o _bT@sdZdZdZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z dd lmZmZmZmZdd lmZee_d d Zee_ ejejed ZejejedZdaddZddZGdddeZddZ dZ!dZ"dZ#dZ$dZ%ejedZ&ejedZ'ejedZ(dZ)d Z*d!Z+ejed"d#Z,ejed$d%Z-ejed&Z.ejed$d'Z/ejed"d(Z0ejed$d)Z1Gd*d+d+eZ2dS),z Serg BresterzHCopyright (c) 2015 Serg G. Brester (sebres), 2008- Fail2Ban ContributorsGPLN) fail2banregex) Fail2banRegexget_opt_parserexec_command_lineoutput str2LogLevel) setUpMyTimetearDownMyTimeLogCaptureTestCaselogSys) CONFIG_DIRcGst|ddS)Nr)rnotice)argsrF/usr/lib/python3/dist-packages/fail2ban/tests/fail2banregextestcase.py _test_output%srconfigfilescGs@t}|t|\}}|jdvrtt|j||t|fS)N)rwarning)r parse_argslist log_levelrsetLevelr r)rparseroptsrrr_Fail2banRegex/s  rcGst|\}}}||SN)rstart)rr fail2banRegexrrr _test_exec7s r"c@seZdZddZdS) ExitExceptioncCs||_d||_dS)NzExit with code: %s)codemsg)selfr$rrr__init__<szExitException.__init__N)__name__ __module__ __qualname__r'rrrrr#;s r#c Gsd dd}tjtjtjd}d}|t_tsttjdatt_t_zBztt |Wnt y?}z |j }WYd}~nd}~wwW|dt_|dt_|dt_|SW|dt_|dt_|dt_|S|dt_|dt_|dt_w) NrcSst|r)r#)r$rrr_exitAsz&_test_exec_command_line.._exit)exitstdoutstderrwr,r-r.)r) sysr,r-r.DEV_NULLopenosdevnullrrr#r$)rr+_org _exit_codeerrr_test_exec_command_line@s2          r8zRDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.0zB[sshd] error: PAM: Authentication failure for kevin from 192.0.2.0z(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) z8Authentication failure for .*? from $z.*? from $ztestcase01.logztestcase02.logztestcase-wrong-char.loga"Nov 28 09:16:03 srv sshd[32307]: Failed publickey for git from 192.0.2.1 port 57904 ssh2: ECDSA 0e:ff:xx:xx:xx:xx:xx:xx:xx:xx:xx:... Nov 28 09:16:03 srv sshd[32307]: Failed publickey for git from 192.0.2.1 port 57904 ssh2: RSA 04:bc:xx:xx:xx:xx:xx:xx:xx:xx:xx:... Nov 28 09:16:03 srv sshd[32307]: Postponed publickey for git from 192.0.2.1 port 57904 ssh2 [preauth] Nov 28 09:16:05 srv sshd[32310]: Failed publickey for git from 192.0.2.2 port 57910 ssh2: ECDSA 1e:fe:xx:xx:xx:xx:xx:xx:xx:xx:xx:... Nov 28 09:16:05 srv sshd[32310]: Failed publickey for git from 192.0.2.2 port 57910 ssh2: RSA 14:ba:xx:xx:xx:xx:xx:xx:xx:xx:xx:... Nov 28 09:16:05 srv sshd[32310]: Disconnecting: Too many authentication failures for git [preauth] Nov 28 09:16:05 srv sshd[32310]: Connection closed by 192.0.2.2 [preauth]zNov 28 09:16:06 srv sshd[32307]: Accepted publickey for git from 192.0.2.1 port 57904 ssh2: DSA 36:48:xx:xx:xx:xx:xx:xx:xx:xx:xx:...zINov 28 09:16:06 srv sshd[32307]: Connection closed by 192.0.2.1 [preauth]logssshdzfilter.dz sshd.confzzzz-sshd-obsolete-multiline.logz zzz-sshd-obsolete-multiline.confzzzz-generic-examplezzzz-generic-example.confc@seZdZddZddZddZddZd d Zd d Zd dZ ddZ ddZ ddZ ddZ ddZddZddZddZdd Zd!d"Zd#d$Zd%d&Zd'd(Zd)d*Zd+d,Zd-d.Zd/d0Zd1d2Zd3d4Zd5d6Zd7d8Zd9d:Zd;d<Z d=d>Z!d?d@Z"dAdBZ#dCS)DFail2banRegexTestcCt|tdS)zCall before every test case.N)r setUpr r&rrrr=y  zFail2banRegexTest.setUpcCr<)zCall after every test case.N)r tearDownr r>rrrr@~r?zFail2banRegexTest.tearDowncCs|tdd|ddS)Ntestz.** from $$Unable to compile regular expression assertFalser" assertLoggedr>rrr testWrongREszFail2banRegexTest.testWrongREcCs$|tddddd|ddS)N --datepattern{^LN-BEG}EPOCHrAz.*? from $z.**rBrCr>rrrtestWrongIngnoreREs z$Fail2banRegexTest.testWrongIngnoreREc Cs&|tddddtd|ddS)NrG*^(?:%a )?%b %d %H:%M:%S(?:\.%f)?(?: %ExY)?--print-all-matched--print-no-missed+Authentication failure for .*? from $.Lines: 1 lines, 0 ignored, 1 matched, 0 missed assertTruer"STR_00rEr>rrrtestDirectFoundsz!Fail2banRegexTest.testDirectFoundcCs |tdtd|ddS)N--print-all-missedzXYZ from $z.Lines: 1 lines, 0 ignored, 0 matched, 1 missedrOr>rrrtestDirectNotFounds z$Fail2banRegexTest.testDirectNotFoundcCs"|tdtdd|ddS)N--print-all-ignoredrMzkevin from 192.0.2.0$z.Lines: 1 lines, 1 ignored, 0 matched, 0 missedrOr>rrrtestDirectIgnoredsz#Fail2banRegexTest.testDirectIgnoredcCsL|tdddtt|d|d|d|d|ddS) NrGrJrK0Lines: 19 lines, 0 ignored, 16 matched, 3 missedError decoding linez6Continuing to process line ignoring invalid characterszVDez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128zVDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10rPr" FILENAME_01RE_00rEr>rrrtestDirectRE_1s    z Fail2banRegexTest.testDirectRE_1c Cs&|tddddtt|ddS)NrGrJrK--rawz0Lines: 19 lines, 0 ignored, 19 matched, 0 missedrYr>rrrtestDirectRE_1raws z#Fail2banRegexTest.testDirectRE_1rawc Cs\|tdddddtt|d||tddd d |jd d d |ddS)NrGrJrKr]z --usedns=norW-d^Epochz1490349000 test failed.dns.chz^\s*test \S+rNTallz)Unable to find a corresponding IP address)rPr"rZr[rEpruneLogassertNotLoggedr>rrrtestDirectRE_1raw_noDnss z)Fail2banRegexTest.testDirectRE_1raw_noDnscCs$|tdddtt|ddS)NrGrJrK/Lines: 13 lines, 0 ignored, 5 matched, 8 missedrPr" FILENAME_02r[rEr>rrrtestDirectRE_2s z Fail2banRegexTest.testDirectRE_2c Cs@|tdddddddtt |d|d |d dS) NrGrJz --timezonezUTC+0200z --verbose--verbose-daterLrfz&141.3.81.106 Sun Aug 14 11:53:59 2005z&141.3.81.106 Sun Aug 14 11:54:59 2005rgr>rrr testVerboses  zFail2banRegexTest.testVerbosec Csv|tdddddddttd |jd d d d ||tddd dtdd|jddd d |jddd d dS)N-lr-vrjrKrU-cr:8[29116]: User root not allowed because account is lockedz)[29116]: Received disconnect from 1.2.3.4Tra-vvzRDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.1zsshd[logtype=short]zReal filter options :z'logtype': 'short''logtype': 'file''logtype': 'journal')rPr"r FILENAME_SSHDrErcrdr>rrrtestVerboseFullSshds$z%Fail2banRegexTest.testVerboseFullSshdc Cs0|tddddttd|jdddd d dS) NrlrrKrnzsshd.conf[mode=normal]z"[29116]: Connection from 192.0.2.4ro+[29116]: Received disconnect from 192.0.2.4Tra)rPr"rFILENAME_ZZZ_SSHDrEr>rrr testFastSshds zFail2banRegexTest.testFastSshdc Cs>|tdddddtjtttjt|jddddS) NrlrrKrSrnruTra) rPr"r3pathdirnameFILTER_ZZZ_SSHDrvbasenamerEr>rrrtestMultilineSshds   z#Fail2banRegexTest.testMultilineSshdcCs|tddttddS)Nrlrz [mode=test])rPr"FILENAME_ZZZ_GENFILTER_ZZZ_GENr>rrrtestFullGenerics z!Fail2banRegexTest.testFullGenericc CsldD]1}|d||tddddddd d |d d |d |d|df|jddddqdS)N)rz[test-phase %s]--usednsnor_r`rK --maxlines5z1490349000 TEST-NL L1490349000 FAIL 1490349000 TEST1 1490349001 TEST2 1490349001 HOST 192.0.2.34*^\s*FAIL\s*$^\s*HOST \s*$z0Lines: %s lines, 0 ignored, 2 matched, %s missedrz| 1490349000 FAILz| 1490349001 HOST 192.0.2.34Tra)rcrPr"rE)r&preLinesrrrtestDirectMultilineBufsz(Fail2banRegexTest.testDirectMultilineBufc Cs:|tddddddddd d |d |d d dS)Nrrr_r` --debuggexrKrrrr.Lines: 4 lines, 0 ignored, 2 matched, 2 missedz&flags=mz?flags=mrPr"rEr>rrrtestDirectMultilineBufDebuggex)s z0Fail2banRegexTest.testDirectMultilineBufDebuggexc Cs,|tddddddddd |d dS) Nrrr_r`rKz-L2z)1490349000 FAIL: failure host: 192.0.2.35z^\s*FAIL:\s*.*\nhost:\s+$z.Lines: 2 lines, 0 ignored, 2 matched, 0 missedrr>rrrtestSinglelineWithNLinContent3s  z/Fail2banRegexTest.testSinglelineWithNLinContentc Cs(|tddddddd|ddS) Nz-rr_^\[{LEPOCH}\]\s+rrz[1516469849] 192.0.2.1 FAIL: failure [1516469849551] 192.0.2.2 FAIL: failure [1516469849551000] 192.0.2.3 FAIL: failure [1516469849551.000] 192.0.2.4 FAIL: failurez^ FAIL\b.Lines: 4 lines, 0 ignored, 4 matched, 0 missedrr>rrrtestRegexEpochPatterns<s  z(Fail2banRegexTest.testRegexEpochPatternsc Cs8|tddddddd|d|jd d d d dS) Nrpr_rrrz[1516469849] 192.0.2.1 FAIL: failure [1516469849] 192.0.2.1/24 FAIL: failure [1516469849] 2001:DB8:FF:FF::1 FAIL: failure [1516469849] 2001:DB8:FF:FF::1/60 FAIL: failure z^ FAIL\brz 192.0.2.0/24z2001:db8:ff:f0::/60Trarr>rrrtestRegexSubnetGs  z!Fail2banRegexTest.testRegexSubnetcCsh|tddtt|d||tdddd|td||tdddd||tddd d |td ||tdd tt|jd dddd||tdd tt|jddddd||tddtt|t||tddtt|d||tddtt|d|dS)N-oidkevinz"1591983743.667 192.0.2.1 192.0.2.2z(^\s* \S+)z 192.0.2.1 192.0.2.2z#1591983743.667 left 192.0.2.3 rightzM^\s*\S+ \S+z+1591983743.667 left [192.0.2.4]:12345 rightzc^\s*\S+ : \S+)z[192.0.2.4]:12345leftrightrowz['kevin'z'ip4': '192.0.2.0'z'fid': 'kevin'Traz ['192.0.2.0'z'user': 'kevin'r%userz, , z192.0.2.0, kevin, inet4)rPr"rQRE_00_IDrErcstr RE_00_USERr>rrrtestFrmtOutputSsF        z Fail2banRegexTest.testFrmtOutputc Cst|tddddtt|jddddd ||tdd ddtt|jddd |jdddd |dS) Nr_rHrzFound-ID:z*Found a match but no valid date/time foundzMatch without a timestamp:zFound-ID:kevinTraz{NONE})rPr" STR_00_NODTrrErcrdr>rrrtestNoDateTime~s  z Fail2banRegexTest.testNoDateTimec Csptjjdd|tdddtddtdtd td}|d |d vo+d |d v|j d |d d |d dd| d| d|tdddtddtdtd|j d |dd |dd |d d |d dd| d| d|tdddtddtdt dtdddt dd d}|j d|dd|d d|d dddS)NTstockrz, , rnrr z&sshd[logtype=short, publickey=invalid]rz192.0.2.2, git, raz192.0.2.1, git, zA[test-phase 1] mode=aggressive & publickey=nofail + OK (accepted)z$sshd[logtype=short, mode=aggressive]zL[test-phase 2] mode=aggressive & publickey=nofail + FAIL (closed on preauth)rr) unittestF2BSkipIfCfgMissingrPr"r STR_ML_SSHDSTR_ML_SSHD_OKsplitrErdrcSTR_ML_SSHD_FAIL)r&linesrrrtestFrmtOutputWrapMLsL                 $    z&Fail2banRegexTest.testFrmtOutputWrapMLcCs|tttdSr)rDr"r}r>rrrtestWrongFilterFiles z%Fail2banRegexTest.testWrongFilterFilecCsddlm}|dS)Nr)_decode_line_warn) server.filterrclear)r&rrrr_resets  zFail2banRegexTest._resetc Csdtjjdd||tddddtt|d|d|d |d |d dS) NTrrlrrGrJrrXz7Continuing to process line ignoring invalid characters:zMNov 8 00:16:12 main sshd[32548]: input_userauth_request: invalid user llincozkNov 8 00:16:12 main sshd[32547]: pam_succeed_if(sshd:auth): error retrieving information about user llinco rrrrrPr"FILENAME_WRONGCHAR FILTER_SSHDrEr>rrr testWronChars    zFail2banRegexTest.testWronCharc CsVtjjdd||tddddddttd |d |d |d dS) NTrrlrrGrJrrKz llinco[^\\]rXz.Lines: 4 lines, 1 ignored, 2 matched, 1 missedzhttps://rr>rrrtestWronCharDebuggexs  z&Fail2banRegexTest.testWronCharDebuggexcCsP|td||tdd|t||tdddS)Nrz-Vz --version)assertNotEqualr8rc assertEqualrEr normVersionr>rrrtestExecCmdLine_Usages z'Fail2banRegexTest.testExecCmdLine_UsagecC$|tddtdd|ddS)NrlinforMrrN)rr8rQrEr>rrrtestExecCmdLine_Directz(Fail2banRegexTest.testExecCmdLine_DirectcCr)NrlrzAuthentication failurerzNo failure-id group in )rr8rQrEr>rrrtestExecCmdLine_MissFailIDrz,Fail2banRegexTest.testExecCmdLine_MissFailIDc CsR|tddddddd|d||td ddddd|d dS) Nrlrr_z%:%.%-LOGRErz ERROR: Failed to set datepatternrmzFailed to set datepattern)rr8rErcr>rrrtestExecCmdLine_ErrorParams   z,Fail2banRegexTest.testExecCmdLine_ErrorParamcCstjstd|tdtdd|d|d|d| |tdtdd d|d|ddS) Nz.Skip test because no systemd backend availablezsystemd-journalz,[journalmatch="SYSLOG_IDENTIFIER=dummy",z; failregex="^dummy regex, never match xxx"]rrrqz.Lines: 0 lines, 0 ignored, 0 matched, 0 missedz[logtype=file,z, journalmatch="SYSLOG_IDENTIFIER=dummy",) r FilterSystemdrSkipTestrPr"r~rErdrcr>rrrtestLogtypeSystemdJournal s0     z+Fail2banRegexTest.testLogtypeSystemdJournalN)$r(r)r*r=r@rFrIrRrTrVr\r^rerirkrtrwr|rrrrrrrrrrrrrrrrrrrrrrr;wsD         +- r;)3 __author__ __copyright__ __license__r3r0rclientrclient.fail2banregexrrrrr utilsr r r rrrrxjoinry__file__TEST_CONFIG_DIRTEST_FILES_DIRr1rr" Exceptionr#r8rQrr[rrrZrhrrrrrsrrvrzr}r~r;rrrrsL