#28 fail2ban cannot recognize leap-year day

closed-fixed
nobody
None
5
2008-02-29
2008-02-29
Taku YASUI
No

On latest fail2ban (0.8.1) cannot recognize leap-year day as follows:

1. Up loglevel to 4 (DEBUG) on your fail2ban.conf
2. Following message is shown at your fail2ban.log

2008-02-29 06:26:37,548 fail2ban.filter : DEBUG Found a match but no valid date/time found for Feb 29 05:14:55 osdnns sshd[3776]: Invalid user users from 74.205.125.93
. Please contact the author in order to get support for this format

Maybe it causes at "server/datestrptime.py". python time.strptime() cannot recognize reap-year day when the year has not specified as follows:

% python
Python 2.4.4 (#2, Apr 5 2007, 20:11:18)
[GCC 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import time
>>> time.strptime("Feb 29 05:14:55", "%b %d %H:%M:%S")
Traceback (most recent call last):
File "<stdin>", line 1, in ?
File "/usr/lib/python2.4/_strptime.py", line 425, in strptime
julian = datetime_date(year, month, day).toordinal() - \ ValueError: day is out of range for month

Standard syslogd does not recorded year. Therefore fail2ban failed to recognize leap-year day.

Discussion

  • Taku YASUI

    Taku YASUI - 2008-02-29

    Logged In: YES
    user_id=131241
    Originator: YES

    When the year specified, strptime() returns correct value as follows:

    >>> time.strptime("Feb 29 06:26:55", "%b %d %H:%M:%S")
    Traceback (most recent call last):
    File "<stdin>", line 1, in ?
    File "/usr/lib/python2.4/_strptime.py", line 425, in strptime
    julian = datetime_date(year, month, day).toordinal() - \ ValueError: day is out of range for month
    >>> time.strptime("2008 Feb 29 06:26:55", "%Y %b %d %H:%M:%S")
    (2008, 2, 29, 6, 26, 55, 4, 60, -1)

    So, fail2ban may append "this year" valut to strptime() argument to fix this problem.

    Thanks,

     
  • Nobody/Anonymous

    Logged In: NO

    I also got this error:

    2008-02-29 00:00:02,648 ERROR: Fail2Ban got an unhandled exception and died.
    2008-02-29 00:00:02,649 ERROR: Type: 'ValueError'
    Value: ('day is out of range for month',)
    TB: [('/usr/bin/fail2ban', 47, '?', 'fail2ban.main()'), ('/usr/share/fail2ban/fail2ban.py', 519, 'main', 'e = element[1].getFailures()'), ('/usr/share/fail2ban/logreader/logreader.py', 158, 'getFailures', 'self.lastDate = self.getTime(lastLine)'), ('/usr/share/fail2ban/logreader/logreader.py', 205, 'getTime', 'date = self.getUnixTime(timeMatch.group())'), ('/usr/share/fail2ban/logreader/logreader.py', 213, 'getUnixTime', 'date = list(time.strptime(value, self.timepattern))'), ('/usr/lib/python2.4/_strptime.py', 425, 'strptime', 'julian = datetime_date(year, month, day).toordinal() - \\')]
    2008-02-29 00:00:02,649 WARNING: Restoring firewall rules...

     
  • Nobody/Anonymous

    Logged In: NO

    In 0.6.2 it prints:
    ...
    2008-02-29 10:49:56,905 ERROR: day is out of range for month
    2008-02-29 10:49:56,906 ERROR: Please check the format and your locale settings.
    2008-02-29 10:52:18,047 ERROR: day is out of range for month
    2008-02-29 10:52:18,048 ERROR: Please check the format and your locale settings.
    ...
    all the time.

     
  • Cyril Jaquier

    Cyril Jaquier - 2008-02-29
    • status: open --> closed-fixed
     
  • Cyril Jaquier

    Cyril Jaquier - 2008-02-29

    Logged In: YES
    user_id=933467
    Originator: NO

    Fixed in the 0.8 branch. I attached a patch for 0.8.1. I will release a patch for 0.6.2 this evening. Many thanks to Yaroslav Halchenko for the patch.
    File Added: fix-leap-year-detection-0.8.1.patch

     
  • Cyril Jaquier

    Cyril Jaquier - 2008-02-29

    Logged In: YES
    user_id=933467
    Originator: NO

    File Added: fix-leap-year-detection-0.6.2.patch

     

Log in to post a comment.