a
=*fv @ s d Z dZdZdZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl
Z ddlZ ddlmZmZ ddlmZmZmZ zdd lmZ W n ey dZY n0 dd
lmZmZ d d lm Z m Z m Z dd
l m Z m!Z!m"Z" ddl#m$Z$m%Z% ddl&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z, e*dZ-d0ddZ.dd Z/d1ddZ0d2ddZ1d d Z2d d Z3d d! Z4G d"d# d#eZ5d$d% Z6G d&d' d'e7Z8G d(d) d)e7Z9G d*d+ d+e7Z:d,d- Z;d.d/ Z.
Many contributions by Yaroslav O. Halchenko, Steven Hiscocks, Sergey G. Brester (sebres).ZGPL N) OptionParserOption)
NoOptionErrorNoSectionErrorMissingSectionHeaderError )
FilterSystemd)version normVersion ) FilterReader
JailReader NoJailError)Filter
FileContainerMyTime)RegexRegexException) str2LogLevelgetVerbosityFormatFormatterWithTraceBack getLoggerextractOptions
PREFER_ENCZfail2banFyesc C s2 t j||d| dd}|r"d|d< dtj| S )N)useDnsZpython)restrZflavormflagszhttps://www.debuggex.com/?)r Z_resolveHostTagurllibparse urlencode)Zsampleregex multiliner args r& A/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py debuggexURL? s r( c C s t | d S N)printr% r& r& r' outputH s r, 5 c C s$ t | |kr | d|d d S | S )zReturn shortened string
N ...)len)slr& r& r' shortstrK s r3 c C s< t | s d S |rd| }nd}t|d d| d d S )Nz|- %s
z| z
| z
`-)r0 r, join)r2 headerr1 r& r& r' pprint_listR s
r7 c c s< z | }W n ty" Y q Y n0 |s*q8| |V q d S r) )Zget_nextOSErrorZformatJournalEntry)flt myjournalentryr& r& r' journal_lines_gen[ s
r< c G s t t td d S Nr )r, r
sysexitr+ r& r& r' dumpNormVersione s
r@ c C s dt jd S )Nz(%s [OPTIONS] [IGNOREREGEX]r )r> argvr& r& r& r' i rB c @ s e Zd Zdd ZdS )
_f2bOptParserc O s@ d| _ dt d t d tj| g|R i | d t d S )z, Overwritten format helper with full ussage.r4 zUsage:
a
LOG:
string a string representing a log line
filename path to a log file (/var/log/auth.log)
systemd-journal search systemd journal (systemd-python required),
optionally with backend parameters, see `man jail.conf`
for usage and examples (systemd-journal[journalflags=1]).
REGEX:
string a string representing a 'failregex'
filter name of filter, optionally with options (sshd[mode=aggressive])
filename path to a filter file (filter.d/sshd.conf)
IGNOREREGEX:
string a string representing an 'ignoreregex'
filename path to a filter file (filter.d/sshd.conf)
z>
Report bugs to https://github.com/fail2ban/fail2ban/issues
)usage__doc__r format_help
__copyright__)selfr% kwargsr& r& r' rH l s z_f2bOptParser.format_helpN)__name__
__module__ __qualname__rH r& r& r& r' rD k s rD c C sf t t dt d} | tdddddtdd d
d td d
dd ddtddtddtddddddtddd ddtdd td d d td d!d"d td#d$d%d&d'd(td)d*td+d,td-d.d/d0d d1d2td3dd0td4d5td6d7dd8d9td:d;ddd?d@dAd2tdBdCddDd dEd2tdFddGd9tdHddId9tdJddKd9tdLddMd9tdNddOd9tdPdQddRd9tdSddTd9g | S )UNz%prog )rF r z-cz--configz
/etc/fail2banz set alternate config directory)defaulthelpz-dz
--datepatternz+set custom pattern used to match date/times)rP z
--timezonez--TZstorez)set time-zone used by convert time format)actionrO rP z-ez
--encodingz%File encoding. Default: system localez-rz--raw
store_trueFz Raw hosts, don't resolve dnsz--usednszpDNS specified replacement of tags in regexp ('yes' - matches all form of hosts, 'no' - IP addresses only)z-Lz
--maxlinesr z maxlines for multi-line regex.)typerO rP z-mz--journalmatchzGjournalctl style matches overriding filter file. "systemd-journal" onlyz-lz --log-level log_levelcriticalz(Log level for the Fail2Ban logger to use)destrO rP z-Vcallbackz,get version in machine-readable short format)rR rX rP z-vz --verbosecountverbosezIncrease verbosity)rR rW rO rP z --verbosityz'Set numerical level of verbosity (0..4))rR rW rT rP z--verbose-datez--VDz%Verbose date patterns/regex in output)rR rP z-Dz
--debuggexz-Produce debuggex.com urls for debugging therez--no-check-all store_false
checkAllRegexTz Disable check for all regex'sz-oz--outoutzaSet token to print failure information only (row, id, ip, msg, host, ip4, ip6, dns, matches, ...)z--print-no-missedz Do not print any missed linesz--print-no-ignoredz Do not print any ignored linesz--print-all-matchedzPrint all matched linesz--print-all-missedz*Print all missed lines, no matter how manyz--print-all-ignoredz+Print all ignored lines, no matter how manyz-tz--log-tracebackz.Enrich log-messages with compressed tracebacksz--full-tracebackzBEither to make the tracebacks full, not compressed (as by default))rD rF r Z add_optionsr r intr@ )pr& r& r' get_opt_parser s
6r` c @ sD e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dS ) RegexStatc C s d| _ || _t | _d S r= )_stats
_failregexlist_ipList)rJ failregexr& r& r' __init__ s zRegexStat.__init__c C s d| j | j| j| jf S )Nz%s(%r) %d failed: %s) __class__rc rb re rJ r& r& r' __str__ s zRegexStat.__str__c C s | j d7 _ d S Nr rb ri r& r& r' inc s z
RegexStat.incc C s | j S r) rl ri r& r& r' getStats s zRegexStat.getStatsc C s | j S r) )rc ri r& r& r' getFailRegex s zRegexStat.getFailRegexc C s | j | d S r) )re append)rJ valuer& r& r' appendIP s zRegexStat.appendIPc C s | j S r) )re ri r& r& r' getIPList s zRegexStat.getIPListN)
rL rM rN rg rj rm rn ro rr rs r& r& r& r' ra s ra c @ s( e Zd ZdZdd Zdd Zdd ZdS ) LineStatsz(Just a convenience container for stats
c C sF d | _ | _g | _d| _g | _d| _g | _|jrBg | _g | _ g | _
d S r= ) testedmatched
matched_linesmissed missed_linesignored
ignored_linesZdebuggexmatched_lines_timeextractedmissed_lines_timeextractedignored_lines_timeextracted)rJ optsr& r& r' rg s zLineStats.__init__c C s d| S )NzM%(tested)d lines, %(ignored)d ignored, %(matched)d matched, %(missed)d missedr& ri r& r& r' rj s zLineStats.__str__c C s t | |rt| |S dS )Nr4 )hasattrgetattr)rJ keyr& r& r' __getitem__ s zLineStats.__getitem__N)rL rM rN rG rg rj r r& r& r& r' rt s rt c @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z d ddZ dd Z
dd Zdd Zd d Zd d ZdS )!
Fail2banRegexc C sN | j tdd |j D || _d| _d| _d | _t | _t d | _
d| _ t | _
t | _t | _d | _t|| _|jr| |j nd| _|jd ur| t|j |jr| j
|j d| j
_ t d ddl m } | |j!r| "|j! |j#r| j
$|j# |j%| j
_&|j'o&|j( | j
_'t)|j(| j
_*| j+| j
_,d| _-d S ) Nc s s | ]\}}d | |fV qdS )_Nr& ).0ovr& r& r' rC z)Fail2banRegex.__init__..Fr r )
_updateTimeREauto).__dict__updatedictitems_opts
_maxlines_set_datepattern_set
_journalmatch share_configr _filter_prefREMatchedrd
_prefREGroups _ignoreregexrc
_time_elapsedrt _line_statsmaxlines setMaxLines _maxlines journalmatchsetJournalMatchshlexsplittimezoneZsetLogTimeZoneZ
checkFindTimer ZsetAlternateNowZserver.strptimer datepatternsetDatePatternusednsZ setUseDnsrawZ
returnRawHostr\ r] boolZ
ignorePending_onIgnoreRegexZ
onIgnoreRegex_backend)rJ r r r& r& r' rg sB
zFail2banRegex.__init__c C s | j jst| d S r) )r r] r, rJ liner& r& r' r, ! s zFail2banRegex.outputc C s | | jdS )Nignore)encode _encodingr r& r& r' encode_line$ s zFail2banRegex.encode_linec C s@ | j s<| j| d| _ |d ur<| d|| j d f d S )NTz Use datepattern : %s : %sr )r r r r, ZgetDatePattern)rJ patternr& r& r' r ' s z Fail2banRegex.setDatePatternc C s4 | j s0| jt| d| _ | d| j d S )NTzUse maxlines : %d)r r r r^ r, getMaxLinesrJ r r& r& r' r / s zFail2banRegex.setMaxLinesc C s
|| _ d S r) )r r r& r& r' r 5 s z Fail2banRegex.setJournalMatchc s i } }t tr$ fdd}n jr8 fdd}ndd }ddgt| D ]8}z ||v rj|| n||||< W qT ty Y qT0 qT| d| d S )Nc s d| S NZ
Definition)getkreaderr& r' rB < rC z0Fail2banRegex._dumpRealOptions..c s j d| S r )filterr r r r& r' rB > rC c S s d S r) r& r r& r& r' rB @ rC Zlogtyper zReal filter options : %r)Z getCombined
isinstancer r rd keysr r, )rJ r fltOptZrealoptsZcomboptsZ_get_optr r& r r' _dumpRealOptions8 s
z Fail2banRegex._dumpRealOptionsc C s> |dv s J |d }| j j}|}d }i }d }|dkrtd|rzt|\}}td|sz t|d| j|d}| W n ty d }Y n0 d|d d v r|f} n||d
|d f} | D ]}t j
|d krt j
||}nJd
|vr&t j
|d krt j
||}nt j
|d |}n t j
|}t j
|rF qLd }qW nT ty }
z:tdt|
f td|f | jr|
W Y d }
~
dS d }
~
0 0 d } |rD| dd|f |r| d| |si }| j|d< |j|d} | s td|f dS | jdks(t tjkr4| || |jdd} n|d ur|| j jkst j
|d ksd|d d vrd
|vrt j
|d krt j
|}t j
t j
|d }| dd||f n0| d d|f d }t j
|st j
|}|r| d | t |d || j|d }
d } z*|d urH|
} n|
d |
} W nD ty }
z*td t|
f | jr|
W Y d }
~
n
d }
~
0 0 | std!| dS |
!| j |
d | jdkst tjkr| |
| |
} | ri }| D ]}|d d"kr*|d# }n |d d$kr |d#d }nq z,|d% d&krt|D ]}|| j"_#q`n|d% d'kr|$d}|st% }|d< |D ]}|&t'| qn|d% d(kr|$d)}|st% }|d)< |D ]}|&t'| qnr|d% d*kr*|D ]}| (| qnL|d% d+krP|D ]}| )| qdd }nXdkrPd d }nFd
vrffd d}n0d d
lm mm dd fdd}|S )zOPrepares output- and fetch-function corresponding given '--out' option (format))idZfidc S s | D ]}t |d qd S rk )r, r rr& r& r' _out/ s z+Fail2banRegex._prepaireOutput.._outipc S s& | D ] }t |d d|d qd S )Nr. r r r, r r r& r& r' r 3 s msgc S sH | D ]>}|d dD ]*}t|ts8ddd |D }t| qqd S )Nr. matchesr4 c s s | ]
}|V qd S r) r& r r r& r& r' r ; rC >Fail2banRegex._prepaireOutput.._out..)r r r r5 r, r r& r& r' r 7 s
rowc S s> | D ]4}t d|d |d tdd |d D f qd S )Nz
[%r, %r, %r],r r c s s" | ]\}}|d kr||fV qdS )r Nr& )r r r r& r& r' r @ rC r r. )r, r r r r& r& r' r > s ._escOutc s g }ddi| D ]n d d d d} |} fdd}||d < j|d
}d rv| |f qt| q|D ]N\ } d d D ]6 t tsd d
d D |d t qqd S )NNLr r r r. )timedatac s8 d s(t d dg dkr(| d S dd< dS d S )Nr r. r r msg )r0 r ri r wrapr& r' _get_msgS s z=Fail2banRegex._prepaireOutput.._out.._get_msgr )Z escapeValr r4 c s s | ]
}|V qd S r) r& r r& r& r' r d rC r r ) Z
ActionInfoZreplaceDynamicTagsrp r, r r r r5 r )r ZrowsZticketZaInfor r r r r r r r r' r L s$
)r r] Zserver.actionsr r r )rJ r r& r r' _prepaireOutput+ s
z Fail2banRegex._prepaireOutputc C s t }| jjr| }|D ]}t|trV| |d |d \}}}d|d }n*|d}| ds |spq | |\}}}| jjrt
|dkr |s || q |r| j j d7 _ | j
s| js| j j | jd kr| j j| | jr| j j| nt
|dkrD| j jd7 _| jr| j j| | jr| j j| nX| j jd7 _| js| jsx| j j| jd kr| j j| | jr| j j | | j j d7 _ q t | | _ d S )Nr r r4 z
#) r r r] r r tupler r5 rstrip
startswithr0 r rz _print_no_ignoredZ_print_all_ignoredr r{ rp r r~ rv r rw r| rx _print_no_missedZ_print_all_missedry r} ru r )rJ
test_linesZt0r] r Zline_datetimestrippedr r r& r& r' processj sB
$zFail2banRegex.processc sN j }|j|j|j|j ks"J || }||d }j dk|rJd| f }jr|dksp|dkrxj }nj
}||d }|j k st d| rg g}||fD ] fdd |D }qfd
d |D }t
d d |D | ntd |||f nD|j k s"t d| r8t
d
d |D | ntd |||f d S )NZ_linesr z %s line(s):rx rv Z_lines_timeextractedZ _print_all_c s g | ]} D ]}||g q qS r& r& )r xy)argr& r'
rC z,Fail2banRegex.printLines..c sL g | ]D}|d d |d d t|d |d jj qS )r z | r z | )ro r( r r r )r a)r$ rJ r& r' r s c S s g | ] }| qS r& r
r r r& r& r' r rC z?%s too many to print. Use --print-all-%s to print all %d linesc S s g | ] }| qS r& r r r& r& r' r rC )r rx ru rv rz r r
capitalizer rc r r r r7 r, ) rJ ZltypeZlstatsr r2 r6 Z regexlistZansbr& )r r$ rJ r'
printLines s8 zFail2banRegex.printLinesc
s j jr dS td td td fdd} jjr jj}| g} jrl jD ]}|d|f qVtdd j f t
| |d
j }|d j } jj
d ur4td g } jj
jD ]f} js|jr|d
|j|jf jr|d|j|jjt|ddf |dt|ddf qt
|d td j jd ur\td j td jrv d js d js d dS )NTr4 ZResultsz=======c
s dg }}t |D ]\}}| }||7 }|s4 jrP|d|d || f jrt| r| D ]B}t|d }t d|} |d|d | |d rdpd f qjqt
d
| |f t |d |S ) Nr z %2d) [%d] %sr r z%a %b %d %H:%M:%S %Yz %s %s%sz (multiple regex matched)r4
%s: %d totalz" #) [# of hits] regular expression) enumeratern r rp ro r0 rs r localtimestrftimer, r7 )
r Z failregexestotalr] Zcntrf r r Z timeTupleZ
timeStringri r& r' print_failregexes s(
z3Fail2banRegex.printStats..print_failregexesz %sr Z PrefregexZ FailregexZ Ignoreregexz
Date template hits:z[%d] %sz& # weight: %.3f (%.3f), pattern: %sr z # regex: %sr# z[# of hits] date formatz
Lines: %sz[processed in %.2f sec]rv rz rx )r r] r, r r ZgetRegexr r rp r r7 rc r Z dateDetectorZ templateshitsnameZ
_verbose_dateZweighttemplater r r r r r r
)rJ r r r] grpr r r# r& ri r'
printStats sN
zFail2banRegex.printStatsc
C sx |d d \}}| dr d| _z8| |ds4W dS t|dkrV| |d dsVW dS W n2 ty } ztd| W Y d }~dS d }~0 0 tj|rz2t || j
d d
}| d | | d | j
W n0 t y } zt| W Y d }~dS d }~0 0 nP| drt s td
dS | d | d | j
t
|\}}t di |}|| j
| } | j}
| d |
r||
| dd|
t|| }n| j dkrd|vr| dt|dd |g}nn|d}| dt| t|D ]>\} } | dkr*| d qH| d| d t| f q| d | d | | | stdS d S ) Nr zsystemd-journalZsystemdr Fr. r r T)ZdoOpenzUse log file : %szUse encoding : %sz,Error: systemd library not found. Exiting...zUse systemd journalzUse journal match : %s r rE zUse single line : %sz\nz Use multi line : %s line(s) z| ...z | %2.2s: %sz`-r4 )N) r r r r0 r r, r r r r r IOErrorr r ZsetLogEncodingZgetJournalReaderr r ZaddJournalMatchr5 r< r r r3 r r r r r% )
rJ r% Zcmd_logZ cmd_regexr r r ZbeArgsr9 r: r ir2 r& r& r' start sd
zFail2banRegex.start)N)rL rM rN rg r, r r r r r r r r r r r r% r* r& r& r& r' r s *
@?) Hr c C s6 | t kr| tks|jdkr(t| ||S td d S )N r )BrokenPipeErrorr( errnor> __excepthook__r? )exctyperq tracebackr& r& r' _loc_except_hook; s r1 c
G s t t_dt_t }|j| \}} g }|jr:|jr:| d |j
rP|j rP| d t | dvrf| d |r|
tjdd| d td |jstd td td
td t|j|_t|j ttj}|jd krd nd
}|jrt }|j r dpd| }ntj }| |t |j| t!| z t"|}W nd t#y } zJ|jsrt$ tj%krtj&|dd n td| td W Y d }~n
d }~0 0 |'| std d S )NTzGERROR: --print-no-missed and --print-all-missed are mutually exclusive.zIERROR: --print-no-ignored and --print-all-ignored are mutually exclusive.)r r. z&ERROR: provide both and .rE r4 z
Running testsz
=============r z %(levelname)-1.1s: %(message)sz %(message)sz %(tb)sz %(tbc)s)exc_infor )(r1 r>
excepthookr Z
exitOnIOErrorr`
parse_argsZprint_no_missedZprint_all_missedrp Zprint_no_ignoredZprint_all_ignoredr0
print_helpstderrwriter5 r? r] r, r rU r ZsetLevelZ
StreamHandlerstdoutrZ Z
log_tracebackr Zfull_traceback FormatterZ setFormatterr Z
addHandlerr r r r rV r* ) r% parserr errorsr9 fmtr: Z
fail2banRegexr r& r& r' exec_command_lineA sN
r> )Fr )r- )N)=rG
__author__rI Z __license__getoptr r r r r> r Zurllib.requestr urllib.parseZ urllib.errorZoptparser r Z configparserr r r Zserver.filtersystemdr ImportErrorr r
Z
jailreaderr r
r Z
server.filterr r r Zserver.failregexr r Zhelpersr r r r r r r r( r, r3 r7 r< r@ rF rD r` objectra rt r r1 r> r& r& r& r' sR
? J