-1]],))
+		_killfile(f, fname)
 
 
 	def testGetFailures02(self):

From 239406a8b9c26829453daf5a078c0debc2f4d990 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 12:09:06 -0400
Subject: [PATCH 269/544] Changelog for preceeding commit

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index be28f028..a4dc4b75 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -103,6 +103,7 @@ fail2ban-users mailing list and IRC.
    * [40c5a2d] adding more of diagnostic messages into -client while starting
      the daemon.
    * [8e63d4c] Compare against None with 'is' instead of '=='.
+   * [6fef85f] Strip CR and LF while analyzing the log line
   Daniel Black
    * [3aeb1a9] Add jail.conf manual page. Closes gh-143.
    * [MANY] man page edits.

From c9dd163852c8d35e43460b665ed90070239053f5 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 13:46:06 -0400
Subject: [PATCH 270/544] Add README.Solaris into distribution

---
 MANIFEST | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MANIFEST b/MANIFEST
index b7ac5f33..0537abae 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1,4 +1,5 @@
 README.md
+README.Solaris
 ChangeLog
 TODO
 THANKS

From 582d1c5ea51e6850350b7c2677f23af7d84ccb80 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 13:59:09 -0400
Subject: [PATCH 271/544] ENH: remove use of $Revision and $Date SVN tags

---
 client/__init__.py                | 2 --
 client/actionreader.py            | 2 --
 client/configparserinc.py         | 2 --
 client/configreader.py            | 2 --
 client/configurator.py            | 2 --
 client/csocket.py                 | 2 --
 client/fail2banreader.py          | 2 --
 client/filterreader.py            | 2 --
 client/jailreader.py              | 2 --
 client/jailsreader.py             | 2 --
 common/__init__.py                | 2 --
 common/helpers.py                 | 2 --
 common/protocol.py                | 2 --
 testcases/__init__.py             | 2 --
 testcases/actiontestcase.py       | 2 --
 testcases/banmanagertestcase.py   | 2 --
 testcases/datedetectortestcase.py | 2 --
 testcases/failmanagertestcase.py  | 2 --
 testcases/servertestcase.py       | 2 --
 testcases/sockettestcase.py       | 2 --
 20 files changed, 40 deletions(-)

diff --git a/client/__init__.py b/client/__init__.py
index 3de9058c..2b76f4b6 100644
--- a/client/__init__.py
+++ b/client/__init__.py
@@ -21,7 +21,5 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
diff --git a/client/actionreader.py b/client/actionreader.py
index c1a64245..8f60b55b 100644
--- a/client/actionreader.py
+++ b/client/actionreader.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/configparserinc.py b/client/configparserinc.py
index df5af1ac..f5e124a1 100644
--- a/client/configparserinc.py
+++ b/client/configparserinc.py
@@ -21,8 +21,6 @@
 # Modified: Cyril Jaquier
 
 __author__ = 'Yaroslav Halhenko'
-__revision__ = '$Revision$'
-__date__ = '$Date$'
 __copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
 __license__ = 'GPL'
 
diff --git a/client/configreader.py b/client/configreader.py
index 9fb6b3eb..3d3aff94 100644
--- a/client/configreader.py
+++ b/client/configreader.py
@@ -21,8 +21,6 @@
 # Modified by: Yaroslav Halchenko (SafeConfigParserWithIncludes)
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/configurator.py b/client/configurator.py
index fc588558..d5f46305 100644
--- a/client/configurator.py
+++ b/client/configurator.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/csocket.py b/client/csocket.py
index c6f318f2..3d8362b5 100644
--- a/client/csocket.py
+++ b/client/csocket.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index 026076fa..ada88084 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/filterreader.py b/client/filterreader.py
index b8c47558..f75190f9 100644
--- a/client/filterreader.py
+++ b/client/filterreader.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/jailreader.py b/client/jailreader.py
index d6f678ee..f8757e26 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/client/jailsreader.py b/client/jailsreader.py
index f87794dd..098b525d 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/common/__init__.py b/common/__init__.py
index 3de9058c..2b76f4b6 100644
--- a/common/__init__.py
+++ b/common/__init__.py
@@ -21,7 +21,5 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
diff --git a/common/helpers.py b/common/helpers.py
index 3c830138..dba4c9d6 100644
--- a/common/helpers.py
+++ b/common/helpers.py
@@ -22,8 +22,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2009 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/common/protocol.py b/common/protocol.py
index ccd44398..9309ce7f 100644
--- a/common/protocol.py
+++ b/common/protocol.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/__init__.py b/testcases/__init__.py
index 3de9058c..2b76f4b6 100644
--- a/testcases/__init__.py
+++ b/testcases/__init__.py
@@ -21,7 +21,5 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index e8a03abf..9a7776ac 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/banmanagertestcase.py b/testcases/banmanagertestcase.py
index 58651573..1e585244 100644
--- a/testcases/banmanagertestcase.py
+++ b/testcases/banmanagertestcase.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 4b38fb12..8a838700 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index de23219c..1bfab339 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 9a285553..ff3f2e88 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
diff --git a/testcases/sockettestcase.py b/testcases/sockettestcase.py
index cd13c772..d70c45cf 100644
--- a/testcases/sockettestcase.py
+++ b/testcases/sockettestcase.py
@@ -21,8 +21,6 @@
 # 
 
 __author__ = "Steven Hiscocks"
-__version__ = "$Revision$"
-__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 

From 28794d842dc8d737f7fb17ad5bbc91297f0aba0f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 15:14:28 -0400
Subject: [PATCH 272/544] ENH: close files in _test_move_into_file

---
 testcases/filtertestcase.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 00946f90..6cfa53a7 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -477,8 +477,8 @@ def get_monitor_failures_testcase(Filter_):
 
 		def _test_move_into_file(self, interim_kill=False):
 			# if we move a new file into the location of an old (monitored) file
-			self.file1 = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
-												  n=100)
+			_copy_lines_between_files(GetFailures.FILENAME_01, self.name,
+									  n=100).close()
 			# make sure that it is monitored first
 			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 3)
@@ -488,14 +488,15 @@ def get_monitor_failures_testcase(Filter_):
 				time.sleep(0.2)				  # let them know
 
 			# now create a new one to override old one
-			self.file = _copy_lines_between_files(GetFailures.FILENAME_01,
-												   self.name + '.new', n=100)
+			_copy_lines_between_files(GetFailures.FILENAME_01, self.name + '.new',
+									  n=100).close()
 			os.rename(self.name + '.new', self.name)
 			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 6)
 
 			# and to make sure that it now monitored for changes
-			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, n=100)
+			_copy_lines_between_files(GetFailures.FILENAME_01, self.name,
+									  n=100).close()
 			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 9)
 

From f4d2b5b33860c6ad6b6e8e83e67c2e451dabc04c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 8 May 2013 16:12:37 -0400
Subject: [PATCH 273/544] Previous coverage was 56% (without disregarding any
 pragma)

---
 ChangeLog | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index be28f028..50ffe209 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,7 +12,7 @@ ver. 0.8.9 (2013/05/XX) - wanna-be-stable
 
 Originally targeted as a bugfix release, it incorporated many new
 enhancements, few new features, and more importantly -- quite extended
-tests battery with current 94% coverage.
+tests battery with current 94% coverage (from 56% of 0.8.8).
 
 This release introduces over 200 of non-merge commits from 16
 contributors (sorted by number of commits): Yaroslav Halchenko, Daniel

From 7a6eecbe219d42aed0d667f175e185e98159f134 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 9 May 2013 13:25:29 -0400
Subject: [PATCH 274/544] ENH: close open file in a test

---
 testcases/filtertestcase.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index c1e91e74..1657f694 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -592,17 +592,19 @@ class GetFailures(unittest.TestCase):
 	def testCRLFFailures01(self):
 		# We first adjust logfile/failures to end with CR+LF
 		fname = tempfile.mktemp(prefix='tmp_fail2ban', suffix='crlf')
-		f = open(fname, 'w')
-		for l in open(GetFailures.FILENAME_01).readlines():
-			f.write('%s\r\n' % l.rstrip('\n'))
-		f.close()
+		# poor man unix2dos:
+		fin, fout = open(GetFailures.FILENAME_01), open(fname, 'w')
+		for l in fin.readlines():
+			fout.write('%s\r\n' % l.rstrip('\n'))
+		fin.close()
+		fout.close()
 
 		# now see if we should be getting the "same" failures
 		self.testGetFailures01(filename=fname,
 							   failures=GetFailures.FAILURES_01[:3] +
 							   ([x.rstrip('\n') + '\r\n' for x in
 								 GetFailures.FAILURES_01[-1]],))
-		_killfile(f, fname)
+		_killfile(fout, fname)
 
 
 	def testGetFailures02(self):

From 728aaec6b851b45afa5dcf030e229fda29a66373 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 9 May 2013 22:27:16 -0400
Subject: [PATCH 275/544] ENH: point to the status of master branch on travis

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 04f8b349..65183b92 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,7 @@ the website: http://www.fail2ban.org
 Code status:
 ------------
 
-* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)
 
 * [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=master)](https://coveralls.io/r/fail2ban/fail2ban)
 

From 90d6a4a6cd8c2de9004239039c82dba80e562384 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 9 May 2013 22:46:59 -0400
Subject: [PATCH 276/544] ENH: consistent operation of formatExceptionInfo +
 unittest for it

---
 common/helpers.py         | 12 ++++++-----
 fail2ban-testcases        |  3 +++
 server/asyncserver.py     |  4 ++--
 testcases/misctestcase.py | 44 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 7 deletions(-)
 create mode 100644 testcases/misctestcase.py

diff --git a/common/helpers.py b/common/helpers.py
index dba4c9d6..c0cf052e 100644
--- a/common/helpers.py
+++ b/common/helpers.py
@@ -17,11 +17,7 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-# Author: Cyril Jaquier
-# Author: Arturo 'Buanzo' Busleiman
-# 
-
-__author__ = "Cyril Jaquier"
+__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman"
 __copyright__ = "Copyright (c) 2009 Cyril Jaquier"
 __license__ = "GPL"
 
@@ -33,6 +29,12 @@ def formatExceptionInfo():
 	excName = cla.__name__
 	try:
 		excArgs = exc.__dict__["args"]
+		# Assure that we always return a string, without unneeded
+		# 'decorations' with python <= 2.5 where args would be a tuple
+		if isinstance(excArgs, tuple) and len(excArgs) == 1:
+			excArgs = excArgs[0]
+		excArgs = str(excArgs)
 	except KeyError:
+		# And always provide a string output
 		excArgs = str(exc)
 	return (excName, excArgs)
diff --git a/fail2ban-testcases b/fail2ban-testcases
index e00cc908..4e6689ea 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -36,6 +36,7 @@ from testcases import servertestcase
 from testcases import datedetectortestcase
 from testcases import actiontestcase
 from testcases import sockettestcase
+from testcases import misctestcase
 
 from testcases.utils import FormatterWithTraceBack
 from server.mytime import MyTime
@@ -150,6 +151,8 @@ tests.addTest(unittest.makeSuite(clientreadertestcase.JailReaderTest))
 tests.addTest(unittest.makeSuite(clientreadertestcase.JailsReaderTest))
 # CSocket and AsyncServer
 tests.addTest(unittest.makeSuite(sockettestcase.Socket))
+# Misc helpers
+tests.addTest(unittest.makeSuite(misctestcase.HelpersTest))
 
 # Filter
 if not opts.no_network:
diff --git a/server/asyncserver.py b/server/asyncserver.py
index 87f91633..62a5dd8b 100644
--- a/server/asyncserver.py
+++ b/server/asyncserver.py
@@ -70,8 +70,8 @@ class RequestHandler(asynchat.async_chat):
 		self.close_when_done()
 		
 	def handle_error(self):
-		e1,e2 = helpers.formatExceptionInfo()
-		logSys.error("Unexpected communication error: "+e2)
+		e1, e2 = helpers.formatExceptionInfo()
+		logSys.error("Unexpected communication error: %s" % str(e2))
 		logSys.error(traceback.format_exc().splitlines())
 		self.close()
 		
diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
new file mode 100644
index 00000000..9b053c13
--- /dev/null
+++ b/testcases/misctestcase.py
@@ -0,0 +1,44 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+__author__ = "Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2013 Yaroslav Halchenko"
+__license__ = "GPL"
+
+import unittest
+from common.helpers import formatExceptionInfo
+
+class HelpersTest(unittest.TestCase):
+
+	def testFormatExceptionInfoBasic(self):
+		try:
+			raise ValueError("Very bad exception")
+		except:
+			name, args = formatExceptionInfo()
+			self.assertEqual(name, "ValueError")
+			self.assertEqual(args, "Very bad exception")
+
+	def testFormatExceptionConvertArgs(self):
+		try:
+			raise ValueError("Very bad", None)
+		except:
+			name, args = formatExceptionInfo()
+			self.assertEqual(name, "ValueError")
+			# might be fragile due to ' vs "
+			self.assertEqual(args, "('Very bad', None)")

From 26715d5e5e4b1671ce6cbfabe13a6495a9f64b75 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 9 May 2013 23:08:20 -0400
Subject: [PATCH 277/544] ENH: basic test for setup.py itself (when applicable,
 should greatly improve coverage ;) )

---
 fail2ban-testcases        |  1 +
 testcases/misctestcase.py | 38 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 4e6689ea..94b8208e 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -153,6 +153,7 @@ tests.addTest(unittest.makeSuite(clientreadertestcase.JailsReaderTest))
 tests.addTest(unittest.makeSuite(sockettestcase.Socket))
 # Misc helpers
 tests.addTest(unittest.makeSuite(misctestcase.HelpersTest))
+tests.addTest(unittest.makeSuite(misctestcase.SetupTest))
 
 # Filter
 if not opts.no_network:
diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index 9b053c13..e3c20882 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -21,7 +21,12 @@ __author__ = "Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-import unittest
+import os, sys, unittest
+import tempfile
+import shutil
+
+from glob import glob
+
 from common.helpers import formatExceptionInfo
 
 class HelpersTest(unittest.TestCase):
@@ -42,3 +47,34 @@ class HelpersTest(unittest.TestCase):
 			self.assertEqual(name, "ValueError")
 			# might be fragile due to ' vs "
 			self.assertEqual(args, "('Very bad', None)")
+
+
+class SetupTest(unittest.TestCase):
+
+	def setUp(self):
+		setup = os.path.join(os.path.dirname(__file__), '..', 'setup.py')
+		self.setup = os.path.exists(setup) and setup or None
+		if not self.setup and sys.version_info >= (2,7): # running not out of the source
+			raise unittest.SkipTest(
+				"Seems to be running not out of source distribution"
+				" -- cannot locate setup.py")
+
+	def testSetupInstallRoot(self):
+		if not self.setup: return			  # if verbose skip didn't work out
+		tmp = tempfile.mkdtemp()
+		os.system("%s install --root=%s >/dev/null" % (self.setup, tmp))
+
+		def addpath(l):
+			return [os.path.join(tmp, x) for x in l]
+
+		self.assertEqual(sorted(glob('%s/*' % tmp)),
+						 addpath(['etc', 'usr', 'var']))
+
+		# Assure presence of some files we expect to see in the installation
+		for f in ('etc/fail2ban/fail2ban.conf',
+				  'etc/fail2ban/jail.conf'):
+			self.assertTrue(os.path.exists(os.path.join(tmp, f)),
+							msg="Can't find %s" % f)
+
+		# clean up
+		shutil.rmtree(tmp)

From e70d01bc1010a2ad617b3c2d5ecbc8d8bdb35459 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 9 May 2013 23:16:03 -0400
Subject: [PATCH 278/544] TST: cover few more lines in fail2banreader.py

---
 testcases/clientreadertestcase.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index fad16f04..faa8dcd6 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -160,6 +160,15 @@ class JailsReaderTest(unittest.TestCase):
 		self.assertEqual(opts['socket'], '/var/run/fail2ban/fail2ban.sock')
 		self.assertEqual(opts['pidfile'], '/var/run/fail2ban/fail2ban.pid')
 
+		configurator.getOptions()
+		configurator.convertToProtocol()
+		commands = configurator.getConfigStream()
+		# and there is logging information left to be passed into the
+		# server
+		self.assertEqual(commands,
+						 [['set', 'loglevel', 3],
+						  ['set', 'logtarget', '/var/log/fail2ban.log']])
+
 		# and if we force change configurator's fail2ban's baseDir
 		# there should be an error message (test visually ;) --
 		# otherwise just a code smoke test)

From dc05eee0f502e94b10c3d6cdf0cda1fcc7f93b49 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 9 May 2013 23:42:51 -0400
Subject: [PATCH 279/544] TST: Some primarily smoke tests for tests utils

---
 fail2ban-testcases        |  1 +
 testcases/misctestcase.py | 54 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 94b8208e..5ad7494e 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -154,6 +154,7 @@ tests.addTest(unittest.makeSuite(sockettestcase.Socket))
 # Misc helpers
 tests.addTest(unittest.makeSuite(misctestcase.HelpersTest))
 tests.addTest(unittest.makeSuite(misctestcase.SetupTest))
+tests.addTest(unittest.makeSuite(misctestcase.TestsUtilsTest))
 
 # Filter
 if not opts.no_network:
diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index e3c20882..89be2b17 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -21,12 +21,14 @@ __author__ = "Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
+import logging
 import os, sys, unittest
 import tempfile
 import shutil
 
 from glob import glob
 
+from utils import mbasename, TraceBack, FormatterWithTraceBack
 from common.helpers import formatExceptionInfo
 
 class HelpersTest(unittest.TestCase):
@@ -78,3 +80,55 @@ class SetupTest(unittest.TestCase):
 
 		# clean up
 		shutil.rmtree(tmp)
+
+class TestsUtilsTest(unittest.TestCase):
+
+	def testmbasename(self):
+		self.assertEqual(mbasename("sample.py"), 'sample')
+		self.assertEqual(mbasename("/long/path/sample.py"), 'sample')
+		# this one would include only the directory for the __init__ and base files
+		self.assertEqual(mbasename("/long/path/__init__.py"), 'path.__init__')
+		self.assertEqual(mbasename("/long/path/base.py"), 'path.base')
+		self.assertEqual(mbasename("/long/path/base"), 'path.base')
+
+	def testTraceBack(self):
+		# pretty much just a smoke test since tests runners swallow all the detail
+
+		for compress in True, False:
+			tb = TraceBack(compress=compress)
+
+			def func_raise():
+				raise ValueError()
+
+			def deep_function(i):
+				if i: deep_function(i-1)
+				else: func_raise()
+
+			try:
+				print deep_function(3)
+			except ValueError:
+				s = tb()
+			self.assertTrue('>' in s)
+			self.assertTrue(':' in s)
+
+
+	def testFormatterWithTraceBack(self):
+		from StringIO import StringIO
+		strout = StringIO()
+		Formatter = FormatterWithTraceBack
+
+		# and both types of traceback at once
+		fmt = ' %(tb)s | %(tbc)s : %(message)s'
+		logSys = logging.getLogger("fail2ban_tests")
+		out = logging.StreamHandler(strout)
+		out.setFormatter(Formatter(fmt))
+		logSys.addHandler(out)
+		logSys.error("XXX")
+
+		s = strout.getvalue()
+		self.assertTrue(s.rstrip().endswith(': XXX'))
+		pindex = s.index('|')
+
+		# in this case compressed and not should be the same (?)
+		self.assertTrue(pindex > 10)	  # we should have some traceback
+		self.assertEqual(s[:pindex], s[pindex+1:pindex*2 + 1])

From 281d310b7eb45bca49c0a57a32a6c430f6bfddac Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 10 May 2013 00:02:49 -0400
Subject: [PATCH 280/544] ENH: actually tune up TraceBack to determine
 "unittest" portions of the stack across all python  releases

before for 2.7 it would spit out "suite" and other components of unittest module
---
 testcases/misctestcase.py | 2 +-
 testcases/utils.py        | 9 +++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index 89be2b17..c9449407 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -108,7 +108,7 @@ class TestsUtilsTest(unittest.TestCase):
 				print deep_function(3)
 			except ValueError:
 				s = tb()
-			self.assertTrue('>' in s)
+			self.assertFalse('>' in s)  # There is only "fail2ban-testcases" in this case, no true traceback
 			self.assertTrue(':' in s)
 
 
diff --git a/testcases/utils.py b/testcases/utils.py
index 6b894193..87aab915 100644
--- a/testcases/utils.py
+++ b/testcases/utils.py
@@ -61,11 +61,12 @@ class TraceBack(object):
 
 	def __call__(self):
 		ftb = traceback.extract_stack(limit=100)[:-2]
-		entries = [[mbasename(x[0]), str(x[1])] for x in ftb]
-		entries = [ e for e in entries
-					if not e[0] in ['unittest', 'logging.__init__' ]]
+		entries = [[mbasename(x[0]), dirname(x[0]), str(x[1])] for x in ftb]
+		entries = [ [e[0], e[2]] for e in entries
+					if not (e[0] in ['unittest', 'logging.__init__']
+							or e[1].endswith('/unittest'))]
 
-		# lets make it more consize
+		# lets make it more concise
 		entries_out = [entries[0]]
 		for entry in entries[1:]:
 			if entry[0] == entries_out[-1][0]:

From bdc86e5f1d1ff9dd09f46e11491671d515e3b4a2 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 10 May 2013 11:17:04 -0400
Subject: [PATCH 281/544] ENH: use the same python executable for setup.py test

This doesn't anyhow resolve gh-161 which was revealed consistently on Debian sytem
after adding this testSetupInstallRoot
---
 testcases/misctestcase.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index c9449407..4a6b4241 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -64,7 +64,8 @@ class SetupTest(unittest.TestCase):
 	def testSetupInstallRoot(self):
 		if not self.setup: return			  # if verbose skip didn't work out
 		tmp = tempfile.mkdtemp()
-		os.system("%s install --root=%s >/dev/null" % (self.setup, tmp))
+		os.system("%s %s install --root=%s >/dev/null"
+				  % (sys.executable, self.setup, tmp))
 
 		def addpath(l):
 			return [os.path.join(tmp, x) for x in l]

From 8161038987608d58c5202977048a8b3f6a462ad6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 10 May 2013 11:40:12 -0400
Subject: [PATCH 282/544] ENH: strengthen detection of working pyinotify

Even though import might work -- pyinotify might be dysfunctional.
Check by creating/deleting a dummy WatchManager upon import
---
 server/filterpyinotify.py | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/server/filterpyinotify.py b/server/filterpyinotify.py
index 4c270d2e..cea82711 100644
--- a/server/filterpyinotify.py
+++ b/server/filterpyinotify.py
@@ -23,19 +23,28 @@ __author__ = "Cyril Jaquier, Lee Clemens, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Lee Clemens, 2012 Yaroslav Halchenko"
 __license__ = "GPL"
 
+import time, logging, pyinotify
+
 from distutils.version import LooseVersion
+from os.path import dirname, sep as pathsep
 
 from failmanager import FailManagerEmpty
 from filter import FileFilter
 from mytime import MyTime
 
-import time, logging, pyinotify
 
 if not hasattr(pyinotify, '__version__') \
   or LooseVersion(pyinotify.__version__) < '0.8.3':
   raise ImportError("Fail2Ban requires pyinotify >= 0.8.3")
 
-from os.path import dirname, sep as pathsep
+# Verify that pyinotify is functional on this system
+# Even though imports -- might be dysfunctional, e.g. as on kfreebsd
+try:
+	manager = pyinotify.WatchManager()
+	del manager
+except Exception, e:
+	raise ImportError("Pyinotify is probably not functional on this system: %s"
+					  % str(e))
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")

From 8af3ffb332a3e0aecabe09e97c6805169f72421e Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 10 May 2013 16:54:53 +0100
Subject: [PATCH 283/544] BF: Fix for filterpoll incorrectly checking for
 jailless state

---
 server/filterpoll.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/filterpoll.py b/server/filterpoll.py
index 8a6a88e7..20cde0ca 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -104,7 +104,8 @@ class FilterPoll(FileFilter):
 				time.sleep(self.getSleepTime())
 			else:
 				time.sleep(self.getSleepTime())
-		logSys.debug((self.jail and self.jail.getName() or "jailless") +
+		logSys.debug(
+			(self.jail is not None and self.jail.getName() or "jailless") +
 					 " filter terminated")
 		return True
 
@@ -130,7 +131,7 @@ class FilterPoll(FileFilter):
 			self.__file404Cnt[filename] += 1
 			if self.__file404Cnt[filename] > 2:
 				logSys.warn("Too many errors. Setting the jail idle")
-				if self.jail:
+				if self.jail is not None:
 					self.jail.setIdle(True)
 				else:
 					logSys.warn("No jail is assigned to %s" % self)

From 90b8433ac5113d17b458005ee77dc89d692cbd52 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 21:42:59 -0400
Subject: [PATCH 284/544] DOC: inline commends with ';' are in effect only if
 ';' follows as space

---
 README.Solaris       | 2 +-
 config/fail2ban.conf | 2 +-
 config/jail.conf     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.Solaris b/README.Solaris
index 49056062..10a5f88c 100644
--- a/README.Solaris
+++ b/README.Solaris
@@ -71,7 +71,7 @@ OPT: Create /etc/fail2ban/fail2ban.local containing:
 
 # Fail2Ban main configuration file
 #
-# Comments: use '#' for comment lines and ';' for inline comments
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
 #
 # Changes:  in most of the cases you should not modify this
 #           file, but provide customizations in fail2ban.local file, e.g.:
diff --git a/config/fail2ban.conf b/config/fail2ban.conf
index 1888eddb..4094c8cd 100644
--- a/config/fail2ban.conf
+++ b/config/fail2ban.conf
@@ -1,6 +1,6 @@
 # Fail2Ban main configuration file
 #
-# Comments: use '#' for comment lines and ';' for inline comments
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
 #
 # Changes:  in most of the cases you should not modify this
 #           file, but provide customizations in fail2ban.local file, e.g.:
diff --git a/config/jail.conf b/config/jail.conf
index 33453ab5..ec5b32ef 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -1,6 +1,6 @@
 # Fail2Ban jail specifications file
 #
-# Comments: use '#' for comment lines and ';' for inline comments
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
 #
 # Changes:  in most of the cases you should not modify this
 #           file, but provide customizations in jail.local file, e.g.:

From 571ff33fde2c43b47c9a22ebdff020bdf77a3c17 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 22:19:17 -0400
Subject: [PATCH 285/544] ENH: issue a warning if jail name is longer than 19
 symbols (Close #222)

---
 fail2ban-testcases          |  1 +
 server/jail.py              |  6 +++++-
 testcases/servertestcase.py | 10 ++++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 5ad7494e..0bd70259 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -140,6 +140,7 @@ else: # pragma: no cover
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+tests.addTest(unittest.makeSuite(servertestcase.JailTests))
 tests.addTest(unittest.makeSuite(actiontestcase.ExecuteAction))
 # FailManager
 tests.addTest(unittest.makeSuite(failmanagertestcase.AddFailure))
diff --git a/server/jail.py b/server/jail.py
index dee64e7f..5e60ec7f 100644
--- a/server/jail.py
+++ b/server/jail.py
@@ -38,7 +38,7 @@ class Jail:
 	_BACKENDS = ['pyinotify', 'gamin', 'polling']
 
 	def __init__(self, name, backend = "auto"):
-		self.__name = name
+		self.setName(name)
 		self.__queue = Queue.Queue()
 		self.__filter = None
 		logSys.info("Creating new jail '%s'" % self.__name)
@@ -102,6 +102,10 @@ class Jail:
 		self.__filter = FilterPyinotify(self)
 	
 	def setName(self, name):
+		if len(name) >= 20:
+			logSys.warning("Jail name %r might be too long and some commands "
+							"might not function correctly. Please shorten"
+							% name)
 		self.__name = name
 	
 	def getName(self):
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index ff3f2e88..0a5593e3 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -26,6 +26,7 @@ __license__ = "GPL"
 
 import unittest, socket, time, tempfile, os
 from server.server import Server
+from server.jail import Jail
 from common.exceptions import UnknownJailException
 
 class StartStop(unittest.TestCase):
@@ -507,3 +508,12 @@ class TransmitterLogging(TransmitterBase):
 		self.setGetTest("loglevel", "-1", -1)
 		self.setGetTest("loglevel", "0", 0)
 		self.setGetTestNOK("loglevel", "Bird")
+
+
+class JailTests(unittest.TestCase):
+
+	def testLongName(self):
+		# Just a smoke test for now
+		longname = "veryveryverylongname"
+		jail = Jail(longname)
+		self.assertEqual(jail.getName(), longname)

From 21474884e0d02902f147d3ccc67af3607c5e739d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 22:55:02 -0400
Subject: [PATCH 286/544] ENH: now we know that logging handlers closing was
 still buggy in 2.6.2

---
 server/server.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/server.py b/server/server.py
index a8cf1c2f..773fdf0b 100644
--- a/server/server.py
+++ b/server/server.py
@@ -377,10 +377,11 @@ class Server:
 					handler.flush()
 					handler.close()
 				except (ValueError, KeyError): # pragma: no cover
-					if sys.version_info >= (2,6):
-						raise
-					# is known to be thrown after logging was shutdown once
+					# Is known to be thrown after logging was shutdown once
 					# with older Pythons -- seems to be safe to ignore there
+					# At least it was still failing on 2.6.2-0ubuntu1 (jaunty)
+					if sys.version_info >= (2,6,3):
+						raise
 			# tell the handler to use this format
 			hdlr.setFormatter(formatter)
 			logging.getLogger("fail2ban").addHandler(hdlr)

From f345c4d7dc4c3261d0b1bb04b92356b438b48320 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 23:22:50 -0400
Subject: [PATCH 287/544] ENH: include explicit list of new files which should
 not be there upon "install --root"

that is to figure out what gets there on failing travis tests:

e.g. https://travis-ci.org/fail2ban/fail2ban/jobs/7112324
---
 testcases/misctestcase.py | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index 4a6b4241..c63d4cae 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -50,6 +50,15 @@ class HelpersTest(unittest.TestCase):
 			# might be fragile due to ' vs "
 			self.assertEqual(args, "('Very bad', None)")
 
+# based on
+# http://stackoverflow.com/questions/2186525/use-a-glob-to-find-files-recursively-in-python
+def recursive_glob(treeroot, pattern):
+	import fnmatch, os
+	results = []
+	for base, dirs, files in os.walk(treeroot):
+		goodfiles = fnmatch.filter(dirs + files, pattern)
+		results.extend(os.path.join(base, f) for f in goodfiles)
+	return results
 
 class SetupTest(unittest.TestCase):
 
@@ -70,8 +79,23 @@ class SetupTest(unittest.TestCase):
 		def addpath(l):
 			return [os.path.join(tmp, x) for x in l]
 
-		self.assertEqual(sorted(glob('%s/*' % tmp)),
-						 addpath(['etc', 'usr', 'var']))
+		def strippath(l):
+			return [x[len(tmp)+1:] for x in l]
+
+		got = strippath(sorted(glob('%s/*' % tmp)))
+		need = ['etc', 'usr', 'var']
+
+		if got != need:
+			files = {}
+			for missing in set(got).difference(need):
+				missing_full = os.path.join(tmp, missing)
+				files[missing] = os.path.exists(missing_full) \
+					and strippath(recursive_glob(missing_full, '*')) or None
+
+			self.assertEqual(
+				got, need,
+				msg="Got: %s Needed: %s under %s. Files under new paths: %s"
+				% (got, need, tmp, files))
 
 		# Assure presence of some files we expect to see in the installation
 		for f in ('etc/fail2ban/fail2ban.conf',

From 1b301d723d4b2b8e66ca083d62645d60ec5d264e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 23:27:32 -0400
Subject: [PATCH 288/544] ENH: also print the failing traceback line in case of
 failure

Also to troubleshoot
https://travis-ci.org/fail2ban/fail2ban/jobs/7112324
---
 testcases/misctestcase.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index c63d4cae..d63f8afc 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -133,8 +133,8 @@ class TestsUtilsTest(unittest.TestCase):
 				print deep_function(3)
 			except ValueError:
 				s = tb()
-			self.assertFalse('>' in s)  # There is only "fail2ban-testcases" in this case, no true traceback
-			self.assertTrue(':' in s)
+			self.assertFalse('>' in s, msg="'>' present in %r" % s)  # There is only "fail2ban-testcases" in this case, no true traceback
+			self.assertTrue(':' in s, msg="no ':' in %r" % s)
 
 
 	def testFormatterWithTraceBack(self):

From 6aed705f3dd3567256666304c72e2eecedf5f0a3 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 23:42:01 -0400
Subject: [PATCH 289/544] BF: (travis) if tests ran under coverage -- there is
 a traceback parts to report (thus > would be present)

---
 testcases/misctestcase.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index d63f8afc..84eafa01 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -133,7 +133,13 @@ class TestsUtilsTest(unittest.TestCase):
 				print deep_function(3)
 			except ValueError:
 				s = tb()
-			self.assertFalse('>' in s, msg="'>' present in %r" % s)  # There is only "fail2ban-testcases" in this case, no true traceback
+
+			# if we run it through 'coverage' (e.g. on travis) then we
+			# would get a traceback
+			if 'coverage' in s:
+				self.assertTrue('>' in s, msg="no '>' in %r" % s)
+			else:
+				self.assertFalse('>' in s, msg="'>' present in %r" % s)  # There is only "fail2ban-testcases" in this case, no true traceback
 			self.assertTrue(':' in s, msg="no ':' in %r" % s)
 
 

From 04bf9eceb64059afce466dc5b78bfe1c33a9c25b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 12 May 2013 23:42:57 -0400
Subject: [PATCH 290/544] BF: (travis) relax the test for needed to be
 presented installed directories -- allow new

on travis scripts install into user's home by default
---
 testcases/misctestcase.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index 84eafa01..08c8fc30 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -85,7 +85,11 @@ class SetupTest(unittest.TestCase):
 		got = strippath(sorted(glob('%s/*' % tmp)))
 		need = ['etc', 'usr', 'var']
 
-		if got != need:
+		# if anything is missing
+		if set(need).difference(got):
+			#  below code was actually to print out not missing but
+			#  rather files in 'excess'.  Left in place in case we
+			#  decide to revert to such more strict test
 			files = {}
 			for missing in set(got).difference(need):
 				missing_full = os.path.join(tmp, missing)

From a7f41af67182c9baae351f9261b5a149ebb5af9b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 13 May 2013 11:00:44 -0400
Subject: [PATCH 291/544] All the (version) updates for the release of 0.8.9

---
 ChangeLog             | 4 ++--
 README.md             | 6 +++---
 common/version.py     | 6 +++---
 man/fail2ban-client.1 | 7 +++++--
 man/fail2ban-regex.1  | 4 ++--
 man/fail2ban-server.1 | 4 ++--
 6 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b8d39b3a..e3ed79a7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,10 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.9)                                              2013/04/XX
+Fail2Ban (version 0.8.9)                                              2013/05/13
 ================================================================================
 
-ver. 0.8.9 (2013/05/XX) - wanna-be-stable
+ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------
 
 Originally targeted as a bugfix release, it incorporated many new
diff --git a/README.md b/README.md
index 65183b92..91deaf19 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.8.8                  2012/07/31
+                       v0.8.9                  2013/05/13
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors 
 
@@ -30,8 +30,8 @@ Optional:
 
 To install, just do:
 
-    tar xvfj fail2ban-0.8.8.tar.bz2
-    cd fail2ban-0.8.8
+    tar xvfj fail2ban-0.8.9.tar.bz2
+    cd fail2ban-0.8.9
     python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
diff --git a/common/version.py b/common/version.py
index df3b97c3..e6f948cd 100644
--- a/common/version.py
+++ b/common/version.py
@@ -18,10 +18,10 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 # Author: Cyril Jaquier
-# 
+#
 
 __author__ = "Cyril Jaquier, Yaroslav Halchenko"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-version = "0.8.8"
+version = "0.8.9"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index 431e690f..d7d620bc 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
-.TH FAIL2BAN-CLIENT "1" "March 2013" "fail2ban-client v0.8.8" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "May 2013" "fail2ban-client v0.8.9" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR] \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.8.8 reads log file that contains password failure report
+Fail2Ban v0.8.9 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -62,6 +62,9 @@ server
 .TP
 \fBping\fR
 tests if the server is alive
+.TP
+\fBhelp\fR
+return this output
 .IP
 LOGGING
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index 09b9d6b0..a42d96d5 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
-.TH FAIL2BAN-REGEX "1" "March 2013" "fail2ban-regex v0.8.8" "User Commands"
+.TH FAIL2BAN-REGEX "1" "May 2013" "fail2ban-regex v0.8.9" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 [\fIOPTIONS\fR] \fI<LOG> <REGEX> \fR[\fIIGNOREREGEX\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.8 reads log file that contains password failure report
+Fail2Ban v0.8.9 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 3f6b013f..43e9d6d4 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
-.TH FAIL2BAN-SERVER "1" "March 2013" "fail2ban-server v0.8.8" "User Commands"
+.TH FAIL2BAN-SERVER "1" "May 2013" "fail2ban-server v0.8.9" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.8 reads log file that contains password failure report
+Fail2Ban v0.8.9 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 152c619dc401e29089b7a2220eff6240758f3eb3 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 13 May 2013 11:24:07 -0400
Subject: [PATCH 292/544] BF: add missing files to MANIFEST (I think we shoult
 not rely on sdist anyways -- 'git tag' tarballs are more thorough ;) )

---
 MANIFEST | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/MANIFEST b/MANIFEST
index 0537abae..5491c7d5 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -47,6 +47,26 @@ testcases/files/testcase-usedns.log
 testcases/files/logs/bsd/syslog-plain.txt
 testcases/files/logs/bsd/syslog-v.txt
 testcases/files/logs/bsd/syslog-vv.txt
+testcases/files/logs/apache-overflows
+testcases/files/logs/assp
+testcases/files/logs/asterisk
+testcases/files/logs/dovecot
+testcases/files/logs/exim
+testcases/files/logs/lighttpd
+testcases/files/logs/mysqld.log
+testcases/files/logs/named-refused
+testcases/files/logs/pam-generic
+testcases/files/logs/postfix
+testcases/files/logs/proftpd
+testcases/files/logs/pure-ftpd
+testcases/files/logs/roundcube-auth
+testcases/files/logs/sasl
+testcases/files/logs/sogo-auth
+testcases/files/logs/sshd
+testcases/files/logs/sshd-ddos
+testcases/files/logs/vsftpd
+testcases/files/logs/webmin-auth
+testcases/files/logs/wu-ftpd
 testcases/banmanagertestcase.py
 testcases/failmanagertestcase.py
 testcases/clientreadertestcase.py
@@ -60,6 +80,8 @@ testcases/files/testcase01.log
 testcases/files/testcase02.log
 testcases/files/testcase03.log
 testcases/files/testcase04.log
+testcases/misctestcase.py
+testcases/utils.py
 setup.py
 setup.cfg
 common/__init__.py
@@ -101,6 +123,9 @@ config/filter.d/dropbear.conf
 config/filter.d/lighttpd-auth.conf
 config/filter.d/recidive.conf
 config/filter.d/roundcube-auth.conf
+config/filter.d/assp.conf
+config/filter.d/mysqld-auth.conf
+config/filter.d/sogo-auth.conf
 config/action.d/bsd-ipfw.conf
 config/action.d/dummy.conf
 config/action.d/iptables-blocktype.conf
@@ -153,3 +178,7 @@ files/cacti/README
 files/nagios/check_fail2ban
 files/nagios/f2ban.txt
 files/bash-completion
+files/fail2ban-tmpfiles.conf
+files/fail2ban.service
+files/ipmasq-ZZZzzz_fail2ban.rul
+files/nagios/README

From 725d666ee69735e65d85597b5de70eff7faf805e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 13 May 2013 12:56:21 -0400
Subject: [PATCH 293/544] Getting ready for further development

---
 ChangeLog         | 10 +++++++++-
 DEVELOP           |  4 +++-
 common/version.py |  2 +-
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index e3ed79a7..6f98cc11 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,9 +4,17 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.9)                                              2013/05/13
+Fail2Ban (version 0.8.9.dev)                                          2013/??/??
 ================================================================================
 
+ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
+-----------
+
+- Fixes
+- New Features
+- Enhancements
+
+
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------
 
diff --git a/DEVELOP b/DEVELOP
index 6ccb162e..f067a865 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -338,8 +338,10 @@ Post Release
 
 Add the following to the top of the ChangeLog
 
-ver. 0.8.9 (2013/XX/XXX) - wanna-be-stable
+ver. 0.8.11 (2013/XX/XXX) - wanna-be-stable
 - Fixes
 - New Features
 - Enhancements
 
+and adjust common/version.py to carry .dev suffix to signal
+a version under development.
diff --git a/common/version.py b/common/version.py
index e6f948cd..86c45760 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-version = "0.8.9"
+version = "0.8.9.dev"

From 5c8fb68a2cd803a820bc624ac47bf8462fb5cd4d Mon Sep 17 00:00:00 2001
From: silviogarbes <silviogarbes@gmail.com>
Date: Tue, 14 May 2013 08:04:11 -0300
Subject: [PATCH 294/544] Update asterisk.conf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Para ficar compatível com asterisk 11
---
 config/filter.d/asterisk.conf | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 9ed69804..8ae67ff8 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -20,19 +20,23 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Wrong password$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - No matching peer found$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)$
+failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)$
+            NOTICE%(__pid_re)s.* .*: Call from '.*' \(<HOST>:.*\) to extension '.*' rejected because extension not found in context 'default'.$
             NOTICE%(__pid_re)s <HOST> failed to authenticate as '.*'$
             NOTICE%(__pid_re)s .*: No registration for peer '.*' \(from <HOST>\)$
             NOTICE%(__pid_re)s .*: Host <HOST> failed MD5 authentication for '.*' (.*)$
             NOTICE%(__pid_re)s .*: Failed to authenticate user .*@<HOST>.*$
+            SECURITY%(__pid_re)s .*: SecurityEvent="InvalidAccountID",EventTV=".*",Severity=".*",Service=".*",EventVersion=".*",AccountID=".*",SessionID=".*",LocalAddress=".*",RemoteAddress=".*/.*/<HOST>/.*"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
 ignoreregex =
+
+

From 52fa5f19b0d82bd0614db49460496bf7aa949371 Mon Sep 17 00:00:00 2001
From: silviogarbes <silviogarbes@gmail.com>
Date: Tue, 14 May 2013 12:58:43 -0300
Subject: [PATCH 295/544] Update asterisk

---
 testcases/files/logs/asterisk | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index 4715f608..21cc8826 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -9,3 +9,6 @@
 [2012-02-13 17:39:20] NOTICE[1638] chan_iax2.c: No registration for peer 'Fail2ban' (from 1.2.3.4)
 [2012-02-13 17:44:26] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed MD5 authentication for 'Fail2ban' (e7df7cd2ca07f4f1ab415d457a6e1c13 != 53ac4bc41ee4ec77888ed4aa50677247)
 [2012-02-13 17:37:07] NOTICE[1638] chan_sip.c: Failed to authenticate user "Fail2ban" <sip:301@1.2.3.4>;tag=1r698745234
+[2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (176.58.76.57:10836) to extension '0972598285108' rejected because extension not found in context 'default'.
+[2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@200.251.240.30' failed for '193.238.16.99:23930' - No matching peer found
+[2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/200.251.240.30/5060",RemoteAddress="IPV4/UDP/82.205.8.77/5070"

From 89e06bba15df7b56804134b5649564254bcc0843 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 24 May 2013 11:15:46 -0400
Subject: [PATCH 296/544] BF: blocktype must be defined within [Init] -- adding
 [Init] section.  Close #232

---
 ChangeLog                      | 5 ++++-
 config/action.d/route.conf     | 2 ++
 config/action.d/shorewall.conf | 2 ++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 6f98cc11..90a57f75 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,7 +10,10 @@ Fail2Ban (version 0.8.9.dev)                                          2013/??/??
 ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
 -----------
 
-- Fixes
+- Fixes:
+  Yaroslav Halchenko
+   * action.d/{route,shorewall}.conf - blocktype must be defined
+     within [Init].  Closes gh-232
 - New Features
 - Enhancements
 
diff --git a/config/action.d/route.conf b/config/action.d/route.conf
index bb4ec8e1..123245e5 100644
--- a/config/action.d/route.conf
+++ b/config/action.d/route.conf
@@ -18,6 +18,8 @@
 actionban   = ip route add <blocktype> <ip>
 actionunban = ip route del <blocktype> <ip>
 
+[Init]
+
 # Option:  blocktype
 # Note:    Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
 # Values:  STRING
diff --git a/config/action.d/shorewall.conf b/config/action.d/shorewall.conf
index b165c701..81ac0518 100644
--- a/config/action.d/shorewall.conf
+++ b/config/action.d/shorewall.conf
@@ -48,6 +48,8 @@ actionban = shorewall <blocktype> <ip>
 #
 actionunban = shorewall allow <ip>
 
+[Init]
+
 # Option:  blocktype
 # Note:    This is what the action does with rules.
 #          See man page of shorewall for options that include drop, logdrop, reject, or logreject

From d2b1c73b92edf385908c270a0ca0e7418c12235d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 24 May 2013 14:33:08 -0400
Subject: [PATCH 297/544] CFG: assure actions for all the jails

---
 ChangeLog        | 4 +++-
 config/jail.conf | 8 +++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 90a57f75..a0eda6dd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,7 +16,9 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
      within [Init].  Closes gh-232
 - New Features
 - Enhancements
-
+  Yaroslav Halchenko
+   * jail.conf -- assure all jails have actions and remove unused
+     ports specifications
 
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------
diff --git a/config/jail.conf b/config/jail.conf
index ec5b32ef..d3a23920 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -239,10 +239,8 @@ logpath  = /var/log/roundcube/userlogins
 
 enabled  = false
 filter   = sogo-auth
-port     = http, https
 # without proxy this would be:
 # port    = 20000
-
 action   = iptables[name=SOGo, port="http,https"]
 logpath  = /var/log/sogo/sogo.log
 
@@ -253,7 +251,7 @@ logpath  = /var/log/sogo/sogo.log
 [php-url-fopen]
 
 enabled = false
-port    = http,https
+action  = iptables[name=php-url-open, port="http,https"]
 filter  = php-url-fopen
 logpath = /var/www/*/logs/access_log
 maxretry = 1
@@ -268,8 +266,8 @@ maxretry = 1
 [lighttpd-fastcgi]
 
 enabled = false
-port    = http,https
 filter  = lighttpd-fastcgi
+action  = iptables[name=lighttpd-fastcgi, port="http,https"]
 # adapt the following two items as needed
 logpath = /var/log/lighttpd/error.log
 maxretry = 2
@@ -280,8 +278,8 @@ maxretry = 2
 [lighttpd-auth]
 
 enabled = false
-port    = http,https
 filter  = lighttpd-auth
+action  = iptables[name=lighttpd-auth, port="http,https"]
 # adapt the following two items as needed
 logpath = /var/log/lighttpd/error.log
 maxretry = 2

From 8a57ffd2fb40aa4c4f28b58967d3af440e854933 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 24 May 2013 14:33:48 -0400
Subject: [PATCH 298/544] TST: test all stock jails to have actions and
 correctly specifying blocktype

---
 testcases/clientreadertestcase.py | 32 +++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index faa8dcd6..dbaa8ec2 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -144,10 +144,38 @@ class JailsReaderTest(unittest.TestCase):
 			# and warn on useDNS
 			self.assertTrue(['set', j, 'usedns', 'warn'] in comm_commands)
 			self.assertTrue(['start', j] in comm_commands)
+
 		# last commands should be the 'start' commands
 		self.assertEqual(comm_commands[-1][0], 'start')
-		# TODO: make sure that all of the jails have actions assigned,
-		#       otherwise it makes little to no sense
+
+		for j in  jails._JailsReader__jails:
+			actions = j._JailReader__actions
+			jail_name = j.getName()
+			# make sure that all of the jails have actions assigned,
+			# otherwise it makes little to no sense
+			self.assertTrue(len(actions),
+							msg="No actions found for jail %s" % jail_name)
+
+			# Test for presence of blocktype (in relation to gh-232)
+			for action in actions:
+				commands = action.convert()
+				file_ = action.getFile()
+				if '<blocktype>' in str(commands):
+					# Verify that it is among cInfo
+					self.assertTrue('blocktype' in action._ActionReader__cInfo)
+					# Verify that we have a call to set it up
+					blocktype_present = False
+					target_command = [ 'set', jail_name, 'setcinfo', file_, 'blocktype' ]
+					for command in commands:
+						if (len(command) > 5 and
+							command[:5] == target_command):
+							blocktype_present = True
+							continue
+					self.assertTrue(
+						blocktype_present,
+						msg="Found no %s command among %s"
+						    % (target_command, str(commands)) )
+
 
 	def testConfigurator(self):
 		configurator = Configurator()

From 244a96f9b3fb58867f073957714cf4d464cde80a Mon Sep 17 00:00:00 2001
From: Terence Namusonge <terence.namusonge@gmail.com>
Date: Sat, 25 May 2013 19:26:13 +0200
Subject: [PATCH 299/544] fixed failregex line for roundcube 0.9+

# Only works only if  log driver: is set to  'syslog'. this is becoz fail2ban fails to 'read' the line due to the
 brackets around the date timestamp on logline when log driver is set to file
---
 config/filter.d/roundcube-auth.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf
index 41766e31..7b153f44 100644
--- a/config/filter.d/roundcube-auth.conf
+++ b/config/filter.d/roundcube-auth.conf
@@ -1,6 +1,6 @@
 # Fail2Ban configuration file for roundcube web server
 #
-# Author: Teodor Micu & Yaroslav Halchenko
+# Author: Teodor Micu & Yaroslav Halchenko & terence namusonge
 #
 #
 
@@ -13,7 +13,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = FAILED login for .*. from <HOST>\s*$
+failregex = (FAILED login|Login failed) for .* from <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 098c88a67b8db83beaac6d9820e20ee109e3e6d0 Mon Sep 17 00:00:00 2001
From: Terence Namusonge <terence.namusonge@gmail.com>
Date: Sun, 26 May 2013 07:46:29 +0200
Subject: [PATCH 300/544] failregex when roundcube log driver is set to
 'syslog'

---
 testcases/files/logs/roundcube-auth | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth
index d16f7266..04e0faf5 100644
--- a/testcases/files/logs/roundcube-auth
+++ b/testcases/files/logs/roundcube-auth
@@ -1 +1,2 @@
 [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10
+May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47

From 7a4db4b4b9cd40671f3d444a45c7382c8fc3d637 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 26 May 2013 14:29:59 +0100
Subject: [PATCH 301/544] TST: Fix fail2ban.conf reader test for unreliable
 dictionary order

---
 testcases/clientreadertestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index dbaa8ec2..a8c60bf8 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -193,7 +193,7 @@ class JailsReaderTest(unittest.TestCase):
 		commands = configurator.getConfigStream()
 		# and there is logging information left to be passed into the
 		# server
-		self.assertEqual(commands,
+		self.assertEqual(sorted(commands),
 						 [['set', 'loglevel', 3],
 						  ['set', 'logtarget', '/var/log/fail2ban.log']])
 

From 567cd353a14c55b66ad8a6afd18758c3d6431901 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 29 May 2013 09:41:20 -0400
Subject: [PATCH 302/544] DOC: Changelog entry fro preceeding merge from
 Terence

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index a0eda6dd..f68fdded 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,6 +19,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
   Yaroslav Halchenko
    * jail.conf -- assure all jails have actions and remove unused
      ports specifications
+  Terence Namusonge
+   * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+
 
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------

From 39d32e0352922b21c8d7ba3a95a71ea65ebe07c1 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 29 May 2013 09:56:15 -0400
Subject: [PATCH 303/544] Changelog for previous PR

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index f68fdded..69b87b06 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -21,6 +21,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
      ports specifications
   Terence Namusonge
    * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+
+  Daniel Black
+   * files/suse-initd -- update to the copy from stock SUSE
 
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------

From 0f7b6093365e2f5dc8f2cf5e18660ea218358087 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 30 May 2013 09:43:39 +1000
Subject: [PATCH 304/544] ENH: port optional

---
 config/filter.d/asterisk.conf | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 8ae67ff8..8ff1dbbf 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -20,12 +20,12 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)$
+failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Wrong password$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - No matching peer found$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Username/auth name mismatch$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Device does not match ACL$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Peer is not supposed to register$
+            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - ACL error (permit/deny)$
             NOTICE%(__pid_re)s.* .*: Call from '.*' \(<HOST>:.*\) to extension '.*' rejected because extension not found in context 'default'.$
             NOTICE%(__pid_re)s <HOST> failed to authenticate as '.*'$
             NOTICE%(__pid_re)s .*: No registration for peer '.*' \(from <HOST>\)$

From 4cf402d60e42003d7bb1c10e22eb99ebb57d0f71 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 30 May 2013 10:15:58 +1000
Subject: [PATCH 305/544] ENH/BF: constrain regex. Fix ACL error regex

---
 config/filter.d/asterisk.conf | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 8ff1dbbf..f177f53c 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -20,18 +20,18 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Wrong password$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - No matching peer found$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Username/auth name mismatch$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Device does not match ACL$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - Peer is not supposed to register$
-            NOTICE%(__pid_re)s .*: Registration from '.*' failed for '<HOST>(:[0-9]+)?' - ACL error (permit/deny)$
-            NOTICE%(__pid_re)s.* .*: Call from '.*' \(<HOST>:.*\) to extension '.*' rejected because extension not found in context 'default'.$
-            NOTICE%(__pid_re)s <HOST> failed to authenticate as '.*'$
-            NOTICE%(__pid_re)s .*: No registration for peer '.*' \(from <HOST>\)$
-            NOTICE%(__pid_re)s .*: Host <HOST> failed MD5 authentication for '.*' (.*)$
-            NOTICE%(__pid_re)s .*: Failed to authenticate user .*@<HOST>.*$
-            SECURITY%(__pid_re)s .*: SecurityEvent="InvalidAccountID",EventTV=".*",Severity=".*",Service=".*",EventVersion=".*",AccountID=".*",SessionID=".*",LocalAddress=".*",RemoteAddress=".*/.*/<HOST>/.*"$
+failregex = NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Wrong password$
+            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - No matching peer found$
+            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Username/auth name mismatch$
+            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Device does not match ACL$
+            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Peer is not supposed to register$
+            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - ACL error \(permit/deny\)$
+            NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:.*\) to extension '[0-9]+' rejected because extension not found in context 'default'.$
+            NOTICE%(__pid_re)s [^:]+: Host <HOST> failed to authenticate as '[^']*'$
+            NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from <HOST>\)$
+            NOTICE%(__pid_re)s [^:]+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
+            NOTICE%(__pid_re)s [^:]+: Failed to authenticate user [^@]+@<HOST>.*$
+            SECURITY%(__pid_re)s [^:]+: SecurityEvent="InvalidAccountID",EventTV="[0-9-]+",Severity="[a-zA-Z]+",Service="[a-zA-Z]+",EventVersion="[0-9]+",AccountID="[0-9]+",SessionID="0x[0-9a-f]+",LocalAddress="IPV[46]/(UD|TC)P/[0-9a-fA-F:.]+/[0-9]+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/[0-9]+"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 916b5a7c234abe70599ddb889055ccc7c97c3c16 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 30 May 2013 10:24:48 +1000
Subject: [PATCH 306/544] TST: normalize logs to use example.com and 1.2.3.4 as
 IP

---
 testcases/files/logs/asterisk | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index 21cc8826..667eee02 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -1,14 +1,14 @@
 # Sample log files for asterisk 
-[2012-02-13 17:21:54] NOTICE[1638] chan_sip.c: Registration from '<sip:301@asclepios.eyepea.be>' failed for '1.2.3.4' - Wrong password
-[2012-02-13 17:18:22] NOTICE[1638] chan_sip.c: Registration from '<sip:301@asclepios.eyepea.be>' failed for '1.2.3.4' - No matching peer found
-[2012-02-13 17:21:21] NOTICE[1638] chan_sip.c: Registration from '<sip:301@asclepios.eyepea.be>' failed for '1.2.3.4' - Username/auth name mismatch
-[2012-02-13 17:32:01] NOTICE[1638] chan_sip.c: Registration from '<sip:301@asclepios.eyepea.be>' failed for '1.2.3.4' - Device does not match ACL
-[2012-02-13 17:34:10] NOTICE[1638] chan_sip.c: Registration from '<sip:301@asclepios.eyepea.be>' failed for '1.2.3.4' - Peer is not supposed to register
-[2012-02-13 17:36:23] NOTICE[1638] chan_sip.c: Registration from '<sip:301@asclepios.eyepea.be>' failed for '1.2.3.4' - ACL error (permit/deny)
+[2012-02-13 17:21:54] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Wrong password
+[2012-02-13 17:18:22] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - No matching peer found
+[2012-02-13 17:21:21] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Username/auth name mismatch
+[2012-02-13 17:32:01] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Device does not match ACL
+[2012-02-13 17:34:10] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Peer is not supposed to register
+[2012-02-13 17:36:23] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - ACL error (permit/deny)
 [2012-02-13 17:53:59] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed to authenticate as 'Fail2ban'
 [2012-02-13 17:39:20] NOTICE[1638] chan_iax2.c: No registration for peer 'Fail2ban' (from 1.2.3.4)
 [2012-02-13 17:44:26] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed MD5 authentication for 'Fail2ban' (e7df7cd2ca07f4f1ab415d457a6e1c13 != 53ac4bc41ee4ec77888ed4aa50677247)
 [2012-02-13 17:37:07] NOTICE[1638] chan_sip.c: Failed to authenticate user "Fail2ban" <sip:301@1.2.3.4>;tag=1r698745234
-[2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (176.58.76.57:10836) to extension '0972598285108' rejected because extension not found in context 'default'.
-[2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@200.251.240.30' failed for '193.238.16.99:23930' - No matching peer found
-[2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/200.251.240.30/5060",RemoteAddress="IPV4/UDP/82.205.8.77/5070"
+[2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '0972598285108' rejected because extension not found in context 'default'.
+[2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@1.2.3.4' failed for '1.2.3.4:23930' - No matching peer found
+[2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/1.2.3.4/5060",RemoteAddress="IPV4/UDP/1.2.3.4/5070"

From e54498f6fe15e0016cbc6c195817e6cc817e7147 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 30 May 2013 10:25:03 +1000
Subject: [PATCH 307/544] DOC: how to do filter enhancements

---
 DEVELOP | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/DEVELOP b/DEVELOP
index f067a865..00b7d6d5 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -34,9 +34,19 @@ When submitting pull requests on GitHub we ask you to:
 * Include a change to the relevant section of the ChangeLog; and
 * Include yourself in THANKS if not already there.
 
-Testing
+Filters
 =======
 
+* Include sample logs with 1.2.3.4 used for IP addresses and 
+  example.com/example.org used for DNS names
+* Ensure ./fail2ban-regex testcases/files/logs/{samplelog} config/filter.d/{filter}.conf
+  has matches for EVERY regex
+* Ensure regexs end with a $ and are restrictive as possible. E.g. not .* if
+ [0-9]+ is sufficient
+
+Code Testing
+============
+
 Existing tests can be run by executing `fail2ban-testcases`. This has options
 like --log-level that will probably be useful. `fail2ban-testcases --help` for
 full options.

From 28fc14d01080a2cd86baf6d9479fc5e4e7ce7585 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 30 May 2013 10:27:30 +1000
Subject: [PATCH 308/544] DOC: credits

---
 ChangeLog | 2 ++
 THANKS    | 1 +
 2 files changed, 3 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 69b87b06..5366135c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -23,6 +23,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
    * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+
   Daniel Black
    * files/suse-initd -- update to the copy from stock SUSE
+	silviogarbes
+	 * Updates to asterisk filter closes gh-227/gh-230.
 
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------
diff --git a/THANKS b/THANKS
index 9545d43a..0b74ba81 100644
--- a/THANKS
+++ b/THANKS
@@ -39,6 +39,7 @@ René Berber
 Robert Edeker
 Russell Odom
 Sireyessire
+silviogarbes
 Stephen Gildea
 Steven Hiscocks
 Tom Pike

From 05c88bd85d73ab15997dcd119bfc30c5f4a26065 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 30 May 2013 11:34:04 +1000
Subject: [PATCH 309/544] ENH: purge a few more .*

---
 config/filter.d/asterisk.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index f177f53c..589a188c 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -26,11 +26,11 @@ failregex = NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOS
             NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Device does not match ACL$
             NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Peer is not supposed to register$
             NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - ACL error \(permit/deny\)$
-            NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:.*\) to extension '[0-9]+' rejected because extension not found in context 'default'.$
+            NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:[0-9]+\) to extension '[0-9]+' rejected because extension not found in context 'default'.$
             NOTICE%(__pid_re)s [^:]+: Host <HOST> failed to authenticate as '[^']*'$
             NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from <HOST>\)$
             NOTICE%(__pid_re)s [^:]+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
-            NOTICE%(__pid_re)s [^:]+: Failed to authenticate user [^@]+@<HOST>.*$
+            NOTICE%(__pid_re)s [^:]+: Failed to authenticate user [^@]+@<HOST>\S*$
             SECURITY%(__pid_re)s [^:]+: SecurityEvent="InvalidAccountID",EventTV="[0-9-]+",Severity="[a-zA-Z]+",Service="[a-zA-Z]+",EventVersion="[0-9]+",AccountID="[0-9]+",SessionID="0x[0-9a-f]+",LocalAddress="IPV[46]/(UD|TC)P/[0-9a-fA-F:.]+/[0-9]+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/[0-9]+"$
 
 # Option:  ignoreregex

From 3736d7ddbf07d8bb7cc5670b7a8e80d527e25156 Mon Sep 17 00:00:00 2001
From: JP Espinosa <jp@pcel.com>
Date: Mon, 3 Jun 2013 06:29:36 -0500
Subject: [PATCH 310/544] Rewrite to use native init.d functions

- There was a bug with the old "getpid" function, when running linux containers you can see multiple fail2ban instances on hardware node and could stop one on a random virtual environment
- Added reload and status options
---
 files/redhat-initd | 91 +++++++++++++++++++++++-----------------------
 1 file changed, 46 insertions(+), 45 deletions(-)

diff --git a/files/redhat-initd b/files/redhat-initd
index 75c7f808..8c1d03a4 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -1,38 +1,40 @@
 #!/bin/bash
 #
 # chkconfig: 345 92 08
-# description: Fail2ban daemon
-#              http://fail2ban.sourceforge.net/wiki/index.php/Main_Page
-# process name: fail2ban-server
-#
-#
-# Author: Tyler Owen
+# processname: fail2ban-server
+# config: /etc/fail2ban/fail2ban.conf
+# pidfile: /var/run/fail2ban/fail2ban.pid
+# description: fail2ban is a daemon to ban hosts that cause multiple authentication errors
 #
+### BEGIN INIT INFO
+# Provides: fail2ban
+# Required-Start: $local_fs $remote_fs $network
+# Required-Stop: $local_fs $remote_fs $network
+# Default-Start: 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: start and stop fail2ban
+### END INIT INFO
 
 # Source function library.
-. /etc/init.d/functions
+. /etc/rc.d/init.d/functions
 
 # Check that the config file exists
 [ -f /etc/fail2ban/fail2ban.conf ] || exit 0
 
 FAIL2BAN="/usr/bin/fail2ban-client"
-
+prog=fail2ban-server
+lockfile=${LOCKFILE-/var/lock/subsys/fail2ban}
+socket=${SOCKET-/var/run/fail2ban/fail2ban.sock}
+pidfile=${PIDFILE-/var/run/fail2ban/fail2ban.pid}
 RETVAL=0
 
-getpid() {
-    pid=`ps -eo pid,comm | grep fail2ban- | awk '{ print $1 }'`
-}
-
 start() {
     echo -n $"Starting fail2ban: "
-    getpid
-    if [ -z "$pid" ]; then
-	rm -rf /var/run/fail2ban/fail2ban.sock # in case of unclean shutdown
-        $FAIL2BAN start > /dev/null
-        RETVAL=$?
-    fi
-    if [ $RETVAL -eq 0 ]; then
-        touch /var/lock/subsys/fail2ban
+    rm -f ${socket} # in case of unclean shutdown
+    ${FAIL2BAN} start > /dev/null
+    RETVAL=$?
+    if [ $RETVAL = 0 ]; then
+        touch ${lockfile}
         echo_success
     else
         echo_failure
@@ -43,51 +45,50 @@ start() {
 
 stop() {
     echo -n $"Stopping fail2ban: "
-    getpid
+    ${FAIL2BAN} stop > /dev/null
     RETVAL=$?
-    if [ -n "$pid" ]; then
-        $FAIL2BAN stop > /dev/null
-    sleep 1
-    getpid
-    if [ -z "$pid" ]; then
-        rm -f /var/lock/subsys/fail2ban
+    if [ $RETVAL = 0 ]; then
+        rm -f ${lockfile} ${pidfile}
         echo_success
     else
         echo_failure
     fi
-    else
-        echo_failure
-    fi
+    echo
+    return $RETVAL
+}
+
+reload() {
+    echo "Reloading fail2ban: "
+    ${FAIL2BAN} reload
+    RETVAL=$?
     echo
     return $RETVAL
 }
 
 # See how we were called.
 case "$1" in
-  start)
+    start)
+        status -p ${pidfile} ${prog} >/dev/null 2>&1 && exit 0
         start
         ;;
-  stop)
+    stop)
         stop
         ;;
-  status)
-        getpid
-        if [ -n "$pid" ]; then
-                echo "Fail2ban (pid $pid) is running..."
-                $FAIL2BAN status
-        else
-                RETVAL=1
-                echo "Fail2ban is stopped"
-        fi
+    reload)
+        reload
         ;;
-  restart)
+    restart)
         stop
         start
         ;;
-  *)
-        echo $"Usage: $0 {start|stop|status|restart}"
-        exit 1
+    status)
+        status -p ${pidfile} ${prog}
+        RETVAL=$?
+        [ $RETVAL = 0 ] && ${FAIL2BAN} status
         ;;
+    *)
+        echo $"Usage: fail2ban {start|stop|restart|reload|status}"
+        RETVAL=2
 esac
 
 exit $RETVAL

From 32b271c36e12cbf687189de880e2aab6303fb077 Mon Sep 17 00:00:00 2001
From: JP Espinosa <jp@pcel.com>
Date: Mon, 3 Jun 2013 12:34:47 -0400
Subject: [PATCH 311/544] Update redhat-initd

- Using `-x` to remove previous socket on start
- Using Should- to wait for iptables and wrappers
---
 files/redhat-initd | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/files/redhat-initd b/files/redhat-initd
index 8c1d03a4..43147c95 100755
--- a/files/redhat-initd
+++ b/files/redhat-initd
@@ -8,11 +8,14 @@
 #
 ### BEGIN INIT INFO
 # Provides: fail2ban
-# Required-Start: $local_fs $remote_fs $network
-# Required-Stop: $local_fs $remote_fs $network
+# Required-Start: $local_fs $remote_fs
+# Required-Stop: $local_fs $remote_fs
+# Should-Start: $time $network $syslog iptables firehol shorewall ferm
+# Should-Stop: $network $syslog iptables firehol shorewall ferm
 # Default-Start: 3 4 5
 # Default-Stop: 0 1 6
-# Short-Description: start and stop fail2ban
+# Short-Description: Start/Stop fail2ban
+# Description: Start/Stop fail2ban, a daemon to ban hosts that cause multiple authentication errors
 ### END INIT INFO
 
 # Source function library.
@@ -30,8 +33,7 @@ RETVAL=0
 
 start() {
     echo -n $"Starting fail2ban: "
-    rm -f ${socket} # in case of unclean shutdown
-    ${FAIL2BAN} start > /dev/null
+    ${FAIL2BAN} -x start > /dev/null
     RETVAL=$?
     if [ $RETVAL = 0 ]; then
         touch ${lockfile}

From 47b063b022d45013bfbff4c23d4e01ccee16c4c1 Mon Sep 17 00:00:00 2001
From: Carlos Alberto Lopez Perez <clopez@igalia.com>
Date: Mon, 10 Jun 2013 19:41:13 +0200
Subject: [PATCH 312/544] Filter Asterisk: Add AUTH_UNKNOWN_DOMAIN error to
 list

 * I have been seeing bruteforcing attempts where asterisk fails with
   AUTH_UNKNOWN_DOMAIN (Not a local domain)
---
 config/filter.d/asterisk.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 589a188c..c1b3dcab 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -26,6 +26,7 @@ failregex = NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOS
             NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Device does not match ACL$
             NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Peer is not supposed to register$
             NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - ACL error \(permit/deny\)$
+            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Not a local domain$
             NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:[0-9]+\) to extension '[0-9]+' rejected because extension not found in context 'default'.$
             NOTICE%(__pid_re)s [^:]+: Host <HOST> failed to authenticate as '[^']*'$
             NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from <HOST>\)$

From 7248ef4564d3ad3b8c24ac17b4caa666c79f2122 Mon Sep 17 00:00:00 2001
From: Carlos Alberto Lopez Perez <clopez@igalia.com>
Date: Tue, 11 Jun 2013 02:08:26 +0200
Subject: [PATCH 313/544] Filter Asterisk: Add sample log entry to testcase.

 * Sample log entry for AUTH_UNKNOWN_DOMAIN (Not a local domain)
---
 testcases/files/logs/asterisk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index 667eee02..45b69304 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -12,3 +12,4 @@
 [2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '0972598285108' rejected because extension not found in context 'default'.
 [2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@1.2.3.4' failed for '1.2.3.4:23930' - No matching peer found
 [2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/1.2.3.4/5060",RemoteAddress="IPV4/UDP/1.2.3.4/5070"
+[2013-06-10 18:15:03] NOTICE[2723] chan_sip.c: Registration from '"100"<sip:100@192.168.0.2:5060>' failed for '1.2.3.4' - Not a local domain

From 4787777cee3c68868345ebfd721d26a0095e5aff Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 11 Jun 2013 10:30:56 +1000
Subject: [PATCH 314/544] DOC: credits for gh-244

---
 ChangeLog | 2 ++
 THANKS    | 1 +
 2 files changed, 3 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 5366135c..e58bce06 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,6 +25,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
    * files/suse-initd -- update to the copy from stock SUSE
 	silviogarbes
 	 * Updates to asterisk filter closes gh-227/gh-230.
+	Carlos Alberto Lopez Perez
+	 * Updates to asterisk to include AUTH_UNKNOWN_DOMAIN - gh-244.
 
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------
diff --git a/THANKS b/THANKS
index 0b74ba81..ba33b766 100644
--- a/THANKS
+++ b/THANKS
@@ -9,6 +9,7 @@ Andrey G. Grozin
 Arturo 'Buanzo' Busleiman
 Axel Thimm
 Bill Heaton
+Carlos Alberto Lopez Perez
 Christian Rauch
 Christoph Haas
 Christos Psonis

From 16d63434ef3f4691ee68553582705b2aa7d1ae69 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 11 Jun 2013 23:56:09 +1000
Subject: [PATCH 315/544] DOC: credits

---
 ChangeLog                   |  2 ++
 THANKS                      |  1 +
 config/filter.d/3proxy.conf | 17 +++++++++++++++++
 config/jail.conf            |  6 ++++++
 testcases/files/logs/3proxy |  2 ++
 5 files changed, 28 insertions(+)
 create mode 100644 config/filter.d/3proxy.conf
 create mode 100644 testcases/files/logs/3proxy

diff --git a/ChangeLog b/ChangeLog
index e58bce06..d2bf5d42 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,8 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
    * action.d/{route,shorewall}.conf - blocktype must be defined
      within [Init].  Closes gh-232
 - New Features
+  Daniel Black and ykimon
+	 * filter.d/3proxy filter added
 - Enhancements
   Yaroslav Halchenko
    * jail.conf -- assure all jails have actions and remove unused
diff --git a/THANKS b/THANKS
index ba33b766..9e151406 100644
--- a/THANKS
+++ b/THANKS
@@ -48,5 +48,6 @@ Tyler
 Vaclav Misek
 Vincent Deffontaines
 Yaroslav Halchenko
+ykimon
 Yehuda Katz
 zugeschmiert
diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf
new file mode 100644
index 00000000..f68ad44e
--- /dev/null
+++ b/config/filter.d/3proxy.conf
@@ -0,0 +1,17 @@
+# Fail2Ban configuration file
+#
+# Author: Daniel Black
+#
+# Requested by ykimon in https://github.com/fail2ban/fail2ban/issues/246
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems
+#          Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
+# Values:  TEXT
+#
+failregex = \S+\s0000[1-9]\s\S+\s<HOST>:[0-9]+\S+[0-9]+\s[0-9]+\s.*$
+
+ignoreregex = 
diff --git a/config/jail.conf b/config/jail.conf
index d3a23920..69197f5b 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -401,4 +401,10 @@ action = pf
 logpath  = /var/log/sshd.log
 maxretry=5
 
+[3proxy]
+
+enabled = false
+filter  = 3proxy
+action  = iptables-multiport[name=3proxy, port=318, protocol=tcp]
+logpath = /var/log/3proxy.log
 
diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy
new file mode 100644
index 00000000..ff4774f3
--- /dev/null
+++ b/testcases/files/logs/3proxy
@@ -0,0 +1,2 @@
+11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
+11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1

From f2fa4d53a8d5fbaa5e4b3769eed8a21832379eb1 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 12 Jun 2013 08:30:59 +1000
Subject: [PATCH 316/544] ENH: stricter regex thanks to Steven Hiscocks (kwirk)

---
 config/filter.d/3proxy.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf
index f68ad44e..be3a68d0 100644
--- a/config/filter.d/3proxy.conf
+++ b/config/filter.d/3proxy.conf
@@ -8,10 +8,10 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems
+# Notes.:  http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems (%E field)
 #          Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
 # Values:  TEXT
 #
-failregex = \S+\s0000[1-9]\s\S+\s<HOST>:[0-9]+\S+[0-9]+\s[0-9]+\s.*$
+failregex = \s[+-][0-9]{4} \S+ 0000[1-9] \S+ <HOST>:[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$
 
 ignoreregex = 

From fd9f9f16e0b6ed8ff2c6f9761c1f42c61468e656 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 12 Jun 2013 08:48:30 +1000
Subject: [PATCH 317/544] BF: need to anchor the start to avoid another repeat
 of DoS injection like Apache

---
 config/filter.d/3proxy.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf
index be3a68d0..09855d75 100644
--- a/config/filter.d/3proxy.conf
+++ b/config/filter.d/3proxy.conf
@@ -12,6 +12,6 @@
 #          Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
 # Values:  TEXT
 #
-failregex = \s[+-][0-9]{4} \S+ 0000[1-9] \S+ <HOST>:[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$
+failregex = ^\s[+-][0-9]{4} \S+ 0000[1-9] \S+ <HOST>:[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$
 
 ignoreregex = 

From 6ccd57813cca617561fc67d2771361f30642eef7 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 11 Jun 2013 14:56:25 -0400
Subject: [PATCH 318/544] BF: anchor apache- filters.  Close #248

See https://vndh.net/note:fail2ban-089-denial-service for more information
---
 config/filter.d/apache-auth.conf      | 10 +++++++---
 config/filter.d/apache-common.conf    | 17 +++++++++++++++++
 config/filter.d/apache-nohome.conf    |  8 +++++++-
 config/filter.d/apache-noscript.conf  | 10 ++++++++--
 config/filter.d/apache-overflows.conf |  8 +++++++-
 testcases/files/logs/apache-auth      |  5 +++++
 testcases/files/logs/apache-noscript  |  1 +
 7 files changed, 52 insertions(+), 7 deletions(-)
 create mode 100644 config/filter.d/apache-common.conf
 create mode 100644 testcases/files/logs/apache-auth
 create mode 100644 testcases/files/logs/apache-noscript

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 66f6a1d6..ae3232f2 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -4,6 +4,12 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = apache-common.conf
+
 [Definition]
 
 # Option:  failregex
@@ -13,9 +19,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = [[]client <HOST>[]] user .* authentication failure
-            [[]client <HOST>[]] user .* not found
-            [[]client <HOST>[]] user .* password mismatch
+failregex = ^%(_apache_error_client)s user .* (authentication failure|not found|password mismatch)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
new file mode 100644
index 00000000..c3829e2f
--- /dev/null
+++ b/config/filter.d/apache-common.conf
@@ -0,0 +1,17 @@
+# Generic configuration items (to be used as interpolations) in other
+# apache filters
+#
+# Author: Yaroslav Halchenko
+#
+#
+
+[INCLUDES]
+
+# Load customizations if any available
+after = apache-common.local
+
+
+[DEFAULT]
+
+# Common prefix for [error] apache messages which also would include <HOST>
+_apache_error_client = \[[^]]+\] \[error\] \[client <HOST>\]
diff --git a/config/filter.d/apache-nohome.conf b/config/filter.d/apache-nohome.conf
index 6e738c68..1347b10d 100644
--- a/config/filter.d/apache-nohome.conf
+++ b/config/filter.d/apache-nohome.conf
@@ -4,6 +4,12 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = apache-common.conf
+
 [Definition]
 
 # Option:  failregex
@@ -13,7 +19,7 @@
 #          per-domain log files.
 # Values:  TEXT
 #
-failregex = [[]client <HOST>[]] File does not exist: .*/~.*
+failregex = ^%(_apache_error_client)s File does not exist: .*/~.*
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 5b48cb32..295e1b9f 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -4,6 +4,12 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = apache-common.conf
+
 [Definition]
 
 # Option:  failregex
@@ -13,8 +19,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)
-            [[]client <HOST>[]] script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat *$
+failregex = ^%(_apache_error_client)s (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)\s*$
+            ^%(_apache_error_client)s script '/\S*(\.php|\.asp|\.exe|\.pl)\S*' not found or unable to stat\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/filter.d/apache-overflows.conf b/config/filter.d/apache-overflows.conf
index e25b79a4..1cf08db7 100644
--- a/config/filter.d/apache-overflows.conf
+++ b/config/filter.d/apache-overflows.conf
@@ -4,13 +4,19 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = apache-common.conf
+
 [Definition]
 
 # Option:  failregex
 # Notes.:  Regexp to catch Apache overflow attempts.
 # Values:  TEXT
 #
-failregex = [[]client <HOST>[]] (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string)
+failregex = ^%(_apache_error_client)s (Invalid (method|URI) in request|request failed: URI too long|erroneous characters after protocol string)
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
new file mode 100644
index 00000000..cf0f6d30
--- /dev/null
+++ b/testcases/files/logs/apache-auth
@@ -0,0 +1,5 @@
+# Should not match -- DoS vector https://vndh.net/note:fail2ban-089-denial-service
+[Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
+
+# should match
+[Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found
diff --git a/testcases/files/logs/apache-noscript b/testcases/files/logs/apache-noscript
new file mode 100644
index 00000000..5d5d35ff
--- /dev/null
+++ b/testcases/files/logs/apache-noscript
@@ -0,0 +1 @@
+[Sun Jun 09 07:57:47 2013] [error] [client 192.0.43.10] script '/usr/lib/cgi-bin/gitweb.cgiwp-login.php' not found or unable to stat

From 728b5e8bf4d268bc09d31d83e9f319746cec10a5 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 11 Jun 2013 14:57:15 -0400
Subject: [PATCH 319/544] Changes for 0.8.10 release (changelog, version, etc)

---
 ChangeLog             | 24 +++++++++++++++---------
 README.md             |  8 ++++----
 common/version.py     |  2 +-
 man/fail2ban-client.1 |  6 +++---
 man/fail2ban-regex.1  |  8 ++++----
 man/fail2ban-server.1 |  6 +++---
 6 files changed, 30 insertions(+), 24 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index e58bce06..5e592bd7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,17 +4,23 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.9.dev)                                          2013/??/??
+Fail2Ban (version 0.8.10)                                             2013/06/11
 ================================================================================
 
-ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
+ver. 0.8.10 (2013/06/11) - wanna-be-secure
 -----------
 
-- Fixes:
-  Yaroslav Halchenko
+Primarily bugfix and enhancements release, triggered by "bugs" in
+apache- filters.  If you are relying on listed below apache- filters,
+upgrade asap and seek your distributions to patch their fail2ban
+distribution with [6ccd5781].
+
+- Fixes: Yaroslav Halchenko
+   * [6ccd5781] filter.d/apache-{auth,nohome,noscript,overflows} - anchor
+     failregex at the beginning (and where applicable at the end).
+     Addresses a possible DoS. Closes gh-248
    * action.d/{route,shorewall}.conf - blocktype must be defined
      within [Init].  Closes gh-232
-- New Features
 - Enhancements
   Yaroslav Halchenko
    * jail.conf -- assure all jails have actions and remove unused
@@ -23,10 +29,10 @@ ver. 0.8.10 (2013/XX/XXX) - NOT-YET-RELEASED
    * config/filter.d/roundcube-auth.conf -- support roundcube 0.9+
   Daniel Black
    * files/suse-initd -- update to the copy from stock SUSE
-	silviogarbes
-	 * Updates to asterisk filter closes gh-227/gh-230.
-	Carlos Alberto Lopez Perez
-	 * Updates to asterisk to include AUTH_UNKNOWN_DOMAIN - gh-244.
+  silviogarbes & Daniel Black
+    * Updates to asterisk filter. Closes gh-227/gh-230.
+  Carlos Alberto Lopez Perez
+    * Updates to asterisk to include AUTH_UNKNOWN_DOMAIN. Closes gh-244.
 
 ver. 0.8.9 (2013/05/13) - wanna-be-stable
 ----------
diff --git a/README.md b/README.md
index 91deaf19..dc6bf49f 100644
--- a/README.md
+++ b/README.md
@@ -2,9 +2,9 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.8.9                  2013/05/13
+                       v0.8.10                  2013/06/11
 
-## Fail2Ban: ban hosts that cause multiple authentication errors 
+## Fail2Ban: ban hosts that cause multiple authentication errors
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
 password failures. It updates firewall rules to reject the IP address. These
@@ -30,8 +30,8 @@ Optional:
 
 To install, just do:
 
-    tar xvfj fail2ban-0.8.9.tar.bz2
-    cd fail2ban-0.8.9
+    tar xvfj fail2ban-0.8.10.tar.bz2
+    cd fail2ban-0.8.10
     python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
diff --git a/common/version.py b/common/version.py
index 86c45760..fe99f95e 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-version = "0.8.9.dev"
+version = "0.8.10"
diff --git a/man/fail2ban-client.1 b/man/fail2ban-client.1
index d7d620bc..a6eb461e 100644
--- a/man/fail2ban-client.1
+++ b/man/fail2ban-client.1
@@ -1,12 +1,12 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
-.TH FAIL2BAN-CLIENT "1" "May 2013" "fail2ban-client v0.8.9" "User Commands"
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.41.2.
+.TH FAIL2BAN-CLIENT "1" "June 2013" "fail2ban-client v0.8.10" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fIOPTIONS\fR] \fI<COMMAND>\fR
 .SH DESCRIPTION
-Fail2Ban v0.8.9 reads log file that contains password failure report
+Fail2Ban v0.8.10 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
diff --git a/man/fail2ban-regex.1 b/man/fail2ban-regex.1
index a42d96d5..379cd761 100644
--- a/man/fail2ban-regex.1
+++ b/man/fail2ban-regex.1
@@ -1,12 +1,12 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
-.TH FAIL2BAN-REGEX "1" "May 2013" "fail2ban-regex v0.8.9" "User Commands"
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.41.2.
+.TH FAIL2BAN-REGEX "1" "June 2013" "fail2ban-regex v0.8.10" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
 .B fail2ban-regex
 [\fIOPTIONS\fR] \fI<LOG> <REGEX> \fR[\fIIGNOREREGEX\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.9 reads log file that contains password failure report
+Fail2Ban v0.8.10 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 This tools can test regular expressions for "fail2ban".
@@ -26,7 +26,7 @@ verbose output
 a string representing a log line
 .TP
 \fBfilename\fR
-path to a log file (/var/log/auth.log)
+path to a log file (\fI/var/log/auth.log\fP)
 .SH REGEX
 .TP
 \fBstring\fR
diff --git a/man/fail2ban-server.1 b/man/fail2ban-server.1
index 43e9d6d4..3851db91 100644
--- a/man/fail2ban-server.1
+++ b/man/fail2ban-server.1
@@ -1,12 +1,12 @@
-.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.40.10.
-.TH FAIL2BAN-SERVER "1" "May 2013" "fail2ban-server v0.8.9" "User Commands"
+.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.41.2.
+.TH FAIL2BAN-SERVER "1" "June 2013" "fail2ban-server v0.8.10" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fIOPTIONS\fR]
 .SH DESCRIPTION
-Fail2Ban v0.8.9 reads log file that contains password failure report
+Fail2Ban v0.8.10 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .PP
 Only use this command for debugging purpose. Start the server with

From 921d9a8e4b507ca08744056fc798c7864a78e114 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 12 Jun 2013 13:20:00 -0400
Subject: [PATCH 320/544] DOC: add information on where to report
 vulnerabilities + pointer to HOWTO_Seek_Help

originally following command was used to add header to all config files:

  sed -ie '/# Author/ i\# Please report vulnerabilities to fail2ban-vulnerabilities at lists dot sourceforge dot net\n# and see http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help for generic bug-reports.\n#' action.d/* filter.d/*

but it would be overkill ATM causing havoc in user-tuned configs -- postponed for now

Also adjusted the release date for today (by mistake in 1 commit ... sorry)
---
 ChangeLog | 4 ++--
 README.md | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 5e592bd7..230ee10d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,10 +4,10 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.10)                                             2013/06/11
+Fail2Ban (version 0.8.10)                                             2013/06/12
 ================================================================================
 
-ver. 0.8.10 (2013/06/11) - wanna-be-secure
+ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
 
 Primarily bugfix and enhancements release, triggered by "bugs" in
diff --git a/README.md b/README.md
index dc6bf49f..05e92fd6 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
                         / _|__ _(_) |_  ) |__  __ _ _ _  
                        |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v0.8.10                  2013/06/11
+                       v0.8.10                  2013/06/12
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
@@ -63,9 +63,14 @@ Code status:
 Contact:
 --------
 
+### You found a severe security vulnerability in Fail2Ban?
+email details to fail2ban-vulnerabilities at lists dot sourceforge dot net .
+
 ### You need some new features, you found bugs?
 visit [Issues](https://github.com/fail2ban/fail2ban/issues)
-and if your issue is not yet known -- file a bug report.
+and if your issue is not yet known -- file a bug report. See
+[Fail2Ban wiki](http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help)
+on further instructions.
 
 ### You would like to troubleshoot or discuss?
 join the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)

From 8faf84b7f7540830d40b3c643c8123a9234342a5 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 13 Jun 2013 08:34:10 +1000
Subject: [PATCH 321/544] BF: authentication errors end in 01-09 but the
 beginning part indicates the service as per
 https://github.com/fail2ban/fail2ban/issues/246#issuecomment-19327955 thanks
 to ykimon

---
 config/filter.d/3proxy.conf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf
index 09855d75..c341cf80 100644
--- a/config/filter.d/3proxy.conf
+++ b/config/filter.d/3proxy.conf
@@ -8,10 +8,11 @@
 [Definition]
 
 # Option:  failregex
-# Notes.:  http://www.3proxy.ru/howtoe.asp#ERRORS that 1-9 are all authentication problems (%E field)
+# Notes.:  http://www.3proxy.ru/howtoe.asp#ERRORS indicates that 01-09 are
+#          all authentication problems (%E field)
 #          Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
 # Values:  TEXT
 #
-failregex = ^\s[+-][0-9]{4} \S+ 0000[1-9] \S+ <HOST>:[0-9]+ [0-9.]+:[0-9]+ [0-9]+ .*$
+failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [0-9.]+:\d+ \d+
 
 ignoreregex = 

From 9dbaec0894ff64de9e902771da9ccae9d2c8b7bf Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 13 Jun 2013 10:23:14 +1000
Subject: [PATCH 322/544] ENH: sample log + more specific regex

---
 config/filter.d/3proxy.conf | 2 +-
 testcases/files/logs/3proxy | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/3proxy.conf b/config/filter.d/3proxy.conf
index c341cf80..b22b4588 100644
--- a/config/filter.d/3proxy.conf
+++ b/config/filter.d/3proxy.conf
@@ -13,6 +13,6 @@
 #          Log format is: "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
 # Values:  TEXT
 #
-failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [0-9.]+:\d+ \d+
+failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s
 
 ignoreregex = 
diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy
index ff4774f3..2967c9bf 100644
--- a/testcases/files/logs/3proxy
+++ b/testcases/files/logs/3proxy
@@ -1,2 +1,3 @@
 11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
 11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
+13-06-2013 01:39:34 +0300 PROXY.3128 00508 - 1.2.3.4:28938 0.0.0.0:0 0 0 0 

From 460e09af668b9a84ba2d4c4aff20ccb1751b263a Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 12 Jun 2013 21:22:26 -0400
Subject: [PATCH 323/544] it was not the end of the world and we should
 continue

---
 ChangeLog         | 10 ++++++++++
 DEVELOP           | 13 +++++++++----
 common/version.py |  2 +-
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 230ee10d..590edfa6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,16 @@
 Fail2Ban (version 0.8.10)                                             2013/06/12
 ================================================================================
 
+ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
+-----------
+
+- Fixes:
+  
+- New Features:
+  
+- Enhancements:
+  
+
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
 
diff --git a/DEVELOP b/DEVELOP
index 00b7d6d5..bebc12b3 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -348,10 +348,15 @@ Post Release
 
 Add the following to the top of the ChangeLog
 
-ver. 0.8.11 (2013/XX/XXX) - wanna-be-stable
-- Fixes
-- New Features
-- Enhancements
+ver. 0.8.12 (2013/XX/XXX) - wanna-be-released
+-----------
+
+- Fixes:
+  
+- New Features:
+  
+- Enhancements:
+  
 
 and adjust common/version.py to carry .dev suffix to signal
 a version under development.
diff --git a/common/version.py b/common/version.py
index fe99f95e..87cb5020 100644
--- a/common/version.py
+++ b/common/version.py
@@ -24,4 +24,4 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-version = "0.8.10"
+version = "0.8.10.dev"

From 88b4598ed8a59ee5984b3e9a556ab873894811c3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 13 Jun 2013 14:43:15 +1000
Subject: [PATCH 324/544] BF: fix to proxy port in 3proxy example

---
 config/jail.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/jail.conf b/config/jail.conf
index 69197f5b..c999cc7b 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -405,6 +405,6 @@ maxretry=5
 
 enabled = false
 filter  = 3proxy
-action  = iptables-multiport[name=3proxy, port=318, protocol=tcp]
+action  = iptables-multiport[name=3proxy, port=3128, protocol=tcp]
 logpath = /var/log/3proxy.log
 

From 3e3802512aa1d18c3749aac11122c237508bad75 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 13 Jun 2013 17:44:18 +1000
Subject: [PATCH 325/544] ENH/BF: exim improvements with sample

---
 ChangeLog                 | 2 ++
 THANKS                    | 1 +
 config/filter.d/exim.conf | 2 +-
 testcases/files/logs/exim | 2 ++
 4 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 590edfa6..6bdcd9e1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - New Features:
   
 - Enhancements:
+  Daniel Black and Georgiy Mernov
+   * filter.d/exim -- update regex for new exim fail log message with sample
   
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
diff --git a/THANKS b/THANKS
index ba33b766..05c46561 100644
--- a/THANKS
+++ b/THANKS
@@ -18,6 +18,7 @@ Daniel Black
 David Nutter
 Eric Gerbier
 Enrico Labedzki
+Georgiy Mernov
 Guillaume Delvit
 Hanno 'Rince' Wagner
 Iain Lea
diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index b846e992..511f30b8 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -14,7 +14,7 @@
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
-             login authenticator failed for .* \[<HOST>\]: 535 Incorrect authentication data \(set_id=.*\)\s*$
+             ^ login authenticator failed for ([^\s\(]+\s)?\([^)]*\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index dd507379..5bfc4060 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -1,2 +1,4 @@
 # From IRC 2013-01-04
 2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)
+# From IRC 2013-06-13 XATRIX (Georgiy Mernov)
+2013-06-12 03:57:58 login authenticator failed for (ylmf-pc) [120.196.140.45]: 535 Incorrect authentication data: 1 Time(s)

From 4c67a269bf9d3186201c72305cead1820fc1fbaa Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 13 Jun 2013 22:11:05 +1000
Subject: [PATCH 326/544] ENH: proftp regex hardening and log messages

---
 ChangeLog                    |  2 ++
 config/filter.d/proftpd.conf | 17 ++++++++++++-----
 testcases/files/logs/proftpd |  3 +++
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 590edfa6..ef5ab555 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - New Features:
   
 - Enhancements:
+  Daniel Black
+   * filter.d/proftpd -- harden and anchor regex and add two testcases
   
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index f28e2d4b..3a16b877 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -1,8 +1,15 @@
 # Fail2Ban configuration file
 #
 # Author: Yaroslav Halchenko
+#         Daniel Black - hardening of regex
 #
-#
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
 
 [Definition]
 
@@ -13,10 +20,10 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
-            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
-            \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
-            \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
+failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
+            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
+            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
+            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd
index def8a83e..5c88c1c1 100644
--- a/testcases/files/logs/proftpd
+++ b/testcases/files/logs/proftpd
@@ -1,5 +1,8 @@
 Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers
 Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21 
+Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password.
+Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21
+Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
 
 
 

From dbe7ffe050057ef6ea022127110222908bf2673d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 13 Jun 2013 23:52:15 +1000
Subject: [PATCH 327/544] ENH: dovecot regexs rewritten and extra failures

---
 ChangeLog                    |  3 +++
 config/filter.d/dovecot.conf | 21 ++++++++++++---------
 testcases/files/logs/dovecot |  8 +++++++-
 3 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 590edfa6..240fe494 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - New Features:
   
 - Enhancements:
+  Daniel Black
+   * filter/dovecot -- updated to use full anchored regex with extra failure
+	   examples in sample logs
   
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index d7fb6e6d..dd4c35ba 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -1,20 +1,23 @@
-# Fail2Ban configuration file for dovcot
+# Fail2Ban configuration file for dovecot
 #
 # Author: Martin Waschbuesch
-#
-#
+#         Daniel Black (rewrote with begin and end anchors)
+
+[INCLUDES]
+
+before = common.conf
 
 [Definition]
 
+_daemon = dovecot(-auth)?
+
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Notes.:  regex to match the password failures messages in the logfile.
+#          first regex is essentially a copy of pam-generic.conf
 # Values:  TEXT
 #
-failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*\s+rip=(?P<host>\S*),.*
-            pam.*dovecot.*(?:authentication failure).*\s+rhost=<HOST>(?:\s+user=.*)?\s*$
+failregex = ^%(__prefix_line)s(pam_unix(?:\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
+            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3},( TLS( handshaking)?(: Disconnected)?)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index 434acade..fd84789e 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -3,6 +3,12 @@
 @e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
 # Above example with injected rhost into ruser -- should not match for 1.2.3.4
 @e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=rhost=1.2.3.4 rhost=192.0.43.10
-@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.224  user=root
+@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.225  user=root
 
 Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
+
+Jun 13 16:30:54 platypus dovecot: imap-login: Disconnected (auth failed, 2 attempts): user=<username.bob>, method=PLAIN, rip=49.176.98.87, lip=113.212.99.194, TLS
+Jun 13 20:48:11 platypus dovecot: pop3-login: Disconnected (no auth attempts): rip=121.44.24.254, lip=113.212.99.194, TLS: Disconnected
+Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth attempts): rip=180.200.180.81, lip=113.212.99.194, TLS
+Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected
+

From 2e2ec5d1f515cb6dc02eb0d40c665fc6b992fb34 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 00:17:41 +1000
Subject: [PATCH 328/544] ENH: injection of fail data into USER field

---
 testcases/files/logs/proftpd | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd
index 5c88c1c1..aaaf0295 100644
--- a/testcases/files/logs/proftpd
+++ b/testcases/files/logs/proftpd
@@ -3,6 +3,7 @@ Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.
 Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password.
 Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21
 Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
+Jun 14 00:09:59 platypus.ace-hosting.com.au proftpd[17839] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): USER platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (hihoinjection[1.2.3.44]): no such user found from ::ffff:59.167.242.100 [::ffff:59.167.242.100] to ::ffff:113.212.99.194:21
 
 
 

From 9940cd1b6b0146c2a088edab611e8d77e1d2984d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 00:29:43 +1000
Subject: [PATCH 329/544] ENH: proftpd chan accept usernames with spaces

---
 config/filter.d/proftpd.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 3a16b877..13080fcc 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -20,9 +20,9 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
-            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
-            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
+failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
+            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): .*$
+            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
             ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
 
 # Option:  ignoreregex

From e8b6acfa6521f0995adaf06db9349b260d438544 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 00:53:03 +1000
Subject: [PATCH 330/544] TST: attempts at injection with
 username=rhost=1.2.3.4 have no user= logged in dovecot-1.2.15

---
 testcases/files/logs/dovecot | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index fd84789e..f904a8fe 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -8,6 +8,7 @@
 Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
 
 Jun 13 16:30:54 platypus dovecot: imap-login: Disconnected (auth failed, 2 attempts): user=<username.bob>, method=PLAIN, rip=49.176.98.87, lip=113.212.99.194, TLS
+Jun 14 00:48:21 platypus dovecot: imap-login: Disconnected (auth failed, 1 attempts): method=PLAIN, rip=59.167.242.100, lip=113.212.99.194, TLS: Disconnected
 Jun 13 20:48:11 platypus dovecot: pop3-login: Disconnected (no auth attempts): rip=121.44.24.254, lip=113.212.99.194, TLS: Disconnected
 Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth attempts): rip=180.200.180.81, lip=113.212.99.194, TLS
 Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected

From 6a09ecff5c8c1115919b825b822d343c41061da3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 08:41:50 +1000
Subject: [PATCH 331/544] ENH: anchor a bit mor. Use \d and \w where possible.
 Escape a literal .

---
 config/filter.d/asterisk.conf | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index c1b3dcab..56ea68b4 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -14,25 +14,22 @@ before = common.conf
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+# Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT
 #
-failregex = NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Wrong password$
-            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - No matching peer found$
-            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Username/auth name mismatch$
-            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Device does not match ACL$
-            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Peer is not supposed to register$
-            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - ACL error \(permit/deny\)$
-            NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:[0-9]+)?' - Not a local domain$
-            NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:[0-9]+\) to extension '[0-9]+' rejected because extension not found in context 'default'.$
-            NOTICE%(__pid_re)s [^:]+: Host <HOST> failed to authenticate as '[^']*'$
-            NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from <HOST>\)$
-            NOTICE%(__pid_re)s [^:]+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
-            NOTICE%(__pid_re)s [^:]+: Failed to authenticate user [^@]+@<HOST>\S*$
-            SECURITY%(__pid_re)s [^:]+: SecurityEvent="InvalidAccountID",EventTV="[0-9-]+",Severity="[a-zA-Z]+",Service="[a-zA-Z]+",EventVersion="[0-9]+",AccountID="[0-9]+",SessionID="0x[0-9a-f]+",LocalAddress="IPV[46]/(UD|TC)P/[0-9a-fA-F:.]+/[0-9]+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/[0-9]+"$
+failregex = \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
+            \]\s*NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Host <HOST> failed to authenticate as '[^']*'$
+            \]\s*NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from <HOST>\)$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
+            \]\s*NOTICE%(__pid_re)s [^:]+: Failed to authenticate user [^@]+@<HOST>\S*$
+            \]\s*SECURITY%(__pid_re)s [^:]+: SecurityEvent="InvalidAccountID",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From d4940563d3f3be6eae68c0ff4ebd869e2145356f Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 08:55:25 +1000
Subject: [PATCH 332/544] ENH: regex hardening on assp

---
 ChangeLog                 | 2 ++
 config/filter.d/assp.conf | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 590edfa6..a9e02d68 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - New Features:
   
 - Enhancements:
+  Daniel Black
+   * filter.d/assp -- regex hardening
   
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf
index b1bfc082..4b8f5caf 100644
--- a/config/filter.d/assp.conf
+++ b/config/filter.d/assp.conf
@@ -20,9 +20,9 @@
 #           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
 __assp_actions = (dropping|refusing)
 
-failregex = <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: [a-zA-Z0-9]+;$
-			<HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
-			Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
+failregex = ^ \[SSL-out\] <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
+			^ \[SSL-out\] <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
+			^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
 
 
 # Option:  ignoreregex

From a447aa615d2d6114db4af582576836dea9ce78b2 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 12:27:35 +1000
Subject: [PATCH 333/544] BF: [SSL-out] is optional in assp

---
 config/filter.d/assp.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf
index 4b8f5caf..2b98ffc2 100644
--- a/config/filter.d/assp.conf
+++ b/config/filter.d/assp.conf
@@ -18,10 +18,10 @@
 # Examples: Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
 #           Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
 #           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
-__assp_actions = (dropping|refusing)
+__assp_actions = (?:dropping|refusing)
 
-failregex = ^ \[SSL-out\] <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
-			^ \[SSL-out\] <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
+failregex = ^(:? \[SSL-out\])?<HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
+			^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
 			^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
 
 

From 7018d81244d560d6fc0d40418f7331b8dfd609e1 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 12:35:44 +1000
Subject: [PATCH 334/544] BF: missed a space

---
 config/filter.d/assp.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/assp.conf b/config/filter.d/assp.conf
index 2b98ffc2..2854d898 100644
--- a/config/filter.d/assp.conf
+++ b/config/filter.d/assp.conf
@@ -20,7 +20,7 @@
 #           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
 __assp_actions = (?:dropping|refusing)
 
-failregex = ^(:? \[SSL-out\])?<HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
+failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
 			^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
 			^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
 

From 09302c5c2566b6924bcb1243b86d031ad5398e6b Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Jun 2013 18:58:13 -0400
Subject: [PATCH 335/544] ENH: asterisk -- use \S instead of [^:] + prefix
 failregex with ^\[

detected date portion is stripped from the string to be matched, so it is not only
the right ] is left, but also the left one ;-)
---
 config/filter.d/asterisk.conf | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 56ea68b4..a8f65e09 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -17,19 +17,19 @@ before = common.conf
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT
 #
-failregex = \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
-            \]\s*NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Host <HOST> failed to authenticate as '[^']*'$
-            \]\s*NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from <HOST>\)$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
-            \]\s*NOTICE%(__pid_re)s [^:]+: Failed to authenticate user [^@]+@<HOST>\S*$
-            \]\s*SECURITY%(__pid_re)s [^:]+: SecurityEvent="InvalidAccountID",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
+failregex = ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
+            ^\[\]\s*NOTICE%(__pid_re)s\[\S+\] \S+: Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Host <HOST> failed to authenticate as '[^']*'$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: No registration for peer '[^']*' \(from <HOST>\)$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
+            ^\[\]\s*NOTICE%(__pid_re)s \S+: Failed to authenticate user [^@]+@<HOST>\S*$
+            ^\[\]\s*SECURITY%(__pid_re)s \S+: SecurityEvent="InvalidAccountID",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 97f9cfc0b05cd00ada984eed6514b96546fb30a1 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Jun 2013 22:56:36 -0400
Subject: [PATCH 336/544] ENH: 'heavydebug' level == 5 for even more debugging
 in tricky cases

I mocked logging library directly -- seems to be Ok.
---
 common/__init__.py | 5 +++++
 fail2ban-testcases | 5 +++--
 server/filter.py   | 4 ++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/common/__init__.py b/common/__init__.py
index 2b76f4b6..3eae8ee3 100644
--- a/common/__init__.py
+++ b/common/__init__.py
@@ -23,3 +23,8 @@
 __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
+
+import logging
+
+# Custom debug level
+logging.HEAVYDEBUG = 5
diff --git a/fail2ban-testcases b/fail2ban-testcases
index 0bd70259..fc5cc146 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -52,7 +52,7 @@ def get_opt_parser():
 	p.add_options([
 		Option('-l', "--log-level", type="choice",
 			   dest="log_level",
-			   choices=('debug', 'info', 'warn', 'error', 'fatal'),
+			   choices=('heavydebug', 'debug', 'info', 'warning', 'error', 'fatal'),
 			   default=None,
 			   help="Log level for the logger to use during running tests"),
 		Option('-n', "--no-network", action="store_true",
@@ -76,7 +76,8 @@ parser = get_opt_parser()
 logSys = logging.getLogger("fail2ban")
 
 # Numerical level of verbosity corresponding to a log "level"
-verbosity = {'debug': 3,
+verbosity = {'heavydebug': 4,
+			 'debug': 3,
 			 'info': 2,
 			 'warn': 1,
 			 'error': 1,
diff --git a/server/filter.py b/server/filter.py
index 90530f92..59e612ed 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -291,6 +291,8 @@ class Filter(JailThread):
 		except UnicodeDecodeError:
 			l = line
 		l = l.rstrip('\r\n')
+
+		logSys.log(5, "Working on line %r", l)
 		timeMatch = self.dateDetector.matchTime(l)
 		if timeMatch:
 			# Lets split into time part and log part of the line
@@ -355,6 +357,8 @@ class Filter(JailThread):
 			if failRegex.hasMatched():
 				# The failregex matched.
 				date = self.dateDetector.getUnixTime(timeLine)
+				logSys.log(7, "Date: %r, message: %r",
+							  timeLine, logLine)
 				if date is None:
 					logSys.debug("Found a match for %r but no valid date/time "
 								 "found for %r. Please file a detailed issue on"

From ffe381d91cbe92cf505df93648fd322f5673155d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Jun 2013 22:19:10 -0400
Subject: [PATCH 337/544] RF: reworked -regex cmdline tool to use optparse,
 some unification and enhancement of outputs

---
 fail2ban-regex | 464 +++++++++++++++++++++++++------------------------
 1 file changed, 237 insertions(+), 227 deletions(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index a0a90b05..af38d4d9 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -17,9 +17,17 @@
 # You should have received a copy of the GNU General Public License
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+"""
+Fail2Ban  reads log file that contains password failure report
+and bans the corresponding IP addresses using firewall rules.
+
+This tools can test regular expressions for "fail2ban".
+
+Report bugs to https://github.com/fail2ban/fail2ban/issues
+"""
 
 __author__ = "Cyril Jaquier, Yaroslav Halchenko"
-__copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2012 Yaroslav Halchenko"
+__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
 import getopt, sys, time, logging, os
@@ -37,202 +45,201 @@ from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderErro
 from server.filter import Filter
 from server.failregex import RegexException
 
+from optparse import OptionParser, Option
+
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.regex")
 
-class RegexStat:
+def shortstr(s, l=53):
+	"""Return shortened string
+	"""
+	if len(s) > l:
+		return s[:l-3] + '...'
+	return s
+
+def pprint_list(l, header=None):
+	if not len(l):
+		return
+	if header:
+		s = "|- %s\n" % header
+	else:
+		s = ''
+	print s + "|  " + "\n|  ".join(l) + '\n`-'
+
+def get_opt_parser():
+	# use module docstring for help output
+	p = OptionParser(
+				usage="%s [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]\n" % sys.argv[0] + __doc__
+				+ """
+LOG:
+    string                  a string representing a log line
+    filename                path to a log file (/var/log/auth.log)
+
+REGEX:
+    string                  a string representing a 'failregex'
+    filename                path to a filter file (filter.d/sshd.conf)
+
+IGNOREREGEX:
+    string                  a string representing an 'ignoreregex'
+    filename                path to a filter file (filter.d/sshd.conf)
+""",
+				version="%prog " + version)
+
+	p.add_options([
+		Option('-l', "--log-level", type="choice",
+			   dest="log_level",
+			   choices=('debug', 'info', 'warn', 'error', 'fatal'),
+			   default=None,
+			   help="Log level for the Fail2Ban logger to use"),
+		Option("-v", "--verbose", action='store_true',
+			   help="Be verbose in output"),
+		Option("--print-all-missed", action='store_true',
+			   help="Either to print all missed lines"),
+		Option("--print-all-ignored", action='store_true',
+			   help="Either to print all ignored lines"),
+
+		])
+
+	return p
+
+
+class RegexStat(object):
 
 	def __init__(self, failregex):
-		self.__stats = 0
-		self.__failregex = failregex
-		self.__ipList = list()
+		self._stats = 0
+		self._failregex = failregex
+		self._ipList = list()
 
 	def __str__(self):
 		return "%s(%r) %d failed: %s" \
-		  % (self.__class__, self.__failregex, self.__stats, self.__ipList)
+		  % (self.__class__, self._failregex, self._stats, self._ipList)
 
 	def inc(self):
-		self.__stats += 1
+		self._stats += 1
 
 	def getStats(self):
-		return self.__stats
+		return self._stats
 
 	def getFailRegex(self):
-		return self.__failregex
+		return self._failregex
 
 	def appendIP(self, value):
-		self.__ipList.extend(value)
+		self._ipList.extend(value)
 
 	def getIPList(self):
-		return self.__ipList
+		return self._ipList
 
-class Fail2banRegex:
 
+class LineStats(object):
+	"""Just a convenience container for stats
+	"""
+	def __init__(self):
+		self.tested = self.matched = 0
+		self.missed_lines = []
+		self.ignored_lines = []
+
+	def __str__(self):
+		return "%(tested)d lines, %(ignored)d ignored, %(matched)d matched, %(missed)d missed" % self
+
+	@property
+	def ignored(self):
+		return len(self.ignored_lines)
+
+	@property
+	def missed(self):
+		return self.tested - (self.ignored + self.matched)
+
+	# just for convenient str
+	def __getitem__(self, key):
+		return getattr(self, key)
+
+
+class Fail2banRegex(object):
+
+	# ???
 	test = None
 
 	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
 
-	def __init__(self):
-		self.__filter = Filter(None)
-		self.__ignoreregex = list()
-		self.__failregex = list()
-		self.__verbose = False
+	def __init__(self, opts):
+		self._verbose = opts.verbose
+		self._print_all_missed = opts.print_all_missed
+		self._print_all_ignored = opts.print_all_ignored
+
+		self._filter = Filter(None)
+		self._ignoreregex = list()
+		self._failregex = list()
+		self._line_stats = LineStats()
+
 		# Setup logging
 		logging.getLogger("fail2ban").handlers = []
-		self.__hdlr = logging.StreamHandler(Fail2banRegex.test)
+		self._hdlr = logging.StreamHandler(Fail2banRegex.test)
 		# set a format which is simpler for console use
 		formatter = logging.Formatter("%(message)s")
 		# tell the handler to use this format
-		self.__hdlr.setFormatter(formatter)
-		self.__logging_level = self.__verbose and logging.DEBUG or logging.WARN
-		logging.getLogger("fail2ban").addHandler(self.__hdlr)
+		self._hdlr.setFormatter(formatter)
+		self._logging_level = self._verbose and logging.DEBUG or logging.WARN
+		logging.getLogger("fail2ban").addHandler(self._hdlr)
 		logging.getLogger("fail2ban").setLevel(logging.ERROR)
 
-	#@staticmethod
-	def dispVersion():
-		print "Fail2Ban v" + version
-		print
-		print "Copyright (c) 2004-2008 Cyril Jaquier"
-		print "Copyright of modifications held by their respective authors."
-		print "Licensed under the GNU General Public License v2 (GPL)."
-		print
-		print "Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>."
-		print "Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>."
-	dispVersion = staticmethod(dispVersion)
 
-	#@staticmethod
-	def dispUsage():
-		print "Usage: "+sys.argv[0]+" [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]"
-		print
-		print "Fail2Ban v" + version + " reads log file that contains password failure report"
-		print "and bans the corresponding IP addresses using firewall rules."
-		print
-		print "This tools can test regular expressions for \"fail2ban\"."
-		print
-		print "Options:"
-		print "    -h, --help              display this help message"
-		print "    -V, --version           print the version"
-		print "    -v, --verbose           verbose output"
-		print
-		print "Log:"
-		print "    string                  a string representing a log line"
-		print "    filename                path to a log file (/var/log/auth.log)"
-		print
-		print "Regex:"
-		print "    string                  a string representing a 'failregex'"
-		print "    filename                path to a filter file (filter.d/sshd.conf)"
-		print
-		print "IgnoreRegex:"
-		print "    string                  a string representing an 'ignoreregex'"
-		print "    filename                path to a filter file (filter.d/sshd.conf)"
-		print
-		print "Report bugs to https://github.com/fail2ban/fail2ban/issues"
-	dispUsage = staticmethod(dispUsage)
-
-	def getCmdLineOptions(self, optList):
-		""" Gets the command line options
-		"""
-		for opt in optList:
-			if opt[0] in ["-h", "--help"]:
-				self.dispUsage()
-				sys.exit(0)
-			elif opt[0] in ["-V", "--version"]:
-				self.dispVersion()
-				sys.exit(0)
-			elif opt[0] in ["-v", "--verbose"]:
-				self.__verbose = True
-
-	#@staticmethod
-	def logIsFile(value):
-		return os.path.isfile(value)
-	logIsFile = staticmethod(logIsFile)
-
-	def readIgnoreRegex(self, value):
+	def readRegex(self, value, regextype):
+		assert(regextype in ('fail', 'ignore'))
+		regex = regextype + 'regex'
 		if os.path.isfile(value):
 			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
 			try:
 				reader.read(value)
-				print "Use ignoreregex file : " + value
-				self.__ignoreregex = [RegexStat(m)
-									for m in reader.get("Definition", "ignoreregex").split('\n')]
+				print "Use %11s file : %s" % (regex, value)
+				# TODO: reuse functionality in client
+				regex_values = [RegexStat(m)
+							    for m in reader.get("Definition", regex).split('\n')]
 			except NoSectionError:
-				print "No [Definition] section in " + value
-				print
+				print "No [Definition] section in %s" % value
 				return False
 			except NoOptionError:
-				print "No failregex option in " + value
-				print
+				print "No %s option in %s" % (regex, value)
 				return False
 			except MissingSectionHeaderError:
-				print "No section headers in " + value
-				print
+				print "No section headers in %s" % value
 				return False
 		else:
-			if len(value) > 53:
-				stripReg = value[0:50] + "..."
-			else:
-				stripReg = value
-			print "Use ignoreregex line : " + stripReg
-			self.__ignoreregex = [RegexStat(value)]
-		return True
+			print "Use %11s line : %s" % (regex, shortstr(value))
+			regex_values = [RegexStat(value)]
 
-	def readRegex(self, value):
-		if os.path.isfile(value):
-			reader = SafeConfigParserWithIncludes(defaults=self.CONFIG_DEFAULTS)
-			try:
-				reader.read(value)
-				print "Use regex file : " + value
-				self.__failregex = [RegexStat(m)
-									for m in reader.get("Definition", "failregex").split('\n')]
-			except NoSectionError:
-				print "No [Definition] section in " + value
-				print
-				return False
-			except NoOptionError:
-				print "No failregex option in " + value
-				print
-				return False
-			except MissingSectionHeaderError:
-				print "No section headers in " + value
-				print
-				return False
-		else:
-			if len(value) > 53:
-				stripReg = value[0:50] + "..."
-			else:
-				stripReg = value
-			print "Use regex line : " + stripReg
-			self.__failregex = [RegexStat(value)]
+		setattr(self, "_" + regex, regex_values)
 		return True
 
 	def testIgnoreRegex(self, line):
 		found = False
-		for regex in self.__ignoreregex:
-			logging.getLogger("fail2ban").setLevel(self.__logging_level)
+		for regex in self._ignoreregex:
+			logging.getLogger("fail2ban").setLevel(self._logging_level)
 			try:
-				self.__filter.addIgnoreRegex(regex.getFailRegex())
+				self._filter.addIgnoreRegex(regex.getFailRegex())
 				try:
-					ret = self.__filter.ignoreLine(line)
+					ret = self._filter.ignoreLine(line)
 					if ret:
+						found = True
 						regex.inc()
 				except RegexException, e:
 					print e
 					return False
 			finally:
-				self.__filter.delIgnoreRegex(0)
-				logging.getLogger("fail2ban").setLevel(self.__logging_level)
+				self._filter.delIgnoreRegex(0)
+				logging.getLogger("fail2ban").setLevel(self._logging_level)
+		return found
 
 	def testRegex(self, line):
 		found = False
-		for regex in self.__ignoreregex:
-			self.__filter.addIgnoreRegex(regex.getFailRegex())
-		for regex in self.__failregex:
-			logging.getLogger("fail2ban").setLevel(logging.DEBUG)
+		for regex in self._ignoreregex:
+			self._filter.addIgnoreRegex(regex.getFailRegex())
+		for regex in self._failregex:
+			# logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			try:
-				self.__filter.addFailRegex(regex.getFailRegex())
+				self._filter.addFailRegex(regex.getFailRegex())
 				try:
-					ret = self.__filter.processLine(line)
-					if not len(ret) == 0:
+					ret = self._filter.processLine(line)
+					if len(ret):
 						if found == True:
 							ret[0].append(True)
 						else:
@@ -247,16 +254,47 @@ class Fail2banRegex:
 					print "Sorry, but no <host> found in regex"
 					return False
 			finally:
-				self.__filter.delFailRegex(0)
+				self._filter.delFailRegex(0)
 				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
-		for regex in self.__ignoreregex:
-					self.__filter.delIgnoreRegex(0)
+		for regex in self._ignoreregex:
+			self._filter.delIgnoreRegex(0)
+		return found
+
+
+	def process(self, test_lines):
+
+		for line in test_lines:
+			if line.startswith('# ') or not line.strip():
+				# skip comment and empty lines
+				continue
+			is_ignored = fail2banRegex.testIgnoreRegex(line)
+			if is_ignored:
+				self._line_stats.ignored_lines.append(line)
+
+			if fail2banRegex.testRegex(line):
+				assert(not is_ignored)
+				self._line_stats.matched += 1
+			else:
+				if not is_ignored:
+					self._line_stats.missed_lines.append(line)
+			self._line_stats.tested += 1
+
+	def printLines(self, ltype):
+		lstats = self._line_stats
+		assert(len(lstats.missed_lines) == lstats.tested - (lstats.matched + lstats.ignored))
+		l = lstats[ltype + '_lines']
+		if len(l):
+			header = "%s line(s):" % (ltype.capitalize(),)
+			if len(l) < 20 or getattr(self, '_print_all_' + ltype):
+				pprint_list([x.rstrip() for x in l], header)
+			else:
+				print "%s: too many to print.  Use --print-all-%s " \
+					  "to print all %d lines" % (header, ltype, len(l))
 
 	def printStats(self):
 		print
 		print "Results"
 		print "======="
-		print
 
 		def print_failregexes(title, failregexes):
 			# Print title
@@ -264,106 +302,78 @@ class Fail2banRegex:
 			for cnt, failregex in enumerate(failregexes):
 				match = failregex.getStats()
 				total += match
-				if (match or self.__verbose):
-					out.append("|  %d) [%d] %s" % (cnt+1, match, failregex.getFailRegex()))
-			print "%s: %d total" % (title, total)
-			if len(out):
-				print "|- #) [# of hits] regular expression"
-				print '\n'.join(out)
-				print '`-'
-			print
-			return total
+				if (match or self._verbose):
+					out.append("%2d) [%d] %s" % (cnt+1, match, failregex.getFailRegex()))
 
-		# Print title
-		total = print_failregexes("Failregex", self.__failregex)
-		_ = print_failregexes("Ignoreregex", self.__ignoreregex)
-
-		print "Summary"
-		print "======="
-		print
-
-		if total == 0:
-			print "Sorry, no match"
-			print
-			print "Look at the above section 'Running tests' which could contain important"
-			print "information."
-			return False
-		else:
-			# Print stats
-			print "Addresses found:"
-			for cnt, failregex in enumerate(self.__failregex):
-				if self.__verbose or len(failregex.getIPList()):
-					print "[%d]" % (cnt+1)
+				if self._verbose and len(failregex.getIPList()):
 					for ip in failregex.getIPList():
 						timeTuple = time.localtime(ip[1])
 						timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
-						print "    %s (%s)%s" % (
-							ip[0], timeString, ip[2] and " (already matched)" or "")
-			print
+						out.append("    %s  %s%s" % (
+							ip[0], timeString, ip[2] and " (already matched)" or ""))
 
-			print "Date template hits:"
-			for template in self.__filter.dateDetector.getTemplates():
-				if self.__verbose or template.getHits():
-					print `template.getHits()` + " hit(s): " + template.getName()
-			print
+			print "\n%s: %d total" % (title, total)
+			pprint_list(out, " #) [# of hits] regular expression")
+			return total
 
-			print "Success, the total number of match is " + str(total)
-			print
-			print "However, look at the above section 'Running tests' which could contain important"
-			print "information."
-			return True
+		# Print title
+		total = print_failregexes("Failregex", self._failregex)
+		_ = print_failregexes("Ignoreregex", self._ignoreregex)
+
+
+		print "\nDate template hits:"
+		out = []
+		for template in self._filter.dateDetector.getTemplates():
+			if self._verbose or template.getHits():
+				out.append("[%d] %s" % (template.getHits(), template.getName()))
+		pprint_list(out, "[# of hits] date format")
+
+		print "\nLines: %s" % self._line_stats
+
+		self.printLines('ignored')
+		self.printLines('missed')
+
+		return True
 
 
 if __name__ == "__main__":
-	fail2banRegex = Fail2banRegex()
-	# Reads the command line options.
-	try:
-		cmdOpts = 'hVcv'
-		cmdLongOpts = ['help', 'version', 'verbose']
-		optList, args = getopt.getopt(sys.argv[1:], cmdOpts, cmdLongOpts)
-	except getopt.GetoptError:
-		fail2banRegex.dispUsage()
-		sys.exit(-1)
-	# Process command line
-	fail2banRegex.getCmdLineOptions(optList)
+
+	parser = get_opt_parser()
+	(opts, args) = parser.parse_args()
+
+	fail2banRegex = Fail2banRegex(opts)
 
 	# We need 2 or 3 parameters
 	if not len(args) in (2, 3):
-		fail2banRegex.dispUsage()
+		sys.stderr.write("ERROR: provide both <LOG> and <REGEX>.\n\n")
+		parser.print_help()
 		sys.exit(-1)
+
+	print
+	print "Running tests"
+	print "============="
+	print
+
+	cmd_log, cmd_regex = args[:2]
+
+	if len(args) == 3:
+		fail2banRegex.readRegex(args[2], 'ignore') or sys.exit(-1)
+
+	fail2banRegex.readRegex(cmd_regex, 'fail') or sys.exit(-1)
+
+	if os.path.isfile(cmd_log):
+		try:
+			hdlr = open(cmd_log)
+			print "Use         log file : %s" % cmd_log
+			test_lines = hdlr.readlines()
+		except IOError, e:
+			print e
+			sys.exit(-1)
 	else:
-		print
-		print "Running tests"
-		print "============="
-		print
+		print "Use      single line : %s" % shortstr(cmd_log)
+		test_lines = [ cmd_log ]
+	print
 
-		cmd_log, cmd_regex = args[:2]
+	fail2banRegex.process(test_lines)
 
-		if len(args) == 3:
-			fail2banRegex.readIgnoreRegex(args[2]) or sys.exit(-1)
-
-		fail2banRegex.readRegex(cmd_regex) or sys.exit(-1)
-
-		if fail2banRegex.logIsFile(cmd_log):
-			try:
-				hdlr = open(cmd_log)
-				print "Use log file   : " + cmd_log
-				print
-				for line in hdlr:
-					fail2banRegex.testIgnoreRegex(line)
-					fail2banRegex.testRegex(line)
-			except IOError, e:
-				print e
-				print
-				sys.exit(-1)
-		else:
-			if len(sys.argv[1]) > 53:
-				stripLog = cmd_log[0:50] + "..."
-			else:
-				stripLog = cmd_log
-			print "Use single line: " + stripLog
-			print
-			fail2banRegex.testIgnoreRegex(cmd_log)
-			fail2banRegex.testRegex(cmd_log)
-
-		fail2banRegex.printStats() or sys.exit(-1)
+	fail2banRegex.printStats() or sys.exit(-1)

From e91419d361c9120896b67c92a1b811a7edf467ef Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Jun 2013 23:01:35 -0400
Subject: [PATCH 338/544] ENH: fail2ban-regex -- add specification of loglevels
 to enable

---
 fail2ban-regex | 60 ++++++++++++++++++++++++++++++++------------------
 1 file changed, 38 insertions(+), 22 deletions(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index af38d4d9..4f5ffd73 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -40,15 +40,16 @@ except ImportError, e:
 	sys.path.insert(1, "/usr/share/fail2ban")
 	from common.version import version
 
+from optparse import OptionParser, Option
+
 from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
 from server.filter import Filter
 from server.failregex import RegexException
 
-from optparse import OptionParser, Option
-
+from testcases.utils import FormatterWithTraceBack
 # Gets the instance of the logger.
-logSys = logging.getLogger("fail2ban.regex")
+logSys = logging.getLogger("fail2ban")
 
 def shortstr(s, l=53):
 	"""Return shortened string
@@ -88,7 +89,7 @@ IGNOREREGEX:
 	p.add_options([
 		Option('-l', "--log-level", type="choice",
 			   dest="log_level",
-			   choices=('debug', 'info', 'warn', 'error', 'fatal'),
+			   choices=('heavydebug', 'debug', 'info', 'warning', 'error', 'fatal'),
 			   default=None,
 			   help="Log level for the Fail2Ban logger to use"),
 		Option("-v", "--verbose", action='store_true',
@@ -97,6 +98,10 @@ IGNOREREGEX:
 			   help="Either to print all missed lines"),
 		Option("--print-all-ignored", action='store_true',
 			   help="Either to print all ignored lines"),
+		Option("-t", "--log-traceback", action='store_true',
+			   help="Enrich log-messages with compressed tracebacks"),
+		Option("--full-traceback", action='store_true',
+			   help="Either to make the tracebacks full, not compressed (as by default)"),
 
 		])
 
@@ -156,9 +161,6 @@ class LineStats(object):
 
 class Fail2banRegex(object):
 
-	# ???
-	test = None
-
 	CONFIG_DEFAULTS = {'configpath' : "/etc/fail2ban/"}
 
 	def __init__(self, opts):
@@ -171,17 +173,6 @@ class Fail2banRegex(object):
 		self._failregex = list()
 		self._line_stats = LineStats()
 
-		# Setup logging
-		logging.getLogger("fail2ban").handlers = []
-		self._hdlr = logging.StreamHandler(Fail2banRegex.test)
-		# set a format which is simpler for console use
-		formatter = logging.Formatter("%(message)s")
-		# tell the handler to use this format
-		self._hdlr.setFormatter(formatter)
-		self._logging_level = self._verbose and logging.DEBUG or logging.WARN
-		logging.getLogger("fail2ban").addHandler(self._hdlr)
-		logging.getLogger("fail2ban").setLevel(logging.ERROR)
-
 
 	def readRegex(self, value, regextype):
 		assert(regextype in ('fail', 'ignore'))
@@ -213,7 +204,6 @@ class Fail2banRegex(object):
 	def testIgnoreRegex(self, line):
 		found = False
 		for regex in self._ignoreregex:
-			logging.getLogger("fail2ban").setLevel(self._logging_level)
 			try:
 				self._filter.addIgnoreRegex(regex.getFailRegex())
 				try:
@@ -226,7 +216,6 @@ class Fail2banRegex(object):
 					return False
 			finally:
 				self._filter.delIgnoreRegex(0)
-				logging.getLogger("fail2ban").setLevel(self._logging_level)
 		return found
 
 	def testRegex(self, line):
@@ -234,7 +223,6 @@ class Fail2banRegex(object):
 		for regex in self._ignoreregex:
 			self._filter.addIgnoreRegex(regex.getFailRegex())
 		for regex in self._failregex:
-			# logging.getLogger("fail2ban").setLevel(logging.DEBUG)
 			try:
 				self._filter.addFailRegex(regex.getFailRegex())
 				try:
@@ -255,7 +243,6 @@ class Fail2banRegex(object):
 					return False
 			finally:
 				self._filter.delFailRegex(0)
-				logging.getLogger("fail2ban").setLevel(logging.CRITICAL)
 		for regex in self._ignoreregex:
 			self._filter.delIgnoreRegex(0)
 		return found
@@ -349,6 +336,35 @@ if __name__ == "__main__":
 		parser.print_help()
 		sys.exit(-1)
 
+	# TODO: taken from -testcases -- move common functionality somewhere
+	if opts.log_level is not None: # pragma: no cover
+		# so we had explicit settings
+		logSys.setLevel(getattr(logging, opts.log_level.upper()))
+	else: # pragma: no cover
+		# suppress the logging but it would leave unittests' progress dots
+		# ticking, unless like with '-l fatal' which would be silent
+		# unless error occurs
+		logSys.setLevel(getattr(logging, 'FATAL'))
+
+	# Add the default logging handler
+	stdout = logging.StreamHandler(sys.stdout)
+
+	fmt = 'D: %(message)s'
+
+	if opts.log_traceback:
+		Formatter = FormatterWithTraceBack
+		fmt = (opts.full_traceback and ' %(tb)s' or ' %(tbc)s') + fmt
+	else:
+		Formatter = logging.Formatter
+
+	# Custom log format for the verbose tests runs
+	if opts.verbose > 1: # pragma: no cover
+		stdout.setFormatter(Formatter(' %(asctime)-15s %(thread)s' + fmt))
+	else: # pragma: no cover
+		# just prefix with the space
+		stdout.setFormatter(Formatter(fmt))
+	logSys.addHandler(stdout)
+
 	print
 	print "Running tests"
 	print "============="

From 9b351350dd5c5b6e91a2eabc31741d95fffdf63c Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Jun 2013 23:19:08 -0400
Subject: [PATCH 339/544] DOC: Changelog for asterisk hardening

---
 ChangeLog | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 590edfa6..1ea46aed 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,7 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - New Features:
   
 - Enhancements:
-  
+  Daniel Black
+   * config/filter.d/asterisk.conf -- more stringent anchoring
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------

From 77044fce35be6e7e1d6310521227f6a25ea61ac9 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 13 Jun 2013 23:21:48 -0400
Subject: [PATCH 340/544] DOC: Changelog for fail2ban-regex RF

---
 ChangeLog | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 1ea46aed..316d20f2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - Enhancements:
   Daniel Black
    * config/filter.d/asterisk.conf -- more stringent anchoring
+  Yaroslav Halchenko
+   * fail2ban-regex -- refactored to provide more details (missing and
+     ignored lines, control over logging, etc) while maintaining look&feel.
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------

From a433a8ea5fa4762d46208977327428329c62fcc3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 15:21:50 +1000
Subject: [PATCH 341/544] ENH: readibility thanks to Yaroslav

---
 config/filter.d/exim.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 511f30b8..2c4a516b 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -14,7 +14,7 @@
 # Values:  TEXT
 #
 failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
-             ^ login authenticator failed for ([^\s\(]+\s)?\([^)]*\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))\s*$
+             ^ login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 8cc13b5b4013137a51365013c3bd36618fff2548 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 14 Jun 2013 18:12:53 +1000
Subject: [PATCH 342/544] BF/ENH: Incorrect authentication data doesn't need
 tailier so that's optional. Also gained log entry for Unrouteable address

---
 config/filter.d/exim.conf | 4 ++--
 testcases/files/logs/exim | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 2c4a516b..d335c9fc 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -13,8 +13,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = \[<HOST>\] .*(?:rejected by local_scan|Unrouteable address)
-             ^ login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))\s*$
+failregex = ^ H=\S+ \(\S+\) \[<HOST>\] sender verify fail for <\S+>: (?:rejected by local_scan|Unrouteable address)\s*$
+             ^ login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 5bfc4060..d86b6455 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -2,3 +2,5 @@
 2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)
 # From IRC 2013-06-13 XATRIX (Georgiy Mernov)
 2013-06-12 03:57:58 login authenticator failed for (ylmf-pc) [120.196.140.45]: 535 Incorrect authentication data: 1 Time(s)
+2013-06-12 13:18:11 login authenticator failed for (USER-KVI9FGS9KP) [101.66.165.86]: 535 Incorrect authentication data
+2013-06-10 10:10:59 H=ufficioestampa.it (srv.ufficioestampa.it) [193.169.56.211] sender verify fail for <user@example.com>: Unrouteable address

From d441d61a1e6d982d408823d807028c8233abbb59 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 15 Jun 2013 12:34:16 +1000
Subject: [PATCH 343/544] TST/ENH: Improve regex around exim

rejected by local_scan now has test cases.

Unrouteable address error messages now normalised after looking into
exim code.
---
 config/filter.d/exim.conf | 7 ++++++-
 testcases/files/logs/exim | 6 ++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index d335c9fc..da975d61 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -13,7 +13,12 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^ H=\S+ \(\S+\) \[<HOST>\] sender verify fail for <\S+>: (?:rejected by local_scan|Unrouteable address)\s*$
+
+# From exim source code: ./src/receive.c:add_host_info_for_log
+host_info = H=\S+ (\(\S+\) )?\[<HOST>\] (?:I=\[\S+\]:\d+ )?(?:U=\S+ )?(P=e?smtp )?
+
+failregex = ^ %(host_info)ssender verify fail for <\S+>: Unrouteable address\s*$
+             ^ \S+ F=(?:<>|\S+@\S+) %(host_info)s(?:temporarily )?rejected by local_scan\(\): .{0,256}$
              ^ login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
 
 # Option:  ignoreregex
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index d86b6455..d7f0e58b 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -4,3 +4,9 @@
 2013-06-12 03:57:58 login authenticator failed for (ylmf-pc) [120.196.140.45]: 535 Incorrect authentication data: 1 Time(s)
 2013-06-12 13:18:11 login authenticator failed for (USER-KVI9FGS9KP) [101.66.165.86]: 535 Incorrect authentication data
 2013-06-10 10:10:59 H=ufficioestampa.it (srv.ufficioestampa.it) [193.169.56.211] sender verify fail for <user@example.com>: Unrouteable address
+# http://forum.lissyara.su/viewtopic.php?f=20&t=2985
+2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
+# http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
+2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
+# http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
+2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0

From ee786671aa5824d908275398ccdcd17cc0ad099d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 15 Jun 2013 13:17:09 +1000
Subject: [PATCH 344/544] DOC: developing filters without DoS

---
 DEVELOP | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 85 insertions(+), 2 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index bebc12b3..474ddc81 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -41,8 +41,91 @@ Filters
   example.com/example.org used for DNS names
 * Ensure ./fail2ban-regex testcases/files/logs/{samplelog} config/filter.d/{filter}.conf
   has matches for EVERY regex
-* Ensure regexs end with a $ and are restrictive as possible. E.g. not .* if
- [0-9]+ is sufficient
+* Ensure regexs start with a ^ and are restrictive as possible. E.g. not .* if
+  \d+ is sufficient
+* Use the functionality of regexs http://docs.python.org/2/library/re.html
+* Take a look at the source code of the application. You may see optional or
+  extra log messages, or parts there of, that need to form part of your regex.
+
+If you only have a basic knowledge of regular repressions read
+http://docs.python.org/2/library/re.html first.
+
+Filter Security
+---------------
+
+Poor filter regular expressions are suseptable to DoS attacks.
+
+When a remote user has the ability to introduce text that will match the 
+filter regex such that the inserted text matches the <HOST> part they have the
+ability to deny any host they choose.
+
+So the <HOST> part must be anchored on text generated by the application and not
+the user. Ideally this should anchor to the beginning and end of the log line
+however as more applications log at the beginning than the end, achoring the 
+beginning is more important.
+
+When creating a regex that extends back to the begining remember the date part
+has been removed within fail2ban so theres no need to match that. If the format
+is like '<date...> error 1.2.3.4 is evil' then you will need to match the < at
+the start so here the regex would start like '^<> <HOST> is evil$'.
+
+Some applications log spaces at the end. If you're not sure add \s*$ as the
+end part of the regex.
+
+Examples of poor filters
+------------------------
+
+1. Too restrictive
+
+We find a log message:
+
+    Apr-07-13 07:08:36 Invalid command fial2ban from 1.2.3.4
+
+We make a failregex
+
+    ^Invalid command \S+ from <HOST>
+
+Now think evil. The user does the command 'blah from 1.2.3.44'
+
+The program diliently logs:
+
+    Apr-07-13 07:08:36 Invalid command blah from 1.2.3.44 from 1.2.3.4
+
+And fail2ban matches 1.2.3.44 as the IP that it ban. A DoS attack was successful.
+
+The fix here is that the command can be anything so .* is approprate.
+
+    ^Invalid command .* from <HOST>
+
+Here the .* will match until the end of the string. Then realise it has more to
+match, i.e. "from <HOST>" and go back until it find this. Then it will ban
+1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex witha $
+
+    ^Invalid command .* from <HOST>$
+
+Note if we'd just had the expression:
+
+    ^Invalid command \S+ from <HOST>$
+
+Then provided the user put a space in their command they would have never been
+banned.
+
+2. Applicaiton generates two identical log messages with different meanings
+
+If the application generates the following two messages under different
+circmstances:
+
+    client <IP>: authentication failed
+    client <USER>: authentication failed
+
+
+Then its obvious that a regex of "^client <HOST>: authentication
+failed$" will still cause problems if the user can trigger the second
+log message with a <USER> of 123.1.1.1.
+
+Here there's nothing to do except request/change the application so it logs
+messages differently.
+
 
 Code Testing
 ============

From b8cfda68b8dfda32648db621cd256d334eca0365 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 16 Jun 2013 00:19:37 +1000
Subject: [PATCH 345/544] ENH: new exim filter regexs. Also note a begining PID
 in this format. Thanks to ftoppi for the log entries

---
 ChangeLog                 |  2 +-
 THANKS                    |  1 +
 config/filter.d/exim.conf | 13 +++++++++----
 testcases/files/logs/exim |  8 ++++++++
 4 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f0df7ddc..842932fc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,7 +19,7 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
      and extra failure examples in sample logs
-  Daniel Black & Georgiy Mernov
+  Daniel Black & Georgiy Mernov & ftoppi
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
 
diff --git a/THANKS b/THANKS
index 47c3e999..f8b18daa 100644
--- a/THANKS
+++ b/THANKS
@@ -18,6 +18,7 @@ Daniel Black
 David Nutter
 Eric Gerbier
 Enrico Labedzki
+ftoppi
 Georgiy Mernov
 Guillaume Delvit
 Hanno 'Rince' Wagner
diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index da975d61..62184fbf 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -15,11 +15,16 @@
 #
 
 # From exim source code: ./src/receive.c:add_host_info_for_log
-host_info = H=\S+ (\(\S+\) )?\[<HOST>\] (?:I=\[\S+\]:\d+ )?(?:U=\S+ )?(P=e?smtp )?
+host_info = H=([\w.-]+ )?(\(\S+\) )?\[<HOST>\](:\d+)? (?:I=\[\S+\]:\d+ )?(?:U=\S+ )?(P=e?smtp )?
+pid = ( \[\d+\])?
 
-failregex = ^ %(host_info)ssender verify fail for <\S+>: Unrouteable address\s*$
-             ^ \S+ F=(?:<>|\S+@\S+) %(host_info)s(?:temporarily )?rejected by local_scan\(\): .{0,256}$
-             ^ login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: Unrouteable address\s*$
+             ^%(pid)s \S+ F=(?:<>|\S+@\S+) %(host_info)s(?:temporarily )?rejected by local_scan\(\): .{0,256}$
+             ^%(pid)s login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+             ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (rejected found in dnsbl \S+|relay not permitted)\s*$
+             ^%(pid)s \S+ %(host_info)sF=(?:<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
+             ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
+             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index d7f0e58b..ebcb9726 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -10,3 +10,11 @@
 2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
 # http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
 2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0
+# https://github.com/fail2ban/fail2ban/pull/251#issuecomment-19493875
+2013-06-15 11:19:33 [2249] H=([2.181.148.95]) [2.181.148.95]:52391 I=[1.2.3.4]:25 F=fantasizesg4@google.com rejected RCPT some@email.com: rejected found in dnsbl zen.spamhaus.org
+2013-06-10 18:33:32 [10099] H=(yakult.com.tw) [202.132.70.178]:3755 I=[1.2.3.4]:25 F=menacedsj04@listserv.eurasia.org rejected RCPT dir@ml3.ru: relay not permitted
+2013-06-09 10:21:28 [14127] 1UlasQ-0003fr-45 F=mcorporation4@aol.com H=(mail38.fssprus.ru) [46.254.240.82]:43671 I=[1.2.3.4]:25 P=esmtp rejected by local_scan(): Rejected
+2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL).
+2013-06-02 06:54:20 [13314] SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[211.148.195.192]:25936 I=[1.2.3.4]:25 input="GET / HTTP/1.1\r\n\r\n"
+2013-06-02 09:05:48 [18505] SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "RSET" H=ba77.mx83.fr [82.96.160.77]:58302 I=[1.2.3.4]:25 next input="QUIT\r\n"
+2013-06-02 09:22:05 [19591] SMTP call from pc012-6201.spo.scu.edu.tw [163.14.21.161]:3767 I=[1.2.3.4]:25 dropped: too many nonmail commands (last was "RSET")

From 25c3bbfc2fead08c54891f293f5522d61199a62e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 16 Jun 2013 00:25:24 +1000
Subject: [PATCH 346/544] DOC: credits/blame to me for changes to exim

---
 config/filter.d/exim.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 62184fbf..252da07a 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -1,7 +1,7 @@
 # Fail2Ban configuration file
 #
 # Author: Cyril Jaquier
-#
+#         Daniel Black (rewrote with strong regexs)
 #
 
 [Definition]

From 2974cac40cc7709909fcb11a510f164c88e7db46 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 19 Jun 2013 22:10:18 -0400
Subject: [PATCH 347/544] RF: log all logging output from fail2ban-client to
 stderr. Close #264

otherwise it
1. 'interferes' with meaninful output of the client
2. if ERROR is logged it better go to stderr and separating ERROR from other levels is not that transparent with python's logging
---
 ChangeLog       | 3 ++-
 fail2ban-client | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a6bc4e21..f2425d2f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -24,7 +24,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
      sample logs
   Yaroslav Halchenko
    * fail2ban-regex -- refactored to provide more details (missing and
-     ignored lines, control over logging, etc) while maintaining look&feel.
+     ignored lines, control over logging, etc) while maintaining look&feel
+   * fail2ban-client -- log to standard error
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
diff --git a/fail2ban-client b/fail2ban-client
index de8519f4..57235d79 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -336,13 +336,13 @@ class Fail2banClient:
 			logSys.setLevel(logging.INFO)
 		else:
 			logSys.setLevel(logging.DEBUG)
-		# Add the default logging handler
-		stdout = logging.StreamHandler(sys.stdout)
+		# Add the default logging handler to dump to stderr
+		logout = logging.StreamHandler(sys.stderr)
 		# set a format which is simpler for console use
 		formatter = logging.Formatter('%(levelname)-6s %(message)s')
 		# tell the handler to use this format
-		stdout.setFormatter(formatter)
-		logSys.addHandler(stdout)
+		logout.setFormatter(formatter)
+		logSys.addHandler(logout)
 
 		# Set the configuration path
 		self.__configurator.setBaseDir(self.__conf["conf"])

From b6be8b8243273bbe6549a1f1057e8633e767c314 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 21 Jun 2013 11:09:16 -0400
Subject: [PATCH 348/544] ENH/RF: remove __readJailConfig in favor of
 __readConfig + catch/error exceptions while reading the configuration

---
 fail2ban-client | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/fail2ban-client b/fail2ban-client
index 57235d79..be48a613 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -229,7 +229,7 @@ class Fail2banClient:
 		elif len(cmd) == 2 and cmd[0] == "reload":
 			if self.__ping():
 				jail = cmd[1]
-				ret = self.__readJailConfig(jail)
+				ret = self.__readConfig(jail)
 				# Do not continue if configuration is not 100% valid
 				if not ret:
 					return False
@@ -394,19 +394,18 @@ class Fail2banClient:
 				return False
 			return self.__processCommand(args)
 
-	def __readConfig(self):
+	def __readConfig(self, jail=None):
 		# Read the configuration
-		self.__configurator.readAll()
-		ret = self.__configurator.getOptions()
-		self.__configurator.convertToProtocol()
-		self.__stream = self.__configurator.getConfigStream()
-		return ret
-
-	def __readJailConfig(self, jail):
-		self.__configurator.readAll()
-		ret = self.__configurator.getOptions(jail)
-		self.__configurator.convertToProtocol()
-		self.__stream = self.__configurator.getConfigStream()
+		# TODO: get away from stew of return codes and exception
+		# handling -- handle via exceptions
+		try:
+			self.__configurator.readAll()
+			ret = self.__configurator.getOptions(jail)
+			self.__configurator.convertToProtocol()
+			self.__stream = self.__configurator.getConfigStream()
+		except Exception, e:
+			logSys.error("Failed during configuration: %s" % e)
+			ret = False
 		return ret
 
 	#@staticmethod

From 27947407bc7910f0f50972113218ebc73c4a22c7 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 21 Jun 2013 11:08:27 -0400
Subject: [PATCH 349/544] ENH: raise an exception if not a single file was
 found for the jail. Close #63

---
 client/jailreader.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index f8757e26..ef444125 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -107,12 +107,17 @@ class JailReader(ConfigReader):
 		stream = []
 		for opt in self.__opts:
 			if opt == "logpath":
+				found_files = 0
 				for path in self.__opts[opt].split("\n"):
 					pathList = glob.glob(path)
 					if len(pathList) == 0:
-						logSys.error("No file found for " + path)
+						logSys.error("No file(s) found for glob %s" % path)
 					for p in pathList:
+						found_files += 1
 						stream.append(["set", self.__name, "addlogpath", p])
+				if not found_files:
+					raise ValueError(
+						"Have not found any log file for %s jail" % self.__name)
 			elif opt == "backend":
 				backend = self.__opts[opt]
 			elif opt == "maxretry":

From 61f81c6b2f17576e970967a918997af55bc2b829 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 21 Jun 2013 11:12:27 -0400
Subject: [PATCH 350/544] Changelog entries with close statements for recent
 changes

---
 ChangeLog | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index f2425d2f..0dd7a073 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -25,7 +25,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
   Yaroslav Halchenko
    * fail2ban-regex -- refactored to provide more details (missing and
      ignored lines, control over logging, etc) while maintaining look&feel
-   * fail2ban-client -- log to standard error
+   * fail2ban-client -- log to standard error. Closes gh-264
+   * Fail to configure if not a single log file was found for an
+     enabled jail. Closes gh-63
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------

From 057f0ad1357273f027b944e046d66e486c2f197f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 21 Jun 2013 12:44:37 -0400
Subject: [PATCH 351/544] ENH: allow_no_files option for jail's convert to
 allow testing of stock jail.conf

---
 client/jailreader.py              | 13 +++++++++++--
 client/jailsreader.py             | 13 +++++++++++--
 testcases/clientreadertestcase.py |  2 +-
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/client/jailreader.py b/client/jailreader.py
index ef444125..1a2be432 100644
--- a/client/jailreader.py
+++ b/client/jailreader.py
@@ -103,7 +103,16 @@ class JailReader(ConfigReader):
 				logSys.warn("No actions were defined for %s" % self.__name)
 		return True
 	
-	def convert(self):
+	def convert(self, allow_no_files=False):
+		"""Convert read before __opts to the commands stream
+
+		Parameters
+		----------
+		allow_missing : bool
+		  Either to allow log files to be missing entirely.  Primarily is
+		  used for testing
+		 """
+
 		stream = []
 		for opt in self.__opts:
 			if opt == "logpath":
@@ -115,7 +124,7 @@ class JailReader(ConfigReader):
 					for p in pathList:
 						found_files += 1
 						stream.append(["set", self.__name, "addlogpath", p])
-				if not found_files:
+				if not (found_files or allow_no_files):
 					raise ValueError(
 						"Have not found any log file for %s jail" % self.__name)
 			elif opt == "backend":
diff --git a/client/jailsreader.py b/client/jailsreader.py
index 098b525d..408a40bf 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -79,14 +79,23 @@ class JailsReader(ConfigReader):
 					return False
 		return True
 	
-	def convert(self):
+	def convert(self, allow_no_files=False):
+		"""Convert read before __opts and jails to the commands stream
+
+		Parameters
+		----------
+		allow_missing : bool
+		  Either to allow log files to be missing entirely.  Primarily is
+		  used for testing
+		"""
+
 		stream = list()
 		for opt in self.__opts:
 			if opt == "":
 				stream.append([])
 		# Convert jails
 		for jail in self.__jails:
-			stream.extend(jail.convert())
+			stream.extend(jail.convert(allow_no_files=allow_no_files))
 		# Start jails
 		for jail in self.__jails:
 			stream.append(["start", jail.getName()])
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index a8c60bf8..948431b3 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -132,7 +132,7 @@ class JailsReaderTest(unittest.TestCase):
 		jails = JailsReader(basedir='config', force_enable=True) # we are running tests from root project dir atm
 		self.assertTrue(jails.read())		  # opens fine
 		self.assertTrue(jails.getOptions())	  # reads fine
-		comm_commands = jails.convert()
+		comm_commands = jails.convert(allow_no_files=True)
 
 		# by default we have lots of jails ;)
 		self.assertTrue(len(comm_commands))

From fa7a105483e6653d45830ae0336c84daba6899fc Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 27 Jun 2013 09:16:14 +1000
Subject: [PATCH 352/544] ENH: filter.d/asterisk - consolidate log prefix regex
 and add a few fail messages

---
 ChangeLog                     |  2 ++
 THANKS                        |  1 +
 config/filter.d/asterisk.conf | 29 ++++++++++++++++-------------
 testcases/files/logs/asterisk |  6 ++++++
 4 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a6bc4e21..44744a76 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,6 +22,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
   Daniel Black & Georgiy Mernov
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
+  Daniel Black & Sebastian Arcus
+	 * filter.d/asterisk -- more regexes
   Yaroslav Halchenko
    * fail2ban-regex -- refactored to provide more details (missing and
      ignored lines, control over logging, etc) while maintaining look&feel.
diff --git a/THANKS b/THANKS
index 47c3e999..c549d77f 100644
--- a/THANKS
+++ b/THANKS
@@ -40,6 +40,7 @@ Raphaël Marichez
 René Berber
 Robert Edeker
 Russell Odom
+Sebastian Arcus
 Sireyessire
 silviogarbes
 Stephen Gildea
diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index a8f65e09..6d351f8b 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -17,19 +17,22 @@ before = common.conf
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT
 #
-failregex = ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
-            ^\[\]\s*NOTICE%(__pid_re)s\[\S+\] \S+: Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Host <HOST> failed to authenticate as '[^']*'$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: No registration for peer '[^']*' \(from <HOST>\)$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
-            ^\[\]\s*NOTICE%(__pid_re)s \S+: Failed to authenticate user [^@]+@<HOST>\S*$
-            ^\[\]\s*SECURITY%(__pid_re)s \S+: SecurityEvent="InvalidAccountID",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
+log_prefix= \[\]\s*(?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[\S+\d*\])? \S+:\d*
+
+failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
+            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
+            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
+            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
+            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
+            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
+            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
+            ^%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
+            ^%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
+            ^%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
+            ^%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
+            ^%(log_prefix)s Failed to authenticate user [^@]+@<HOST>\S*$
+            ^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*
+            ^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index 45b69304..e2fe3b6e 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -13,3 +13,9 @@
 [2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@1.2.3.4' failed for '1.2.3.4:23930' - No matching peer found
 [2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/1.2.3.4/5060",RemoteAddress="IPV4/UDP/1.2.3.4/5070"
 [2013-06-10 18:15:03] NOTICE[2723] chan_sip.c: Registration from '"100"<sip:100@192.168.0.2:5060>' failed for '1.2.3.4' - Not a local domain
+# http://forum.4psa.com/showthread.php?t=6601
+[2009-12-22 16:35:24] NOTICE[6163] chan_sip.c: Sending fake auth rejection for device <sip:0004*001@192.168.2.102>;tag=e3793a95e1acbc69o
+# http://www.freepbx.org/forum/general-help/fake-auth-rejection
+[2009-12-22 16:35:24] NOTICE[1570][C-00000086] chan_sip.c: Sending fake auth rejection for device 1022<sip:1022@192.168.2.102>;tag=5d8b6f92
+# http://www.spinics.net/lists/asterisk/msg127381.html
+[2009-12-22 16:35:24] NOTICE[14916]: chan_sip.c:15644 handle_request_subscribe: Sending fake auth rejection for user <sip:CS@192.168.2.102>;tag=6pwd6erg54

From 6d331bcbea049b31a146f2196aeb33bfdccbe30f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 27 Jun 2013 11:43:27 -0400
Subject: [PATCH 353/544] BF: make colon after [daemon] optional.  Close #267

---
 ChangeLog                   | 3 ++-
 config/filter.d/common.conf | 2 +-
 testcases/files/logs/sshd   | 3 +++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a3ac95ce..45c6f343 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,7 +11,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 -----------
 
 - Fixes:
-  
+  Yaroslav Halchenko
+   * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf
index aafeb5ca..d44a6325 100644
--- a/config/filter.d/common.conf
+++ b/config/filter.d/common.conf
@@ -33,7 +33,7 @@ __daemon_extra_re = (?:\[ID \d+ \S+\])
 
 # Combinations of daemon name and PID
 # EXAMPLES: sshd[31607], pop(pam_unix)[4920]
-__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
+__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?)
 
 # Some messages have a kernel prefix with a timestamp
 # EXAMPLES: kernel: [769570.846956]
diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index 5dab1606..1943fb37 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -46,3 +46,6 @@ Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error
 Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201
 Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102
 Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103
+
+#11 https://github.com/fail2ban/fail2ban/issues/267  There might be no colon after [daemon]
+Jun 25 23:53:34 [sshd] User root from 1.2.3.4 not allowed because not listed in AllowUsers

From 1b170b2aef828899ad6596ada0c379c6e07a620e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 28 Jun 2013 09:34:12 -0400
Subject: [PATCH 354/544] BF: support apache 2.4 more detailed error log
 format.  Close #268

---
 ChangeLog                          | 2 ++
 config/filter.d/apache-common.conf | 6 +++++-
 testcases/files/logs/apache-nohome | 4 ++++
 3 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 testcases/files/logs/apache-nohome

diff --git a/ChangeLog b/ChangeLog
index 45c6f343..e5c38eb1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - Fixes:
   Yaroslav Halchenko
    * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
+   * filter.d/apache-common.conf -- support apache 2.4 more detailed error
+     log format.  Closes gh-268
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
index c3829e2f..cc35ae5f 100644
--- a/config/filter.d/apache-common.conf
+++ b/config/filter.d/apache-common.conf
@@ -14,4 +14,8 @@ after = apache-common.local
 [DEFAULT]
 
 # Common prefix for [error] apache messages which also would include <HOST>
-_apache_error_client = \[[^]]+\] \[error\] \[client <HOST>\]
+# Depending on the version it could be
+# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
+# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
+# Reference: https://github.com/fail2ban/fail2ban/issues/268
+_apache_error_client = \[[^]]+\] \[(error|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]( \S+:)?
diff --git a/testcases/files/logs/apache-nohome b/testcases/files/logs/apache-nohome
new file mode 100644
index 00000000..e8ef56bc
--- /dev/null
+++ b/testcases/files/logs/apache-nohome
@@ -0,0 +1,4 @@
+# Apache 2.2
+[Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4] File does not exist: /xxx/~
+# Apache 2.4
+[Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 192.0.2.12:46652] AH00128: File does not exist: /xxx/~

From 0086a7edabaffc0524ed8dd02e679c9cdcd577fb Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 29 Jun 2013 11:30:37 +1000
Subject: [PATCH 355/544] ENH: missed a $

---
 config/filter.d/asterisk.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 6d351f8b..5e775430 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -31,7 +31,7 @@ failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?'
             ^%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
             ^%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
             ^%(log_prefix)s Failed to authenticate user [^@]+@<HOST>\S*$
-            ^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*
+            ^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
             ^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
 
 # Option:  ignoreregex

From ec0680d73ad6eb8cc136ac5493be9a636b1ee519 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 29 Jun 2013 19:17:22 +0100
Subject: [PATCH 356/544] BF: fail2ban-regex when using ignoreregex file with
 empty regex

---
 fail2ban-regex | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index 4f5ffd73..78716a43 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -183,8 +183,10 @@ class Fail2banRegex(object):
 				reader.read(value)
 				print "Use %11s file : %s" % (regex, value)
 				# TODO: reuse functionality in client
-				regex_values = [RegexStat(m)
-							    for m in reader.get("Definition", regex).split('\n')]
+				regex_values = [
+					RegexStat(m)
+					for m in reader.get("Definition", regex).split('\n')
+					if m != ""]
 			except NoSectionError:
 				print "No [Definition] section in %s" % value
 				return False

From b670b5c792bcdd6d49e25a84b52799a86b2abcfe Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 29 Jun 2013 20:17:42 +0100
Subject: [PATCH 357/544] TST: Change depreciated assertEquals to assertEqual
 in some tests

---
 testcases/actiontestcase.py       | 8 ++++----
 testcases/clientreadertestcase.py | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/testcases/actiontestcase.py b/testcases/actiontestcase.py
index 9a7776ac..1aa9f24e 100644
--- a/testcases/actiontestcase.py
+++ b/testcases/actiontestcase.py
@@ -69,11 +69,11 @@ class ExecuteAction(unittest.TestCase):
 		self.assertFalse(Action.substituteRecursiveTags({'A': '<B>', 'B': '<A>'}))
 		self.assertFalse(Action.substituteRecursiveTags({'A': '<B>', 'B': '<C>', 'C': '<A>'}))
 		# missing tags are ok
-		self.assertEquals(Action.substituteRecursiveTags({'A': '<C>'}), {'A': '<C>'})
-		self.assertEquals(Action.substituteRecursiveTags({'A': '<C> <D> <X>','X':'fun'}), {'A': '<C> <D> fun', 'X':'fun'})
-		self.assertEquals(Action.substituteRecursiveTags({'A': '<C> <B>', 'B': 'cool'}), {'A': '<C> cool', 'B': 'cool'})
+		self.assertEqual(Action.substituteRecursiveTags({'A': '<C>'}), {'A': '<C>'})
+		self.assertEqual(Action.substituteRecursiveTags({'A': '<C> <D> <X>','X':'fun'}), {'A': '<C> <D> fun', 'X':'fun'})
+		self.assertEqual(Action.substituteRecursiveTags({'A': '<C> <B>', 'B': 'cool'}), {'A': '<C> cool', 'B': 'cool'})
 		# rest is just cool
-		self.assertEquals(Action.substituteRecursiveTags(aInfo),
+		self.assertEqual(Action.substituteRecursiveTags(aInfo),
 								{ 'HOST': "192.0.2.0",
 									'ABC': '123 192.0.2.0',
 									'xyz': '890 123 192.0.2.0',
diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 948431b3..695b3877 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -108,7 +108,7 @@ class JailReaderTest(unittest.TestCase):
 		action = "mail-whois[name=SSH]"
 		expected = ['mail-whois', {'name': 'SSH'}]
 		result = JailReader.splitAction(action)
-		self.assertEquals(expected, result)
+		self.assertEqual(expected, result)
 
 class JailsReaderTest(unittest.TestCase):
 

From c2696fe641c92002b1535bb5ea76d47d442547a3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 30 Jun 2013 15:03:13 +1000
Subject: [PATCH 358/544] DOC: enhance development doc to show how
 CVE-2013-2178 was done

---
 DEVELOP | 45 +++++++++++++++++++++++++++++++++++++--------
 1 file changed, 37 insertions(+), 8 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index 474ddc81..2731fd13 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -56,13 +56,21 @@ Filter Security
 Poor filter regular expressions are suseptable to DoS attacks.
 
 When a remote user has the ability to introduce text that will match the 
-filter regex such that the inserted text matches the <HOST> part they have the
+filter regex, such that the inserted text matches the <HOST> part, they have the
 ability to deny any host they choose.
 
-So the <HOST> part must be anchored on text generated by the application and not
-the user. Ideally this should anchor to the beginning and end of the log line
-however as more applications log at the beginning than the end, achoring the 
-beginning is more important.
+So the <HOST> part must be anchored on text generated by the application, and not
+the user, to a sufficient extent that the user cannot insert the entire text.
+
+Filters are matched against the log line with their date removed.
+
+Ideally filter regex should anchor to the beginning and end of the log line
+however as more applications log at the beginning than the end, achoring the
+beginning is more important. If the log file used by the application is shared
+with other applications, like system logs, ensure the other application that
+use that log file do not log user generated text at the beginning of the line,
+or, if they do, ensure the regexs of the filter are sufficient to mitigate the
+risk of insertion.
 
 When creating a regex that extends back to the begining remember the date part
 has been removed within fail2ban so theres no need to match that. If the format
@@ -99,7 +107,7 @@ The fix here is that the command can be anything so .* is approprate.
 
 Here the .* will match until the end of the string. Then realise it has more to
 match, i.e. "from <HOST>" and go back until it find this. Then it will ban
-1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex witha $
+1.2.3.4 correctly. Since the <HOST> is always at the end, end the regex with a $.
 
     ^Invalid command .* from <HOST>$
 
@@ -110,7 +118,28 @@ Note if we'd just had the expression:
 Then provided the user put a space in their command they would have never been
 banned.
 
-2. Applicaiton generates two identical log messages with different meanings
+2. Filter regex can match other user injected data
+
+From the apache vulnerability CVE-2013-2178
+( original ref: https://vndh.net/note:fail2ban-089-denial-service ).
+
+An example bad regex for apache:
+
+    failregex = [[]client <HOST>[]] user .* not found
+
+Since the user can do a get request on:
+
+    GET /[client%20192.168.0.1]%20user%20root%20not%20found HTTP/1.0
+Host: remote.site
+
+Now the log line will be:
+
+    [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
+
+As this log line doesn't match other expressions hence it matches the above
+regex and blocks 192.168.33.1 as a denial of service from the HTTP requester.
+
+3. Applicaiton generates two identical log messages with different meanings
 
 If the application generates the following two messages under different
 circmstances:
@@ -119,7 +148,7 @@ circmstances:
     client <USER>: authentication failed
 
 
-Then its obvious that a regex of "^client <HOST>: authentication
+Then it's obvious that a regex of "^client <HOST>: authentication
 failed$" will still cause problems if the user can trigger the second
 log message with a <USER> of 123.1.1.1.
 

From 3b76fc79f9a6269aca915fc33ea15fcef1709ffb Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 1 Jul 2013 21:12:51 +1000
Subject: [PATCH 359/544] BF: fix dovecot filter for when no TLS is enabled on
 pop/imap

---
 ChangeLog                    | 2 ++
 THANKS                       | 1 +
 config/filter.d/dovecot.conf | 2 +-
 testcases/files/logs/dovecot | 1 +
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 45c6f343..c11215a7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - Fixes:
   Yaroslav Halchenko
    * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
+	Daniel Black & Мернов Георгий
+	 * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in ,
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/THANKS b/THANKS
index f8b18daa..eac3c6f0 100644
--- a/THANKS
+++ b/THANKS
@@ -33,6 +33,7 @@ Mark Edgington
 Markus Hoffmann
 Marvin Rouge
 mEDI
+Мернов Георгий
 Michael C. Haller
 Michael Hanselmann
 NickMunger
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index dd4c35ba..e3702fcf 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -17,7 +17,7 @@ _daemon = dovecot(-auth)?
 # Values:  TEXT
 #
 failregex = ^%(__prefix_line)s(pam_unix(?:\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
-            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3},( TLS( handshaking)?(: Disconnected)?)?\s*$
+            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=<HOST>, lip=(?:\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index f904a8fe..01df0af3 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -12,4 +12,5 @@ Jun 14 00:48:21 platypus dovecot: imap-login: Disconnected (auth failed, 1 attem
 Jun 13 20:48:11 platypus dovecot: pop3-login: Disconnected (no auth attempts): rip=121.44.24.254, lip=113.212.99.194, TLS: Disconnected
 Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth attempts): rip=180.200.180.81, lip=113.212.99.194, TLS
 Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected
+Jun 23 00:52:43 vhost1-ua dovecot: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts): user=<info>, method=PLAIN, rip=193.95.245.163, lip=176.214.13.210
 

From 72f9e6a51ecf12abb92d6d14349f3558c5e60c7c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 1 Jul 2013 21:50:35 +1000
Subject: [PATCH 360/544] ENH/TST: more samples and rejection types for sender
 verify fail and rejected RCPT

---
 ChangeLog                 | 2 +-
 config/filter.d/exim.conf | 4 ++--
 testcases/files/logs/exim | 6 ++++++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index c11215a7..549eb7f7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,7 +22,7 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
      and extra failure examples in sample logs
-  Daniel Black & Georgiy Mernov & ftoppi
+  Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
   Yaroslav Halchenko
diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 252da07a..fc744dd3 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -18,10 +18,10 @@
 host_info = H=([\w.-]+ )?(\(\S+\) )?\[<HOST>\](:\d+)? (?:I=\[\S+\]:\d+ )?(?:U=\S+ )?(P=e?smtp )?
 pid = ( \[\d+\])?
 
-failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: Unrouteable address\s*$
+failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
              ^%(pid)s \S+ F=(?:<>|\S+@\S+) %(host_info)s(?:temporarily )?rejected by local_scan\(\): .{0,256}$
              ^%(pid)s login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
-             ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (rejected found in dnsbl \S+|relay not permitted)\s*$
+             ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (rejected found in dnsbl \S+|relay not permitted|Sender verify failed|Unknown user)\s*$
              ^%(pid)s \S+ %(host_info)sF=(?:<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
              ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
              ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index ebcb9726..792f949e 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -18,3 +18,9 @@
 2013-06-02 06:54:20 [13314] SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[211.148.195.192]:25936 I=[1.2.3.4]:25 input="GET / HTTP/1.1\r\n\r\n"
 2013-06-02 09:05:48 [18505] SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "RSET" H=ba77.mx83.fr [82.96.160.77]:58302 I=[1.2.3.4]:25 next input="QUIT\r\n"
 2013-06-02 09:22:05 [19591] SMTP call from pc012-6201.spo.scu.edu.tw [163.14.21.161]:3767 I=[1.2.3.4]:25 dropped: too many nonmail commands (last was "RSET")
+2013-06-02 15:06:18 H=(VM-WIN2K3-1562) [46.20.35.114] sender verify fail for <usfh@technological-systems.com>: Unknown user
+2013-06-07 02:02:09 H=treeladders.kiev.ua [91.232.21.92] sender verify fail for <mailer@treeladders.kiev.ua>: all relevant MX records point to non-existent hosts
+2013-06-15 16:34:55 H=mx.tillions.com [182.18.24.93] F=<buh@caladan.ebay.sun.com> rejected RCPT <ruslan@maslovskiy.com.ua>: Sender verify failed
+2013-06-15 16:36:49 H=altmx.marsukov.com [111.67.203.116] F=<kadrofutcheti@mail.ru> rejected RCPT <oksana@birzhatm.ua>: Unknown user
+#2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F=<trudofspiori@mail.ru> rejected RCPT <info@nanomedtech.ua>: rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114
+

From 9757e1df2b84bd40a42d52eb4ede6890092998a9 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 1 Jul 2013 21:53:05 +1000
Subject: [PATCH 361/544] ENH: make groupings non-capturing

---
 config/filter.d/exim.conf | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index fc744dd3..9e8491b7 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -20,11 +20,11 @@ pid = ( \[\d+\])?
 
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
              ^%(pid)s \S+ F=(?:<>|\S+@\S+) %(host_info)s(?:temporarily )?rejected by local_scan\(\): .{0,256}$
-             ^%(pid)s login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
-             ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (rejected found in dnsbl \S+|relay not permitted|Sender verify failed|Unknown user)\s*$
+             ^%(pid)s login authenticator failed for (?:\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data(?: \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+             ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (?:rejected found in dnsbl \S+|relay not permitted|Sender verify failed|Unknown user)\s*$
              ^%(pid)s \S+ %(host_info)sF=(?:<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
-             ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
-             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
+             ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$
+             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (?:I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From ca996ace5e9bed218223da7fd96eff6606e64c04 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 1 Jul 2013 21:56:02 +1000
Subject: [PATCH 362/544] ENH: remove temporary failures from local_scan in
 line with comments in gh-258

---
 config/filter.d/exim.conf | 2 +-
 testcases/files/logs/exim | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 9e8491b7..49a7d2c4 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -19,7 +19,7 @@ host_info = H=([\w.-]+ )?(\(\S+\) )?\[<HOST>\](:\d+)? (?:I=\[\S+\]:\d+ )?(?:U=\S
 pid = ( \[\d+\])?
 
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
-             ^%(pid)s \S+ F=(?:<>|\S+@\S+) %(host_info)s(?:temporarily )?rejected by local_scan\(\): .{0,256}$
+             ^%(pid)s \S+ F=(?:<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
              ^%(pid)s login authenticator failed for (?:\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data(?: \(set_id=.*\)|: \d+ Time\(s\))?\s*$
              ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (?:rejected found in dnsbl \S+|relay not permitted|Sender verify failed|Unknown user)\s*$
              ^%(pid)s \S+ %(host_info)sF=(?:<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 792f949e..2a59ecdc 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -5,9 +5,9 @@
 2013-06-12 13:18:11 login authenticator failed for (USER-KVI9FGS9KP) [101.66.165.86]: 535 Incorrect authentication data
 2013-06-10 10:10:59 H=ufficioestampa.it (srv.ufficioestampa.it) [193.169.56.211] sender verify fail for <user@example.com>: Unrouteable address
 # http://forum.lissyara.su/viewtopic.php?f=20&t=2985
-2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
+#2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
 # http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
-2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
+#2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
 # http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
 2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0
 # https://github.com/fail2ban/fail2ban/pull/251#issuecomment-19493875

From c7d64c3c7f9dee7b300f97e6c6f444b7ca6e8c10 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 1 Jul 2013 21:58:03 +1000
Subject: [PATCH 363/544] TST: url reference fix

---
 testcases/files/logs/exim | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 2a59ecdc..96b901ab 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -4,7 +4,7 @@
 2013-06-12 03:57:58 login authenticator failed for (ylmf-pc) [120.196.140.45]: 535 Incorrect authentication data: 1 Time(s)
 2013-06-12 13:18:11 login authenticator failed for (USER-KVI9FGS9KP) [101.66.165.86]: 535 Incorrect authentication data
 2013-06-10 10:10:59 H=ufficioestampa.it (srv.ufficioestampa.it) [193.169.56.211] sender verify fail for <user@example.com>: Unrouteable address
-# http://forum.lissyara.su/viewtopic.php?f=20&t=2985
+# http://forum.lissyara.su/viewtopic.php?f=20&t=29857
 #2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
 # http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
 #2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory

From 4777cfd4e7d45c13cf6f7fcfcf2aadaed323caa6 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 2 Jul 2013 20:03:16 +1000
Subject: [PATCH 364/544] ENH: split out exim-spam into speparate filter

---
 config/filter.d/exim-common.conf | 17 +++++++++++++++++
 config/filter.d/exim-spam.conf   | 29 +++++++++++++++++++++++++++++
 config/filter.d/exim.conf        | 31 +++++++++++++++----------------
 testcases/files/logs/exim        |  6 +++---
 4 files changed, 64 insertions(+), 19 deletions(-)
 create mode 100644 config/filter.d/exim-common.conf
 create mode 100644 config/filter.d/exim-spam.conf

diff --git a/config/filter.d/exim-common.conf b/config/filter.d/exim-common.conf
new file mode 100644
index 00000000..79d6ffbb
--- /dev/null
+++ b/config/filter.d/exim-common.conf
@@ -0,0 +1,17 @@
+# Fail2Ban configuration file for exim
+#
+# Author:  Daniel Black
+#
+
+[INCLUDES]
+
+# Load customizations if any available
+#
+after = exim-common.local
+
+[Definition]
+
+# From exim source code: ./src/receive.c:add_host_info_for_log
+host_info = H=([\w.-]+ )?(\(\S+\) )?\[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?(U=\S+ )?(P=e?smtp )?
+pid = ( \[\d+\])?
+
diff --git a/config/filter.d/exim-spam.conf b/config/filter.d/exim-spam.conf
new file mode 100644
index 00000000..55a6f5dd
--- /dev/null
+++ b/config/filter.d/exim-spam.conf
@@ -0,0 +1,29 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+#         Daniel Black (rewrote with strong regexs)
+#
+
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# exim-common.local
+before = exim-common.conf
+
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  This includes the spam rejection messages of exim.
+#          Note the %(host_info) defination contains a <HOST> match
+
+failregex =  ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
+             ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$
+             ^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 49a7d2c4..63b0fa1d 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -4,27 +4,26 @@
 #         Daniel Black (rewrote with strong regexs)
 #
 
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# exim-common.local
+before = exim-common.conf
+
+
 [Definition]
 
 # Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-#
-
-# From exim source code: ./src/receive.c:add_host_info_for_log
-host_info = H=([\w.-]+ )?(\(\S+\) )?\[<HOST>\](:\d+)? (?:I=\[\S+\]:\d+ )?(?:U=\S+ )?(P=e?smtp )?
-pid = ( \[\d+\])?
+# Notes.:  This includes the rejection messages of exim. For spam and filter
+#          related bans use the exim-spam.conf
+#          Note the %(host_info) defination contains a <HOST> match
 
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
-             ^%(pid)s \S+ F=(?:<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
-             ^%(pid)s login authenticator failed for (?:\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data(?: \(set_id=.*\)|: \d+ Time\(s\))?\s*$
-             ^%(pid)s %(host_info)sF=(?:<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (?:rejected found in dnsbl \S+|relay not permitted|Sender verify failed|Unknown user)\s*$
-             ^%(pid)s \S+ %(host_info)sF=(?:<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
-             ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$
-             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (?:I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
+             ^%(pid)s login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+             ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
+             ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
+             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 96b901ab..95ca621f 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -5,9 +5,9 @@
 2013-06-12 13:18:11 login authenticator failed for (USER-KVI9FGS9KP) [101.66.165.86]: 535 Incorrect authentication data
 2013-06-10 10:10:59 H=ufficioestampa.it (srv.ufficioestampa.it) [193.169.56.211] sender verify fail for <user@example.com>: Unrouteable address
 # http://forum.lissyara.su/viewtopic.php?f=20&t=29857
-#2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
+# 2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
 # http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
-#2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
+# 2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
 # http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
 2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0
 # https://github.com/fail2ban/fail2ban/pull/251#issuecomment-19493875
@@ -22,5 +22,5 @@
 2013-06-07 02:02:09 H=treeladders.kiev.ua [91.232.21.92] sender verify fail for <mailer@treeladders.kiev.ua>: all relevant MX records point to non-existent hosts
 2013-06-15 16:34:55 H=mx.tillions.com [182.18.24.93] F=<buh@caladan.ebay.sun.com> rejected RCPT <ruslan@maslovskiy.com.ua>: Sender verify failed
 2013-06-15 16:36:49 H=altmx.marsukov.com [111.67.203.116] F=<kadrofutcheti@mail.ru> rejected RCPT <oksana@birzhatm.ua>: Unknown user
-#2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F=<trudofspiori@mail.ru> rejected RCPT <info@nanomedtech.ua>: rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114
+2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F=<trudofspiori@mail.ru> rejected RCPT <info@nanomedtech.ua>: rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114
 

From aebd24ec5485dacc5146728fa22387340b51099e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 2 Jul 2013 20:09:27 +1000
Subject: [PATCH 365/544] BF: replace with ed so its cross platform, fixes
 permission problem gh-266, and Yaroslav doesn't revert to perl

---
 ChangeLog                      | 2 ++
 config/action.d/hostsdeny.conf | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index e5c38eb1..51835de4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
    * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
    * filter.d/apache-common.conf -- support apache 2.4 more detailed error
      log format.  Closes gh-268
+  Daniel Black
+	 * action.d/hostsdeny -- ensure permissions are fixed - gh-266
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 50a4545c..36e34948 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -39,7 +39,7 @@ actionban = IP=<ip> &&
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = IP=<ip> && sed  /ALL:\ $IP/d <file> > <file>.new && mv <file>.new <file>
+actionunban = echo "/ALL: <ip>$/<br>d<br>w<br>q" | ed <file>
 
 [Init]
 

From e6823149a1d4916a80594970fe8f7f7845310e88 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 2 Jul 2013 20:16:43 +1000
Subject: [PATCH 366/544] ENH: remove non-capturing groups for readibility

---
 config/filter.d/dovecot.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index e3702fcf..f111859f 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -16,8 +16,8 @@ _daemon = dovecot(-auth)?
 #          first regex is essentially a copy of pam-generic.conf
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)s(pam_unix(?:\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
-            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=<HOST>, lip=(?:\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?\s*$
+failregex = ^%(__prefix_line)s(pam_unix(\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
+            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From da594075f3f59476ef055a6387634468fa839036 Mon Sep 17 00:00:00 2001
From: Alexander Dietrich <alexander@dietrich.cx>
Date: Tue, 2 Jul 2013 20:30:41 +0200
Subject: [PATCH 367/544] Move sendmail settings to common file, make sender
 name configurable

---
 config/action.d/sendmail-buffered.conf    | 18 +++++++-----------
 config/action.d/sendmail-common.conf      | 23 +++++++++++++++++++++++
 config/action.d/sendmail-whois-lines.conf | 18 +++++++-----------
 config/action.d/sendmail-whois.conf       | 18 +++++++-----------
 config/action.d/sendmail.conf             | 18 +++++++-----------
 5 files changed, 51 insertions(+), 44 deletions(-)
 create mode 100644 config/action.d/sendmail-common.conf

diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index bec1e91c..f5ca6c10 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -4,6 +4,10 @@
 #
 #
 
+[INCLUDES]
+
+before = sendmail-common.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -11,7 +15,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
-              From: Fail2Ban <<sender>>
+              From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
@@ -25,7 +29,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 #
 actionstop = if [ -f <tmpfile> ]; then
                  printf %%b "Subject: [Fail2Ban] <name>: summary
-                 From: Fail2Ban <<sender>>
+                 From: <sendername> <<sender>>
                  To: <dest>\n
                  Hi,\n
                  These hosts have been banned by Fail2Ban.\n
@@ -58,7 +62,7 @@ actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
             LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
             if [ $LINE -ge <lines> ]; then
                 printf %%b "Subject: [Fail2Ban] <name>: summary
-                From: Fail2Ban <<sender>>
+                From: <sendername> <<sender>>
                 To: <dest>\n
                 Hi,\n
                 These hosts have been banned by Fail2Ban.\n
@@ -82,14 +86,6 @@ actionunban =
 #
 name = default
 
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-
 # Default number of lines that are buffered
 #
 lines = 5
diff --git a/config/action.d/sendmail-common.conf b/config/action.d/sendmail-common.conf
new file mode 100644
index 00000000..e2820470
--- /dev/null
+++ b/config/action.d/sendmail-common.conf
@@ -0,0 +1,23 @@
+# Fail2Ban configuration file
+#
+# Common settings for sendmail actions
+#
+# Users can override the defaults in sendmail-common.local
+
+[INCLUDES]
+
+after = sendmail-common.local
+
+[Init]
+
+# Recipient mail address
+#
+dest = root
+
+# Sender mail address
+#
+sender = fail2ban
+
+# Sender display name
+#
+sendername = Fail2Ban
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index bc5074c6..2cb27bd2 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -4,6 +4,10 @@
 #
 #
 
+[INCLUDES]
+
+before = sendmail-common.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -12,7 +16,7 @@
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
               Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: Fail2Ban <<sender>>
+              From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
@@ -25,7 +29,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: Fail2Ban <<sender>>
+             From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
@@ -46,7 +50,7 @@ actioncheck =
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-            From: Fail2Ban <<sender>>
+            From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -72,14 +76,6 @@ actionunban =
 #
 name = default
 
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-
 # Path to the log files which contain relevant lines for the abuser IP
 #
 logpath = /dev/null
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
index 0d1fd97e..b111e19f 100644
--- a/config/action.d/sendmail-whois.conf
+++ b/config/action.d/sendmail-whois.conf
@@ -4,6 +4,10 @@
 #
 #
 
+[INCLUDES]
+
+before = sendmail-common.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -12,7 +16,7 @@
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
               Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: Fail2Ban <<sender>>
+              From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
@@ -25,7 +29,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: Fail2Ban <<sender>>
+             From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
@@ -46,7 +50,7 @@ actioncheck =
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-            From: Fail2Ban <<sender>>
+            From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -70,11 +74,3 @@ actionunban =
 #
 name = default
 
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
index 8054050d..55d388fc 100644
--- a/config/action.d/sendmail.conf
+++ b/config/action.d/sendmail.conf
@@ -4,6 +4,10 @@
 #
 #
 
+[INCLUDES]
+
+before = sendmail-common.conf
+
 [Definition]
 
 # Option:  actionstart
@@ -12,7 +16,7 @@
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
               Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-              From: Fail2Ban <<sender>>
+              From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
               The jail <name> has been started successfully.\n
@@ -25,7 +29,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-             From: Fail2Ban <<sender>>
+             From: <sendername> <<sender>>
              To: <dest>\n
              Hi,\n
              The jail <name> has been stopped.\n
@@ -46,7 +50,7 @@ actioncheck =
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
-            From: Fail2Ban <<sender>>
+            From: <sendername> <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
@@ -68,11 +72,3 @@ actionunban =
 #
 name = default
 
-# Destination/Addressee of the mail
-#
-dest = root
-
-# Sender of the mail
-#
-sender = fail2ban
-

From 8f3671bc94c604ae33a7592d0e72220cbc00dd52 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 17:10:00 -0400
Subject: [PATCH 368/544] BF: figure out minimal sleep time needed for mtime
 changes to get detected.  Close #223, and probably #103

---
 testcases/filtertestcase.py | 22 +++++-----------
 testcases/utils.py          | 50 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 55 insertions(+), 17 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 1657f694..2381c942 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -39,6 +39,8 @@ from server.failmanager import FailManagerEmpty
 # Useful helpers
 #
 
+from utils import mtimesleep
+
 # yoh: per Steven Hiscocks's insight while troubleshooting
 # https://github.com/fail2ban/fail2ban/issues/103#issuecomment-15542836
 # adding a sufficiently large buffer might help to guarantee that
@@ -68,18 +70,6 @@ def _killfile(f, name):
 		_killfile(None, name + '.bak')
 
 
-def _sleep_4_poll():
-	"""PollFilter relies on file timestamps - so we might need to
-	sleep to guarantee that they differ
-	"""
-	if sys.version_info[:2] <= (2,4):
-		# on old Python st_mtime is int, so we should give
-		# at least 1 sec so polling filter could detect
-		# the change
-		time.sleep(1.)
-	else:
-		time.sleep(0.1)
-
 def _assert_equal_entries(utest, found, output, count=None):
 	"""Little helper to unify comparisons with the target entries
 
@@ -237,14 +227,14 @@ class LogFileMonitor(unittest.TestCase):
 		# but not any longer
 		self.assertTrue(self.notModified())
 		self.assertTrue(self.notModified())
-		_sleep_4_poll()				# to guarantee freshier mtime
+		mtimesleep()				# to guarantee freshier mtime
 		for i in range(4):			  # few changes
 			# unless we write into it
 			self.file.write("line%d\n" % i)
 			self.file.flush()
 			self.assertTrue(self.isModified())
 			self.assertTrue(self.notModified())
-			_sleep_4_poll()				# to guarantee freshier mtime
+			mtimesleep()				# to guarantee freshier mtime
 		os.rename(self.name, self.name + '.old')
 		# we are not signaling as modified whenever
 		# it gets away
@@ -252,7 +242,7 @@ class LogFileMonitor(unittest.TestCase):
 		f = open(self.name, 'a')
 		self.assertTrue(self.isModified())
 		self.assertTrue(self.notModified())
-		_sleep_4_poll()
+		mtimesleep()
 		f.write("line%d\n" % i)
 		f.flush()
 		self.assertTrue(self.isModified())
@@ -398,7 +388,7 @@ def get_monitor_failures_testcase(Filter_):
 			# actions might be happening too fast in the tests,
 			# sleep a bit to guarantee reliable time stamps
 			if isinstance(self.filter, FilterPoll):
-				_sleep_4_poll()
+				mtimesleep()
 
 		def isEmpty(self, delay=0.4):
 			# shorter wait time for not modified status
diff --git a/testcases/utils.py b/testcases/utils.py
index 87aab915..b8d467bf 100644
--- a/testcases/utils.py
+++ b/testcases/utils.py
@@ -22,7 +22,7 @@ __author__ = "Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-import logging, os, re, traceback
+import logging, os, re, tempfile, sys, time, traceback
 from os.path import basename, dirname
 
 #
@@ -100,3 +100,51 @@ class FormatterWithTraceBack(logging.Formatter):
 	def format(self, record):
 		record.tbc = record.tb = self._tb()
 		return logging.Formatter.format(self, record)
+
+
+class MTimeSleep(object):
+	"""Sleep minimal duration needed to resolve changes in mtime of files in TMPDIR
+
+	mtime resolution depends on Python version AND underlying filesystem
+	"""
+	def __init__(self):
+		self._sleep = None
+
+	@staticmethod
+	def _get_good_sleep():
+		times = [1., 2., 5., 10.]
+		# we know that older Pythons simply have no ability to resolve
+		# at < sec level.
+		if sys.version_info[:2] > (2, 4):
+			times = [0.01, 0.1] + times
+		ffid, name = tempfile.mkstemp()
+		tfile = os.fdopen(ffid, 'w')
+
+		for stime in times:
+			prev_stat, dt = "", 0.
+			# needs to be done 3 times (not clear why)
+			for i in xrange(3):
+				stat2 = os.stat(name)
+				if prev_stat:
+					dt = (stat2.st_mtime - prev_stat.st_mtime)
+				prev_stat = stat2
+				tfile.write("LOAD\n")
+				tfile.flush()
+				time.sleep(stime)
+			if dt:
+				break
+		if not dt:
+			import logging
+			logSys = logging.getLogger("fail2ban.tests")
+			#from warnings import warn
+			logSys.warn("Could not deduce appropriate sleep time for tests. "
+						"Maximal tested one of %f sec will be used." % stime)
+		os.unlink(name)
+		return stime
+
+	def __call__(self):
+		if self._sleep is None:
+			self._sleep = self._get_good_sleep()
+		time.sleep(self._sleep)
+
+mtimesleep = MTimeSleep()

From 591590860ac3077d9ec24af3c0f998df15820541 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 17:11:24 -0400
Subject: [PATCH 369/544] BF: setSleepTime -- would barf since value is not str
 (wasn't used/tested)

---
 server/jailthread.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/jailthread.py b/server/jailthread.py
index 11d1a82b..ca6effae 100644
--- a/server/jailthread.py
+++ b/server/jailthread.py
@@ -56,7 +56,7 @@ class JailThread(Thread):
 	
 	def setSleepTime(self, value):
 		self.__sleepTime = value
-		logSys.info("Set sleeptime = " + value)
+		logSys.info("Set sleeptime %s" % value)
 	
 	##
 	# Get the time that the thread sleeps.

From e9c8a51ce492d2ee225e514395642f50ae8a64d6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 17:26:41 -0400
Subject: [PATCH 370/544] ENH: further tighten up detection of mtimesleep
 duration + log what was assigned

---
 testcases/utils.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/testcases/utils.py b/testcases/utils.py
index b8d467bf..6107516b 100644
--- a/testcases/utils.py
+++ b/testcases/utils.py
@@ -112,11 +112,12 @@ class MTimeSleep(object):
 
 	@staticmethod
 	def _get_good_sleep():
-		times = [1., 2., 5., 10.]
+		logSys = logging.getLogger("fail2ban.tests")
+		times = [1.5, 2., 5., 10.]
 		# we know that older Pythons simply have no ability to resolve
 		# at < sec level.
 		if sys.version_info[:2] > (2, 4):
-			times = [0.01, 0.1] + times
+			times = [0.1] + times
 		ffid, name = tempfile.mkstemp()
 		tfile = os.fdopen(ffid, 'w')
 
@@ -131,14 +132,19 @@ class MTimeSleep(object):
 				tfile.write("LOAD\n")
 				tfile.flush()
 				time.sleep(stime)
-			if dt:
-				break
+
+			# check dt but also verify that we are not getting 'quick'
+			# stime simply by chance of catching second increment
+			if dt and \
+				not (stime < 1 and int(stat2.st_mtime) == stat2.st_mtime):
+					break
 		if not dt:
-			import logging
-			logSys = logging.getLogger("fail2ban.tests")
 			#from warnings import warn
 			logSys.warn("Could not deduce appropriate sleep time for tests. "
 						"Maximal tested one of %f sec will be used." % stime)
+		else:
+			logSys.debug("It was needed a sleep of %f to detect dt=%f mtime change"
+						% (stime, dt))
 		os.unlink(name)
 		return stime
 

From d6dece490043671604ddf9710590e294fd2c9095 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 3 Jul 2013 07:42:47 +1000
Subject: [PATCH 371/544] ENH: Split log and provide jail examples

---
 config/jail.conf               | 11 +++++++++++
 testcases/files/logs/exim      |  7 -------
 testcases/files/logs/exim-spam | 12 ++++++++++++
 3 files changed, 23 insertions(+), 7 deletions(-)
 create mode 100644 testcases/files/logs/exim-spam

diff --git a/config/jail.conf b/config/jail.conf
index c999cc7b..b3b93e53 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -408,3 +408,14 @@ filter  = 3proxy
 action  = iptables-multiport[name=3proxy, port=3128, protocol=tcp]
 logpath = /var/log/3proxy.log
 
+[exim]
+enabled = false
+filter = exim
+action = iptables-multiport[name=exim,port="25,465,587"]
+logpath = /var/log/exim/mainlog
+
+[exim-spam]
+enabled = false
+filter = exim-spam
+action = iptables-multiport[name=exim-spam,port="25,465,587"]
+logpath = /var/log/exim/mainlog
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 95ca621f..0d5ae51d 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -8,13 +8,7 @@
 # 2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
 # http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
 # 2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
-# http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
-2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0
-# https://github.com/fail2ban/fail2ban/pull/251#issuecomment-19493875
-2013-06-15 11:19:33 [2249] H=([2.181.148.95]) [2.181.148.95]:52391 I=[1.2.3.4]:25 F=fantasizesg4@google.com rejected RCPT some@email.com: rejected found in dnsbl zen.spamhaus.org
 2013-06-10 18:33:32 [10099] H=(yakult.com.tw) [202.132.70.178]:3755 I=[1.2.3.4]:25 F=menacedsj04@listserv.eurasia.org rejected RCPT dir@ml3.ru: relay not permitted
-2013-06-09 10:21:28 [14127] 1UlasQ-0003fr-45 F=mcorporation4@aol.com H=(mail38.fssprus.ru) [46.254.240.82]:43671 I=[1.2.3.4]:25 P=esmtp rejected by local_scan(): Rejected
-2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL).
 2013-06-02 06:54:20 [13314] SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[211.148.195.192]:25936 I=[1.2.3.4]:25 input="GET / HTTP/1.1\r\n\r\n"
 2013-06-02 09:05:48 [18505] SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "RSET" H=ba77.mx83.fr [82.96.160.77]:58302 I=[1.2.3.4]:25 next input="QUIT\r\n"
 2013-06-02 09:22:05 [19591] SMTP call from pc012-6201.spo.scu.edu.tw [163.14.21.161]:3767 I=[1.2.3.4]:25 dropped: too many nonmail commands (last was "RSET")
@@ -22,5 +16,4 @@
 2013-06-07 02:02:09 H=treeladders.kiev.ua [91.232.21.92] sender verify fail for <mailer@treeladders.kiev.ua>: all relevant MX records point to non-existent hosts
 2013-06-15 16:34:55 H=mx.tillions.com [182.18.24.93] F=<buh@caladan.ebay.sun.com> rejected RCPT <ruslan@maslovskiy.com.ua>: Sender verify failed
 2013-06-15 16:36:49 H=altmx.marsukov.com [111.67.203.116] F=<kadrofutcheti@mail.ru> rejected RCPT <oksana@birzhatm.ua>: Unknown user
-2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F=<trudofspiori@mail.ru> rejected RCPT <info@nanomedtech.ua>: rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114
 
diff --git a/testcases/files/logs/exim-spam b/testcases/files/logs/exim-spam
new file mode 100644
index 00000000..535309f5
--- /dev/null
+++ b/testcases/files/logs/exim-spam
@@ -0,0 +1,12 @@
+# http://forum.lissyara.su/viewtopic.php?f=20&t=29857
+# 2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
+# http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
+# 2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
+# http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
+2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0
+# https://github.com/fail2ban/fail2ban/pull/251#issuecomment-19493875
+2013-06-15 11:19:33 [2249] H=([2.181.148.95]) [2.181.148.95]:52391 I=[1.2.3.4]:25 F=fantasizesg4@google.com rejected RCPT some@email.com: rejected found in dnsbl zen.spamhaus.org
+2013-06-09 10:21:28 [14127] 1UlasQ-0003fr-45 F=mcorporation4@aol.com H=(mail38.fssprus.ru) [46.254.240.82]:43671 I=[1.2.3.4]:25 P=esmtp rejected by local_scan(): Rejected
+2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL).
+2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F=<trudofspiori@mail.ru> rejected RCPT <info@nanomedtech.ua>: rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114
+

From 256f60adae92933b2fa7e9099103b95a54b90478 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 3 Jul 2013 09:01:24 +1000
Subject: [PATCH 372/544] DOC: improved log message

---
 ChangeLog | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 51835de4..5331e4a0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,7 +16,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
    * filter.d/apache-common.conf -- support apache 2.4 more detailed error
      log format.  Closes gh-268
   Daniel Black
-	 * action.d/hostsdeny -- ensure permissions are fixed - gh-266
+	 * action.d/hostsdeny -- Switched to use 'ed' available across all
+	   platforms to ensure permissions are the same before and after a ban - gh-266
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added

From 2ffc14359722acff7ddb19f4f1758dab69fb6f8e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 19:49:41 -0400
Subject: [PATCH 373/544] ENH: more of heavydebug'ing for FilterPoll

---
 server/filterpoll.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/server/filterpoll.py b/server/filterpoll.py
index 20cde0ca..4acecd42 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -30,6 +30,11 @@ from mytime import MyTime
 
 import time, logging, os
 
+def _ctime(t):
+	"""Given time in seconds provide string representation with milliseconds
+	"""
+	return "%s%.3f" %(time.strftime("%X", time.localtime(t)), (t-int(t)))
+
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
 
@@ -84,6 +89,9 @@ class FilterPoll(FileFilter):
 	def run(self):
 		self.setActive(True)
 		while self._isActive():
+			if logSys.getEffectiveLevel() <= 6:
+				logSys.log(6, "Woke up idle=%s with %d files monitored",
+						   self.getIdle(), len(self.getLogPath()))
 			if not self.getIdle():
 				# Get file modification
 				for container in self.getLogPath():
@@ -119,6 +127,12 @@ class FilterPoll(FileFilter):
 		try:
 			logStats = os.stat(filename)
 			self.__file404Cnt[filename] = 0
+			if logSys.getEffectiveLevel() <= 7:
+				# we do not want to waste time on strftime etc if not necessary
+				dt = logStats.st_mtime - self.__lastModTime[filename]
+				logSys.log(7, "Checking %s for being modified. Previous/current mtimes: %s / %s. dt: %s",
+				           filename, _ctime(self.__lastModTime[filename]), _ctime(logStats.st_mtime), dt)
+				# os.system("stat %s | grep Modify" % filename)
 			if self.__lastModTime[filename] == logStats.st_mtime:
 				return False
 			else:

From 8c125b6053d137132bacfa7c25cb84e261cd9894 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 19:50:22 -0400
Subject: [PATCH 374/544] ENH: do not sleep 1 sec only on older Pythons while
 testing filters

---
 testcases/filtertestcase.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 2381c942..f2f6eb50 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -109,10 +109,9 @@ def _copy_lines_between_files(fin, fout, n=None, skip=0, mode='a', terminal_line
 
 	Returns open fout
 	"""
-	if sys.version_info[:2] <= (2,4): # pragma: no cover
-		# on old Python st_mtime is int, so we should give at least 1 sec so
-		# polling filter could detect the change
-		time.sleep(1)
+	# on older Pythons and on some FSs st_mtime is int, so we should
+	# give it some time so polling filter could detect the change
+	mtimesleep()
 	if isinstance(fin, str): # pragma: no branch - only used with str in test cases
 		fin = open(fin, 'r')
 	# Skip

From f340e5c0f5a74a6bb0b515d9e25dec57f28467c6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 20:43:51 -0400
Subject: [PATCH 375/544] ENH(+possibly BF): for FilterPoll rely not only on
 mtime but also ino and size to assess if file was modified

mtime alone is a poor measure here as many of our tests shown -- on older Pythons and some file systems
mtime might be reported only with precision up to a second.  If file gets rotated fast, or there are new
modifications within the same second, fail2ban might miss them with Polling backend if judging only by
mtime.  With this modification we will track also inode and size which are all indicative of a file
change.
---
 server/filterpoll.py | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/server/filterpoll.py b/server/filterpoll.py
index 4acecd42..4cd7cb48 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -57,7 +57,7 @@ class FilterPoll(FileFilter):
 		FileFilter.__init__(self, jail)
 		self.__modified = False
 		## The time of the last modification of the file.
-		self.__lastModTime = dict()
+		self.__prevStats = dict()
 		self.__file404Cnt = dict()
 		logSys.debug("Created FilterPoll")
 
@@ -67,7 +67,7 @@ class FilterPoll(FileFilter):
 	# @param path log file path
 
 	def _addLogPath(self, path):
-		self.__lastModTime[path] = 0
+		self.__prevStats[path] = (0, None, None)	 # mtime, ino, size
 		self.__file404Cnt[path] = 0
 
 	##
@@ -76,7 +76,7 @@ class FilterPoll(FileFilter):
 	# @param path the log file to delete
 
 	def _delLogPath(self, path):
-		del self.__lastModTime[path]
+		del self.__prevStats[path]
 		del self.__file404Cnt[path]
 
 	##
@@ -126,18 +126,20 @@ class FilterPoll(FileFilter):
 	def isModified(self, filename):
 		try:
 			logStats = os.stat(filename)
+			stats = logStats.st_mtime, logStats.st_ino, logStats.st_size
+			pstats = self.__prevStats[filename]
 			self.__file404Cnt[filename] = 0
 			if logSys.getEffectiveLevel() <= 7:
 				# we do not want to waste time on strftime etc if not necessary
-				dt = logStats.st_mtime - self.__lastModTime[filename]
-				logSys.log(7, "Checking %s for being modified. Previous/current mtimes: %s / %s. dt: %s",
-				           filename, _ctime(self.__lastModTime[filename]), _ctime(logStats.st_mtime), dt)
+				dt = logStats.st_mtime - pstats[0]
+				logSys.log(7, "Checking %s for being modified. Previous/current stats: %s / %s. dt: %s",
+				           filename, pstats, stats, dt)
 				# os.system("stat %s | grep Modify" % filename)
-			if self.__lastModTime[filename] == logStats.st_mtime:
+			if pstats == stats:
 				return False
 			else:
-				logSys.debug(filename + " has been modified")
-				self.__lastModTime[filename] = logStats.st_mtime
+				logSys.debug("%s has been modified", filename)
+				self.__prevStats[filename] = stats
 				return True
 		except OSError, e:
 			logSys.error("Unable to get stat on %s because of: %s"

From 052e7ff9da53865a38c28631a6857112ad21bbad Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 20:44:28 -0400
Subject: [PATCH 376/544] ENH: deprecate sophisticated MTimeSleep in favor of
 no sleeping at all

all invocations of mtimesleep() are left in the tests for now
---
 testcases/utils.py | 57 ++++------------------------------------------
 1 file changed, 4 insertions(+), 53 deletions(-)

diff --git a/testcases/utils.py b/testcases/utils.py
index 6107516b..643c9ad1 100644
--- a/testcases/utils.py
+++ b/testcases/utils.py
@@ -101,56 +101,7 @@ class FormatterWithTraceBack(logging.Formatter):
 		record.tbc = record.tb = self._tb()
 		return logging.Formatter.format(self, record)
 
-
-class MTimeSleep(object):
-	"""Sleep minimal duration needed to resolve changes in mtime of files in TMPDIR
-
-	mtime resolution depends on Python version AND underlying filesystem
-	"""
-	def __init__(self):
-		self._sleep = None
-
-	@staticmethod
-	def _get_good_sleep():
-		logSys = logging.getLogger("fail2ban.tests")
-		times = [1.5, 2., 5., 10.]
-		# we know that older Pythons simply have no ability to resolve
-		# at < sec level.
-		if sys.version_info[:2] > (2, 4):
-			times = [0.1] + times
-		ffid, name = tempfile.mkstemp()
-		tfile = os.fdopen(ffid, 'w')
-
-		for stime in times:
-			prev_stat, dt = "", 0.
-			# needs to be done 3 times (not clear why)
-			for i in xrange(3):
-				stat2 = os.stat(name)
-				if prev_stat:
-					dt = (stat2.st_mtime - prev_stat.st_mtime)
-				prev_stat = stat2
-				tfile.write("LOAD\n")
-				tfile.flush()
-				time.sleep(stime)
-
-			# check dt but also verify that we are not getting 'quick'
-			# stime simply by chance of catching second increment
-			if dt and \
-				not (stime < 1 and int(stat2.st_mtime) == stat2.st_mtime):
-					break
-		if not dt:
-			#from warnings import warn
-			logSys.warn("Could not deduce appropriate sleep time for tests. "
-						"Maximal tested one of %f sec will be used." % stime)
-		else:
-			logSys.debug("It was needed a sleep of %f to detect dt=%f mtime change"
-						% (stime, dt))
-		os.unlink(name)
-		return stime
-
-	def __call__(self):
-		if self._sleep is None:
-			self._sleep = self._get_good_sleep()
-		time.sleep(self._sleep)
-
-mtimesleep = MTimeSleep()
+def mtimesleep():
+	# no sleep now should be necessary since polling tracks now not only
+	# mtime but also ino and size
+	pass

From 8d25e83f5d154fd2adcaa3cac5f883a8f87b56ad Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 23:37:23 -0400
Subject: [PATCH 377/544] BF: race condition -- file should not be read unless
 it is not empty

Previous code would store md5sum of an empty line as the one
identifying the monitored file.  That file then was read and possibly
failures were found.  Upon next "container.open()", md5 digest of now
present first line was compared against previous digest of an empty
line, which was different, thus file was assumed to be rotated and all
the log lines were read once again.

The History
-----------
In rare cases various tests failed somewhat consistently.  Below you
can find one case in test_move_file where such failure really made no
sense -- we should have not had 4 failures by that point.

Fail2ban 0.8.10.dev test suite. Python 2.4.6 (#2, Sep 25 2009, 22:22:06) [GCC 4.3.4]. Please wait...
I: Skipping gamin backend testing. Got exception 'No module named gamin'
I: Skipping pyinotify backend testing. Got exception 'No module named pyinotify'
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/d41d8cd98f00b204e9800998ecf8427e inos=5398862/5398862 pos=0 rotate=False
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2efdc8> with pos 1231
D: fn=/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0 hashes=d41d8cd98f00b204e9800998ecf8427e/aeb4e73e6922a746d027eb365ece2149 inos=5398862/5398862 pos=1231 rotate=True
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Adding a ticket for ('193.168.0.128', 1124013599.0, ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n'])
D: Closed <closed file '/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban-0', mode 'r' at 0x7f472b2ef558> with pos 1231
F
======================================================================
FAIL: test_move_file (testcases.filtertestcase.MonitorFailures<FilterPoll>(/home/yoh/test/monitorfailures_FilterPoll9nUKoCfail2ban))
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 451, in test_move_file
    "Queue must be empty but it is not: %s."
AssertionError: Queue must be empty but it is not: server.ticket.FailTicket: ip=193.168.0.128 time=1124013599.0 #attempts=4.

----------------------------------------------------------------------

N.B.1 I preserved here and in the code corresponding additional debug
print statements, which are commented out by default. sensible md5
digest was generated by using hexdigest() instead of current a bit
faster digest().  Running tests with all the debug output simply
breaks the race loose and failure doesn't trigger.

N.B.2 d41d8cd98f00b204e9800998ecf8427e is an md5sum of an empty
string, and aeb4e73e6922a746d027eb365ece2149 of the first line in that
file.
---
 server/filter.py | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index 59e612ed..b7c2d091 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -21,6 +21,8 @@ __author__ = "Cyril Jaquier and Fail2Ban Contributors"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
+import sys
+
 from failmanager import FailManagerEmpty
 from failmanager import FailManager
 from ticket import FailTicket
@@ -322,6 +324,7 @@ class Filter(JailThread):
 				logSys.debug("Ignore %s" % ip)
 				continue
 			logSys.debug("Found %s" % ip)
+			## print "D: Adding a ticket for %s" % ((ip, unixTime, [line]),)
 			self.failManager.addFailure(FailTicket(ip, unixTime, [line]))
 
 	##
@@ -477,7 +480,7 @@ class FileFilter(Filter):
 			return False
 		# Try to open log file.
 		try:
-			container.open()
+			has_content = container.open()
 		# see http://python.org/dev/peps/pep-3151/
 		except IOError, e:
 			logSys.error("Unable to open %s" % filename)
@@ -492,7 +495,12 @@ class FileFilter(Filter):
 			logSys.exception(e)
 			return False
 
-		while True:
+		# yoh: has_content is just a bool, so do not expect it to
+		# change -- loop is exited upon break, and is not entered at
+		# all if upon container opening that one was empty.  If we
+		# start reading tested to be empty container -- race condition
+		# might occur leading at least to tests failures.
+		while has_content:
 			line = container.readline()
 			if (line == "") or not self._isActive():
 				# The jail reached the bottom or has been stopped
@@ -555,10 +563,20 @@ class FileContainer:
 		fd = self.__handler.fileno()
 		flags = fcntl.fcntl(fd, fcntl.F_GETFD)
 		fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
+		# Stat the file before even attempting to read it
+		stats = os.fstat(self.__handler.fileno())
+		if not stats.st_size:
+			# yoh: so it is still an empty file -- nothing should be
+			#      read from it yet
+			# print "D: no content -- return"
+			return False
 		firstLine = self.__handler.readline()
 		# Computes the MD5 of the first line.
 		myHash = md5sum(firstLine).digest()
-		stats = os.fstat(self.__handler.fileno())
+		## print "D: fn=%s hashes=%s/%s inos=%s/%s pos=%s rotate=%s" % (
+		## 	self.__filename, self.__hash, myHash, stats.st_ino, self.__ino, self.__pos,
+		## 	self.__hash != myHash or self.__ino != stats.st_ino)
+		## sys.stdout.flush()
 		# Compare hash and inode
 		if self.__hash != myHash or self.__ino != stats.st_ino:
 			logSys.debug("Log rotation detected for %s" % self.__filename)
@@ -567,6 +585,7 @@ class FileContainer:
 			self.__pos = 0
 		# Sets the file pointer to the last position.
 		self.__handler.seek(self.__pos)
+		return True
 
 	def readline(self):
 		if self.__handler is None:
@@ -580,6 +599,8 @@ class FileContainer:
 			# Closes the file.
 			self.__handler.close()
 			self.__handler = None
+		## print "D: Closed %s with pos %d" % (handler, self.__pos)
+		## sys.stdout.flush()
 
 
 

From 47ac39fb3451c1d29141aefb452124c05653ef87 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 23:37:41 -0400
Subject: [PATCH 378/544] TST: minor enhancement to test failure msg

---
 testcases/filtertestcase.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index f2f6eb50..d918bbf7 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -447,7 +447,9 @@ def get_monitor_failures_testcase(Filter_):
 			self.file = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
 												  n=14, mode='w')
 			# Poll might need more time
-			self.assertTrue(self.isEmpty(4 + int(isinstance(self.filter, FilterPoll))*2))
+			self.assertTrue(self.isEmpty(4 + int(isinstance(self.filter, FilterPoll))*2),
+							"Queue must be empty but it is not: %s."
+							% (', '.join([str(x) for x in self.jail.queue])))
 			self.assertRaises(FailManagerEmpty, self.filter.failManager.toBan)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 2)
 

From 5d7ab9e7fb99287dae3d050ba04a7f5f046f4598 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 23:38:27 -0400
Subject: [PATCH 379/544] DOC: Changelog for preceding changes

---
 ChangeLog | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 39c0a5aa..dc08641d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,7 +7,7 @@
 Fail2Ban (version 0.8.10)                                             2013/06/12
 ================================================================================
 
-ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
+ver. 0.8.11 (2013/XX/XXX) - loves-unittests
 -----------
 
 - Fixes:
@@ -15,6 +15,15 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
    * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
    * filter.d/apache-common.conf -- support apache 2.4 more detailed error
      log format.  Closes gh-268
+   * Backends changes detection and parsing. Close gh-223 and gh-103:
+     - Polling backend: detect changes in the files not only based on
+       mtime, but also on the size and inode.  It should allow for
+       better detection of changes and log rotations on busy servers,
+       older python 2.4, and file systems with precision of mtime only
+       up to a second (e.g. ext3).
+     - All backends, possible race condition: do not read from a file
+       initially reported empty.  Originally could have lead to
+       accounting for detected log lines multiple times.
   Daniel Black & Мернов Георгий
    * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in ,
 - New Features:

From 5df6796e6943807e17b0e5ea962613af8f7b189f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 23:51:06 -0400
Subject: [PATCH 380/544] ENH: DNS resolution -- catch parent exception

IMHO there is no good reason to capture only gaierror.

on my network it was consistent to error out with

======================================================================
ERROR: testIgnoreIPNOK (testcases.filtertestcase.IgnoreIP)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/yoh/deb/gits/fail2ban/testcases/filtertestcase.py", line 166, in testIgnoreIPNOK
    self.assertFalse(self.filter.inIgnoreIPList(ip))
  File "/home/yoh/deb/gits/fail2ban/server/filter.py", line 277, in inIgnoreIPList
    ips = DNSUtils.dnsToIp(i)
  File "/home/yoh/deb/gits/fail2ban/server/filter.py", line 625, in dnsToIp
    return socket.gethostbyname_ex(dns)[2]
error: [Errno 11] Resource temporarily unavailable

with this commit tests would pass normally as they should
---
 server/filter.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/filter.py b/server/filter.py
index b7c2d091..6cd37ca1 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -623,9 +623,9 @@ class DNSUtils:
 		"""
 		try:
 			return socket.gethostbyname_ex(dns)[2]
-		except socket.gaierror:
-			logSys.warn("Unable to find a corresponding IP address for %s"
-						% dns)
+		except socket.error, e:
+			logSys.warn("Unable to find a corresponding IP address for %s: %s"
+						% (dns, e))
 			return list()
 	dnsToIp = staticmethod(dnsToIp)
 

From 404574499d9d76c04e07c36b09a1fbcfb1361795 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 2 Jul 2013 23:52:37 -0400
Subject: [PATCH 381/544] BF: fail2ban-testcases -- use full "warning" instead
 of warn for the verbosity dictionary

---
 fail2ban-testcases | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index fc5cc146..89fc7deb 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -79,7 +79,7 @@ logSys = logging.getLogger("fail2ban")
 verbosity = {'heavydebug': 4,
 			 'debug': 3,
 			 'info': 2,
-			 'warn': 1,
+			 'warning': 1,
 			 'error': 1,
 			 'fatal': 0,
 			 None: 1}[opts.log_level]

From e282d6b1c7aa15281be3fb748c11ad70ca5dd035 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 3 Jul 2013 00:09:39 -0400
Subject: [PATCH 382/544] ENH: Remove unused any longer _ctime helper

---
 server/filterpoll.py | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/server/filterpoll.py b/server/filterpoll.py
index 4cd7cb48..8b4038b8 100644
--- a/server/filterpoll.py
+++ b/server/filterpoll.py
@@ -30,11 +30,6 @@ from mytime import MyTime
 
 import time, logging, os
 
-def _ctime(t):
-	"""Given time in seconds provide string representation with milliseconds
-	"""
-	return "%s%.3f" %(time.strftime("%X", time.localtime(t)), (t-int(t)))
-
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.filter")
 

From 2155f6bfa58ed820d95ce50ce7488d6c43c31a20 Mon Sep 17 00:00:00 2001
From: Alexander Dietrich <alexander@dietrich.cx>
Date: Thu, 4 Jul 2013 08:57:52 +0200
Subject: [PATCH 383/544] Update ChangeLog and jail.conf example

---
 ChangeLog        | 3 +++
 config/jail.conf | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 39c0a5aa..dd5426a2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -35,6 +35,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
    * fail2ban-client -- log to standard error. Closes gh-264
    * Fail to configure if not a single log file was found for an
      enabled jail. Closes gh-63
+  Alexander Dietrich
+   * action.d/sendmail-common.conf -- added common sendmail settings file
+     and made the sender display name configurable
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
diff --git a/config/jail.conf b/config/jail.conf
index c999cc7b..e4e7e5b0 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -66,6 +66,8 @@ enabled  = false
 filter   = sshd
 action   = iptables[name=SSH, port=ssh, protocol=tcp]
            sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com]
+# Alternative example:
+#          sendmail-whois[name=SSH, sendername="Fail2Ban - example.com"]
 logpath  = /var/log/sshd.log
 maxretry = 5
 

From 04b8069ceed9212ef9b72ec2ea3d8b8030a31685 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Fri, 5 Jul 2013 10:12:29 -0400
Subject: [PATCH 384/544] ENH: adjust sendmail-whois 'active' example to have
 also sendername in it

---
 config/jail.conf | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/config/jail.conf b/config/jail.conf
index e4e7e5b0..740db30c 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -65,9 +65,7 @@ usedns = warn
 enabled  = false
 filter   = sshd
 action   = iptables[name=SSH, port=ssh, protocol=tcp]
-           sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com]
-# Alternative example:
-#          sendmail-whois[name=SSH, sendername="Fail2Ban - example.com"]
+           sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com, sendername="Fail2Ban"]
 logpath  = /var/log/sshd.log
 maxretry = 5
 

From bfa2b9dec3bb5414e8a8f46d518ec3bce2fbec1a Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 5 Jul 2013 18:36:02 +0100
Subject: [PATCH 385/544] ENH: dovecot filter additions for session, time value
 and blank user

---
 ChangeLog                    | 3 +++
 config/filter.d/dovecot.conf | 2 +-
 testcases/files/logs/dovecot | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index dd5426a2..c91d6bcd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -38,6 +38,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
   Alexander Dietrich
    * action.d/sendmail-common.conf -- added common sendmail settings file
      and made the sender display name configurable
+  Steven Hiscocks
+   * filter.d/dovecot - Addition of session, time values and possible blank
+     user
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index f111859f..2143e224 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -17,7 +17,7 @@ _daemon = dovecot(-auth)?
 # Values:  TEXT
 #
 failregex = ^%(__prefix_line)s(pam_unix(\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
-            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \((no auth attempts|auth failed, \d+ attempts|tried to use disabled \S+ auth)\):( user=<\S+>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?\s*$
+            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index 01df0af3..b4d978b6 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -14,3 +14,5 @@ Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth
 Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected
 Jun 23 00:52:43 vhost1-ua dovecot: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts): user=<info>, method=PLAIN, rip=193.95.245.163, lip=176.214.13.210
 
+Jul 02 13:49:31 hostname dovecot[442]: pop3-login: Aborted login (auth failed, 1 attempts in 17 secs): user=<test>, method=PLAIN, rip=192.51.100.13, lip=203.0.113.17, session=<YADINsQCDs5BH8Pg>
+Jul 02 13:49:32 hostname dovecot[442]: pop3-login: Disconnected (no auth attempts in 58 secs): user=<>, rip=192.51.100.13, lip=203.0.113.17, session=<LgDINsQCkttVIMPg>

From 619603fe054765da7bcfed374c55ce07c142abeb Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 7 Jul 2013 17:48:20 +1000
Subject: [PATCH 386/544] BF: match asterisk InvalidPassword correctly

---
 config/filter.d/asterisk.conf | 2 +-
 testcases/files/logs/asterisk | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index 5e775430..e4e5de5f 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -32,7 +32,7 @@ failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?'
             ^%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
             ^%(log_prefix)s Failed to authenticate user [^@]+@<HOST>\S*$
             ^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
-            ^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$
+            ^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index e2fe3b6e..b4ecf974 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -19,3 +19,4 @@
 [2009-12-22 16:35:24] NOTICE[1570][C-00000086] chan_sip.c: Sending fake auth rejection for device 1022<sip:1022@192.168.2.102>;tag=5d8b6f92
 # http://www.spinics.net/lists/asterisk/msg127381.html
 [2009-12-22 16:35:24] NOTICE[14916]: chan_sip.c:15644 handle_request_subscribe: Sending fake auth rejection for user <sip:CS@192.168.2.102>;tag=6pwd6erg54
+[2013-07-06 09:09:25] SECURITY[3308] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="1373098165-824497",Severity="Error",Service="SIP",EventVersion="2",AccountID="972592891005",SessionID="0x88aab6c",LocalAddress="IPV4/UDP/92.28.73.180/5060",RemoteAddress="IPV4/UDP/141.255.164.106/5084",Challenge="41d26de5",ReceivedChallenge="41d26de5",ReceivedHash="7a6a3a2e95a05260aee612896e1b4a39"

From 1f5097649c55925e7b51c3156d5e0fdd0627a21e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 9 Jul 2013 08:20:13 +1000
Subject: [PATCH 387/544] DOC: ChangeLog for exim-spam.conf filter  and
 tabs->spaces in changelog

---
 ChangeLog | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 549eb7f7..4a28f815 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,11 +13,14 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 - Fixes:
   Yaroslav Halchenko
    * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267
-	Daniel Black & Мернов Георгий
-	 * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in ,
+  Daniel Black & Мернов Георгий
+   * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in ,
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
+  Daniel Black
+   * filter.d/exim-spam.conf -- a splitout of exim's spam regexes
+     with additions for greater control over filtering spam.
 - Enhancements:
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening

From 174e3dba6dc5bfc44d34f02c68f5dee459cc7b92 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 9 Jul 2013 08:36:53 +1000
Subject: [PATCH 388/544] DOC: Note on new dependency - ed for hosts_deny

---
 ChangeLog | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 5331e4a0..d02601c1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,8 +16,9 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
    * filter.d/apache-common.conf -- support apache 2.4 more detailed error
      log format.  Closes gh-268
   Daniel Black
-	 * action.d/hostsdeny -- Switched to use 'ed' available across all
-	   platforms to ensure permissions are the same before and after a ban - gh-266
+  * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
+    all platforms to ensure permissions are the same before and after a ban -
+		closes gh-266
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added

From 424da926010cbc31e4849704b3c7b32e2e87f854 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 9 Jul 2013 08:51:11 +1000
Subject: [PATCH 389/544] DOC: close message for commits.

---
 DEVELOP | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index 2731fd13..2d7a043b 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -248,6 +248,10 @@ Use the following tags in your commit messages:
 
 Multiple tags could be joined with +, e.g. "BF+TST:".
 
+Use the text "closes #333"/"resolves #333 "/"fixes #333" where 333 represents
+an issue that is closed. Other text and details in link below.
+See: https://help.github.com/articles/closing-issues-via-commit-messages
+
 Adding Actions
 --------------
 

From 6ce41a611d8f4a7daf8b522ba25aa230f726ca96 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 11 Jul 2013 22:13:51 +1000
Subject: [PATCH 390/544] BF: fix filter on apache-auth. Closes #286

---
 ChangeLog                        | 3 ++-
 THANKS                           | 1 +
 config/filter.d/apache-auth.conf | 8 ++++++--
 testcases/files/logs/apache-auth | 5 ++++-
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f0df7ddc..c289be80 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,7 +11,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
 -----------
 
 - Fixes:
-  
+  Daniel Black & Marcel Dopita
+   * filter.d/apache-auth -- fixed and apache auth samples provide. closes #286
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/THANKS b/THANKS
index 47c3e999..26e8041f 100644
--- a/THANKS
+++ b/THANKS
@@ -28,6 +28,7 @@ Joël Bertrand
 Justin Shore
 Kévin Drapel
 kojiro
+Marcel Dopita
 Mark Edgington
 Markus Hoffmann
 Marvin Rouge
diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index ae3232f2..aa906401 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -18,8 +18,12 @@ before = apache-common.conf
 #          be used for standard IP/hostname matching and is only an alias for
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
-#
-failregex = ^%(_apache_error_client)s user .* (authentication failure|not found|password mismatch)\s*$
+
+# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c
+
+failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
+            ^%(_apache_error_client)s user .* not found: \S*\s*$
+
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index cf0f6d30..744a3406 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -2,4 +2,7 @@
 [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
 
 # should match
-[Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found
+# from https://github.com/fail2ban/fail2ban/issues/286
+[Thu Jul 11 01:21:41 2013] [error] [client 194.228.20.113] user  not found: /
+[Thu Jul 11 01:21:43 2013] [error] [client 194.228.20.113] user dsfasdf not found: /
+[Thu Jul 11 01:21:45 2013] [error] [client 194.228.20.113] user dsfasdf not found: /

From fce431add8a2bc940b7c56bec723c543d167da8a Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 11 Jul 2013 22:28:27 +1000
Subject: [PATCH 391/544] ENH: add mod_authz_core failures to apache-auth

---
 config/filter.d/apache-auth.conf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index aa906401..e99af22c 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -19,10 +19,14 @@ before = apache-common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 
-# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c
+# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c (1st 2)
+# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c
 
 failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
+            ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
+            ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
+            ^%(_apache_error_client)s user .* authorization failure for "\S*": \S*\s*$
 
 
 # Option:  ignoreregex

From 384b72a535ada04cbd2062beeabf9ece81dd722e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 11 Jul 2013 22:58:36 +1000
Subject: [PATCH 392/544] ENH: apache-auth filter - client wrong auth

---
 config/filter.d/apache-auth.conf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index e99af22c..82aedea0 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -19,11 +19,12 @@ before = apache-common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 
-# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c (1st 2)
-# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c
+# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c (1st 3)
+# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c (2nd 3)
 
 failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
+            ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
             ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
             ^%(_apache_error_client)s user .* authorization failure for "\S*": \S*\s*$

From 10e3be857a7d1aec02fea14ed1566bde6297ad22 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 11 Jul 2013 23:08:46 +1000
Subject: [PATCH 393/544] ENH: apache-auth filter added mod_auth_digest message

---
 config/filter.d/apache-auth.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 82aedea0..0ed7fe34 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -21,6 +21,7 @@ before = apache-common.conf
 
 # http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c (1st 3)
 # http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c (2nd 3)
+# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_digest.c (next 4)
 
 failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
@@ -28,6 +29,10 @@ failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*":
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
             ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
             ^%(_apache_error_client)s user .* authorization failure for "\S*": \S*\s*$
+            ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
+            ^%(_apache_error_client)s invalid nonce .* received - user attempted time travel\s*$
+            ^%(_apache_error_client)s user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
+            ^%(_apache_error_client)s user .*: one-time-nonce mismatch - sending new nonce\s*$
 
 
 # Option:  ignoreregex

From bf54db7ce711b65aa423099e086ae3e203836076 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 11 Jul 2013 23:10:44 +1000
Subject: [PATCH 394/544] ENH: ChangeLog notes for apache-auth enhancements

---
 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c289be80..14e8b2ef 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
      and extra failure examples in sample logs
+	 * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
+     mod_auth_digest failures.
   Daniel Black & Georgiy Mernov
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs

From 975999591f19f397eccf589089a73579f5ff7ea4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 12 Jul 2013 07:39:18 +1000
Subject: [PATCH 395/544] ENH/DOC: more realm mismatch errors. Documented
 filter design criteria

---
 config/filter.d/apache-auth.conf | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 0ed7fe34..366e25ab 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -12,27 +12,37 @@ before = apache-common.conf
 
 [Definition]
 
-# Option:  failregex
-# Notes.:  regex to match the password failure messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values:  TEXT
-
-# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_basic.c (1st 3)
-# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_authz_core.c (2nd 3)
-# http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/mod_auth_digest.c (next 4)
+# This filter matches the authorization failures of Apache. It takes the log messages
+# from the modules in aaa that return HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED or
+# HTTP_FORBIDDEN and not AUTH_GENERAL_ERROR or HTTP_INTERNAL_SERVER_ERROR.
+#
+# As an unauthorized response is the first step for a browser to instigate authentication
+# so don't set max retry too low.
+#
+# Source:
+#
+# By searching the code in http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/*
+# for ap_log_rerror(APLOG_MARK, APLOG_ERR and examining resulting return code should get
+# all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
+# to return the actual failure.
 
 failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
             ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
             ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
-            ^%(_apache_error_client)s user .* authorization failure for "\S*": \S*\s*$
+            ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
+            ^%(_apache_error_client)s user .* authorization failure for "\S*": \s*$
             ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
             ^%(_apache_error_client)s invalid nonce .* received - user attempted time travel\s*$
             ^%(_apache_error_client)s user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
             ^%(_apache_error_client)s user .*: one-time-nonce mismatch - sending new nonce\s*$
+            ^%(_apache_error_client)s realm mismatch - got `.*' but expected `.+'\s*$
+            ^%(_apache_error_client)s unknown algorithm `\S+' received: \S*\s*"$
+            ^%(_apache_error_client)s user `.*' in realm `.+' (not found|denied by provider): \S*\s*"$
+            ^%(_apache_error_client)s user .* password mismatch: \S*\s*"$
+            ^%(_apache_error_client)s invalid qop `.*' received: \S*\s*"$
+
 
 
 # Option:  ignoreregex

From 1bb427cc14a9faf005270b4b8f34cbced5fa465e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 12 Jul 2013 09:09:24 +1000
Subject: [PATCH 396/544] TST: remove dup test log entry

---
 testcases/files/logs/apache-auth | 1 -
 1 file changed, 1 deletion(-)

diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index 744a3406..e673e86d 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -5,4 +5,3 @@
 # from https://github.com/fail2ban/fail2ban/issues/286
 [Thu Jul 11 01:21:41 2013] [error] [client 194.228.20.113] user  not found: /
 [Thu Jul 11 01:21:43 2013] [error] [client 194.228.20.113] user dsfasdf not found: /
-[Thu Jul 11 01:21:45 2013] [error] [client 194.228.20.113] user dsfasdf not found: /

From 606e97683baf3216be2c521305b21122f500a586 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 12 Jul 2013 23:34:04 +0100
Subject: [PATCH 397/544] BF: jail.conf multiport actions previously using
 single port iptables

---
 config/jail.conf | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/config/jail.conf b/config/jail.conf
index c41d2c1b..e3b92038 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -229,7 +229,7 @@ logpath  = /var/log/apache2/error_log
 
 enabled  = false
 filter   = roundcube-auth
-action   = iptables[name=RoundCube, port="http,https"]
+action   = iptables-multiport[name=RoundCube, port="http,https"]
 logpath  = /var/log/roundcube/userlogins
 
 
@@ -241,7 +241,7 @@ enabled  = false
 filter   = sogo-auth
 # without proxy this would be:
 # port    = 20000
-action   = iptables[name=SOGo, port="http,https"]
+action   = iptables-multiport[name=SOGo, port="http,https"]
 logpath  = /var/log/sogo/sogo.log
 
 # Ban attackers that try to use PHP's URL-fopen() functionality
@@ -251,7 +251,7 @@ logpath  = /var/log/sogo/sogo.log
 [php-url-fopen]
 
 enabled = false
-action  = iptables[name=php-url-open, port="http,https"]
+action  = iptables-multiport[name=php-url-open, port="http,https"]
 filter  = php-url-fopen
 logpath = /var/www/*/logs/access_log
 maxretry = 1
@@ -267,7 +267,7 @@ maxretry = 1
 
 enabled = false
 filter  = lighttpd-fastcgi
-action  = iptables[name=lighttpd-fastcgi, port="http,https"]
+action  = iptables-multiport[name=lighttpd-fastcgi, port="http,https"]
 # adapt the following two items as needed
 logpath = /var/log/lighttpd/error.log
 maxretry = 2
@@ -279,7 +279,7 @@ maxretry = 2
 
 enabled = false
 filter  = lighttpd-auth
-action  = iptables[name=lighttpd-auth, port="http,https"]
+action  = iptables-multiport[name=lighttpd-auth, port="http,https"]
 # adapt the following two items as needed
 logpath = /var/log/lighttpd/error.log
 maxretry = 2
@@ -405,7 +405,7 @@ maxretry=5
 
 enabled = false
 filter  = 3proxy
-action  = iptables-multiport[name=3proxy, port=3128, protocol=tcp]
+action  = iptables[name=3proxy, port=3128, protocol=tcp]
 logpath = /var/log/3proxy.log
 
 [exim]

From 40f67c64b8d8d25a6d887ca83c9527549113ef41 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 13 Jul 2013 23:03:01 +0100
Subject: [PATCH 398/544] TST: Test sample logs' entries are matched by filter
 regexs

---
 fail2ban-testcases                            |  3 +
 server/filter.py                              |  9 +-
 testcases/files/logs/3proxy                   |  3 +
 testcases/files/logs/apache-auth              |  2 +
 testcases/files/logs/apache-nohome            |  2 +
 testcases/files/logs/apache-noscript          |  1 +
 testcases/files/logs/apache-overflows         |  2 +
 testcases/files/logs/assp                     | 12 +++
 testcases/files/logs/asterisk                 | 18 ++++
 testcases/files/logs/dovecot                  | 17 +++-
 testcases/files/logs/exim                     | 12 +++
 testcases/files/logs/exim-spam                |  5 +
 .../files/logs/{lighttpd => lighttpd-auth}    |  2 +
 .../files/logs/{mysqld.log => mysqld-auth}    |  6 ++
 testcases/files/logs/named-refused            |  6 ++
 testcases/files/logs/pam-generic              |  7 ++
 testcases/files/logs/postfix                  |  1 +
 testcases/files/logs/proftpd                  |  6 ++
 testcases/files/logs/pure-ftpd                |  2 +
 testcases/files/logs/roundcube-auth           |  2 +
 testcases/files/logs/sasl                     |  2 +
 testcases/files/logs/sogo-auth                | 14 +++
 testcases/files/logs/sshd                     | 28 ++++++
 testcases/files/logs/sshd-ddos                |  1 +
 testcases/files/logs/vsftpd                   |  3 +
 testcases/files/logs/webmin-auth              |  2 +
 testcases/files/logs/{wu-ftpd => wuftpd}      |  1 +
 testcases/samplestestcase.py                  | 98 +++++++++++++++++++
 28 files changed, 261 insertions(+), 6 deletions(-)
 rename testcases/files/logs/{lighttpd => lighttpd-auth} (60%)
 rename testcases/files/logs/{mysqld.log => mysqld-auth} (51%)
 rename testcases/files/logs/{wu-ftpd => wuftpd} (60%)
 create mode 100644 testcases/samplestestcase.py

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 89fc7deb..278dd890 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -32,6 +32,7 @@ from testcases import banmanagertestcase
 from testcases import clientreadertestcase
 from testcases import failmanagertestcase
 from testcases import filtertestcase
+from testcases import samplestestcase
 from testcases import servertestcase
 from testcases import datedetectortestcase
 from testcases import actiontestcase
@@ -170,6 +171,8 @@ tests.addTest(unittest.makeSuite(filtertestcase.JailTests))
 
 # DateDetector
 tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
+# Filter Regex tests with sample logs
+tests.addTest(unittest.makeSuite(samplestestcase.FilterSamplesRegex))
 
 #
 # Extensive use-tests of different available filters backends
diff --git a/server/filter.py b/server/filter.py
index 6cd37ca1..d0390e62 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -284,7 +284,7 @@ class Filter(JailThread):
 		return False
 
 
-	def processLine(self, line):
+	def processLine(self, line, returnRawHost=False):
 		"""Split the time portion from log msg and return findFailures on them
 		"""
 		try:
@@ -306,7 +306,7 @@ class Filter(JailThread):
 		else:
 			timeLine = l
 			logLine = l
-		return self.findFailure(timeLine, logLine)
+		return self.findFailure(timeLine, logLine, returnRawHost)
 
 	def processLineAndAdd(self, line):
 		"""Processes the line for failures and populates failManager
@@ -348,7 +348,7 @@ class Filter(JailThread):
 	# to find the logging time.
 	# @return a dict with IP and timestamp.
 
-	def findFailure(self, timeLine, logLine):
+	def findFailure(self, timeLine, logLine, returnRawHost=False):
 		failList = list()
 		# Checks if we must ignore this line.
 		if self.ignoreLine(logLine):
@@ -371,6 +371,9 @@ class Filter(JailThread):
 				else:
 					try:
 						host = failRegex.getHost()
+						if returnRawHost:
+							failList.append([host, date])
+							break
 						ipMatch = DNSUtils.textToIp(host, self.__useDns)
 						if ipMatch:
 							for ip in ipMatch:
diff --git a/testcases/files/logs/3proxy b/testcases/files/logs/3proxy
index 2967c9bf..614600ef 100644
--- a/testcases/files/logs/3proxy
+++ b/testcases/files/logs/3proxy
@@ -1,3 +1,6 @@
+# failJSON: { "time": "2013-06-11T02:09:40", "match": true , "host": "1.2.3.4" }
 11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
+# failJSON: { "time": "2013-06-11T02:09:43", "match": true , "host": "1.2.3.4" }
 11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
+# failJSON: { "time": "2013-06-13T01:39:34", "match": true , "host": "1.2.3.4" }
 13-06-2013 01:39:34 +0300 PROXY.3128 00508 - 1.2.3.4:28938 0.0.0.0:0 0 0 0 
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index cf0f6d30..6035db3f 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -1,5 +1,7 @@
 # Should not match -- DoS vector https://vndh.net/note:fail2ban-089-denial-service
+# failJSON: { "match": false }
 [Sat Jun 01 02:17:42 2013] [error] [client 192.168.33.1] File does not exist: /srv/http/site/[client 192.168.0.1] user root not found
 
 # should match
+# failJSON: { "time": "2005-06-01T02:17:42", "match": true , "host": "192.168.0.2" }
 [Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found
diff --git a/testcases/files/logs/apache-nohome b/testcases/files/logs/apache-nohome
index e8ef56bc..aea0d816 100644
--- a/testcases/files/logs/apache-nohome
+++ b/testcases/files/logs/apache-nohome
@@ -1,4 +1,6 @@
 # Apache 2.2
+# failJSON: { "time": "2005-06-01T11:23:08", "match": true , "host": "1.2.3.4" }
 [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4] File does not exist: /xxx/~
 # Apache 2.4
+# failJSON: { "time": "2005-06-27T11:55:44", "match": true , "host": "192.0.2.12" }
 [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 192.0.2.12:46652] AH00128: File does not exist: /xxx/~
diff --git a/testcases/files/logs/apache-noscript b/testcases/files/logs/apache-noscript
index 5d5d35ff..e08b3468 100644
--- a/testcases/files/logs/apache-noscript
+++ b/testcases/files/logs/apache-noscript
@@ -1 +1,2 @@
+# failJSON: { "time": "2005-06-09T07:57:47", "match": true , "host": "192.0.43.10" }
 [Sun Jun 09 07:57:47 2013] [error] [client 192.0.43.10] script '/usr/lib/cgi-bin/gitweb.cgiwp-login.php' not found or unable to stat
diff --git a/testcases/files/logs/apache-overflows b/testcases/files/logs/apache-overflows
index 18a44bfc..1af377f1 100644
--- a/testcases/files/logs/apache-overflows
+++ b/testcases/files/logs/apache-overflows
@@ -1,2 +1,4 @@
+# failJSON: { "time": "2005-03-16T15:39:29", "match": true , "host": "58.179.109.179" }
 [Tue Mar 16 15:39:29 2010] [error] [client 58.179.109.179] Invalid URI in request \xf9h\xa9\xf3\x88\x8cXKj \xbf-l*4\x87n\xe4\xfe\xd4\x1d\x06\x8c\xf8m\\rS\xf6n\xeb\x8
+# failJSON: { "time": "2005-03-15T15:44:47", "match": true , "host": "121.222.2.133" }
 [Mon Mar 15 15:44:47 2010] [error] [client 121.222.2.133] Invalid URI in request n\xed*\xbe*\xab\xefd\x80\xb5\xae\xf6\x01\x10M?\xf2\xce\x13\x9c\xd7\xa0N\xa7\xdb%0\xde\xe0\xfc\xd2\xa0\xfe\xe9w\xee\xc4`v\x9b[{\x0c:\xcb\x93\xc6\xa0\x93\x9c`l\\\x8d\xc9
diff --git a/testcases/files/logs/assp b/testcases/files/logs/assp
index 99363001..2c658eb9 100644
--- a/testcases/files/logs/assp
+++ b/testcases/files/logs/assp
@@ -1,13 +1,25 @@
+# failJSON: { "time": "2013-04-07T07:08:36", "match": true , "host": "68.171.223.68" }
 Apr-07-13 07:08:36 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+# failJSON: { "time": "2013-04-07T07:08:36", "match": true , "host": "68.171.223.68" }
 Apr-07-13 07:08:36 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+# failJSON: { "time": "2013-04-07T07:10:37", "match": true , "host": "68.171.223.68" }
 Apr-07-13 07:10:37 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+# failJSON: { "time": "2013-04-07T07:12:37", "match": true , "host": "68.171.223.68" }
 Apr-07-13 07:12:37 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+# failJSON: { "time": "2013-04-07T07:14:36", "match": true , "host": "68.171.223.68" }
 Apr-07-13 07:14:36 [SSL-out] 68.171.223.68 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
+# failJSON: { "time": "2013-04-27T02:25:09", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:09 Blocking 217.194.197.97 - too much AUTH errors (8);
+# failJSON: { "time": "2013-04-27T02:25:09", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:09 Blocking 217.194.197.97 - too much AUTH errors (9);
+# failJSON: { "time": "2013-04-27T02:25:09", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:09 Blocking 217.194.197.97 - too much AUTH errors (10);
+# failJSON: { "time": "2013-04-27T02:25:10", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:10 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+# failJSON: { "time": "2013-04-27T02:25:10", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:10 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+# failJSON: { "time": "2013-04-27T02:25:10", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:10 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
+# failJSON: { "time": "2013-04-27T02:25:11", "match": true , "host": "217.194.197.97" }
 Apr-27-13 02:25:11 [SSL-out] 217.194.197.97 max sender authentication errors (5) exceeded -- dropping connection - after reply: 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6;
 
diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index b4ecf974..ec2fec7c 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -1,22 +1,40 @@
 # Sample log files for asterisk 
+# failJSON: { "time": "2012-02-13T17:21:54", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:21:54] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Wrong password
+# failJSON: { "time": "2012-02-13T17:18:22", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:18:22] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - No matching peer found
+# failJSON: { "time": "2012-02-13T17:21:21", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:21:21] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Username/auth name mismatch
+# failJSON: { "time": "2012-02-13T17:32:01", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:32:01] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Device does not match ACL
+# failJSON: { "time": "2012-02-13T17:34:10", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:34:10] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Peer is not supposed to register
+# failJSON: { "time": "2012-02-13T17:36:23", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:36:23] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - ACL error (permit/deny)
+# failJSON: { "time": "2012-02-13T17:53:59", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:53:59] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed to authenticate as 'Fail2ban'
+# failJSON: { "time": "2012-02-13T17:39:20", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:39:20] NOTICE[1638] chan_iax2.c: No registration for peer 'Fail2ban' (from 1.2.3.4)
+# failJSON: { "time": "2012-02-13T17:44:26", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:44:26] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed MD5 authentication for 'Fail2ban' (e7df7cd2ca07f4f1ab415d457a6e1c13 != 53ac4bc41ee4ec77888ed4aa50677247)
+# failJSON: { "time": "2012-02-13T17:37:07", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:37:07] NOTICE[1638] chan_sip.c: Failed to authenticate user "Fail2ban" <sip:301@1.2.3.4>;tag=1r698745234
+# failJSON: { "time": "2013-02-05T23:44:42", "match": true , "host": "1.2.3.4" }
 [2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '0972598285108' rejected because extension not found in context 'default'.
+# failJSON: { "time": "2013-03-26T15:47:54", "match": true , "host": "1.2.3.4" }
 [2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@1.2.3.4' failed for '1.2.3.4:23930' - No matching peer found
+# failJSON: { "time": "2013-05-13T07:10:53", "match": true , "host": "1.2.3.4" }
 [2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/1.2.3.4/5060",RemoteAddress="IPV4/UDP/1.2.3.4/5070"
+# failJSON: { "time": "2013-06-10T18:15:03", "match": true , "host": "1.2.3.4" }
 [2013-06-10 18:15:03] NOTICE[2723] chan_sip.c: Registration from '"100"<sip:100@192.168.0.2:5060>' failed for '1.2.3.4' - Not a local domain
 # http://forum.4psa.com/showthread.php?t=6601
+# failJSON: { "time": "2009-12-22T16:35:24", "match": true , "host": "192.168.2.102" }
 [2009-12-22 16:35:24] NOTICE[6163] chan_sip.c: Sending fake auth rejection for device <sip:0004*001@192.168.2.102>;tag=e3793a95e1acbc69o
 # http://www.freepbx.org/forum/general-help/fake-auth-rejection
+# failJSON: { "time": "2009-12-22T16:35:24", "match": true , "host": "192.168.2.102" }
 [2009-12-22 16:35:24] NOTICE[1570][C-00000086] chan_sip.c: Sending fake auth rejection for device 1022<sip:1022@192.168.2.102>;tag=5d8b6f92
 # http://www.spinics.net/lists/asterisk/msg127381.html
+# failJSON: { "time": "2009-12-22T16:35:24", "match": true , "host": "192.168.2.102" }
 [2009-12-22 16:35:24] NOTICE[14916]: chan_sip.c:15644 handle_request_subscribe: Sending fake auth rejection for user <sip:CS@192.168.2.102>;tag=6pwd6erg54
+# failJSON: { "time": "2013-07-06T09:09:25", "match": true , "host": "141.255.164.106" }
 [2013-07-06 09:09:25] SECURITY[3308] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="1373098165-824497",Severity="Error",Service="SIP",EventVersion="2",AccountID="972592891005",SessionID="0x88aab6c",LocalAddress="IPV4/UDP/92.28.73.180/5060",RemoteAddress="IPV4/UDP/141.255.164.106/5084",Challenge="41d26de5",ReceivedChallenge="41d26de5",ReceivedHash="7a6a3a2e95a05260aee612896e1b4a39"
diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index 01df0af3..19297912 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -1,16 +1,27 @@
+# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "80.187.101.33" }
 @400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
 
-@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
+# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "176.61.140.224" }
+@400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
 # Above example with injected rhost into ruser -- should not match for 1.2.3.4
-@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=rhost=1.2.3.4 rhost=192.0.43.10
-@e040c6d8a3bfa62d358083300119c259cd44dcd0 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.225  user=root
+# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "192.0.43.10" }
+@400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=rhost=1.2.3.4 rhost=192.0.43.10
+# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "176.61.140.225" }
+@400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.225  user=root
 
+# failJSON: { "time": "2004-12-12T11:19:11", "match": true , "host": "190.210.136.21" }
 Dec 12 11:19:11 dunnart dovecot: pop3-login: Aborted login (tried to use disabled plaintext auth): rip=190.210.136.21, lip=113.212.99.193
 
+# failJSON: { "time": "2005-06-13T16:30:54", "match": true , "host": "49.176.98.87" }
 Jun 13 16:30:54 platypus dovecot: imap-login: Disconnected (auth failed, 2 attempts): user=<username.bob>, method=PLAIN, rip=49.176.98.87, lip=113.212.99.194, TLS
+# failJSON: { "time": "2005-06-14T00:48:21", "match": true , "host": "59.167.242.100" }
 Jun 14 00:48:21 platypus dovecot: imap-login: Disconnected (auth failed, 1 attempts): method=PLAIN, rip=59.167.242.100, lip=113.212.99.194, TLS: Disconnected
+# failJSON: { "time": "2005-06-13T20:48:11", "match": true , "host": "121.44.24.254" }
 Jun 13 20:48:11 platypus dovecot: pop3-login: Disconnected (no auth attempts): rip=121.44.24.254, lip=113.212.99.194, TLS: Disconnected
+# failJSON: { "time": "2005-06-13T21:48:06", "match": true , "host": "180.200.180.81" }
 Jun 13 21:48:06 platypus dovecot: pop3-login: Disconnected: Inactivity (no auth attempts): rip=180.200.180.81, lip=113.212.99.194, TLS
+# failJSON: { "time": "2005-06-13T20:20:21", "match": true , "host": "180.189.168.166" }
 Jun 13 20:20:21 platypus dovecot: imap-login: Disconnected (no auth attempts): rip=180.189.168.166, lip=113.212.99.194, TLS handshaking: Disconnected
+# failJSON: { "time": "2005-06-23T00:52:43", "match": true , "host": "193.95.245.163" }
 Jun 23 00:52:43 vhost1-ua dovecot: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts): user=<info>, method=PLAIN, rip=193.95.245.163, lip=176.214.13.210
 
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 0d5ae51d..95c70d25 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -1,19 +1,31 @@
 # From IRC 2013-01-04
+# failJSON: { "time": "2013-01-04T17:03:46", "match": true , "host": "24.106.174.74" }
 2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)
 # From IRC 2013-06-13 XATRIX (Georgiy Mernov)
+# failJSON: { "time": "2013-06-12T03:57:58", "match": true , "host": "120.196.140.45" }
 2013-06-12 03:57:58 login authenticator failed for (ylmf-pc) [120.196.140.45]: 535 Incorrect authentication data: 1 Time(s)
+# failJSON: { "time": "2013-06-12T13:18:11", "match": true , "host": "101.66.165.86" }
 2013-06-12 13:18:11 login authenticator failed for (USER-KVI9FGS9KP) [101.66.165.86]: 535 Incorrect authentication data
+# failJSON: { "time": "2013-06-10T10:10:59", "match": true , "host": "193.169.56.211" }
 2013-06-10 10:10:59 H=ufficioestampa.it (srv.ufficioestampa.it) [193.169.56.211] sender verify fail for <user@example.com>: Unrouteable address
 # http://forum.lissyara.su/viewtopic.php?f=20&t=29857
 # 2010-11-24 21:48:41 1PLKOW-00046U-EW F=wvhluo@droolindog.com H=93-143-146-237.adsl.net.t-com.hr (droolindog.com) [93.143.146.237] I=[10.10.10.32]:25 P=esmtp temporarily rejected by local_scan(): Temporary local problem
 # http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
 # 2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
+# failJSON: { "time": "2013-06-10T18:33:32", "match": true , "host": "202.132.70.178" }
 2013-06-10 18:33:32 [10099] H=(yakult.com.tw) [202.132.70.178]:3755 I=[1.2.3.4]:25 F=menacedsj04@listserv.eurasia.org rejected RCPT dir@ml3.ru: relay not permitted
+# failJSON: { "time": "2013-06-02T06:54:20", "match": true , "host": "211.148.195.192" }
 2013-06-02 06:54:20 [13314] SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[211.148.195.192]:25936 I=[1.2.3.4]:25 input="GET / HTTP/1.1\r\n\r\n"
+# failJSON: { "time": "2013-06-02T09:05:48", "match": true , "host": "82.96.160.77" }
 2013-06-02 09:05:48 [18505] SMTP protocol synchronization error (next input sent too soon: pipelining was not advertised): rejected "RSET" H=ba77.mx83.fr [82.96.160.77]:58302 I=[1.2.3.4]:25 next input="QUIT\r\n"
+# failJSON: { "time": "2013-06-02T09:22:05", "match": true , "host": "163.14.21.161" }
 2013-06-02 09:22:05 [19591] SMTP call from pc012-6201.spo.scu.edu.tw [163.14.21.161]:3767 I=[1.2.3.4]:25 dropped: too many nonmail commands (last was "RSET")
+# failJSON: { "time": "2013-06-02T15:06:18", "match": true , "host": "46.20.35.114" }
 2013-06-02 15:06:18 H=(VM-WIN2K3-1562) [46.20.35.114] sender verify fail for <usfh@technological-systems.com>: Unknown user
+# failJSON: { "time": "2013-06-07T02:02:09", "match": true , "host": "91.232.21.92" }
 2013-06-07 02:02:09 H=treeladders.kiev.ua [91.232.21.92] sender verify fail for <mailer@treeladders.kiev.ua>: all relevant MX records point to non-existent hosts
+# failJSON: { "time": "2013-06-15T16:34:55", "match": true , "host": "182.18.24.93" }
 2013-06-15 16:34:55 H=mx.tillions.com [182.18.24.93] F=<buh@caladan.ebay.sun.com> rejected RCPT <ruslan@maslovskiy.com.ua>: Sender verify failed
+# failJSON: { "time": "2013-06-15T16:36:49", "match": true , "host": "111.67.203.116" }
 2013-06-15 16:36:49 H=altmx.marsukov.com [111.67.203.116] F=<kadrofutcheti@mail.ru> rejected RCPT <oksana@birzhatm.ua>: Unknown user
 
diff --git a/testcases/files/logs/exim-spam b/testcases/files/logs/exim-spam
index 535309f5..46b915d1 100644
--- a/testcases/files/logs/exim-spam
+++ b/testcases/files/logs/exim-spam
@@ -3,10 +3,15 @@
 # http://us.generation-nt.com/answer/exim-spamassassin-2010-0-x64-help-204020461.html
 # 2011-07-07 15:44:16 1QexIu-0006dj-PX F=XXXXXX@XXXXXXXXXXXX H=localhost (saf.bio.caltech.edu) [127.0.0.1] P=esmtp temporarily rejected by local_scan(): Local configuration error - local_scan() library failure/usr/lib/exim/sa-exim.so: cannot open shared object file: No such file or directory
 # http://www.clues.ltd.uk/howto/debian-sa-fprot-HOWTO.html
+# failJSON: { "time": "2004-01-18T07:15:35", "match": true , "host": "4.47.28.40" }
 2004-01-18 07:15:35 1Ai79e-0000Dq-8i F=uzwltcmwto24@melissacam.biz H=lsanca1-ar3-4-47-028-040.lsanca1.elnk.dsl.genuity.net [4.47.28.40] P=smtp rejected by local_scan(): Rejected: hits=7.5 required=5.0 trigger=5.0
 # https://github.com/fail2ban/fail2ban/pull/251#issuecomment-19493875
+# failJSON: { "time": "2013-06-15T11:19:33", "match": true , "host": "2.181.148.95" }
 2013-06-15 11:19:33 [2249] H=([2.181.148.95]) [2.181.148.95]:52391 I=[1.2.3.4]:25 F=fantasizesg4@google.com rejected RCPT some@email.com: rejected found in dnsbl zen.spamhaus.org
+# failJSON: { "time": "2013-06-09T10:21:28", "match": true , "host": "46.254.240.82" }
 2013-06-09 10:21:28 [14127] 1UlasQ-0003fr-45 F=mcorporation4@aol.com H=(mail38.fssprus.ru) [46.254.240.82]:43671 I=[1.2.3.4]:25 P=esmtp rejected by local_scan(): Rejected
+# failJSON: { "time": "2013-06-15T11:20:36", "match": true , "host": "83.235.177.148" }
 2013-06-15 11:20:36 [2516] 1Unmew-0000ea-SE H=egeftech.static.otenet.gr [83.235.177.148]:32706 I=[1.2.3.4]:25 F=auguriesvbd40@google.com rejected after DATA: This message contains a virus (Sanesecurity.Junk.39934.UNOFFICIAL).
+# failJSON: { "time": "2013-06-16T02:50:43", "match": true , "host": "111.67.203.114" }
 2013-06-16 02:50:43 H=dbs.marsukov.com [111.67.203.114] F=<trudofspiori@mail.ru> rejected RCPT <info@nanomedtech.ua>: rejected because 111.67.203.114 is in a black list at dnsbl.sorbs.net\nCurrently Sending Spam See: http://www.sorbs.net/lookup.shtml?111.67.203.114
 
diff --git a/testcases/files/logs/lighttpd b/testcases/files/logs/lighttpd-auth
similarity index 60%
rename from testcases/files/logs/lighttpd
rename to testcases/files/logs/lighttpd-auth
index c3cfcb75..745a2462 100644
--- a/testcases/files/logs/lighttpd
+++ b/testcases/files/logs/lighttpd-auth
@@ -1,3 +1,5 @@
 #authentification failure (mod_auth)
+# failJSON: { "time": "2011-12-25T17:09:20", "match": true , "host": "4.4.4.4" }
 2011-12-25 17:09:20: (http_auth.c.875) password doesn't match for /gitweb/ username: francois, IP: 4.4.4.4
+# failJSON: { "time": "2012-09-26T10:24:35", "match": true , "host": "4.4.4.4" }
 2012-09-26 10:24:35: (http_auth.c.1136) digest: auth failed for  xxx : wrong password, IP: 4.4.4.4
diff --git a/testcases/files/logs/mysqld.log b/testcases/files/logs/mysqld-auth
similarity index 51%
rename from testcases/files/logs/mysqld.log
rename to testcases/files/logs/mysqld-auth
index b3a73078..757ecb66 100644
--- a/testcases/files/logs/mysqld.log
+++ b/testcases/files/logs/mysqld-auth
@@ -1,6 +1,12 @@
+# failJSON: { "time": "2013-03-24T00:04:00", "match": true , "host": "192.168.1.35" }
 130324  0:04:00 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: NO)
+# failJSON: { "time": "2013-03-24T08:24:09", "match": true , "host": "220.95.238.171" }
 130324  8:24:09 [Warning] Access denied for user 'root'@'220.95.238.171' (using password: NO)
+# failJSON: { "time": "2013-03-24T17:56:13", "match": true , "host": "61.160.223.112" }
 130324 17:56:13 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: NO)
+# failJSON: { "time": "2013-03-24T17:56:14", "match": true , "host": "61.160.223.112" }
 130324 17:56:14 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES)
+# failJSON: { "time": "2013-03-24T19:01:39", "match": true , "host": "61.147.108.35" }
 130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO)
+# failJSON: { "time": "2013-03-24T19:01:40", "match": true , "host": "61.147.108.35" }
 130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)
diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 130e7417..6f6092e2 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -1,6 +1,12 @@
+# failJSON: { "time": "2005-07-24T14:16:55", "match": true , "host": "194.145.196.18" }
 Jul 24 14:16:55 raid5 named[3935]: client 194.145.196.18#4795: query 'ricreig.com/NS/IN' denied
+# failJSON: { "time": "2005-07-24T14:16:56", "match": true , "host": "62.123.164.113" }
 Jul 24 14:16:56 raid5 named[3935]: client 62.123.164.113#32768: query 'ricreig.com/NS/IN' denied
+# failJSON: { "time": "2005-07-24T14:17:13", "match": true , "host": "148.160.29.6" }
 Jul 24 14:17:13 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'geo-mueller.de/NS/IN' denied
+# failJSON: { "time": "2005-07-24T14:20:25", "match": true , "host": "148.160.29.6" }
 Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shivaree.de/NS/IN' denied
+# failJSON: { "time": "2005-07-24T14:23:36", "match": true , "host": "148.160.29.6" }
 Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied
+# failJSON: { "time": "2005-07-24T14:23:36", "match": true , "host": "62.109.4.89" }
 Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied
diff --git a/testcases/files/logs/pam-generic b/testcases/files/logs/pam-generic
index d84ab153..dc7efeee 100644
--- a/testcases/files/logs/pam-generic
+++ b/testcases/files/logs/pam-generic
@@ -1,7 +1,14 @@
+# failJSON: { "time": "2005-02-07T15:10:42", "match": true , "host": "192.168.1.1" }
 Feb  7 15:10:42 example pure-ftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=sample-user rhost=192.168.1.1 
+# failJSON: { "time": "2005-05-12T09:47:54", "match": true , "host": "71-13-115-12.static.mdsn.wi.charter.com" }
 May 12 09:47:54 vaio sshd[16004]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com  user=root
+# failJSON: { "time": "2005-05-12T09:48:03", "match": true , "host": "71-13-115-12.static.mdsn.wi.charter.com" }
 May 12 09:48:03 vaio sshd[16021]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com
+# failJSON: { "time": "2005-05-15T18:02:12", "match": true , "host": "66.232.129.62" }
 May 15 18:02:12 localhost proftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=66.232.129.62  user=mark
+# failJSON: { "time": "2004-11-25T17:12:13", "match": true , "host": "192.168.10.3" }
 Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
+# failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www3.google.com" }
 Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www3.google.com
+# failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www3.google.com" }
 Jul 19 18:11:26 srv2 vsftpd: pam_unix: authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www3.google.com
diff --git a/testcases/files/logs/postfix b/testcases/files/logs/postfix
index 28ff95a4..50e3a360 100644
--- a/testcases/files/logs/postfix
+++ b/testcases/files/logs/postfix
@@ -1,3 +1,4 @@
 # per https://github.com/fail2ban/fail2ban/issues/125
 # and https://github.com/fail2ban/fail2ban/issues/126
+# failJSON: { "time": "2005-02-21T09:21:54", "match": true , "host": "192.0.43.10" }
 Feb 21 09:21:54 xxx postfix/smtpd[14398]: NOQUEUE: reject: RCPT from example.com[192.0.43.10]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=
diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd
index aaaf0295..404ebfaf 100644
--- a/testcases/files/logs/proftpd
+++ b/testcases/files/logs/proftpd
@@ -1,8 +1,14 @@
+# failJSON: { "time": "2005-01-10T00:00:00", "match": true , "host": "123.123.123.123" }
 Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers
+# failJSON: { "time": "2005-02-01T00:00:00", "match": true , "host": "123.123.123.123" }
 Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21 
+# failJSON: { "time": "2005-06-09T07:30:58", "match": true , "host": "67.227.224.66" }
 Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password.
+# failJSON: { "time": "2005-06-09T11:15:43", "match": true , "host": "101.71.143.238" }
 Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21
+# failJSON: { "time": "2005-06-13T22:07:23", "match": true , "host": "59.167.242.100" }
 Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
+# failJSON: { "time": "2005-06-14T00:09:59", "match": true , "host": "59.167.242.100" }
 Jun 14 00:09:59 platypus.ace-hosting.com.au proftpd[17839] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): USER platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (hihoinjection[1.2.3.44]): no such user found from ::ffff:59.167.242.100 [::ffff:59.167.242.100] to ::ffff:113.212.99.194:21
 
 
diff --git a/testcases/files/logs/pure-ftpd b/testcases/files/logs/pure-ftpd
index 4b4e3455..ef49b2ff 100644
--- a/testcases/files/logs/pure-ftpd
+++ b/testcases/files/logs/pure-ftpd
@@ -1,2 +1,4 @@
+# failJSON: { "time": "2005-01-31T16:54:07", "match": true , "host": "24.79.92.194" }
 Jan 31 16:54:07 desktop pure-ftpd: (?@24.79.92.194) [WARNING] Authentication failed for user [Administrator]
+# failJSON: { "time": "2004-11-05T18:54:02", "match": true , "host": "server202181210195.ixlink.net" }
 Nov 5 18:54:02 pure-ftpd: (?@server202181210195.ixlink.net) [WARNING] Authentication failed for user [Administrator] 
diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth
index 04e0faf5..dec8051e 100644
--- a/testcases/files/logs/roundcube-auth
+++ b/testcases/files/logs/roundcube-auth
@@ -1,2 +1,4 @@
+# failJSON: { "time": "2013-01-22T22:28:21", "match": true , "host": "192.0.43.10" }
 [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10
+# failJSON: { "time": "2005-05-26T07:12:40", "match": true , "host": "10.1.1.47" }
 May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47
diff --git a/testcases/files/logs/sasl b/testcases/files/logs/sasl
index 18c5ff14..ca306098 100644
--- a/testcases/files/logs/sasl
+++ b/testcases/files/logs/sasl
@@ -1,5 +1,7 @@
 #1 Example from postfix from dbts #507990
+# failJSON: { "time": "2004-12-02T22:24:22", "match": true , "host": "114.44.142.233" }
 Dec  2 22:24:22 hel postfix/smtpd[7676]: warning: 114-44-142-233.dynamic.hinet.net[114.44.142.233]: SASL CRAM-MD5 authentication failed: PDc3OTEwNTkyNTEyMzA2NDIuMTIyODI1MzA2MUBoZWw+
 #2 Example from postfix from dbts #573314
+# failJSON: { "time": "2005-03-10T13:33:30", "match": true , "host": "1.1.1.1" }
 Mar 10 13:33:30 gandalf postfix/smtpd[3937]: warning: HOSTNAME[1.1.1.1]: SASL LOGIN authentication failed: authentication failure
 
diff --git a/testcases/files/logs/sogo-auth b/testcases/files/logs/sogo-auth
index e4fb9409..02a69c6d 100644
--- a/testcases/files/logs/sogo-auth
+++ b/testcases/files/logs/sogo-auth
@@ -1,17 +1,31 @@
 # yoh: Kept original apache log lines as well, just in case they might come useful
 #      for (testing) multiline regular expressions which would further constraint
 #      SOGo log lines
+# failJSON: { "match": false }
 Mar 24 08:58:32 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87c3008> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=hack0r,ou=users,dc=mail,dc=example,dc=org"; }
+# failJSON: { "time": "2005-03-24T08:58:32", "match": true , "host": "173.194.44.31" }
 Mar 24 08:58:32 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'hack0r' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+# failJSON: { "match": false }
 173.194.44.31 - - [24/Mar/2013:08:58:32 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/38 0.311 - - 2M
+# failJSON: { "match": false }
 Mar 24 08:58:40 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87bb8d8> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=kiddy,ou=users,dc=mail,dc=example,dc=org"; }
+# failJSON: { "time": "2005-03-24T08:58:40", "match": true , "host": "173.194.44.31" }
 Mar 24 08:58:40 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'kiddy' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+# failJSON: { "match": false }
 173.194.44.31 - - [24/Mar/2013:08:58:40 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/37 0.007 - - 32K
+# failJSON: { "match": false }
 Mar 24 08:58:50 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87c27f8> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=plsBanMe,ou=users,dc=mail,dc=example,dc=org"; }
+# failJSON: { "time": "2005-03-24T08:58:50", "match": true , "host": "173.194.44.31" }
 Mar 24 08:58:50 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'plsBanMe' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+# failJSON: { "match": false }
 173.194.44.31 - - [24/Mar/2013:08:58:50 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/40 0.008 - - 0
+# failJSON: { "match": false }
 Mar 24 08:58:59 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87be830> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=root,ou=users,dc=mail,dc=example,dc=org"; }
+# failJSON: { "time": "2005-03-24T08:58:59", "match": true , "host": "173.194.44.31" }
 Mar 24 08:58:59 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'root' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
+# failJSON: { "match": false }
 173.194.44.31 - - [24/Mar/2013:08:58:59 GMT] "POST /SOGo/connect HTTP/1.1" 403 34/36 0.007 - - 0
+# failJSON: { "match": false }
 Mar 24 08:59:04 sogod [26818]: <0x0xb8537990[LDAPSource]> <NSException: 0xb87bc088> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{login = "uid=admin,ou=users,dc=mail,dc=example,dc=org"; }
+# failJSON: { "time": "2005-03-24T08:59:04", "match": true , "host": "173.194.44.31" }
 Mar 24 08:59:04 sogod [26818]: SOGoRootPage Login from '173.194.44.31' for user 'admin' might not have worked - password policy: 65535  grace: -1  expire: -1  bound: 0
diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index 1943fb37..ff97c5a5 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -1,51 +1,79 @@
 #1
+# failJSON: { "time": "2005-06-21T16:47:48", "match": true , "host": "192.030.0.6" }
 Jun 21 16:47:48 digital-mlhhyiqscv sshd[13709]: error: PAM: Authentication failure for myhlj1374 from 192.030.0.6
+# failJSON: { "time": "2005-05-29T20:56:52", "match": true , "host": "example.com" }
 May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from example.com
 
 #2
+# failJSON: { "time": "2005-02-25T14:34:10", "match": true , "host": "194.117.26.69" }
 Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.69 port 50273 ssh2
+# failJSON: { "time": "2005-02-25T14:34:10", "match": true , "host": "194.117.26.70" }
 Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.70 port 12345
 
 #3
+# failJSON: { "time": "2005-01-05T01:31:41", "match": true , "host": "1.2.3.4" }
 Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM 1.2.3.4
+# failJSON: { "time": "2005-01-05T01:31:41", "match": true , "host": "1.2.3.4" }
 Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4
 
 #4
+# failJSON: { "time": "2005-07-20T14:42:11", "match": true , "host": "211.114.51.213" }
 Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
 
 #5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
 # yoh: added ':' after [sshd] since the case without is not really common any more
+# failJSON: { "time": "2005-03-03T00:17:22", "match": true , "host": "211.188.220.49" }
 Mar  3 00:17:22 [sshd]: User root from 211.188.220.49 not allowed because not listed in AllowUsers
+# failJSON: { "time": "2005-02-25T14:34:11", "match": true , "host": "example.com" }
 Feb 25 14:34:11 belka sshd[31607]: User root from example.com not allowed because not listed in AllowUsers
 
 #6 ew filter introduced thanks to report Guido Bozzetto <reportbug@G-B.it>
+# failJSON: { "time": "2004-11-11T23:33:27", "match": true , "host": "218.249.210.161" }
 Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)
 
 #7 added exclamation mark to BREAK-IN
 #  Now should be a negative since we decided not to catch those
+# failJSON: { "match": false }
 Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT
+# failJSON: { "match": false }
 Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
 
 #8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47
+# failJSON: { "time": "2005-04-16T22:01:15", "match": true , "host": "46.45.128.3" }
 Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers
 
 #9 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182
+# failJSON: { "time": "2005-03-29T05:59:23", "match": true , "host": "205.186.180.55" }
 Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.55 port 42742 ssh2
+# failJSON: { "time": "2005-03-29T05:20:09", "match": true , "host": "205.186.180.30" }
 Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
 
 #10 OSX syslog error
+# failJSON: { "time": "2005-04-29T17:16:20", "match": true , "host": "example.com" }
 Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from example.com via 192.168.1.201
+# failJSON: { "time": "2005-04-29T20:11:08", "match": true , "host": "205.186.180.35" }
 Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.35 port 42742 ssh2
+# failJSON: { "time": "2005-04-29T20:12:08", "match": true , "host": "205.186.180.22" }
 Apr 29 20:12:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.22 port 54520 ssh2
+# failJSON: { "time": "2005-04-29T20:13:08", "match": true , "host": "205.186.180.42" }
 Apr 29 20:13:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for james from 205.186.180.42 port 54520 ssh2
+# failJSON: { "time": "2005-04-29T20:14:08", "match": true , "host": "205.186.180.44" }
 Apr 29 20:14:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for <invalid username> from 205.186.180.44 port 42742 ssh2
+# failJSON: { "time": "2005-04-30T01:42:12", "match": true , "host": "205.186.180.77" }
 Apr 30 01:42:12 Jamess-iMac.local sshd[2554]: Failed keyboard-interactive/pam for invalid user jamedds from 205.186.180.77 port 33723 ssh2
+# failJSON: { "time": "2005-04-29T12:53:38", "match": true , "host": "205.186.180.88" }
 Apr 29 12:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication failure for james from 205.186.180.88 via 192.168.1.201
+# failJSON: { "time": "2005-04-29T13:53:38", "match": true , "host": "205.186.180.99" }
 Apr 29 13:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication failure for james from 205.186.180.99 via 192.168.1.201
+# failJSON: { "time": "2005-04-29T15:53:38", "match": true , "host": "205.186.180.100" }
 Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error for james from 205.186.180.100 via 192.168.1.201
+# failJSON: { "time": "2005-04-29T16:53:38", "match": true , "host": "205.186.180.101" }
 Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201
+# failJSON: { "time": "2005-04-29T17:53:38", "match": true , "host": "205.186.180.102" }
 Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102
+# failJSON: { "time": "2005-04-29T18:53:38", "match": true , "host": "205.186.180.103" }
 Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103
 
 #11 https://github.com/fail2ban/fail2ban/issues/267  There might be no colon after [daemon]
+# failJSON: { "time": "2005-06-25T23:53:34", "match": true , "host": "1.2.3.4" }
 Jun 25 23:53:34 [sshd] User root from 1.2.3.4 not allowed because not listed in AllowUsers
diff --git a/testcases/files/logs/sshd-ddos b/testcases/files/logs/sshd-ddos
index d71c6bb2..452abbde 100644
--- a/testcases/files/logs/sshd-ddos
+++ b/testcases/files/logs/sshd-ddos
@@ -1,2 +1,3 @@
 # http://forums.powervps.com/showthread.php?t=1667
+# failJSON: { "time": "2005-06-07T01:10:56", "match": true , "host": "69.61.56.114" }
 Jun 7 01:10:56 host sshd[5937]: Did not receive identification string from 69.61.56.114
diff --git a/testcases/files/logs/vsftpd b/testcases/files/logs/vsftpd
index a8b6a4cf..f3fb997f 100644
--- a/testcases/files/logs/vsftpd
+++ b/testcases/files/logs/vsftpd
@@ -1,7 +1,10 @@
 #1 PAM based
+# failJSON: { "time": "2004-10-11T01:06:47", "match": true , "host": "209.67.1.67" }
 Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=209.67.1.67
+# failJSON: { "time": "2005-02-06T12:02:29", "match": true , "host": "64.168.103.1" }
 Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1
 
 #2 Internal
+# failJSON: { "time": "2005-01-19T12:20:33", "match": true , "host": "64.106.46.98" }
 Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.98"
 
diff --git a/testcases/files/logs/webmin-auth b/testcases/files/logs/webmin-auth
index 86d3f321..424c114d 100644
--- a/testcases/files/logs/webmin-auth
+++ b/testcases/files/logs/webmin-auth
@@ -1,7 +1,9 @@
 #Webmin authentication failures from /var/log/auth.log
 
 #1 User exists, bad password
+# failJSON: { "time": "2004-12-13T08:15:18", "match": true , "host": "89.2.49.230" }
 Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230 
 
 #2 User does not exists
+# failJSON: { "time": "2004-12-12T23:14:19", "match": true , "host": "188.40.105.142" }
 Dec 12 23:14:19 sb1 webmin[22134]: Non-existent login as robert from 188.40.105.142 
diff --git a/testcases/files/logs/wu-ftpd b/testcases/files/logs/wuftpd
similarity index 60%
rename from testcases/files/logs/wu-ftpd
rename to testcases/files/logs/wuftpd
index b6b41613..22ac0303 100644
--- a/testcases/files/logs/wu-ftpd
+++ b/testcases/files/logs/wuftpd
@@ -1,2 +1,3 @@
 # This login line is from syslog
+# failJSON: { "time": "2004-10-06T09:59:26", "match": true , "host": "202.108.145.173" }
 Oct  6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173]
diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
new file mode 100644
index 00000000..2bb73ca1
--- /dev/null
+++ b/testcases/samplestestcase.py
@@ -0,0 +1,98 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
+# This file is part of Fail2Ban.
+#
+# Fail2Ban is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Fail2Ban is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Fail2Ban; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+# Fail2Ban developers
+
+__copyright__ = "Copyright (c) 2013 Steven Hiscocks"
+__license__ = "GPL"
+
+import unittest, os, fileinput, re, json, datetime
+
+from server.filter import Filter
+from client.filterreader import FilterReader
+
+TEST_FILES_DIR = os.path.join(os.path.dirname(__file__), "files")
+CONFIG_DIR = "config"
+
+class FilterSamplesRegex(unittest.TestCase):
+
+	def setUp(self):
+		"""Call before every test case."""
+		self.filter = Filter(None)
+		self.filter.setActive(True)
+
+	def tearDown(self):
+		"""Call after every test case."""
+
+def testSampleRegexsFactory(name):
+	def testFilter(self):
+
+		# Check filter exists
+		filterConf = FilterReader(name, "jail", basedir=CONFIG_DIR)
+		filterConf.read()
+		filterConf.getOptions({})
+
+		for opt in filterConf.convert():
+			if opt[2] == "addfailregex":
+				self.filter.addFailRegex(opt[3])
+
+		logFile = fileinput.FileInput(
+			os.path.join(TEST_FILES_DIR, "logs", name))
+		for line in logFile:
+			jsonREMatch = re.match("^# ?failJSON:(.+)$", line)
+			if jsonREMatch:
+				try:
+					faildata = json.loads(jsonREMatch.group(1))
+				except ValueError, e:
+					raise ValueError("%s: %s:%i" %
+						(e, logFile.filename(), logFile.filelineno()))
+				line = next(logFile)
+			elif line.startswith("#") or not line.strip():
+				continue
+			else:
+				faildata = {}
+
+			ret = self.filter.processLine(line, returnRawHost=True)
+			if not ret:
+				# Check line is flagged as none match
+				self.assertFalse(faildata.get('match', True),
+					 "Line not matched when should have: %s:%i" %
+					(logFile.filename(), logFile.filelineno()))
+			elif ret:
+				# Check line is flagged to match
+				self.assertTrue(faildata.get('match', False),
+					"Line matched when shouldn't have: %s:%i" %
+					(logFile.filename(), logFile.filelineno()))
+				self.assertEqual(len(ret), 1)
+				# Verify timestamp and host as expected
+				host, time = ret[0]
+				self.assertEqual(host, faildata.get("host", None))
+				self.assertEqual(
+					datetime.datetime.fromtimestamp(time),
+					datetime.datetime.strptime(
+						faildata.get("time", None), "%Y-%m-%dT%H:%M:%S"))
+
+	return testFilter
+
+for filter_ in os.listdir(os.path.join(TEST_FILES_DIR, "logs")):
+	if os.path.isfile(os.path.join(TEST_FILES_DIR, "logs", filter_)):
+		setattr(
+			FilterSamplesRegex,
+			"testSampleRegexs%s" % filter_.upper(),
+			testSampleRegexsFactory(filter_))

From 09850d6ba52c7c1fbbe007cfa11348ca60dd7ee1 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 14 Jul 2013 10:25:06 +1000
Subject: [PATCH 399/544] DOC: shorten example and provide clarifcation and
 spelling fixes

---
 README.Solaris | 23 +++--------------------
 1 file changed, 3 insertions(+), 20 deletions(-)

diff --git a/README.Solaris b/README.Solaris
index 10a5f88c..86f56241 100644
--- a/README.Solaris
+++ b/README.Solaris
@@ -69,27 +69,10 @@ FAIL2BAN CONFIGURATION
 
 OPT: Create /etc/fail2ban/fail2ban.local containing:
 
-# Fail2Ban main configuration file
-#
-# Comments: use '#' for comment lines and ';' (following a space) for inline comments
-#
-# Changes:  in most of the cases you should not modify this
-#           file, but provide customizations in fail2ban.local file, e.g.:
-#
-# [Definition]
-# loglevel = 4
+# Fail2Ban configuration file for logging fail2ban on Solaris
 #
 [Definition]
 
-# Option:  logtarget
-# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
-#          Only one log target can be specified.
-#          If you change logtarget from the default value and you are
-#          using logrotate -- also adjust or disable rotation in the
-#          corresponding configuration file
-#          (e.g. /etc/logrotate.d/fail2ban on Debian systems)
-# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
-#
 logtarget = /var/adm/fail2ban.log
 
 
@@ -105,7 +88,7 @@ ignoreregex = for myuser from
 logpath     = /var/adm/auth.log
 
 Set the sendmail dest address to something useful or drop the line to stop it spamming you.
-Set 'myuser' to your username to avoid banning yourself or drop it.
+Set 'myuser' to your username to avoid banning yourself or remove the line.
 
 START (OR RESTART) FAIL2BAN
 
@@ -128,7 +111,7 @@ GOTCHAS AND FIXMES
     svcadm enable fail2ban
 
 * If svcs -xv says that fail2ban failed to start or svcs says it's in maintenance mode
-  chcek /var/svc/log/network-fail2ban:default.log for clues. 
+  check /var/svc/log/network-fail2ban:default.log for clues. 
   Check permissions on /var/adm, /var/adm/auth.log /var/adm/fail2ban.log and /var/run/fail2ban
   You may need to:
 

From ab10664b57630fcf012ee5cf8cc1f00c2eadf7b4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 14 Jul 2013 16:20:21 +1000
Subject: [PATCH 400/544] ENH: action.d/hostsdeny to take daemon_list arguement
 as suggested in README.Solaris

---
 ChangeLog                      |  2 +-
 README.Solaris                 |  6 ++----
 config/action.d/hostsdeny.conf | 11 +++++++++--
 config/jail.conf               |  2 +-
 4 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 5b9ec79e..2fba9401 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,7 +29,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black
   * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
     all platforms to ensure permissions are the same before and after a ban -
-		closes gh-266
+		closes gh-266. hostsdeny supports daemon_list now too.
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/README.Solaris b/README.Solaris
index 10a5f88c..6a3335d7 100644
--- a/README.Solaris
+++ b/README.Solaris
@@ -99,7 +99,7 @@ REQ: Create /etc/fail2ban/jail.local containing:
 
 enabled     = true
 filter      = sshd
-action      = hostsdeny
+action      = hostsdeny[sshd]
               sendmail-whois[name=SSH, dest=you@example.com]
 ignoreregex = for myuser from
 logpath     = /var/adm/auth.log
@@ -136,6 +136,4 @@ GOTCHAS AND FIXMES
 
 * Fail2ban adds lines like these to /etc/hosts.deny:
 
-    ALL: 1.2.3.4
-
-  wouldn't it be better to just block sshd?
+    sshd: 1.2.3.4
diff --git a/config/action.d/hostsdeny.conf b/config/action.d/hostsdeny.conf
index 36e34948..d74f498d 100644
--- a/config/action.d/hostsdeny.conf
+++ b/config/action.d/hostsdeny.conf
@@ -1,6 +1,7 @@
 # Fail2Ban configuration file
 #
 # Author: Cyril Jaquier
+# Edited for cross platform by: James Stout, Yaroslav Halchenko and Daniel Black
 #
 #
 
@@ -31,7 +32,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = IP=<ip> &&
-            printf %%b "ALL: $IP\n" >> <file>
+            printf %%b "<daemon_list>: $IP\n" >> <file>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -39,7 +40,7 @@ actionban = IP=<ip> &&
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = echo "/ALL: <ip>$/<br>d<br>w<br>q" | ed <file>
+actionunban = echo "/^<daemon_list>: <ip>$/<br>d<br>w<br>q" | ed <file>
 
 [Init]
 
@@ -48,3 +49,9 @@ actionunban = echo "/ALL: <ip>$/<br>d<br>w<br>q" | ed <file>
 # Values:  STR  Default:  /etc/hosts.deny
 #
 file = /etc/hosts.deny
+
+# Option:  daemon_list
+# Notes:   The list of services that this action will deny. See the man page
+#          for hosts.deny/hosts_access. Default is all services.
+# Values:  STR  Default: ALL
+daemon_list = ALL
diff --git a/config/jail.conf b/config/jail.conf
index e3b92038..ccc1ae9a 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -103,7 +103,7 @@ logpath  = /root/path/to/assp/logs/maillog.txt
 
 enabled     = false
 filter      = sshd
-action      = hostsdeny
+action      = hostsdeny[daemon_list=sshd]
               sendmail-whois[name=SSH, dest=you@example.com]
 ignoreregex = for myuser from
 logpath     = /var/log/sshd.log

From 94376bfbe1a7a097876c21582558425db500bf93 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Jul 2013 11:15:45 +0100
Subject: [PATCH 401/544] TST: Handle lack of `json` library in python2.5 for
 samples test case

---
 fail2ban-testcases           | 16 +++++++++++++---
 testcases/samplestestcase.py |  8 +++++++-
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 278dd890..8ba697b3 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -27,17 +27,26 @@ __license__ = "GPL"
 
 import unittest, logging, sys, time, os
 
+if sys.version_info >= (2, 6):
+	import json
+else:
+	try:
+		import simplejson as json
+	except ImportError:
+		json = None
+
 from common.version import version
 from testcases import banmanagertestcase
 from testcases import clientreadertestcase
 from testcases import failmanagertestcase
 from testcases import filtertestcase
-from testcases import samplestestcase
 from testcases import servertestcase
 from testcases import datedetectortestcase
 from testcases import actiontestcase
 from testcases import sockettestcase
 from testcases import misctestcase
+if json:
+	from testcases import samplestestcase
 
 from testcases.utils import FormatterWithTraceBack
 from server.mytime import MyTime
@@ -171,8 +180,9 @@ tests.addTest(unittest.makeSuite(filtertestcase.JailTests))
 
 # DateDetector
 tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
-# Filter Regex tests with sample logs
-tests.addTest(unittest.makeSuite(samplestestcase.FilterSamplesRegex))
+if json:
+	# Filter Regex tests with sample logs
+	tests.addTest(unittest.makeSuite(samplestestcase.FilterSamplesRegex))
 
 #
 # Extensive use-tests of different available filters backends
diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index 2bb73ca1..656bbffa 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -22,7 +22,13 @@
 __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 
-import unittest, os, fileinput, re, json, datetime
+import unittest, sys, os, fileinput, re, datetime
+
+if sys.version_info >= (2, 6):
+	import json
+else:
+	import simplejson as json
+	next = lambda x: x.next()
 
 from server.filter import Filter
 from client.filterreader import FilterReader

From 6e4b1441644c2399a30c6cc311a52d79a5f22d83 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 14 Jul 2013 21:43:14 +1000
Subject: [PATCH 402/544] DOC: fix for README.Solaris. Thanks Steven.

---
 README.Solaris | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.Solaris b/README.Solaris
index 6a3335d7..5157c099 100644
--- a/README.Solaris
+++ b/README.Solaris
@@ -99,7 +99,7 @@ REQ: Create /etc/fail2ban/jail.local containing:
 
 enabled     = true
 filter      = sshd
-action      = hostsdeny[sshd]
+action      = hostsdeny[daemon_list=sshd]
               sendmail-whois[name=SSH, dest=you@example.com]
 ignoreregex = for myuser from
 logpath     = /var/adm/auth.log

From 1116f23151706c89e923d7e4db2b818591c27614 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 14 Jul 2013 18:19:16 +0100
Subject: [PATCH 403/544] TST: Sample log regex test now warns if no log for a
 filter

Also checks that at least some tests are present
---
 fail2ban-testcases           |  2 ++
 testcases/samplestestcase.py | 44 +++++++++++++++++++++++++++---------
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 8ba697b3..5aed6e43 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -183,6 +183,8 @@ tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
 if json:
 	# Filter Regex tests with sample logs
 	tests.addTest(unittest.makeSuite(samplestestcase.FilterSamplesRegex))
+else:
+	print "I: Skipping filter samples testing. No simplejson/json module"
 
 #
 # Extensive use-tests of different available filters backends
diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index 656bbffa..6b0e9ae0 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -22,7 +22,7 @@
 __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 
-import unittest, sys, os, fileinput, re, datetime
+import unittest, sys, os, fileinput, re, datetime, inspect
 
 if sys.version_info >= (2, 6):
 	import json
@@ -46,6 +46,14 @@ class FilterSamplesRegex(unittest.TestCase):
 	def tearDown(self):
 		"""Call after every test case."""
 
+	def testFiltersPresent(self):
+		"""Check to ensure some tests exist"""
+		self.assertTrue(
+			len([test for test in inspect.getmembers(self)
+				if test[0].startswith('testSampleRegexs')])
+			>= 10,
+			"Expected more FilterSampleRegexs tests")
+
 def testSampleRegexsFactory(name):
 	def testFilter(self):
 
@@ -58,8 +66,22 @@ def testSampleRegexsFactory(name):
 			if opt[2] == "addfailregex":
 				self.filter.addFailRegex(opt[3])
 
+		if not self.filter.getFailRegex():
+			# No fail regexs set: likely just common file for includes.
+			return
+
+		# TODO: Remove exception handling once sample logs obtained for all
+		try:
+			self.assertTrue(
+				os.path.isfile(os.path.join(TEST_FILES_DIR, "logs", name)),
+				"No sample log file available for '%s' filter" % name)
+		except AssertionError:
+			print "I: No sample log file available for '%s' filter" % name
+			return
+
 		logFile = fileinput.FileInput(
 			os.path.join(TEST_FILES_DIR, "logs", name))
+
 		for line in logFile:
 			jsonREMatch = re.match("^# ?failJSON:(.+)$", line)
 			if jsonREMatch:
@@ -78,13 +100,13 @@ def testSampleRegexsFactory(name):
 			if not ret:
 				# Check line is flagged as none match
 				self.assertFalse(faildata.get('match', True),
-					 "Line not matched when should have: %s:%i" %
-					(logFile.filename(), logFile.filelineno()))
+					 "Line not matched when should have: %s:%i %r" %
+					(logFile.filename(), logFile.filelineno(), line))
 			elif ret:
 				# Check line is flagged to match
 				self.assertTrue(faildata.get('match', False),
-					"Line matched when shouldn't have: %s:%i" %
-					(logFile.filename(), logFile.filelineno()))
+					"Line matched when shouldn't have: %s:%i %r" %
+					(logFile.filename(), logFile.filelineno(), line))
 				self.assertEqual(len(ret), 1)
 				# Verify timestamp and host as expected
 				host, time = ret[0]
@@ -96,9 +118,9 @@ def testSampleRegexsFactory(name):
 
 	return testFilter
 
-for filter_ in os.listdir(os.path.join(TEST_FILES_DIR, "logs")):
-	if os.path.isfile(os.path.join(TEST_FILES_DIR, "logs", filter_)):
-		setattr(
-			FilterSamplesRegex,
-			"testSampleRegexs%s" % filter_.upper(),
-			testSampleRegexsFactory(filter_))
+for filter_ in os.listdir(os.path.join(CONFIG_DIR, "filter.d")):
+	filterName = filter_.rpartition(".")[0]
+	setattr(
+		FilterSamplesRegex,
+		"testSampleRegexs%s" % filterName.upper(),
+		testSampleRegexsFactory(filterName))

From 2c8747cc76e88a58deb93d94fe39e51eaa9b8852 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Mon, 15 Jul 2013 18:40:32 +0100
Subject: [PATCH 404/544] BF: fail2ban-regex date detector template hits count
 now correct

closes #295
---
 fail2ban-regex | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index 78716a43..e75cb2a3 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -46,6 +46,7 @@ from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
 from server.filter import Filter
 from server.failregex import RegexException
+from server.datedetector import DateDetector
 
 from testcases.utils import FormatterWithTraceBack
 # Gets the instance of the logger.
@@ -172,6 +173,8 @@ class Fail2banRegex(object):
 		self._ignoreregex = list()
 		self._failregex = list()
 		self._line_stats = LineStats()
+		self._dateDetector = DateDetector()
+		self._dateDetector.addDefaultTemplate()
 
 
 	def readRegex(self, value, regextype):
@@ -256,6 +259,9 @@ class Fail2banRegex(object):
 			if line.startswith('# ') or not line.strip():
 				# skip comment and empty lines
 				continue
+
+			self._dateDetector.matchTime(line)
+
 			is_ignored = fail2banRegex.testIgnoreRegex(line)
 			if is_ignored:
 				self._line_stats.ignored_lines.append(line)
@@ -312,7 +318,7 @@ class Fail2banRegex(object):
 
 		print "\nDate template hits:"
 		out = []
-		for template in self._filter.dateDetector.getTemplates():
+		for template in self._dateDetector.getTemplates():
 			if self._verbose or template.getHits():
 				out.append("[%d] %s" % (template.getHits(), template.getName()))
 		pprint_list(out, "[# of hits] date format")

From 5bd186b85495319f717bfc94b8eb8888003bff43 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 15 Jul 2013 13:52:42 -0400
Subject: [PATCH 405/544] ENH(minor): fail2ban-regex comment line doesn't have
 to have a space after leading #

---
 fail2ban-regex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index e75cb2a3..3326e328 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -256,7 +256,7 @@ class Fail2banRegex(object):
 	def process(self, test_lines):
 
 		for line in test_lines:
-			if line.startswith('# ') or not line.strip():
+			if line.startswith('#') or not line.strip():
 				# skip comment and empty lines
 				continue
 

From 1a2b6442a069a0aa7f86ff21e4a9dee55b893c1b Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Mon, 15 Jul 2013 22:16:40 +0100
Subject: [PATCH 406/544] ENH+BF+TST: Filter now returns reference to failregex
 and ignoreregex

This avoids duplication of code across fail2ban-regex and samples test
cases. This also now more neatly resolves the issue of double counting
date templates matches in fail2ban-regex.
In addition, the samples test cases now also print a warning message
that not all regexs have samples for them, with future plan to change
this to an assertion.
---
 fail2ban-regex               | 85 +++++++++++++++---------------------
 server/datedetector.py       |  1 +
 server/datetemplate.py       |  5 ++-
 server/filter.py             | 42 ++++++++++--------
 testcases/samplestestcase.py | 21 +++++++--
 5 files changed, 79 insertions(+), 75 deletions(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index 3326e328..2c050e0d 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -46,7 +46,6 @@ from client.configparserinc import SafeConfigParserWithIncludes
 from ConfigParser import NoOptionError, NoSectionError, MissingSectionHeaderError
 from server.filter import Filter
 from server.failregex import RegexException
-from server.datedetector import DateDetector
 
 from testcases.utils import FormatterWithTraceBack
 # Gets the instance of the logger.
@@ -130,7 +129,7 @@ class RegexStat(object):
 		return self._failregex
 
 	def appendIP(self, value):
-		self._ipList.extend(value)
+		self._ipList.append(value)
 
 	def getIPList(self):
 		return self._ipList
@@ -173,8 +172,6 @@ class Fail2banRegex(object):
 		self._ignoreregex = list()
 		self._failregex = list()
 		self._line_stats = LineStats()
-		self._dateDetector = DateDetector()
-		self._dateDetector.addDefaultTemplate()
 
 
 	def readRegex(self, value, regextype):
@@ -204,53 +201,39 @@ class Fail2banRegex(object):
 			regex_values = [RegexStat(value)]
 
 		setattr(self, "_" + regex, regex_values)
+		for regex in regex_values:
+			getattr(
+				self._filter,
+				'add%sRegex' % regextype.title())(regex.getFailRegex())
 		return True
 
 	def testIgnoreRegex(self, line):
 		found = False
-		for regex in self._ignoreregex:
-			try:
-				self._filter.addIgnoreRegex(regex.getFailRegex())
-				try:
-					ret = self._filter.ignoreLine(line)
-					if ret:
-						found = True
-						regex.inc()
-				except RegexException, e:
-					print e
-					return False
-			finally:
-				self._filter.delIgnoreRegex(0)
+		try:
+			ret = self._filter.ignoreLine(line)
+			if ret is not None:
+				found = True
+				regex = self._ignoreregex[ret].inc()
+		except RegexException, e:
+			print e
+			return False
 		return found
 
 	def testRegex(self, line):
-		found = False
-		for regex in self._ignoreregex:
-			self._filter.addIgnoreRegex(regex.getFailRegex())
-		for regex in self._failregex:
-			try:
-				self._filter.addFailRegex(regex.getFailRegex())
-				try:
-					ret = self._filter.processLine(line)
-					if len(ret):
-						if found == True:
-							ret[0].append(True)
-						else:
-							found = True
-							ret[0].append(False)
-						regex.inc()
-						regex.appendIP(ret)
-				except RegexException, e:
-					print e
-					return False
-				except IndexError:
-					print "Sorry, but no <host> found in regex"
-					return False
-			finally:
-				self._filter.delFailRegex(0)
-		for regex in self._ignoreregex:
-			self._filter.delIgnoreRegex(0)
-		return found
+		try:
+			ret = self._filter.processLine(line, checkAllRegex=True)
+			for match in ret:
+				match.append(len(ret)>1)
+				regex = self._failregex[match[0]]
+				regex.inc()
+				regex.appendIP(match)
+		except RegexException, e:
+			print e
+			return False
+		except IndexError:
+			print "Sorry, but no <host> found in regex"
+			return False
+		return len(ret) > 0
 
 
 	def process(self, test_lines):
@@ -259,9 +242,6 @@ class Fail2banRegex(object):
 			if line.startswith('#') or not line.strip():
 				# skip comment and empty lines
 				continue
-
-			self._dateDetector.matchTime(line)
-
 			is_ignored = fail2banRegex.testIgnoreRegex(line)
 			if is_ignored:
 				self._line_stats.ignored_lines.append(line)
@@ -302,10 +282,13 @@ class Fail2banRegex(object):
 
 				if self._verbose and len(failregex.getIPList()):
 					for ip in failregex.getIPList():
-						timeTuple = time.localtime(ip[1])
+						timeTuple = time.localtime(ip[2])
 						timeString = time.strftime("%a %b %d %H:%M:%S %Y", timeTuple)
-						out.append("    %s  %s%s" % (
-							ip[0], timeString, ip[2] and " (already matched)" or ""))
+						out.append(
+							"    %s  %s%s" % (
+								ip[1],
+								timeString,
+								ip[3] and " (multiple regex matched)" or ""))
 
 			print "\n%s: %d total" % (title, total)
 			pprint_list(out, " #) [# of hits] regular expression")
@@ -318,7 +301,7 @@ class Fail2banRegex(object):
 
 		print "\nDate template hits:"
 		out = []
-		for template in self._dateDetector.getTemplates():
+		for template in self._filter.dateDetector.getTemplates():
 			if self._verbose or template.getHits():
 				out.append("[%d] %s" % (template.getHits(), template.getName()))
 		pprint_list(out, "[# of hits] date format")
diff --git a/server/datedetector.py b/server/datedetector.py
index 0c8b4df2..0ed9e00a 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -174,6 +174,7 @@ class DateDetector:
 				match = template.matchDate(line)
 				if not match is None:
 					logSys.debug("Matched time template %s" % template.getName())
+					template.incHits()
 					return match
 			return None
 		finally:
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 8c49aa15..86eeee8e 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -59,11 +59,12 @@ class DateTemplate:
 	
 	def getHits(self):
 		return self.__hits
+
+	def incHits(self):
+		self.__hits += 1
 	
 	def matchDate(self, line):
 		dateMatch = self.__cRegex.search(line)
-		if not dateMatch is None:
-			self.__hits += 1
 		return dateMatch
 	
 	def getDate(self, line):
diff --git a/server/filter.py b/server/filter.py
index d0390e62..ae12968e 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -284,7 +284,7 @@ class Filter(JailThread):
 		return False
 
 
-	def processLine(self, line, returnRawHost=False):
+	def processLine(self, line, returnRawHost=False, checkAllRegex=False):
 		"""Split the time portion from log msg and return findFailures on them
 		"""
 		try:
@@ -306,14 +306,15 @@ class Filter(JailThread):
 		else:
 			timeLine = l
 			logLine = l
-		return self.findFailure(timeLine, logLine, returnRawHost)
+		return self.findFailure(timeLine, logLine, returnRawHost, checkAllRegex)
 
 	def processLineAndAdd(self, line):
 		"""Processes the line for failures and populates failManager
 		"""
 		for element in self.processLine(line):
-			ip = element[0]
-			unixTime = element[1]
+			failregex = element[0]
+			ip = element[1]
+			unixTime = element[2]
 			logSys.debug("Processing line with time:%s and ip:%s"
 						 % (unixTime, ip))
 			if unixTime < MyTime.time() - self.getFindTime():
@@ -335,11 +336,11 @@ class Filter(JailThread):
 	# @return: a boolean
 
 	def ignoreLine(self, line):
-		for ignoreRegex in self.__ignoreRegex:
+		for ignoreRegexIndex, ignoreRegex in enumerate(self.__ignoreRegex):
 			ignoreRegex.search(line)
 			if ignoreRegex.hasMatched():
-				return True
-		return False
+				return ignoreRegexIndex
+		return None
 
 	##
 	# Finds the failure in a line given split into time and log parts.
@@ -348,18 +349,19 @@ class Filter(JailThread):
 	# to find the logging time.
 	# @return a dict with IP and timestamp.
 
-	def findFailure(self, timeLine, logLine, returnRawHost=False):
+	def findFailure(self, timeLine, logLine,
+			returnRawHost=False, checkAllRegex=False):
 		failList = list()
 		# Checks if we must ignore this line.
-		if self.ignoreLine(logLine):
+		if self.ignoreLine(logLine) is not None:
 			# The ignoreregex matched. Return.
 			return failList
+		date = self.dateDetector.getUnixTime(timeLine)
 		# Iterates over all the regular expressions.
-		for failRegex in self.__failRegex:
+		for failRegexIndex, failRegex in enumerate(self.__failRegex):
 			failRegex.search(logLine)
 			if failRegex.hasMatched():
 				# The failregex matched.
-				date = self.dateDetector.getUnixTime(timeLine)
 				logSys.log(7, "Date: %r, message: %r",
 							  timeLine, logLine)
 				if date is None:
@@ -372,14 +374,16 @@ class Filter(JailThread):
 					try:
 						host = failRegex.getHost()
 						if returnRawHost:
-							failList.append([host, date])
-							break
-						ipMatch = DNSUtils.textToIp(host, self.__useDns)
-						if ipMatch:
-							for ip in ipMatch:
-								failList.append([ip, date])
-							# We matched a regex, it is enough to stop.
-							break
+							failList.append([failRegexIndex, host, date])
+							if not checkAllRegex:
+								break
+						else:
+							ipMatch = DNSUtils.textToIp(host, self.__useDns)
+							if ipMatch:
+								for ip in ipMatch:
+									failList.append([failRegexIndex, ip, date])
+								if not checkAllRegex:
+									break
 					except RegexException, e: # pragma: no cover - unsure if reachable
 						logSys.error(e)
 		return failList
diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index 6b0e9ae0..a52873b9 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -82,6 +82,7 @@ def testSampleRegexsFactory(name):
 		logFile = fileinput.FileInput(
 			os.path.join(TEST_FILES_DIR, "logs", name))
 
+		regexsUsed = set()
 		for line in logFile:
 			jsonREMatch = re.match("^# ?failJSON:(.+)$", line)
 			if jsonREMatch:
@@ -96,7 +97,8 @@ def testSampleRegexsFactory(name):
 			else:
 				faildata = {}
 
-			ret = self.filter.processLine(line, returnRawHost=True)
+			ret = self.filter.processLine(
+				line, returnRawHost=True, checkAllRegex=True)
 			if not ret:
 				# Check line is flagged as none match
 				self.assertFalse(faildata.get('match', True),
@@ -107,15 +109,28 @@ def testSampleRegexsFactory(name):
 				self.assertTrue(faildata.get('match', False),
 					"Line matched when shouldn't have: %s:%i %r" %
 					(logFile.filename(), logFile.filelineno(), line))
-				self.assertEqual(len(ret), 1)
+				self.assertEqual(len(ret), 1, "Multiple regexs matched")
 				# Verify timestamp and host as expected
-				host, time = ret[0]
+				failregex, host, time = ret[0]
 				self.assertEqual(host, faildata.get("host", None))
 				self.assertEqual(
 					datetime.datetime.fromtimestamp(time),
 					datetime.datetime.strptime(
 						faildata.get("time", None), "%Y-%m-%dT%H:%M:%S"))
 
+				regexsUsed.add(failregex)
+
+		# TODO: Remove exception handling once all regexs have samples
+		for failRegexIndex, failRegex in enumerate(self.filter.getFailRegex()):
+			try:
+				self.assertTrue(
+					failRegexIndex in regexsUsed,
+					"Regex for filter '%s' has no samples: %i: %r" %
+						(name, failRegexIndex, failRegex))
+			except AssertionError:
+				print "I: Regex for filter '%s' has no samples: %i: %r" % (
+					name, failRegexIndex, failRegex)
+
 	return testFilter
 
 for filter_ in os.listdir(os.path.join(CONFIG_DIR, "filter.d")):

From 148cbd8d2a2d3cab6815fc100a4e635c0e6a10ed Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 9 Jul 2013 12:47:41 -0400
Subject: [PATCH 407/544] ENH: heavier debugging -- log split date/log line
 even for no match.  Log matching regex upon match

---
 server/failregex.py | 3 ++-
 server/filter.py    | 7 ++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/server/failregex.py b/server/failregex.py
index 957c77db..d302370b 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -50,7 +50,8 @@ class Regex:
 		except sre_constants.error:
 			raise RegexException("Unable to compile regular expression '%s'" %
 								 regex)
-	
+	def __str__(self):
+		return "%s(%r)" % (self.__class__.__name__, self._regex)
 	##
 	# Gets the regular expression.
 	#
diff --git a/server/filter.py b/server/filter.py
index d0390e62..54efb619 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -294,7 +294,7 @@ class Filter(JailThread):
 			l = line
 		l = l.rstrip('\r\n')
 
-		logSys.log(5, "Working on line %r", l)
+		logSys.log(7, "Working on line %r", l)
 		timeMatch = self.dateDetector.matchTime(l)
 		if timeMatch:
 			# Lets split into time part and log part of the line
@@ -349,19 +349,20 @@ class Filter(JailThread):
 	# @return a dict with IP and timestamp.
 
 	def findFailure(self, timeLine, logLine, returnRawHost=False):
+		logSys.log(5, "Date: %r, message: %r", timeLine, logLine)
 		failList = list()
 		# Checks if we must ignore this line.
 		if self.ignoreLine(logLine):
 			# The ignoreregex matched. Return.
+			logSys.log(7, "Matched ignoreregex and was ignored")
 			return failList
 		# Iterates over all the regular expressions.
 		for failRegex in self.__failRegex:
 			failRegex.search(logLine)
 			if failRegex.hasMatched():
 				# The failregex matched.
+				logSys.log(7, "Matched %s", failRegex)
 				date = self.dateDetector.getUnixTime(timeLine)
-				logSys.log(7, "Date: %r, message: %r",
-							  timeLine, logLine)
 				if date is None:
 					logSys.debug("Found a match for %r but no valid date/time "
 								 "found for %r. Please file a detailed issue on"

From 8add63c733f997feb0a3dd321cdf205ce22c3f04 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 9 Jul 2013 12:48:12 -0400
Subject: [PATCH 408/544] ENH: anchor roundcube-auth at the beginning as well

---
 config/filter.d/roundcube-auth.conf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf
index 7b153f44..77d872fb 100644
--- a/config/filter.d/roundcube-auth.conf
+++ b/config/filter.d/roundcube-auth.conf
@@ -4,6 +4,10 @@
 #
 #
 
+[INCLUDES]
+
+before = common.conf
+
 [Definition]
 
 # Option:  failregex
@@ -13,7 +17,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = (FAILED login|Login failed) for .* from <HOST>\s*$
+failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .* from <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 0a02cfe9e8e65e68ec438bcd1c10fb7493f3e842 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 16 Jul 2013 14:39:42 -0400
Subject: [PATCH 409/544] ENH: <HOST> must end with alphanumeric \w (not a dot
 or a dash etc)

Otherwise <HOST> regexp might swallow period in the sentence right after the address.
I have decided to enforce alphanumeric instead of switching to non-greedy +? ... because
I think it is closer to what we actually want here
---
 server/failregex.py         | 2 +-
 testcases/servertestcase.py | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/server/failregex.py b/server/failregex.py
index d302370b..bfa50575 100644
--- a/server/failregex.py
+++ b/server/failregex.py
@@ -41,7 +41,7 @@ class Regex:
 		self._matchCache = None
 		# Perform shortcuts expansions.
 		# Replace "<HOST>" with default regular expression for host.
-		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_]+)")
+		regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_]*\w)")
 		if regex.lstrip() == '':
 			raise RegexException("Cannot add empty regex")
 		try:
diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 0a5593e3..07cc373c 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -334,9 +334,9 @@ class Transmitter(TransmitterBase):
 				"failed attempt from <HOST> again",
 			],
 			[
-				"user john at (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)",
-				"Admin user login from (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)",
-				"failed attempt from (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) again",
+				"user john at (?:::f{4,6}:)?(?P<host>[\w\-.^_]*\\w)",
+				"Admin user login from (?:::f{4,6}:)?(?P<host>[\w\-.^_]*\\w)",
+				"failed attempt from (?:::f{4,6}:)?(?P<host>[\w\-.^_]*\\w) again",
 			],
 			self.jailName
 		)
@@ -359,7 +359,7 @@ class Transmitter(TransmitterBase):
 			],
 			[
 				"user john",
-				"Admin user login from (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)",
+				"Admin user login from (?:::f{4,6}:)?(?P<host>[\w\-.^_]*\\w)",
 				"Dont match me!",
 			],
 			self.jailName

From f6a8a04cf34b11e317ac8b90970f9ae6518980e9 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 16 Jul 2013 14:45:59 -0400
Subject: [PATCH 410/544] ENH: roundcube-auth - adopt for current format with
 trailing error message.  thanks @kwirk for the review/feedback

I also used non-greedy .*? for the login portion since not sure if space could
be there and trying to minimize possibility of reacting on injected "from
<HOST>" somewhere within the trailing .*
---
 config/filter.d/roundcube-auth.conf | 2 +-
 testcases/files/logs/roundcube-auth | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf
index 77d872fb..fe669f66 100644
--- a/config/filter.d/roundcube-auth.conf
+++ b/config/filter.d/roundcube-auth.conf
@@ -17,7 +17,7 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .* from <HOST>\s*$
+failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. AUTHENTICATE .*)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth
index dec8051e..7c16efbd 100644
--- a/testcases/files/logs/roundcube-auth
+++ b/testcases/files/logs/roundcube-auth
@@ -2,3 +2,5 @@
 [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10
 # failJSON: { "time": "2005-05-26T07:12:40", "match": true , "host": "10.1.1.47" }
 May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47
+# failJSON: { "time": "2005-07-11T03:06:37", "match": true , "host": "1.2.3.4" }
+Jul 11 03:06:37 myhostname roundcube: IMAP Error: Login failed for admin from 1.2.3.4. AUTHENTICATE PLAIN: A0002 NO Login failed. in /usr/share/roundcube/program/include/rcube_imap.php on line 205 (POST /wmail/?_task=login&_action=login)

From 90ec82669c696894dfeb0d1c71dc01f415be15e7 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Tue, 16 Jul 2013 15:10:41 -0400
Subject: [PATCH 411/544] DOC: changelog entries for preceeding changes

---
 ChangeLog | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 16c93db1..a6a6ab23 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,7 +29,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black
   * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
     all platforms to ensure permissions are the same before and after a ban -
-		closes gh-266
+    closes gh-266
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
@@ -51,6 +51,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
    * fail2ban-client -- log to standard error. Closes gh-264
    * Fail to configure if not a single log file was found for an
      enabled jail. Closes gh-63
+   * <HOST> is now enforced to end with an alphanumeric
+   * filter.d/roundcube-auth.conf -- anchored version
   Alexander Dietrich
    * action.d/sendmail-common.conf -- added common sendmail settings file
      and made the sender display name configurable

From c2bdfefb626899c7c249dfc37e93c994377b568f Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Tue, 16 Jul 2013 20:58:44 +0100
Subject: [PATCH 412/544] DOC: Comment to fail2ban-regex - flagging lines
 matched multiple regexs

---
 fail2ban-regex | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fail2ban-regex b/fail2ban-regex
index 2c050e0d..e19b1bc9 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -223,6 +223,8 @@ class Fail2banRegex(object):
 		try:
 			ret = self._filter.processLine(line, checkAllRegex=True)
 			for match in ret:
+				# Append True/False flag depending if line was matched by
+				# more than one regex
 				match.append(len(ret)>1)
 				regex = self._failregex[match[0]]
 				regex.inc()

From ba29f6bef3cb1757155e7a2bae475eac6afb3aa0 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Tue, 16 Jul 2013 21:11:10 +0100
Subject: [PATCH 413/544] DOC: Update doc in reference to changes for sample
 testcases

---
 DEVELOP | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/DEVELOP b/DEVELOP
index 2d7a043b..b0f7b47e 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -39,8 +39,9 @@ Filters
 
 * Include sample logs with 1.2.3.4 used for IP addresses and 
   example.com/example.org used for DNS names
-* Ensure ./fail2ban-regex testcases/files/logs/{samplelog} config/filter.d/{filter}.conf
-  has matches for EVERY regex
+* Ensure sample log is provided in testcases/files/logs/ with same name as the
+  filter. Each log line should include match meta data for time & IP above
+  every line (see other sample log files for examples)
 * Ensure regexs start with a ^ and are restrictive as possible. E.g. not .* if
   \d+ is sufficient
 * Use the functionality of regexs http://docs.python.org/2/library/re.html

From 40cc336cd565c2140f4680c2c4e6c9d1064f57a7 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 17 Jul 2013 22:46:04 +1000
Subject: [PATCH 414/544] TST: testcases and logs for apache-auth basic

---
 testcases/files/config/apache-auth/README         | 13 +++++++++++++
 .../files/config/apache-auth/basic/file/.htaccess |  5 +++++
 .../files/config/apache-auth/basic/file/.htpasswd |  1 +
 testcases/files/logs/apache-auth                  | 15 +++++++++++++++
 4 files changed, 34 insertions(+)
 create mode 100644 testcases/files/config/apache-auth/README
 create mode 100644 testcases/files/config/apache-auth/basic/file/.htaccess
 create mode 100644 testcases/files/config/apache-auth/basic/file/.htpasswd

diff --git a/testcases/files/config/apache-auth/README b/testcases/files/config/apache-auth/README
new file mode 100644
index 00000000..b25a30b2
--- /dev/null
+++ b/testcases/files/config/apache-auth/README
@@ -0,0 +1,13 @@
+
+Apache Auth.
+
+This directory contains the configuration file of Apache's Web Server to
+simulate authentication files.
+
+These assumed that /var/www/html is the web root and AllowOverides is "All".
+
+The subdirectories here are copied to the /var/www/html directory.
+
+Commands executed are in testcases/files/log/apache-auth with their
+corresponding failure mechanism.
+
diff --git a/testcases/files/config/apache-auth/basic/file/.htaccess b/testcases/files/config/apache-auth/basic/file/.htaccess
new file mode 100644
index 00000000..e36e884b
--- /dev/null
+++ b/testcases/files/config/apache-auth/basic/file/.htaccess
@@ -0,0 +1,5 @@
+AuthType basic
+AuthName "private area"
+AuthBasicProvider file
+AuthUserFile /var/www/html/basic/file/.htpasswd
+Require valid-user
diff --git a/testcases/files/config/apache-auth/basic/file/.htpasswd b/testcases/files/config/apache-auth/basic/file/.htpasswd
new file mode 100644
index 00000000..fcc6ec72
--- /dev/null
+++ b/testcases/files/config/apache-auth/basic/file/.htpasswd
@@ -0,0 +1 @@
+username:$apr1$uUMsOjCQ$.BzXClI/B/vZKddgIAJCR.
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index e673e86d..37fff9eb 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -5,3 +5,18 @@
 # from https://github.com/fail2ban/fail2ban/issues/286
 [Thu Jul 11 01:21:41 2013] [error] [client 194.228.20.113] user  not found: /
 [Thu Jul 11 01:21:43 2013] [error] [client 194.228.20.113] user dsfasdf not found: /
+
+# The failures below use the configuration described in testcases/conf/apache-auth
+#
+# wget --http-user=username --http-password=wrongpass http://localhost/basic/file -O /dev/null
+# failJSON: { "time": "2013-07-17T22:18:52", "match": true , "host": "127.0.0.1" }
+[Wed Jul 17 22:18:52 2013] [error] [client 127.0.0.1] user username: authentication failure for "/basic/file": Password Mismatch
+
+# wget --http-user=wrongusername --http-password=wrongpass http://localhost/basic/file -O /dev/null
+# failJSON: { "time": "2013-07-17T22:32:48", "match": true , "host": "127.0.0.1" }
+[Wed Jul 17 22:32:48 2013] [error] [client 127.0.0.1] user wrongusername not found: /basic/file
+
+# wget --header='Authorization: Digest username="Mufasa",realm="testrealm@host.com",nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",uri="/dir/index.html",qop=auth,nc=00000001,cnonce="0a4f113b",response="6629fae49393a05397450978507c4ef1",opaque="5ccc069c403ebaf9f0171e9517f40e41"'  http://localhost/basic/file -O /dev/null
+# failJSON: { "time": "2013-07-17T22:39:55", "match": true , "host": "127.0.0.1" }
+[Wed Jul 17 22:39:55 2013] [error] [client 127.0.0.1] client used wrong authentication scheme: /basic/file
+

From e0292913eb69203033397600c09f5ce7f124a756 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 17 Jul 2013 23:05:04 +1000
Subject: [PATCH 415/544] ENH/TST: filter, testcase and log entry for
 apache-auth authorization scheme mod_authz_owner

---
 config/filter.d/apache-auth.conf                             | 1 +
 .../files/config/apache-auth/basic/authz_owner/.htaccess     | 5 +++++
 .../files/config/apache-auth/basic/authz_owner/.htpasswd     | 1 +
 .../config/apache-auth/basic/authz_owner/cant_get_me.html    | 0
 testcases/files/logs/apache-auth                             | 3 +++
 5 files changed, 10 insertions(+)
 create mode 100644 testcases/files/config/apache-auth/basic/authz_owner/.htaccess
 create mode 100644 testcases/files/config/apache-auth/basic/authz_owner/.htpasswd
 create mode 100644 testcases/files/config/apache-auth/basic/authz_owner/cant_get_me.html

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 366e25ab..34089abb 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -29,6 +29,7 @@ before = apache-common.conf
 failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
             ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
+            ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: file owner \S+ does not match.\s*$
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
             ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
             ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
diff --git a/testcases/files/config/apache-auth/basic/authz_owner/.htaccess b/testcases/files/config/apache-auth/basic/authz_owner/.htaccess
new file mode 100644
index 00000000..583e5422
--- /dev/null
+++ b/testcases/files/config/apache-auth/basic/authz_owner/.htaccess
@@ -0,0 +1,5 @@
+AuthType basic
+AuthName "private area"
+AuthBasicProvider file
+AuthUserFile /var/www/html/basic/authz_owner/.htpasswd
+Require file-owner
diff --git a/testcases/files/config/apache-auth/basic/authz_owner/.htpasswd b/testcases/files/config/apache-auth/basic/authz_owner/.htpasswd
new file mode 100644
index 00000000..d9de6185
--- /dev/null
+++ b/testcases/files/config/apache-auth/basic/authz_owner/.htpasswd
@@ -0,0 +1 @@
+username:$apr1$1f5oQUl4$21lLXSN7xQOPtNsj5s4Nk/
diff --git a/testcases/files/config/apache-auth/basic/authz_owner/cant_get_me.html b/testcases/files/config/apache-auth/basic/authz_owner/cant_get_me.html
new file mode 100644
index 00000000..e69de29b
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index 37fff9eb..2c1b6a73 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -20,3 +20,6 @@
 # failJSON: { "time": "2013-07-17T22:39:55", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:39:55 2013] [error] [client 127.0.0.1] client used wrong authentication scheme: /basic/file
 
+# wget --http-user=username --http-password=password http://localhost/basic/authz_owner/cant_get_me.html -O /dev/null
+# failJSON: { "time": "2013-07-17T22:54:32", "match": true , "host": "127.0.0.1" }
+[Wed Jul 17 22:54:32 2013] [error] [client 127.0.0.1] Authorization of user username to access /basic/authz_owner/cant_get_me.html failed, reason: file owner dan does not match.

From 4eca2c0bd5d76156266ceb250abd545863c88490 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 17 Jul 2013 23:24:19 +1000
Subject: [PATCH 416/544] TST: apache-auth client denied by server
 configuration

---
 config/filter.d/apache-auth.conf                     |  5 +++--
 testcases/files/config/apache-auth/noentry/.htaccess |  1 +
 testcases/files/logs/apache-auth                     | 10 ++++++++++
 3 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 testcases/files/config/apache-auth/noentry/.htaccess

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 34089abb..47373573 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -26,12 +26,13 @@ before = apache-common.conf
 # all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
 # to return the actual failure.
 
-failregex = ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
+failregex = ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
+            ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
             ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
             ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: file owner \S+ does not match.\s*$
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
-            ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
+            
             ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
             ^%(_apache_error_client)s user .* authorization failure for "\S*": \s*$
             ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
diff --git a/testcases/files/config/apache-auth/noentry/.htaccess b/testcases/files/config/apache-auth/noentry/.htaccess
new file mode 100644
index 00000000..3a428827
--- /dev/null
+++ b/testcases/files/config/apache-auth/noentry/.htaccess
@@ -0,0 +1 @@
+Deny from all
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index 2c1b6a73..b84631f7 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -8,6 +8,15 @@
 
 # The failures below use the configuration described in testcases/conf/apache-auth
 #
+
+# wget  http://localhost/noentry/cant_get_me.html -O /dev/null
+# failJSON: { "time": "2013-07-17T23:20:45", "match": true , "host": "127.0.0.1" } 
+[Wed Jul 17 23:20:45 2013] [error] [client 127.0.0.1] client denied by server configuration: /var/www/html/noentry/cant_get_me.html
+
+# wget --http-user='' --http-password='' http://localhost/basic/file/cant_get_me.html -O /dev/null
+# failJSON: { "time": "2013-07-17T23:14:37", "match": true , "host": "127.0.0.1" }
+[Wed Jul 17 23:14:37 2013] [error] [client 127.0.0.1] user  not found: /basic/anon/cant_get_me.html
+
 # wget --http-user=username --http-password=wrongpass http://localhost/basic/file -O /dev/null
 # failJSON: { "time": "2013-07-17T22:18:52", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:18:52 2013] [error] [client 127.0.0.1] user username: authentication failure for "/basic/file": Password Mismatch
@@ -23,3 +32,4 @@
 # wget --http-user=username --http-password=password http://localhost/basic/authz_owner/cant_get_me.html -O /dev/null
 # failJSON: { "time": "2013-07-17T22:54:32", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:54:32 2013] [error] [client 127.0.0.1] Authorization of user username to access /basic/authz_owner/cant_get_me.html failed, reason: file owner dan does not match.
+

From f8b5b3a1ef831df9a5a539dbf304f8c5b07292ee Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 17 Jul 2013 23:31:44 +1000
Subject: [PATCH 417/544] ENH: apache-auth - quite a lot of authorization
 failure messages depending on module. Make a wildcard

---
 config/filter.d/apache-auth.conf | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 47373573..2cc746f0 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -30,9 +30,8 @@ failregex = ^%(_apache_error_client)s client denied by server configuration: (ur
             ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
             ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
-            ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: file owner \S+ does not match.\s*$
+            ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: .*$
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
-            
             ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
             ^%(_apache_error_client)s user .* authorization failure for "\S*": \s*$
             ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$

From 8ce9c78474afb94f14c05bf0a5d7d68669f819f4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Jul 2013 00:36:17 +1000
Subject: [PATCH 418/544] TST: apache-auth digest logs

---
 config/filter.d/apache-auth.conf                         | 8 +++++---
 testcases/files/config/apache-auth/digest/.htaccess      | 6 ++++++
 testcases/files/config/apache-auth/digest/.htpasswd      | 1 +
 testcases/files/config/apache-auth/digest_anon/.htaccess | 9 +++++++++
 testcases/files/config/apache-auth/digest_anon/.htpasswd | 3 +++
 .../files/config/apache-auth/digest_wrongrelm/.htaccess  | 6 ++++++
 .../files/config/apache-auth/digest_wrongrelm/.htpasswd  | 2 ++
 testcases/files/logs/apache-auth                         | 7 +++++++
 8 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100644 testcases/files/config/apache-auth/digest/.htaccess
 create mode 100644 testcases/files/config/apache-auth/digest/.htpasswd
 create mode 100644 testcases/files/config/apache-auth/digest_anon/.htaccess
 create mode 100644 testcases/files/config/apache-auth/digest_anon/.htpasswd
 create mode 100644 testcases/files/config/apache-auth/digest_wrongrelm/.htaccess
 create mode 100644 testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 2cc746f0..083cfbc8 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -25,13 +25,17 @@ before = apache-common.conf
 # for ap_log_rerror(APLOG_MARK, APLOG_ERR and examining resulting return code should get
 # all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
 # to return the actual failure.
-
+#
+# See also: http://wiki.apache.org/httpd/ListOfErrors
+#
 failregex = ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
             ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
             ^%(_apache_error_client)s user .* not found: \S*\s*$
             ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
             ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: .*$
             ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
+            ^%(_apache_error_client)s (Digest: )?user .*: password mismatch: \S*\s*$
+            ^%(_apache_error_client)s (Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
             ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
             ^%(_apache_error_client)s user .* authorization failure for "\S*": \s*$
             ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
@@ -40,8 +44,6 @@ failregex = ^%(_apache_error_client)s client denied by server configuration: (ur
             ^%(_apache_error_client)s user .*: one-time-nonce mismatch - sending new nonce\s*$
             ^%(_apache_error_client)s realm mismatch - got `.*' but expected `.+'\s*$
             ^%(_apache_error_client)s unknown algorithm `\S+' received: \S*\s*"$
-            ^%(_apache_error_client)s user `.*' in realm `.+' (not found|denied by provider): \S*\s*"$
-            ^%(_apache_error_client)s user .* password mismatch: \S*\s*"$
             ^%(_apache_error_client)s invalid qop `.*' received: \S*\s*"$
 
 
diff --git a/testcases/files/config/apache-auth/digest/.htaccess b/testcases/files/config/apache-auth/digest/.htaccess
new file mode 100644
index 00000000..c4d0d003
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest/.htaccess
@@ -0,0 +1,6 @@
+AuthType Digest
+AuthName "digest private area"
+AuthDigestDomain /digest/
+AuthBasicProvider file
+AuthUserFile /var/www/html/digest/.htpasswd
+Require valid-user
diff --git a/testcases/files/config/apache-auth/digest/.htpasswd b/testcases/files/config/apache-auth/digest/.htpasswd
new file mode 100644
index 00000000..cc649515
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest/.htpasswd
@@ -0,0 +1 @@
+username:digest private area:fad48d3a7c63f61b5b3567a4105bbb04
diff --git a/testcases/files/config/apache-auth/digest_anon/.htaccess b/testcases/files/config/apache-auth/digest_anon/.htaccess
new file mode 100644
index 00000000..c8e8648e
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest_anon/.htaccess
@@ -0,0 +1,9 @@
+AuthType Digest
+AuthName "digest anon"
+AuthDigestDomain /digest_anon/
+AuthBasicProvider file anon
+AuthUserFile /var/www/html/digest_anon/.htpasswd
+Anonymous_NoUserID off
+Anonymous anonymous
+Anonymous_LogEmail on
+Require valid-user
diff --git a/testcases/files/config/apache-auth/digest_anon/.htpasswd b/testcases/files/config/apache-auth/digest_anon/.htpasswd
new file mode 100644
index 00000000..47a6af58
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest_anon/.htpasswd
@@ -0,0 +1,3 @@
+username:digest anon:25e4077a9344ceb1a88f2a62c9fb60d8
+05bbb04
+anonymous:digest anon:faa4e5870970cf935bb9674776e6b26a
diff --git a/testcases/files/config/apache-auth/digest_wrongrelm/.htaccess b/testcases/files/config/apache-auth/digest_wrongrelm/.htaccess
new file mode 100644
index 00000000..5e7946d2
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest_wrongrelm/.htaccess
@@ -0,0 +1,6 @@
+AuthType Digest
+AuthName "digest private area"
+AuthDigestDomain /digest_wrongrelm/
+AuthBasicProvider file
+AuthUserFile /var/www/html/digest_wrongrelm/.htpasswd
+Require valid-user
diff --git a/testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd b/testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd
new file mode 100644
index 00000000..019e005d
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest_wrongrelm/.htpasswd
@@ -0,0 +1,2 @@
+username:wrongrelm:99cd340e1283c6d0ab34734bd47bdc30
+4105bbb04
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index b84631f7..3470f589 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -33,3 +33,10 @@
 # failJSON: { "time": "2013-07-17T22:54:32", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:54:32 2013] [error] [client 127.0.0.1] Authorization of user username to access /basic/authz_owner/cant_get_me.html failed, reason: file owner dan does not match.
 
+# wget --http-user='username' --http-password='wrongpassword' http://localhost/digest/cant_get_me.html -O /dev/null
+# failJSON: { "time": "2013-07-17T23:50:37", "match": true , "host": "127.0.0.1" }
+[Wed Jul 17 23:50:37 2013] [error] [client 127.0.0.1] Digest: user username: password mismatch: /digest/cant_get_me.html
+
+# wget --http-user='username' --http-password='password' http://localhost/digest_wrongrelm/cant_get_me.html -O /dev/null
+# failJSON: { "time": "2013-07-18T00:08:39", "match": true , "host": "127.0.0.1" }
+[Thu Jul 18 00:08:39 2013] [error] [client 127.0.0.1] Digest: user `username' in realm `digest private area' not found: /digest_wrongrelm/cant_get_me.html

From 03ec7c211b32b07053246689cf3420049cd88121 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Jul 2013 00:37:33 +1000
Subject: [PATCH 419/544] ENH: could not find a way to trigger filter
 ^%(_apache_error_client)s authorization failure \(no authenticated user\):
 \S*\s*$

---
 config/filter.d/apache-auth.conf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 083cfbc8..fa453309 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -33,7 +33,6 @@ failregex = ^%(_apache_error_client)s client denied by server configuration: (ur
             ^%(_apache_error_client)s user .* not found: \S*\s*$
             ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
             ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: .*$
-            ^%(_apache_error_client)s authorization failure \(no authenticated user\): \S*\s*$
             ^%(_apache_error_client)s (Digest: )?user .*: password mismatch: \S*\s*$
             ^%(_apache_error_client)s (Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
             ^%(_apache_error_client)s user .* authorization failure: \S*\s*$

From fa85be2eea526e6f119723a8e696283c8934ab63 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 18 Jul 2013 08:37:05 +1000
Subject: [PATCH 420/544] DOC/TST: fix configuration path for apache-auth test
 cases

---
 testcases/files/logs/apache-auth | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index 3470f589..e007b918 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -6,7 +6,7 @@
 [Thu Jul 11 01:21:41 2013] [error] [client 194.228.20.113] user  not found: /
 [Thu Jul 11 01:21:43 2013] [error] [client 194.228.20.113] user dsfasdf not found: /
 
-# The failures below use the configuration described in testcases/conf/apache-auth
+# The failures below use the configuration described in testcases/files/config/apache-auth
 #
 
 # wget  http://localhost/noentry/cant_get_me.html -O /dev/null

From 60aa44f42d34c050a20228462bf6bf380752b057 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 18 Jul 2013 14:43:41 -0400
Subject: [PATCH 421/544] DOC: added a note on commit comments for merges with
 Conflicts

---
 DEVELOP | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/DEVELOP b/DEVELOP
index b0f7b47e..61248393 100644
--- a/DEVELOP
+++ b/DEVELOP
@@ -253,6 +253,10 @@ Use the text "closes #333"/"resolves #333 "/"fixes #333" where 333 represents
 an issue that is closed. Other text and details in link below.
 See: https://help.github.com/articles/closing-issues-via-commit-messages
 
+If merge resulted in conflicts, clarify what changes were done to
+corresponding files in the 'Conflicts:' section of the merge commit
+message.  See e.g. https://github.com/fail2ban/fail2ban/commit/f5a8a8ac
+
 Adding Actions
 --------------
 

From 2a3a6273223aa98c12d2071adb385ff073252da9 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Thu, 18 Jul 2013 22:17:14 +0100
Subject: [PATCH 422/544] TST: Add sample for sieve regex

---
 testcases/files/logs/sieve | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 testcases/files/logs/sieve

diff --git a/testcases/files/logs/sieve b/testcases/files/logs/sieve
new file mode 100644
index 00000000..5cc19673
--- /dev/null
+++ b/testcases/files/logs/sieve
@@ -0,0 +1,2 @@
+# failJSON: { "time": "2004-12-01T20:36:56", "match": true , "host": "1.2.3.4" }
+Dec 1 20:36:56 mail sieve[23713]: badlogin: example.com[1.2.3.4] PLAIN authentication failure

From a012b5411715f3a478cd7b19acd70e652044d625 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Thu, 18 Jul 2013 22:17:31 +0100
Subject: [PATCH 423/544] TST: Add additional postfix filter sample

---
 testcases/files/logs/postfix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testcases/files/logs/postfix b/testcases/files/logs/postfix
index 50e3a360..e4d07b58 100644
--- a/testcases/files/logs/postfix
+++ b/testcases/files/logs/postfix
@@ -2,3 +2,5 @@
 # and https://github.com/fail2ban/fail2ban/issues/126
 # failJSON: { "time": "2005-02-21T09:21:54", "match": true , "host": "192.0.43.10" }
 Feb 21 09:21:54 xxx postfix/smtpd[14398]: NOQUEUE: reject: RCPT from example.com[192.0.43.10]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=
+# failJSON: { "time": "2005-07-12T07:47:48", "match": true , "host": "1.2.3.4" }
+Jul 12 07:47:48 saturn postfix/smtpd[8738]: NOQUEUE: reject: RCPT from 1-2-3-4-example.com[1.2.3.4]: 554 5.7.1 <smtp@example.com>: Relay access denied; from=<john@example.com> to=<smtp@example.org> proto=SMTP helo=<198.51.100.17>

From fcf79b475f26884a584617f3fd5ff66afa6df371 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 19 Jul 2013 20:14:53 +1000
Subject: [PATCH 424/544] ENH: new filter perdition.conf

---
 ChangeLog                      |  2 ++
 THANKS                         |  1 +
 config/filter.d/perdition.conf | 16 ++++++++++++++++
 testcases/files/logs/perdition |  4 ++++
 4 files changed, 23 insertions(+)
 create mode 100644 config/filter.d/perdition.conf
 create mode 100644 testcases/files/logs/perdition

diff --git a/ChangeLog b/ChangeLog
index a6a6ab23..4139dfe1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -36,6 +36,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black
    * filter.d/exim-spam.conf -- a splitout of exim's spam regexes
      with additions for greater control over filtering spam.
+  Christophe Carles & Daniel Black
+   * filter.d/perdition.conf -- filter added
 - Enhancements:
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
diff --git a/THANKS b/THANKS
index af790f67..b853c0dc 100644
--- a/THANKS
+++ b/THANKS
@@ -11,6 +11,7 @@ Axel Thimm
 Bill Heaton
 Carlos Alberto Lopez Perez
 Christian Rauch
+Christophe Carles
 Christoph Haas
 Christos Psonis
 Daniel B. Cid
diff --git a/config/filter.d/perdition.conf b/config/filter.d/perdition.conf
new file mode 100644
index 00000000..e7cb0f7d
--- /dev/null
+++ b/config/filter.d/perdition.conf
@@ -0,0 +1,16 @@
+# Fail2Ban configuration file
+#
+# Author: Christophe Carles and Daniel Black
+#
+#
+
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+_daemon=perdition.imaps
+
+failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id="\S+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: Re-Authentication Failure"$
+            ^%(__prefix_line)sFatal Error reading authentication information from client <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+: Exiting child$
diff --git a/testcases/files/logs/perdition b/testcases/files/logs/perdition
new file mode 100644
index 00000000..2304e372
--- /dev/null
+++ b/testcases/files/logs/perdition
@@ -0,0 +1,4 @@
+# failJSON: { "time": "2013-07-18T16:07:18", "match": true , "host": "192.168.8.100" }
+Jul 18 16:07:18 ares perdition.imaps[3194]: Auth: 192.168.8.100:2274->193.48.191.9:993 client-secure=ssl authorisation_id=NONE authentication_id="carles" server="imap.biotoul.fr:993" protocol=IMAP4S server-secure=ssl status="failed: Re-Authentication Failure"
+# failJSON: { "time": "2013-07-18T16:08:58", "match": true , "host": "192.168.8.100" }
+Jul 18 16:08:58 ares perdition.imaps[3194]: Fatal Error reading authentication information from client 192.168.8.100:2274->193.48.191.9:993: Exiting child

From eea5b071e61ba5cd5f4943100dc4bc0a278cf358 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Fri, 19 Jul 2013 20:27:15 +1000
Subject: [PATCH 425/544] ENH: jail for perdition

---
 config/jail.conf | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index e3b92038..735f028c 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -419,3 +419,10 @@ enabled = false
 filter = exim-spam
 action = iptables-multiport[name=exim-spam,port="25,465,587"]
 logpath = /var/log/exim/mainlog
+
+[perdition]
+enabled = false
+filter = perdition
+action = iptables-multiport[name=perdition="110,143,993,995"]
+logpath  = /var/log/maillog
+

From 6fdfd8d356838512bf8582b8bc2cff0cfb5fade9 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 20 Jul 2013 15:09:25 +1000
Subject: [PATCH 426/544] BF: fix port

---
 config/jail.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/jail.conf b/config/jail.conf
index 735f028c..07f9cacc 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -423,6 +423,6 @@ logpath = /var/log/exim/mainlog
 [perdition]
 enabled = false
 filter = perdition
-action = iptables-multiport[name=perdition="110,143,993,995"]
+action = iptables-multiport[name=perdition,port="110,143,993,995"]
 logpath  = /var/log/maillog
 

From bdcde678d199a360f39e03fa27719fc0fa68fbc6 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 20 Jul 2013 15:15:02 +1000
Subject: [PATCH 427/544] TST: fix year

---
 testcases/files/logs/perdition | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testcases/files/logs/perdition b/testcases/files/logs/perdition
index 2304e372..24848e6f 100644
--- a/testcases/files/logs/perdition
+++ b/testcases/files/logs/perdition
@@ -1,4 +1,4 @@
-# failJSON: { "time": "2013-07-18T16:07:18", "match": true , "host": "192.168.8.100" }
+# failJSON: { "time": "2005-07-18T16:07:18", "match": true , "host": "192.168.8.100" }
 Jul 18 16:07:18 ares perdition.imaps[3194]: Auth: 192.168.8.100:2274->193.48.191.9:993 client-secure=ssl authorisation_id=NONE authentication_id="carles" server="imap.biotoul.fr:993" protocol=IMAP4S server-secure=ssl status="failed: Re-Authentication Failure"
-# failJSON: { "time": "2013-07-18T16:08:58", "match": true , "host": "192.168.8.100" }
+# failJSON: { "time": "2005-07-18T16:08:58", "match": true , "host": "192.168.8.100" }
 Jul 18 16:08:58 ares perdition.imaps[3194]: Fatal Error reading authentication information from client 192.168.8.100:2274->193.48.191.9:993: Exiting child

From 5cfe1081865cb9cd413cd252c20e4ae228163169 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 20 Jul 2013 22:21:08 +1000
Subject: [PATCH 428/544] ENH: filter enhancements (with test cases) for
 apache-auth (httpd-2.4.4)

---
 config/filter.d/apache-auth.conf   | 16 ++++++++--------
 config/filter.d/apache-common.conf |  2 +-
 testcases/files/logs/apache-auth   | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 9 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index fa453309..4a275a4b 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -28,15 +28,15 @@ before = apache-common.conf
 #
 # See also: http://wiki.apache.org/httpd/ListOfErrors
 #
-failregex = ^%(_apache_error_client)s client denied by server configuration: (uri )?\S*\s*$
-            ^%(_apache_error_client)s user .* authentication failure for "\S*": Password Mismatch$
-            ^%(_apache_error_client)s user .* not found: \S*\s*$
-            ^%(_apache_error_client)s client used wrong authentication scheme: \S*\s*$
-            ^%(_apache_error_client)s Authorization of user \S+ to access \S* failed, reason: .*$
-            ^%(_apache_error_client)s (Digest: )?user .*: password mismatch: \S*\s*$
-            ^%(_apache_error_client)s (Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
+failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*\s*$
+            ^%(_apache_error_client)s (AH01617: )?user .* authentication failure for "\S*": Password Mismatch$
+            ^%(_apache_error_client)s (AH01618: )?user .* not found: \S*\s*$
+            ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*\s*$
+            ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
+            ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$
+            ^%(_apache_error_client)s (AH0179[01]: )?(Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
             ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
-            ^%(_apache_error_client)s user .* authorization failure for "\S*": \s*$
+            ^%(_apache_error_client)s (AH01631: )?user .* authorization failure for "\S*": \s*$
             ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
             ^%(_apache_error_client)s invalid nonce .* received - user attempted time travel\s*$
             ^%(_apache_error_client)s user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
index c3829e2f..ee9c84a0 100644
--- a/config/filter.d/apache-common.conf
+++ b/config/filter.d/apache-common.conf
@@ -14,4 +14,4 @@ after = apache-common.local
 [DEFAULT]
 
 # Common prefix for [error] apache messages which also would include <HOST>
-_apache_error_client = \[[^]]+\] \[error\] \[client <HOST>\]
+_apache_error_client = \[[^]]+\] \[(\w+:)?error\] (\[pid \d+:tid \d+\] )?\[client <HOST>(:\d+)?\]
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index e007b918..e6d1aaad 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -13,30 +13,56 @@
 # failJSON: { "time": "2013-07-17T23:20:45", "match": true , "host": "127.0.0.1" } 
 [Wed Jul 17 23:20:45 2013] [error] [client 127.0.0.1] client denied by server configuration: /var/www/html/noentry/cant_get_me.html
 
+# failJSON: { "time": "2013-07-20T21:34:49", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:34:49.453232 2013] [access_compat:error] [pid 17512:tid 140123104306944] [client 127.0.0.1:51380] AH01797: client denied by server configuration: /var/www/html/noentry/cant_get_me.html
+
 # wget --http-user='' --http-password='' http://localhost/basic/file/cant_get_me.html -O /dev/null
 # failJSON: { "time": "2013-07-17T23:14:37", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 23:14:37 2013] [error] [client 127.0.0.1] user  not found: /basic/anon/cant_get_me.html
 
+# failJSON: { "time": "2013-07-20T21:37:32", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:37:32.266605 2013] [auth_basic:error] [pid 17512:tid 140123079128832] [client 127.0.0.1:51386] AH01618: user  not found: /basic/file/cant_get_me.html
+
 # wget --http-user=username --http-password=wrongpass http://localhost/basic/file -O /dev/null
 # failJSON: { "time": "2013-07-17T22:18:52", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:18:52 2013] [error] [client 127.0.0.1] user username: authentication failure for "/basic/file": Password Mismatch
 
+# failJSON: { "time": "2013-07-20T21:39:11", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:39:11.978080 2013] [auth_basic:error] [pid 17512:tid 140123053950720] [client 127.0.0.1:51390] AH01617: user username: authentication failure for "/basic/file": Password Mismatch
+
 # wget --http-user=wrongusername --http-password=wrongpass http://localhost/basic/file -O /dev/null
 # failJSON: { "time": "2013-07-17T22:32:48", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:32:48 2013] [error] [client 127.0.0.1] user wrongusername not found: /basic/file
 
+# failJSON: { "time": "2013-07-20T21:40:33", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:40:33.803528 2013] [auth_basic:error] [pid 17540:tid 140123095914240] [client 127.0.0.1:51395] AH01618: user wrongusername not found: /basic/file
+
 # wget --header='Authorization: Digest username="Mufasa",realm="testrealm@host.com",nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",uri="/dir/index.html",qop=auth,nc=00000001,cnonce="0a4f113b",response="6629fae49393a05397450978507c4ef1",opaque="5ccc069c403ebaf9f0171e9517f40e41"'  http://localhost/basic/file -O /dev/null
 # failJSON: { "time": "2013-07-17T22:39:55", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:39:55 2013] [error] [client 127.0.0.1] client used wrong authentication scheme: /basic/file
 
+# failJSON: { "time": "2013-07-20T21:41:52", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:41:52.523931 2013] [auth_basic:error] [pid 17512:tid 140122964092672] [client 127.0.0.1:51396] AH01614: client used wrong authentication scheme: /basic/file
+
 # wget --http-user=username --http-password=password http://localhost/basic/authz_owner/cant_get_me.html -O /dev/null
 # failJSON: { "time": "2013-07-17T22:54:32", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 22:54:32 2013] [error] [client 127.0.0.1] Authorization of user username to access /basic/authz_owner/cant_get_me.html failed, reason: file owner dan does not match.
 
+# failJSON: { "time": "2013-07-20T22:11:43", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 22:11:43.147674 2013] [authz_owner:error] [pid 17540:tid 140122922129152] [client 127.0.0.1:51548] AH01637: Authorization of user username to access /basic/authz_owner/cant_get_me.html failed, reason: file owner dan does not match
+# failJSON: { "time": "2013-07-20T21:42:44", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:42:44.304159 2013] [authz_core:error] [pid 17484:tid 140123095914240] [client 127.0.0.1:51397] AH01631: user username: authorization failure for "/basic/authz_owner/cant_get_me.html": 
+
 # wget --http-user='username' --http-password='wrongpassword' http://localhost/digest/cant_get_me.html -O /dev/null
 # failJSON: { "time": "2013-07-17T23:50:37", "match": true , "host": "127.0.0.1" }
 [Wed Jul 17 23:50:37 2013] [error] [client 127.0.0.1] Digest: user username: password mismatch: /digest/cant_get_me.html
 
+# failJSON: { "time": "2013-07-20T21:44:06", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:44:06.867985 2013] [auth_digest:error] [pid 17540:tid 140123070736128] [client 127.0.0.1:51406] AH01792: user username: password mismatch: /digest/cant_get_me.html
+
 # wget --http-user='username' --http-password='password' http://localhost/digest_wrongrelm/cant_get_me.html -O /dev/null
 # failJSON: { "time": "2013-07-18T00:08:39", "match": true , "host": "127.0.0.1" }
 [Thu Jul 18 00:08:39 2013] [error] [client 127.0.0.1] Digest: user `username' in realm `digest private area' not found: /digest_wrongrelm/cant_get_me.html
+
+# failJSON: { "time": "2013-07-20T21:45:28", "match": true , "host": "127.0.0.1" } 
+[Sat Jul 20 21:45:28.890523 2013] [auth_digest:error] [pid 17540:tid 140122972485376] [client 127.0.0.1:51408] AH01790: user `username' in realm `digest private area' not found: /digest_wrongrelm/cant_get_me.html

From eb2f0c927257120dfc32d2450fd63f1962f38821 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 15:31:21 +0100
Subject: [PATCH 429/544] ENH: Improve postfix regex and add more samples

---
 config/filter.d/postfix.conf | 13 +++++++++++--
 testcases/files/logs/postfix |  4 ++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index f92c3619..b70f0377 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -4,8 +4,17 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]
 
+_daemon = postfix/smtpd
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -13,8 +22,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = reject: RCPT from (.*)\[<HOST>\]: 554
-            reject: RCPT from (.*)\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
+failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
+            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/postfix b/testcases/files/logs/postfix
index e4d07b58..172bfca4 100644
--- a/testcases/files/logs/postfix
+++ b/testcases/files/logs/postfix
@@ -4,3 +4,7 @@
 Feb 21 09:21:54 xxx postfix/smtpd[14398]: NOQUEUE: reject: RCPT from example.com[192.0.43.10]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo=
 # failJSON: { "time": "2005-07-12T07:47:48", "match": true , "host": "1.2.3.4" }
 Jul 12 07:47:48 saturn postfix/smtpd[8738]: NOQUEUE: reject: RCPT from 1-2-3-4-example.com[1.2.3.4]: 554 5.7.1 <smtp@example.com>: Relay access denied; from=<john@example.com> to=<smtp@example.org> proto=SMTP helo=<198.51.100.17>
+# failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.65" }
+Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.65]: 554 5.7.1 <bad.domain>: Helo command rejected: match bad.domain; from=<foo@good.domain> to=<foo@porcupine.org> proto=SMTP helo=<bad.domain>
+# failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.43" }
+Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.43]: 554 5.7.1 <foo@bad.domain>: Sender address rejected: match bad.domain; from=<foo@bad.domain> to=<foo@porcupine.org> proto=SMTP helo=<192.51.100.43>

From 83a80a29ea51d1cb2dc1ce45a33b1d44a8619c9c Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 15:34:00 +0100
Subject: [PATCH 430/544] ENH: Improve couriersmtp and add sample logs

---
 config/filter.d/couriersmtp.conf | 11 ++++++++++-
 testcases/files/logs/couriersmtp |  8 ++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 testcases/files/logs/couriersmtp

diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf
index 6c0cf5ff..65ffa5d7 100644
--- a/config/filter.d/couriersmtp.conf
+++ b/config/filter.d/couriersmtp.conf
@@ -4,8 +4,17 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]
 
+_daemon = courieresmtpd
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -13,7 +22,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = error,relay=<HOST>,.*550 User unknown
+failregex = ^%(__prefix_line)serror,relay=<HOST>,.*: 550 User unknown\.$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/couriersmtp b/testcases/files/logs/couriersmtp
new file mode 100644
index 00000000..212df3b4
--- /dev/null
+++ b/testcases/files/logs/couriersmtp
@@ -0,0 +1,8 @@
+# failJSON: { "time": "2005-04-10T03:47:57", "match": true , "host": "1.2.3.4" }
+Apr 10 03:47:57 web courieresmtpd: error,relay=::ffff:1.2.3.4,ident=tmf,from=<tmf@example.com>,to=<mailman-subscribe@example.com>: 550 User unknown.
+# failJSON: { "time": "2005-07-06T03:42:28", "match": true , "host": "1.2.3.4" }
+Jul  6 03:42:28 whistler courieresmtpd: error,relay=::ffff:1.2.3.4,from=<>,to=<admin at memcpy>: 550 User unknown.
+# failJSON: { "time": "2004-11-21T23:16:17", "match": true , "host": "1.2.3.4" }
+Nov 21 23:16:17 server courieresmtpd: error,relay=::ffff:1.2.3.4,from=<>,to=<>: 550 User unknown.
+# failJSON: { "time": "2004-08-14T12:51:04", "match": true , "host": "1.2.3.4" }
+Aug 14 12:51:04 HOSTNAME courieresmtpd: error,relay=::ffff:1.2.3.4,from=<firozquarl@aclunc.org>,to=<BOGUSUSER@HOSTEDDOMAIN.org>: 550 User unknown.

From bd175f026737d66e7110868fb50b3760ff75e087 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 15:38:29 +0100
Subject: [PATCH 431/544] ENH: Improve cyrus-imap regex and add sample log file

---
 config/filter.d/cyrus-imap.conf | 16 ++++++++++++----
 testcases/files/logs/cyrus-imap | 10 ++++++++++
 2 files changed, 22 insertions(+), 4 deletions(-)
 create mode 100644 testcases/files/logs/cyrus-imap

diff --git a/config/filter.d/cyrus-imap.conf b/config/filter.d/cyrus-imap.conf
index 758f75de..ae7bf6bd 100644
--- a/config/filter.d/cyrus-imap.conf
+++ b/config/filter.d/cyrus-imap.conf
@@ -4,8 +4,17 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]
 
+_daemon = (?:cyrus/)?(?:imapd?|pop3d?)
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -13,10 +22,9 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = : badlogin: .*\[<HOST>\] plaintext .*SASL\(-13\): authentication failure: checkpass failed$
-	    : badlogin: .*\[<HOST>\] LOGIN \[SASL\(-13\): authentication failure: checkpass failed\]$
-	    : badlogin: .*\[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
-	    : badlogin: .*\[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
+failregex = ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] (?:plaintext|LOGIN) .* \[?SASL\(-13\): authentication failure: checkpass failed\]?$
+	    ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
+	    ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/cyrus-imap b/testcases/files/logs/cyrus-imap
new file mode 100644
index 00000000..5886938e
--- /dev/null
+++ b/testcases/files/logs/cyrus-imap
@@ -0,0 +1,10 @@
+# failJSON: { "time": "2005-01-04T21:51:05", "match": true , "host": "127.0.0.1" }
+Jan 4 21:51:05 hostname cyrus/imap[5355]: badlogin: localhost.localdomain [127.0.0.1] plaintext cyrus@localdomain SASL(-13): authentication failure: checkpass failed
+# failJSON: { "time": "2005-02-20T17:23:32", "match": true , "host": "198.51.100.23" }
+Feb 20 17:23:32 domain cyrus/pop3[18635]: badlogin: localhost [198.51.100.23] plaintext administrator SASL(-13): authentication failure: checkpass failed
+# failJSON: { "time": "2005-02-20T17:23:32", "match": true , "host": "1.2.3.4" }
+Feb 20 17:23:32 cyrus/pop3[4297]: badlogin: example.com [1.2.3.4] plaintext mail0001 SASL(-13): authentication failure: checkpass failed
+# failJSON: { "time": "2005-06-08T18:11:13", "match": true , "host": "198.51.100.45" }
+Jun 8 18:11:13 lampserver imap[4480]: badlogin: example.com [198.51.100.45] DIGEST-MD5 [SASL(-13): authentication failure: client response doesn't match what we generated]
+# failJSON: { "time": "2004-12-21T10:01:57", "match": true , "host": "198.51.100.57" }
+Dec 21 10:01:57 hostname imapd[18454]: badlogin: example.com [198.51.100.57] CRAM-MD5 [SASL(-13): authentication failure: incorrect digest response]

From 57a6c11260c835b221b88edf8821948128953bed Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 15:53:18 +0100
Subject: [PATCH 432/544] ENH: Improve courierlogin regex and add sample logs

---
 config/filter.d/courierlogin.conf | 11 ++++++++++-
 testcases/files/logs/courierlogin |  8 ++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 testcases/files/logs/courierlogin

diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf
index 20731e5d..f096325e 100644
--- a/config/filter.d/courierlogin.conf
+++ b/config/filter.d/courierlogin.conf
@@ -5,8 +5,17 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]
 
+_daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -14,7 +23,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
+failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[<HOST>\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/courierlogin b/testcases/files/logs/courierlogin
new file mode 100644
index 00000000..e3d0d8c3
--- /dev/null
+++ b/testcases/files/logs/courierlogin
@@ -0,0 +1,8 @@
+# failJSON: { "time": "2005-04-23T21:59:01", "match": true , "host": "1.2.3.4" }
+Apr 23 21:59:01 dns2 imapd: LOGIN FAILED, user=sales@example.com, ip=[::ffff:1.2.3.4]
+# failJSON: { "time": "2005-04-23T21:59:38", "match": true , "host": "198.51.100.76" }
+Apr 23 21:59:38 dns2 pop3d: LOGIN FAILED, user=info@example.com, ip=[::ffff:198.51.100.76]
+# failJSON: { "time": "2004-11-13T08:11:53", "match": true , "host": "198.51.100.33" }
+Nov 13 08:11:53 server imapd-ssl: LOGIN FAILED, user=user@domain.tld, ip=[::ffff:198.51.100.33]
+# failJSON: { "time": "2005-04-17T19:17:11", "match": true , "host": "1.2.3.4" }
+Apr 17 19:17:11 SERVER courierpop3login: LOGIN FAILED, user=USER@EXAMPLE.org, ip=[::ffff:1.2.3.4]

From ab671b0b1a2c6beec54f8cb585716513210db62e Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 16:34:24 +0100
Subject: [PATCH 433/544] ENH: Improve wuftpd failregex, drop duplicate pam
 regex and add sample

For wu-ftpd configured to use pam, the pam filter used be used, as regex
is more robust.
---
 config/filter.d/wuftpd.conf | 11 +++++++++--
 testcases/files/logs/wuftpd |  2 ++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
index 3351d258..5c1cbb58 100644
--- a/config/filter.d/wuftpd.conf
+++ b/config/filter.d/wuftpd.conf
@@ -4,14 +4,21 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
 [Definition]
 
+_daemon = wu-ftpd
+
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = wu-ftpd(?:\[\d+\])?:\s+\(pam_unix\)\s+authentication failure.* rhost=<HOST>$
-            wu-ftpd(?:\[\d+\])?: *failed login from .*\[<HOST>\] *$
+failregex = ^%(__prefix_line)sfailed login from \S+ \[<HOST>\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/wuftpd b/testcases/files/logs/wuftpd
index 22ac0303..bbb816cc 100644
--- a/testcases/files/logs/wuftpd
+++ b/testcases/files/logs/wuftpd
@@ -1,3 +1,5 @@
 # This login line is from syslog
 # failJSON: { "time": "2004-10-06T09:59:26", "match": true , "host": "202.108.145.173" }
 Oct  6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173]
+# failJSON: { "time": "2004-10-11T16:45:07", "match": true , "host": "198.51.100.71" }
+Oct 11 16:45:07 ubuntu wu-ftpd[2360]: failed login from example.com [198.51.100.71]

From d791ba12bab3cbf7c1d804cff91b6dc30a254bcc Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 16:54:28 +0100
Subject: [PATCH 434/544] TST: Add sample log for dropbear filter

---
 testcases/files/logs/dropbear | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 testcases/files/logs/dropbear

diff --git a/testcases/files/logs/dropbear b/testcases/files/logs/dropbear
new file mode 100644
index 00000000..5a2e197a
--- /dev/null
+++ b/testcases/files/logs/dropbear
@@ -0,0 +1,4 @@
+# failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
+Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
+# failJSON: { "time": "2005-02-11T15:23:17", "match": true , "host": "198.51.100.215" }
+Feb 11 15:23:17 dropbear[1252]: login attempt for nonexistent user from ::ffff:198.51.100.215:60495

From 534be189dcd43f93182ee14f32ce78e67e5c5084 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 17:26:09 +0100
Subject: [PATCH 435/544] ENH: Improve sieve regex and add sample line

---
 config/filter.d/sieve.conf | 11 ++++++++++-
 testcases/files/logs/sieve |  4 ++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/sieve.conf b/config/filter.d/sieve.conf
index 866b4228..83608fa6 100644
--- a/config/filter.d/sieve.conf
+++ b/config/filter.d/sieve.conf
@@ -4,15 +4,24 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]
 
+_deamon = (?:cyrus/)?(?:tim)?sieved?
+
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching.
 # Values: TEXT
 #
-failregex = : badlogin: .*\[<HOST>\] (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failure$
+failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] (?:LOGIN|PLAIN|OTP|(?:CRAM|DIGEST)-MD5) authentication failure$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/sieve b/testcases/files/logs/sieve
index 5cc19673..770d17ad 100644
--- a/testcases/files/logs/sieve
+++ b/testcases/files/logs/sieve
@@ -1,2 +1,6 @@
 # failJSON: { "time": "2004-12-01T20:36:56", "match": true , "host": "1.2.3.4" }
 Dec 1 20:36:56 mail sieve[23713]: badlogin: example.com[1.2.3.4] PLAIN authentication failure
+# failJSON: { "time": "2005-07-18T17:21:58", "match": true , "host": "1.2.3.4" }
+Jul 18 17:21:58 ophelia cyrus/timsieved[12305]: badlogin: example.com[1.2.3.4] PLAIN authentication failure
+# failJSON: { "time": "2004-09-25T22:07:38", "match": true , "host": "1.2.3.4" }
+Sep 25 22:07:38 web9 timsieved[21040]: badlogin: web4[1.2.3.4] OTP authentication failure

From a11f91b83506289d03c4df2bf3c5ea3cad27f665 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 20 Jul 2013 17:28:28 +0100
Subject: [PATCH 436/544] ENH: Improve cyrus-imap regex and add extra sample
 line

---
 config/filter.d/cyrus-imap.conf | 5 ++---
 testcases/files/logs/cyrus-imap | 3 +++
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/cyrus-imap.conf b/config/filter.d/cyrus-imap.conf
index ae7bf6bd..b63fad8f 100644
--- a/config/filter.d/cyrus-imap.conf
+++ b/config/filter.d/cyrus-imap.conf
@@ -22,9 +22,8 @@ _daemon = (?:cyrus/)?(?:imapd?|pop3d?)
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] (?:plaintext|LOGIN) .* \[?SASL\(-13\): authentication failure: checkpass failed\]?$
-	    ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
-	    ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
+failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] (?:plaintext|PLAIN|LOGIN) .* \[?SASL\(-13\): authentication failure: checkpass failed\]?$
+	    ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] (?:(?:CRAM|DIGEST)-MD5|NTLM|OTP) \[SASL\(-13\): authentication failure: .*\]$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/cyrus-imap b/testcases/files/logs/cyrus-imap
index 5886938e..9bf271f6 100644
--- a/testcases/files/logs/cyrus-imap
+++ b/testcases/files/logs/cyrus-imap
@@ -8,3 +8,6 @@ Feb 20 17:23:32 cyrus/pop3[4297]: badlogin: example.com [1.2.3.4] plaintext mail
 Jun 8 18:11:13 lampserver imap[4480]: badlogin: example.com [198.51.100.45] DIGEST-MD5 [SASL(-13): authentication failure: client response doesn't match what we generated]
 # failJSON: { "time": "2004-12-21T10:01:57", "match": true , "host": "198.51.100.57" }
 Dec 21 10:01:57 hostname imapd[18454]: badlogin: example.com [198.51.100.57] CRAM-MD5 [SASL(-13): authentication failure: incorrect digest response]
+# failJSON: { "time": "2004-12-30T16:03:27", "match": true , "host": "1.2.3.4" }
+Dec 30 16:03:27 somehost imapd[2517]: badlogin: local-somehost[1.2.3.4] OTP [SASL(-13): authentication failure: External SSF not good enough]
+

From e7b7815de33446a8705dac69326bb167fcd302ec Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 15:22:44 +0100
Subject: [PATCH 437/544] TST: Add additional sshd sample logs

---
 testcases/files/logs/sshd | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd
index ff97c5a5..75854774 100644
--- a/testcases/files/logs/sshd
+++ b/testcases/files/logs/sshd
@@ -77,3 +77,11 @@ Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error
 #11 https://github.com/fail2ban/fail2ban/issues/267  There might be no colon after [daemon]
 # failJSON: { "time": "2005-06-25T23:53:34", "match": true , "host": "1.2.3.4" }
 Jun 25 23:53:34 [sshd] User root from 1.2.3.4 not allowed because not listed in AllowUsers
+# failJSON: { "time": "2004-12-12T20:04:39", "match": true , "host": "10.215.4.227" }
+Dec 12 20:04:39 aragorn sshd[1328]: error: PAM: User not known to the underlying authentication module for illegal user kernelitshell from 10.215.4.227 
+# failJSON: { "time": "2005-03-26T04:56:27", "match": true , "host": "example.com" }
+Mar 26 04:56:27 angel sshd[9739]: User allena from example.com not allowed because not in any group
+# failJSON: { "time": "2005-02-07T16:01:07", "match": true , "host": "192.51.100.54" }
+Feb 7 16:01:07 linux-m899 sshd[5106]: User root from 192.51.100.54 not allowed because a group is listed in DenyGroups
+# failJSON: { "time": "2005-01-05T11:15:05", "match": true , "host": "10.0.0.40" }
+Jan 5 11:15:05 NAS sshd[1966]: User root from 10.0.0.40 not allowed because none of user's groups are listed in AllowGroups

From b5ffbced37b3000aae229f0bcac88029646be4b2 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 15:31:32 +0100
Subject: [PATCH 438/544] TST: Sample test cases now handle ignoreregex and add
 recidive samples

---
 testcases/files/logs/recidive | 6 ++++++
 testcases/samplestestcase.py  | 2 ++
 2 files changed, 8 insertions(+)
 create mode 100644 testcases/files/logs/recidive

diff --git a/testcases/files/logs/recidive b/testcases/files/logs/recidive
new file mode 100644
index 00000000..cf6df933
--- /dev/null
+++ b/testcases/files/logs/recidive
@@ -0,0 +1,6 @@
+# failJSON: { "time": "2006-02-13T15:52:30", "match": true , "host": "1.2.3.4" }
+2006-02-13 15:52:30,388 fail2ban.actions: WARNING [sendmail] Ban 1.2.3.4
+# failJSON: { "match": false }
+2006-02-13 16:07:31,183 fail2ban.actions: WARNING [sendmail] Unban 1.2.3.4
+# failJSON: { "match": false }
+2006-02-13 15:52:30,388 fail2ban.actions: WARNING [recidive] Ban 1.2.3.4
diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index a52873b9..dd478fbf 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -65,6 +65,8 @@ def testSampleRegexsFactory(name):
 		for opt in filterConf.convert():
 			if opt[2] == "addfailregex":
 				self.filter.addFailRegex(opt[3])
+			elif opt[2] == "addignoreregex":
+				self.filter.addIgnoreRegex(opt[3])
 
 		if not self.filter.getFailRegex():
 			# No fail regexs set: likely just common file for includes.

From 4033857f63cdb5702bf15e436a7360880d8a1676 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 15:44:09 +0100
Subject: [PATCH 439/544] ENH: Improve xinetd-fail regex and add sample logs

---
 config/filter.d/xinetd-fail.conf | 13 +++++++++++--
 testcases/files/logs/xinetd-fail |  4 ++++
 2 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 testcases/files/logs/xinetd-fail

diff --git a/config/filter.d/xinetd-fail.conf b/config/filter.d/xinetd-fail.conf
index 4ff5bfde..253ce15d 100644
--- a/config/filter.d/xinetd-fail.conf
+++ b/config/filter.d/xinetd-fail.conf
@@ -4,8 +4,17 @@
 #
 #
 
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
 [Definition]
 
+_daemon = xinetd
+
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -19,8 +28,8 @@
 # load => xinetd: max_load (temporary problem)
 #
 
-failregex = xinetd(?:\[\d{1,5}\])?: FAIL: \S+ address from=<HOST>$
-            xinetd(?:\[\d{1,5}\])?: FAIL: \S+ libwrap from=<HOST>$
+failregex = ^%(__prefix_line)sFAIL: \S+ address from=<HOST>$
+            ^%(__prefix_line)sFAIL: \S+ libwrap from=<HOST>$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/xinetd-fail b/testcases/files/logs/xinetd-fail
new file mode 100644
index 00000000..8545a067
--- /dev/null
+++ b/testcases/files/logs/xinetd-fail
@@ -0,0 +1,4 @@
+# failJSON: { "time": "2005-05-15T17:38:49", "match": true , "host": "198.51.100.169" }
+May 15 17:38:49 boo xinetd[16256]: FAIL: telnet address from=198.51.100.169
+# failJSON: { "time": "2005-08-03T14:38:49", "match": true , "host": "198.51.100.223" }
+Aug  3 14:38:49 backup xinetd[31234]: FAIL: amanda libwrap from=198.51.100.223

From 8b9bafda7988d007b8e02dc21e17ea8fd6b07c30 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 16:31:11 +0100
Subject: [PATCH 440/544] ENH: Change lighttpd-fastcgi to suhosin, and improve
 regex and samples

suhosin is hardened php implmentation, which will log the alerts (as
seen in samples) to stderr, which is picked up by fastcgi webserver
(e.g. lighttpd, apache, nginx)
---
 MANIFEST                                         |  2 +-
 .../{lighttpd-fastcgi.conf => suhosin.conf}      |  3 ++-
 config/jail.conf                                 | 16 +++-------------
 testcases/files/logs/suhosin                     |  4 ++++
 4 files changed, 10 insertions(+), 15 deletions(-)
 rename config/filter.d/{lighttpd-fastcgi.conf => suhosin.conf} (67%)
 create mode 100644 testcases/files/logs/suhosin

diff --git a/MANIFEST b/MANIFEST
index 5491c7d5..f637dca0 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -101,7 +101,7 @@ config/filter.d/couriersmtp.conf
 config/filter.d/cyrus-imap.conf
 config/filter.d/exim.conf
 config/filter.d/gssftpd.conf
-config/filter.d/lighttpd-fastcgi.conf
+config/filter.d/suhosin.conf
 config/filter.d/named-refused.conf
 config/filter.d/postfix.conf
 config/filter.d/proftpd.conf
diff --git a/config/filter.d/lighttpd-fastcgi.conf b/config/filter.d/suhosin.conf
similarity index 67%
rename from config/filter.d/lighttpd-fastcgi.conf
rename to config/filter.d/suhosin.conf
index 1c6e3fce..c79c157f 100644
--- a/config/filter.d/lighttpd-fastcgi.conf
+++ b/config/filter.d/suhosin.conf
@@ -9,7 +9,8 @@
 # Notes.:  regex to match ALERTS as notified by lighttpd's FastCGI Module
 # Values:  TEXT
 #
-failregex = .*ALERT\ -\ .*attacker\ \'<HOST>\'
+# https://github.com/stefanesser/suhosin/blob/1fba865ab73cc98a3109f88d85eb82c1bfc29b37/log.c#L161
+failregex = ALERT - .* \(attacker '<HOST>', file '.*'(?:, line \d+)?\)$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/config/jail.conf b/config/jail.conf
index e3b92038..640a5874 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -256,25 +256,15 @@ filter  = php-url-fopen
 logpath = /var/www/*/logs/access_log
 maxretry = 1
 
-# A simple PHP-fastcgi jail which works with lighttpd.
-# If you run a lighttpd server, then you probably will
-# find these kinds of messages in your error_log:
-# ALERT – tried to register forbidden variable ‘GLOBALS’
-# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')
-# This jail would block the IP 1.2.3.4.
-
-[lighttpd-fastcgi]
+[suhosin]
 
 enabled = false
-filter  = lighttpd-fastcgi
-action  = iptables-multiport[name=lighttpd-fastcgi, port="http,https"]
+filter  = suhosin
+action  = iptables-multiport[name=suhosin, port="http,https"]
 # adapt the following two items as needed
 logpath = /var/log/lighttpd/error.log
 maxretry = 2
 
-# Same as above for mod_auth
-# It catches wrong authentications
-
 [lighttpd-auth]
 
 enabled = false
diff --git a/testcases/files/logs/suhosin b/testcases/files/logs/suhosin
new file mode 100644
index 00000000..90ed7bf1
--- /dev/null
+++ b/testcases/files/logs/suhosin
@@ -0,0 +1,4 @@
+# failJSON: { "time": "2005-03-11T22:52:12", "match": true , "host": "198.51.100.167" }
+Mar 11 22:52:12   lighttpd[53690]: (mod_fastcgi.c.2676) FastCGI-stderr: ALERT - configured request variable name length limit exceeded - dropped variable 'upqchi07vFfAFuBjnIKGIwiLrHo3Vt68T3yqvhQu2TqetQ78roy7Q6bpTfDUtYFR593/MA' (attacker '198.51.100.167', file '/usr/local/captiveportal/index.php')
+# failJSON: { "time": "2005-02-26T22:52:29", "match": true , "host": "198.51.100.77" }
+Feb 26 22:52:29 host suhosin[9636]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '198.51.100.77', file '/var/www/wordpress/wp-admin/includes/image.php', line 161)

From e59a4960a3bea0e90fcb01ffcc03092ebf1c10f3 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 16:48:12 +0100
Subject: [PATCH 441/544] TST: Add additional sample log line for
 apache-noscript

---
 testcases/files/logs/apache-noscript | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testcases/files/logs/apache-noscript b/testcases/files/logs/apache-noscript
index e08b3468..172bb510 100644
--- a/testcases/files/logs/apache-noscript
+++ b/testcases/files/logs/apache-noscript
@@ -1,2 +1,4 @@
 # failJSON: { "time": "2005-06-09T07:57:47", "match": true , "host": "192.0.43.10" }
 [Sun Jun 09 07:57:47 2013] [error] [client 192.0.43.10] script '/usr/lib/cgi-bin/gitweb.cgiwp-login.php' not found or unable to stat
+# failJSON: { "time": "2005-07-22T06:48:30", "match": true , "host": "198.51.100.86" }
+[Tue Jul 22 06:48:30 2008] [error] [client 198.51.100.86] File does not exist: /home/southern/public_html/azenv.php

From cf1e5bdbc223384340b2457b9eba08524f924ba8 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 22:03:49 +0100
Subject: [PATCH 442/544] ENH: Tweak proftpd regex and add sample logs

Needed to add optional ":" post __pid_re, and for consistency, decided
to make use of __prefix_line instead which includes this.
---
 config/filter.d/proftpd.conf | 10 ++++++----
 testcases/files/logs/proftpd |  7 ++++---
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 13080fcc..d17658ce 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -13,6 +13,8 @@ before = common.conf
 
 [Definition]
 
+_deamon = proftpd
+
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
@@ -20,10 +22,10 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
-            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): .*$
-            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
-            ^ %(__hostname)s %(__daemon_re)s%(__pid_re)s %(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
+failregex = ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
+            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): .*$
+            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
+            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/proftpd b/testcases/files/logs/proftpd
index 404ebfaf..9687d992 100644
--- a/testcases/files/logs/proftpd
+++ b/testcases/files/logs/proftpd
@@ -10,6 +10,7 @@ Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.
 Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
 # failJSON: { "time": "2005-06-14T00:09:59", "match": true , "host": "59.167.242.100" }
 Jun 14 00:09:59 platypus.ace-hosting.com.au proftpd[17839] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): USER platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (hihoinjection[1.2.3.44]): no such user found from ::ffff:59.167.242.100 [::ffff:59.167.242.100] to ::ffff:113.212.99.194:21
-
-
-
+# failJSON: { "time": "2005-05-31T10:53:25", "match": true , "host": "1.2.3.4" }
+May 31 10:53:25 mail proftpd[15302]: xxxxxxxxxx (::ffff:1.2.3.4[::ffff:1.2.3.4]) - Maximum login attempts (3) exceeded 
+# failJSON: { "time": "2004-12-05T15:44:32", "match": true , "host": "1.2.3.4" }
+Dec 5 15:44:32 serv1 proftpd[70944]: serv1.domain.com (example.com[1.2.3.4]) - USER jtittle@domain.org: no such user found from example.com [1.2.3.4] to 1.2.3.4:21 

From 37f240bef00febcbe2711014ba1c4d53dab5070c Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sun, 21 Jul 2013 22:13:37 +0100
Subject: [PATCH 443/544] TST: Add sample log for php-url-fopen filter

---
 testcases/files/logs/php-url-fopen | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 testcases/files/logs/php-url-fopen

diff --git a/testcases/files/logs/php-url-fopen b/testcases/files/logs/php-url-fopen
new file mode 100644
index 00000000..f119a928
--- /dev/null
+++ b/testcases/files/logs/php-url-fopen
@@ -0,0 +1,2 @@
+# failJSON: { "time": "2009-03-26T08:44:20", "match": true , "host": "66.185.212.172" }
+66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

From b92316ff17024ef1c0f0fa48298b5b51f60026b6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 22 Jul 2013 11:47:36 -0400
Subject: [PATCH 444/544] RF(ENH): JailsReader.getOptions -- avoid code
 duplication when asking for 1 jail or all

---
 client/jailsreader.py | 45 +++++++++++++++++++------------------------
 1 file changed, 20 insertions(+), 25 deletions(-)

diff --git a/client/jailsreader.py b/client/jailsreader.py
index 408a40bf..00c63e3c 100644
--- a/client/jailsreader.py
+++ b/client/jailsreader.py
@@ -18,7 +18,7 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 # Author: Cyril Jaquier
-# 
+#
 
 __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
@@ -32,7 +32,7 @@ from jailreader import JailReader
 logSys = logging.getLogger("fail2ban.client.config")
 
 class JailsReader(ConfigReader):
-	
+
 	def __init__(self, force_enable=False, **kwargs):
 		"""
 		Parameters
@@ -44,17 +44,25 @@ class JailsReader(ConfigReader):
 		ConfigReader.__init__(self, **kwargs)
 		self.__jails = list()
 		self.__force_enable = force_enable
-	
+
 	def read(self):
 		return ConfigReader.read(self, "jail")
-	
-	def getOptions(self, section = None):
+
+	def getOptions(self, section=None):
+		"""Reads configuration for jail(s) and adds enabled jails to __jails
+		"""
 		opts = []
 		self.__opts = ConfigReader.getOptions(self, "Definition", opts)
 
-		if section:
-			# Get the options of a specific jail.
-			jail = JailReader(section, basedir=self.getBaseDir(), force_enable=self.__force_enable)
+		if section is None:
+			sections = self.sections()
+		else:
+			sections = [ section ]
+
+		# Get the options of all jails.
+		for sec in sections:
+			jail = JailReader(sec, basedir=self.getBaseDir(),
+							  force_enable=self.__force_enable)
 			jail.read()
 			ret = jail.getOptions()
 			if ret:
@@ -62,23 +70,10 @@ class JailsReader(ConfigReader):
 					# We only add enabled jails
 					self.__jails.append(jail)
 			else:
-				logSys.error("Errors in jail '%s'. Skipping..." % section)
+				logSys.error("Errors in jail %r. Skipping..." % sec)
 				return False
-		else:
-			# Get the options of all jails.
-			for sec in self.sections():
-				jail = JailReader(sec, basedir=self.getBaseDir(), force_enable=self.__force_enable)
-				jail.read()
-				ret = jail.getOptions()
-				if ret:
-					if jail.isEnabled():
-						# We only add enabled jails
-						self.__jails.append(jail)
-				else:
-					logSys.error("Errors in jail '" + sec + "'. Skipping...")
-					return False
 		return True
-	
+
 	def convert(self, allow_no_files=False):
 		"""Convert read before __opts and jails to the commands stream
 
@@ -99,6 +94,6 @@ class JailsReader(ConfigReader):
 		# Start jails
 		for jail in self.__jails:
 			stream.append(["start", jail.getName()])
-		
+
 		return stream
-		
+

From 149a83545fe45d1b66d0ee525ee29ccce5c2288d Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 22 Jul 2013 11:52:51 -0400
Subject: [PATCH 445/544] TST: basic test for reading of a bogus jail

---
 testcases/clientreadertestcase.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 695b3877..4e8cdd9d 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -126,6 +126,13 @@ class JailsReaderTest(unittest.TestCase):
 		# commands to communicate to the server
 		self.assertEqual(comm_commands, [])
 
+		# We should not "read" some bogus jail
+		old_comm_commands = comm_commands[:]   # make a copy
+		self.assertFalse(jails.getOptions("BOGUS"))
+		# and there should be no side-effects
+		self.assertEqual(jails.convert(), old_comm_commands)
+
+
 	def testReadStockJailConfForceEnabled(self):
 		# more of a smoke test to make sure that no obvious surprises
 		# on users' systems when enabling shipped jails

From 3b52eca608d858ce42a6b6109ad5d1cc7a01d3b9 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 22 Jul 2013 12:09:33 -0400
Subject: [PATCH 446/544] ENH+TST: Ticket -- drop unused/bogus get|setFile +
 enh __str__ + basic testing

---
 server/ticket.py                 |  8 +-------
 testcases/failmanagertestcase.py | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/server/ticket.py b/server/ticket.py
index 8826f26b..e0b2cb2e 100644
--- a/server/ticket.py
+++ b/server/ticket.py
@@ -47,7 +47,7 @@ class Ticket:
 
 	def __str__(self):
 		return "%s: ip=%s time=%s #attempts=%d" % \
-			   (self.__class__, self.__ip, self.__time, self.__attempt)
+			   (self.__class__.__name__.split('.')[-1], self.__ip, self.__time, self.__attempt)
 	
 
 	def setIP(self, value):
@@ -59,12 +59,6 @@ class Ticket:
 	def getIP(self):
 		return self.__ip
 	
-	def setFile(self, value):
-		self.__file = value
-	
-	def getFile(self):
-		return self.__file
-	
 	def setTime(self, value):
 		self.__time = value
 	
diff --git a/testcases/failmanagertestcase.py b/testcases/failmanagertestcase.py
index 1bfab339..bd34e25f 100644
--- a/testcases/failmanagertestcase.py
+++ b/testcases/failmanagertestcase.py
@@ -78,6 +78,20 @@ class AddFailure(unittest.TestCase):
 		ticket = self.__failManager.toBan()
 		self.assertEqual(ticket.getIP(), "193.168.0.128")
 		self.assertTrue(isinstance(ticket.getIP(), str))
+
+		# finish with rudimentary tests of the ticket
+		# verify consistent str
+		ticket_str = str(ticket)
+		self.assertEqual(
+			ticket_str,
+			'FailTicket: ip=193.168.0.128 time=1167605999.0 #attempts=5')
+		# and some get/set-ers otherwise not tested
+		ticket.setTime(1000002000.0)
+		self.assertEqual(ticket.getTime(), 1000002000.0)
+		# and str() adjusted correspondingly
+		self.assertEqual(
+			str(ticket),
+			'FailTicket: ip=193.168.0.128 time=1000002000.0 #attempts=5')
 	
 	def testbanNOK(self):
 		self.__failManager.setMaxRetry(10)

From abc41460799fb10b710b2684c0408240ef90d1ec Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 24 Jul 2013 10:27:12 +1000
Subject: [PATCH 447/544] ENH: perdition proxies other types hence daemon can
 include (perdidtion.(imap|pop)s?|managesieve). Also support local
 authentication resulting in the log message: local authentication failure

---
 config/filter.d/perdition.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/perdition.conf b/config/filter.d/perdition.conf
index e7cb0f7d..41980cb1 100644
--- a/config/filter.d/perdition.conf
+++ b/config/filter.d/perdition.conf
@@ -10,7 +10,7 @@ before = common.conf
 
 [Definition]
 
-_daemon=perdition.imaps
+_daemon=perdition.\S+
 
-failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id="\S+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: Re-Authentication Failure"$
+failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id="\S+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: (local authentication failure|Re-Authentication Failure)"$
             ^%(__prefix_line)sFatal Error reading authentication information from client <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+: Exiting child$

From 7d7ef081457f7c55137e18f3235b3c36c356ee3b Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 24 Jul 2013 10:44:52 +1000
Subject: [PATCH 448/544] ENH: authentication_id can be an imap4 quoted string,
 whatever that is, so using .+ as its id

---
 config/filter.d/perdition.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/perdition.conf b/config/filter.d/perdition.conf
index 41980cb1..7fdca14b 100644
--- a/config/filter.d/perdition.conf
+++ b/config/filter.d/perdition.conf
@@ -12,5 +12,5 @@ before = common.conf
 
 _daemon=perdition.\S+
 
-failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id="\S+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: (local authentication failure|Re-Authentication Failure)"$
+failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id=".+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: (local authentication failure|Re-Authentication Failure)"$
             ^%(__prefix_line)sFatal Error reading authentication information from client <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+: Exiting child$

From 8f532f9148a79a4caea77275660aa7fe18e3d14e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 24 Jul 2013 11:29:58 +1000
Subject: [PATCH 449/544] NIT: space remove

---
 config/jail.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/jail.conf b/config/jail.conf
index 07f9cacc..8d086da4 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -424,5 +424,5 @@ logpath = /var/log/exim/mainlog
 enabled = false
 filter = perdition
 action = iptables-multiport[name=perdition,port="110,143,993,995"]
-logpath  = /var/log/maillog
+logpath = /var/log/maillog
 

From b5639a8672b3ace9c3e761d05fc76b50c29d3b17 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 11:55:09 +0100
Subject: [PATCH 450/544] ENH: Simplify cyrus-imap filter fail regex

---
 config/filter.d/cyrus-imap.conf | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/config/filter.d/cyrus-imap.conf b/config/filter.d/cyrus-imap.conf
index b63fad8f..0ace92c1 100644
--- a/config/filter.d/cyrus-imap.conf
+++ b/config/filter.d/cyrus-imap.conf
@@ -22,8 +22,7 @@ _daemon = (?:cyrus/)?(?:imapd?|pop3d?)
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] (?:plaintext|PLAIN|LOGIN) .* \[?SASL\(-13\): authentication failure: checkpass failed\]?$
-	    ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] (?:(?:CRAM|DIGEST)-MD5|NTLM|OTP) \[SASL\(-13\): authentication failure: .*\]$
+failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ .*?\[?SASL\(-13\): authentication failure: .*\]?$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 2f4aaa9fb9a26b89149a5a7e831f9a7bd765d80f Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 12:01:09 +0100
Subject: [PATCH 451/544] ENH: Simplify sieve filter failregex

---
 config/filter.d/sieve.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/sieve.conf b/config/filter.d/sieve.conf
index 83608fa6..b2af6774 100644
--- a/config/filter.d/sieve.conf
+++ b/config/filter.d/sieve.conf
@@ -21,7 +21,7 @@ _deamon = (?:cyrus/)?(?:tim)?sieved?
 #          be used for standard IP/hostname matching.
 # Values: TEXT
 #
-failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] (?:LOGIN|PLAIN|OTP|(?:CRAM|DIGEST)-MD5) authentication failure$
+failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ authentication failure$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From f7d8e6873885ec37843a346171a544dc6a4e4600 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 12:32:29 +0100
Subject: [PATCH 452/544] TST: Add apache-badbots sample log

---
 testcases/files/logs/apache-badbots | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 testcases/files/logs/apache-badbots

diff --git a/testcases/files/logs/apache-badbots b/testcases/files/logs/apache-badbots
new file mode 100644
index 00000000..35669252
--- /dev/null
+++ b/testcases/files/logs/apache-badbots
@@ -0,0 +1,2 @@
+# failJSON: { "time": "2007-03-05T14:39:21", "match": true , "host": "1.2.3.4" }
+1.2.3.4 - - [05/Mar/2007:14:39:21 +0100] "POST /123.html/trackback/ HTTP/1.0" 301 459 "http://www.mydomain.tld/123.html/trackback" "TrackBack/1.02"

From 5437f5fe908d3a95926d058e0fb4da9b4ab829d6 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 17:02:53 +0100
Subject: [PATCH 453/544] TST: Add gssftpd sample log

---
 testcases/files/logs/gssftpd | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 testcases/files/logs/gssftpd

diff --git a/testcases/files/logs/gssftpd b/testcases/files/logs/gssftpd
new file mode 100644
index 00000000..58fda7dc
--- /dev/null
+++ b/testcases/files/logs/gssftpd
@@ -0,0 +1,2 @@
+# failJSON: { "time": "2005-01-22T18:09:46", "match": true , "host": "198.51.100.23" }
+Jan 22 18:09:46 host ftpd[132]: repeated login failures from 198.51.100.23 (example.com)

From 1c7d28d1ea8e79dd8bd11f7899a2a4d4be1f4830 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 17:03:14 +0100
Subject: [PATCH 454/544] TST: Add qmail sample log

---
 testcases/files/logs/qmail | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 testcases/files/logs/qmail

diff --git a/testcases/files/logs/qmail b/testcases/files/logs/qmail
new file mode 100644
index 00000000..63cad4cc
--- /dev/null
+++ b/testcases/files/logs/qmail
@@ -0,0 +1,4 @@
+# failJSON: { "time": "2004-09-06T07:33:33", "match": true , "host": "198.51.100.77" }
+Sep  6 07:33:33 sd6 qmail: 1157520813.485077 rblsmtpd: 198.51.100.77 pid 19597 sbl-xbl.spamhaus.org: 451 http://www.spamhaus.org/query/bl?ip=198.51.100.77
+# failJSON: { "time": "2004-09-06T07:18:29", "match": true , "host": "198.51.100.54" }
+Sep  6 07:18:29 sd6 qmail: 1157519909.633171 qmail-smtpd: 421 badiprbl: ip 198.51.100.54 rbl: example.com

From bf021ebd97719c9a1b7436366f4379f3d86d71ed Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 17:05:17 +0100
Subject: [PATCH 455/544] TST: Mandate that all filters and each regex has
 sample log entry

---
 testcases/samplestestcase.py | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index dd478fbf..54afc864 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -72,14 +72,9 @@ def testSampleRegexsFactory(name):
 			# No fail regexs set: likely just common file for includes.
 			return
 
-		# TODO: Remove exception handling once sample logs obtained for all
-		try:
-			self.assertTrue(
-				os.path.isfile(os.path.join(TEST_FILES_DIR, "logs", name)),
-				"No sample log file available for '%s' filter" % name)
-		except AssertionError:
-			print "I: No sample log file available for '%s' filter" % name
-			return
+		self.assertTrue(
+			os.path.isfile(os.path.join(TEST_FILES_DIR, "logs", name)),
+			"No sample log file available for '%s' filter" % name)
 
 		logFile = fileinput.FileInput(
 			os.path.join(TEST_FILES_DIR, "logs", name))
@@ -124,14 +119,10 @@ def testSampleRegexsFactory(name):
 
 		# TODO: Remove exception handling once all regexs have samples
 		for failRegexIndex, failRegex in enumerate(self.filter.getFailRegex()):
-			try:
-				self.assertTrue(
-					failRegexIndex in regexsUsed,
-					"Regex for filter '%s' has no samples: %i: %r" %
-						(name, failRegexIndex, failRegex))
-			except AssertionError:
-				print "I: Regex for filter '%s' has no samples: %i: %r" % (
-					name, failRegexIndex, failRegex)
+			self.assertTrue(
+				failRegexIndex in regexsUsed,
+				"Regex for filter '%s' has no samples: %i: %r" %
+					(name, failRegexIndex, failRegex))
 
 	return testFilter
 

From 11100a2fc0c65677f3e5d7b065c012aa37cbd547 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 26 Jul 2013 17:20:05 +0100
Subject: [PATCH 456/544] DOC: Changelog additions for regex changes

---
 ChangeLog | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index a6a6ab23..237ef672 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -59,6 +59,10 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Steven Hiscocks
    * filter.d/dovecot - Addition of session, time values and possible blank
      user
+   * filter.d/{courier{login,smtp},proftpd,sieve,wuftpd,xinetd} - General
+     regex impovements
+   * IMPORTANT: 'lighttpd-fastcgi' filter has been renamed to 'suhosin', which
+     will require changing in jail.{conf,local} if using this filter.
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------

From 8936f2cd02c476cac0581b87c65c0e739cd2de68 Mon Sep 17 00:00:00 2001
From: Jamyn Shanley <jamyn@cpanel.net>
Date: Thu, 25 Jul 2013 07:36:10 -0500
Subject: [PATCH 457/544] fail2ban-users: Sebastian Arcus - Detect device auth
 failures on Asterisk 11

---
 config/filter.d/asterisk.conf | 2 +-
 testcases/files/logs/asterisk | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf
index e4e5de5f..fef43693 100644
--- a/config/filter.d/asterisk.conf
+++ b/config/filter.d/asterisk.conf
@@ -30,7 +30,7 @@ failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?'
             ^%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
             ^%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
             ^%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
-            ^%(log_prefix)s Failed to authenticate user [^@]+@<HOST>\S*$
+            ^%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
             ^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
             ^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?$
 
diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk
index ec2fec7c..b2eb7738 100644
--- a/testcases/files/logs/asterisk
+++ b/testcases/files/logs/asterisk
@@ -1,4 +1,6 @@
 # Sample log files for asterisk 
+# failJSON: { "time": "2013-07-25T07:26:43", "match": true , "host": "1.2.3.4" }
+[2013-07-25 07:26:43] NOTICE[26015][C-000006b2] chan_sip.c: Failed to authenticate device 101<sip:101@1.2.3.4>;tag=deadbeef
 # failJSON: { "time": "2012-02-13T17:21:54", "match": true , "host": "1.2.3.4" }
 [2012-02-13 17:21:54] NOTICE[1638] chan_sip.c: Registration from '<sip:301@example.com>' failed for '1.2.3.4' - Wrong password
 # failJSON: { "time": "2012-02-13T17:18:22", "match": true , "host": "1.2.3.4" }

From a355fab91b87b0843dfa5c804db93de8e0157361 Mon Sep 17 00:00:00 2001
From: Jamyn Shanley <jshanley@gmail.com>
Date: Sat, 27 Jul 2013 03:31:00 +0000
Subject: [PATCH 458/544] https://github.com/fail2ban/fail2ban/issues/306

Fix regex for latest dropbear (keep backwards compatibility). Add test case logfiles.

Signed-off-by: Jamyn Shanley <jshanley@gmail.com>
---
 config/filter.d/dropbear.conf | 5 +++--
 testcases/files/logs/dropbear | 6 ++++++
 2 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 testcases/files/logs/dropbear

diff --git a/config/filter.d/dropbear.conf b/config/filter.d/dropbear.conf
index c822d08c..b48615e6 100644
--- a/config/filter.d/dropbear.conf
+++ b/config/filter.d/dropbear.conf
@@ -27,8 +27,9 @@ _daemon = dropbear
 # These match the unmodified dropbear messages. It isn't possible to
 # match the source of the 'exit before auth' messages from dropbear.
 #
-failregex = ^%(__prefix_line)slogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
-            ^%(__prefix_line)sbad password attempt for .+ from <HOST>:.*\s*$
+failregex = ^%(__prefix_line)s(L|l)ogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
+            ^%(__prefix_line)s(B|b)ad password attempt for .+ from <HOST>:.*\s*$
+	     ^%(__prefix_line)sExit before auth \(user .+, \d+ fails\): Max auth tries reached - user .+ from <HOST>:.*\s*$
 
 # The only line we need to match with the modified dropbear.
 
diff --git a/testcases/files/logs/dropbear b/testcases/files/logs/dropbear
new file mode 100644
index 00000000..414c3c7a
--- /dev/null
+++ b/testcases/files/logs/dropbear
@@ -0,0 +1,6 @@
+# failJSON: { "time": "2005-07-27T01:04:12", "match": true , "host": "1.2.3.4" }
+Jul 27 01:04:12 fail2ban-test dropbear[1335]: Bad password attempt for 'root' from 1.2.3.4:60588
+# failJSON: { "time": "2005-07-27T01:04:22", "match": true , "host": "1.2.3.4" }
+Jul 27 01:04:22 fail2ban-test dropbear[1335]: Exit before auth (user 'root', 10 fails): Max auth tries reached - user 'root' from 1.2.3.4:60588
+# failJSON: { "time": "2005-07-27T01:18:59", "match": true , "host": "1.2.3.4" }
+Jul 27 01:18:59 fail2ban-test dropbear[1477]: Login attempt for nonexistent user from 1.2.3.4:60794

From af46cd0e4f6ed194f2661b70ea83e5c7ab5c6e77 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 27 Jul 2013 11:34:10 +0100
Subject: [PATCH 459/544] ENH: fail2ban-regex now sorts date templates, similar
 to actual filters

Sort occurs every 10 lines, as to not overly effect performance
---
 fail2ban-regex | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index e19b1bc9..ff4bbd10 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -240,7 +240,7 @@ class Fail2banRegex(object):
 
 	def process(self, test_lines):
 
-		for line in test_lines:
+		for line_no, line in enumerate(test_lines):
 			if line.startswith('#') or not line.strip():
 				# skip comment and empty lines
 				continue
@@ -256,6 +256,9 @@ class Fail2banRegex(object):
 					self._line_stats.missed_lines.append(line)
 			self._line_stats.tested += 1
 
+			if line_no % 10 == 0:
+				self._filter.dateDetector.sortTemplate()
+
 	def printLines(self, ltype):
 		lstats = self._line_stats
 		assert(len(lstats.missed_lines) == lstats.tested - (lstats.matched + lstats.ignored))

From 879c1a32f7e1d5ea72c72c950d97c72dc6c464ef Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 27 Jul 2013 11:36:01 +0100
Subject: [PATCH 460/544] ENH: fail2ban-regex now uses iteraable for log file

Previosuly, the whole file was read in first
---
 fail2ban-regex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban-regex b/fail2ban-regex
index ff4bbd10..4c5a0a11 100755
--- a/fail2ban-regex
+++ b/fail2ban-regex
@@ -377,7 +377,7 @@ if __name__ == "__main__":
 		try:
 			hdlr = open(cmd_log)
 			print "Use         log file : %s" % cmd_log
-			test_lines = hdlr.readlines()
+			test_lines = hdlr # Iterable
 		except IOError, e:
 			print e
 			sys.exit(-1)

From 1e270078b47ed8051f12b99f33857af2508f1899 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Sat, 27 Jul 2013 20:21:05 +0100
Subject: [PATCH 461/544] TST: Warn if date templates overlap in default
 detectors

---
 server/datetemplate.py            |  3 +++
 testcases/datedetectortestcase.py | 41 ++++++++++++++++++++++++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/server/datetemplate.py b/server/datetemplate.py
index 86eeee8e..0754391b 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -62,6 +62,9 @@ class DateTemplate:
 
 	def incHits(self):
 		self.__hits += 1
+
+	def resetHits(self):
+		self.__hits = 0
 	
 	def matchDate(self, line):
 		dateMatch = self.__cRegex.search(line)
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 8a838700..218abba9 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -24,7 +24,7 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest
+import unittest, calendar, datetime, re, pprint
 from server.datedetector import DateDetector
 from server.datetemplate import DateTemplate
 
@@ -122,6 +122,45 @@ class DateDetectorTest(unittest.TestCase):
 			self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')[:6],
 			m1)
 
+	def testDateDetectorTemplateOverlap(self):
+		patterns = [template.getPattern()
+			for template in self.__datedetector.getTemplates()
+			if hasattr(template, "getPattern")]
+
+		year = 2008 # Leap year, 08 for %y can be confused with both %d and %m
+		def iterDates(year):
+			for month in xrange(1, 13):
+				for day in xrange(2, calendar.monthrange(year, month)[1]+1, 9):
+					for hour in xrange(0, 24, 6):
+						for minute in xrange(0, 60, 15):
+							for second in xrange(0, 60, 15): # Far enough?
+								yield datetime.datetime(
+									year, month, day, hour, minute, second)
+
+		overlapedTemplates = set()
+		for date in iterDates(year):
+			for pattern in patterns:
+				datestr = date.strftime(pattern)
+				datestrs = set([
+					datestr,
+					re.sub(r"(\s)0", r"\1 ", datestr),
+					re.sub(r"(\s)0", r"\1", datestr)])
+				for template in self.__datedetector.getTemplates():
+					template.resetHits()
+					for datestr in datestrs:
+						if template.matchDate(datestr): # or getDate?
+							template.incHits()
+
+				matchedTemplates = [template
+					for template in self.__datedetector.getTemplates()
+					if template.getHits() > 0]
+				assert matchedTemplates != [] # Should match at least one
+				if len(matchedTemplates) > 1:
+					overlapedTemplates.add((pattern, tuple(sorted(template.getName()
+						for template in matchedTemplates))))
+		if overlapedTemplates:
+			print "WARNING: The following date templates overlap:"
+			pprint.pprint(overlapedTemplates)
 
 #	def testDefaultTempate(self):
 #		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")

From 0fb04cb2f043061adf4dd521794253ae0c286d5c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Jul 2013 22:00:55 +1000
Subject: [PATCH 462/544] ENH: filter enhancements on mod-digest (with test
 cases) for apache-auth (httpd-2.4.4)

---
 config/filter.d/apache-auth.conf              |  15 ++-
 testcases/files/config/apache-auth/digest.py  |  99 ++++++++++++++++++
 .../config/apache-auth/digest_time/.htaccess  |   7 ++
 .../apache-auth/digest_time/.htaccess.swp     | Bin 0 -> 12288 bytes
 .../config/apache-auth/digest_time/.htpasswd  |   1 +
 testcases/files/logs/apache-auth              |  32 ++++++
 6 files changed, 146 insertions(+), 8 deletions(-)
 create mode 100755 testcases/files/config/apache-auth/digest.py
 create mode 100644 testcases/files/config/apache-auth/digest_time/.htaccess
 create mode 100644 testcases/files/config/apache-auth/digest_time/.htaccess.swp
 create mode 100644 testcases/files/config/apache-auth/digest_time/.htpasswd

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 4a275a4b..d1a2ffcb 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -35,15 +35,14 @@ failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server config
             ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
             ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$
             ^%(_apache_error_client)s (AH0179[01]: )?(Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
-            ^%(_apache_error_client)s user .* authorization failure: \S*\s*$
             ^%(_apache_error_client)s (AH01631: )?user .* authorization failure for "\S*": \s*$
-            ^%(_apache_error_client)s invalid nonce .* received - (length|hash) is not \S+\s*$
-            ^%(_apache_error_client)s invalid nonce .* received - user attempted time travel\s*$
-            ^%(_apache_error_client)s user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
-            ^%(_apache_error_client)s user .*: one-time-nonce mismatch - sending new nonce\s*$
-            ^%(_apache_error_client)s realm mismatch - got `.*' but expected `.+'\s*$
-            ^%(_apache_error_client)s unknown algorithm `\S+' received: \S*\s*"$
-            ^%(_apache_error_client)s invalid qop `.*' received: \S*\s*"$
+            ^%(_apache_error_client)s (AH0177[56]: )?invalid nonce .* received - (length|hash) is not \S+\s*$
+            ^%(_apache_error_client)s (AH01788: )?realm mismatch - got `.*' but expected `.+'\s*$
+            ^%(_apache_error_client)s (AH01789: )?unknown algorithm `\S+' received: \S*\s*"$
+            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*"$
+            ^%(_apache_error_client)s (AH01777: )?invalid nonce .* received - user attempted time travel\s*$
+            ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
+            ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
 
 
 
diff --git a/testcases/files/config/apache-auth/digest.py b/testcases/files/config/apache-auth/digest.py
new file mode 100755
index 00000000..ed0e18eb
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest.py
@@ -0,0 +1,99 @@
+#!/bin/env python
+import requests
+import md5
+
+
+def auth(v):
+
+    ha1 = md5.new(username + ':' + realm + ':' + password).hexdigest()
+    ha2 = md5.new("GET:" + url).hexdigest()
+    
+    #response = md5.new(ha1 + ':' + v['nonce'][1:-1] + ':' + v['nc'] + ':' + v['cnonce'][1:-1]
+    #                  + ':' + v['qop'][1:-1] + ':' + ha2).hexdigest()
+    
+    nonce = v['nonce'][1:-1]
+    nc=v.get('nc') or ''
+    cnonce = v.get('cnonce') or ''
+    qop = v['qop'][1:-1]
+    algorithm = v['algorithm']
+    response = md5.new(ha1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + qop + ':' + ha2).hexdigest()
+    
+    p = requests.Request('GET', host + url).prepare()
+    #p.headers['Authentication-Info'] = response 
+    p.headers['Authorization'] = """
+        Digest username="%s",
+        algorithm="%s",
+        realm="%s",
+        uri="%s",
+        nonce="%s",
+        cnonce="",
+        nc="",
+        qop=%s,
+        response="%s"
+    """ % ( username, algorithm, realm, url, nonce, qop, response )
+    
+    s =  requests.Session()
+    return s.send(p)
+
+def preauth():
+    r = requests.get(host + url)
+    r.headers['www-authenticate'].split(', ')
+    return dict([ a.split('=',1) for a in r.headers['www-authenticate'].split(', ') ])
+
+
+url='/digest/'
+host = 'http://localhost:801'
+
+v = preauth()
+
+#print v
+username="username"
+password = "password"
+
+realm = 'so far away'
+r = auth(v)
+
+realm = v['Digest realm'][1:-1]
+
+# [Sun Jul 28 21:27:56.549667 2013] [auth_digest:error] [pid 24835:tid 139895297222400] [client 127.0.0.1:57052] AH01788: realm mismatch - got `so far away' but expected `digest private area'
+
+
+algorithm = v['algorithm']
+v['algorithm'] = 'super funky chicken'
+r = auth(v)
+
+# [Sun Jul 28 21:41:20 2013] [error] [client 127.0.0.1] Digest: unknown algorithm `super funky chicken' received: /digest/
+
+print r.status_code,r.headers, r.text
+v['algorithm'] = algorithm
+
+
+r = auth(v)
+print r.status_code,r.headers, r.text
+
+nonce = v['nonce']
+v['nonce']=v['nonce'][5:-5]
+
+r = auth(v)
+print r.status_code,r.headers, r.text
+
+# [Sun Jul 28 21:05:31.178340 2013] [auth_digest:error] [pid 24224:tid 139895539455744] [client 127.0.0.1:56906] AH01793: invalid qop `auth' received: /digest/qop_none/
+
+
+v['nonce']=nonce[0:11] + 'ZZZ' + nonce[14:]
+
+r = auth(v)
+print r.status_code,r.headers, r.text
+
+#[Sun Jul 28 21:18:11.769228 2013] [auth_digest:error] [pid 24752:tid 139895505884928] [client 127.0.0.1:56964] AH01776: invalid nonce b9YAiJDiBAZZZ1b1abe02d20063ea3b16b544ea1b0d981c1bafe received - hash is not d42d824dee7aaf50c3ba0a7c6290bd453e3dd35b
+
+
+url='/digest_time/'
+v=preauth()
+
+import time
+time.sleep(1)
+
+r = auth(v)
+print r.status_code,r.headers, r.text
+
diff --git a/testcases/files/config/apache-auth/digest_time/.htaccess b/testcases/files/config/apache-auth/digest_time/.htaccess
new file mode 100644
index 00000000..44036f57
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest_time/.htaccess
@@ -0,0 +1,7 @@
+AuthType Digest
+AuthName "digest private area"
+AuthDigestDomain /digest_time/
+AuthBasicProvider file
+AuthUserFile /var/www/html/digest_time/.htpasswd
+AuthDigestNonceLifetime 1
+Require valid-user
diff --git a/testcases/files/config/apache-auth/digest_time/.htaccess.swp b/testcases/files/config/apache-auth/digest_time/.htaccess.swp
new file mode 100644
index 0000000000000000000000000000000000000000..1d14e6f29e6247f67d618dc791a6b6791672ed5f
GIT binary patch
literal 12288
zcmeI&!Aiq07zglgL-8bvdx1F5Tc<ndK@Z9h1RYbHSNYavF4C?wNn1Sm2tI&s;hXp-
z9=vPXO;8aByAA(=kB}x`lKyU`-=KAMawc}0ZE|g$=<)sSytY)O_JAnhaq)C!GYR`L
z;&C&KeGY>-V)bjHm$CNpJoiR63cWzxNMo<9ilo;ZS@wNt%*?Z}00I!0Lm;)o#@;Hm
zceYza_EvpU)HeEaY=jgDKmY;|fB*y_009U<U{M8ZQlSTT`ReoqR;GRBM?W2+g8&2|
z009U<00Izz00bZa0SG`~0R=c9T3#bMa8dmK|NQ=cb>kNo&n})^+`8zwDAw(}K!X4T
zAOHafKmY;|fB*y_009X68-WXXmntnq#-R!tsgarvQ#<OEmF?Yl?8{R%ltqQR*e+-K
zZppC<rTDWHK4D|>piDSoqx_zZGZjcJhA#EX37xXiUVN*hFQ>cgPOMJ~>_wtg##Rc}
PlI!L4<$WT><dXCOwwrD;

literal 0
HcmV?d00001

diff --git a/testcases/files/config/apache-auth/digest_time/.htpasswd b/testcases/files/config/apache-auth/digest_time/.htpasswd
new file mode 100644
index 00000000..cc649515
--- /dev/null
+++ b/testcases/files/config/apache-auth/digest_time/.htpasswd
@@ -0,0 +1 @@
+username:digest private area:fad48d3a7c63f61b5b3567a4105bbb04
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index e6d1aaad..95397cb5 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -66,3 +66,35 @@
 
 # failJSON: { "time": "2013-07-20T21:45:28", "match": true , "host": "127.0.0.1" } 
 [Sat Jul 20 21:45:28.890523 2013] [auth_digest:error] [pid 17540:tid 140122972485376] [client 127.0.0.1:51408] AH01790: user `username' in realm `digest private area' not found: /digest_wrongrelm/cant_get_me.html
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-28T21:05:31", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:05:31.178340 2013] [auth_digest:error] [pid 24224:tid 139895539455744] [client 127.0.0.1:56906] AH01793: invalid qop `auth' received: /digest/qop_none/
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-28T21:12:44", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:12:44 2013] [error] [client 127.0.0.1] Digest: invalid nonce JDiBAA=db9372522295196b7ac31db99e10cd1106c received - length is not 52
+
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-28T21:16:37", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:16:37 2013] [error] [client 127.0.0.1] Digest: invalid nonce l19lgpDiBAZZZf1ec3d9613f3b3ef43660e3628d78455fd8b937 received - hash is not 6fda8bbcbcf85ff1ebfe7d1c43faba583bc53a02
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-28T21:18:11", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:18:11.769228 2013] [auth_digest:error] [pid 24752:tid 139895505884928] [client 127.0.0.1:56964] AH01776: invalid nonce b9YAiJDiBAZZZ1b1abe02d20063ea3b16b544ea1b0d981c1bafe received - hash is not d42d824dee7aaf50c3ba0a7c6290bd453e3dd35b
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-28T21:30:02", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:30:02 2013] [error] [client 127.0.0.1] Digest: realm mismatch - got `so far away' but expected `digest private area'
+
+# failJSON: { "time": "2013-07-28T21:27:56", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:27:56.549667 2013] [auth_digest:error] [pid 24835:tid 139895297222400] [client 127.0.0.1:57052] AH01788: realm mismatch - got `so far away' but expected `digest private area'
+
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-28T21:41:20", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:41:20 2013] [error] [client 127.0.0.1] Digest: unknown algorithm `super funky chicken' received: /digest/
+
+# failJSON: { "time": "2013-07-28T21:42:03", "match": true , "host": "127.0.0.1" }
+[Sun Jul 28 21:42:03.930190 2013] [auth_digest:error] [pid 24835:tid 139895505884928] [client 127.0.0.1:57115] AH01789: unknown algorithm `super funky chicken' received: /digest/

From 52aaa1c9bb5916e0d6be146cc154ae041ff5dc8d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 28 Jul 2013 22:01:51 +1000
Subject: [PATCH 463/544] TST: bad include of vim swap files

---
 .../apache-auth/digest_time/.htaccess.swp       | Bin 12288 -> 0 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 testcases/files/config/apache-auth/digest_time/.htaccess.swp

diff --git a/testcases/files/config/apache-auth/digest_time/.htaccess.swp b/testcases/files/config/apache-auth/digest_time/.htaccess.swp
deleted file mode 100644
index 1d14e6f29e6247f67d618dc791a6b6791672ed5f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 12288
zcmeI&!Aiq07zglgL-8bvdx1F5Tc<ndK@Z9h1RYbHSNYavF4C?wNn1Sm2tI&s;hXp-
z9=vPXO;8aByAA(=kB}x`lKyU`-=KAMawc}0ZE|g$=<)sSytY)O_JAnhaq)C!GYR`L
z;&C&KeGY>-V)bjHm$CNpJoiR63cWzxNMo<9ilo;ZS@wNt%*?Z}00I!0Lm;)o#@;Hm
zceYza_EvpU)HeEaY=jgDKmY;|fB*y_009U<U{M8ZQlSTT`ReoqR;GRBM?W2+g8&2|
z009U<00Izz00bZa0SG`~0R=c9T3#bMa8dmK|NQ=cb>kNo&n})^+`8zwDAw(}K!X4T
zAOHafKmY;|fB*y_009X68-WXXmntnq#-R!tsgarvQ#<OEmF?Yl?8{R%ltqQR*e+-K
zZppC<rTDWHK4D|>piDSoqx_zZGZjcJhA#EX37xXiUVN*hFQ>cgPOMJ~>_wtg##Rc}
PlI!L4<$WT><dXCOwwrD;


From 7b2773889d6d4e31dc9225d47fcd79fa275292dd Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Jul 2013 02:29:04 +1000
Subject: [PATCH 464/544] TST: apache-auth filter - nonce timetravel tests +
 other expression fixes

---
 config/filter.d/apache-auth.conf             | 10 ++--
 testcases/files/config/apache-auth/digest.py | 54 +++++++++++++++++++-
 testcases/files/logs/apache-auth             | 11 ++++
 3 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index d1a2ffcb..0db34523 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -35,11 +35,11 @@ failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server config
             ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
             ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$
             ^%(_apache_error_client)s (AH0179[01]: )?(Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
-            ^%(_apache_error_client)s (AH01631: )?user .* authorization failure for "\S*": \s*$
-            ^%(_apache_error_client)s (AH0177[56]: )?invalid nonce .* received - (length|hash) is not \S+\s*$
-            ^%(_apache_error_client)s (AH01788: )?realm mismatch - got `.*' but expected `.+'\s*$
-            ^%(_apache_error_client)s (AH01789: )?unknown algorithm `\S+' received: \S*\s*"$
-            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*"$
+            ^%(_apache_error_client)s (AH01631: )?user .*: authorization failure for "\S*":\s*$
+            ^%(_apache_error_client)s (AH0177[56]: )?(Digest: )?invalid nonce .* received - (length|hash) is not \S+\s*$
+            ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*' but expected `.+'\s*$
+            ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*' received: \S*\s*$
+            ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*$
             ^%(_apache_error_client)s (AH01777: )?invalid nonce .* received - user attempted time travel\s*$
             ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
             ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
diff --git a/testcases/files/config/apache-auth/digest.py b/testcases/files/config/apache-auth/digest.py
index ed0e18eb..c12b1b33 100755
--- a/testcases/files/config/apache-auth/digest.py
+++ b/testcases/files/config/apache-auth/digest.py
@@ -37,18 +37,19 @@ def auth(v):
 
 def preauth():
     r = requests.get(host + url)
+    print r
     r.headers['www-authenticate'].split(', ')
     return dict([ a.split('=',1) for a in r.headers['www-authenticate'].split(', ') ])
 
 
 url='/digest/'
-host = 'http://localhost:801'
+host = 'http://localhost:802'
 
 v = preauth()
 
-#print v
 username="username"
 password = "password"
+print v
 
 realm = 'so far away'
 r = auth(v)
@@ -97,3 +98,52 @@ time.sleep(1)
 r = auth(v)
 print r.status_code,r.headers, r.text
 
+# Obtained by putting the following code in modules/aaa/mod_auth_digest.c
+# in the function initialize_secret
+#    {
+#       const char *hex = "0123456789abcdef";
+#       char secbuff[SECRET_LEN * 4];
+#       char *hash = secbuff;
+#       int idx;
+
+#       for (idx=0; idx<sizeof(secret); idx++) {
+#       *hash++ = hex[secret[idx] >> 4];
+#       *hash++ = hex[secret[idx] & 0xF];
+#       }
+#       *hash = '\0';
+#       /* remove comment in below for apache-2.4+ */
+#       ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, /*  APLOGNO(11759) */ "secret: %s", secbuff);
+#   }
+
+
+import sha
+import binascii
+import base64
+import struct
+
+apachesecret = binascii.unhexlify('cc969f83b4029e672115f2e8ff7dd21a976728f9')
+s = sha.sha(apachesecret)
+
+v=preauth()
+
+print v['nonce']
+realm = v['Digest realm'][1:-1]
+
+(t,) = struct.unpack('l',base64.b64decode(v['nonce'][1:13]))
+
+# whee, time travel
+t = t + 5540
+
+timepac = base64.b64encode(struct.pack('l',t))
+
+s.update(realm)
+s.update(timepac)
+
+v['nonce'] =  v['nonce'][0] + timepac + s.hexdigest() + v['nonce'][-1]
+
+print v
+
+r = auth(v)
+#[Mon Jul 29 02:12:55.539813 2013] [auth_digest:error] [pid 9647:tid 139895522670336] [client 127.0.0.1:58474] AH01777: invalid nonce 59QJppTiBAA=b08983fd166ade9840407df1b0f75b9e6e07d88d received - user attempted time travel
+print r.status_code,r.headers, r.text
+
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index 95397cb5..915fabc1 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -50,6 +50,8 @@
 
 # failJSON: { "time": "2013-07-20T22:11:43", "match": true , "host": "127.0.0.1" } 
 [Sat Jul 20 22:11:43.147674 2013] [authz_owner:error] [pid 17540:tid 140122922129152] [client 127.0.0.1:51548] AH01637: Authorization of user username to access /basic/authz_owner/cant_get_me.html failed, reason: file owner dan does not match
+
+# wget --http-user=username --http-password=password http://localhost/basic/authz_owner/cant_get_me.html -O /dev/null
 # failJSON: { "time": "2013-07-20T21:42:44", "match": true , "host": "127.0.0.1" } 
 [Sat Jul 20 21:42:44.304159 2013] [authz_core:error] [pid 17484:tid 140123095914240] [client 127.0.0.1:51397] AH01631: user username: authorization failure for "/basic/authz_owner/cant_get_me.html": 
 
@@ -98,3 +100,12 @@
 
 # failJSON: { "time": "2013-07-28T21:42:03", "match": true , "host": "127.0.0.1" }
 [Sun Jul 28 21:42:03.930190 2013] [auth_digest:error] [pid 24835:tid 139895505884928] [client 127.0.0.1:57115] AH01789: unknown algorithm `super funky chicken' received: /digest/
+
+# ./testcases/files/config/apache-auth/digest.py
+# failJSON: { "time": "2013-07-29T02:15:26", "match": true , "host": "127.0.0.1" }
+[Mon Jul 29 02:15:26 2013] [error] [client 127.0.0.1] Digest: invalid nonce LWEDr5TiBAA=ceddd011628c30e3646f7acda4f1a0ab6b7c5ae6 received - user attempted time travel
+
+
+
+# failJSON: { "time": "2013-07-29T02:12:55", "match": true , "host": "127.0.0.1" }
+[Mon Jul 29 02:12:55.539813 2013] [auth_digest:error] [pid 9647:tid 139895522670336] [client 127.0.0.1:58474] AH01777: invalid nonce 59QJppTiBAA=b08983fd166ade9840407df1b0f75b9e6e07d88d received - user attempted time travel

From d8883f4346400c2cef937497b12e87df0a6d2876 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Jul 2013 08:59:25 +1000
Subject: [PATCH 465/544] DOC: Notes about 401 responses and how apache logs
 this

---
 config/filter.d/apache-auth.conf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 0db34523..2b1397cf 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -16,8 +16,9 @@ before = apache-common.conf
 # from the modules in aaa that return HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED or
 # HTTP_FORBIDDEN and not AUTH_GENERAL_ERROR or HTTP_INTERNAL_SERVER_ERROR.
 #
-# As an unauthorized response is the first step for a browser to instigate authentication
-# so don't set max retry too low.
+# An unauthorized response 401 is the first step for a browser to instigate authentication
+# however apache doesn't log this as an error. Only subsequent errors are logged in the 
+# error log.
 #
 # Source:
 #

From 04ff9450b51f21177fb6c34a57601cd5f9e136dc Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 29 Jul 2013 10:45:15 +1000
Subject: [PATCH 466/544] BF: testcases is a package that needs to be
 installed. Thanks to Michael Danko on irc

---
 setup.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index 1b6268bf..b61ecce4 100755
--- a/setup.py
+++ b/setup.py
@@ -53,7 +53,8 @@ setup(
 	packages =	[
 					'common',
 					'client',
-					'server'
+					'server',
+					'testcases'
 				],
 	data_files =	[
 						('/etc/fail2ban',

From c0a2e5055909132006371dc60419a4bb3384bfa2 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 6 Aug 2013 17:13:09 +1000
Subject: [PATCH 467/544] TST: apache auth - opaque value

---
 testcases/files/config/apache-auth/digest.py | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/testcases/files/config/apache-auth/digest.py b/testcases/files/config/apache-auth/digest.py
index c12b1b33..bed4067c 100755
--- a/testcases/files/config/apache-auth/digest.py
+++ b/testcases/files/config/apache-auth/digest.py
@@ -14,6 +14,7 @@ def auth(v):
     nonce = v['nonce'][1:-1]
     nc=v.get('nc') or ''
     cnonce = v.get('cnonce') or ''
+    opaque = v.get('opaque') or ''
     qop = v['qop'][1:-1]
     algorithm = v['algorithm']
     response = md5.new(ha1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + qop + ':' + ha2).hexdigest()
@@ -31,7 +32,8 @@ def auth(v):
         qop=%s,
         response="%s"
     """ % ( username, algorithm, realm, url, nonce, qop, response )
-    
+#        opaque="%s",
+    print p.method, p.url, p.headers
     s =  requests.Session()
     return s.send(p)
 
@@ -43,7 +45,7 @@ def preauth():
 
 
 url='/digest/'
-host = 'http://localhost:802'
+host = 'http://localhost:801'
 
 v = preauth()
 
@@ -111,7 +113,7 @@ print r.status_code,r.headers, r.text
 #       *hash++ = hex[secret[idx] & 0xF];
 #       }
 #       *hash = '\0';
-#       /* remove comment in below for apache-2.4+ */
+#       /* remove comment makings in below for apache-2.4+ */
 #       ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, /*  APLOGNO(11759) */ "secret: %s", secbuff);
 #   }
 
@@ -121,7 +123,7 @@ import binascii
 import base64
 import struct
 
-apachesecret = binascii.unhexlify('cc969f83b4029e672115f2e8ff7dd21a976728f9')
+apachesecret = binascii.unhexlify('497d8894adafa5ec7c8c981ddf9c8457da7a90ac')
 s = sha.sha(apachesecret)
 
 v=preauth()
@@ -147,3 +149,11 @@ r = auth(v)
 #[Mon Jul 29 02:12:55.539813 2013] [auth_digest:error] [pid 9647:tid 139895522670336] [client 127.0.0.1:58474] AH01777: invalid nonce 59QJppTiBAA=b08983fd166ade9840407df1b0f75b9e6e07d88d received - user attempted time travel
 print r.status_code,r.headers, r.text
 
+url='/digest_onetime/'
+v=preauth()
+
+# Need opaque header handling in auth
+r = auth(v)
+print r.status_code,r.headers, r.text
+r = auth(v)
+print r.status_code,r.headers, r.text

From 547c123cfb5dd66ecaa8390896e71ad03893dcf4 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Wed, 7 Aug 2013 22:56:57 -0400
Subject: [PATCH 468/544] BF: example.com is pointing to another IP now. 
 Closes #313

This is a permanent change according to private correspondence with
David Closson @ IANN, thus replaced 192.0.43.10 with updated IP
93.184.216.119, while leaving 192.0.43.10 as is in the sample log
files (it is still within IANN dedicated testing network).
---
 testcases/files/testcase-usedns.log |  2 +-
 testcases/filtertestcase.py         | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/testcases/files/testcase-usedns.log b/testcases/files/testcase-usedns.log
index 87c99fdb..a91fd7ac 100644
--- a/testcases/files/testcase-usedns.log
+++ b/testcases/files/testcase-usedns.log
@@ -1,2 +1,2 @@
 Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2
-Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:192.0.43.10 port 51332 ssh2
+Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index d918bbf7..b961d0dc 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -632,12 +632,12 @@ class GetFailures(unittest.TestCase):
 
 	def testGetFailuresUseDNS(self):
 		# We should still catch failures with usedns = no ;-)
-		output_yes = ('192.0.43.10', 2, 1124013539.0,
+		output_yes = ('93.184.216.119', 2, 1124013539.0,
 					  ['Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2\n',
-					   'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:192.0.43.10 port 51332 ssh2\n'])
+					   'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2\n'])
 
-		output_no = ('192.0.43.10', 1, 1124013539.0,
-					  ['Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:192.0.43.10 port 51332 ssh2\n'])
+		output_no = ('93.184.216.119', 1, 1124013539.0,
+					  ['Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2\n'])
 
 		# Actually no exception would be raised -- it will be just set to 'no'
 		#self.assertRaises(ValueError,
@@ -684,9 +684,9 @@ class DNSUtilsTests(unittest.TestCase):
 		res = DNSUtils.textToIp('www.example.com', 'no')
 		self.assertEqual(res, [])
 		res = DNSUtils.textToIp('www.example.com', 'warn')
-		self.assertEqual(res, ['192.0.43.10'])
+		self.assertEqual(res, ['93.184.216.119'])
 		res = DNSUtils.textToIp('www.example.com', 'yes')
-		self.assertEqual(res, ['192.0.43.10'])
+		self.assertEqual(res, ['93.184.216.119'])
 
 	def testTextToIp(self):
 		# Test hostnames
@@ -698,7 +698,7 @@ class DNSUtilsTests(unittest.TestCase):
 		for s in hostnames:
 			res = DNSUtils.textToIp(s, 'yes')
 			if s == 'www.example.com':
-				self.assertEqual(res, ['192.0.43.10'])
+				self.assertEqual(res, ['93.184.216.119'])
 			else:
 				self.assertEqual(res, [])
 

From c0456fd835f3ba8989ff207ff26e5d464ed620c4 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 8 Aug 2013 09:47:47 -0400
Subject: [PATCH 469/544] BF: Fixing a name for MySQL date pattern which
 misplaced Year (should not effect functionality) Closes #312

---
 server/datedetector.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 0ed9e00a..0bbbc089 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -151,7 +151,7 @@ class DateDetector:
 			self._appendTemplate(template)
 			# MySQL: 130322 11:46:11
 			template = DateStrptime()
-			template.setName("MonthDayYear Hour:Minute:Second")
+			template.setName("YearMonthDay Hour:Minute:Second")
 			template.setRegex("^\d{2}\d{2}\d{2} +\d{1,2}:\d{2}:\d{2}")
 			template.setPattern("%y%m%d %H:%M:%S")
 			self._appendTemplate(template)

From 9487ee55629068f8e0dd716485b9844b0be64518 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 8 Aug 2013 09:54:15 -0400
Subject: [PATCH 470/544] minor: consistent indentation in dropbear.conf

---
 config/filter.d/dropbear.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/dropbear.conf b/config/filter.d/dropbear.conf
index b48615e6..6f34c1ba 100644
--- a/config/filter.d/dropbear.conf
+++ b/config/filter.d/dropbear.conf
@@ -29,7 +29,7 @@ _daemon = dropbear
 #
 failregex = ^%(__prefix_line)s(L|l)ogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
             ^%(__prefix_line)s(B|b)ad password attempt for .+ from <HOST>:.*\s*$
-	     ^%(__prefix_line)sExit before auth \(user .+, \d+ fails\): Max auth tries reached - user .+ from <HOST>:.*\s*$
+            ^%(__prefix_line)sExit before auth \(user .+, \d+ fails\): Max auth tries reached - user .+ from <HOST>:.*\s*$
 
 # The only line we need to match with the modified dropbear.
 

From 4e0ddc5f67df99e91bf27220fd275277b9efcff1 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 8 Aug 2013 09:58:36 -0400
Subject: [PATCH 471/544] ENH: hardened added dropbear failregex to avoid
 trailing .* and enclose username in ''

---
 config/filter.d/dropbear.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/dropbear.conf b/config/filter.d/dropbear.conf
index 6f34c1ba..350747c6 100644
--- a/config/filter.d/dropbear.conf
+++ b/config/filter.d/dropbear.conf
@@ -29,7 +29,7 @@ _daemon = dropbear
 #
 failregex = ^%(__prefix_line)s(L|l)ogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
             ^%(__prefix_line)s(B|b)ad password attempt for .+ from <HOST>:.*\s*$
-            ^%(__prefix_line)sExit before auth \(user .+, \d+ fails\): Max auth tries reached - user .+ from <HOST>:.*\s*$
+            ^%(__prefix_line)sExit before auth \(user '.+', \d+ fails\): Max auth tries reached - user '.+' from <HOST>:\d+\s*$
 
 # The only line we need to match with the modified dropbear.
 

From e4dad8dfc945d8c04c7831dd329f3cbfa297c938 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 8 Aug 2013 22:00:17 -0400
Subject: [PATCH 472/544] TST: SYSLOG present only on Linuxes thus do not test
 if not Linux

---
 testcases/servertestcase.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/testcases/servertestcase.py b/testcases/servertestcase.py
index 07cc373c..0af8f920 100644
--- a/testcases/servertestcase.py
+++ b/testcases/servertestcase.py
@@ -24,7 +24,7 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest, socket, time, tempfile, os
+import unittest, socket, time, tempfile, os, sys
 from server.server import Server
 from server.jail import Jail
 from common.exceptions import UnknownJailException
@@ -498,7 +498,8 @@ class TransmitterLogging(TransmitterBase):
 
 		self.setGetTest("logtarget", "STDOUT")
 		self.setGetTest("logtarget", "STDERR")
-		self.setGetTest("logtarget", "SYSLOG")
+		if sys.platform.lower().startswith('linux'):
+			self.setGetTest("logtarget", "SYSLOG")
 
 	def testLogLevel(self):
 		self.setGetTest("loglevel", "4", 4)

From 67497db6e56130792d12c87b32d536f47e84e071 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@cora.nwra.com>
Date: Thu, 8 Aug 2013 20:28:55 -0600
Subject: [PATCH 473/544] Change /tmp/fail2ban.sock to
 /var/run/fail2ban/fail2ban.sock

---
 client/fail2banreader.py | 2 +-
 files/nagios/README      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/fail2banreader.py b/client/fail2banreader.py
index ada88084..0171b457 100644
--- a/client/fail2banreader.py
+++ b/client/fail2banreader.py
@@ -39,7 +39,7 @@ class Fail2banReader(ConfigReader):
 		ConfigReader.read(self, "fail2ban")
 	
 	def getEarlyOptions(self):
-		opts = [["string", "socket", "/tmp/fail2ban.sock"],
+		opts = [["string", "socket", "/var/run/fail2ban/fail2ban.sock"],
 				["string", "pidfile", "/var/run/fail2ban/fail2ban.pid"]]
 		return ConfigReader.getOptions(self, "Definition", opts)
 	
diff --git a/files/nagios/README b/files/nagios/README
index 28e84495..2b855d83 100644
--- a/files/nagios/README
+++ b/files/nagios/README
@@ -35,7 +35,7 @@ HELP:
 /etc/init.d/fail2ban stop
 
 2.) delete the socket if available
-rm /tmp/fail2ban.sock
+rm /var/run/fail2ban/fail2ban.sock
 
 3.) start the Service 
 /etc/init.d/fail2ban start

From 511e0ace2e6081ef9b0378db961e232af13591eb Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 8 Aug 2013 22:25:14 -0400
Subject: [PATCH 474/544] TST: Even more of conditioning of tests for cygwin

---
 testcases/clientreadertestcase.py | 9 +++++++--
 testcases/filtertestcase.py       | 8 +++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index 4e8cdd9d..b52ad618 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -21,7 +21,7 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2013 Yaroslav Halchenko"
 __license__ = "GPL"
 
-import os, shutil, tempfile, unittest
+import os, tempfile, shutil, unittest
 from client.configreader import ConfigReader
 from client.jailreader import JailReader
 from client.jailsreader import JailsReader
@@ -65,7 +65,12 @@ option = %s
 		self._write('d.conf', 0)
 		self.assertEqual(self._getoption('d'), 0)
 		os.chmod(f, 0)
-		self.assertFalse(self.c.read('d'))	# should not be readable BUT present
+		# fragile test and known to fail e.g. under Cygwin where permissions
+		# seems to be not enforced, thus condition
+		if not os.access('d.conf', os.R_OK):
+			self.assertFalse(self.c.read('d'))	# should not be readable BUT present
+		else:
+			raise unittest.SkipTest("Skipping on %s -- access rights are not enforced" % platform)
 
 
 	def testOptionalDotDDir(self):
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index b961d0dc..ecdc7bde 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -83,7 +83,13 @@ def _assert_equal_entries(utest, found, output, count=None):
 	utest.assertEqual(found_time, output_time)
 	if len(output) > 3 and count is None: # match matches
 		# do not check if custom count (e.g. going through them twice)
-		utest.assertEqual(repr(found[3]), repr(output[3]))
+		if os.linesep != '\n' or sys.platform.startswith('cygwin'):
+			# on those where text file lines end with '\r\n', override
+			# repr for this test to disregard trailing CR LF
+			srepr = lambda x: repr(str(x).rstrip('\n\r'))
+		else:
+			srepr = repr
+		utest.assertEqual(srepr(found[3]), srepr(output[3]))
 
 def _assert_correct_last_attempt(utest, filter_, output, count=None):
 	"""Additional helper to wrap most common test case

From 31a78b271143cb652aca70579b75bab78efb85eb Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@cora.nwra.com>
Date: Thu, 8 Aug 2013 20:41:44 -0600
Subject: [PATCH 475/544] Use /var/run/fail2ban in config/action.d/dummy.conf

---
 config/action.d/dummy.conf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/action.d/dummy.conf b/config/action.d/dummy.conf
index 20507c0b..dc4e1dbf 100644
--- a/config/action.d/dummy.conf
+++ b/config/action.d/dummy.conf
@@ -10,14 +10,14 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = touch /tmp/fail2ban.dummy
-              printf %%b "<init>\n" >> /tmp/fail2ban.dummy
+actionstart = touch /var/run/fail2ban/fail2ban.dummy
+              printf %%b "<init>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = rm -f /tmp/fail2ban.dummy
+actionstop = rm -f /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -31,7 +31,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
+actionban = printf %%b "+<ip>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -39,7 +39,7 @@ actionban = printf %%b "+<ip>\n" >> /tmp/fail2ban.dummy
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionunban = printf %%b "-<ip>\n" >> /tmp/fail2ban.dummy
+actionunban = printf %%b "-<ip>\n" >> /var/run/fail2ban/fail2ban.dummy
 
 [Init]
 

From 2aa8ddea4d6f60e74a33765a5e6068374c566e4f Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 8 Aug 2013 22:58:06 -0400
Subject: [PATCH 476/544] BF: fixed up conditioning of tests under cygwin
 (still 3 fail)

---
 testcases/clientreadertestcase.py | 6 ++++--
 testcases/filtertestcase.py       | 5 ++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/testcases/clientreadertestcase.py b/testcases/clientreadertestcase.py
index b52ad618..65c3bbc2 100644
--- a/testcases/clientreadertestcase.py
+++ b/testcases/clientreadertestcase.py
@@ -67,10 +67,12 @@ option = %s
 		os.chmod(f, 0)
 		# fragile test and known to fail e.g. under Cygwin where permissions
 		# seems to be not enforced, thus condition
-		if not os.access('d.conf', os.R_OK):
+		if not os.access(f, os.R_OK):
 			self.assertFalse(self.c.read('d'))	# should not be readable BUT present
 		else:
-			raise unittest.SkipTest("Skipping on %s -- access rights are not enforced" % platform)
+			# SkipTest introduced only in 2.7 thus can't yet use generally
+			# raise unittest.SkipTest("Skipping on %s -- access rights are not enforced" % platform)
+			pass
 
 
 	def testOptionalDotDDir(self):
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index ecdc7bde..2061327a 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -84,9 +84,8 @@ def _assert_equal_entries(utest, found, output, count=None):
 	if len(output) > 3 and count is None: # match matches
 		# do not check if custom count (e.g. going through them twice)
 		if os.linesep != '\n' or sys.platform.startswith('cygwin'):
-			# on those where text file lines end with '\r\n', override
-			# repr for this test to disregard trailing CR LF
-			srepr = lambda x: repr(str(x).rstrip('\n\r'))
+			# on those where text file lines end with '\r\n', remove '\r'
+			srepr = lambda x: repr(x).replace(r'\r', '')
 		else:
 			srepr = repr
 		utest.assertEqual(srepr(found[3]), srepr(output[3]))

From 9002de069ebe13a59ee9bada65763120b4290a4f Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 9 Aug 2013 18:54:08 +0100
Subject: [PATCH 477/544] ENH: Improve proftpd regex.

Taken from @yarikoptic comment:
https://github.com/fail2ban/fail2ban/pull/303#discussion_r5687500
---
 config/filter.d/proftpd.conf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index d17658ce..872ab0ca 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -22,8 +22,10 @@ _deamon = proftpd
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
+
+__suffix_failed_login = (User not authorized|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit (access|configuration) denies login|Not a UserAlias|maximum login length exceeded).?
 failregex = ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
-            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): .*$
+            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): %(__suffix_failed_login)s\s*$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
 

From 53e16e07addb827ab11e608cd4204f0513f09ec4 Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Fri, 9 Aug 2013 19:04:26 +0100
Subject: [PATCH 478/544] ENH: Minor tweak on previous commit proftpd regex
 changes

---
 config/filter.d/proftpd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 872ab0ca..d3120216 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -23,7 +23,7 @@ _deamon = proftpd
 # Values: TEXT
 #
 
-__suffix_failed_login = (User not authorized|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit (access|configuration) denies login|Not a UserAlias|maximum login length exceeded).?
+__suffix_failed_login = (User not authorized for login|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit (access|configuration) denies login|Not a UserAlias|maximum login length exceeded).?
 failregex = ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): %(__suffix_failed_login)s\s*$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$

From d3ce9e860fd42941ddb16a9ebafe18a193fc4b8c Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Fri, 9 Aug 2013 14:39:06 -0600
Subject: [PATCH 479/544] Install empty /etc/fail2ban/jail.d directory

---
 setup.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/setup.py b/setup.py
index b61ecce4..f401d79c 100755
--- a/setup.py
+++ b/setup.py
@@ -66,6 +66,9 @@ setup(
 						('/etc/fail2ban/action.d',
 							glob("config/action.d/*.conf")
 						),
+						('/etc/fail2ban/jail.d',
+							''
+						),
 						('/var/run/fail2ban',
 							''
 						),

From 5d451bc4d6e5d18f583df56c9899c04eb8fd084e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 18 Aug 2013 22:19:31 +1000
Subject: [PATCH 480/544] ENH: add refused zone tranfer to named-refused
 filter. closes #323

---
 ChangeLog                          | 2 ++
 THANKS                             | 1 +
 config/filter.d/named-refused.conf | 1 +
 testcases/files/logs/named-refused | 2 ++
 4 files changed, 6 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 51539e8c..ccb56b67 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -61,6 +61,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Steven Hiscocks
    * filter.d/dovecot - Addition of session, time values and possible blank
      user
+  Zurd and Daniel Black
+   * filter/named-refused - added refused on zone transfer
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
diff --git a/THANKS b/THANKS
index b853c0dc..76c9f000 100644
--- a/THANKS
+++ b/THANKS
@@ -56,3 +56,4 @@ Yaroslav Halchenko
 ykimon
 Yehuda Katz
 zugeschmiert
+Zurd
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index 1cdc626e..e30afee7 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -26,6 +26,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 # Values: TEXT
 #
 failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
+            %(__line_prefix)sclient <HOST>#\S+: zone transfer '\S+/AXFR/\w+' denied\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 6f6092e2..7a77919f 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -10,3 +10,5 @@ Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shi
 Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied
 # failJSON: { "time": "2005-07-24T14:23:36", "match": true , "host": "62.109.4.89" }
 Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied
+# failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" }
+11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied

From 444e989dd5f6995197065b6654ea14d1f14d3523 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 18 Aug 2013 22:49:59 +1000
Subject: [PATCH 481/544] TST: another zone transfer refused example for file
 named-refused

---
 testcases/files/logs/named-refused | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 7a77919f..6746e72a 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -12,3 +12,6 @@ Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mie
 Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied
 # failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" }
 11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied
+# failJSON: { "time": "2005-08-17T08:20:22", "match": true , "host": "223.252.23.219" }
+Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone transfer 'openquery.eu/AXFR/IN' denied
+

From 4f39d2b1fdf8feaa2abf67fb40b68eca7aeeaa85 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 18 Aug 2013 23:04:53 +1000
Subject: [PATCH 482/544] TST: fix failJson year

---
 testcases/files/logs/named-refused | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 6746e72a..04b0e34f 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -12,6 +12,6 @@ Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mie
 Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query (cache) './NS/IN' denied
 # failJSON: { "time": "2013-08-11T03:36:11", "match": true , "host": "1.2.3.4" }
 11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied
-# failJSON: { "time": "2005-08-17T08:20:22", "match": true , "host": "223.252.23.219" }
+# failJSON: { "time": "2004-08-17T08:20:22", "match": true , "host": "223.252.23.219" }
 Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone transfer 'openquery.eu/AXFR/IN' denied
 

From 61d43608ae4d6a142469c91ec4c0611cf117a08d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 19 Aug 2013 18:32:07 +1000
Subject: [PATCH 483/544] ENH: filter.d/postfix - add filter for VRFY. Closes
 gh-322

---
 ChangeLog                    | 3 +++
 config/filter.d/postfix.conf | 1 +
 testcases/files/logs/postfix | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 237ef672..0252e9fd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -63,6 +63,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      regex impovements
    * IMPORTANT: 'lighttpd-fastcgi' filter has been renamed to 'suhosin', which
      will require changing in jail.{conf,local} if using this filter.
+  Zurd
+   * filter.d/postfix - add filter for VRFY failures. closes gh-322.
+
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf
index b70f0377..da981733 100644
--- a/config/filter.d/postfix.conf
+++ b/config/filter.d/postfix.conf
@@ -24,6 +24,7 @@ _daemon = postfix/smtpd
 #
 failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
             ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
+            ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/postfix b/testcases/files/logs/postfix
index 172bfca4..122ad8e5 100644
--- a/testcases/files/logs/postfix
+++ b/testcases/files/logs/postfix
@@ -8,3 +8,5 @@ Jul 12 07:47:48 saturn postfix/smtpd[8738]: NOQUEUE: reject: RCPT from 1-2-3-4-e
 Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.65]: 554 5.7.1 <bad.domain>: Helo command rejected: match bad.domain; from=<foo@good.domain> to=<foo@porcupine.org> proto=SMTP helo=<bad.domain>
 # failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.43" }
 Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.43]: 554 5.7.1 <foo@bad.domain>: Sender address rejected: match bad.domain; from=<foo@bad.domain> to=<foo@porcupine.org> proto=SMTP helo=<192.51.100.43>
+# failJSON: { "time": "2005-08-10T10:55:38", "match": true , "host": "72.53.132.234" }
+Aug 10 10:55:38 f-vanier-bourgeois postfix/smtpd[2162]: NOQUEUE: reject: VRFY from 72-53-132-234.cpe.distributel.net[72.53.132.234]: 550 5.1.1 : Recipient address rejected: User unknown in local recipient tab

From ed42b08789525afb1138b9b0508aad22cdfb4839 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 19 Aug 2013 21:22:17 +1000
Subject: [PATCH 484/544] TST: merge dropbear log samples

---
 testcases/files/logs/dropbear | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/testcases/files/logs/dropbear b/testcases/files/logs/dropbear
index 5a2e197a..139292d7 100644
--- a/testcases/files/logs/dropbear
+++ b/testcases/files/logs/dropbear
@@ -2,3 +2,8 @@
 Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
 # failJSON: { "time": "2005-02-11T15:23:17", "match": true , "host": "198.51.100.215" }
 Feb 11 15:23:17 dropbear[1252]: login attempt for nonexistent user from ::ffff:198.51.100.215:60495
+# failJSON: { "time": "2005-03-24T15:25:51", "match": true , "host": "198.51.100.87" }
+Mar 24 15:25:51 buffalo1 dropbear[4092]: bad password attempt for 'root' from 198.51.100.87:5543
+# failJSON: { "time": "2005-02-11T15:23:17", "match": true , "host": "198.51.100.215" }
+Feb 11 15:23:17 dropbear[1252]: login attempt for nonexistent user from ::ffff:198.51.100.215:60495
+

From ea7cba420598fa2a38b2ce01fc9737cba5c03eaa Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 19 Aug 2013 21:42:43 +1000
Subject: [PATCH 485/544] ENH: trailing space as per discussion on gh-303

---
 config/filter.d/wuftpd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/wuftpd.conf b/config/filter.d/wuftpd.conf
index 5c1cbb58..de98d02d 100644
--- a/config/filter.d/wuftpd.conf
+++ b/config/filter.d/wuftpd.conf
@@ -18,7 +18,7 @@ _daemon = wu-ftpd
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = ^%(__prefix_line)sfailed login from \S+ \[<HOST>\]$
+failregex = ^%(__prefix_line)sfailed login from \S+ \[<HOST>\]\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From c44328b1a3922fbdb255f6f66282547ea2621e07 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 19 Aug 2013 22:04:55 +1000
Subject: [PATCH 486/544] ENH: new "realm mismatch" message from
 https://issues.apache.org/bugzilla/show_bug.cgi?id=55284#c8

---
 config/filter.d/apache-auth.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 2b1397cf..811017e3 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -44,6 +44,7 @@ failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server config
             ^%(_apache_error_client)s (AH01777: )?invalid nonce .* received - user attempted time travel\s*$
             ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
             ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
+            ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
 
 
 

From 6a36ff1a4a4e0b6bf01cf062d56449a7554da506 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 19 Aug 2013 22:36:58 +1000
Subject: [PATCH 487/544] BF: order mailx arguments with dest email address
 last - redhat bugzilla 998020. Closes gh-328

---
 ChangeLog                     | 9 ++++++---
 THANKS                        | 1 +
 config/action.d/complain.conf | 2 +-
 config/action.d/dshield.conf  | 6 +++---
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 51539e8c..0d088e0b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -27,9 +27,12 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black & Мернов Георгий
    * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in ,
   Daniel Black
-  * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
-    all platforms to ensure permissions are the same before and after a ban -
-		closes gh-266. hostsdeny supports daemon_list now too.
+   * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
+     all platforms to ensure permissions are the same before and after a ban -
+     closes gh-266. hostsdeny supports daemon_list now too.
+  Rolf Fokkens
+   * action.d/dshield.conf and complain.conf -- reorder mailx arguements.
+	   https://bugzilla.redhat.com/show_bug.cgi?id=998020
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
diff --git a/THANKS b/THANKS
index b853c0dc..ac9eee30 100644
--- a/THANKS
+++ b/THANKS
@@ -42,6 +42,7 @@ Patrick Börjesson
 Raphaël Marichez
 René Berber
 Robert Edeker
+Rolf Fokkens
 Russell Odom
 Sebastian Arcus
 Sireyessire
diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf
index 4c2de92b..57f19135 100644
--- a/config/action.d/complain.conf
+++ b/config/action.d/complain.conf
@@ -58,7 +58,7 @@ actioncheck =
 actionban = ADDRESSES=`whois <ip> | perl -e 'while (<STDIN>) { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'`
 	    IP=<ip>
             if [ ! -z "$ADDRESSES" ]; then
-                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep '<ip>' <logpath>) | <mailcmd> "Abuse from <ip>" $ADDRESSES <mailargs>
+                (printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; grep '<ip>' <logpath>) | <mailcmd> "Abuse from <ip>" <mailargs> $ADDRESSES
             fi
 
 # Option:  actionunban
diff --git a/config/action.d/dshield.conf b/config/action.d/dshield.conf
index ca68e638..29ed3043 100644
--- a/config/action.d/dshield.conf
+++ b/config/action.d/dshield.conf
@@ -39,7 +39,7 @@ actionstart =
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile>.buffer ]; then
-                 cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <dest> <mailargs>
+                 cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <mailargs> <dest>
                  date +%%s > <tmpfile>.lastsent
              fi
              rm -f <tmpfile>.buffer <tmpfile>.first
@@ -80,7 +80,7 @@ actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
             LASTREPORT=$(($NOW - `cat <tmpfile>.lastsent`))
             LINES=$( wc -l <tmpfile>.buffer | awk '{ print $1 }' )
             if [ $LINES -ge <lines> && $LASTREPORT -gt <minreportinterval> ] || [ $LOGAGE -gt <maxbufferage> ]; then
-                cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <dest> <mailargs>
+                cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <mailargs> <dest>
                 rm -f <tmpfile>.buffer <tmpfile>.first
                 echo $NOW > <tmpfile>.lastsent
             fi
@@ -95,7 +95,7 @@ actionunban = if [ -f <tmpfile>.first ]; then
                   NOW=`date +%%s`
                   LOGAGE=$(($NOW - `cat <tmpfile>.first`))
                   if [ $LOGAGE -gt <maxbufferage> ]; then
-                      cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <dest> <mailargs>
+                      cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <mailargs> <dest>
                       rm -f <tmpfile>.buffer <tmpfile>.first
                       echo $NOW > <tmpfile>.lastsent
                   fi

From aad7d08451a87465553fe08cc5d28d8805c65d51 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 20 Aug 2013 07:33:35 +1000
Subject: [PATCH 488/544] BF: disable filter expressions without tests

---
 config/filter.d/apache-auth.conf | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 811017e3..7adb0fcf 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -28,6 +28,11 @@ before = apache-common.conf
 # to return the actual failure.
 #
 # See also: http://wiki.apache.org/httpd/ListOfErrors
+# Expressions that don't have tests and aren't common.
+# more be added with  https://issues.apache.org/bugzilla/show_bug.cgi?id=55284 
+#     ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
+#     ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
+#     ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
 #
 failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*\s*$
             ^%(_apache_error_client)s (AH01617: )?user .* authentication failure for "\S*": Password Mismatch$
@@ -42,10 +47,6 @@ failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server config
             ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*' received: \S*\s*$
             ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*$
             ^%(_apache_error_client)s (AH01777: )?invalid nonce .* received - user attempted time travel\s*$
-            ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
-            ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
-            ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
-
 
 
 # Option:  ignoreregex

From 0204cec5ce98ed3afaa3435cc230cba93d214ea9 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 17:06:10 +1000
Subject: [PATCH 489/544] TST: www.example.com DNS changed

---
 testcases/files/testcase-usedns.log |  2 +-
 testcases/filtertestcase.py         | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/testcases/files/testcase-usedns.log b/testcases/files/testcase-usedns.log
index 87c99fdb..a91fd7ac 100644
--- a/testcases/files/testcase-usedns.log
+++ b/testcases/files/testcase-usedns.log
@@ -1,2 +1,2 @@
 Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2
-Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:192.0.43.10 port 51332 ssh2
+Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index d918bbf7..b961d0dc 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -632,12 +632,12 @@ class GetFailures(unittest.TestCase):
 
 	def testGetFailuresUseDNS(self):
 		# We should still catch failures with usedns = no ;-)
-		output_yes = ('192.0.43.10', 2, 1124013539.0,
+		output_yes = ('93.184.216.119', 2, 1124013539.0,
 					  ['Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2\n',
-					   'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:192.0.43.10 port 51332 ssh2\n'])
+					   'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2\n'])
 
-		output_no = ('192.0.43.10', 1, 1124013539.0,
-					  ['Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:192.0.43.10 port 51332 ssh2\n'])
+		output_no = ('93.184.216.119', 1, 1124013539.0,
+					  ['Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2\n'])
 
 		# Actually no exception would be raised -- it will be just set to 'no'
 		#self.assertRaises(ValueError,
@@ -684,9 +684,9 @@ class DNSUtilsTests(unittest.TestCase):
 		res = DNSUtils.textToIp('www.example.com', 'no')
 		self.assertEqual(res, [])
 		res = DNSUtils.textToIp('www.example.com', 'warn')
-		self.assertEqual(res, ['192.0.43.10'])
+		self.assertEqual(res, ['93.184.216.119'])
 		res = DNSUtils.textToIp('www.example.com', 'yes')
-		self.assertEqual(res, ['192.0.43.10'])
+		self.assertEqual(res, ['93.184.216.119'])
 
 	def testTextToIp(self):
 		# Test hostnames
@@ -698,7 +698,7 @@ class DNSUtilsTests(unittest.TestCase):
 		for s in hostnames:
 			res = DNSUtils.textToIp(s, 'yes')
 			if s == 'www.example.com':
-				self.assertEqual(res, ['192.0.43.10'])
+				self.assertEqual(res, ['93.184.216.119'])
 			else:
 				self.assertEqual(res, [])
 

From 1d9702be323eab8232ecf60293e314e8c0fb4393 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 17:34:36 +1000
Subject: [PATCH 490/544] TST: datetime mismatch to show error line

---
 testcases/samplestestcase.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index 54afc864..e5a7723f 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -110,10 +110,12 @@ def testSampleRegexsFactory(name):
 				# Verify timestamp and host as expected
 				failregex, host, time = ret[0]
 				self.assertEqual(host, faildata.get("host", None))
-				self.assertEqual(
-					datetime.datetime.fromtimestamp(time),
-					datetime.datetime.strptime(
-						faildata.get("time", None), "%Y-%m-%dT%H:%M:%S"))
+				fail2banTime = datetime.datetime.fromtimestamp(time)
+				jsonTime = datetime.datetime.strptime(
+							faildata.get("time", None), "%Y-%m-%dT%H:%M:%S")
+				
+				self.assertEqual(fail2banTime, jsonTime,
+					"Time mismatch %s != %s on %s:" % ( fail2banTime, jsonTime, line ) )
 
 				regexsUsed.add(failregex)
 

From 21914d155e950abcba5773263c23ae2fea1794dd Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 17:49:09 +1000
Subject: [PATCH 491/544] TST: add failJSON data

---
 testcases/files/logs/apache-auth | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index 7714c4bb..b2aa75ff 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -4,7 +4,10 @@
 
 # should match
 # from https://github.com/fail2ban/fail2ban/issues/286
+# failJSON: { "time": "2013-07-11T01:21:41", "match": true , "host": "194.228.20.113" } 
 [Thu Jul 11 01:21:41 2013] [error] [client 194.228.20.113] user  not found: /
+
+# failJSON: { "time": "2013-07-11T01:21:43", "match": true , "host": "194.228.20.113" } 
 [Thu Jul 11 01:21:43 2013] [error] [client 194.228.20.113] user dsfasdf not found: /
 
 # The failures below use the configuration described in testcases/files/config/apache-auth
@@ -109,5 +112,5 @@
 # failJSON: { "time": "2013-07-29T02:12:55", "match": true , "host": "127.0.0.1" }
 [Mon Jul 29 02:12:55.539813 2013] [auth_digest:error] [pid 9647:tid 139895522670336] [client 127.0.0.1:58474] AH01777: invalid nonce 59QJppTiBAA=b08983fd166ade9840407df1b0f75b9e6e07d88d received - user attempted time travel
 
-# failJSON: { "time": "2005-06-01T02:17:42", "match": true , "host": "192.168.0.2" }
+# failJSON: { "time": "2013-06-01T02:17:42", "match": true , "host": "192.168.0.2" }
 [Sat Jun 01 02:17:42 2013] [error] [client 192.168.0.2] user root not found

From c84a2e595a80390916a1981f71c775c2906b3080 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sat, 24 Aug 2013 22:55:10 -0400
Subject: [PATCH 492/544] ENH(BF): put 'standard' template after more detailed
 ones with day of week and year

otherwise years present in the freshly contributed by Dan apache regexes do not match
although should have.  I had also to adjust failing now vsftpd test
---
 ChangeLog                   |  2 ++
 server/datedetector.py      | 12 ++++++------
 testcases/files/logs/vsftpd |  2 +-
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index edb30055..f06e46a9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -57,6 +57,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      enabled jail. Closes gh-63
    * <HOST> is now enforced to end with an alphanumeric
    * filter.d/roundcube-auth.conf -- anchored version
+   * date matching - for standard asctime formats prefer more detailed
+     first (thus use year if available)
   Alexander Dietrich
    * action.d/sendmail-common.conf -- added common sendmail settings file
      and made the sender display name configurable
diff --git a/server/datedetector.py b/server/datedetector.py
index 0ed9e00a..0f0feb6d 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -46,12 +46,6 @@ class DateDetector:
 	def addDefaultTemplate(self):
 		self.__lock.acquire()
 		try:
-			# standard
-			template = DateStrptime()
-			template.setName("MONTH Day Hour:Minute:Second")
-			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
-			template.setPattern("%b %d %H:%M:%S")
-			self._appendTemplate(template)
 			# asctime
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second Year")
@@ -64,6 +58,12 @@ class DateDetector:
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%a %b %d %H:%M:%S")
 			self._appendTemplate(template)
+			# standard - most loose from above 3 so by default follows after
+			template = DateStrptime()
+			template.setName("MONTH Day Hour:Minute:Second")
+			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%b %d %H:%M:%S")
+			self._appendTemplate(template)
 			# simple date
 			template = DateStrptime()
 			template.setName("Year/Month/Day Hour:Minute:Second")
diff --git a/testcases/files/logs/vsftpd b/testcases/files/logs/vsftpd
index f3fb997f..ac6d0454 100644
--- a/testcases/files/logs/vsftpd
+++ b/testcases/files/logs/vsftpd
@@ -5,6 +5,6 @@ Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid
 Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1
 
 #2 Internal
-# failJSON: { "time": "2005-01-19T12:20:33", "match": true , "host": "64.106.46.98" }
+# failJSON: { "time": "2007-01-19T12:20:33", "match": true , "host": "64.106.46.98" }
 Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.98"
 

From 8e467437b251f94c818cb280012c7030b60081af Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 18:09:39 +1000
Subject: [PATCH 493/544] TST: fix year on asctime

---
 testcases/files/logs/apache-nohome    | 4 ++--
 testcases/files/logs/apache-noscript  | 4 ++--
 testcases/files/logs/apache-overflows | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/testcases/files/logs/apache-nohome b/testcases/files/logs/apache-nohome
index aea0d816..78327a62 100644
--- a/testcases/files/logs/apache-nohome
+++ b/testcases/files/logs/apache-nohome
@@ -1,6 +1,6 @@
 # Apache 2.2
-# failJSON: { "time": "2005-06-01T11:23:08", "match": true , "host": "1.2.3.4" }
+# failJSON: { "time": "2013-06-01T11:23:08", "match": true , "host": "1.2.3.4" }
 [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4] File does not exist: /xxx/~
 # Apache 2.4
-# failJSON: { "time": "2005-06-27T11:55:44", "match": true , "host": "192.0.2.12" }
+# failJSON: { "time": "2013-06-27T11:55:44", "match": true , "host": "192.0.2.12" }
 [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 192.0.2.12:46652] AH00128: File does not exist: /xxx/~
diff --git a/testcases/files/logs/apache-noscript b/testcases/files/logs/apache-noscript
index 172bb510..53e33baf 100644
--- a/testcases/files/logs/apache-noscript
+++ b/testcases/files/logs/apache-noscript
@@ -1,4 +1,4 @@
-# failJSON: { "time": "2005-06-09T07:57:47", "match": true , "host": "192.0.43.10" }
+# failJSON: { "time": "2013-06-09T07:57:47", "match": true , "host": "192.0.43.10" }
 [Sun Jun 09 07:57:47 2013] [error] [client 192.0.43.10] script '/usr/lib/cgi-bin/gitweb.cgiwp-login.php' not found or unable to stat
-# failJSON: { "time": "2005-07-22T06:48:30", "match": true , "host": "198.51.100.86" }
+# failJSON: { "time": "2008-07-22T06:48:30", "match": true , "host": "198.51.100.86" }
 [Tue Jul 22 06:48:30 2008] [error] [client 198.51.100.86] File does not exist: /home/southern/public_html/azenv.php
diff --git a/testcases/files/logs/apache-overflows b/testcases/files/logs/apache-overflows
index 1af377f1..d40c1c4f 100644
--- a/testcases/files/logs/apache-overflows
+++ b/testcases/files/logs/apache-overflows
@@ -1,4 +1,4 @@
-# failJSON: { "time": "2005-03-16T15:39:29", "match": true , "host": "58.179.109.179" }
+# failJSON: { "time": "2010-03-16T15:39:29", "match": true , "host": "58.179.109.179" }
 [Tue Mar 16 15:39:29 2010] [error] [client 58.179.109.179] Invalid URI in request \xf9h\xa9\xf3\x88\x8cXKj \xbf-l*4\x87n\xe4\xfe\xd4\x1d\x06\x8c\xf8m\\rS\xf6n\xeb\x8
-# failJSON: { "time": "2005-03-15T15:44:47", "match": true , "host": "121.222.2.133" }
+# failJSON: { "time": "2010-03-15T15:44:47", "match": true , "host": "121.222.2.133" }
 [Mon Mar 15 15:44:47 2010] [error] [client 121.222.2.133] Invalid URI in request n\xed*\xbe*\xab\xefd\x80\xb5\xae\xf6\x01\x10M?\xf2\xce\x13\x9c\xd7\xa0N\xa7\xdb%0\xde\xe0\xfc\xd2\xa0\xfe\xe9w\xee\xc4`v\x9b[{\x0c:\xcb\x93\xc6\xa0\x93\x9c`l\\\x8d\xc9

From cb61fcd326e727f1b8ec5c2787cd18b8fab50506 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 18:11:54 +1000
Subject: [PATCH 494/544] TST: standardise output format on Time mismatch test

---
 testcases/samplestestcase.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index e5a7723f..01a78f6c 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -115,7 +115,8 @@ def testSampleRegexsFactory(name):
 							faildata.get("time", None), "%Y-%m-%dT%H:%M:%S")
 				
 				self.assertEqual(fail2banTime, jsonTime,
-					"Time mismatch %s != %s on %s:" % ( fail2banTime, jsonTime, line ) )
+					"Time  mismatch %s != %s on: %s:%i %r:" % 
+					(fail2banTime, jsonTime, logFile.filename(), logFile.filelineno(), line ) )
 
 				regexsUsed.add(failregex)
 

From 6a567276691f0d1b2b4fcdc2587691e639f4be72 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 18:30:30 +1000
Subject: [PATCH 495/544] BF: apache-common regex - datetime could be entirely
 consumed

---
 config/filter.d/apache-common.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
index cc35ae5f..69364247 100644
--- a/config/filter.d/apache-common.conf
+++ b/config/filter.d/apache-common.conf
@@ -18,4 +18,4 @@ after = apache-common.local
 # 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
 # 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
 # Reference: https://github.com/fail2ban/fail2ban/issues/268
-_apache_error_client = \[[^]]+\] \[(error|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]( \S+:)?
+_apache_error_client = \[[^]]*\] \[(error|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]( \S+:)?

From 9a1df3501b936d730e330ecb878802cf93c59aed Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 20:19:42 +1000
Subject: [PATCH 496/544] TST: display details of duplicate matches

---
 testcases/samplestestcase.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index 01a78f6c..938b9c13 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -106,7 +106,8 @@ def testSampleRegexsFactory(name):
 				self.assertTrue(faildata.get('match', False),
 					"Line matched when shouldn't have: %s:%i %r" %
 					(logFile.filename(), logFile.filelineno(), line))
-				self.assertEqual(len(ret), 1, "Multiple regexs matched")
+				self.assertEqual(len(ret), 1, "Multiple regexs matched - %s:%i %r " %
+								 (logFile.filename(), logFile.filelineno(), ret))
 				# Verify timestamp and host as expected
 				failregex, host, time = ret[0]
 				self.assertEqual(host, faildata.get("host", None))

From 62c13c15d6b4923d7b0c2611d2d8144c2402af8d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 21:02:30 +1000
Subject: [PATCH 497/544] TST: reorder and condense error message for Multiple
 regexs matched

---
 testcases/samplestestcase.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index 938b9c13..c7ff0b9a 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -106,8 +106,9 @@ def testSampleRegexsFactory(name):
 				self.assertTrue(faildata.get('match', False),
 					"Line matched when shouldn't have: %s:%i %r" %
 					(logFile.filename(), logFile.filelineno(), line))
-				self.assertEqual(len(ret), 1, "Multiple regexs matched - %s:%i %r " %
-								 (logFile.filename(), logFile.filelineno(), ret))
+				self.assertEqual(len(ret), 1, "Multiple regexs matched %r - %s:%i" %
+								 (map(lambda x: x[0], ret),logFile.filename(), logFile.filelineno()))
+
 				# Verify timestamp and host as expected
 				failregex, host, time = ret[0]
 				self.assertEqual(host, faildata.get("host", None))

From ced271b908d13f35951a7997bb0b5645eb21191e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 21:11:47 +1000
Subject: [PATCH 498/544] ENH: date for apache-2.4 - adds milliseconds

---
 ChangeLog              | 1 +
 server/datedetector.py | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index f06e46a9..d088833c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -38,6 +38,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black
    * filter.d/exim-spam.conf -- a splitout of exim's spam regexes
      with additions for greater control over filtering spam.
+   * add date expression for apache-2.4 - milliseconds
 - Enhancements:
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
diff --git a/server/datedetector.py b/server/datedetector.py
index 0f0feb6d..83d69733 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -46,7 +46,13 @@ class DateDetector:
 	def addDefaultTemplate(self):
 		self.__lock.acquire()
 		try:
-			# asctime
+			# asctime with subsecond
+			template = DateStrptime()
+			template.setName("WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year")
+			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}\.\d+ \d{4}")
+			template.setPattern("%a %b %d %H:%M:%S.%f %Y")
+			self._appendTemplate(template)
+			# asctime without no subsecond
 			template = DateStrptime()
 			template.setName("WEEKDAY MONTH Day Hour:Minute:Second Year")
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}")

From fd7cc5bda75625052fd4fbf3f7e68f00bd3fa0f9 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 21:13:11 +1000
Subject: [PATCH 499/544] BF: duplicate regex match fixed

---
 config/filter.d/apache-auth.conf   | 6 +++---
 config/filter.d/apache-common.conf | 2 +-
 config/filter.d/apache-nohome.conf | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index 7adb0fcf..fa828b72 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -36,17 +36,17 @@ before = apache-common.conf
 #
 failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*\s*$
             ^%(_apache_error_client)s (AH01617: )?user .* authentication failure for "\S*": Password Mismatch$
-            ^%(_apache_error_client)s (AH01618: )?user .* not found: \S*\s*$
+            ^%(_apache_error_client)s (AH01618: )?user .* not found(: )?\S*\s*$
             ^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*\s*$
             ^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
             ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$
-            ^%(_apache_error_client)s (AH0179[01]: )?(Digest: )?user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
+            ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
             ^%(_apache_error_client)s (AH01631: )?user .*: authorization failure for "\S*":\s*$
             ^%(_apache_error_client)s (AH0177[56]: )?(Digest: )?invalid nonce .* received - (length|hash) is not \S+\s*$
             ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*' but expected `.+'\s*$
             ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*' received: \S*\s*$
             ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*$
-            ^%(_apache_error_client)s (AH01777: )?invalid nonce .* received - user attempted time travel\s*$
+            ^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .* received - user attempted time travel\s*$
 
 
 # Option:  ignoreregex
diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
index 69364247..134fad29 100644
--- a/config/filter.d/apache-common.conf
+++ b/config/filter.d/apache-common.conf
@@ -18,4 +18,4 @@ after = apache-common.local
 # 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
 # 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
 # Reference: https://github.com/fail2ban/fail2ban/issues/268
-_apache_error_client = \[[^]]*\] \[(error|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]( \S+:)?
+_apache_error_client = \[[^]]*\] \[(error|\S+:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]
diff --git a/config/filter.d/apache-nohome.conf b/config/filter.d/apache-nohome.conf
index 1347b10d..0eede317 100644
--- a/config/filter.d/apache-nohome.conf
+++ b/config/filter.d/apache-nohome.conf
@@ -19,7 +19,7 @@ before = apache-common.conf
 #          per-domain log files.
 # Values:  TEXT
 #
-failregex = ^%(_apache_error_client)s File does not exist: .*/~.*
+failregex = ^%(_apache_error_client)s (AH00128: )?File does not exist: .*/~.*
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From ef903db3c97d56948edfee1bcf7a02c89ee1a093 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 22:44:30 +1000
Subject: [PATCH 500/544] ENH: filter.d/named-refused.conf - BIND 9.9.3 regex
 changes. Closes gh-333

---
 ChangeLog                          | 1 +
 config/filter.d/named-refused.conf | 4 ++--
 testcases/files/logs/named-refused | 4 ++++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 8fe5f763..b40b1bc6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -53,6 +53,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
+   * filter.d/named-refused.conf - BIND 9.9.3 regex changes
   Daniel Black & Sebastian Arcus
    * filter.d/asterisk -- more regexes
   Yaroslav Halchenko
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index e30afee7..00c721e3 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -25,8 +25,8 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
-            %(__line_prefix)sclient <HOST>#\S+: zone transfer '\S+/AXFR/\w+' denied\s*$
+failregex = %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
+            %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 04b0e34f..82765876 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -14,4 +14,8 @@ Jul 24 14:23:36 raid5 named[3935]: client 62.109.4.89#9334: view external: query
 11-Aug-2013 03:36:11.372 error: client 1.2.3.4#52115: zone transfer 'domain.com/AXFR/IN' denied
 # failJSON: { "time": "2004-08-17T08:20:22", "match": true , "host": "223.252.23.219" }
 Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone transfer 'openquery.eu/AXFR/IN' denied
+# https://github.com/fail2ban/fail2ban/issues/333
+# BIND9 ver: BIND 9.9.3-rpz2+rl.13208.13-P2-RedHat-9.9.3-4.P2.el6 (Extended Support Version)
+# failJSON: { "time": "2013-08-23T10:32:56", "match": true , "host": "82.207.95.42" }
+23-Aug-2013 10:32:56.621 client 82.207.95.42#40278 (redginseng.com.ua): query (cache) 'redginseng.com.ua/A/IN' denied
 

From ca4729e943b20f06954822f666e0326e8174f913 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 25 Aug 2013 23:02:10 +1000
Subject: [PATCH 501/544] ENH: filter.d/exim.conf - add authentication failures
 for "plain" authentication

---
 config/filter.d/exim.conf | 2 +-
 testcases/files/logs/exim | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf
index 63b0fa1d..a30c9503 100644
--- a/config/filter.d/exim.conf
+++ b/config/filter.d/exim.conf
@@ -20,7 +20,7 @@ before = exim-common.conf
 #          Note the %(host_info) defination contains a <HOST> match
 
 failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
-             ^%(pid)s login authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
+             ^%(pid)s (plain|login) authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
              ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
              ^%(pid)s SMTP protocol synchronization error \(.*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
              ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 95c70d25..889df191 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -29,3 +29,9 @@
 # failJSON: { "time": "2013-06-15T16:36:49", "match": true , "host": "111.67.203.116" }
 2013-06-15 16:36:49 H=altmx.marsukov.com [111.67.203.116] F=<kadrofutcheti@mail.ru> rejected RCPT <oksana@birzhatm.ua>: Unknown user
 
+# 'https://github.com/fail2ban/fail2ban/pull/251#issuecomment-23001227' 
+# failJSON: { "time": "2013-08-20T07:48:02", "match": true , "host": "85.25.92.177" }
+2013-08-20 07:48:02 login authenticator failed for static-ip-85-25-92-177.inaddr.ip-pool.com (USER) [85.25.92.177]: 535 Incorrect authentication data: 1 Time(s)
+# failJSON: { "time": "2013-08-20T23:30:05", "match": true , "host": "91.218.72.71" }
+2013-08-20 23:30:05 plain authenticator failed for ([192.168.2.102]) [91.218.72.71]: 535 Incorrect authentication data: 1 Time(s)
+

From e133b9f1d1201e6e211ace2b89532f586c3ca93d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Boulogne?= <fboulogne sciunto org>
Date: Sun, 25 Aug 2013 21:29:43 +0200
Subject: [PATCH 502/544] MAINT: add support for lightty1.4.31

---
 config/filter.d/lighttpd-auth.conf | 2 +-
 testcases/files/logs/lighttpd-auth | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf
index 1931373c..b89c5d96 100644
--- a/config/filter.d/lighttpd-auth.conf
+++ b/config/filter.d/lighttpd-auth.conf
@@ -9,7 +9,7 @@
 # Notes.:  regex to match wrong passwords as notified by lighttpd's auth Module
 # Values:  TEXT
 #
-failregex = .*http_auth.*(password doesn\'t match|wrong password).*IP: <HOST>\s*$
+failregex = .*http_auth.*(password doesn\'t match|wrong password|get_password failed).*IP: <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/lighttpd-auth b/testcases/files/logs/lighttpd-auth
index 745a2462..a373c652 100644
--- a/testcases/files/logs/lighttpd-auth
+++ b/testcases/files/logs/lighttpd-auth
@@ -3,3 +3,5 @@
 2011-12-25 17:09:20: (http_auth.c.875) password doesn't match for /gitweb/ username: francois, IP: 4.4.4.4
 # failJSON: { "time": "2012-09-26T10:24:35", "match": true , "host": "4.4.4.4" }
 2012-09-26 10:24:35: (http_auth.c.1136) digest: auth failed for  xxx : wrong password, IP: 4.4.4.4
+# failJSON: { "time": "2013-08-25T00:24:55", "match": true , "host": "4.4.4.4" }
+2013-08-25 00:24:55: (http_auth.c.877) get_password failed, IP: 4.4.4.4

From 1aabee20f645110524c4f745393cffd206e8e12b Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 26 Aug 2013 08:42:00 +1000
Subject: [PATCH 503/544] DOC: credits for gh-338

---
 ChangeLog | 2 ++
 THANKS    | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 8fe5f763..2a680b15 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -45,6 +45,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Christophe Carles & Daniel Black
    * filter.d/perdition.conf -- filter added
 - Enhancements:
+  François Boulogne and Frédéric
+   * filter.d/lighttpd - auth regexs for lighttpd-1.4.31
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
      and extra failure examples in sample logs
diff --git a/THANKS b/THANKS
index 779ce602..7c5d8d2e 100644
--- a/THANKS
+++ b/THANKS
@@ -20,6 +20,8 @@ David Nutter
 Eric Gerbier
 Enrico Labedzki
 ftoppi
+François Boulogne
+Frédéric
 Georgiy Mernov
 Guillaume Delvit
 Hanno 'Rince' Wagner

From a7ebb84a7d9746d2a6d5681871e873b2ecb8f26c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 26 Aug 2013 08:42:45 +1000
Subject: [PATCH 504/544] ENH: tighted up lighttpd regex

---
 config/filter.d/lighttpd-auth.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf
index b89c5d96..375b26bd 100644
--- a/config/filter.d/lighttpd-auth.conf
+++ b/config/filter.d/lighttpd-auth.conf
@@ -9,7 +9,7 @@
 # Notes.:  regex to match wrong passwords as notified by lighttpd's auth Module
 # Values:  TEXT
 #
-failregex = .*http_auth.*(password doesn\'t match|wrong password|get_password failed).*IP: <HOST>\s*$
+failregex = ^: \(http_auth\.c\.\d+\) (password doesn\'t match|digest: auth failed for .*: wrong password|get_password failed).*, IP: <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From b8e7d0b867f1542fda44e13a4a11a92627fc2838 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 26 Aug 2013 08:51:40 +1000
Subject: [PATCH 505/544] ENH: further tighten lighttpd basic auth regex

---
 config/filter.d/lighttpd-auth.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf
index 375b26bd..b59a98a2 100644
--- a/config/filter.d/lighttpd-auth.conf
+++ b/config/filter.d/lighttpd-auth.conf
@@ -9,7 +9,7 @@
 # Notes.:  regex to match wrong passwords as notified by lighttpd's auth Module
 # Values:  TEXT
 #
-failregex = ^: \(http_auth\.c\.\d+\) (password doesn\'t match|digest: auth failed for .*: wrong password|get_password failed).*, IP: <HOST>\s*$
+failregex = ^: \(http_auth\.c\.\d+\) (password doesn\'t match .* username: .*|digest: auth failed for .*: wrong password|get_password failed), IP: <HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 265a85ec1fbb2d7ed1279aebfce8fe370868c7c5 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sat, 24 Aug 2013 23:05:31 -0400
Subject: [PATCH 506/544] RF: do not catch for now "invalid nonce \S*  received
 - hash is not \S*" -- imho needs more analysis

---
 config/filter.d/apache-auth.conf | 2 +-
 testcases/files/logs/apache-auth | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf
index fa828b72..b4061778 100644
--- a/config/filter.d/apache-auth.conf
+++ b/config/filter.d/apache-auth.conf
@@ -42,7 +42,7 @@ failregex = ^%(_apache_error_client)s (AH01797: )?client denied by server config
             ^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*: password mismatch: \S*\s*$
             ^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*' in realm `.+' (not found|denied by provider): \S*\s*$
             ^%(_apache_error_client)s (AH01631: )?user .*: authorization failure for "\S*":\s*$
-            ^%(_apache_error_client)s (AH0177[56]: )?(Digest: )?invalid nonce .* received - (length|hash) is not \S+\s*$
+            ^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+\s*$
             ^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*' but expected `.+'\s*$
             ^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*' received: \S*\s*$
             ^%(_apache_error_client)s (AH01793: )?invalid qop `.*' received: \S*\s*$
diff --git a/testcases/files/logs/apache-auth b/testcases/files/logs/apache-auth
index b2aa75ff..d6c40ac5 100644
--- a/testcases/files/logs/apache-auth
+++ b/testcases/files/logs/apache-auth
@@ -83,11 +83,12 @@
 
 
 # ./testcases/files/config/apache-auth/digest.py
-# failJSON: { "time": "2013-07-28T21:16:37", "match": true , "host": "127.0.0.1" }
+# yoh: ATM it should not match because matching failregex is still under "investigation"
+# failJSON: { "time": "2013-07-28T21:16:37", "match": false , "host": "127.0.0.1" }
 [Sun Jul 28 21:16:37 2013] [error] [client 127.0.0.1] Digest: invalid nonce l19lgpDiBAZZZf1ec3d9613f3b3ef43660e3628d78455fd8b937 received - hash is not 6fda8bbcbcf85ff1ebfe7d1c43faba583bc53a02
 
 # ./testcases/files/config/apache-auth/digest.py
-# failJSON: { "time": "2013-07-28T21:18:11", "match": true , "host": "127.0.0.1" }
+# failJSON: { "time": "2013-07-28T21:18:11", "match": false , "host": "127.0.0.1" }
 [Sun Jul 28 21:18:11.769228 2013] [auth_digest:error] [pid 24752:tid 139895505884928] [client 127.0.0.1:56964] AH01776: invalid nonce b9YAiJDiBAZZZ1b1abe02d20063ea3b16b544ea1b0d981c1bafe received - hash is not d42d824dee7aaf50c3ba0a7c6290bd453e3dd35b
 
 # ./testcases/files/config/apache-auth/digest.py

From ef504c869f0b00d3bbc80d837d00bc867305229d Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Mon, 26 Aug 2013 16:06:23 -0700
Subject: [PATCH 507/544] added osx specific ipfw action with random rulenum

---
 config/action.d/osx-ipfw.conf | 67 +++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 config/action.d/osx-ipfw.conf

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
new file mode 100644
index 00000000..8cd36df6
--- /dev/null
+++ b/config/action.d/osx-ipfw.conf
@@ -0,0 +1,67 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Andy Fragen
+#
+# Mod for OS X, using random rulenum
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <port>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+
+[Init]
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  localhost
+# Notes.:  the local IP address of the network interface
+# Values:  IP
+#
+localhost = 127.0.0.1
+
+# Option: number for ipfw rule
+# Values: 1 - 65535
+# Random value between 10000 and 12000
+rulenum = "`echo $((RANDOM%%2000+10000))`"
+

From a401d1164430c237b728582780c1160e63485737 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 28 Aug 2013 00:53:08 +1000
Subject: [PATCH 508/544] ENH: add regex for bad zone transfer request/ TST:
 add test for bind-9.9 zone transfer denied

---
 config/filter.d/named-refused.conf | 1 +
 testcases/files/logs/named-refused | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index 00c721e3..21afb07d 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -27,6 +27,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 #
 failregex = %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
             %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
+            %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 82765876..8a539ee9 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -19,3 +19,7 @@ Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone trans
 # failJSON: { "time": "2013-08-23T10:32:56", "match": true , "host": "82.207.95.42" }
 23-Aug-2013 10:32:56.621 client 82.207.95.42#40278 (redginseng.com.ua): query (cache) 'redginseng.com.ua/A/IN' denied
 
+# failJSON: { "time": "2013-08-27T17:49:45", "match": true , "host": "59.167.242.100" }
+27-Aug-2013 17:49:45.330 client 59.167.242.100#44281 (watt.kiev.ua): zone transfer 'watt.kiev.ua/AXFR/IN' denied
+# failJSON: { "time": "2013-08-27T16:58:31", "match": true , "host": "176.9.92.38" }
+Aug 27 16:58:31 vhost1-ua named[29206]: client 176.9.92.38#42592 (simmarket.com.ua): bad zone transfer request: 'simmarket.com.ua/IN': non-authoritative zone (NOTAUTH)

From cbed57bffd4aedd9fa1aba0ac6098aaba22bff2c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 28 Aug 2013 08:52:56 +1000
Subject: [PATCH 509/544] TST: fix year in named-bind test case

---
 testcases/files/logs/named-refused | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/files/logs/named-refused b/testcases/files/logs/named-refused
index 8a539ee9..7414a1b3 100644
--- a/testcases/files/logs/named-refused
+++ b/testcases/files/logs/named-refused
@@ -21,5 +21,5 @@ Aug 17 08:20:22 catinthehat named[2954]: client 223.252.23.219#56275: zone trans
 
 # failJSON: { "time": "2013-08-27T17:49:45", "match": true , "host": "59.167.242.100" }
 27-Aug-2013 17:49:45.330 client 59.167.242.100#44281 (watt.kiev.ua): zone transfer 'watt.kiev.ua/AXFR/IN' denied
-# failJSON: { "time": "2013-08-27T16:58:31", "match": true , "host": "176.9.92.38" }
+# failJSON: { "time": "2004-08-27T16:58:31", "match": true , "host": "176.9.92.38" }
 Aug 27 16:58:31 vhost1-ua named[29206]: client 176.9.92.38#42592 (simmarket.com.ua): bad zone transfer request: 'simmarket.com.ua/IN': non-authoritative zone (NOTAUTH)

From d5684a08348309c2ef4484e1e691375ff63dbd0b Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 28 Aug 2013 11:57:38 +1000
Subject: [PATCH 510/544] BF: filter.d/routecube-auth - time offset can be
 positive or negative

---
 ChangeLog                           | 1 +
 config/filter.d/roundcube-auth.conf | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 2a680b15..ae3552c9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,6 +32,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
    * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
      all platforms to ensure permissions are the same before and after a ban -
      closes gh-266. hostsdeny supports daemon_list now too.
+  * filter.d/roundcube-auth - timezone offset can be positive or negative
   Rolf Fokkens
    * action.d/dshield.conf and complain.conf -- reorder mailx arguements.
 	   https://bugzilla.redhat.com/show_bug.cgi?id=998020
diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf
index fe669f66..d36f5fef 100644
--- a/config/filter.d/roundcube-auth.conf
+++ b/config/filter.d/roundcube-auth.conf
@@ -17,7 +17,7 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^\s*(\[(\s\+[0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. AUTHENTICATE .*)?\s*$
+failregex = ^\s*(\[(\s[+-][0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. AUTHENTICATE .*)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From 15f2f3897259ed23c7fd1da1f94807c405fa9c18 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 28 Aug 2013 12:32:40 +1000
Subject: [PATCH 511/544] ENH: anchor regex at start

---
 config/filter.d/named-refused.conf | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index 21afb07d..1b6f4d4d 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -21,16 +21,11 @@ __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)
 # this can be optional (for instance if we match named native log files)
 __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
-            %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
-            %(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
+# note - (\.\d+)? is a really ugly catch of the microseconds not captured in
+# in the date detector
 #
-ignoreregex = 
+failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
+            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
+            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
+

From 13b4f176abc53dca4b08f4ae4051ae4c3854ca5e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 28 Aug 2013 11:23:57 +1000
Subject: [PATCH 512/544] TST: improve datedetector error reporting

---
 testcases/datedetectortestcase.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 218abba9..a18c87aa 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -87,9 +87,11 @@ class DateDetectorTest(unittest.TestCase):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude
 
-			# yoh: on [:6] see in above test
-			self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
-			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+			#[ yoh: on [:6] see in above test
+			logtime = self.__datedetector.getTime(log)
+			self.assertIsNotNone(logtime, "getTime retrieved nothing: failure for %s" % sdate)
+			self.assertEqual(logtime[:6], date[:6], "getTime comparison failure for %s" % sdate)
+			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix, "getUnixTime failure for %s" % sdate)
 
 	def testStableSortTemplate(self):
 		old_names = [x.getName() for x in self.__datedetector.getTemplates()]

From f2a60daea136c2e8c6ce33522822a8feca737779 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 28 Aug 2013 12:55:21 +1000
Subject: [PATCH 513/544] TST/BF: assertIsNotNone replaced with assertNotEqual
 for python 2.4 compatibility

---
 testcases/datedetectortestcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index a18c87aa..457b90e9 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -89,7 +89,7 @@ class DateDetectorTest(unittest.TestCase):
 
 			#[ yoh: on [:6] see in above test
 			logtime = self.__datedetector.getTime(log)
-			self.assertIsNotNone(logtime, "getTime retrieved nothing: failure for %s" % sdate)
+			self.assertNotEqual(logtime, None, "getTime retrieved nothing: failure for %s" % sdate)
 			self.assertEqual(logtime[:6], date[:6], "getTime comparison failure for %s" % sdate)
 			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix, "getUnixTime failure for %s" % sdate)
 

From 71317332ecef78548d987e7dd55254e5c4a7b314 Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@nwra.com>
Date: Wed, 28 Aug 2013 11:33:05 -0600
Subject: [PATCH 514/544] Install empty /etc/fail2ban/fail2ban.d directory

---
 setup.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/setup.py b/setup.py
index f401d79c..ccead3e5 100755
--- a/setup.py
+++ b/setup.py
@@ -66,6 +66,9 @@ setup(
 						('/etc/fail2ban/action.d',
 							glob("config/action.d/*.conf")
 						),
+						('/etc/fail2ban/fail2ban.d',
+							''
+						),
 						('/etc/fail2ban/jail.d',
 							''
 						),

From 2acaef9d890a05f6ecdb669ebaa3fcf9d59220d0 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Thu, 29 Aug 2013 09:17:13 +1000
Subject: [PATCH 515/544] TST: more detail in assertion

---
 testcases/datedetectortestcase.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 457b90e9..bc6a3865 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -87,11 +87,11 @@ class DateDetectorTest(unittest.TestCase):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude
 
-			#[ yoh: on [:6] see in above test
+			# yoh: on [:6] see in above test
 			logtime = self.__datedetector.getTime(log)
 			self.assertNotEqual(logtime, None, "getTime retrieved nothing: failure for %s" % sdate)
-			self.assertEqual(logtime[:6], date[:6], "getTime comparison failure for %s" % sdate)
-			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix, "getUnixTime failure for %s" % sdate)
+			self.assertEqual(logtime[:6], date[:6], "getTime comparison failure for %s: \"%s\" is not \"%s\"" % (sdate, logtime[:6], date[:6]))
+			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix, "getUnixTime failure for %s: \"%s\" is not \"%s\"" % (sdate, logtime[:6], date[:6]))
 
 	def testStableSortTemplate(self):
 		old_names = [x.getName() for x in self.__datedetector.getTemplates()]

From 7cc3e8a8c0a2def35682b3f33ed1e40a71dcda39 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 08:59:02 +1000
Subject: [PATCH 516/544] BF: Invert expression on actionstop in bsd-ipfw.conf
 to ensure exit status 0 on success. Closes gh-343

---
 ChangeLog                     | 5 +++++
 THANKS                        | 1 +
 config/action.d/bsd-ipfw.conf | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index ae3552c9..c3811a47 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -36,6 +36,10 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Rolf Fokkens
    * action.d/dshield.conf and complain.conf -- reorder mailx arguements.
 	   https://bugzilla.redhat.com/show_bug.cgi?id=998020
+  John Doe (ache)
+   * action.d/bsd-ipfw.conf - invert actionstop logic to make exist status 0.
+     closes gh-343.
+
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
@@ -45,6 +49,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
    * add date expression for apache-2.4 - milliseconds
   Christophe Carles & Daniel Black
    * filter.d/perdition.conf -- filter added
+
 - Enhancements:
   François Boulogne and Frédéric
    * filter.d/lighttpd - auth regexs for lighttpd-1.4.31
diff --git a/THANKS b/THANKS
index 7c5d8d2e..e3d2cd13 100644
--- a/THANKS
+++ b/THANKS
@@ -5,6 +5,7 @@ know (preferably send a pull request on github with the "fix") and you
 will be added
 
 Adrien Clerc
+ache
 Andrey G. Grozin
 Arturo 'Buanzo' Busleiman
 Axel Thimm
diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf
index 33f176e4..059de386 100644
--- a/config/action.d/bsd-ipfw.conf
+++ b/config/action.d/bsd-ipfw.conf
@@ -21,7 +21,7 @@ actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop =  [ -f <startstatefile> ] && ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
+actionstop =  [ ! -f <startstatefile> ] || ( read num < "<startstatefile>" <br> ipfw -q delete $num <br> rm "<startstatefile>" )
 
 
 # Option:  actioncheck

From 908d4adf6f736bf2c6cf7a3a1dadbc8246287fbe Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 09:37:15 +1000
Subject: [PATCH 517/544] DOC: credits and thanks for Andy for osx-ipfw

---
 ChangeLog | 3 +++
 THANKS    | 1 +
 2 files changed, 4 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c3811a47..e46e9e4f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -41,6 +41,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      closes gh-343.
 
 - New Features:
+  Andy Fragen and Daniel Black
+	 * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule
+     numbers.
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
   Daniel Black
diff --git a/THANKS b/THANKS
index e3d2cd13..41780856 100644
--- a/THANKS
+++ b/THANKS
@@ -7,6 +7,7 @@ will be added
 Adrien Clerc
 ache
 Andrey G. Grozin
+Andy Fragen
 Arturo 'Buanzo' Busleiman
 Axel Thimm
 Bill Heaton

From 5741348f45df3fd061786ab102686b3742d1bac8 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 09:38:18 +1000
Subject: [PATCH 518/544] ENH: more options and ruggedness to prevent
 unintensional consequences

---
 config/action.d/osx-ipfw.conf | 41 +++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 8cd36df6..b7f2f376 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -1,9 +1,9 @@
 # Fail2Ban configuration file
 #
 # Author: Nick Munger
-# Modified by: Andy Fragen
+# Modified by: Andy Fragen and Daniel Black
 #
-# Mod for OS X, using random rulenum
+# Mod for OS X, using random rulenum as OSX ipfw doesn't include tables
 #
 
 [Definition]
@@ -35,7 +35,7 @@ actioncheck =
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <port>
+actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to <dst> <port>
 
 
 # Option:  actionunban
@@ -44,24 +44,41 @@ actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <por
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> <port>$/s//\1/p'`
 
 [Init]
 
 # Option:  port
-# Notes.:  specifies port to monitor
+# Notes.:  specifies port to block
 # Values:  [ NUM | STRING ]
 #
 port = ssh
 
-# Option:  localhost
+# Option:  dst
 # Notes.:  the local IP address of the network interface
-# Values:  IP
+# Values:  IP, any, me or anything support by ipfw as a dst
 #
-localhost = 127.0.0.1
+dst = me
 
-# Option: number for ipfw rule
-# Values: 1 - 65535
-# Random value between 10000 and 12000
-rulenum = "`echo $((RANDOM%%2000+10000))`"
+# Option: block
+# Notes:  This is how much to block.
+#         Can be "ip", "tcp", "udp" or various other options.
+# Values: STRING
+block = tcp
 
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 8 ipfw
+#          Common values: deny, unreach port, reset
+# Values:  STRING
+#
+blocktype = unreach port
+
+# Option:  set number
+# Notes.:  The ipset number this is added to.
+# Values:  0-31
+setnum = 10
+
+# Option:  number for ipfw rule
+# Notes:   This is ment to be automaticly generated and not overwritten
+# Values:  Random value between 10000 and 12000
+rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"

From 808aa1a792302a07b6a0334c932d5f38a6461fd7 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 09:39:21 +1000
Subject: [PATCH 519/544] ENH: added jail.conf example. closes gh-340

---
 config/jail.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 86c61911..7f1e40b5 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -416,3 +416,8 @@ filter = perdition
 action = iptables-multiport[name=perdition,port="110,143,993,995"]
 logpath = /var/log/maillog
 
+[osx-ssh-ipfw]
+enabled = false
+filter = sshd
+action = osx-ipfw
+logpath = /var/log/secure.log

From 8b22fa15b55a590d72f21b1d02533f46b0af43b3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 11:03:01 +1000
Subject: [PATCH 520/544] BF: reverted to simplier random rulenum. If your
 machine is handling 1000s of block the addition complexity isnt what you want

---
 config/action.d/osx-ipfw.conf | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index b7f2f376..416344a7 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -79,6 +79,9 @@ blocktype = unreach port
 setnum = 10
 
 # Option:  number for ipfw rule
-# Notes:   This is ment to be automaticly generated and not overwritten
+# Notes:   This is meant to be automaticly generated and not overwritten
 # Values:  Random value between 10000 and 12000
-rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"
+rulenum="`echo $((RANDOM%%2000+10000))`"
+
+# Duplicate prevention mechanism
+#rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"

From 749f2150898710360789c502b55eebbf5486680c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 11:07:15 +1000
Subject: [PATCH 521/544] ENH: port optional

---
 config/action.d/osx-ipfw.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 416344a7..2aadd626 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -44,12 +44,12 @@ actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> <port>$/s//\1/p'`
+actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> ?<port>$/s//\1/p'`
 
 [Init]
 
 # Option:  port
-# Notes.:  specifies port to block
+# Notes.:  specifies port to block. Can be blank however may require block="ip"
 # Values:  [ NUM | STRING ]
 #
 port = ssh

From f2bcf84893b13e1dd69b63074c0064b79978af1d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 11:40:04 +1000
Subject: [PATCH 522/544] BF: action.d/bsd-ipfw - use blocktype instead of
 unused action for icmp rejecting blocked packets

---
 ChangeLog                     |  4 +++-
 config/action.d/bsd-ipfw.conf | 17 +++++++++--------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index c3811a47..cadca394 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,7 +32,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
    * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
      all platforms to ensure permissions are the same before and after a ban -
      closes gh-266. hostsdeny supports daemon_list now too.
-  * filter.d/roundcube-auth - timezone offset can be positive or negative
+   * filter.d/roundcube-auth - timezone offset can be positive or negative
+   * action.d/bsd-ipfw - action option unsed. Fixed to blocktype for
+     consistency. default to port unreach instead of deny
   Rolf Fokkens
    * action.d/dshield.conf and complain.conf -- reorder mailx arguements.
 	   https://bugzilla.redhat.com/show_bug.cgi?id=998020
diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf
index 059de386..1285361d 100644
--- a/config/action.d/bsd-ipfw.conf
+++ b/config/action.d/bsd-ipfw.conf
@@ -14,7 +14,7 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num deny <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
+actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num <blocktype> <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
 
 
 # Option:  actionstop
@@ -68,15 +68,16 @@ port =
 # Values:  STRING
 startstatefile = /var/run/fail2ban/ipfw-started-table_<table>
 
-# Option:  action
-# Notes:   This is the action to take for automaticly created rules. See the 
-#          ACTION defination at the top of man ipfw for allowed values.
-#          "deny" and "unreach port" are probably the useful.
-# Values:  STRING
-action = deny
-
 # Option: block
 # Notes:  This is how much to block.
 #         Can be "ip", "tcp", "udp" or various other options.
 # Values: STRING
 block = ip
+
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 5 ipfw
+#          Common values: deny, unreach port, reset
+#          ACTION defination at the top of man ipfw for allowed values.
+# Values:  STRING
+#
+blocktype = unreach port

From 8ae55fe03be04eeb18b90946c057a8eb0e1b1595 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sat, 31 Aug 2013 10:04:03 -0400
Subject: [PATCH 523/544] ChangeLog entries (+few typo fixes) for the last
 merges

---
 ChangeLog | 13 +++++++++----
 THANKS    |  1 +
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index aa6435f8..ebe98d76 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -34,12 +34,15 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      closes gh-266. hostsdeny supports daemon_list now too.
   * filter.d/roundcube-auth - timezone offset can be positive or negative
   Rolf Fokkens
-   * action.d/dshield.conf and complain.conf -- reorder mailx arguements.
-	   https://bugzilla.redhat.com/show_bug.cgi?id=998020
+   * action.d/dshield.conf and complain.conf -- reorder mailx arguments.
+     https://bugzilla.redhat.com/show_bug.cgi?id=998020
   John Doe (ache)
    * action.d/bsd-ipfw.conf - invert actionstop logic to make exist status 0.
      closes gh-343.
-
+  JP Espinosa (Reviewed by O.Poplawski)
+   * files/redhat-initd - rewritten to use stock init.d functions thus
+     avoiding problems with getpid.  Also $network and iptables moved
+     to Should- rc init fields
 - New Features:
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
@@ -88,7 +91,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      will require changing in jail.{conf,local} if using this filter.
   Zurd
    * filter.d/postfix - add filter for VRFY failures. closes gh-322.
-
+  Orion Poplawski
+   * fail2ban.d/ and jail.d/ directories are added to etc/fail2ban to facilitate
+     their use
 
 ver. 0.8.10 (2013/06/12) - wanna-be-secure
 -----------
diff --git a/THANKS b/THANKS
index e3d2cd13..e57fdab6 100644
--- a/THANKS
+++ b/THANKS
@@ -30,6 +30,7 @@ Iain Lea
 Jonathan Kamens
 Jonathan Underwood
 Joël Bertrand
+JP Espinosa
 Justin Shore
 Kévin Drapel
 kojiro

From a4884f82cd57c2047f8cf1f41c1769493fbfaa22 Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Sat, 31 Aug 2013 08:39:19 -0700
Subject: [PATCH 524/544] add mods from grooverdan and fix actionunban

actionunban still not working in grooverdan's mod. I made this one grep both <ip> and <port>. It should be more specific if the same <ip> is banned on multiple ports.
---
 config/action.d/osx-ipfw.conf | 45 +++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 12 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 8cd36df6..4f421ffb 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -1,9 +1,9 @@
 # Fail2Ban configuration file
 #
 # Author: Nick Munger
-# Modified by: Andy Fragen
+# Modified by: Andy Fragen and Daniel Black
 #
-# Mod for OS X, using random rulenum
+# Mod for OS X, using random rulenum as OSX ipfw doesn't include tables
 #
 
 [Definition]
@@ -35,7 +35,7 @@ actioncheck =
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <port>
+actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to <dst> <port>
 
 
 # Option:  actionunban
@@ -44,24 +44,45 @@ actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <por
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipfw delete `ipfw list | grep -i <ip> | grep -i <port> | awk '{print $1;}'`
+#actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> ?<port>$/s//\1/p'`
 
 [Init]
 
 # Option:  port
-# Notes.:  specifies port to monitor
+# Notes.:  specifies port to block. Can be blank however may require block="ip"
 # Values:  [ NUM | STRING ]
 #
 port = ssh
 
-# Option:  localhost
+# Option:  dst
 # Notes.:  the local IP address of the network interface
-# Values:  IP
+# Values:  IP, any, me or anything support by ipfw as a dst
 #
-localhost = 127.0.0.1
+dst = me
 
-# Option: number for ipfw rule
-# Values: 1 - 65535
-# Random value between 10000 and 12000
-rulenum = "`echo $((RANDOM%%2000+10000))`"
+# Option: block
+# Notes:  This is how much to block.
+#         Can be "ip", "tcp", "udp" or various other options.
+# Values: STRING
+block = tcp
 
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 8 ipfw
+#          Common values: deny, unreach port, reset
+# Values:  STRING
+#
+blocktype = deny
+
+# Option:  set number
+# Notes.:  The ipset number this is added to.
+# Values:  0-31
+setnum = 10
+
+# Option:  number for ipfw rule
+# Notes:   This is meant to be automaticly generated and not overwritten
+# Values:  Random value between 10000 and 12000
+rulenum="`echo $((RANDOM%%2000+10000))`"
+
+# Duplicate prevention mechanism
+#rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"
\ No newline at end of file

From fe557e5900b79af1e563b32a5d59425f5580a507 Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Sun, 1 Sep 2013 13:09:51 -0700
Subject: [PATCH 525/544] more specific actionunban

---
 config/action.d/osx-ipfw.conf | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 4f421ffb..b90a136e 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -44,8 +44,7 @@ actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | grep -i <port> | awk '{print $1;}'`
-#actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> ?<port>$/s//\1/p'`
+actionunban = ipfw delete `ipfw -S list | grep -i 'set <setnum> <blocktype> log <block> from <ip> to <dst>' | awk '{print $1;}'`
 
 [Init]
 

From 317e82e144f29017b3015931a9a8c8221527901c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 2 Sep 2013 17:10:49 +1000
Subject: [PATCH 526/544] TST: one more exim test case

---
 testcases/files/logs/exim | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim
index 889df191..89fa7f87 100644
--- a/testcases/files/logs/exim
+++ b/testcases/files/logs/exim
@@ -35,3 +35,5 @@
 # failJSON: { "time": "2013-08-20T23:30:05", "match": true , "host": "91.218.72.71" }
 2013-08-20 23:30:05 plain authenticator failed for ([192.168.2.102]) [91.218.72.71]: 535 Incorrect authentication data: 1 Time(s)
 
+# failJSON: { "time": "2013-09-02T09:19:07", "match": true , "host": "118.233.20.68" }
+2013-09-02 09:19:07 login authenticator failed for (gkzwsoju) [118.233.20.68]: 535 Incorrect authentication data

From d258a51a23ea296ef43d8a78cbeb9bd7100af694 Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Wed, 4 Sep 2013 11:28:03 -0700
Subject: [PATCH 527/544] after some research it looks like setting to
 unreachable better than deny

---
 config/action.d/osx-ipfw.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index b90a136e..fe0caa2a 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -71,7 +71,7 @@ block = tcp
 #          Common values: deny, unreach port, reset
 # Values:  STRING
 #
-blocktype = deny
+blocktype = unreach port
 
 # Option:  set number
 # Notes.:  The ipset number this is added to.

From 060bd4529567172b5b957511fa71ee8a65090333 Mon Sep 17 00:00:00 2001
From: Beau Raines <beau.raines@gmail.com>
Date: Sun, 8 Sep 2013 15:21:58 -0700
Subject: [PATCH 528/544] ENH - Added server name to subject line in email
 notifications   This is useful when fail2ban is running on multiple servers
 and keeping the notifictions separate and knowing which machine is "under
 attack".

---
 THANKS                                    | 1 +
 config/action.d/mail-buffered.conf        | 6 +++---
 config/action.d/mail-whois-lines.conf     | 6 +++---
 config/action.d/mail-whois.conf           | 6 +++---
 config/action.d/mail.conf                 | 6 +++---
 config/action.d/sendmail-buffered.conf    | 8 ++++----
 config/action.d/sendmail-whois-lines.conf | 6 +++---
 config/action.d/sendmail-whois.conf       | 6 +++---
 config/action.d/sendmail.conf             | 6 +++---
 9 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/THANKS b/THANKS
index 2da6614f..d5910297 100644
--- a/THANKS
+++ b/THANKS
@@ -10,6 +10,7 @@ Andrey G. Grozin
 Andy Fragen
 Arturo 'Buanzo' Busleiman
 Axel Thimm
+Beau Raines
 Bill Heaton
 Carlos Alberto Lopez Perez
 Christian Rauch
diff --git a/config/action.d/mail-buffered.conf b/config/action.d/mail-buffered.conf
index 7ff17cf2..914d4a5a 100644
--- a/config/action.d/mail-buffered.conf
+++ b/config/action.d/mail-buffered.conf
@@ -14,7 +14,7 @@ actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Output will be buffered until <lines> lines are available.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -25,13 +25,13 @@ actionstop = if [ -f <tmpfile> ]; then
                  These hosts have been banned by Fail2Ban.\n
                  `cat <tmpfile>`
                  Regards,\n
-                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary" <dest>
+                 Fail2Ban"|mail -s "[Fail2Ban] <name>: Summary from `uname -n`" <dest>
                  rm <tmpfile>
              fi
              printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
diff --git a/config/action.d/mail-whois-lines.conf b/config/action.d/mail-whois-lines.conf
index d30e266d..758c4eff 100644
--- a/config/action.d/mail-whois-lines.conf
+++ b/config/action.d/mail-whois-lines.conf
@@ -13,7 +13,7 @@
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -22,7 +22,7 @@ actionstart = printf %%b "Hi,\n
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -44,7 +44,7 @@ actionban = printf %%b "Hi,\n
             Lines containing IP:<ip> in <logpath>\n
             `grep '\<<ip>\>' <logpath>`\n\n
             Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from  `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
diff --git a/config/action.d/mail-whois.conf b/config/action.d/mail-whois.conf
index f58ae535..fa133ab3 100644
--- a/config/action.d/mail-whois.conf
+++ b/config/action.d/mail-whois.conf
@@ -13,7 +13,7 @@
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started on `uname -n`" <dest>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -22,7 +22,7 @@ actionstart = printf %%b "Hi,\n
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -42,7 +42,7 @@ actionban = printf %%b "Hi,\n
             Here are more information about <ip>:\n
             `whois <ip>`\n
             Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
diff --git a/config/action.d/mail.conf b/config/action.d/mail.conf
index f9a54979..7bf51a1d 100644
--- a/config/action.d/mail.conf
+++ b/config/action.d/mail.conf
@@ -13,7 +13,7 @@
 actionstart = printf %%b "Hi,\n
               The jail <name> has been started successfully.\n
               Regards,\n
-              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>
+              Fail2Ban"|mail -s "[Fail2Ban] <name>: started  on `uname -n`" <dest>
 
 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
@@ -22,7 +22,7 @@ actionstart = printf %%b "Hi,\n
 actionstop = printf %%b "Hi,\n
              The jail <name> has been stopped.\n
              Regards,\n
-             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>
+             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped on `uname -n`" <dest>
 
 # Option:  actioncheck
 # Notes.:  command executed once before each actionban command
@@ -40,7 +40,7 @@ actionban = printf %%b "Hi,\n
             The IP <ip> has just been banned by Fail2Ban after
             <failures> attempts against <name>.\n
             Regards,\n
-            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip>" <dest>
+            Fail2Ban"|mail -s "[Fail2Ban] <name>: banned <ip> from `uname -n`" <dest>
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
diff --git a/config/action.d/sendmail-buffered.conf b/config/action.d/sendmail-buffered.conf
index f5ca6c10..80eb20a3 100644
--- a/config/action.d/sendmail-buffered.conf
+++ b/config/action.d/sendmail-buffered.conf
@@ -14,7 +14,7 @@ before = sendmail-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               From: <sendername> <<sender>>
               To: <dest>\n
               Hi,\n
@@ -28,7 +28,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = if [ -f <tmpfile> ]; then
-                 printf %%b "Subject: [Fail2Ban] <name>: summary
+                 printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                  From: <sendername> <<sender>>
                  To: <dest>\n
                  Hi,\n
@@ -38,7 +38,7 @@ actionstop = if [ -f <tmpfile> ]; then
                  Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
                  rm <tmpfile>
              fi
-             printf %%b "Subject: [Fail2Ban] <name>: stopped
+             printf %%b "Subject: [Fail2Ban] <name>: stopped  on `uname -n`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -61,7 +61,7 @@ actioncheck =
 actionban = printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile>
             LINE=$( wc -l <tmpfile> | awk '{ print $1 }' )
             if [ $LINE -ge <lines> ]; then
-                printf %%b "Subject: [Fail2Ban] <name>: summary
+                printf %%b "Subject: [Fail2Ban] <name>: summary from `uname -n`
                 From: <sendername> <<sender>>
                 To: <dest>\n
                 Hi,\n
diff --git a/config/action.d/sendmail-whois-lines.conf b/config/action.d/sendmail-whois-lines.conf
index 2cb27bd2..5a331e24 100644
--- a/config/action.d/sendmail-whois-lines.conf
+++ b/config/action.d/sendmail-whois-lines.conf
@@ -14,7 +14,7 @@ before = sendmail-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: <sendername> <<sender>>
               To: <dest>\n
@@ -27,7 +27,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: <sendername> <<sender>>
              To: <dest>\n
@@ -48,7 +48,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
diff --git a/config/action.d/sendmail-whois.conf b/config/action.d/sendmail-whois.conf
index b111e19f..a65f9875 100644
--- a/config/action.d/sendmail-whois.conf
+++ b/config/action.d/sendmail-whois.conf
@@ -14,7 +14,7 @@ before = sendmail-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: <sendername> <<sender>>
               To: <dest>\n
@@ -27,7 +27,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: <sendername> <<sender>>
              To: <dest>\n
@@ -48,7 +48,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n
diff --git a/config/action.d/sendmail.conf b/config/action.d/sendmail.conf
index 55d388fc..70f38329 100644
--- a/config/action.d/sendmail.conf
+++ b/config/action.d/sendmail.conf
@@ -14,7 +14,7 @@ before = sendmail-common.conf
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on `uname -n`
               Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: <sendername> <<sender>>
               To: <dest>\n
@@ -27,7 +27,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped on `uname -n`
              Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: <sendername> <<sender>>
              To: <dest>\n
@@ -48,7 +48,7 @@ actioncheck =
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip> from `uname -n`
             Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: <sendername> <<sender>>
             To: <dest>\n

From 851520436fdf02f10216a35c589e94ab65fbabe7 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 12 Sep 2013 13:24:26 -0400
Subject: [PATCH 529/544] DOC: slight tune up of THANKS file to list Cyril's
 role there since now THANKS is pointed to from Wiki

---
 THANKS | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/THANKS b/THANKS
index d5910297..fc26f14f 100644
--- a/THANKS
+++ b/THANKS
@@ -1,8 +1,10 @@
-Fail2Ban is an open source project with many contributions from its
-users community. Below is an alphabetically sorted partial list of the
-contributors to the project.  If you have been left off, please let us
-know (preferably send a pull request on github with the "fix") and you
-will be added
+Fail2Ban is an open source project which was conceived and originally
+developed by Cyril Jaquier until 2010.  Since then Fail2Ban grew into
+a community-driven project with many contributions from its users.
+Below is an alphabetically sorted partial list of the contributors to
+the project.  If you have been left off, please let us know
+(preferably send a pull request on github with the "fix") and you will
+be added
 
 Adrien Clerc
 ache
@@ -17,6 +19,7 @@ Christian Rauch
 Christophe Carles
 Christoph Haas
 Christos Psonis
+Cyril Jaquier
 Daniel B. Cid
 Daniel Black
 David Nutter

From 660e0597a72fb8b22dbd12d3fa56a4b16a8cfa30 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 12 Sep 2013 14:21:20 -0400
Subject: [PATCH 530/544] DOC: Adding Manuel Ramierz to THANKS (was on Wiki)
 and spacing our Nick Munger

---
 THANKS | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/THANKS b/THANKS
index fc26f14f..ad8eed60 100644
--- a/THANKS
+++ b/THANKS
@@ -39,6 +39,7 @@ JP Espinosa
 Justin Shore
 Kévin Drapel
 kojiro
+Manuel Arostegui Ramirez
 Marcel Dopita
 Mark Edgington
 Markus Hoffmann
@@ -47,7 +48,7 @@ mEDI
 Мернов Георгий
 Michael C. Haller
 Michael Hanselmann
-NickMunger
+Nick Munger
 Patrick Börjesson
 Raphaël Marichez
 René Berber

From abc75b30223dab51218f5816f12cc81bf1ecc63e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 12 Sep 2013 22:47:58 -0400
Subject: [PATCH 531/544] ENH: simplify our formatExceptionInfo

Actually it was not that consistent before and e.g. could add  () if
exception had no parameters and empty tuple.  Simple str'ing seems to
provide the most consistent output and now would bring up our coverage %
---
 common/helpers.py | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/common/helpers.py b/common/helpers.py
index c0cf052e..74ea7a7a 100644
--- a/common/helpers.py
+++ b/common/helpers.py
@@ -17,24 +17,12 @@
 # along with Fail2Ban; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
-__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman"
-__copyright__ = "Copyright (c) 2009 Cyril Jaquier"
+__author__ = "Cyril Jaquier, Arturo 'Buanzo' Busleiman, Yaroslav Halchenko"
 __license__ = "GPL"
 
 
 def formatExceptionInfo():
-	""" Author: Arturo 'Buanzo' Busleiman """
+	""" Consistently format exception information """
 	import sys
 	cla, exc = sys.exc_info()[:2]
-	excName = cla.__name__
-	try:
-		excArgs = exc.__dict__["args"]
-		# Assure that we always return a string, without unneeded
-		# 'decorations' with python <= 2.5 where args would be a tuple
-		if isinstance(excArgs, tuple) and len(excArgs) == 1:
-			excArgs = excArgs[0]
-		excArgs = str(excArgs)
-	except KeyError:
-		# And always provide a string output
-		excArgs = str(exc)
-	return (excName, excArgs)
+	return (cla.__name__, str(exc))

From f1adf75b59d51651d0ad6a0e53c00b5bb33ebe99 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Thu, 12 Sep 2013 23:12:18 -0400
Subject: [PATCH 532/544] ENH: basic testing for iso8601 code which had no
 explicit tests + spit out ValueError for incorrect type of input and
 ParseError otherwise

---
 fail2ban-testcases        |  1 +
 server/iso8601.py         | 13 +++++++++----
 testcases/misctestcase.py | 26 ++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/fail2ban-testcases b/fail2ban-testcases
index 5aed6e43..7088d068 100755
--- a/fail2ban-testcases
+++ b/fail2ban-testcases
@@ -167,6 +167,7 @@ tests.addTest(unittest.makeSuite(sockettestcase.Socket))
 tests.addTest(unittest.makeSuite(misctestcase.HelpersTest))
 tests.addTest(unittest.makeSuite(misctestcase.SetupTest))
 tests.addTest(unittest.makeSuite(misctestcase.TestsUtilsTest))
+tests.addTest(unittest.makeSuite(misctestcase.CustomDateFormatsTest))
 
 # Filter
 if not opts.no_network:
diff --git a/server/iso8601.py b/server/iso8601.py
index a42989ea..3d788274 100644
--- a/server/iso8601.py
+++ b/server/iso8601.py
@@ -111,7 +111,7 @@ def parse_date(datestring, default_timezone=UTC):
     default.
     """
     if not isinstance(datestring, basestring):
-        raise ParseError("Expecting a string %r" % datestring)
+        raise ValueError("Expecting a string %r" % datestring)
     m = ISO8601_REGEX.match(datestring)
     if not m:
         raise ParseError("Unable to parse date string %r" % datestring)
@@ -121,6 +121,11 @@ def parse_date(datestring, default_timezone=UTC):
         groups["fraction"] = 0
     else:
         groups["fraction"] = int(float("0.%s" % groups["fraction"]) * 1e6)
-    return datetime(int(groups["year"]), int(groups["month"]), int(groups["day"]),
-        int(groups["hour"]), int(groups["minute"]), int(groups["second"]),
-        int(groups["fraction"]), tz)
+
+    try:
+        return datetime(int(groups["year"]), int(groups["month"]), int(groups["day"]),
+            int(groups["hour"]), int(groups["minute"]), int(groups["second"]),
+            int(groups["fraction"]), tz)
+    except Exception, e:
+        raise ParseError("Failed to create a valid datetime record due to: %s"
+                         % e)
diff --git a/testcases/misctestcase.py b/testcases/misctestcase.py
index 08c8fc30..747f83e4 100644
--- a/testcases/misctestcase.py
+++ b/testcases/misctestcase.py
@@ -167,3 +167,29 @@ class TestsUtilsTest(unittest.TestCase):
 		# in this case compressed and not should be the same (?)
 		self.assertTrue(pindex > 10)	  # we should have some traceback
 		self.assertEqual(s[:pindex], s[pindex+1:pindex*2 + 1])
+
+from server import iso8601
+import datetime
+
+class CustomDateFormatsTest(unittest.TestCase):
+
+	def testIso8601(self):
+		date = iso8601.parse_date("2007-01-25T12:00:00Z")
+		self.assertEqual(
+			date,
+			datetime.datetime(2007, 1, 25, 12, 0, tzinfo=iso8601.Utc()))
+		self.assertRaises(ValueError, iso8601.parse_date, None)
+		self.assertRaises(ValueError, iso8601.parse_date, date)
+
+		self.assertRaises(iso8601.ParseError, iso8601.parse_date, "")
+		self.assertRaises(iso8601.ParseError, iso8601.parse_date, "Z")
+
+		self.assertRaises(iso8601.ParseError,
+						  iso8601.parse_date, "2007-01-01T120:00:00Z")
+		self.assertRaises(iso8601.ParseError,
+						  iso8601.parse_date, "2007-13-01T12:00:00Z")
+
+	def testTimeZone(self):
+		# Just verify consistent operation and improve coverage ;)
+		self.assertEqual(iso8601.parse_timezone(None), iso8601.UTC)
+		self.assertEqual(iso8601.parse_timezone('Z'),  iso8601.UTC)

From 504111b0b1e62eb882888b2e8acceaf547e6b9f5 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 16 Sep 2013 01:22:42 +1000
Subject: [PATCH 533/544] ENH: filter.d/recidive - anchor regex at start and
 support f2b SYSLOG target

---
 ChangeLog                     |  1 +
 config/filter.d/recidive.conf | 14 ++++++++++++--
 testcases/files/logs/recidive |  4 ++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 633bebbb..b68e7ddc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -66,6 +66,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      and extra failure examples in sample logs
 	 * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
+   * filter.d/recidive -- support f2b syslog target and anchor regex at start
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf
index bbb48008..5d1ab0dd 100644
--- a/config/filter.d/recidive.conf
+++ b/config/filter.d/recidive.conf
@@ -15,8 +15,18 @@
 # for most jails, and shorewall for this one).
 #
 
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
 [Definition]
 
+_daemon = fail2ban.actions
+
+
 # The name of the jail that this filter is used for. In jail.conf, name the 
 # jail using this filter 'recidive', or change this line!
 _jailname = recidive
@@ -28,11 +38,11 @@ _jailname = recidive
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = fail2ban.actions:\s+WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
+failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
 # Ignore our own bans, to keep our counts exact.
-ignoreregex = fail2ban.actions:\s+WARNING\s+\[%(_jailname)s\]\s+Ban\s+<HOST>
+ignoreregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[%(_jailname)s\]\s+Ban\s+<HOST>
diff --git a/testcases/files/logs/recidive b/testcases/files/logs/recidive
index cf6df933..6af85137 100644
--- a/testcases/files/logs/recidive
+++ b/testcases/files/logs/recidive
@@ -4,3 +4,7 @@
 2006-02-13 16:07:31,183 fail2ban.actions: WARNING [sendmail] Unban 1.2.3.4
 # failJSON: { "match": false }
 2006-02-13 15:52:30,388 fail2ban.actions: WARNING [recidive] Ban 1.2.3.4
+# syslog example
+# failJSON: { "time": "2004-09-16T00:44:55", "match": true , "host": "10.0.0.7" }
+Sep 16 00:44:55 spaceman fail2ban.actions: WARNING [jail] Ban 10.0.0.7
+

From 38b07ca46e96eeabccf1ef3081063ac5e85f168e Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Sun, 15 Sep 2013 23:03:18 -0400
Subject: [PATCH 534/544] BF: catch and report exceptions while executing
 commands in client interactive mode (Close #353)

---
 ChangeLog       | 2 ++
 fail2ban-client | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 633bebbb..5a7ce8fb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -26,6 +26,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      - All backends, possible race condition: do not read from a file
        initially reported empty.  Originally could have lead to
        accounting for detected log lines multiple times.
+     - Do not crash if executing a command in fail2ban-client interactive
+       mode has failed (e.g. due to incorrect syntax). Closes gh-353
   Daniel Black & Мернов Георгий
    * filter.d/dovecot.conf -- Fix when no TLS enabled - line doesn't end in ,
   Daniel Black
diff --git a/fail2ban-client b/fail2ban-client
index be48a613..c18b7d55 100755
--- a/fail2ban-client
+++ b/fail2ban-client
@@ -383,7 +383,10 @@ class Fail2banClient:
 						if cmd == "help":
 							self.dispUsage()
 						elif not cmd == "":
-							self.__processCommand(shlex.split(cmd))
+							try:
+								self.__processCommand(shlex.split(cmd))
+							except Exception, e:
+								logSys.error(e)
 			except (EOFError, KeyboardInterrupt):
 				print
 				return True

From 673cc4d77ff17c573cfb1b9602d4d2fc48bbeefd Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 16 Sep 2013 18:43:56 +1000
Subject: [PATCH 535/544] ENH: anchor at end of recidive filter

---
 config/filter.d/recidive.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf
index 5d1ab0dd..151bd18e 100644
--- a/config/filter.d/recidive.conf
+++ b/config/filter.d/recidive.conf
@@ -38,11 +38,11 @@ _jailname = recidive
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
+failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 #
 # Ignore our own bans, to keep our counts exact.
-ignoreregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[%(_jailname)s\]\s+Ban\s+<HOST>
+ignoreregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[%(_jailname)s\]\s+Ban\s+<HOST>\s*$

From bb32295b50a0277e1cb85f5e533d458aa8a21fe6 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 16 Sep 2013 09:49:24 -0400
Subject: [PATCH 536/544] DOC: minor  - untabified few entries in the ChangeLog

---
 ChangeLog | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 5a7ce8fb..2001158b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -49,7 +49,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      to Should- rc init fields
 - New Features:
   Andy Fragen and Daniel Black
-	 * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule
+   * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule
      numbers.
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
@@ -66,7 +66,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
   Daniel Black
    * filter.d/{asterisk,assp,dovecot,proftpd}.conf -- regex hardening
      and extra failure examples in sample logs
-	 * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
+   * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in

From 13ec9d58c0adf7f8265779950ae93770548e4bf4 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 07:25:23 +1000
Subject: [PATCH 537/544] ENH: filter gssftpd is a syslog based service so
 anchor it using syslog prefix

---
 ChangeLog                    |  1 +
 config/filter.d/gssftpd.conf | 21 ++++++++++-----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 2001158b..976a2e87 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -68,6 +68,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      and extra failure examples in sample logs
    * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
+   * filter.d/gssftpd - anchored regex at start
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
diff --git a/config/filter.d/gssftpd.conf b/config/filter.d/gssftpd.conf
index e6c2e84a..5bce817b 100644
--- a/config/filter.d/gssftpd.conf
+++ b/config/filter.d/gssftpd.conf
@@ -1,19 +1,18 @@
-# Fail2Ban configuration file for wuftpd
+# Fail2Ban configuration file for gssftp
 #
-# Author: Kevin Zembower (copied from wsftpd.conf)
+# Author: Kevin Zembower
+# Edited: Daniel Black - syslog based daemon
 #
+# Note: gssftp is part of the krb5-appl-servers in Fedora
 #
+[INCLUDES]
+
+before = common.conf
 
 [Definition]
 
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile.
-# Values: TEXT
-#
-failregex = ftpd(?:\[\d+\])?:\s+repeated login failures from <HOST> \(\S+\)$
+_daemon = ftpd
+
+failregex = ^%(__prefix_line)srepeated login failures from <HOST> \(\S+\)$
 
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
 ignoreregex = 

From ee497ff1cbc4ca555db819285f81892a5d5a0d00 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 07:57:19 +1000
Subject: [PATCH 538/544] ENH: filter mysqld-auth can be a is a syslog based
 service so anchor it using syslog prefix

---
 ChangeLog                        | 1 +
 config/filter.d/mysqld-auth.conf | 5 +++--
 testcases/files/logs/mysqld-auth | 5 +++++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 2001158b..de0d6517 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -68,6 +68,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      and extra failure examples in sample logs
    * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
+   * filter.d/mysqld-auth.conf - mysql can use syslog
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
diff --git a/config/filter.d/mysqld-auth.conf b/config/filter.d/mysqld-auth.conf
index 197c8232..64dd16ed 100644
--- a/config/filter.d/mysqld-auth.conf
+++ b/config/filter.d/mysqld-auth.conf
@@ -13,7 +13,7 @@ before = common.conf
 
 [Definition]
 
-#_daemon = mysqld
+_daemon = mysqld
 
 # Option:  failregex
 # Notes.:  regex to match the password failures messages in the logfile. The
@@ -22,7 +22,8 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 # 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
-failregex = Access denied for user '\w+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
+#
+failregex = ^%(__prefix_line)s(\d{6} \s?\d{1,2}:\d{2}:\d{2} )?\[Warning\] Access denied for user '\w+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/testcases/files/logs/mysqld-auth b/testcases/files/logs/mysqld-auth
index 757ecb66..ce35d740 100644
--- a/testcases/files/logs/mysqld-auth
+++ b/testcases/files/logs/mysqld-auth
@@ -10,3 +10,8 @@
 130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO)
 # failJSON: { "time": "2013-03-24T19:01:40", "match": true , "host": "61.147.108.35" }
 130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)
+# failJSON: { "time": "2013-09-16T21:30:26", "match": true , "host": "74.207.241.159" }
+Sep 16 21:30:26 catinthehat mysqld: 130916 21:30:26 [Warning] Access denied for user 'hacker'@'74.207.241.159' (using password: YES)
+# failJSON: { "time": "2013-09-16T21:30:32", "match": true , "host": "74.207.241.159" }
+Sep 16 21:30:32 catinthehat mysqld: 130916 21:30:32 [Warning] Access denied for user 'hacker'@'74.207.241.159' (using password: NO)
+

From 8f4142226291d12500a494eb88bb7a069101005d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 10:09:19 +1000
Subject: [PATCH 539/544] TST: domains need to exist for fail2ban-regex to work

---
 testcases/files/logs/pam-generic | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testcases/files/logs/pam-generic b/testcases/files/logs/pam-generic
index dc7efeee..a7d1def8 100644
--- a/testcases/files/logs/pam-generic
+++ b/testcases/files/logs/pam-generic
@@ -9,6 +9,6 @@ May 15 18:02:12 localhost proftpd: (pam_unix) authentication failure; logname= u
 # failJSON: { "time": "2004-11-25T17:12:13", "match": true , "host": "192.168.10.3" }
 Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
 # failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www3.google.com" }
-Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www3.google.com
+Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www.google.com
 # failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www3.google.com" }
-Jul 19 18:11:26 srv2 vsftpd: pam_unix: authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www3.google.com
+Jul 19 18:11:26 srv2 vsftpd: pam_unix: authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www.google.com

From 7e756dfadaad7a8d93ce1105f999b4a1bfea07df Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 10:48:09 +1000
Subject: [PATCH 540/544] TST: correct failJSON for www3.google.com ->
 www.google.com changes. Disable test case for pre-0.99.2.0 version of
 linux-pam failure messages

---
 testcases/files/logs/pam-generic | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/testcases/files/logs/pam-generic b/testcases/files/logs/pam-generic
index a7d1def8..c6312a9b 100644
--- a/testcases/files/logs/pam-generic
+++ b/testcases/files/logs/pam-generic
@@ -6,9 +6,12 @@ May 12 09:47:54 vaio sshd[16004]: (pam_unix) authentication failure; logname= ui
 May 12 09:48:03 vaio sshd[16021]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com
 # failJSON: { "time": "2005-05-15T18:02:12", "match": true , "host": "66.232.129.62" }
 May 15 18:02:12 localhost proftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=66.232.129.62  user=mark
-# failJSON: { "time": "2004-11-25T17:12:13", "match": true , "host": "192.168.10.3" }
-Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
-# failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www3.google.com" }
+
+# linux-pam messages before commit f0f9c4479303b5a9c37667cf07f58426dc081676 (release 0.99.2.0 )
+# disable_failJSON: { "time": "2004-11-25T17:12:13", "match": true , "host": "192.168.10.3" }
+# Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
+
+# failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www.google.com" }
 Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www.google.com
-# failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www3.google.com" }
+# failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www.google.com" }
 Jul 19 18:11:26 srv2 vsftpd: pam_unix: authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www.google.com

From 30bb1a77a3d0214cb941cd65df7c8c520d5f46d8 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 10:50:46 +1000
Subject: [PATCH 541/544] ENH: added syslog prefix to pam-generic filter.
 Disable regex match for pre 2006 (< 0.99.2.0) versions on linux-pam

---
 ChangeLog                        |  2 ++
 config/filter.d/pam-generic.conf | 15 ++++++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 2001158b..c4d4afcc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -68,6 +68,8 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      and extra failure examples in sample logs
    * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
+   * filter.d/pam-generic - added syslog prefix. Disabled support for
+     linux-pam before version 0.99.2.0 (2005)
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
diff --git a/config/filter.d/pam-generic.conf b/config/filter.d/pam-generic.conf
index eaeb122f..15aadf3e 100644
--- a/config/filter.d/pam-generic.conf
+++ b/config/filter.d/pam-generic.conf
@@ -3,6 +3,9 @@
 # Author: Yaroslav Halchenko
 #
 #
+[INCLUDES]
+
+before = common.conf
 
 [Definition]
 
@@ -11,17 +14,19 @@
 # To catch all failed logins
 _ttys_re=\S*
 
-#
-# Shortcuts for easier comprehension of the failregex
-__pid_re=(?:\[\d+\])
 __pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
-__pam_combs_re=(?:%(__pid_re)s?:\s+%(__pam_re)s|%(__pam_re)s%(__pid_re)s?:)
+_daemon = \S+
 
 # Option: failregex
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = \s\S+ \S+%(__pam_combs_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+
+# for linux-pam before 0.99.2.0 (late 2005)
+# _daemon = \S*\(?pam_unix\)?
+# failregex = ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
+
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

From bec723b21d989c52e490135f757388a15e85e232 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 10:51:48 +1000
Subject: [PATCH 542/544] TST: failJSON date fix

---
 testcases/files/logs/mysqld-auth | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testcases/files/logs/mysqld-auth b/testcases/files/logs/mysqld-auth
index ce35d740..aa684266 100644
--- a/testcases/files/logs/mysqld-auth
+++ b/testcases/files/logs/mysqld-auth
@@ -10,8 +10,8 @@
 130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO)
 # failJSON: { "time": "2013-03-24T19:01:40", "match": true , "host": "61.147.108.35" }
 130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)
-# failJSON: { "time": "2013-09-16T21:30:26", "match": true , "host": "74.207.241.159" }
+# failJSON: { "time": "2004-09-16T21:30:26", "match": true , "host": "74.207.241.159" }
 Sep 16 21:30:26 catinthehat mysqld: 130916 21:30:26 [Warning] Access denied for user 'hacker'@'74.207.241.159' (using password: YES)
-# failJSON: { "time": "2013-09-16T21:30:32", "match": true , "host": "74.207.241.159" }
+# failJSON: { "time": "2004-09-16T21:30:32", "match": true , "host": "74.207.241.159" }
 Sep 16 21:30:32 catinthehat mysqld: 130916 21:30:32 [Warning] Access denied for user 'hacker'@'74.207.241.159' (using password: NO)
 

From ad5fb81f4b081088ceeeabcdbd9119eec062f32e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Tue, 17 Sep 2013 21:18:24 +1000
Subject: [PATCH 543/544] TST: failJSON set match to false on longer supported
 pam version

---
 testcases/files/logs/pam-generic | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/testcases/files/logs/pam-generic b/testcases/files/logs/pam-generic
index c6312a9b..e562ac7f 100644
--- a/testcases/files/logs/pam-generic
+++ b/testcases/files/logs/pam-generic
@@ -7,9 +7,9 @@ May 12 09:48:03 vaio sshd[16021]: (pam_unix) authentication failure; logname= ui
 # failJSON: { "time": "2005-05-15T18:02:12", "match": true , "host": "66.232.129.62" }
 May 15 18:02:12 localhost proftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=66.232.129.62  user=mark
 
-# linux-pam messages before commit f0f9c4479303b5a9c37667cf07f58426dc081676 (release 0.99.2.0 )
-# disable_failJSON: { "time": "2004-11-25T17:12:13", "match": true , "host": "192.168.10.3" }
-# Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
+# linux-pam messages before commit f0f9c4479303b5a9c37667cf07f58426dc081676 (release 0.99.2.0 ) - nolonger supported
+# failJSON: { "time": "2004-11-25T17:12:13", "match": false }
+Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
 
 # failJSON: { "time": "2005-07-19T18:11:26", "match": true , "host": "www.google.com" }
 Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www.google.com

From c3ee03b9ba7e1a868f70f36a7f1a1f0a630a0d57 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 18 Sep 2013 07:32:26 +1000
Subject: [PATCH 544/544] BF: fix daemon name typo for filter proftpd

---
 config/filter.d/proftpd.conf | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index d3120216..66e4b6e7 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -6,31 +6,17 @@
 
 [INCLUDES]
 
-# Read common prefixes. If any customizations available -- read them from
-# common.local
 before = common.conf
 
-
 [Definition]
 
-_deamon = proftpd
-
-# Option: failregex
-# Notes.: regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
-# Values: TEXT
-#
+_daemon = proftpd
 
 __suffix_failed_login = (User not authorized for login|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit (access|configuration) denies login|Not a UserAlias|maximum login length exceeded).?
+
 failregex = ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): %(__suffix_failed_login)s\s*$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
             ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
 
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
 ignoreregex =