fail2ban

Commit Graph

Author	SHA1	Message	Date
Yaroslav Halchenko	90d6a4a6cd	ENH: consistent operation of formatExceptionInfo + unittest for it	12 years ago
Daniel Black	495f2dd877	DOC: purge of svn tags	12 years ago
Nicolas Collignon	39667ff6f7	FD_CLOEXEC support * 001-fail2ban-server-socket-close-on-exec-no-leak.diff Add code that marks server and client sockets with FD_CLOEXEC flags. Avoid leaking file descriptors to processes spawned when handling fail2ban actions (ex: iptables). Unix sockets managed by fail2ban-server don't need to be passed to any child process. Fail2ban already uses the FD_CLOEXEC flags in the filter code. This patch also avoids giving iptables access to fail2ban UNIX socket in a SELinux environment (A sane SELinux policy should trigger an audit event because "iptables" will be given read/write access to the fail2ban control socket). Some random references related to this bug: http://sourceforge.net/tracker/?func=detail&atid=689044&aid=2086568&group_id=121032 http://www.redhat.com/archives/fedora-selinux-list/2009-June/msg00124.html http://forums.fedoraforum.org/showthread.php?t=234230 * 002-fail2ban-filters-close-on-exec-typo-fix.diff There is a typo in the fail2ban server/filter.py source code. The FD_CLOEXEC is correctly set but additional random flags are also set. It has no side-effect as long as the fd doesn't match a valid flag :) "fcntl.fcntl(fd, fcntl.F_SETFD, fd \| fcntl.FD_CLOEXEC)" <== the 3rd parameter should be flags, not a file descriptor. * 003-fail2ban-gamin-socket-close-on-exec-no-leak.diff Add code that marks the Gamin monitor file descriptor with FD_CLOEXEC flags. Avoid leaking file descriptors to processes spawned when handling fail2ban actions (ex: iptables). --- File descriptors in action process before patches: dr-x------ 2 root root 0 . dr-xr-xr-x 8 root root 0 .. lr-x------ 1 root root 64 0 -> /dev/null <== OK l-wx------ 1 root root 64 1 -> /tmp/test.log <== used by test action lrwx------ 1 root root 64 2 -> /dev/null <== OK lrwx------ 1 root root 64 3 -> socket:[116361] <== NOK (fail2ban.sock leak) lr-x------ 1 root root 64 4 -> /proc/20090/fd <== used by test action l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK lrwx------ 1 root root 64 6 -> socket:[115608] <== NOK (gamin sock leak) File descriptors in action process after patches: dr-x------ 2 root root 0 . dr-xr-xr-x 8 root root 0 .. lr-x------ 1 root root 64 0 -> /dev/null <== OK l-wx------ 1 root root 64 1 -> /tmp/test.log <== used by test action lrwx------ 1 root root 64 2 -> /dev/null <== OK lr-x------ 1 root root 64 3 -> /proc/18284/fd <== used by test action l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK	12 years ago
Daniel Black	3665e6dc44	Add development documentation and framework for code coverage measurement	12 years ago
Leonardo Chiquitto	a7d47e8b36	Update Free Software Foundation's address The address has changed from "59 Temple Place, Suite 330, Boston, MA 02111-1307 USA" to "51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA" some time ago.	13 years ago
Yaroslav Halchenko	a9be451079	ENH: removed expansion for few Date and Revision SVN keywords For consistency of appearance... eventually we might just remove them altogether	13 years ago
Yaroslav Halchenko	ed6daa70bf	ENH: modelines for emacs and vim to assure consistent indentation scheme (tabs)	13 years ago
Arturo 'Buanzo' Busleiman	3e3a68f9de	added traceback to asyncserver.py's import. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@750 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Cyril Jaquier	b88956e898	- Added helper module in common. - Moved formatExceptionInfo by Buanzo to common/helpers.py. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@740 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Arturo 'Buanzo' Busleiman	81e2fe8306	added 'unexpected communication error' fix to ChangeLog. Added formatExceptionInfo to server/asyncserver.py We should move that function to a helpers module. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@739 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Arturo 'Buanzo' Busleiman	b2f0bfe751	added missing import sys to asyncserver.py git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@738 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Arturo 'Buanzo' Busleiman	08a36ca657	more readable code for python version comparison git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@737 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Arturo 'Buanzo' Busleiman	fd898c9eac	added python version detection to asyncore.loop(use_poll=True\|False) git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@736 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Arturo 'Buanzo' Busleiman	e09fad559a	Fix for python 2.6 / 3.0 incompatibility git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@735 a942ae1a-1317-0410-a47c-b1dcaea8d605	15 years ago
Cyril Jaquier	cc62cd7076	- Use poll instead of select in asyncore.loop. This should solve the "Unknown error 514". Thanks to Michael Geiger and Klaus Lehmann. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@700 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	9163e5b61b	- Removed debug message. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@648 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	379aa2f855	- Display a message if we could not bind the socket. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@636 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	5bd32566c3	- Moved socket to /var/run/fail2ban. - Rewrote the communication server. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@628 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago

18 Commits (5d7ab9e7fb99287dae3d050ba04a7f5f046f4598)