Commit Graph

3898 Commits (ce2b4fe634bea9e4d629ba27bf4f7de47472c52c)

Author SHA1 Message Date
Yaroslav Halchenko b435e1e4c8 Merge pull request #1311 from sbraz/gentoo-init
gentoo-initd: do not hide useful output
2016-01-29 09:54:35 -05:00
Louis Sautier 869d99dd37
Remove compression and count from logrotate
Initially reported at https://bugs.gentoo.org/show_bug.cgi?id=549856
2016-01-29 00:15:48 +01:00
Louis Sautier 294a7790a9
gentoo-initd: do not hide useful output
Gentoo applies a patch for this: https://bugs.gentoo.org/show_bug.cgi?id=536320
2016-01-28 23:40:36 +01:00
Yaroslav Halchenko 3f437b32db Merge remote-tracking branch 'pr/1288/head'
* pr/1288/head:
  Update haproxy-http-auth.conf
  Added HAProxy HTTP Auth filter

 Conflicts:
	config/jail.conf - resolved + removed unnecessary filter/enabled (defaults should be as good)
2016-01-28 08:51:45 -05:00
Yaroslav Halchenko 377ea32441 Merge pull request #1295 from obounaim/master
The sender option is ignored by some actions
2016-01-28 08:48:22 -05:00
Serg G. Brester fe14c8fa05 Merge pull request #1292 from albel727/master
Add nftables actions
2016-01-24 23:55:50 +01:00
Jordan Moeser d7b46509d8 Update haproxy-http-auth.conf
Updated failregex to be more strict
2016-01-12 08:37:33 +10:00
local 58a8736e0f Updating changelog. 2016-01-10 00:10:05 +01:00
local 40c0bed82c action_mw, action_mwl, action_cf_mwl ignore the "sender" option when sending a notification email.
This commit adds "sender="%(sender)s"" to the three actions to correct this issue.
2016-01-10 00:05:03 +01:00
Yaroslav Halchenko 5d0d96a5cb Merge pull request #1286 from yarikoptic/enh-jail
ENH: harmonize jail.conf + 1 more test that passed bantime is non-degenerate and int
2016-01-08 08:51:08 -05:00
Alexander Belykh 985e8938a4 Refactor nftables actionstop into smaller parts 2016-01-06 17:39:54 +06:00
Alexander Belykh 9779eeb986 Add nftables_type/family/table parameters 2016-01-06 17:33:14 +06:00
Alexander Belykh 260c30535d Escape curly braces in nftables actions 2016-01-06 17:13:30 +06:00
Alexander Belykh 1983e15580 Add empty line between parameters in nftables-common.conf 2016-01-06 16:55:29 +06:00
Alexander Belykh cb2d70d7a8 Add ChangeLog entry for new nftables actions 2016-01-05 19:04:44 +06:00
Alexander Belykh f7f91a8bd4 Refactor common code out of nftables-multiport/allports.conf 2016-01-05 19:03:47 +06:00
sebres 25a09352e4 + ChangeLog entry 2016-01-04 14:46:43 +01:00
sebres 69f5623f83 code simplifying (remove duplication): agent will be always supplied as parameter from jail.conf 2016-01-04 09:30:32 +01:00
Alexander Belykh 618e97bce8 Add nftables actions 2016-01-04 01:36:28 +06:00
sebres ac31121432 amend to fix fail2ban-version: correct user-agent for badips.py "Fail2Ban/ver", changeable within jail/config now; 2015-12-31 02:32:17 +01:00
Jordan Moeser e133762a28 Added HAProxy HTTP Auth filter 2015-12-31 11:16:23 +10:00
sebres cf334421bd Provides fail2ban version to jail (as interpolation variable during parse of jail.conf);
BF: use `fail2ban_agent` as user-agent in actions badips, blocklist_de, etc. (closes #1271, closes #1272)
2015-12-31 01:38:25 +01:00
Yaroslav Halchenko b76aede40d ENH(TST): verify that passed bantime is non-0 and int 2015-12-29 20:22:06 -05:00
Yaroslav Halchenko 28c9832293 RF: harmonize jail.conf (no explicit enabled=false in jails, match filter name for screesharingd, etc) 2015-12-29 19:43:52 -05:00
Yaroslav Halchenko 69aa1feac0 Merge "Mac OS Screen Sharing filter" PR 1232
* pr/1232/head:
  removed system.log
  Removed old svn revision comment
  removed false matches
  Removed includes comment for screensharing jail
  Now using a literal logpath for screensharing jail
  Fixed blatant typo in regex
  clarified comments on sample log format
  Fixed name (again?)
  Made screensharing jail off by default
  Changed regex prequel
  added entry for new screensharingd filter
  name change & new sample data
  Added json metadata
  Sample log for test case
  Replaced .* with literal
  Update jail.conf
  Added new path variable for system.log
  Added in settings for screensharingd filter
  Created file

Conflicts:
	ChangeLog - moved to New Features
	config/jail.conf  - kept at the end
2015-12-29 19:36:59 -05:00
Yaroslav Halchenko 16710237e3 Merge remote-tracking branch 'origin/master'
* origin/master:
  Add 'Sender address rejected: Domain not found' Postfix failregex
2015-12-29 19:31:04 -05:00
sebres 6daa152c0c Merge branch 'f2b-perfom-prepare-716' into ban-time-incr 2015-12-29 19:53:07 +01:00
sebres b3d4ce291e start observer together with the server (parametrized to prevent constantly start/stop of observer by addJail in test cases) 2015-12-29 19:52:16 +01:00
sebres 134c33cc6d fail2ban-testcases: added option "--ignore": negate [regexps] filter, to ignore tests matched specified regexps 2015-12-29 19:00:51 +01:00
sebres 8eca2ecd84 optimized version of "str2seconds" with pre-compiled regexp; 2015-12-29 19:00:49 +01:00
sebres 9d4f163e88 code review and minor repair after merge with performance branch (changed naming convention, wrong resolved conflicts, etc) 2015-12-29 17:36:00 +01:00
sebres 21f058a9f7 Merge remote-tracking branch 'remotes/gh-origin/f2b-perfom-prepare-716' into ban-time-incr 2015-12-29 14:04:41 +01:00
sebres da51fbf9c6 code review and performance optimization:
- default date templates cache + regexp compiling on the fly (if required);
- better usage of shared config over all test cases;
- obsolete test cases removed (simple test of memleak/gc);
- skip some slow test cases in fast mode (setup test, etc.);
2015-12-29 12:49:53 +01:00
sebres 3f2b58e973 datedetector: matchTime, template list etc. rewritten because of performance degradation (without sorting templates now) - in-place reordering using hits and last used time;
todo: rewrite "reGroupDictStrptime" because may be too slow;
2015-12-29 12:49:51 +01:00
sebres e065941ac5 use "maxEntries" (currently 50 as default) as range for max number of the last matches/failures, fail2ban will hold per IP in the list of failures in failmanager resp. in the database;
prevents out of memory situation if many IP's makes extremely many failures (or very large files since last fail2ban run);
closes gh-1277
todo: parameter `maxentries` should be configurable (jail.conf resp. fail2ban.conf);
todo: adjust ban-time-incr branch by merge (table "bips").
2015-12-29 12:49:48 +01:00
sebres 935d79eaae 1) prevents a bug by logging stdout/stderr if retcode still None:
```
in executeCmd
    if retcode < 0:
TypeError: unorderable types: NoneType() < int()
```
2) prevents a rarely test case bug of testExecuteTimeoutWithNastyChildren, because no stdout (Resource temporarily unavailable), possible no flush by IO of the killing process;
2015-12-29 12:49:46 +01:00
sebres 6406f6f560 background servicing (temporally executed from failmanager): prevents memory leak on some platforms/python versions, using forced GC in periodic intervals (latency and threshold);
Side effect: GC is disabled now inside fail2ban-server (to avoid multiple garbage collect)
2015-12-29 12:49:44 +01:00
sebres a10eb39bbe test cases extended with memory leakage check 2015-12-29 12:49:41 +01:00
sebres f7cc55103c optimized FailManager: increase performance, try to prevent memory leakage (don't copy failures resp. it list on some operations) 2015-12-29 12:49:39 +01:00
sebres f143ae479c code and config review after rebase to current master 2015-12-29 12:49:37 +01:00
sebres 72f29e9061 asyncserver (asyncore) code fixed and test cases repaired (always delete temp files, wait for end of thread/server, etc)
definitely closes gh-161, also other usage of asyncore event loop (in test_smtp.py)
repair cache in ipToName (can returns None), precaching of invalid IPs (according to RFC 5737) to stop endless wait for resolving it in test cases.
2015-12-29 12:49:34 +01:00
sebres 770c219ab6 SetupTest should run at version of python currently installed (resp. active one), skip if started with another version. 2015-12-29 12:49:32 +01:00
sebres cf3cf27fa3 - filtering of test cases extended for method additionally to class (matches method only not whole class for regexp matched method name);
- new options for "fail2ban-testcases" introduced: "-g" or "--no-gamin" and "-m" or "--memory-db", both are true also if "-f" or "--fast" specified,
  for example: `fail2ban-testcases -ngm` will runs faster (because no network, no gamin, memory database)
  but will use the same default sleep intervals as in production (in comparison to -nf);
- seekToTime rewritten, accuracy increased by seekToTime, extended for all FileFilter (PyInotify, Gamin also), test cases extended etc.
- common performance optimized and code reviewed;
2015-12-29 12:49:30 +01:00
sebres 6faffe3201 test cases extended, code review (+ python 3.x compatibility);
database test cases extended - enable deleted (disabled) jail in addJail;
2015-12-29 12:49:27 +01:00
Yaroslav Halchenko 0e61b7586a RF: use descriptive loop variable (oldticket) and matching associated variable suffixes (old) 2015-12-29 12:49:26 +01:00
Yaroslav Halchenko e2a68bb02d RF: make Jail new style class, avoiding multiple inheritance with object 2015-12-29 12:49:24 +01:00
Yaroslav Halchenko 78eb4d95eb RF: is_alive -> isAlive to stay consistent in camelCasing 2015-12-29 12:49:21 +01:00
sebres 59bf5013c0 - performance of fail2ban optimized
-- cache dnsToIp, ipToName to prevent long wait during retrieving of ip/name for wrong dns or lazy dns-system;
   -- instead of simple "sleep" used conditional wait "wait_for", that internal increases sleep interval up to sleeptime;
   -- ticket / banmanager / failmanager modules are performance optimized;
   -- api of filter (log files), jail, etc. rewritten and extended for performance purposes;
- performance of test cases optimized:
   -- added option "--fast" to decrease wait intervals, avoid passive waiting, and skip few very slow test cases;
- code review after partially cherry pick of branch 'ban-time-incr' (see gh-716)
   -- ticket module prepared to easy merge with newest version of 'ban-time-incr', now additionally holds banTime, banCount and json-data;
   -- executeCmd partially moved from action to new module utils, etc.
   -- python 2.6 compatibility;
- testExecuteTimeoutWithNastyChildren: test case repaired - wait for pid file inside bash, kill tree in any case (gh-1155);
- testSocket: test case repaired - wait for server thread starts a socket (listener)
2015-12-29 12:49:19 +01:00
sebres 3540619a73 code review, test case extended; 2015-12-29 12:49:17 +01:00
sebres d23d103f96 code review and few new test cases 2015-12-29 12:49:15 +01:00