a
=*f@w @ st d Z dZdZddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddl m Z zddl
mZ W n ey ddlmZ Y n0 ddlmZ dd lmZ dd
lmZ dd lmZ d d
lmZmZm Z m Z m Z m Z m Z ee!Z"e # Z$ej%Z&e'dZ(dZ)e'dZ*dd dd dZ+dddZ,e,-e+ G dd dee.Z/G dd de.e d Z0d d d Z1G d d! d!e0Z2dS )"z'Cyril Jaquier and Fail2Ban Contributorsz>Copyright (c) 2004 Cyril Jaquier, 2011-2012 Yaroslav HalchenkoZGPL N)ABCMeta)MutableMapping )
mapTag2Opt)DNSUtils)MyTime)Utils ) getLogger_merge_copy_dicts
splitwordssubstituteRecursiveTags
uni_stringTAG_CREMAX_TAG_REPLACE_COUNTz)inet4inet6z^(\w+)\?(family)=(.*)$c C s t tjddS )NTZfqdnstrr Z getHostname r r :/usr/lib/python3.9/site-packages/fail2ban/server/action.py? r c C s t tjddS )NFr r r r r r r @ r )z fq-hostnamez sh-hostname
)brspc @ s e Zd ZdZdZdZdd Zd ddZd d
d ZeZ d!d
dZ
dd Z dd Z dd Z
dd Zdd Zdd Zdd Zd d Zd S )"
CallingMapa" A Mapping type which returns the result of callable values.
`CallingMap` behaves similar to a standard python dictionary,
with the exception that any values which are callable, are called
and the result is returned as the value.
No error handling is in place, such that any errors raised in the
callable will raised as usual.
Actual dictionary is stored in property `data`, and can be accessed
to obtain original callable values.
Attributes
----------
data : dict
The dictionary data which can be accessed to obtain items uncalled
r )datastorage immutableZ
__org_datac O s" t | _d| _t |i || _d S )NT)dictr r! r )selfargskwargsr r r __init___ s zCallingMap.__init__Tc C s2 t | _z | j| _W n ty& Y n0 || _d S N)r" r _CallingMap__org_datar AttributeErrorr! )r# r! r r r resetd s zCallingMap.resetFc C s d| j j| |tf S )Nz%s(%r)) __class____name___asdictr )r#
calculatedr r r _asreprl s zCallingMap._asreprNc s t jfi j}|s2t fdd| D S t| D ]@\}}t|r>z" |}|rf|| |||< W q> Y q>0 q>|S )Nc 3 s, | ]$\}}t |r | jv r||fV qd S r' )callable
CM_REPR_ITEMS).0nvr# r r u s
z%CallingMap._asdict..)r" r r itemslistr0 __getitem__)r# r. Zcheckerdr3 r4 r r5 r r- r s
zCallingMap._asdictc C s0 z| j | }W n ty* | j| }Y n0 |S r' )r KeyErrorr r# keyvaluer r r
getRawItem s
zCallingMap.getRawItemc C sb z| j | }W n ty* | j| }Y n0 t|r^t|drN|jjrN|| n| }|| j |< |S )N__code__)r r; r r0 hasattrr@ co_argcountr< r r r r9 s
zCallingMap.__getitem__c C s: | j r,| j | _| j| _| j | _d| _ || j|< d S NF)r! r copyr r( r< r r r __setitem__ s zCallingMap.__setitem__c C s t d| d S )NzKey %r was deleted)r; r# r= r r r Z
__unavailable s zCallingMap.__unavailablec C sX | j r,| j | _| j| _| j | _d| _ z | j|= W n tyJ Y n0 | j|= d S rC )r! r rD r r( r; rF r r r __delitem__ s zCallingMap.__delitem__c C s
t | jS r' )iterr r5 r r r __iter__ s zCallingMap.__iter__c C s
t | jS r' )lenr r5 r r r __len__ s zCallingMap.__len__c C s | t| j| jS r' )r+ r r r r5 r r r rD s zCallingMap.copy)T)F)FN)r,
__module__ __qualname____doc__r1 __slots__r& r* r/ __repr__r- r? r9 rE Z_CallingMap__unavailablerG rI rK rD r r r r r J s
r c @ sX e Zd ZdZedd Zdd Zdd Zdd Zd
d Z d d
Z
e dd Z dd Z
dS )
ActionBasea An abstract base class for actions in Fail2Ban.
Action Base is a base definition of what methods need to be in
place to create a Python based action for Fail2Ban. This class can
be inherited from to ease implementation.
Required methods:
- __init__(jail, name)
- start()
- stop()
- ban(aInfo)
- unban(aInfo)
Called when action is created, but before the jail/actions is
started. This should carry out necessary methods to initialise
the action but not "start" the action.
Parameters
----------
jail : Jail
The jail in which the action belongs to.
name : str
Name assigned to the action.
Notes
-----
Any additional arguments specified in `jail.conf` or passed
via `fail2ban-client` will be passed as keyword arguments.
c C s( d}|D ]}t t||d s dS qdS )N)startstopbanrebanunbanFT)r0 getattr)clsCrequiredmethodr r r __subclasshook__ s
zActionBase.__subclasshook__c C s" || _ || _td| jj | _d S )Nz fail2ban.%s)_jail_namer
r+ r, _logSysr# Zjailnamer r r r& s zActionBase.__init__c C s dS )z,Executed when the jail/action is started.
Nr r5 r r r rR s zActionBase.startc C s dS )z,Executed when the jail/action is stopped.
Nr r5 r r r rS s zActionBase.stopc C s dS )Executed when a ban occurs.
Parameters
----------
aInfo : dict
Dictionary which includes information in relation to
the ban.
Nr r# aInfor r r rT s zActionBase.banc C s
| |S )rb )rT rc r r r rU s zActionBase.rebanc C s dS rC r r5 r r r _prolongable s zActionBase._prolongablec C s dS )zExecuted when a ban expires.
Parameters
----------
aInfo : dict
Dictionary which includes information in relation to
the ban.
Nr rc r r r rV s zActionBase.unbanN)r, rL rM rN classmethodr\ r& rR rS rT rU propertyre rV r r r r rQ s
rQ ) metaclass str2secondsignore)timeoutZbantimec s e Zd ZdZedZdd Z fddZedd Z d d
Z
e
Z d d Z e
d
d Ze
dd Zdd Zdd Zg dfddZe
dd Ze
dd Ze
d d Zd d ZdNd!d"ZdOd$d%Ze
d&d' Zd(d) Zd*d+ Zd,d- Z d.d/ Z d0d1 Z dPd2d3Z d4d5 Z dQd6d7Z!e"#d8Z$ed9d: Z%edRdZ$e"#d?Z'edSd@dAZ(e
dBdC Z)dDdE Z*dTdGdHZ+dUdIdJZ,e-dVdLdMZ. Z/S )W
CommandActiona A action which executes OS shell commands.
This is the default type of action which Fail2Ban uses.
Default sets all commands for actions as empty string, such
no command is executed.
Parameters
----------
jail : Jail
The jail in which the action belongs to.
name : str
Name assigned to the action.
Attributes
----------
actionban
actioncheck
actionreban
actionreload
actionrepair
actionstart
actionstop
actionunban
timeout
)matchesZ ipmatchesZ
ipjailmatchesc C sZ d| _ zFd| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _
W d| _ nd| _ 0 dS )z8 Clear all lists/dicts parameters (used by reloading)
r < r N) _CommandAction__initrk Z actionstartZ actionban actionrebanZ actionunban actioncheckZ actionrepairZ actionflushZ
actionstopZ actionreloadr5 r r r clearAllParams> s z CommandAction.clearAllParamsc sH t t| || d| _d | _i | _i | _| | j d| j
d S )Nr z
Created %s) superrl r& rp _CommandAction__properties_CommandAction__started_CommandAction__substCachers r_ debugr+ r` r+ r r r& X s zCommandAction.__init__c C s t S r' )NotImplemented)rX rY r r r r\ a s z CommandAction.__subclasshook__c C sn | ds`| js`t|s`t|}|dkr.d S |dkr@t|}d | _| j | j
d|| || j |< d S )N_rj ri z
Set %s = %r)
startswithrp r0 WRAP_CMD_PARAMSgetr ri ru rw clearr_ rx __dict__)r# ra r> Zwrpr r r __setattr__e s
zCommandAction.__setattr__c C s4 | ds(d | _| j | jd| | j|= d S )Nr{ z
Unset %s)r| ru rw r r_ rx r )r# ra r r r __delattr__w s
zCommandAction.__delattr__c s2 j dur j S t fddt D _ j S )z`A dictionary of the actions properties.
This is used to substitute "tags" in the commands.
Nc 3 s4 | ],}| d stt |s|t |fV qdS )r{ N)r| r0 rW )r2 r= r5 r r r6 s z,CommandAction._properties..)ru r" dirr5 r r5 r _properties s
zCommandAction._propertiesc C s | j S r' )rw r5 r r r _substCache s zCommandAction._substCachec C sF | j || j|rd| nd| jd}|r.d|vr2|S | |d|i}|S )Nfamily=ro conditionalcache<family)
replaceTagr rw replaceDynamicTags)r# tagr cmdr r r
_getOperation s
zCommandAction._getOperationc s d|f}t |sLt s,| j|i S fdd| j|i D S |d }|rz| j| }W n ty i }| j|< Y n0 || < nPz<| j| }| }t| D ]\ }||kr| = qW n ty Y n0 dS )z? Get, set or delete command of operation considering family.
Z__eOpCmdc s g | ]\}} |r|qS r r r2 fr4 r r r
r z4CommandAction._operationExecuted..r N)rJ r0 rw r~ r7 r; popr8 )r# r r r$ r= r Zfamdr4 r r r _operationExecuted s(
z CommandAction._operationExecutedNc sB d}d}|s dd | j D }|D ] z| | }d}|r|| | fddvr|} | jrt| jjdd}
|
s| jjd}
t| jjd|
t
|
d < |
d
< | ||
} | | | j
}||M }|r| | | | |r|nd W q$ ty } zd }| }W Y d} ~ q$d} ~ 0 0 q$|s>td || j| j|f |S )
zExecutes the operation commands (like "actionstart", "actionstop", etc).
Replace the tags in the action command with actions properties
and executes the resulting command.
Tz Script errorc S s g | ]\}}|r|qS r r )r2 famoperr4 r r r r r z3CommandAction._executeOperation..c s | kS r' r )r r r r r r z1CommandAction._executeOperation..Z
actionInfoNtimer FzError %s action %s/%s: %r)rv r7 r r r] rW actionsZ_getActionInfosetattrr r r
executeCmdrk
ValueError RuntimeErrorr^ ) r# r Z operationr afterExecreserrr retrealCmdrd er r r _executeOperation s8 z CommandAction._executeOperationc C sH | j d}|d ur|S d}| j D ]}t|r"d} q:q"|| j d< |S )NZ__hasCondSectionFT)r r~ CONDITIONAL_FAM_REmatch)r# r4 r3 r r r _hasCondSection s
z CommandAction._hasCondSectionc C sl | j d}|r|S | j d}|rr )r rv r r r5 r r _started s z&CommandAction._start.._started
Zstartingr r )r rv r~ r r )r# r
forceStartr r r r5 r r s zCommandAction._start c C s` | dd}| jr,| j |s,| j|dd | ||sDtd| | j |ddB | j|< dS ) a) Executes the given command ("actionban" or "actionreban").
Replaces the tags in the action command with actions properties
and ban information, and executes the resulting command.
Parameters
----------
aInfo : dict
Dictionary which includes information in relation to
the ban.
r ro Tr zError banning %(ip)sr N)r~ r rv r _processCmdr )r# rd r r r r r rT % s
zCommandAction.banc C s t | do | jo t| j S )N
actionprolong)rA r r isspacer5 r r r re ; s zCommandAction._prolongablec C s | d|std| dS )a Executes the "actionprolong" command.
Replaces the tags in the action command with actions properties
and ban information, and executes the resulting command.
Parameters
----------
aInfo : dict
Dictionary which includes information in relation to
the ban.
zzError prolonging %(ip)sN)r r rc r r r prolong@ s zCommandAction.prolongc C s: | dd}| j |dd@ r6| d|s6td| dS )a Executes the "actionunban" command.
Replaces the tags in the action command with actions properties
and ban information, and executes the resulting command.
Parameters
----------
aInfo : dict
Dictionary which includes information in relation to
the ban.
r ro r r
zError unbanning %(ip)sN)r~ rv r r )r# rd r r r r rV O s zCommandAction.unbanc C s | || jrdndS )aD Executes the "actionreban" command if available, otherwise simply repeat "actionban".
Replaces the tags in the action command with actions properties
and ban information, and executes the resulting command.
Parameters
----------
aInfo : dict
Dictionary which includes information in relation to
the ban.
z
r )rT rq rc r r r rU ` s
zCommandAction.rebanc s: dd j D }|s dS fdd} jdd||dS ) a Executes the "actionflush" command.
Command executed in order to flush all bans at once (e. g. by stop/shutdown
the system), instead of unbanning of each single ticket.
Replaces the tags in the action command with actions properties
and executes the resulting command.
c S s g | ]\}}|d @ d kr|qS )r r r r r r r y r z'CommandAction.flush..Tc s& |r" j | r" j | dM < d S )N)rv r~ r r5 r r _afterFlush} s z(CommandAction.flush.._afterFlushz
Zflushingr )rv r7 r )r# r r r r5 r flusho s
zCommandAction.flushc C s | S )Executes the "actionstop" command.
Replaces the tags in the action command with actions properties
and executes the resulting command.
)_stopr5 r r r rS s zCommandAction.stopc s| |du r,dd j D }|s$dS i _ n2z j | dM < |g}W n ty\ Y dS 0 fdd} jdd ||d
S ) r Nc S s g | ]\}}|r|qS r r r r r r r r z'CommandAction._stop..Tr c s |r d| d d S )Nr )r r r5 r r _stopped s z%CommandAction._stop.._stoppedr Zstoppingr )rv r7 r; r )r# r r r r5 r r s
zCommandAction._stopc K s | ddS )zExecutes the "actionreload" command.
Parameters
----------
kwargs : dict
Currently unused, because CommandAction do not support initOpts
Replaces the tags in the action command with actions properties
and executes the resulting command.
zZ reloading)r )r# r% r r r reload s zCommandAction.reloadc C sV d}| j rRt| j D ]8\}}|r| ||sd| j|< | d|d |dM }q|S )zFExecutes the invariant check with repair if expected (conditional).
Tr r NF)rr r8 rv r7 _invariantCheckr )r# beforeRepairr r startedr r r consistencyCheck s
z CommandAction.consistencyCheckz [\\#&;`|*?~<>^()\[\]{}$'"\n\r]c s( ddd fdd}| j ||}|S )a5 Escape characters which may be used for command injection.
Parameters
----------
value : str
A string of which characters will be escaped.
Returns
-------
str
`value` with certain characters escaped.
Notes
-----
The following characters are escaped::
\#&;`|*?~<>^()[]{}$'"
r3 r)r
c s | }d || S )N\)groupr~ )mcZ_map2cr r substChar s z*CommandAction.escapeTag..substChar)
ESCAPE_CREsub)rX r> r r r r escapeTag s
zCommandAction.escapeTagro c s< d|vr |S |dur:|f}z
|| W S t y8 Y n0 t|t}||sd }|durdt|f}z || W n t y Y n0 du rt|j|d|dur||< tt fdd} td }
t | |} |rq&| |ks&d| vrq&| }|
d8 }
|
dkrt
d |f q|dur8| ||< | S )
zReplaces tags in `query` with property values.
Parameters
----------
query : str
String with tags.
aInfo : dict
Tags(keys) and associated values for substitution in query.
Returns
-------
str
`query` string with tags replaced.
r Nz
subst-tags)rj addreplc sn | d}d }r$|d }|d u rN|}|d u rN || S t|}|jv rj|}|S )Nr ?)r r~ r _escapedTagsr r r r> ADD_REPL_TAGS_CMrX r ZsubInfor r substVal s
z*CommandAction.replaceTag..substValr r zaunexpected too long replacement interpolation, possible self referencing definitions in query: %s) r; r r idr
r
ADD_REPL_TAGSr r r r ) rX queryrd r r r ZckeyZ noRecReplZcsubkeyr countr> r r r r sP
zCommandAction.replaceTagz![\\#&;`|*?~<>\^\(\)\[\]{}$'"\n\r]z\Wc s t sfddtt fdd}t||}d|v rpdsVi fdd}t||}rt|}|S ) a% Replaces dynamical tags in `query` with property values.
**Important**
-------------
Because this tags are dynamic resp. foreign (user) input:
- values should be escaped (using "escape" as shell variable)
- no recursive substitution (no interpolation for >)
- don't use cache
Parameters
----------
query : str
String with tags.
aInfo : dict
Tags(keys) and associated values for substitution in query.
Returns
-------
str
shell script as string or array with tags replaced (direct or as variables).
c s2 j |r.d jd| } || < d| }|S )Nzf2bV_%sr{ $)r search
ESCAPE_VN_CREr )r r> )rX varsDictr r escapeValS s
z3CommandAction.replaceDynamicTags..escapeValc sL | d}z | }W n" ty8 || Y S 0 t|}||S )Nr )r r; r~ r r )r rd r r r r a s
z2CommandAction.replaceDynamicTags..substValr zF-*c sB t | d}zt| }W n ty2 Y dS 0 d| |S )Nr ro ZF_)r r r r; r )r tickDatar r substTags s z2CommandAction.replaceDynamicTags..substTag) r" r r r r r~ FCUSTAG_CREr Z
buildShellCmd)rX r rd r r r r )r rd rX r r r r r 8 s
z CommandAction.replaceDynamicTagsc C s t | ddS )N _banEpochr )rW r5 r r r banEpoch s zCommandAction.banEpochc C s6 | j dur&| j jjd | _| j j_n | jd | _dS )zIncrements ban epoch of jail and this action, so already banned tickets would cause
a re-ban for all tickets with previous epoch.Nr )r] r r r r5 r r r invalidateBanEpoch s
z CommandAction.invalidateBanEpochTc C s |s|dur|| j vrdS | d|}|r8| || jrzr z Unable to restore environmentr )
rv r r rk r_ errorr Zcriticalr r r r r~ )r# r r r ZcheckCmdZ repairCmdr r r r s6
z CommandAction._invariantCheckc s dkrj d dS z |d }W n ttfy> d}Y n0 d}|r|jr| fdd}j|| dkd }|d
kr|d S j j|rd | ndjd
}|dur ||}n }
|j }|d
7 }|s|d
krD|S qDdS )a Executes a command with preliminary checks and substitutions.
Before executing any commands, executes the "check" command first
in order to check if pre-requirements are met. If this check fails,
it tries to restore a sane environment before executing the real
command.
Parameters
----------
cmd : str
The command to execute.
aInfo : dictionary
Dynamic properties.
Returns
-------
bool
True if the command succeeded.
ro
Nothing to doTr r c s( dkr$j ds$jd dS dS )Nr Zactionrepair_on_unbanz,Invariant check failed. Unban is impossible.FT)r r~ r_ r r r r# r r
_beforeRepair s z0CommandAction._processCmd.._beforeRepairr r r Fr r N) r_ rx r; TypeErrorrr r r r rw r r rk )r# r rd r Zrepcntr r r r r r r s.
zCommandAction._processCmdrn c K sn t tjk rt d| | s,t d dS t* tj| |fddd|W d S 1 s`0 Y dS )aI Executes a command.
Parameters
----------
realCmd : str
The command to execute.
timeout : int
The time out in seconds for the command.
Returns
-------
bool
True if the command succeeded.
Raises
------
OSError
If command fails to be executed.
RuntimeError
If command execution times out.
r TF)shelloutputN) logSysZgetEffectiveLevelloggingDEBUGlogrx _cmd_lockr r )r rk r% r r r r s
zCommandAction.executeCmd)NF)r )N)N)ro NN)N)NNT)N)rn )0r, rL rM rN r r rs r& rf r\ r rE r rg r r r r r r r r rR r rT re r rV rU r rS r r r recompiler r r r r r r r r staticmethodr
__classcell__r r ry r rl sf
'
Y
I
(
?rl )3
__author__Z
__copyright__Z __license__r osr signal
subprocessZtempfile threadingr abcr collections.abcr ImportError collectionsZ failregexr Zipdnsr Zmytimer Zutilsr Zhelpersr
r r r
r r r r, r Lockr Z
IPv6IsAllowedr r r Z
COND_FAMILIESr Z
DYN_REPL_TAGSr updateobjectr rQ r} rl r r r r sN $
oc