File: //lib/python3/dist-packages/fail2ban/tests/__pycache__/servertestcase.cpython-38.pyc
U
]^�P � @ s� d Z dZdZddlZddlZddlZddlZddlZddlZddl Z ddl
m Z m Z m
Z
ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lm Z ddl m Z ddl m Z m!Z!m"Z" ddl#m$Z$m%Z%m&Z& ddl'm(Z( zddlm)Z) W n e*k
�r dZ)Y nX ej+�,ej+�-e.�d�Z/dZ0e$d�Z1G dd� de�Z2G dd� de �Z3G dd � d e3�Z4G d d � d e3�Z5G d d � d ej6�Z7G d!d"� d"ej6�Z8G d#d$� d$e�Z9G d%d&� d&e �Z:dd'l;m<Z<m=Z=m>Z> G d(d)� d)e �Z?dS )*z
Cyril Jaquierz Copyright (c) 2004 Cyril JaquierZGPL� N� )�Regex� FailRegex�RegexException)�actions)�Server)�IPAddr)�Jail)�
JailThread)� BanTicket)�Utils� )� DummyJail)�LogCaptureTestCase�
with_alt_time�MyTime)� getLogger�extractOptions�
PREFER_ENC)�version)�
filtersystemd�files�polling�fail2banc @ s e Zd Zdd� Zdd� ZdS )�
TestServerc O s d S �N� ��self�args�kwargsr r �?/usr/lib/python3/dist-packages/fail2ban/tests/servertestcase.py� setLogLevel< s zTestServer.setLogLevelc O s d S r r r r r r! � setLogTarget? s zTestServer.setLogTargetN)�__name__�
__module__� __qualname__r" r# r r r r! r ; s r c sL e Zd Z� fdd�Z� fdd�Zdd d
�Zdd d �Zd
d� Zdd� Z� Z S )�TransmitterBasec s2 t t| ��� | jj| _d| _| j�| jt� dS )� Call before every test case.Z TestJail1N) �superr' �setUp�server�_Server__transm�transm�jailName�addJail� FAST_BACKEND�r �� __class__r r! r* E s
zTransmitterBase.setUpc s | j �� tt| ��� dS �zCall after every test case.N)r+ �quitr) r' �tearDownr1 r2 r r! r6 N s
zTransmitterBase.tearDownr r NFc
s� d||g}d|g}|dk r2|� d|� |� d|� |dkr>|}� fdd�} | �| | j�|��| ||f�� |s�| �| | j�|��| d|f�� dS ) zoProcess set/get commands and compare both return values
with outValue if it was given otherwise with inValue�set�getNr
r c s � r t | �S | S )z Prepare value for comparison)�repr��x��repr_r r! �va s z%TransmitterBase.setGetTest.<locals>.vr )�insert� assertEqualr- �proceed)
r �cmd�inValue�outValue�outCode�jailr= �setCmd�getCmdr> r r< r! �
setGetTestT s
zTransmitterBase.setGetTestc C sv d||g}d|g}|d k r2|� d|� |� d|� | j�|�d }| �| j�|�d d� | �| j�|�d|f� d S )Nr7 r8 r
r )r? r- rA r@ )r rB rC rF rG rH Z initValuer r r! �
setGetTestNOKj s
z TransmitterBase.setGetTestNOKc C s� d| }d| }| � | j�d||g�dg f� t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt|d |d � ��fdd� q6t|�D ]�\}}| j�d|||g�}| j|d ttt|d ��fdttt||d d � ��fdd� | j�d||g�}| j|d ttt|d ��fdttt||d d � ��fdd� q�d S ) N�add�delr8 r r7 r
r )�level)r@ r- rA � enumerate�assertSortedEqual�list�map�str) r rB �valuesrF �cmdAdd�cmdDel�n�value�retr r r! �jailAddDelTestw s �@B@z TransmitterBase.jailAddDelTestc C s d| }d| }| � | j�d||g�dg f� t|�D ]^\}}| � | j�d|||g�d|d |d � f� | � | j�d||g�d|d |d � f� q6t|�D ]^\}}| � | j�d||dg�d||d d � f� | � | j�d||g�d||d d � f� q�d S )NrK rL r8 r r7 r
)r@ r- rA rN ) r rB ZinValuesZ outValuesrF rT rU rV rW r r r! �jailAddDelRegexTest� s0 �����z#TransmitterBase.jailAddDelRegexTest)r r NF)N)
r$ r% r& r* r6 rI rJ rY rZ �
__classcell__r r r2 r! r' C s
r' c sx e Zd Z� fdd�Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zed%d&� �Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z!d=d>� Z"d?d@� Z#dAdB� Z$dCdD� Z%dEdF� Z&dGdH� Z'dIdJ� Z(dKdL� Z)dMdN� Z*dOdP� Z+dQdR� Z,dSdT� Z-dUdV� Z.dWdX� Z/� Z0S )Y� Transmitterc s t � | _tt| ��� d S r )r r+ r) r\ r* r1 r2 r r! r* � s zTransmitter.setUpc C s | � | j�� � d S r )� assertFalser+ � isStartedr1 r r r! �testServerIsNotStarted� s z"Transmitter.testServerIsNotStartedc C s | � | j�dg�d� d S )N�stop�r N�r@ r- rA r1 r r r! �testStopServer� s zTransmitter.testStopServerc C s | � | j�dg�d� d S )NZping)r Zpongrb r1 r r r! �testPing� s zTransmitter.testPingc C s | � | j�dg�dtjf� d S )Nr r )r@ r- rA r r1 r r r! � testVersion� s zTransmitter.testVersionc C s| t jjs`t�� }| �| j�ddg�d� t�� }|| }| jd| k oNdk n d| d� n| �| j�ddg�d� d S ) N�sleepz0.1ra g
ףp=
�?g�������?zSleep was %g sec)�msgz0.0001)�unittest�F2B�fast�timer@ r- rA �
assertTrue)r Zt0�t1Zdtr r r! � testSleep� s (zTransmitter.testSleepc C s� t jjst�dd�\}}nd}| �d|� | j�| j� | � d|� | � d|� | � ddd� | �dd� | � d d
d � | �d d� | j�
| jt � | � d|� | j�| j� | � | j
�d dd
g�d� | � | j
�ddg�d� | � | j
�d ddg�d� | � | j
�ddg�d� | � | j
�d d dg�d� | � | j
�dd g�d� | j�
| jt � | � | j
�d dd
g�d� t jj�s�t�|� t�|� d S )Nz.dbZ fail2ban_z:memory:ZdbfileZ dbmaxmatchesZ100�d ZLIZARDZ
dbpurgeage�600�X r7 �Nonera r8 �500)rh ri Z memory_db�tempfile�mkstemprJ r+ ZdelJailr. rI r/ r0 r@ r- rA �os�close�unlink)r ZtmpZ tmpFilenamer r r! � testDatabase� sj
��
��
��
��
��
��
��
zTransmitter.testDatabasec C s� d}d}d}| � | j�d|dg�d|f� | � | j�d|g�d|f� | � | j�d|dg�d d� | � | j�d|d g�d|f� | � | j�d| jdg�d d� | � | j�dd
dg�d d� d S ) N� TestJail2� TestJail3Z TestJail4rK r r zinvalid backendr
�auto�--all�r@ r- rA r. )r Zjail2Zjail3Zjail4r r r! � testAddJail� s0 � � � � �zTransmitter.testAddJailc sp � � � j�d� jg�d� t�tj� � �t� � fdd�d�� � � � j�d� jg�d� � �
� j� j j � d S )N�startra c s& � j �d�o$t� j�d� jg�t� S )Nr
�status�r+ ZisAlive�
isinstancer- rA r. � RuntimeErrorr r1 r r! �<lambda> � z/Transmitter.testStartStopJail.<locals>.<lambda>� r` )
r@ r- rA r. rk rf r �DEFAULT_SLEEP_TIMErl �wait_for� assertNotInr+ �_Server__jailsr1 r r1 r! �testStartStopJail� s �
� �z Transmitter.testStartStopJailc s� � j �dt� � �� j�d� jg�d� � �� j�ddg�d� t�t j
� � � t � � fdd�d�� � �� j�ddg�d� � � t � � fd d�d�� � �
� j� j j� � �
d� j j� d S )
Nrz r� ra c s& � j �d�o$t� j�d� jg�t� S )Nr r� r� r r1 r r! r� r� z2Transmitter.testStartStopAllJail.<locals>.<lambda>r� r` r} c s t � jj� S r )�lenr+ r� r r1 r r! r� r� )r+ r/ r0 r@ r- rA r. rk rf r r� rl r� r� r� r1 r r1 r! �testStartStopAllJail s$ � �
�z Transmitter.testStartStopAllJailc C sb | � | j�d| jddg�d� | � | j�d| jddg�d� | � | j�d| jddg�d d � d S )
Nr7 ZidleZon�r TZoff�r FZCATr r
r~ r1 r r r! � testJailIdle s ���zTransmitter.testJailIdlec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZfindtimeZ120�x �rF Z60�< Z30m� z-60i���ZDog�rI r. rJ r1 r r r! �testJailFindTime( s
z Transmitter.testJailFindTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZbantimerp rq r� Z50�2 z-50i���z
15d 5h 30mi� ZCatr� r1 r r r! �testJailBanTime/ s
zTransmitter.testJailBanTimec C sf | j ddd| jd� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | jdd | jd� d S ) NZ datepattern�%%%Y%m%d%H%M%S)r� z %YearMonthDay24hourMinuteSecondr� �Epoch)Nr� z^Epoch)Nz{^LN-BEG}Epoch�TAI64N)Nr� z
%Cat%a%%%gr� r1 r r r! �testDatePattern6 s. � � � �zTransmitter.testDatePatternc C s* | j ddd| jd� | jdd| jd� d S )NZ logtimezonezUTC+0400r� znot-a-time-zoner� r1 r r r! �testLogTimeZoneB s zTransmitter.testLogTimeZonec C s\ | j dd| jd� | j dd| jd� | j dd| jd� d}| �| j�d| jd|g�d� d S ) NZusednsZyesr� �warn�noZFishr7 )r r� )rI r. r@ r- rA �r rW r r r! �testJailUseDNSF s �zTransmitter.testJailUseDNSc C s | j �| j� | �| j�d| jddddg�d� | jddddd � | �| j�d| jdd
g�d � | jd dd
� | �| j�d| jdddddg�d� | jddddd � | jddddd � | �� | �| j�d| jdddg�d d� | �| j�d| jdddg�d� | jddddd � d S )Nr7 �banip� 192.0.2.1� 192.0.2.2)r r �
Ban 192.0.2.1�
Ban 192.0.2.2T��all�waitZBadger�r r
z
Ban Badger�r� �unbanipz 192.0.2.255z 192.0.2.254zUnban 192.0.2.1zUnban 192.0.2.2z192.0.2.255 is not bannedz192.0.2.254 is not bannedz--report-absentr r
)r r )r+ � startJailr. r@ r- rA � assertLogged�pruneLogr1 r r r! �
testJailBanIPQ sF ���������zTransmitter.testJailBanIPc s� � j �� j� � fdd�}� jddd� jd� dD ]&}dD ] }� �||d | g�d
� q:q2� jd d d
d
d� � �||dd� dD ��d
� � jdd
d� � jdd
d� � �d� d S )Nc s � j �d� jd| g| �S )Nr7 �attempt)r- rA r. )�ipZmatchesr1 r r! r� q s z.Transmitter.testJailAttemptIP.<locals>.attempt�maxretry�5� r� )r
r )r� r� �test failure %dr� z 192.0.2.1:2z 192.0.2.2:2Tr� c S s g | ] }d | �qS )r� r )�.0�ir r r! �
<listcomp>{ s z1Transmitter.testJailAttemptIP.<locals>.<listcomp>)r� � r� z 192.0.2.2:5r� r� r� )r+ r� r. rI r@ r� �assertNotLogged)r r� r� r� r r1 r! �testJailAttemptIPn s z Transmitter.testJailAttemptIPc s� d}� j �|t� � j �|� d d dg f� fdd� }||g d� ||dddgd � ||d
ddd gd � ||d dd
d gd
� ||dd
d gd� ||d d
gd� ||d
g d� d S )NZTestJailBanListr c s� |d k r6� � � j�d| d|g�d� � jd| dd� |d k rl� � � j�d| d|g�d� � jd| dd� � j� j�d | dgt|� �d
|fd d � t�t�� d
� d S )Nr7 r� r� zBan %sTr� r� zUnban %sr8 r F)Z
nestedOnlyr
) r@ r- rA r� rO rP r ZsetTimerk )rF r� r� r �outListr1 r r! �_getBanListTest� s$ �� �z4Transmitter.testJailBanList.<locals>._getBanListTest)r� � 127.0.0.1)z --with-timez:127.0.0.1 2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01)r� r r� z 192.168.0.1z<192.168.0.1 2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02z 192.168.1.10)r� r� )r� r� )r+ r/ r0 r� )r rF r� r r1 r! �testJailBanList� s6 ��������zTransmitter.testJailBanListc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
NZ
maxmatchesr� r� r� �2r �-2����Duckr� r1 r r r! �testJailMaxMatches� s z Transmitter.testJailMaxMatchesc C sR | j ddd| jd� | j ddd| jd� | j ddd| jd� | jdd | jd� d S )
Nr� r� r� r� r� r r� r� r� r� r1 r r r! �testJailMaxRetry� s z Transmitter.testJailMaxRetryc C sP | j ddd| jd� | j ddd| jd� | jdd| jd� | jdd| jd� d S ) NZmaxlinesr� r� r� r� r r� r� r� r1 r r r! �testJailMaxLines� s z Transmitter.testJailMaxLinesc C sN | j dd| jd� | j dd| jd� | j ddt| jd� | jdd| jd� d S )NZ logencodingzUTF-8r� �asciir| ZMonkey)rI r. r rJ r1 r r r! �testJailLogEncoding� s
�z Transmitter.testJailLogEncodingc
C sh | � dtj�td�tj�td�tj�td�g| j� tj�td�}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d | jdg�d|gf� | �| j�d| jd
|g�dg f� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d g�d|gf� | �| j�d| jd|d
g�d d� | �| j�d| jd|||g�d d� d S )NZlogpath�testcase01.logztestcase02.logztestcase03.logztestcase04.logr7 �
addlogpathr r8 Z
dellogpath�tail�headZbadgerr
) rY rv �path�join�TEST_FILES_DIRr. r@ r- rA r� r r r! �testJailLogPath� sj ��
��������������zTransmitter.testJailLogPathc C s2 d}| j �d| jd|g�}| �t|d t�� d S )Nzthis_file_shouldn't_existr7 r� r
)r- rA r. rl r� �IOError)r rW �resultr r r! �testJailLogPathInvalidFile� s
�z&Transmitter.testJailLogPathInvalidFilec C sX t jdd�}|d }t�||� | j�d| jd|g�}| �t|d t �� t�
|� d S )NZtmp_fail2ban_broken_symlink)�prefixz.slinkr7 r� r
) rt Zmktemprv �symlinkr- rA r. rl r� r� rx )r �nameZsnamer� r r r! � testJailLogPathBrokenSymlink� s �z(Transmitter.testJailLogPathBrokenSymlinkc C s | � ddddg| j� d}| �| j�d| jd|g�d|gf� | �| j�d| jd|g�d|gf� | �| j�d| jdg�d|gf� | �| j�d| jd |g�dg f� | �| j�d| jd
g�d � | �| j�d| jd
d g�d
� | �| j�d| jd
g�d
� d S )NZignoreipr� z 192.168.1.1z8.8.8.8r7 Z addignoreipr r8 Z delignoreipZ
ignoreselfr� Fr� )rY r. r@ r- rA r� r r r! �testJailIgnoreIP sJ �� �������z Transmitter.testJailIgnoreIPc C s | j dd| jd� d S )NZ
ignorecommandzbin/ignore-command <ip>r� �rI r. r1 r r r! �testJailIgnoreCommand& s z!Transmitter.testJailIgnoreCommandc C s2 | j dddddg| jd� | j ddd | jd� d S )NZ ignorecachez%key="<ip>",max-time=1d,max-count=9999z<ip>i' i�Q r� � r� r1 r r r! �testJailIgnoreCache) s �z Transmitter.testJailIgnoreCachec
C s� | � ddddgdt�d� dt�d� dt�d� g| j� | �| j�d | jd
d g�d d
� | �| j�d | jd
dg�d d
� d S )NZ failregexzuser john at <HOST>� Admin user login from <HOST>z failed attempt from <HOST> againzuser john at %s�<HOST>�Admin user login from %sz failed attempt from %s againr7 � addfailregexz
No host regexr r
i� �rZ r Z_resolveHostTagr. r@ r- rA r1 r r r! �
testJailRegex0 s6 � �� ��� ���zTransmitter.testJailRegexc C sp | � ddddgddt�d� dg| j� | �| j�d| jdd g�d
d � | �| j�d| jdd g�d
d � d S )
NZ ignoreregexz user johnr� zDont match me!r� r� r7 ZaddignoreregexzInvalid [regexr r
r� r� r1 r r r! �testJailIgnoreRegexH s6 � �� ��� ���z Transmitter.testJailIgnoreRegexc C s� | j g}| �| j�dg�ddt|�fdd�|�fgf� | j�dt� |� d� | �| j�dg�ddt|�fdd�|�fgf� d S )Nr� r zNumber of jailz Jail listz, rz )
r. r@ r- rA r� r� r+ r/ r0 �append)r �jailsr r r! �
testStatus` s �
�zTransmitter.testStatusc
C sB | � | j�d| jg�dddddg fgfddd d
g fgfgf� d S ) Nr� r �Filter�zCurrently failedr �z Total failedr � File list�Actions�zCurrently bannedr �z Total bannedr �Banned IP listr~ r1 r r r! �testJailStatusi s �����zTransmitter.testJailStatusc
C sD | � | j�d| jdg�dddddg fgfdd d
d g fgfgf� d S ) Nr� Zbasicr r� r� r� r� r� r� r� r� r~ r1 r r r! �testJailStatusBasic{ s �����z Transmitter.testJailStatusBasicc
C sD | � | j�d| jdg�dddddg fgfdd d
d g fgfgf� d S ) Nr� �INVALIDr r� r� r� r� r� r� r� r� r~ r1 r r r! �testJailStatusBasicKwarg� s �����z$Transmitter.testJailStatusBasicKwargc
C s� t j�� zdd l}dd l}W n tk
r8 dg}Y nX g }| �| j�d| j dg�dddddg fgfd d
d d g fd
|fd|fd|fgfgf� d S )Nr �errorr� Zcymrur� r� r� r� r� r� r� r� zBanned ASN listzBanned Country listzBanned RIR list)
rh ri ZSkipIfNoNetworkZ
dns.exceptionZ dns.resolver� ImportErrorr@ r- rA r. )r ZdnsrW r r r! �testJailStatusCymru� s2
�����z Transmitter.testJailStatusCymruc C s� d}dddddg}ddd d
d g}| � | j�d | jd
|g�d|f� | � | j�d| jdg�d d |� t||�D ].\}}| � | j�d | jd|||g�d|f� qpt||�D ],\}}| � | j�d| jd||g�d|f� q�| � | j�d | jd|ddg�d� | � | j�d| jd|dg�d� | � | j�d| jd|dg�d d� | � | j�d | jd|ddg�d� | � | j�d| jd|dg�d� | � | j�d | jd|g�d� | � | j�d | jdd g�d d� d S ) N�TestCaseActionZ actionstartZ
actionstopZ actioncheckZ actionbanZ actionunbanz Action Startz Action Stopz Action Checkz
Action Banz Action Unbanr7 � addactionr r8 r r
�actionZKEY�VALUE)r r� Z
InvalidKey�timeoutZ10)r �
Z delactionra z
Doesn't exist)r@ r- rA r. �zip)r r� ZcmdListZ cmdValueListrB rW r r r! �
testAction� s� ���
������������������� ���zTransmitter.testActionc C s� d}z:| j �d| jd|tj�tdd�dg�}| �|d|f� W nZ tk
r� dt j
krdd k r�n n*d
|d kr�dd l }|� d t j
� Y d S � Y nX | �| j �d
| jd|g�d ddg� | �| j �d
| jd|dg�d� | �| j �d
| jd|dg�d� | �| j �d
| jd|g�d ddddddg� | �| j �d| jd|ddg�d � | �| j �d| jd|dd g�d � | �| j �d| jd|ddg�d � d S ) Nr� r7 r� �action.dz action.pyz{"opt1": "value"}r )r � )r r r� z#__init__() keywords must be stringsr
z�Your version of Python %s seems to experience a known issue forbidding correct operation of Fail2Ban: http://bugs.python.org/issue2646 Upgrade your Python and meanwhile other intestPythonActionMethodsAndProperties will be skippedr8 ZactionpropertiesZopt1Zopt2r� )r rW ra Z
actionmethods�banZrebanr� r` Z
testmethod�unbanz{"text": "world!"})r zHello world! value�
another value)r r )r zHello world! another value)r- rA r. rv r� r� r� r@ �AssertionError�sys� version_info�warningsr� r rO )r r� �outr r r r! �$testPythonActionMethodsAndProperties� s�
��
��� ���������� �� �� ��z0Transmitter.testPythonActionMethodsAndPropertiesc C s | � | j�ddg�d d� d S )Nr� �COMMANDr r
rb r1 r r r! �testNOK- s zTransmitter.testNOKc C s" | � | j�dddg�d d� d S )Nr7 r� r r r
rb r1 r r r! �
testSetNOK0 s �zTransmitter.testSetNOKc C s" | � | j�dddg�d d� d S )Nr8 r� r r r
rb r1 r r r! �
testGetNOK4 s �zTransmitter.testGetNOKc C s" | � | j�dddg�d d� d S )Nr� r� r r r
rb r1 r r r! �
testStatusNOK8 s �zTransmitter.testStatusNOKc
C s< t st�d��d}| j�|d� dddg}t|�D ]>\}}| �| j�d|d|g�d d
d � |d |d � D �f� q2t|�D ]>\}}| �| j�d|d
|g�d dd � ||d d � D �f� qzd}| �| j�d|d|g�d |ggf� | �| j�d|d|g�d |g|ggf� | �| j�d|d
|g�d |ggf� | �| j�d|d
|g�d g f� ddddg}| �| j�d|dg| �d dgddggf� | �| j�d|d
g|d d � �d ddggf� | �| j�d|d
g|dd � �d g f� d}| j�d|d|g�}| � t
|d t �� d}| j�d|d
|g�}| � t
|d t �� d S )N�&systemd python interface not availablerz Zsystemd�_SYSTEMD_UNIT=sshd.service�TEST_FIELD1=ABC�_HOSTNAME=example.comr7 �addjournalmatchr c S s g | ]
}|g�qS r r �r� �valr r r! r� J s z0Transmitter.testJournalMatch.<locals>.<listcomp>r
�deljournalmatchc S s g | ]
}|g�qS r r r r r r! r� O s z
_COMM=sshd�+z_UID=0r zThis isn't valid!zFIELD=NotPresent) r rh �SkipTestr+ r/ rN r@ r- rA rl r� �
ValueError)r r. rS rV rW r� r r r! �testJournalMatch< s�
�
� �
� �
�
�
��
�
�
�� � ��� ���
�
�z Transmitter.testJournalMatchc
C s� t st�d��| �d� d}| j�|d� dddg}t|�D ]>\}}| �| j� d|d |g�d
d d � |d |d
� D �f� q<t|�D ]>\}}| �| j� d|d|g�d
dd � ||d
d � D �f� q�d S )Nr Tr{ zsystemd[journalflags=2]r r r r7 r r c S s g | ]
}|g�qS r r r r r r! r� � s z5Transmitter.testJournalFlagsMatch.<locals>.<listcomp>r
r c S s g | ]
}|g�qS r r r r r r! r� � s )
r rh r rl r+ r/ rN r@ r- rA )r r. rS rV rW r r r! �testJournalFlagsMatch� s.
�
� �
� �z!Transmitter.testJournalFlagsMatch)1r$ r% r& r* r_ rc rd re rn ry r r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r
r r
r r r r r[ r r r2 r! r\ � sZ 0
+*
% <4Gr\ c sT e Zd Z� fdd�Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
� Z S )�TransmitterLoggingc s> t � | _tt| ��� | j�d� | j�d� | j�d� d S )N� /dev/null�CRITICALr| )r r+ r) r r* r# r" ZsetSyslogSocketr1 r2 r r! r* � s
zTransmitterLogging.setUpc C s� g }t d�D ],}t�dd�}|�|d � t�|d � q |D ]}| �d|� q>d}| �d|� | j� ddd g� |D ]}t�
|� qv| �dd
d � | �dd d
� d S )Nr� r Z transmitterr
r � logtarget�/this/path/should/not/existr7 r z STDOUT[format="%(message)s"]ZSTDOUTz!STDERR[datetime=off, padding=off]�STDERR) �rangert ru r� rv rw rI rJ r- rA �remove)r Z
logTargets�_ZtmpFileZ logTargetrW r r r! �
testLogTarget� s z TransmitterLogging.testLogTargetc C sJ t j�d�st�d��| �| j�� d� | �dd� | �| j�� d� d S )N�/dev/logz'/dev/log' not presentr| r �SYSLOG) rv r� �existsrh r rl r+ ZgetSyslogSocketrI r1 r r r! �testLogTargetSYSLOG� s
z&TransmitterLogging.testLogTargetSYSLOGc C s | � dd� d S )N� syslogsocketz/dev/log/NEW/PATH)rI r1 r r r! �testSyslogSocket� s z#TransmitterLogging.testSyslogSocketc C s` | � dd� | �dd� | � dd� | j d i tdtd�dd �d
�t�� d koVtj�d� � d S )
Nr+ r! r r( r' r
zFailed to change log targetT)rE rD r= )TF)ZLinux)r r( ) rI rJ �dict� Exception�platform�systemrv r� r) r1 r r r! �testSyslogSocketNOK� s ����z&TransmitterLogging.testSyslogSocketNOKc C s� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd� | � dd � | � dd
� | � dd d
� | �dd � d S )
NZloglevelZ
HEAVYDEBUGZ
TRACEDEBUG�9�DEBUG�INFOZNOTICE�WARNINGZERRORr ZcRiTiCaLZBird)rI rJ r1 r r r! � testLogLevel� s z TransmitterLogging.testLogLevelc C s: | � | j�dg�d� �z�t�d�\}}t�|� | j �
d� | � | j�dd|g�d|f� t d�}|� d � �z\t�d�\}}t�|� t�
||� |� d
� | � | j�dg�d� |� d � t|d ���}t|�}|�d
�dkr�t|�}| �|�d�� t|�}| �|�d�� z:t|�}|�d�dk�r<| �t|j� n| �d| � W n tk
�rb Y nX W 5 Q R X t|d ��L}t|�}|�d�dk�r�t|�}| �|�d�� | �t|j� |�� W 5 Q R X W 5 t�|� X W 5 zt�|� W n tk
�r Y nX X | � | j�dddg�d� | � | j�dg�d� d S )NZ flushlogs)r z rolled overz fail2ban.logr5 r7 r r r zBefore file movedzAfter file movedzAfter flushlogs�rzChanged logging target tozBefore file moved
zAfter file moved
zCommand: ['flushlogs']zCException StopIteration or Command: ['flushlogs'] expected. Got: %szrollover performed onzAfter flushlogs
r" )r r" )r Zflushed)r@ r- rA rv r$ �OSErrorrt ru rw r+ r" r Zwarning�rename�open�next�findrl �endswith� assertRaises�
StopIteration�__next__�fail) r �fn�f�lZfn2�f2Zline1Zline2rV r r r! �
testFlushLogs� sV
z TransmitterLogging.testFlushLogsc C s� | j ddd| jd� | j ddd| jd� | j dd d
| jd� | j d d d | jd� | j d
d| jd� | j ddd| jd� | j ddd| jd� d S )Nzbantime.increment�trueTr� zbantime.rndtimeZ30minr� zbantime.maxtimez 1000 daysi \&zbantime.factorr� zbantime.formulazGban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)zbantime.multipliersz1 5 30 60 300 720 1440 2880zbantime.overalljailsr� r1 r r r! �testBanTimeIncr
s z"TransmitterLogging.testBanTimeIncr) r$ r% r& r* r& r* r, r1 r6 rF rH r[ r r r2 r! r � s
0r c @ s e Zd Zdd� ZdS )� JailTestsc C s d}t |�}| �|j|� d S )NZveryveryverylongname)r r@ r� )r ZlongnamerF r r r! � testLongName s zJailTests.testLongNameN)r$ r% r& rJ r r r r! rI s rI c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�
RegexTestsc C s. | � ttd� | � ttd� | � ttd� d S )Nr� � � )r> r r r1 r r r! �testInit" s zRegexTests.testInitc C s8 | � ttd���dd�d� | �ttd���d�� d S )N�a�"�'z
Regex('a')r� z
FailRegex()r@ rR r �replacerl r �
startswithr1 r r r! �testStr( s zRegexTests.testStrc C s | � ttd� | � ttd� | �td�� | �td�� | �td�� | �td�� | �td�� | �td�� | �td �� td
�}| �|�� � |�d g� | �|�� � | � t|j� td �}| �|�� � |�d
g� | �|�� � | � t|j� td�}| �|�� � |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� |�dg� | �|�� � | �|�� d� td�}| �|�� � |�dg� | �|�� � | �|� � d� td�}|�dg� |�
� }| �||j fd� |�dg� |�
� }| �||j fd� |�d g� |�
� }| �||j fd � |�d g� |�
� }| �||j fd � td �}|�d!g� |�
� }| �||j fd"� |�d#g� |�
� }| �||j fd� |�d$g� |�
� }| �||j fd%� |�d&g� |�
� }| �||j fd'� d S )(Nr� z^test no group$z^test <HOST> group$z^test <IP4> group$z^test <IP6> group$z^test <DNS> group$z<^test id group: ip:port = <F-ID><IP4>(?::<F-PORT/>)?</F-ID>$z-^test id group: user:\(<F-ID>[^\)]+</F-ID>\)$z#^test id group: anything = <F-ID/>$z %%<HOST>?)z%%r� r� z#%%inet(?:=<F-IP4/>|inet6=<F-IP6/>)?)z %%inet=testr� r� z(%%(?:inet(?:=<IP4>|6=<IP6>)?|dns=<DNS>?))z%%inet=192.0.2.1r� r� r� )z%%inet6=2001:DB8::r� r� �
2001:DB8::)z%%dns=example.comr� r� z example.com)z%test id group: user:(test login name)r� r� ztest login namez%%net=<SUBNET>)z%%net=192.0.2.1r� r� )r� �inet4)z%%net=192.0.2.1/24r� r� )z 192.0.2.0/24rV )z%%net=2001:DB8:FF:FF::1r� r� )z2001:db8:ff:ff::1�inet6)z%%net=2001:DB8:FF:FF::1/60r� r� )z2001:db8:ff:f0::/60rW z %%ip="<ADDR>", mask="<CIDR>?")z%%ip="192.0.2.2", mask=""r� r� )r� rV )z%%ip="192.0.2.2", mask="24"r� r� )z"%%ip="2001:DB8:2FF:FF::1", mask=""r� r� )z2001:db8:2ff:ff::1rW )z$%%ip="2001:DB8:2FF:FF::1", mask="60"r� r� )z2001:db8:2ff:f0::/60rW ) r> r r rl r] Z
hasMatched�searchZgetHostr@ Z getFailIDZgetIPZ familyStr)r �frr� r r r! �testHost. sz zRegexTests.testHostN)r$ r% r& rN rT rZ r r r r! rK s rK c @ s e Zd Zdd� ZdS )�
_BadThreadc C s t d��d S )Nzrun bad thread exception)r� r1 r r r! �runv s z_BadThread.runN)r$ r% r& r\ r r r r! r[ u s r[ c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� LoggingTestsc C s* t d�}| �|jjd� | �|jd� d S )Nz fail2ban.some.string.with.namer z
fail2ban.name)r r@ �parentr� )r Z
testLogSysr r r! �testGetF2BLogger| s z LoggingTests.testGetF2BLoggerc s� t j}g ��fdd�t _z6t� }|�� |�� � �t�� �fdd�d�� W 5 |t _X � �d� � � t
��d� � � �d d t � d S )Nc s
� � | �S r )r� )r r: r r! r� � r� z5LoggingTests.testFail2BanExceptHook.<locals>.<lambda>c s t ��o� �d�S )N�Unhandled exception)r� Z
_is_loggedr �r r; r r! r� � r� r� r` r
r ) r �__excepthook__r[ r� r� rl r r� r� r@ r� r� )r Z prev_exchookZ badThreadr ra r! �testFail2BanExceptHook� s
z#LoggingTests.testFail2BanExceptHookc
C s� g }t �dd�\}}t�|� |�|� t �dd�\}}t�|� |�|� t� }z,|j
||dd� | � |� � � | �
d� W 5 |�� |D ]}tj�|�r�t� |� q�X d S )Nz
fail2ban.sockzf2b-testz fail2ban.pidF)ZforcezServer already running)rt ru rv rw r� r r5 r� r) r$ r� r] r^ r� )r Z tmp_filesZsock_fdZ sock_nameZ
pidfile_fdZ pidfile_namer+ rC r r r! �testStartFailedSockExists� s
z&LoggingTests.testStartFailedSockExistsN)r$ r% r& r_ rc rd r r r r! r] z s r] )� ActionReader� JailsReader�
CONFIG_DIRc s� e Zd Z� fdd�Z� fdd�Z� fdd�Zddd �Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dd� Z ddd�Z
dd� Z� ZS ) �ServerConfigReaderTestsc s t t| �j||� i | _d S r )r) rh �__init__�#_ServerConfigReaderTests__share_cfgr r2 r r! ri � s z ServerConfigReaderTests.__init__c s t t| ��� g | _dS )r( N)r) rh r* Z _execCmdLstr1 r2 r r! r* � s z ServerConfigReaderTests.setUpc s t t| ��� dS r4 )r) rh r6 r1 r2 r r! r6 � s z ServerConfigReaderTests.tearDownr� c C s6 |� d�D ]&}|�d�s&t�d|� q
t�|� q
dS )N�
�#zexec-cmd: `%s`T)�splitrS �logSys�debug)r �realCmdr� rD r r r! � _executeCmd� s
z#ServerConfigReaderTests._executeCmdc C sP t | d�sJt� }i | _dD ].\}}t|�}|�d� tj�||�| j|< q| jS )NZ__aInfos))�ipv4r� )�ipv6rU rq )�hasattrr Z _ServerConfigReaderTests__aInfosr Z
setBanTime�_actionsr� �
ActionInfo)r �dmyjail�tr� �ticketr r r! �_testActionInfos� s
z(ServerConfigReaderTests._testActionInfosc C s2 |j }| �� }|D �]}|| jD �]}|| j| }t�d� t�d|d |j � t�d� t|tj�snq"| j |_
t�d� | � � |� � t�d� | � � |�
|d � t�d� | � � |�|d � t�d� | � � |�
|d � t�d
� | � � |�|d � t�d � | � � |�� q"qd S ) N�4# ==================================================�
# == %-44s ==� - �# === start ===�# === ban-ipv4 ===rr �# === unban ipv4 ===�# === ban ipv6 ===rs �# === unban ipv6 ===�# === stop ===)r� rz r rn ro �_namer� ru �
CommandActionrq �
executeCmdr� r� r r r` )r r+ r� �aInfosrF rO r� r r r! �_testExecActions� s:
z(ServerConfigReaderTests._testExecActionsc C s� t jjdd� ttd| jd�}| �|�� � | �|�� � |j dd�}t
� }|j }|j }|D �]
}|d dkr\|d dkr�d|d < n�t
|�d
kr�|d d kr�|d d kr�tj�td
|d �}tj�|�s�tj�td�}||d
< nDt jj�r$t
|�d
k�r$|d dk�r$|d dk�r$d |d< d|d
< z ||� W q\ tk
�rf } z| �d||f � W 5 d }~X Y q\X q\t jj�s~| �|� d S )NT�Zstock)�basedirZ force_enable� share_config)Zallow_no_filesr r� rK r r r� r7 r� Zlogsr
r� )r7 z multi-setr� zDUMMY-REGEX <HOST>z"Command %r has failed. Received %r)rh ri �SkipIfCfgMissingrf rg rj rl �read�
getOptions�convertr r, � _Transmitter__commandHandlerr� rv r� r� r� r) rj r. rA r� ) r r� �streamr+ r- �
cmdHandlerrB rB �er r r! �testCheckStockJailActions� s@
$
�
�
� &
z1ServerConfigReaderTests.testCheckStockJailActionsc C sb |� d|�}t|�\}}d|dgg}t|||| jtd�}| �|�� � |�i � |�|� � � |S )Nz %(__name__)srK r )r� r� )
rR r re rj rg rl r� r� �extendr� )r rF �actZactNameZactOptr� r� r r r! �getDefaultJailStream s � �
z,ServerConfigReaderTests.getDefaultJailStreamc
C s� t jjdd� t j�� dd l}t� }|j}|�tj� t
dd��D ]V}tj� |�� dd�}| �
d| |�}|D ] }|�|�\}} | �|d� qn| �|� qBd S ) NTr� r r z*.confz.confr� zj-)rh ri r� Z
SkipIfFast�globr r, rv r� r� rg �basenamerR r� rA r@ r� )
r r� r+ r- ZactCfgr� r� rB rX �resr r r! �testCheckStockAllActions+ s
z0ServerConfigReaderTests.testCheckStockAllActionsc C s� t jjdd� ddddddd d
d d d
ddddd�
fdddddddddddd d d d d�
fd d!d"d#d$d%d&d'd(d)d*d+� fd,d-d"d#d.d/d0d1d2�fd3d4d5d6d7d8d9d:d;d<d=d>d?d@dA� fdBdCd5d6dDdEdFdGdHdIdJdKdLdMdA� fdNdOdPdQdRdSdTdUdVdWdXdYdZ�
fd[d\d]d^d_d`dadbdcdddedfdZ�
fdgdhd5d6didjdkdldmdndodpdqdrdA� fdsdtd5d6dudvdwdxdydzd{d|d}d~dA� fdd�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�dA� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�d�d�� fd�d�d�d�d�d�d�d�d�d�d�d�dZ�
fd�d�d�d�d�d�d�d�d�d�d�d�dZ�
ff}t� }|j}|j}|D ]>\}}}| �||�}|D ] } |�| �\}
} | �|
dݡ �q~�qd|j } | �
� }
|D �]\}}}| | j D �]�}| | j | }t �
dޡ t �
d�|d� |j � t �
dޡ | �t|tj�� | j|_| �d� |�� |�d��rX| j|d� d�di� n4|�d��r�|�d��r�| j|d� |d� d�di� | �d� |�|
d� � |�d��r�| j|�d�d��|d� d�di� |�d��r�| j|d� d�di� | j|�d�d��|d� d�di� | j|d� d�di� | �d� |�|
d� � | j|�d�d��|d� d�di� | j|d� d�di� | �d� |�|
d� � |�d��r�| j|�d�d��|d� d�di� |�d��r�| j|d� d�di� | j|�d�d��|d� d�di� | j|d� d�di� | �d� |�|
d� � | j|�d�d��|d� d�di� | j|d� d�di� |�d���r�| �d�� |� � | j|d� d�di� | �d�� |� � |�d���r�| j|d� d�di� �q̐q�d S )�NTr� z
j-w-nft-mpzQnftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"])zip Z ipv4_addrzaddr-)zip6 Z ipv6_addrzaddr6-)� `nft add table inet f2b-table`�W`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`z9`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`z`done`)zG`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`zj`nft add rule inet f2b-table f2b-chain $proto dport \{ http,https \} ip saddr @addr-set-j-w-nft-mp reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`zl`nft add rule inet f2b-table f2b-chain $proto dport \{ http,https \} ip6 saddr @addr6-set-j-w-nft-mp reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`�5`nft delete rule inet f2b-table f2b-chain $hdl; done`z3`nft delete set inet f2b-table addr-set-j-w-nft-mp`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-mp`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)
�ip4�ip6�*-start� ip4-start� ip6-start�flushr` � ip4-check� ip6-check�ip4-ban� ip4-unban�ip6-ban� ip6-unbanz
j-w-nft-apz8nftables-allports[name=%(__name__)s, protocol="tcp,udp"])r� r� )zG`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`zg`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`zi`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || )z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z3`nft delete set inet f2b-table addr-set-j-w-nft-ap`z�`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r� z4`nft delete set inet f2b-table addr6-set-j-w-nft-ap`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`zj-dummyzAdummy[name=%(__name__)s, init="==", target="/tmp/fail2ban.dummy"])z
family: inet4)z
family: inet6)z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`)z9`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`)z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`)zP`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`)zR`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`)zQ`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`)zS`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`) r� r� r� r� r` r� r� r� r� z j-hostsdenyzPhostsdeny[name=%(__name__)s, actionstop="rm <file>", file="/tmp/fail2ban.dummy"])z5`printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`)z^`IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)z8`printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`)za`IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)r� r� r� r� r� r� zj-w-iptables-mpzniptables-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])�
`iptables �icmp-port-unreachable)� `ip6tables �icmp6-port-unreachable)z$`iptables -w -N f2b-j-w-iptables-mp`z.`iptables -w -A f2b-j-w-iptables-mp -j RETURN`zU`iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`)z%`ip6tables -w -N f2b-j-w-iptables-mp`z/`ip6tables -w -A f2b-j-w-iptables-mp -j RETURN`zV`ip6tables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`)�$`iptables -w -F f2b-j-w-iptables-mp`�%`ip6tables -w -F f2b-j-w-iptables-mp`)zU`iptables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z$`iptables -w -X f2b-j-w-iptables-mp`zV`ip6tables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`r� z%`ip6tables -w -X f2b-j-w-iptables-mp`)z>`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`)z?`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`)za`iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`) r� r� r� r� r� r` r� r� r� r� r� r� zj-w-iptables-apzZiptables-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z$`iptables -w -N f2b-j-w-iptables-ap`z.`iptables -w -A f2b-j-w-iptables-ap -j RETURN`z4`iptables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`)z%`ip6tables -w -N f2b-j-w-iptables-ap`z/`ip6tables -w -A f2b-j-w-iptables-ap -j RETURN`z5`ip6tables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`)�$`iptables -w -F f2b-j-w-iptables-ap`�%`ip6tables -w -F f2b-j-w-iptables-ap`)z4`iptables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`r� z$`iptables -w -X f2b-j-w-iptables-ap`z5`ip6tables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`r� z%`ip6tables -w -X f2b-j-w-iptables-ap`)z>`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`)z?`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`)za`iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-ipsetz~iptables-ipset-proto6[name=%(__name__)s, bantime="10m", default-timeout=0, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-iptables-ipset )z f2b-j-w-iptables-ipset6 )z7`ipset create f2b-j-w-iptables-ipset hash:ip timeout 0`z�`iptables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`)zE`ipset create f2b-j-w-iptables-ipset6 hash:ip timeout 0 family inet6`z�`ip6tables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)�$`ipset flush f2b-j-w-iptables-ipset`�%`ipset flush f2b-j-w-iptables-ipset6`)z�`iptables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-iptables-ipset`z�`ip6tables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-iptables-ipset6`)z?`ipset add f2b-j-w-iptables-ipset 192.0.2.1 timeout 600 -exist`)z3`ipset del f2b-j-w-iptables-ipset 192.0.2.1 -exist`)zA`ipset add f2b-j-w-iptables-ipset6 2001:db8:: timeout 600 -exist`)z5`ipset del f2b-j-w-iptables-ipset6 2001:db8:: -exist`)
r� r� r� r� r� r` r� r� r� r� zj-w-iptables-ipset-apzjiptables-ipset-proto6-allports[name=%(__name__)s, bantime="10m", default-timeout=0, chain="<known/chain>"])z f2b-j-w-iptables-ipset-ap )z f2b-j-w-iptables-ipset-ap6 )z:`ipset create f2b-j-w-iptables-ipset-ap hash:ip timeout 0`zu`iptables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zH`ipset create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 family inet6`zx`ip6tables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)�'`ipset flush f2b-j-w-iptables-ipset-ap`�(`ipset flush f2b-j-w-iptables-ipset-ap6`)zu`iptables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z)`ipset destroy f2b-j-w-iptables-ipset-ap`zx`ip6tables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z*`ipset destroy f2b-j-w-iptables-ipset-ap6`)zB`ipset add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 600 -exist`)z6`ipset del f2b-j-w-iptables-ipset-ap 192.0.2.1 -exist`)zD`ipset add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 600 -exist`)z8`ipset del f2b-j-w-iptables-ipset-ap6 2001:db8:: -exist`z j-w-iptablesz^iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z!`iptables -w -N f2b-j-w-iptables`z+`iptables -w -A f2b-j-w-iptables -j RETURN`z>`iptables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`)z"`ip6tables -w -N f2b-j-w-iptables`z,`ip6tables -w -A f2b-j-w-iptables -j RETURN`z?`ip6tables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`)�!`iptables -w -F f2b-j-w-iptables`�"`ip6tables -w -F f2b-j-w-iptables`)z>`iptables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`r� z!`iptables -w -X f2b-j-w-iptables`z?`ip6tables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`r� z"`ip6tables -w -X f2b-j-w-iptables`)z;`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`)z<`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`)z^`iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z\`iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)za`ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z_`ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-newzbiptables-new[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z%`iptables -w -N f2b-j-w-iptables-new`z/`iptables -w -A f2b-j-w-iptables-new -j RETURN`zW`iptables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`)z&`ip6tables -w -N f2b-j-w-iptables-new`z0`ip6tables -w -A f2b-j-w-iptables-new -j RETURN`zX`ip6tables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`)�%`iptables -w -F f2b-j-w-iptables-new`�&`ip6tables -w -F f2b-j-w-iptables-new`)zW`iptables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`r� z%`iptables -w -X f2b-j-w-iptables-new`zX`ip6tables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`r� z&`ip6tables -w -X f2b-j-w-iptables-new`)z?`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`)z@`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`)zb`iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z``iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)ze`ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zc`ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-xtrezPiptables-xt_recent-echo[name=%(__name__)s, bantime="10m", chain="<known/chain>"])r� z/f2b-j-w-iptables-xtre`)r� z/f2b-j-w-iptables-xtre6`)z�`if [ `id -u` -eq 0 ];then iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`)z�`if [ `id -u` -eq 0 ];then ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`)z4`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre`z�`if [ `id -u` -eq 0 ];then iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`z5`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`z�`if [ `id -u` -eq 0 ];then ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`)z3`test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z4`test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z=`echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z=`echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z?`echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z?`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`) r� r� r� r� r` r� r� r� r� r� r� zj-w-pfz2pf[name=%(__name__)s, actionstart_on_demand=false]r )zF`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`z
port="<port>"z\`echo "block quick proto tcp from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`)�,`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`)zT`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`r� z+`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`)z.`pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`)z4`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`)z7`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`)z5`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`)z8`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`) r� r� r� r� r` r� r� r� r� r� r� z j-w-pf-mpz@pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"])zL`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`zport="http,https"zb`echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`)�2`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`)z]`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`r� z1`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`)z4`pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`)z:`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`z j-w-pf-apzHpf[actiontype=<allports>, actionstart_on_demand=true][name=%(__name__)s])zL`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`zW`echo "block quick proto tcp from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`)�2`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`)z]`pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`r� z1`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`)z4`pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`)z:`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`z j-w-fwcmd-mpzqfirewallcmd-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])z ipv4 r� )z ipv6 r� )z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`z j-w-fwcmd-apz]firewallcmd-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)zT`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`zT`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z�`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-fwcmd-ipsetzzfirewallcmd-ipset[name=%(__name__)s, bantime="10m", default-timeout=0, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset )z f2b-j-w-fwcmd-ipset6 )z4`ipset create f2b-j-w-fwcmd-ipset hash:ip timeout 0`z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`)zB`ipset create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)�!`ipset flush f2b-j-w-fwcmd-ipset`�"`ipset flush f2b-j-w-fwcmd-ipset6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`r� z#`ipset destroy f2b-j-w-fwcmd-ipset`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r� z$`ipset destroy f2b-j-w-fwcmd-ipset6`)z<`ipset add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 600 -exist`)z0`ipset del f2b-j-w-fwcmd-ipset 192.0.2.1 -exist`)z>`ipset add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 600 -exist`)z2`ipset del f2b-j-w-fwcmd-ipset6 2001:db8:: -exist`zj-w-fwcmd-ipset-apzqfirewallcmd-ipset[name=%(__name__)s, bantime="10m", actiontype=<allports>, protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset-ap )z f2b-j-w-fwcmd-ipset-ap6 )z9`ipset create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 600`z�`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zG`ipset create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 600 family inet6`z�`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)�$`ipset flush f2b-j-w-fwcmd-ipset-ap`�%`ipset flush f2b-j-w-fwcmd-ipset-ap6`)z�`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r� z&`ipset destroy f2b-j-w-fwcmd-ipset-ap`z�`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r� z'`ipset destroy f2b-j-w-fwcmd-ipset-ap6`)z?`ipset add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 600 -exist`)z3`ipset del f2b-j-w-fwcmd-ipset-ap 192.0.2.1 -exist`)zA`ipset add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 600 -exist`)z5`ipset del f2b-j-w-fwcmd-ipset-ap6 2001:db8:: -exist`r r{ r| r} r~ r� r� r� r� r rr r� r� r� r� r� r� r� rs r� r� r� r� r� r� z# === flush ===r� r` ) rh ri r� r r, r� r� rA r@ r� rz r rn ro r� rl r� ru r� rq r� r� r� r8 r� r� r r r� r` )r �testJailsActionsr+ r- r� rF r� �testsr� rB rX r� r� r� rO r� r r r! � testCheckStockCommandActions? sV �1 �. � � �, �, �$ �$ �, �, �" � � � �( �( �$ �� � � � �
z4ServerConfigReaderTests.testCheckStockCommandActionsc C s` |}t |t�r|d }t�dd|�}t�ddd� |d�}t |t�rL||d< n|}tjj||d�S ) Nr z\)\s*\|\s*(\S*mail\b[^\n]*)z$) | cat; printf "\\n... | "; echo \1z\bADDRESSES=\$\(dig\s[^\n]+c S s dS )Nz@ADDRESSES="abuse-1@abuse-test-server, abuse-2@abuse-test-server"r )�mr r r! r� r� z9ServerConfigReaderTests._executeMailCmd.<locals>.<lambda>r
)r� )r� rP �re�subru r� r� )r rp r� rB r r r! �_executeMailCmd s
� �
z'ServerConfigReaderTests._executeMailCmdc C s t jjdd� ddtj�td� d d tj�td� d d
d ifd d
tj�td� d d tj�td� d d
difddtj�td� d d tj�td� d ddd�fddddd�ff}t� }|j}|j }|D ]:\}}}| �
||�}|D ] } |� | �\}
} | � |
d� q�q�|j
} td�}
td�}t� }|D ]�\}}}| | jD ]�}| | j| }t�d � t�d |d |j � t�d � | j|_d
|
fd |ffD ]t\}}|�|��s��q�| �d | � t|�}|�d!� |�d"d#g� tj � ||�}|� |� | j || d$di� �q��qD�q0d S )%NTr� zj-mail-whois-linesz\mail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s", logpath="r� rk z ztestcase01a.logz8", _whois_command="echo '-- information about <ip> --'"]r� )�;The IP 87.142.124.10 has just been banned by Fail2Ban afterz(100 attempts against j-mail-whois-lines.�.Here is more information about 87.142.124.10 :�%-- information about 87.142.124.10 --�2Lines containing failures of 87.142.124.10 (max 2)�etestcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�etestcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10zj-sendmail-whois-lineszxsendmail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd='testmail -f "<sender>" "<dest>"', logpath=")r� z,100 attempts against j-sendmail-whois-lines.r� r� r� r� r� zj-complain-abusez�complain[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s 'Hostname: <ip-host>, family: <family>' - ",debug=1,logpath="z", ])�6try to resolve 10.124.142.87.abuse-contacts.abusix.orgr� r� r� zymail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-server)�htry to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgz0Lines containing failures of 2001:db8::1 (max 2)zwmail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-server)r� r� z j-xarf-abusezIxarf-login-attack[name=%(__name__)s, mailcmd="mail", mailargs="",debug=1])r� z8We have detected abuse from the IP address 87.142.124.10�VDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�UDec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10�8mail abuse-1@abuse-test-server abuse-2@abuse-test-server)r� z6We have detected abuse from the IP address 2001:db8::1r� r z
87.142.124.10z 2001:db8::1r{ r| r} r� z # === %s ===ro r� r� r� ) rh ri r� rv r� r� r� r r, r� r� rA r@ r� r r r rn ro r� r� r� r8 r� r Z
setAttemptZ
setMatchesru r� rv r r� )r r� r+ r- r� rF r� r� r� rB rX r� r� rr rs rw rO r� Ztestr� ry r r r! � testComplexMailActionMultiLog s� ��� �� �� ��� �� �� ��� �� �� ���_
�
z5ServerConfigReaderTests.testComplexMailActionMultiLog)r� )r� )r$ r% r& ri r* r6 rq rz r� r� r� r� r� r� r� r[ r r r2 r! rh � s"
"3 T
rh )@�
__author__Z
__copyright__Z __license__rh rk rt rv r� r r/ Zserver.failregexr r r r+ r ru Z
server.serverr Z server.ipdnsr Z server.jailr Zserver.jailthreadr
Z
server.ticketr Z server.utilsr Z dummyjailr Zutilsr r r Zhelpersr r r r� r r r� r� r� �dirname�__file__r� r0 rn r r' r\ r ZTestCaserI rK r[ r] Zclientreadertestcasere rf rg rh r r r r! �<module> sX
[ } U*