=*faSrSrSrSSKrSSKrSSKrSSKrSSKJr SSK J r SSK J r Jr SS KJr SS KJr SS KJrJrJr SS KJr SS KJr SSKJr SSKJr \"\5r "SS\\5r!g!\ a SSK Jr N_f=f)z Cyril Jaquierz Copyright (c) 2004 Cyril JaquierGPLN)Mapping) OrderedDict) BanManager BanTicket)IPAddr) JailThread) ActionBase CommandAction CallingMap)MyTime) Observers)Utils) getLoggerc \rSrSrSrSr\S5rS"SjrS#Sjr Sr S r S r S r S rS rSrSrSrS$SjrSrS%SjrS&SjrSr"SS\5rSrS'SjrS&SjrS(SjrSrS&SjrS)Sjr S(Sjr!S*S jr"S!r#g)+Actions2aHandles jail actions. This class handles the actions of the jail. Creation, deletion or to actions must be done through this class. This class is based on the Mapping type, and the `add` method must be used to add new actions. This class also starts and stops the actions, and fetches bans from the jail executing these bans via the actions. Parameters ---------- jail: Jail The jail of which the actions belongs to. Attributes ---------- daemon ident name status active : bool Control the state of the thread. idle : bool Control the idle state of the thread. sleeptime : int The time the thread sleeps for in the loop. c[R"USUR-S9 Xl[ 5Ul[ 5UlSUlSUl SUl URS-Ul g)Nzf2b/a.)namer r) r __init__r_jailr_actionsr banManagerbanEpoch _Actions__lastConsistencyCheckTM banPrecedence unbanMaxCount)selfjails 9/usr/lib/python3/dist-packages/fail2ban/server/actions.pyrActions.__init__Ns\ d$))!34*-$-L$/$-"#$$))A-$c[R"U5n[US5(d[SU-5e[ UR [ 5(d'[U<SUR R<S35eU$)NActionz&%s module does not have 'Action' classz module z$ does not implement required methods)rload_python_modulehasattr RuntimeError issubclassr'r __name__) pythonModulemods r#_load_python_moduleActions._load_python_module\sm   .# h   ,|; == cjj* - - 3::&&( )) *r%NcXR;aeU(d[SU-5eURUn[US5(a0[US5(aUR5 X0RU'gUc[ UR U5nO/URU5nUR"UR U40UD6nXPRU'g)aAdds a new action. Add a new action if not already present, defaulting to standard `CommandAction`, or specified Python module. Parameters ---------- name : str The name of the action. pythonModule : str, optional Path to Python file which must contain `Action` class. Default None, which means `CommandAction` is used. initOpts : dict, optional Options for Python Action, used as keyword arguments for initialisation. Default None. Raises ------ ValueError If action name already exists. RuntimeError If external Python module does not have `Action` class or does not implement necessary methods as per `ActionBase` abstract class. zAction %s already existsreloadclearAllParamsN) r ValueErrorr)r3_reload_actionsr rr/r')r!rr-initOptsr2actioncustomActionModules r#add Actions.addis6 ]]  /$6 77 MM$ 6 fhv'(( "*$  $**d +600>  % %djj$ C( C6--r%c^U(a[5Tlg[TS5(aTRR5H?up#UTR;dMTRUR "S0U(aUO0D6 MA [ U4SjTRR555n[U5(a TRSUSS9 TRUS9 [TS5 gg) zMBegin or end of reloading resp. refreshing of all parameters r5c3R># UHupUTR;dMX4v M g7fN)r5).0rr7r!s r# !Actions.reload..s,*=R\T D((()4.=Rs' 'FT)dbactionsstoprBN) dictr5r)itemsrr2rlen_Actions__flushBan stopActionsdelattr)r!beginrr6delactss` r#r2Actions.reloads &4 d%&&..446   mmD  BHbB7*T]]=P=P=R**G 7|| __wT_: g& D#$'r%cZURU$![a [SU-5ef=fNzInvalid Action name: %srKeyErrorr!rs r# __getitem__Actions.__getitem__s64 --  4 +d2 334s*cXURU g![a [SU-5ef=frPrQrSs r# __delitem__Actions.__delitem__s34 }}T 4 +d2 334s )c,[UR5$r=)iterrr!s r#__iter__Actions.__iter__s dmm r%c,[UR5$r=)rHrr[s r#__len__Actions.__len__s T]] r%cgNFrE)r!others r#__eq__Actions.__eq__s r%c[U5$r=)idr[s r#__hash__Actions.__hash__s D/r%c[R"U5nURRU5 [R SU-5 g)Nz banTime: %s)r str2secondsr setBanTimelogSysinfo)r!values r#rlActions.setBanTimes5   U #%//U#++o%&r%c6URR5$r=)r getBanTimer[s r#rrActions.getBanTimes  # # %%r%cURR5nU(dU$[U5S:Xa USU;aS$S$UVs/sH o3U;aSOSPM sn$s snfNrr)r getBanListrH)r!idslstips r# getBannedActions.getBanneds] ""$# :X]1v}!#!#*- .#BSy!a # .. .sAc6URRSUS9$)zhReturns the list of banned IP addresses. Returns ------- list The list of banned IP addresses. T)orderedwithTime)rrv)r!r~s r#rvActions.getBanLists  # #D8 # DDr%c^[R"5m[U[5(a U4SjU5nO [ UT54nUR U5$)zBan an IP or list of IPs.c3<># UHn[UT5v M g7fr=)r)r>ryunixTimes r#r?&Actions.addBannedIP..s 3"iH%%s)rtime isinstancelistr_Actions__checkBan)r!ryticketsrs @r# addBannedIPActions.addBannedIPsE [[](D 3 37H% '7  !!r%cUcURU5$[U[[45(a9/nSnUHnXPR XbU5- nM U(a[ SU-5eU$U(aGURRb0URRRURU5 URRU5nUbURU5 g[U[5(dl[U5nUR(dP[[UR URR#555n U (aUR XU5$SU-n [$R'[(R*U 5 U(ag[ U 5e![ a! U(dUR U5 GMGMf=f)aGRemoves banned IP calling actions' unban method Remove a banned IP now, rather than waiting for it to expire, even if set to never expire. Parameters ---------- ip : list, str, IPAddr or None The IP address (or multiple IPs as list) to unban or all IPs if None Raises ------ ValueError If `ip` is not banned rznot banned: %rz%s is not bannedr)rIrrtupleremoveBannedIPr4appendrdatabasedelBanr getTicketByID_Actions__unBanr isSinglefiltercontainsrvrmlogloggingMSG) r!ryrAifexistsmissedcntiticketipaipsmsgs r#rActions.removeBannedIPsz"Z //" T5M"" 6 3 q  x 00S   %. // :DJJ   +::djj"- ?? ( ( ,& <<  R *C << s||T__%?%?%AB CS  ( 33 b 3 ::gkk3 C9   mmA sF$$"GGc Uc URn[[UR555HNup#UR 5 URU [ RSURRU5 MP g![ aWn[ RSURRX$[ R5[R:*S9 SnANSnAff=f)zLStops the actions in reverse sequence (optionally filtered) Nz(Failed to stop jail '%s' action '%s': %sexc_infoz%s: action %s terminated)rreversedrrGrC ExceptionrmerrorrrgetEffectiveLevelrDEBUGdebug)r!rBrr7es r#rJActions.stopActions/s _ ]]7tGMMO45ld9 KKM  }}T <<*DJJOOTB6 9 LL; ZZ__d&&('--799sB C&A C!!C&c ^SnTRR5Hup#UR5 M TR(GaTR(aS[RS5 [R"U4SjSTR 5 [RS5 MwSn[#TR TR$R&[(R*"5- 5n[R-S S UTR 5 [R"U4S jU5(aTR/5nX- nU(aUTR0:aTR(aUS -n[R-S S U(aUTR2:aUO TR2UTR25 TR5U(aUTR2:aUO TR25 SnTR(aGMTR7SS9 TR95 g![aYn[R STR RX$[R5[R:*S9 SnAGMdSnAff=f![aWn[R STR RU[R5[R:*S9 SnANSnAff=f)zMain loop for Threading. This function is the main loop of the thread. It checks the jail queue and executes commands when an IP address is banned. Returns ------- bool True when the thread exits nicely. rz)Failed to start jail '%s' action '%s': %srNzActions: enter idle modecV>TR(+=(d TR(+$r=)activeidler[sr#Actions.run..Vs O<499}TR(+=(d TRR$r=)rrhasFailTicketsr[sr#rr^s$++oJ1J1JJr%rz+Actions: check-unban %s, bancnt %s, max: %sz*[%s] unhandled error in actions thread: %sT)rC)rrGstartrrmrrrrrrrrrrwait_for sleeptimeminr_nextUnbanTimerrrrrr _Actions__checkUnBanrIrJ)r!rrr7rbancntwts` r#run Actions.run?s> #mm))+ld9 LLN, 9 yy \\,- ^^<T^^% \\,- F T^^T__;;fkkmK LB JJqEr4>>Z ~~JBOOooV]S SD...  kf jjAVX^aeasasXs6y}zLzLNTVZVhVhi &Vd6H6H-HdN`N`a S- 8//t/ E 9 LL< ZZ__d&&('--79996 9 LL= ZZ__a&&('--799s9H$ A"J /EJ $ J.A JJ K+A K&&K+c\rSrSrSr0SS_SS_SS_S S _S S _S S_SS_SS_SS_SS_SS_SS2Sj_SS_SS_S S!_S"S#_S$S%_S&S'S(S)S*.Er\RS+-rSS,\4S-jrS.r S/r S3S0jr S1r g)4Actions.ActionInfoir)fid raw-ticketryc6URR5$r=)_ActionInfo__ticketgetIPr[s r#rActions.ActionInfo.w,,.r%familyc USR$Nry) familyStrr[s r#rrxsDJ00r%zip-revc*USRS5$)Nry)getPTRr[s r#rrys4:,,R0r%zip-hostc(USR5$r)getHostr[s r#rrzs4:--/r%rc6URR5$r=)rgetIDr[s r#rr{rr%failuresc6URR5$r=)r getAttemptr[s r#rr|sDMM446r%rc6URR5$r=)rgetTimer[s r#rr}s$--//1r%bantimec"UR5$r=) _getBanTimer[s r#rr~s D,,.r%bancountc6URR5$r=)r getBanCountr[s r#rrsT]]668r%matchescTSRURR55$N )joinr getMatchesr[s r#rrs499T]]%=%=%?@r%restoredc@URR(aS$S$ru)rrr[s r#rrs$--"8"8Q?a?r%zF-*Nc8URRU5$r=)rgetData)r!tags r#rrs4==#8#8#=r% ipmatchesc^SRURS5R55$)NrTr_mi4iprr[s r#rrstyyT):)E)E)GHr% ipjailmatchesc\SRUR5R55$rrr[s r#rrs4;;=+C+C+E!Fr% ipfailuresc@URS5R5$NTrrr[s r#rrs D 1 < < >r%ipjailfailuresc>UR5R5$r=rr[s r#rrs$++-":":"9r%cURURURURURR 55$r=) __class__rrrrcopyr[s r#r Actions.ActionInfo.copys. .. T^^TYY^^EU VVr%cURR5nUc$URRR5n[ U5$r=)rrrrrBint)r!btimes r#rActions.ActionInfo._getBanTimes: == # # %5 mT[[00;;=U e*r%c X[US5(d0UlURnU(aSOSnX2;aX#bX#$UR$URnUSnSX#'UR(d UR$U(aURR US9X#'OURR XTS9X#'X#bX#$UR$![ aNn[RSUWRU[R5[R:*S 9 SnANhSnAff=f) aGets bans merged once, a helper for lambda(s), prevents stop of executing action by any exception inside. This function never returns None for ainfo lambdas - always a ticket (merged or single one) and prevents any errors through merging (to guarantee ban actions will be executed). [TODO] move merging to observer - here we could wait for merge and read already merged info from a database Parameters ---------- overalljails : bool switch to get a merged bans : False - (default) bans merged for current jail only True - bans merged for all jails of current ip address Returns ------- BanTicket merged or self ticket only rallr"Nry)ry)ryr"z+Failed to get %s bans merged, jail '%s': %sr) r)_ActionInfo__mi4iprrr getBansMergedrrmrrrrr)r! overalljailsmiidxr"ryrs r#rActions.ActionInfo._mi4ips & $ " "DL 2F3 ig)27% &<' *3+ .KQJR5 ':""%FF)"&$WW (>c  ^SnU(dURUR5nSnUGHn[R"U5mUR UR R 55nTR 5nURT5n0nUR RTUS9(Ga<US- n[Rb=TR(d,[RRSTURU5 [RSURR TR(dSOSU5 UR"R%5H]upTR(a['U S S 5(aM+UR((dUR+5 U R-U5 M_ S TlUR:(aUR:TlGMGMUR=SS5(a.[R?SURR U5 GMUR=ST5mTR8(GaURA5TRA5- n U S:a[4R6O%U S:a[4RBO[4RDn [RGU SURR U5 TR:UR::XaU S:aU(d[HRJ"5URLS-:a^[HRJ"5Ul&UR"RO5H&n [QU S5(dMU RS5 M( TR:UR::aIU(d-[UU4SjUR"R%555nX RWTUS9- nGMGMX RWT5- nGM U(a][RYSUUR R[5UR R]5URR 5 U$![.aZn [R1S URR XU [R35[4R6:*S 9 Sn A GMpSn A ff=f)zCheck for IP address to ban. If tickets are not specified look in the jail queue for FailTicket. If a ticket is available, it executes the "ban" command and adds a ticket to the BanManager. Returns ------- bool True if an IP address get banned. rN)reasonrbanFoundz [%s] %sBan %srzRestore norestoredF9Failed to execute ban jail '%s' action '%s' info '%r': %srTexpiredz[%s] Ignore %s, expired bantimer<z[%s] %s already bannedconsistencyCheckc3f># UH&upURTR:dM!X4v M( g7fr=)r)r>rr7bTickets r#r?%Actions.__checkBan..'s0)/*?,$ ??W-- -~*?s 1 1rDz"Banned %s / %s, %s ticket(s) in %r)/_Actions__getFailTicketsrrwraprrrrr% addBanTicketrMainrr9rrmnoticerrrGgetattrrresetbanrrrrrbannedrgetrnrNOTICEWARNINGrrrrvaluesr)r4rF_Actions__reBanrrr)r!rr rebanactsrrryr$r-rr7rdiftmllr6s @r# __checkBanActions.__checkBans~ #   " "4#5#5 67)f ^^F #7   T__779 :5 2   w '5 6 oo""76":1HC~~!'*:*:^^ GTZZ? MM/4::??w?O?ORU_bde ++-  ;   gflEBB __ekkm jj .GN }} Wzz)Q [[2DJJOORH jj7+G~~~ ^^  1 1U #QY'--"RZ'.. // ZZ,djjoorBDMM)eai 6;;=4+H+H1+LL'-{{}t$]]))+6 6- . .  ", 4==( D)/*.--*=*=*?)/%/  \\'9\ 55c )  LL !!S}B  <<4cOO!4??#7#7#94::??L *a ; ll zzQ((*GMM9 ;;;s"#Q-2Q-- S7AS  Sc >U=(d URnUR5nURU5nU(aZ[R SUR R U[U5S:XaS[UR55S-OS5 UR5Hcupg[RSUR R Xd5 UR(dUR5 URU5 Me S UlUR*(aUR*Ulg![aYn[R!SUR R XeU[R#5[$R&:*S9 S nA gS nAff=f) zRepeat bans for the ticket. Executes the actions in order to reban the host given in the ticket. Parameters ---------- ticket : Ticket Ticket to reban z[%s] Reban %s%srz , action %rrrz[%s] action %r: reban %sz;Failed to execute reban jail '%s' action '%s' info '%r': %srNT)rrr%rmr<rrrHrkeysrGrrr>rebanrrrrrr@r) r!rrBrryr$rr7rs r#__reBanActions.__reBan4s0  $t}}' ||~"   f %% =="DJJOORehipequvev-$w||~J^_`Ja:a|~Ammold   LL+TZZ__dG ??EKKM LL &&- ]]]]6?    LL ZZ__d1&&('--7 9  s.AD99 FAFFc ZURRU5(dgSnURR5Hup4UR(a[ USS5(aM+UR (dM>UcURU5nUR(dUR5 URU5 M g![aYn[RSURRX2U[R!5["R$:*S9 SnAMSnAff=f)Nr/Fr0r)r _inBanListrrGrr= _prolongabler%rr>prolongrrmrrrrrr)r!rr$rr7rs r# _prolongBanActions._prolongBanVs  # #F + +V %mm))+ld9 76<??     }   (U ??EKKM NN5, 9 LL ZZ__d1&&('--7 99s&#C)CT(a([TSS5(d[RS5 gg)Nactionrepair_on_unbanz,Invariant check failed. Flush is impossible.FT)r=rmr)r7rCsr# _beforeRepair)Actions.__flushBan.._beforeRepairs( gf&=tDD ||BC r%z! Unban tickets each individuallyz Flush jail in database)rBrrz! Unbanned %s, %s ticket(s) in %r)rmrr flushBanListrZrrGr)rr actionflushr<rrr\rrrrrrnr4rrrr) r!rArBrCrrxr unbactionsrrr_rr7s ` @r# __flushBanActions.__flushBan{s # _ <<"#  % % '3 3 doo 3 #*")"5w4==OOQldFvwFM)J)JfN`N` ]]14::??DI  <<34:+R, 'DJJ   + <<*+::djj)f<<S<1!83 ,,2 1 *9   LLD ZZ__d&&('--79 KK9:v)**  ]+ + s9A7G I= B I88I=c Uc URnOUnUR5nURU5nU(a+[R SUR R U5 UR5Hcupx[RSUR R Xu5 UR(dUR5 URU5 Me g![aYn [RSUR R XvU [R5[R :*S9 Sn A MSn A ff=f)zUnbans host corresponding to the ticket. Executes the actions in order to unban the host given in the ticket. Parameters ---------- ticket : FailTicket Ticket of failures of which to unban Nz [%s] Unban %sz[%s] action %r: unban %sz;Failed to execute unban jail '%s' action '%s' info '%r': %sr)rrr%rmr<rrrGrrr>unbanrrrrr) r!rrBrrcryr$rr7rs r#__unBanActions.__unBans _ :: ||~"   f %% ==$**//26 &&(ld 9 LL+TZZ__dG ??EKKM LL ) 9 LL ZZ__d1&&('--7 99s>QWYjkl w ??   !4??#>#>#@ AA w OO & & (6 V3    3 c "t2245 7# w f % &&3 w;;=:==jIJT__EEjQR==jIJLL3 *r%)__lastConsistencyCheckTMrrr5rrrr )NNF)Tr)NTFr=)dr)FNF)rl)$r,rrr__doc__r staticmethodr/r9r2rTrWr\r_rdrhrlrrrzrvrrrJrr r"r%r8rrErTrrIrrxr!rEr%r#rr2s6 .    ,\%*4 4 '&/E "7 t C 1fZ<*Z r%r)" __author__ __copyright__ __license__rossysrcollections.abcr ImportError collectionsr banmanagerrripdnsr jailthreadr r7r r r mytimerobserverrutilsrhelpersrr,rmrrEr%r#rsz. 2   !$$-"99 8 w  j'w  #! !sA// A>=A>