fail2ban/fail2ban — pull request #214 by kwirk (2013-05-04 17:13:23+00:00)
Title: Custom date templates and date detector changes

As discussed in #193, these are some changes such that templates _regex_ and _name_ for date templates are generated from the _pattern_. This will then allow easy setting of custom date templates from the _fail2ban-client_ or from config file. Obviously this is limited to those date formats which can be handled by non-complex _strptime_ formats.

I've not made changes for the config file elements, because I was uncertain whether the option should be: part of a _filter_ config `[Init]` (override in _jail_ config); or just putting the option straight in the _jail_ config?

I've been through the current regexs, and believe that all should continue working as normal. Primarily the changes to the current regexs is some added flexibility, e.g. some templates explicitly state that _day_ should be `\d{2}`, others allow for leading space and one digit `\s{1,2}\d{1,2}`. The new more generic regex will allow optional one digit with optionalleading space for all templates; but then the regex ensures that the day is between 1-31.
To this end, I've created a quick "test" based on suggestion from @yarikoptic in #193. I've not included it in the pull request currently, as I wasn't sure if you'll want to add it.: https://gist.github.com/kwirk/5518039

Output from: `python2 -c 'from fail2ban.tests.utils import testTemplateOverlap;import pprint; pprint.pprint(testTemplateOverlap())'`
Current _0.9_ branch:
```python
set([('%Y-%m-%d %H:%M:%S',
('ISO 8601',
'Year-Month-Day Hour:Minute:Second',
'Year.Month.Day Hour:Minute:Second')),
('%Y/%m/%d %H:%M:%S',
('Year.Month.Day Hour:Minute:Second',
'Year/Month/Day Hour:Minute:Second')),
('%a %b %d %H:%M:%S',
('MONTH Day Hour:Minute:Second',
'WEEKDAY MONTH Day Hour:Minute:Second')),
('%a %b %d %H:%M:%S %Y',
('MONTH Day Hour:Minute:Second',
'WEEKDAY MONTH Day Hour:Minute:Second',
'WEEKDAY MONTH Day Hour:Minute:Second Year')),
('%d-%m-%Y %H:%M:%S',
('Day-Month-Year Hour:Minute:Second',
'Month-Day-Year Hour:Minute:Second[.Millisecond]')),
('%m-%d-%Y %H:%M:%S',
('Day-Month-Year Hour:Minute:Second',
'Month-Day-Year Hour:Minute:Second[.Millisecond]'))])
```
With PR:
```python
set([('%Y-%m-%d %H:%M:%S',
('ISO 8601',
'Year-Month-Day 24hour:Minute:Second')),
('%a %b %d %H:%M:%S',
('DAY MON Day 24hour:Minute:Second',
'MON Day 24hour:Minute:Second')),
('%a %b %d %H:%M:%S %Y',
('DAY MON Day 24hour:Minute:Second',
'DAY MON Day 24hour:Minute:Second Year',
'MON Day 24hour:Minute:Second')),
('%d-%m-%Y %H:%M:%S',
('Day-Month-Year 24hour:Minute:Second',
'Month-Day-Year 24hour:Minute:Second')),
('%m-%d-%Y %H:%M:%S',
('Day-Month-Year 24hour:Minute:Second',
'Month-Day-Year 24hour:Minute:Second'))])
```
Note there is a slight difference in the naming of each template.
The only difference is the results is caused by the regex for period separated date format, meaning the `.` is matching any string, which I believe is a bug?

In general analysis from these results, for both the current _0.9_ (and _master_) branches:
I would also suggest removing the `Year-Month-Day 24hour:Minute:Second` format, as it is duplicating ISO 8601.
Also, looking at `%a %b %d %H:%M:%S`, with and without `%Y`, patterns, the current ordering means that the one without the year is preferable. Suggestion would be to drop the leading `%a` (effectively merging the ones lacking a year) from all as is redundant, and switching the order such the `%Y` is preferable.

This reduces the output to:
```python
set([('%b %d %H:%M:%S %Y',
('MON Day 24hour:Minute:Second',
'MON Day 24hour:Minute:Second Year')),
('%d-%m-%Y %H:%M:%S',
('Day-Month-Year 24hour:Minute:Second',
'Month-Day-Year 24hour:Minute:Second')),
('%m-%d-%Y %H:%M:%S',
('Day-Month-Year 24hour:Minute:Second',
'Month-Day-Year 24hour:Minute:Second'))])
```
(It's game over for day/month/year, month/day/year, but changes do mean that month is checked to be in limits of 1-12, so your good for second half of every month :wink:)

Sorry for the long comment. :grin: