Repository: fail2ban/fail2ban

Issue:
Unix time match only matches when at start of the line
When i log entry witch puts brackets arround the Unix time it won't match

example:

[1387288694] nsd[7745]: info: ratelimit block hccforums.nl. type any target 46.182.105.0/24 query 46.182.105.8 TYPE255
[1387288694] nsd[7745]: info: ratelimit block hccforums.nl. type any target 95.211.36.0/24 query 95.211.36.244 TYPE255

fail2ban-regex reports:

but no valid date/time found for u



Discussion:
Not ideal, but functional:

```
diff --git a/server/datetemplate.py b/server/datetemplate.py
index decaee1..74c094d 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -78,7 +78,7 @@ class DateEpoch(DateTemplate):

    def __init__(self):
        DateTemplate.__init__(self)
-       self.setRegex("(?:^|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\)))")
+       self.setRegex("(?:^|(?P<square>(?<=\[))|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\))(?(square)(?=\])))")

    def getDate(self, line):
        date = None
```

Confirmed working on IRC by @basd82 using _failregex_ below:
`^\[\]%(__prefix_line)sinfo: ratelimit block .* query <HOST> TYPE255$`

i'd put change the first square bit to anchor at the start:

<pre>
In [9]: re.search('(?:^|(?P&gt;square&lt;(?&gt;=^\[))|(?P<selinux>(?&gt;=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\))(?(square)(?=\])))', '[1387288694] nsd[7745]: info: ratelimit block hccforums.nl. type any target 95.211.36.0/24 query 95.211.36.244 TYPE255').group()
Out[9]: '1387288694'
</pre>

@grooverdan Agreed :smile:

``` diff
diff --git a/server/datetemplate.py b/server/datetemplate.py
index decaee1..33c6970 100644
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -78,7 +78,7 @@ class DateEpoch(DateTemplate):

    def __init__(self):
        DateTemplate.__init__(self)
-       self.setRegex("(?:^|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\)))")
+       self.setRegex("(?:^|(?P<square>(?<=^\[))|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\))(?(square)(?=\])))")

    def getDate(self, line):
        date = None
```

have i missed the discussion/example?

Steven Hiscocks notifications@github.com wrote:

> @grooverdan Agreed :smile:
> 
> ``` diff
> diff --git a/server/datetemplate.py b/server/datetemplate.py
> index decaee1..33c6970 100644
> --- a/server/datetemplate.py
> +++ b/server/datetemplate.py
> @@ -78,7 +78,7 @@ class DateEpoch(DateTemplate):
> 
>   def __init__(self):
>       DateTemplate.__init__(self)
> -      self.setRegex("(?:^|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\)))")
> +      self.setRegex("(?:^|(?P<square>(?<=^\[))|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\))(?(square)(?=\])))")
> 
>   def getDate(self, line):
>       date = None
> ```
> 
> ---
> 
> Reply to this email directly or view it on GitHub:
> https://github.com/fail2ban/fail2ban/issues/501#issuecomment-30798886

## 

Sent from a phone which beats iPhone.

nope. original log sample only. Though I think we need a full filter for nsd to justify its inclusion. So @basd82, what other nsd failures would you be blocking?

I think i quit complete with this one

this what i have:

```

# Fail2Ban configuration file
#
# Author: Bas van den Dikkenberg
#
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


[Definition]

_daemon = nsd

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT

failregex =  ^\[\]%(__prefix_line)sinfo: ratelimit block .* query <HOST> TYPE255
              ^\[\]%(__prefix_line)sinfo: .* <HOST> refused, no acl matches.$


# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =
```

and a log sample for the second expression please?

if add please use this anonmenised log exampels

```
[1387347136] nsd[23580]: info: notify for zone some.domain.nl. from client 123.123.123.123 refused, no acl matches.
[1387348935] nsd[23600]: info: axfr for zone domain.nl. from client 123.123.123.123 refused, no acl matches
[1387305472] nsd[13002]: info: ratelimit block domain.nl. type any target 123.123.123.0/24 query 123.123.123.123 TYPE255
```

i am not sure if sould add this ignoreregex i am not sure, i don't think so becouse it is no match

```
ignoreregex =  ^\[\]%(__prefix_line)sinfo: ratelimit unblock .* query <HOST> TYPE255$

log entry:

[1387305472] nsd[13002]: info: ratelimit unblock domain.nl. type any target 123.123.123.0/24 query 123.123.123.123 TYPE255

```

no need for an ignorerex. Thanks for the samples.


Resolving patch:
diff --git a/server/datetemplate.py b/server/datetemplate.py
--- a/server/datetemplate.py
+++ b/server/datetemplate.py
@@ -78,7 +78,7 @@ class DateEpoch(DateTemplate):
 	
 	def __init__(self):
 		DateTemplate.__init__(self)
-		self.setRegex("(?:^|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\)))")
+		self.setRegex("(?:^|(?P<square>(?<=^\[))|(?P<selinux>(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\))(?(square)(?=\])))")
 	
 	def getDate(self, line):
 		date = None


Test patch: