|
Server : Apache System : Linux iad1-shared-b8-43 6.6.49-grsec-jammy+ #10 SMP Thu Sep 12 23:23:08 UTC 2024 x86_64 User : dh_edsupp ( 6597262) PHP Version : 8.2.26 Disable Function : NONE Directory : /lib/python3/dist-packages/fail2ban/tests/__pycache__/ |
Upload File : |
o
;s*b�] � @ s� d Z dZdZddlZddlZddlZddlZddlmZm Z m
Z
ddl m Z m
Z
ddlmZ d d
lmZ d d lmZmZmZ G d d
� d
e�ZdS )z
Cyril Jaquierz Copyright (c) 2004 Cyril Jaquier�GPL� N� )�
CommandAction�
CallingMap�substituteRecursiveTags)� OrderedDict�Actions)�Utils� )� DummyJail)�
pid_exists� with_tmpdir�LogCaptureTestCasec @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
e dd� �Z dd� Z
e dd� �Ze dd� �Ze dd� �Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Z d3d4� Z d5S )6�CommandActionTestc s> t ��� tdd��_d�_�jj� � �fdd�}|�j_dS )z Call before every test case.N�TestFc s d�_ � � S )NT)�"_CommandActionTest__action_started� ��orgstart�selfr �?/usr/lib/python3/dist-packages/fail2ban/tests/actiontestcase.py�
_action_start1 s z.CommandActionTest.setUp.<locals>._action_start)r �setUpr �_CommandActionTest__actionr �start)r r r r r r * s
zCommandActionTest.setUpc C s | j r| j�� t�| � dS )zCall after every test case.N)r r �stopr �tearDown�r r r r r 6 s
zCommandActionTest.tearDownc
C s� dddd�}| � tdd� � | � tdd� � | � tdd� � | � td d� � | � td
d� � trl| �ttd ��d d
ddd�� | �ttd��dddd
ddd�� | �ttd��td�� | � tdd� � | � tdd� � | �tdd i�dd i� | �td d d ��d d d �� | �td!d"d#��d$d"d#�� | �td%d"d#��d&d"d#�� | �td'd(d)d*��d+d(d)d*�� | �t|�dd,d-d�� | �td.d/d0��d1d/d0�� | �td.d/d2d3��d2d/d2d3�� | �td4d5d2d3��d6d5d2d3�� d S )7N� 192.0.2.0z
123 <HOST>z 890 <ABC>��HOST�ABC�xyzc S s t ddi�S )N�A�<A>�r r r r r �<lambda>D � z?CommandActionTest.testSubstituteRecursiveTags.<locals>.<lambda>c S s t ddd��S )N�<B>r$ �r# �Br% r r r r r& F � c S s t dddd��S )Nr( �<C>r$ )r# r* �Cr% r r r r r& H � c S � t ddddd��S )Nzto=<B> fromip=<IP>r( r, � )r# r- r* �Dr% r r r r r& K � c S r/ )Nzto=<honeypot> fromip=<IP>z
<honeypot>z<sweet>r0 )� failregex�sweet�honeypot� ignoreregexr% r r r r r& M r2 ))�Xzx=x<T>��T�1)�Zz <X> <T> <Y>��Yzy=y<T>zx=x1r: zy=y1z x=x1 1 y=y1)r7 r9 r= r; ))r7 zx=x<T> <Z> <<R1>> <<R2>>)�R1r; )�R2r= r8 )r; z<T> <Y>r< zx=x1 1 y=y1 1 y=y1 y=y1r; r= z1 y=y1)r7 r> r? r9 r; r= )
)� actionstartzgipset create <ipmset> hash:ip timeout <bantime> family <ipsetfamily>
<iptables> -I <chain> <actiontype>)�ipmsetz
f2b-<name>��name�any��bantime�600�� ipsetfamily�inet)�iptablesziptables <lockingopt>��
lockingoptz-w��chain�INPUT)�
actiontypez <multiport>)� multiportzY-p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>��protocol�tcp��port�ssh�� blocktype�REJECT)
)r@ z�ipset create f2b-any hash:ip timeout 600 family inet
iptables -w -I INPUT -p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT)rA zf2b-anyrB rE rH )rK z iptables -wrL rN )rQ �I-p tcp -m multiport --dports ssh -m set --match-set f2b-any src -j REJECT)rR r\ rS rV rY c S � t td��S )N)�r# z<<B><C>>�r* r1 �r- �E��DEz cycle <A>�r r r r r r r& { r' c S r] )N)rb r^ r_ r` rd r r r r r& � r' r# r, z <C> <D> <X>�fun)r# r7 z <C> <D> funz<C> <B>�coolr) z<C> coolz
<matches> <B>z<matches> coolz/to=<honeypot> fromip=<IP> evilperson=<honeypot>�pokier0 )r3 r5 r6 z%to=pokie fromip=<IP> evilperson=pokiez
123 192.0.2.0z890 123 192.0.2.0z <<PREF>HOST>�IPV4)r# �PREFz
<IPV4HOST>z1.2.3.4)r# ri �IPV4HOSTz A <IP<PREF>HOST> B IP<PREF> C�V4zA 1.2.3.4 B IPV4 C)� assertRaises�
ValueErrorr � assertEqualr �r �aInfor r r �testSubstituteRecursiveTags< sx ������� ���� ��
���
�
�z-CommandActionTest.testSubstituteRecursiveTagsc s� t ddd� ddd��� t� � ddd�� d< ��t� fdd�� t� � d � d
< ��t� fd d�� ���j�d � �d
� ���j�d� �d� ��t� �fdd�� ���j�d� �d � d S )Nr c S � dS )Nz<A><A>r r r r r r& � � zHCommandActionTest.testSubstRec_DontTouchUnusedCallable.<locals>.<lambda>r0 )r# r* r- r1 c S s dt | d � S )N� r# ��int)r �ir r r r& � r. r- c s � d S )Nr- r r ��cmr r r& � � �test=<C>r1 c s t � �S �Nr% r rx r r r& � rz ztest=<A>ztest=0ztest=<A>--<B>--<A>ztest=0--<A><A>--0c s �j �d� �S )Nr{ )r �
replaceTagr �ry r r r r& � r+ z<D>)r )r r rl �ZeroDivisionErrorrn r r} r r r~ r �$testSubstRec_DontTouchUnusedCallable� s �z6CommandActionTest.testSubstRec_DontTouchUnusedCallablec C s� dddd�}| � | j�d|�d� | � | j�d|�d� | � | j�d |�d
� | � | j�d d d
i�d� | � | j�ddd
i�d� | � | j�dddi�d� d|d< | � | j�d |�d� | � | j�dtdd� d��d � d S ) Nr �123�890r z Text<br>textz Text
textzText <HOST> textzText 192.0.2.0 textzText <xyz> text <ABC> ABCzText 890 text 123 ABCz <matches>�matchesz$some >char< should \< be[ escap}ed&
z,some \>char\< should \\\< be\[ escap\}ed\&\nz <ipmatches>� ipmatchesz<ipjailmatches>�
ipjailmatchesz%some >char< should \< be[ escap}ed&
z.some \>char\< should \\\< be\[ escap\}ed\&\r\nz<xyz>r! zText 890 text 890 ABCz09 <matches> 11c S � t d�S �N�
��strr r r r r& � rz z2CommandActionTest.testReplaceTag.<locals>.<lambda>�r� z09 10 11�rn r r} r ro r r r �testReplaceTag� sZ � � � ������� � ��z CommandActionTest.testReplaceTagc C s$ | � | j�dtdd� d��d� d S )N�abcc S r� �N�aru r r r r r& � rz z4CommandActionTest.testReplaceNoTag.<locals>.<lambda>r� r� r r r r �testReplaceNoTag� s ��z"CommandActionTest.testReplaceNoTagc s� t � jdd� t � jdd� t � jdd� t � jdd� t � jd d
� t � jd d � � �td
� fdd�� t� jd� � �td� fdd�� d S )Nr� z<a�bzc>zb?family=inet6zb>�ac�<a><b>�abz<ac>zx?family=inet6r0 z/properties contain self referencing definitionsc � � j jd� j jdd�S )Nr� � family=inet4�� conditional�r r} � _propertiesr r r r r& � � �z?CommandActionTest.testReplaceTagSelfRecursion.<locals>.<lambda>z.possible self referencing definitions in queryc r� )NzZ<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x<x>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>� family=inet6r� r� r r r r r& � r� )�setattrr �assertRaisesRegexrm �delattrr r r r �testReplaceTagSelfRecursion� s
�
�z-CommandActionTest.testReplaceTagSelfRecursionc C sp t | jdd� t | jdd� t | jdd� t | jdd� t | jd d
� | jj}td �D ]2}| �| jjd | jjd
|d�d� | �| jjd | jjd|d�d� | �| jjd | jjd|d�d� q+| �t|�dk� t | jdd� | �t|�d� td �D ]2}| �| jjd | jjd
|d�d� | �| jjd | jjd|d�d� | �| jjd | jjd|d�d� qz| �t|�dk� d S )Nr� r� zabc?family=inet4�345zabc?family=inet6�567r" z 890-<abc>� banactionzText <xyz> text <abc>r z<banaction> '<abc>'r0 )r� �cachezText 890-123 text 123 '123'r� zText 890-345 text 345 '345'r� zText 890-567 text 567 '567'� z 000-<abc>r zText 000-123 text 123 '123'zText 000-345 text 345 '345'zText 000-567 text 567 '567') r� r � _substCache�rangern r} r� �
assertTrue�len)r r� rw r r r � testReplaceTagConditionalCached s` ������ ������z1CommandActionTest.testReplaceTagConditionalCachedc C s� |d7 }d| | j _| j j| j _| �| j jd| � d| | j _| �| j jd| � d| j _| �| j jd� d| | j _| �| j jd| � d| j _| �| j jd� | �� | � d� | j �
dd i� | � d � | � d
� | j � � | � | j j� d S ) N�/fail2ban.test�
touch '%s'�
rm -f '%s'zecho -n� [ -e '%s' ]�true�returned�ip�Invariant check failedzreturned successfully)
r r@ � actionrepairrn �
actionstop� actionban� actioncheck� actionunban�pruneLog�assertNotLogged�ban� assertLoggedr �r �tmpr r r �testExecuteActionBan, s&
z&CommandActionTest.testExecuteActionBanc C s� d| j _d| j _d| j _d| j _| j �� | j �i � | �� | j �i � | j ddd� | j �i � | �d� | j �
� | j �i � | j � � | j ddd� | � d� d S ) Nr0 zecho -n 'flush'zecho -n 'stop'�
Nothing to doT��wait� [phase 2]r )
r r� r� � actionflushr� r r� r� �unbanr� �flushr r� r r r r �testExecuteActionEmptyUnbanE s
z-CommandActionTest.testExecuteActionEmptyUnbanc C sL |d7 }d| j _d| | j _d| | j _d| | j _| j �� | j �� d S )Nr� r ztouch '%s.<HOST>'zrm -f '%s.<HOST>'z[ -e '%s.192.0.2.0' ])r r r@ r� r� r �consistencyCheckr� r r r �testExecuteActionStartCtagsY s
z-CommandActionTest.testExecuteActionStartCtagsc C s� |d7 }d| j _d| | j _d| | j _d| | j _| �t| j jdd i� | jddd d
� | � d � d | | j _d| | j _d
| | j _d| | j _| j �dd i� | �d� | �
d� d S )Nr� r0 r� �rm '%s'r� r� r� � Unable to restore environmentT��allr� r� z printf "%%%%b
" <ip> >> '%s') r r@ r� r� r� rl � RuntimeErrorr� r� r� r� r� r r r �(testExecuteActionCheckRestoreEnvironmentc s
z:CommandActionTest.testExecuteActionCheckRestoreEnvironmentc C s� |d7 }d| j _d| j _d| | j _d| | j _d| | j _| j �dd i� | jddd d
� | �� d| j _| � t
| j jdd i� | jddd d d
� d S ) Nr� r0 r� r� z echo 'repair ...'; touch '%s'r� z Invariant check failed. Tryingzecho 'repair ...'Tr� r� ) r r@ r� r� r� r� r� r� r� rl r� r� r r r �'testExecuteActionCheckRepairEnvironmentv s
�z9CommandActionTest.testExecuteActionCheckRepairEnvironmentc C s. | � tt| jd� d| j_| �| jjd� d S )N�ROSTr )rl �AttributeError�getattrr r� rn r r r r � testExecuteActionChangeCtags� s z.CommandActionTest.testExecuteActionChangeCtagsc C sP t dddd� d��}d| j_d| j_| j�|� | j�|� | jdd d
d � d S ) Nr� � 192.0.2.1c S s dddd�S )N�o �� �tester)�fid�fport�userr r r r r r& � s �z?CommandActionTest.testExecuteActionUnbanAinfo.<locals>.<lambda>)r! r� zF-*zFecho '<ABC>, failure <F-ID> of <F-USER> -<F-TEST>- from <ip>:<F-PORT>'z$echo '<ABC>, user <F-USER> unbanned'z> -- stdout: '123, failure 111 of tester -- from 192.0.2.1:222'z' -- stdout: '123, user tester unbanned'Tr� )r r r� r� r� r� r� ro r r r �testExecuteActionUnbanAinfo� s �
�z-CommandActionTest.testExecuteActionUnbanAinfoc C s^ d| j _| j �� | �| j �d�� | �d� | �� | �| j �d�� | �d� | �� d S )Nr0 r� )r r@ r r� �
executeCmdr� r� � _processCmdr r r r �testExecuteActionStartEmpty� s
z-CommandActionTest.testExecuteActionStartEmptyc C s6 | � | jjddddd�d�� | jddd d
d d � d S )
NzUprintf %b "foreign input:\n -- $f2bV_A --\n -- $f2bV_B --\n -- $(echo -n $f2bV_C) --"z I'm a hacker; && $(echo $f2bV_B)zI"m very bad hackerz#`Very | very
$(bad & worst hacker)`)�f2bV_A�f2bV_B�f2bV_C)�varsDictzforeign input:z' -- I'm a hacker; && $(echo $f2bV_B) --z -- I"m very bad hacker --z* -- `Very | very $(bad & worst hacker)` --Tr� )r� r r� r� r r r r �testExecuteWithVars� s
��
�z%CommandActionTest.testExecuteWithVarsc C s� d| j _d| j _d| j _g d�}ddd�|�d�}| �� | j �|� | jd |d
|d g|�R d d
i� | jd|d
dd
d� | �� | j � |� | j �
� | jd|d
dd
d� d S )Nz3echo "** ban <ip>, reason: <reason> ...\n<matches>"zecho "** unban <ip>"zecho "** stop monitoring")z
<actionunban>z " Hooray! #z`I'm cool script kiddyz7`I`m very cool > /here-is-the-path/to/bin/.x-attempt.shz <actionstop>r� zAhacking attempt ( he thought he knows how f2b internally works ;)�
)r� �reasonr� z ** ban %sr� r� r� Tz ** unban %sz** stop monitoringr� ) r r� r� r� �joinr� r� r� r� r� r )r r� rp r r r � testExecuteReplaceEscapeWithVars� s4 � ����
�z2CommandActionTest.testExecuteReplaceEscapeWithVarsc C s t �d� | �d� d S )Nz+/bin/ls >/dev/null
bogusXXX now 2>/dev/nullz HINT on 127: "Command not found"�r r� r� r r r r �testExecuteIncorrectCmd� s
z)CommandActionTest.testExecuteIncorrectCmdc C sv t � � }tjjs
dnd}| �tjd|d�� | �t � � || ko)t � � || d k� | jdddd� | �dd � d S )
Nr
g{�G�z�?zsleep 30��timeoutz -- timed out afterTr� � -- killed with SIGTERM� -- killed with SIGKILL) �time�unittest�F2B�fast� assertFalser r� r� r� )r �stimer� r r r �testExecuteTimeout� s *�z$CommandActionTest.testExecuteTimeoutc sP t �dd��t�d��}|�d� � W d � n1 s w Y d���fdd�}�fdd ��t�� �| �tjd
� |d �� �� � | �t �
� fd d
�d�� | � dd� | � d� | � dd� t �
�d � t�� �| �tjd� |d �� �� � | �t �
� fdd
�d�� | � dd� | � d� | � dd� t �
�� t �
�d � d S )Nz.sh� fail2ban_�wzo#!/bin/bash
trap : HUP EXIT TERM
echo "$$" > %s.pid
echo "my pid $$ . sleeping lo-o-o-ong"
sleep 30
r c s � � d up t � � � dkS �Nrt )r� r )� getnastypidr� r r �
getnasty_tout� s
�zLCommandActionTest.testExecuteTimeoutWithNastyChildren.<locals>.getnasty_toutc sz d } t j�� d �r;t� d ��#}zt|�� �} W n ty" Y n w W d � | S W d � | S 1 s6w Y | S )N�.pid)�os�path�isfile�openrv �readrm )�cpid�f)� tmpFilenamer r r� � s ��
��
��zJCommandActionTest.testExecuteTimeoutWithNastyChildren.<locals>.getnastypidzbash %sr� c �
t � � S r| �r r �r r r r& �
zGCommandActionTest.testExecuteTimeoutWithNastyChildren.<locals>.<lambda>r� zmy pid z Resource temporarily unavailablez timed outzkilled with SIGTERMzkilled with SIGKILLr� zout=`bash %s`; echo ALRIGHTc r r| r r r r r r& r z
-- timed outr� r� )�tempfile�mktempr� �writer� r� r r� r� r �wait_forr� r� �unlink)r r r� r )r r� r� r r �#testExecuteTimeoutWithNastyChildren� sD � � �
��
�
z5CommandActionTest.testExecuteTimeoutWithNastyChildrenc C s, t �d� | �d� t �d� | �d� d S )Nzecho "How now brown cow"z stdout: 'How now brown cow'
z7echo "The rain in Spain stays mainly in the plain" 1>&2z6stderr: 'The rain in Spain stays mainly in the plain'
r� r r r r �testCaptureStdOutErr& s
��z&CommandActionTest.testCaptureStdOutErrc C s> t dd� dd� ddd�}| �d| d� | �td d� |� d S )
Nc S r� r� r� r r r r r& / rz z2CommandActionTest.testCallingMap.<locals>.<lambda>c S r� r� ru r r r r r& / rz �string� )�callme�error�
dontcallme�numberz)%(callme)s okay %(dontcallme)s %(number)iz10 okay string 17c S s d| S )Nz %(error)ir )�xr r r r& 7 rz )r rn rl rm )r �mymapr r r �testCallingMap. s ��z CommandActionTest.testCallingMapc C sT t dd� dd� dd��}|�� d|d< |d= | �t|�d � | �d|� | �|d |d
fd � |�� t|�}| �t|�d � | �d|� | �|d |d
|d fd
� d|d< |�� }dd� |d< d|d< |d
= |d= | �d
|v � | �d|v � | � d
|v � | � d|v � | �|d |d
|d |d fd� | �|d |d fd� d S )Nc S rr r� r r r r r r& ; rs z8CommandActionTest.testCallingMapModify.<locals>.<lambda>c S � | d d S �Nr� � r r r r r r& < r' �test�r� r� �c� r� r r r� )r r� r� )rt � r �dddd�dc S r )Nr� � r r r r r r& Q r' r
)rt r r r )r
� )
r �resetrn r� � assertNotIn�repr�assertIn�copyr� r� )r �m�s�m2r r r �testCallingMapModify9 s8 � $ z&CommandActionTest.testCallingMapModifyc C s� t dd� dd� dd��}t|�}| �d|� | �d|� | �d|� |�d �}| �d
|� | �d |� | �d|� d d� |d
< |�d �}| �d
|� | �d |� | �d|� | �d|� d S )Nc S rr r� r r r r r r& ^ rs z5CommandActionTest.testCallingMapRep.<locals>.<lambda>c S r r r r r r r r& _ r' r0 r z'a': z'b': z'c': ''Tz'a': 5z'b': 11c S r )N�xxxr" r r r r r r& l r' r z'c': )r r& r% r' �_asrepr)r r) r* r r r �testCallingMapRep\ s& �
z#CommandActionTest.testCallingMapRepc C sR t t� �}d|_d|_|�� | jddd� d|_| jddd� d|_|�� d S )Ng-C ��6?TzActions: enter idle moder� r� FzActions: leave idle mode)r r � sleeptime�idler r� �activer� )r r� r r r �testActionsIdleModes s
z%CommandActionTest.testActionsIdleModeN) �__name__�
__module__� __qualname__r r rq r� r� r� r� r� r
r� r� r� r� r� r� r� r� r� r� r� r� r
r r r, r/ r3 r r r r r ( s> e ()
= # r )�
__author__�
__copyright__� __license__r� r r� r� �
server.actionr r r �server.actionsr r � server.utilsr � dummyjailr �utilsr r
r r r r r r �<module> s