From ef504c869f0b00d3bbc80d837d00bc867305229d Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Mon, 26 Aug 2013 16:06:23 -0700
Subject: [PATCH 01/19] added osx specific ipfw action with random rulenum

---
 config/action.d/osx-ipfw.conf | 67 +++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 config/action.d/osx-ipfw.conf

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
new file mode 100644
index 00000000..8cd36df6
--- /dev/null
+++ b/config/action.d/osx-ipfw.conf
@@ -0,0 +1,67 @@
+# Fail2Ban configuration file
+#
+# Author: Nick Munger
+# Modified by: Andy Fragen
+#
+# Mod for OS X, using random rulenum
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = 
+
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = 
+
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = 
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <port>
+
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+# Values:  CMD
+#
+actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+
+[Init]
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]
+#
+port = ssh
+
+# Option:  localhost
+# Notes.:  the local IP address of the network interface
+# Values:  IP
+#
+localhost = 127.0.0.1
+
+# Option: number for ipfw rule
+# Values: 1 - 65535
+# Random value between 10000 and 12000
+rulenum = "`echo $((RANDOM%%2000+10000))`"
+

From 908d4adf6f736bf2c6cf7a3a1dadbc8246287fbe Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 09:37:15 +1000
Subject: [PATCH 02/19] DOC: credits and thanks for Andy for osx-ipfw

---
 ChangeLog | 3 +++
 THANKS    | 1 +
 2 files changed, 4 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index c3811a47..e46e9e4f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -41,6 +41,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      closes gh-343.
 
 - New Features:
+  Andy Fragen and Daniel Black
+	 * filter.d/osx-ipfw.conf - ipfw action for OSX based on random rule
+     numbers.
   Daniel Black & ykimon
    * filter.d/3proxy.conf -- filter added
   Daniel Black
diff --git a/THANKS b/THANKS
index e3d2cd13..41780856 100644
--- a/THANKS
+++ b/THANKS
@@ -7,6 +7,7 @@ will be added
 Adrien Clerc
 ache
 Andrey G. Grozin
+Andy Fragen
 Arturo 'Buanzo' Busleiman
 Axel Thimm
 Bill Heaton

From 5741348f45df3fd061786ab102686b3742d1bac8 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 09:38:18 +1000
Subject: [PATCH 03/19] ENH: more options and ruggedness to prevent
 unintensional consequences

---
 config/action.d/osx-ipfw.conf | 41 +++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 8cd36df6..b7f2f376 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -1,9 +1,9 @@
 # Fail2Ban configuration file
 #
 # Author: Nick Munger
-# Modified by: Andy Fragen
+# Modified by: Andy Fragen and Daniel Black
 #
-# Mod for OS X, using random rulenum
+# Mod for OS X, using random rulenum as OSX ipfw doesn't include tables
 #
 
 [Definition]
@@ -35,7 +35,7 @@ actioncheck =
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <port>
+actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to <dst> <port>
 
 
 # Option:  actionunban
@@ -44,24 +44,41 @@ actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <por
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> <port>$/s//\1/p'`
 
 [Init]
 
 # Option:  port
-# Notes.:  specifies port to monitor
+# Notes.:  specifies port to block
 # Values:  [ NUM | STRING ]
 #
 port = ssh
 
-# Option:  localhost
+# Option:  dst
 # Notes.:  the local IP address of the network interface
-# Values:  IP
+# Values:  IP, any, me or anything support by ipfw as a dst
 #
-localhost = 127.0.0.1
+dst = me
 
-# Option: number for ipfw rule
-# Values: 1 - 65535
-# Random value between 10000 and 12000
-rulenum = "`echo $((RANDOM%%2000+10000))`"
+# Option: block
+# Notes:  This is how much to block.
+#         Can be "ip", "tcp", "udp" or various other options.
+# Values: STRING
+block = tcp
 
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 8 ipfw
+#          Common values: deny, unreach port, reset
+# Values:  STRING
+#
+blocktype = unreach port
+
+# Option:  set number
+# Notes.:  The ipset number this is added to.
+# Values:  0-31
+setnum = 10
+
+# Option:  number for ipfw rule
+# Notes:   This is ment to be automaticly generated and not overwritten
+# Values:  Random value between 10000 and 12000
+rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"

From 808aa1a792302a07b6a0334c932d5f38a6461fd7 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 09:39:21 +1000
Subject: [PATCH 04/19] ENH: added jail.conf example. closes gh-340

---
 config/jail.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/config/jail.conf b/config/jail.conf
index 86c61911..7f1e40b5 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -416,3 +416,8 @@ filter = perdition
 action = iptables-multiport[name=perdition,port="110,143,993,995"]
 logpath = /var/log/maillog
 
+[osx-ssh-ipfw]
+enabled = false
+filter = sshd
+action = osx-ipfw
+logpath = /var/log/secure.log

From 8b22fa15b55a590d72f21b1d02533f46b0af43b3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 11:03:01 +1000
Subject: [PATCH 05/19] BF: reverted to simplier random rulenum. If your
 machine is handling 1000s of block the addition complexity isnt what you want

---
 config/action.d/osx-ipfw.conf | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index b7f2f376..416344a7 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -79,6 +79,9 @@ blocktype = unreach port
 setnum = 10
 
 # Option:  number for ipfw rule
-# Notes:   This is ment to be automaticly generated and not overwritten
+# Notes:   This is meant to be automaticly generated and not overwritten
 # Values:  Random value between 10000 and 12000
-rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"
+rulenum="`echo $((RANDOM%%2000+10000))`"
+
+# Duplicate prevention mechanism
+#rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"

From 749f2150898710360789c502b55eebbf5486680c Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 11:07:15 +1000
Subject: [PATCH 06/19] ENH: port optional

---
 config/action.d/osx-ipfw.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 416344a7..2aadd626 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -44,12 +44,12 @@ actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> <port>$/s//\1/p'`
+actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> ?<port>$/s//\1/p'`
 
 [Init]
 
 # Option:  port
-# Notes.:  specifies port to block
+# Notes.:  specifies port to block. Can be blank however may require block="ip"
 # Values:  [ NUM | STRING ]
 #
 port = ssh

From f2bcf84893b13e1dd69b63074c0064b79978af1d Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sat, 31 Aug 2013 11:40:04 +1000
Subject: [PATCH 07/19] BF: action.d/bsd-ipfw - use blocktype instead of unused
 action for icmp rejecting blocked packets

---
 ChangeLog                     |  4 +++-
 config/action.d/bsd-ipfw.conf | 17 +++++++++--------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index c3811a47..cadca394 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,7 +32,9 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
    * action.d/hostsdeny -- NOTE: new dependancy 'ed'. Switched to use 'ed' across
      all platforms to ensure permissions are the same before and after a ban -
      closes gh-266. hostsdeny supports daemon_list now too.
-  * filter.d/roundcube-auth - timezone offset can be positive or negative
+   * filter.d/roundcube-auth - timezone offset can be positive or negative
+   * action.d/bsd-ipfw - action option unsed. Fixed to blocktype for
+     consistency. default to port unreach instead of deny
   Rolf Fokkens
    * action.d/dshield.conf and complain.conf -- reorder mailx arguements.
 	   https://bugzilla.redhat.com/show_bug.cgi?id=998020
diff --git a/config/action.d/bsd-ipfw.conf b/config/action.d/bsd-ipfw.conf
index 059de386..1285361d 100644
--- a/config/action.d/bsd-ipfw.conf
+++ b/config/action.d/bsd-ipfw.conf
@@ -14,7 +14,7 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num deny <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
+actionstart = ipfw show | fgrep -q 'table(<table>)' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e <br> else exit b }'; num=$?; ipfw -q add $num <blocktype> <block> from table\(<table>\) to me <port>; echo $num > "<startstatefile>" )
 
 
 # Option:  actionstop
@@ -68,15 +68,16 @@ port =
 # Values:  STRING
 startstatefile = /var/run/fail2ban/ipfw-started-table_<table>
 
-# Option:  action
-# Notes:   This is the action to take for automaticly created rules. See the 
-#          ACTION defination at the top of man ipfw for allowed values.
-#          "deny" and "unreach port" are probably the useful.
-# Values:  STRING
-action = deny
-
 # Option: block
 # Notes:  This is how much to block.
 #         Can be "ip", "tcp", "udp" or various other options.
 # Values: STRING
 block = ip
+
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 5 ipfw
+#          Common values: deny, unreach port, reset
+#          ACTION defination at the top of man ipfw for allowed values.
+# Values:  STRING
+#
+blocktype = unreach port

From a4884f82cd57c2047f8cf1f41c1769493fbfaa22 Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Sat, 31 Aug 2013 08:39:19 -0700
Subject: [PATCH 08/19] add mods from grooverdan and fix actionunban

actionunban still not working in grooverdan's mod. I made this one grep both <ip> and <port>. It should be more specific if the same <ip> is banned on multiple ports.
---
 config/action.d/osx-ipfw.conf | 45 +++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 12 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 8cd36df6..4f421ffb 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -1,9 +1,9 @@
 # Fail2Ban configuration file
 #
 # Author: Nick Munger
-# Modified by: Andy Fragen
+# Modified by: Andy Fragen and Daniel Black
 #
-# Mod for OS X, using random rulenum
+# Mod for OS X, using random rulenum as OSX ipfw doesn't include tables
 #
 
 [Definition]
@@ -35,7 +35,7 @@ actioncheck =
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <port>
+actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to <dst> <port>
 
 
 # Option:  actionunban
@@ -44,24 +44,45 @@ actionban = ipfw add <rulenum> set 10 deny log tcp from <ip> to <localhost> <por
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipfw delete `ipfw list | grep -i <ip> | grep -i <port> | awk '{print $1;}'`
+#actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> ?<port>$/s//\1/p'`
 
 [Init]
 
 # Option:  port
-# Notes.:  specifies port to monitor
+# Notes.:  specifies port to block. Can be blank however may require block="ip"
 # Values:  [ NUM | STRING ]
 #
 port = ssh
 
-# Option:  localhost
+# Option:  dst
 # Notes.:  the local IP address of the network interface
-# Values:  IP
+# Values:  IP, any, me or anything support by ipfw as a dst
 #
-localhost = 127.0.0.1
+dst = me
 
-# Option: number for ipfw rule
-# Values: 1 - 65535
-# Random value between 10000 and 12000
-rulenum = "`echo $((RANDOM%%2000+10000))`"
+# Option: block
+# Notes:  This is how much to block.
+#         Can be "ip", "tcp", "udp" or various other options.
+# Values: STRING
+block = tcp
 
+# Option:  blocktype
+# Notes.:  How to block the traffic. Use a action from man 8 ipfw
+#          Common values: deny, unreach port, reset
+# Values:  STRING
+#
+blocktype = deny
+
+# Option:  set number
+# Notes.:  The ipset number this is added to.
+# Values:  0-31
+setnum = 10
+
+# Option:  number for ipfw rule
+# Notes:   This is meant to be automaticly generated and not overwritten
+# Values:  Random value between 10000 and 12000
+rulenum="`echo $((RANDOM%%2000+10000))`"
+
+# Duplicate prevention mechanism
+#rulenum = "`a=$((RANDOM%%2000+10000)); while ipfw show | grep -q ^$a\ ; do a=$((RANDOM%%2000+10000)); done; echo $a`"
\ No newline at end of file

From fe557e5900b79af1e563b32a5d59425f5580a507 Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Sun, 1 Sep 2013 13:09:51 -0700
Subject: [PATCH 09/19] more specific actionunban

---
 config/action.d/osx-ipfw.conf | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index 4f421ffb..b90a136e 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -44,8 +44,7 @@ actionban = ipfw add <rulenum> set <setnum> <blocktype> log <block> from <ip> to
 # Tags:    <ip>  IP address
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | grep -i <port> | awk '{print $1;}'`
-#actionunban = ipfw delete `ipfw list | sed  -n '/^\([0-9]*\) set <setnum> <blocktype> log <block> from <ip> to <dst> ?<port>$/s//\1/p'`
+actionunban = ipfw delete `ipfw -S list | grep -i 'set <setnum> <blocktype> log <block> from <ip> to <dst>' | awk '{print $1;}'`
 
 [Init]
 

From d258a51a23ea296ef43d8a78cbeb9bd7100af694 Mon Sep 17 00:00:00 2001
From: Andy Fragen <andy@thefragens.com>
Date: Wed, 4 Sep 2013 11:28:03 -0700
Subject: [PATCH 10/19] after some research it looks like setting to
 unreachable better than deny

---
 config/action.d/osx-ipfw.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/osx-ipfw.conf b/config/action.d/osx-ipfw.conf
index b90a136e..fe0caa2a 100644
--- a/config/action.d/osx-ipfw.conf
+++ b/config/action.d/osx-ipfw.conf
@@ -71,7 +71,7 @@ block = tcp
 #          Common values: deny, unreach port, reset
 # Values:  STRING
 #
-blocktype = deny
+blocktype = unreach port
 
 # Option:  set number
 # Notes.:  The ipset number this is added to.

From d0098b02137516cc89e46b871e916427e86d3f93 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 9 Sep 2013 03:37:59 +1000
Subject: [PATCH 11/19] ENH: add timezone offest and subsecond support to
 Datedetector

---
 ChangeLog                           |  1 +
 config/filter.d/apache-common.conf  |  2 +-
 config/filter.d/named-refused.conf  |  7 ++----
 config/filter.d/roundcube-auth.conf |  2 +-
 server/datedetector.py              | 32 +++++++++++++----------
 server/datetemplate.py              | 39 ++++++++++++++++++++++++++---
 testcases/datedetectortestcase.py   | 29 +++++++++++++++++----
 testcases/files/logs/apache-badbots |  2 +-
 testcases/files/logs/php-url-fopen  |  2 +-
 testcases/files/logs/roundcube-auth |  2 +-
 10 files changed, 87 insertions(+), 31 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 633bebbb..e0343ede 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -66,6 +66,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests
      and extra failure examples in sample logs
 	 * filter.d/apache-auth - added expressions for mod_authz, mod_auth and
      mod_auth_digest failures.
+   * Support %z (Timezone offset) and %f (sub-seconds) support for datedetector
   Daniel Black & Georgiy Mernov & ftoppi & Мернов Георгий
    * filter.d/exim.conf -- regex hardening and extra failure examples in
      sample logs
diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf
index 134fad29..6955dae1 100644
--- a/config/filter.d/apache-common.conf
+++ b/config/filter.d/apache-common.conf
@@ -18,4 +18,4 @@ after = apache-common.local
 # 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
 # 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
 # Reference: https://github.com/fail2ban/fail2ban/issues/268
-_apache_error_client = \[[^]]*\] \[(error|\S+:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]
+_apache_error_client = \[\] \[(error|\S+:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index 1b6f4d4d..4c30a0fe 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -22,10 +22,7 @@ __daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)
 __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 
 
-# note - (\.\d+)? is a really ugly catch of the microseconds not captured in
-# in the date detector
-#
-failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
-            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
+failregex = ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
+            ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
             ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 
diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf
index d36f5fef..5af6431a 100644
--- a/config/filter.d/roundcube-auth.conf
+++ b/config/filter.d/roundcube-auth.conf
@@ -17,7 +17,7 @@ before = common.conf
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^\s*(\[(\s[+-][0-9]{4})?\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. AUTHENTICATE .*)?\s*$
+failregex = ^\s*(\[\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. AUTHENTICATE .*)?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
diff --git a/server/datedetector.py b/server/datedetector.py
index ab2dd174..2d773113 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -48,8 +48,8 @@ class DateDetector:
 		try:
 			# asctime with subsecond
 			template = DateStrptime()
-			template.setName("WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year")
-			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}\.\d+ \d{4}")
+			template.setName("WEEKDAY MONTH Day Hour:Minute:Second.Subsecond Year")
+			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}\.(?P<_f>\d+) \d{4}")
 			template.setPattern("%a %b %d %H:%M:%S.%f %Y")
 			self._appendTemplate(template)
 			# asctime without no subsecond
@@ -64,7 +64,7 @@ class DateDetector:
 			template.setRegex("\S{3} \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%a %b %d %H:%M:%S")
 			self._appendTemplate(template)
-			# standard - most loose from above 3 so by default follows after
+			# standard - most loose from above so by default follows after
 			template = DateStrptime()
 			template.setName("MONTH Day Hour:Minute:Second")
 			template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
@@ -89,11 +89,11 @@ class DateDetector:
 			template.setRegex("\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%y %H:%M:%S")
 			self._appendTemplate(template)
-			# Apache format [31/Oct/2006:09:22:55 -0000]
+			# Apache format [31/Oct/2006:09:22:55 -0200]
 			template = DateStrptime()
-			template.setName("Day/MONTH/Year:Hour:Minute:Second")
-			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2}")
-			template.setPattern("%d/%b/%Y:%H:%M:%S")
+			template.setName("Day/MONTH/Year:Hour:Minute:Second ZoneOffset")
+			template.setRegex("\d{2}/\S{3}/\d{4}:\d{2}:\d{2}:\d{2} (?P<_z>[+-]\d{4})")
+			template.setPattern("%d/%b/%Y:%H:%M:%S %z")
 			self._appendTemplate(template)
 			# CPanel 05/20/2008:01:57:39
 			template = DateStrptime()
@@ -115,9 +115,15 @@ class DateDetector:
 			self._appendTemplate(template)
 			# named 26-Jul-2007 15:20:52.252 
 			template = DateStrptime()
-			template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]")
-			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}")
-			template.setPattern("%d-%b-%Y %H:%M:%S")
+			template.setName("Day-MONTH-Year Hour:Minute:Second.Subsecond")
+			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2}\.(?P<_f>\d+)")
+			template.setPattern("%d-%b-%Y %H:%M:%S.%f")
+			self._appendTemplate(template)
+			# roundcube 26-Jul-2007 15:20:52 +0200
+			template = DateStrptime()
+			template.setName("Day-MONTH-Year Hour:Minute:Second ZoneOffset")
+			template.setRegex("\d{2}-\S{3}-\d{4} \d{2}:\d{2}:\d{2} (?P<_z>[+-]\d{4})")
+			template.setPattern("%d-%b-%Y %H:%M:%S %z")
 			self._appendTemplate(template)
 			# 17-07-2008 17:23:25
 			template = DateStrptime()
@@ -127,9 +133,9 @@ class DateDetector:
 			self._appendTemplate(template)
 			# 01-27-2012 16:22:44.252
 			template = DateStrptime()
-			template.setName("Month-Day-Year Hour:Minute:Second[.Millisecond]")
-			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}")
-			template.setPattern("%m-%d-%Y %H:%M:%S")
+			template.setName("Month-Day-Year Hour:Minute:Second.Subsecond")
+			template.setRegex("\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.(?P<_f>\d+)")
+			template.setPattern("%m-%d-%Y %H:%M:%S.%f")
 			self._appendTemplate(template)
 			# TAI64N
 			template = DateTai64n()
diff --git a/server/datetemplate.py b/server/datetemplate.py
index 0754391b..f4847640 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -114,9 +114,12 @@ class DateStrptime(DateTemplate):
 	def __init__(self):
 		DateTemplate.__init__(self)
 		self.__pattern = ""
+		self.__unsupportedStrptimeBits = False
 	
 	def setPattern(self, pattern):
-		self.__pattern = pattern.strip()
+		self.__unsupported_f = not DateStrptime._f and re.search('%f', pattern)
+		self.__unsupported_z = not DateStrptime._z and re.search('%z', pattern)
+		self.__pattern = pattern
 		
 	def getPattern(self):
 		return self.__pattern
@@ -135,13 +138,23 @@ class DateStrptime(DateTemplate):
 	def getDate(self, line):
 		date = None
 		dateMatch = self.matchDate(line)
+
 		if dateMatch:
+			datePattern = self.getPattern()
+			if self.__unsupported_f:
+				if dateMatch.group('_f'):
+					datePattern = re.sub(r'%f', dateMatch.group('_f'), datePattern)
+					logSys.debug(u"Replacing %%f with %r now %r" % (dateMatch.group('_f'), datePattern))
+			if self.__unsupported_z:
+				if dateMatch.group('_z'):
+					datePattern = re.sub(r'%z', dateMatch.group('_z'), datePattern)
+					logSys.debug(u"Replacing %%z with %r now %r" % (dateMatch.group('_z'), datePattern))
 			try:
 				# Try first with 'C' locale
-				date = list(time.strptime(dateMatch.group(), self.getPattern()))
+				date = list(time.strptime(dateMatch.group(), datePattern))
 			except ValueError:
 				# Try to convert date string to 'C' locale
-				conv = self.convertLocale(dateMatch.group())
+				conv = self.convertLocale(datePattern)
 				try:
 					date = list(time.strptime(conv, self.getPattern()))
 				except (ValueError, re.error), e:
@@ -179,8 +192,28 @@ class DateStrptime(DateTemplate):
 					# NOTE: Possibly makes week/year day incorrect
 					date[1] = MyTime.gmtime()[1]
 					date[2] = MyTime.gmtime()[2]
+			if self.__unsupported_z:
+				z = dateMatch.group('_z')
+				if z:
+					date_sec = time.mktime(date)
+					date_sec -= (int(z[1:3]) * 60 + int(z[3:])) * int(z[0] + '60')
+					date = list(time.localtime(date_sec))
+					#date[8] = 0 # dst
+					logSys.debug(u"After working with offset date now %r" % date)
+				
 		return date
 
+try:
+	time.strptime("26-Jul-2007 15:20:52.252","%d-%b-%Y %H:%M:%S.%f")
+	DateStrptime._f = True
+except ValueError:
+	DateTemplate._f = False
+
+try:
+	time.strptime("24/Mar/2013:08:58:32 -0500","%d/%b/%Y:%H:%M:%S %z")
+	DateStrptime._z = True
+except ValueError:
+	DateStrptime._z = False
 
 class DateTai64n(DateTemplate):
 	
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index bc6a3865..f60adcc6 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -65,16 +65,18 @@ class DateDetectorTest(unittest.TestCase):
 
 		for sdate in (
 			"Jan 23 21:59:59",
+			"Sun Jan 23 21:59:59.011 2005",
 			"Sun Jan 23 21:59:59 2005",
 			"Sun Jan 23 21:59:59",
 			"2005/01/23 21:59:59",
 			"2005.01.23 21:59:59",
 			"23/01/2005 21:59:59",
 			"23/01/05 21:59:59",
-			"23/Jan/2005:21:59:59",
+			"23/Jan/2005:22:59:59 +0100",
 			"01/23/2005:21:59:59",
 			"2005-01-23 21:59:59",
-			"23-Jan-2005 21:59:59",
+			"23-Jan-2005 21:59:59.02",
+			"23-Jan-2005 22:59:59 +0100",
 			"23-01-2005 21:59:59",
 			"01-23-2005 21:59:59.252", # reported on f2b, causes Feb29 fix to break
 			"@4000000041f4104f00000000", # TAI64N
@@ -129,6 +131,23 @@ class DateDetectorTest(unittest.TestCase):
 			for template in self.__datedetector.getTemplates()
 			if hasattr(template, "getPattern")]
 
+		ZERO = datetime.timedelta(0)
+		HOUR = datetime.timedelta(hours=1)
+
+		# A UTC class. to make %z formats work
+
+		class UTC(datetime.tzinfo):
+		    """UTC"""
+
+		    def utcoffset(self, dt):
+		        return ZERO
+
+		    def tzname(self, dt):
+				return "UTC"
+
+		    def dst(self, dt):
+				return ZERO
+
 		year = 2008 # Leap year, 08 for %y can be confused with both %d and %m
 		def iterDates(year):
 			for month in xrange(1, 13):
@@ -137,7 +156,7 @@ class DateDetectorTest(unittest.TestCase):
 						for minute in xrange(0, 60, 15):
 							for second in xrange(0, 60, 15): # Far enough?
 								yield datetime.datetime(
-									year, month, day, hour, minute, second)
+									year, month, day, hour, minute, second, 300, UTC())
 
 		overlapedTemplates = set()
 		for date in iterDates(year):
@@ -156,12 +175,12 @@ class DateDetectorTest(unittest.TestCase):
 				matchedTemplates = [template
 					for template in self.__datedetector.getTemplates()
 					if template.getHits() > 0]
-				assert matchedTemplates != [] # Should match at least one
+				self.assertNotEqual(matchedTemplates, [], "Date %r should match at least one template" % pattern)
 				if len(matchedTemplates) > 1:
 					overlapedTemplates.add((pattern, tuple(sorted(template.getName()
 						for template in matchedTemplates))))
 		if overlapedTemplates:
-			print "WARNING: The following date templates overlap:"
+			print("WARNING: The following date templates overlap:")
 			pprint.pprint(overlapedTemplates)
 
 #	def testDefaultTempate(self):
diff --git a/testcases/files/logs/apache-badbots b/testcases/files/logs/apache-badbots
index 35669252..20134971 100644
--- a/testcases/files/logs/apache-badbots
+++ b/testcases/files/logs/apache-badbots
@@ -1,2 +1,2 @@
-# failJSON: { "time": "2007-03-05T14:39:21", "match": true , "host": "1.2.3.4" }
+# failJSON: { "time": "2007-03-05T13:39:21", "match": true , "host": "1.2.3.4" }
 1.2.3.4 - - [05/Mar/2007:14:39:21 +0100] "POST /123.html/trackback/ HTTP/1.0" 301 459 "http://www.mydomain.tld/123.html/trackback" "TrackBack/1.02"
diff --git a/testcases/files/logs/php-url-fopen b/testcases/files/logs/php-url-fopen
index f119a928..5168e299 100644
--- a/testcases/files/logs/php-url-fopen
+++ b/testcases/files/logs/php-url-fopen
@@ -1,2 +1,2 @@
-# failJSON: { "time": "2009-03-26T08:44:20", "match": true , "host": "66.185.212.172" }
+# failJSON: { "time": "2009-03-26T13:44:20", "match": true , "host": "66.185.212.172" }
 66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth
index 7c16efbd..ed71af75 100644
--- a/testcases/files/logs/roundcube-auth
+++ b/testcases/files/logs/roundcube-auth
@@ -1,4 +1,4 @@
-# failJSON: { "time": "2013-01-22T22:28:21", "match": true , "host": "192.0.43.10" }
+# failJSON: { "time": "2013-01-22T20:28:21", "match": true , "host": "192.0.43.10" }
 [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10
 # failJSON: { "time": "2005-05-26T07:12:40", "match": true , "host": "10.1.1.47" }
 May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47

From 8c1b8284231932fc2f3e41ff66baf371c3c71001 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 9 Sep 2013 03:41:12 +1000
Subject: [PATCH 12/19] BF: capture of microseconds no longer needed. Closes
 gh-341

---
 config/filter.d/named-refused.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index 4c30a0fe..031b8608 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -24,5 +24,5 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 
 failregex = ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
             ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
-            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
+            ^%(__line_prefix)s( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
 

From b78507654853525b57c3375583ce40a57cf440c7 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 15 Sep 2013 23:37:04 +1000
Subject: [PATCH 13/19] TST: fix test data to match parsing of timezone in UTC

---
 testcases/files/logs/apache-badbots | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/files/logs/apache-badbots b/testcases/files/logs/apache-badbots
index 20134971..35669252 100644
--- a/testcases/files/logs/apache-badbots
+++ b/testcases/files/logs/apache-badbots
@@ -1,2 +1,2 @@
-# failJSON: { "time": "2007-03-05T13:39:21", "match": true , "host": "1.2.3.4" }
+# failJSON: { "time": "2007-03-05T14:39:21", "match": true , "host": "1.2.3.4" }
 1.2.3.4 - - [05/Mar/2007:14:39:21 +0100] "POST /123.html/trackback/ HTTP/1.0" 301 459 "http://www.mydomain.tld/123.html/trackback" "TrackBack/1.02"

From d875e8ca0d4083372aba0f5963bb51f8f4aa3d00 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 15 Sep 2013 23:38:44 +1000
Subject: [PATCH 14/19] TST: fix test data - TAI64N timedata was in UTC+1 DST
 rather than UTC+1

---
 testcases/files/logs/dovecot | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index 553ed621..b581baf1 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -1,12 +1,12 @@
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "80.187.101.33" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "80.187.101.33" }
 @400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
 
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "176.61.140.224" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "176.61.140.224" }
 @400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
 # Above example with injected rhost into ruser -- should not match for 1.2.3.4
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "192.0.43.10" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "192.0.43.10" }
 @400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=rhost=1.2.3.4 rhost=192.0.43.10
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "176.61.140.225" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "176.61.140.225" }
 @400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.225  user=root
 
 # failJSON: { "time": "2004-12-12T11:19:11", "match": true , "host": "190.210.136.21" }

From 4997b30193d9b154967c22ad0a744800dc7bbcf3 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 15 Sep 2013 23:39:41 +1000
Subject: [PATCH 15/19] TST: add datetime method on mytime for rework of
 datedetector

---
 server/mytime.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/server/mytime.py b/server/mytime.py
index 8ae85184..554d3544 100644
--- a/server/mytime.py
+++ b/server/mytime.py
@@ -21,7 +21,7 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import time
+import time, datetime
 
 ##
 # MyTime class.
@@ -74,6 +74,14 @@ class MyTime:
 			return time.gmtime(MyTime.myTime)
 	gmtime = staticmethod(gmtime)
 
+	#@staticmethod
+	def now():
+		if MyTime.myTime is None:
+			return datetime.now()
+		else:
+			return datetime.datetime.fromtimestamp(MyTime.myTime)
+	now = staticmethod(now)
+
 	def localtime(x=None):
 		if MyTime.myTime is None or x is not None:
 			return time.localtime(x)

From 422e2527c4f18f3c77a8011246a78e6499f20d08 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 15 Sep 2013 23:42:38 +1000
Subject: [PATCH 16/19] TST: correct failData - faildata in UTC+1 not UTC

---
 testcases/files/logs/php-url-fopen  | 2 +-
 testcases/files/logs/roundcube-auth | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/testcases/files/logs/php-url-fopen b/testcases/files/logs/php-url-fopen
index 5168e299..cbeacf93 100644
--- a/testcases/files/logs/php-url-fopen
+++ b/testcases/files/logs/php-url-fopen
@@ -1,2 +1,2 @@
-# failJSON: { "time": "2009-03-26T13:44:20", "match": true , "host": "66.185.212.172" }
+# failJSON: { "time": "2009-03-26T14:44:20", "match": true , "host": "66.185.212.172" }
 66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth
index ed71af75..3046c63b 100644
--- a/testcases/files/logs/roundcube-auth
+++ b/testcases/files/logs/roundcube-auth
@@ -1,4 +1,4 @@
-# failJSON: { "time": "2013-01-22T20:28:21", "match": true , "host": "192.0.43.10" }
+# failJSON: { "time": "2013-01-22T21:28:21", "match": true , "host": "192.0.43.10" }
 [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10
 # failJSON: { "time": "2005-05-26T07:12:40", "match": true , "host": "10.1.1.47" }
 May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47

From d8f73c0205ae64976e95681f913d8c23d6448010 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 15 Sep 2013 23:44:30 +1000
Subject: [PATCH 17/19] ENH: full timezone support

ISO8601 and %z based timezones now fully supported.

Restructured so log lines are also only parsed once and return
a unixtime and a pattern match.

Fix all test cases to adjust for the change in return value.
---
 server/datedetector.py            |  4 --
 server/datetemplate.py            | 92 +++++++++++++++++--------------
 server/filter.py                  | 34 ++++++------
 testcases/datedetectortestcase.py | 69 ++++++++++-------------
 testcases/filtertestcase.py       | 23 ++++----
 testcases/samplestestcase.py      | 20 ++++---
 6 files changed, 124 insertions(+), 118 deletions(-)

diff --git a/server/datedetector.py b/server/datedetector.py
index 2d773113..8d15d01c 100644
--- a/server/datedetector.py
+++ b/server/datedetector.py
@@ -208,10 +208,6 @@ class DateDetector:
 		finally:
 			self.__lock.release()
 
-	def getUnixTime(self, line):
-		date = self.getTime(line)
-		return date and time.mktime(date)
-
 	##
 	# Sort the template lists using the hits score. This method is not called
 	# in this object and thus should be called from time to time.
diff --git a/server/datetemplate.py b/server/datetemplate.py
index f4847640..0d7aefb4 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -24,7 +24,10 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import re, time
+import re, time, calendar
+
+from datetime import datetime
+from datetime import timedelta
 
 from mytime import MyTime
 import iso8601
@@ -82,12 +85,11 @@ class DateEpoch(DateTemplate):
 		self.setRegex("^\d{10}(\.\d{6})?")
 	
 	def getDate(self, line):
-		date = None
 		dateMatch = self.matchDate(line)
 		if dateMatch:
 			# extract part of format which represents seconds since epoch
-			date = list(MyTime.localtime(float(dateMatch.group())))
-		return date
+			return (float(dateMatch.group()), dateMatch)
+		return None
 
 
 ##
@@ -136,7 +138,6 @@ class DateStrptime(DateTemplate):
 	convertLocale = staticmethod(convertLocale)
 	
 	def getDate(self, line):
-		date = None
 		dateMatch = self.matchDate(line)
 
 		if dateMatch:
@@ -151,12 +152,12 @@ class DateStrptime(DateTemplate):
 					logSys.debug(u"Replacing %%z with %r now %r" % (dateMatch.group('_z'), datePattern))
 			try:
 				# Try first with 'C' locale
-				date = list(time.strptime(dateMatch.group(), datePattern))
+				date = datetime.strptime(dateMatch.group(), datePattern)
 			except ValueError:
 				# Try to convert date string to 'C' locale
-				conv = self.convertLocale(datePattern)
+				conv = self.convertLocale(dateMatch.group())
 				try:
-					date = list(time.strptime(conv, self.getPattern()))
+					date = datetime.strptime(conv, self.getPattern())
 				except (ValueError, re.error), e:
 					# Try to add the current year to the pattern. Should fix
 					# the "Feb 29" issue.
@@ -165,7 +166,7 @@ class DateStrptime(DateTemplate):
 					if not '%Y' in opattern:
 						pattern = "%s %%Y" % opattern
 						conv += " %s" % MyTime.gmtime()[0]
-						date = list(time.strptime(conv, pattern))
+						date = datetime.strptime(conv, pattern)
 					else:
 						# we are helpless here
 						raise ValueError(
@@ -173,35 +174,48 @@ class DateStrptime(DateTemplate):
 							"exception was %r and Feb 29 workaround could not "
 							"be tested due to already present year mark in the "
 							"pattern" % (opattern, e))
-			if date[0] < 2000:
-				# There is probably no year field in the logs
-				# NOTE: Possibly makes week/year day incorrect
-				date[0] = MyTime.gmtime()[0]
-				# Bug fix for #1241756
-				# If the date is greater than the current time, we suppose
-				# that the log is not from this year but from the year before
-				if time.mktime(date) > MyTime.time():
-					logSys.debug(
-						u"Correcting deduced year from %d to %d since %f > %f" %
-						(date[0], date[0]-1, time.mktime(date), MyTime.time()))
-					# NOTE: Possibly makes week/year day incorrect
-					date[0] -= 1
-				elif date[1] == 1 and date[2] == 1:
-					# If it is Jan 1st, it is either really Jan 1st or there
-					# is neither month nor day in the log.
-					# NOTE: Possibly makes week/year day incorrect
-					date[1] = MyTime.gmtime()[1]
-					date[2] = MyTime.gmtime()[2]
+
 			if self.__unsupported_z:
 				z = dateMatch.group('_z')
 				if z:
-					date_sec = time.mktime(date)
-					date_sec -= (int(z[1:3]) * 60 + int(z[3:])) * int(z[0] + '60')
-					date = list(time.localtime(date_sec))
-					#date[8] = 0 # dst
-					logSys.debug(u"After working with offset date now %r" % date)
+					delta = timedelta(hours=int(z[1:3]),minutes=int(z[3:]))
+					direction = z[0]
+					logSys.debug(u"Altering %r by removing time zone offset (%s)%s" % (date, direction, delta))
+					# here we reverse the effect of the timezone and force it to UTC
+					if direction == '+':
+						date -= delta
+					else:
+						date += delta
+					date = date.replace(tzinfo=iso8601.Utc())
+				else:
+					logSys.warn("No _z group captured and %%z is not supported on current platform"
+								" - timezone ignored and assumed to be localtime. date: %s on line: %s"
+								% (date, line))
+
+			if date.year < 2000:
+				# There is probably no year field in the logs
+				# NOTE: Possibly makes week/year day incorrect
+				date = date.replace(year=MyTime.gmtime()[0])
+				# Bug fix for #1241756
+				# If the date is greater than the current time, we suppose
+				# that the log is not from this year but from the year before
+				if date > MyTime.now():
+					logSys.debug(
+						u"Correcting deduced year by one since %s > now (%s)" %
+						(date, MyTime.time()))
+					date = date.replace(year=date.year-1)
+				elif date.month == 1 and date.day == 1:
+					# If it is Jan 1st, it is either really Jan 1st or there
+					# is neither month nor day in the log.
+					# NOTE: Possibly makes week/year day incorrect
+					date = date.replace(month=MyTime.gmtime()[1], day=1)
+
+			if date.tzinfo:
+				return ( calendar.timegm(date.utctimetuple()), dateMatch )
+			else:
+				return ( time.mktime(date.utctimetuple()), dateMatch )
 				
-		return date
+		return None
 
 try:
 	time.strptime("26-Jul-2007 15:20:52.252","%d-%b-%Y %H:%M:%S.%f")
@@ -224,15 +238,14 @@ class DateTai64n(DateTemplate):
 		self.setRegex("@[0-9a-f]{24}", wordBegin=False)
 	
 	def getDate(self, line):
-		date = None
 		dateMatch = self.matchDate(line)
 		if dateMatch:
 			# extract part of format which represents seconds since epoch
 			value = dateMatch.group()
 			seconds_since_epoch = value[2:17]
 			# convert seconds from HEX into local time stamp
-			date = list(MyTime.localtime(int(seconds_since_epoch, 16)))
-		return date
+			return (int(seconds_since_epoch, 16), dateMatch)
+		return None
 
 
 class DateISO8601(DateTemplate):
@@ -245,11 +258,10 @@ class DateISO8601(DateTemplate):
 		self.setRegex(date_re)
 	
 	def getDate(self, line):
-		date = None
 		dateMatch = self.matchDate(line)
 		if dateMatch:
 			# Parses the date.
 			value = dateMatch.group()
-			date = list(iso8601.parse_date(value).timetuple())
-		return date
+			return (calendar.timegm(iso8601.parse_date(value).utctimetuple()), dateMatch)
+		return None
 
diff --git a/server/filter.py b/server/filter.py
index 2f88cbea..412dd2d1 100644
--- a/server/filter.py
+++ b/server/filter.py
@@ -295,18 +295,8 @@ class Filter(JailThread):
 		l = l.rstrip('\r\n')
 
 		logSys.log(7, "Working on line %r", l)
-		timeMatch = self.dateDetector.matchTime(l)
-		if timeMatch:
-			# Lets split into time part and log part of the line
-			timeLine = timeMatch.group()
-			# Lets leave the beginning in as well, so if there is no
-			# anchore at the beginning of the time regexp, we don't
-			# at least allow injection. Should be harmless otherwise
-			logLine  = l[:timeMatch.start()] + l[timeMatch.end():]
-		else:
-			timeLine = l
-			logLine = l
-		return self.findFailure(timeLine, logLine, returnRawHost, checkAllRegex)
+
+		return self.findFailure(l, returnRawHost, checkAllRegex)
 
 	def processLineAndAdd(self, line):
 		"""Processes the line for failures and populates failManager
@@ -349,16 +339,28 @@ class Filter(JailThread):
 	# to find the logging time.
 	# @return a dict with IP and timestamp.
 
-	def findFailure(self, timeLine, logLine,
+	def findFailure(self, logLine,
 			returnRawHost=False, checkAllRegex=False):
-		logSys.log(5, "Date: %r, message: %r", timeLine, logLine)
 		failList = list()
 		# Checks if we must ignore this line.
 		if self.ignoreLine(logLine) is not None:
 			# The ignoreregex matched. Return.
-			logSys.log(7, "Matched ignoreregex and was ignored")
+			logSys.log(7, "Matched ignoreregex and was \"%s\" ignored", logLine)
 			return failList
-		date = self.dateDetector.getUnixTime(timeLine)
+		dd = self.dateDetector.getTime(logLine)
+		
+		if dd is None:
+			return failList
+		date = dd[0]
+		timeMatch = dd[1]
+		if timeMatch:
+			# Lets split into time part and log part of the line
+			timeLine = timeMatch.group()
+			# Lets leave the beginning in as well, so if there is no
+			# anchore at the beginning of the time regexp, we don't
+			# at least allow injection. Should be harmless otherwise
+			logLine  = logLine[:timeMatch.start()] + logLine[timeMatch.end():]
+
 		# Iterates over all the regular expressions.
 		for failRegexIndex, failRegex in enumerate(self.__failRegex):
 			failRegex.search(logLine)
diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index f60adcc6..27a32c19 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -24,9 +24,10 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
-import unittest, calendar, datetime, re, pprint
+import unittest, calendar, time, datetime, re, pprint
 from server.datedetector import DateDetector
 from server.datetemplate import DateTemplate
+from server.iso8601 import Utc
 
 class DateDetectorTest(unittest.TestCase):
 
@@ -40,11 +41,12 @@ class DateDetectorTest(unittest.TestCase):
 	
 	def testGetEpochTime(self):
 		log = "1138049999 [sshd] error: PAM: Authentication failure"
-		date = [2006, 1, 23, 21, 59, 59, 0, 23, 0]
+		#date = [2006, 1, 23, 21, 59, 59, 0, 23, 0]
 		dateUnix = 1138049999.0
 
-		self.assertEqual(self.__datedetector.getTime(log), date)
-		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+		( datelog, matchlog ) = self.__datedetector.getTime(log)
+		self.assertEqual(datelog, dateUnix)
+		self.assertEqual(matchlog.group(), '1138049999')
 	
 	def testGetTime(self):
 		log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"
@@ -54,8 +56,9 @@ class DateDetectorTest(unittest.TestCase):
 		#      is not correctly determined atm, since year is not present
 		#      in the log entry.  Since this doesn't effect the operation
 		#      of fail2ban -- we just ignore incorrect day of the week
-		self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
-		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+		( datelog, matchlog ) = self.__datedetector.getTime(log)
+		self.assertEqual(datelog, dateUnix)
+		self.assertEqual(matchlog.group(), 'Jan 23 21:59:59')
 
 	def testVariousTimes(self):
 		"""Test detection of various common date/time formats f2b should understand
@@ -72,16 +75,16 @@ class DateDetectorTest(unittest.TestCase):
 			"2005.01.23 21:59:59",
 			"23/01/2005 21:59:59",
 			"23/01/05 21:59:59",
-			"23/Jan/2005:22:59:59 +0100",
+			"23/Jan/2005:21:59:59 +0100",
 			"01/23/2005:21:59:59",
 			"2005-01-23 21:59:59",
 			"23-Jan-2005 21:59:59.02",
-			"23-Jan-2005 22:59:59 +0100",
+			"23-Jan-2005 21:59:59 +0100",
 			"23-01-2005 21:59:59",
 			"01-23-2005 21:59:59.252", # reported on f2b, causes Feb29 fix to break
 			"@4000000041f4104f00000000", # TAI64N
-			"2005-01-23T21:59:59.252Z", #ISO 8601
-			"2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ
+			"2005-01-23T20:59:59.252Z", #ISO 8601
+			"2005-01-23T15:59:59-05:00", #ISO 8601 with TZ
 			"<01/23/05@21:59:59>",
 			"050123 21:59:59", # MySQL
 			"Jan-23-05 21:59:59", # ASSP like
@@ -92,8 +95,9 @@ class DateDetectorTest(unittest.TestCase):
 			# yoh: on [:6] see in above test
 			logtime = self.__datedetector.getTime(log)
 			self.assertNotEqual(logtime, None, "getTime retrieved nothing: failure for %s" % sdate)
-			self.assertEqual(logtime[:6], date[:6], "getTime comparison failure for %s: \"%s\" is not \"%s\"" % (sdate, logtime[:6], date[:6]))
-			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix, "getUnixTime failure for %s: \"%s\" is not \"%s\"" % (sdate, logtime[:6], date[:6]))
+			( logUnix, logMatch ) = logtime
+			self.assertEqual(logUnix, dateUnix, "getTime comparison failure for %s: \"%s\" is not \"%s\"" % (sdate, logUnix, dateUnix))
+			self.assertEqual(logMatch.group(), sdate)
 
 	def testStableSortTemplate(self):
 		old_names = [x.getName() for x in self.__datedetector.getTemplates()]
@@ -110,44 +114,29 @@ class DateDetectorTest(unittest.TestCase):
 		# see https://github.com/fail2ban/fail2ban/pull/130
 		# yoh: unfortunately this test is not really effective to reproduce the
 		#      situation but left in place to assure consistent behavior
-		m1 = [2012, 10, 11, 2, 37, 17]
-		self.assertEqual(
-			self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')[:6],
-			m1)
+		mu = time.mktime(datetime.datetime(2012, 10, 11, 2, 37, 17).utctimetuple())
+		logdate = self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')
+		self.assertNotEqual(logdate, None)
+		( logTime, logMatch ) = logdate
+		self.assertEqual(logTime, mu)
+		self.assertEqual(logMatch.group(), '2012/10/11 02:37:17')
 		self.__datedetector.sortTemplate()
 		# confuse it with year being at the end
 		for i in xrange(10):
-			self.assertEqual(
-				self.__datedetector.getTime('11/10/2012 02:37:17 [error] 18434#0')[:6],
-				m1)
+			( logTime, logMatch ) =	self.__datedetector.getTime('11/10/2012 02:37:17 [error] 18434#0')
+			self.assertEqual(logTime, mu)
+			self.assertEqual(logMatch.group(), '11/10/2012 02:37:17')
 		self.__datedetector.sortTemplate()
 		# and now back to the original
-		self.assertEqual(
-			self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')[:6],
-			m1)
+		( logTime, logMatch ) = self.__datedetector.getTime('2012/10/11 02:37:17 [error] 18434#0')
+		self.assertEqual(logTime, mu)
+		self.assertEqual(logMatch.group(), '2012/10/11 02:37:17')
 
 	def testDateDetectorTemplateOverlap(self):
 		patterns = [template.getPattern()
 			for template in self.__datedetector.getTemplates()
 			if hasattr(template, "getPattern")]
 
-		ZERO = datetime.timedelta(0)
-		HOUR = datetime.timedelta(hours=1)
-
-		# A UTC class. to make %z formats work
-
-		class UTC(datetime.tzinfo):
-		    """UTC"""
-
-		    def utcoffset(self, dt):
-		        return ZERO
-
-		    def tzname(self, dt):
-				return "UTC"
-
-		    def dst(self, dt):
-				return ZERO
-
 		year = 2008 # Leap year, 08 for %y can be confused with both %d and %m
 		def iterDates(year):
 			for month in xrange(1, 13):
@@ -156,7 +145,7 @@ class DateDetectorTest(unittest.TestCase):
 						for minute in xrange(0, 60, 15):
 							for second in xrange(0, 60, 15): # Far enough?
 								yield datetime.datetime(
-									year, month, day, hour, minute, second, 300, UTC())
+									year, month, day, hour, minute, second, 300, Utc())
 
 		overlapedTemplates = set()
 		for date in iterDates(year):
diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py
index 2061327a..a89e62c0 100644
--- a/testcases/filtertestcase.py
+++ b/testcases/filtertestcase.py
@@ -40,6 +40,7 @@ from server.failmanager import FailManagerEmpty
 #
 
 from utils import mtimesleep
+from server.mytime import MyTime
 
 # yoh: per Steven Hiscocks's insight while troubleshooting
 # https://github.com/fail2ban/fail2ban/issues/103#issuecomment-15542836
@@ -78,8 +79,8 @@ def _assert_equal_entries(utest, found, output, count=None):
 	utest.assertEqual(found[0], output[0])            # IP
 	utest.assertEqual(found[1], count or output[1])   # count
 	found_time, output_time = \
-				time.localtime(found[2]),\
-				time.localtime(output[2])
+				MyTime.localtime(found[2]),\
+				MyTime.localtime(output[2])
 	utest.assertEqual(found_time, output_time)
 	if len(output) > 3 and count is None: # match matches
 		# do not check if custom count (e.g. going through them twice)
@@ -560,7 +561,7 @@ class GetFailures(unittest.TestCase):
 	FILENAME_USEDNS = "testcases/files/testcase-usedns.log"
 
 	# so that they could be reused by other tests
-	FAILURES_01 = ('193.168.0.128', 3, 1124013599.0,
+	FAILURES_01 = ('193.168.0.128', 3, 1124017199.0,
 				  ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n']*3)
 
 	def setUp(self):
@@ -604,7 +605,7 @@ class GetFailures(unittest.TestCase):
 
 
 	def testGetFailures02(self):
-		output = ('141.3.81.106', 4, 1124013539.0,
+		output = ('141.3.81.106', 4, 1124017139.0,
 				  ['Aug 14 11:%d:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2\n'
 				   % m for m in 53, 54, 57, 58])
 
@@ -614,7 +615,7 @@ class GetFailures(unittest.TestCase):
 		_assert_correct_last_attempt(self, self.filter, output)
 
 	def testGetFailures03(self):
-		output = ('203.162.223.135', 6, 1124013544.0)
+		output = ('203.162.223.135', 6, 1124017144.0)
 
 		self.filter.addLogPath(GetFailures.FILENAME_03)
 		self.filter.addFailRegex("error,relay=<HOST>,.*550 User unknown")
@@ -622,8 +623,8 @@ class GetFailures(unittest.TestCase):
 		_assert_correct_last_attempt(self, self.filter, output)
 
 	def testGetFailures04(self):
-		output = [('212.41.96.186', 4, 1124013600.0),
-				  ('212.41.96.185', 4, 1124013598.0)]
+		output = [('212.41.96.186', 4, 1124017200.0),
+				  ('212.41.96.185', 4, 1124017198.0)]
 
 		self.filter.addLogPath(GetFailures.FILENAME_04)
 		self.filter.addFailRegex("Invalid user .* <HOST>")
@@ -637,11 +638,11 @@ class GetFailures(unittest.TestCase):
 
 	def testGetFailuresUseDNS(self):
 		# We should still catch failures with usedns = no ;-)
-		output_yes = ('93.184.216.119', 2, 1124013539.0,
+		output_yes = ('93.184.216.119', 2, 1124017139.0,
 					  ['Aug 14 11:54:59 i60p295 sshd[12365]: Failed publickey for roehl from example.com port 51332 ssh2\n',
 					   'Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2\n'])
 
-		output_no = ('93.184.216.119', 1, 1124013539.0,
+		output_no = ('93.184.216.119', 1, 1124017139.0,
 					  ['Aug 14 11:58:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:93.184.216.119 port 51332 ssh2\n'])
 
 		# Actually no exception would be raised -- it will be just set to 'no'
@@ -663,7 +664,7 @@ class GetFailures(unittest.TestCase):
 
 
 	def testGetFailuresMultiRegex(self):
-		output = ('141.3.81.106', 8, 1124013541.0)
+		output = ('141.3.81.106', 8, 1124017141.0)
 
 		self.filter.addLogPath(GetFailures.FILENAME_02)
 		self.filter.addFailRegex("Failed .* from <HOST>")
@@ -672,7 +673,7 @@ class GetFailures(unittest.TestCase):
 		_assert_correct_last_attempt(self, self.filter, output)
 
 	def testGetFailuresIgnoreRegex(self):
-		output = ('141.3.81.106', 8, 1124013541.0)
+		output = ('141.3.81.106', 8, 1124017141.0)
 
 		self.filter.addLogPath(GetFailures.FILENAME_02)
 		self.filter.addFailRegex("Failed .* from <HOST>")
diff --git a/testcases/samplestestcase.py b/testcases/samplestestcase.py
index c7ff0b9a..acd553c1 100644
--- a/testcases/samplestestcase.py
+++ b/testcases/samplestestcase.py
@@ -22,7 +22,9 @@
 __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"
 
-import unittest, sys, os, fileinput, re, datetime, inspect
+import unittest, sys, os, fileinput, re, time, datetime, inspect
+from server.mytime import MyTime
+
 
 if sys.version_info >= (2, 6):
 	import json
@@ -110,15 +112,19 @@ def testSampleRegexsFactory(name):
 								 (map(lambda x: x[0], ret),logFile.filename(), logFile.filelineno()))
 
 				# Verify timestamp and host as expected
-				failregex, host, time = ret[0]
+				failregex, host, fail2banTime = ret[0]
 				self.assertEqual(host, faildata.get("host", None))
-				fail2banTime = datetime.datetime.fromtimestamp(time)
-				jsonTime = datetime.datetime.strptime(
-							faildata.get("time", None), "%Y-%m-%dT%H:%M:%S")
+
+				t = faildata.get("time", None)
+				jsonTimeLocal =	datetime.datetime.strptime(t, "%Y-%m-%dT%H:%M:%S")
+
+				jsonTime = time.mktime(jsonTimeLocal.utctimetuple())
 				
 				self.assertEqual(fail2banTime, jsonTime,
-					"Time  mismatch %s != %s on: %s:%i %r:" % 
-					(fail2banTime, jsonTime, logFile.filename(), logFile.filelineno(), line ) )
+					"UTC Time  mismatch fail2ban %s (%s) != failJson %s (%s)  (diff %i seconds) on: %s:%i %r:" % 
+					(fail2banTime, time.strftime("%Y-%m-%dT%H:%M:%S", time.gmtime(fail2banTime)),
+					jsonTime, time.strftime("%Y-%m-%dT%H:%M:%S", time.gmtime(jsonTime)),
+					fail2banTime - jsonTime, logFile.filename(), logFile.filelineno(), line ) )
 
 				regexsUsed.add(failregex)
 

From 2cefce5ee0594527ec27f15c43035b3c1aadb6a9 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 16 Sep 2013 00:09:41 +1000
Subject: [PATCH 18/19] TST: testDateDetectorTemplateOverlap fix for python-2.5
 without %f in strftime

---
 testcases/datedetectortestcase.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py
index 27a32c19..6eca3204 100644
--- a/testcases/datedetectortestcase.py
+++ b/testcases/datedetectortestcase.py
@@ -151,6 +151,7 @@ class DateDetectorTest(unittest.TestCase):
 		for date in iterDates(year):
 			for pattern in patterns:
 				datestr = date.strftime(pattern)
+				datestr = re.sub(r'%f','300', datestr) # for python 2.5 where there is no %f
 				datestrs = set([
 					datestr,
 					re.sub(r"(\s)0", r"\1 ", datestr),

From 50a6289f03a0f1540c0a965e85b07609b476e1ae Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Mon, 16 Sep 2013 18:50:19 +1000
Subject: [PATCH 19/19] BF: handle 2.4 and %f in strftime

---
 server/datetemplate.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/datetemplate.py b/server/datetemplate.py
index 0d7aefb4..174538e5 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -220,7 +220,7 @@ class DateStrptime(DateTemplate):
 try:
 	time.strptime("26-Jul-2007 15:20:52.252","%d-%b-%Y %H:%M:%S.%f")
 	DateStrptime._f = True
-except ValueError:
+except (ValueError, KeyError):
 	DateTemplate._f = False
 
 try: