CasperSecurity
o
;s*b�q � @ sR d Z dZdZddlZddlmZmZ ddlZddlZddlZddl Z ddl
Z
ddl m Z m
Z
ddlmZ dd lmZmZ dd
lmZ dd lmZmZ d d
lmZ d dlmZm Z m Z m Z m Z m Z m!Z! ee"�Z#dZ$dZ%dZ&zddl'm(Z( W n e)y dZ(Y nw dd� Z*ze+ W n e,y� e-Z+Y nw dd� Z.G dd� d�Z/G dd� de0�Z1dS )z
Cyril Jaquierz Copyright (c) 2004 Cyril Jaquier�GPL� N)�Lock�RLock� )� Observers�ObserverThread)�Jails)�
FileFilter�
JournalFilter)� Transmitter)� AsyncServer�AsyncServerException� )�version)� getLogger�_as_bool�extractOptions� str2LogLevel�getVerbosityFormat�
excepthook�prctl_set_th_name�auto�INFO�STDOUT)�
Fail2BanDbc C s t �� jjS �N)� threading�current_thread� __class__�__name__� r r �8/usr/lib/python3/dist-packages/fail2ban/server/server.py� _thread_name: � r" c
C sd t j�| �} t j�| �r0zt �| � W dS ttfy/ } z
|jdkr$� W Y d}~dS d}~ww dS )z0Creates path of file (last level only) on demand� N)�os�path�dirname�isabs�mkdir�OSError�FileExistsError�errno)�name�er r r! �_make_file_pathB s
����r/ c @ s� e Zd Zd�dd�Zdd� Zdd� Zdd � Zdd
i fd d �Zd
d� Zdd� Z d�dd�Z
dd� Z dd� Z dd� Z
dd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd�d)d*�Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z!dAdB� Z"dCdD� Z#dEdF� Z$dGdH� Z%dIdJ� Z&dKdL� Z'dMdN� Z(dOdP� Z)d�dQdR�Z*d�dTdU�Z+dVdW� Z,d�dXdY�Z-dZd[� Z.d\d]� Z/d^d_� Z0d`da� Z1dbdc� Z2ddde� Z3dfdg� Z4dhdi� Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9drds� Z:dtdu� Z;dvdw� Z<dxdy� Z=dzd{� Z>d�d|d}�Z?d�d~d�Z@d�d�� ZAd�d�d��ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�d��ZFd�d�� ZGd�d�d��ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTdSS )��ServerFc C sj t � | _t� | _t� | _d | _|| _t| �| _ i | _
d | _ d | _ d | _
d | _d | _dddd�| _i | _d S )Nz/var/run/syslogz /var/run/logz/dev/log)�Darwin�FreeBSD�Linux)r �_Server__loggingLockr �
_Server__lockr �_Server__jails� _Server__db�_Server__daemonr �_Server__transm�_Server__reload_state�_Server__asyncServer�_Server__logLevel�_Server__logTarget�_Server__verbose�_Server__syslogSocket� _Server__autoSyslogSocketPaths�_Server__prev_signals)�self�daemonr r r! �__init__Q s"
�
zServer.__init__c C � t �d|� | �� d S )NzCaught signal %d. Exiting)�logSys�debug�quit)rB �signum�framer r r! �__sigTERMhandlerf � zServer.__sigTERMhandlerc C rE )Nz Caught signal %d. Flushing logs)rF rG � flushLogs)rB rI �fnamer r r! �__sigUSR1handlerj rL zServer.__sigUSR1handlerc C s t �|�| j|< t � ||� dS )z>Bind new signal handler while storing old one in _prev_signalsN)�signal� getsignalrA )rB �s�newr r r! �
_rebindSignaln s zServer._rebindSignalTc
C s� t �d� | jr,t�d� | �� }|d u rdS |d s,d|dd � f}t�|� t|��t|� dd�� |� d d �| _
| � |� d
| j d urH| j nt
�� | �|� d | jd urY| jnt�� | �|� d | jd urj| jnt�� t�d
� t�dtj� | jr�t�d� t� dkr�tjtjfD ] }| �|| j� q�| �tj| j � t t _ z t� d|� t |� t!|d�} | �"dt �#� � | �$� W n t%t&fy� }
z t�d|
� W Y d }
~
nd }
~
ww |r�t'j(d u r�t)� t'_(t'j(�*� t� d� zt |� t+| j,�| _-|� d�| j-_.| j-�*||� W n t/�y# }
z t�d|
� W Y d }
~
nd }
~
ww | �0� zt� d|� t �1|� W d S t%t&f�yR }
z
t�d|
� W Y d }
~
d S d }
~
ww )N�? zStarting in daemon modeFr zCould not create daemon %sr �pnamezfail2ban-server�verbose� syslogsocket�loglevel� logtargetz2--------------------------------------------------zStarting Fail2ban v%szDaemon started� _MainThreadzCreating PID file %s�wz%s
z Unable to create PID file: %szStarting communication�onstartzCould not start server: %szRemove PID file %sz Unable to remove PID file: %s)2r% �umaskr8 rF �info�_Server__createDaemon�error�ServerInitializationErrorr �getr> �setSyslogSocketr? �DEF_SYSLOGSOCKET� setLogLevelr< � DEF_LOGLEVEL� setLogTargetr= �
DEF_LOGTARGETr r" rP �SIGTERM�SIGINTrT �_Server__sigTERMhandler�SIGUSR1�_Server__sigUSR1handlerr �sysrG r/ �open�write�getpid�closer* �IOErrorr �Mainr �startr r9 r; r] r
rH �remove) rB �sock�pidfile�force�observer�conf�ret�errrR �pidFiler. r r r! rv s s|
�
�
�
��
�� ��z Server.startc C s� dd� | _ t�d� | jd ur| j�� t� dkr)| j�� D ]
\}}t�||� q t j
}|d ur;|j dd�r8d }d t _
| � � |d urG|� � | j
rR| j
�� d | _
| jd ur_| j� � d | _t�d� d S )Nc S s dS )NFr r r r r! �<lambda>� s z Server.quit.<locals>.<lambda>zShutdown in progress...r[ F)� forceQuitzExiting Fail2ban)rH rF r_ r; �stop_communicationr" rA �itemsrP r ru �stop� stopAllJailr7 rs )rB rR �sh�obsMainr r r! rH � s,
z Server.quitc C s� d}| j �|�r:| j�|�r:| j| }|j|kr&d}t�d|� d | j |< nt�d||j|� | j|dd� | j |= |rE| j�||| j � | j d urU| j �
| j| � d S d S )NTFzReload jail %rz"Restart jail %r (reason: %r != %r)�r� ) r: rc r6 �exists�backendrF r_ �delJail�addr7 �addJail)rB r- r� �addflg�jailr r r! r� � s
�zServer.addJailc C sN | j | }|s |�� r|j||d� |r%| jd ur | j�|� | j |= d S d S )N�r� �join)r6 �isAliver� r7 r� )rB r- r� r� r� r r r! r� s
�zServer.delJailc C s� | j �4 | j| }|�� s|�� n|| jv r!t�d|� | j|= |jr/d|_W d � d S W d � d S 1 s:w Y d S )NzJail %r reloadedF)r5 r6 r� rv r: rF r_ �idle)rB r- r� r r r! � startJail s
�"�zServer.startJailc C s: | j � | j|dd� W d � d S 1 sw Y d S )NTr� )r5 r� �rB r- r r r! �stopJail s "�zServer.stopJailc C s~ t �d� | j�- t| j�� �D ]
}| j|ddd� qt| j�� �D ]
}| j|ddd� q"W d � d S 1 s8w Y d S )NzStopping all jailsTFr� )rF r_ r5 �listr6 �keysr� r� r r r! r� s
�"�zServer.stopAllJailc C s� |r�| j r|dks| j �|�rtd��t�d|dkr d| nd � | j�k |dkrPd }d|vs6| j�|�r;| j| }|rOd|v rF| �|� d|v rO| � |� nd|v rX| �� d|v r`| �
� | j� � D ]"\}}|dksq||kr�d |_ || j |< |j
jd d
� |jjd d
� qeW d � d S 1 s�w Y d S | j�7 g }| j� � D ] \}}|| j v r�|�|� q�|j
jd d
� |jjd d
� q�|D ]}| �|� q�W d � n1 s�w Y i | _ t�d � d S )
Nz--allzReload already in progresszReload zjail %sz all jailsz --if-existsz--unbanz --restartT)�beginFzReload finished.)r: rc �
ValueErrorrF r_ r5 r6 r� �
setUnbanIPr� r� r� r� �filter�reload�actions�appendr� )rB r- �optsr� r� �jn�deljailsr r r! � reloadJails( sR
�
�"�
� �
zServer.reloadJailsc C s || j | _dS )NT�r6 r� �rB r- �valuer r r! � setIdleJail] s zServer.setIdleJailc C � | j | jS r r� r� r r r! � getIdleJaila r# zServer.getIdleJailc C s t |�| j| j_d S r )r r6 r� �
ignoreSelfr� r r r! �
setIgnoreSelfe � zServer.setIgnoreSelfc C � | j | jjS r )r6 r� r� r� r r r! �
getIgnoreSelfh � zServer.getIgnoreSelfc C � | j | j�|� d S r )r6 r� � addIgnoreIP�rB r- �ipr r r! r� k r� zServer.addIgnoreIPc C r� r )r6 r� � delIgnoreIPr� r r r! r� n r� zServer.delIgnoreIPc C � | j | j�� S r )r6 r� � getIgnoreIPr� r r r! r� q � zServer.getIgnoreIPc C s* | j | j}t|t�r|�||� d S d S r )r6 r� �
isinstancer �
addLogPath)rB r- �fileName�tail�filter_r r r! r� t s
�zServer.addLogPathc C �( | j | j}t|t�r|�|� d S d S r )r6 r� r� r �
delLogPath)rB r- r� r� r r r! r� y �
�zServer.delLogPathc C �0 | j | j}t|t�r|�� S t�d| � g S )Nz$Jail %s is not a FileFilter instance)r6 r� r� r � getLogPathsrF r_ �rB r- r� r r r! �
getLogPath~ �
zServer.getLogPathc C r� r )r6 r� r� r
�addJournalMatch�rB r- �matchr� r r r! r� � r� zServer.addJournalMatchc C r� r )r6 r� r� r
�delJournalMatchr� r r r! r� � r� zServer.delJournalMatchc C r� )Nz'Jail %s is not a JournalFilter instance)r6 r� r� r
�getJournalMatchrF r_ r� r r r! r� � r� zServer.getJournalMatchc C s | j | j}|�|� d S r )r6 r� �setLogEncoding)rB r- �encodingr� r r r! r� � s zServer.setLogEncodingc C s | j | j}|�� S r )r6 r� �getLogEncodingr� r r r! r� � s zServer.getLogEncodingc C r� r )r6 r� � setFindTimer� r r r! r� � r� zServer.setFindTimec C r� r )r6 r� � getFindTimer� r r r! r� � r� zServer.getFindTimec C r� r )r6 r� �setDatePattern)rB r- �patternr r r! r� � r� zServer.setDatePatternc C r� r )r6 r� �getDatePatternr� r r r! r� � r� zServer.getDatePatternc C r� r )r6 r� �setLogTimeZone)rB r- �tzr r r! r� � r� zServer.setLogTimeZonec C r� r )r6 r� �getLogTimeZoner� r r r! r� � r� zServer.getLogTimeZonec C s || j | j_d S r �r6 r� �
ignoreCommandr� r r r! �setIgnoreCommand� � zServer.setIgnoreCommandc C r� r r� r� r r r! �getIgnoreCommand� r� zServer.getIgnoreCommandc C s& t d| d �\}}|| j| j_d S )Nzcache[�])r r6 r� � ignoreCache)rB r- r� �optionsr r r! �setIgnoreCache� s zServer.setIgnoreCachec C r� r )r6 r� r� r� r r r! �getIgnoreCache� r� zServer.getIgnoreCachec C s" | j | j}t�d|� ||_d S )Nz prefregex: %r)r6 r� rF rG � prefRegex)rB r- r� �fltr r r! � setPrefRegex� s
zServer.setPrefRegexc C r� r )r6 r� r� r� r r r! � getPrefRegex� r� zServer.getPrefRegexc C �: | j | j}|s |f}|D ]
}t�d|� |�|� q
d S )Nz failregex: %r)r6 r� rF rG � addFailRegex�rB r- r� �multipler� r r r! r� � �
�zServer.addFailRegexNc C r� r )r6 r� � delFailRegex�rB r- �indexr r r! r� � r� zServer.delFailRegexc C r� r )r6 r� � getFailRegexr� r r r! r� � r� zServer.getFailRegexc C r� )Nz ignoreregex: %r)r6 r� rF rG �addIgnoreRegexr� r r r! r� � r� zServer.addIgnoreRegexc C r� r )r6 r� �delIgnoreRegexr� r r r! r� � r� zServer.delIgnoreRegexc C r� r )r6 r� �getIgnoreRegexr� r r r! r� � r� zServer.getIgnoreRegexc C r� r )r6 r� � setUseDnsr� r r r! r� � r� zServer.setUseDnsc C r� r )r6 r� � getUseDnsr� r r r! r� � r� zServer.getUseDnsc C s || j | jj_d S r �r6 r� � failManager�
maxMatchesr� r r r! �
setMaxMatches� � zServer.setMaxMatchesc C s | j | jjjS r r� r� r r r! �
getMaxMatches� r� zServer.getMaxMatchesc C r� r )r6 r� � setMaxRetryr� r r r! r� � r� zServer.setMaxRetryc C r� r )r6 r� � getMaxRetryr� r r r! r� � r� zServer.getMaxRetryc C r� r )r6 r� � setMaxLinesr� r r r! r� � r� zServer.setMaxLinesc C r� r )r6 r� � getMaxLinesr� r r r! r� � r� zServer.getMaxLinesc G s* | j | jj|g|�R d|| jv i� d S )Nr� )r6 r� r� r: )rB r- r� �argsr r r! � addAction� s
�zServer.addActionc C r� r �r6 r� r� r r r! �
getActions� r# zServer.getActionsc C s | j | j|= d S r r� r� r r r! � delAction r� zServer.delActionc C s | j | j| S r r� r� r r r! � getAction r� zServer.getActionc C r� r )r6 r� �
setBanTimer� r r r! r r� zServer.setBanTimec G s | j | jj|� S r )r6 r� �
addAttempt)rB r- r� r r r! � addAttemptIP r� zServer.addAttemptIPc C � | j | j�|�S r )r6 r� � addBannedIPr� r r r! �setBanIP r� zServer.setBanIPc C sV |d ur | j | g}nt| j �� �}d}||d u O }|D ] }||jj||d�7 }q |S )Nr )�ifexists)r6 r� �valuesr� �removeBannedIP)rB r- r� r �jails�cntr� r r r! r� s zServer.setUnbanIPc C s� |d ur | j | g}nt| j �� �}g }|d u r:|r:|D ]}g }|D ]}|j�|g�r1|�|j� q"|�|� q |S |D ]}|j�|�}|d urL| S |�|j|i� q<|S r )r6 r� r r� � getBannedr� r- )rB r- �idsr
�resr� r} r� r r r! �banned s& � � z
Server.bannedc C r� r )r6 r� �
getBanTimer� r r r! r 9 r� zServer.getBanTimec C r )z�Returns the list of banned IP addresses for a jail.
Parameters
----------
name : str
The name of a jail.
Returns
-------
list
The list of banned IP addresses.
)r6 r� �
getBanList)rB r- �withTimer r r! r < s
zServer.getBanListc C s | j | �||� d S r )r6 �setBanTimeExtra)rB r- �optr� r r r! r K r� zServer.setBanTimeExtrac C s | j | �|�S r )r6 �getBanTimeExtra)rB r- r r r r! r N r� zServer.getBanTimeExtrac C s | j d uo | j �� S r )r; �isActive�rB r r r! � isStartedQ r� zServer.isStartedc C s@ |d ur
t | j�|kr
dS t| j�� �D ] }|�� s dS qdS )Nr r )�lenr6 r� r r� )rB �jailnumr� r r r! r� T s �zServer.isAlivec C sZ z&| j �� t| j�}|�� d�|�}dt| j�fd|fg}|W | j �� S | j �� w )Nz, zNumber of jailz Jail list)r5 �acquirer� r6 �sortr� r �release)rB r
�jailListr} r r r! �status] s
�z
Server.status�basicc C s | j | j|d�S )N)�flavor)r6 r )rB r- r! r r r! �
statusJaili r� zServer.statusJailc C s� |� � }| j�0 | j|kr W d � d S t|�}td��tdks'|tjk r)|nt � || _W d � d S 1 s:w Y d S )N�fail2ban� INHERITED)
�upperr4 r< r r �setLevelri �logging�DEBUGrg )rB r� �llr r r! rf y s
��"�zServer.setLogLevelc C �0 | j � | jW d � S 1 sw Y d S r )r4 r< r r r r! � getLogLevel� � $�zServer.getLogLevelc
C s� t |�\}}|�� }| j��� | j|kr W d � dS |dkr-|| _ W d � dS |�d�}|dkr�|�dd��� }|d u rDd}z ttjjd| �}W n t yf t
� d |�d�� tjjj }Y nw | j
d
kryd d l}| j�|�� �| _
| j
d ur�tj�| j
�r�t�t�| j
�j�r�tjj| j
|d �}nTt
� d
| j
� W d � dS |dv r�t�tj�}n8|dkr�t�tj�}n-zt|d�� � tj� |�}W n t y� t
� d|� t
� d| j� Y W d � dS w t d�}|jd d d� D ]2} |�!| � z
| �"� | � � W q� t#t$f�y+ dtj% k�r!dk �s(n dtj%k�r)� Y q�w |�&� tj'k�rD| j(d u �rDtj'|�&� d | _(|�d�}
|
d u�rSt)|
�}
n|dv}
|d u�rat)|�}nd}|�d d �d k�rr|�d �} nd } | j(d u�r�| j(d k�r�| j(d } t*| |
|d �} |�+t�,| �� |�-|� | jd u�r�t
� d t.j.� t
� d!|dk�r�|nd"|| j
f t.j.f � || _ W d � dS 1 �s�w Y d S )#NTr$ �padding�SYSLOG�facility�DAEMON�0�LOG_z)Unable to set facility %r, using 'DAEMON'r r )r/ z9Syslog socket file: %s does not exists or is not a socketF)r �SYSOUT�STDERR�azUnable to log to %rz Logging to previous target %rr# ���)r � � )r8 )r8 r r �datetime)r. r3 �format� r )�addtimer- zStart Fail2ban v%sz-Changed logging target to %s for Fail2ban v%sz%s (%s))/r r% r4 r= rc �getattrr' �handlers�
SysLogHandler�AttributeErrorrF ra �
LOG_DAEMONr? �platformr@ �systemr% r& r� �stat�S_ISSOCK�st_mode�
StreamHandlerro �stdout�stderrrp rs �RotatingFileHandlerrt r_ r �
removeHandler�flushr� �KeyError� version_info�getEffectiveLevelr( r> r r � setFormatter� Formatter�
addHandlerr )
rB �target�
logOptions� systargetr- r/ rB �hdlr�logger�handlerr< �fmtrW r r r! rh � s�
��
�
�
��������" �+
��
�����&�zServer.setLogTargetc C s^ | j � | j|kr W d � dS || _W d � n1 s w Y | jdkp.| �| j�S )NTr. )r4 r? r= rh )rB rX r r r! rd s
� �
�zServer.setSyslogSocketc C r* r )r4 r= r r r r! � getLogTarget r, zServer.getLogTargetc C r* r )r4 r? r r r r! �getSyslogSocket r, zServer.getSyslogSocketc C s� | j dvr2td�jD ]%}z|�� t�d| j � W q
ty/ |�� t�d| j � Y q
w dS td�jD ]}|�� t�d| j � q7dS )N)r4 r r. r# zrollover performed on %szflush performed on %sz rolled over�flushed)r= r r> �
doRolloverrF r_ r@ rL )rB rX r r r! rM s
�zServer.flushLogsc C s< |� � D ]\}}|dkrt�t|�d � qtd| ��d S )N� stacksize� zunknown option %r)r� r �
stack_size�intrM )rB r� �o�vr r r! �setThreadOptions& s
�zServer.setThreadOptionsc C s dt �� d iS )Nr^ r_ )r r` r r r r! �getThreadOptions- r� zServer.getThreadOptionsc C s� | j r | j j|kr d S | j s|�� dkrd S t| j�dkr!td��|�� dkr+d | _ ntd ur>t|� t|�| _ | j �� nt �
d� t j d urQt j �
| j � d S d S )N�noner z3Cannot change database when there are jails presentzEUnable to import fail2ban database module as sqlite is not available.)r7 �filename�lowerr r6 � RuntimeErrorr r/ � delAllJailsrF ra r ru �db_set)rB rg r r r! � setDatabase0 s( �
�
�zServer.setDatabasec C s | j S r )r7 r r r r! � getDatabaseG s zServer.getDatabasec
C s� | � tjtj� zt�� }W n ty( } zd|j|jffW Y d}~S d}~ww |dkrbt� � zt�� }W n tyQ } zd|j|jffW Y d}~S d}~ww |dkr\t�
d� nt� d� ndS zt� d�}W n
t
tfyx d}Y nw tjdd� dkr�t�d tj�}td|�D ]}ztj�||�s�t�|� W q� ty� Y q�w t�|� nt�d|� t�d
tj� t�d
tj� t�d
tj� d S ) z� Detach a process from the controlling terminal and run it in the
background as a daemon.
http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/278731
FNr �/� SC_OPEN_MAX� r8 )r8 � r z /dev/urandomz /dev/null)T)rT rP �SIGHUP�SIG_IGNr% �forkr* r, �strerror�setsid�chdir�_exit�sysconfr@ r� ro rN rp �O_RDONLY�ranger& � sameopenfilers �
closerange�O_RDWR)rB �pidr. �maxfd�
urandom_fd�fdr r r! �__createDaemonJ sP
�� �� �
� � zServer.__createDaemon)F)TTr )NNT)NN)r )Ur �
__module__� __qualname__rD rl rn rT rv rH r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� r r r r r r r� r r" rf r+ rh rd rZ r[ rM rd re rl rm r` r r r r! r0 O s�
P/
5
q r0 c @ s e Zd ZdS )rb N)r r� r� r r r r! rb � s rb )2�
__author__�
__copyright__� __license__r r r r' r% rP rD ro r{ r r r
r r� r r
� transmitterr � asyncserverr r
r; r �helpersr r r r r r r r rF re rg ri �databaser � ImportErrorr" r+ � NameErrorr* r/ r0 � Exceptionrb r r r r! �<module> sR $ � �
W