Changelog and version changes for 0.8.6

This reverts commit 927a01a076.

Let's not change this behavior for now from previous release since it
would break finding recent hits upon restart.

.gitignore

@@ -0,0 +1 @@
+*~

.pylintrc

@@ -0,0 +1,37 @@
+# Custom pylint configuration for the Fail2Ban project
+#
+# Set your PYLINTRC environment variable to point to this file
+# e.g.
+#      export PYLINTRC=$PWD/.pylintrc
+
+[FORMAT]
+indent-string='\t'
+
+[BASIC]
+# Fail2Ban uses non-conventional to Python world camel-casing
+# These regexps were originally borrowed from 0.4.x series of
+# PyMVPA which had similar conventions.
+
+# Regular expression which should only match correct module names
+module-rgx=(([a-z][a-z0-9_]*)|([A-Z][a-zA-Z0-9_]+))$
+
+attr-rgx=[a-z_][a-zA-Z0-9_]{2,30}
+
+# Regular expression which should only match correct class names
+class-rgx=[A-Z_]+[a-zA-Z0-9]+$
+
+# Regular expression which should only match correct function names
+function-rgx=[a-z_]+[a-z_][a-zA-Z0-9]*$
+
+# Regular expression which should only match correct method names
+method-rgx=([a-z_]|__)[a-zA-Z0-9]*(__)?$
+
+# Regular expression which should only match correct argument names
+argument-rgx=[a-z][a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?$
+
+# Regular expression which should only match correct variable names
+variable-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?||(__.*__))$||[A-Z]
+
+# Regular expression which should only match correct module level names
+# Default: (([A-Z_][A-Z1-9_]*)|(__.*__))$
+const-rgx=([a-z_]+[a-zA-Z0-9]*_*[a-zA-Z0-9]*_*[a-zA-Z0-9]*_?|__.*__)$||[A-Z]

ChangeLog

@@ -4,9 +4,52 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.5)                                              2011/07/28
+Fail2Ban (version 0.8.6)                                              2011/11/28
 ================================================================================
 
+ver. 0.8.6 (2011/11/28) - stable
+----------
+- Fixes:
+  Markos Chandras & Yaroslav Halchenko
+   * [492d8e5,bd658fc] Use hashlib (instead of deprecated md5) where available
+  Robert Trace & Michael Lorant
+   * [c48c2b1] gentoo-initd cleanup and fixes: assure /var/run + remove stale
+     sock file
+  Michael Saavedra
+   * [3a58d0e] Lock server's executeCmd to prevent racing among iptables calls:
+     see http://bugs.debian.org/554162
+  Yaroslav Halchenko
+   * [3eb5e3b] Allow for trailing spaces in sasl logs
+   * [1632244] Stop server-side communication before stopping the
+     jails (prevents lockup if actions use fail2ban-client upon
+	 unban): see https://github.com/fail2ban/fail2ban/issues/7
+   * [5a2d518] Various changes to reincarnate unittests
+  Yehuda
+   * Wiki was cleaned from SPAM
+- Enhancements:
+  Adam Spiers
+   * [3152afb] Recognise time-stamped kernel messages
+  Guido Bozzetto
+   * [713fea6] Added ipmasq rule file to restart fail2ban when iptables are
+     wiped out: see http://bugs.debian.org/461417
+  Łukasz
+   * [5f23542] Matching of month names in Polish (thanks michaelberg79
+     for QA)
+  Tom Hendrikx
+   * [9fa54cf] Added Date: header for sendmail*.conf actions
+  Yaroslav Halchenko & Tom Hendrikx
+   * [b52d420..22b7007] <matches> in action files now can be used
+     to provide matched	loglines which triggered action
+  Yaroslav Halchenko
+   * [ed0bf3a] Removed duplicate entry for DataCha0s/2\.0 in badbots:
+     see http://bugs.debian.org/519557
+   * [dad91f7] sshd.conf: allow user names to have spaces and
+     trailing spaces in the line
+   * [a9be451] removed expansions for few Date and Revision SVN keywords
+   * [a33135c] set/getFile for ticket.py -- found in source distribution
+     of 0.8.4
+   * [fbce415] additional logging while stopping the jails
+
 ver. 0.8.5 (2011/07/28) - stable
 ----------
 - Fix: use addfailregex instead of failregex while processing per-jail

MANIFEST

@@ -1,6 +1,7 @@
 README
 ChangeLog
 TODO
+THANKS
 COPYING
 fail2ban-client
 fail2ban-server

README

@@ -4,7 +4,7 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-Fail2Ban (version 0.8.5)                                              2011/07/26
+Fail2Ban (version 0.8.6)                                              2011/11/28
 ================================================================================
 
 Fail2Ban scans log files like /var/log/pwdfail and bans IP that makes too many
@@ -26,8 +26,8 @@ Optional:
 
 To install, just do:
 
-> tar xvfj fail2ban-0.8.4.tar.bz2
-> cd fail2ban-0.8.4
+> tar xvfj fail2ban-0.8.6.tar.bz2
+> cd fail2ban-0.8.6
 > python setup.py install
 
 This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
@@ -54,25 +54,23 @@ to the website: http://www.fail2ban.org
 Contact:
 --------
 
-You need some new features, you found bugs or you just appreciate this program,
-you can contact me at:
-
 Website: http://www.fail2ban.org
 
-Cyril Jaquier: <cyril.jaquier@fail2ban.org>
+You need some new features, you found bugs: visit
+https://github.com/fail2ban/fail2ban/issues
+and if your issue is not yet known -- file a bug report.
+
+If you would like to troubleshoot or discuss: join the mailing list
+https://lists.sourceforge.net/lists/listinfo/fail2ban-users
+
+If you just appreciate this program: send kudos to the original
+author: Cyril Jaquier: <cyril.jaquier@fail2ban.org>
+
 
 Thanks:
 -------
 
-Kévin Drapel, Marvin Rouge, Sireyessire, Robert Edeker, Tom Pike, Iain Lea,
-Andrey G. Grozin, Yaroslav Halchenko, Jonathan Kamens, Stephen Gildea, Markus
-Hoffmann, Mark Edgington, Patrick Börjesson, kojiro, zugeschmiert, Tyler, Nick
-Munger, Christoph Haas, Justin Shore, Joël Bertrand, René Berber, mEDI, Axel
-Thimm, Eric Gerbier, Christian Rauch, Michael C. Haller, Jonathan Underwood,
-Hanno 'Rince' Wagner, Daniel B. Cid, David Nutter, Raphaël Marichez, Guillaume
-Delvit, Vaclav Misek, Adrien Clerc, Michael Hanselmann, Vincent Deffontaines,
-Bill Heaton, Russell Odom, Christos Psonis, Arturo 'Buanzo' Busleiman and many
-others.
+See THANKS file.
 
 License:
 --------

THANKS

@@ -0,0 +1,47 @@
+Fail2Ban is an open source project with many contributions from its
+users community. Below is an alphabetically sorted partial list of the
+contributors to the project.  If you have been left off, please let us
+know (preferably send a pull request on github with the "fix") and you
+will be added
+
+Adrien Clerc
+Andrey G. Grozin
+Arturo 'Buanzo' Busleiman
+Axel Thimm
+Bill Heaton
+Christian Rauch
+Christoph Haas
+Christos Psonis
+Daniel B. Cid
+David Nutter
+Eric Gerbier
+Guillaume Delvit
+Hanno 'Rince' Wagner
+Iain Lea
+Jonathan Kamens
+Jonathan Underwood
+Joël Bertrand
+Justin Shore
+Kévin Drapel
+kojiro
+Mark Edgington
+Markus Hoffmann
+Marvin Rouge
+mEDI
+Michael C. Haller
+Michael Hanselmann
+NickMunger
+Patrick Börjesson
+Raphaël Marichez
+René Berber
+Robert Edeker
+Russell Odom
+Sireyessire
+Stephen Gildea
+Tom Pike
+Tyler
+Vaclav Misek
+Vincent Deffontaines
+Yaroslav Halchenko
+Yehuda Katz
+zugeschmiert

TODO

@@ -4,7 +4,7 @@
                        |_| \__,_|_|_/___|_.__/\__,_|_||_|
 
 ================================================================================
-ToDo                                                            $Revision$
+ToDo
 ================================================================================
 
 Legend:

client/__init__.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

client/actionreader.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -87,4 +90,4 @@ class ActionReader(ConfigReader):
 				stream.append(head + ["setcinfo", self.__file, p, self.__cInfo[p]])
 
 		return stream
-		
+		

client/beautifier.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

client/configparserinc.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -19,8 +22,8 @@
 # $Revision$
 
 __author__ = 'Yaroslav Halhenko'
-__revision__ = '$Revision: $'
-__date__ = '$Date:  $'
+__revision__ = '$Revision$'
+__date__ = '$Date$'
 __copyright__ = 'Copyright (c) 2007 Yaroslav Halchenko'
 __license__ = 'GPL'
 

client/configreader.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

client/configurator.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -75,4 +78,4 @@ class Configurator:
 		for opt in self.__streams["jails"]:
 			cmds.append(opt)
 		return cmds
-	
+	

client/csocket.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

client/fail2banreader.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -55,4 +58,4 @@ class Fail2banReader(ConfigReader):
 			elif opt == "logtarget":
 				stream.append(["set", "logtarget", self.__opts[opt]])
 		return stream
-	
+	

client/filterreader.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -71,4 +74,4 @@ class FilterReader(ConfigReader):
 					if regex != '':
 						stream.append(["set", self.__name, "addignoreregex", regex])		
 		return stream
-		
+		

client/jailreader.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

client/jailsreader.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -84,4 +87,4 @@ class JailsReader(ConfigReader):
 			stream.append(["start", jail.getName()])
 		
 		return stream
-		
+		

common/__init__.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

common/helpers.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -27,12 +30,12 @@ __license__ = "GPL"
 
 
 def formatExceptionInfo():
-    """ Author: Arturo 'Buanzo' Busleiman """
-    import sys
-    cla, exc = sys.exc_info()[:2]
-    excName = cla.__name__
-    try:
-        excArgs = exc.__dict__["args"]
-    except KeyError:
-        excArgs = str(exc)
-    return (excName, excArgs)
+	""" Author: Arturo 'Buanzo' Busleiman """
+	import sys
+	cla, exc = sys.exc_info()[:2]
+	excName = cla.__name__
+	try:
+		excArgs = exc.__dict__["args"]
+	except KeyError:
+		excArgs = str(exc)
+	return (excName, excArgs)

common/protocol.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

common/version.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -24,4 +27,4 @@ __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011 Yaroslav Halchenko"
 __license__ = "GPL"
 
-version = "0.8.5"
+version = "0.8.6"

config/action.d/sendmail-whois-lines.conf

@@ -12,6 +12,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: Fail2Ban <<sender>>
               To: <dest>\n
               Hi,\n
@@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -46,6 +48,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n

config/action.d/sendmail-whois.conf

@@ -12,6 +12,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: Fail2Ban <<sender>>
               To: <dest>\n
               Hi,\n
@@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -46,6 +48,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n

config/action.d/sendmail.conf

@@ -12,6 +12,7 @@
 # Values:  CMD
 #
 actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
+              Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
               From: Fail2Ban <<sender>>
               To: <dest>\n
               Hi,\n
@@ -24,6 +25,7 @@ actionstart = printf %%b "Subject: [Fail2Ban] <name>: started
 # Values:  CMD
 #
 actionstop = printf %%b "Subject: [Fail2Ban] <name>: stopped
+             Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
              From: Fail2Ban <<sender>>
              To: <dest>\n
              Hi,\n
@@ -46,6 +48,7 @@ actioncheck =
 # Values:  CMD
 #
 actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
+            Date: `date -u +"%%a, %%d %%h %%Y %%T +0000"`
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n

config/filter.d/apache-badbots.conf

@@ -11,7 +11,7 @@
 [Definition]
 
 badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
-badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
+badbots = atSpider/1\.0|autoemailspider|China Local Browse 2\.6|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 +http\://letscrawl\.com/|Lincoln State Web Browser|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|MVAClient|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|sogou spider|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|WebVulnCrawl\.blogspot\.com/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
 
 # Option:  failregex
 # Notes.:  Regexp to catch known spambots and software alike. Please verify

config/filter.d/common.conf

@@ -32,10 +32,16 @@ __daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
 # EXAMPLES: sshd[31607], pop(pam_unix)[4920]
 __daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
 
+# Some messages have a kernel prefix with a timestamp
+# EXAMPLES: kernel: [769570.846956]
+__kernel_prefix = kernel: \[\d+\.\d+\]
+
+__hostname = \S+
+
 #
 # Common line prefixes (beginnings) which could be used in filters
 #
 #       [hostname] [vserver tag] daemon_id spaces
 # this can be optional (for instance if we match named native log files)
-__prefix_line = \s*(?:\S+ )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
+__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
 

config/filter.d/dovecot.conf

@@ -2,7 +2,7 @@
 #
 # Author: Martin Waschbuesch
 #
-# $Revision: $
+# $Revision$
 #
 
 [Definition]

config/filter.d/pam-generic.conf

@@ -2,7 +2,7 @@
 #
 # Author: Yaroslav Halchenko
 #
-# $Revision:  $
+# $Revision$
 #
 
 [Definition]

config/filter.d/pure-ftpd.conf

@@ -3,7 +3,7 @@
 # Author: Cyril Jaquier
 # Modified: Yaroslav Halchenko for pure-ftpd
 #
-# $Revision: 3$
+# $Revision$
 #
 
 [Definition]

config/filter.d/sasl.conf

@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?$
+failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

config/filter.d/sshd.conf

@@ -28,11 +28,11 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* fro
             ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
-            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers$
             ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
             ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
-            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
+            ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.

fail2ban-client

@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

fail2ban-server

@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

fail2ban-testcases

@@ -1,4 +1,7 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -26,7 +29,7 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 
-import unittest, logging, sys
+import unittest, logging, sys, time, os
 
 from common.version import version
 from testcases import banmanagertestcase
@@ -40,6 +43,11 @@ from server.mytime import MyTime
 
 # Set the time to a fixed, known value
 # Sun Aug 14 12:00:00 CEST 2005
+
+# yoh: we need to adjust TZ to match the one used by Cyril so all the timestamps match
+old_TZ = os.environ.get('TZ', None)
+os.environ['TZ'] = 'Europe/Zurich'
+time.tzset()
 MyTime.setTime(1124013600)
 
 # Gets the instance of the logger.
@@ -57,6 +65,7 @@ tests = unittest.TestSuite()
 tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
 tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
 tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
+tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
 # Server
 #tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 #tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
@@ -73,3 +82,10 @@ tests.addTest(unittest.makeSuite(datedetectortestcase.DateDetectorTest))
 # Tests runner
 testRunner = unittest.TextTestRunner()
 testRunner.run(tests)
+
+# Just for the sake of it reset the TZ
+# yoh is planing to move all this into setup/teardown methods within tests
+os.environ.pop('TZ')
+if old_TZ:
+	os.environ['TZ'] = old_TZ
+time.tzset()

files/gentoo-initd

@@ -19,7 +19,7 @@
 # 
 # $Revision$
 
-opts="start stop restart reload showlog"
+opts="reload showlog"
 
 FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}"
 
@@ -31,6 +31,14 @@ depend() {
 
 start() {
 	ebegin "Starting fail2ban"
+	if [ ! -d /var/run/fail2ban ]; then
+		mkdir /var/run/fail2ban || return 1
+	fi
+	if [ -e /var/run/fail2ban/fail2ban.sock ]; then
+		# remove stalled sock file after system crash
+		# bug 347477
+		rm -rf /var/run/fail2ban/fail2ban.sock || return 1
+	fi
 	${FAIL2BAN} start &> /dev/null
 	eend $? "Failed to start fail2ban"
 }
@@ -41,14 +49,6 @@ stop() {
 	eend $? "Failed to stop fail2ban"
 }
 
-restart() {
-	if ! service_stopped "${SVCNAME}" ; then
-		svc_stop || return "$?"
-		sleep 1
-	fi
-	svc_start
-}
-
 reload() {
 	ebegin "Reloading fail2ban"
 	${FAIL2BAN} reload > /dev/null

files/ipmasq-ZZZzzz|fail2ban.rul

@@ -0,0 +1,31 @@
+#! /bin/sh
+#
+# ZZZzzz|fail2ban.rul
+#
+# Ultima modifica: 20060112 <Nauta@G-B.it> Creazione
+# Ultima modifica: 20071205 <Nauta@G-B.it> Verifica sia in esecuzione
+#
+# Riconfigura le regole di filtraggio relative a fail2ban alla fine
+# dell'inizializzazione delle regole.
+# Solo all'avvio del sistema mostra la (ri)esecuzione dello script
+
+_NAME=fail2ban
+_INITSCRIPT=/etc/init.d/$_NAME
+_CONFIG="/etc/$_NAME/$_NAME.local /etc/$_NAME/$_NAME.conf"
+
+if [ -s $_INITSCRIPT ]; then
+  SOCKFILE=`sed -n -e '/^[^#]*socket\s*=/{
+	s/.*socket\s*=\s*\(\S\+\).*/\1/p;q}' $_CONFIG 2>/dev/null`
+  [ -z "$SOCKFILE" ] && SOCKFILE="/tmp/$_NAME.sock"
+  if [ -S "$SOCKFILE" ]; then # Is daemon running ?
+    if [ "$SHOWRULES" = "yes" ]; then
+      echo "#: Reinitializing $_NAME"
+      echo $_INITSCRIPT force-reload
+    else
+      [ ! $runlevel ] && HIDEOUTPUT=true
+    fi
+    if [ "$NOACT" != "yes" ]; then
+      eval $_INITSCRIPT force-reload ${HIDEOUTPUT:+\>/dev/null 2\>&1}
+    fi
+  fi # SOCKFILE is a socket
+fi # _INITSCRIPT exist

server/__init__.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/action.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -25,11 +28,15 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging, os
+import threading
 #from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
 
+# Create a lock for running system commands
+_cmd_lock = threading.Lock()
+
 ##
 # Execute commands.
 #
@@ -301,17 +308,21 @@ class Action:
 	#@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
-		try:
-			# The following line gives deadlock with multiple jails
-			#retcode = call(realCmd, shell=True)
-			retcode = os.system(realCmd)
-			if retcode == 0:
-				logSys.debug("%s returned successfully" % realCmd)
-				return True
-			else:
-				logSys.error("%s returned %x" % (realCmd, retcode))
-		except OSError, e:
-			logSys.error("%s failed with %s" % (realCmd, e))
+		_cmd_lock.acquire()
+		try: # Try wrapped within another try needed for python version < 2.5
+			try:
+				# The following line gives deadlock with multiple jails
+				#retcode = call(realCmd, shell=True)
+				retcode = os.system(realCmd)
+				if retcode == 0:
+					logSys.debug("%s returned successfully" % realCmd)
+					return True
+				else:
+					logSys.error("%s returned %x" % (realCmd, retcode))
+			except OSError, e:
+				logSys.error("%s failed with %s" % (realCmd, e))
+		finally:
+			_cmd_lock.release()
 		return False
 	executeCmd = staticmethod(executeCmd)
 	

server/actions.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -158,6 +161,7 @@ class Actions(JailThread):
 			aInfo["ip"] = bTicket.getIP()
 			aInfo["failures"] = bTicket.getAttempt()
 			aInfo["time"] = bTicket.getTime()
+			aInfo["matches"] = "".join(bTicket.getMatches())
 			if self.__banManager.addBanTicket(bTicket):
 				logSys.warn("[%s] Ban %s" % (self.jail.getName(), aInfo["ip"]))
 				for action in self.__actions:
@@ -198,6 +202,7 @@ class Actions(JailThread):
 		aInfo["ip"] = ticket.getIP()
 		aInfo["failures"] = ticket.getAttempt()
 		aInfo["time"] = ticket.getTime()
+		aInfo["matches"] = "".join(ticket.getMatches())
 		logSys.warn("[%s] Unban %s" % (self.jail.getName(), aInfo["ip"]))
 		for action in self.__actions:
 			action.execActionUnban(aInfo)

server/asyncserver.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -16,11 +19,11 @@
 
 # Author: Cyril Jaquier
 # 
-# $Revision: 567 $
+# $Revision$
 
 __author__ = "Cyril Jaquier"
-__version__ = "$Revision: 567 $"
-__date__ = "$Date: 2007-03-26 23:17:31 +0200 (Mon, 26 Mar 2007) $"
+__version__ = "$Revision$"
+__date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 

server/banmanager.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -130,7 +133,7 @@ class BanManager:
 		ip = ticket.getIP()
 		#lastTime = ticket.getTime()
 		lastTime = MyTime.time()
-		banTicket = BanTicket(ip, lastTime)
+		banTicket = BanTicket(ip, lastTime, ticket.getMatches())
 		banTicket.setAttempt(ticket.getAttempt())
 		return banTicket
 	createBanTicket = staticmethod(createBanTicket)

server/datedetector.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -71,6 +74,13 @@ class DateDetector:
 			template.setRegex("\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%d/%m/%Y %H:%M:%S")
 			self.__templates.append(template)
+			# previous one but with year given by 2 digits
+			# (See http://bugs.debian.org/537610)
+			template = DateStrptime()
+			template.setName("Day/Month/Year Hour:Minute:Second")
+			template.setRegex("\d{2}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%d/%m/%y %H:%M:%S")
+			self.__templates.append(template)
 			# Apache format [31/Oct/2006:09:22:55 -0000]
 			template = DateStrptime()
 			template.setName("Day/MONTH/Year:Hour:Minute:Second")
@@ -89,6 +99,12 @@ class DateDetector:
 			template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")
 			template.setPattern("%Y-%m-%d %H:%M:%S")
 			self.__templates.append(template)
+			# custom for syslog-ng 2006.12.21 06:43:20
+			template = DateStrptime()
+			template.setName("Year.Month.Day Hour:Minute:Second")
+			template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}")
+			template.setPattern("%Y.%m.%d %H:%M:%S")
+			self.__templates.append(template)
 			# named 26-Jul-2007 15:20:52.252 
 			template = DateStrptime()
 			template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]")

server/datetemplate.py

@@ -1,4 +1,6 @@
-# -*- coding: utf-8 -*-
+# emacs: -*- mode: python; coding: utf-8; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -30,6 +32,10 @@ import re, time
 from mytime import MyTime
 import iso8601
 
+import logging
+logSys = logging.getLogger("fail2ban.datetemplate")
+
+
 class DateTemplate:
 	
 	def __init__(self):
@@ -76,7 +82,7 @@ class DateEpoch(DateTemplate):
 		dateMatch = self.matchDate(line)
 		if dateMatch:
 			# extract part of format which represents seconds since epoch
-			date = list(time.localtime(float(dateMatch.group())))
+			date = list(MyTime.localtime(float(dateMatch.group())))
 		return date
 
 
@@ -86,20 +92,20 @@ class DateEpoch(DateTemplate):
 # standard.
 
 class DateStrptime(DateTemplate):
-	
+
 	TABLE = dict()
-	TABLE["Jan"] = []
-	TABLE["Feb"] = [u"Fév"]
-	TABLE["Mar"] = [u"Mär"]
-	TABLE["Apr"] = ["Avr"]
-	TABLE["May"] = ["Mai"]
-	TABLE["Jun"] = []
-	TABLE["Jul"] = []
-	TABLE["Aug"] = ["Aou"]
-	TABLE["Sep"] = []
-	TABLE["Oct"] = ["Okt"]
-	TABLE["Nov"] = []
-	TABLE["Dec"] = [u"Déc", "Dez"]
+	TABLE["Jan"] = ["Sty"]
+	TABLE["Feb"] = [u"Fév", "Lut"]
+	TABLE["Mar"] = [u"Mär", "Mar"]
+	TABLE["Apr"] = ["Avr", "Kwi"]
+	TABLE["May"] = ["Mai", "Maj"]
+	TABLE["Jun"] = ["Lip"]
+	TABLE["Jul"] = ["Sie"]
+	TABLE["Aug"] = ["Aou", "Wrz"]
+	TABLE["Sep"] = ["Sie"]
+	TABLE["Oct"] = [u"Paź"]
+	TABLE["Nov"] = ["Lis"]
+	TABLE["Dec"] = [u"Déc", "Dez", "Gru"]
 	
 	def __init__(self):
 		DateTemplate.__init__(self)
@@ -116,6 +122,8 @@ class DateStrptime(DateTemplate):
 		for t in DateStrptime.TABLE:
 			for m in DateStrptime.TABLE[t]:
 				if date.find(m) >= 0:
+					logSys.debug(u"Replacing %r with %r in %r" %
+								 (m, t, date))
 					return date.replace(m, t)
 		return date
 	convertLocale = staticmethod(convertLocale)
@@ -145,6 +153,9 @@ class DateStrptime(DateTemplate):
 				# If the date is greater than the current time, we suppose
 				# that the log is not from this year but from the year before
 				if time.mktime(date) > MyTime.time():
+					logSys.debug(
+						u"Correcting deduced year from %d to %d since %f > %f" %
+						(date[0], date[0]-1, time.mktime(date), MyTime.time()))
 					date[0] -= 1
 				elif date[1] == 1 and date[2] == 1:
 					# If it is Jan 1st, it is either really Jan 1st or there
@@ -169,7 +180,7 @@ class DateTai64n(DateTemplate):
 			value = dateMatch.group()
 			seconds_since_epoch = value[2:17]
 			# convert seconds from HEX into local time stamp
-			date = list(time.localtime(int(seconds_since_epoch, 16)))
+			date = list(MyTime.localtime(int(seconds_since_epoch, 16)))
 		return date
 
 

server/faildata.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -35,16 +38,27 @@ class FailData:
 		self.__retry = 0
 		self.__lastTime = 0
 		self.__lastReset = 0
-	
+		self.__matches = []
+
 	def setRetry(self, value):
 		self.__retry = value
-	
+		# keep only the last matches or reset entirely
+		# Explicit if/else for compatibility with Python 2.4
+		if value:
+			self.__matches = self.__matches[-min(len(self.__matches, value)):]
+		else:
+			self.__matches = []
+
 	def getRetry(self):
 		return self.__retry
-	
-	def inc(self):
+
+	def getMatches(self):
+		return self.__matches
+
+	def inc(self, matches=None):
 		self.__retry += 1
-	
+		self.__matches += matches or []
+
 	def setLastTime(self, value):
 		if value > self.__lastTime:
 			self.__lastTime = value

server/failmanager.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -88,19 +91,22 @@ class FailManager:
 			self.__lock.acquire()
 			ip = ticket.getIP()
 			unixTime = ticket.getTime()
+			matches = ticket.getMatches()
 			if self.__failList.has_key(ip):
 				fData = self.__failList[ip]
 				if fData.getLastReset() < unixTime - self.__maxTime:
 					fData.setLastReset(unixTime)
 					fData.setRetry(0)
-				fData.inc()
+				fData.inc(matches)
 				fData.setLastTime(unixTime)
 			else:
 				fData = FailData()
-				fData.inc()
+				fData.inc(matches)
 				fData.setLastReset(unixTime)
 				fData.setLastTime(unixTime)
 				self.__failList[ip] = fData
+			logSys.debug("Currently have failures from %d IPs: %s"
+						 % (len(self.__failList), self.__failList.keys()))
 			self.__failTotal += 1
 		finally:
 			self.__lock.release()
@@ -134,7 +140,7 @@ class FailManager:
 				if data.getRetry() >= self.__maxRetry:
 					self.__delFailure(ip)
 					# Create a FailTicket from BanData
-					failTicket = FailTicket(ip, data.getLastTime())
+					failTicket = FailTicket(ip, data.getLastTime(), data.getMatches())
 					failTicket.setAttempt(data.getRetry())
 					return failTicket
 			raise FailManagerEmpty

server/failregex.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/filter.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -278,7 +281,7 @@ class Filter(JailThread):
 				logSys.debug("Ignore %s" % ip)
 				continue
 			logSys.debug("Found %s" % ip)
-			self.failManager.addFailure(FailTicket(ip, unixTime))
+			self.failManager.addFailure(FailTicket(ip, unixTime, [line]))
 
 	##
 	# Returns true if the line should be ignored.
@@ -443,7 +446,14 @@ class FileFilter(Filter):
 # In order to detect log rotation, the hash (MD5) of the first line of the file
 # is computed and compared to the previous hash of this line.
 
-import md5
+try:
+	import hashlib
+	md5sum = hashlib.md5
+except ImportError:
+	# hashlib was introduced in Python 2.5.  For compatibility with those
+	# elderly Pythons, import from md5
+	import md5
+	md5sum = md5.new
 
 class FileContainer:
 	
@@ -458,7 +468,7 @@ class FileContainer:
 		try:
 			firstLine = handler.readline()
 			# Computes the MD5 of the first line.
-			self.__hash = md5.new(firstLine).digest()
+			self.__hash = md5sum(firstLine).digest()
 			# Start at the beginning of file if tail mode is off.
 			if tail:
 				handler.seek(0, 2)
@@ -478,7 +488,7 @@ class FileContainer:
 		fcntl.fcntl(fd, fcntl.F_SETFD, fd | fcntl.FD_CLOEXEC)
 		firstLine = self.__handler.readline()
 		# Computes the MD5 of the first line.
-		myHash = md5.new(firstLine).digest()
+		myHash = md5sum(firstLine).digest()
 		stats = os.fstat(self.__handler.fileno())
 		# Compare hash and inode
 		if self.__hash != myHash or self.__ino != stats.st_ino:

server/filtergamin.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/filterpoll.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/iso8601.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: nil -*-
+# vi: set ft=python sts=4 ts=4 sw=4 et:
+
 # Copyright (c) 2007 Michael Twomey
 #
 # Permission is hereby granted, free of charge, to any person obtaining a

server/jail.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/jails.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/jailthread.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

server/mytime.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -76,4 +79,10 @@ class MyTime:
 		else:
 			return time.gmtime(MyTime.myTime)
 	gmtime = staticmethod(gmtime)
-	
+
+	def localtime(x=None):
+		if MyTime.myTime == None or x is not None:
+			return time.localtime(x)
+		else:
+			return time.localtime(MyTime.myTime)
+	localtime = staticmethod(localtime)

server/server.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -104,9 +107,15 @@ class Server:
 			self.__loggingLock.release()
 	
 	def quit(self):
-		self.stopAllJail()
-		# Stop communication
+		# Stop communication first because if jail's unban action
+		# tries to communicate via fail2ban-client we get a lockup
+		# among threads.  So the simplest resolution is to stop all
+		# communications first (which should be ok anyways since we
+		# are exiting)
+		# See https://github.com/fail2ban/fail2ban/issues/7
 		self.__asyncServer.stop()
+		# Now stop all the jails
+		self.stopAllJail()
 	
 	def addJail(self, name, backend):
 		self.__jails.add(name, backend)
@@ -123,6 +132,7 @@ class Server:
 			self.__lock.release()
 	
 	def stopJail(self, name):
+		logSys.debug("Stopping jail %s" % name)
 		try:
 			self.__lock.acquire()
 			if self.isAlive(name):
@@ -132,6 +142,7 @@ class Server:
 			self.__lock.release()
 	
 	def stopAllJail(self):
+		logSys.info("Stopping all jails")
 		try:
 			self.__lock.acquire()
 			for jail in self.__jails.getAll():

server/ticket.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -31,17 +34,37 @@ logSys = logging.getLogger("fail2ban")
 
 class Ticket:
 	
-	def __init__(self, ip, time):
+	def __init__(self, ip, time, matches=None):
+		"""Ticket constructor
+
+		@param ip the IP address
+		@param time the ban time
+		@param matches (log) lines caused the ticket
+		"""
+
 		self.__ip = ip
 		self.__time = time
 		self.__attempt = 0
+		self.__file = None
+		self.__matches = matches or []
+
+	def __str__(self):
+		return "%s: ip=%s time=%s #attempts=%d" % \
+			   (self.__class__, self.__ip, self.__time, self.__attempt)
 	
+
 	def setIP(self, value):
 		self.__ip = value
 	
 	def getIP(self):
 		return self.__ip
 	
+	def setFile(self, value):
+		self.__file = value
+	
+	def getFile(self):
+		return self.__file
+	
 	def setTime(self, value):
 		self.__time = value
 	
@@ -54,11 +77,12 @@ class Ticket:
 	def getAttempt(self):
 		return self.__attempt
 
+	def getMatches(self):
+		return self.__matches
+
 
 class FailTicket(Ticket):
-	
-	def __init__(self, ip, time):
-		Ticket.__init__(self, ip, time)
+	pass
 
 
 ##
@@ -67,14 +91,4 @@ class FailTicket(Ticket):
 # This class extends the Ticket class. It is mainly used by the BanManager.
 
 class BanTicket(Ticket):
-	
-	##
-	# Constructor.
-	#
-	# Call the Ticket (parent) constructor and initialize default
-	# values.
-	# @param ip the IP address
-	# @param time the ban time
-	
-	def __init__(self, ip, time):
-		Ticket.__init__(self, ip, time)
+	pass

server/transmitter.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -261,4 +264,4 @@ class Transmitter:
 			name = command[0]
 			return self.__server.statusJail(name)
 		raise Exception("Invalid command (no status)")
-	
+	

setup.py

@@ -1,4 +1,6 @@
 #!/usr/bin/python
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
 
 # This file is part of Fail2Ban.
 #

testcases/__init__.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -22,4 +25,4 @@ __author__ = "Cyril Jaquier"
 __version__ = "$Revision$"
 __date__ = "$Date$"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
-__license__ = "GPL"
+__license__ = "GPL"

testcases/actiontestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -44,4 +47,4 @@ class ExecuteAction(unittest.TestCase):
 		self.__action.setActionCheck("[ -e /tmp/fail2ban.test ]")
 		
 		self.assertTrue(self.__action.execActionBan(None))
-		
+		

testcases/banmanagertestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -53,4 +56,4 @@ class AddFailure(unittest.TestCase):
 	def _testInListNOK(self):
 		ticket = BanTicket('111.111.1.111', 1167605999.0)
 		self.assertFalse(self.__banManager.inBanList(ticket))
-		
+		

testcases/clientreadertestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -40,4 +43,4 @@ class JailReaderTest(unittest.TestCase):
 		expected = ['mail-whois', {'name': 'SSH'}]
 		result = JailReader.splitAction(action)
 		self.assertEquals(expected, result)
-		
+		

testcases/datedetectortestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -54,6 +57,26 @@ class DateDetectorTest(unittest.TestCase):
 		self.assertEqual(self.__datedetector.getTime(log), date)
 		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
 
+	def testVariousTimes(self):
+		"""Test detection of various common date/time formats f2b should understand
+		"""
+		date = [2005, 1, 23, 21, 59, 59, 1, 23, -1]
+		dateUnix = 1106513999.0
+
+		for sdate in (
+			"Jan 23 21:59:59",
+			"2005.01.23 21:59:59",
+			"23/01/2005 21:59:59",
+			):
+			log = sdate + "[sshd] error: PAM: Authentication failure"
+			# exclude
+
+			# TODO (Yarik is confused): figure out why for above it is
+			#      "1" as day of the week which would be Tue, although it
+			#      was Sun
+			self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6])
+			self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
+
 #	def testDefaultTempate(self):
 #		self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}")
 #		self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")
@@ -64,4 +87,4 @@ class DateDetectorTest(unittest.TestCase):
 #		
 #		self.assertEqual(self.__datedetector.getTime(log), date)
 #		self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix)
-	
+	

testcases/failmanagertestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify

testcases/files/logs/apache-overflows

@@ -0,0 +1,2 @@
+[Tue Mar 16 15:39:29 2010] [error] [client 58.179.109.179] Invalid URI in request \xf9h\xa9\xf3\x88\x8cXKj \xbf-l*4\x87n\xe4\xfe\xd4\x1d\x06\x8c\xf8m\\rS\xf6n\xeb\x8
+[Mon Mar 15 15:44:47 2010] [error] [client 121.222.2.133] Invalid URI in request n\xed*\xbe*\xab\xefd\x80\xb5\xae\xf6\x01\x10M?\xf2\xce\x13\x9c\xd7\xa0N\xa7\xdb%0\xde\xe0\xfc\xd2\xa0\xfe\xe9w\xee\xc4`v\x9b[{\x0c:\xcb\x93\xc6\xa0\x93\x9c`l\\\x8d\xc9

testcases/files/logs/dovecot

@@ -0,0 +1 @@
+@400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS

testcases/files/logs/named-refused

@@ -0,0 +1,5 @@
+Jul 24 14:16:55 raid5 named[3935]: client 194.145.196.18#4795: query 'ricreig.com/NS/IN' denied
+Jul 24 14:16:56 raid5 named[3935]: client 62.123.164.113#32768: query 'ricreig.com/NS/IN' denied
+Jul 24 14:17:13 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'geo-mueller.de/NS/IN' denied
+Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shivaree.de/NS/IN' denied
+Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied

testcases/files/logs/pam-generic

@@ -0,0 +1,7 @@
+Feb  7 15:10:42 example pure-ftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=sample-user rhost=192.168.1.1 
+May 12 09:47:54 vaio sshd[16004]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com  user=root
+May 12 09:48:03 vaio sshd[16021]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com
+May 15 18:02:12 localhost proftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=66.232.129.62  user=mark
+Nov 25 17:12:13 webmail pop(pam_unix)[4920]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.10.3 user=mailuser
+Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www3.google.com
+Jul 19 18:11:26 srv2 vsftpd: pam_unix: authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www3.google.com

testcases/files/logs/proftpd

@@ -0,0 +1,5 @@
+Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers
+Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21 
+
+
+

testcases/files/logs/pure-ftpd

@@ -0,0 +1,2 @@
+Jan 31 16:54:07 desktop pure-ftpd: (?@24.79.92.194) [WARNING] Authentication failed for user [Administrator]
+Nov 5 18:54:02 pure-ftpd: (?@server202181210195.ixlink.net) [WARNING] Authentication failed for user [Administrator] 

testcases/files/logs/sasl

@@ -0,0 +1,5 @@
+#1 Example from postfix from dbts #507990
+Dec  2 22:24:22 hel postfix/smtpd[7676]: warning: 114-44-142-233.dynamic.hinet.net[114.44.142.233]: SASL CRAM-MD5 authentication failed: PDc3OTEwNTkyNTEyMzA2NDIuMTIyODI1MzA2MUBoZWw+
+#2 Example from postfix from dbts #573314
+Mar 10 13:33:30 gandalf postfix/smtpd[3937]: warning: HOSTNAME[1.1.1.1]: SASL LOGIN authentication failed: authentication failure
+

testcases/files/logs/sshd

@@ -0,0 +1,26 @@
+#1
+Jun 21 16:47:48 digital-mlhhyiqscv sshd[13709]: error: PAM: Authentication failure for myhlj1374 from 192.030.0.6
+May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from www.onerussian.com
+
+#2
+Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.69 port 50273 ssh2
+Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.70 port 12345
+
+#3
+Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM 1.2.3.4
+Jan  5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4
+
+#4
+Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
+
+
+#5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
+Mar  3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers
+Feb 25 14:34:11 belka sshd[31607]: User root from ferrari.inescn.pt not allowed because not listed in AllowUsers
+
+#6 ew filter introduced thanks to report Guido Bozzetto <reportbug@G-B.it>
+Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)
+
+#7 added exclamation mark to BREAK-IN
+Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT
+Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

testcases/files/logs/vsftpd

@@ -0,0 +1,7 @@
+#1 PAM based
+Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=209.67.1.67
+Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1
+
+#2 Internal
+Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.98"
+

testcases/filtertestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -25,8 +28,10 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import unittest
+import time
+
 from server.filterpoll import FilterPoll
-from server.filter import FileFilter
+from server.filter import FileFilter, DNSUtils
 from server.failmanager import FailManager
 from server.failmanager import FailManagerEmpty
 
@@ -94,26 +99,44 @@ class GetFailures(unittest.TestCase):
 
 	def tearDown(self):
 		"""Call after every test case."""
-		
+
+	def _assertEqualEntries(self, found, output):
+		"""Little helper to unify comparisons with the target entries
+
+		and report helpful failure reports instead of millions of seconds ;)
+		"""
+		self.assertEqual(found[:2], output[:2])
+		found_time, output_time = \
+					time.localtime(found[2]),\
+					time.localtime(output[2])
+		self.assertEqual(found_time, output_time)
+		if len(found) > 3:				# match matches
+			self.assertEqual(found[3], output[3])
+
+
 	def testGetFailures01(self):
-		output = ('193.168.0.128', 3, 1124013599.0)
-		
+		output = ('193.168.0.128', 3, 1124013599.0,
+				  ['Aug 14 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128\n']*3)
+
 		self.__filter.addLogPath(GetFailures.FILENAME_01)
 		self.__filter.addFailRegex("(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>")
 
 		self.__filter.getFailures(GetFailures.FILENAME_01)
-		
+
 		ticket = self.__filter.failManager.toBan()
 
 		attempts = ticket.getAttempt()
 		date = ticket.getTime()
 		ip = ticket.getIP()
-		found = (ip, attempts, date)
-		
-		self.assertEqual(found, output)
+		matches = ticket.getMatches()
+		found = (ip, attempts, date, matches)
+
+		self._assertEqualEntries(found, output)
 	
 	def testGetFailures02(self):
-		output = ('141.3.81.106', 4, 1124013539.0)
+		output = ('141.3.81.106', 4, 1124013539.0,
+				  ['Aug 14 11:%d:59 i60p295 sshd[12365]: Failed publickey for roehl from ::ffff:141.3.81.106 port 51332 ssh2\n'
+				   % m for m in 53, 54, 57, 58])
 
 		self.__filter.addLogPath(GetFailures.FILENAME_02)
 		self.__filter.addFailRegex("Failed .* from <HOST>")
@@ -125,9 +148,10 @@ class GetFailures(unittest.TestCase):
 		attempts = ticket.getAttempt()
 		date = ticket.getTime()
 		ip = ticket.getIP()
-		found = (ip, attempts, date)
+		matches = ticket.getMatches()
+		found = (ip, attempts, date, matches)
 		
-		self.assertEqual(found, output)
+		self._assertEqualEntries(found, output)
 
 	def testGetFailures03(self):
 		output = ('203.162.223.135', 6, 1124013544.0)
@@ -144,7 +168,7 @@ class GetFailures(unittest.TestCase):
 		ip = ticket.getIP()
 		found = (ip, attempts, date)
 		
-		self.assertEqual(found, output)	
+		self._assertEqualEntries(found, output)	
 
 	def testGetFailures04(self):
 		output = [('212.41.96.186', 4, 1124013600.0),
@@ -182,7 +206,7 @@ class GetFailures(unittest.TestCase):
 		ip = ticket.getIP()
 		found = (ip, attempts, date)
 		
-		self.assertEqual(found, output)
+		self._assertEqualEntries(found, output)
 	
 	def testGetFailuresIgnoreRegex(self):
 		output = ('141.3.81.106', 8, 1124013541.0)
@@ -195,3 +219,15 @@ class GetFailures(unittest.TestCase):
 		self.__filter.getFailures(GetFailures.FILENAME_02)
 		
 		self.assertRaises(FailManagerEmpty, self.__filter.failManager.toBan)
+
+class DNSUtilsTests(unittest.TestCase):
+
+	def testTextToIp(self):
+		bogus = [
+			'doh1.2.3.4.buga.xxxxx.yyy',
+			'1.2.3.4.buga.xxxxx.yyy',
+			]
+		"""Really bogus addresses which should have no matches"""
+		for s in bogus:
+			res = DNSUtils.textToIp(s)
+			self.assertEqual(res, [])

testcases/servertestcase.py

@@ -1,3 +1,6 @@
+# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
+# vi: set ft=python sts=4 ts=4 sw=4 noet :
+
 # This file is part of Fail2Ban.
 #
 # Fail2Ban is free software; you can redistribute it and/or modify
@@ -124,4 +127,4 @@ class Transmitter(unittest.TestCase):
 				jail = self.__server.jails[name]
 				self.assertEqual(jail.getFilter().failManager.size(), 0)
 				self.assertEqual(jail.getAction().banManager.size(), 2)
-		
+