CasperSecurity
o
� �_
L � @ s� d Z dZdZddlZddlZddlmZ ddlmZm Z m
Z
m Z m Z m
Z
ddlmZ dd lmZ d
d lmZ ee�Zd Ze�d
ej�Zejddd�Zd dd�Z dd� fdd�Z G dd� de �Z G dd� de �Z G dd � d e �Z!dS ) z'Cyril Jaquier and Fail2Ban Contributorsz Copyright (c) 2004 Cyril Jaquier�GPL� N)�Lock� )�re� DateTemplate�DatePatternRegex�
DateTai64n� DateEpoch�RE_EPOCH_PATTERN)�validateTimeZone)�Utils� )� getLogger� z(?<!\\)\{DATE\}i� i )�maxCount�maxTimec C s� |d u r| }d| vr| � � }t�|�}|sWd|v r?t�| �r't| d|v d�}n|dv r3t|dkd�}n |dv r?t|dkdd �}|d u rW|d
v rSt|d krNd nd
d�}nt| �}t�||� |S )N�%�EPOCH�LEPOCH)�pattern�longFrm)r z{^LN-BEG}EPOCHz^EPOCH)�
lineBeginOnly)r z{^LN-BEG}LEPOCHz^LEPOCHT)r r )�TAI64Nz{^LN-BEG}TAI64Nz^TAI64Nr �startF)� wordBegin) �upper�DD_patternCache�getr
�searchr r r �set)r �key�template� r" �>/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py�_getPatternTemplate, s&
r$ c C s d| S �N� {^LN-BEG}r" ��sr" r" r# �<lambda>D s r) c C sd || j �}t�|�}|s0|t| d| j��}t| d�r t�|�}|s0t| d�s,t|�}|S t|�}|S )Nr )�namer r �getattr�regex�hasattrr$ )r! �wrapr* � template2r, r" r" r# �_getAnchoredTemplateD s
�r0 c @ sH e Zd ZdZdd� Zedd� �Zdd� Zg d�Zed d
� �Z d d � Z
d
S )�DateDetectorCachez7Implements the caching of the default templates list.
c C s t � | _t� | _d S �N)r �_DateDetectorCache__lock�list� _DateDetectorCache__templates��selfr" r" r# �__init__\ s zDateDetectorCache.__init__c C s^ | j r| j S | j� | j r| j W d � S | �� | j W d � S 1 s(w Y dS )�6List of template instances managed by the detector.
N)r5 r3 �_addDefaultTemplater6 r" r" r# � templates` s �$�zDateDetectorCache.templatesc C s` |j }|�d�s&|�d�s&t|d�r&t|�}|j |kr&d|_| jd �|� | jd �|� dS )z&Cache Fail2Ban's default template.
r& �^r, g Y@r r N)r* �
startswithr- r0 �weight� _DateDetectorCache__tmpcache�append)r7 r! r* r/ r" r" r# �_cacheTemplatel s
z DateDetectorCache._cacheTemplate)zF%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T| ?)%H:%M:%S(?:[.,]%f)?(?:\s*%z)?z)(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z$(?:%a )?%b %d %ExY %k:%M:%S(?:\.%f)?z1%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%Sz=%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\.%f)?(?: %z)?z%m/%d/%ExY:%H:%M:%Sz %m-%d-%ExY %k:%M:%S(?:\.%f)?r z{^LN-BEG}%H:%M:%Sz^<%m/%d/%Exy@%H:%M:%S>z%Exy%Exm%Exd ?%H:%M:%Sz%b %d, %ExY %I:%M:%S %pz^%b-%d-%Exy %k:%M:%Sz6%ExY%Exm%Exd(?:T| ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\s*%z)?z1(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z1(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?r c C s< t tjd t�rttj�D ]
\}}t|�}|tj|< q
tjS )Nr )�
isinstancer1 �DEFAULT_TEMPLATES�str� enumerater$ )r7 �i�dtr" r" r# �defaultTemplates� s
z"DateDetectorCache.defaultTemplatesc C s> g g f| _ | jD ]}| �|� q| j d | j d | _| ` dS )z<Add resp. cache Fail2Ban's default set of date templates.
r r N)r? rH rA r5 )r7 rG r" r" r# r: � s
z%DateDetectorCache._addDefaultTemplateN) �__name__�
__module__� __qualname__�__doc__r8 �propertyr; rA rC rH r: r" r" r" r# r1 Y s
5
r1 c @ s0 e Zd ZdZdZdd� Zedd� �Zdd� Zd S )
�DateDetectorTemplateztUsed for "shallow copy" of the template object.
Prevents collectively usage of hits/lastUsed in cached templates
�r! �hits�lastUsed�distancec C s || _ d| _d| _d| _d S )Nr ��rO )r7 r! r" r" r# r8 � s
z DateDetectorTemplate.__init__c C s | j | jj td| j� S )Nr )rP r! r> �maxrR r6 r" r" r# r> � s zDateDetectorTemplate.weightc C s t | j|�S )zF Returns attribute of template (called for parameters not in slots)
)r+ r! )r7 r* r" r" r# � __getattr__� s z DateDetectorTemplate.__getattr__N) rI rJ rK rL � __slots__r8 rM r> rU r" r" r" r# rN � s
rN c @ sz e Zd ZdZe� Zdd� Zddd�Zdd� Zdd d �Z e
d
d� �Z dd� Z e
dd� �Z
e
jdd� �Z
ddd�Zdd� Zd S )� DateDetectorzjManages one or more date templates to find a date within a log line.
Attributes
----------
templates
c C s> t � | _t� | _d| _d| _d| _d| _d| _d | _ d | _
d S )Ni, )r N)rS NrS r ) r4 �_DateDetector__templatesr �_DateDetector__known_names�_DateDetector__unusedTime�_DateDetector__lastPos�_DateDetector__lastEndPos�_DateDetector__lastTemplIdx�_DateDetector__firstUnused�_DateDetector__preMatch�_DateDetector__default_tzr6 r" r" r# r8 � s
zDateDetector.__init__Fc C sD |j }|| jv r|r d S td| ��| j�|� | j�t|�� d S )Nz(There is already a template with name %s)r* rY �
ValueError�addrX r@ rN )r7 r! � ignoreDupr* r" r" r# �_appendTemplate� s
� z DateDetector._appendTemplatec s� t |t�rK| � }d|vr|�� � t�� �}|sE� dv r)� fdd�}| �|� dS d� v r6| j|dd� dS � d kr@td
� �}nt|� �}t�� |� | �|� t �
d t |d d
�|j � t �
dt |d d
�|j� dS )a� Add a date template to manage and use in search of dates.
Parameters
----------
template : DateTemplate or str
Can be either a `DateTemplate` instance, or a string which will
be used as the pattern for the `DatePatternRegex` template. The
template will then be added to the detector.
Raises
------
ValueError
If a template already exists with the same name.
r )r& z {DEFAULT}c s � dkr
| j tj@ S d S r% )�flagsr �
LINE_BEGIN)r! �r r" r# r) s z-DateDetector.appendTemplate.<locals>.<lambda>Nz{DATE}F)�preMatch� allDefaultsz{NONE}z{UNB}^z date pattern `%r`: `%s`r � z date pattern regex for %r: %s)rB rD r r r �addDefaultTemplater$ r rd �logSys�infor+ r* �debugr, )r7 r! r �fltr" rg r# �appendTemplate s2
�
��zDateDetector.appendTemplateNTc sh t | j�dk}|r
tjjntjjD ] }|dur ||�s q� dur*t|� fdd�d�}| j||d� qdS )z0Add Fail2Ban's default set of date templates.
r Nc s t �� fdd���S )Nc s
t �� �S r2 )r �unboundPattern)�mr' r" r# r) 7 s
zCDateDetector.addDefaultTemplate.<locals>.<lambda>.<locals>.<lambda>)�RE_DATE_PREMATCH�subr' �rh r' r# r) 7 s z1DateDetector.addDefaultTemplate.<locals>.<lambda>)r. )rc )�lenrX rW � _defCacher; rH r0 rd )r7 �filterTemplaterh ri rc r! r" ru r# rk * s �
��z DateDetector.addDefaultTemplatec C � | j S )r9 )rX r6 r" r" r# r; ; s zDateDetector.templatesc
C s� t | j�s | �� t�� tkrtjndd� }|td d|� d}d}d}| j}|t | j�k �r%| j| }|j}|j t
j t
j B @ rP|td d|� |�
|�}|}n�| jd | jd } }
|td d
|| |
|| d | � | jd || |
� ||
|
d � | jd �
|| d | � | jd ks�|| | jd kr�| jd �� s�||
|
d � | jd ks�||
d | jd kr�| jd �� s�|td d || |
� � |�
|| |
�}n|td d
� |�
|�}|}|�r |�� } |�� }
t | j�dk�s |j t
j t
j B @ �s | | jd k�r|
| jd k�r|td|� n|td� || |
|f}d}n|td� |�s�|tdt | j�� d }| jD ]�}||k�rC|d7 }�q6|td d||j� |j}|�
|�}|�r�|�� } |�� }
|td|| |j| jd |j� |d t | j�k�r{ nQ|j t
j t
j B @ �r� nE| d k�r�|j�r�| j|d jj�s� n0| |jk�s�| | jd k�r�|td� | |d k �r�|| |
|f}d}|d7 }�q6 n|d7 }�q6|�s�|d �r�|\}} }
}|td|� | j| }|j}|�r:| jd7 _t�� |_| |_| j|k�r| jd7 _| || d | � || f| _|
||
d ||
|
d � f| _|�r3|| jk�r3| �|�}|| _||fS |td� dS )a� Attempts to find date on a log line using templates.
This uses the templates' `matchDate` method in an attempt to find
a date. It also increments the match hit count for the winning
template.
Parameters
----------
line : str
Line which is searched by the date templates.
Returns
-------
re.MatchObject, DateTemplate
The regex match returned from the first successfully matched
template.
c W s d S r2 r" )�argsr" r" r# r) V s z(DateDetector.matchTime.<locals>.<lambda>r z"try to match time for line: %.120sN)NrS rS ���rS z/ try to match last anchored template #%02i ...r zJ try to match last template #%02i (from %r to %r): ...%r==%r %s %r==%r...r
z+ boundaries are correct, search in part %rz, boundaries show conflict, try whole searchz" matched last time template #%02izB ** last pattern collision - pattern change, reserve & search ...z8 ** last pattern not found - pattern change, search ...z search template (%i) ...z try template #%02i: %sz2 matched time template #%02i (at %r <= %r, %r) %sz1 ** distance collision - pattern change, reservez use best time template #%02iz
no template.)NN)rv rX rk rl �getEffectiveLevel�logLevel�logr] r! re r rf �LINE_END� matchDater[ r\ �isalnumr �endr* rR rP �timerQ r^ �_reorderTemplate) r7 �liner~ �match�found�ignoreBySearchrF �ddtemplr! rR �endposr" r" r# � matchTimeA s�
� $
�
�&
zDateDetector.matchTimec C ry r2 )r` r6 r" r" r# �
default_tz� s zDateDetector.default_tzc C s t |�| _d S r2 )r r` )r7 �valuer" r" r# r� � s c C s� |du r | � |�}|d }|durHz,|j||d | jd�}|dur;t�� tkr8t�td|d |d �d�|j� |W S W dS t yG Y dS w dS )a Attempts to return the date on a log line using templates.
This uses the templates' `getDate` method in an attempt to find
a date.
For the faster usage, always specify a parameter timeMatch (the previous tuple result
of the matchTime), then this will work without locking and without cycle over templates.
Parameters
----------
line : str
Line which is searched by the date templates.
Returns
-------
float
The Unix timestamp returned from the first successfully matched
template or None if not found.
Nr r )r� z& got time %f for %r using template %s)
r� �getDater` rl r| r} r~ �groupr* ra )r7 r� � timeMatchr! �dater" r" r# �getTime� s&
�� ��zDateDetector.getTimec s �r�| j ��� � t�� tkrt�td�� j� � j| j �� j�| j �k r)| j n�d �� �����fdd�}|� sL��d krC�S �d �|� sL�S ��= � g��d�< | j t
��k rw�| j jrw| j d7 _ | j t
��k rw�| j jsct�� tkr�t�td��� �S �S )z�Reorder template (bubble up) in template list if hits grows enough.
Parameters
----------
num : int
Index of template should be moved.
z% -> reorder template #%02i, hits: %rr
c sL �� j } t�� tkrt�td���| � j�� j� �| kp%��� jkS )NzE -> compare template #%02i & #%02i, weight %.3f > %.3f, hits %r > %r)r> rl r| r} r~ rP rQ )�pweight�r� �num�posr; �untimer> r" r# � _moveable
s
�z0DateDetector._reorderTemplate.<locals>._moveabler r z" -> moved template #%02i -> #%02i) rX rl r| r} r~ rP rQ rZ r> r^ rv )r7 r� r� r" r� r# r� � s0 � z DateDetector._reorderTemplate)F)NNTr2 )rI rJ rK rL r1 rw r8 rd rp rk rM r; r� r� �setterr� r� r" r" r" r# rW � s"
*
$rW r2 )"�
__author__�
__copyright__� __license__�copyr� � threadingr � datetemplater r r r r r
�strptimer �utilsr �helpersr rI rl r} �compile�
IGNORECASErs �Cacher r$ r0 �objectr1 rN rW r" r" r" r# �<module> s&
n