Current File : //lib/python2.7/site-packages/fail2ban/server/actions.pyc
�
��&dc @ s; d Z d Z d Z d d l Z d d l Z d d l Z d d l Z d d l m Z y d d l m Z Wn e
k
r e Z n Xd d l m
Z
m Z d d l m Z d d
l m Z d d l m Z m Z m Z d d l m Z d d
l m Z d d l m Z d d l m Z e e � Z d e e f d � � YZ! d S( s
Cyril Jaquiers Copyright (c) 2004 Cyril Jaquiert GPLi����N( t Mapping( t OrderedDicti ( t
BanManagert BanTicket( t IPAddr( t
JailThread( t
ActionBaset
CommandActiont
CallingMap( t MyTime( t Observers( t Utilsi ( t getLoggert Actionsc B sY e Z d Z d � Z e d � � Z d d e d � Z e d � Z
d � Z d � Z d � Z
d � Z d � Z d
� Z d � Z d � Z d
� Z e d � Z d � Z d e e d � Z d d � Z d � Z d e f d � � YZ d � Z d d � Z d d � Z d e d � Z d � Z d d � Z e d e d � Z! d e d � Z" d d � Z# RS(! s� Handles jail actions.
This class handles the actions of the jail. Creation, deletion or to
actions must be done through this class. This class is based on the
Mapping type, and the `add` method must be used to add new actions.
This class also starts and stops the actions, and fetches bans from
the jail executing these bans via the actions.
Parameters
----------
jail: Jail
The jail of which the actions belongs to.
Attributes
----------
daemon
ident
name
status
active : bool
Control the state of the thread.
idle : bool
Control the idle state of the thread.
sleeptime : int
The time the thread sleeps for in the loop.
c C sj t j | d d | j �| | _ t � | _ t � | _ d | _ d | _ d | _
| j
d | _ d S( Nt names f2b/a.i i
i ( R t __init__R t _jailR t _actionsR t _Actions__banManagert banEpocht _Actions__lastConsistencyCheckTMt
banPrecedencet
unbanMaxCount( t selft jail( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR N s c C sf t j | � } t | d � s1 t d | � � n1 t | j t � sb t d | | j j f � � n | S( Nt Actions& %s module does not have 'Action' classs0 %s module %s does not implement required methods( R t load_python_modulet hasattrt RuntimeErrort
issubclassR R t __name__( t pythonModulet mod( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt _load_python_module\ s c C s� | | j k rt | s( t d | � � n | j | } t | d � rt t | d � rm | j � | | j | <n d Sn | d k r� t | j | � } n' | j | � } | j | j | | � } | | j | <d S( s� Adds a new action.
Add a new action if not already present, defaulting to standard
`CommandAction`, or specified Python module.
Parameters
----------
name : str
The name of the action.
pythonModule : str, optional
Path to Python file which must contain `Action` class.
Default None, which means `CommandAction` is used.
initOpts : dict, optional
Options for Python Action, used as keyword arguments for
initialisation. Default None.
Raises
------
ValueError
If action name already exists.
RuntimeError
If external Python module does not have `Action` class
or does not implement necessary methods as per `ActionBase`
abstract class.
s Action %s already existst reloadt clearAllParamsN(
R t
ValueErrorR R$ t _reload_actionst NoneR R R" R ( R R R t initOptsR# t actiont customActionModule( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt addi s
c s� | r t � � _ n� t � d � r� xO � j j � D]> \ } } | � j k r4 � j | j | rh | n i � q4 q4 Wt � f d � � j j � D� � } t | � r� � j d t d | d t
� � j d | � n t � d � n d S( s@ Begin or end of reloading resp. refreshing of all parameters
R& c 3 s0 | ]& \ } } | � j k r | | f Vq d S( N( R& ( t .0R R) ( R ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pys <genexpr>� s t dbt actionst stopN(
t dictR& R t iteritemsR R# R t lent _Actions__flushBant Falset Truet stopActionst delattr( R t beginR R( t delacts( ( R s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR# � s '% c C s7 y | j | SWn! t k
r2 t d | � � n Xd S( Ns Invalid Action name: %s( R t KeyError( R R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __getitem__� s
c C s6 y | j | =Wn! t k
r1 t d | � � n Xd S( Ns Invalid Action name: %s( R R: ( R R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __delitem__� s
c C s
t | j � S( N( t iterR ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __iter__� s c C s
t | j � S( N( R2 R ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __len__� s c C s t S( N( R4 ( R t other( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __eq__� s c C s
t | � S( N( t id( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __hash__� s c C s4 t j | � } | j j | � t j d | � d S( Ns
banTime: %s( R
t str2secondsR t
setBanTimet logSyst info( R t value( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRE � s c C s
| j j � S( N( R t
getBanTime( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRI � s c sY | j j � � | s � St | � d k rC | d � k r? d Sd St � f d � | � S( Ni i c s | � k r d Sd S( Ni i ( ( t ip( t lst( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt <lambda>� s ( R t
getBanListR2 t map( R t ids( ( RK s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt getBanned� s c C s | j j d t d | � S( sk Returns the list of banned IP addresses.
Returns
-------
list
The list of banned IP addresses.
t orderedt withTime( R RM R5 ( R RR ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRM � s c sS t j � � t | t � r4 � f d � | D� } n t | � � f } | j | � S( s Ban an IP or list of IPs.c 3 s | ] } t | � � Vq d S( N( R ( R, RJ ( t unixTime( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pys <genexpr>� s ( R
t timet
isinstancet listR t _Actions__checkBan( R RJ t tickets( ( RS s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt addBannedIP� s
c C s� | d k r | j | � St | t t f � r� g } d } xU | D]M } y | | j | | | � 7} WqA t k
r� | s� | j | � q� qA XqA W| r� t d | � � n | S| r� | j j d k r� | j j j
| j | � n | j j | � } | d k r| j
| � n� t | t � sot | � } | j sot | j | j j � � } | rl| j | | | � Sqon d | }
t j t j |
� | r�d St |
� � d S( sO Removes banned IP calling actions' unban method
Remove a banned IP now, rather than waiting for it to expire,
even if set to never expire.
Parameters
----------
ip : list, str, IPAddr or None
The IP address (or multiple IPs as list) to unban or all IPs if None
Raises
------
ValueError
If `ip` is not banned
i s not banned: %rs %s is not bannedi N( R' R3 RU RV t tuplet removeBannedIPR% t appendR t databaset delBanR t
getTicketByIDt _Actions__unBanR t isSinglet filtert containsRM RF t logt loggingt MSG( R RJ R- t ifexistst missedt cntt it tickett ipat ipst msg( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR[ � s>
c C s� | d k r | j } n | j � } | j � x� | D]� \ } } y | j � WnD t k
r� } t j d | j j | | d t j
� t j k �n X| j | =t j
d | j j | � q5 Wd S( s> Stops the actions in reverse sequence (optionally filtered)
s( Failed to stop jail '%s' action '%s': %st exc_infos %s: action %s terminatedN( R' R t itemst reverseR/ t ExceptionRF t errorR R t getEffectiveLevelRe t DEBUGt debug( R R. t
revactionsR R) t e( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR6 / s
c sK d } xr � j j � D]a \ } } y | j � Wq t k
rv } t j d � j j | | d t j � t j
k �q Xq Wx�� j r,y^� j r� t j
d � t j � f d � d � � j � t j
d � w~ n d } t � j � j j t j � � } t j d d | � j � t j � f d
� | � rJ� j � } | | 7} n | s`| � j k r�� j r�| d 9} t j d d | r�| � j k r�| n � j | � j � � j | r�| � j k r�| n � j � n d } n Wq~ t k
r(} t j d
� j j | d t j � t j
k �q~ Xq~ W� j d t � � j � t S( s� Main loop for Threading.
This function is the main loop of the thread. It checks the jail
queue and executes commands when an IP address is banned.
Returns
-------
bool
True when the thread exits nicely.
i s) Failed to start jail '%s' action '%s': %sRo s Actions: enter idle modec s � j p � j S( N( t activet idle( ( R ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL X s c S s t S( N( R4 ( ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL Y s s Actions: leave idle modei s1 Actions: wait for pending tickets %s (default %s)c s � j p � j j S( N( Ry R t hasFailTickets( ( R ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL ` s i s+ Actions: check-unban %s, bancnt %s, max: %ss* [%s] unhandled error in actions thread: %sR/ ( R R1 t startRr RF Rs R R Rt Re Ru Ry Rz Rv R t wait_fort sleeptimet minR t _nextUnbanTimeR
RT Rd RW R R t _Actions__checkUnBanR3 R5 R6 ( R Ri R R) Rx t bancntt wt( ( R s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt runA sF
"
:.
t
ActionInfoc B s� e Z d) Z i d � d 6d � d 6d � d 6d � d 6d
� d 6d � d 6d
� d 6d � d 6d � d 6d � d 6d � d 6d* d � d 6d � d 6d � d 6d � d 6d � d 6d! � d 6Z e j d+ Z d* e e d% � Z d& � Z d' � Z
e d( � Z RS(, t fids
raw-ticketc C s
| j j � S( N( t _ActionInfo__tickett getIP( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL y s RJ c C s | d j S( NRJ ( t familyStr( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL z s t familyc C s | d j d � S( NRJ t ( t getPTR( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL { s s ip-revc C s | d j � S( NRJ ( t getHost( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL | s s ip-hostc C s
| j j � S( N( R� t getID( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL } s c C s
| j j � S( N( R� t
getAttempt( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL ~ s t failuresc C s
| j j � S( N( R� t getTime( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL s RT c C s
| j � S( N( t _getBanTime( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t bantimec C s
| j j � S( N( R� t getBanCount( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t bancountc C s d j | j j � � S( Ns
( t joinR� t
getMatches( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t matchesc C s | j j r d Sd S( Ni i ( R� t restored( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s R� c C s | j j | � S( N( R� t getData( R t tag( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s s F-*c C s d j | j t � j � � S( Ns
( R� t _mi4ipR5 R� ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t ipmatchesc C s d j | j � j � � S( Ns
( R� R� R� ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t
ipjailmatchesc C s | j t � j � S( N( R� R5 R� ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t
ipfailuresc C s | j � j � S( N( R� R� ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t ipjailfailuresc C s
t | j � S( N( t reprR� ( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyRL � s t __tickett __jailt __mi4ipc C s4 | | _ | | _ t � | _ | | _ | | _ d S( N( R� t _ActionInfo__jailR0 t storaget immutablet data( R Rk R R� R� ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR � s
c C s( | j | j | j | j | j j � � S( N( t __class__R� R� R� R� t copy( R ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR� � s c C s: | j j � } | d k r0 | j j j � } n t | � S( N( R� RI R' R� R. t int( R t btime( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR� � s c C s6 t | d � s i | _ n | j } | r0 d n d } | | k ra | | d k rZ | | S| j Syr | j } | d } d | | <| j s� | j S| r� | j j d | � | | <n | j j d | d | � | | <WnA t k
r} t j d | | j
| d t j � t j
k �n X| | d k r/| | S| j S( s� Gets bans merged once, a helper for lambda(s), prevents stop of executing action by any exception inside.
This function never returns None for ainfo lambdas - always a ticket (merged or single one)
and prevents any errors through merging (to guarantee ban actions will be executed).
[TODO] move merging to observer - here we could wait for merge and read already merged info from a database
Parameters
----------
overalljails : bool
switch to get a merged bans :
False - (default) bans merged for current jail only
True - bans merged for all jails of current ip address
Returns
-------
BanTicket
merged or self ticket only
R� t allR RJ s+ Failed to get %s bans merged, jail '%s': %sRo N( R t _ActionInfo__mi4ipR' R� R� R] t
getBansMergedRr RF Rs R Rt Re Ru ( R t overalljailst mit idxR RJ Rx ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR� � s*
#( R� s
raw-ticketN( s __tickets __jails __mi4ip(
R t
__module__t
CM_REPR_ITEMSR' t AI_DICTR t __slots__R5 R R� R� R4 R� ( ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR� t s0
c C s7 | s t d t j � � } n t j | | j � } | S( NR� ( R R
RT R R� R ( R Rk t aInfo( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt _getActionInfo� s id c c sE d } x8 | | k r@ | j j � } | s. Pn | V| d 7} q Wd S( sA Generator to get maximal count failure tickets from fail-manager.i i N( R t
getFailTicket( R t countRi Rk ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __getFailTickets� s c s� d } | s! | j | j � } n d } xK| D]C} t j | � � | j | j j � � } � j � } | j � � } i } | j j � d | �r�| d 7} t
j d k r� � j r� t
j j
d � | j | � n t j d | j j � j s� d n d | � x� | j j � D]� \ } }
yH � j rAt |
d t � rAwn | j sW| j � n |
j | � Wqt k
r�} t j d | j j | | | d
t j � t j k �qXqWt � _ | j rq| j � _ qqq. | j! d d � rt j" d | j j | � q. n | j! d
� � � � j r^| j# � � j# � } | d k rNt j n | d k rct j$ n t j% }
t j& |
d | j j | � � j | j k r�| d k r�| r�t' j( � | j) d k r�x! | j j* � D] }
|
j+ � q�Wt' j( � | _) q�n � j | j k rq| s?t, � f d � | j j � D� � } n | | j- � d | �7} qqq. | | j- � � 7} q. W| r�t j. d | | j j/ � | j j0 � | j j � n | S( s Check for IP address to ban.
If tickets are not specified look in the jail queue for FailTicket. If a ticket is available,
it executes the "ban" command and adds a ticket to the BanManager.
Returns
-------
bool
True if an IP address get banned.
i t reasoni t banFounds
[%s] %sBan %sR� s Restore t
norestoreds9 Failed to execute ban jail '%s' action '%s' info '%r': %sRo t expireds [%s] Ignore %s, expired bantimeRk i i< s [%s] %s already bannedc 3 s3 | ]) \ } } | j � j k r | | f Vq d S( N( R ( R, R R) ( t bTicket( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pys <genexpr>$ s R. s" Banned %s / %s, %s ticket(s) in %rN(1 t _Actions__getFailTicketsR R' R t wrapRI R R� R� t addBanTicketR t MainR� R+ R RF t noticeR R R1 t getattrR4 R� t resett banRr Rs Rt Re Ru R5 t bannedR t getRG R� t NOTICEt WARNINGRd R
RT R t
itervaluest consistencyCheckR0 t _Actions__reBanRv t getBanTotalt size( R RX Ri t rebanactsRk R� RJ R� R� R R) Rx t diftmt ll( ( R� s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt
__checkBan� sn
+
% (c C sI | p | j } | j � } | j | � } | ry t j d | j j | d t | � d k ro d | j � d n d � n x� | j � D]� \ } } yC t j
d | j j | | � | j s� | j � n | j
| � Wq� t k
r } t j d | j j | | | d t j � t j k �d SXq� Wt | _ | j rE| j | _ n d S(
s� Repeat bans for the ticket.
Executes the actions in order to reban the host given in the
ticket.
Parameters
----------
ticket : Ticket
Ticket to reban
s [%s] Reban %s%sRJ i s , action %ri R� s [%s] action %r: reban %ss; Failed to execute reban jail '%s' action '%s' info '%r': %sRo ( R R� R� RF R� R R R2 t keysR1 Rv R� R� t rebanRr Rs Rt Re Ru R5 R� R ( R Rk R. Rd RJ R� R R) Rx ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __reBan0 s* I
c
C s� | j j | � s d Sd } x� | j j � D]� \ } } yu | j r\ t | d t � r\ w, n | j sk w, n | d k r� | j | � } n | j
s� | j � n | j | � Wq, t
k
r� } t j d | j j | | | d t j � t j k �q, Xq, Wd S( NR� s9 Failed to execute ban jail '%s' action '%s' info '%r': %sRo ( R t
_inBanListR' R R1 R� R� R4 t _prolongableR� R� R� t prolongRr RF Rs R R Rt Re Ru ( R Rk R� R R) Rx ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt _prolongBanR s&
c C sw | j j t j � | � } x | D] } | j | � q" Wt | � } | rs t j d | | j j � | j j
� n | S( sK Check for IP address to unban.
Unban IP addresses which are outdated.
s Unbanned %s, %s ticket(s) in %r( R t unBanListR
RT R` R2 RF Rv R� R R ( R t maxCountRK Rk Ri ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __checkUnBani s
c s! t } | d k r1 t j d � � j j � } n t } t � j � } d } i } x+| d k rg | n � j j � D]\ } � yZ t
� d � r� t � t � s� � j
r� t j d � j j | � � j � r� wt q� n Wn� t k
rd} t j d � j j | | d t j � t j k �t j d � t
� d � re� � � f d � }
� j |
� qt qen Xt j d
� � | | <qt W| } | r�� j j d k r�t j d � � j j j � j � n x1 | D]) } � j | d | d
| �| d 7} q�Wt j d | � j j � � j j � | S( s� Flush the ban list.
Unban all IP address which are still in the banning list.
If actions specified, don't flush list - just execute unban for
given actions (reload, obsolete resp. removed actions).
s Flush ban listi t flushs [%s] Flush ticket(s) with %ss1 Failed to flush bans in jail '%s' action '%s': %sRo s' No flush occurred, do consistency checkR� c s1 � r- t � d d � r- � j j d � t St S( Nt actionrepair_on_unbans, Invariant check failed. Flush is impossible.( R� R' t _logSysRs R4 R5 ( ( R) R R/ ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt
_beforeRepair� s s Unban tickets each individualys Flush jail in databaseR. Rd i s! Unbanned %s, %s ticket(s) in %rN( R5 R' RF Rv R t flushBanListR4 R= R R1 R RU R t actionflushR� R R R� Rr Rs Rt Re Ru RG R� R] R^ R` R� ( R R- R. R/ Rd RK Ri t
unbactionsR Rx R� Rk ( ( R) R R/ s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt
__flushBanw sF
.(
c
C s
| d k r | j } n | } | j � } | j | � } | r_ t j d | j j | d � n x� | j � D]� \ } } yC t j d | j j | | � | j
s� | j � n | j | � Wql t
k
r} t j d | j j | | | d t j � t j k �ql Xql Wd S( s� Unbans host corresponding to the ticket.
Executes the actions in order to unban the host given in the
ticket.
Parameters
----------
ticket : FailTicket
Ticket of failures of which to unban
s
[%s] Unban %sRJ s [%s] action %r: unban %ss; Failed to execute unban jail '%s' action '%s' info '%r': %sRo N( R' R R� R� RF R� R R R1 Rv R� R� t unbanRr Rs Rt Re Ru (
R Rk R. Rd R� RJ R� R R) Rx ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt __unBan� s$
t basicc C s( d d d g } | d k s' | | k rA t j d | | f � n | d k rk | j j � } t | � } n | j j � } d | f d | j j � f g } | d k r� | d | f g 7} n | d k r$| j j � } | d | j j | � f d | j j
| � f d
| j j | � f g 7} n | S( sE Status of current and total ban counts and current banned IP list.
t shortR� t cymrus9 Unsupported extended jail status flavor %r. Supported: %ss Currently banneds Total banneds Banned IP lists Banned ASN lists Banned Country lists Banned RIR listN( R' RF t warningR RM R2 R� R� t getBanListExtendedCymruInfot geBanListExtendedASNt geBanListExtendedCountryt geBanListExtendedRIR( R t flavort supported_flavorsR� Ri t rett
cymru_info( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt status� s$ N($ R R� t __doc__R t staticmethodR" R' R4 R+ R5 R# R; R< R> R? RA RC RE RI RP RM RY R[ R6 R� R R� R� R� RW R� R� R� R3 R` R� ( ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyR 2 s:
.
: 3X
T" 6 (" t
__author__t
__copyright__t __license__Re t ost sysRT t collectionsR R t ImportErrorR0 t
banmanagerR R t ipdnsR t
jailthreadR R) R R R t mytimeR
t observerR t utilsR t helpersR
R RF R ( ( ( s; /usr/lib/python2.7/site-packages/fail2ban/server/actions.pyt <module> s*
Mini Shell