File: //lib/python3/dist-packages/fail2ban/tests/__pycache__/actiontestcase.cpython-38.pyc
U
]^ ^ � @ s� d Z dZdZddlZddlZddlZddlZddlmZm Z m
Z
ddl m Z m
Z
ddlmZ d d
lmZ d d lmZmZmZ G d d
� d
e�ZdS )z
Cyril Jaquierz Copyright (c) 2004 Cyril JaquierZGPL� N� )�
CommandAction�
CallingMap�substituteRecursiveTags)� OrderedDict�Actions)�Utils� )� DummyJail)�
pid_exists� with_tmpdir�LogCaptureTestCasec @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
e dd� �Z dd� Z
e dd� �Ze dd� �Ze dd� �Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5S )6�CommandActionTestc s> t ��� tdd��_d�_�jj� � �fdd�}|�j_dS )z Call before every test case.NZTestFc s d�_ � � S )NT)�"_CommandActionTest__action_started� �Zorgstart�selfr �?/usr/lib/python3/dist-packages/fail2ban/tests/actiontestcase.py�
_action_start1 s z.CommandActionTest.setUp.<locals>._action_start)r
�setUpr �_CommandActionTest__actionr �start)r r r r r r * s
zCommandActionTest.setUpc C s | j r| j�� t�| � dS )zCall after every test case.N)r r �stopr
�tearDown�r r r r r 6 s
zCommandActionTest.tearDownc
C s� dddd�}| � tdd� � | � tdd� � | � tdd� � | � td d� � | � td
d� � tr�| �ttd ��d d
ddd�� | �ttd��dddd
ddd�� | �ttd��td�� | � tdd� � | � tdd� � | �tdd i�dd i� | �td d d ��d d d �� | �td!d"d#��d$d"d#�� | �td%d"d#��d&d"d#�� | �td'd(d)d*��d+d(d)d*�� | �t|�dd,d-d�� | �td.d/d0��d1d/d0�� | �td.d/d2d3��d2d/d2d3�� | �td4d5d2d3��d6d5d2d3�� d S )7N� 192.0.2.0z
123 <HOST>z 890 <ABC>��HOST�ABC�xyzc S s t ddi�S )N�A�<A>�r r r r r �<lambda>D � z?CommandActionTest.testSubstituteRecursiveTags.<locals>.<lambda>c S s t ddd��S )N�<B>r! �r �Br" r r r r r# F r$ c S s t dddd��S )Nr% �<C>r! )r r' �Cr" r r r r r# H r$ c S s t ddddd��S )Nzto=<B> fromip=<IP>r% r( � )r r) r' �Dr" r r r r r# K r$ c S s t ddddd��S )Nzto=<honeypot> fromip=<IP>z
<honeypot>z<sweet>r* )� failregexZsweet�honeypot� ignoreregexr" r r r r r# M r$ ))�Xzx=x<T>��T�1)�Zz <X> <T> <Y>��Yzy=y<T>zx=x1r2 zy=y1z x=x1 1 y=y1)r/ r1 r5 r3 ))r/ zx=x<T> <Z> <<R1>> <<R2>>)�R1r3 )�R2r5 r0 )r3 z<T> <Y>r4 zx=x1 1 y=y1 1 y=y1 y=y1r3 r5 z1 y=y1)r/ r6 r7 r1 r3 r5 )
)� actionstartzgipset create <ipmset> hash:ip timeout <bantime> family <ipsetfamily>
<iptables> -I <chain> <actiontype>)�ipmsetz
f2b-<name>��name�any�ZbantimeZ600�Z ipsetfamilyZinet)�iptablesziptables <lockingopt>�Z
lockingoptz-w��chainZINPUT)�
actiontypez <multiport>)� multiportzY-p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>�ZprotocolZtcp�ZportZssh�Z blocktypeZREJECT)
)r8 z�ipset create f2b-any hash:ip timeout 600 family inet
iptables -w -I INPUT -p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT)r9 zf2b-anyr: r= r> )r? z iptables -wr@ rA )rC �I-p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT)rD rH rE rF rG c S s t td��S )N)�r z<<B><C>>�r' r+ �r) �E�ZDEz cycle <A>�r r r r r r r# { r$ c S s t td��S )N)rM rI rJ rK rN r r r r r# � r$ r r( z <C> <D> <X>Zfun)r r/ z <C> <D> funz<C> <B>Zcoolr& z<C> coolz
<matches> <B>z<matches> coolz/to=<honeypot> fromip=<IP> evilperson=<honeypot>Zpokier* )r, r- r. z%to=pokie fromip=<IP> evilperson=pokiez
123 192.0.2.0z890 123 192.0.2.0z <<PREF>HOST>ZIPV4)r �PREFz
<IPV4HOST>z1.2.3.4)r rO ZIPV4HOSTz A <IP<PREF>HOST> B IP<PREF> CZV4zA 1.2.3.4 B IPV4 C)� assertRaises�
ValueErrorr � assertEqualr �r �aInfor r r �testSubstituteRecursiveTags< sx ������� ���� ��
���
�
�z-CommandActionTest.testSubstituteRecursiveTagsc s� t ddd� ddd��� t� � ddd�� d< ��t� fdd�� t� � d � d
< ��t� fd d�� ���j�d � �d
� ���j�d� �d� ��t� �fdd�� ���j�d� �d � d S )Nr c S s dS )Nz<A><A>r r r r r r# � r$ zHCommandActionTest.testSubstRec_DontTouchUnusedCallable.<locals>.<lambda>r* )r r' r) r+ c S s dt | d � S )N� r ��int)r �ir r r r# � r$ r) c s � d S )Nr) r r ��cmr r r# � r$ �test=<C>r+ c s t � �S �Nr" r rZ r r r# � r$ ztest=<A>ztest=0ztest=<A>--<B>--<A>ztest=0--<A><A>--0c s �j �d� �S )Nr\ )r �
replaceTagr �r[ r r r r# � r$ z<D>)r )r r rP �ZeroDivisionErrorrR r r^ r r r_ r �$testSubstRec_DontTouchUnusedCallable� s �z6CommandActionTest.testSubstRec_DontTouchUnusedCallablec C s� dddd�}| � | j�d|�d� | � | j�d|�d� | � | j�d |�d
� | � | j�d d d
i�d� | � | j�ddd
i�d� | � | j�dddi�d� d|d< | � | j�d |�d� | � | j�dtdd� d��d � d S ) Nr �123Z890r z Text<br>textz Text
textzText <HOST> textzText 192.0.2.0 textzText <xyz> text <ABC> ABCzText 890 text 123 ABCz <matches>�matchesz$some >char< should \< be[ escap}ed&
z,some \>char\< should \\\< be\[ escap\}ed\&\nz <ipmatches>Z ipmatchesz<ipjailmatches>Z
ipjailmatchesz%some >char< should \< be[ escap}ed&
z.some \>char\< should \\\< be\[ escap\}ed\&\r\nz<xyz>r zText 890 text 890 ABCz09 <matches> 11c S s t d�S �N�
��strr r r r r# � r$ z2CommandActionTest.testReplaceTag.<locals>.<lambda>�rc z09 10 11�rR r r^ r rS r r r �testReplaceTag� sZ � � � ������� � ��z CommandActionTest.testReplaceTagc C s$ | � | j�dtdd� d��d� d S )N�abcc S s t d�S �N�arW r r r r r# � r$ z4CommandActionTest.testReplaceNoTag.<locals>.<lambda>rh ri r r r r �testReplaceNoTag� s ��z"CommandActionTest.testReplaceNoTagc s� t � jdd� t � jdd� t � jdd� t � jdd� t � jd d
� t � jd d � � �td
� fdd�� t� jd� � �td� fdd�� d S )Nrm z<a�bzc>zb?family=inet6zb>Zac�<a><b>Zabz<ac>zx?family=inet6r* z/properties contain self referencing definitionsc s � j jd� j jdd�S )Nrp � family=inet4�� conditional�r r^ � _propertiesr r r r r# � s �z?CommandActionTest.testReplaceTagSelfRecursion.<locals>.<lambda>z.possible self referencing definitions in queryc s � j jd� j jdd�S )Nz?<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x>>>>>>>>>>>>>>>>>>>>>� family=inet6rr rt r r r r r# � s �)�setattrr ZassertRaisesRegexrQ �delattrr r r r �testReplaceTagSelfRecursion� s
�
�z-CommandActionTest.testReplaceTagSelfRecursionc C sp t | jdd� t | jdd� t | jdd� t | jdd� t | jd d
� | jj}td �D ]d}| �| jjd | jjd
|d�d� | �| jjd | jjd|d�d� | �| jjd | jjd|d�d� qV| �t|�dk� t | jdd� | �t|�d� td �D ]d}| �| jjd | jjd
|d�d� | �| jjd | jjd|d�d� | �| jjd | jjd|d�d� q�| �t|�dk� d S )Nrk rb zabc?family=inet4Z345zabc?family=inet6Z567r z 890-<abc>Z banactionzText <xyz> text <abc>r z<banaction> '<abc>'r* )rs �cachezText 890-123 text 123 '123'rq zText 890-345 text 345 '345'rv zText 890-567 text 567 '567'� z 000-<abc>r zText 000-123 text 123 '123'zText 000-345 text 345 '345'zText 000-567 text 567 '567') rw r Z _substCache�rangerR r^ ru �
assertTrue�len)r rz rY r r r � testReplaceTagConditionalCached sl �� �� �� �� �� ��z1CommandActionTest.testReplaceTagConditionalCachedc C s� |d7 }d| | j _| j j| j _| �| j jd| � d| | j _| �| j jd| � d| j _| �| j jd� d| | j _| �| j jd| � d| j _| �| j jd� | �� | � d� | j �
dd i� | � d � | � d
� | j � � | � | j j� d S ) N�/fail2ban.test�
touch '%s'�
rm -f '%s'zecho -n� [ -e '%s' ]�trueZreturned�ip�Invariant check failedzreturned successfully)
r r8 � actionrepairrR �
actionstop� actionban� actioncheck� actionunban�pruneLog�assertNotLogged�ban� assertLoggedr �r Ztmpr r r �testExecuteActionBan, s&
z&CommandActionTest.testExecuteActionBanc C s� d| j _d| j _d| j _d| j _| j �� | j �i � | �� | j �i � | j ddd� | j �i � | �d� | j �
� | j �i � | j � � | j ddd� | � d� d S ) Nr* zecho -n 'flush'zecho -n 'stop'�
Nothing to doT��wait� [phase 2]r )
r r� r� Z actionflushr� r r� r� �unbanr� �flushr r� r r r r �testExecuteActionEmptyUnbanE s
z-CommandActionTest.testExecuteActionEmptyUnbanc C sL |d7 }d| j _d| | j _d| | j _d| | j _| j �� | j �� d S )Nr� r ztouch '%s.<HOST>'zrm -f '%s.<HOST>'z[ -e '%s.192.0.2.0' ])r r r8 r� r� r ZconsistencyCheckr� r r r �testExecuteActionStartCtagsY s
z-CommandActionTest.testExecuteActionStartCtagsc C s� |d7 }d| j _d| | j _d| | j _d| | j _| �t| j jdd i� | jddd d
� | � d � d | | j _d| | j _d
| | j _d| | j _| j �dd i� | �d� | �
d� d S )Nr� r* r� �rm '%s'r� r� r� � Unable to restore environmentT��allr� r� z printf "%%%%b
" <ip> >> '%s') r r8 r� r� r� rP � RuntimeErrorr� r� r� r� r� r r r �(testExecuteActionCheckRestoreEnvironmentc s
z:CommandActionTest.testExecuteActionCheckRestoreEnvironmentc C s� |d7 }d| j _d| j _d| | j _d| | j _d| | j _| j �dd i� | jddd d
� | �� d| j _| � t
| j jdd i� | jddd d d
� d S ) Nr� r* r� r� z echo 'repair ...'; touch '%s'r� z Invariant check failed. Tryingzecho 'repair ...'Tr� r� ) r r8 r� r� r� r� r� r� r� rP r� r� r r r �'testExecuteActionCheckRepairEnvironmentv s" �z9CommandActionTest.testExecuteActionCheckRepairEnvironmentc C s. | � tt| jd� d| j_| �| jjd� d S )N�ROSTr )rP �AttributeError�getattrr r� rR r r r r � testExecuteActionChangeCtags� s z.CommandActionTest.testExecuteActionChangeCtagsc C sP t dddd� d��}d| j_d| j_| j�|� | j�|� | jdd d
d � d S ) Nrb � 192.0.2.1c S s dddd�S )N�o �� Ztester)ZfidZfport�userr r r r r r# � s �z?CommandActionTest.testExecuteActionUnbanAinfo.<locals>.<lambda>)r r� zF-*zFecho '<ABC>, failure <F-ID> of <F-USER> -<F-TEST>- from <ip>:<F-PORT>'z$echo '<ABC>, user <F-USER> unbanned'z> -- stdout: '123, failure 111 of tester -- from 192.0.2.1:222'z' -- stdout: '123, user tester unbanned'Tr� )r r r� r� r� r� r� rS r r r �testExecuteActionUnbanAinfo� s � �z-CommandActionTest.testExecuteActionUnbanAinfoc C s^ d| j _| j �� | �| j �d�� | �d� | �� | �| j �d�� | �d� | �� d S )Nr* r� )r r8 r r} �
executeCmdr� r� Z _processCmdr r r r �testExecuteActionStartEmpty� s
z-CommandActionTest.testExecuteActionStartEmptyc C s6 | � | jjddddd�d�� | jddd d
d d � d S )
NzUprintf %b "foreign input:\n -- $f2bV_A --\n -- $f2bV_B --\n -- $(echo -n $f2bV_C) --"z I'm a hacker; && $(echo $f2bV_B)zI"m very bad hackerz#`Very | very
$(bad & worst hacker)`)Zf2bV_AZf2bV_BZf2bV_C)ZvarsDictzforeign input:z' -- I'm a hacker; && $(echo $f2bV_B) --z -- I"m very bad hacker --z* -- `Very | very $(bad & worst hacker)` --Tr� )r} r r� r� r r r r �testExecuteWithVars� s
�� �z%CommandActionTest.testExecuteWithVarsc C s� d| j _d| j _d| j _dddddg}d d
d �|�d �}| �� | j �|� | jd
|d |d f|�ddi� | jd|d ddd� | �� | j � |� | j �
� | jd|d ddd� d S )Nz3echo "** ban <ip>, reason: <reason> ...\n<matches>"zecho "** unban <ip>"zecho "** stop monitoring"z
<actionunban>z " Hooray! #z`I'm cool script kiddyz7`I`m very cool > /here-is-the-path/to/bin/.x-attempt.shz <actionstop>r� zAhacking attempt ( he thought he knows how f2b internally works ;)�
)r� �reasonrc z ** ban %sr� r� r� Tz ** unban %sz** stop monitoringr� ) r r� r� r� �joinr� r� r� r� r� r )r rc rT r r r � testExecuteReplaceEscapeWithVars� sH ��
���
�
�z2CommandActionTest.testExecuteReplaceEscapeWithVarsc C s t �d� | �d� d S )Nz+/bin/ls >/dev/null
bogusXXX now 2>/dev/nullz HINT on 127: "Command not found"�r r� r� r r r r �testExecuteIncorrectCmd� s
z)CommandActionTest.testExecuteIncorrectCmdc C sv t � � }tjjsdnd}| �tjd|d�� | �t � � || koRt � � || d k� | jdddd� | �dd � d S )
Nr g{�G�z�?zsleep 30��timeoutz -- timed out afterTr� � -- killed with SIGTERM� -- killed with SIGKILL) �time�unittestZF2BZfast� assertFalser r� r} r� )r �stimer� r r r �testExecuteTimeout� s *�z$CommandActionTest.testExecuteTimeoutc s< t �dd��t�d��}|�d� � W 5 Q R X d���fdd�}�fdd ��t�� �| �tjd
� |d �� �� � | �t �
� fd d
�d�� | � dd� | � d� | � dd� t �
�d � t�� �| �tjd� |d �� �� � | �t �
� fdd
�d�� | � dd� | � d� | � dd� t �
�� t �
�d � d S )Nz.shZ fail2ban_�wzo#!/bin/bash
trap : HUP EXIT TERM
echo "$$" > %s.pid
echo "my pid $$ . sleeping lo-o-o-ong"
sleep 30
r c s � � d k pt � � � dkS �NrV )r� r )� getnastypidr� r r �
getnasty_tout� s
�zLCommandActionTest.testExecuteTimeoutWithNastyChildren.<locals>.getnasty_toutc sV d } t j�� d �rRt� d ��,}zt|�� �} W n tk
rF Y nX W 5 Q R X | S )N�.pid)�os�path�isfile�openrX �readrQ )�cpid�f)� tmpFilenamer r r� � s zJCommandActionTest.testExecuteTimeoutWithNastyChildren.<locals>.getnastypidzbash %sr� c s
t � � S r] �r r �r� r r r# r$ zGCommandActionTest.testExecuteTimeoutWithNastyChildren.<locals>.<lambda>r{ zmy pid z Resource temporarily unavailablez timed outzkilled with SIGTERMzkilled with SIGKILLr� zout=`bash %s`; echo ALRIGHTc s
t � � S r] r� r r� r r r# r$ z
-- timed outr� r� )�tempfileZmktempr� �writer� r� r r� r} r Zwait_forr� r� �unlink)r r� r� r )r� r� r� r� r �#testExecuteTimeoutWithNastyChildren� sF � �
� �
�
z5CommandActionTest.testExecuteTimeoutWithNastyChildrenc C s, t �d� | �d� t �d� | �d� d S )Nzecho "How now brown cow"z stdout: 'How now brown cow'
z7echo "The rain in Spain stays mainly in the plain" 1>&2z6stderr: 'The rain in Spain stays mainly in the plain'
r� r r r r �testCaptureStdOutErr& s
��z&CommandActionTest.testCaptureStdOutErrc C s> t dd� dd� ddd�}| �d| d� | �td d� |� d S )
Nc S s t d�S rd rf r r r r r# / r$ z2CommandActionTest.testCallingMap.<locals>.<lambda>c S s t d�S rl rW r r r r r# / r$ �string� )Zcallme�errorZ
dontcallmeZnumberz)%(callme)s okay %(dontcallme)s %(number)iz10 okay string 17c S s d| S )Nz %(error)ir )�xr r r r# 7 r$ )r rR rP rQ )r Zmymapr r r �testCallingMap. s ��z CommandActionTest.testCallingMapc C sT t dd� dd� dd��}|�� d|d< |d= | �t|�d � | �d|� | �|d |d
fd � |�� t|�}| �t|�d � | �d|� | �|d |d
|d fd
� d|d< |�� }dd� |d< d|d< |d
= |d= | �d
|k� | �d|k� | � d
|k� | � d|k� | �|d |d
|d |d fd� | �|d |d fd� d S )Nc S s dS r� r r r r r r# ; r$ z8CommandActionTest.testCallingMapModify.<locals>.<lambda>c S s | d d S �Nrm � r r r r r r# < r$ �test�rm ro �c� rm r� r ro )r� re r{ )rV � r� �dddd�dc S s | d d S )Nrm � r r r r r r# Q r$ r )rV r� r� r� )r � )
r �resetrR r~ � assertNotIn�repr�assertIn�copyr} r� )r �m�sZm2r r r �testCallingMapModify9 s8 � $z&CommandActionTest.testCallingMapModifyc C s� t dd� dd� dd��}t|�}| �d|� | �d|� | �d|� |�d �}| �d
|� | �d |� | �d|� d d� |d
< |�d �}| �d
|� | �d |� | �d|� | �d|� d S )Nc S s dS r� r r r r r r# ^ r$ z5CommandActionTest.testCallingMapRep.<locals>.<lambda>c S s | d d S r� r r r r r r# _ r$ r* r� z'a': z'b': z'c': ''Tz'a': 5z'b': 11c S s | d d S )NZxxxr� r r r r r r# l r$ r� z'c': )r r� r� r� Z_asrepr)r r� r� r r r �testCallingMapRep\ s& �
z#CommandActionTest.testCallingMapRepc C sR t t� �}d|_d|_|�� | jddd� d|_| jddd� d|_|�� d S )Ng-C ��6?TzActions: enter idle modere r� FzActions: leave idle mode)r r
Z sleeptimeZidler r� Zactiver� )r rm r r r �testActionsIdleModes s
z%CommandActionTest.testActionsIdleModeN) �__name__�
__module__� __qualname__r r rU ra rj rn ry r r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r ( s< e ()
= #r )�
__author__Z
__copyright__Z __license__r� r� r� r� Z
server.actionr r r Zserver.actionsr r Z server.utilsr Z dummyjailr
Zutilsr r r
r r r r r �<module> s