|
Server : Apache System : Linux iad1-shared-b8-43 6.6.49-grsec-jammy+ #10 SMP Thu Sep 12 23:23:08 UTC 2024 x86_64 User : dh_edsupp ( 6597262) PHP Version : 8.2.26 Disable Function : NONE Directory : /lib/python3/dist-packages/fail2ban/tests/__pycache__/ |
Upload File : |
o
� �_bT � @ s� d Z dZdZddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
dd lmZmZmZmZ dd
lmZ ee_d d � Zee_ ej�ej�e�d
�Zej�ej�e�d�Zdadd� Z dd� Z G dd� de �Z dd� Z dZ!dZ"dZ#dZ$dZ%ej�ed �Z&ej�ed �Z'ej�ed �Z(d Z)d Z*d!Z+ej�ed"d#�Z,ej�ed$d%�Z-ej�ed&�Z.ej�ed$d'�Z/ej�ed"d(�Z0ej�ed$d)�Z1G d*d+� d+e�Z2dS ),z Serg BresterzHCopyright (c) 2015 Serg G. Brester (sebres), 2008- Fail2Ban Contributors�GPL� N� )�
fail2banregex)�
Fail2banRegex�get_opt_parser�exec_command_line�output� str2LogLevel� )� setUpMyTime�tearDownMyTime�LogCaptureTestCase�logSys)�
CONFIG_DIRc G s t �| d � d S )Nr )r �notice)�args� r �F/usr/lib/python3/dist-packages/fail2ban/tests/fail2banregextestcase.py� _test_output% s r �config�filesc G s@ t � }|�t| ��\}} |jdv rt�t|j�� || t|�fS )N)r �warning)r �
parse_args�list� log_levelr �setLevelr r )r �parser�optsr r r �_Fail2banRegex/ s
r c G s t | � \}} }|�| �S �N)r �start)r r �
fail2banRegexr r r �
_test_exec7 s
r" c @ s e Zd Zdd� ZdS )�
ExitExceptionc C s || _ d| | _d S )NzExit with code: %s)�code�msg)�selfr$ r r r �__init__< s zExitException.__init__N)�__name__�
__module__� __qualname__r' r r r r r# ; s r# c
G s� d dd�}t jt jt jd�}d}|t _tsttjd�at t _t _zBztt | �� W n t
y? } z |j }W Y d }~nd }~ww W |d t _|d t _|d t _|S W |d t _|d t _|d t _|S |d t _|d t _|d t _w )
Nr c S s t | ��r )r# )r$ r r r �_exitA s z&_test_exec_command_line.<locals>._exit)�exit�stdout�stderr�wr, r- r. )r ) �sysr, r- r. �DEV_NULL�open�os�devnullr r r# r$ )r r+ �_org�
_exit_code�er r r �_test_exec_command_line@ s2
���
�
�
r8 zRDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.0zB[sshd] error: PAM: Authentication failure for kevin from 192.0.2.0z�(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>z8Authentication failure for <F-ID>.*?</F-ID> from <ADDR>$z<Authentication failure for <F-USER>.*?</F-USER> from <ADDR>$ztestcase01.logztestcase02.logztestcase-wrong-char.loga" Nov 28 09:16:03 srv sshd[32307]: Failed publickey for git from 192.0.2.1 port 57904 ssh2: ECDSA 0e:ff:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:03 srv sshd[32307]: Failed publickey for git from 192.0.2.1 port 57904 ssh2: RSA 04:bc:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:03 srv sshd[32307]: Postponed publickey for git from 192.0.2.1 port 57904 ssh2 [preauth]
Nov 28 09:16:05 srv sshd[32310]: Failed publickey for git from 192.0.2.2 port 57910 ssh2: ECDSA 1e:fe:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:05 srv sshd[32310]: Failed publickey for git from 192.0.2.2 port 57910 ssh2: RSA 14:ba:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:05 srv sshd[32310]: Disconnecting: Too many authentication failures for git [preauth]
Nov 28 09:16:05 srv sshd[32310]: Connection closed by 192.0.2.2 [preauth]z�Nov 28 09:16:06 srv sshd[32307]: Accepted publickey for git from 192.0.2.1 port 57904 ssh2: DSA 36:48:xx:xx:xx:xx:xx:xx:xx:xx:xx:...zINov 28 09:16:06 srv sshd[32307]: Connection closed by 192.0.2.1 [preauth]�logs�sshdzfilter.dz sshd.confz zzz-sshd-obsolete-multiline.logz zzz-sshd-obsolete-multiline.confzzzz-generic-examplezzzz-generic-example.confc @ s e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCS )D�Fail2banRegexTestc C � t �| � t� dS )z Call before every test case.N)r
�setUpr �r& r r r r= y �
zFail2banRegexTest.setUpc C r< )zCall after every test case.N)r
�tearDownr r> r r r r@ ~ r? zFail2banRegexTest.tearDownc C s | � tdd�� | �d� d S )N�testz.** from <HOST>$�$Unable to compile regular expression�� assertFalser" � assertLoggedr> r r r � testWrongRE� s �z Fail2banRegexTest.testWrongREc C s$ | � tddddd�� | �d� d S )N�
--datepattern�{^LN-BEG}EPOCHrA z.*? from <HOST>$z.**rB rC r> r r r �testWrongIngnoreRE� s
�z$Fail2banRegexTest.testWrongIngnoreREc C s& | � tddddtd�� | �d� d S )NrG �*^(?:%a )?%b %d %H:%M:%S(?:\.%f)?(?: %ExY)?�--print-all-matched�--print-no-missed�+Authentication failure for .*? from <HOST>$�.Lines: 1 lines, 0 ignored, 1 matched, 0 missed��
assertTruer" �STR_00rE r> r r r �testDirectFound� s �z!Fail2banRegexTest.testDirectFoundc C s | � tdtd�� | �d� d S )N�--print-all-missedzXYZ from <HOST>$z.Lines: 1 lines, 0 ignored, 0 matched, 1 missedrO r> r r r �testDirectNotFound� s �z$Fail2banRegexTest.testDirectNotFoundc C s" | � tdtdd�� | �d� d S )N�--print-all-ignoredrM zkevin from 192.0.2.0$z.Lines: 1 lines, 1 ignored, 0 matched, 0 missedrO r> r r r �testDirectIgnored� s �z#Fail2banRegexTest.testDirectIgnoredc C sL | � tdddtt�� | �d� | �d� | �d� | �d� | �d� d S ) NrG rJ rK �0Lines: 19 lines, 0 ignored, 16 matched, 3 missed�Error decoding linez6Continuing to process line ignoring invalid characterszVDez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128zVDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�rP r" � FILENAME_01�RE_00rE r> r r r �testDirectRE_1� s �
z Fail2banRegexTest.testDirectRE_1c C s& | � tddddtt�� | �d� d S )NrG rJ rK �--rawz0Lines: 19 lines, 0 ignored, 19 matched, 0 missedrY r> r r r �testDirectRE_1raw� s �z#Fail2banRegexTest.testDirectRE_1rawc
C s\ | � tdddddtt�� | �d� | �� | � tddd d
�� | jd d d
� | �d� d S )NrG rJ rK r] z --usedns=norW �-d�^Epochz 1490349000 test failed.dns.chz^\s*test <F-ID>\S+</F-ID>rN T��allz)Unable to find a corresponding IP address)rP r" rZ r[ rE �pruneLog�assertNotLoggedr> r r r �testDirectRE_1raw_noDns� s �
�z)Fail2banRegexTest.testDirectRE_1raw_noDnsc C s$ | � tdddtt�� | �d� d S )NrG rJ rK �/Lines: 13 lines, 0 ignored, 5 matched, 8 missed�rP r" � FILENAME_02r[ rE r> r r r �testDirectRE_2� s �z Fail2banRegexTest.testDirectRE_2c C s@ | � tdddddddtt� � | �d� | �d � | �d
� d S ) NrG rJ z
--timezonezUTC+0200z --verbose�--verbose-daterL rf z&141.3.81.106 Sun Aug 14 11:53:59 2005z&141.3.81.106 Sun Aug 14 11:54:59 2005rg r> r r r � testVerbose� s �
z Fail2banRegexTest.testVerbosec
C sv | � tdddddddttd�
� | jd d
d d � | �� | � tddd
dtdd�� | jddd d � | jddd d � d S )N�-lr �-vrj rK rU �-cr: �8[29116]: User root not allowed because account is lockedz)[29116]: Received disconnect from 1.2.3.4Tra �-vvzRDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.1zsshd[logtype=short]zReal filter options :z'logtype': 'short'�'logtype': 'file'�'logtype': 'journal')rP r" r �
FILENAME_SSHDrE rc rd r> r r r �testVerboseFullSshd� s$ ���z%Fail2banRegexTest.testVerboseFullSshdc
C s0 | � tddddttd�� | jdddd d
� d S ) Nrl r rK rn zsshd.conf[mode=normal]z"[29116]: Connection from 192.0.2.4ro �+[29116]: Received disconnect from 192.0.2.4Tra )rP r" r �FILENAME_ZZZ_SSHDrE r> r r r � testFastSshd� s �
�z Fail2banRegexTest.testFastSshdc
C s> | � tdddddtj�t�ttj�t��� | jddd� d S ) Nrl r rK rS rn ru Tra ) rP r" r3 �path�dirname�FILTER_ZZZ_SSHDrv �basenamerE r> r r r �testMultilineSshd s �
�z#Fail2banRegexTest.testMultilineSshdc C s | � tddttd �� d S )Nrl r z [mode=test])rP r" �FILENAME_ZZZ_GEN�FILTER_ZZZ_GENr> r r r �testFullGeneric s
�z!Fail2banRegexTest.testFullGenericc
C sl dD ]1}| � d| � | �tddddddd d
| d d � � | �d
|d |d f � | jdddd� qd S )N)r � z[test-phase %s]�--usedns�nor_ r` rK �
--maxlines�5z1490349000 TEST-NL
�L1490349000 FAIL
1490349000 TEST1
1490349001 TEST2
1490349001 HOST 192.0.2.34�*^\s*FAIL\s*$<SKIPLINES>^\s*HOST <HOST>\s*$z0Lines: %s lines, 0 ignored, 2 matched, %s missed� r z| 1490349000 FAILz | 1490349001 HOST 192.0.2.34Tra )rc rP r" rE )r& �preLinesr r r �testDirectMultilineBuf s ���z(Fail2banRegexTest.testDirectMultilineBufc
C s: | � tddddddddd d
�
� | �d � | �d d
� d S )Nr� r� r_ r` �
--debuggexrK r� r� r� r� �.Lines: 4 lines, 0 ignored, 2 matched, 2 missedz&flags=mz?flags=m�rP r" rE r> r r r � testDirectMultilineBufDebuggex) s �
z0Fail2banRegexTest.testDirectMultilineBufDebuggexc C s, | � tddddddddd � � | �d
� d S ) Nr� r� r_ r` rK z-L�2z)1490349000 FAIL: failure
host: 192.0.2.35z ^\s*FAIL:\s*.*\nhost:\s+<HOST>$z.Lines: 2 lines, 0 ignored, 2 matched, 0 missedr� r> r r r � testSinglelineWithNLinContent3 s
�z/Fail2banRegexTest.testSinglelineWithNLinContentc
C s( | � tddddddd�� | �d� d S ) Nz-rr_ �^\[{LEPOCH}\]\s+r� r� z�[1516469849] 192.0.2.1 FAIL: failure
[1516469849551] 192.0.2.2 FAIL: failure
[1516469849551000] 192.0.2.3 FAIL: failure
[1516469849551.000] 192.0.2.4 FAIL: failurez^<HOST> FAIL\b�.Lines: 4 lines, 0 ignored, 4 matched, 0 missedr� r> r r r �testRegexEpochPatterns< s
�z(Fail2banRegexTest.testRegexEpochPatternsc
C s8 | � tddddddd�� | �d� | jd d
d d � d S )
Nrp r_ r� r� r� z�[1516469849] 192.0.2.1 FAIL: failure
[1516469849] 192.0.2.1/24 FAIL: failure
[1516469849] 2001:DB8:FF:FF::1 FAIL: failure
[1516469849] 2001:DB8:FF:FF::1/60 FAIL: failure
z^<SUBNET> FAIL\br� z 192.0.2.0/24z2001:db8:ff:f0::/60Tra r� r> r r r �testRegexSubnetG s
�
z!Fail2banRegexTest.testRegexSubnetc C sh | � tddtt�� | �d� | �� | � tdddd�� | �td�� | �� | � tdddd�� | �� | � tddd d
�� | �td �� | �� | � tdd tt�� | jd
dddd� | �� | � tdd tt�� | jddddd� | �� | � tddtt�� | �t� | �� | � tddtt�� | �d� | �� | � tddtt�� | �d� | �� d S )N�-o�id�kevinz"1591983743.667 192.0.2.1 192.0.2.2z(^\s*<F-ID/> <F-TUPLE_ID>\S+</F-TUPLE_ID>)z 192.0.2.1� 192.0.2.2z#1591983743.667 left 192.0.2.3 rightzM^\s*<F-TUPLE_ID_1>\S+</F-TUPLE_ID_1> <F-ID/> <F-TUPLE_ID_2>\S+</F-TUPLE_ID_2>z+1591983743.667 left [192.0.2.4]:12345 rightzc^\s*<F-TUPLE_ID_1>\S+</F-TUPLE_ID_1> <F-ID><ADDR>:<F-PORT/></F-ID> <F-TUPLE_ID_2>\S+</F-TUPLE_ID_2>)z[192.0.2.4]:12345�left�right�rowz['kevin'z'ip4': '192.0.2.0'z'fid': 'kevin'Tra z ['192.0.2.0'z'user': 'kevin'r% �userz<ip>, <F-USER>, <family>z192.0.2.0, kevin, inet4)rP r" rQ �RE_00_IDrE rc �str�
RE_00_USERr> r r r �testFrmtOutputS sF
�
�
�
z Fail2banRegexTest.testFrmtOutputc C st | � tddddtt�� | jddddd � | �� | � tdd
ddtt�� | jddd � | jdddd � | �� d S ) Nr_ rH r� zFound-ID:<F-ID>z*Found a match but no valid date/time foundzMatch without a timestamp:zFound-ID:kevinTra z{NONE})rP r" � STR_00_NODTr� rE rc rd r> r r r �testNoDateTime~ s ��� z Fail2banRegexTest.testNoDateTimec C sp t jjdd� | �tdddtddtd t d �� t�d�}| �d
|d vo+d
|d v � | j d
|d d
|d dd� | �
d� | � d� | �tdddtddtd t d�� | j d
|d d
|d d
|d d
|d dd� | �
d� | � d� | �tdddtddtd t d�� t�d�dd� t �d�d d � }| j d|d d|d d|d dd� d S )NT��stockr� z<ip>, <F-USER>, <msg>rn r� r� �
z&sshd[logtype=short, publickey=invalid]r� ������z192.0.2.2, git, ra z192.0.2.1, git, zA[test-phase 1] mode=aggressive & publickey=nofail + OK (accepted)z$sshd[logtype=short, mode=aggressive]������zL[test-phase 2] mode=aggressive & publickey=nofail + FAIL (closed on preauth)r r )
�unittest�F2B�SkipIfCfgMissingrP r" r � STR_ML_SSHD�STR_ML_SSHD_OK�splitrE rd rc �STR_ML_SSHD_FAIL)r& �linesr r r �testFrmtOutputWrapML� sL
�
�
�
�
�$
�z&Fail2banRegexTest.testFrmtOutputWrapMLc C s | � ttt�� d S r )rD r" r} r> r r r �testWrongFilterFile� s
�z%Fail2banRegexTest.testWrongFilterFilec C s ddl m} |�� d S )Nr )�_decode_line_warn)�
server.filterr� �clear)r& r� r r r �_reset� s zFail2banRegexTest._resetc C sd t jjdd� | �� | �tddddtt�� | �d� | �d� | �d � | �d
� | �d � d S ) NTr� rl r rG rJ r� rX z7Continuing to process line ignoring invalid characters:zMNov 8 00:16:12 main sshd[32548]: input_userauth_request: invalid user llincozkNov 8 00:16:12 main sshd[32547]: pam_succeed_if(sshd:auth): error retrieving information about user llinco� r� r� r� r� rP r" �FILENAME_WRONGCHAR� FILTER_SSHDrE r> r r r � testWronChar� s �
z Fail2banRegexTest.testWronCharc C sV t jjdd� | �� | �tddddddttd � � | �d
� | �d � | �d � d S )
NTr� rl r rG rJ r� rK z llinco[^\\]rX z.Lines: 4 lines, 1 ignored, 2 matched, 1 missedzhttps://r� r> r r r �testWronCharDebuggex� s �
z&Fail2banRegexTest.testWronCharDebuggexc C sP | � t� d� | �� | �td�d� | �t�� � | �� | �td�d� d S )Nr z-Vz --version)�assertNotEqualr8 rc � assertEqualrE r � normVersionr> r r r �testExecCmdLine_Usage� s z'Fail2banRegexTest.testExecCmdLine_Usagec C �$ | � tddtd�d� | �d� d S )Nrl �inforM r rN )r� r8 rQ rE r> r r r �testExecCmdLine_Direct� � ��z(Fail2banRegexTest.testExecCmdLine_Directc C r� )Nrl r� zAuthentication failurer zNo failure-id group in )r� r8 rQ rE r> r r r �testExecCmdLine_MissFailID� r� z,Fail2banRegexTest.testExecCmdLine_MissFailIDc C sR | � tdddddd�d� | �d� | �� | � td dddd�d� | �d
� d S ) Nrl r r_ z%:%.%-�LOG�REr z ERROR: Failed to set datepatternrm zFailed to set datepattern)r� r8 rE rc r> r r r �testExecCmdLine_ErrorParam� s ��
��z,Fail2banRegexTest.testExecCmdLine_ErrorParamc C s� t jst�d��| �tdtd d �� | �d� | �d� | �d� | � � | �tdtd d d �� | �d� | �d� d S )
Nz.Skip test because no systemd backend availablezsystemd-journalz,[journalmatch="SYSLOG_IDENTIFIER=dummy",z; failregex="^ dummy regex, never match <F-ID>xxx</F-ID>"]rr rq z.Lines: 0 lines, 0 ignored, 0 matched, 0 missedz[logtype=file,z, journalmatch="SYSLOG_IDENTIFIER=dummy",)
r �
FilterSystemdr� �SkipTestrP r" r~ rE rd rc r> r r r �testLogtypeSystemdJournal
s0
���
����
z+Fail2banRegexTest.testLogtypeSystemdJournalN)$r( r) r* r= r@ rF rI rR rT rV r\ r^ re ri rk rt rw r| r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r; w sD
+-
r; )3�
__author__�
__copyright__� __license__r3 r0 r� �clientr �client.fail2banregexr r r r r �utilsr r r
r r r rx �joinry �__file__�TEST_CONFIG_DIR�TEST_FILES_DIRr1 r r" � Exceptionr# r8 rQ r� r[ r� r� rZ rh r� r� r� r� rs r� rv rz r} r~ r; r r r r �<module> sL