o _ L@sdZdZdZddlZddlZddlmZddlmZm Z m Z m Z m Z m Z ddlmZdd lmZd d lmZeeZd Zed ejZejdddZdddZddfddZGdddeZGdddeZ GdddeZ!dS)z'Cyril Jaquier and Fail2Ban Contributorsz Copyright (c) 2004 Cyril JaquierGPLN)Lock)re DateTemplateDatePatternRegex DateTai64n DateEpochRE_EPOCH_PATTERN)validateTimeZone)Utils) getLoggerz(?/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py_getPatternTemplate,s&   r$cCsd|SN {^LN-BEG}r"sr"r"r#Dsr)cCsd||j}t|}|s0|t|d|j}t|drt|}|s0t|ds,t|}|St|}|S)Nr)namerrgetattrregexhasattrr$)r!wrapr* template2r,r"r"r#_getAnchoredTemplateDs     r0c@sHeZdZdZddZeddZddZgdZed d Z d d Z d S)DateDetectorCachez7Implements the caching of the default templates list. cCst|_t|_dSN)r_DateDetectorCache__locklist_DateDetectorCache__templatesselfr"r"r#__init__\s zDateDetectorCache.__init__cCs^|jr|jS|j|jr|jWdS||jWdS1s(wYdS)6List of template instances managed by the detector. N)r5r3_addDefaultTemplater6r"r"r# templates`s$zDateDetectorCache.templatescCs`|j}|ds&|ds&t|dr&t|}|j|kr&d|_|jd||jd|dS)z&Cache Fail2Ban's default template. r&^r,gY@rrN)r* startswithr-r0weight_DateDetectorCache__tmpcacheappend)r7r!r*r/r"r"r#_cacheTemplatels z DateDetectorCache._cacheTemplate)zF%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T| ?)%H:%M:%S(?:[.,]%f)?(?:\s*%z)?z)(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z$(?:%a )?%b %d %ExY %k:%M:%S(?:\.%f)?z1%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%Sz=%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\.%f)?(?: %z)?z%m/%d/%ExY:%H:%M:%Sz%m-%d-%ExY %k:%M:%S(?:\.%f)?rz{^LN-BEG}%H:%M:%Sz^<%m/%d/%Exy@%H:%M:%S>z%Exy%Exm%Exd ?%H:%M:%Sz%b %d, %ExY %I:%M:%S %pz^%b-%d-%Exy %k:%M:%Sz6%ExY%Exm%Exd(?:T| ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\s*%z)?z1(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z1(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?rcCs<ttjdtrttjD] \}}t|}|tj|<q tjS)Nr) isinstancer1DEFAULT_TEMPLATESstr enumerater$)r7idtr"r"r#defaultTemplatess  z"DateDetectorCache.defaultTemplatescCs>ggf|_|jD]}||q|jd|jd|_|`dS)zmaxrRr6r"r"r#r>szDateDetectorTemplate.weightcCs t|j|S)zF Returns attribute of template (called for parameters not in slots) )r+r!)r7r*r"r"r# __getattr__s z DateDetectorTemplate.__getattr__N) rIrJrKrL __slots__r8rMr>rUr"r"r"r#rNs  rNc@szeZdZdZeZddZdddZddZdd d Z e d dZ ddZ e ddZ e jddZ dddZddZd S) DateDetectorzjManages one or more date templates to find a date within a log line. Attributes ---------- templates cCs>t|_t|_d|_d|_d|_d|_d|_d|_ d|_ dS)Ni,)rN)rSNrSr) r4_DateDetector__templatesr_DateDetector__known_names_DateDetector__unusedTime_DateDetector__lastPos_DateDetector__lastEndPos_DateDetector__lastTemplIdx_DateDetector__firstUnused_DateDetector__preMatch_DateDetector__default_tzr6r"r"r#r8s zDateDetector.__init__FcCsD|j}||jvr|r dStd||j||jt|dS)Nz(There is already a template with name %s)r*rY ValueErroraddrXr@rN)r7r! ignoreDupr*r"r"r#_appendTemplates  zDateDetector._appendTemplatecst|trK|}d|vr|t}|sEdvr)fdd}||dSdvr6|j|dddSd kr@td }nt|}t|||t d t |d d |j t dt |d d |jdS)aAdd a date template to manage and use in search of dates. Parameters ---------- template : DateTemplate or str Can be either a `DateTemplate` instance, or a string which will be used as the pattern for the `DatePatternRegex` template. The template will then be added to the detector. Raises ------ ValueError If a template already exists with the same name. r)r&z {DEFAULT}csdkr |jtj@SdSr%)flagsr LINE_BEGIN)r!r r"r#r)sz-DateDetector.appendTemplate..Nz{DATE}F)preMatch allDefaultsz{NONE}z{UNB}^z date pattern `%r`: `%s`rz date pattern regex for %r: %s)rBrDrrraddDefaultTemplater$rrdlogSysinfor+r*debugr,)r7r!rfltr"rgr#appendTemplates2        zDateDetector.appendTemplateNTcsht|jdk}|r tjjntjjD] }|dur||sqdur*t|fddd}|j||dqdS)z0Add Fail2Ban's default set of date templates. rNcstfddS)Ncs tSr2)runboundPattern)mr'r"r#r)7s zCDateDetector.addDefaultTemplate....)RE_DATE_PREMATCHsubr'rhr'r#r)7sz1DateDetector.addDefaultTemplate..)r.)rc)lenrXrW _defCacher;rHr0rd)r7filterTemplaterhrircr!r"rur#rk*s zDateDetector.addDefaultTemplatecC|jS)r9)rXr6r"r"r#r;;szDateDetector.templatesc Cst|js |ttkrtjndd}|tdd|d}d}d}|j}|t|jkr%|j|}|j}|j t j t j B@rP|tdd|| |}|}n|jd |jd } } |tdd || | || d| |jd|| | || | d|jd  || d| |jdks|| |jd kr|jd s|| | d|jd ks|| d|jdkr|jds|tdd || | | || | }n|tdd | |}|}|r |} |} t|jdks |j t j t j B@s | |jd kr| |jd kr|td|n|td|| | |f}d}n|td|s|tdt|jd }|jD]}||krC|d7}q6|tdd||j|j}| |}|r|} |} |td|| |j|jd |j|dt|jkr{nQ|j t j t j B@rnE| d kr|jr|j|djjsn0| |jks| |jd kr|td| |dkr|| | |f}d}|d7}q6n|d7}q6|s|d r|\}} } }|td||j|}|j}|r:|jd7_t|_| |_|j|kr|jd7_| || d| || f|_| || d|| | df|_|r3||jkr3||}||_||fS|tddS)aAttempts to find date on a log line using templates. This uses the templates' `matchDate` method in an attempt to find a date. It also increments the match hit count for the winning template. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- re.MatchObject, DateTemplate The regex match returned from the first successfully matched template. cWsdSr2r")argsr"r"r#r)Vsz(DateDetector.matchTime..rz"try to match time for line: %.120sN)NrSrSrSz/ try to match last anchored template #%02i ...rzJ try to match last template #%02i (from %r to %r): ...%r==%r %s %r==%r...r z+ boundaries are correct, search in part %rz, boundaries show conflict, try whole searchz" matched last time template #%02izB ** last pattern collision - pattern change, reserve & search ...z8 ** last pattern not found - pattern change, search ...z search template (%i) ...z try template #%02i: %sz2 matched time template #%02i (at %r <= %r, %r) %sz1 ** distance collision - pattern change, reservez use best time template #%02iz no template.)NN)rvrXrkrlgetEffectiveLevellogLevellogr]r!rerrfLINE_END matchDater[r\isalnumrendr*rRrPtimerQr^_reorderTemplate) r7liner~matchfoundignoreBySearchrFddtemplr!rRendposr"r"r# matchTimeAs      $        &           zDateDetector.matchTimecCryr2)r`r6r"r"r# default_tzszDateDetector.default_tzcCst||_dSr2)r r`)r7valuer"r"r#rscCs|dur ||}|d}|durHz,|j||d|jd}|dur;ttkr8ttd|d|dd|j|WSWdSt yGYdSwdS)aAttempts to return the date on a log line using templates. This uses the templates' `getDate` method in an attempt to find a date. For the faster usage, always specify a parameter timeMatch (the previous tuple result of the matchTime), then this will work without locking and without cycle over templates. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- float The Unix timestamp returned from the first successfully matched template or None if not found. Nrr)rz& got time %f for %r using template %s) rgetDater`rlr|r}r~groupr*ra)r7r timeMatchr!dater"r"r#getTimes&   zDateDetector.getTimecsr|jttkrttdjj|jj|j kr)|j ndfdd}|sLdkrCSd|sLS=gd<|j t krw|j jrw|j d7_ |j t krw|j jscttkrttdSS)zReorder template (bubble up) in template list if hits grows enough. Parameters ---------- num : int Index of template should be moved. z% -> reorder template #%02i, hits: %rr c sLj}ttkrttd|jj|kp%jkS)NzE -> compare template #%02i & #%02i, weight %.3f > %.3f, hits %r > %r)r>rlr|r}r~rPrQ)pweightrnumposr;untimer>r"r# _moveable s  z0DateDetector._reorderTemplate.._moveablerrz" -> moved template #%02i -> #%02i) rXrlr|r}r~rPrQrZr>r^rv)r7rrr"rr#rs0    zDateDetector._reorderTemplate)F)NNTr2)rIrJrKrLr1rwr8rdrprkrMr;rrsetterrrr"r"r"r#rWs"  *     $rWr2)" __author__ __copyright__ __license__copyr threadingr datetemplaterrrrr r strptimer utilsr helpersrrIrlr}compile IGNORECASErsCacherr$r0objectr1rNrWr"r"r"r#s&      n