GkcL<dZdZdZddlZddlZddlmZddlmZm Z m Z m Z m Z m Z ddlmZdd lmZd d lmZeeZd Zej.d ej0Zej4ddZddZdfdZGddeZGddeZ GddeZ!y)z'Cyril Jaquier and Fail2Ban Contributorsz Copyright (c) 2004 Cyril JaquierGPLN)Lock)re DateTemplateDatePatternRegex DateTai64n DateEpochRE_EPOCH_PATTERN)validateTimeZone)Utils) getLoggerz(?/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py_getPatternTemplater%,sK# 3    $ ^g&(c/BH 44w8H 77x$GH  55xWULH(HS(#c d|zSN {^LN-BEG})ss r$r,Ds +/r&c ||j}tj|}|sd|t|d|j}t |drtj|}|s$t |ds t |}|St |}|S)Nr)namerrgetattrregexhasattrr%)r#wrapr. template2r0s r$_getAnchoredTemplater4Ds X]]   & wxHNN; <% Xy!""5)9  (I &#D)I $E*Ir&cJeZdZdZdZedZdZgdZedZ dZ y) DateDetectorCachez7Implements the caching of the default templates list. c@t|_t|_yN)r_DateDetectorCache__locklist_DateDetectorCache__templatesselfs r$__init__zDateDetectorCache.__init__\s$+V$r&c|jr |jS|j5|jr|jcdddS|j|jcdddS#1swYyxYw)6List of template instances managed by the detector. N)r;r9_addDefaultTemplater<s r$ templateszDateDetectorCache.templates`sh     {{        sA,A,,A5c2|j}|jds\|jdsKt|dr?t|}|j|k7r%d|_|j dj ||j dj |y)z&Cache Fail2Ban's default template. r)^r0gY@rrN)r. startswithr1r4weight_DateDetectorCache__tmpcacheappend)r=r#r.r3s r$_cacheTemplatez DateDetectorCache._cacheTemplatels| $  %dooc.BwxY`Ga#H-9nnIOOAi(//!H%r&)zF%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T| ?)%H:%M:%S(?:[.,]%f)?(?:\s*%z)?z)(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z$(?:%a )?%b %d %ExY %k:%M:%S(?:\.%f)?z1%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%Sz=%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\.%f)?(?: %z)?z%m/%d/%ExY:%H:%M:%Sz%m-%d-%ExY %k:%M:%S(?:\.%f)?rz{^LN-BEG}%H:%M:%Sz^<%m/%d/%Exy@%H:%M:%S>z%Exy%Exm%Exd ?%H:%M:%Sz%b %d, %ExY %I:%M:%S %pz^%b-%d-%Exy %k:%M:%Sz6%ExY%Exm%Exd(?:T| ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\s*%z)?z1(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z1(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?rcttjdtr?t tjD]#\}}t |}|tj|<%tjS)Nr) isinstancer6DEFAULT_TEMPLATESstr enumerater%)r=idts r$defaultTemplatesz"DateDetectorCache.defaultTemplatess`!33A6<+==>0uq" R B-/''*0  , ,,r&cggf|_|jD]}|j||jd|jdz|_|`y)zpropertyrBrIrLrQrAr*r&r$r6r6YsG    &$3j - - r&r6c0eZdZdZdZdZedZdZy)DateDetectorTemplateztUsed for "shallow copy" of the template object. Prevents collectively usage of hits/lastUsed in cached templates r#hitslastUseddistancec<||_d|_d|_d|_y)NrrZ)r=r#s r$r>zDateDetectorTemplate.__init__s$-$)$-$-r&cv|j|jjztd|jz S)Nr)r[r#rFmaxr]r<s r$rFzDateDetectorTemplate.weights+ T]])) )C4==,A AAr&c.t|j|S)zF Returns attribute of template (called for parameters not in slots) )r/r#)r=r.s r$ __getattr__z DateDetectorTemplate.__getattr__s  %%r&N) rSrTrUrV __slots__r>rWrFrcr*r&r$rYrYs.: B B&r&rYceZdZdZeZdZd dZdZddZ e dZ dZ e d Z e jd Z dd Zd Zy) DateDetectorzjManages one or more date templates to find a date within a log line. Attributes ---------- templates ct|_t|_d|_d|_d|_d|_d|_d|_ d|_ y)Ni,)rN)r_Nr_r) r:_DateDetector__templatesr!_DateDetector__known_names_DateDetector__unusedTime_DateDetector__lastPos_DateDetector__lastEndPos_DateDetector__lastTemplIdx_DateDetector__firstUnused_DateDetector__preMatch_DateDetector__default_tzr<s r$r>zDateDetector.__init__sLV$u$$$.&$"$$$/$r&c|j}||jvr|rytd|z|jj||jj t |y)Nz(There is already a template with name %s)r.ri ValueErroraddrhrHrY)r=r# ignoreDupr.s r$_appendTemplatezDateDetector._appendTemplatesa $ T   .5 77.x89r&c$t|tr|x}d|vr|jtj }|sQdvrfd}|j |ydvr|j |dydk(r t d }n t |}tj||j|tjd t|d d |jtjd t|d d |jy)aAdd a date template to manage and use in search of dates. Parameters ---------- template : DateTemplate or str Can be either a `DateTemplate` instance, or a string which will be used as the pattern for the `DatePatternRegex` template. The template will then be added to the detector. Raises ------ ValueError If a template already exists with the same name. r)r)z {DEFAULT}cLdk(r|jtjzSdSr()flagsr LINE_BEGIN)r#r"s r$r,z-DateDetector.appendTemplate..s"3+CUx~~ (?(??[_r&Nz{DATE}F)preMatch allDefaultsz{NONE}z{UNB}^z date pattern `%r`: `%s`rz date pattern regex for %r: %s)rKrMrrraddDefaultTemplater%r!rulogSysinfor/r.debugr0)r=r#rfltr"s @r$appendTemplatezDateDetector.appendTemplates#3  --/C!!#&8  ((_  S! S g5A #Hc2X#GS1XsH%x ++) 8Y#X]]4,,0 8Y#X^^5r&Nc t|jdkD}|rtjjntjj D]2}| ||st |fd}|j||4y)z0Add Fail2Ban's default set of date templates. rNc8tjfdS)Nc.tjSr8)runboundPattern)mr+s r$r,zCDateDetector.addDefaultTemplate....7s<3N3Nq3Qr&)RE_DATE_PREMATCHsub)r+rzs`r$r,z1DateDetector.addDefaultTemplate..7s$(()QS[\r&)r2)rt)lenrhrf _defCacherBrQr4ru)r=filterTemplaterzr{rtr#s ` r$r}zDateDetector.addDefaultTemplate*s$""#a')'2<## 8N8N8_8_ 7h )A8#H \^HI6 7r&c|jS)r@)rhr<s r$rBzDateDetector.templates;s   r&c8 t|js|jtj t krtj nd}|t dz d|d}d}d}|j}|t|jkrq|j|}|j}|jtjtjzzr&|t dz d||j|}|}nD|jd|jd} } |t dz d || | || dz | |jd|| | || | dz|jd  || dz | |jdk(s5|| | dz|jd k(r|jd j!su|| | dz|jd k(s5|| dz | |jdk(rE|jdj!s(|t dz d || | |j|| | }n#|t dz d |j|}|}|r|j#} |j%} t|jdk(sR|jtjtjzzs$| |jdk(r!| |jdk(r|t d |n#|t d|| | |f}d}n |t d|s|t dt|jd}|jD]o}||k(r|dz }|t dz d||j&|j}|j|}|r |j#} |j%} |t d|| |j(|jd|j&|dzt|jk\rn|jtjtjzzrn| dk(r4|j*r(|j|dzjj*snO| |j(kDs| |jdkDr$|t d| |dkr|| | |f}d}|dz }in|dz }r|s5|dr0|\}} } }|t d||j|}|j}|rxj*dz c_t-j,|_ |_|j0|k(r|xj0dz c_| || dz | || f|_ || dz || | dzf|_|r ||jk7r|j3|}||_|fS|t dy)aAttempts to find date on a log line using templates. This uses the templates' `matchDate` method in an attempt to find a date. It also increments the match hit count for the winning template. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- re.MatchObject, DateTemplate The regex match returned from the first successfully matched template. cyr8r*)argss r$r,z(DateDetector.matchTime..Vsr&rz"try to match time for line: %.120sN)Nr_r_r_z/ try to match last anchored template #%02i ...rzJ try to match last template #%02i (from %r to %r): ...%r==%r %s %r==%r...rz+ boundaries are correct, search in part %rz, boundaries show conflict, try whole searchz" matched last time template #%02izB ** last pattern collision - pattern change, reserve & search ...z8 ** last pattern not found - pattern change, search ...z search template (%i) ...z try template #%02i: %sz2 matched time template #%02i (at %r <= %r, %r) %sz1 ** distance collision - pattern change, reservez use best time template #%02iz no template.)NN)rrhr}r~getEffectiveLevellogLevellogrmr#rxrryLINE_END matchDaterkrlisalnumrendr.r]r[timer\rn_reorderTemplate) r=linermatchfoundignoreBySearchrOddtemplr#r]endposs r$ matchTimezDateDetector.matchTimeAsw& T   ..0H< BT#hqj6= % *%. !T      a 78nn // 0E0EEF EqI   t $EN~~a($*;*;A*>fH `& (1*Xq 1 (6 &D--a0 2 (1*X$.."33 HXaZ DNN1$55dnnQ>O>W>W>Y &d//22 F1HV 1 1! 44T=N=Nq=Q=Y=Y=[ !BDRXDYZ   h 7U!CD    %U^ {{}H YY[F   a ^^|..|/D/DDE$..##$2C2CA2F(F7;WX Hfa 'U ULM x,c$2B2B.CD1""" wN!VQ  .7<<@H   t $E  XiikVG7##T^^A%6 G !s4##$$ ,11,2G2GGH Q7<<1A1A!A#1F1O1O1T1T  7###x$..2C'C (GH E!H h)ue1fa FAE" H E!H!&E8VQ2A6q!GH  <<1<iik77 A!d8A:h7hG4>tF1H~tF6!8/DD4A$$ $ a A4 ( h r&c|jSr8)rpr<s r$ default_tzzDateDetector.default_tzs  r&c$t||_yr8)r rp)r=values r$rzDateDetector.default_tzs&u-$r&cT||j|}|d}| |j||d|j}|Ytj t kr reorder template #%02i, hits: %rrc j}tjtkr7tj td|j j |kDxsj kDS)NzE -> compare template #%02i & #%02i, weight %.3f > %.3f, hits %r > %r)rFr~rrrr[r\)pweightrnumposrBuntimerFs r$ _moveablez0DateDetector._reorderTemplate.._moveable son##G !X- ZZa 3y~/B/BD G  ?v #(?(???r&rrz" -> moved template #%02i -> #%02i) rhr~rrrr[r\rjrFrnr)r=rrrrrBrrFs ` @@@@@r$rzDateDetector._reorderTemplatesW 9 s^7  H, JJx@#w||T   t00 06 NN6#11C7  SAX3@@ + c!e| Z a%C ; Z~i9S  c)n ,4;M;M1N1S1S!   c)n ,4;M;M1N1S1S  H, JJx=sCH : *r&)F)NNTr8)rSrTrUrVr6rr>rurr}rWrBrrsetterrrr*r&r$rfrfsz   :(5T7"   JX   .."H- r&rfr8)" __author__ __copyright__ __license__copyr threadingr datetemplaterrrr r r strptimer utilsr helpersrrSr~rcompile IGNORECASErCacherr%r4objectr6rYrfr*r&r$rs(7 2  & 8  2::0"--@%++tU;0)B*kk\&6&.H 6H r&