mirror of https://github.com/fail2ban/fail2ban
BF: anchoring regex for IP with " *$" at the end + adjust regexp for <HOST>
to forbid matching IPs encoded in the hostname (like 1.2.3.4.xxx.yyyyy.zzz) prior doing actual DNS lookup. It is quite important and actually security hazard: DoS is easy to perform... Since now we don't do \S matching in <HOST> regexp, in the development branches we should also allow for unicode characters by adding 're.U' to HOST's regexpdebian-releases/squeeze
parent
3ecce6a188
commit
b54290affb
|
@ -44,7 +44,7 @@ class Regex:
|
||||||
self._matchCache = None
|
self._matchCache = None
|
||||||
# Perform shortcuts expansions.
|
# Perform shortcuts expansions.
|
||||||
# Replace "<HOST>" with default regular expression for host.
|
# Replace "<HOST>" with default regular expression for host.
|
||||||
regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
|
regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_]+)")
|
||||||
if regex.lstrip() == '':
|
if regex.lstrip() == '':
|
||||||
raise RegexException("Cannot add empty regex")
|
raise RegexException("Cannot add empty regex")
|
||||||
try:
|
try:
|
||||||
|
|
|
@ -492,7 +492,7 @@ import socket, struct
|
||||||
|
|
||||||
class DNSUtils:
|
class DNSUtils:
|
||||||
|
|
||||||
IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
|
IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}$")
|
||||||
|
|
||||||
#@staticmethod
|
#@staticmethod
|
||||||
def dnsToIp(dns):
|
def dnsToIp(dns):
|
||||||
|
|
Loading…
Reference in New Issue