github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

fixes search for the best datepattern (gh-3020) - e. g. if line is too short, boundaries check for previously known unprecise pattern may fail on incomplete lines (logging break-off, no flush, etc)

pull/3117/head
sebres 2021-05-07 01:16:48 +02:00
parent 2918849f9e
commit ef5c826c74
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fail2ban/server/datedetector.py
View File

@ -365,10 +365,10 @@ class DateDetector(object):
# with space or some special char), otherwise possible collision/pattern switch:
if ((
line[distance-1:distance] == self.__lastPos[1] or
(line[distance] == self.__lastPos[2] and not self.__lastPos[2].isalnum())
(line[distance:distance+1] == self.__lastPos[2] and not self.__lastPos[2].isalnum())
) and (
line[endpos:endpos+1] == self.__lastEndPos[2] or
(line[endpos-1] == self.__lastEndPos[1] and not self.__lastEndPos[1].isalnum())
(line[endpos-1:endpos] == self.__lastEndPos[1] and not self.__lastEndPos[1].isalnum())
)):
# search in line part only:
log(logLevel-1, " boundaries are correct, search in part %r", line[distance:endpos])

12
fail2ban/tests/fail2banregextestcase.py
View File

@ -384,7 +384,17 @@ class Fail2banRegexTest(LogCaptureTestCase):
"Found a match but no valid date/time found",
"Match without a timestamp:", all=True)
self.pruneLog()
def testIncompleteDateTime(self):
# datepattern in followed lines doesn't match previously known pattern + line is too short
# (logging break-off, no flush, etc):
self.assertTrue(_test_exec(
'-o', 'Found-ADDR:<ip>',
'192.0.2.1 - - [02/May/2021:18:40:55 +0100] "GET / HTTP/1.1" 302 328 "-" "Mozilla/5.0" "-"\n'
'192.0.2.2 - - [02/May/2021:18:40:55 +0100\n'
'192.0.2.3 - - [02/May/2021:18:40:55',
'^<ADDR>'))
self.assertLogged(
"Found-ADDR:192.0.2.1", "Found-ADDR:192.0.2.2", "Found-ADDR:192.0.2.3", all=True)
def testFrmtOutputWrapML(self):
unittest.F2B.SkipIfCfgMissing(stock=True)