Compare commits

...
Author SHA1 Message Date
Yaroslav Halchenko 48fb03fb1b NF: adding unittests for previous commit
* NF: adding unittests for previous commit
* BF: anchoring regex for IP with " *$" at the end + adjust regexp for
  <HOST> (closes: #514163)
2009-02-05 10:25:27 -05:00
Yaroslav Halchenko fe58fc517c NF: adding unittests for previous commit 2009-02-05 10:23:01 -05:00
Yaroslav Halchenko 3e8e4b1c6f BF: anchoring regex for IP with " *$" at the end + adjust regexp for <HOST>
to forbid matching IPs encoded in the hostname (like
1.2.3.4.xxx.yyyyy.zzz) prior doing actual DNS lookup.

It is quite important and actually security hazard: DoS is easy to
perform...

Since now we don't do \S matching in <HOST> regexp, in the development
branches we should also allow for unicode characters by adding 're.U' to HOST's
regexp
2009-02-05 10:22:49 -05:00
5 changed files with 24 additions and 3 deletions
+8
View File
@@ -1,3 +1,11 @@
fail2ban (0.8.3-2sid1) unstable; urgency=low
* NF: adding unittests for previous commit
* BF: anchoring regex for IP with " *$" at the end + adjust regexp for
<HOST> (closes: #514163)
-- Yaroslav Halchenko <debian@onerussian.com> Thu, 05 Feb 2009 10:23:12 -0500
fail2ban (0.8.3-2) unstable; urgency=low
* BF in apache-noscript.conf - regexp matched in referer (Closes: #492319).
+1
View File
@@ -57,6 +57,7 @@ tests = unittest.TestSuite()
tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
tests.addTest(unittest.makeSuite(filtertestcase.LogFile))
tests.addTest(unittest.makeSuite(filtertestcase.GetFailures))
tests.addTest(unittest.makeSuite(filtertestcase.DNSUtilsTests))
# Server
#tests.addTest(unittest.makeSuite(servertestcase.StartStop))
#tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
+1 -1
View File
@@ -44,7 +44,7 @@ class Regex:
self._matchCache = None
# Perform shortcuts expansions.
# Replace "<HOST>" with default regular expression for host.
regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>\S+)")
regex = regex.replace("<HOST>", "(?:::f{4,6}:)?(?P<host>[\w\-.^_]+)")
if regex.lstrip() == '':
raise RegexException("Cannot add empty regex")
try:
+1 -1
View File
@@ -491,7 +491,7 @@ import socket, struct
class DNSUtils:
IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}")
IP_CRE = re.compile("(?:\d{1,3}\.){3}\d{1,3}$")
#@staticmethod
def dnsToIp(dns):
+13 -1
View File
@@ -26,7 +26,7 @@ __license__ = "GPL"
import unittest
from server.filterpoll import FilterPoll
from server.filter import FileFilter
from server.filter import FileFilter, DNSUtils
from server.failmanager import FailManager
from server.failmanager import FailManagerEmpty
@@ -195,3 +195,15 @@ class GetFailures(unittest.TestCase):
self.__filter.getFailures(GetFailures.FILENAME_02)
self.assertRaises(FailManagerEmpty, self.__filter.failManager.toBan)
class DNSUtilsTests(unittest.TestCase):
def testTextToIp(self):
bogus = [
'doh1.2.3.4.buga.xxxxx.yyy',
'1.2.3.4.buga.xxxxx.yyy',
]
"""Really bogus addresses which should have no matches"""
for s in bogus:
res = DNSUtils.textToIp(s)
self.assertEqual(res, [])