o ;s*bMi@sdZdZdZddlZddlZddlZddlmZddlm Z ddl m Z m Z d d l mZmZmZdd lmZed ZGd ddeZe dZGdddejZdS)z Cyril Jaquierz Copyright (c) 2004 Cyril JaquierGPLN) DateDetector) datedetector)DatePatternRegex DateTemplate) setUpMyTimetearDownMyTimeLogCaptureTestCase) getLoggerfail2banc@seZdZddZddZeddZddZd d Zd d Z d dZ ddZ ddZ ddZ ddZddZddZddZddZdd Zd!S)"DateDetectorTestcCst|td|_dSzCall before every test case.N)r setUpr _DateDetectorTest__datedetectorselfrE/usr/lib/python3/dist-packages/fail2ban/tests/datedetectortestcase.pyr*s  zDateDetectorTest.setUpcCst|tdSzCall after every test case.N)r tearDownr rrrrr0s  zDateDetectorTest.tearDowncCs"|jdurt|_|j|jS)N)rraddDefaultTemplaterrrrr5s  zDateDetectorTest.datedetectorcCst|_|jddD];}dD]6}||}|d}|j|}||d|f|\}}|t|||| dt |t |dfqq dD]}dD]}||}|d}|j|}| |qNqJdS) NEPOCHiCClo&%s[%s]z[%s.555]zaudit(%s.555:101)* [sshd] error: PAM: Authentication failureParse epoch time for %s failedrz.555) 1234567899999999999999999 1138049999A A1138049999) rrappendTemplatergetTime assertTrue assertEqualintassertIngroupstr assertFalse)rdateUnixdatelogdatelogmatchlogrrrtestGetEpochTime<s(  $   z!DateDetectorTest.testGetEpochTimecCst|_|jddD]>}dD]9}dD]4}||}||}|d}|j|}||d|f|\}}|t||||dt |qqq dD]}d D]}||}|d}|j|}| |qQqMdS) NLEPOCHrii@Br)rrrz audit(%s:101)rrr)r 999999999999999999r"r#r rrr$rr%r&r'r(r*r+r,)rfactr-r.dateLongr/r0r1rrrtestGetEpochMsTimeQs.     z#DateDetectorTest.testGetEpochMsTimecCst|_|jddD]5}dD]0}||}d|}|j|}||d|f|\}}|t||||dt |qq dD]}||}|j|}| |qDdS)Nz(?<=\|\s){LEPOCH}(?=\s\|)r4rz"auth-error | %s | invalid passwordzParse epoch time failed: %rr)z test%s123ztest-right | %stestztest%s | test-leftr6)rr7r-r8r/r0r1rrrtestGetEpochPatternhs"     z$DateDetectorTest.testGetEpochPatterncCs:d}d}|j|\}}|||||dddS)Nz9Jan 23 21:59:59 [sshd] error: PAM: Authentication failure}ArJan 23 21:59:59)rr%r'r*)rr/r-r0r1rrr testGetTime{s  zDateDetectorTest.testGetTimec Cs~t}|dtj}d}|ddddd}d||dddd dfd ||fd ||dddd d fd||dddddfd||dddddfd||dddddfd||dddddfd||dddddfd||dddddfd||dddddfd||dddddfd||dddddfd||dddd d fd|d|fd |d|fd |d|fd|d|fd |d|dddddfd|d|dddddfd |d|dddd dfd|d!|dddd dfd|d"|fd|d#|dddddfd|d$|dddddfd|d%|dddd d ffD]+\}}}td&||||_||\}} ||} || |d'| ||||jfq| t t |d(d)d|_dS)*Nz#^%ExY-%Exm-%Exd %H:%M:%S(?: ?%Exz)?z2017-01-23 15:00:00irrzUTC+0300 UTCzUTC-0430zGMT+12CETz+0100zCEST-01CEST z+0200zCET+01zCET+0100zCET+0130z GMTz -1045-z -10:45z +0945z +09:45z Zz CETz CESTz CET+0130z== test %r with TZ %rz3wrong offset %r != %r by %r with default TZ %r (%r) default_tzzWRONG-TZ) rr$datetimelogSysdebugrLr%utcfromtimestampr' assertRaises ValueErrorsetattr) rdddtlogdtdtUTCtzr/desiredr0_valrrrtestDefaultTimeZonesN         z$DateDetectorTest.testDefaultTimeZonec Csd}dD]\}}}}|dur|dkr|}td||||f|dudf| dfdfD]\}}||d }|s;|d kr;q*td |||j|} |rr|| dd ||||f| \} } || |d ||| |f|| d|n || dd||| f|j|\} } }|j||} td| r| jnd|r|| dd ||||f| \} } || |d||| |f|| d|n || dd||| ftdq*qdS)zKTest detection of various common date/time formats f2b should understand r;)")FTr<N)FFzSun Jan 23 21:59:59 2005N)FFzSun Jan 23 21:59:59N)FFzSun Jan 23 2005 21:59:59N)FTz2005/01/23 21:59:59N)FTz2005.01.23 21:59:59N)FTz23/01/2005 21:59:59N)FTz23/01/05 21:59:59N)FTz23/Jan/2005:21:59:59N)FTz23/Jan/2005:21:59:59 +0100N)FTz01/23/2005:21:59:59NFTz2005-01-23 21:59:59N)FTz2005-01-23 21:59:59,000N)FTz23-Jan-2005 21:59:59N)FTz23-Jan-2005 21:59:59.02N)FTz23-Jan-2005 21:59:59 +0100N)FTz23-01-2005 21:59:59NTT 1106513999N)FTz01-23-2005 21:59:59.252N)FFz@4000000041f4104f00000000N)FTz2005-01-23T20:59:59.252ZN)FTz2005-01-23T15:59:59-05:00Nr])FT20050123T215959N)FTz20050123 215959N)TTz<01/23/05@21:59:59>N)FTz050123 21:59:59N)TTzJan-23-05 21:59:59N)FTzJan 23, 2005 9:59:59 PMNr^)TT1106513999.000N)TTz[1106513999.000]ra)FTzaudit(1106513999.000:987)ra)TT no date lineNNrbz == test %rz bogus-prefix )F word-boundaryz)[sshd] error: PAM: Authentication failurerdz -- test %-5s for %rzMgetTime retrieved nothing: failure for %s by prefix %r, anchored: %r, log: %sz@getTime comparison failure for %s: by prefix %r "%s" is not "%s"rz;getTime should have not matched for %r by prefix %r Got: %sz -- found - %rFz@getTime comparison failure for %s by prefix %r: "%s" is not "%s"z -- OK) rNrOrr%assertNotEqualr'r* matchTimename)rr-anchoredboundsdaterdate should_matchprefixr/logtimelogUnixlogMatch timeMatchtemplaterfrrrtestVariousTimessT$      z!DateDetectorTest.testVariousTimescCs|t|jj|jjddS)Nr)rQrRrr$ templatesrrrrtestAllUniqueTemplateNames s  z+DateDetectorTest.testAllUniqueTemplateNamesc Csttdddddd}|jd}||d|\}}|||||dd t dD]}|jd \}}|||||dd q2|jd\}}|||||dd dS) Ni r%z#2012/10/11 02:37:17 [error] 18434#0rz2012/10/11 02:37:17z#11/10/2012 02:37:17 [error] 18434#0z11/10/2012 02:37:17) timemktimerM timetuplerr%rer'r*range)rmulogdatelogTimerpirrrtestFullYearMatch_gh130s      z(DateDetectorTest.testFullYearMatch_gh130cCst}|d||jd|t|jd||dddt }d|_ | d|jvd}||d |d d||||d|d }| ||t }d |_ | d |jvd }| |d || ||d ||d|dd||||d|d}| ||t }d|_ | d|jvd}|||d|d}|||d|d}|||d|dS)Nz ^a{3,5}b?c*$z^(a{3,5}b?c*)$rcaaaacrz'(?iu)**time:%ExY%Exm%ExdT%ExH%ExM%ExS**z**zTIME:20050102T010203XzTIME:50050102T010203z'{^LN-BEG}time:%ExY%Exm%ExdT%ExH%ExM%ExS^ztime:20050102T010203z##z...z ^%Y %b %dz(?iu)z 2005 jun 03z 2005 Jun 03z 2005 JUN 03) rsetRegexr'regexrQ ExceptiongetDate matchDater*rpatternr,r&)rtrUrrrtestDateTemplate#s:    z!DateDetectorTest.testDateTemplatecCs`dD]+}t}||dD]}dD]}|||}||d|dfd|fqqqdS)N)z%H:%M:%Sz {UNB}%H:%M:%S)z%s testz%8s testztest %sztest %8s) 00:01:0200:01:200:1:20:1:2rrrrrrrggA)rr$r%r'r*)rdprTfmtrUrrrrtestNotAnchoredCollisionMs  "z)DateDetectorTest.testNotAnchoredCollisioncCsp|j}dD]0\}}}td|||ft|D]}td|||\}}||||d|qqdS)N))z030324 0:03:59z9some free text 030324 0:03:59 -- 2003-03-07 17:05:01 ...r)z2003-03-07 17:05:01z+some free text 2003-03-07 17:05:01 test ...r?)z030324 0:04:00z{server mysqld[1000]: 030324 0:04:00 [Warning] Access denied ... foreign-input just some free text 2003-03-07 17:05:01 testrv)zSep 16 21:30:26z[server mysqld[1020]: Sep 16 21:30:26 server mysqld: 030916 21:30:26 [Warning] Access deniedr?)z2005-10-07 06:09:42zEserver mysqld[5906]: 2005-10-07 06:09:42 5907 [Warning] Access denied)z2005-10-08T15:26:18.237955zFserver mysqld[5906]: 2005-10-08T15:26:18.237955 6 [Note] Access deniedr)z051009 10:05:30z@server mysqld[1000]: 051009 10:05:30 [Warning] Access denied ...2 == test: %rzLine: %sr)rrNrOr}rfr&r'r*)rrTdebitlinecntrmatchrrrrrtestAmbiguousInOrderedTemplatesbs   z0DateDetectorTest.testAmbiguousInOrderedTemplatescCszKtj|_tjtdkrtdt_|j}d}dD](\}}t|||dD]}td|||f|||\}}||q)qW|jt_dS|jt_w)Nrr))Gserver mysqld[5906]: 2005-10-07 06:09:%02i 5907 [Warning] Access deniedr)zCserver mysqld[5906]: 051007 06:10:%02i 5907 [Warning] Access deniedrK)rrvr) rlogLevel _DateDetectorTest__old_eff_levelrNgetEffectiveLevelr}rOrfr&)rrTrrrrrrrrrtestLowLevelLogging{s   z$DateDetectorTest.testLowLevelLoggingcCsBtd}|t|jd|d|jt}|t|jddS)Nz (%ExY%Exm%Exdz (20050101zCompile %r failedrb)rrQrr assertLoggedrgrr)rrrrrtestWrongTemplates z"DateDetectorTest.testWrongTemplateN)__name__ __module__ __qualname__rrpropertyrr2r9r:r=r\rsrurrrrrrrrrrr(s$  1T* rz%Y-%m-%d[T ]%H:%M:%S(?:\.%f)?%zc@s4eZdZddZddZddZddZd d Zd S) CustomDateFormatsTestcCtj|tdSr)unittestTestCaserr rrrrr  zCustomDateFormatsTest.setUpcCrr)rrrr rrrrrrzCustomDateFormatsTest.tearDownc Cs\tjtdd}||tddddd|ttjd|ttj||tdd|tdd|td d|td dtjtd d}||tdddd dtjtd d}||tdddd dtjtdd}||tdddddtjtdd}||tddddddS)Nz2007-01-25T12:00:00Zrirr@rcZz2007-01-01T120:00:00Zz2007-13-01T12:00:00Zz2007-01-25T12:00:00+0400z2007-01-25T12:00:00+04:00z2007-01-25T12:00:00-0400z2007-01-25T12:00:00-04)rMrPiso8601rr'rQ TypeError)rr.rrr testIso8601sR     z!CustomDateFormatsTest.testIso8601cCst}|dD]I\}}}td|||f|dur|}nt}||||}|rL||t|trC| ||d dq | ||dq | |dq dS)N)&)r<Nz*Test failure Jan 23 21:59:59 for 192.0.2.1)FNz7Test failure TestJan 23 21:59:59.011 2015 for 192.0.2.1)FNz3Test failure Jan 23 21:59:59123456789 for 192.0.2.1)Aug 8 11:25:50Nz@Aug 8 11:25:50 20030f2329b8 Authentication failed from 192.0.2.1)rNzB[Aug 8 11:25:50] 20030f2329b8 Authentication failed from 192.0.2.1)zAug 8 11:25:50 2014NzEAug 8 11:25:50 2014 20030f2329b8 Authentication failed from 192.0.2.1)20:00:00 01.02.2003z%H:%M:%S %d.%m.%Y$z 192.0.2.1 at 20:00:00 01.02.2003)[20:00:00 01.02.2003]\[%H:%M:%S %d.%m.%Y\]192.0.2.1[20:00:00 01.02.2003])rr[20:00:00 01.02.2003]192.0.2.1)rz\[%H:%M:%S %d.%m.%Y\]$r)rz^\[%H:%M:%S %d.%m.%Y\]r)[17/Jun/2011 17:00:45]z^\[%d/%b/%Y %H:%M:%S\]z4[17/Jun/2011 17:00:45] Attempt, IP address 192.0.2.1)r\[%d/%b/%Y %H:%M:%S\]z3Attempt [17/Jun/2011 17:00:45] IP address 192.0.2.1)rrz:Attempt IP address 192.0.2.1, date: [17/Jun/2011 17:00:45])F%H:%M:%S %d.%m.%Y192.0.2.1x20:00:00 01.02.2003)Fr20:00:00 01.02.2003x192.0.2.1)r**%H:%M:%S %d.%m.%Y**r)rrr)z*20:00:00 01.02.2003*z\**%H:%M:%S %d.%m.%Y\**ztest*20:00:00 01.02.2003*test)rrz192.0.2.1 20:00:00 01.02.2003)rrz20:00:00 01.02.2003 192.0.2.1)Nz%Y-%Exm-%Exd %ExH:%ExM:%ExS)0000-12-30 00:00:00 - 2003-12-30 00:00:00)2003-12-30 00:00:00z%ExY-%Exm-%Exd %ExH:%ExM:%ExSr)rNr)z 200333 010203z %Y%m%d %H%M%S)text:200333 010203 | date:20031230 010203)20031230 010203%ExY%Exm%Exd %ExH%ExM%ExSr)rNr)z20030101 000000r!00001230 010203 - 20030101 000000)N"{^LN-BEG}%ExY%Exm%Exd %ExH%ExM%ExSr)rrz!20031230 010203 - 20030101 000000)20031230010203#{^LN-BEG}%ExY%Exm%Exd%ExH%ExM%ExS**2003123001020320030101000000)rrz#2003123001020320030101000000)rrz##2003123001020320030101000000)rz!{^LN-BEG}%ExY%Exm%Exd%ExH%ExM%ExSz[20031230010203]20030101000000)=`A.{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %z)? [2003-12-30 01:02:03] server ...)r.{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %Z)?r)EgAr$[2003-12-30 01:02:03 UTC] server ...)rrrrrr) rrrNrOr$r%r& isinstancer+r'r*)rdefDDmatchedrrrTr.rrrtestAmbiguousDatePatterns ;    z.CustomDateFormatsTest.testAmbiguousDatePatterncCsdD]B\}}}td|||ft}||||}|r>||t|tr5|||d dq|||dq||dqdS)N))g?|Az^%B %Exd %I:%ExM:%ExS**zJanuary 23 12:59:59)g'\Az^%y %U %A %ExH:%ExM:%ExS**01 11 Wednesday 21:59:59)gWAz^%y %W %A %ExH:%ExM:%ExS**r)gZA^%y %W %w %ExH:%ExM:%ExS**z01 11 0 21:59:59)g'YArz01 11 6 21:59:59)gOA^%ExH:%ExM:%ExS**z21:59:59)g@XArz00:00:01)gMAz^%m/%d %ExH:%ExM:%ExS**z09/01 21:59:59rrr) rNrOrr$r%r&rr+r'r*)rrrrrTr.rrrtestVariousFormatSpecss    z,CustomDateFormatsTest.testVariousFormatSpecsN)rrrrrrrrrrrrrs # Nr) __author__ __copyright__ __license__rrzrMserver.datedetectorrserverrserver.datetemplaterrutilsr r r helpersr rNrrrrrrrrs"   s