=*f@wSrSrSrSSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK r SSK J r SSK Jr SSKJr SS KJr SS KJr SS KJr S S KJrJrJrJrJrJrJ r \"\!5r"\ RF"5r$\RJr&\RN"S5r(Sr)\RN"S5r*SSS.r+SSS.r,\,R[\+5 "SS\\.5r/"SS\.\ S9r0SSS.r1"SS \05r2g!\a SSKJr Nf=f)!z'Cyril Jaquier and Fail2Ban Contributorsz>Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav HalchenkoGPLN)ABCMeta)MutableMapping) mapTag2Opt)DNSUtils)MyTime)Utils) getLogger_merge_copy_dicts splitwordssubstituteRecursiveTags uni_stringTAG_CREMAX_TAG_REPLACE_COUNTz)inet4inet6z^(\w+)\?(family)=(.*)$c<[[R"SS95$)NTfqdnstrr getHostname8/usr/lib/python3/dist-packages/fail2ban/server/action.pyr?sH00d; U$! MG=f)Nc3r># UH,up[U5(aUTR;dM'X4v M. g7fr3)callable CM_REPR_ITEMS).0nvr-s r %CallingMap._asdict..us23  A;;!t111u s&7 7)r,r'r(itemslistrC __getitem__)r-r>checkerdrFrGs` rr=CallingMap._asdictrs 499% %!  3 3 33 !'')_caqkk  ! Q qT (  s =$B''B,cfURUnU$![a URUnU$f=fr3)r(KeyErrorr'r-keyvalues r getRawItemCallingMap.getRawItems? << 5 ,  99S>5 ,s 00cURUn[U5(aI[ US5(a#UR R (aU"U5OU"5nX RU'U$![a URUnNvf=f)N__code__)r(rQr'rChasattrrX co_argcountrRs rrLCallingMap.__getitem__sv << 5e__!%449S9S5;Y^Y`5<< ,  99S>5sA,,BBcUR(aVURR5UlURUlURR5UlSUlX RU'gNF)r)r(copyr'r4rRs r __setitem__CallingMap.__setitem__sM ^^,,##%4<YY4?yy~~494>,,src[SU-5e)NzKey %r was deleted)rQr-rSs r __unavailableCallingMap.__unavailables%+,,rc(UR(aVURR5UlURUlURR5UlSUlURU URU g![ a Nf=fr])r)r(r^r'r4rQrbs r __delitem__CallingMap.__delitem__ss ^^,,##%4<YY4?yy~~494> ||C iin s) B BBc,[UR5$r3)iterr'r-s r__iter__CallingMap.__iter__s diirc,[UR5$r3)lenr'rjs r__len__CallingMap.__len__s TYYrc`UR[URUR55$r3)r;r r'r(rjs rr^CallingMap.copys! )$))T\\B CCr)r*r'r)r()T)F)FN)r< __module__ __qualname____firstlineno____doc__rD __slots__r0r6r?__repr__r=rUrLr__CallingMap__unavailablerfrkror^__static_attributes__rrrr%r%JsZ <$ M  $ - Drr%c\\rSrSrSr\S5rSrSrSr Sr Sr \ S 5r S rS rg ) ActionBaseaAn abstract base class for actions in Fail2Ban. Action Base is a base definition of what methods need to be in place to create a Python based action for Fail2Ban. This class can be inherited from to ease implementation. Required methods: - __init__(jail, name) - start() - stop() - ban(aInfo) - unban(aInfo) Called when action is created, but before the jail/actions is started. This should carry out necessary methods to initialise the action but not "start" the action. Parameters ---------- jail : Jail The jail in which the action belongs to. name : str Name assigned to the action. Notes ----- Any additional arguments specified in `jail.conf` or passed via `fail2ban-client` will be passed as keyword arguments. cRSnUHn[[XS55(aM g g)N)startstopbanrebanunbanFT)rCgetattr)clsCrequiredmethods r__subclasshook__ActionBase.__subclasshook__s/(f 71d+ , ,  rcjXlX l[SURR-5Ulg)Nz fail2ban.%s)_jail_namer r;r<_logSys)r-jailnames rr0ActionBase.__init__s'**=4>>+B+BBC$,rcg)z:Executed when the jail/action is started. Nrrjs rrActionBase.startrcg)z:Executed when the jail/action is stopped. Nrrjs rrActionBase.stoprrcg)Executed when a ban occurs. Parameters ---------- aInfo : dict Dictionary which includes information in relation to the ban. Nrr-aInfos rrActionBase.banrc$URU5$)r)rrs rrActionBase.rebans %rcgr]rrjs r _prolongableActionBase._prolongable s rcg)zExecuted when a ban expires. Parameters ---------- aInfo : dict Dictionary which includes information in relation to the ban. Nrrs rrActionBase.unbanrr)rrrN)r<rsrtrurv classmethodrr0rrrrpropertyrrrzrrrr|r|sN<  D       rr|) metaclass str2secondsignore)timeoutbantimec^\rSrSrSr\"S5rSrU4Sjr\ S5r Sr \ r Sr \S 5r\S 5rS rS r/S 4Sjr\S5r\S5r\S5rSrS*SjrS+Sjr\S5rSrSrSrSrSrS,Sjr Sr!S,Sjr"\#RH"S5r%\ S5r&\ S-S j5r'\#RH"S!5r%\#RH"S"5r(\ S,S#j5r)\S$5r*S%r+S.S&jr,S,S'jr-\.S/S(j5r/S)r0U=r1$)0 CommandActioni aA action which executes OS shell commands. This is the default type of action which Fail2Ban uses. Default sets all commands for actions as empty string, such no command is executed. Parameters ---------- jail : Jail The jail in which the action belongs to. name : str Name assigned to the action. Attributes ---------- actionban actioncheck actionreban actionreload actionrepair actionstart actionstop actionunban timeout )matches ipmatches ipjailmatchescSUlSUlSUlSUlSUlSUlSUlSUlSUlSUl SUl SUlg!SUlf=f)zEClear all lists/dicts parameters (used by reloading) r<rN) _CommandAction__initr actionstart actionban actionreban actionunban actioncheck actionrepair actionflush actionstop actionreloadrjs rclearAllParamsCommandAction.clearAllParams>sl$+4<44>444444?44;4;s AA A c>[[U] X5 SUlSUl0Ul0UlUR5 URRSUR-5 g)Nrz Created %s) superrr0r_CommandAction__properties_CommandAction__started_CommandAction__substCacherrdebugr;)r-rrr;s rr0CommandAction.__init__XsW t%d1$+$$.$,,\DNN23rc[$r3)NotImplemented)rrs rrCommandAction.__subclasshook__as rcxURS5(dUR(d[U5(du[R U5nUS:XagUS:Xa[ R "U5nSUlURR5 URRSX5 X RU'g)N_rrz Set %s = %r) startswithrrCWRAP_CMD_PARAMSgetr rrrclearrr__dict__)r-rrTwrps r __setattr__CommandAction.__setattr__es   dkk(5//   T "3 Xo  }   u %E4<<ot3--rcURS5(d=SUlURR5 URR SU5 UR U g)Nrz Unset %s)rrrrrrr)r-rs r __delattr__CommandAction.__delattr__wsK   4<<lD) mmDrc^TRb TR$[U4Sj[T555TlTR$)z\A dictionary of the actions properties. This is used to substitute "tags" in the commands. c3># UHGnURS5(aM[[TU55(aM7U[TU54v MI g7f)rN)rrCr)rErSr-s rrH,CommandAction._properties..sFs .. &.wtS/A&BCs sAAA)rr,dirrjs`r _propertiesCommandAction._propertiessI "   $i$   rcUR$r3)rrjs r _substCacheCommandAction._substCaches  rcURXRU(aSU-OSURS9nU(aSU;aU$URUSU05nU$)Nfamily=r conditionalcache<family) replaceTagrrreplaceDynamicTags)r-tagrcmds r _getOperationCommandAction._getOperations_ --$* &     # 3c>#: hv%67# *rcSU4n[U5(d[U5(d+URRU05RU5$URRU05R 5VVs/sHupVU"U5(dMUPM snn$USnU(aURUnXxU'gURUnUR U5n[UR 55Hup&Xg:XdM X M gs snnf![ a 0=oRU'Ntf=f![ a gf=f)zLGet, set or delete command of operation considering family. __eOpCmdrN)rnrCrrrJrQpoprK) r-rrr.rSfrGrfamds r_operationExecuted CommandAction._operationExecuteds, C# T 6      b ) - -f 55**..sB7==? M?6!91? MM Q#'   S !D<   S !D ((6 C$**,'   ,( N '$&&D  S !'   s7=D D +DAD2D2D/.D/2 D?>D?Nc ^SnSnU(d7URR5VVs/sHupxU(dMUPM nnnUGH3mURUT5n Sn U (aXRUU4Sj5;aU n UR(a[ URR SS5n U (dFURR RS5n [URR SU 5 [R"5U S'TU S'URX5n URXR5n XZ-nU(a U"TU 5 URUTU (aU OS5 GM6 U(d/[S U<S UR<S UR <S U<35eU$s snnf![an SnU nSn A GMSn A ff=f) zExecutes the operation commands (like "actionstart", "actionstop", etc). Replace the tags in the action command with actions properties and executes the resulting command. Tz Script errorc>UT:g$r3r)rfamopers rr1CommandAction._executeOperation..s gr actionInfoNtimerFzError z action /z: )rrJrrrractions_getActionInfosetattrr rr executeCmdr ValueError RuntimeErrorr)r-r operationr afterExecreserrrrGrretrealCmdres ` r_executeOperationCommandAction._executeOperationsx ## (,(<(<(> D(>'!W(>6 Dg   S' *C C s11#7MNNW djj((,=e zz!!006utzz!!<7kkmeFmeHo''3g ??7LL 1SZS)GS)C#$?)0 Y DJJX[\ ]] *7 E,  C C s# F6F6 D.F<< GGGcURRS5nUbU$SnURH!n[RU5(dMSn O XRS'U$)N__hasCondSectionFT)rrCONDITIONAL_FAM_REmatch)r-rGrFs r_hasCondSectionCommandAction._hasCondSectionsg -.!] 8 !   aq!! A  *+%& (rcRURRS5nU(aU$URRS5nU(a'[U[[45(d [ U5nO+UR (a[5(aSS/OS/nOS/nXRS'U$)N __familiesfamiliesrrr)rr isinstancerKsetrr  allowed_ipv6r-rGs r _familiesCommandAction._familiess <(!q :&!z!d3Z((!}1 )^^'1 t1#$< (rczURRS5nUbU$URnXRS'U$)z1Checks the action depends on family (conditional)actionstart_on_demand)rrr rs r_startOnDemandCommandAction._startOnDemandsD 23!] 8 !./*+ (rc"UR5$)Executes the "actionstart" command. Replace the tags in the action command with actions properties and executes the resulting command. )_startrjs rrCommandAction.start s rc^TR(a U(dgO(U(d!TRRU5(agUbU/O TRnU4SjnTR SSXS9nU$)rTcZ>U(a#TRSUS5 STRU'gg)N r)rrrrr-s r_started&CommandAction._start.._starteds+ NFD9DNN6 r startingrr)rrrrr)r-r forceStartr$rs` rrCommandAction._startsh     $..,,V44 )F8t~~&  6^# *rcJURSS5nUR(a0URRU5(dURUSS9 UR X!5(d[ SU-5eURRUS5S-URU'g) a'Executes the given command ("actionban" or "actionreban"). Replaces the tags in the action command with actions properties and ban information, and executes the resulting command. Parameters ---------- aInfo : dict Dictionary which includes information in relation to the ban. rrTr)zError banning %(ip)srN)rrrr _processCmdr)r-rrrs rrCommandAction.ban%s 99Xr "&  ..  V $ $KK4K(  # % % ,u4 55>>--fa81<$..rc[US5=(a; UR=(a( [UR5R5(+$)N actionprolong)rYr1risspacerjs rrCommandAction._prolongable;s= $ ( -T-?-? - t!! " * * ,,.rcNURSU5(d[SU-5eg)aExecutes the "actionprolong" command. Replaces the tags in the action command with actions properties and ban information, and executes the resulting command. Parameters ---------- aInfo : dict Dictionary which includes information in relation to the ban. zzError prolonging %(ip)sN)r.rrs rprolongCommandAction.prolong@s.   +U 3 3 /%7 88 4rcURSS5nURRUS5S-(a&URSU5(d[SU-5egg)aExecutes the "actionunban" command. Replaces the tags in the action command with actions properties and ban information, and executes the resulting command. Parameters ---------- aInfo : dict Dictionary which includes information in relation to the ban. rrrr zError unbanning %(ip)sN)rrr.r)r-rrs rrCommandAction.unbanOs[ 99Xr "& ^^"Q&   ?E 2 2 /%7 88 3'rcRURXR(aS5$S5$)aBExecutes the "actionreban" command if available, otherwise simply repeat "actionban". Replaces the tags in the action command with actions properties and ban information, and executes the resulting command. Parameters ---------- aInfo : dict Dictionary which includes information in relation to the ban. z )rrrs rrCommandAction.reban`s# %,<,< PP- PPrc^TRR5VVs/sHupUS-S:XdMUPM nnnU(dgU4SjnTRSSX4S9$s snnf)aExecutes the "actionflush" command. Command executed in order to flush all bans at once (e. g. by stop/shutdown the system), instead of unbanning of each single ticket. Replaces the tags in the action command with actions properties and executes the resulting command. r-Tc>U(a9TRRU5(aTRU==S-ss'ggg)N)rrr#s r _afterFlush(CommandAction.flush.._afterFlush}s5 dnn  ((NN6b )crz flushingr()rrJr)r-rrGrr@s` rflushCommandAction.flushos^ >>//1 @1%1QUaZA1& @ "   F  bb As AAc"UR5$)Executes the "actionstop" command. Replaces the tags in the action command with actions properties and executes the resulting command. )_stoprjs rrCommandAction.stops rc(^UcGTRR5VVs/sHup#U(dMUPM nnnU(dg0TlOTRU==S-ss'U/nU4SjnTRSSXS9$s snnf![a gf=f)rFTrc<>U(aTRSUS5 gg)Nr&)rr#s r_stopped%CommandAction._stop.._stoppeds OVT: rr"stoppingr()rrJrQr)r-rrrGrKs` rrGCommandAction._stops ^ NN002 825AaQ26 8 4>NN6aXF;    6  ^^ 9  s A>A> B BBc &URSS5$)zExecutes the "actionreload" command. Parameters ---------- kwargs : dict Currently unused, because CommandAction do not support initOpts Replaces the tags in the action command with actions properties and executes the resulting command. z reloading)r)r-r/s rreloadCommandAction.reloads    0+ >>rcSnUR(at[URR55HMup4U(dMUR X15(aM&SURU'UR SUS5 US-nMO U$)zTExecutes the invariant check with repair if expected (conditional). Trr&NF)rrKrrJ_invariantCheckr)r- beforeRepairrrstarteds rconsistencyCheckCommandAction.consistencyChecksv #  !5!5!78wt++FAAT^^F _fd;E\S 9 *rz[\\#&;`|*?~<>^()\[\]{}$'"\n\r]cT^SSS.mU4SjnURRX!5nU$)aEscape characters which may be used for command injection. Parameters ---------- value : str A string of which characters will be escaped. Returns ------- str `value` with certain characters escaped. Notes ----- The following characters are escaped:: \#&;`|*?~<>^()[]{}$'" rFr)r  cL>UR5nSTRX5-$)N\)groupr)mc_map2cs r substChar*CommandAction.escapeTag..substChars"wwy1 A! !!r) ESCAPE_CREsub)rrTrbras @r escapeTagCommandAction.escapeTags/*S !&" ..  Y .% ,rc^^^ ^ SU;aU$Ub UT4nXV$[U[5nUm U(d:S=m nUbS[U5T4nXXm T c[ UTTR US9m UbT XX'[[ 5m U UUU 4Sjn [S-n [R"X5n U(aO*X:XdSU ;aOU nU S-n U S::a[SU<35eMHUbXW'U $![a Nf=f![a Nf=f) zReplaces tags in `query` with property values. Parameters ---------- query : str String with tags. aInfo : dict Tags(keys) and associated values for substitution in query. Returns ------- str `query` string with tags replaced. rNz subst-tags)raddreplc.>URS5nSnT(aTRUS-T-5nUc3TRU5nUcTRXR55$[U5nUTR;aTR U5nU$)Nr?)r^rr _escapedTagsrf)r_rrTADD_REPL_TAGS_CMrrsubInfos rsubstVal*CommandAction.replaceTag..substVals 3 5 KKc K/ 0E m KK E }  ggi 00 e 5 S   MM% E \^\(\)\[\]{}$'"\n\r]z\WcP^^^^^^[5mT(dUU4Sjm[[5mUUU4Sjn[R"XA5nSU;a6TR S5mT(d0mUU4Sjn[ R XQ5nT(a[R"UT5nU$)aReplaces dynamical tags in `query` with property values. **Important** ------------- Because this tags are dynamic resp. foreign (user) input: - values should be escaped (using "escape" as shell variable) - no recursive substitution (no interpolation for >) - don't use cache Parameters ---------- query : str String with tags. aInfo : dict Tags(keys) and associated values for substitution in query. Returns ------- str shell script as string or array with tags replaced (direct or as variables). c>TRRU5(a)STRRSU5-nUTU'SU-nU$)Nzf2bV_%sr$)rdsearch ESCAPE_VN_CREre)rrTrvarsDicts r escapeVal3CommandAction.replaceDynamicTags..escapeValSsN ~~U## s((,,S#6 6SXc] WU Lrc>URS5nTUn[U5nT"X5$![a" TRXR55s$f=f)Nr)r^rQrr)r_rrTrmrrs rro2CommandAction.replaceDynamicTags..substValas] 30 #JE e 5 C  0   WWY //0s,)AArzF-*c>[URS55n[TU5nT"SU-U5$![a gf=f)NrrF_)rr^rrQ)r_rrTrtickDatas rsubstTag2CommandAction.replaceDynamicTags..substTagssO QWWQZ C  &U T#Xu %%  s7 AA) r,r%rrrrer FCUSTAG_CREr buildShellCmd) rrrrrorrmrr~s ` `` @@@rr CommandAction.replaceDynamicTags8s0V(   .   KK *' G^ii8 rH&__X /7  ( 37 .rc[USS5$)N _banEpochr)rrjs rbanEpochCommandAction.banEpochs {A &&rcURbDURRRS-=UlURRlgURS-Ulg)zIncrements ban epoch of jail and this action, so already banned tickets would cause a re-ban for all tickets with previous epoch.Nr)rrrrrjs rinvalidateBanEpoch CommandAction.invalidateBanEpochsM ZZ26**2D2D2M2MPQ2QQ4>DJJ&&/MMA%4>rc\U(dUbXR;agURSU5nU(a URX@R5(agU(a U"5(dgURR S5 UR 5 URSU5nU(a[URXPR5(d+SURU'URRS5 gSURU'O9URU5 URX=(d UR(+S9 URRU5(a<URX@R5(dURRS5 gg![a Nf=f) z>Executes a substituted `actioncheck` command. rz zrzUnable to restore environmentr,) rrrrrerrorrcriticalrGrrrr)r-rrUr)checkCmd repairCmds rrTCommandAction._invariantChecksP *v^^/K    8( T__X||<< ,.. ,,AC  !16:) //)\\ 2 2DNN6LL9: 4>>& JJv;;v"GD4G4G0G;H ^^,,(O(O<<89   s F F+*F+c^^TS:XaTRRS5 gUSnSnU(a2TR(a!UU4SjnTR X5TS:gS9nUS :wag TR TTRU(aS U-OSTRS 9nUbTRXr5nOTnTRUTR5nUS - nU(dUS :aU$M![[4a SnNf=f) aExecutes a command with preliminary checks and substitutions. Before executing any commands, executes the "check" command first in order to check if pre-requirements are met. If this check fails, it tries to restore a sane environment before executing the real command. Parameters ---------- cmd : str The command to execute. aInfo : dictionary Dynamic properties. Returns ------- bool True if the command succeeded. r Nothing to doTrrc>TS:Xa<TRRS5(dTRRS5 gg)Nr8actionrepair_on_unbanz,Invariant check failed. Unban is impossible.FT)rrrr)rr-sr _beforeRepair0CommandAction._processCmd.._beforeRepairs; t'7'7';';44         457$% N                 (>, . . 99" Qc&_. ?  jj>? 8WWrjjABE" GGR ' '&& P=~QQrr)3 __author__ __copyright__ __license__rosrsignal subprocesstempfile threadingrabcrcollections.abcr ImportError collections failregexripdnsrmytimer utilsr helpersr r rrrrrr<rLockr IPv6IsAllowedrrr COND_FAMILIESr  DYN_REPL_TAGSrrupdateobjectr%r|rrrrrrs,(7 P    (+"QQQ 8  NN  %% jj./ " ZZ 9: ==    ]#lDlD^_7_F   r QJr Q{('(sC-- C<;C<