File: //lib/python3.9/site-packages/fail2ban/tests/__pycache__/servertestcase.cpython-39.pyc
a
UJ �Y�VY� @ s� d Z dZdZddlZddlZddlZddlZddlZddlZddl Z ddl
m Z m Z m
Z
ddlmZ ddlmZ dd lmZmZ dd
lmZ dd lmZ dd lmZ dd
l m Z ddl m Z ddl m!Z!m"Z"m#Z# ddl$m%Z%m&Z&m'Z' ddl(m)Z) zddlm*Z* W n e+�y dZ*Y n0 ej,�-ej,�.e/�d�Z0dZ1e%d�Z2G dd� de�Z3G dd� de!�Z4G dd � d e4�Z5G d d � d e4�Z6G d d � d ej7�Z8G d!d"� d"ej7�Z9G d#d$� d$e�Z:G d%d&� d&e!�Z;dd'l<m=Z=m>Z>m?Z? G d(d)� d)e!�Z@dS )*z
Cyril Jaquierz Copyright (c) 2004 Cyril Jaquier�GPL� N� )�Regex� FailRegex�RegexException)�actions)�Server)�DNSUtils�IPAddr)�Jail)�
JailThread)� BanTicket)�Utils� )� DummyJail)�LogCaptureTestCase�
with_alt_time�MyTime)� getLogger�extractOptions�
PREFER_ENC)�version)�
filtersystemd�files�polling�fail2banc @ s e Zd Zdd� Zdd� ZdS )�
TestServerc O s d S �N� ��self�args�kwargsr r �A/usr/lib/python3.9/site-packages/fail2ban/tests/servertestcase.py� setLogLevel< s zTestServer.setLogLevelc O s d S r r r r r r# � setLogTarget? s zTestServer.setLogTargetN)�__name__�
__module__� __qualname__r$ r% r r r r# r ; s r c sP e Zd ZeZ� fdd�Z� fdd�Zdd d
�Zdd d �Zd
d� Z dd� Z
� Z S )�TransmitterBasec s< t t| ��� | �� | _| jj| _d| _| j�| jt � dS )� Call before every test case.� TestJail1N)
�superr) �setUp�TEST_SRV_CLASS�server�_Server__transm�transm�jailName�addJail� FAST_BACKEND�r �� __class__r r# r- G s
zTransmitterBase.setUpc s | j �� tt| ��� dS �zCall after every test case.N)r/ �quitr, r) �tearDownr5 r6 r r# r: Q s
zTransmitterBase.tearDownr r NFc
s� d||g}d|g}|dur2|� d|� |� d|� |dkr>|}� fdd�} | �| | j�|��| ||f�� |s�| �| | j�|��| d|f�� dS ) zoProcess set/get commands and compare both return values
with outValue if it was given otherwise with inValue�set�getNr r c s � r t | �S | S )z Prepare value for comparison)�repr��x��repr_r r# �vd s z%TransmitterBase.setGetTest.<locals>.vr )�insert� assertEqualr1 �proceed)
r �cmd�inValue�outValue�outCode�jailrA �setCmd�getCmdrB r r@ r# �
setGetTestW s
zTransmitterBase.setGetTestc C sv d||g}d|g}|d ur2|� d|� |� d|� | j�|�d }| �| j�|�d d� | �| j�|�d|f� d S )Nr; r< r r )rC r1 rE rD )r rF rG rJ rK rL Z initValuer r r# �
setGetTestNOKm s
z TransmitterBase.setGetTestNOKc C s� d| }d| }| � | j�d||g�dg f� t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� q6t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt||d d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt||d d � ��fdd� q�d S ) N�add�delr< r r; r r )�level)rD r1 rE � enumerate�assertSortedEqual�list�map�str) r rF �valuesrJ �cmdAdd�cmdDel�n�value�retr r r# �jailAddDelTestz s �@B@z TransmitterBase.jailAddDelTestc C s d| }d| }| � | j�d||g�dg f� t|�D ]^\}}| � | j�d|||g�d|d |d � f� | � | j�d||g�d|d |d � f� q6t|�D ]^\}}| � | j�d||dg�d||d d � f� | � | j�d||g�d||d d � f� q�d S )NrO rP r< r r; r )rD r1 rE rR ) r rF ZinValuesZ outValuesrJ rX rY rZ r[ r r r# �jailAddDelRegexTest� s. �����z#TransmitterBase.jailAddDelRegexTest)r r NF)N) r& r' r( r r. r- r: rM rN r] r^ �
__classcell__r r r6 r# r) C s
r) c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zed%d&� �Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z!d=d>� Z"d?d@� Z#dAdBdCdDg fgfdEdFdGdHg fgfgZ$dIdJ� Z%dKdL� Z&dMdN� Z'dOdP� Z(dQdR� Z)dSdT� Z*dUdV� Z+dWdX� Z,dYdZ� Z-d[d\� Z.d]d^� Z/d_d`� Z0dadb� Z1dcS )d� Transmitterc C s | � | j�� � d S r )� assertFalser/ � isStartedr5 r r r# �testServerIsNotStarted� s z"Transmitter.testServerIsNotStartedc C s | � | j�dg�d� d S )N�stop�r N�rD r1 rE r5 r r r# �testStopServer� s zTransmitter.testStopServerc C s | � | j�dg�d� d S )NZping)r Zpongrf r5 r r r# �testPing� s zTransmitter.testPingc C s | � | j�dg�dtjf� d S )Nr r )rD r1 rE r r5 r r r# � testVersion� s zTransmitter.testVersionc C s� z�| � | j�g d��d� | �t�� � | �d� | �� | � | j�g d��d� | �t�� � | �d� | �� W | � | j�g d��d� | �d � | �� n,| � | j�g d��d� | �d � | �� 0 d S )
N)r; � allowipv6�yes)r rk z
IPv6 is on)r; rj �no�r rl z IPv6 is off)r; rj �auto)r rn z IPv6 is auto) rD r1 rE �
assertTruer Z
IPv6IsAllowed� assertLogged�pruneLogra r5 r r r# � testSetIPv6� s �zTransmitter.testSetIPv6c C s| t jjs`t�� }| �| j�ddg�d� t�� }|| }| jd| k oNdk n d| d� n| �| j�ddg�d� d S ) N�sleepz0.1re g
ףp=
�?g�������?zSleep was %g sec)�msgz0.0001)�unittest�F2B�fast�timerD r1 rE ro )r �t0�t1�dtr r r# � testSleep� s (zTransmitter.testSleepc C s� t jjst�dd�\}}nd}| �d|� | j�| j� | � d|� | � d|� | � ddd� | �dd� | � d d
d � | �d d� | j�
| jt � | � d|� | j�| j� | � | j
�g d ��d
� | � | j
�ddg�d
� | � | j
�g d��d
� | � | j
�ddg�d
� | � | j
�g d��d
� | � | j
�dd g�d
� | j�
| jt � | � | j
�g d ��d
� t jj�s�t�|� t�|� d S )Nz.dbZ fail2ban_z:memory:�dbfile� dbmaxmatches�100�d ZLIZARD�
dbpurgeage�600�X )r; r} �Nonere r< )r; r~ r )r; r� �500)ru rv Z memory_db�tempfile�mkstemprN r/ ZdelJailr2 rM r3 r4 rD r1 rE �os�close�unlink)r �tmpZ tmpFilenamer r r# � testDatabase� sj
��
��
��
��
��
��
��
zTransmitter.testDatabasec C s� d}d}d}| � | j�d|dg�d|f� | � | j�d|g�d|f� | � | j�d|dg�d d� | � | j�d|d g�d|f� | � | j�d| jdg�d d� | � | j�g d
��d d� d S ) N� TestJail2� TestJail3Z TestJail4rO r r zinvalid backendr rn )rO �--allr �rD r1 rE r2 )r Zjail2Zjail3Zjail4r r r# � testAddJail� s& � ����zTransmitter.testAddJailc sp � � � j�d� jg�d� t�tj� � �t� � fdd�d�� � � � j�d� jg�d� � �
� j� j j � d S )N�startre c s& � j �d�o$t� j�d� jg�t� S )Nr �status�r/ ZisAlive�
isinstancer1 rE r2 � RuntimeErrorr r5 r r# �<lambda> � z/Transmitter.testStartStopJail.<locals>.<lambda>� rd )
rD r1 rE r2 rx rs r �DEFAULT_SLEEP_TIMEro �wait_for� assertNotInr/ �_Server__jailsr5 r r5 r# �testStartStopJail s �
��z Transmitter.testStartStopJailc s� � j �dt� � �� j�d� jg�d� � �� j�ddg�d� t�t j
� � � t � � fdd�d�� � �� j�ddg�d� � � t � � fd d�d�� � �
� j� j j� � �
d� j j� d S )
Nr� r� re c s& � j �d�o$t� j�d� jg�t� S )Nr r� r� r r5 r r# r� " r� z2Transmitter.testStartStopAllJail.<locals>.<lambda>r� rd r� c s t � jj� S r )�lenr/ r� r r5 r r# r� % r� )r/ r3 r4 rD r1 rE r2 rx rs r r� ro r� r� r� r5 r r5 r# �testStartStopAllJail s ��
�z Transmitter.testStartStopAllJailc C sb | � | j�d| jddg�d� | � | j�d| jddg�d� | � | j�d| jddg�d d � d S )
Nr; Zidle�on�r T�off�r FZCATr r r� r5 r r r# � testJailIdle) s ���zTransmitter.testJailIdlec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZfindtimeZ120�x �rJ Z60�< Z30m� z-60i���ZDog�rM r2 rN r5 r r r# �testJailFindTime4 s
z Transmitter.testJailFindTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZbantimer� r� r� Z50�2 z-50i���z
15d 5h 30mi� ZCatr� r5 r r r# �testJailBanTime; s
zTransmitter.testJailBanTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZ datepattern�%%%Y%m%d%H%M%S)r� z %YearMonthDay24hourMinuteSecondr� �Epoch)Nr� z^Epoch)Nz{^LN-BEG}Epoch�TAI64N)Nr� z
%Cat%a%%%gr� r5 r r r# �testDatePatternB s �
�
�
�zTransmitter.testDatePatternc C s* | j ddd| jd� | jdd| jd� d S )NZ logtimezonezUTC+0400r� znot-a-time-zoner� r5 r r r# �testLogTimeZoneN s zTransmitter.testLogTimeZonec C s\ | j dd| jd� | j dd| jd� | j dd| jd� d}| �| j�d| jd|g�d� d S ) NZusednsrk r� �warnrl ZFishr; rm )rM r2 rD r1 rE �r r[ r r r# �testJailUseDNSR s �zTransmitter.testJailUseDNSc C s | j �| j� | �| j�d| jddddg�d� | jddddd � | �| j�d| jdd
g�d � | jd dd
� | �| j�d| jdddddg�d� | jddddd � | jddddd � | �� | �| j�d| jdddg�d d� | �| j�d| jdddg�d� | jddddd � d S )Nr; �banip� 192.0.2.1� 192.0.2.2)r r �
Ban 192.0.2.1�
Ban 192.0.2.2T��all�waitZBadger�r r z
Ban Badger�r� �unbanipz 192.0.2.255z 192.0.2.254zUnban 192.0.2.1zUnban 192.0.2.2z192.0.2.255 is not bannedz192.0.2.254 is not bannedz--report-absentr r �r r )r/ � startJailr2 rD r1 rE rp rq r5 r r r# �
testJailBanIP] sF ���������zTransmitter.testJailBanIPc s� � j �� j� � fdd�}� jddd� jd� dD ]&}dD ] }� �||d | g�d
� q:q2� jd d d
d
d� � �||dd� dD ��d
� � jdd
d� � jdd
d� � �d� d S )Nc s � j �d� jd| g| �S )Nr; �attempt)r1 rE r2 )�ip�matchesr5 r r# r� } s z.Transmitter.testJailAttemptIP.<locals>.attempt�maxretry�5� r� )r r )r� r� �test failure %dr� z 192.0.2.1:2z 192.0.2.2:2Tr� c S s g | ] }d | �qS )r� r )�.0�ir r r# �
<listcomp>� r� z1Transmitter.testJailAttemptIP.<locals>.<listcomp>)r� � r� z 192.0.2.2:5r� r� r� )r/ r� r2 rM rD rp �assertNotLogged)r r� r� r� r r5 r# �testJailAttemptIPz s z Transmitter.testJailAttemptIPc s� d}� j �|t� � j �|� d d dg f� fdd� }||g d� ||dddgd � ||d
ddd gd � ||d g d
�d� ||dd
d gd� ||d d
gd� ||d
g d� d S )NZTestJailBanListr c s� |d ur6� � � j�d| d|g�d� � jd| dd� |d url� � � j�d| d|g�d� � jd| dd� � j� j�d | dgt|� �d
|fd d � t�t�� d
� d S )Nr; r� r� zBan %sTr� r� zUnban %sr< r F)Z
nestedOnlyr ) rD r1 rE rp rS rT r ZsetTimerx )rJ r� r� r! �outListr5 r r# �_getBanListTest� s" ���z4Transmitter.testJailBanList.<locals>._getBanListTest)r� � 127.0.0.1)z --with-timez:127.0.0.1 2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01)r� r! r� � 192.168.0.1z<192.168.0.1 2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02� 192.168.1.10)r� r� r� )r� r� )r� r� )r/ r3 r4 r� )r rJ r� r r5 r# �testJailBanList� s6 ��������zTransmitter.testJailBanListc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
NZ
maxmatchesr� r� r� �2r �-2����Duckr� r5 r r r# �testJailMaxMatches� s z Transmitter.testJailMaxMatchesc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
Nr� r� r� r� r� r r� r� r� r� r5 r r r# �testJailMaxRetry� s z Transmitter.testJailMaxRetryc C sP | j ddd| jd� | j ddd| jd� | jdd| jd� | jdd| jd� d S ) NZmaxlinesr� r� r� r� r r� r� r� r5 r r r# �testJailMaxLines� s z Transmitter.testJailMaxLinesc C sN | j dd| jd� | j dd| jd� | j ddt| jd� | jdd| jd� d S )NZ logencodingzUTF-8r� �asciirn ZMonkey)rM r2 r rN r5 r r r# �testJailLogEncoding� s
�z Transmitter.testJailLogEncodingc
C sh | � dtj�td�tj�td�tj�td�g| j� tj�td�}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d | jdg�d|gf� | �| j�d| jd
|g�dg f� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d
g�d d� | �| j�d| jd|||g�d d� d S )NZlogpath�testcase01.logztestcase02.logztestcase03.logztestcase04.logr; �
addlogpathr r< Z
dellogpath�tail�headZbadgerr ) r] r� �path�join�TEST_FILES_DIRr2 rD r1 rE r� r r r# �testJailLogPath� sj ��
��������������zTransmitter.testJailLogPathc C s2 d}| j �d| jd|g�}| �t|d t�� d S )Nzthis_file_shouldn't_existr; r� r )r1 rE r2 ro r� �IOError)r r[ �resultr r r# �testJailLogPathInvalidFile� s
�z&Transmitter.testJailLogPathInvalidFilec C sX t jdd�}|d }t�||� | j�d| jd|g�}| �t|d t �� t�
|� d S )NZtmp_fail2ban_broken_symlink)�prefixz.slinkr; r� r ) r� �mktempr� �symlinkr1 rE r2 ro r� r� r� )r �nameZsnamer� r r r# � testJailLogPathBrokenSymlink s �z(Transmitter.testJailLogPathBrokenSymlinkc C s� | � dg d�| j� d}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d| jdg�d|gf� | �| j�d| jd|g�dg f� | �| j�d| jd g�d
� | �| j�d| jd d g�d � | �| j�d| jd g�d � d S )
NZignoreip)r� z 192.168.1.1z8.8.8.8r� r; Z addignoreipr r< Z delignoreipZ
ignoreselfr� Fr� )r] r2 rD r1 rE r� r r r# �testJailIgnoreIP
sD � �������z Transmitter.testJailIgnoreIPc C s | j dd| jd� d S )NZ
ignorecommandzbin/ignore-command <ip>r� �rM r2 r5 r r r# �testJailIgnoreCommand2 s z!Transmitter.testJailIgnoreCommandc C s0 | j ddg d�| jd� | j ddd | jd� d S )NZ ignorecachez%key="<ip>",max-time=1d,max-count=9999)z<ip>i' i�Q r� � r� r5 r r r# �testJailIgnoreCache5 s �z Transmitter.testJailIgnoreCachec C s | j dd| jd� d S )NZ prefregexz^Testr� r� r5 r r r# �testJailPrefRegex< s z Transmitter.testJailPrefRegexc
C s� | � dg d�dt�d� dt�d� dt�d� g| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ failregex)zuser john at <HOST>� Admin user login from <HOST>z failed attempt from <HOST> againzuser john at %s�<HOST>�Admin user login from %sz failed attempt from %s againr; � addfailregexz
No host regexr r i� �r^ r Z_resolveHostTagr2 rD r1 rE r5 r r r# �
testJailRegex? s0 �� ��� ���zTransmitter.testJailRegexc C sn | � dg d�ddt�d� dg| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ ignoreregex)� user johnr� �Dont match me!r� r� r� r� r; ZaddignoreregexzInvalid [regexr r r� r� r5 r r r# �testJailIgnoreRegexW s0 �� ��� ���z Transmitter.testJailIgnoreRegex�Filter�zCurrently failedr �z Total failedr � File list�Actions�zCurrently bannedr �z Total bannedr �Banned IP listc C s� | j g}| �| j�dg�ddt|�fdd�|�fgf� | j�dt� |� d� | �| j�dg�ddt|�fdd�|�fgf� | �| j�ddg�ddt|�fdd�|�f| j
| j
d�gf� | �| j�d g�dtd
d
gtd
d
gd�f� d S ) Nr� r zNumber of jailz Jail listz, r� r� )r+ r� Zstatsr� ) r2 rD r1 rE r� r� r/ r3 r4 �append� _JAIL_STATUS)r �jailsr r r# �
testStatus| s( �
� ����zTransmitter.testStatusc C s$ | � | j�d| jg�d| jf� d S )Nr� r �rD r1 rE r2 r r5 r r r# �testJailStatus� s �zTransmitter.testJailStatusc C s& | � | j�d| jdg�d| jf� d S )Nr� Zbasicr r r5 r r r# �testJailStatusBasic� s �z Transmitter.testJailStatusBasicc C s& | � | j�d| jdg�d| jf� d S )Nr� �INVALIDr r r5 r r r# �testJailStatusBasicKwarg� s �z$Transmitter.testJailStatusBasicKwargc
C s� t j�� zdd l}dd l}W n ty6 dg}Y n0 g }| �| j�d| j dg�dddddg fgfd d
d d g fd
|fd|fd|fgfgf� d S )Nr �errorr� Zcymrur� r r r r r r r zBanned ASN listzBanned Country listzBanned RIR list)
ru rv ZSkipIfNoNetworkZ
dns.exceptionZ dns.resolver� ImportErrorrD r1 rE r2 )r Zdnsr[ r r r# �testJailStatusCymru� s2
�����z Transmitter.testJailStatusCymruc C s� d}g d�}g d�}| � | j�d| jd|g�d|f� | � | j�d| jdg�d d |� t||�D ].\}}| � | j�d| jd
|||g�d|f� qdt||�D ],\}}| � | j�d| jd
||g�d|f� q�| � | j�d| jd
|d d g�d
� | � | j�d| jd
|d g�d
� | � | j�d| jd
|dg�d d � | � | j�d| jd
|ddg�d� | � | j�d| jd
|dg�d� | � | j�d| jd|g�d� | � | j�d| jddg�d d � d S )N�TestCaseAction)Z actionstartZ
actionstopZ actioncheckZ actionbanZ actionunban)z Action Startz Action Stopz Action Checkz
Action Banz Action Unbanr; � addactionr r< r r �actionZKEY�VALUE)r r Z
InvalidKey�timeout�10)r �
Z delactionre z
Doesn't exist)rD r1 rE r2 �zip)r r ZcmdListZ cmdValueListrF r[ r r r# �
testAction� s� �
������������������� ���zTransmitter.testActionc C s0 d}| j �d| jd|tj�tdd�dg�}| �|d|f� | �| j �d| jd |g�d
d d g� | �| j �d| jd
|d g�d� | �| j �d| jd
|d g�d� | �| j �d| jd|g�d
g d�� | �| j �d| jd
|ddg�d� | �| j �d| jd
|d dg�d� | �| j �d| jd
|ddg�d� d S )Nr r; r �action.dz action.pyz{"opt1": "value"}r r< Zactionpropertiesr �opt1�opt2r )r r[ re Z
actionmethods)�banZrebanr� rd �
testmethod�unbanr z{"text": "world!"})r zHello world! value�
another value)r r" )r zHello world! another value) r1 rE r2 r� r� r� r� rD rS )r r �outr r r# �$testPythonActionMethodsAndProperties� sl
�� ����������������z0Transmitter.testPythonActionMethodsAndPropertiesc C s | � | j�ddg�d d� d S )Nr �COMMANDr r rf r5 r r r# �testNOK s zTransmitter.testNOKc C s | � | j�g d��d d� d S )N)r; r r% r r rf r5 r r r# �
testSetNOK s �zTransmitter.testSetNOKc C s | � | j�g d��d d� d S )N)r< r r% r r rf r5 r r r# �
testGetNOK" s �zTransmitter.testGetNOKc C s | � | j�g d��d d� d S )N)r� r r% r r rf r5 r r r# �
testStatusNOK& s �zTransmitter.testStatusNOKc
C s6 t st�d��d}| j�|d� g d�}t|�D ]>\}}| �| j�d|d|g�ddd � |d |d
� D �f� q0t|�D ]>\}}| �| j�d|d |g�dd d � ||d
d � D �f� qxd
}| �| j�d|d|g�d|ggf� | �| j�d|d|g�d|g|ggf� | �| j�d|d |g�d|ggf� | �| j�d|d |g�dg f� g d�}| �| j�d|dg| �dd
gddggf� | �| j�d|d g|d d
� �dddggf� | �| j�d|d g|dd � �dg f� d}| j�d|d|g�}| � t
|d
t �� d}| j�d|d |g�}| � t
|d
t �� d S )N�&systemd python interface not availabler� Zsystemd��_SYSTEMD_UNIT=sshd.servicezTEST_FIELD1=ABCz_HOSTNAME=example.comr; �addjournalmatchr c S s g | ]
}|g�qS r r �r� �valr r r# r� 8 r� z0Transmitter.testJournalMatch.<locals>.<listcomp>r �deljournalmatchc S s g | ]
}|g�qS r r r. r r r# r� = r� �
_COMM=sshd)r1 �+r, �_UID=0r, r3 r zThis isn't valid!zFIELD=NotPresent) r ru �SkipTestr/ r3 rR rD r1 rE ro r� �
ValueError)r r2 rW rZ r[ r� r r r# �testJournalMatch* s�
� �
� �
�
�
��
�
�
�� ��� ���
�
�z Transmitter.testJournalMatchc
C s� t st�d��| �d� d}| j�|d� g d�}t|�D ]>\}}| �| j� d|d|g�dd d
� |d |d � D �f� q:t|�D ]>\}}| �| j� d|d |g�dd
d
� ||d d � D �f� q�d S )Nr* Tr� zsystemd[journalflags=2]r+ r; r- r c S s g | ]
}|g�qS r r r. r r r# r� � r� z5Transmitter.testJournalFlagsMatch.<locals>.<listcomp>r r0 c S s g | ]
}|g�qS r r r. r r r# r� � r� )
r ru r4 ro r/ r3 rR rD r1 rE )r r2 rW rZ r[ r r r# �testJournalFlagsMatchq s(
� �
� �z!Transmitter.testJournalFlagsMatchN)2r& r' r( rc rg rh ri rr r| r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r
r r
r r r r$ r& r' r( r) r6 r7 r r r r# r` � sr
0
+*
%���
<$Gr` c sX e Zd ZeZ� fdd�Zdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z � Z
S )�TransmitterLoggingc s6 t t| ��� | j�d� | j�d� | j�d� d S )N� /dev/null�CRITICALrn )r, r8 r- r/ r% r$ ZsetSyslogSocketr5 r6 r r# r- � s zTransmitterLogging.setUpc C s� g }t d�D ],}t�dd�}|�|d � t�|d � q |D ]}| �d|� q>d}| �d|� | j� g d�� |D ]}t�
|� qt| �dd d
� | �dd d � d S )
Nr� r Z transmitterr r � logtarget�/this/path/should/not/exist)r; r; r9 z STDOUT[format="%(message)s"]�STDOUTz!STDERR[datetime=off, padding=off]�STDERR) �ranger� r� r r� r� rM rN r1 rE �remove)r Z
logTargets�_ZtmpFileZ logTargetr[ r r r# �
testLogTarget� s z TransmitterLogging.testLogTargetc C sJ t j�d�st�d��| �| j�� d� | �dd� | �| j�� d� d S )N�/dev/logz'/dev/log' not presentrn r; �SYSLOG) r� r� �existsru r4 ro r/ ZgetSyslogSocketrM r5 r r r# �testLogTargetSYSLOG� s
z&TransmitterLogging.testLogTargetSYSLOGc C s | � dd� d S )N� syslogsocketz/dev/log/NEW/PATH)rM r5 r r r# �testSyslogSocket� s z#TransmitterLogging.testSyslogSocketc C sd | � dd� | �dd� | � dd� | j d i i tdtd�dd �d
�t�� d v oXtj�d� �� d S )
NrG r< r; rD rC r zFailed to change log targetT)rI rH rA )TF)�Linux)r; rD ) rM rN �dict� Exception�platform�systemr� r� rE r5 r r r# �testSyslogSocketNOK� s ����z&TransmitterLogging.testSyslogSocketNOKc C s� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd � | � dd
� | � dd d
� | �dd � d S )
NZloglevel�
HEAVYDEBUG�
TRACEDEBUG�9�DEBUG�INFO�NOTICE�WARNING�ERRORr: ZcRiTiCaLZBird)rM rN r5 r r r# � testLogLevel� s z TransmitterLogging.testLogLevelc C s� | � | j�dg�d� �z t�d�\}}t�|� | j�d� | � | j�dd|g�d|f� t d�}|�
d � �z�t�d�\}}t�|� t� ||� |�
d
� | � | j�dg�d� |�
d � t |d ���}t
|�}|�d
�dkr�t
|�}| �|�d�� t
|�}| �|�d�� z:t
|�}|�d�dk�r<| �t|j� n| �d| � W n t�y` Y n0 W d � n1 �sx0 Y t |d ��V}t
|�}|�d�dk�r�t
|�}| �|�d�� | �t|j� |�� W d � n1 �s�0 Y W t�|� n t�|� 0 W zt�|� W n t�y2 Y n0 n&zt�|� W n t�yX Y n0 0 | � | j�g d��d� | � | j�dg�d� d S )NZ flushlogs)r z rolled overz fail2ban.logrU r; r; r r zBefore file movedzAfter file movedzAfter flushlogs�rzChanged logging target tozBefore file moved
zAfter file moved
zCommand: ['flushlogs']zCException StopIteration or Command: ['flushlogs'] expected. Got: %szrollover performed onzAfter flushlogs
)r; r; r> )r r> )r Zflushed)rD r1 rE r� r� r� r� r/ r$ r �warning�rename�open�next�findro �endswith� assertRaises�
StopIteration�__next__�failr@ �OSError) r �f�fn�l�f2Zfn2�line1Zline2rZ r r r# �
testFlushLogs� s^
& *�z TransmitterLogging.testFlushLogsc C s� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | j d d d | jd� | j d
d| jd� | j ddd| jd� | j ddd| jd� d S )Nzbantime.increment�trueTr� zbantime.rndtimeZ30minr� zbantime.maxtimez 1000 daysi \&zbantime.factorr� zbantime.formulazGban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)zbantime.multipliersz1 5 30 60 300 720 1440 2880zbantime.overalljailsr� r5 r r r# �testBanTimeIncr� s z"TransmitterLogging.testBanTimeIncr)r& r' r( r r. r- rB rF rH rN rW ri rk r_ r r r6 r# r8 � s
0r8 c @ s e Zd Zdd� ZdS )� JailTestsc C s d}t |�}| �|j|� d S )NZveryveryverylongname)r rD r� )r ZlongnamerJ r r r# � testLongName s zJailTests.testLongNameN)r& r' r( rm r r r r# rl s rl c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�
RegexTestsc C s. | � ttd� | � ttd� | � ttd� d S )Nr� � � )r_ r r r5 r r r# �testInit s zRegexTests.testInitc C s8 | � ttd���dd�d� | �ttd���d�� d S )N�a�"�'z
Regex('a')r� z
FailRegex()rD rV r �replacero r �
startswithr5 r r r# �testStr s zRegexTests.testStrc C s | � ttd� | � ttd� | �td�� | �td�� | �td�� | �td�� | �td�� | �td�� | �td �� td
�}| �|�� � |�d g� | �|�� � | � t|j� td �}| �|�� � |�d
g� | �|�� � | � t|j� td�}| �|�� � |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� td�}| �|�� � |�dg� | �|�� � | �|� � d� td�}|�dg� |�
� }| �||j fd� |�dg� |�
� }| �||j fd� |�d g� |�
� }| �||j fd � |�d g� |�
� }| �||j fd � td �}|�d!g� |�
� }| �||j fd"� |�d#g� |�
� }| �||j fd� |�d$g� |�
� }| �||j fd%� |�d&g� |�
� }| �||j fd'� d S )(Nr� z^test no group$z^test <HOST> group$z^test <IP4> group$z^test <IP6> group$z^test <DNS> group$z<^test id group: ip:port = <F-ID><IP4>(?::<F-PORT/>)?</F-ID>$z-^test id group: user:\(<F-ID>[^\)]+</F-ID>\)$z#^test id group: anything = <F-ID/>$z %%<HOST>?)z%%r� r� z#%%inet(?:=<F-IP4/>|inet6=<F-IP6/>)?)z %%inet=testr� r� z(%%(?:inet(?:=<IP4>|6=<IP6>)?|dns=<DNS>?))z%%inet=192.0.2.1r� r� r� )z%%inet6=2001:DB8::r� r� �
2001:DB8::)z%%dns=example.comr� r� z example.com)z%test id group: user:(test login name)r� r� ztest login namez%%net=<SUBNET>)z%%net=192.0.2.1r� r� )r� �inet4)z%%net=192.0.2.1/24r� r� )z 192.0.2.0/24ry )z%%net=2001:DB8:FF:FF::1r� r� )z2001:db8:ff:ff::1�inet6)z%%net=2001:DB8:FF:FF::1/60r� r� )z2001:db8:ff:f0::/60rz z %%ip="<ADDR>", mask="<CIDR>?")z%%ip="192.0.2.2", mask=""r� r� )r� ry )z%%ip="192.0.2.2", mask="24"r� r� )z"%%ip="2001:DB8:2FF:FF::1", mask=""r� r� )z2001:db8:2ff:ff::1rz )z$%%ip="2001:DB8:2FF:FF::1", mask="60"r� r� )z2001:db8:2ff:f0::/60rz ) r_ r r ro ra Z
hasMatched�searchZgetHostrD Z getFailIDZgetIPZ familyStr)r �frr� r r r# �testHost sz zRegexTests.testHostN)r& r' r( rq rw r} r r r r# rn s rn c @ s e Zd Zdd� ZdS )�
_BadThreadc C s t d��d S )Nzrun bad thread exception)r� r5 r r r# �rune s z_BadThread.runN)r& r' r( r r r r r# r~ d s r~ c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� LoggingTestsc C s* t d�}| �|jjd� | �|jd� d S )Nz fail2ban.some.string.with.namer z
fail2ban.name)r rD �parentr� )r Z
testLogSysr r r# �testGetF2BLoggerk s z LoggingTests.testGetF2BLoggerc s� t j}g ��fdd�t _z<t� }|�� |�� � �t�� �fdd�d�� W |t _n|t _0 � �d� � � t
��d� � � �d d t � d S )Nc s
� � | �S r )r )r! r> r r# r� s r� z5LoggingTests.testFail2BanExceptHook.<locals>.<lambda>c s t ��o� �d�S )N�Unhandled exception)r� Z
_is_loggedr �r r? r r# r� x r� r� r� r r ) �sys�__excepthook__r~ r� r� ro r r� rp rD r� r� )r Z prev_exchookZ badThreadr r� r# �testFail2BanExceptHookp s
z#LoggingTests.testFail2BanExceptHookc
C s� g }t �dd�\}}t�|� |�|� t �dd�\}}t�|� |�|� t� }zT|j||dd� | �|�� � | � d� W |�
� |D ]}tj � |�r�t�
|� q�n*|�
� |D ]}tj � |�r�t�
|� q�0 d S )Nz
fail2ban.sockzf2b-testz fail2ban.pidF)�forcezServer already running)r� r� r� r� r r r� ra rb rp r9 r� rE r@ )r Z tmp_filesZsock_fdZ sock_nameZ
pidfile_fdZ pidfile_namer/ rd r r r# �testStartFailedSockExists s(
� z&LoggingTests.testStartFailedSockExistsN)r& r' r( r� r� r� r r r r# r� i s r� )� ActionReader� JailsReader�
CONFIG_DIRc s� e Zd Z� fdd�Z� fdd�Z� fdd�Zddd �Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z ddd�Z
dd� Z� ZS ) �ServerConfigReaderTestsc s t t| �j|i |�� i | _d S r )r, r� �__init__�#_ServerConfigReaderTests__share_cfgr r6 r r# r� � s z ServerConfigReaderTests.__init__c s t t| ��� g | _dS )r* N)r, r� r- Z _execCmdLstr5 r6 r r# r- � s z ServerConfigReaderTests.setUpc s t t| ��� dS r8 )r, r� r: r5 r6 r r# r: � s z ServerConfigReaderTests.tearDownr� c C s6 |� d�D ]&}|�d�s&t�d|� q
t�|� q
dS )N�
�#zexec-cmd: `%s`T)�splitrv �logSys�debug)r �realCmdr rf r r r# � _executeCmd� s
z#ServerConfigReaderTests._executeCmdc C sP t | d�sJt� }i | _dD ].\}}t|�}|�d� tj�||�| j|< q| jS )NZ__aInfos))�ipv4r� )�ipv6rx r� )�hasattrr Z _ServerConfigReaderTests__aInfosr
Z
setBanTime�_actionsr �
ActionInfo)r �dmyjail�tr� �ticketr r r# �_testActionInfos� s
z(ServerConfigReaderTests._testActionInfosc C s2 |j }| �� }|D �]}|| jD �]}|| j| }t�d� t�d|d |j � t�d� t|tj�snq"| j |_
t�d� | � � |� � t�d� | � � |�
|d � t�d� | � � |�|d � t�d� | � � |�
|d � t�d
� | � � |�|d � t�d � | � � |�� q"qd S ) N�4# ==================================================�
# == %-44s ==� - �# === start ===�# === ban-ipv4 ===r� �# === unban ipv4 ===�# === ban ipv6 ===r� �# === unban ipv6 ===�# === stop ===)r� r� r r� r� �_namer� r� �
CommandActionr� �
executeCmdrq r� r r! rd )r r/ r �aInfosrJ rr r r r r# �_testExecActions� s,
z(ServerConfigReaderTests._testExecActionsc C s� t jjdd� ttd| jd�}| �|�� � | �|�� � |j dd�}t
� }|j }|j }|D �] }|d dkr\|d dkr�d|d < n�t
|�d
kr�|d d kr�|d d kr�tj�td
|d �}tj�|�s�tj�td�}||d
< nDt jj�r$t
|�d
k�r$|d dv �r$|d dk�r$d |d< d|d
< z ||� W q\ t�yh } z | �d||f � W Y d }~q\d }~0 0 q\t jj�s�| �|� d S )NT�Zstock)�basedirZ force_enable� share_config)Zallow_no_filesr r� rO r r r� r; r� Zlogsr r� )r; z multi-setr� zDUMMY-REGEX <HOST>z"Command %r has failed. Received %r)ru rv �SkipIfCfgMissingr� r� r� ro �read�
getOptions�convertr r0 � _Transmitter__commandHandlerr� r� r� r� r� rE rw rK rb r� ) r r �streamr/ r1 �
cmdHandlerrF re �er r r# �testCheckStockJailActions� s@
$
�
�
� *
z1ServerConfigReaderTests.testCheckStockJailActionsc C sb |� d|�}t|�\}}d|dgg}t|||| jtd�}| �|�� � |�i � |�|� � � |S )Nz %(__name__)srO r )r� r� )
ru r r� r� r� ro r� r� �extendr� )r rJ �actZactNameZactOptr� r r r r# �getDefaultJailStream s ��
z,ServerConfigReaderTests.getDefaultJailStreamc
C s� t jjdd� t j�� dd l}t� }|j}|�tj� t
dd��D ]V}tj� |�� dd�}| �
d| |�}|D ] }|�|�\}} | �|d� qn| �|� qBd S ) NTr� r r z*.confz.confr� zj-)ru rv r� Z
SkipIfFast�globr r0 r� r� r� r� �basenameru r� rE rD r� )
r r� r/ r1 ZactCfgr� r� rF r\ �resr r r# �testCheckStockAllActions s
z0ServerConfigReaderTests.testCheckStockAllActionsc C s> t jjdd� ddddddd d
d d d
ddddd�
fdddddddddddd d d d d�
fd d!d"d#d$d%d&d'd(d)d*d+� fd,d-d"d#d.d/d0d1d2�fd3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdB�
fdCdDd5d6d7dEdFdGdHdIdJdKdLdMdNdB�
fdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]dB�
fd^d_d`dadSdbdcdddedfdgdhdidjdkdB�
fdldmd5d6dSdndodpdqdrdsdtdudvdwdB�
fdxdyd5d6dSdzd{d|d}d~dd�d�d�d�dB�
fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�dל
fd�d�d�d�d�d�d�d�d�d�d�d�dל
fd�d�d�d�d�d�d�d�d2�fd�d�d�d�d�d�d�d�d2�ff}t� }|j}|j}|D ]>\}}}| �||�}|D ] } |�| �\}
} | �|
d� �q��q�|j } | �
� }
|D �]@\}}}| | j D �]&}| | j | }t �
d� t �
d�|d� |j � t �
d� | �t|tj�� | j|_| �d�� |�� |�d���r�| j|d� d�di� n4|�d���r�|�d���r�| j|d� |d� d�di� | �d�� |�|
d� � |�d���r| j|�d�|�d�d���|d� d�di� |�d���r8| j|d� d�di� | j|d� d�di� | j|�d d�di� | ��d� |�|
d� � | j|�d d�di� | j|�d d�di� | ��d� |�|
�d � |�d���r�| j|�d�|�d�d���|d� d�di� |�d���r| j|d� d�di� | j|�d d�di� | j|�d d�di� | ��d� |�|
�d � | j|�d d�di� | j|�d d�di� |��d ��r | ��d
� |� |
d� �d � | j|��d |�d�d���|�d d�di� |��d
��r |�d
|�d k�r | j|�d
d�di� |��d
��r�| ��d� |� |
�d �d � | j|��d |�d�d���|�d
d�di� |��d ��r�|�d |�d
k�r�| j|�d d�di� |��d��r�| ��d� |� � | j|�d d�di� | ��d� |� � |��d��r | j|�d�d��|�d d�di� �q �q�d S ( NTr� z
j-w-nft-mpzQnftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"])zip Z ipv4_addrzaddr-)zip6 Z ipv6_addrzaddr6-)� `nft add table inet f2b-table`�W`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`�9`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`�`done`)zG`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`z�`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`z�`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`�5`nft delete rule inet f2b-table f2b-chain $hdl; done`z3`nft delete set inet f2b-table addr-set-j-w-nft-mp`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-mp`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)
�ip4�ip6�*-start� ip4-start� ip6-start�flushrd � ip4-check� ip6-check�ip4-ban� ip4-unban�ip6-ban� ip6-unbanz
j-w-nft-apz8nftables-allports[name=%(__name__)s, protocol="tcp,udp"])r� r� )zG`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`zg`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`zi`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z3`nft delete set inet f2b-table addr-set-j-w-nft-ap`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-ap`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`zj-dummyzodummy[name=%(__name__)s, init="=='<family>/<ip>'==bt:<bantime>==bc:<bancount>==", target="/tmp/fail2ban.dummy"])z
family: inet4)z
family: inet6)z$`printf %b "=='/'==bt:600==bc:0==\n"z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`)z9`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`)z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`)zP`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`)zR`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`)zQ`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`)zS`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`) r� r� r� r� rd r� r� r� r� z j-hostsdenyzPhostsdeny[name=%(__name__)s, actionstop="rm <file>", file="/tmp/fail2ban.dummy"])z5`printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`)z^`IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)z8`printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`)za`IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)r� r� r� r� r� r� zj-w-iptables-mpzwiptables-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp,udp,sctp", chain="<known/chain>"])�
`iptables �icmp-port-unreachable)� `ip6tables �icmp6-port-unreachable)r� r� )z�`{ iptables -w -C f2b-j-w-iptables-mp -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-mp || true; iptables -w -A f2b-j-w-iptables-mp -j RETURN; }`z�`{ iptables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp; }`)z�`{ ip6tables -w -C f2b-j-w-iptables-mp -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-mp || true; ip6tables -w -A f2b-j-w-iptables-mp -j RETURN; }`zq`{ ip6tables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp >/dev/null 2>&1; } || z]{ ip6tables -w -I INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp; }`)�$`iptables -w -F f2b-j-w-iptables-mp`�%`ip6tables -w -F f2b-j-w-iptables-mp`)zX`iptables -w -D INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z$`iptables -w -X f2b-j-w-iptables-mp`zY`ip6tables -w -D INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z%`ip6tables -w -X f2b-j-w-iptables-mp`)zX`iptables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`)zY`ip6tables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`)za`iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)
r� r� �*-start-stop-checkr� r� r� rd r� r� r� r� r� r� zj-w-iptables-apzciptables-allports[name=%(__name__)s, bantime="10m", protocol="tcp,udp,sctp", chain="<known/chain>"])z�`{ iptables -w -C f2b-j-w-iptables-ap -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-ap || true; iptables -w -A f2b-j-w-iptables-ap -j RETURN; }`zO`{ iptables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap >/dev/null 2>&1; } || z;{ iptables -w -I INPUT -p $proto -j f2b-j-w-iptables-ap; }`)z�`{ ip6tables -w -C f2b-j-w-iptables-ap -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-ap || true; ip6tables -w -A f2b-j-w-iptables-ap -j RETURN; }`zP`{ ip6tables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap >/dev/null 2>&1; } || z<{ ip6tables -w -I INPUT -p $proto -j f2b-j-w-iptables-ap; }`)�$`iptables -w -F f2b-j-w-iptables-ap`�%`ip6tables -w -F f2b-j-w-iptables-ap`)z7`iptables -w -D INPUT -p $proto -j f2b-j-w-iptables-ap`r� z$`iptables -w -X f2b-j-w-iptables-ap`z8`ip6tables -w -D INPUT -p $proto -j f2b-j-w-iptables-ap`r� z%`ip6tables -w -X f2b-j-w-iptables-ap`)z7`iptables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap`)z8`ip6tables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap`)za`iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-ipsetz\iptables-ipset-proto6[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-iptables-ipset )z f2b-j-w-iptables-ipset6 )z0`for proto in $(echo 'tcp' | sed 's/,/ /g'); do`r� )zM`ipset -exist create f2b-j-w-iptables-ipset hash:ip timeout 0 maxelem 65536 `aJ `{ iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable; }`)zZ`ipset -exist create f2b-j-w-iptables-ipset6 hash:ip timeout 0 maxelem 65536 family inet6`aP `{ ip6tables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable; }`)�$`ipset flush f2b-j-w-iptables-ipset`�%`ipset flush f2b-j-w-iptables-ipset6`)z�`iptables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-iptables-ipset`z�`ip6tables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-iptables-ipset6`)z�`iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`)z�`ip6tables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)z=`ipset -exist add f2b-j-w-iptables-ipset 192.0.2.1 timeout 0`)z3`ipset -exist del f2b-j-w-iptables-ipset 192.0.2.1`)z?`ipset -exist add f2b-j-w-iptables-ipset6 2001:db8:: timeout 0`)z5`ipset -exist del f2b-j-w-iptables-ipset6 2001:db8::`zj-w-iptables-ipset-apzHiptables-ipset-proto6-allports[name=%(__name__)s, chain="<known/chain>"])z f2b-j-w-iptables-ipset-ap )z f2b-j-w-iptables-ipset-ap6 )zP`ipset -exist create f2b-j-w-iptables-ipset-ap hash:ip timeout 0 maxelem 65536 `a `{ iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable; })z]`ipset -exist create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 maxelem 65536 family inet6`a `{ ip6tables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable; })�'`ipset flush f2b-j-w-iptables-ipset-ap`�(`ipset flush f2b-j-w-iptables-ipset-ap6`)z`iptables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z)`ipset destroy f2b-j-w-iptables-ipset-ap`z�`ip6tables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z*`ipset destroy f2b-j-w-iptables-ipset-ap6`)z`iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)z�`ip6tables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)z@`ipset -exist add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 0`)z6`ipset -exist del f2b-j-w-iptables-ipset-ap 192.0.2.1`)zB`ipset -exist add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 0`)z8`ipset -exist del f2b-j-w-iptables-ipset-ap6 2001:db8::`z j-w-iptablesz^iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z�`{ iptables -w -C f2b-j-w-iptables -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables || true; iptables -w -A f2b-j-w-iptables -j RETURN; }z�`{ iptables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto --dport http -j f2b-j-w-iptables; }`)z�`{ ip6tables -w -C f2b-j-w-iptables -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables || true; ip6tables -w -A f2b-j-w-iptables -j RETURN; }z�`{ ip6tables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto --dport http -j f2b-j-w-iptables; }`)�!`iptables -w -F f2b-j-w-iptables`�"`ip6tables -w -F f2b-j-w-iptables`)zA`iptables -w -D INPUT -p $proto --dport http -j f2b-j-w-iptables`r� z!`iptables -w -X f2b-j-w-iptables`zB`ip6tables -w -D INPUT -p $proto --dport http -j f2b-j-w-iptables`r� z"`ip6tables -w -X f2b-j-w-iptables`)zA`iptables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables`)zB`ip6tables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables`)z^`iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z\`iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)za`ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z_`ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-newzbiptables-new[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z�`{ iptables -w -C f2b-j-w-iptables-new -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-new || true; iptables -w -A f2b-j-w-iptables-new -j RETURN; }`z�`{ iptables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new >/dev/null 2>&1; } || { iptables -w -I INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new; }`)z�`{ ip6tables -w -C f2b-j-w-iptables-new -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-new || true; ip6tables -w -A f2b-j-w-iptables-new -j RETURN; }`z�`{ ip6tables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new >/dev/null 2>&1; } || { ip6tables -w -I INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new; }`)�%`iptables -w -F f2b-j-w-iptables-new`�&`ip6tables -w -F f2b-j-w-iptables-new`)zZ`iptables -w -D INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`r� z%`iptables -w -X f2b-j-w-iptables-new`z[`ip6tables -w -D INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`r� z&`ip6tables -w -X f2b-j-w-iptables-new`)zZ`iptables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`)z[`ip6tables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`)zb`iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z``iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)ze`ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zc`ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-xtrezPiptables-xt_recent-echo[name=%(__name__)s, bantime="10m", chain="<known/chain>"])r� z/f2b-j-w-iptables-xtre`)r� z/f2b-j-w-iptables-xtre6`)a" `{ iptables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable; }`)a( `{ ip6tables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable; }`)z4`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre`�`if [ `id -u` -eq 0 ];then`z�`iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;`�`fi`z5`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`r� z�`ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;`r� )z�`{ iptables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z�`{ ip6tables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z=`echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z=`echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z?`echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z?`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`) r� r� r� r� rd r� r� r� r� r� r� zj-w-pfz2pf[name=%(__name__)s, actionstart_on_demand=false]r )zF`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`z
port="<port>"z\`echo "block quick $protocol from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`)�,`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`)zT`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`r� z+`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`)z.`pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`)z4`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`)z7`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`)z5`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`)z8`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`) r� r� r� r� rd r� r� r� r� r� r� z j-w-pf-mpz@pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"])zL`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`zport="http,https"zb`echo "block quick $protocol from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`)�2`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`)z]`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`r� z1`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`)z4`pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`)z:`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`z j-w-pf-apzHpf[actiontype=<allports>, actionstart_on_demand=true][name=%(__name__)s])zL`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`zW`echo "block quick $protocol from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`)�2`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`)z]`pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`r� z1`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`)z4`pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`)z:`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`) r� r� r� r� r� rd r� r� r� r� r� r� z j-w-fwcmd-mpzqfirewallcmd-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])z ipv4 r� )z ipv6 r� )z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`z j-w-fwcmd-apz]firewallcmd-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)zT`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`zT`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-fwcmd-ipsetzXfirewallcmd-ipset[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset )z f2b-j-w-fwcmd-ipset6 )zJ`ipset -exist create f2b-j-w-fwcmd-ipset hash:ip timeout 0 maxelem 65536 `z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`)zW`ipset -exist create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 maxelem 65536 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)�!`ipset flush f2b-j-w-fwcmd-ipset`�"`ipset flush f2b-j-w-fwcmd-ipset6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z#`ipset destroy f2b-j-w-fwcmd-ipset`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z$`ipset destroy f2b-j-w-fwcmd-ipset6`)z:`ipset -exist add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0`)z0`ipset -exist del f2b-j-w-fwcmd-ipset 192.0.2.1`)z<`ipset -exist add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 0`)z2`ipset -exist del f2b-j-w-fwcmd-ipset6 2001:db8::`)
r� r� r� r� r� rd r� r� r� r� zj-w-fwcmd-ipset-apzbfirewallcmd-ipset[name=%(__name__)s, actiontype=<allports>, protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset-ap )z f2b-j-w-fwcmd-ipset-ap6 )zM`ipset -exist create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 0 maxelem 65536 `z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zZ`ipset -exist create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 0 maxelem 65536 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)�$`ipset flush f2b-j-w-fwcmd-ipset-ap`�%`ipset flush f2b-j-w-fwcmd-ipset-ap6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-fwcmd-ipset-ap`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-fwcmd-ipset-ap6`)z=`ipset -exist add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0`)z3`ipset -exist del f2b-j-w-fwcmd-ipset-ap 192.0.2.1`)z?`ipset -exist add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 0`)z5`ipset -exist del f2b-j-w-fwcmd-ipset-ap6 2001:db8::`z
j-fwcmd-rrz4firewallcmd-rich-rules[port="22:24", protocol="tcp"])z
family='ipv4'r� )z
family='ipv6'r� )z�`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z�`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z� `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`)z�`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`z
j-fwcmd-rlz6firewallcmd-rich-logging[port="22:24", protocol="tcp"])a
`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a
`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a
`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`)a `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� z# === check ipv4 ===�familyz*-checkr� z# === check ipv6 ===r� z# === flush ===r� rd ) ru rv r� r r0 r� r� rE rD r� r� r r� r� r� ro r� r� r� r� r� rq r� r< rp r� r r! Z_invariantCheckr� rd )r �testJailsActionsr/ r1 r� rJ r� �testsr� rF r\ r� r r� rr r r r r# � testCheckStockCommandActions. sr �1�.���3�3�1�1�3�3
�&����(�(�$�$��� � � � � � a
4 4 ,$ ,$ z4ServerConfigReaderTests.testCheckStockCommandActionsc C s` |}t |t�r|d }t�dd|�}t�ddd� |d�}t |t�rL||d< n|}tjj||d�S ) Nr z\)\s*\|\s*(\S*mail\b[^\n]*)z$) | cat; printf "\\n... | "; echo \1z\bADDRESSES=\$\(dig\s[^\n]+c S s dS )Nz@ADDRESSES="abuse-1@abuse-test-server, abuse-2@abuse-test-server"r )�mr r r# r� n r� z9ServerConfigReaderTests._executeMailCmd.<locals>.<lambda>r )r )r� rT �re�subr� r� r� )r r� r rF r r r# �_executeMailCmde s
��
z'ServerConfigReaderTests._executeMailCmdc C s t jjdd� ddtj�td� d d tj�td� d d
d ifd d
tj�td� d d tj�td� d d
difddtj�td� d d tj�td� d ddd�fddddd�ff}t� }|j}|j }|D ]:\}}}| �
||�}|D ] } |� | �\}
} | � |
d� q�q�|j
} td�}
td�}t� }|D ]�\}}}| | jD ]�}| | j| }t�d � t�d |d |j � t�d � | j|_d
|
fd |ffD ]t\}}|�|��s��q�| �d | � t|�}|�d!� |�d"d#g� tj � ||�}|� |� | j || d$di� �q��qD�q0d S )%NTr� zj-mail-whois-linesz\mail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s", logpath="r� r� z ztestcase01a.logz8", _whois_command="echo '-- information about <ip> --'"]r� )�;The IP 87.142.124.10 has just been banned by Fail2Ban afterz(100 attempts against j-mail-whois-lines.�.Here is more information about 87.142.124.10 :�%-- information about 87.142.124.10 --�2Lines containing failures of 87.142.124.10 (max 2)�etestcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�etestcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10zj-sendmail-whois-lineszxsendmail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd='testmail -f "<sender>" "<dest>"', logpath=")r� z,100 attempts against j-sendmail-whois-lines.r� r� r� r� r� zj-complain-abusez�complain[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s 'Hostname: <ip-host>, family: <family>' - ",debug=1,logpath="z", ])�6try to resolve 10.124.142.87.abuse-contacts.abusix.orgr� r� r� zymail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-server)�htry to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgz0Lines containing failures of 2001:db8::1 (max 2)zwmail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-server)r� r� z j-xarf-abusezIxarf-login-attack[name=%(__name__)s, mailcmd="mail", mailargs="",debug=1])r� z8We have detected abuse from the IP address 87.142.124.10�VDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�UDec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10�8mail abuse-1@abuse-test-server abuse-2@abuse-test-server)r� z6We have detected abuse from the IP address 2001:db8::1r� r z
87.142.124.10z 2001:db8::1r� r� r� r� z # === %s ===r� r� r� r� ) ru rv r� r� r� r� r� r r0 r� r� rE rD r� r
r r r� r� r� r� r� r< rq r
Z
setAttemptZ
setMatchesr� r r� r rp )r r� r/ r1 r� rJ r� r� r� rF r\ r� r r� r� r� rr r �testr� r� r r r# � testComplexMailActionMultiLogw s� ��� ���� ��� ���� ��� �� �� ���_
�
z5ServerConfigReaderTests.testComplexMailActionMultiLog)r� )r� )r& r' r( r� r- r: r� r� r� r� r� r� r� r� r r_ r r r6 r# r� � s$
"3 =
r� )A�
__author__�
__copyright__� __license__ru rx r� r� r� r� rL Zserver.failregexr r r r/ r r� Z
server.serverr Z server.ipdnsr r
Z server.jailr Zserver.jailthreadr Z
server.ticketr
Z server.utilsr Z dummyjailr �utilsr r r Zhelpersr r r r� r r r r� r� �dirname�__file__r� r4 r� r r) r` r8 ZTestCaserl rn r~ r� Zclientreadertestcaser� r� r� r� r r r r# �<module> sV
^ l~ U*