CasperSecurity
o
;s*b�� � @ s� d Z dZdZddlZddlZddlZddlZddlZddlZddl Z ddl
m Z m
Z
mZmZmZ ddlmZ ddlmZ dd lmZmZmZ dd
lmZ dd lm Z m Z m Z dd l m!Z!m Z" dd
l#m$Z$ ddl%m%Z% ddl&m'Z' ddl(m)Z) ddl*m+Z+m,Z-m.Z.m/Z/m0Z0m1Z1m2Z3m4Z4m5Z5 ddl6m7Z7 e7e8�Z,dZ9dZ:ee!�;� �Z<e j=�>e j=j?�Z?e j=�>e j=j@�Z@e?d e_?e, e_, e_,e_,e%jAZBe%jCZDdd� ZEeE e_F e_F e_Fe$_Fdd� ZGe%jHZHdd� ZIe@fd d �ZJG d d � d ejK�ZKG d d!� d!ejK�ZLeKZMeLZNg aOd"d#� ZPePe_Qd$ e_Re_Re+jSZTd%d&� ZUd'd(� ZV , d?d-d.�ZWd/d0� ZXd1d2� ZYd3d4� ZZd5d6� Z[i fd7d8�Z\G d9d:� d:e+�Z]G d;d<� d<e]�Z^G d=d>� d>e]�Z_dS )@z Serg BresterzICopyright (c) 2014- Serg G. Brester (sebres), 2008- Fail2Ban Contributors�GPL� N)�join�isdir�isfile�exists�dirname��wraps)�Thread� )�fail2banclient�fail2banserver�fail2bancmdline)�Fail2banCmdLine)�exec_command_line�CSocket�
VisualWait)�Fail2banServerr )�protocol)�server)�MyTime)�Utils� ) �LogCaptureTestCase�logSys� with_tmpdir�shutil�logging�STOCK�
CONFIG_DIR�TEST_NOW�tearDownMyTime)� getLoggerzfail2ban-clientzfail2ban-serverc G s t �| d � d S �Nr )r �info��args� r' �G/usr/lib/python3/dist-packages/fail2ban/tests/fail2banclienttestcase.py� _test_outputJ s r) c C s& t �d| � t�t�� | d � d S )Nz===>>> time shift + %s min�< )r �debugr �setTime�time)�shiftr' r' r( � _time_shiftQ s r/ c C s. t jdurt j�t� t j�td � dS dS )z$Helper to wait observer becomes idleN� )� Observers�Main�
wait_empty� MID_WAITTIME� wait_idler' r' r' r( �_observer_wait_idleY s
�r6 c s2 t jdurt jj� � ��fdd�}|t j_dS dS )zOHelper to block observer before increase bantime until some condition gets trueNc s: � t j_t�d� t���� t�d� � | i |�� d S )Nz4 [Observer::banFound] *** observer blocked for testz. [Observer::banFound] +++ observer runs again)r1 r2 �banFoundr r+ r �wait_for�r& �kwargs��
_obs_banFound�cond�timeoutr' r( � _banFoundd s
z0_observer_wait_before_incrban.<locals>._banFound)r1 r2 r7 )r= r> r? r' r; r( � _observer_wait_before_incrban_ s
�r@ c @ � e Zd ZdZdS )�
ExitExceptionz Exception upon a normal exitN��__name__�
__module__� __qualname__�__doc__r' r' r' r( rB t � rB c @ rA )�FailExitExceptionz Exception upon abnormal exitNrC r' r' r' r( rI y rH rI c G s t t�r t�d�S dS )Nr �exit)�len�INTERACT�popr% r' r' r( �_test_input_command� s
rN Fc G s2 t | |�}|�d�|�|rdnd � |�� d S )N�
� )�open�writer �close)�fn�mode�lines�fr' r' r( � _write_file� s
rX c C s> d }zt | �}|�� W |d ur|�� S S |d ur |�� w w �N)rQ �readrS )rT rW r' r' r( �
_read_file� s
�
�r[ � /dev/null�:memory:r' �rP c C s� t | d�}|dkrt | d�}d} |r}tr}dd� }
tjt||
d� |d u s,J dt|� ��|d u r2d }t�d
�} tj t |d �d d
�D ]} | �
d�} | � | �rOd} t | � qAt�d�} tj t |d�d d
�D ]} | �
d�} | � | �rqd} t | � qc|rzdnd} n*t
�|� tt |d �dddd|�dd� ddt | d � d t | d � dd | d d!d�
| r�tt || �dgd"dd#d$| df| �R � |r�tt |d%�dg|�R � tjjtjk r�tt |d �� tt |d�� |r�tt |d%�� | r�| dkr�tt || �� |�rt�r|D ]}
t
�t
j�t t|
��t ||
�� q�|�r%|D ]
}
t|
d&| i dd� �qd'\}}tjjtjk �rGttjj�}tjj d(k�rGd)d*tjj f}|d+|f }d,|d-t | d �d.t | d �d/|f| d0dd1tt j �f S )2N�config�autozf2b-db.sqlite3� jail.confc s � fdd�|D �S )z?Filters list of 'files' to contain only directories (under dir)c s g | ] }t t� |��r|�qS r' )r �pjoin)�.0rW ��dirr' r( �
<listcomp>� s z2_start_params.<locals>.ig_dirs.<locals>.<listcomp>r' )re �filesr' rd r( �ig_dirs� s z _start_params.<locals>.ig_dirs)�ignorez?We are about to overload use_stock_cfg from the one provided %s)�action.dzfilter.dz ^dbfile\s*=z
fail2ban.confT)�inplacerO zdbfile = :memory:z ^backend\s*=�backend = pollingz
jail.localrP �w� [Definition]zloglevel = INFOz logtarget = �%z%%zsyslogsocket = autoz socket = �f2b.sockz
pidfile = �f2b.pidz dbfile = zdbmaxmatches = 100zdbpurgeage = 1d�
[INCLUDES]� [DEFAULT]ztmp = zfail2ban.local�tmp)r' �INFOr �-�vz
--loglevel�-c�-sz-p� --logtargetz--syslogsocketz --timeout) rb r r �copytree�STOCK_CONF_DIR�repr�re�compile� fileinput�input�rstrip�match�print�os�mkdirrX �replace�unittest�F2B� log_levelr �DEBUG� _out_file�symlink�path�abspathru �str� verbosityr � MAX_WAITTIME)rt � use_stock�
use_stock_cfg� logtarget�db� f2b_local�jails�create_before_start�cfg�j_confrh �r�line�n�vvv�llevr' r' r( �
_start_params� s�
�
�
��� " ��
��r� c C s. z | | � d�d dkW S ty Y dS w )Nrz r � INHERITEDF)�index�
ValueError�� startparamsr' r' r( �_inherited_log� s
�r� c
C sX d }zt | �}t�d|��� }t|�W S ty+ } z t�|� W Y d }~|S d }~ww )Nz\S+)r[ r~ r� �group�int� Exceptionr r+ )�pidfile�pid�er' r' r( �_get_pid_from_file� s
��r� c
sf t �d| t| �f� t| �r | }t|d�} t| �s t|d�} tjjtj k r:t|d�}t|�r3t
|� nt � dd|� t| �sFt �d|� dS t �d | � t | �� � d u rVd
S zDt �d � � � d ksg� t
�� krotd
� | f ��t�� �swW dS t
�� tj� t�� fdd�d�s�t
�� tj� t �d� t�� � W S ty� } z t �|� W Y d }~dS d }~ww )Nz cleanup: %rrq z fail2ban.pid�f2b.logr0 z
no logfile %rzcleanup: no pidfile for %rTzcleanup pidfile: %rFzcleanup pid: %rr zpid %s of %s is invalidc s t �� � S rY )r �
pid_existsr' �r� r' r( �<lambda>+ � z_kill_srv.<locals>.<lambda>r �cleanup: kill ready)r r+ r rb r r� r� r� r r� r� �logr� r� �getpidr� r r� �kill�signal�SIGTERMr8 �SIGKILLr� � exception)r� �piddir�logfiler� r' r� r( � _kill_srv sD
��r� c s t � �� fdd��}|S )z�Helper to decorate tests which receive in the last argument tmpdir to pass to kill_srv
To be used in tandem with @with_tmpdir
c s. |d }z
� | g|�R � W t |� S t |� w )N���)r� )�selfr& r� �rW r' r( �wrapper: s z with_kill_srv.<locals>.wrapperr �rW r� r' r� r( �
with_kill_srv5 s r� c s � fdd�}|S )z}Helper to decorate tests uses foreground server (as thread), started directly in test-cases
To be used only in subclasses
c s t t� �� �fdd���}|S )Nc
s� d }t � � z�z|t�fddi����td�j��� fd�}d|_|�� ttff� ���fdd� }|�_t �
� fdd �t � �� � �
d
d �� �j�d�� d � t�d � ��� ����g|�R i |��W W |rt�d
� ��� ��� � �
dd �r|�� t� S ty� } ztd| � ��� }|r�td| � ��� � d }~ww |r�t�d
� ��� ��� � �
dd �r�|�� t� w )Nr� r� �_TestCaseWorker)�name�targetr& Tc s� t � � �dd �s tj�t�d��s t�� fdd�t� � �dd �sE�� | �d� t�� fdd�t
� �� � �dd �� �j ddd t
d
� d d� �_
d S ) N�endrq c � � � dd �d uS �Nr� ��getr' ��phaser' r( r� _ � zywith_foreground_server_thread.<locals>._deco_wrapper.<locals>.wrapper.<locals>._stopAndWaitForServerEnd.<locals>.<lambda>�stopc r� r� r� r' r� r' r( r� d r� �Shutdown successfulzExiting Fail2banT��all�waitc _ � d S rY r' r9 r' r' r( r� h � )r! r� r� r� r rb r r8 r4 �execCmdr� �
assertTrue� assertLogged�stopAndWaitForServerEnd��code�r� r� r� rt r' r( �_stopAndWaitForServerEnd[ s zgwith_foreground_server_thread.<locals>._deco_wrapper.<locals>.wrapper.<locals>._stopAndWaitForServerEndc r� )N�startr� r' r� r' r( r� k r� zWwith_foreground_server_thread.<locals>._deco_wrapper.<locals>.wrapper.<locals>.<lambda>r� )r� r� z === within server: begin ===z === within server: end. ===r� z=== Catch an exception: %sz#=== Error of server, log: ===
%s===)�dictr� r
�_testStartForeground�daemonr� �SUCCESS�FAILEDr� r r8 r� r� r� �
_wait_for_srv� DefLogSysr$ �pruneLogr r! r� r� �getLog)r� rt r& r: �thr� r� r� )rW �
startextrar� r( r� I sT �
� ��
zEwith_foreground_server_thread.<locals>._deco_wrapper.<locals>.wrapper)r r r� �r� r� r( �
_deco_wrapperH s :z4with_foreground_server_thread.<locals>._deco_wrapperr' )r� r� r' r� r( � with_foreground_server_threadC s >r� c @ sp e Zd ZejZdd� Zdd� Zdd� Ze ddd ��Z
dd d
�Z dd� Z dd� Z
dd� Zeddid�dd� �Zd S )�Fail2banClientServerBasec O r� rY r' )r� r& r: r' r' r( � _setLogLevel� s z%Fail2banClientServerBase._setLogLevelc C s( t �| � dt_tjt_t| j�t _
dS )z Call before every test case.r� N) r �setUpr �
DEF_LOGTARGETr� �level� DEF_LOGLEVEL� staticmethod�
_test_exitr �_exit�r� r' r' r( r� � s
z Fail2banClientServerBase.setUpc C s( | j t_tt_tt_t� | � t
� dS )zCall after every test case.N) �
_orig_exitr r� �SRV_DEF_LOGTARGETr r� �SRV_DEF_LOGLEVELr� r �tearDownr! r� r' r' r( r� � s
z!Fail2banClientServerBase.tearDownr c C s | dkrt � �t� �r# )rB rI r� r' r' r( r� � s z#Fail2banClientServerBase._test_exitTNc s� � si � z:t |d��t�� �fdd�t�}|r � �d�r#td|f ��|r9t��fdd�t�}|s<td� |f ��W d S W d S t|�rRtd��� � �� � t |d �}t
|�r`t |� � t|�sjt �
d
|� � ) Nrp c s � � d�pt��S r� )r� r r' )r� �sockr' r( r� � s z8Fail2banClientServerBase._wait_for_srv.<locals>.<lambda>r� z9Unexpected: Socket file does not exists.
Start failed: %rc s d� � � v S )N� Server ready)r� r' r� r' r( r� � r� zBUnexpected: Server ready was not found, phase %r.
Start failed: %rz,=== Error by wait fot server, log: ===
%s===r� z*No log file %s to examine details of error)rb r r8 r� r� r� r� r� r� r� r r� r r+ )r� rt �readyr� r� �retr� r' )r� r� r� r( r� � s>
�����
� z&Fail2banClientServerBase._wait_for_srvc G s* | � || jd | jdd � | | � d S )Nr r )� assertRaisesr )r� �exitTyper� r& r' r' r( r� � s �z Fail2banClientServerBase.execCmdc G s: ||� d�d }t|�}z
|�|�W |�� S |�� w )Nry r )r� r �sendrS )r� r� r& r� �sr' r' r( �
execCmdDirect� s
z&Fail2banClientServerBase.execCmdDirectc C sb t �d� d|d< z| �td| d� W d|d< d|d< t �d� d S d|d< d|d< t �d� w )Nzstart of test workerTr� )z-fFr� zend of test worker)r r+ r� r� )r� rt r� r� r' r' r( r� � s
� z-Fail2banClientServerBase._testStartForegroundr� )z[Thread]zstacksize = 128r� c C sR | � � | �t|dd� | �d� | �t|d� | �t|d� | �t|dd� d S )Nr� �threadz{'stacksize': 128}�ping�~~unknown~cmd~failed~~�echo� TEST-ECHO)r� r� r� r� r� �r� rt r� r' r' r( �testStartForeground� s
z,Fail2banClientServerBase.testStartForeground)r )TNN)rD rE rF r r� r� r� r� r� r� r� r� r� r r� r� r r' r' r' r( r� � s
r� c @ st e Zd ZeefZdd� Zdd� Zedd� �Z ee
dd� ��Z ee
d d
� ��Z ee
d d � ��Z
ed
d� �Zdd� ZdS )�Fail2banClientTestc C s, | � tttt��� | � tttt��� d S rY )r� r rb �BIN�CLIENT�SERVERr� r' r' r( �testConsistency� s z"Fail2banClientTest.testConsistencyc C s� | � tdd� | �dt � | �d� | �� | � tdd� | �t�� � | �� | � tddd� | �dtj � | �� | � tdd d
� | �d � d S ) Nr' �-h�Usage: �Report bugs to z-Vz-vqz --versionz
Fail2Ban vz --str2sec�1d12h30m�131400)r� r� r� r r� r � normVersion�versionr� r' r' r( �testClientUsage� s
z"Fail2banClientTest.testClientUsagec C sP t |d�}| �t|d� | �d� | �d� | �� | �t|d� | �d� d S )NTz-vvdz
Loading filesz['set', 'logtarget',z--dp)r� r� r� r� r� r
r' r' r( �testClientDump s
z!Fail2banClientTest.testClientDumpc C s t |d�}| �td| d� | j|d|d� | �d� | �d� z8| �t|dd� | �t|d � | �� | �td| d� | �d
� W | �� | �t|d � | �d � | �d� n| �� | �t|d � | �d � | �d� w | �� | �t|d � | �d
� | �d� d S )NT�z-br� r� r� �Exit with code 0r r r zServer already runningr� r� z Failed to access socket pathzIs fail2ban running?)r� r� r� r� r� r� r� r
r' r' r( � testClientStartBackgroundInside s.
�
z2Fail2banClientTest.testClientStartBackgroundInsidec C s� t |t|d�d�}tjjr| �t|d � n0tjtt t
�f}t � d|� || d }t
j|tddd�}| �t|�o<|d � | j|d|d
� | �d � | �� z�| �t|d d
� | �d
� | �d� | �� | �t|dd� | �d� | �� tt|d��}z t�|tj� t�t
j � | �t |dd� W t�|tj � nt�|tj � w | �d� | �� t g d�7 a | �t|d� | �d� | �dd� | �d� | �� t g d�7 a | �t|d� | �d� | �d � | �d � | �d� | �� t d d g7 a | �t|d� | �d � | �� | �t |d d!� | �d � | �d"� | �� W | �� | �t|d#� | �d � | �d� d S | �� | �t|d#� | �d � | �d� w )$Nr� �r� )r� � Start %s ...)�--asyncr� FT�r> �shell�outputr r� r� r r r r z0.1zServer replied: pongrq z1e-10z timed out)zecho INTERACT-ECHO�statusrJ z-iz
INTERACT-ECHO�StatuszNumber of jail:)�reload�restartrJ zReading config files:r� z reload ~~unknown~jail~fail~~rJ z@Failed during configuration: No section: '~~unknown~jail~fail~~'r% z~~unknown~jail~fail~~zExit with code 255r� ) r� rb r� r� �fastr� r� �sys�
executabler
r r r+ r �
executeCmdr� r� rK r� r� r� r� r� r� r� �SIGSTOPr- �sleep�DEFAULT_SHORT_INTERVALr� �SIGCONTrL )r� rt r� �cmdr� r� r' r' r( � testClientStartBackgroundCall2 sv
�
�
z0Fail2banClientTest.testClientStartBackgroundCallc C s� t |dd�}| �tdddt|d�d� | �dt|d� d � | �� | �tddt|d
�d t|d �d
� | �d� | �� tt|d �d��� | �tdddt|d
�d t|d �d� | �d� | �� t� t|d �� | �tdd � | �d� | �� d S )Nr� r r' r rx �missr� � Base configuration directory � does not existr_ ry rp r% �Could not find server�a�LFail2ban seems to be in unexpected state (not running but the socket exists)r �
r� r� r� rb r� r� rQ rS r� �remover
r' r' r( �testClientFailStart� s* ��
�
z&Fail2banClientTest.testClientFailStartc C sX t |dd�}| �t|dd� | �d� | �� | �t|dddd� | �d� | �� d S ) Nr� r r% �jailr4 r z--xxxz"Unexpected argument(s) for reload:)r� r� r� r� r� r
r' r' r( �testClientFailCommands� s �
�
z)Fail2banClientTest.testClientFailCommandsc C sn d}dD ]0}d}t |d�� }|r%|�� |r tjjs t�|� |d8 }|sW d � n1 s/w Y qd S )Ng�Q� ��?)r r � r0 r )r � heartbeatr� r� r' r- r, )r� � sleeptime�verbose�cntr�visr' r' r( �testVisualWait� s
�� ���z!Fail2banClientTest.testVisualWaitN)rD rE rF � _exec_clientr r r r r r r� r r0 r9 r; rB r' r' r' r( r � s$
T
r c @ s� e Zd ZeefZdd� Zeedd� ��Z eedd� ��Z
eedd� ��Z ed d
� �Z e
d d id
�dd� �Zejjdd�e
dddd�d
�dd� ��Zejjdd�e
ddd d d �d
�d d � ��Ze
� d!d"� �Zd(S ))�Fail2banServerTestc C s* | � tdd� | �dt � | �d� d S )Nr' r r r )r� r� r� r r� r' r' r( �testServerUsage� s z"Fail2banServerTest.testServerUsagec C s t |t|d�d�}tjttt�f}t�d|� || d }tj |t
ddd�}| � t |�o/|d � | j
|d|d � | �d
� | �� z'| �t|d d � | �t|d
� W | �� | �t|d� | �d� | �d� d S | �� | �t|d� | �d� | �d� w )Nr� r r r FTr r r� r� r r r r� r� r )r� rb r( r) r
r r r+ r r* r� r� rK r� r� r� r� r� r� �r� rt r� r/ r� r' r' r( �testServerStartBackground� s(
�
z,Fail2banServerTest.testServerStartBackgroundc
C s� t |dd�}| �tddt|d�� | �dt|d� d � | �� tt|d�d ��� | �tddt|d
�d t|d�� | �d � | �� t� t|d�� d S )
Nr� r r' rx r1 r2 r3 rp r5 r_ ry r6 r7 r
r' r' r( �testServerFailStart� s
��
z&Fail2banServerTest.testServerFailStartc C s� t |dd�}t|d�}| �d� | �t|d� | �d� tt|d�dd d
d d d � | �d
� | �t|d� | jddddd� | �d� | �t|dd� | jddddd� d S )Nr� r r_ z[test-phase 0]z--testz$OK: configuration test is successfulra r5 rP �
[broken-jail]�filter = broken-jail-filter�enabled = truez[test-phase 0a]�.Unable to read the filter 'broken-jail-filter'z Errors in jail 'broken-jail'.z ERROR: test configuration failedT�r� z[test-phase 0b]z-tr� )r� rb r� r� r� r� rX r� )r� rt r� r� r' r' r( �testServerTestFailStart� s(
�
�
�z*Fail2banServerTest.testServerTestFailStartc
s
zQt � t� d�d�}tjttt�f}t�d|� || d }tj |t
ddd�}| � t |�o0|d � | j
� d|d � | �d
� | �� t�d � � W | � t� �� n| � t� �� w t�� fd d
�t
� | �tt� d��� | �d� | �� | � t� �� | �d� d S )NzGf2b.log[format="SRV: %(relativeCreated)3d | %(message)s", datetime=off]r r r FTr r r� r� zKill server ... %sc s t t� d�� S )Nrq )r rb r' �rt r' r( r� - r� z7Fail2banServerTest.testKillAfterStart.<locals>.<lambda>rq r� zcleanup: no pidfile for)r� rb r( r) r
r r r+ r r* r� r� rK r� r� r� r� r8 � assertFalser rF r' rO r( �testKillAfterStart s( �
z%Fail2banServerTest.testKillAfterStartr� r` r� c s�
t |d�� t |d��t |d��t |d��t�t � d�� dȇ fd d
� }dɇ ���fdd� }|dd� |dd� |dgg d�d� tt � d�dddddd� t�dgttt�� ��d fd �R � t�d� t�d� | �d � t j
j t j
k r}t�� | �t|d � | jd d dtd!� | �d"� � | �d#� | jd$d%dd&� | jd'd(dtd!� | jd)d*d+dd&� | �d,� |dd-gd.� t�d/� t j
j t j
k r�t�� | �t|d � | jd td0� | jd1d#dd&� | jd"� d"� dd&� | jd2d3dd&� | jd4d5dd&� | jd6d7dd&� | �d8� | �d9� |dgd.� |dd:d d;d d<d d=� | �t|d � | jd td0� | jd1d#dd&� | �d>� | jd2d?dd&� | �d@� | �dA� | �dB� |ddCdD� |d-d gd.� | �dE� t�d/gttt�� ��dF fd ttt�� ��dG fd ttt�� ��dH fd ttt�� ��dI fd �R � t j
j t j
k �r�t�� | jdJdKdtd!� | �t|dLdMdNdO� | jdPtd0� | jdQdRdSdTdUdVdWdd&� | jdXdYdZd[dd&� t� | �| �|d\�d]d^g d_�idMg d`�igf� | �| �|d\dadbdc�d]d^gd^dMgg gf� | �| �|ddd^d\�d g d_�� | �| �|dddMd\�d g d`�� | �| �|ddd^d\de�d d� | �| �|ddd^d\dO�d d]� | �| �|ddd^d\dedO�d dd]g� t�d/� t�d/� | �df� | �t|dgdM� | jd dhdPdtd!� | jdidjdkdld5dmdndodd&� | jdpdqdtd!� | jdrdsdd&� | �dt� | �t|dLdMdNdu� | �t|dLdMdNdv� | jdwdxdtd!� t� | �dy� | �t|dddMdNdz� | jdbd{dudvdtd!� | �d|� | �t|ddd^dN� | jdad}dedbd{dtd!� | �d~� | �t|dgddM� | jd d5dtd!� | jdld5didjdkdd&� | jd�d�dd&� | �d�� | jd�d�dd&� | jdUdVdd&� |ddCdD� |g d.� | �d�� | �t|d d^� | jd td0� | jd�d�dd&� | jd�d�d�dd&� | �d�� |dgd�� | �t|d � | jd td0� | �d�� | jd�dldd&� | jd�� d�� dd&� | �d�� t�d/gttt�� ��d� fd ttt�� ��d� fd ttt�� ��d� fd �R � t j
j t j
k �r�t�� | jd�d�dtd!� | jd�d�d�d�dd&� | �d�� | �d�� | �t|d�d�d�d�� | jd�d�dtd!� | �d�� | �t|d�d�d�� | jd�d�dtd!� | �t|d�d�d�d�� | jd�d�dtd!� | �d�� | �t|d�dLd^dNd�d�� | jd�d�dtd!� | �t|d�dLd^d�d�� | jd�d�dtd!� | �d�� | �t|d d� | jd td0� | jd�d1d�dd&� | jd�d�d#dSdd&� | �d�� | �t|d�d�d�� | jd�d�dd&� | �d�� |dgd�d�� | �t|d � | jd td0� | jd�d�dd&� | �d�� |dgd�� | �t|d � | jd td0� | �d�� | �t|d�d dM� | jd td0� | �d�� | �� | �t|d�d d�dM� | jd td0� | jd4d5dd&� | �d�� | �t|d�d d�d�� | jd td0� | jd�d�dtd!� | �dá | �t|d�dLd^d�d�dơ | �t|d�ddd^dǡ | jd�d�dd&� d S )�Nr_ � test1.logz test2.logz test3.logrj � test-action1TrP c sn t � dd| �}|st�|� d S t|ddddddd d
d d |d
|d|d|d|� tjjtjkr5t |� d S d S )Nrj �%s.confrm rs z_exec_once = 0rP rn znorestored = %(_exec_once)sz
restore = zinfo = z<_use_flush_ = echo '[%(name)s] %(actname)s: -- flushing IPs'z6actionstart = echo '[%(name)s] %(actname)s: ** start'z7actionreload = echo '[%(name)s] %(actname)s: .. reload'zMactionban = echo '[%(name)s] %(actname)s: ++ ban <ip> %(restore)s%(info)s'z;actionunban = echo '[%(name)s] %(actname)s: -- unban <ip>'z5actionstop = echo '[%(name)s] %(actname)s: __ stop')
rb r� r8 rX r� r� r� r r� r� )�actname�allowr� r% �ban�unbanr� rT �r� r' r( �_write_action_cfgE s,
� �zBFail2banServerTest.testServerReloadTest.<locals>._write_action_cfg�r r r' �pollingc sP t g t� d��d�d�d�d�d�d�d�d�d �d
�d �d�d �d
| �d�d�d|v r/dnd�d|v r7dnd�d|v r?dnd�d� �d| v rMd� nd�d| v rWd� nd�d �d| v radnd�d| v ridnd�d�d�d
| �d�d�d|v r}dnd�d|v r�dnd�d� �d| v r�dnd�R � tjjtjkr�tt� d�� d S d S )Nra rm rr rP rs � usedns = no� maxretry = 3zfindtime = 10mzBfailregex = ^\s*failure <F-ERRCODE>401|403</F-ERRCODE> from <HOST>� datepattern = {^LN-BEG}EPOCHzignoreip = 127.0.0.1/8 ::1� [test-jail1]�
backend = �filter =z action = r z* test-action1[name='%(__name__)s']r zj test-action2[name='%(__name__)s', restore='restored: <restored>', info=', err-code: <F-ERRCODE>']� z� test-action2[name='%(__name__)s', actname=test-action3, _exec_once=1, restore='restored: <restored>', actionflush=<_use_flush_>]�
logpath = z
z@ ^\s*error <F-ERRCODE>401|403</F-ERRCODE> from <HOST>rK z [test-jail2]�rX rb r� r� r� r r� r� )�enabled�actions�backend�r� �test1log�test2log�test3logr' r( �_write_jail_cfg] s� ���������� �
�
�
� �
����������������� � ��!��"�#�%�z@Fail2banServerTest.testServerReloadTest.<locals>._write_jail_cfg)rU � test-action2r )r r rc )rf rg ra r5 rI rJ rK rm z# failure 401 from 192.0.2.1: test 1rc z[test-phase 1a]r% �Reload finished.z1 ticket(s) in 'test-jail1r� zAdded logfile: %rz[test-jail1] Ban 192.0.2.1z-stdout: '[test-jail1] test-action1: ** start'z-stdout: '[test-jail1] test-action2: ** start'rM zPstdout: '[test-jail1] test-action2: ++ ban 192.0.2.1 restored: 0, err-code: 401'zAstdout: '[test-jail1] test-action3: ++ ban 192.0.2.1 restored: 0'rL z)Errors in jail 'broken-jail'. Skipping...z:Jail 'broken-jail' skipped, because of wrong configurationz[test-phase 1b]r )rg �w+�r� z [test-jail1] Unban 192.0.2.1z.stdout: '[test-jail1] test-action1: .. reload'z.stdout: '[test-jail1] test-action2: .. reload'z Creating new jail 'test-jail2'zJail 'test-jail2' startedz4stdout: '[test-jail1] test-action3: -- flushing IPs'z,stdout: '[test-jail1] test-action3: __ stop'z7stdout: '[test-jail1] test-action3: -- unban 192.0.2.1'z[test-phase 2a]z+ echo '[<name>] %s: started.'z, echo '[<name>] %s: reloaded.'z+ echo '[<name>] %s: stopped.')rU r� r% r� zAdded logfile:z.stdout: '[test-jail1] test-action1: reloaded.'z7stdout: '[test-jail1] test-action2: -- unban 192.0.2.1'z,stdout: '[test-jail1] test-action2: __ stop'z7stdout: '[test-jail1] test-action1: -- unban 192.0.2.1'F)rU rV z[test-phase 2b]z# error 403 from 192.0.2.2: test 2z# error 403 from 192.0.2.3: test 2z# failure 401 from 192.0.2.4: test 2z# failure 401 from 192.0.2.8: test 2z2 ticket(s) in 'test-jail2z5 ticket(s) in 'test-jail1�setz
test-jail2�banip� 192.0.2.9z3 ticket(s) in 'test-jail2z[test-jail1] Ban 192.0.2.2z[test-jail1] Ban 192.0.2.3z[test-jail1] Ban 192.0.2.4z[test-jail1] Ban 192.0.2.8z[test-jail2] Ban 192.0.2.4z[test-jail2] Ban 192.0.2.8z[test-jail2] Ban 192.0.2.9z [test-jail2] Found 192.0.2.2z[test-jail2] Ban 192.0.2.2z [test-jail2] Found 192.0.2.3z[test-jail2] Ban 192.0.2.3�bannedr �
test-jail1)� 192.0.2.4� 192.0.2.1� 192.0.2.8� 192.0.2.3� 192.0.2.2)rw rt ry rx rw z 192.0.2.222r� rz z[test-phase 2c]r& z Restore Banz [test-jail2] Unban 192.0.2.4z [test-jail2] Unban 192.0.2.8z [test-jail2] Unban 192.0.2.9zJail 'test-jail2' stoppedz"[test-jail2] Restore Ban 192.0.2.4z"[test-jail2] Restore Ban 192.0.2.8z"[test-jail2] Restore Ban 192.0.2.9zPstdout: '[test-jail2] test-action2: ++ ban 192.0.2.4 restored: 1, err-code: 401'zPstdout: '[test-jail2] test-action2: ++ ban 192.0.2.8 restored: 1, err-code: 401'zAstdout: '[test-jail2] test-action3: ++ ban 192.0.2.4 restored: 1'zAstdout: '[test-jail2] test-action3: ++ ban 192.0.2.8 restored: 1'z[test-phase 2d]z
192.0.2.21z
192.0.2.22z5stdout: '[test-jail2] test-action3: ++ ban 192.0.2.22z6stdout: '[test-jail2] test-action3: ++ ban 192.0.2.22 z[test-phase 2d.1]rO ry z[test-phase 2d.2]r{ z[test-phase 2e]z--unbanz7stdout: '[test-jail2] test-action2: -- unban 192.0.2.21z8stdout: '[test-jail2] test-action2: -- unban 192.0.2.22'z4stdout: '[test-jail2] test-action3: -- flushing IPs'z8stdout: '[test-jail2] test-action3: -- unban 192.0.2.21'z8stdout: '[test-jail2] test-action3: -- unban 192.0.2.22'z[test-phase 3]zReload jail 'test-jail1'zJail 'test-jail1' reloadedzReload jail 'test-jail2'zJail 'test-jail2' reloadedzJail 'test-jail1' startedz[test-phase 4])rf zStopping jail 'test-jail2'zRemoved logfile: %rz[test-phase 5]z# failure 401 from 192.0.2.1: test 5z# error 403 from 192.0.2.5: test 5z# failure 401 from 192.0.2.6: test 5z6 ticket(s) in 'test-jail1z%[test-jail1] 192.0.2.1 already bannedz [test-jail1] Found 192.0.2.1z [test-jail1] Found 192.0.2.6z[test-jail1] Ban 192.0.2.6z [test-jail1] Found 192.0.2.5z[test-phase 6a]r rX z 192.0.2.5z 192.0.2.6z192.0.2.5 is not bannedz [test-jail1] Unban 192.0.2.6z[test-phase 6b]z 192.0.2.2/31z [test-jail1] Unban 192.0.2.2z [test-jail1] Unban 192.0.2.3z 192.0.2.8/31z192.0.2.100/31z [test-jail1] Unban 192.0.2.8z 192.0.2.100/31 is not bannedz[test-phase 6c]z
192.0.2.96/28z192.0.2.112/28z [test-jail1] Ban 192.0.2.96/28z [test-jail1] Ban 192.0.2.112/28�unbanipz
192.0.2.64/26z [test-jail1] Unban 192.0.2.96/28z![test-jail1] Unban 192.0.2.112/28z[test-phase 7]z [test-jail1] Unban 192.0.2.4zJail 'test-jail1' stoppedz[test-phase 7b]�--allzFlush ban listz'Unbanned 0, 0 ticket(s) in 'test-jail1'z[test-phase 8a]zxxx-unknown-backend-zzz)rf rh z0Restart jail 'test-jail1' (reason: 'polling' != zUnknown backend z[test-phase 8b]z[test-phase end-1]z$the jail 'test-jail2' does not existz --if-existsz[test-phase end-2]� --restartz[test-phase end-3]� addignoreipz 192.0.2.1/32z2001:DB8::1/96�ignoreip)rS TrP rP rP rP rP )r[ r' r\ )rb r� r� rX r� r� r r- r� r� r� r� r r� r� r� r� r� r4 �assertNotLoggedr6 �assertSortedEqualr � assertEqualr� )r� rt r� rZ rm r' ri r( �testServerReloadTest5 sZ
�
*
�(
�
���
������
��
����
�������� �
�
��
� ��
���
���
���
���
���
��� ��
���
�
�
�������
��
���
�����
��
����
��
��
���
��
�
�
��
��
��z'Fail2banServerTest.testServerReloadTestznginx-block-map)�action)�%(tmp)s/blck-failures.log)rj ) z[nginx-blck-lst]rl r] z#logpath = %(tmp)s/blck-failures.logzRaction = nginx-block-map[blck_lst_reload="", blck_lst_file="%(tmp)s/blck-lst.map"]z� blocklist_de[actionban='curl() { echo "*** curl" "$*";}; <Definition/actionban>', email="Fail2Ban <fail2ban@localhost>", apikey="TEST-API-KEY", agent="fail2ban-test-agent", service=<name>]rb �datepattern = ^Epochz3failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>z maxretry = 1rK )r� r� r� c C s� t |d�}dd|i }dd|i }t|dttt�� ��d ttt�� ��d ttt�� ��d ttt�� ��d ttt�� ��d
� | jd d d
ddddtd� t|� t |�}| �
d|� | �
d|� | �
d|� | �
d|� | �
d|� | jdddtd� | � t |ddd d � t|� t |�}| �
d|� | �
d|� | �
d|� | �
d|� | �
d|� | �t � | �d � t|� t |�}| �|d � d S ) Nr_ r� rt z%(tmp)s/blck-lst.maprp z" failure "125-000-001" - 192.0.2.1z" failure "125-000-002" - 192.0.2.1u1 failure "125-000-003" - 192.0.2.1 (òðåòèé)u1 failure "125-000-004" - 192.0.2.1 (òðåòèé)z" failure "125-000-005" - 192.0.2.1z [nginx-blck-lst] Ban 125-000-001z [nginx-blck-lst] Ban 125-000-002z [nginx-blck-lst] Ban 125-000-003z [nginx-blck-lst] Ban 125-000-004z [nginx-blck-lst] Ban 125-000-005z 5 ticket(s)Tr� z\125-000-001 1;
z\125-000-002 1;
z\125-000-003 1;
z\125-000-004 1;
z\125-000-005 1;
z�stdout: '*** curl --fail --data-urlencode server=Fail2Ban <fail2ban@localhost> --data apikey=TEST-API-KEY --data service=nginx-blck-lst z=stdout: ' --data format=text --user-agent fail2ban-test-agentrX z 125-000-001z 125-000-002z 125-000-005z5[nginx-blck-lst] Flush ticket(s) with nginx-block-maprP )rb rX r� r� r r- r� r4 r� r[ �assertInr� r� � assertNotInr� r� )r� rt r� r� �lgfn�mpfn�mpr' r' r( � testServerActions_NginxBlockMap' sX
�� �
z2Fail2banServerTest.testServerActions_NginxBlockMapz
sendmail-auth)�filter)�%(tmp)s/test.logT)rs zdbmaxmatches = 1)z�test_action = dummy[actionstart_on_demand=1, init="start: %(__name__)s", target="%(tmp)s/test.txt",
actionban='<known/actionban>;
echo "<matches>"; printf "=====\n%%b\n=====\n\n" "<matches>" >> <target>']z[sendmail-auth]rl r] �logpath = %(tmp)s/test.log�action = %(test_action)sz%filter = sendmail-auth[logtype=short]r� r^ zmaxmatches = 2rK z[sendmail-reject]rl r] r� r� z'filter = sendmail-reject[logtype=short]r� r^ rK )r� r� r� r� c
C s` t |d�}dd|i }dd|i }ttt�� ��d ttt�� ��d ttt�� ��d f}ttt�� ��d ttt�� ��d ttt�� ��d
f}| �d � t|d g|�R � | jd
ddtd� t |� t
|�}|d } | � | |� |dd � D ]} | � | |� qz| �d� t|d g|�R � | jdddtd� t |� t
|�}|D ]} | � | |� q�| �d� | �
t|ddd� | jddddtd� t
|�}|d } | �| � | � | |� |dd � D ]
} | �| � | � | |� q�| jd ddtd� t
|�}|d } | �| � | � | |� |dd � D ]} | �| � | � | |� �q| �d � | �t� | �t|�� d S ) Nr_ r� rt z%(tmp)s/test.txtz] smtp1 sm-mta[5133]: s1000000000001: [192.0.2.1]: possible SMTP attack: command=AUTH, count=1z] smtp1 sm-mta[5133]: s1000000000002: [192.0.2.1]: possible SMTP attack: command=AUTH, count=2z] smtp1 sm-mta[5133]: s1000000000003: [192.0.2.1]: possible SMTP attack: command=AUTH, count=3z� smtp1 sm-mta[21134]: s2000000000001: ruleset=check_rcpt, arg1=<123@example.com>, relay=xxx.dynamic.example.com [192.0.2.2], reject=550 5.7.1 <123@example.com>... Relaying denied. Proper authentication required.z� smtp1 sm-mta[21134]: s2000000000002: ruleset=check_rcpt, arg1=<345@example.com>, relay=xxx.dynamic.example.com [192.0.2.2], reject=550 5.7.1 <345@example.com>... Relaying denied. Proper authentication required.z� smtp1 sm-mta[21134]: s3000000000003: ruleset=check_rcpt, arg1=<567@example.com>, relay=xxx.dynamic.example.com [192.0.2.2], reject=550 5.7.1 <567@example.com>... Relaying denied. Proper authentication required.z[test-phase sendmail-auth]rp z [sendmail-auth] Ban 192.0.2.1z 1 ticket(s) in 'sendmail-auth'Tr� r r z [test-phase sendmail-reject]z [sendmail-reject] Ban 192.0.2.2z 1 ticket(s) in 'sendmail-reject'z [test-phase restart sendmail-*]r% r~ r} ro z%[sendmail-auth] Restore Ban 192.0.2.1r� z'[sendmail-reject] Restore Ban 192.0.2.2z[test-phase stop server])rb r� r� r r- r� rX r� r4 r� r[ r� r� r� r� r� r� rP r )
r� rt r� r� r� �tofn� smaut_msg� smrej_msg�td�mr' r' r( �testServerJails_Sendmailw sv
( ��
�
�
��
�
z+Fail2banServerTest.testServerJails_Sendmailc s� t |d��t |d��t�t �d�� d=�fdd� }d>��fd d
� }|dd d � |d
dd � |� t�d� | �d� | �t|d� t�dgttt �
� ��d fd �R � t � | j dddt
d� t � | �d� td� t � | j ddddt
d� t � | �d � d �t�fd d �� t�dgttt �
� ��d fd �R � | j d!d"dt
d� | �d#� | �t|d$d%d&d'� | j d(d)dt
d� d�t � | �d*� td+� t � | j d,dt
d� t � | �d-� | �t|d$d%d&d'� | j d(d.dt
d� | �d/� t� d0d1i� tj�� �fd2d3�}��d4|� ��d4d5d � � t�� fd6d �t� �j�tjj�r-d7nd8df�fd9d:� }|�_| �t� | � d;� | � �j � | � �j d � d � d0< | j d;dd<� ��!� d S )?Nr_ rR rj rS Tc sL t � dd| �}t|ddddd|rdndd � tjjtjkr$t|� d S d S )
Nrj rT rm rs rP rn zeactionban = printf %%s "[%(name)s] %(actname)s: ++ ban <ip> -c <bancount> -t <bantime> : <F-MSG>"ziactionprolong = printf %%s "[%(name)s] %(actname)s: ++ prolong <ip> -c <bancount> -t <bantime> : <F-MSG>"zBactionunban = printf %%b '[%(name)s] %(actname)s: -- unban <ip>')rb rX r� r� r� r r� r� )rU �prolongrT rY r' r( rZ � s �� �z@Fail2banServerTest.testServerObserver.<locals>._write_action_cfgr\ c sd t t� d�ddddddddd d
d dd d
| dddd� ddd� tjjtjkr0tt� d�� d S d S )Nra rm rr rP rs r] r^ z
findtime = 1mz bantime = 5mzbantime.increment = truer_ r` ra rb z*action = test-action1[name='%(__name__)s']z* test-action2[name='%(__name__)s']rd zXfailregex = ^\s*failure <F-ERRCODE>401|403</F-ERRCODE> from <HOST>:\s*<F-MSG>.*</F-MSG>$rK re )rh )r� rj r' r( rm � s*
��z>Fail2banServerTest.testServerObserver.<locals>._write_jail_cfgF)rU r� rn rm z[test-phase 0) time-0]r% rp z> failure 401 from 192.0.2.11: I'm bad "hacker" `` $(echo test)rc zDstdout: '[test-jail1] test-action1: ++ ban 192.0.2.11 -c 1 -t 300 : zDstdout: '[test-jail1] test-action2: ++ ban 192.0.2.11 -c 1 -t 300 : r� z[test-phase 1) time+10m]�
z7stdout: '[test-jail1] test-action1: -- unban 192.0.2.11z7stdout: '[test-jail1] test-action2: -- unban 192.0.2.11z0 ticket(s) in 'test-jail1'z[test-phase 2) time+10m]c s � S rY r' r' )�wakeObsr' r( r� 9 r� z7Fail2banServerTest.testServerObserver.<locals>.<lambda>zC failure 401 from 192.0.2.11: I'm very bad "hacker" `` $(echo test)r zDstdout: '[test-jail1] test-action1: ++ ban 192.0.2.11 -c 2 -t 300 : zDstdout: '[test-jail1] test-action2: ++ ban 192.0.2.11 -c 2 -t 300 : z"[test-phase 2) time+10m - get-ips]r� rv rs z --with-timez
192.0.2.11z+ 300 =z[test-phase 2) time+11m]r zHstdout: '[test-jail1] test-action2: ++ prolong 192.0.2.11 -c 2 -t 600 : z"[test-phase 2) time+11m - get-ips]z+ 600 =z'[test-phase end) stop on busy observer]�stater c s< t �d� d� d< t�� fdd�t� ��� t �d� d S )Nz!++ observer enters busy state ...r r� c � � d dkS )Nr� r r' r' �r5 r' r( r� e r� zMFail2banServerTest.testServerObserver.<locals>._long_action.<locals>.<lambda>z -- observer leaves busy state.)r r$ r r8 r� �db_purger' )r5 �obsMainr' r( � _long_actionb s
z;Fail2banServerTest.testServerObserver.<locals>._long_action�callc S r� rY r' r' r' r' r( r� i r� c r� )Nr� r r' r' r� r' r( r� k r� g{�G�z�?g�������?c s
� | |�S rY r' )�wtime� forceQuit)� obsMain_stopr' r( �_stopn s
z4Fail2banServerTest.testServerObserver.<locals>._stopzobserver leaves busy staterq )rS T)r\ )"rb r� r� rX r� r� r� r� r� r r- r6 r� r4 r/ r@ r! r1 r2 �addr r8 r� r� r� r� r' r� r� rP �idler� �_ObserverThread__dbr )r� rt r� rZ rm r� r� r' )r5 r� r� r� rj r� r( �testServerObserver� s�
��
�
��
�
�
�
z%Fail2banServerTest.testServerObserverFc C s | � t� d S rY )r� r� r
r' r' r( �_testServerStartStop~ s z'Fail2banServerTest._testServerStartStopc C s t d�D ]}| �� qd S )Ni� )�ranger� )r� �ir' r' r( �testServerStartStop� s
�z&Fail2banServerTest.testServerStartStopN)rD rE rF � _exec_serverr r rE r r� rG rH rN rQ r� r� r� r� �skip_if_cfg_missingr� r� r� r� r� r' r' r' r( rD � sL
t� :� &L
rD )FNr\ r] r' r^ N)`�
__author__�
__copyright__� __license__r� r� r~ r( r- r� r� �os.pathr rb r r r r � functoolsr � threadingr
�clientr r
r �client.fail2bancmdliner �client.fail2banclientr rC r r �client.fail2banserverr r� rP r r �
server.mytimer � server.utilsr �utilsr r r� r r r r r r| r r! �helpersr" rD r r �
getServerPathr
r� � maxWaitTimer� r4 r� r� r� r� r) r" r/ r1 r6 r@ rB rI r� r� rL rN �
input_command�
PRODUCTION�dumpFiler� rX r[ r� r� r� r� r� r� r� r rD r' r' r' r( �<module> s� ,
��� �
�W
, Fh U