GkcLDdZdZdZddlZddlZddlmZddlmZm Z m Z m Z m Z m Z ddlmZdd lmZd d lmZeeZd Zejd ejZejddZddZdfdZGddeZGddeZ GddeZ!dS)z'Cyril Jaquier and Fail2Ban Contributorsz Copyright (c) 2004 Cyril JaquierGPLN)Lock)re DateTemplateDatePatternRegex DateTai64n DateEpochRE_EPOCH_PATTERN)validateTimeZone)Utils) getLoggerz(?/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py_getPatternTemplater%,sK# 3    $ $ ) ^^g&&H(c/BBBHH 444w888HH 777x$GGGH  555xWWULLLHH((HS(###c d|zSN {^LN-BEG})ss r$r,Ds +/r&cR||j}t|}|sz|t|d|j}t |drt|}|s/t |dst |}nt |}|S)Nr)namerrgetattrregexhasattrr%)r#wrapr. template2r0s r$_getAnchoredTemplater4Ds X]   & & + $wxHN;; < <% Xy!!*""5))9 + (I & &+#D))II#E**Ir&cXeZdZdZdZedZdZgdZedZ dZ dS) DateDetectorCachez7Implements the caching of the default templates list. cRt|_t|_dSN)r_DateDetectorCache__locklist_DateDetectorCache__templatesselfs r$__init__zDateDetectorCache.__init__\s$+VV$r&c|jr|jS|j5|jr|jcdddS||jcdddS#1swxYwYdS)6List of template instances managed by the detector. N)r;r9_addDefaultTemplater<s r$ templateszDateDetectorCache.templates`s    {      sAAAAcJ|j}|dsf|dsQt|drAt|}|j|kr'd|_|jd||jd|dS)z&Cache Fail2Ban's default template. r)^r0gY@rrN)r. startswithr1r4weight_DateDetectorCache__tmpcacheappend)r=r#r.r3s r$_cacheTemplatez DateDetectorCache._cacheTemplatels $  % %)dooc.B.B)wxY`GaGa)#H--9nIOAi(((/!H%%%%%r&)zF%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T| ?)%H:%M:%S(?:[.,]%f)?(?:\s*%z)?z)(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z$(?:%a )?%b %d %ExY %k:%M:%S(?:\.%f)?z1%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%Sz=%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\.%f)?(?: %z)?z%m/%d/%ExY:%H:%M:%Sz%m-%d-%ExY %k:%M:%S(?:\.%f)?rz{^LN-BEG}%H:%M:%Sz^<%m/%d/%Exy@%H:%M:%S>z%Exy%Exm%Exd ?%H:%M:%Sz%b %d, %ExY %I:%M:%S %pz^%b-%d-%Exy %k:%M:%Sz6%ExY%Exm%Exd(?:T| ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\s*%z)?z1(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z1(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?rcttjdtr=t tjD]#\}}t |}|tj|<$tjS)Nr) isinstancer6DEFAULT_TEMPLATESstr enumerater%)r=idts r$defaultTemplatesz"DateDetectorCache.defaultTemplatessc!3A6<<0+=>>00uq" R B-/'**  ,,r&cggf|_|jD]}|||jd|jdz|_|`dS)zpropertyrBrIrLrQrAr*r&r$r6r6Ys    ( &&&$333j -- (-     r&r6c8eZdZdZdZdZedZdZdS)DateDetectorTemplateztUsed for "shallow copy" of the template object. Prevents collectively usage of hits/lastUsed in cached templates r#hitslastUseddistancec>||_d|_d|_d|_dS)NrrZ)r=r#s r$r>zDateDetectorTemplate.__init__s"$-$)$-$---r&cV|j|jjztd|jz S)Nr)r[r#rFmaxr]r<s r$rFzDateDetectorTemplate.weights% T]) )C4=,A,A AAr&c,t|j|S)zF Returns attribute of template (called for parameters not in slots) )r/r#)r=r.s r$ __getattr__z DateDetectorTemplate.__getattr__s  % %%r&N) rSrTrUrV __slots__r>rWrFrcr*r&r$rYrYsa: BB (B&&&&&r&rYceZdZdZeZdZddZdZddZ e d Z d Z e d Z e jd Z dd ZdZdS) DateDetectorzjManages one or more date templates to find a date within a log line. Attributes ---------- templates ct|_t|_d|_d|_d|_d|_d|_d|_ d|_ dS)Ni,)rN)r_Nr_r) r:_DateDetector__templatesr!_DateDetector__known_names_DateDetector__unusedTime_DateDetector__lastPos_DateDetector__lastEndPos_DateDetector__lastTemplIdx_DateDetector__firstUnused_DateDetector__preMatch_DateDetector__default_tzr<s r$r>zDateDetector.__init__sVVV$uu$$$.&$"$$$/$r&Fc|j}||jvr|rdStd|z|j||jt |dS)Nz(There is already a template with name %s)r.ri ValueErroraddrhrHrY)r=r# ignoreDupr.s r$_appendTemplatezDateDetector._appendTemplatesx $ T  .5 7 77.x8899999r&ct|tr|x}d|vr|t}|sddvrfd}||dSdvr||ddSdkrt d }nt |}t|||t d t|d d |j t d t|d d |jdS)aAdd a date template to manage and use in search of dates. Parameters ---------- template : DateTemplate or str Can be either a `DateTemplate` instance, or a string which will be used as the pattern for the `DatePatternRegex` template. The template will then be added to the detector. Raises ------ ValueError If a template already exists with the same name. r)r)z {DEFAULT}c<dkr|jtjzndSr()flagsr LINE_BEGIN)r#r"s r$r,z-DateDetector.appendTemplate..s!3+CUCUx~ (???[_r&Nz{DATE}F)preMatch allDefaultsz{NONE}z{UNB}^z date pattern `%r`: `%s`rz date pattern regex for %r: %s)rKrMrrraddDefaultTemplater%r!rulogSysinfor/r.debugr0)r=r#rfltr"s @r$appendTemplatezDateDetector.appendTemplatesf#&3  --//C!!#&&8  2 (((____  S!!! V S g5AAA V #Hc22XX#GS11XsH%%%x   ++) 8Y##X]444,,0 8Y##X^55555r&NTct|jdk}|rtjjntjjD]=}| ||st |fd}|||>dS)z0Add Fail2Ban's default set of date templates. rNcBtfdS)Nc,tjSr8)runboundPattern)mr+s r$r,zCDateDetector.addDefaultTemplate....7s<3Nq3Q3Qr&)RE_DATE_PREMATCHsub)r+rzs`r$r,z1DateDetector.addDefaultTemplate..7s$$(()Q)Q)Q)QS[\\r&)r2)rt)lenrhrf _defCacherBrQr4ru)r=filterTemplaterzr{rtr#s ` r$r}zDateDetector.addDefaultTemplate*s$"##a')'2_<## 8N8_ 7 7h )A)A 8#H \ \ \ \^^^HI6666 7 7r&c|jS)r@)rhr<s r$rBzDateDetector.templates;s   r&cj t|js|tt kr tjnd}|t dz d|d}d}d}|j}|t|jkr|j|}|j}|j tj tj zzr.|t dz d|| |}|}nx|jd|jd} } |t dz d || | || dz | |jd|| | || | dz|jd  || dz | |jdks;|| | dz|jd kr|jd s|| | dz|jd ks;|| dz | |jdkrT|jds5|t dz d || | | || | }n+|t dz d | |}|}|r|} |} t|jdksC|j tj tj zzs"| |jdkr$| |jdkr|t d |n+|t d|| | |f}d}n|t d|s|t dt|jd}|jD]T}||kr|dz }|t dz d||j|j}| |}|r|} |} |t d|| |j|jd|j|dzt|jkrn|j tj tj zzrnz| dkr#|jr|j|dzjjsnQ| |jks| |jdkr,|t d| |dkr|| | |f}d}|dz }Mn|dz }V|s5|dr-|\}} } }|t d||j|}|j}|r|xjdz c_t-j|_| |_|j|kr|xjdz c_| || dz | || f|_| || dz || | dzf|_|r ||jkr||}||_||fS|t ddS)aAttempts to find date on a log line using templates. This uses the templates' `matchDate` method in an attempt to find a date. It also increments the match hit count for the winning template. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- re.MatchObject, DateTemplate The regex match returned from the first successfully matched template. cdSr8r*)argss r$r,z(DateDetector.matchTime..VsPTr&rz"try to match time for line: %.120sN)Nr_r_r_z/ try to match last anchored template #%02i ...rzJ try to match last template #%02i (from %r to %r): ...%r==%r %s %r==%r...rz+ boundaries are correct, search in part %rz, boundaries show conflict, try whole searchz" matched last time template #%02izB ** last pattern collision - pattern change, reserve & search ...z8 ** last pattern not found - pattern change, search ...z search template (%i) ...z try template #%02i: %sz2 matched time template #%02i (at %r <= %r, %r) %sz1 ** distance collision - pattern change, reservez use best time template #%02iz no template.)NN)rrhr}r~getEffectiveLevellogLevellogrmr#rxrryLINE_END matchDaterkrlisalnumrendr.r]r[timer\rn_reorderTemplate) r=linermatchfoundignoreBySearchrOddtemplr#r]endposs r$ matchTimezDateDetector.matchTimeAsR& T   ..00H<< BTBT##hqj6=== % *%. !T     a 78n / 0EEFC EqIII   t $ $ENN~a($*;A*>fHC `& (1*X q 1 (6/ &/D-a0 222 (1*X $."333 HXaZ  DN1$555dnQ>O>W>W>Y>Y5 &/d/222 F1HVO 1! 444T=Nq=Q=Y=Y=[=[4 S!BDRXDYZZZ   h 7 7UUS!CDDD    % %U^ N{{}}H YY[[F  a ^|.|/DDE $.###$2CA2F(F(FS7;;;;SWXXX Hfa 'U UUCLMMM + 3x,c$2B.C.CDDD1"" " wN!VQ C .7<@@@H   t $ $E   XiikkVSG7#T^A%6 GGG !s4#$$$$ e,1,2GGH  e Q7<1A!A#1F1O1T e 7###x$.2C'C'C c(GHHH E!H  h)ue1fa UFAA  E!H !&E8VQC2A666q!GH  <<1<<ikk77 A!d8A:h#67hG4>tF1H~tF6!8O/DD4!A$ $ $ a  A4 ( #h   r&c|jSr8)rpr<s r$ default_tzzDateDetector.default_tzs r&c.t||_dSr8)r rp)r=values r$rzDateDetector.default_tzs&u--$r&c|||}|d}| |||d|j}|ktt krGtt d|d|dd|j|Sn#t$rYnwxYwdS)aAttempts to return the date on a log line using templates. This uses the templates' `getDate` method in an attempt to find a date. For the faster usage, always specify a parameter timeMatch (the previous tuple result of the matchTime), then this will work without locking and without cycle over templates. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- float The Unix timestamp returned from the first successfully matched template or None if not found. Nrr)rz& got time %f for %r using template %s) rgetDaterpr~rrrgroupr.rr)r=r timeMatchr#dates r$getTimezDateDetector.getTimes(~~d##9 q\(    D)A,4;L  M MD   ""h.. jjC AwQ a  (-111 [     D sBB44 CCcrj|jttkr'ttdjj|jz j|j kr|j ndzfd}|sdz krSdz |sS=gd<|j tkrL|j jr:|xj dz c_ |j tkr|j j:ttkr"ttdSS)zReorder template (bubble up) in template list if hits grows enough. Parameters ---------- num : int Index of template should be moved. z% -> reorder template #%02i, hits: %rrc j}ttkr6ttd|jj|kpjkS)NzE -> compare template #%02i & #%02i, weight %.3f > %.3f, hits %r > %r)rFr~rrrr[r\)pweightrnumposrBuntimerFs r$ _moveablez0DateDetector._reorderTemplate.._moveable svn#G !!X-- ZZa 3y~/BDDD G  ?v #(???r&rrz" -> moved template #%02i -> #%02i) rhr~rrrr[r\rjrFrnr)r=rrrrrBrrFs ` @@@@@r$rzDateDetector._reorderTemplates $9 s^7   H,, JJx@#w|TTT  t0 06 N6#1C77  SAX3@@@@@@@@@@ )++ c!e|| Z a%C 9;; Z~i9SU c)nn , ,4;M1N1S ,!  c)nn , ,4;M1N1S ,   H,, JJx=sCHHH : *r&)F)NNTr8)rSrTrUrVr6rr>rurr}rWrBrrsetterrrr*r&r$rfrfs    ::::(5(5(5T7777"  ( JJJX  ( ...""""H- - - - - r&rfr8)" __author__ __copyright__ __license__copyr threadingr datetemplaterrrr r r strptimer utilsr helpersrrSr~rcompile IGNORECASErCacherr%r4objectr6rYrfr*r&r$rs(7 2  &&&&&& 8   2:0"-@@%+tU;;;0)B(A*kkkkkkkk\&&&&&6&&&.H H H H H 6H H H H H r&