[users] Fwd: [Fail2ban-users] "Feb 29" bug

[Nils Breunese (Lemonbit)]

Hello,

There is a leap year bug in fail2ban that can cause fail2ban to use  
100% CPU on Feb 29 when logs don't specify a year. It happened to me  
on a lot of machines. There is a patch for fail2ban 0.6 in this  
forwarded message. I manually patched my installs, but maybe this can  
be added to the packages for CentOS 4?

There is also a patch for fail2ban 0.8 (CentOS 5) here: http://sourceforge.net/tracker/index.php?func=detail&aid=1904430&group_id=121032&atid=689044

Nils Breunese.

Forwarded message:

> Van: Cyril Jaquier <cyril.jaquier at fail2ban.org>
> Datum: 29 februari 2008 16:57:45 GMT+01:00
> Aan: "Nils Breunese (Lemonbit)" <nils at lemonbit.nl>
> Kopie: fail2ban-users at lists.sourceforge.net
> Onderwerp: Antw.: [Fail2ban-users] "Feb 29" bug
>
> Hi Nils,
>
>> I have a couple of CentOS 4 machines that still run fail2ban  
>> 0.6.2,  because that's what the rpmforge repository provides  
>> (CentOS 4 comes  with Python 2.3). Fail2ban 0.6 doesn't have a file  
>> called  datestrptime.py. Could you maybe provide a patch for  
>> fail2ban 0.6 for  us Python 2.3 users, pretty please? Some machines  
>> have already hit  this bug...
>
> I will find a patch for 0.6.2 here:
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=1904430&group_id=121032&atid=689044
>
> I attached it to this e-mail too.
>
> Regards,
>
> Cyril
> --- logreader.py.orig	2008-02-29 12:52:54.000000000 +0100
> +++ logreader.py	2008-02-29 12:56:49.000000000 +0100
> @@ -209,7 +209,14 @@
> 		try:
> 			# Check if the parsed value is in TAI64N format
> 			if not self.timepattern.lower() == "tai64n":
> -				date = list(time.strptime(value, self.timepattern))
> +				try:
> +					date = list(time.strptime(value, self.timepattern))
> +				except ValueError:
> +					# Try to add the current year to the pattern. Should fix
> +					# the "Feb 29" issue.
> +					value += " %s" % time.gmtime()[0]
> +					pattern = "%s %%Y" % self.timepattern
> +					date = list(time.strptime(value, pattern))
> 			else:
> 				# extract part of format which represents seconds since epoch
> 				seconds_since_epoch = value[2:17]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.rpmforge.net/pipermail/users/attachments/20080229/31b3d313/attachment.html