File: //usr/lib/python3.9/site-packages/fail2ban/tests/__pycache__/servertestcase.cpython-39.opt-2.pyc
a
UJ �Y�VY� @ s� d Z dZdZddlZddlZddlZddlZddlZddlZddl Z ddl
m Z m Z m
Z
ddlmZ ddlmZ dd lmZmZ dd
lmZ dd lmZ dd lmZ dd
l m Z ddl m Z ddl m!Z!m"Z"m#Z# ddl$m%Z%m&Z&m'Z' ddl(m)Z) zddlm*Z* W n e+�y dZ*Y n0 ej,�-ej,�.e/�d�Z0dZ1e%d�Z2G dd� de�Z3G dd� de!�Z4G dd � d e4�Z5G d d � d e4�Z6G d d � d ej7�Z8G d!d"� d"ej7�Z9G d#d$� d$e�Z:G d%d&� d&e!�Z;dd'l<m=Z=m>Z>m?Z? G d(d)� d)e!�Z@dS )*z
Cyril Jaquierz Copyright (c) 2004 Cyril JaquierZGPL� N� )�Regex� FailRegex�RegexException)�actions)�Server)�DNSUtils�IPAddr)�Jail)�
JailThread)� BanTicket)�Utils� )� DummyJail)�LogCaptureTestCase�
with_alt_time�MyTime)� getLogger�extractOptions�
PREFER_ENC)�version)�
filtersystemd�files�polling�fail2banc @ s e Zd Zdd� Zdd� ZdS )�
TestServerc O s d S �N� ��self�args�kwargsr r �A/usr/lib/python3.9/site-packages/fail2ban/tests/servertestcase.py� setLogLevel< s zTestServer.setLogLevelc O s d S r r r r r r" � setLogTarget? s zTestServer.setLogTargetN)�__name__�
__module__� __qualname__r# r$ r r r r" r ; s r c sP e Zd ZeZ� fdd�Z� fdd�Zdd d
�Zdd d �Zd
d� Z dd� Z
� Z S )�TransmitterBasec s< t t| ��� | �� | _| jj| _d| _| j�| jt � dS )� Call before every test case.� TestJail1N)
�superr( �setUp�TEST_SRV_CLASS�server�_Server__transm�transm�jailName�addJail� FAST_BACKEND�r �� __class__r r" r, G s
zTransmitterBase.setUpc s | j �� tt| ��� dS �zCall after every test case.N)r. �quitr+ r( �tearDownr4 r5 r r" r9 Q s
zTransmitterBase.tearDownr r NFc
s� d||g}d|g}|dur2|� d|� |� d|� |dkr>|}� fdd�} | �| | j�|��| ||f�� |s�| �| | j�|��| d|f�� dS ) zoProcess set/get commands and compare both return values
with outValue if it was given otherwise with inValue�set�getNr r c s � r t | �S | S )z Prepare value for comparison)�repr��x��repr_r r" �vd s z%TransmitterBase.setGetTest.<locals>.vr )�insert� assertEqualr0 �proceed)
r �cmd�inValue�outValue�outCode�jailr@ �setCmd�getCmdrA r r? r" �
setGetTestW s
zTransmitterBase.setGetTestc C sv d||g}d|g}|d ur2|� d|� |� d|� | j�|�d }| �| j�|�d d� | �| j�|�d|f� d S )Nr: r; r r )rB r0 rD rC )r rE rF rI rJ rK Z initValuer r r" �
setGetTestNOKm s
z TransmitterBase.setGetTestNOKc C s� d| }d| }| � | j�d||g�dg f� t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� q6t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt||d d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt||d d � ��fdd� q�d S ) N�add�delr; r r: r r )�level)rC r0 rD � enumerate�assertSortedEqual�list�map�str) r rE �valuesrI �cmdAdd�cmdDel�n�value�retr r r" �jailAddDelTestz s �@B@z TransmitterBase.jailAddDelTestc C s d| }d| }| � | j�d||g�dg f� t|�D ]^\}}| � | j�d|||g�d|d |d � f� | � | j�d||g�d|d |d � f� q6t|�D ]^\}}| � | j�d||dg�d||d d � f� | � | j�d||g�d||d d � f� q�d S )NrN rO r; r r: r )rC r0 rD rQ ) r rE ZinValuesZ outValuesrI rW rX rY rZ r r r" �jailAddDelRegexTest� s. �����z#TransmitterBase.jailAddDelRegexTest)r r NF)N) r% r& r' r r- r, r9 rL rM r\ r] �
__classcell__r r r5 r" r( C s
r( c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zed%d&� �Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z!d=d>� Z"d?d@� Z#dAdBdCdDg fgfdEdFdGdHg fgfgZ$dIdJ� Z%dKdL� Z&dMdN� Z'dOdP� Z(dQdR� Z)dSdT� Z*dUdV� Z+dWdX� Z,dYdZ� Z-d[d\� Z.d]d^� Z/d_d`� Z0dadb� Z1dcS )d� Transmitterc C s | � | j�� � d S r )� assertFalser. � isStartedr4 r r r" �testServerIsNotStarted� s z"Transmitter.testServerIsNotStartedc C s | � | j�dg�d� d S )N�stop�r N�rC r0 rD r4 r r r" �testStopServer� s zTransmitter.testStopServerc C s | � | j�dg�d� d S )NZping)r Zpongre r4 r r r" �testPing� s zTransmitter.testPingc C s | � | j�dg�dtjf� d S )Nr r )rC r0 rD r r4 r r r" � testVersion� s zTransmitter.testVersionc C s� z�| � | j�g d��d� | �t�� � | �d� | �� | � | j�g d��d� | �t�� � | �d� | �� W | � | j�g d��d� | �d � | �� n,| � | j�g d��d� | �d � | �� 0 d S )
N)r: � allowipv6�yes)r rj z
IPv6 is on)r: ri �no�r rk z IPv6 is off)r: ri �auto)r rm z IPv6 is auto) rC r0 rD �
assertTruer Z
IPv6IsAllowed� assertLogged�pruneLogr` r4 r r r" � testSetIPv6� s �zTransmitter.testSetIPv6c C s| t jjs`t�� }| �| j�ddg�d� t�� }|| }| jd| k oNdk n d| d� n| �| j�ddg�d� d S ) N�sleepz0.1rd g
ףp=
�?g�������?zSleep was %g sec)�msgz0.0001)�unittest�F2B�fast�timerC r0 rD rn )r Zt0�t1Zdtr r r" � testSleep� s (zTransmitter.testSleepc C s� t jjst�dd�\}}nd}| �d|� | j�| j� | � d|� | � d|� | � ddd� | �dd� | � d d
d � | �d d� | j�
| jt � | � d|� | j�| j� | � | j
�g d ��d
� | � | j
�ddg�d
� | � | j
�g d��d
� | � | j
�ddg�d
� | � | j
�g d��d
� | � | j
�dd g�d
� | j�
| jt � | � | j
�g d ��d
� t jj�s�t�|� t�|� d S )Nz.dbZ fail2ban_z:memory:�dbfile� dbmaxmatches�100�d ZLIZARD�
dbpurgeage�600�X )r: rz �Nonerd r; )r: r{ r| )r: r~ �500)rt ru Z memory_db�tempfile�mkstemprM r. ZdelJailr1 rL r2 r3 rC r0 rD �os�close�unlink)r �tmpZ tmpFilenamer r r" � testDatabase� sj
��
��
��
��
��
��
��
zTransmitter.testDatabasec C s� d}d}d}| � | j�d|dg�d|f� | � | j�d|g�d|f� | � | j�d|dg�d d� | � | j�d|d g�d|f� | � | j�d| jdg�d d� | � | j�g d
��d d� d S ) N� TestJail2� TestJail3Z TestJail4rN r r zinvalid backendr rm )rN �--allr �rC r0 rD r1 )r Zjail2Zjail3Zjail4r r r" � testAddJail� s& � ����zTransmitter.testAddJailc sp � � � j�d� jg�d� t�tj� � �t� � fdd�d�� � � � j�d� jg�d� � �
� j� j j � d S )N�startrd c s& � j �d�o$t� j�d� jg�t� S )Nr �status�r. ZisAlive�
isinstancer0 rD r1 � RuntimeErrorr r4 r r" �<lambda> � z/Transmitter.testStartStopJail.<locals>.<lambda>� rc )
rC r0 rD r1 rw rr r
�DEFAULT_SLEEP_TIMErn �wait_for� assertNotInr. �_Server__jailsr4 r r4 r" �testStartStopJail s �
��z Transmitter.testStartStopJailc s� � j �dt� � �� j�d� jg�d� � �� j�ddg�d� t�t j
� � � t � � fdd�d�� � �� j�ddg�d� � � t � � fd d�d�� � �
� j� j j� � �
d� j j� d S )
Nr� r� rd c s& � j �d�o$t� j�d� jg�t� S )Nr r� r� r r4 r r" r� " r� z2Transmitter.testStartStopAllJail.<locals>.<lambda>r� rc r� c s t � jj� S r )�lenr. r� r r4 r r" r� % r� )r. r2 r3 rC r0 rD r1 rw rr r
r� rn r� r� r� r4 r r4 r" �testStartStopAllJail s ��
�z Transmitter.testStartStopAllJailc C sb | � | j�d| jddg�d� | � | j�d| jddg�d� | � | j�d| jddg�d d � d S )
Nr: Zidle�on�r T�off�r FZCATr r r� r4 r r r" � testJailIdle) s ���zTransmitter.testJailIdlec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZfindtimeZ120�x �rI Z60�< Z30m� z-60i���ZDog�rL r1 rM r4 r r r" �testJailFindTime4 s
z Transmitter.testJailFindTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZbantimer r� r� Z50�2 z-50i���z
15d 5h 30mi� ZCatr� r4 r r r" �testJailBanTime; s
zTransmitter.testJailBanTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZ datepattern�%%%Y%m%d%H%M%S)r� z %YearMonthDay24hourMinuteSecondr� �Epoch)Nr� z^Epoch)Nz{^LN-BEG}Epoch�TAI64N)Nr� z
%Cat%a%%%gr� r4 r r r" �testDatePatternB s �
�
�
�zTransmitter.testDatePatternc C s* | j ddd| jd� | jdd| jd� d S )NZ logtimezonezUTC+0400r� znot-a-time-zoner� r4 r r r" �testLogTimeZoneN s zTransmitter.testLogTimeZonec C s\ | j dd| jd� | j dd| jd� | j dd| jd� d}| �| j�d| jd|g�d� d S ) NZusednsrj r� �warnrk ZFishr: rl )rL r1 rC r0 rD �r rZ r r r" �testJailUseDNSR s �zTransmitter.testJailUseDNSc C s | j �| j� | �| j�d| jddddg�d� | jddddd � | �| j�d| jdd
g�d � | jd dd
� | �| j�d| jdddddg�d� | jddddd � | jddddd � | �� | �| j�d| jdddg�d d� | �| j�d| jdddg�d� | jddddd � d S )Nr: �banip� 192.0.2.1� 192.0.2.2)r r �
Ban 192.0.2.1�
Ban 192.0.2.2T��all�waitZBadger�r r z
Ban Badger�r� �unbanipz 192.0.2.255z 192.0.2.254zUnban 192.0.2.1zUnban 192.0.2.2z192.0.2.255 is not bannedz192.0.2.254 is not bannedz--report-absentr r �r r )r. � startJailr1 rC r0 rD ro rp r4 r r r" �
testJailBanIP] sF ���������zTransmitter.testJailBanIPc s� � j �� j� � fdd�}� jddd� jd� dD ]&}dD ] }� �||d | g�d
� q:q2� jd d d
d
d� � �||dd� dD ��d
� � jdd
d� � jdd
d� � �d� d S )Nc s � j �d� jd| g| �S )Nr: �attempt)r0 rD r1 )�ipZmatchesr4 r r" r� } s z.Transmitter.testJailAttemptIP.<locals>.attempt�maxretry�5� r� )r r )r� r� �test failure %dr� z 192.0.2.1:2z 192.0.2.2:2Tr� c S s g | ] }d | �qS )r� r )�.0�ir r r" �
<listcomp>� r� z1Transmitter.testJailAttemptIP.<locals>.<listcomp>)r� � r� z 192.0.2.2:5r� r� r� )r. r� r1 rL rC ro �assertNotLogged)r r� r� r� r r4 r" �testJailAttemptIPz s z Transmitter.testJailAttemptIPc s� d}� j �|t� � j �|� d d dg f� fdd� }||g d� ||dddgd � ||d
ddd gd � ||d g d
�d� ||dd
d gd� ||d d
gd� ||d
g d� d S )NZTestJailBanListr c s� |d ur6� � � j�d| d|g�d� � jd| dd� |d url� � � j�d| d|g�d� � jd| dd� � j� j�d | dgt|� �d
|fd d � t�t�� d
� d S )Nr: r� r� zBan %sTr� r� zUnban %sr; r F)Z
nestedOnlyr ) rC r0 rD ro rR rS r ZsetTimerw )rI r� r� r �outListr4 r r" �_getBanListTest� s" ���z4Transmitter.testJailBanList.<locals>._getBanListTest)r� � 127.0.0.1)z --with-timez:127.0.0.1 2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01)r� r r� � 192.168.0.1z<192.168.0.1 2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02� 192.168.1.10)r� r� r� )r� r� )r� r� )r. r2 r3 r� )r rI r� r r4 r" �testJailBanList� s6 ��������zTransmitter.testJailBanListc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
NZ
maxmatchesr� r� r� �2r �-2����Duckr� r4 r r r" �testJailMaxMatches� s z Transmitter.testJailMaxMatchesc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
Nr� r� r� r� r� r r� r� r� r� r4 r r r" �testJailMaxRetry� s z Transmitter.testJailMaxRetryc C sP | j ddd| jd� | j ddd| jd� | jdd| jd� | jdd| jd� d S ) NZmaxlinesr� r� r� r� r r� r� r� r4 r r r" �testJailMaxLines� s z Transmitter.testJailMaxLinesc C sN | j dd| jd� | j dd| jd� | j ddt| jd� | jdd| jd� d S )NZ logencodingzUTF-8r� �asciirm ZMonkey)rL r1 r rM r4 r r r" �testJailLogEncoding� s
�z Transmitter.testJailLogEncodingc
C sh | � dtj�td�tj�td�tj�td�g| j� tj�td�}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d | jdg�d|gf� | �| j�d| jd
|g�dg f� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d
g�d d� | �| j�d| jd|||g�d d� d S )NZlogpath�testcase01.logztestcase02.logztestcase03.logztestcase04.logr: �
addlogpathr r; Z
dellogpath�tail�headZbadgerr ) r\ r� �path�join�TEST_FILES_DIRr1 rC r0 rD r� r r r" �testJailLogPath� sj ��
��������������zTransmitter.testJailLogPathc C s2 d}| j �d| jd|g�}| �t|d t�� d S )Nzthis_file_shouldn't_existr: r� r )r0 rD r1 rn r� �IOError)r rZ �resultr r r" �testJailLogPathInvalidFile� s
�z&Transmitter.testJailLogPathInvalidFilec C sX t jdd�}|d }t�||� | j�d| jd|g�}| �t|d t �� t�
|� d S )NZtmp_fail2ban_broken_symlink)�prefixz.slinkr: r� r ) r� �mktempr� �symlinkr0 rD r1 rn r� r� r� )r �nameZsnamer� r r r" � testJailLogPathBrokenSymlink s �z(Transmitter.testJailLogPathBrokenSymlinkc C s� | � dg d�| j� d}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d| jdg�d|gf� | �| j�d| jd|g�dg f� | �| j�d| jd g�d
� | �| j�d| jd d g�d � | �| j�d| jd g�d � d S )
NZignoreip)r� z 192.168.1.1z8.8.8.8r� r: Z addignoreipr r; Z delignoreipZ
ignoreselfr� Fr� )r\ r1 rC r0 rD r� r r r" �testJailIgnoreIP
sD � �������z Transmitter.testJailIgnoreIPc C s | j dd| jd� d S )NZ
ignorecommandzbin/ignore-command <ip>r� �rL r1 r4 r r r" �testJailIgnoreCommand2 s z!Transmitter.testJailIgnoreCommandc C s0 | j ddg d�| jd� | j ddd | jd� d S )NZ ignorecachez%key="<ip>",max-time=1d,max-count=9999)z<ip>i' i�Q r� � r� r4 r r r" �testJailIgnoreCache5 s �z Transmitter.testJailIgnoreCachec C s | j dd| jd� d S )NZ prefregexz^Testr� r� r4 r r r" �testJailPrefRegex< s z Transmitter.testJailPrefRegexc
C s� | � dg d�dt�d� dt�d� dt�d� g| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ failregex)zuser john at <HOST>� Admin user login from <HOST>z failed attempt from <HOST> againzuser john at %s�<HOST>�Admin user login from %sz failed attempt from %s againr: � addfailregexz
No host regexr r i� �r] r Z_resolveHostTagr1 rC r0 rD r4 r r r" �
testJailRegex? s0 �� ��� ���zTransmitter.testJailRegexc C sn | � dg d�ddt�d� dg| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ ignoreregex)� user johnr� �Dont match me!r� r� r� r� r: ZaddignoreregexzInvalid [regexr r r� r� r4 r r r" �testJailIgnoreRegexW s0 �� ��� ���z Transmitter.testJailIgnoreRegex�Filter�zCurrently failedr �z Total failedr � File list�Actions�zCurrently bannedr �z Total bannedr �Banned IP listc C s� | j g}| �| j�dg�ddt|�fdd�|�fgf� | j�dt� |� d� | �| j�dg�ddt|�fdd�|�fgf� | �| j�ddg�ddt|�fdd�|�f| j
| j
d�gf� | �| j�d g�dtd
d
gtd
d
gd�f� d S ) Nr� r zNumber of jailz Jail listz, r� r� )r* r� Zstatsr� ) r1 rC r0 rD r� r� r. r2 r3 �append� _JAIL_STATUS)r �jailsr r r" �
testStatus| s( �
� ����zTransmitter.testStatusc C s$ | � | j�d| jg�d| jf� d S )Nr� r �rC r0 rD r1 r r4 r r r" �testJailStatus� s �zTransmitter.testJailStatusc C s& | � | j�d| jdg�d| jf� d S )Nr� Zbasicr r r4 r r r" �testJailStatusBasic� s �z Transmitter.testJailStatusBasicc C s& | � | j�d| jdg�d| jf� d S )Nr� �INVALIDr r r4 r r r" �testJailStatusBasicKwarg� s �z$Transmitter.testJailStatusBasicKwargc
C s� t j�� zdd l}dd l}W n ty6 dg}Y n0 g }| �| j�d| j dg�dddddg fgfd d
d d g fd
|fd|fd|fgfgf� d S )Nr �errorr� Zcymrur� r� r� r� r� r r r zBanned ASN listzBanned Country listzBanned RIR list)
rt ru ZSkipIfNoNetworkZ
dns.exceptionZ dns.resolver� ImportErrorrC r0 rD r1 )r ZdnsrZ r r r" �testJailStatusCymru� s2
�����z Transmitter.testJailStatusCymruc C s� d}g d�}g d�}| � | j�d| jd|g�d|f� | � | j�d| jdg�d d |� t||�D ].\}}| � | j�d| jd
|||g�d|f� qdt||�D ],\}}| � | j�d| jd
||g�d|f� q�| � | j�d| jd
|d d g�d
� | � | j�d| jd
|d g�d
� | � | j�d| jd
|dg�d d � | � | j�d| jd
|ddg�d� | � | j�d| jd
|dg�d� | � | j�d| jd|g�d� | � | j�d| jddg�d d � d S )N�TestCaseAction)Z actionstartZ
actionstopZ actioncheckZ actionbanZ actionunban)z Action Startz Action Stopz Action Checkz
Action Banz Action Unbanr: � addactionr r; r r �actionZKEY�VALUE)r r Z
InvalidKey�timeoutZ10)r �
Z delactionrd z
Doesn't exist)rC r0 rD r1 �zip)r r ZcmdListZ cmdValueListrE rZ r r r" �
testAction� s� �
������������������� ���zTransmitter.testActionc C s0 d}| j �d| jd|tj�tdd�dg�}| �|d|f� | �| j �d| jd |g�d
d d g� | �| j �d| jd
|d g�d� | �| j �d| jd
|d g�d� | �| j �d| jd|g�d
g d�� | �| j �d| jd
|ddg�d� | �| j �d| jd
|d dg�d� | �| j �d| jd
|ddg�d� d S )Nr r: r �action.dz action.pyz{"opt1": "value"}r r; Zactionpropertiesr Zopt1Zopt2r )r rZ rd Z
actionmethods)�banZrebanr� rc �
testmethod�unbanr z{"text": "world!"})r zHello world! value�
another value)r r )r zHello world! another value) r0 rD r1 r� r� r� r� rC rR )r r �outr r r" �$testPythonActionMethodsAndProperties� sl
�� ����������������z0Transmitter.testPythonActionMethodsAndPropertiesc C s | � | j�ddg�d d� d S )Nr
�COMMANDr r re r4 r r r" �testNOK s zTransmitter.testNOKc C s | � | j�g d��d d� d S )N)r: r
r r r re r4 r r r" �
testSetNOK s �zTransmitter.testSetNOKc C s | � | j�g d��d d� d S )N)r; r
r r r re r4 r r r" �
testGetNOK" s �zTransmitter.testGetNOKc C s | � | j�g d��d d� d S )N)r� r
r r r re r4 r r r" �
testStatusNOK& s �zTransmitter.testStatusNOKc
C s6 t st�d��d}| j�|d� g d�}t|�D ]>\}}| �| j�d|d|g�ddd � |d |d
� D �f� q0t|�D ]>\}}| �| j�d|d |g�dd d � ||d
d � D �f� qxd
}| �| j�d|d|g�d|ggf� | �| j�d|d|g�d|g|ggf� | �| j�d|d |g�d|ggf� | �| j�d|d |g�dg f� g d�}| �| j�d|dg| �dd
gddggf� | �| j�d|d g|d d
� �dddggf� | �| j�d|d g|dd � �dg f� d}| j�d|d|g�}| � t
|d
t �� d}| j�d|d |g�}| � t
|d
t �� d S )N�&systemd python interface not availabler� Zsystemd��_SYSTEMD_UNIT=sshd.servicezTEST_FIELD1=ABCz_HOSTNAME=example.comr: �addjournalmatchr c S s g | ]
}|g�qS r r �r� �valr r r" r� 8 r� z0Transmitter.testJournalMatch.<locals>.<listcomp>r �deljournalmatchc S s g | ]
}|g�qS r r r' r r r" r� = r� �
_COMM=sshd)r* �+r% �_UID=0r% r, r zThis isn't valid!zFIELD=NotPresent) r rt �SkipTestr. r2 rQ rC r0 rD rn r� �
ValueError)r r1 rV rY rZ r� r r r" �testJournalMatch* s�
� �
� �
�
�
��
�
�
�� ��� ���
�
�z Transmitter.testJournalMatchc
C s� t st�d��| �d� d}| j�|d� g d�}t|�D ]>\}}| �| j� d|d|g�dd d
� |d |d � D �f� q:t|�D ]>\}}| �| j� d|d |g�dd
d
� ||d d � D �f� q�d S )Nr# Tr� zsystemd[journalflags=2]r$ r: r& r c S s g | ]
}|g�qS r r r' r r r" r� � r� z5Transmitter.testJournalFlagsMatch.<locals>.<listcomp>r r) c S s g | ]
}|g�qS r r r' r r r" r� � r� )
r rt r- rn r. r2 rQ rC r0 rD )r r1 rV rY rZ r r r" �testJournalFlagsMatchq s(
� �
� �z!Transmitter.testJournalFlagsMatchN)2r% r& r' rb rf rg rh rq ry r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r! r" r/ r0 r r r r" r_ � sr
0
+*
%���
<$Gr_ c sX e Zd ZeZ� fdd�Zdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z � Z
S )�TransmitterLoggingc s6 t t| ��� | j�d� | j�d� | j�d� d S )N� /dev/null�CRITICALrm )r+ r1 r, r. r$ r# ZsetSyslogSocketr4 r5 r r" r, � s zTransmitterLogging.setUpc C s� g }t d�D ],}t�dd�}|�|d � t�|d � q |D ]}| �d|� q>d}| �d|� | j� g d�� |D ]}t�
|� qt| �dd d
� | �dd d � d S )
Nr� r Z transmitterr r � logtarget�/this/path/should/not/exist)r: r4 r2 z STDOUT[format="%(message)s"]�STDOUTz!STDERR[datetime=off, padding=off]�STDERR) �ranger� r� r r� r� rL rM r0 rD �remove)r Z
logTargets�_ZtmpFileZ logTargetrZ r r r" �
testLogTarget� s z TransmitterLogging.testLogTargetc C sJ t j�d�st�d��| �| j�� d� | �dd� | �| j�� d� d S )N�/dev/logz'/dev/log' not presentrm r4 �SYSLOG) r� r� �existsrt r- rn r. ZgetSyslogSocketrL r4 r r r" �testLogTargetSYSLOG� s
z&TransmitterLogging.testLogTargetSYSLOGc C s | � dd� d S )N� syslogsocketz/dev/log/NEW/PATH)rL r4 r r r" �testSyslogSocket� s z#TransmitterLogging.testSyslogSocketc C sd | � dd� | �dd� | � dd� | j d i i tdtd�dd �d
�t�� d v oXtj�d� �� d S )
Nr@ r5 r4 r= r< r zFailed to change log targetT)rH rG r@ )TF)ZLinux)r4 r= ) rL rM �dict� Exception�platform�systemr� r� r> r4 r r r" �testSyslogSocketNOK� s ����z&TransmitterLogging.testSyslogSocketNOKc C s� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd � | � dd
� | � dd d
� | �dd � d S )
NZloglevelZ
HEAVYDEBUGZ
TRACEDEBUG�9�DEBUG�INFOZNOTICE�WARNING�ERRORr3 ZcRiTiCaLZBird)rL rM r4 r r r" � testLogLevel� s z TransmitterLogging.testLogLevelc C s� | � | j�dg�d� �z t�d�\}}t�|� | j�d� | � | j�dd|g�d|f� t d�}|�
d � �z�t�d�\}}t�|� t� ||� |�
d
� | � | j�dg�d� |�
d � t |d ���}t
|�}|�d
�dkr�t
|�}| �|�d�� t
|�}| �|�d�� z:t
|�}|�d�dk�r<| �t|j� n| �d| � W n t�y` Y n0 W d � n1 �sx0 Y t |d ��V}t
|�}|�d�dk�r�t
|�}| �|�d�� | �t|j� |�� W d � n1 �s�0 Y W t�|� n t�|� 0 W zt�|� W n t�y2 Y n0 n&zt�|� W n t�yX Y n0 0 | � | j�g d��d� | � | j�dg�d� d S )NZ flushlogs)r z rolled overz fail2ban.logrJ r: r4 r r zBefore file movedzAfter file movedzAfter flushlogs�rzChanged logging target tozBefore file moved
zAfter file moved
zCommand: ['flushlogs']zCException StopIteration or Command: ['flushlogs'] expected. Got: %szrollover performed onzAfter flushlogs
)r: r4 r7 )r r7 )r Zflushed)rC r0 rD r� r� r� r� r. r# r Zwarning�rename�open�next�findrn �endswith� assertRaises�
StopIteration�__next__�failr9 �OSError) r �f�fn�l�f2Zfn2Zline1Zline2rY r r r" �
testFlushLogs� s^
& *�z TransmitterLogging.testFlushLogsc C s� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | j d d d | jd� | j d
d| jd� | j ddd| jd� | j ddd| jd� d S )Nzbantime.increment�trueTr� zbantime.rndtimeZ30minr� zbantime.maxtimez 1000 daysi \&zbantime.factorr� zbantime.formulazGban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)zbantime.multipliersz1 5 30 60 300 720 1440 2880zbantime.overalljailsr� r4 r r r" �testBanTimeIncr� s z"TransmitterLogging.testBanTimeIncr)r% r& r' r r- r, r; r? rA rF rL r\ r^ r^ r r r5 r" r1 � s
0r1 c @ s e Zd Zdd� ZdS )� JailTestsc C s d}t |�}| �|j|� d S )NZveryveryverylongname)r
rC r� )r ZlongnamerI r r r" � testLongName s zJailTests.testLongNameN)r% r& r' r` r r r r" r_ s r_ c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�
RegexTestsc C s. | � ttd� | � ttd� | � ttd� d S )Nr� � � )rS r r r4 r r r" �testInit s zRegexTests.testInitc C s8 | � ttd���dd�d� | �ttd���d�� d S )N�a�"�'z
Regex('a')r� z
FailRegex()rC rU r �replacern r �
startswithr4 r r r" �testStr s zRegexTests.testStrc C s | � ttd� | � ttd� | �td�� | �td�� | �td�� | �td�� | �td�� | �td�� | �td �� td
�}| �|�� � |�d g� | �|�� � | � t|j� td �}| �|�� � |�d
g� | �|�� � | � t|j� td�}| �|�� � |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� td�}| �|�� � |�dg� | �|�� � | �|� � d� td�}|�dg� |�
� }| �||j fd� |�dg� |�
� }| �||j fd� |�d g� |�
� }| �||j fd � |�d g� |�
� }| �||j fd � td �}|�d!g� |�
� }| �||j fd"� |�d#g� |�
� }| �||j fd� |�d$g� |�
� }| �||j fd%� |�d&g� |�
� }| �||j fd'� d S )(Nr� z^test no group$z^test <HOST> group$z^test <IP4> group$z^test <IP6> group$z^test <DNS> group$z<^test id group: ip:port = <F-ID><IP4>(?::<F-PORT/>)?</F-ID>$z-^test id group: user:\(<F-ID>[^\)]+</F-ID>\)$z#^test id group: anything = <F-ID/>$z %%<HOST>?)z%%r� r� z#%%inet(?:=<F-IP4/>|inet6=<F-IP6/>)?)z %%inet=testr� r� z(%%(?:inet(?:=<IP4>|6=<IP6>)?|dns=<DNS>?))z%%inet=192.0.2.1r� r� r� )z%%inet6=2001:DB8::r� r� �
2001:DB8::)z%%dns=example.comr� r� z example.com)z%test id group: user:(test login name)r� r� ztest login namez%%net=<SUBNET>)z%%net=192.0.2.1r� r� )r� �inet4)z%%net=192.0.2.1/24r� r� )z 192.0.2.0/24rl )z%%net=2001:DB8:FF:FF::1r� r� )z2001:db8:ff:ff::1�inet6)z%%net=2001:DB8:FF:FF::1/60r� r� )z2001:db8:ff:f0::/60rm z %%ip="<ADDR>", mask="<CIDR>?")z%%ip="192.0.2.2", mask=""r� r� )r� rl )z%%ip="192.0.2.2", mask="24"r� r� )z"%%ip="2001:DB8:2FF:FF::1", mask=""r� r� )z2001:db8:2ff:ff::1rm )z$%%ip="2001:DB8:2FF:FF::1", mask="60"r� r� )z2001:db8:2ff:f0::/60rm ) rS r r rn r` Z
hasMatched�searchZgetHostrC Z getFailIDZgetIPZ familyStr)r �frr� r r r" �testHost sz zRegexTests.testHostN)r% r& r' rd rj rp r r r r" ra s ra c @ s e Zd Zdd� ZdS )�
_BadThreadc C s t d��d S )Nzrun bad thread exception)r� r4 r r r" �rune s z_BadThread.runN)r% r& r' rr r r r r" rq d s rq c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� LoggingTestsc C s* t d�}| �|jjd� | �|jd� d S )Nz fail2ban.some.string.with.namer z
fail2ban.name)r rC �parentr� )r Z
testLogSysr r r" �testGetF2BLoggerk s z LoggingTests.testGetF2BLoggerc s� t j}g ��fdd�t _z<t� }|�� |�� � �t�� �fdd�d�� W |t _n|t _0 � �d� � � t
��d� � � �d d t � d S )Nc s
� � | �S r )r )r r= r r" r� s r� z5LoggingTests.testFail2BanExceptHook.<locals>.<lambda>c s t ��o� �d�S )N�Unhandled exception)r� Z
_is_loggedr �r r> r r" r� x r� r� rv r r ) �sys�__excepthook__rq r� r� rn r
r� ro rC r� r� )r Z prev_exchookZ badThreadr rw r" �testFail2BanExceptHookp s
z#LoggingTests.testFail2BanExceptHookc
C s� g }t �dd�\}}t�|� |�|� t �dd�\}}t�|� |�|� t� }zT|j||dd� | �|�� � | � d� W |�
� |D ]}tj � |�r�t�
|� q�n*|�
� |D ]}tj � |�r�t�
|� q�0 d S )Nz
fail2ban.sockzf2b-testz fail2ban.pidF)�forcezServer already running)r� r� r� r� r r r� r` ra ro r8 r� r> r9 )r Z tmp_filesZsock_fdZ sock_nameZ
pidfile_fdZ pidfile_namer. rX r r r" �testStartFailedSockExists s(
� z&LoggingTests.testStartFailedSockExistsN)r% r& r' ru rz r| r r r r" rs i s rs )� ActionReader� JailsReader�
CONFIG_DIRc s� e Zd Z� fdd�Z� fdd�Z� fdd�Zddd �Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z ddd�Z
dd� Z� ZS ) �ServerConfigReaderTestsc s t t| �j|i |�� i | _d S r )r+ r� �__init__�#_ServerConfigReaderTests__share_cfgr r5 r r" r� � s z ServerConfigReaderTests.__init__c s t t| ��� g | _dS )r) N)r+ r� r, Z _execCmdLstr4 r5 r r" r, � s z ServerConfigReaderTests.setUpc s t t| ��� dS r7 )r+ r� r9 r4 r5 r r" r9 � s z ServerConfigReaderTests.tearDownr� c C s6 |� d�D ]&}|�d�s&t�d|� q
t�|� q
dS )N�
�#zexec-cmd: `%s`T)�splitri �logSys�debug)r �realCmdr rZ r r r" � _executeCmd� s
z#ServerConfigReaderTests._executeCmdc C sP t | d�sJt� }i | _dD ].\}}t|�}|�d� tj�||�| j|< q| jS )NZ__aInfos))�ipv4r� )�ipv6rk r� )�hasattrr Z _ServerConfigReaderTests__aInfosr Z
setBanTime�_actionsr� �
ActionInfo)r �dmyjail�tr� �ticketr r r" �_testActionInfos� s
z(ServerConfigReaderTests._testActionInfosc C s2 |j }| �� }|D �]}|| jD �]}|| j| }t�d� t�d|d |j � t�d� t|tj�snq"| j |_
t�d� | � � |� � t�d� | � � |�
|d � t�d� | � � |�|d � t�d� | � � |�
|d � t�d
� | � � |�|d � t�d � | � � |�� q"qd S ) N�4# ==================================================�
# == %-44s ==� - �# === start ===�# === ban-ipv4 ===r� �# === unban ipv4 ===�# === ban ipv6 ===r� �# === unban ipv6 ===�# === stop ===)r� r� r r� r� �_namer� r� �
CommandActionr� �
executeCmdrp r� r r rc )r r. r �aInfosrI re r r r r" �_testExecActions� s,
z(ServerConfigReaderTests._testExecActionsc C s� t jjdd� ttd| jd�}| �|�� � | �|�� � |j dd�}t
� }|j }|j }|D �] }|d dkr\|d dkr�d|d < n�t
|�d
kr�|d d kr�|d d kr�tj�td
|d �}tj�|�s�tj�td�}||d
< nDt jj�r$t
|�d
k�r$|d dv �r$|d dk�r$d |d< d|d
< z ||� W q\ t�yh } z | �d||f � W Y d }~q\d }~0 0 q\t jj�s�| �|� d S )NT�Zstock)�basedirZ force_enable� share_config)Zallow_no_filesr r� rN r r r� r: r� Zlogsr r� )r: z multi-setr� zDUMMY-REGEX <HOST>z"Command %r has failed. Received %r)rt ru �SkipIfCfgMissingr~ r r� rn �read�
getOptions�convertr r/ � _Transmitter__commandHandlerr� r� r� r� r� r> rv rC rV r� ) r r �streamr. r0 �
cmdHandlerrE rY �er r r" �testCheckStockJailActions� s@
$
�
�
� *
z1ServerConfigReaderTests.testCheckStockJailActionsc C sb |� d|�}t|�\}}d|dgg}t|||| jtd�}| �|�� � |�i � |�|� � � |S )Nz %(__name__)srN r )r� r� )
rh r r} r� r rn r� r� �extendr� )r rI �actZactNameZactOptr� r r r r" �getDefaultJailStream s ��
z,ServerConfigReaderTests.getDefaultJailStreamc
C s� t jjdd� t j�� dd l}t� }|j}|�tj� t
dd��D ]V}tj� |�� dd�}| �
d| |�}|D ] }|�|�\}} | �|d� qn| �|� qBd S ) NTr� r r z*.confz.confr� zj-)rt ru r� Z
SkipIfFast�globr r/ r� r� r� r �basenamerh r� rD rC r� )
r r� r. r0 ZactCfgr� r� rE r[ �resr r r" �testCheckStockAllActions s
z0ServerConfigReaderTests.testCheckStockAllActionsc C s> t jjdd� ddddddd d
d d d
ddddd�
fdddddddddddd d d d d�
fd d!d"d#d$d%d&d'd(d)d*d+� fd,d-d"d#d.d/d0d1d2�fd3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdB�
fdCdDd5d6d7dEdFdGdHdIdJdKdLdMdNdB�
fdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]dB�
fd^d_d`dadSdbdcdddedfdgdhdidjdkdB�
fdldmd5d6dSdndodpdqdrdsdtdudvdwdB�
fdxdyd5d6dSdzd{d|d}d~dd�d�d�d�dB�
fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�dל
fd�d�d�d�d�d�d�d�d�d�d�d�dל
fd�d�d�d�d�d�d�d�d2�fd�d�d�d�d�d�d�d�d2�ff}t� }|j}|j}|D ]>\}}}| �||�}|D ] } |�| �\}
} | �|
d� �q��q�|j } | �
� }
|D �]@\}}}| | j D �]&}| | j | }t �
d� t �
d�|d� |j � t �
d� | �t|tj�� | j|_| �d�� |�� |�d���r�| j|d� d�di� n4|�d���r�|�d���r�| j|d� |d� d�di� | �d�� |�|
d� � |�d���r| j|�d�|�d�d���|d� d�di� |�d���r8| j|d� d�di� | j|d� d�di� | j|�d d�di� | ��d� |�|
d� � | j|�d d�di� | j|�d d�di� | ��d� |�|
�d � |�d���r�| j|�d�|�d�d���|d� d�di� |�d���r| j|d� d�di� | j|�d d�di� | j|�d d�di� | ��d� |�|
�d � | j|�d d�di� | j|�d d�di� |��d ��r | ��d
� |� |
d� �d � | j|��d |�d�d���|�d d�di� |��d
��r |�d
|�d k�r | j|�d
d�di� |��d
��r�| ��d� |� |
�d �d � | j|��d |�d�d���|�d
d�di� |��d ��r�|�d |�d
k�r�| j|�d d�di� |��d��r�| ��d� |� � | j|�d d�di� | ��d� |� � |��d��r | j|�d�d��|�d d�di� �q �q�d S ( NTr� z
j-w-nft-mpzQnftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"])zip Z ipv4_addrzaddr-)zip6 Z ipv6_addrzaddr6-)� `nft add table inet f2b-table`�W`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`�9`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`�`done`)zG`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`z�`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`z�`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`�5`nft delete rule inet f2b-table f2b-chain $hdl; done`z3`nft delete set inet f2b-table addr-set-j-w-nft-mp`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-mp`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)
�ip4�ip6�*-start� ip4-start� ip6-start�flushrc � ip4-check� ip6-check�ip4-ban� ip4-unban�ip6-ban� ip6-unbanz
j-w-nft-apz8nftables-allports[name=%(__name__)s, protocol="tcp,udp"])r� r� )zG`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`zg`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`zi`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z3`nft delete set inet f2b-table addr-set-j-w-nft-ap`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-ap`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`zj-dummyzodummy[name=%(__name__)s, init="=='<family>/<ip>'==bt:<bantime>==bc:<bancount>==", target="/tmp/fail2ban.dummy"])z
family: inet4)z
family: inet6)z$`printf %b "=='/'==bt:600==bc:0==\n"z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`)z9`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`)z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`)zP`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`)zR`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`)zQ`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`)zS`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`) r� r� r� r� rc r� r� r� r� z j-hostsdenyzPhostsdeny[name=%(__name__)s, actionstop="rm <file>", file="/tmp/fail2ban.dummy"])z5`printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`)z^`IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)z8`printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`)za`IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)r� r� r� r� r� r� zj-w-iptables-mpzwiptables-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp,udp,sctp", chain="<known/chain>"])�
`iptables �icmp-port-unreachable)� `ip6tables �icmp6-port-unreachable)r� r� )z�`{ iptables -w -C f2b-j-w-iptables-mp -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-mp || true; iptables -w -A f2b-j-w-iptables-mp -j RETURN; }`z�`{ iptables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp; }`)z�`{ ip6tables -w -C f2b-j-w-iptables-mp -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-mp || true; ip6tables -w -A f2b-j-w-iptables-mp -j RETURN; }`zq`{ ip6tables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp >/dev/null 2>&1; } || z]{ ip6tables -w -I INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp; }`)�$`iptables -w -F f2b-j-w-iptables-mp`�%`ip6tables -w -F f2b-j-w-iptables-mp`)zX`iptables -w -D INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z$`iptables -w -X f2b-j-w-iptables-mp`zY`ip6tables -w -D INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z%`ip6tables -w -X f2b-j-w-iptables-mp`)zX`iptables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`)zY`ip6tables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`)za`iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)
r� r� �*-start-stop-checkr� r� r� rc r� r� r� r� r� r� zj-w-iptables-apzciptables-allports[name=%(__name__)s, bantime="10m", protocol="tcp,udp,sctp", chain="<known/chain>"])z�`{ iptables -w -C f2b-j-w-iptables-ap -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-ap || true; iptables -w -A f2b-j-w-iptables-ap -j RETURN; }`zO`{ iptables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap >/dev/null 2>&1; } || z;{ iptables -w -I INPUT -p $proto -j f2b-j-w-iptables-ap; }`)z�`{ ip6tables -w -C f2b-j-w-iptables-ap -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-ap || true; ip6tables -w -A f2b-j-w-iptables-ap -j RETURN; }`zP`{ ip6tables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap >/dev/null 2>&1; } || z<{ ip6tables -w -I INPUT -p $proto -j f2b-j-w-iptables-ap; }`)�$`iptables -w -F f2b-j-w-iptables-ap`�%`ip6tables -w -F f2b-j-w-iptables-ap`)z7`iptables -w -D INPUT -p $proto -j f2b-j-w-iptables-ap`r� z$`iptables -w -X f2b-j-w-iptables-ap`z8`ip6tables -w -D INPUT -p $proto -j f2b-j-w-iptables-ap`r� z%`ip6tables -w -X f2b-j-w-iptables-ap`)z7`iptables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap`)z8`ip6tables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap`)za`iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-ipsetz\iptables-ipset-proto6[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-iptables-ipset )z f2b-j-w-iptables-ipset6 )z0`for proto in $(echo 'tcp' | sed 's/,/ /g'); do`r� )zM`ipset -exist create f2b-j-w-iptables-ipset hash:ip timeout 0 maxelem 65536 `aJ `{ iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable; }`)zZ`ipset -exist create f2b-j-w-iptables-ipset6 hash:ip timeout 0 maxelem 65536 family inet6`aP `{ ip6tables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable; }`)�$`ipset flush f2b-j-w-iptables-ipset`�%`ipset flush f2b-j-w-iptables-ipset6`)z�`iptables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-iptables-ipset`z�`ip6tables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-iptables-ipset6`)z�`iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`)z�`ip6tables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)z=`ipset -exist add f2b-j-w-iptables-ipset 192.0.2.1 timeout 0`)z3`ipset -exist del f2b-j-w-iptables-ipset 192.0.2.1`)z?`ipset -exist add f2b-j-w-iptables-ipset6 2001:db8:: timeout 0`)z5`ipset -exist del f2b-j-w-iptables-ipset6 2001:db8::`zj-w-iptables-ipset-apzHiptables-ipset-proto6-allports[name=%(__name__)s, chain="<known/chain>"])z f2b-j-w-iptables-ipset-ap )z f2b-j-w-iptables-ipset-ap6 )zP`ipset -exist create f2b-j-w-iptables-ipset-ap hash:ip timeout 0 maxelem 65536 `a `{ iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable; })z]`ipset -exist create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 maxelem 65536 family inet6`a `{ ip6tables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable; })�'`ipset flush f2b-j-w-iptables-ipset-ap`�(`ipset flush f2b-j-w-iptables-ipset-ap6`)z`iptables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z)`ipset destroy f2b-j-w-iptables-ipset-ap`z�`ip6tables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z*`ipset destroy f2b-j-w-iptables-ipset-ap6`)z`iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)z�`ip6tables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)z@`ipset -exist add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 0`)z6`ipset -exist del f2b-j-w-iptables-ipset-ap 192.0.2.1`)zB`ipset -exist add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 0`)z8`ipset -exist del f2b-j-w-iptables-ipset-ap6 2001:db8::`z j-w-iptablesz^iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z�`{ iptables -w -C f2b-j-w-iptables -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables || true; iptables -w -A f2b-j-w-iptables -j RETURN; }z�`{ iptables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto --dport http -j f2b-j-w-iptables; }`)z�`{ ip6tables -w -C f2b-j-w-iptables -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables || true; ip6tables -w -A f2b-j-w-iptables -j RETURN; }z�`{ ip6tables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto --dport http -j f2b-j-w-iptables; }`)�!`iptables -w -F f2b-j-w-iptables`�"`ip6tables -w -F f2b-j-w-iptables`)zA`iptables -w -D INPUT -p $proto --dport http -j f2b-j-w-iptables`r� z!`iptables -w -X f2b-j-w-iptables`zB`ip6tables -w -D INPUT -p $proto --dport http -j f2b-j-w-iptables`r� z"`ip6tables -w -X f2b-j-w-iptables`)zA`iptables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables`)zB`ip6tables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables`)z^`iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z\`iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)za`ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z_`ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-newzbiptables-new[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z�`{ iptables -w -C f2b-j-w-iptables-new -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-new || true; iptables -w -A f2b-j-w-iptables-new -j RETURN; }`z�`{ iptables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new >/dev/null 2>&1; } || { iptables -w -I INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new; }`)z�`{ ip6tables -w -C f2b-j-w-iptables-new -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-new || true; ip6tables -w -A f2b-j-w-iptables-new -j RETURN; }`z�`{ ip6tables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new >/dev/null 2>&1; } || { ip6tables -w -I INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new; }`)�%`iptables -w -F f2b-j-w-iptables-new`�&`ip6tables -w -F f2b-j-w-iptables-new`)zZ`iptables -w -D INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`r� z%`iptables -w -X f2b-j-w-iptables-new`z[`ip6tables -w -D INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`r� z&`ip6tables -w -X f2b-j-w-iptables-new`)zZ`iptables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`)z[`ip6tables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`)zb`iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z``iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)ze`ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zc`ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-xtrezPiptables-xt_recent-echo[name=%(__name__)s, bantime="10m", chain="<known/chain>"])r� z/f2b-j-w-iptables-xtre`)r� z/f2b-j-w-iptables-xtre6`)a" `{ iptables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable; }`)a( `{ ip6tables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable; }`)z4`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre`�`if [ `id -u` -eq 0 ];then`z�`iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;`�`fi`z5`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`r� z�`ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;`r� )z�`{ iptables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z�`{ ip6tables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z=`echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z=`echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z?`echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z?`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`) r� r� r� r� rc r� r� r� r� r� r� zj-w-pfz2pf[name=%(__name__)s, actionstart_on_demand=false]r )zF`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`z
port="<port>"z\`echo "block quick $protocol from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`)�,`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`)zT`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`r� z+`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`)z.`pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`)z4`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`)z7`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`)z5`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`)z8`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`) r� r� r� r� rc r� r� r� r� r� r� z j-w-pf-mpz@pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"])zL`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`zport="http,https"zb`echo "block quick $protocol from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`)�2`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`)z]`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`r� z1`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`)z4`pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`)z:`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`z j-w-pf-apzHpf[actiontype=<allports>, actionstart_on_demand=true][name=%(__name__)s])zL`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`zW`echo "block quick $protocol from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`)�2`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`)z]`pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`r� z1`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`)z4`pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`)z:`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`) r� r� r� r� r� rc r� r� r� r� r� r� z j-w-fwcmd-mpzqfirewallcmd-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])z ipv4 r� )z ipv6 r� )z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`z j-w-fwcmd-apz]firewallcmd-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)zT`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`zT`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-fwcmd-ipsetzXfirewallcmd-ipset[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset )z f2b-j-w-fwcmd-ipset6 )zJ`ipset -exist create f2b-j-w-fwcmd-ipset hash:ip timeout 0 maxelem 65536 `z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`)zW`ipset -exist create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 maxelem 65536 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)�!`ipset flush f2b-j-w-fwcmd-ipset`�"`ipset flush f2b-j-w-fwcmd-ipset6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z#`ipset destroy f2b-j-w-fwcmd-ipset`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z$`ipset destroy f2b-j-w-fwcmd-ipset6`)z:`ipset -exist add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0`)z0`ipset -exist del f2b-j-w-fwcmd-ipset 192.0.2.1`)z<`ipset -exist add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 0`)z2`ipset -exist del f2b-j-w-fwcmd-ipset6 2001:db8::`)
r� r� r� r� r� rc r� r� r� r� zj-w-fwcmd-ipset-apzbfirewallcmd-ipset[name=%(__name__)s, actiontype=<allports>, protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset-ap )z f2b-j-w-fwcmd-ipset-ap6 )zM`ipset -exist create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 0 maxelem 65536 `z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zZ`ipset -exist create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 0 maxelem 65536 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)�$`ipset flush f2b-j-w-fwcmd-ipset-ap`�%`ipset flush f2b-j-w-fwcmd-ipset-ap6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-fwcmd-ipset-ap`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-fwcmd-ipset-ap6`)z=`ipset -exist add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0`)z3`ipset -exist del f2b-j-w-fwcmd-ipset-ap 192.0.2.1`)z?`ipset -exist add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 0`)z5`ipset -exist del f2b-j-w-fwcmd-ipset-ap6 2001:db8::`z
j-fwcmd-rrz4firewallcmd-rich-rules[port="22:24", protocol="tcp"])z
family='ipv4'r� )z
family='ipv6'r� )z�`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z�`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z� `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`)z�`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`z
j-fwcmd-rlz6firewallcmd-rich-logging[port="22:24", protocol="tcp"])a
`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a
`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a
`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`)a `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� z# === check ipv4 ===Zfamilyz*-checkr� z# === check ipv6 ===r� z# === flush ===r� rc ) rt ru r� r r/ r� r� rD rC r� r� r r� r� r� rn r� r� r� r� r� rp r� r; ro r� r r Z_invariantCheckr� rc )r �testJailsActionsr. r0 r� rI r� �testsr� rE r[ r� r r� re r r r r" � testCheckStockCommandActions. sr �1�.���3�3�1�1�3�3
�&����(�(�$�$��� � � � � � a
4 4 ,$ ,$ z4ServerConfigReaderTests.testCheckStockCommandActionsc C s` |}t |t�r|d }t�dd|�}t�ddd� |d�}t |t�rL||d< n|}tjj||d�S ) Nr z\)\s*\|\s*(\S*mail\b[^\n]*)z$) | cat; printf "\\n... | "; echo \1z\bADDRESSES=\$\(dig\s[^\n]+c S s dS )Nz@ADDRESSES="abuse-1@abuse-test-server, abuse-2@abuse-test-server"r )�mr r r" r� n r� z9ServerConfigReaderTests._executeMailCmd.<locals>.<lambda>r )r )r� rS �re�subr� r� r� )r r� r rE r r r" �_executeMailCmde s
��
z'ServerConfigReaderTests._executeMailCmdc C s t jjdd� ddtj�td� d d tj�td� d d
d ifd d
tj�td� d d tj�td� d d
difddtj�td� d d tj�td� d ddd�fddddd�ff}t� }|j}|j }|D ]:\}}}| �
||�}|D ] } |� | �\}
} | � |
d� q�q�|j
} td�}
td�}t� }|D ]�\}}}| | jD ]�}| | j| }t�d � t�d |d |j � t�d � | j|_d
|
fd |ffD ]t\}}|�|��s��q�| �d | � t|�}|�d!� |�d"d#g� tj � ||�}|� |� | j || d$di� �q��qD�q0d S )%NTr� zj-mail-whois-linesz\mail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s", logpath="r� r� z ztestcase01a.logz8", _whois_command="echo '-- information about <ip> --'"]r� )�;The IP 87.142.124.10 has just been banned by Fail2Ban afterz(100 attempts against j-mail-whois-lines.�.Here is more information about 87.142.124.10 :�%-- information about 87.142.124.10 --�2Lines containing failures of 87.142.124.10 (max 2)�etestcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�etestcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10zj-sendmail-whois-lineszxsendmail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd='testmail -f "<sender>" "<dest>"', logpath=")r� z,100 attempts against j-sendmail-whois-lines.r� r� r� r� r� zj-complain-abusez�complain[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s 'Hostname: <ip-host>, family: <family>' - ",debug=1,logpath="z", ])�6try to resolve 10.124.142.87.abuse-contacts.abusix.orgr� r� r� zymail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-server)�htry to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgz0Lines containing failures of 2001:db8::1 (max 2)zwmail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-server)r� r� z j-xarf-abusezIxarf-login-attack[name=%(__name__)s, mailcmd="mail", mailargs="",debug=1])r� z8We have detected abuse from the IP address 87.142.124.10�VDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�UDec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10�8mail abuse-1@abuse-test-server abuse-2@abuse-test-server)r� z6We have detected abuse from the IP address 2001:db8::1r� r z
87.142.124.10z 2001:db8::1r� r� r� r� z # === %s ===r} r� r� r� ) rt ru r� r� r� r� r� r r/ r� r� rD rC r� r r r r� r� r� r� r� r; rp r Z
setAttemptZ
setMatchesr� r� r� r ro )r r� r. r0 r� rI r� r� r� rE r[ r� r r� r� r� re r �testr� r� r r r" � testComplexMailActionMultiLogw s� ��� ���� ��� ���� ��� �� �� ���_
�
z5ServerConfigReaderTests.testComplexMailActionMultiLog)r� )r� )r% r& r' r� r, r9 r� r� r� r� r� r� r� r� r� r^ r r r5 r" r� � s$
"3 =
r� )A�
__author__Z
__copyright__Z __license__rt rw r� r� r� rx rD Zserver.failregexr r r r. r r� Z
server.serverr Z server.ipdnsr r Z server.jailr
Zserver.jailthreadr Z
server.ticketr Z server.utilsr
Z dummyjailr Zutilsr r r Zhelpersr r r r� r r r
r� r� �dirname�__file__r� r3 r� r r( r_ r1 ZTestCaser_ ra rq rs Zclientreadertestcaser} r~ r r� r r r r" �<module> sV
^ l~ U*