=*fL:SrSrSrSSKrSSKrSSKJr SSKJrJ r J r J r J r J r SSKJr SS KJr S S KJr \"\5rS r\R."S \R05r\R4"SSS9rSSjrS4Sjr"SS\5r"SS\5r "SS\5r!g)z'Cyril Jaquier and Fail2Ban Contributorsz Copyright (c) 2004 Cyril JaquierGPLN)Lock)re DateTemplateDatePatternRegex DateTai64n DateEpochRE_EPOCH_PATTERN)validateTimeZone)Utils) getLoggerz(?/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py_getPatternTemplater%,sK# 3    $ ^g&&(c/BH 44w8H 77x$GH  55xWULH(HS#c SU-$N {^LN-BEG})ss r$r,Ds+/r&cHU"UR5n[RU5nU(dsU"[USUR55n[ US5(a[RU5nU(d)[ US5(d [ U5nU$[ U5nU$)Nr)namerrgetattrregexhasattrr%)r#wrapr. template2r0s r$_getAnchoredTemplater4Ds X]]   & wxHNN; <% Xy!!""5)9  (I & &#D)I $E*Ir&cR\rSrSrSrSr\S5rSr/SQr \S5r Sr S r g ) DateDetectorCacheYz>Implements the caching of the default templates list. c@[5Ul[5UlgN)r_DateDetectorCache__locklist_DateDetectorCache__templatesselfs r$__init__DateDetectorCache.__init__\s$+V$r&cUR(a UR$UR UR(aURsSSS5 $UR5 URsSSS5 $!,(df  g=f)DList of template instances managed by the detector. N)r<r:_addDefaultTemplater=s r$ templatesDateDetectorCache.templates`sZ     {{    {    {{sA6A66 BcRURnURS5(dgURS5(dQ[US5(a@[U5nURU:wa%SUlUR SR U5 UR SR U5 g)z4Cache Fail2Ban's default template. r)^r0gY@rrN)r. startswithr1r4weight_DateDetectorCache__tmpcacheappend)r>r#r.r3s r$_cacheTemplate DateDetectorCache._cacheTemplatels $  % %dooc.B.BwxY`GaGa#H-9nnIOOAi(//!H%r&)zF%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T| ?)%H:%M:%S(?:[.,]%f)?(?:\s*%z)?z)(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z$(?:%a )?%b %d %ExY %k:%M:%S(?:\.%f)?z1%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%Sz=%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\.%f)?(?: %z)?z%m/%d/%ExY:%H:%M:%Sz%m-%d-%ExY %k:%M:%S(?:\.%f)?rz{^LN-BEG}%H:%M:%Sz^<%m/%d/%Exy@%H:%M:%S>z%Exy%Exm%Exd ?%H:%M:%Sz%b %d, %ExY %I:%M:%S %pz^%b-%d-%Exy %k:%M:%Sz6%ExY%Exm%Exd(?:T| ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\s*%z)?z1(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?z1(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\.%f)?(?: %ExY)?rc[[RS[5(a@[ [R5H#up[ U5nU[RU'M% [R$)Nr) isinstancer6DEFAULT_TEMPLATESstr enumerater%)r>idts r$defaultTemplates"DateDetectorCache.defaultTemplatess\!33A6<<+==>uq R B-/''*?  , ,,r&c//4UlURHnURU5 M URSURS-UlU?g)zJAdd resp. cache Fail2Ban's default set of date templates. rrN)rJrUrLr<)r>rTs r$rC%DateDetectorCache._addDefaultTemplatesSF$/  ! !br "__Q'$//!*<<$ or&)__lock __templates __tmpcacheN) __name__ __module__ __qualname____firstlineno____doc__r?propertyrDrLrPrUrC__static_attributes__r*r&r$r6r6YsG    &$3j - - r&r6c8\rSrSrSrSrSr\S5rSr Sr g) DateDetectorTemplatezrUsed for "shallow copy" of the template object. Prevents collectively usage of hits/lastUsed in cached templates r#hitslastUseddistancec:XlSUlSUlSUlg)Nrrf)r>r#s r$r?DateDetectorTemplate.__init__s-$)$-$-r&cvURURR-[SUR5- $)Nr)rgr#rImaxrir=s r$rIDateDetectorTemplate.weights+ T]])) )C4==,A AAr&c.[URU5$)zSReturns attribute of template (called for parameters not in slots) )r/r#)r>r.s r$ __getattr__ DateDetectorTemplate.__getattr__s  %%r&)rirgrhr#N) r\r]r^r_r` __slots__r?rarIrqrbr*r&r$rdrds.: B B&r&rdc\rSrSrSr\"5rSrSSjrSr SSjr \ S5r S r \ S 5r\RS 5rSS jrS rSrg) DateDetectorzfManages one or more date templates to find a date within a log line. Attributes ---------- templates c[5Ul[5UlSUlSUlSUlSUlSUlSUl SUl g)Ni,)rN)rkNrkr) r;_DateDetector__templatesr!_DateDetector__known_names_DateDetector__unusedTime_DateDetector__lastPos_DateDetector__lastEndPos_DateDetector__lastTemplIdx_DateDetector__firstUnused_DateDetector__preMatch_DateDetector__default_tzr=s r$r?DateDetector.__init__sLV$u$$$.&$"$$$/$r&cURnX0R;aU(ag[SU-5eURRU5 URR [ U55 g)Nz(There is already a template with name %s)r.ry ValueErroraddrxrKrd)r>r# ignoreDupr.s r$_appendTemplateDateDetector._appendTemplates_ $   .5 77.x89r&cB^[U[5(aU=mnSU;aUR5m[R T5nU(dTTS;aU4SjnUR U5 gST;aUR USS9 gTS:Xa [ S T5nO [ UT5n[RTU5 URU5 [RS [US S 5UR5 [RS [US S 5UR5 g)aAdd a date template to manage and use in search of dates. Parameters ---------- template : DateTemplate or str Can be either a `DateTemplate` instance, or a string which will be used as the pattern for the `DatePatternRegex` template. The template will then be added to the detector. Raises ------ ValueError If a template already exists with the same name. r)r)z {DEFAULT}cN>TS:XaUR[R-$S$r()flagsr LINE_BEGIN)r#r"s r$r,-DateDetector.appendTemplate..s$3+CUx~~ (?(??_[__r&Nz{DATE}F)preMatch allDefaultsz{NONE}z{UNB}^z date pattern `%r`: `%s`rz date pattern regex for %r: %s)rOrQrrraddDefaultTemplater%r!rlogSysinfor/r.debugr0)r>r#rfltr"s @r$appendTemplateDateDetector.appendTemplates#3  --/C!!#&8  ((_  S! S g5A #Hc2X#GS1XsH%x ++) 8Y#X]]4,,0 8Y#X^^5r&Nc^[UR5S:nU(a[RRO[RR H5nUbU"U5(dMTb[ UU4SjS9nURXTS9 M7 g)z>Add Fail2Ban's default set of date templates. rNc:>^[RU4SjT5$)Nc0>[R"T5$r9)runboundPattern)mr+s r$r,CDateDetector.addDefaultTemplate....7s<3N3Nq3Qr&)RE_DATE_PREMATCHsub)r+rs`r$r,1DateDetector.addDefaultTemplate..7s$(()QS[\r&)r2)r)lenrxru _defCacherDrUr4r)r>filterTemplaterrrr#s ` r$rDateDetector.addDefaultTemplate*s$""#a')'2<## 8N8N8_8__ )A)A8#H \^H6`r&cUR$)rB)rxr=s r$rDDateDetector.templates;s   r&c [UR5(dUR5 [R 5[ ::a[R OSnU"[ S- SU5 SnSnSnURnU[UR5:GaURUnURnUR[R[R--(a&U"[ S- SU5 URU5nUnGOGURSURSpU"[ S- S XiU XS- U URSXU XU S-URS 5 XS- U URS:Xd:XU S-URS :XaURS R!5(dxXU S-URS :Xd:XS- U URS:XaHURSR!5(d&U"[ S- S XU 5 URXU 5nO#U"[ S- S 5 URU5nUnU(aUR#5n UR%5n [UR5S:XdWUR[R[R--(d$XRS:Xa!XRS:XaU"[ S U5 O!U"[ S5 X9X4nSnO U"[ S5 U(GdU"[ S[UR55 SnURGHnXe:XaUS- nMU"[ S- SXgR&5 URnURU5nU(Ga/UR#5n UR%5n U"[ SXiUR(URSUR&5 US-[UR5:a OUR[R[R--(a OU S:Xa>UR*(a-URUS-RR*(d OPXR(:dXRS:a#U"[ S5 XS:aX9X4nSnUS- nGM} O US- nGM U(d8US(a.Uup9pU"[ SU5 URUnURnU(aW=R*S- sl[,R,"5UlW UlUR0U:XaU=R0S- slXU S- U X4UlW XS- XU S-4UlU(a X`R:waUR3U5nX`lUW4$U"[ S5 g)aAttempts to find date on a log line using templates. This uses the templates' `matchDate` method in an attempt to find a date. It also increments the match hit count for the winning template. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- re.MatchObject, DateTemplate The regex match returned from the first successfully matched template. cgr9r*)argss r$r,(DateDetector.matchTime..VsPTr&rz"try to match time for line: %.120sN)Nrkrkrkz/ try to match last anchored template #%02i ...rzJ try to match last template #%02i (from %r to %r): ...%r==%r %s %r==%r...rz+ boundaries are correct, search in part %rz, boundaries show conflict, try whole searchz" matched last time template #%02izB ** last pattern collision - pattern change, reserve & search ...z8 ** last pattern not found - pattern change, search ...z search template (%i) ...z try template #%02i: %sz2 matched time template #%02i (at %r <= %r, %r) %sz1 ** distance collision - pattern change, reservez use best time template #%02iz no template.)NN)rrxrrgetEffectiveLevellogLevellogr}r#rrrLINE_END matchDater{r|isalnumrendr.rirgtimerhr~_reorderTemplate) r>linermatchfoundignoreBySearchrSddtemplr#riendposs r$ matchTimeDateDetector.matchTimeAs=& T    ..0H< BT#hqj6= % *%. !T      a 78nn // 0E0EEF EqI   t $EN~~a($*;*;A*>f `& 1*Xq 1 6 D--a0 2 1*X$.."33 XaZ DNN1$55dnnQ>O>W>W>Y>Y d//22 1HV 1 1! 44T=N=Nq=Q=Y=Y=[=[ !BDRXDYZ    7U!CD    %U^ {{}H YY[F   a ^^|..|/D/DDE..##2C2CA2F(F7;WX f 'U ULM x,c$2B2B.CD1""w!VQ  .<<@H   t $E  XiikVG7##T^^A%6 G !s4##$$ ,11,2G2GGH Q7<<1A1A!A#1F1O1O1T1T  ###x..2C'C (GH !H )ue1fa FAE#H E!H!&EV2A6q!GH  <<1<iik77 A!8A:h7G4>t1H~t6!8/DD4A$$ $ a A ( h r&cUR$r9)rr=s r$ default_tzDateDetector.default_tzs  r&c$[U5Ulgr9)r r)r>values r$rrs&u-$r&cVUcURU5nUSnUb}URXSURS9nUbZ[R 5[ ::a<[R [ SUSUSRS5UR5 U$gg![a gf=f)aAttempts to return the date on a log line using templates. This uses the templates' `getDate` method in an attempt to find a date. For the faster usage, always specify a parameter timeMatch (the previous tuple result of the matchTime), then this will work without locking and without cycle over templates. Parameters ---------- line : str Line which is searched by the date templates. Returns ------- float The Unix timestamp returned from the first successfully matched template or None if not found. Nrr)rz& got time %f for %r using template %s) rgetDaterrrrrgroupr.r)r>r timeMatchr#dates r$getTimeDateDetector.getTimes(~~d#9 q\(    DA,4;L;L  MD   "h. jjC AwQ a (--1 [      sA9B B('B(cN^^^^^^T(GaURmTTm[R5[::a&[R [STTR 5 TR UR- mTRmURT:a UROTS-mUUUUUU4SjnU"5(dTTS- :XaT$TS- mU"5(dT$TT T/TTS&UR[T5:alTURR (aNU=RS- sl UR[T5:a TURR (aMN[R5[::a[R [STT5 T$T$)zReorder template (bubble up) in template list if hits grows enough. Parameters ---------- num : int Index of template should be moved. z% -> reorder template #%02i, hits: %rrc >TTRn[R5[::a7[R [STTTUTR TTR 5 TU:=(d TTTR :$)NzE -> compare template #%02i & #%02i, weight %.3f > %.3f, hits %r > %r)rIrrrrrgrh)pweightrnumposrDuntimerIs r$ _moveable0DateDetector._reorderTemplate.._moveable son##G !X- ZZa 3y~/B/BD G  ?v #(?(???r&rrz" -> moved template #%02i -> #%02i) rxrrrrrgrhrzrIr~r)r>rrrrrDrrIs ` @@@@@r$rDateDetector._reorderTemplates^ 9 s^7  H, JJx@#w||T   t00 06 NN6#11C7  SAX3@@ ++ c!e| Z a%C ;; Z~i9S  c)n ,4;M;M1N1S1S!   c)n ,4;M;M1N1S1S1S  H, JJx=sCH : *r&) __default_tz __firstUnused __known_names __lastEndPos __lastPos__lastTemplIdx __preMatchrZ __unusedTime)F)NNTr9)r\r]r^r_r`r6rr?rrrrarDrrsetterrrrbr*r&r$rurusz   :(5T7"   JX   .."H- r&rur9)" __author__ __copyright__ __license__copyr threadingr datetemplaterrrr r r strptimer utilsr helpersrr\rrcompile IGNORECASErCacherr%r4objectr6rdrur*r&r$rs(7 2  & 8  ::0"--@++tU;0)B*kk\&6&.H 6H r&