github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

fix cut out of match for pattern with `{EPOCH}` (similar to other datepatterns group capturing whole regex only added if no groups specified at all); 

allows to specify more precise anchored patterns, for example `datepattern = ^type=\S+ msg=audit\(({EPOCH})` for selinux-filters
pull/3372/merge
sebres 2022-11-14 19:00:08 +01:00
parent eba33d6205
commit a58fcb8786
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fail2ban/server/datetemplate.py
View File

@ -227,8 +227,10 @@ class DateEpoch(DateTemplate):
self.name = "LongEpoch" if not pattern else pattern self.name = "LongEpoch" if not pattern else pattern
epochRE = r"\d{10,11}(?:\d{3}(?:\.\d{1,6}|\d{3})?)?" epochRE = r"\d{10,11}(?:\d{3}(?:\.\d{1,6}|\d{3})?)?"
if pattern: if pattern:
# pattern should capture/cut out the whole match: # pattern should find the whole pattern, but cut out grouped match (or whole match if no groups specified):
regex = "(" + RE_EPOCH_PATTERN.sub(lambda v: "(%s)" % epochRE, pattern) + ")" regex = RE_EPOCH_PATTERN.sub(lambda v: "(%s)" % epochRE, pattern)
if not RE_GROUPED.search(pattern):
regex = "(" + regex + ")"
self._grpIdx = 2 self._grpIdx = 2
self.setRegex(regex) self.setRegex(regex)
elif not lineBeginOnly: elif not lineBeginOnly:

9
fail2ban/tests/datedetectortestcase.py
View File

@ -119,6 +119,15 @@ class DateDetectorTest(LogCaptureTestCase):
log = log % dateLong log = log % dateLong
datelog = self.datedetector.getTime(log) datelog = self.datedetector.getTime(log)
self.assertFalse(datelog) self.assertFalse(datelog)
def testGetEpochPatternCut(self):
self.__datedetector = DateDetector()
self.__datedetector.appendTemplate(r'^type=\S+ msg=audit\(({EPOCH})')
# correct epoch time and cut out epoch string only (captured group only, not the whole match):
line = "type=USER_AUTH msg=audit(1106513999.000:987)"
datelog = self.datedetector.getTime(line)
timeMatch = datelog[1]
self.assertEqual([int(datelog[0]), line[timeMatch.start(1):timeMatch.end(1)]], [1106513999, '1106513999.000'])
def testGetTime(self): def testGetTime(self):
log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure" log = "Jan 23 21:59:59 [sshd] error: PAM: Authentication failure"