File: //usr/lib/python3/dist-packages/fail2ban/tests/__pycache__/servertestcase.cpython-39.pyc
a
���`�] � @ s� d Z dZdZddlZddlZddlZddlZddlZddlZddl Z ddl
m Z m Z m
Z
ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lm Z ddl m Z ddl m Z m!Z!m"Z" ddl#m$Z$m%Z%m&Z& ddl'm(Z( zddlm)Z) W n e*�y dZ)Y n0 ej+�,ej+�-e.�d�Z/dZ0e$d�Z1G dd� de�Z2G dd� de �Z3G dd � d e3�Z4G d d � d e3�Z5G d d � d ej6�Z7G d!d"� d"ej6�Z8G d#d$� d$e�Z9G d%d&� d&e �Z:dd'l;m<Z<m=Z=m>Z> G d(d)� d)e �Z?dS )*z
Cyril Jaquierz Copyright (c) 2004 Cyril JaquierZGPL� N� )�Regex� FailRegex�RegexException)�actions)�Server)�IPAddr)�Jail)�
JailThread)� BanTicket)�Utils� )� DummyJail)�LogCaptureTestCase�
with_alt_time�MyTime)� getLogger�extractOptions�
PREFER_ENC)�version)�
filtersystemd�files�polling�fail2banc @ s e Zd Zdd� Zdd� ZdS )�
TestServerc O s d S �N� ��self�args�kwargsr r �?/usr/lib/python3/dist-packages/fail2ban/tests/servertestcase.py� setLogLevel< s zTestServer.setLogLevelc O s d S r r r r r r! � setLogTarget? s zTestServer.setLogTargetN)�__name__�
__module__� __qualname__r" r# r r r r! r ; s r c sL e Zd Z� fdd�Z� fdd�Zdd d
�Zdd d �Zd
d� Zdd� Z� Z S )�TransmitterBasec s2 t t| ��� | jj| _d| _| j�| jt� dS )� Call before every test case.Z TestJail1N) �superr' �setUp�server�_Server__transm�transm�jailName�addJail� FAST_BACKEND�r �� __class__r r! r* E s
zTransmitterBase.setUpc s | j �� tt| ��� dS �zCall after every test case.N)r+ �quitr) r' �tearDownr1 r2 r r! r6 N s
zTransmitterBase.tearDownr r NFc
s� d||g}d|g}|dur2|� d|� |� d|� |dkr>|}� fdd�} | �| | j�|��| ||f�� |s�| �| | j�|��| d|f�� dS ) zoProcess set/get commands and compare both return values
with outValue if it was given otherwise with inValue�set�getNr
r c s � r t | �S | S )z Prepare value for comparison)�repr��x��repr_r r! �va s z%TransmitterBase.setGetTest.<locals>.vr )�insert� assertEqualr- �proceed)
r �cmd�inValue�outValue�outCode�jailr= �setCmd�getCmdr> r r< r! �
setGetTestT s
zTransmitterBase.setGetTestc C sv d||g}d|g}|d ur2|� d|� |� d|� | j�|�d }| �| j�|�d d� | �| j�|�d|f� d S )Nr7 r8 r
r )r? r- rA r@ )r rB rC rF rG rH Z initValuer r r! �
setGetTestNOKj s
z TransmitterBase.setGetTestNOKc C s� d| }d| }| � | j�d||g�dg f� t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� q6t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt||d d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt||d d � ��fdd� q�d S ) N�add�delr8 r r7 r
r )�level)r@ r- rA � enumerate�assertSortedEqual�list�map�str) r rB �valuesrF �cmdAdd�cmdDel�n�value�retr r r! �jailAddDelTestw s �@B@z TransmitterBase.jailAddDelTestc C s d| }d| }| � | j�d||g�dg f� t|�D ]^\}}| � | j�d|||g�d|d |d � f� | � | j�d||g�d|d |d � f� q6t|�D ]^\}}| � | j�d||dg�d||d d � f� | � | j�d||g�d||d d � f� q�d S )NrK rL r8 r r7 r
)r@ r- rA rN ) r rB ZinValuesZ outValuesrF rT rU rV rW r r r! �jailAddDelRegexTest� s. �����z#TransmitterBase.jailAddDelRegexTest)r r NF)N)
r$ r% r& r* r6 rI rJ rY rZ �
__classcell__r r r2 r! r' C s
r' c s� e Zd Z� fdd�Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zed%d&� �Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z!d=d>� Z"d?d@� Z#dAdB� Z$dCdD� Z%dEdF� Z&dGdH� Z'dIdJ� Z(dKdL� Z)dMdN� Z*dOdP� Z+dQdR� Z,dSdT� Z-dUdV� Z.dWdX� Z/dYdZ� Z0� Z1S )[� Transmitterc s t � | _tt| ��� d S r )r r+ r) r\ r* r1 r2 r r! r* � s zTransmitter.setUpc C s | � | j�� � d S r )� assertFalser+ � isStartedr1 r r r! �testServerIsNotStarted� s z"Transmitter.testServerIsNotStartedc C s | � | j�dg�d� d S )N�stop�r N�r@ r- rA r1 r r r! �testStopServer� s zTransmitter.testStopServerc C s | � | j�dg�d� d S )NZping)r Zpongrb r1 r r r! �testPing� s zTransmitter.testPingc C s | � | j�dg�dtjf� d S )Nr r )r@ r- rA r r1 r r r! � testVersion� s zTransmitter.testVersionc C s| t jjs`t�� }| �| j�ddg�d� t�� }|| }| jd| k oNdk n d| d� n| �| j�ddg�d� d S ) N�sleepz0.1ra g
ףp=
�?g�������?zSleep was %g sec)�msgz0.0001)�unittest�F2B�fast�timer@ r- rA �
assertTrue)r Zt0�t1Zdtr r r! � testSleep� s (zTransmitter.testSleepc C s� t jjst�dd�\}}nd}| �d|� | j�| j� | � d|� | � d|� | � ddd� | �dd� | � d d
d � | �d d� | j�
| jt � | � d|� | j�| j� | � | j
�g d ��d
� | � | j
�ddg�d
� | � | j
�g d��d
� | � | j
�ddg�d
� | � | j
�g d��d
� | � | j
�dd g�d
� | j�
| jt � | � | j
�g d ��d
� t jj�s�t�|� t�|� d S )Nz.dbZ fail2ban_z:memory:�dbfile� dbmaxmatches�100�d ZLIZARD�
dbpurgeage�600�X )r7 ro �Nonera r8 )r7 rp rq )r7 rs �500)rh ri Z memory_db�tempfile�mkstemprJ r+ ZdelJailr. rI r/ r0 r@ r- rA �os�close�unlink)r �tmpZ tmpFilenamer r r! � testDatabase� sj
��
��
��
��
��
��
��
zTransmitter.testDatabasec C s� d}d}d}| � | j�d|dg�d|f� | � | j�d|g�d|f� | � | j�d|dg�d d� | � | j�d|d g�d|f� | � | j�d| jdg�d d� | � | j�g d
��d d� d S ) N� TestJail2� TestJail3Z TestJail4rK r r zinvalid backendr
�auto)rK �--allr �r@ r- rA r. )r Zjail2Zjail3Zjail4r r r! � testAddJail� s& � ����zTransmitter.testAddJailc sp � � � j�d� jg�d� t�tj� � �t� � fdd�d�� � � � j�d� jg�d� � �
� j� j j � d S )N�startra c s& � j �d�o$t� j�d� jg�t� S )Nr
�status�r+ ZisAlive�
isinstancer- rA r. � RuntimeErrorr r1 r r! �<lambda> � z/Transmitter.testStartStopJail.<locals>.<lambda>� r` )
r@ r- rA r. rk rf r �DEFAULT_SLEEP_TIMErl �wait_for� assertNotInr+ �_Server__jailsr1 r r1 r! �testStartStopJail� s �
��z Transmitter.testStartStopJailc s� � j �dt� � �� j�d� jg�d� � �� j�ddg�d� t�t j
� � � t � � fdd�d�� � �� j�ddg�d� � � t � � fd d�d�� � �
� j� j j� � �
d� j j� d S )
Nr r� ra c s& � j �d�o$t� j�d� jg�t� S )Nr r� r� r r1 r r! r� r� z2Transmitter.testStartStopAllJail.<locals>.<lambda>r� r` r� c s t � jj� S r )�lenr+ r� r r1 r r! r� r� )r+ r/ r0 r@ r- rA r. rk rf r r� rl r� r� r� r1 r r1 r! �testStartStopAllJail s ��
�z Transmitter.testStartStopAllJailc C sb | � | j�d| jddg�d� | � | j�d| jddg�d� | � | j�d| jddg�d d � d S )
Nr7 ZidleZon�r TZoff�r FZCATr r
r� r1 r r r! � testJailIdle s ���zTransmitter.testJailIdlec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZfindtimeZ120�x �rF Z60�< Z30m� z-60i���ZDog�rI r. rJ r1 r r r! �testJailFindTime( s
z Transmitter.testJailFindTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZbantimert ru r� Z50�2 z-50i���z
15d 5h 30mi� ZCatr� r1 r r r! �testJailBanTime/ s
zTransmitter.testJailBanTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZ datepattern�%%%Y%m%d%H%M%S)r� z %YearMonthDay24hourMinuteSecondr� �Epoch)Nr� z^Epoch)Nz{^LN-BEG}Epoch�TAI64N)Nr� z
%Cat%a%%%gr� r1 r r r! �testDatePattern6 s �
�
�
�zTransmitter.testDatePatternc C s* | j ddd| jd� | jdd| jd� d S )NZ logtimezonezUTC+0400r� znot-a-time-zoner� r1 r r r! �testLogTimeZoneB s zTransmitter.testLogTimeZonec C s\ | j dd| jd� | j dd| jd� | j dd| jd� d}| �| j�d| jd|g�d� d S ) NZusednsZyesr� �warn�noZFishr7 )r r� )rI r. r@ r- rA �r rW r r r! �testJailUseDNSF s �zTransmitter.testJailUseDNSc C s | j �| j� | �| j�d| jddddg�d� | jddddd � | �| j�d| jdd
g�d � | jd dd
� | �| j�d| jdddddg�d� | jddddd � | jddddd � | �� | �| j�d| jdddg�d d� | �| j�d| jdddg�d� | jddddd � d S )Nr7 �banip� 192.0.2.1� 192.0.2.2)r r �
Ban 192.0.2.1�
Ban 192.0.2.2T��all�waitZBadger�r r
z
Ban Badger�r� �unbanipz 192.0.2.255z 192.0.2.254zUnban 192.0.2.1zUnban 192.0.2.2z192.0.2.255 is not bannedz192.0.2.254 is not bannedz--report-absentr r
)r r )r+ � startJailr. r@ r- rA � assertLogged�pruneLogr1 r r r! �
testJailBanIPQ sF ���������zTransmitter.testJailBanIPc s� � j �� j� � fdd�}� jddd� jd� dD ]&}dD ] }� �||d | g�d
� q:q2� jd d d
d
d� � �||dd� dD ��d
� � jdd
d� � jdd
d� � �d� d S )Nc s � j �d� jd| g| �S )Nr7 �attempt)r- rA r. )�ipZmatchesr1 r r! r� q s z.Transmitter.testJailAttemptIP.<locals>.attempt�maxretry�5� r� )r
r )r� r� �test failure %dr� z 192.0.2.1:2z 192.0.2.2:2Tr� c S s g | ] }d | �qS )r� r )�.0�ir r r! �
<listcomp>{ r� z1Transmitter.testJailAttemptIP.<locals>.<listcomp>)r� � r� z 192.0.2.2:5r� r� r� )r+ r� r. rI r@ r� �assertNotLogged)r r� r� r� r r1 r! �testJailAttemptIPn s z Transmitter.testJailAttemptIPc s� d}� j �|t� � j �|� d d dg f� fdd� }||g d� ||dddgd � ||d
ddd gd � ||d g d
�d� ||dd
d gd� ||d d
gd� ||d
g d� d S )NZTestJailBanListr c s� |d ur6� � � j�d| d|g�d� � jd| dd� |d url� � � j�d| d|g�d� � jd| dd� � j� j�d | dgt|� �d
|fd d � t�t�� d
� d S )Nr7 r� r� zBan %sTr� r� zUnban %sr8 r F)Z
nestedOnlyr
) r@ r- rA r� rO rP r ZsetTimerk )rF r� r� r �outListr1 r r! �_getBanListTest� s" ���z4Transmitter.testJailBanList.<locals>._getBanListTest)r� � 127.0.0.1)z --with-timez:127.0.0.1 2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01)r� r r� � 192.168.0.1z<192.168.0.1 2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02� 192.168.1.10)r� r� r� )r� r� )r� r� )r+ r/ r0 r� )r rF r� r r1 r! �testJailBanList� s6 ��������zTransmitter.testJailBanListc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
NZ
maxmatchesr� r� r� �2r �-2����Duckr� r1 r r r! �testJailMaxMatches� s z Transmitter.testJailMaxMatchesc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
Nr� r� r� r� r� r r� r� r� r� r1 r r r! �testJailMaxRetry� s z Transmitter.testJailMaxRetryc C sP | j ddd| jd� | j ddd| jd� | jdd| jd� | jdd| jd� d S ) NZmaxlinesr� r� r� r� r r� r� r� r1 r r r! �testJailMaxLines� s z Transmitter.testJailMaxLinesc C sN | j dd| jd� | j dd| jd� | j ddt| jd� | jdd| jd� d S )NZ logencodingzUTF-8r� �asciir� ZMonkey)rI r. r rJ r1 r r r! �testJailLogEncoding� s
�z Transmitter.testJailLogEncodingc
C sh | � dtj�td�tj�td�tj�td�g| j� tj�td�}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d | jdg�d|gf� | �| j�d| jd
|g�dg f� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d
g�d d� | �| j�d| jd|||g�d d� d S )NZlogpath�testcase01.logztestcase02.logztestcase03.logztestcase04.logr7 �
addlogpathr r8 Z
dellogpath�tail�headZbadgerr
) rY rz �path�join�TEST_FILES_DIRr. r@ r- rA r� r r r! �testJailLogPath� sj ��
��������������zTransmitter.testJailLogPathc C s2 d}| j �d| jd|g�}| �t|d t�� d S )Nzthis_file_shouldn't_existr7 r� r
)r- rA r. rl r� �IOError)r rW �resultr r r! �testJailLogPathInvalidFile� s
�z&Transmitter.testJailLogPathInvalidFilec C sX t jdd�}|d }t�||� | j�d| jd|g�}| �t|d t �� t�
|� d S )NZtmp_fail2ban_broken_symlink)�prefixz.slinkr7 r� r
) rx Zmktemprz �symlinkr- rA r. rl r� r� r| )r �nameZsnamer� r r r! � testJailLogPathBrokenSymlink� s �z(Transmitter.testJailLogPathBrokenSymlinkc C s� | � dg d�| j� d}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d| jdg�d|gf� | �| j�d| jd|g�dg f� | �| j�d| jd g�d
� | �| j�d| jd d g�d � | �| j�d| jd g�d � d S )
NZignoreip)r� z 192.168.1.1z8.8.8.8r� r7 Z addignoreipr r8 Z delignoreipZ
ignoreselfr� Fr� )rY r. r@ r- rA r� r r r! �testJailIgnoreIP sD � �������z Transmitter.testJailIgnoreIPc C s | j dd| jd� d S )NZ
ignorecommandzbin/ignore-command <ip>r� �rI r. r1 r r r! �testJailIgnoreCommand& s z!Transmitter.testJailIgnoreCommandc C s0 | j ddg d�| jd� | j ddd | jd� d S )NZ ignorecachez%key="<ip>",max-time=1d,max-count=9999)z<ip>i' i�Q r� � r� r1 r r r! �testJailIgnoreCache) s �z Transmitter.testJailIgnoreCachec C s | j dd| jd� d S )NZ prefregexz^Testr� r� r1 r r r! �testJailPrefRegex0 s z Transmitter.testJailPrefRegexc
C s� | � dg d�dt�d� dt�d� dt�d� g| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ failregex)zuser john at <HOST>� Admin user login from <HOST>z failed attempt from <HOST> againzuser john at %s�<HOST>�Admin user login from %sz failed attempt from %s againr7 � addfailregexz
No host regexr r
i� �rZ r Z_resolveHostTagr. r@ r- rA r1 r r r! �
testJailRegex3 s0 �� ��� ���zTransmitter.testJailRegexc C sn | � dg d�ddt�d� dg| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ ignoreregex)� user johnr� �Dont match me!r� r� r� r� r7 ZaddignoreregexzInvalid [regexr r
r� r� r1 r r r! �testJailIgnoreRegexK s0 �� ��� ���z Transmitter.testJailIgnoreRegexc C s� | j g}| �| j�dg�ddt|�fdd�|�fgf� | j�dt� |� d� | �| j�dg�ddt|�fdd�|�fgf� d S )Nr� r zNumber of jailz Jail listz, r )
r. r@ r- rA r� r� r+ r/ r0 �append)r �jailsr r r! �
testStatusc s �
�zTransmitter.testStatusc
C sB | � | j�d| jg�dddddg fgfddd d
g fgfgf� d S ) Nr� r �Filter�zCurrently failedr �z Total failedr � File list�Actions�zCurrently bannedr �z Total bannedr �Banned IP listr� r1 r r r! �testJailStatusl s �����zTransmitter.testJailStatusc
C sD | � | j�d| jdg�dddddg fgfdd d
d g fgfgf� d S ) Nr� Zbasicr r� r� r� r� r� r� r� r� r� r1 r r r! �testJailStatusBasic~ s �����z Transmitter.testJailStatusBasicc
C sD | � | j�d| jdg�dddddg fgfdd d
d g fgfgf� d S ) Nr� �INVALIDr r� r� r� r� r� r� r� r� r� r1 r r r! �testJailStatusBasicKwarg� s �����z$Transmitter.testJailStatusBasicKwargc
C s� t j�� zdd l}dd l}W n ty6 dg}Y n0 g }| �| j�d| j dg�dddddg fgfd d
d d g fd
|fd|fd|fgfgf� d S )Nr �errorr� Zcymrur� r� r� r� r� r� r� r� zBanned ASN listzBanned Country listzBanned RIR list)
rh ri ZSkipIfNoNetworkZ
dns.exceptionZ dns.resolver� ImportErrorr@ r- rA r. )r ZdnsrW r r r! �testJailStatusCymru� s2
�����z Transmitter.testJailStatusCymruc C s� d}g d�}g d�}| � | j�d| jd|g�d|f� | � | j�d| jdg�d d |� t||�D ].\}}| � | j�d| jd
|||g�d|f� qdt||�D ],\}}| � | j�d| jd
||g�d|f� q�| � | j�d| jd
|d d g�d
� | � | j�d| jd
|d g�d
� | � | j�d| jd
|dg�d d � | � | j�d| jd
|ddg�d� | � | j�d| jd
|dg�d� | � | j�d| jd|g�d� | � | j�d| jddg�d d � d S )N�TestCaseAction)Z actionstartZ
actionstopZ actioncheckZ actionbanZ actionunban)z Action Startz Action Stopz Action Checkz
Action Banz Action Unbanr7 � addactionr r8 r r
�actionZKEY�VALUE)r r Z
InvalidKey�timeoutZ10)r �
Z delactionra z
Doesn't exist)r@ r- rA r. �zip)r r ZcmdListZ cmdValueListrB rW r r r! �
testAction� s� �
������������������� ���zTransmitter.testActionc C s� d}z:| j �d| jd|tj�tdd�dg�}| �|d|f� W nX ty� dt j
krbd k r�n n*d
|d v r�dd l }|� d t j
� Y d S � Y n0 | �| j �d
| jd|g�d ddg� | �| j �d
| jd|dg�d� | �| j �d
| jd|dg�d� | �| j �d
| jd|g�d g d�� | �| j �d| jd|ddg�d� | �| j �d| jd|ddg�d� | �| j �d| jd|ddg�d� d S ) Nr r7 r �action.dz action.pyz{"opt1": "value"}r )r � )r r r� z#__init__() keywords must be stringsr
z�Your version of Python %s seems to experience a known issue forbidding correct operation of Fail2Ban: http://bugs.python.org/issue2646 Upgrade your Python and meanwhile other intestPythonActionMethodsAndProperties will be skippedr8 ZactionpropertiesZopt1Zopt2r )r rW ra Z
actionmethods)�banZrebanr� r` �
testmethod�unbanr
z{"text": "world!"})r zHello world! value�
another value)r r )r zHello world! another value)r- rA r. rz r� r� r� r@ �AssertionError�sys� version_info�warningsr� r rO )r r �outr r r r! �$testPythonActionMethodsAndProperties� s�
��
��� ����������������z0Transmitter.testPythonActionMethodsAndPropertiesc C s | � | j�ddg�d d� d S )Nr� �COMMANDr r
rb r1 r r r! �testNOK0 s zTransmitter.testNOKc C s | � | j�g d��d d� d S )N)r7 r� r r r
rb r1 r r r! �
testSetNOK3 s �zTransmitter.testSetNOKc C s | � | j�g d��d d� d S )N)r8 r� r r r
rb r1 r r r! �
testGetNOK7 s �zTransmitter.testGetNOKc C s | � | j�g d��d d� d S )N)r� r� r r r
rb r1 r r r! �
testStatusNOK; s �zTransmitter.testStatusNOKc
C s6 t st�d��d}| j�|d� g d�}t|�D ]>\}}| �| j�d|d|g�ddd � |d |d
� D �f� q0t|�D ]>\}}| �| j�d|d |g�dd d � ||d
d � D �f� qxd
}| �| j�d|d|g�d|ggf� | �| j�d|d|g�d|g|ggf� | �| j�d|d |g�d|ggf� | �| j�d|d |g�dg f� g d�}| �| j�d|dg| �dd
gddggf� | �| j�d|d g|d d
� �dddggf� | �| j�d|d g|dd � �dg f� d}| j�d|d|g�}| � t
|d
t �� d}| j�d|d |g�}| � t
|d
t �� d S )N�&systemd python interface not availabler Zsystemd��_SYSTEMD_UNIT=sshd.servicezTEST_FIELD1=ABCz_HOSTNAME=example.comr7 �addjournalmatchr c S s g | ]
}|g�qS r r �r� �valr r r! r� M r� z0Transmitter.testJournalMatch.<locals>.<listcomp>r
�deljournalmatchc S s g | ]
}|g�qS r r r r r r! r� R r� �
_COMM=sshd)r" �+r �_UID=0r r$ r zThis isn't valid!zFIELD=NotPresent) r rh �SkipTestr+ r/ rN r@ r- rA rl r� �
ValueError)r r. rS rV rW r� r r r! �testJournalMatch? s�
� �
� �
�
�
��
�
�
�� ��� ���
�
�z Transmitter.testJournalMatchc
C s� t st�d��| �d� d}| j�|d� g d�}t|�D ]>\}}| �| j� d|d|g�dd d
� |d |d � D �f� q:t|�D ]>\}}| �| j� d|d |g�dd
d
� ||d d � D �f� q�d S )Nr Tr� zsystemd[journalflags=2]r r7 r r c S s g | ]
}|g�qS r r r r r r! r� � r� z5Transmitter.testJournalFlagsMatch.<locals>.<listcomp>r
r! c S s g | ]
}|g�qS r r r r r r! r� � r� )
r rh r% rl r+ r/ rN r@ r- rA )r r. rS rV rW r r r! �testJournalFlagsMatch� s(
� �
� �z!Transmitter.testJournalFlagsMatch)2r$ r% r& r* r_ rc rd re rn r~ r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r' r( r[ r r r2 r! r\ � s\ 0
+*
% <4Gr\ c sT e Zd Z� fdd�Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
� Z S )�TransmitterLoggingc s> t � | _tt| ��� | j�d� | j�d� | j�d� d S )N� /dev/null�CRITICALr� )r r+ r) r) r* r# r" ZsetSyslogSocketr1 r2 r r! r* � s
zTransmitterLogging.setUpc C s� g }t d�D ],}t�dd�}|�|d � t�|d � q |D ]}| �d|� q>d}| �d|� | j� g d�� |D ]}t�
|� qt| �dd d
� | �dd d � d S )
Nr� r Z transmitterr
r � logtarget�/this/path/should/not/exist)r7 r, r* z STDOUT[format="%(message)s"]ZSTDOUTz!STDERR[datetime=off, padding=off]�STDERR) �rangerx ry r� rz r{ rI rJ r- rA �remove)r Z
logTargets�_ZtmpFileZ logTargetrW r r r! �
testLogTarget� s z TransmitterLogging.testLogTargetc C sJ t j�d�st�d��| �| j�� d� | �dd� | �| j�� d� d S )N�/dev/logz'/dev/log' not presentr� r, �SYSLOG) rz r� �existsrh r% rl r+ ZgetSyslogSocketrI r1 r r r! �testLogTargetSYSLOG� s
z&TransmitterLogging.testLogTargetSYSLOGc C s | � dd� d S )N� syslogsocketz/dev/log/NEW/PATH)rI r1 r r r! �testSyslogSocket� s z#TransmitterLogging.testSyslogSocketc C sd | � dd� | �dd� | � dd� | j d i i tdtd�dd �d
�t�� d v oXtj�d� �� d S )
Nr7 r- r, r4 r3 r
zFailed to change log targetT)rE rD r= )TF)ZLinux)r, r4 ) rI rJ �dict� Exception�platform�systemrz r� r5 r1 r r r! �testSyslogSocketNOK� s ����z&TransmitterLogging.testSyslogSocketNOKc C s� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd � | � dd
� | � dd d
� | �dd � d S )
NZloglevelZ
HEAVYDEBUGZ
TRACEDEBUG�9�DEBUG�INFOZNOTICE�WARNINGZERRORr+ ZcRiTiCaLZBird)rI rJ r1 r r r! � testLogLevel� s z TransmitterLogging.testLogLevelc C s� | � | j�dg�d� �z t�d�\}}t�|� | j�d� | � | j�dd|g�d|f� t d�}|�
d � �z�t�d�\}}t�|� t� ||� |�
d
� | � | j�dg�d� |�
d � t |d ���}t
|�}|�d
�dkr�t
|�}| �|�d�� t
|�}| �|�d�� z:t
|�}|�d�dk�r<| �t|j� n| �d| � W n t�y` Y n0 W d � n1 �sx0 Y t |d ��V}t
|�}|�d�dk�r�t
|�}| �|�d�� | �t|j� |�� W d � n1 �s�0 Y W t�|� n t�|� 0 W zt�|� W n t�y2 Y n0 n&zt�|� W n t�yX Y n0 0 | � | j�g d��d� | � | j�dg�d� d S )NZ flushlogs)r z rolled overz fail2ban.logrA r7 r, r r zBefore file movedzAfter file movedzAfter flushlogs�rzChanged logging target tozBefore file moved
zAfter file moved
zCommand: ['flushlogs']zCException StopIteration or Command: ['flushlogs'] expected. Got: %szrollover performed onzAfter flushlogs
)r7 r, r. )r r. )r Zflushed)r@ r- rA rx ry rz r{ r+ r" r Zwarning�rename�open�next�findrl �endswith� assertRaises�
StopIteration�__next__�failr0 �OSError) r �f�fn�l�f2Zfn2Zline1Zline2rV r r r! �
testFlushLogs� s^
& *�z TransmitterLogging.testFlushLogsc C s� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | j d d d | jd� | j d
d| jd� | j ddd| jd� | j ddd| jd� d S )Nzbantime.increment�trueTr� zbantime.rndtimeZ30minr� zbantime.maxtimez 1000 daysi \&zbantime.factorr� zbantime.formulazGban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)zbantime.multipliersz1 5 30 60 300 720 1440 2880zbantime.overalljailsr� r1 r r r! �testBanTimeIncr s z"TransmitterLogging.testBanTimeIncr) r$ r% r& r* r2 r6 r8 r= rB rR rT r[ r r r2 r! r) � s
0r) c @ s e Zd Zdd� ZdS )� JailTestsc C s d}t |�}| �|j|� d S )NZveryveryverylongname)r r@ r� )r ZlongnamerF r r r! � testLongName s zJailTests.testLongNameN)r$ r% r& rV r r r r! rU s rU c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�
RegexTestsc C s. | � ttd� | � ttd� | � ttd� d S )Nr� � � )rI r r r1 r r r! �testInit% s zRegexTests.testInitc C s8 | � ttd���dd�d� | �ttd���d�� d S )N�a�"�'z
Regex('a')r� z
FailRegex()r@ rR r �replacerl r �
startswithr1 r r r! �testStr+ s zRegexTests.testStrc C s | � ttd� | � ttd� | �td�� | �td�� | �td�� | �td�� | �td�� | �td�� | �td �� td
�}| �|�� � |�d g� | �|�� � | � t|j� td �}| �|�� � |�d
g� | �|�� � | � t|j� td�}| �|�� � |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� td�}| �|�� � |�dg� | �|�� � | �|� � d� td�}|�dg� |�
� }| �||j fd� |�dg� |�
� }| �||j fd� |�d g� |�
� }| �||j fd � |�d g� |�
� }| �||j fd � td �}|�d!g� |�
� }| �||j fd"� |�d#g� |�
� }| �||j fd� |�d$g� |�
� }| �||j fd%� |�d&g� |�
� }| �||j fd'� d S )(Nr� z^test no group$z^test <HOST> group$z^test <IP4> group$z^test <IP6> group$z^test <DNS> group$z<^test id group: ip:port = <F-ID><IP4>(?::<F-PORT/>)?</F-ID>$z-^test id group: user:\(<F-ID>[^\)]+</F-ID>\)$z#^test id group: anything = <F-ID/>$z %%<HOST>?)z%%r� r� z#%%inet(?:=<F-IP4/>|inet6=<F-IP6/>)?)z %%inet=testr� r� z(%%(?:inet(?:=<IP4>|6=<IP6>)?|dns=<DNS>?))z%%inet=192.0.2.1r� r� r� )z%%inet6=2001:DB8::r� r� �
2001:DB8::)z%%dns=example.comr� r� z example.com)z%test id group: user:(test login name)r� r� ztest login namez%%net=<SUBNET>)z%%net=192.0.2.1r� r� )r� �inet4)z%%net=192.0.2.1/24r� r� )z 192.0.2.0/24rb )z%%net=2001:DB8:FF:FF::1r� r� )z2001:db8:ff:ff::1�inet6)z%%net=2001:DB8:FF:FF::1/60r� r� )z2001:db8:ff:f0::/60rc z %%ip="<ADDR>", mask="<CIDR>?")z%%ip="192.0.2.2", mask=""r� r� )r� rb )z%%ip="192.0.2.2", mask="24"r� r� )z"%%ip="2001:DB8:2FF:FF::1", mask=""r� r� )z2001:db8:2ff:ff::1rc )z$%%ip="2001:DB8:2FF:FF::1", mask="60"r� r� )z2001:db8:2ff:f0::/60rc ) rI r r rl r] Z
hasMatched�searchZgetHostr@ Z getFailIDZgetIPZ familyStr)r �frr� r r r! �testHost1 sz zRegexTests.testHostN)r$ r% r& rZ r` rf r r r r! rW # s rW c @ s e Zd Zdd� ZdS )�
_BadThreadc C s t d��d S )Nzrun bad thread exception)r� r1 r r r! �runy s z_BadThread.runN)r$ r% r& rh r r r r! rg x s rg c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� LoggingTestsc C s* t d�}| �|jjd� | �|jd� d S )Nz fail2ban.some.string.with.namer z
fail2ban.name)r r@ �parentr� )r Z
testLogSysr r r! �testGetF2BLogger s z LoggingTests.testGetF2BLoggerc s� t j}g ��fdd�t _z<t� }|�� |�� � �t�� �fdd�d�� W |t _n|t _0 � �d� � � t
��d� � � �d d t � d S )Nc s
� � | �S r )r� )r r: r r! r� � r� z5LoggingTests.testFail2BanExceptHook.<locals>.<lambda>c s t ��o� �d�S )N�Unhandled exception)r� Z
_is_loggedr �r r; r r! r� � r� r� rl r
r ) r �__excepthook__rg r� r� rl r r� r� r@ r� r� )r Z prev_exchookZ badThreadr rm r! �testFail2BanExceptHook� s
z#LoggingTests.testFail2BanExceptHookc
C s� g }t �dd�\}}t�|� |�|� t �dd�\}}t�|� |�|� t� }zT|j||dd� | �|�� � | � d� W |�
� |D ]}tj � |�r�t�
|� q�n*|�
� |D ]}tj � |�r�t�
|� q�0 d S )Nz
fail2ban.sockzf2b-testz fail2ban.pidF)ZforcezServer already running)rx ry rz r{ r� r r� r] r^ r� r5 r� r5 r0 )r Z tmp_filesZsock_fdZ sock_nameZ
pidfile_fdZ pidfile_namer+ rN r r r! �testStartFailedSockExists� s(
� z&LoggingTests.testStartFailedSockExistsN)r$ r% r& rk ro rp r r r r! ri } s ri )� ActionReader� JailsReader�
CONFIG_DIRc s� e Zd Z� fdd�Z� fdd�Z� fdd�Zddd �Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z ddd�Z
dd� Z� ZS ) �ServerConfigReaderTestsc s t t| �j|i |�� i | _d S r )r) rt �__init__�#_ServerConfigReaderTests__share_cfgr r2 r r! ru � s z ServerConfigReaderTests.__init__c s t t| ��� g | _dS )r( N)r) rt r* Z _execCmdLstr1 r2 r r! r* � s z ServerConfigReaderTests.setUpc s t t| ��� dS r4 )r) rt r6 r1 r2 r r! r6 � s z ServerConfigReaderTests.tearDownr� c C s6 |� d�D ]&}|�d�s&t�d|� q
t�|� q
dS )N�
�#zexec-cmd: `%s`T)�splitr_ �logSys�debug)r �realCmdr rP r r r! � _executeCmd� s
z#ServerConfigReaderTests._executeCmdc C sP t | d�sJt� }i | _dD ].\}}t|�}|�d� tj�||�| j|< q| jS )NZ__aInfos))�ipv4r� )�ipv6ra ru )�hasattrr Z _ServerConfigReaderTests__aInfosr Z
setBanTime�_actionsr� �
ActionInfo)r �dmyjail�tr� �ticketr r r! �_testActionInfos� s
z(ServerConfigReaderTests._testActionInfosc C s2 |j }| �� }|D �]}|| jD �]}|| j| }t�d� t�d|d |j � t�d� t|tj�snq"| j |_
t�d� | � � |� � t�d� | � � |�
|d � t�d� | � � |�|d � t�d� | � � |�
|d � t�d
� | � � |�|d � t�d � | � � |�� q"qd S ) N�4# ==================================================�
# == %-44s ==� - �# === start ===�# === ban-ipv4 ===r~ �# === unban ipv4 ===�# === ban ipv6 ===r �# === unban ipv6 ===�# === stop ===)r� r� r rz r{ �_namer� r� �
CommandActionr} �
executeCmdr� r� r r r` )r r+ r� �aInfosrF r[ r r r r! �_testExecActions� s,
z(ServerConfigReaderTests._testExecActionsc C s� t jjdd� ttd| jd�}| �|�� � | �|�� � |j dd�}t
� }|j }|j }|D �] }|d dkr\|d dkr�d|d < n�t
|�d
kr�|d d kr�|d d kr�tj�td
|d �}tj�|�s�tj�td�}||d
< nDt jj�r$t
|�d
k�r$|d dv �r$|d dk�r$d |d< d|d
< z ||� W q\ t�yh } z | �d||f � W Y d }~q\d }~0 0 q\t jj�s�| �|� d S )NT�Zstock)�basedirZ force_enable� share_config)Zallow_no_filesr r� rK r r r� r7 r� Zlogsr
r� )r7 z multi-setr� zDUMMY-REGEX <HOST>z"Command %r has failed. Received %r)rh ri �SkipIfCfgMissingrr rs rv rl �read�
getOptions�convertr r, � _Transmitter__commandHandlerr� rz r� r� r� r5 rj r: rL r� ) r r� �streamr+ r- �
cmdHandlerrB rO �er r r! �testCheckStockJailActions� s@
$
�
�
� *
z1ServerConfigReaderTests.testCheckStockJailActionsc C sb |� d|�}t|�\}}d|dgg}t|||| jtd�}| �|�� � |�i � |�|� � � |S )Nz %(__name__)srK r )r� r� )
r^ r rq rv rs rl r� r� �extendr� )r rF �actZactNameZactOptr� r r r r! �getDefaultJailStream s ��
z,ServerConfigReaderTests.getDefaultJailStreamc
C s� t jjdd� t j�� dd l}t� }|j}|�tj� t
dd��D ]V}tj� |�� dd�}| �
d| |�}|D ] }|�|�\}} | �|d� qn| �|� qBd S ) NTr� r r
z*.confz.confr� zj-)rh ri r� Z
SkipIfFast�globr r, rz r� r� rs �basenamer^ r� rA r@ r� )
r r� r+ r- ZactCfgr� r� rB rX �resr r r! �testCheckStockAllActions. s
z0ServerConfigReaderTests.testCheckStockAllActionsc C s t jjdd� ddddddd d
d d d
ddddd�
fdddddddddddd d d d d�
fd d!d"d#d$d%d&d'd(d)d*d+� fd,d-d"d#d.d/d0d1d2�fd3d4d5d6d7d8d9d:d;d<d=d>d?d@dA� fdBdCd5d6dDdEdFdGdHdIdJdKdLdMdA� fdNdOdPdQdRdSdTdUdVdWdXdYdZ�
fd[d\d]d^d_d`dadbdcdddedfdZ�
fdgdhd5d6didjdkdldmdndodpdqdrdA� fdsdtd5d6dudvdwdxdydzd{d|d}d~dA� fdd�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�dA� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�dZ�
fd�d�d�d�d�d�d�d�d�d�d�d�dZ�
fd�d�d�d�d�d�d�d�d2�fd�d�d�d�d�d�d�d�d2�ff}t� }|j}|j}|D ]>\}}}| �||�}|D ] } |�| �\}
} | �|
d� �q��q�|j } | �
� }
|D �]\}}}| | j D �] }| | j | }t �
d� t �
d�|d� |j � t �
d� | �t|tj�� | j|_| �d� |�� |�d��r�| j|d� d�di� n4|�d��r�|�d��r�| j|d� |d� d�di� | �d� |�|
d� � |�d��r�| j|�d�d��|d� d�di� |�d��r | j|d� d�di� | j|�d�d��|d� d�di� | j|d� d�di� | �d�� |�|
d� � | j|�d�d��|d� d�di� | j|d� d�di� | �d�� |�|
d� � |�d��r�| j|�d�d��|d� d�di� |�d��r | j|d� d�di� | j|�d�d��|d� d�di� | j|�d d�di� | ��d� |�|
d� � | j|�d�d��|�d d�di� | j|�d d�di� |��d��r�| ��d� |� � | j|�d d�di� | ��d� |� � |��d��r�| j|�d d�di� �q��q�d S ( NTr� z
j-w-nft-mpzQnftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"])zip Z ipv4_addrzaddr-)zip6 Z ipv6_addrzaddr6-)� `nft add table inet f2b-table`�W`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`z9`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`z`done`)zG`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`z�`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`z�`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`�5`nft delete rule inet f2b-table f2b-chain $hdl; done`z3`nft delete set inet f2b-table addr-set-j-w-nft-mp`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-mp`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)
�ip4�ip6�*-start� ip4-start� ip6-start�flushr` � ip4-check� ip6-check�ip4-ban� ip4-unban�ip6-ban� ip6-unbanz
j-w-nft-apz8nftables-allports[name=%(__name__)s, protocol="tcp,udp"])r� r� )zG`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`zg`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`zi`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z3`nft delete set inet f2b-table addr-set-j-w-nft-ap`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-ap`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`zj-dummyzodummy[name=%(__name__)s, init="=='<family>/<ip>'==bt:<bantime>==bc:<bancount>==", target="/tmp/fail2ban.dummy"])z
family: inet4)z
family: inet6)z$`printf %b "=='/'==bt:600==bc:0==\n"z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`)z9`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`)z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`)zP`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`)zR`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`)zQ`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`)zS`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`) r� r� r� r� r` r� r� r� r� z j-hostsdenyzPhostsdeny[name=%(__name__)s, actionstop="rm <file>", file="/tmp/fail2ban.dummy"])z5`printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`)z^`IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)z8`printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`)za`IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)r� r� r� r� r� r� zj-w-iptables-mpzniptables-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])�
`iptables �icmp-port-unreachable)� `ip6tables �icmp6-port-unreachable)z$`iptables -w -N f2b-j-w-iptables-mp`z.`iptables -w -A f2b-j-w-iptables-mp -j RETURN`zU`iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`)z%`ip6tables -w -N f2b-j-w-iptables-mp`z/`ip6tables -w -A f2b-j-w-iptables-mp -j RETURN`zV`ip6tables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`)�$`iptables -w -F f2b-j-w-iptables-mp`�%`ip6tables -w -F f2b-j-w-iptables-mp`)zU`iptables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z$`iptables -w -X f2b-j-w-iptables-mp`zV`ip6tables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z%`ip6tables -w -X f2b-j-w-iptables-mp`)z>`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`)z?`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`)za`iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`) r� r� r� r� r� r` r� r� r� r� r� r� zj-w-iptables-apzZiptables-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z$`iptables -w -N f2b-j-w-iptables-ap`z.`iptables -w -A f2b-j-w-iptables-ap -j RETURN`z4`iptables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`)z%`ip6tables -w -N f2b-j-w-iptables-ap`z/`ip6tables -w -A f2b-j-w-iptables-ap -j RETURN`z5`ip6tables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`)�$`iptables -w -F f2b-j-w-iptables-ap`�%`ip6tables -w -F f2b-j-w-iptables-ap`)z4`iptables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`r� z$`iptables -w -X f2b-j-w-iptables-ap`z5`ip6tables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`r� z%`ip6tables -w -X f2b-j-w-iptables-ap`)z>`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`)z?`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`)za`iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-ipsetz\iptables-ipset-proto6[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-iptables-ipset )z f2b-j-w-iptables-ipset6 )z8`ipset create f2b-j-w-iptables-ipset hash:ip timeout 0 `z�`iptables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`)zE`ipset create f2b-j-w-iptables-ipset6 hash:ip timeout 0 family inet6`z�`ip6tables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)�$`ipset flush f2b-j-w-iptables-ipset`�%`ipset flush f2b-j-w-iptables-ipset6`)z�`iptables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-iptables-ipset`z�`ip6tables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-iptables-ipset6`)z=`ipset add f2b-j-w-iptables-ipset 192.0.2.1 timeout 0 -exist`)z3`ipset del f2b-j-w-iptables-ipset 192.0.2.1 -exist`)z?`ipset add f2b-j-w-iptables-ipset6 2001:db8:: timeout 0 -exist`)z5`ipset del f2b-j-w-iptables-ipset6 2001:db8:: -exist`)
r� r� r� r� r� r` r� r� r� r� zj-w-iptables-ipset-apzHiptables-ipset-proto6-allports[name=%(__name__)s, chain="<known/chain>"])z f2b-j-w-iptables-ipset-ap )z f2b-j-w-iptables-ipset-ap6 )z;`ipset create f2b-j-w-iptables-ipset-ap hash:ip timeout 0 `zu`iptables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zH`ipset create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 family inet6`zx`ip6tables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)�'`ipset flush f2b-j-w-iptables-ipset-ap`�(`ipset flush f2b-j-w-iptables-ipset-ap6`)zu`iptables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z)`ipset destroy f2b-j-w-iptables-ipset-ap`zx`ip6tables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z*`ipset destroy f2b-j-w-iptables-ipset-ap6`)z@`ipset add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 0 -exist`)z6`ipset del f2b-j-w-iptables-ipset-ap 192.0.2.1 -exist`)zB`ipset add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 0 -exist`)z8`ipset del f2b-j-w-iptables-ipset-ap6 2001:db8:: -exist`z j-w-iptablesz^iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z!`iptables -w -N f2b-j-w-iptables`z+`iptables -w -A f2b-j-w-iptables -j RETURN`z>`iptables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`)z"`ip6tables -w -N f2b-j-w-iptables`z,`ip6tables -w -A f2b-j-w-iptables -j RETURN`z?`ip6tables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`)�!`iptables -w -F f2b-j-w-iptables`�"`ip6tables -w -F f2b-j-w-iptables`)z>`iptables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`r� z!`iptables -w -X f2b-j-w-iptables`z?`ip6tables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`r� z"`ip6tables -w -X f2b-j-w-iptables`)z;`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`)z<`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`)z^`iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z\`iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)za`ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z_`ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-newzbiptables-new[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z%`iptables -w -N f2b-j-w-iptables-new`z/`iptables -w -A f2b-j-w-iptables-new -j RETURN`zW`iptables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`)z&`ip6tables -w -N f2b-j-w-iptables-new`z0`ip6tables -w -A f2b-j-w-iptables-new -j RETURN`zX`ip6tables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`)�%`iptables -w -F f2b-j-w-iptables-new`�&`ip6tables -w -F f2b-j-w-iptables-new`)zW`iptables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`r� z%`iptables -w -X f2b-j-w-iptables-new`zX`ip6tables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`r� z&`ip6tables -w -X f2b-j-w-iptables-new`)z?`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`)z@`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`)zb`iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z``iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)ze`ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zc`ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-xtrezPiptables-xt_recent-echo[name=%(__name__)s, bantime="10m", chain="<known/chain>"])r� z/f2b-j-w-iptables-xtre`)r� z/f2b-j-w-iptables-xtre6`)z�`if [ `id -u` -eq 0 ];then iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`)z�`if [ `id -u` -eq 0 ];then ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`)z4`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre`z�`if [ `id -u` -eq 0 ];then iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`z5`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`z�`if [ `id -u` -eq 0 ];then ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`)z3`test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z4`test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z=`echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z=`echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z?`echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z?`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`) r� r� r� r� r` r� r� r� r� r� r� zj-w-pfz2pf[name=%(__name__)s, actionstart_on_demand=false]r )zF`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`z
port="<port>"z\`echo "block quick proto tcp from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`)�,`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`)zT`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`r� z+`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`)z.`pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`)z4`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`)z7`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`)z5`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`)z8`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`) r� r� r� r� r` r� r� r� r� r� r� z j-w-pf-mpz@pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"])zL`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`zport="http,https"zb`echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`)�2`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`)z]`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`r� z1`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`)z4`pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`)z:`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`z j-w-pf-apzHpf[actiontype=<allports>, actionstart_on_demand=true][name=%(__name__)s])zL`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`zW`echo "block quick proto tcp from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`)�2`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`)z]`pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`r� z1`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`)z4`pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`)z:`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`z j-w-fwcmd-mpzqfirewallcmd-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])z ipv4 r� )z ipv6 r� )z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`z j-w-fwcmd-apz]firewallcmd-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)zT`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`zT`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-fwcmd-ipsetzXfirewallcmd-ipset[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset )z f2b-j-w-fwcmd-ipset6 )z5`ipset create f2b-j-w-fwcmd-ipset hash:ip timeout 0 `z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`)zB`ipset create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)�!`ipset flush f2b-j-w-fwcmd-ipset`�"`ipset flush f2b-j-w-fwcmd-ipset6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z#`ipset destroy f2b-j-w-fwcmd-ipset`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z$`ipset destroy f2b-j-w-fwcmd-ipset6`)z:`ipset add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0 -exist`)z0`ipset del f2b-j-w-fwcmd-ipset 192.0.2.1 -exist`)z<`ipset add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 0 -exist`)z2`ipset del f2b-j-w-fwcmd-ipset6 2001:db8:: -exist`zj-w-fwcmd-ipset-apzbfirewallcmd-ipset[name=%(__name__)s, actiontype=<allports>, protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset-ap )z f2b-j-w-fwcmd-ipset-ap6 )z8`ipset create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 0 `z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zE`ipset create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 0 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)�$`ipset flush f2b-j-w-fwcmd-ipset-ap`�%`ipset flush f2b-j-w-fwcmd-ipset-ap6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-fwcmd-ipset-ap`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-fwcmd-ipset-ap6`)z=`ipset add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0 -exist`)z3`ipset del f2b-j-w-fwcmd-ipset-ap 192.0.2.1 -exist`)z?`ipset add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 0 -exist`)z5`ipset del f2b-j-w-fwcmd-ipset-ap6 2001:db8:: -exist`z
j-fwcmd-rrz4firewallcmd-rich-rules[port="22:24", protocol="tcp"])z
family='ipv4'r� )z
family='ipv6'r� )z�`ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z�`ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`)z�`ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`z
j-fwcmd-rlz6firewallcmd-rich-logging[port="22:24", protocol="tcp"])a" `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a% `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a% `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`)a' `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`r r� r� r� r� r� r� r� r� r� r~ r� r� r� r� r� r� r� r r� r� r� r� r� r� z# === flush ===r� r` ) rh ri r� r r, r� r� rA r@ r� r� r rz r{ r� rl r� r� r� r} r� r� r� r8 r� r� r r r� r` )r �testJailsActionsr+ r- r� rF r� �testsr� rB rX r� r� r� r[ r r r r! � testCheckStockCommandActionsB sF �1�.���,�,�$�$�,�,�"����(�(�$�$��� � � � � � '
,
, " z4ServerConfigReaderTests.testCheckStockCommandActionsc C s` |}t |t�r|d }t�dd|�}t�ddd� |d�}t |t�rL||d< n|}tjj||d�S ) Nr z\)\s*\|\s*(\S*mail\b[^\n]*)z$) | cat; printf "\\n... | "; echo \1z\bADDRESSES=\$\(dig\s[^\n]+c S s dS )Nz@ADDRESSES="abuse-1@abuse-test-server, abuse-2@abuse-test-server"r )�mr r r! r� ; r� z9ServerConfigReaderTests._executeMailCmd.<locals>.<lambda>r
)r )r� rP �re�subr� r� r� )r r| r rB r r r! �_executeMailCmd2 s
��
z'ServerConfigReaderTests._executeMailCmdc C s t jjdd� ddtj�td� d d tj�td� d d
d ifd d
tj�td� d d tj�td� d d
difddtj�td� d d tj�td� d ddd�fddddd�ff}t� }|j}|j }|D ]:\}}}| �
||�}|D ] } |� | �\}
} | � |
d� q�q�|j
} td�}
td�}t� }|D ]�\}}}| | jD ]�}| | j| }t�d � t�d |d |j � t�d � | j|_d
|
fd |ffD ]t\}}|�|��s��q�| �d | � t|�}|�d!� |�d"d#g� tj � ||�}|� |� | j || d$di� �q��qD�q0d S )%NTr� zj-mail-whois-linesz\mail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s", logpath="r� rw z ztestcase01a.logz8", _whois_command="echo '-- information about <ip> --'"]r� )�;The IP 87.142.124.10 has just been banned by Fail2Ban afterz(100 attempts against j-mail-whois-lines.�.Here is more information about 87.142.124.10 :�%-- information about 87.142.124.10 --�2Lines containing failures of 87.142.124.10 (max 2)�etestcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�etestcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10zj-sendmail-whois-lineszxsendmail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd='testmail -f "<sender>" "<dest>"', logpath=")r� z,100 attempts against j-sendmail-whois-lines.r� r� r� r� r� zj-complain-abusez�complain[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s 'Hostname: <ip-host>, family: <family>' - ",debug=1,logpath="z", ])�6try to resolve 10.124.142.87.abuse-contacts.abusix.orgr� r� r� zymail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-server)�htry to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgz0Lines containing failures of 2001:db8::1 (max 2)zwmail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-server)r� r� z j-xarf-abusezIxarf-login-attack[name=%(__name__)s, mailcmd="mail", mailargs="",debug=1])r� z8We have detected abuse from the IP address 87.142.124.10�VDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�UDec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10�8mail abuse-1@abuse-test-server abuse-2@abuse-test-server)r� z6We have detected abuse from the IP address 2001:db8::1r� r z
87.142.124.10z 2001:db8::1r� r� r� r� z # === %s ===rr r� r� r� ) rh ri r� rz r� r� r� r r, r� r� rA r@ r� r r r rz r{ r� r� r� r8 r� r Z
setAttemptZ
setMatchesr� r� r� r r� )r r� r+ r- r� rF r� r� r� rB rX r� r� r~ r r� r[ r �testr� r� r r r! � testComplexMailActionMultiLogD s� ��� ���� ��� ���� ��� �� �� ���_
�
z5ServerConfigReaderTests.testComplexMailActionMultiLog)r� )r� )r$ r% r& ru r* r6 r} r� r� r� r� r� r� r� r� r[ r r r2 r! rt � s"
"3 u
rt )@�
__author__Z
__copyright__Z __license__rh rk rx rz r� r r; Zserver.failregexr r r r+ r r� Z
server.serverr Z server.ipdnsr Z server.jailr Zserver.jailthreadr
Z
server.ticketr Z server.utilsr Z dummyjailr Zutilsr r r Zhelpersr r r r� r r r r� r� �dirname�__file__r� r0 rz r r' r\ r) ZTestCaserU rW rg ri Zclientreadertestcaserq rr rs rt r r r r! �<module> sX
[ } U*