github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch '0.11'

pull/3242/head
sebres 2022-03-03 15:18:11 +01:00
parent 3a9f5c0b5d 8c4d02403b
commit f81f85569d
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fail2ban/server/filter.py
View File

@ -794,6 +794,8 @@ class Filter(JailThread):
# be sure we've correct current state ('nofail' and 'mlfgained' only from last failure)
if mlfidGroups.pop('nofail', None): nfflgs |= 4
if mlfidGroups.pop('mlfgained', None): nfflgs |= 4
# gained resets all pending failures (retaining users to check it later)
if nfflgs & 8: mlfidGroups.pop('mlfpending', None)
# if we had no pending failures then clear the matches (they are already provided):
if (nfflgs & 4) == 0 and not mlfidGroups.get('mlfpending', 0):
mlfidGroups.pop("matches", None)

21
fail2ban/tests/fail2banregextestcase.py
View File

@ -514,6 +514,27 @@ class Fail2banRegexTest(LogCaptureTestCase):
'192.0.2.1, git, '+lines[-1],
all=True)
def testOutputNoPendingFailuresAfterGained(self):
unittest.F2B.SkipIfCfgMissing(stock=True)
# connect finished without authorization must generate a failure, because
# connect started will produce pending failure which gets reset by gained
# connect authorized.
self.assertTrue(_test_exec('-o', 'failure from == <ip> ==',
'-c', CONFIG_DIR, '-d', '{NONE}',
'svc[1] connect started 192.0.2.3\n'
'svc[1] connect finished 192.0.2.3\n'
'svc[2] connect started 192.0.2.4\n'
'svc[2] connect authorized 192.0.2.4\n'
'svc[2] connect finished 192.0.2.4\n',
'common[prefregex="^svc\[<F-MLFID>\d+</F-MLFID>\] connect <F-CONTENT>.+</F-CONTENT>$"'
', failregex="'
'^started\n'
'^<F-NOFAIL><F-MLFFORGET>finished</F-MLFFORGET></F-NOFAIL> <ADDR>\n'
'^<F-MLFGAINED>authorized</F-MLFGAINED> <ADDR>'
'", maxlines=1]'
))
self.assertLogged('failure from == 192.0.2.3 ==')
self.assertNotLogged('failure from == 192.0.2.4 ==')
def testWrongFilterFile(self):
# use test log as filter file to cover eror cases...