o

��_bT�@s�
dZd
Z
dZddlZddlZddlZddlmZ
ddlm	Z	m
Z
mZmZm
Z

dd	lmZmZmZmZ
dd
lmZ
ee_dd�Zee_ej�ej�e�
d
�Zej�ej�e�
d�Zdadd�Zdd�ZGdd�de�Zdd�Z dZ!dZ"dZ#dZ$dZ%ej�ed�Z&ej�ed�Z'ej�ed�Z(dZ)d Z*d!Z+ej�ed"d#�Z,ej�ed$d%�Z-ej�ed&�Z.ej�ed$d'�Z/ej�ed"d(�Z0ej�ed$d)�Z1Gd*d+�d+e�Z2dS),zSerg BresterzHCopyright (c) 2015 Serg G. Brester (sebres), 2008- Fail2Ban Contributors�GPL�N�)
�
fail2banregex)�
Fail2banRegex�get_opt_parser�exec_command_line�output�str2LogLevel�
)�setUpMyTime�tearDownMyTime�LogCaptureTestCase�logSys)
�
CONFIG_DIRc
Gst�
|d
�

dS)Nr)r�notice)
�args�r�F/usr/lib/python3/dist-packages/fail2ban/tests/fail2banregextestcase.py�_test_output%s
r�config�filescGs@t�}
|
�
t|�
�
\}}|jd
vrt�t|j�
�

||t|�
fS)N)r�warning)r�
parse_args�list�	log_levelr�setLevelr	r)r�parser�optsrrr�_Fail2banRegex/s





rcGst|�\}
}}|�
|�
S�
N)r�start)rr�
fail2banRegexrrr�
_test_exec7s


r"c@seZ
dZd
d�ZdS)�
ExitExceptioncCs|
|_d
|
|_
dS)NzExit with code: %s)�code�msg)�selfr$rrr�__init__<s

zExitException.__init__N)�__name__�
__module__�__qualname__r'rrrrr#;s
r#c
Gs�d	dd�
}
tj
tjtjd�}d
}|
t_
tsttjd�att_t_zBztt	|�
�

Wnt
y?
}
z	|j}WYd}~nd}~w
wW|dt_
|dt_|dt_|SW|dt_
|dt_|dt_|S|dt_
|dt_|dt_w)
Nrc

Sst|�
�
r)
r#)
r$rrr�_exitAs
z&_test_exec_command_line.<locals>._exit)�exit�stdout�stderr�
wr,r-r.)
r)�sysr,r-r.�DEV_NULL�open�os�devnullrrr#r$)rr+�_org�
_exit_code�
errr�_test_exec_command_line@s2









���





�






�


r8zRDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.0zB[sshd] error: PAM: Authentication failure for kevin from 192.0.2.0z�(?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST>z8Authentication failure for <F-ID>.*?</F-ID> from <ADDR>$z<Authentication failure for <F-USER>.*?</F-USER> from <ADDR>$ztestcase01.logztestcase02.logztestcase-wrong-char.loga"Nov 28 09:16:03 srv sshd[32307]: Failed publickey for git from 192.0.2.1 port 57904 ssh2: ECDSA 0e:ff:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:03 srv sshd[32307]: Failed publickey for git from 192.0.2.1 port 57904 ssh2: RSA 04:bc:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:03 srv sshd[32307]: Postponed publickey for git from 192.0.2.1 port 57904 ssh2 [preauth]
Nov 28 09:16:05 srv sshd[32310]: Failed publickey for git from 192.0.2.2 port 57910 ssh2: ECDSA 1e:fe:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:05 srv sshd[32310]: Failed publickey for git from 192.0.2.2 port 57910 ssh2: RSA 14:ba:xx:xx:xx:xx:xx:xx:xx:xx:xx:...
Nov 28 09:16:05 srv sshd[32310]: Disconnecting: Too many authentication failures for git [preauth]
Nov 28 09:16:05 srv sshd[32310]: Connection closed by 192.0.2.2 [preauth]z�Nov 28 09:16:06 srv sshd[32307]: Accepted publickey for git from 192.0.2.1 port 57904 ssh2: DSA 36:48:xx:xx:xx:xx:xx:xx:xx:xx:xx:...zINov 28 09:16:06 srv sshd[32307]: Connection closed by 192.0.2.1 [preauth]�logs�sshdzfilter.dz	sshd.confzzzz-sshd-obsolete-multiline.logz zzz-sshd-obsolete-multiline.confzzzz-generic-examplezzzz-generic-example.confc@s
eZ
dZd
d�Zdd�Zdd�Zdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
dd�Zdd�Zdd�Z
dd�Zdd�Zdd�Zdd�Zdd �Zd!d"�Zd#d$�Zd%d&�Zd'd(�Zd)d*�Zd+d,�Zd-d.�Zd/d0�Zd1d2�Zd3d4�Zd5d6�Zd7d8�Zd9d:�Zd;d<�Z d=d>�Z!d?d@�Z"dAdB�Z#dCS)D�Fail2banRegexTestc

C�t�
|�

t�
d
S)zCall before every test case.N)r
�setUpr�
r&rrrr=y�


zFail2banRegexTest.setUpc

Cr<)zCall after every test case.N)r
�tearDownrr>rrrr@~r?zFail2banRegexTest.tearDownc

Cs|�t
d
d��

|�d�

dS)N�testz.** from <HOST>$�$Unable to compile regular expression��assertFalser"�assertLoggedr>rrr�testWrongRE�s

�zFail2banRegexTest.testWrongREc

Cs$|�t
d
dddd��

|�d�

dS)N�
--datepattern�{^LN-BEG}EPOCHrAz.*? from <HOST>$z.**rBrCr>rrr�testWrongIngnoreRE�s



�z$Fail2banRegexTest.testWrongIngnoreREc

	Cs&|�t
d
dddtd��

|�d�

dS)NrG�*^(?:%a )?%b %d %H:%M:%S(?:\.%f)?(?: %ExY)?�--print-all-matched�--print-no-missed�+Authentication failure for .*? from <HOST>$�.Lines: 1 lines, 0 ignored, 1 matched, 0 missed��
assertTruer"�STR_00rEr>rrr�testDirectFound�s




�z!Fail2banRegexTest.testDirectFoundc

Cs |�t
d
td��

|�d�

dS)N�--print-all-missedzXYZ from <HOST>$z.Lines: 1 lines, 0 ignored, 0 matched, 1 missedrOr>rrr�testDirectNotFound�s



�z$Fail2banRegexTest.testDirectNotFoundc

Cs"|�t
d
tdd��

|�d�

dS)N�--print-all-ignoredrMzkevin from 192.0.2.0$z.Lines: 1 lines, 1 ignored, 0 matched, 0 missedrOr>rrr�testDirectIgnored�s




�z#Fail2banRegexTest.testDirectIgnoredc

CsL|�t
d
ddtt��

|�d�

|�d�

|�d�

|�d�

|�d�

dS)	NrGrJrK�0Lines: 19 lines, 0 ignored, 16 matched, 3 missed�Error decoding linez6Continuing to process line ignoring invalid characterszVDez 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 193.168.0.128zVDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10�rPr"�FILENAME_01�RE_00rEr>rrr�testDirectRE_1�s



�





z Fail2banRegexTest.testDirectRE_1c

	Cs&|�t
d
dddtt��

|�d�

dS)NrGrJrK�--rawz0Lines: 19 lines, 0 ignored, 19 matched, 0 missedrYr>rrr�testDirectRE_1raw�s



�z#Fail2banRegexTest.testDirectRE_1rawc


Cs\|�t
d
ddddtt��

|�d�

|��
|�t
ddd	d
��

|jddd
�
|�d�

dS)NrGrJrKr]z--usedns=norW�-d�^Epochz1490349000 test failed.dns.chz^\s*test <F-ID>\S+</F-ID>rNT�
�allz)Unable to find a corresponding IP address)rPr"rZr[rE�pruneLog�assertNotLoggedr>rrr�testDirectRE_1raw_noDns�s



�



�
z)Fail2banRegexTest.testDirectRE_1raw_noDnsc

Cs$|�t
d
ddtt��

|�d�

dS)NrGrJrK�/Lines: 13 lines, 0 ignored, 5 matched, 8 missed�rPr"�FILENAME_02r[rEr>rrr�testDirectRE_2�s



�z Fail2banRegexTest.testDirectRE_2c

Cs@|�t
d
ddddddtt�	�

|�d�

|�d	�

|�d
�

dS)NrGrJz
--timezonezUTC+0200z	--verbose�--verbose-daterLrfz&141.3.81.106  Sun Aug 14 11:53:59 2005z&141.3.81.106  Sun Aug 14 11:54:59 2005rgr>rrr�testVerbose�s




�


zFail2banRegexTest.testVerbosec


Csv|�t
d
ddddddttd�
�

|jd	d
dd�
|��
|�t
d
dd
dtdd��

|jdddd�
|jdddd�
dS)N�-lr�-vrjrKrU�-cr:�8[29116]: User root not allowed because account is lockedz)[29116]: Received disconnect from 1.2.3.4Tra�-vvzRDec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.1zsshd[logtype=short]zReal  filter options :z'logtype': 'short'�'logtype': 'file'�'logtype': 'journal')rPr"r�
FILENAME_SSHDrErcrdr>rrr�testVerboseFullSshd�s$




�
�



�
z%Fail2banRegexTest.testVerboseFullSshdc


Cs0|�t
d
dddttd��

|jdddd	d
�
dS)NrlrrKrnzsshd.conf[mode=normal]z"[29116]: Connection from 192.0.2.4ro�+[29116]: Received disconnect from 192.0.2.4Tra)rPr"r�FILENAME_ZZZ_SSHDrEr>rrr�testFastSshd�s




�



�zFail2banRegexTest.testFastSshdc


Cs>|�t
d
ddddtj�t�
ttj�t�
��

|jddd�
dS)	NrlrrKrSrnruTra)	rPr"r3�path�dirname�FILTER_ZZZ_SSHDrv�basenamerEr>rrr�testMultilineSshd
s



�

�z#Fail2banRegexTest.testMultilineSshdc

Cs|�t
d
dttd��

dS)Nrlrz[mode=test])rPr"�FILENAME_ZZZ_GEN�FILTER_ZZZ_GENr>rrr�testFullGeneric
s


�z!Fail2banRegexTest.testFullGenericc

Csld
D]1}
|�d|
�

|�
tddddddd	d
|
dd�	�

|�d
|
d|
df�

|jdddd�
qdS)N)r�z[test-phase %s]�--usedns�nor_r`rK�
--maxlines�
5z1490349000 TEST-NL
�L1490349000 FAIL
1490349000 TEST1
1490349001 TEST2
1490349001 HOST 192.0.2.34�*^\s*FAIL\s*$<SKIPLINES>^\s*HOST <HOST>\s*$z0Lines: %s lines, 0 ignored, 2 matched, %s missed�rz|  1490349000 FAILz|  1490349001 HOST 192.0.2.34Tra)rcrPr"rE)r&�preLinesrrr�testDirectMultilineBuf
s




���z(Fail2banRegexTest.testDirectMultilineBufc


Cs:|�t
d
dddddddd	d
�
�

|�d�

|�dd
�
dS)Nr�r�r_r`�
--debuggexrKr�r�r�r��.Lines: 4 lines, 0 ignored, 2 matched, 2 missedz&flags=mz?flags=m�rPr"rEr>rrr�testDirectMultilineBufDebuggex)
s



�
z0Fail2banRegexTest.testDirectMultilineBufDebuggexc

Cs,|�t
d
dddddddd	�	�

|�d
�

dS)Nr�r�r_r`rKz-L�
2z)1490349000 FAIL: failure
host: 192.0.2.35z^\s*FAIL:\s*.*\nhost:\s+<HOST>$z.Lines: 2 lines, 0 ignored, 2 matched, 0 missedr�r>rrr�testSinglelineWithNLinContent3
s



�z/Fail2banRegexTest.testSinglelineWithNLinContentc


Cs(|�t
d
dddddd��

|�d�

dS)	Nz-rr_�^\[{LEPOCH}\]\s+r�r�z�[1516469849] 192.0.2.1 FAIL: failure
[1516469849551] 192.0.2.2 FAIL: failure
[1516469849551000] 192.0.2.3 FAIL: failure
[1516469849551.000] 192.0.2.4 FAIL: failurez^<HOST> FAIL\b�.Lines: 4 lines, 0 ignored, 4 matched, 0 missedr�r>rrr�testRegexEpochPatterns<
s



�z(Fail2banRegexTest.testRegexEpochPatternsc


Cs8|�t
d
dddddd��

|�d�

|jd	d
dd�
dS)
Nrpr_r�r�r�z�[1516469849] 192.0.2.1 FAIL: failure
[1516469849] 192.0.2.1/24 FAIL: failure
[1516469849] 2001:DB8:FF:FF::1 FAIL: failure
[1516469849] 2001:DB8:FF:FF::1/60 FAIL: failure
z^<SUBNET> FAIL\br�z192.0.2.0/24z2001:db8:ff:f0::/60Trar�r>rrr�testRegexSubnetG
s



�

z!Fail2banRegexTest.testRegexSubnetc

Csh
|�t
d
dtt��

|�d�

|��
|�t
d
ddd��

|�td�
�

|��
|�t
d
ddd��

|��
|�t
d
dd	d
��

|�td�
�

|��
|�t
d
dtt��

|jd
dddd�
|��
|�t
d
dtt��

|jddddd�
|��
|�t
d
dtt��

|�t�

|��
|�t
d
dtt��

|�d�

|��
|�t
d
dtt��

|�d�

|��
dS)N�-o�id�kevinz"1591983743.667 192.0.2.1 192.0.2.2z(^\s*<F-ID/> <F-TUPLE_ID>\S+</F-TUPLE_ID>)z	192.0.2.1�	192.0.2.2z#1591983743.667 left 192.0.2.3 rightzM^\s*<F-TUPLE_ID_1>\S+</F-TUPLE_ID_1> <F-ID/> <F-TUPLE_ID_2>\S+</F-TUPLE_ID_2>z+1591983743.667 left [192.0.2.4]:12345 rightzc^\s*<F-TUPLE_ID_1>\S+</F-TUPLE_ID_1> <F-ID><ADDR>:<F-PORT/></F-ID> <F-TUPLE_ID_2>\S+</F-TUPLE_ID_2>)z[192.0.2.4]:12345�left�right�rowz['kevin'z'ip4': '192.0.2.0'z'fid': 'kevin'Traz['192.0.2.0'z'user': 'kevin'r%�userz<ip>, <F-USER>, <family>z192.0.2.0, kevin, inet4)rPr"rQ�RE_00_IDrErc�str�
RE_00_USERr>rrr�testFrmtOutputS
sF





�



�


�













z Fail2banRegexTest.testFrmtOutputc

	Cst|�t
d
dddtt��

|jddddd	�
|��
|�t
d
d
ddtt��

|jddd	�
|jdddd	�
|��
dS)Nr_rHr�zFound-ID:<F-ID>z*Found a match but no valid date/time foundzMatch without a timestamp:zFound-ID:kevinTraz{NONE})rPr"�STR_00_NODTr�rErcrdr>rrr�testNoDateTime~
s 



�

�

�z Fail2banRegexTest.testNoDateTimec
Csp
tj
jd
d�

|�tdddtddtdtd	��

t�d�
}
|�d
|
dv
o+d
|
dv�

|j	d
|
dd
|
dd
d�
|�
d�

|�d�

|�tdddtddtdtd��

|j	d
|
dd
|
dd
|
dd
|
dd
d�
|�
d�

|�d�

|�tdddtddtdtd��

t�d�
dd�t�d�
dd�}
|j	d|
dd|
dd|
dd
d�
dS)NT�
�stockr�z<ip>, <F-USER>, <msg>rnr�r��

z&sshd[logtype=short, publickey=invalid]r�������z192.0.2.2, git, raz192.0.2.1, git, zA[test-phase 1] mode=aggressive & publickey=nofail + OK (accepted)z$sshd[logtype=short, mode=aggressive]������zL[test-phase 2] mode=aggressive & publickey=nofail + FAIL (closed on preauth)rr)
�unittest�F2B�SkipIfCfgMissingrPr"r�STR_ML_SSHD�STR_ML_SSHD_OK�splitrErdrc�STR_ML_SSHD_FAIL)r&�linesrrr�testFrmtOutputWrapML�
sL



�






�





�








�





�$








�z&Fail2banRegexTest.testFrmtOutputWrapMLc

Cs|�t
tt��

dSr)rDr"r}r>rrr�testWrongFilterFile�
s

�z%Fail2banRegexTest.testWrongFilterFilec
Csd
dlm
}

|
��
dS)Nr)
�_decode_line_warn)�
server.filterr��clear)r&r�rrr�_reset�
s
zFail2banRegexTest._resetc

	Csdtj
jd
d�

|��
|�tddddtt��

|�d�

|�d�

|�d	�

|�d
�

|�d�

dS)NTr�rlrrGrJr�rXz7Continuing to process line ignoring invalid characters:zMNov  8 00:16:12 main sshd[32548]: input_userauth_request: invalid user llincozkNov  8 00:16:12 main sshd[32547]: pam_succeed_if(sshd:auth): error retrieving information about user llinco�	r�r�r�r�rPr"�FILENAME_WRONGCHAR�FILTER_SSHDrEr>rrr�testWronChar�
s





�





zFail2banRegexTest.testWronCharc

CsVtj
jd
d�

|��
|�tddddddttd	�	�

|�d
�

|�d�

|�d�

dS)
NTr�rlrrGrJr�rKzllinco[^\\]rXz.Lines: 4 lines, 1 ignored, 2 matched, 1 missedzhttps://r�r>rrr�testWronCharDebuggex�
s







�


z&Fail2banRegexTest.testWronCharDebuggexc

CsP|�t
�d
�
|��
|�t
d�
d
�
|�t���

|��
|�t
d�
d
�
dS)Nrz-Vz	--version)�assertNotEqualr8rc�assertEqualrEr�normVersionr>rrr�testExecCmdLine_Usage�
s





z'Fail2banRegexTest.testExecCmdLine_Usagec

C�$|�t
d
dtd�d�
|�d�

dS)Nrl�inforMrrN)r�r8rQrEr>rrr�testExecCmdLine_Direct�
�


��z(Fail2banRegexTest.testExecCmdLine_Directc

Cr�)Nrlr�zAuthentication failurerzNo failure-id group in )r�r8rQrEr>rrr�testExecCmdLine_MissFailID�
r�z,Fail2banRegexTest.testExecCmdLine_MissFailIDc

	CsR|�t
d
ddddd�d�
|�d�

|��
|�t
d	dddd�d�
|�d
�

dS)Nrlrr_z%:%.%-�LOG�RErz ERROR: Failed to set datepatternrmzFailed to set datepattern)r�r8rErcr>rrr�testExecCmdLine_ErrorParam�
s
��



��z,Fail2banRegexTest.testExecCmdLine_ErrorParamc

Cs�tj
st�d
�
�
|�tdtdd��

|�d�

|�d�

|�d�

|�	�
|�tdtdd	d��

|�d�

|�d�

dS)
Nz.Skip test because no systemd backend availablezsystemd-journalz,[journalmatch="SYSLOG_IDENTIFIER=
dummy
",z; failregex="^
dummy regex, never match <F-ID>xxx</F-ID>"]rrrqz.Lines: 0 lines, 0 ignored, 0 matched, 0 missedz[logtype=file,z, journalmatch="SYSLOG_IDENTIFIER=
dummy
",)
r�
FilterSystemdr��SkipTestrPr"r~rErdrcr>rrr�testLogtypeSystemdJournal
s0





���







����

z+Fail2banRegexTest.testLogtypeSystemdJournalN)$r(r)r*r=r@rFrIrRrTrVr\r^rerirkrtrwr|rr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrrrr;wsD		

	+-
r;)3�
__author__�
__copyright__�__license__r3r0r��clientr�client.fail2banregexrrrrr	�utilsrrr
rrrrx�joinry�__file__�TEST_CONFIG_DIR�TEST_FILES_DIRr1rr"�	Exceptionr#r8rQr�r[r�r�rZrhr�r�r�r�rsr�rvrzr}r~r;rrrr�<module>
sL