
    =*fq                       S r SrSrSSKrSSKrSSKrSSKrSSKrSSKrSSK	r	SSK
JrJrJr  SSKJr  SSKJr  SS	KJrJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSK J!r!J"r"J#r#  SSK$J%r%J&r&J'r'  SSK(J)r)   SSKJ*r*  \RX                  R[                  \RX                  R]                  \/5      S5      r0Sr1\%" S5      r2 " S S\5      r3 " S S\!5      r4 " S S\45      r5 " S S\45      r6 " S S \Rn                  5      r8 " S! S"\Rn                  5      r9 " S# S$\5      r: " S% S&\!5      r;SS'K<J=r=J>r>J?r?   " S( S)\!5      r@g! \+ a    Sr* Nf = f)*zCyril Jaquierz Copyright (c) 2004 Cyril JaquierGPL    N   )Regex	FailRegexRegexException)actions)Server)DNSUtilsIPAddr)Jail)
JailThread)	BanTicket)Utils   )	DummyJail)LogCaptureTestCasewith_alt_timeMyTime)	getLoggerextractOptions
PREFER_ENC)version)filtersystemdfilespollingfail2banc                        \ rS rSrS rS rSrg)
TestServer;   c                     g N selfargskwargss      ?/usr/lib/python3/dist-packages/fail2ban/tests/servertestcase.pysetLogLevelTestServer.setLogLevel<           c                     g r!   r"   r#   s      r'   setLogTargetTestServer.setLogTarget?   r*   r+   r"   N)__name__
__module____qualname____firstlineno__r(   r-   __static_attributes__r"   r+   r'   r   r   ;   s    r+   r   c                   X   ^  \ rS rSr\rU 4S jrU 4S jrS
S jrSS jr	S r
S rS	rU =r$ )TransmitterBaseC   c                    > [         [        U ]  5         U R                  5       U l        U R                  R
                  U l        SU l        U R                  R                  U R                  [        5        g)Call before every test case.	TestJail1N)
superr5   setUpTEST_SRV_CLASSserver_Server__transmtransmjailNameaddJailFAST_BACKENDr$   	__class__s    r'   r;   TransmitterBase.setUpG   sR    $&##%$+++$+ $-++dmm\2r+   c                 ^   > U R                   R                  5         [        [        U ]  5         gzCall after every test case.N)r=   quitr:   r5   tearDownrC   s    r'   rI   TransmitterBase.tearDownQ   s"     ++')r+   r!   c                 r  ^ SX/nSU/nUb$  UR                  SU5        UR                  SU5        US:X  a  UnU4S jn	U R                  U	" U R                  R                  U5      5      U	" XC45      5        U(       d:  U R                  U	" U R                  R                  U5      5      U	" SU45      5        gg)zmProcess set/get commands and compare both return values 
with outValue if it was given otherwise with inValuesetgetNr   r!   c                 ,   > T(       a  [        U 5      $ U $ )zPrepare value for comparison)repr)xrepr_s    r'   v%TransmitterBase.setGetTest.<locals>.vd   s    47##r+   r   )insertassertEqualr?   proceed)
r$   cmdinValueoutValueoutCodejailrQ   setCmdgetCmdrR   s
         `   r'   
setGetTestTransmitterBase.setGetTestW   s     3 &3<&		==D	==D 8$ 1T[[((011g5H3IJ	Adkk))&12Aq(m4DE 
r+   c                 T   SX/nSU/nUb$  UR                  SU5        UR                  SU5        U R                  R                  U5      S   nU R                  U R                  R                  U5      S   S5        U R                  U R                  R                  U5      SU45        g )NrL   rM   r   r   )rT   r?   rV   rU   )r$   rW   rX   r[   r\   r]   	initValues          r'   setGetTestNOKTransmitterBase.setGetTestNOKm   s    3 &3<&		==D	==D kk!!&)!,)4;;&&v.q1154;;&&v.I?r+   c                 &   SU-   nSU-   nU R                  U R                  R                  SX1/5      S/ 45        [        U5       H  u  pgU R                  R                  SX4U/5      nU R	                  US   [        [        [        US   5      5      4S[        [        [        US US-    5      5      4SS9  U R                  R                  SX1/5      nU R	                  US   [        [        [        US   5      5      4S[        [        [        US US-    5      5      4SS9  M     [        U5       H  u  pgU R                  R                  SX5U/5      nU R	                  US   [        [        [        US   5      5      4S[        [        [        X&S-   S  5      5      4SS9  U R                  R                  SX1/5      nU R	                  US   [        [        [        US   5      5      4S[        [        [        X&S-   S  5      5      4SS9  M     g )	NadddelrM   r   rL   r   r   )level)rU   r?   rV   	enumerateassertSortedEquallistmapstr)	r$   rW   valuesr[   cmdAddcmdDelnvaluerets	            r'   jailAddDelTestTransmitterBase.jailAddDelTestz   s   3;&3;&;;t)*QG5F#ha			eT59	:33q64CQ(8#9:QSfUYVWXYVYlE[@\<]efg			eT/	033q64CQ(8#9:QSfUYVWXYVYlE[@\<]efg	 $
 F#ha			eT59	:33q64CQ(8#9:QSfWXUXUYlE[@\<]efg			eT/	033q64CQ(8#9:QSfWXUXUYlE[@\<]efg	 $r+   c           	      n   SU-   nSU-   nU R                  U R                  R                  SXA/5      S/ 45        [        U5       Hp  u  pxU R                  U R                  R                  SXEU/5      SUS US-    45        U R                  U R                  R                  SXA/5      SUS US-    45        Mr     [        U5       Hn  u  pxU R                  U R                  R                  SXFS/5      SX7S-   S  45        U R                  U R                  R                  SXA/5      SX7S-   S  45        Mp     g )Nre   rf   rM   r   rL   r   )rU   r?   rV   rh   )	r$   rW   inValues	outValuesr[   rn   ro   rp   rq   s	            r'   jailAddDelRegexTest#TransmitterBase.jailAddDelRegexTest   sC   3;&3;&;;t)*QG5H%haKKe45	$1Q3 KK*+	$1Q3	 & H%haKKa01	A#$ KK*+	A#$	 &r+   )r@   r=   r?   )r!   r   NF)r/   r0   r1   r2   r   r<   r;   rI   r^   rb   rs   rx   r3   __classcell__rD   s   @r'   r5   r5   C   s.    3*F,@h" r+   r5   c                   P   \ rS rSrS rS rS rS rS rS r	S r
S	 rS
 rS rS rS rS rS rS rS rS rS r\S 5       rS rS rS rS rS rS rS rS rS r S r!S r"S  r#S! r$S"S#S$S%/ 4/4S&S'S(S)/ 4/4/r%S* r&S+ r'S, r(S- r)S. r*S/ r+S0 r,S1 r-S2 r.S3 r/S4 r0S5 r1S6 r2S7r3g8)9Transmitter   c                 V    U R                  U R                  R                  5       5        g r!   )assertFalser=   	isStartedr$   s    r'   testServerIsNotStarted"Transmitter.testServerIsNotStarted   s     4;;((*+r+   c                 \    U R                  U R                  R                  S/5      S5        g )Nstopr   NrU   r?   rV   r   s    r'   testStopServerTransmitter.testStopServer   s#    4;;&&x0)<r+   c                 \    U R                  U R                  R                  S/5      S5        g )Nping)r   pongr   r   s    r'   testPingTransmitter.testPing   s#    4;;&&x0+>r+   c                 |    U R                  U R                  R                  S/5      S[        R                  45        g )Nr   r   )rU   r?   rV   r   r   s    r'   testVersionTransmitter.testVersion   s,    4;;&&	{3a5IJr+   c                     U R                  U R                  R                  / SQ5      S5        U R                  [        R
                  " 5       5        U R                  S5        U R                  5         U R                  U R                  R                  / SQ5      S5        U R                  [        R
                  " 5       5        U R                  S5        U R                  5         U R                  U R                  R                  / SQ5      S5        U R                  S	5        U R                  5         g ! U R                  U R                  R                  / SQ5      S5        U R                  S	5        U R                  5         f = f)
N)rL   	allowipv6yes)r   r   z
IPv6 is on)rL   r   nor   r   zIPv6 is off)rL   r   auto)r   r   zIPv6 is auto)	rU   r?   rV   
assertTruer
   IPv6IsAllowedassertLoggedpruneLogr   r   s    r'   testSetIPv6Transmitter.testSetIPv6   s   
6DKK''(CDjQ??8))+,\"DMMODKK''(BCYOH**,-]#T]]_ DKK''(DE{S^$dmmo DKK''(DE{S^$dmmos   C$D5 5AFc                    [         R                  R                  (       d  [        R                  " 5       nU R	                  U R
                  R                  SS/5      S5        [        R                  " 5       nX!-
  nU R                  SUs=:  =(       a    S:  Os  SU-  S9  g U R	                  U R
                  R                  SS/5      S5        g )	Nsleepz0.1r   g
ףp=
?g?zSleep was %g sec)msgz0.0001)unittestF2BfasttimerU   r?   rV   r   )r$   t0t1dts       r'   	testSleepTransmitter.testSleep   s    					2DKK''%(899E		2
2??4"??s?(:R(??@DKK''((;<iHr+   c                    [         R                  R                  (       d  [        R                  " SS5      u  pOSnU R                  SU5        U R                  R                  U R                  5        U R                  SU5        U R                  SU5        U R                  SSS5        U R                  SS5        U R                  S	S
S5        U R                  S	S5        U R                  R                  U R                  [        5        U R                  SU5        U R                  R                  U R                  5        U R                  U R                  R                  / SQ5      S5        U R                  U R                  R                  SS/5      S5        U R                  U R                  R                  / SQ5      S5        U R                  U R                  R                  SS/5      S5        U R                  U R                  R                  / SQ5      S5        U R                  U R                  R                  SS	/5      S5        U R                  R                  U R                  [        5        U R                  U R                  R                  / SQ5      S5        [         R                  R                  (       d-  [        R                   " W5        [        R"                  " U5        g g )Nz.db	fail2ban_z:memory:dbfiledbmaxmatches100d   LIZARD
dbpurgeage600X  )rL   r   Noner   rM   )rL   r   r   )rL   r   500)r   r   	memory_dbtempfilemkstemprb   r=   delJailr@   r^   rA   rB   rU   r?   rV   oscloseunlink)r$   tmptmpFilenames      r'   testDatabaseTransmitter.testDatabase   sL   			&&uk:3;X{+++dmm$//(K(//(K(//.%-^X.//,s+\8,++dmm\2//(K(++dmm$ 4;;&& 4;;&&	8 4;;&&!# 4;;&&	> 4;;&&! 4;;&&	< ++dmm\24;;&& 
		88C=99[ 
 r+   c                 f   SnSnSnU R                  U R                  R                  SUS/5      SU45        U R                  U R                  R                  SU/5      SU45        U R                  U R                  R                  SUS/5      S   S5        U R                  U R                  R                  SUS	/5      SU45        U R                  U R                  R                  SU R                  S/5      S   S5        U R                  U R                  R                  / S
Q5      S   S5        g )N	TestJail2	TestJail3	TestJail4re   r   r   zinvalid backendr   r   )re   --allr   rU   r?   rV   r@   )r$   jail2jail3jail4s       r'   testAddJailTransmitter.testAddJail   s!   
%
%
%;;ui01Au:?4;;&&u~6E
C;;u&789!<aA;;uf-.E
< ;;t}}i89!<aA ;;23A6;r+   c                   ^  T R                  T R                  R                  ST R                  /5      S5        [        R
                  " [        R                  5        T R                  [        R                  " U 4S jS5      5        T R                  T R                  R                  ST R                  /5      S5        T R                  T R                  T R                  R                  5        g )Nstartr   c                     > T R                   R                  S5      =(       a:    [        T R                  R	                  ST R
                  /5      [        5      (       + $ )Nr   statusr=   isAlive
isinstancer?   rV   r@   RuntimeErrorr   s   r'   <lambda>/Transmitter.testStartStopJail.<locals>.<lambda>  B    4;;q!r*T[[5H5H(TXTaTaIb5ceq*r&rrr+      r   )rU   r?   rV   r@   r   r   r   DEFAULT_SLEEP_TIMEr   wait_forassertNotInr=   _Server__jailsr   s   `r'   testStartStopJailTransmitter.testStartStopJail  s    ;;/0)=**U%%&//5>>r  ;;./<4==$++"<"<=r+   c                   ^  T R                   R                  S[        5        T R                  T R                  R                  ST R                  /5      S5        T R                  T R                  R                  SS/5      S5        [        R                  " [        R                  5        T R                  [        R                  " U 4S jS5      5        T R                  T R                  R                  SS/5      S5        T R                  [        R                  " U 4S jS5      5        T R                  T R                  T R                   R                  5        T R                  ST R                   R                  5        g )	Nr   r   r   c                     > T R                   R                  S5      =(       a:    [        T R                  R	                  ST R
                  /5      [        5      (       + $ )Nr   r   r   r   s   r'   r   2Transmitter.testStartStopAllJail.<locals>.<lambda>"  r   r+   r   r   r   c                  L   > [        T R                  R                  5      (       + $ r!   )lenr=   r   r   s   r'   r   r   %  s    s4;;3M3M/N+Nr+   )r=   rA   rB   rU   r?   rV   r@   r   r   r   r   r   r   r   r   r   s   `r'   testStartStopAllJail Transmitter.testStartStopAllJail  s   ++k<0;;/0)=;;-.	;
 **U%%&//5>>r  4;;&&'899E//5>>#NPQRT4==$++"<"<=; : :;r+   c                 `   U R                  U R                  R                  SU R                  SS/5      S5        U R                  U R                  R                  SU R                  SS/5      S5        U R                  U R                  R                  SU R                  SS/5      S   S	5        g )
NrL   idleonr   Toffr   FCATr   r   r   r   s    r'   testJailIdleTransmitter.testJailIdle)  s    ;;t}}fd;< ;;t}}fe<= ;;t}}fe<=a@r+   c                    U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SS	S
U R                  S9  U R                  SSU R                  S9  g )Nfindtime120x   r[   60<   30m  z-60iDogr^   r@   rb   r   s    r'   testJailFindTimeTransmitter.testJailFindTime4  s{    //*eSt}}/=//*dBT]]/;//*eU/?//*eSt}}/=ZT]];r+   c                    U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SS	S
U R                  S9  U R                  SSU R                  S9  g )Nbantimer   r   r   502   z-50iz
15d 5h 30mi Catr   r   s    r'   testJailBanTimeTransmitter.testJailBanTime;  s{    //)UCdmm/<//)T2DMM/://)UCdmm/<//)\7/GYDMM:r+   c                    U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SS	S
U R                  S9  U R                  SSU R                  S9  g )Ndatepattern%%%Y%m%d%H%M%S)r  z%YearMonthDay24hourMinuteSecondr   Epoch)Nr  z^Epoch)Nz{^LN-BEG}EpochTAI64N)Nr  z
%Cat%a%%%gr   r   s    r'   testDatePatternTransmitter.testDatePatternB  s    //-!18   //'?  @//(44==  J//(,4==  B]Lt}}Er+   c                 r    U R                  SSSU R                  S9  U R                  SSU R                  S9  g )NlogtimezonezUTC+0400r   znot-a-time-zoner   r   s    r'   testLogTimeZoneTransmitter.testLogTimeZoneN  s4    //-Zdmm/L]$5DMMJr+   c                    U R                  SSU R                  S9  U R                  SSU R                  S9  U R                  SSU R                  S9  SnU R                  U R                  R	                  SU R                  SU/5      S5        g )	Nusednsr   r   warnr   FishrL   r   )r^   r@   rU   r?   rV   r$   rq   s     r'   testJailUseDNSTransmitter.testJailUseDNSR  s{    //(E/6//(F/7//(Dt}}/5 %;;t}}h>?r+   c                 l   U R                   R                  U R                  5        U R                  U R                  R                  SU R                  SSSS/5      S5        U R                  SSSSS	9  U R                  U R                  R                  SU R                  SS
/5      S5        U R                  SSS9  U R                  U R                  R                  SU R                  SSSSS/5      S5        U R                  SSSSS	9  U R                  SSSSS	9  U R                  5         U R                  U R                  R                  SU R                  SSS/5      S   S5        U R                  U R                  R                  SU R                  SSS/5      S5        U R                  SSSSS	9  g )NrL   banip	192.0.2.1	192.0.2.2)r   r   Ban 192.0.2.1Ban 192.0.2.2TallwaitBadgerr   r   z
Ban Badgerr  unbanipz192.0.2.255z192.0.2.254zUnban 192.0.2.1zUnban 192.0.2.2z192.0.2.255 is not bannedz192.0.2.254 is not bannedz--report-absentr   r   r   r   )r=   	startJailr@   rU   r?   rV   r   r   r   s    r'   testJailBanIPTransmitter.testJailBanIP]  s   ++&;;t}}g{KQ\]^	 O_$TJ;;t}}gx@A	 Lt,;;
DMM9m[+}]_	 %'8dN/1LRV]ab--/;;
DMM9&7GIIJLLMO ;;
DMM9m]CEEKM /1LRV]abr+   c           
        ^  T R                   R                  T R                  5        U 4S jnT R                  SSST R                  S9  S H)  nS H   nT R	                  U" USU-  /5      S	5        M"     M+     T R                  S
SSSS9  T R	                  U" WS Vs/ s H  nSU-  PM
     sn5      S	5        T R                  SSS9  T R                  SSS9  T R                  S5        g s  snf )Nc                 \   > TR                   R                  STR                  SU /U-   5      $ )NrL   attempt)r?   rV   r@   )ipmatchesr$   s     r'   r(  .Transmitter.testJailAttemptIP.<locals>.attempt}  s*    
++

udmmYCgM
NNr+   maxretry5   r   )r   r   )r  r  ztest failure %dr  z192.0.2.1:2z192.0.2.2:2Tr  )r      r.  z192.0.2.2:5r   r  r  )r=   r#  r@   r^   rU   r   assertNotLogged)r$   r(  ir)  s   `   r'   testJailAttemptIPTransmitter.testJailAttemptIPz  s    ++&O //*c14==/9a'rWR"3a"7!896B (  M=dF72wGw! 1A 5wGH&QM-O$/'	  Hs   C)c                   ^  SnT R                   R                  U[        5        T R                   R                  U5        S S S/ 4U 4S jjnU" U/ S9  U" USSS/S9  U" US	SSS
/S9  U" US/ SQS9  U" USS	S/S9  U" USS	/S9  U" US	/ S9  g )NTestJailBanListr"   c                   > UbB  TR                  TR                  R                  SU SU/5      S5        TR                  SU-  SS9  UbB  TR                  TR                  R                  SU SU/5      S5        TR                  SU-  SS9  TR	                  TR                  R                  S	U S/[        U5      -   5      S
U4SS9  [        R                  " [        R                  " 5       S-   5        g )NrL   r  r  zBan %sTr   r!  zUnban %srM   r   F)
nestedOnlyr   )	rU   r?   rV   r   ri   rj   r   setTimer   )r[   r  r!  r%   outListr$   s        r'   _getBanListTest4Transmitter.testJailBanList.<locals>._getBanListTest  s    	[[%w67 	h&T2	[[%y':; 	j7*6KKg.tDz9:LU  $ 
>>&++-!#$r+   )r9  	127.0.0.1)z--with-timez:127.0.0.1 	2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01)r  r%   r9  192.168.0.1z<192.168.0.1 	2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02192.168.1.10)r<  r=  r>  )r  r9  )r!  r9  )r=   rA   rB   r#  )r$   r[   r:  s   `  r'   testJailBanListTransmitter.testJailBanList  s    	$++dL)++ #'2r %& $$k0@IJL$m2BACEF $n79$>*,$?$r+   c                     U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SS	U R                  S9  g )
N
maxmatchesr-  r.  r   2r   -2Duckr   r   s    r'   testJailMaxMatchesTransmitter.testJailMaxMatches  sc    //,QT]]/;//,QT]]/;//,bt}}/=\6>r+   c                     U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SS	U R                  S9  g )
Nr,  r-  r.  r   rC  r   rD  rE  rF  r   r   s    r'   testJailMaxRetryTransmitter.testJailMaxRetry  sc    //*c14==/9//*c14==/9//*dBT]]/;Zdmm<r+   c                     U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SSU R                  S9  U R                  SSU R                  S9  g )	Nmaxlinesr-  r.  r   rC  r   rD  rF  r   r   s    r'   testJailMaxLinesTransmitter.testJailMaxLines  sd    //*c14==/9//*c14==/9ZDMM:Zdmm<r+   c                     U R                  SSU R                  S9  U R                  SSU R                  S9  U R                  SS[        U R                  S9  U R                  SSU R                  S9  g )NlogencodingzUTF-8r   asciir   Monkey)r^   r@   r   rb   r   s    r'   testJailLogEncodingTransmitter.testJailLogEncoding  se    //-t}}/=//-t}}/=//-  ]H4==Ar+   c           
         U R                  S[        R                  R                  [        S5      [        R                  R                  [        S5      [        R                  R                  [        S5      /U R
                  5        [        R                  R                  [        S5      nU R                  U R                  R                  SU R
                  SU/5      SU/45        U R                  U R                  R                  SU R
                  SU/5      SU/45        U R                  U R                  R                  S	U R
                  S/5      SU/45        U R                  U R                  R                  SU R
                  S
U/5      S/ 45        U R                  U R                  R                  SU R
                  SUS/5      SU/45        U R                  U R                  R                  SU R
                  SUS/5      SU/45        U R                  U R                  R                  SU R
                  SUS/5      S   S5        U R                  U R                  R                  SU R
                  SXU/5      S   S5        g )Nlogpathtestcase01.logztestcase02.logztestcase03.logztestcase04.logrL   
addlogpathr   rM   
dellogpathtailheadbadgerr   )	rs   r   pathjoinTEST_FILES_DIRr@   rU   r?   rV   r  s     r'   testJailLogPathTransmitter.testJailLogPath  sD   GGLL!12GGLL!12GGLL!12
 == '',,~'7
8%;;t}}lEBCw< ;;t}}lEBCw< ;;t}}i89w< ;;t}}lEBCr7 ;;
DMM<79w< ;;
DMM<79w< ;;
DMM<9;;<> ;;
DMM<u=??@Br+   c                     SnU R                   R                  SU R                  SU/5      nU R                  [	        US   [
        5      5        g )Nzthis_file_shouldn't_existrL   rY  r   )r?   rV   r@   r   r   IOError)r$   rq   results      r'   testJailLogPathInvalidFile&Transmitter.testJailLogPathInvalidFile  sB    
%%;;	4==,.0&//*VAY01r+   c                 $   [         R                  " SS9nUS-   n[        R                  " X5        U R                  R                  SU R                  SU/5      nU R                  [        US   [        5      5        [        R                  " U5        g )Ntmp_fail2ban_broken_symlink)prefixz.slinkrL   rY  r   )r   mktempr   symlinkr?   rV   r@   r   r   rd  r   )r$   namesnamere  s       r'   testJailLogPathBrokenSymlink(Transmitter.testJailLogPathBrokenSymlink  sm    	 =	>$
/%**T;;	4==,.0&//*VAY01))Er+   c                 t   U R                  S/ SQU R                  5        SnU R                  U R                  R	                  SU R                  SU/5      SU/45        U R                  U R                  R	                  SU R                  SU/5      SU/45        U R                  U R                  R	                  SU R                  S/5      SU/45        U R                  U R                  R	                  SU R                  SU/5      S/ 45        U R                  U R                  R	                  SU R                  S	/5      S
5        U R                  U R                  R	                  SU R                  S	S/5      S5        U R                  U R                  R	                  SU R                  S	/5      S5        g )Nignoreip)r<  z192.168.1.1z8.8.8.8r<  rL   addignoreipr   rM   delignoreip
ignoreselfr   Fr   )rs   r@   rU   r?   rV   r  s     r'   testJailIgnoreIPTransmitter.testJailIgnoreIP  s   
 == %;;t}}mUCDw< ;;t}}mUCDw< ;;t}}j9:w< ;;t}}mUCDr7 ;;t}}l;< ;;t}}lEBC ;;t}}l;<r+   c                 :    U R                  SSU R                  S9  g )Nignorecommandzbin/ignore-command <ip>r   r^   r@   r   s    r'   testJailIgnoreCommand!Transmitter.testJailIgnoreCommand2  s    ///#<4==/Qr+   c                 x    U R                  SS/ SQU R                  S9  U R                  SSS U R                  S9  g )Nignorecachez%key="<ip>",max-time=1d,max-count=9999)z<ip>i'  iQ r    rz  r   s    r'   testJailIgnoreCacheTransmitter.testJailIgnoreCache5  s<    //-*   //-T/>r+   c                 :    U R                  SSU R                  S9  g )N	prefregexz^Testr   rz  r   s    r'   testJailPrefRegexTransmitter.testJailPrefRegex<  s    //+wT]]/;r+   c           
         U R                  S/ SQS[        R                  " S5      -  S[        R                  " S5      -  S[        R                  " S5      -  /U R                  5        U R	                  U R
                  R                  SU R                  SS	/5      S
   S5        U R	                  U R
                  R                  SU R                  SS/5      S
   S5        g )N	failregex)zuser john at <HOST>Admin user login from <HOST>z failed attempt from <HOST> againzuser john at %s<HOST>Admin user login from %szfailed attempt from %s againrL   addfailregexzNo host regexr   r   i  rx   r   _resolveHostTagr@   rU   r?   rV   r   s    r'   testJailRegexTransmitter.testJailRegex?  s    ; ..x89%"7"7"AB"e&;&;H&EF
 == ;;
DMM>?;==>@ ;;
DMM>3/1124r+   c           	      h   U R                  S/ SQSS[        R                  " S5      -  S/U R                  5        U R	                  U R
                  R                  SU R                  SS	/5      S
   S5        U R	                  U R
                  R                  SU R                  SS/5      S
   S5        g )Nignoreregex)	user johnr  Dont match me!r  r  r  r  rL   addignoreregexzInvalid [regexr   r   r   r  r   s    r'   testJailIgnoreRegexTransmitter.testJailIgnoreRegexW  s    = %"7"7"AB
 == ;;
DMM+-=>@@AC ;;
DMM+R02235r+   FilterzCurrently failedr   zTotal failedr   	File listActionszCurrently bannedr   zTotal bannedr   Banned IP listc           	         U R                   /nU R                  U R                  R                  S/5      SS[	        U5      4SSR                  U5      4/45        U R                  R                  S[        5        UR                  S5        U R                  U R                  R                  S/5      SS[	        U5      4SSR                  U5      4/45        U R                  U R                  R                  SS/5      SS[	        U5      4SSR                  U5      4U R                  U R                  S./45        U R                  U R                  R                  S	/5      S[        S
S
/[        S
S
/S.45        g )Nr   r   zNumber of jailz	Jail listz, r   r   )r9   r   statsr"  )r@   rU   r?   rV   r   r_  r=   rA   rB   append_JAIL_STATUS)r$   jailss     r'   
testStatusTransmitter.testStatus|  s`   ==/%4;;&&z2	3u:&dii6F(GHIK++k<0,,{4;;&&z2	3u:&dii6F(GHIK4;;&&'':;	3u:&dii6F(G##$2C2CD  4;;&&y1// r+   c                     U R                  U R                  R                  SU R                  /5      SU R                  45        g )Nr   r   rU   r?   rV   r@   r  r   s    r'   testJailStatusTransmitter.testJailStatus  s8    4;;&&$--'@Atr+   c                     U R                  U R                  R                  SU R                  S/5      SU R                  45        g )Nr   basicr   r  r   s    r'   testJailStatusBasicTransmitter.testJailStatusBasic  s:    4;;&&$--'IJtr+   c                     U R                  U R                  R                  SU R                  S/5      SU R                  45        g )Nr   INVALIDr   r  r   s    r'   testJailStatusBasicKwarg$Transmitter.testJailStatusBasicKwarg  s:    4;;&&$--'KLtr+   c                 "   [         R                  R                  5          SS KnSS Kn/ nU R                  U R                  R                  SU R                  S/5      SSSSS/ 4/4S	S
SS/ 4SU4SU4SU4/4/45        g ! [
         a    S/n Ncf = f)Nr   errorr   cymrur  r  r  r  r  r  r  r  zBanned ASN listzBanned Country listzBanned RIR list)
r   r   SkipIfNoNetworkdns.exceptiondns.resolverImportErrorrU   r?   rV   r@   )r$   dnsrq   s      r'   testJailStatusCymruTransmitter.testJailStatusCymru  s    
,,  54;;&&$--'IJB 
 % e$% "  
 95s   A> >BBc                    Sn/ SQn/ SQnU R                  U R                  R                  SU R                  SU/5      SU45        U R                  U R                  R                  SU R                  S/5      S	   S   U5        [	        X#5       HA  u  pEU R                  U R                  R                  SU R                  S
XU/5      SU45        MC     [	        X#5       H@  u  pEU R                  U R                  R                  SU R                  S
X/5      SU45        MB     U R                  U R                  R                  SU R                  S
USS/5      S5        U R                  U R                  R                  SU R                  S
US/5      S5        U R                  U R                  R                  SU R                  S
US/5      S   S	5        U R                  U R                  R                  SU R                  S
USS/5      S5        U R                  U R                  R                  SU R                  S
US/5      S5        U R                  U R                  R                  SU R                  SU/5      S5        U R                  U R                  R                  SU R                  SS/5      S   S	5        g )NTestCaseAction)actionstart
actionstopactioncheck	actionbanactionunban)zAction StartzAction StopzAction Checkz
Action BanzAction UnbanrL   	addactionr   rM   r   r   actionKEYVALUE)r   r  
InvalidKeytimeout10)r   
   	delactionr   zDoesn't exist)rU   r?   rV   r@   zip)r$   r  cmdListcmdValueListrW   rq   s         r'   
testActionTransmitter.testAction  s   &', ;;t}}k6BCv; ;;
DMM9%''(**+-	 .jcKKT]]Hf59;J /
 .jcKKxEFJ / ;;
DMM8VUG<> ;;
DMM8VU35 ;;
DMM8V\:<<=? ;;
DMM8VY=?
 ;;
DMM8VY79
 ;;t}}k6BC ;;
DMM;8::;==>@r+   c                    SnU R                   R                  SU R                  SU[        R                  R                  [        SS5      S/5      nU R                  USU45        U R                  U R                   R                  SU R                  S	U/5      S
   SS/5        U R                  U R                   R                  SU R                  SUS/5      S5        U R                  U R                   R                  SU R                  SUS/5      S5        U R                  U R                   R                  SU R                  SU/5      S
   / SQ5        U R                  U R                   R                  SU R                  SUSS/5      S5        U R                  U R                   R                  SU R                  SUSS/5      S5        U R                  U R                   R                  SU R                  SUSS/5      S5        g )Nr  rL   r  action.dz	action.pyz{"opt1": "value"}r   rM   actionpropertiesr   opt1opt2r  )r   rq   r   actionmethods)banrebanr   r   
testmethodunbanr  z{"text": "world!"})r   zHello world! valueanother value)r   r  )r   zHello world! another value)	r?   rV   r@   r   r^  r_  r`  rU   ri   )r$   r  outs      r'   $testPythonActionMethodsAndProperties0Transmitter.testPythonActionMethodsAndProperties  s    &	4==+vGGLL[9	# 3F$;;t}}  !!"$
F ;;t}}h
  ;;t}}h
  ;;t}}o
 ;= ;;t}}h&( ) ;;t}}h
O  ;;t}}h&( )$&r+   c                 d    U R                  U R                  R                  SS/5      S   S5        g )Nr  COMMANDr   r   r   r   s    r'   testNOKTransmitter.testNOK  s+    4;;&&	9'=>qA!Dr+   c                 d    U R                  U R                  R                  / SQ5      S   S5        g )N)rL   r  r  r   r   r   r   s    r'   
testSetNOKTransmitter.testSetNOK  *    ;;45a8<r+   c                 d    U R                  U R                  R                  / SQ5      S   S5        g )N)rM   r  r  r   r   r   r   s    r'   
testGetNOKTransmitter.testGetNOK"  r  r+   c                 d    U R                  U R                  R                  / SQ5      S   S5        g )N)r   r  r  r   r   r   r   s    r'   testStatusNOKTransmitter.testStatusNOK&  s*    ;;78;A?r+   c           	      
   [         (       d  [        R                  " S5      eSnU R                  R	                  US5        / SQn[        U5       HM  u  p4U R                  U R                  R                  SUSU/5      SUS US-     Vs/ s H  oU/PM     sn45        MO     [        U5       HL  u  p4U R                  U R                  R                  SUS	U/5      SX#S-   S   Vs/ s H  oU/PM     sn45        MN     S
nU R                  U R                  R                  SUSU/5      SU//45        U R                  U R                  R                  SUSU/5      SU/U//45        U R                  U R                  R                  SUS	U/5      SU//45        U R                  U R                  R                  SUS	U/5      S/ 45        / SQnU R                  U R                  R                  SUS/U-   5      SS
/SS//45        U R                  U R                  R                  SUS	/US S -   5      SSS//45        U R                  U R                  R                  SUS	/USS  -   5      S/ 45        SnU R                  R                  SUSU/5      nU R                  [        US   [        5      5        SnU R                  R                  SUS	U/5      nU R                  [        US   [        5      5        g s  snf s  snf )N&systemd python interface not availabler   systemd_SYSTEMD_UNIT=sshd.servicezTEST_FIELD1=ABCz_HOSTNAME=example.comrL   addjournalmatchr   r   deljournalmatch
_COMM=sshd)r  +r  _UID=0r  r  r   zThis isn't valid!zFIELD=NotPresent)r   r   SkipTestr=   rA   rh   rU   r?   rV   r   r   
ValueError)r$   r@   rm   rp   rq   valre  s          r'   testJournalMatchTransmitter.testJournalMatch*  sF   				C	DD(++h	*&
 F#haKKX(%02&!A#,',3,'(* $
 F#haKKX(%02&1,',3,'(* $ %;;
H'/1y> ;;
H'/1%
 ;;
H'/1y>
 ;;
H'/1r7
>%;;
H'(5025x@ABD ;;
H'(5!946	%x0124 ;;
H'(5946r7 %;;	8&.0&//*VAY
34 %;;	8&.0&//*VAY
34o 	(
 	(s   K;#L c           	      .   [         (       d  [        R                  " S5      eU R                  S5        SnU R                  R                  US5        / SQn[        U5       HM  u  p4U R                  U R                  R                  SUSU/5      SUS US	-     Vs/ s H  oU/PM     sn45        MO     [        U5       HL  u  p4U R                  U R                  R                  SUS
U/5      SX#S	-   S   Vs/ s H  oU/PM     sn45        MN     g s  snf s  snf )Nr  Tr   zsystemd[journalflags=2]r  rL   r  r   r   r  )
r   r   r  r   r=   rA   rh   rU   r?   rV   )r$   r@   rm   rp   rq   r  s         r'   testJournalFlagsMatch!Transmitter.testJournalFlagsMatchq  s   				C	DD//$(++h 9:&
 F#haKKX(%02&!A#,',3,'(* $
 F#haKKX(%02&1,',3,'(* $ 	(
 	(s   D4Dr"   N)4r/   r0   r1   r2   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r$  r2  r   r?  rG  rJ  rN  rT  ra  rf  ro  rv  r{  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r3   r"   r+   r'   r}   r}      sD   ,
=?K6	I.`;$
><$	<;
FK	c:(& ) )V?==B(T2#JR?<02  
 b $


<:@x"&HE<<?E5N*r+   r}   c                   V   ^  \ rS rSr\rU 4S jrS rS rS r	S r
S rS rS	 rS
rU =r$ )TransmitterLoggingi  c                    > [         [        U ]  5         U R                  R	                  S5        U R                  R                  S5        U R                  R                  S5        g )N	/dev/nullCRITICALr   )r:   r   r;   r=   r-   r(   setSyslogSocketrC   s    r'   r;   TransmitterLogging.setUp  sG    D')++;'++*%++f%r+   c                    / n[        S5       HG  n[        R                  " SS5      nUR                  US   5        [        R
                  " US   5        MI     U H  nU R                  SU5        M     SnU R                  SU5        U R                  R                  / SQ5        U H  n[        R                  " U5        M     U R                  SS	S
5        U R                  SSS5        g )Nr   r   transmitterr   r   	logtarget/this/path/should/not/exist)rL   r  r  zSTDOUT[format="%(message)s"]STDOUTz!STDERR[datetime=off, padding=off]STDERR)ranger   r   r  r   r   r^   rb   r?   rV   remove)r$   
logTargets_tmpFile	logTargetrq   s         r'   testLogTarget TransmitterLogging.testLogTarget  s    *8aj-87WQZ 88GAJ  i??;	*  (%[%(++78i99Y  //+=xH//+BHMr+   c                 D   [         R                  R                  S5      (       d  [        R                  " S5      eU R                  U R                  R                  5       S5        U R                  SS5        U R                  U R                  R                  5       S5        g )N/dev/logz'/dev/log' not presentr   r  SYSLOG)	r   r^  existsr   r  r   r=   getSyslogSocketr^   r   s    r'   testLogTargetSYSLOG&TransmitterLogging.testLogTargetSYSLOG  sk    	
	#	#			3	44//$++--/8//+x(//$++--/<r+   c                 (    U R                  SS5        g )Nsyslogsocketz/dev/log/NEW/PATH)r^   r   s    r'   testSyslogSocket#TransmitterLogging.testSyslogSocket  s    //."56r+   c                 <   U R                  SS5        U R                  SS5        U R                  SS5        U R                   " S0 0 [        S[        S5      SS	9S
.[        R
                  " 5       S;   =(       a    [        R                  R                  S5         D6  g )Nr  r	  r  r  r  r   zFailed to change log targetT)rZ   rY   rQ   )TF)Linux)r  r  )	r^   rb   dict	Exceptionplatformsystemr   r^  r  r   s    r'   testSyslogSocketNOK&TransmitterLogging.testSyslogSocketNOK  s    //."?@[(+//.*-// 78" J&E277>>*+EGr+   c                    U R                  SS5        U R                  SS5        U R                  SS5        U R                  SS5        U R                  SS5        U R                  SS5        U R                  SS5        U R                  SS	5        U R                  SS
5        U R                  SSS
5        U R                  SS5        g )Nloglevel
HEAVYDEBUG
TRACEDEBUG9DEBUGINFONOTICEWARNINGERRORr  cRiTiCaLBird)r^   rb   r   s    r'   testLogLevelTransmitterLogging.testLogLevel  s    //*l+//*l+//*c"//*g&//*f%//*h'//*i(//*g&//*j)//*j*5Z(r+   c                    U R                  U R                  R                  S/5      S5         [        R                  " S5      u  p[
        R                  " U5        U R                  R                  S5        U R                  U R                  R                  SSU/5      SU45        [        S5      nUR                  S	5         [        R                  " S5      u  pE[
        R                  " U5        [
        R                  " X%5        UR                  S
5        U R                  U R                  R                  S/5      S5        UR                  S5        [        US5       n[        U5      nUR                  S5      S:  a  [        U5      nU R                  UR!                  S5      5        [        U5      nU R                  UR!                  S5      5         [        U5      nUR                  S5      S:  a!  U R#                  [$        UR&                  5        OU R)                  SU-  5         S S S 5        [        US5       n[        U5      nUR                  S5      S:  a  [        U5      nU R                  UR!                  S5      5        U R#                  [$        UR&                  5        UR                  5         S S S 5        [
        R*                  " U5          [
        R*                  " U5        U R                  U R                  R                  / SQ5      S5        U R                  U R                  R                  S/5      S5        g ! [$         a     GN-f = f! , (       d  f       GN8= f! , (       d  f       N= f! [
        R*                  " W5        f = f! [,         a     Nf = f!  [
        R*                  " W5        f ! [,         a     f f = f= f)N	flushlogs)r   zrolled overzfail2ban.logr/  rL   r  r   r   zBefore file movedzAfter file movedzAfter flushlogsrzChanged logging target tozBefore file moved
zAfter file moved
zCommand: ['flushlogs']zCException StopIteration or Command: ['flushlogs'] expected. Got: %szrollover performed onzAfter flushlogs
)rL   r  r  )r   r  )r   flushed)rU   r?   rV   r   r   r   r   r=   r(   r   warningrenameopennextfindr   endswithassertRaisesStopIteration__next__failr  OSError)	r$   ffnlf2fn2line1line2rp   s	            r'   testFlushLogs TransmitterLogging.testFlushLogs  s   4;;&&}57IJ*	N+5188A;;;9%DKK''R(@AAr7K199 !~.GBHHRLIIbII !T[[((+79KLII 	c#!!WU

./141ge	__U^^$9:;!WU	__U^^$89:
q'a	
(	)A	-

3yyVYZZ[ 
 
b!WU

*+q01ge	__U^^$789	}ajj1WWY 
 IIcN	IIbM 4;;&&'EFV4;;&&}5~F#  
 
 
 IIcN  			IIbM
 		s   BN/ BN "A7M!A MM!M/M!0N A<M3 N N/  N 
MM!MM!!
M0+N 3
N=N NN/ 
N,+N,/O1OO
OOOOc                    U R                  SSSU R                  S9  U R                  SSSU R                  S9  U R                  SS	S
U R                  S9  U R                  SSSU R                  S9  U R                  SSU R                  S9  U R                  SSSU R                  S9  U R                  SSSU R                  S9  g )Nzbantime.incrementtrueTr   zbantime.rndtime30minr   zbantime.maxtimez	1000 daysi \&zbantime.factorrC  zbantime.formulazGban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)zbantime.multipliersz1 5 30 60 300 720 1440 2880zbantime.overalljailsrz  r   s    r'   testBanTimeIncr"TransmitterLogging.testBanTimeIncr  s    //%vt$--/H//#We$--/H//#[-dmm/T//"C4==/A//#%nuy  vC  vC/  D//')FHelplyly/z//(&&t}}/Mr+   r"   )r/   r0   r1   r2   r	   r<   r;   r  r  r  r%  r3  rK  rP  r3   rz   r{   s   @r'   r   r     s:    &N(=7).G`N Nr+   r   c                       \ rS rSrS rSrg)	JailTestsi  c                 V    Sn[        U5      nU R                  UR                  U5        g )Nveryveryverylongname)r   rU   rm  )r$   longnamer[   s      r'   testLongNameJailTests.testLongName  s$    #(	h$499h'r+   r"   N)r/   r0   r1   r2   rW  r3   r"   r+   r'   rS  rS    s    (r+   rS  c                   &    \ rS rSrS rS rS rSrg)
RegexTestsi  c                     U R                  [        [        S5        U R                  [        [        S5        U R                  [        [        S5        g )Nr   	)r?  r   r   r   s    r'   testInitRegexTests.testInit  s8    NE2.NE3/NE40r+   c                     U R                  [        [        S5      5      R                  SS5      S5        U R	                  [        [        S5      5      R                  S5      5        g )Na"'z
Regex('a')r  z
FailRegex()rU   rl   r   replacer   r   
startswithr   s    r'   testStrRegexTests.testStr  sH    3uSz?**34lC//#i)*55lCDr+   c                    U R                  [        [        S5        U R                  [        [        S5        U R                  [        S5      5        U R                  [        S5      5        U R                  [        S5      5        U R                  [        S5      5        U R                  [        S5      5        U R                  [        S5      5        U R                  [        S	5      5        [        S
5      nU R	                  UR                  5       5        UR                  S/5        U R                  UR                  5       5        U R                  [        UR                  5        [        S5      nU R	                  UR                  5       5        UR                  S/5        U R                  UR                  5       5        U R                  [        UR                  5        [        S5      nU R	                  UR                  5       5        UR                  S/5        U R                  UR                  5       5        U R                  UR                  5       S5        UR                  S/5        U R                  UR                  5       5        U R                  UR                  5       S5        UR                  S/5        U R                  UR                  5       5        U R                  UR                  5       S5        [        S5      nU R	                  UR                  5       5        UR                  S/5        U R                  UR                  5       5        U R                  UR                  5       S5        [        S5      nUR                  S/5        UR                  5       nU R                  X"R                  4S5        UR                  S/5        UR                  5       nU R                  X"R                  4S5        UR                  S/5        UR                  5       nU R                  X"R                  4S5        UR                  S/5        UR                  5       nU R                  X"R                  4S5        [        S 5      nUR                  S!/5        UR                  5       nU R                  X"R                  4S"5        UR                  S#/5        UR                  5       nU R                  X"R                  4S5        UR                  S$/5        UR                  5       nU R                  X"R                  4S%5        UR                  S&/5        UR                  5       nU R                  X"R                  4S'5        g )(Nr  z^test no group$z^test <HOST> group$z^test <IP4> group$z^test <IP6> group$z^test <DNS> group$z<^test id group: ip:port = <F-ID><IP4>(?::<F-PORT/>)?</F-ID>$z-^test id group: user:\(<F-ID>[^\)]+</F-ID>\)$z#^test id group: anything = <F-ID/>$z	%%<HOST>?)z%%r  r  z#%%inet(?:=<F-IP4/>|inet6=<F-IP6/>)?)z%%inet=testr  r  z(%%(?:inet(?:=<IP4>|6=<IP6>)?|dns=<DNS>?))z%%inet=192.0.2.1r  r  r  )z%%inet6=2001:DB8::r  r  
2001:DB8::)z%%dns=example.comr  r  zexample.com)z%test id group: user:(test login name)r  r  ztest login namez%%net=<SUBNET>)z%%net=192.0.2.1r  r  )r  inet4)z%%net=192.0.2.1/24r  r  )z192.0.2.0/24rj  )z%%net=2001:DB8:FF:FF::1r  r  )z2001:db8:ff:ff::1inet6)z%%net=2001:DB8:FF:FF::1/60r  r  )z2001:db8:ff:f0::/60rk  z%%ip="<ADDR>", mask="<CIDR>?")z%%ip="192.0.2.2", mask=""r  r  )r  rj  )z%%ip="192.0.2.2", mask="24"r  r  )z"%%ip="2001:DB8:2FF:FF::1", mask=""r  r  )z2001:db8:2ff:ff::1rk  )z$%%ip="2001:DB8:2FF:FF::1", mask="60"r  r  )z2001:db8:2ff:f0::/60rk  )r?  r   r   r   r   
hasMatchedsearchgetHostrU   	getFailIDgetIP	familyStr)r$   frr)  s      r'   testHostRegexTests.testHost  s   NIr2NI/@A//)234//)123//)123//)123//)[\]//)LMN//)BCD "2==?#))\N//"--/"NBJJ/78"2==?#))"#$//"--/"NBJJ/<="2==?#))'()//"--/"2::<-)))*+//"--/"2::<.))()*//"--/"2::</AB"2==?#))<=>//"--/"2<<>#45"#"))&'(	xxz"B%'=>)))*+	xxz"B%'@A))./0	xxz"B%'EF))123	xxz"B%'GH12"))012	xxz"B%'=>))234	xxz"B%'@A))9:;	xxz"B%'FG));<=	xxz"B%'HIr+   r"   N)r/   r0   r1   r2   r^  rf  rs  r3   r"   r+   r'   rZ  rZ    s    1EDJr+   rZ  c                       \ rS rSrS rSrg)
_BadThreadid  c                     [        S5      e)Nzrun bad thread exception)r   r   s    r'   run_BadThread.rune  s    /00r+   r"   N)r/   r0   r1   r2   rx  r3   r"   r+   r'   rv  rv  d  s    1r+   rv  c                   &    \ rS rSrS rS rS rSrg)LoggingTestsii  c                     [        S5      nU R                  UR                  R                  S5        U R                  UR                  S5        g )Nzfail2ban.some.string.with.namer   zfail2ban.name)r   rU   parentrm  )r$   
testLogSyss     r'   testGetF2BLoggerLoggingTests.testGetF2BLoggerk  s=    9:*:$$)):6:??O4r+   c                   ^ ^ [         R                  n/ mU4S j[         l         [        5       nUR                  5         UR	                  5         T R                  [        R                  " U U4S jS5      5        U[         l        T R                  S5        T R                  [        T5      S5        T R                  TS   S   [        5        g ! U[         l        f = f)Nc                  &   > TR                  U 5      $ r!   )r  )r%   rP   s    r'   r   5LoggingTests.testFail2BanExceptHook.<locals>.<lambda>s  s    QXXd^r+   c                  J   > [        T5      =(       a    T R                  S5      $ )NUnhandled exception)r   
_is_logged)r$   rP   s   r'   r   r  x  s    CF,]tG\7],]r+   r   r  r   r   )sys__excepthook__rv  r   r_  r   r   r   r   rU   r   r   )r$   prev_exchook	badThreadrP   s   `  @r'   testFail2BanExceptHook#LoggingTests.testFail2BanExceptHookp  s    ##,!3#%|9??>>??ENN$]_`ac$3)*3q611Q47L) %3s   AC Cc                    / n[         R                  " SS5      u  p#[        R                  " U5        UR	                  U5        [         R                  " SS5      u  pE[        R                  " U5        UR	                  U5        [        5       n UR                  X5SS9  U R                  UR                  5       5        U R                  S5        UR                  5         U H?  n[        R                  R                  U5      (       d  M)  [        R                  " U5        MA     g ! UR                  5         U H?  n[        R                  R                  U5      (       d  M)  [        R                  " U5        MA     f = f)Nzfail2ban.sockzf2b-testzfail2ban.pidF)forcezServer already running)r   r   r   r   r  r   r   r   r   r   rH   r^  r  r  )r$   	tmp_filessock_fd	sock_name
pidfile_fdpidfile_namer=   rD  s           r'   testStartFailedSockExists&LoggingTests.testStartFailedSockExists  s   )''D'((79%--njI*((:< <&	<<	u<5F$$&'-.	;;=q	ww~~aYYq\  
;;=q	ww~~aYYq\ s   A D$ $8E; E;r"   N)r/   r0   r1   r2   r  r  r  r3   r"   r+   r'   r{  r{  i  s    5
*r+   r{  )ActionReaderJailsReader
CONFIG_DIRc                   ~   ^  \ rS rSrU 4S jrU 4S jrU 4S jrSS jrS rS r	S r
S	 rS
 rS rSS jrS rSrU =r$ )ServerConfigReaderTestsi  c                 <   > [         [        U ]
  " U0 UD6  0 U l        g r!   )r:   r  __init__#_ServerConfigReaderTests__share_cfg)r$   r%   r&   rD   s      r'   r   ServerConfigReaderTests.__init__  s     /@@$r+   c                 8   > [         [        U ]  5         / U l        g)r8   N)r:   r  r;   _execCmdLstrC   s    r'   r;   ServerConfigReaderTests.setUp  s    ,.$r+   c                 *   > [         [        U ]  5         grG   )r:   r  rI   rC   s    r'   rI    ServerConfigReaderTests.tearDown  s    /1r+   c                     UR                  S5       HF  nUR                  S5      (       d  [        R                  SU5        M1  [        R                  U5        MH     g)N
#zexec-cmd: `%s`T)splitre  logSysdebug)r$   realCmdr  rF  s       r'   _executeCmd#ServerConfigReaderTests._executeCmd  sC    ==a
,,s


LL!1%
LLO	 
 
r+   c                    [        U S5      (       dd  [        5       n0 U l        S HM  u  p#[        U5      nUR	                  S5        [
        R                  R                  XA5      U R                  U'   MO     U R                  $ )N__aInfos))ipv4r  )ipv6ri  r   )hasattrr    _ServerConfigReaderTests__aInfosr   
setBanTime_actionsr  
ActionInfo)r$   dmyjailtr)  tickets        r'   _testActionInfos(ServerConfigReaderTests._testActionInfos  sl    	z	"	"[74=?uqr]F
c''226CDMM! @ 
r+   c                 B   UR                   nU R                  5       nU GH  nX$   R                   GH  nX$   R                  U   n[        R	                  S5        [        R	                  SUS-   UR
                  -   5        [        R	                  S5        [        U[        R                  5      (       d  M  U R                  Ul
        [        R	                  S5        U R                  5         UR                  5         [        R	                  S5        U R                  5         UR                  US   5        [        R	                  S5        U R                  5         UR                  US   5        [        R	                  S5        U R                  5         UR                  US	   5        [        R	                  S
5        U R                  5         UR                  US	   5        [        R	                  S5        U R                  5         UR                  5         GM     GM     g )N4# ==================================================# == %-44s == - # === start ===# === ban-ipv4 ===r  # === unban ipv4 ===# === ban ipv6 ===r  # === unban ipv6 ===# === stop ===)r   r  r   r  r  _namer   r  CommandActionr  
executeCmdr   r   r  r  r   )r$   r=   r  aInfosr[   ra  r  s          r'   _testExecActions(ServerConfigReaderTests._testExecActions  sq   


%  "&dKq[  #F
LL"#
LL$,"=>
LL"#fh4455x((F
LL"#T]]_
LLN
LL%&
JJvf~
LL'($--/
LL 
LL%&
JJvf~
LL'($--/
LL 
LL!"DMMO
KKM5   r+   c                 0   [         R                  R                  SS9  [        [        SU R
                  S9nU R                  UR                  5       5        U R                  UR                  5       5        UR                  SS9n[        5       nUR                  nUR                  nU GH  nUS   S:w  d  M  US   S:X  a  SUS	'   O[        U5      S
:  a  US   S:X  a~  US	   S:X  au  [        R                  R!                  ["        SUS   5      n[        R                  R%                  U5      (       d$  [        R                  R!                  ["        S5      nXvS
'   OJ[         R                  R&                  (       a+  [        U5      S
:  a  US   S;   a  US	   S:X  a
  SUS'   SUS
'    U" U5        GM
     [         R                  R&                  (       d  U R-                  U5        g g ! [(         a%  nU R+                  SU< SU< 35         S nAGMh  S nAff = f)NTstock)basedirforce_enableshare_config)allow_no_filesr   r   re   r   r   r   rL   rY  logsr   rX  )rL   z	multi-setr  zDUMMY-REGEX <HOST>zCommand z has failed. Received )r   r   SkipIfCfgMissingr  r  r  r   read
getOptionsconvertr   r>   _Transmitter__commandHandlerr   r   r^  r_  r`  r  r   r"  rB  r  )	r$   r  streamr=   r?   
cmdHandlerrW   rE  es	            r'   testCheckStockJailActions1ServerConfigReaderTests.testCheckStockJailActions  s   
,,d+
jt$JZJZ
[%//%**,//%""$%===-&<&!!&22* c	!f
1vSV 
SA#a&E/c!f.D
'',,~vs1v
6R GGNN277<<(89bV 
		X\c!f 44Q>9QSV"SV@_/ @ 
		  
  @	YYsA>??@s   'G&&
H0HHc                 "   UR                  SU5      n[        U5      u  p4SUS//n[        X1UU R                  [        S9nU R                  UR                  5       5        UR                  0 5        UR                  UR                  5       5        U$ )Nz%(__name__)sre   r   )r  r  )
rd  r   r  r  r  r   r  r  extendr  )r$   r[   actactNameactOptr  r  s          r'   getDefaultJailStream,ServerConfigReaderTests.getDefaultJailStream  s    ND)#"3'/'	4& 
&  *6& //&++- B-- !	-r+   c                 *   [         R                  R                  SS9  [         R                  R                  5         SS Kn[        5       nUR                  nUR	                  [        R                  R                  [        SS5      5       H  n[        R                  R                  U5      R                  SS5      nU R                  SU-   U5      nU H(  nUR                  U5      u  pU R                  US5        M*     U R!                  U5        M     g )	NTr  r   r  z*.confz.confr  zj-)r   r   r  
SkipIfFastglobr   r>   r   r^  r_  r  basenamerd  r  rV   rU   r  )
r$   r  r=   r?   actCfgr  r  rW   rr   ress
             r'   testCheckStockAllActions0ServerConfigReaderTests.testCheckStockAllActions  s    
,,d+
,,<&!!&		"'',,z:xHIf			&	!	)	)'2	63%%d3h46s~~c"HCS! 
   Jr+   c                 .   [         R                  R                  SS9  SSSSSSS	S
SSSSSSSS.4SSSSSSSSSSSSSSSS.4S S!S"S#S$S%S&S'S(S)S*S+.	4S,S-S"S#S.S/S0S1S2.4S3S4S5S6S7S8S9S:S;S<S=S>S?S@SASB.4SCSDS5S6S7SESFSGSHSISJSKSLSMSNSB.4SOSPSQSRSSSTSUSVSWSXSYSZS[S\S]SB.4S^S_S`SaSSSbScSdSeSfSgShSiSjSkSB.4SlSmS5S6SSSnSoSpSqSrSsStSuSvSwSB.4SxSyS5S6SSSzS{S|S}S~SSSSSSB.4SSSSSSSSSSSSSS.4SSSSSSSSSSSSSS.4SSSSSSSSSSSSSS.4SSSSSSSSSSSSSSS.4SSSSSSSSSSSSSS.4SSSSSSSSSSSSSS.4SSSSSSSSSSSSS.
4SSSSSSSSSSSSS.
4SSSSSSSSS2.4SSSSSSSSS2.44n[        5       nUR                  nUR
                  nU HE  u  pVnU R                  XV5      nU H(  n	UR                  U	5      u  pU R                  U
S5        M*     MG     UR                  nU R                  5       nU GH  u  pVnX   R                   GH  nX   R                  U   n[        R                  S5        [        R                  SUS-   UR                  -   5        [        R                  S5        U R                  [!        U["        R$                  5      5        U R&                  Ul        U R+                  S5        UR-                  5         UR/                  S5      (       a  U R0                  " US   SS06  OGUR/                  S5      (       a1  UR/                  S5      (       a  U R2                  " US   US   -   SS06  U R+                  S5        UR5                  US   5        UR/                  S5      (       a8  U R0                  " UR/                  SUR/                  SS5      5      US   -   SS06  UR/                  S5      (       a  U R2                  " US   SS06  U R0                  " US   SS06  U R2                  " UGS    SS06  U R+                  GS5        UR7                  US   5        U R0                  " UGS   SS06  U R2                  " UGS    SS06  U R+                  GS5        UR5                  UGS   5        UR/                  S5      (       a8  U R0                  " UR/                  SUR/                  SS5      5      US   -   SS06  UR/                  S5      (       a  U R2                  " US   SS06  U R0                  " UGS   SS06  U R2                  " UGS   SS06  U R+                  GS5        UR7                  UGS   5        U R0                  " UGS   SS06  U R2                  " UGS   SS06  UR/                  GS	5      (       a  U R+                  GS
5        UR9                  US   GS   5        U R0                  " UR/                  GSUR/                  SS5      5      UGS	   -   SS06  UR/                  GS5      (       a$  UGS   UGS	   :w  a  U R2                  " UGS   SS06  UR/                  GS5      (       a  U R+                  GS5        UR9                  UGS   GS   5        U R0                  " UR/                  GSUR/                  SS5      5      UGS   -   SS06  UR/                  GS	5      (       a$  UGS	   UGS   :w  a  U R2                  " UGS	   SS06  UR/                  GS5      (       a8  U R+                  GS5        UR;                  5         U R0                  " UGS   SS06  U R+                  GS5        UR=                  5         UR/                  GS5      (       d  GMe  U R0                  " UR/                  SS5      UGS   -   SS06  GM     GM     g (  NTr  z
j-w-nft-mpzQnftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"])zip 	ipv4_addrzaddr-)zip6 	ipv6_addrzaddr6-)`nft add table inet f2b-table`W`nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`9`for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do``done`)zG`nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`z`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`z`nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || )z`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`5`nft delete rule inet f2b-table f2b-chain $hdl; done`z3`nft delete set inet f2b-table addr-set-j-w-nft-mp`z`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r  z4`nft delete set inet f2b-table addr6-set-j-w-nft-mp`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`)ip4ip6*-start	ip4-start	ip6-startflushr   	ip4-check	ip6-checkip4-ban	ip4-unbanip6-ban	ip6-unbanz
j-w-nft-apz8nftables-allports[name=%(__name__)s, protocol="tcp,udp"])r  r  )zG`nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`zg`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`)zH`nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`zi`nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`)zG`{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || zH`{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || )z`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r  z3`nft delete set inet f2b-table addr-set-j-w-nft-ap`z`{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`r  z4`nft delete set inet f2b-table addr6-set-j-w-nft-ap`)zO`nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`)zP`nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`)zD`nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zG`nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`)zF`nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`)zI`nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`zj-dummyzodummy[name=%(__name__)s, init="=='<family>/<ip>'==bt:<bantime>==bc:<bancount>==", target="/tmp/fail2ban.dummy"])zfamily: inet4)zfamily: inet6)z$`printf %b "=='/'==bt:600==bc:0==\n"z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`)z9`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`)z7`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`)zP`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`)zR`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`)zQ`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`)zS`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`)	r  r  r   r  r   r  r  r  r  zj-hostsdenyzPhostsdeny[name=%(__name__)s, actionstop="rm <file>", file="/tmp/fail2ban.dummy"])z5`printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`)z^`IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)z8`printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`)za`IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`)r  r  r  r  r  r  zj-w-iptables-mpzwiptables-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp,udp,sctp", chain="<known/chain>"])
`iptables icmp-port-unreachable)`ip6tables icmp6-port-unreachable)r  r  )z`{ iptables -w -C f2b-j-w-iptables-mp -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-mp || true; iptables -w -A f2b-j-w-iptables-mp -j RETURN; }`z`{ iptables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp; }`)z`{ ip6tables -w -C f2b-j-w-iptables-mp -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-mp || true; ip6tables -w -A f2b-j-w-iptables-mp -j RETURN; }`zq`{ ip6tables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp >/dev/null 2>&1; } || z]{ ip6tables -w -I INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp; }`)$`iptables -w -F f2b-j-w-iptables-mp`%`ip6tables -w -F f2b-j-w-iptables-mp`)zX`iptables -w -D INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`r  z$`iptables -w -X f2b-j-w-iptables-mp`zY`ip6tables -w -D INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`r  z%`ip6tables -w -X f2b-j-w-iptables-mp`)zX`iptables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`)zY`ip6tables -w -C INPUT -p $proto -m multiport --dports http,https -j f2b-j-w-iptables-mp`)za`iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)r  r  *-start-stop-checkr  r  r  r   r  r  r  r  r  r  zj-w-iptables-apzciptables-allports[name=%(__name__)s, bantime="10m", protocol="tcp,udp,sctp", chain="<known/chain>"])z`{ iptables -w -C f2b-j-w-iptables-ap -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-ap || true; iptables -w -A f2b-j-w-iptables-ap -j RETURN; }`zO`{ iptables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap >/dev/null 2>&1; } || z;{ iptables -w -I INPUT -p $proto -j f2b-j-w-iptables-ap; }`)z`{ ip6tables -w -C f2b-j-w-iptables-ap -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-ap || true; ip6tables -w -A f2b-j-w-iptables-ap -j RETURN; }`zP`{ ip6tables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap >/dev/null 2>&1; } || z<{ ip6tables -w -I INPUT -p $proto -j f2b-j-w-iptables-ap; }`)$`iptables -w -F f2b-j-w-iptables-ap`%`ip6tables -w -F f2b-j-w-iptables-ap`)z7`iptables -w -D INPUT -p $proto -j f2b-j-w-iptables-ap`r  z$`iptables -w -X f2b-j-w-iptables-ap`z8`ip6tables -w -D INPUT -p $proto -j f2b-j-w-iptables-ap`r  z%`ip6tables -w -X f2b-j-w-iptables-ap`)z7`iptables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap`)z8`ip6tables -w -C INPUT -p $proto -j f2b-j-w-iptables-ap`)za`iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z_`iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)zd`ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zb`ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-ipsetz\iptables-ipset-proto6[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-iptables-ipset )z f2b-j-w-iptables-ipset6 )z0`for proto in $(echo 'tcp' | sed 's/,/ /g'); do`r  )zM`ipset -exist create f2b-j-w-iptables-ipset hash:ip timeout 0 maxelem 65536 `aJ  `{ iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable; }`)zZ`ipset -exist create f2b-j-w-iptables-ipset6 hash:ip timeout 0 maxelem 65536 family inet6`aP  `{ ip6tables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable; }`)$`ipset flush f2b-j-w-iptables-ipset`%`ipset flush f2b-j-w-iptables-ipset6`)z`iptables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`r	  z&`ipset destroy f2b-j-w-iptables-ipset`z`ip6tables -w -D INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r
  z'`ipset destroy f2b-j-w-iptables-ipset6`)z`iptables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`)z`ip6tables -w -C INPUT -p $proto -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)z=`ipset -exist add f2b-j-w-iptables-ipset 192.0.2.1 timeout 0`)z3`ipset -exist del f2b-j-w-iptables-ipset 192.0.2.1`)z?`ipset -exist add f2b-j-w-iptables-ipset6 2001:db8:: timeout 0`)z5`ipset -exist del f2b-j-w-iptables-ipset6 2001:db8::`zj-w-iptables-ipset-apzHiptables-ipset-proto6-allports[name=%(__name__)s, chain="<known/chain>"])z f2b-j-w-iptables-ipset-ap )z f2b-j-w-iptables-ipset-ap6 )zP`ipset -exist create f2b-j-w-iptables-ipset-ap hash:ip timeout 0 maxelem 65536 `a  `{ iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable; })z]`ipset -exist create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 maxelem 65536 family inet6`a  `{ ip6tables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable; })'`ipset flush f2b-j-w-iptables-ipset-ap`(`ipset flush f2b-j-w-iptables-ipset-ap6`)z`iptables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r  z)`ipset destroy f2b-j-w-iptables-ipset-ap`z`ip6tables -w -D INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r  z*`ipset destroy f2b-j-w-iptables-ipset-ap6`)z`iptables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)z`ip6tables -w -C INPUT -p $proto -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)z@`ipset -exist add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 0`)z6`ipset -exist del f2b-j-w-iptables-ipset-ap 192.0.2.1`)zB`ipset -exist add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 0`)z8`ipset -exist del f2b-j-w-iptables-ipset-ap6 2001:db8::`zj-w-iptablesz^iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z`{ iptables -w -C f2b-j-w-iptables -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables || true; iptables -w -A f2b-j-w-iptables -j RETURN; }z`{ iptables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables >/dev/null 2>&1; } || { iptables -w -I INPUT -p $proto --dport http -j f2b-j-w-iptables; }`)z`{ ip6tables -w -C f2b-j-w-iptables -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables || true; ip6tables -w -A f2b-j-w-iptables -j RETURN; }z`{ ip6tables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables >/dev/null 2>&1; } || { ip6tables -w -I INPUT -p $proto --dport http -j f2b-j-w-iptables; }`)!`iptables -w -F f2b-j-w-iptables`"`ip6tables -w -F f2b-j-w-iptables`)zA`iptables -w -D INPUT -p $proto --dport http -j f2b-j-w-iptables`r  z!`iptables -w -X f2b-j-w-iptables`zB`ip6tables -w -D INPUT -p $proto --dport http -j f2b-j-w-iptables`r  z"`ip6tables -w -X f2b-j-w-iptables`)zA`iptables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables`)zB`ip6tables -w -C INPUT -p $proto --dport http -j f2b-j-w-iptables`)z^`iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z\`iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)za`ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z_`ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-newzbiptables-new[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"])z`{ iptables -w -C f2b-j-w-iptables-new -j RETURN >/dev/null 2>&1; } || { iptables -w -N f2b-j-w-iptables-new || true; iptables -w -A f2b-j-w-iptables-new -j RETURN; }`z`{ iptables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new >/dev/null 2>&1; } || { iptables -w -I INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new; }`)z`{ ip6tables -w -C f2b-j-w-iptables-new -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-j-w-iptables-new || true; ip6tables -w -A f2b-j-w-iptables-new -j RETURN; }`z`{ ip6tables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new >/dev/null 2>&1; } || { ip6tables -w -I INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new; }`)%`iptables -w -F f2b-j-w-iptables-new`&`ip6tables -w -F f2b-j-w-iptables-new`)zZ`iptables -w -D INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`r  z%`iptables -w -X f2b-j-w-iptables-new`z[`ip6tables -w -D INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`r  z&`ip6tables -w -X f2b-j-w-iptables-new`)zZ`iptables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`)z[`ip6tables -w -C INPUT -m state --state NEW -p $proto --dport http -j f2b-j-w-iptables-new`)zb`iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z``iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)ze`ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)zc`ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-iptables-xtrezPiptables-xt_recent-echo[name=%(__name__)s, bantime="10m", chain="<known/chain>"])r   z/f2b-j-w-iptables-xtre`)r  z/f2b-j-w-iptables-xtre6`)a"  `{ iptables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable >/dev/null 2>&1; } || { iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable; }`)a(  `{ ip6tables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable >/dev/null 2>&1; } || { ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable; }`)z4`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre``if [ `id -u` -eq 0 ];then`z`iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;``fi`z5`echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`r  z`ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;`r  )z`{ iptables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z`{ ip6tables -w -C INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z=`echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z=`echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`)z?`echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)z?`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`)r  r  r  r  r   r  r  r  r  r  r  zj-w-pfz2pf[name=%(__name__)s, actionstart_on_demand=false]r"   )zF`echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`zport="<port>"z\`echo "block quick $protocol from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`),`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`)zT`pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`r  z+`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`)z.`pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`)z4`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`)z7`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`)z5`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`)z8`pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`)r  r  r   r  r   r  r  r  r  r  r  z	j-w-pf-mpz@pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"])zL`echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`zport="http,https"zb`echo "block quick $protocol from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`)2`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`)z]`pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`r  z1`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`)z4`pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`)z:`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`z	j-w-pf-apzHpf[actiontype=<allports>, actionstart_on_demand=true][name=%(__name__)s])zL`echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`zW`echo "block quick $protocol from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`)2`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`)z]`pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`r  z1`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`)z4`pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`)z:`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`)z=`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`)z;`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`)z>`pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`)r  r  r  r  r  r   r  r  r  r  r  r  zj-w-fwcmd-mpzqfirewallcmd-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"])z ipv4 r  )z ipv6 r  )z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`z`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`)z`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`z`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports http,https -j f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-fwcmd-apz]firewallcmd-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"])z@`firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)z@`firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`zN`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`zQ`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`)zT`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`zT`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`zC`firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`)zc`firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)zc`firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`)z|`firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`)z~`firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`)z`firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`zj-w-fwcmd-ipsetzXfirewallcmd-ipset[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset )z f2b-j-w-fwcmd-ipset6 )zJ`ipset -exist create f2b-j-w-fwcmd-ipset hash:ip timeout 0 maxelem 65536 `z`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`)zW`ipset -exist create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 maxelem 65536 family inet6`z`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`)!`ipset flush f2b-j-w-fwcmd-ipset`"`ipset flush f2b-j-w-fwcmd-ipset6`)z`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`r  z#`ipset destroy f2b-j-w-fwcmd-ipset`z`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports http -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`r  z$`ipset destroy f2b-j-w-fwcmd-ipset6`)z:`ipset -exist add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0`)z0`ipset -exist del f2b-j-w-fwcmd-ipset 192.0.2.1`)z<`ipset -exist add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 0`)z2`ipset -exist del f2b-j-w-fwcmd-ipset6 2001:db8::`)
r  r  r  r  r  r   r  r  r  r  zj-w-fwcmd-ipset-apzbfirewallcmd-ipset[name=%(__name__)s, actiontype=<allports>, protocol="tcp", chain="<known/chain>"])z f2b-j-w-fwcmd-ipset-ap )z f2b-j-w-fwcmd-ipset-ap6 )zM`ipset -exist create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 0 maxelem 65536 `z`firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`)zZ`ipset -exist create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 0 maxelem 65536 family inet6`z`firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`)$`ipset flush f2b-j-w-fwcmd-ipset-ap`%`ipset flush f2b-j-w-fwcmd-ipset-ap6`)z`firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`r  z&`ipset destroy f2b-j-w-fwcmd-ipset-ap`z`firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`r  z'`ipset destroy f2b-j-w-fwcmd-ipset-ap6`)z=`ipset -exist add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0`)z3`ipset -exist del f2b-j-w-fwcmd-ipset-ap 192.0.2.1`)z?`ipset -exist add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 0`)z5`ipset -exist del f2b-j-w-fwcmd-ipset-ap6 2001:db8::`z
j-fwcmd-rrz4firewallcmd-rich-rules[port="22:24", protocol="tcp"])zfamily='ipv4'r  )zfamily='ipv6'r  )z`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`)z `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`)z`ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`z
j-fwcmd-rlz6firewallcmd-rich-logging[port="22:24", protocol="tcp"])a
  `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a  `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`)a   `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`)a  `ports="22:24"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`r   r  r  r  r  r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  z# === check ipv4 ===familyz*-checkr  z# === check ipv6 ===r  z# === flush ===r  r   )r   r   r  r   r>   r  r  rV   rU   r   r  r   r  r  r  r   r   r  r  r  r  r   r   rM   r   r0  r  r  _invariantCheckr  r   )r$   testJailsActionsr=   r?   r  r[   r  testsr  rW   rr   r  r  r  ra  r  s                   r'   testCheckStockCommandActions4ServerConfigReaderTests.testCheckStockCommandActions.  s   
,,d+ e(1PY/h /b L(1PS,O ,\   E&8+G 4 e&8h     Q2;d
]1S 1f |2;d
]1 1f x(1O


Y/{ /b g+4U


Y/j /b t2;d
]1w 1f |2;d
]1 1f k4=h	C$n $L Bb

 EDJMKN)E . Sb

 KJPSQT)V . [b 
 KJPSQT)^ .   H.7[

G&J &P s.7[

G&v &P q%.I?"t "H ~(1O?"A "H H6?kK   J6?kM Y[x <&!!&22**d%%d06 s~~c"HCS!  + 

%  "&*dKq[  #F
LL"#
LL$,"=>
LL"#OOJvx'='=>?((FMM#$
LLNyy	g1D1	;		EIIk$:$:	5-eK.@@KdKMM&'
JJvf~yyt00%))IuyyQegiGj2klqr}l~2~   J  EI   Jyyt33U;5GRTRuY'2T2%,1D1MM()
LL u[)4t4%,1D1MM&'
JJvf~yyt00%))IuyyQegiGj2klqr}l~2~   J  EI   Jyyt33U;5GRTRuY'2T2%,1D1MM()
LL u[)4t4%,1D1yy	]])*F6N845			)UYY7KR-PQRWXcRddojno		+5#5{9K#K
E+.9D9yy	]])*F6N845			)UYY7KR-PQRWXcRddojno		+5#5{9K#K
E+.9D9yy	]]$%\\^	g1D1MM"#
KKMyy$++UYY7KR-PQVW]Q^-^idhiy   +r+   c                    Un[        U[        5      (       a  US   n[        R                  " SSU5      n[        R                  " SS US5      n[        U[        5      (       a  X1S'   OUn[        R
                  R                  XS9$ )Nr   z\)\s*\|\s*(\S*mail\b[^\n]*)z$) | cat; printf "\\n... | "; echo \1z\bADDRESSES=\$\(dig\s[^\n]+c                     g)Nz@ADDRESSES="abuse-1@abuse-test-server, abuse-2@abuse-test-server"r"   )ms    r'   r   9ServerConfigReaderTests._executeMailCmd.<locals>.<lambda>n  s    Or+   r   )r  )r   rj   resubr  r  r  )r$   r  r  rW   s       r'   _executeMailCmd'ServerConfigReaderTests._executeMailCmde  s    #	3
-*C	1# 	-O	# 1:7				*	*7	*	DDr+   c                 .   [         R                  R                  SS9  SS[        R                  R                  [        S5      -   S-   S-   [        R                  R                  [        S5      -   S	-   S
S04SS[        R                  R                  [        S5      -   S-   S-   [        R                  R                  [        S5      -   S	-   S
S04SS[        R                  R                  [        S5      -   S-   S-   [        R                  R                  [        S5      -   S-   SSS.4SSSSS.44n[        5       nUR                  nUR                  nU HE  u  pVnU R                  XV5      nU H(  n	UR                  U	5      u  pU R                  U
S5        M*     MG     UR                  n[        S5      n[        S5      n[        5       nU GHC  u  pVnX   R                    GH)  nX   R                   U   n["        R%                  S5        ["        R%                  SUS-   UR&                  -   5        ["        R%                  S5        U R(                  Ul        S
U4SU44 H  u  nnUR-                  U5      (       d  M  U R/                  S U-  5        [1        U5      nUR3                  S!5        UR5                  S"S#/5        [6        R8                  R;                  UU5      nUR=                  U5        U R>                  " UU   S$S06  M     GM,     GMF     g )%NTr  zj-mail-whois-linesz\mail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s", logpath="rX  r  z	         ztestcase01a.logz8", _whois_command="echo '-- information about <ip> --'"]r  );The IP 87.142.124.10 has just been banned by Fail2Ban afterz(100 attempts against j-mail-whois-lines..Here is more information about 87.142.124.10 :%-- information about 87.142.124.10 --2Lines containing failures of 87.142.124.10 (max 2)etestcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10etestcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10zj-sendmail-whois-lineszxsendmail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd='testmail -f "<sender>" "<dest>"', logpath=")r)  z,100 attempts against j-sendmail-whois-lines.r*  r+  r,  r-  r.  zj-complain-abusezcomplain[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s 'Hostname: <ip-host>, family: <family>' - ",debug=1,logpath="z", ])6try to resolve 10.124.142.87.abuse-contacts.abusix.orgr,  r-  r.  zymail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-server)htry to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgz0Lines containing failures of 2001:db8::1 (max 2)zwmail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-server)r  r  zj-xarf-abusezIxarf-login-attack[name=%(__name__)s, mailcmd="mail", mailargs="",debug=1])r/  z8We have detected abuse from the IP address 87.142.124.10VDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10UDec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.108mail abuse-1@abuse-test-server abuse-2@abuse-test-server)r0  z6We have detected abuse from the IP address 2001:db8::1r3  r   z87.142.124.10z2001:db8::1r  r  r  r  z# === %s ===r   r1  r2  r  ) r   r   r  r   r^  r_  r`  r   r>   r  r  rV   rU   r   r   r   r   r  r  r  r&  r  rM   r   r   
setAttempt
setMatchesr  r  r  r  r   )r$   r  r=   r?   r  r[   r  r  r  rW   rr   r  r  r  r  r  ra  r  testr)  r  s                        r'   testComplexMailActionMultiLog5ServerConfigReaderTests.testComplexMailActionMultiLogw  sT   
,,d+  GGLL1ABC FJJ 	 WW\\.2CD	EH
	
  
(  GGLL1ABC FJJ 	 WW\\.2CD	EH
	
  
( 
 GGLL1ABC
 FJJ  WW\\.2CDEH

8 
M^~ <&!!&22**d%%d06 s~~c"HCS!  + 

%		 $		$K'*dKq[  #F
LL"#
LL$,"=>
LL"#,,F!4(9d*;<
rIIdOOX	]]>D()mVs^]  ))&':VZZ	d.. =   +r+   )r  __share_cfgr  )r   )r/   r0   r1   r2   r  r;   rI   r  r  r  r  r  r  r  r&  r7  r3   rz   r{   s   @r'   r  r    sL    
2 D1!f!(ujnE$K/ K/r+   r  )A
__author____copyright____license__r   r   r   r   r$  r  r#  server.failregexr   r   r   r=   r   r  server.serverr	   server.ipdnsr
   r   server.jailr   server.jailthreadr   server.ticketr   server.utilsr   	dummyjailr   utilsr   r   r   helpersr   r   r   r  r   r   r  r^  r_  dirname__file__r`  rB   r  r   r5   r}   r   TestCaserS  rZ  rv  r{  clientreadertestcaser  r  r  r  r"   r+   r'   <module>rK     s@  . 
2    	 	 
  ? ? ( " +  * %     < < ; ; # bggooh7A	:	 [( [|d*/ d*N{N {N|(!! (RJ"" RJj1 1
'% 'T H Gm/0 m/G#  s   :E EE