Your IP : 216.73.216.182
U
ܜ^�I � @ s� d Z dZdZddlZddlZddlmZ ddlmZm Z m
Z
m Z m Z m
Z
ddlmZ dd lmZ d
d lmZ ee�Zd Ze�d
ej�Zejddd�Zd dd�Z dd� fdd�Z G dd� de �Z G dd� de �Z G dd � d e �Z!dS ) z'Cyril Jaquier and Fail2Ban Contributorsz Copyright (c) 2004 Cyril JaquierZGPL� N)�Lock� )�re� DateTemplate�DatePatternRegex�
DateTai64n� DateEpoch�RE_EPOCH_PATTERN)�validateTimeZone)�Utils� )� getLogger� z(?<!\\)\{DATE\}i� i )ZmaxCountZmaxTimec C s� |d kr | }d| kr | � � }t�|�}|s�d|kr~t�| �rNt| d|kd�}n0|dkrft|dkd�}n|dkr~t|dkdd �}|d kr�|d
kr�t|d kr�d nd
d�}nt| �}t�||� |S )N�%�EPOCH�LEPOCH)�pattern�longFrm)r z{^LN-BEG}EPOCHz^EPOCH)�
lineBeginOnly)r z{^LN-BEG}LEPOCHz^LEPOCHT)r r )�TAI64Nz{^LN-BEG}TAI64Nz^TAI64Nr �startF)Z wordBegin) �upper�DD_patternCache�getr �searchr r r �set)r �key�template� r �>/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py�_getPatternTemplate, s&
r c C s d| S �N� {^LN-BEG}r ��sr r r �<lambda>D � r% c C sb || j �}t�|�}|s^|t| d| j��}t| d�r>t�|�}|s^t| d�sVt|�}nt|�}|S )Nr )�namer r �getattr�regex�hasattrr )r �wrapr' � template2r) r r r �_getAnchoredTemplateD s
r- c @ sf e Zd ZdZdd� Zedd� �Zdd� Zdd d
d d d
dddddddddddgZedd� �Z dd � Z
d S ) �DateDetectorCachez7Implements the caching of the default templates list.
c C s t � | _t� | _d S �N)r �_DateDetectorCache__lock�list� _DateDetectorCache__templates��selfr r r �__init__\ s zDateDetectorCache.__init__c
C sP | j r | j S | j�4 | j r,| j W 5 Q R � S | �� | j W 5 Q R � S Q R X dS )�6List of template instances managed by the detector.
N)r2 r0 �_addDefaultTemplater3 r r r � templates` s zDateDetectorCache.templatesc C s` |j }|�d�sL|�d�sLt|d�rLt|�}|j |krLd|_| jd �|� | jd �|� dS )z&Cache Fail2Ban's default template.
r" �^r) g Y@r r N)r' �
startswithr* r- �weight� _DateDetectorCache__tmpcache�append)r4 r r' r, r r r �_cacheTemplatel s
z DateDetectorCache._cacheTemplatezF%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T| ?)%H:%M:%S(?:[.,]%f)?(?:\s*%z)?z)(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z$(?:%a )?%b %d %ExY %k:%M:%S(?:\.%f)?z1%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%Sz=%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\.%f)?(?: %z)?z%m/%d/%ExY:%H:%M:%Sz %m-%d-%ExY %k:%M:%S(?:\.%f)?r z{^LN-BEG}%H:%M:%Sz^<%m/%d/%Exy@%H:%M:%S>z%Exy%Exm%Exd ?%H:%M:%Sz%b %d, %ExY %I:%M:%S %pz^%b-%d-%Exy %k:%M:%Sz6%ExY%Exm%Exd(?:T| ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\s*%z)?z1(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z1(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?r c C s< t tjd t�r6ttj�D ]\}}t|�}|tj|< qtjS )Nr )�
isinstancer. �DEFAULT_TEMPLATES�str� enumerater )r4 �i�dtr r r �defaultTemplates� s
z"DateDetectorCache.defaultTemplatesc C s> g g f| _ | jD ]}| �|� q| j d | j d | _| ` dS )z<Add resp. cache Fail2Ban's default set of date templates.
r r N)r< rE r> r2 )r4 rD r r r r7 � s
z%DateDetectorCache._addDefaultTemplateN) �__name__�
__module__� __qualname__�__doc__r5 �propertyr8 r> r@ rE r7 r r r r r. Y s4
�5
r. c @ s0 e Zd ZdZdZdd� Zedd� �Zdd� Zd S )
�DateDetectorTemplateztUsed for "shallow copy" of the template object.
Prevents collectively usage of hits/lastUsed in cached templates
�r �hits�lastUsed�distancec C s || _ d| _d| _d| _d S )Nr ��rL )r4 r r r r r5 � s z DateDetectorTemplate.__init__c C s | j | jj td| j� S )Nr )rM r r; �maxrO r3 r r r r; � s zDateDetectorTemplate.weightc C s t | j|�S )zF Returns attribute of template (called for parameters not in slots)
)r( r )r4 r' r r r � __getattr__� s z DateDetectorTemplate.__getattr__N) rF rG rH rI � __slots__r5 rJ r; rR r r r r rK � s
rK c @ sz e Zd ZdZe� Zdd� Zddd�Zdd� Zdd d �Z e
d
d� �Z dd� Z e
dd� �Z
e
jdd� �Z
ddd�Zdd� Zd S )� DateDetectorzjManages one or more date templates to find a date within a log line.
Attributes
----------
templates
c C s> t � | _t� | _d| _d| _d| _d| _d| _d | _ d | _
d S )Ni, )r N)rP NrP r ) r1 �_DateDetector__templatesr �_DateDetector__known_names�_DateDetector__unusedTime�_DateDetector__lastPos�_DateDetector__lastEndPos�_DateDetector__lastTemplIdx�_DateDetector__firstUnusedZ_DateDetector__preMatch�_DateDetector__default_tzr3 r r r r5 � s zDateDetector.__init__Fc C sD |j }|| jkr$|rd S td| ��| j�|� | j�t|�� d S )Nz(There is already a template with name %s)r' rV �
ValueError�addrU r= rK )r4 r � ignoreDupr' r r r �_appendTemplate� s
� z DateDetector._appendTemplatec s� t |t�r�| � }d|kr"|�� � t�� �}|sv� dkrR� fdd�}| �|� dS d� krl| j|dd� dS t|� �}t�� |� | �|� t �
d t |d
d �|j � t �
d t |d
d �|j� dS )
a� Add a date template to manage and use in search of dates.
Parameters
----------
template : DateTemplate or str
Can be either a `DateTemplate` instance, or a string which will
be used as the pattern for the `DatePatternRegex` template. The
template will then be added to the detector.
Raises
------
ValueError
If a template already exists with the same name.
r )r" z {DEFAULT}c s � dkr| j tj@ S d S r! )�flagsr �
LINE_BEGIN)r �r r r r% r& z-DateDetector.appendTemplate.<locals>.<lambda>Nz{DATE}F)�preMatch� allDefaultsz date pattern `%r`: `%s`r � z date pattern regex for %r: %s)r? rA r r r �addDefaultTemplater r r` �logSys�infor( r' �debugr) )r4 r r Zfltr rc r �appendTemplate s2
�
�
�zDateDetector.appendTemplateNTc sh t | j�dk}|rtjjntjjD ]@}|dk r8||�s8q"� dk rTt|� fdd�d�}| j||d� q"dS )z0Add Fail2Ban's default set of date templates.
r Nc s t �� fdd���S )Nc s
t �� �S r/ )r ZunboundPattern)�mr# r r r% 5 r& zCDateDetector.addDefaultTemplate.<locals>.<lambda>.<locals>.<lambda>)�RE_DATE_PREMATCH�subr# �rd r# r r% 5 r& z1DateDetector.addDefaultTemplate.<locals>.<lambda>)r+ )r_ )�lenrU rT � _defCacher8 rE r- r` )r4 ZfilterTemplaterd re r_ r r ro r rg ( s �
�z DateDetector.addDefaultTemplatec C s | j S )r6 )rU r3 r r r r8 9 s zDateDetector.templatesc
C s* t | j�s| �� t�td d|� d}d}| j}|t | j�k �r�| j| }|j}|jt j
t j B @ r�t� � td kr�t�td d|� |�
|�}|}n�| jd | jd }}t� � td k�r
t�td d|||||d |� | jd |||� |||d � | jd �
||d |� | jd k�rP|||d � | jd k�rP|�
|||�}|�r�|�� }|�� }|jt j
t j B @ �s�|| jd k�r�|| jd k�r�t�td|� nt�td � d}n t�td
� |�s�t�td t | j�� d } d}| jD �]X}t� � td k�r t�td d
||j� ||k�r4|d7 }�q�|j}|�
|�}|�r@|�� }|�� }t� � tk�r�t�td|||j| jd |j� |d t | j�k�r� �qL|jt j
t j B @ �r� �qL|dk�r�|j�r�| j|d jj�s� �qL||jk�s|| jd k�r:t�td� || d k �r*||||f} d}|d7 }�q� �qL|d7 }�q�|�s�| d �r�| \}}}}t�td|� | j| }|j}|�r| jd7 _t�� |_||_| j|k�r�| jd7 _|||d |� f| _||||d � f| _|�r || jk�r | �|�}|| _||fS t�td� dS )a� Attempts to find date on a log line using templates.
This uses the templates' `matchDate` method in an attempt to find
a date. It also increments the match hit count for the winning
template.
Parameters
----------
line : str
Line which is searched by the date templates.
Returns
-------
re.MatchObject, DateTemplate
The regex match returned from the first successfully matched
template.
r z"try to match time for line: %.120sNrP z/ try to match last anchored template #%02i ...r zJ try to match last template #%02i (from %r to %r): ...%r==%r %s %r==%r...z" matched last time template #%02iz8 ** last pattern collision - pattern change, search ...z8 ** last pattern not found - pattern change, search ...z search template (%i) ...)NrP rP ���z try template #%02i: %sz2 matched time template #%02i (at %r <= %r, %r) %sz1 ** distance collision - pattern change, reservez use best time template #%02iz
no template.)NN)rp rU rg rh �log�logLevelrZ r ra r rb ZLINE_END�getEffectiveLevelZ matchDaterX rY r �endr' rO rM �timerN r[ �_reorderTemplate)
r4 �line�matchZignoreBySearchrC �ddtemplr rO �endpos�foundr r r � matchTime? s�
� �� � �
�&
zDateDetector.matchTimec C s | j S r/ )r\ r3 r r r �
default_tz� s zDateDetector.default_tzc C s t |�| _d S r/ )r
r\ )r4 �valuer r r r � s c C s� |dkr| � |�}|d }|dk r�zV|j||d | jd�}|dk rvt�� tkrpt�td|d |d �d�|j� |W S W n t k
r� Y nX dS )a Attempts to return the date on a log line using templates.
This uses the templates' `getDate` method in an attempt to find
a date.
For the faster usage, always specify a parameter timeMatch (the previous tuple result
of the matchTime), then this will work without locking and without cycle over templates.
Parameters
----------
line : str
Line which is searched by the date templates.
Returns
-------
float
The Unix timestamp returned from the first successfully matched
template or None if not found.
Nr r )r z& got time %f for %r using template %s)
r~ ZgetDater\ rh ru rt rs �groupr' r] )r4 ry Z timeMatchr �dater r r �getTime� s"
�
zDateDetector.getTimec s� �r�| j ��� � t�� tkr0t�td�� j� � j| j �� j�| j �k rR| j n�d �� �����fdd�}|� s���d kr��S �d �|� s��S ��= � g��d�< | j t
��k rֈ| j jr�| j d7 _ q�t�� tkr�t�td��� �S �S )z�Reorder template (bubble up) in template list if hits grows enough.
Parameters
----------
num : int
Index of template should be moved.
z% -> reorder template #%02i, hits: %rr c sL �� j } t�� tkr6t�td���| � j�� j� �| kpJ��� jkS )NzE -> compare template #%02i & #%02i, weight %.3f > %.3f, hits %r > %r)r; rh ru rt rs rM rN )Zpweight�r{ �num�posr8 Zuntimer; r r � _moveable s
�z0DateDetector._reorderTemplate.<locals>._moveabler r z" -> moved template #%02i -> #%02i) rU rh ru rt rs rM rN rW r; r[ rp )r4 r� r� r r� r rx � s. z DateDetector._reorderTemplate)F)NNT)N)rF rG rH rI r. rq r5 r` rk rg rJ r8 r~ r �setterr� rx r r r r rT � s
(
$rT )N)"�
__author__Z
__copyright__Z __license__�copyrw Z threadingr Z datetemplater r r r r r �strptimer
Zutilsr Zhelpersr
rF rh rt �compile�
IGNORECASErm ZCacher r r- �objectr. rK rT r r r r �<module> s$
n