Current File : //usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyo
�
��&dc @ s� d Z d Z d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
m Z m Z m
Z
d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z d d
l m Z d d l m Z d d l m Z m! Z! m" Z" d d l# m$ Z$ m% Z% m& Z& d d l' m( Z( y d d l m) Z) Wn e* k
rwe+ Z) n Xe j, j- e j, j. e/ � d � Z0 d Z1 e$ d � Z2 d e f d � � YZ3 d e f d � � YZ4 d e4 f d � � YZ5 d e4 f d � � YZ6 d e j7 f d � � YZ8 d! e j7 f d" � � YZ9 d# e f d$ � � YZ: d% e f d& � � YZ; d d' l< m= Z= m> Z> m? Z? d( e f d) � � YZ@ d S(* s
Cyril Jaquiers Copyright (c) 2004 Cyril Jaquiert GPLi����Ni ( t Regext FailRegext RegexException( t actions( t Server( t IPAddr( t Jail( t
JailThread( t BanTicket( t Utilsi ( t DummyJail( t LogCaptureTestCaset
with_alt_timet MyTime( t getLoggert extractOptionst
PREFER_ENC( t version( t
filtersystemdt filest pollingt fail2bant
TestServerc B s e Z d � Z d � Z RS( c O s d S( N( ( t selft argst kwargs( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt setLogLevel< s c O s d S( N( ( R R R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt setLogTarget? s ( t __name__t
__module__R R ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR ; s t TransmitterBasec B sM e Z d � Z d � Z d d d e d � Z d d � Z d � Z d � Z RS( c C sE t t | � j � | j j | _ d | _ | j j | j t � d S( Nt TestJail1( t superR t setUpt servert _Server__transmt transmt jailNamet addJailt FAST_BACKEND( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR" E s c C s$ | j j � t t | � j � d S( N( R# t quitR! R t tearDown( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR* N s
i c
s� d | | g } d | g } | d k rJ | j d | � | j d | � n | d k r_ | } n � f d � } | j | | j j | � � | | | f � � | s� | j | | j j | � � | d | f � � n d S( Nt sett geti c s � r t | � S| S( N( t repr( t x( t repr_( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt va s i ( N( t Nonet insertt assertEqualR% t proceed(
R t cmdt inValuet outValuet outCodet jailR/ t setCmdt getCmdR0 ( ( R/ sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
setGetTestT s .c C s� d | | g } d | g } | d k rJ | j d | � | j d | � n | j j | � d } | j | j j | � d d � | j | j j | � d | f � d S( NR+ R, i i ( R1 R2 R% R4 R3 ( R R5 R6 R9 R: R; t initValue( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
setGetTestNOKj s c C s� d | } d | } | j | j j d | | g � d g f � x� t | � D]� \ } } | j j d | | | g � } | j | d t t | d � f d t t | | d � f d d �| j j d | | g � } | j | d t t | d � f d t t | | d � f d d �qL Wx� t | � D]� \ } } | j j d | | | g � } | j | d t t | d � f d t t | | d � f d d �| j j d | | g � } | j | d t t | d � f d t t | | d � f d d �q*Wd S( Nt addt delR, i R+ i t leveli ( R3 R% R4 t enumeratet assertSortedEqualt mapt str( R R5 t valuesR9 t cmdAddt cmdDelt nt valuet ret( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt jailAddDelTestw s
% DH Dc C sO d | } d | } | j | j j d | | g � d g f � x� t | � D]u \ } } | j | j j d | | | g � d | | d f � | j | j j d | | g � d | | d f � qL Wx� t | � D]u \ } } | j | j j d | | d g � d | | d f � | j | j j d | | g � d | | d f � q� Wd S( NR? R@ R, i R+ i ( R3 R% R4 RB ( R R5 t inValuest outValuesR9 RG RH RI RJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt jailAddDelRegexTest� s$
%N( N(
R R R" R* R1 t FalseR< R> RL RO ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR C s
t Transmitterc B s� e Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d
� Z d � Z
d � Z d
� Z d � Z d � Z d � Z d � Z e d � � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z! d � Z" d � Z# d! � Z$ d" � Z% d# � Z& d$ � Z' d% � Z( d& � Z) d' � Z* d( � Z+ d) � Z, d* � Z- d+ � Z. d, � Z/ RS(- c C s# t � | _ t t | � j � d S( N( R R# R! RQ R" ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR" � s c C s | j | j j � � d S( N( t assertFalseR# t isStarted( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testServerIsNotStarted� s c C s# | j | j j d g � d � d S( Nt stopi ( i N( R3 R% R4 R1 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testStopServer� s c C s# | j | j j d g � d � d S( Nt pingi t pong( i RX ( R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testPing� s c C s, | j | j j d g � d t j f � d S( NR i ( R3 R% R4 R ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testVersion� s c C s� t j j s� t j � } | j | j j d d g � d � t j � } | | } | j d | k om d k n d d | �n" | j | j j d d g � d
� d S( Nt sleeps 0.1i g
ףp=
�?g�������?t msgs Sleep was %g secs 0.0001( i N( i N( t unittestt F2Bt fastt timeR3 R% R4 R1 t
assertTrue( R t t0t t1t dt( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testSleep� s "
0c C s, t j j s' t j d d � \ } } n d } | j d | � | j j | j � | j d | � | j d | � | j d d d � | j d d � | j d d
d � | j d d � | j j
| j t � | j d | � | j j | j � | j | j
j d d d
g � d � | j | j
j d d g � d � | j | j
j d d d g � d � | j | j
j d d g � d � | j | j
j d d d g � d � | j | j
j d d g � d � | j j
| j t � | j | j
j d d d
g � d � t j j s(t j | � t j | � n d S( Ns .dbt fail2ban_s :memory:t dbfilet dbmaxmatchest 100id t LIZARDt
dbpurgeaget 600iX R+ R1 i R, t 500( i N( i N( i N( i N( i N( i N( i N( R] R^ t memory_dbt tempfilet mkstempR> R# t delJailR& R< R' R( R3 R% R4 R1 t ost closet unlink( R t tmpt tmpFilename( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testDatabase� sN
c C s d } d } d } | j | j j d | d g � d | f � | j | j j d | g � d | f � | j | j j d | d g � d d � | j | j j d | d g � d | f � | j | j j d | j d g � d d � | j | j j d d
d g � d d � d S( Nt TestJail2t TestJail3t TestJail4R? R i s invalid backendi t autos --all( R3 R% R4 R& ( R t jail2t jail3t jail4( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testAddJail� s %(#%&c s� � j � j j d � j g � d � t j t j � � j t j
� f d � d � � � j � j j d � j g � d � � j � j � j j
� d S( Nt starti c s5 � j j d � o4 t � j j d � j g � t � S( Ni t status( R# t isAlivet
isinstanceR% R4 R& t RuntimeError( ( R ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt <lambda> s i RU ( i N( i N( R3 R% R4 R& R1 R` R[ R
t DEFAULT_SLEEP_TIMERa t wait_fort assertNotInR# t _Server__jails( R ( ( R sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testStartStopJail� s
c s � j j d t � � j � j j d � j g � d � � j � j j d d g � d
� t j t
j � � j t
j
� f d � d � � � j � j j d d g � d � � j t
j
� f d � d � � � j � j � j j � � j d � j j � d S( NRx R� i c s5 � j j d � o4 t � j j d � j g � t � S( Ni R� ( R# R� R� R% R4 R& R� ( ( R ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� s i RU s --allc s t � j j � S( N( t lenR# R� ( ( R ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� s ( i N( i N( i N( R# R' R( R3 R% R4 R& R1 R` R[ R
R� Ra R� R� R� ( R ( ( R sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testStartStopAllJail s
""c C s� | j | j j d | j d d g � d t f � | j | j j d | j d d g � d t f � | j | j j d | j d d g � d d � d S( NR+ t idlet oni t offt CATi ( R3 R% R4 R& t TrueRP ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailIdle s
"c C s� | j d d d d | j �| j d d d d | j �| j d d d d | j �| j d d d
d | j �| j d d d | j �d S(
Nt findtimet 120ix R9 t 60i< t 30mi s -60i���t Dogi ( R< R& R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailFindTime( s
c C s� | j d d d d | j �| j d d d d | j �| j d d d d | j �| j d d d
d | j �| j d d d | j �d S( Nt bantimeRl iX R9 t 50i2 s -50i���s
15d 5h 30mi� t Cat( R< R& R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailBanTime/ s
c C s� | j d d d
d | j �| j d d d d | j �| j d d d d | j �| j d d d
d | j �| j d d d | j �d S( Nt datepatterns %%%Y%m%d%H%M%Ss %YearMonthDay24hourMinuteSecondR9 t Epochs ^Epochs {^LN-BEG}Epocht TAI64Ns
%Cat%a%%%g( s %%%Y%m%d%H%M%Ss %YearMonthDay24hourMinuteSecond( NR� ( Ns {^LN-BEG}Epoch( NR� ( R< R& R1 R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testDatePattern6 s
c C s9 | j d d d d | j �| j d d d | j �d S( Nt logtimezones UTC+0400R9 s not-a-time-zone( R< R& R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testLogTimeZoneB s c C s� | j d d d | j �| j d d d | j �| j d d d | j �d } | j | j j d | j d | g � d � d S(
Nt usednst yesR9 t warnt not FishR+ i ( i s no( R< R& R3 R% R4 ( R RJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailUseDNSF s c C s� | j j | j � | j | j j d | j d d d d g � d � | j d d d t d
t �| j | j j d | j d d g � d � | j d
d
t �| j | j j d | j d d d d d g � d � | j d d d t d
t �| j d d d t d
t �| j � | j | j j d | j d d d g � d d � | j | j j d | j d d d g � d � | j d d d t d
t �d S( NR+ t banips 192.0.2.1s 192.0.2.2i i s
Ban 192.0.2.1s
Ban 192.0.2.2t allt waitt Badgeri s
Ban Badgert unbanips 192.0.2.255s 192.0.2.254s Unban 192.0.2.1s Unban 192.0.2.2s 192.0.2.255 is not banneds 192.0.2.254 is not banneds --report-absent( i i ( i i ( i i ( i i ( R# t startJailR& R3 R% R4 t assertLoggedR� t pruneLog( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testJailBanIPQ s. $
# c s � j j � j � � f d � } � j d d d d � j �x? d D]7 } x. d D]& } � j | | d
| g � d � qR WqE W� j d d
d t d t �� j | | g d D] } d
| ^ q� � d � � j d d t �� j d d t �� j d � d S( Nc s# � j j d � j d | g | � S( NR+ t attempt( R% R4 R& ( t ipt matches( R ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� q s t maxretryt 5i R9 i i s 192.0.2.1s 192.0.2.2s test failure %di s 192.0.2.1:2s 192.0.2.2:2R� R� i i s 192.0.2.2:5s
Ban 192.0.2.2s
Ban 192.0.2.1( i i ( s 192.0.2.1s 192.0.2.2( i i ( i i i ( i i ( R# R� R& R< R3 R� R� t assertNotLogged( R R� t iR� ( ( R sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailAttemptIPn s
( 0c s d } � j j | t � � j j | � d d d
g � f d � } | | d g �| | d d d d d d g �| | d d d d d d d
g �| | d d d d d d g �| | d d d d d g �| | d d d d g �| | d d d g �d S( Nt TestJailBanListc s� | d k rN � j � j j d | d | g � d � � j d | d t �n | d k r� � j � j j d | d | g � d � � j d | d t �n � j � j j d | d g t | � � d | f d
t �t j
t j � d � d S(
NR+ R� i i s Ban %sR� R� s Unban %sR, t
nestedOnly( i i ( i i ( R1 R3 R% R4 R� R� RC t listRP R t setTimeR` ( R9 R� R� R t outList( R ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt _getBanListTest� s "R� R� s 127.0.0.1R s --with-times: 127.0.0.1 2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01s 192.168.0.1s< 192.168.0.1 2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02s 192.168.1.10R� ( ( s --with-time( s --with-time( R# R' R( R� R1 ( R R9 R� ( ( R sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailBanList� s&
c C sq | j d d d d | j �| j d d d d | j �| j d d d d | j �| j d d d | j �d S(
Nt
maxmatchesR� i R9 t 2i s -2i����t Duck( R< R& R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailMaxMatches� s c C sq | j d d d d | j �| j d d d d | j �| j d d d d | j �| j d d d | j �d S(
NR� R� i R9 R� i s -2i����R� ( R< R& R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailMaxRetry� s c C sn | j d d d d | j �| j d d d d | j �| j d d d | j �| j d d d | j �d S( Nt maxlinesR� i R9 R� i s -2R� ( R< R& R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailMaxLines� s c C sk | j d d d | j �| j d d d | j �| j d d t d | j �| j d d d | j �d S( Nt logencodings UTF-8R9 t asciiR{ t Monkey( R< R& R R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailLogEncoding� s
c C s | j d t j j t d � t j j t d � t j j t d � g | j � t j j t d � } | j | j j d | j d | g � d | g f � | j | j j d | j d | g � d | g f � | j | j j d | j d g � d | g f � | j | j j d | j d
| g � d g f � | j | j j d | j d | d g � d | g f � | j | j j d | j d | d g � d | g f � | j | j j d | j d | d
g � d d � | j | j j d | j d | | | g � d d � d S( Nt logpaths testcase01.logs testcase02.logs testcase03.logs testcase04.logR+ t
addlogpathi R, t
dellogpatht tailt headt badgeri ( RL Rr t patht joint TEST_FILES_DIRR& R3 R% R4 ( R RJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailLogPath� sF
c C sE d } | j j d | j d | g � } | j t | d t � � d S( Ns this_file_shouldn't_existR+ R� i ( R% R4 R& Ra R� t IOError( R RJ t result( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailLogPathInvalidFile� s c C sx t j d d � } | d } t j | | � | j j d | j d | g � } | j t | d t � � t j
| � d S( Nt prefixt tmp_fail2ban_broken_symlinks .slinkR+ R� i ( Ro t mktempRr t symlinkR% R4 R& Ra R� R� Rt ( R t namet snameR� ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailLogPathBrokenSymlink� s
c C s� | j d d d d g | j � d } | j | j j d | j d | g � d | g f � | j | j j d | j d | g � d | g f � | j | j j d | j d g � d | g f � | j | j j d | j d | g � d g f � | j | j j d | j d
g � d t f � | j | j j d | j d
t g � d t f � | j | j j d | j d
g � d t f � d S( Nt ignoreips 127.0.0.1s 192.168.1.1s 8.8.8.8R+ t addignoreipi R, t delignoreipt
ignoreself( RL R& R3 R% R4 R� RP ( R RJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailIgnoreIP s8
c C s | j d d d | j �d S( Nt
ignorecommands bin/ignore-command <ip>R9 ( R< R& ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailIgnoreCommand& s c C sE | j d d d d d
g d | j �| j d d d d | j �d S( Nt ignorecaches% key="<ip>",max-time=1d,max-count=9999s <ip>i' i i< R9 t i� i�Q ( R< R& R1 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailIgnoreCache) s
c C s | j d d d | j �d S( Nt prefregexs ^TestR9 ( R< R& ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailPrefRegex0 s c C s� | j d d d d g d t j d � d t j d � d t j d � g | j � | j | j j d | j d
d g � d d
� | j | j j d | j d
d g � d d
� d S( Nt failregexs user john at <HOST>s Admin user login from <HOST>s failed attempt from <HOST> agains user john at %ss <HOST>s Admin user login from %ss failed attempt from %s againR+ t addfailregexs
No host regexi i i� ( RO R t _resolveHostTagR& R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testJailRegex3 s
c C s� | j d d d d g d d t j d � d g | j � | j | j j d | j d d g � d
d � | j | j j d | j d d g � d
d � d S(
Nt ignoreregexs user johns Admin user login from <HOST>s Dont match me!s Admin user login from %ss <HOST>R+ t addignoreregexs Invalid [regexi i i2 ( RO R R� R& R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailIgnoreRegexK s
c C s� | j g } | j | j j d g � d d t | � f d d j | � f g f � | j j d t � | j d � | j | j j d g � d d t | � f d d j | � f g f � d S( NR� i s Number of jails Jail lists , Rx (
R& R3 R% R4 R� R� R# R' R( t append( R t jails( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testStatusc s .
c C s_ | j | j j d | j g � d d d d d g f g f d d
d d
g f g f g f � d S( NR� i t Filters Currently faileds Total faileds File listt Actionss Currently banneds Total banneds Banned IP list( s Currently failedi ( s Total failedi ( s Currently bannedi ( s Total bannedi ( R3 R% R4 R& ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailStatusl s c C sb | j | j j d | j d g � d d d d
d g f g f d d d d g f g f g f � d S( NR� t basici R� s Currently faileds Total faileds File listR� s Currently banneds Total banneds Banned IP list( s Currently failedi ( s Total failedi ( s Currently bannedi ( s Total bannedi ( R3 R% R4 R& ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailStatusBasic~ s !c C sb | j | j j d | j d g � d d d d
d g f g f d d d d g f g f g f � d S( NR� t INVALIDi R� s Currently faileds Total faileds File listR� s Currently banneds Total banneds Banned IP list( s Currently failedi ( s Total failedi ( s Currently bannedi ( s Total bannedi ( R3 R% R4 R& ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailStatusBasicKwarg� s !c C s� t j j � y d d l } d d l } Wn t k
rE d g } n Xg } | j | j j d | j d g � d d d d d g f g f d
d d d
g f d | f d | f d | f g f g f � d S( Ni����t errorR� t cymrui R� s Currently faileds Total faileds File listR� s Currently banneds Total banneds Banned IP lists Banned ASN lists Banned Country lists Banned RIR list( s Currently failedi ( s Total failedi ( s Currently bannedi ( s Total bannedi (
R] R^ t SkipIfNoNetworkt
dns.exceptiont dns.resolvert ImportErrorR3 R% R4 R& ( R t dnsRJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJailStatusCymru� s(
! c C s� d } d d d d d g } d d d d
d g } | j | j j d | j d
| g � d | f � | j | j j d | j d g � d d | � xT t | | � D]C \ } } | j | j j d | j d | | | g � d | f � q� WxQ t | | � D]@ \ } } | j | j j d | j d | | g � d | f � q� W| j | j j d | j d | d d g � d � | j | j j d | j d | d g � d � | j | j j d | j d | d g � d d � | j | j j d | j d | d d g � d � | j | j j d | j d | d g � d � | j | j j d | j d | g � d � | j | j j d | j d d g � d d � d S( Nt TestCaseActiont actionstartt
actionstopt actioncheckt actionbant actionunbans Action Starts Action Stops Action Checks
Action Bans Action UnbanR+ t addactioni R, R i t actiont KEYt VALUEt
InvalidKeyt timeoutt 10i
t delactions
Doesn't exist( i R ( i R ( i i
( i i
( i N( R3 R% R4 R& t zipR1 ( R R t cmdListt cmdValueListR5 RJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testAction� sj
! c
C s, d } yS | j j d | j d | t j j t d d � d g � } | j | d | f � Wng t k
r� d t j
k o� d! k n r� d | d k r� d
d l } | j d t j
� d S� n X| j | j j d | j d | g � d d d g � | j | j j d | j d | d g � d" � | j | j j d | j d | d g � d# � | j | j j d | j d | g � d d d d d d d g � | j | j j d | j d | d d g � d$ � | j | j j d | j d | d d g � d% � | j | j j d | j d | d d g � d& � d S(' NR R+ R s action.ds action.pys {"opt1": "value"}i i i i s# __init__() keywords must be stringsi i����s� Your version of Python %s seems to experience a known issue forbidding correct operation of Fail2Ban: http://bugs.python.org/issue2646 Upgrade your Python and meanwhile other intestPythonActionMethodsAndProperties will be skippedR, t actionpropertiest opt1t opt2R RJ t
actionmethodst bant rebanR� RU t
testmethodt unbans {"text": "world!"}s Hello world! values
another values Hello world! another value( i i ( i i i ( i s value( i N( i s Hello world! value( i s
another value( i s Hello world! another value( R% R4 R& Rr R� R� R� R3 t AssertionErrort syst version_infot warningsR� R RC R1 ( R R t outR" ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt$ testPythonActionMethodsAndProperties� sX
c C s* | j | j j d d g � d d � d S( NR� t COMMANDi i ( R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testNOK0 s c C s- | j | j j d d d g � d d � d S( NR+ R� R% i i ( R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testSetNOK3 s c C s- | j | j j d d d g � d d � d S( NR, R� R% i i ( R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testGetNOK7 s c C s- | j | j j d d d g � d d � d S( NR� R� R% i i ( R3 R% R4 ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testStatusNOK; s c C s' t s t j d � � n d } | j j | d � d d d g } xf t | � D]X \ } } | j | j j d | d | g � d g | | d
D] } | g ^ q� f � qM Wxf t | � D]X \ } } | j | j j d | d | g � d g | | d
D] } | g ^ q� f � q� Wd } | j | j j d | d | g � d | g g f � | j | j j d | d | g � d | g | g g f � | j | j j d | d | g � d | g g f � | j | j j d | d | g � d g f � d d
d d g } | j | j j d | d g | � d d g d d g g f � | j | j j d | d g | d
� d d d g g f � | j | j j d | d g | d � d g f � d } | j j d | d | g � } | j t
| d
t � � d } | j j d | d | g � } | j t
| d
t � � d S( Ns& systemd python interface not availableRx t systemds _SYSTEMD_UNIT=sshd.services TEST_FIELD1=ABCs _HOSTNAME=example.comR+ t addjournalmatchi i t deljournalmatchs
_COMM=sshdt +s _UID=0i s This isn't valid!s FIELD=NotPresent( R R] t SkipTestR# R' RB R3 R% R4 Ra R� t
ValueError( R R& RF RI RJ t valR� ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJournalMatch? sn / /
c C s# t s t j d � � n | j t � d } | j j | d � d d d g } xf t | � D]X \ } } | j | j j
d | d | g � d g | | d
D] } | g ^ q� f � qZ Wxf t | � D]X \ } } | j | j j
d | d | g � d g | | d
D] } | g ^ qf � q� Wd S( Ns& systemd python interface not availableRy s systemd[journalflags=2]s _SYSTEMD_UNIT=sshd.services TEST_FIELD1=ABCs _HOSTNAME=example.comR+ R+ i i R, ( R R] R. Ra R� R# R' RB R3 R% R4 ( R R& RF RI RJ R0 ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testJournalFlagsMatch� s$
/ (0 R R R" RT RV RY RZ Re Rw R R� R� R� R� R� R� R� R� R� R� R
R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R R R$ R& R' R( R) R1 R2 ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyRQ � sZ 0 , *
% < 4 Gt TransmitterLoggingc B sP e Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( c C sS t � | _ t t | � j � | j j d � | j j d � | j j d � d S( Ns /dev/nullt CRITICALR{ ( R R# R! R3 R" R R t setSyslogSocket( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR" � s
c C s� g } xH t d � D]: } t j d d � } | j | d � t j | d � q Wx | D] } | j d | � qX Wd } | j d | � | j j d d d g � x | D] } t j
| � q� W| j d d
d � | j d d d
� d S( Ni R t transmitteri i t logtargets /this/path/should/not/existR+ s /dev/nulls STDOUT[format="%(message)s"]t STDOUTs! STDERR[datetime=off, padding=off]t STDERR( t xrangeRo Rp R� Rr Rs R< R> R% R4 t remove( R t
logTargetst _t tmpFilet logTargetRJ ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testLogTarget� s
c C sj t j j d � s$ t j d � � n | j | j j � d � | j d d � | j | j j � d � d S( Ns /dev/logs '/dev/log' not presentR{ R7 t SYSLOG( Rr R� t existsR] R. Ra R# t getSyslogSocketR< ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testLogTargetSYSLOG� s
c C s | j d d � d S( Nt syslogsockets /dev/log/NEW/PATH( R< ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testSyslogSocket� s c C s� | j d d � | j d d � | j d d � | j d d i i t 6t d d d t d � d
t � t 6t j � d k o� t j j
d � � d S(
NRE s /this/path/should/not/existR7 RA s /dev/logR8 i R7 s Failed to change log targetR/ t Linux( RG ( R< R> R� t dictt ExceptionRP t platformt systemRr R� RB ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testSyslogSocketNOK� s
c C s� | j d d � | j d d � | j d d � | j d d � | j d d � | j d d � | j d d � | j d d � | j d d
� | j d d d
� | j d d � d S(
Nt loglevelt
HEAVYDEBUGt
TRACEDEBUGt 9t DEBUGt INFOt NOTICEt WARNINGt ERRORR4 t cRiTiCaLt Bird( R< R> ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testLogLevel� s c C s� | j | j j d g � d � zUt j d � \ } } t j | � | j j d � | j | j j d d | g � d | f � t d � } | j
d � z�t j d � \ } } t j | � t j | | � | j
d
� | j | j j d g � d � | j
d � t | d � �� } | j
� } | j d
� d k rH| j
� } n | j | j d � � | j
� } | j | j d � � yL | j
� } | j d � d k r�| j t | j
� n | j d | � Wn t k
r�n XWd QXt | d � �j } | j
� } | j d � d k r(| j
� } n | j | j d � � | j t | j
� | j � Wd QXWd t j | � XWd y t j | � Wn t k
r�n XX| j | j j d d d g � d � | j | j j d g � d � d S( Nt flushlogsi s rolled overs fail2ban.logRT R+ R7 R s Before file moveds After file moveds After flushlogst rs Changed logging target tos Before file moved
s After file moved
s Command: ['flushlogs']sC Exception StopIteration or Command: ['flushlogs'] expected. Got: %ss rollover performed ons After flushlogs
R9 t flushed( i s rolled over( i s rolled over( i s STDERR( i R[ ( R3 R% R4 Ro Rp Rr Rs R# R R t warningt renamet opent nextt findRa t endswitht assertRaisest
StopIterationt failR; t OSError( R t ft fnt lt f2t fn2t line1t line2RI ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt
testFlushLogs� sV
+
%c C s� | j d d t d | j �| j d d d d | j �| j d d d d | j �| j d d
d
d | j �| j d d d | j �| j d d d d | j �| j d d d d | j �d S( Ns bantime.incrementt trueR9 s bantime.rndtimet 30mini i< s bantime.maxtimes 1000 daysi� i s bantime.factorR� s bantime.formulasG ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)s bantime.multiplierss 1 5 30 60 300 720 1440 2880s bantime.overalljailsi i�] i � i \&( R< R� R& ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testBanTimeIncr s (
R R R" R@ RD RF RL RX Rm Rp ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR3 � s
0t JailTestsc B s e Z d � Z RS( c C s) d } t | � } | j | j | � d S( Nt veryveryverylongname( R R3 R� ( R t longnameR9 ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testLongName s ( R R Rt ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyRq s t
RegexTestsc B s# e Z d � Z d � Z d � Z RS( c C s= | j t t d � | j t t d � | j t t d � d S( NR� t s ( Rb R R ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testInit% s c C sN | j t t d � � j d d � d � | j t t d � � j d � � d S( Nt at "t 's
Regex('a')s <HOST>s
FailRegex(( R3 RE R t replaceRa R t
startswith( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testStr+ s (c C s; | j t t d � | j t t d � | j t d � � | j t d � � | j t d � � | j t d � � | j t d � � | j t d � � | j t d � � t d
� } | j | j � � | j d) g � | j | j � � | j t | j � t d � } | j | j � � | j d* g � | j | j � � | j t | j � t d � } | j | j � � | j d+ g � | j | j � � | j | j � d � | j d, g � | j | j � � | j | j � d � | j d- g � | j | j � � | j | j � d � t d � } | j | j � � | j d. g � | j | j � � | j | j � d � t d � } | j d/ g � | j
� } | j | | j f d0 � | j d1 g � | j
� } | j | | j f d2 � | j d3 g � | j
� } | j | | j f d4 � | j d5 g � | j
� } | j | | j f d6 � t d! � } | j d7 g � | j
� } | j | | j f d8 � | j d9 g � | j
� } | j | | j f d: � | j d; g � | j
� } | j | | j f d< � | j d= g � | j
� } | j | | j f d> � d S(? NR� s ^test no group$s ^test <HOST> group$s ^test <IP4> group$s ^test <IP6> group$s ^test <DNS> group$s< ^test id group: ip:port = <F-ID><IP4>(?::<F-PORT/>)?</F-ID>$s- ^test id group: user:\(<F-ID>[^\)]+</F-ID>\)$s# ^test id group: anything = <F-ID/>$s %%<HOST>?s %%s# %%inet(?:=<F-IP4/>|inet6=<F-IP6/>)?s %%inet=tests( %%(?:inet(?:=<IP4>|6=<IP6>)?|dns=<DNS>?)s %%inet=192.0.2.1s 192.0.2.1s %%inet6=2001:DB8::s
2001:DB8::s %%dns=example.coms example.coms% test id group: user:(test login name)s test login names %%net=<SUBNET>s %%net=192.0.2.1t inet4s %%net=192.0.2.1/24s 192.0.2.0/24s %%net=2001:DB8:FF:FF::1s 2001:db8:ff:ff::1t inet6s %%net=2001:DB8:FF:FF::1/60s 2001:db8:ff:f0::/60s %%ip="<ADDR>", mask="<CIDR>?"s %%ip="192.0.2.2", mask=""s 192.0.2.2s %%ip="192.0.2.2", mask="24"s" %%ip="2001:DB8:2FF:FF::1", mask=""s 2001:db8:2ff:ff::1s$ %%ip="2001:DB8:2FF:FF::1", mask="60"s 2001:db8:2ff:f0::/60( s %%R� R� ( s %%inet=testR� R� ( s %%inet=192.0.2.1R� R� ( s %%inet6=2001:DB8::R� R� ( s %%dns=example.comR� R� ( s% test id group: user:(test login name)R� R� ( s %%net=192.0.2.1R� R� ( s 192.0.2.1R~ ( s %%net=192.0.2.1/24R� R� ( s 192.0.2.0/24R~ ( s %%net=2001:DB8:FF:FF::1R� R� ( s 2001:db8:ff:ff::1R ( s %%net=2001:DB8:FF:FF::1/60R� R� ( s 2001:db8:ff:f0::/60R ( s %%ip="192.0.2.2", mask=""R� R� ( s 192.0.2.2R~ ( s %%ip="192.0.2.2", mask="24"R� R� ( s 192.0.2.0/24R~ ( s" %%ip="2001:DB8:2FF:FF::1", mask=""R� R� ( s 2001:db8:2ff:ff::1R ( s$ %%ip="2001:DB8:2FF:FF::1", mask="60"R� R� ( s 2001:db8:2ff:f0::/60R ( Rb R R Ra RR t
hasMatchedt searcht getHostR3 t getFailIDt getIPt familyStr( R t frR� ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testHost1 sz ( R R Rw R} R� ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyRu # s t
_BadThreadc B s e Z d � Z RS( c C s t d � � d S( Ns run bad thread exception( R� ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt runy s ( R R R� ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� x s t LoggingTestsc B s# e Z d � Z d � Z d � Z RS( c C s9 t d � } | j | j j d � | j | j d � d S( Ns fail2ban.some.string.with.nameR s
fail2ban.name( R R3 t parentR� ( R t
testLogSys( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testGetF2BLogger s c s� t j } g � � f d � t _ zF t � } | j � | j � � j t j � � f d � d � � Wd | t _ X� j d � � j t
� � d � � j � d d t � d S( Nc s
� j | � S( N( R� ( R ( R. ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� � s c s t � � o � j d � S( Ns Unhandled exception( R� t
_is_logged( ( R R. ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� � s i s Unhandled exceptioni i ( R t __excepthook__R� R� R� Ra R
R� R� R3 R� R� ( R t prev_exchookt badThread( ( R R. sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testFail2BanExceptHook� s
)
c C s� g } t j d d � \ } } t j | � | j | � t j d d � \ } } t j | � | j | � t � } z: | j | | d t �| j | j � � | j
d � Wd | j � x0 | D]( } t j j
| � r� t j | � q� q� WXd S( Ns
fail2ban.socks f2b-tests fail2ban.pidt forces Server already running( Ro Rp Rr Rs R� R R� RP RR RS R� R) R� RB R; ( R t tmp_filest sock_fdt sock_namet
pidfile_fdt pidfile_nameR# Rf ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testStartFailedSockExists� s
( R R R� R� R� ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� } s ( t ActionReadert JailsReadert
CONFIG_DIRt ServerConfigReaderTestsc B sz e Z d � Z d � Z d � Z d d � Z d � Z d � Z d � Z d � Z d � Z
d
� Z d d � Z d � Z
RS(
c O s& t t | � j | | � i | _ d S( N( R! R� t __init__t# _ServerConfigReaderTests__share_cfg( R R R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� � s c C s t t | � j � g | _ d S( N( R! R� R" t _execCmdLst( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR" � s c C s t t | � j � d S( N( R! R� R* ( R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR* � s i< c C sM xF | j d � D]5 } | j d � s8 t j d | � q t j | � q Wt S( Ns
t #s exec-cmd: `%s`( t splitR| t logSyst debugR� ( R t realCmdR Rh ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt _executeCmd� s
c C s} t | d � sv t � } i | _ xR d d f D]A \ } } t | � } | j d � t j j | | � | j | <q. Wn | j S( Nt __aInfost ipv4s 192.0.2.1t ipv6s
2001:DB8::iX ( s ipv4s 192.0.2.1( s ipv6s
2001:DB8::( t hasattrR t _ServerConfigReaderTests__aInfosR t
setBanTimet _actionsR� t
ActionInfo( R t dmyjailt tR� t ticket( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt _testActionInfos� s
#c C s� | j } | j � } x�| D]z} xq| | j D]b} | | j | } t j d d d � t j d | d | j � t j d d d � t | t j � s� q0 n | j | _
t j d � | j � | j � t j d � | j � | j
| d � t j d � | j � | j | d � t j d
� | j � | j
| d � t j d � | j � | j | d � t j d
� | j � | j � q0 Wq Wd S( Ns # t =i2 s
# == %-44s ==s - s # === start ===s # === ban-ipv4 ===R� s # === unban ipv4 ===s # === ban ipv6 ===R� s # === unban ipv6 ===s # === stop ===( R� R� R R� R� t _nameR� R� t
CommandActionR� t
executeCmdR� R� R R RU ( R R# R� t aInfosR9 Rx R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt _testExecActions� s:
c C s� t j j d t � t d t d t d | j � } | j | j � � | j | j � � | j
d t � } t � } | j } | j
} xS| D]K} | d d k r� | d d k r� d | d
<n� t | � d k rC| d d k rC| d
d
k rCt j j t d | d � } t j j | � s6t j j t d � } n | | d <nU t j j r�t | � d k r�| d d k r�| d
d k r�d | d <d | d <n y | | � Wq�t k
r�} | j d | | f � q�Xq� q� Wt j j s�| j | � n d S( Nt stockt basedirt force_enablet share_configt allow_no_filesi R� R? R i i R+ R� t logsi s testcase01.logs multi-setR� s DUMMY-REGEX <HOST>s" Command %r has failed. Received %r( s sets multi-set( R] R^ t SkipIfCfgMissingR� R� R� R� Ra t readt
getOptionst convertR R$ t _Transmitter__commandHandlerR� Rr R� R� R� RB R_ RI Rd R� ( R R� t streamR# R% t
cmdHandlerR5 Rg t e( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testCheckStockJailActions� s6
2
2
" c C s� | j d | � } t | � \ } } d | d g g } t | | | d | j d t �} | j | j � � | j i � | j | j � � | S( Ns %(__name__)sR? R R� R� (
R{ R R� R� R� Ra R� R� t extendR� ( R R9 t actt actNamet actOptR� R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt getDefaultJailStream s
c
C s� t j j d t � t j j � d d l } t � } | j } x� | j t j j
t d d � � D]} } t j j | � j
d d � } | j d | | � } x3 | D]+ } | j | � \ } } | j | d � q� W| j | � q` Wd S( NR� i����s action.ds *.confs .confR� s j-i ( R] R^ R� R� t
SkipIfFastt globR R$ Rr R� R� R� t basenameR{ R� R4 R3 R� (
R R� R# R% t actCfgR� R� R5 RK t res( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testCheckStockAllActions. s
(
c C s0 t j j d t � d d i
dkd 6dld 6dmd 6dnd 6dod 6dpd 6dqd 6drd! 6dsd# 6dtd% 6dud' 6dvd) 6dwd+ 6f d, d- i
dxd 6dyd 6dzd 6d{d 6d|d 6d}d 6d~d 6dd! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d> d? i d�d 6d�d 6d�dD 6d�d 6d�d 6d�d% 6d�d' 6d�d) 6d�d+ 6f dK dL i d�d 6d�d 6d�d% 6d�d' 6d�d) 6d�d+ 6f dQ dR i d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f di dj i d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d} d~ i
d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i
d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i d�d 6d�d 6d�d 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i d�d 6d�d 6d�dD 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i d�d 6d�d 6d�dD 6d�d 6d�d 6d�d! 6d�d# 6d�d% 6d�d' 6d�d) 6d�d+ 6f d� d� i d�d 6d�d 6d�d 6d�d 6d�d 6d�d 6d�d! 6d d# 6dd% 6dd' 6dd) 6dd+ 6f d� d i dd 6dd 6dd 6dd 6d d 6d
d! 6d d# 6d d% 6d
d' 6dd) 6dd+ 6f ddi dd 6dd 6dd 6dd 6dd 6dd! 6dd# 6dd% 6dd' 6dd) 6dd+ 6f d)d*i
dd 6d d 6d d 6d d 6d d 6d d 6d!d% 6d"d' 6d#d) 6d$d+ 6f d;d<i
d%d 6d&d 6d'd 6d(d 6d)d 6d*d 6d+d% 6d,d' 6d-d) 6d.d+ 6f dMdNi d/d 6d0d 6d1d% 6d2d' 6d3d) 6d4d+ 6f dUdVi d5d 6d6d 6d7d% 6d8d' 6d9d) 6d:d+ 6f f } t � } | j } | j } x_ | D]W \ } } } | j | | � } x3 | D]+ } | j | � \ }
} | j |
d[� qWq�W| j
} | j � }
x�| D]�\ } } } x�| | j D]�} | | j | } t
j d\d]d^� t
j d_| d`| j � t
j d\d]d^� | j t | t j � � | j | _ | j da� | j � | j dD � r0| j dbt | dD � n@ | j d � rp| j d � rp| j dbt | d | d � n | j dc� | j |
dd� | j d � r�| j dbt | j d d;� | d � n | j d � r�| j dbt | d � n | j dbt | j d! d<� | d% � | j dbt | d � | j de� | j |
dd� | j dbt | j d! d=� | d' � | j dbt | d � | j df� | j |
dg� | j d � r� | j dbt | j d d>� | d � n | j d � r
| j dbt | d � n | j dbt | j d# d?� | d) � | j dbt | d � | j dh� | j |
dg� | j dbt | j d# d@� | d+ � | j dbt | d � | j d � r�
| j di� | j � | j dbt | d � n | j dj� | j � | j d � ro| j dbt | d � qoqoWqRWd S(A NR� s
j-w-nft-mpsQ nftables-multiport[name=%(__name__)s, port="http,https", protocol="tcp,udp,sctp"]s ip t ipv4_addrs addr-t ip4s ip6 t ipv6_addrs addr6-t ip6s `nft add table inet f2b-table`sW `nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`s9 `for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`s `done`s *-startsG `nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`s� `nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`s ip4-startsH `nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`s� `nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`s ip6-startsG `{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || sH `{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || t flushs� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s5 `nft delete rule inet f2b-table f2b-chain $hdl; done`s3 `nft delete set inet f2b-table addr-set-j-w-nft-mp`s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s4 `nft delete set inet f2b-table addr6-set-j-w-nft-mp`RU sO `nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`s ip4-checksP `nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`s ip6-checksD `nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`s ip4-bansG `nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`s ip4-unbansF `nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`s ip6-bansI `nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`s ip6-unbans
j-w-nft-aps8 nftables-allports[name=%(__name__)s, protocol="tcp,udp"]sG `nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`sg `nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`sH `nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`si `nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`sG `{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || sH `{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s3 `nft delete set inet f2b-table addr-set-j-w-nft-ap`s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s4 `nft delete set inet f2b-table addr6-set-j-w-nft-ap`sO `nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`sP `nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`sD `nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`sG `nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`sF `nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`sI `nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`s j-dummyso dummy[name=%(__name__)s, init="=='<family>/<ip>'==bt:<bantime>==bc:<bancount>==", target="/tmp/fail2ban.dummy"]s
family: inet4s
family: inet6s$ `printf %b "=='/'==bt:600==bc:0==\n"s7 `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`R� s9 `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`s7 `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`sP `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`sR `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`sQ `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`sS `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`s j-hostsdenysP hostsdeny[name=%(__name__)s, actionstop="rm <file>", file="/tmp/fail2ban.dummy"]s5 `printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`s^ `IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`s8 `printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`sa `IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`s j-w-iptables-mpsn iptables-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"]s
`iptables s icmp-port-unreachables `ip6tables s icmp6-port-unreachables$ `iptables -w -N f2b-j-w-iptables-mp`s. `iptables -w -A f2b-j-w-iptables-mp -j RETURN`sU `iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`s% `ip6tables -w -N f2b-j-w-iptables-mp`s/ `ip6tables -w -A f2b-j-w-iptables-mp -j RETURN`sV `ip6tables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`s$ `iptables -w -F f2b-j-w-iptables-mp`s% `ip6tables -w -F f2b-j-w-iptables-mp`sU `iptables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`s$ `iptables -w -X f2b-j-w-iptables-mp`sV `ip6tables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`s% `ip6tables -w -X f2b-j-w-iptables-mp`s> `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`s? `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`sa `iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s_ `iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`sd `ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`sb `ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s j-w-iptables-apsZ iptables-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"]s$ `iptables -w -N f2b-j-w-iptables-ap`s. `iptables -w -A f2b-j-w-iptables-ap -j RETURN`s4 `iptables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`s% `ip6tables -w -N f2b-j-w-iptables-ap`s/ `ip6tables -w -A f2b-j-w-iptables-ap -j RETURN`s5 `ip6tables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`s$ `iptables -w -F f2b-j-w-iptables-ap`s% `ip6tables -w -F f2b-j-w-iptables-ap`s4 `iptables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`s$ `iptables -w -X f2b-j-w-iptables-ap`s5 `ip6tables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`s% `ip6tables -w -X f2b-j-w-iptables-ap`s> `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`s? `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`sa `iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s_ `iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`sd `ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`sb `ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s j-w-iptables-ipsets\ iptables-ipset-proto6[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"]s f2b-j-w-iptables-ipset s f2b-j-w-iptables-ipset6 s8 `ipset create f2b-j-w-iptables-ipset hash:ip timeout 0 `s� `iptables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`sE `ipset create f2b-j-w-iptables-ipset6 hash:ip timeout 0 family inet6`s� `ip6tables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`s$ `ipset flush f2b-j-w-iptables-ipset`s% `ipset flush f2b-j-w-iptables-ipset6`s� `iptables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`s& `ipset destroy f2b-j-w-iptables-ipset`s� `ip6tables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`s' `ipset destroy f2b-j-w-iptables-ipset6`s= `ipset add f2b-j-w-iptables-ipset 192.0.2.1 timeout 0 -exist`s3 `ipset del f2b-j-w-iptables-ipset 192.0.2.1 -exist`s? `ipset add f2b-j-w-iptables-ipset6 2001:db8:: timeout 0 -exist`s5 `ipset del f2b-j-w-iptables-ipset6 2001:db8:: -exist`s j-w-iptables-ipset-apsH iptables-ipset-proto6-allports[name=%(__name__)s, chain="<known/chain>"]s f2b-j-w-iptables-ipset-ap s f2b-j-w-iptables-ipset-ap6 s; `ipset create f2b-j-w-iptables-ipset-ap hash:ip timeout 0 `su `iptables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`sH `ipset create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 family inet6`sx `ip6tables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`s' `ipset flush f2b-j-w-iptables-ipset-ap`s( `ipset flush f2b-j-w-iptables-ipset-ap6`su `iptables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`s) `ipset destroy f2b-j-w-iptables-ipset-ap`sx `ip6tables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`s* `ipset destroy f2b-j-w-iptables-ipset-ap6`s@ `ipset add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 0 -exist`s6 `ipset del f2b-j-w-iptables-ipset-ap 192.0.2.1 -exist`sB `ipset add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 0 -exist`s8 `ipset del f2b-j-w-iptables-ipset-ap6 2001:db8:: -exist`s j-w-iptabless^ iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"]s! `iptables -w -N f2b-j-w-iptables`s+ `iptables -w -A f2b-j-w-iptables -j RETURN`s> `iptables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`s" `ip6tables -w -N f2b-j-w-iptables`s, `ip6tables -w -A f2b-j-w-iptables -j RETURN`s? `ip6tables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`s! `iptables -w -F f2b-j-w-iptables`s" `ip6tables -w -F f2b-j-w-iptables`s> `iptables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`s! `iptables -w -X f2b-j-w-iptables`s? `ip6tables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`s" `ip6tables -w -X f2b-j-w-iptables`s; `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`s< `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`s^ `iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s\ `iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`sa `ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s_ `ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s j-w-iptables-newsb iptables-new[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"]s% `iptables -w -N f2b-j-w-iptables-new`s/ `iptables -w -A f2b-j-w-iptables-new -j RETURN`sW `iptables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`s& `ip6tables -w -N f2b-j-w-iptables-new`s0 `ip6tables -w -A f2b-j-w-iptables-new -j RETURN`sX `ip6tables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`s% `iptables -w -F f2b-j-w-iptables-new`s& `ip6tables -w -F f2b-j-w-iptables-new`sW `iptables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`s% `iptables -w -X f2b-j-w-iptables-new`sX `ip6tables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`s& `ip6tables -w -X f2b-j-w-iptables-new`s? `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`s@ `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`sb `iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s` `iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`se `ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`sc `ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s j-w-iptables-xtresP iptables-xt_recent-echo[name=%(__name__)s, bantime="10m", chain="<known/chain>"]s /f2b-j-w-iptables-xtre`s /f2b-j-w-iptables-xtre6`s� `if [ `id -u` -eq 0 ];then iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`s� `if [ `id -u` -eq 0 ];then ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`s4 `echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre`s� `if [ `id -u` -eq 0 ];then iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`s5 `echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`s� `if [ `id -u` -eq 0 ];then ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`s3 `test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`s4 `test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`s= `echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`s= `echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`s? `echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`s? `echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`s j-w-pfs2 pf[name=%(__name__)s, actionstart_on_demand=false]sF `echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`s
port="<port>"s\ `echo "block quick proto tcp from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`s, `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`sT `pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`s+ `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`s. `pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`s4 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`s7 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`s5 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`s8 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`s j-w-pf-mps@ pf[actiontype=<multiport>][name=%(__name__)s, port="http,https"]sL `echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`s port="http,https"sb `echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`s2 `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`s] `pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`s1 `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`s4 `pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`s: `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`s= `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`s; `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`s> `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`s j-w-pf-apsH pf[actiontype=<allports>, actionstart_on_demand=true][name=%(__name__)s]sL `echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`sW `echo "block quick proto tcp from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`s2 `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`s] `pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`s1 `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`s4 `pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`s: `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`s= `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`s; `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`s> `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`s j-w-fwcmd-mpsq firewallcmd-multiport[name=%(__name__)s, bantime="10m", port="http,https", protocol="tcp", chain="<known/chain>"]s ipv4 s ipv6 s@ `firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`sN `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`s� `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`s@ `firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`sN `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`s� `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`s� `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`s� `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`sc `firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`sc `firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`s| `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s `firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s~ `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s� `firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s j-w-fwcmd-aps] firewallcmd-allports[name=%(__name__)s, bantime="10m", protocol="tcp", chain="<known/chain>"]s@ `firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`sN `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`sQ `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`s@ `firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`sN `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`sQ `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`sT `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`sT `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`sc `firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`sc `firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`s| `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s `firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`s~ `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s� `firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`s j-w-fwcmd-ipsetsX firewallcmd-ipset[name=%(__name__)s, port="http", protocol="tcp", chain="<known/chain>"]s f2b-j-w-fwcmd-ipset s f2b-j-w-fwcmd-ipset6 s5 `ipset create f2b-j-w-fwcmd-ipset hash:ip timeout 0 `s� `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`sB `ipset create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 family inet6`s� `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`s! `ipset flush f2b-j-w-fwcmd-ipset`s" `ipset flush f2b-j-w-fwcmd-ipset6`s� `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`s# `ipset destroy f2b-j-w-fwcmd-ipset`s� `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`s$ `ipset destroy f2b-j-w-fwcmd-ipset6`s: `ipset add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0 -exist`s0 `ipset del f2b-j-w-fwcmd-ipset 192.0.2.1 -exist`s< `ipset add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 0 -exist`s2 `ipset del f2b-j-w-fwcmd-ipset6 2001:db8:: -exist`s j-w-fwcmd-ipset-apsb firewallcmd-ipset[name=%(__name__)s, actiontype=<allports>, protocol="tcp", chain="<known/chain>"]s f2b-j-w-fwcmd-ipset-ap s f2b-j-w-fwcmd-ipset-ap6 s8 `ipset create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 0 `s� `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`sE `ipset create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 0 family inet6`s� `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`s$ `ipset flush f2b-j-w-fwcmd-ipset-ap`s% `ipset flush f2b-j-w-fwcmd-ipset-ap6`s� `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`s& `ipset destroy f2b-j-w-fwcmd-ipset-ap`s� `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`s' `ipset destroy f2b-j-w-fwcmd-ipset-ap6`s= `ipset add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0 -exist`s3 `ipset del f2b-j-w-fwcmd-ipset-ap 192.0.2.1 -exist`s? `ipset add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 0 -exist`s5 `ipset del f2b-j-w-fwcmd-ipset-ap6 2001:db8:: -exist`s
j-fwcmd-rrs4 firewallcmd-rich-rules[port="22:24", protocol="tcp"]s
family='ipv4's
family='ipv6's� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`s
j-fwcmd-rls6 firewallcmd-rich-logging[port="22:24", protocol="tcp"]s" `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`s% `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`s% `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`s' `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`i s # R� i2 s
# == %-44s ==s - s # === start ===R� s # === ban-ipv4 ===R� s # === unban ipv4 ===s # === ban ipv6 ===R� s # === unban ipv6 ===s # === flush ===s # === stop ===( s ip R� s addr-( s ip6 R� s addr6-( s `nft add table inet f2b-table`sW `nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`s9 `for proto in $(echo 'tcp,udp,sctp' | sed 's/,/ /g'); do`s `done`( sG `nft add set inet f2b-table addr-set-j-w-nft-mp \{ type ipv4_addr\; \}`s� `nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip saddr @addr-set-j-w-nft-mp reject`( sH `nft add set inet f2b-table addr6-set-j-w-nft-mp \{ type ipv6_addr\; \}`s� `nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'http,https' | sed s/:/-/g) \} ip6 saddr @addr6-set-j-w-nft-mp reject`( sG `{ nft flush set inet f2b-table addr-set-j-w-nft-mp 2> /dev/null; } || sH `{ nft flush set inet f2b-table addr6-set-j-w-nft-mp 2> /dev/null; } || ( s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s5 `nft delete rule inet f2b-table f2b-chain $hdl; done`s3 `nft delete set inet f2b-table addr-set-j-w-nft-mp`s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-mp\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s5 `nft delete rule inet f2b-table f2b-chain $hdl; done`s4 `nft delete set inet f2b-table addr6-set-j-w-nft-mp`( sO `nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-mp[ \t]'`( sP `nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-mp[ \t]'`( sD `nft add element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`( sG `nft delete element inet f2b-table addr-set-j-w-nft-mp \{ 192.0.2.1 \}`( sF `nft add element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`( sI `nft delete element inet f2b-table addr6-set-j-w-nft-mp \{ 2001:db8:: \}`( s ip R� s addr-( s ip6 R� s addr6-( s `nft add table inet f2b-table`sW `nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}`( sG `nft add set inet f2b-table addr-set-j-w-nft-ap \{ type ipv4_addr\; \}`sg `nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip saddr @addr-set-j-w-nft-ap reject`( sH `nft add set inet f2b-table addr6-set-j-w-nft-ap \{ type ipv6_addr\; \}`si `nft add rule inet f2b-table f2b-chain meta l4proto \{ tcp,udp \} ip6 saddr @addr6-set-j-w-nft-ap reject`( sG `{ nft flush set inet f2b-table addr-set-j-w-nft-ap 2> /dev/null; } || sH `{ nft flush set inet f2b-table addr6-set-j-w-nft-ap 2> /dev/null; } || ( s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s5 `nft delete rule inet f2b-table f2b-chain $hdl; done`s3 `nft delete set inet f2b-table addr-set-j-w-nft-ap`s� `{ nft -a list chain inet f2b-table f2b-chain | grep -oP '@addr6-set-j-w-nft-ap\s+.*\s+\Khandle\s+(\d+)$'; } | while read -r hdl; do`s5 `nft delete rule inet f2b-table f2b-chain $hdl; done`s4 `nft delete set inet f2b-table addr6-set-j-w-nft-ap`( sO `nft list chain inet f2b-table f2b-chain | grep -q '@addr-set-j-w-nft-ap[ \t]'`( sP `nft list chain inet f2b-table f2b-chain | grep -q '@addr6-set-j-w-nft-ap[ \t]'`( sD `nft add element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`( sG `nft delete element inet f2b-table addr-set-j-w-nft-ap \{ 192.0.2.1 \}`( sF `nft add element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`( sI `nft delete element inet f2b-table addr6-set-j-w-nft-ap \{ 2001:db8:: \}`( s
family: inet4( s
family: inet6( s$ `printf %b "=='/'==bt:600==bc:0==\n"s7 `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`( s9 `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- clear all"`( s7 `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- stopped"`( sP `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 192.0.2.1 (family: inet4)"`( sR `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 192.0.2.1 (family: inet4)"`( sQ `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- banned 2001:db8:: (family: inet6)"`( sS `echo "[j-dummy] dummy /tmp/fail2ban.dummy -- unbanned 2001:db8:: (family: inet6)"`( s
family: inet4( s
family: inet6( s5 `printf %b "ALL: 192.0.2.1\n" >> /tmp/fail2ban.dummy`( s^ `IP=$(echo "192.0.2.1" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`( s8 `printf %b "ALL: [2001:db8::]\n" >> /tmp/fail2ban.dummy`( sa `IP=$(echo "[2001:db8::]" | sed 's/[][\.]/\\\0/g') && sed -i "/^ALL: $IP$/d" /tmp/fail2ban.dummy`( s
`iptables s icmp-port-unreachable( s `ip6tables s icmp6-port-unreachable( s$ `iptables -w -N f2b-j-w-iptables-mp`s. `iptables -w -A f2b-j-w-iptables-mp -j RETURN`sU `iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`( s% `ip6tables -w -N f2b-j-w-iptables-mp`s/ `ip6tables -w -A f2b-j-w-iptables-mp -j RETURN`sV `ip6tables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`( s$ `iptables -w -F f2b-j-w-iptables-mp`s% `ip6tables -w -F f2b-j-w-iptables-mp`( sU `iptables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`s$ `iptables -w -F f2b-j-w-iptables-mp`s$ `iptables -w -X f2b-j-w-iptables-mp`sV `ip6tables -w -D INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`s% `ip6tables -w -F f2b-j-w-iptables-mp`s% `ip6tables -w -X f2b-j-w-iptables-mp`( s> `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`( s? `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`( sa `iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s_ `iptables -w -D f2b-j-w-iptables-mp -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( sd `ip6tables -w -I f2b-j-w-iptables-mp 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( sb `ip6tables -w -D f2b-j-w-iptables-mp -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s
`iptables s icmp-port-unreachable( s `ip6tables s icmp6-port-unreachable( s$ `iptables -w -N f2b-j-w-iptables-ap`s. `iptables -w -A f2b-j-w-iptables-ap -j RETURN`s4 `iptables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`( s% `ip6tables -w -N f2b-j-w-iptables-ap`s/ `ip6tables -w -A f2b-j-w-iptables-ap -j RETURN`s5 `ip6tables -w -I INPUT -p tcp -j f2b-j-w-iptables-ap`( s$ `iptables -w -F f2b-j-w-iptables-ap`s% `ip6tables -w -F f2b-j-w-iptables-ap`( s4 `iptables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`s$ `iptables -w -F f2b-j-w-iptables-ap`s$ `iptables -w -X f2b-j-w-iptables-ap`s5 `ip6tables -w -D INPUT -p tcp -j f2b-j-w-iptables-ap`s% `ip6tables -w -F f2b-j-w-iptables-ap`s% `ip6tables -w -X f2b-j-w-iptables-ap`( s> `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`( s? `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`( sa `iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s_ `iptables -w -D f2b-j-w-iptables-ap -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( sd `ip6tables -w -I f2b-j-w-iptables-ap 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( sb `ip6tables -w -D f2b-j-w-iptables-ap -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s f2b-j-w-iptables-ipset ( s f2b-j-w-iptables-ipset6 ( s8 `ipset create f2b-j-w-iptables-ipset hash:ip timeout 0 `s� `iptables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`( sE `ipset create f2b-j-w-iptables-ipset6 hash:ip timeout 0 family inet6`s� `ip6tables -w -I INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`( s$ `ipset flush f2b-j-w-iptables-ipset`s% `ipset flush f2b-j-w-iptables-ipset6`( s� `iptables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset src -j REJECT --reject-with icmp-port-unreachable`s$ `ipset flush f2b-j-w-iptables-ipset`s& `ipset destroy f2b-j-w-iptables-ipset`s� `ip6tables -w -D INPUT -p tcp -m multiport --dports http -m set --match-set f2b-j-w-iptables-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`s% `ipset flush f2b-j-w-iptables-ipset6`s' `ipset destroy f2b-j-w-iptables-ipset6`( s= `ipset add f2b-j-w-iptables-ipset 192.0.2.1 timeout 0 -exist`( s3 `ipset del f2b-j-w-iptables-ipset 192.0.2.1 -exist`( s? `ipset add f2b-j-w-iptables-ipset6 2001:db8:: timeout 0 -exist`( s5 `ipset del f2b-j-w-iptables-ipset6 2001:db8:: -exist`( s f2b-j-w-iptables-ipset-ap ( s f2b-j-w-iptables-ipset-ap6 ( s; `ipset create f2b-j-w-iptables-ipset-ap hash:ip timeout 0 `su `iptables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`( sH `ipset create f2b-j-w-iptables-ipset-ap6 hash:ip timeout 0 family inet6`sx `ip6tables -w -I INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`( s' `ipset flush f2b-j-w-iptables-ipset-ap`s( `ipset flush f2b-j-w-iptables-ipset-ap6`( su `iptables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`s' `ipset flush f2b-j-w-iptables-ipset-ap`s) `ipset destroy f2b-j-w-iptables-ipset-ap`sx `ip6tables -w -D INPUT -m set --match-set f2b-j-w-iptables-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`s( `ipset flush f2b-j-w-iptables-ipset-ap6`s* `ipset destroy f2b-j-w-iptables-ipset-ap6`( s@ `ipset add f2b-j-w-iptables-ipset-ap 192.0.2.1 timeout 0 -exist`( s6 `ipset del f2b-j-w-iptables-ipset-ap 192.0.2.1 -exist`( sB `ipset add f2b-j-w-iptables-ipset-ap6 2001:db8:: timeout 0 -exist`( s8 `ipset del f2b-j-w-iptables-ipset-ap6 2001:db8:: -exist`( s
`iptables s icmp-port-unreachable( s `ip6tables s icmp6-port-unreachable( s! `iptables -w -N f2b-j-w-iptables`s+ `iptables -w -A f2b-j-w-iptables -j RETURN`s> `iptables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`( s" `ip6tables -w -N f2b-j-w-iptables`s, `ip6tables -w -A f2b-j-w-iptables -j RETURN`s? `ip6tables -w -I INPUT -p tcp --dport http -j f2b-j-w-iptables`( s! `iptables -w -F f2b-j-w-iptables`s" `ip6tables -w -F f2b-j-w-iptables`( s> `iptables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`s! `iptables -w -F f2b-j-w-iptables`s! `iptables -w -X f2b-j-w-iptables`s? `ip6tables -w -D INPUT -p tcp --dport http -j f2b-j-w-iptables`s" `ip6tables -w -F f2b-j-w-iptables`s" `ip6tables -w -X f2b-j-w-iptables`( s; `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`( s< `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`( s^ `iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s\ `iptables -w -D f2b-j-w-iptables -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( sa `ip6tables -w -I f2b-j-w-iptables 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s_ `ip6tables -w -D f2b-j-w-iptables -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s
`iptables s icmp-port-unreachable( s `ip6tables s icmp6-port-unreachable( s% `iptables -w -N f2b-j-w-iptables-new`s/ `iptables -w -A f2b-j-w-iptables-new -j RETURN`sW `iptables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`( s& `ip6tables -w -N f2b-j-w-iptables-new`s0 `ip6tables -w -A f2b-j-w-iptables-new -j RETURN`sX `ip6tables -w -I INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`( s% `iptables -w -F f2b-j-w-iptables-new`s& `ip6tables -w -F f2b-j-w-iptables-new`( sW `iptables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`s% `iptables -w -F f2b-j-w-iptables-new`s% `iptables -w -X f2b-j-w-iptables-new`sX `ip6tables -w -D INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`s& `ip6tables -w -F f2b-j-w-iptables-new`s& `ip6tables -w -X f2b-j-w-iptables-new`( s? `iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`( s@ `ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`( sb `iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s` `iptables -w -D f2b-j-w-iptables-new -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( se `ip6tables -w -I f2b-j-w-iptables-new 1 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( sc `ip6tables -w -D f2b-j-w-iptables-new -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s
`iptables s /f2b-j-w-iptables-xtre`( s `ip6tables s /f2b-j-w-iptables-xtre6`( s� `if [ `id -u` -eq 0 ];then iptables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`( s� `if [ `id -u` -eq 0 ];then ip6tables -w -I INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`( s4 `echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre`s� `if [ `id -u` -eq 0 ];then iptables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre -j REJECT --reject-with icmp-port-unreachable;fi`s5 `echo / > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`s� `if [ `id -u` -eq 0 ];then ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`( s3 `test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`( s4 `test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`( s= `echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`( s= `echo -192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`( s? `echo +2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`( s? `echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`( ( ( sF `echo "table <f2b-j-w-pf> persist counters" | pfctl -a f2b/j-w-pf -f-`s
port="<port>"s\ `echo "block quick proto tcp from <f2b-j-w-pf> to any port $port" | pfctl -a f2b/j-w-pf -f-`( s, `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`( sT `pfctl -a f2b/j-w-pf -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -a f2b/j-w-pf -f-`s, `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T flush`s+ `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T kill`( s. `pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`( s. `pfctl -a f2b/j-w-pf -sr | grep -q f2b-j-w-pf`( s4 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 192.0.2.1`( s7 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 192.0.2.1`( s5 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T add 2001:db8::`( s8 `pfctl -a f2b/j-w-pf -t f2b-j-w-pf -T delete 2001:db8::`( ( ( sL `echo "table <f2b-j-w-pf-mp> persist counters" | pfctl -a f2b/j-w-pf-mp -f-`s port="http,https"sb `echo "block quick proto tcp from <f2b-j-w-pf-mp> to any port $port" | pfctl -a f2b/j-w-pf-mp -f-`( s2 `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`( s] `pfctl -a f2b/j-w-pf-mp -sr 2>/dev/null | grep -v f2b-j-w-pf-mp | pfctl -a f2b/j-w-pf-mp -f-`s2 `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T flush`s1 `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T kill`( s4 `pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`( s4 `pfctl -a f2b/j-w-pf-mp -sr | grep -q f2b-j-w-pf-mp`( s: `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 192.0.2.1`( s= `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 192.0.2.1`( s; `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T add 2001:db8::`( s> `pfctl -a f2b/j-w-pf-mp -t f2b-j-w-pf-mp -T delete 2001:db8::`( ( ( sL `echo "table <f2b-j-w-pf-ap> persist counters" | pfctl -a f2b/j-w-pf-ap -f-`sW `echo "block quick proto tcp from <f2b-j-w-pf-ap> to any" | pfctl -a f2b/j-w-pf-ap -f-`( ( s2 `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`( s] `pfctl -a f2b/j-w-pf-ap -sr 2>/dev/null | grep -v f2b-j-w-pf-ap | pfctl -a f2b/j-w-pf-ap -f-`s2 `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T flush`s1 `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T kill`( s4 `pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`( s4 `pfctl -a f2b/j-w-pf-ap -sr | grep -q f2b-j-w-pf-ap`( s: `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 192.0.2.1`( s= `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 192.0.2.1`( s; `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T add 2001:db8::`( s> `pfctl -a f2b/j-w-pf-ap -t f2b-j-w-pf-ap -T delete 2001:db8::`( s ipv4 s icmp-port-unreachable( s ipv6 s icmp6-port-unreachable( s@ `firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-mp`sN `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`s� `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`( s@ `firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-mp`sN `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 1000 -j RETURN`s� `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`( s� `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-mp`s� `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -m conntrack --ctstate NEW -p tcp -m multiport --dports "$(echo 'http,https' | sed s/:/-/g)" -j f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-mp`sC `firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-mp`( sc `firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`( sc `firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-mp$'`( s| `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s `firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-mp 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s~ `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s� `firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-mp 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s ipv4 s icmp-port-unreachable( s ipv6 s icmp6-port-unreachable( s@ `firewall-cmd --direct --add-chain ipv4 filter f2b-j-w-fwcmd-ap`sN `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`sQ `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`( s@ `firewall-cmd --direct --add-chain ipv6 filter f2b-j-w-fwcmd-ap`sN `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 1000 -j RETURN`sQ `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`( sT `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-rules ipv4 filter f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-chain ipv4 filter f2b-j-w-fwcmd-ap`sT `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -j f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-rules ipv6 filter f2b-j-w-fwcmd-ap`sC `firewall-cmd --direct --remove-chain ipv6 filter f2b-j-w-fwcmd-ap`( sc `firewall-cmd --direct --get-chains ipv4 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`( sc `firewall-cmd --direct --get-chains ipv6 filter | sed -e 's, ,\n,g' | grep -q '^f2b-j-w-fwcmd-ap$'`( s| `firewall-cmd --direct --add-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s `firewall-cmd --direct --remove-rule ipv4 filter f2b-j-w-fwcmd-ap 0 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`( s~ `firewall-cmd --direct --add-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s� `firewall-cmd --direct --remove-rule ipv6 filter f2b-j-w-fwcmd-ap 0 -s 2001:db8:: -j REJECT --reject-with icmp6-port-unreachable`( s f2b-j-w-fwcmd-ipset ( s f2b-j-w-fwcmd-ipset6 ( s5 `ipset create f2b-j-w-fwcmd-ipset hash:ip timeout 0 `s� `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`( sB `ipset create f2b-j-w-fwcmd-ipset6 hash:ip timeout 0 family inet6`s� `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`( s! `ipset flush f2b-j-w-fwcmd-ipset`s" `ipset flush f2b-j-w-fwcmd-ipset6`( s� `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset src -j REJECT --reject-with icmp-port-unreachable`s! `ipset flush f2b-j-w-fwcmd-ipset`s# `ipset destroy f2b-j-w-fwcmd-ipset`s� `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m multiport --dports "$(echo 'http' | sed s/:/-/g)" -m set --match-set f2b-j-w-fwcmd-ipset6 src -j REJECT --reject-with icmp6-port-unreachable`s" `ipset flush f2b-j-w-fwcmd-ipset6`s$ `ipset destroy f2b-j-w-fwcmd-ipset6`( s: `ipset add f2b-j-w-fwcmd-ipset 192.0.2.1 timeout 0 -exist`( s0 `ipset del f2b-j-w-fwcmd-ipset 192.0.2.1 -exist`( s< `ipset add f2b-j-w-fwcmd-ipset6 2001:db8:: timeout 0 -exist`( s2 `ipset del f2b-j-w-fwcmd-ipset6 2001:db8:: -exist`( s f2b-j-w-fwcmd-ipset-ap ( s f2b-j-w-fwcmd-ipset-ap6 ( s8 `ipset create f2b-j-w-fwcmd-ipset-ap hash:ip timeout 0 `s� `firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`( sE `ipset create f2b-j-w-fwcmd-ipset-ap6 hash:ip timeout 0 family inet6`s� `firewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`( s$ `ipset flush f2b-j-w-fwcmd-ipset-ap`s% `ipset flush f2b-j-w-fwcmd-ipset-ap6`( s� `firewall-cmd --direct --remove-rule ipv4 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap src -j REJECT --reject-with icmp-port-unreachable`s$ `ipset flush f2b-j-w-fwcmd-ipset-ap`s& `ipset destroy f2b-j-w-fwcmd-ipset-ap`s� `firewall-cmd --direct --remove-rule ipv6 filter INPUT_direct 0 -p tcp -m set --match-set f2b-j-w-fwcmd-ipset-ap6 src -j REJECT --reject-with icmp6-port-unreachable`s% `ipset flush f2b-j-w-fwcmd-ipset-ap6`s' `ipset destroy f2b-j-w-fwcmd-ipset-ap6`( s= `ipset add f2b-j-w-fwcmd-ipset-ap 192.0.2.1 timeout 0 -exist`( s3 `ipset del f2b-j-w-fwcmd-ipset-ap 192.0.2.1 -exist`( s? `ipset add f2b-j-w-fwcmd-ipset-ap6 2001:db8:: timeout 0 -exist`( s5 `ipset del f2b-j-w-fwcmd-ipset-ap6 2001:db8:: -exist`( s
family='ipv4's icmp-port-unreachable( s
family='ipv6's icmp6-port-unreachable( s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`( s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' reject type='icmp-port-unreachable'"; done`( s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`( s� `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' reject type='icmp6-port-unreachable'"; done`( s
family='ipv4's icmp-port-unreachable( s
family='ipv6's icmp6-port-unreachable( s" `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`( s% `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv4' source address='192.0.2.1' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp-port-unreachable'"; done`( s% `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`( s' `ports="$(echo '22:24' | sed s/:/-/g)"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='ipv6' source address='2001:db8::' port port='$p' protocol='tcp' log prefix='f2b-j-fwcmd-rl' level='info' limit value='1/m' reject type='icmp6-port-unreachable'"; done`( ( ( ( ( ( ( R] R^ R� R� R R$ R� R� R4 R3 R� R� R R� R� R� Ra R� R� R� R� R� R� R� R, R� R� R R R� RU ( R t testJailsActionsR# R% R� R9 R� t testsR� R5 RK R� R� R� Rx R ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testCheckStockCommandActionsB s
"
* '
'
* '
'
c C s� | } t | t � r" | d } n t j d d | � } t j d d � | d � } t | t � rn | | d <n | } t j j | d | �S( Ni s \)\s*\|\s*(\S*mail\b[^\n]*)s$ ) | cat; printf "\\n... | "; echo \1s \bADDRESSES=\$\(dig\s[^\n]+c S s d S( Ns@ ADDRESSES="abuse-1@abuse-test-server, abuse-2@abuse-test-server"( ( t m( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� ; s i R ( R� R� t ret subR� R� R� ( R R� R R5 ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt _executeMailCmd2 s
c C s t j j d t � d d d t j j t d � d d t j j t d � d i d3 d 6f d d d t j j t d � d d t j j t d � d i d4 d 6f d d d d t j j t d � d d t j j t d � d i d5 d 6d6 d 6f d d d! d" i d7 d 6d8 d 6f f } t � } | j } | j
} x_ | D]W \ } } } | j | | � } x3 | D]+ } | j | � \ }
} | j
|
d( � qkWqCW| j } t d) � }
t d* � } t � } xE| D]=\ } } } x+| | j D] } | | j | } t j d+ d, d- � t j d. | d/ | j � t j d+ d, d- � | j | _ x� d |
f d | f f D]� \ } } | j | � s�qmn | j d0 | � t | � } | j d1 � | j d$ d% g � t j j | | � } | j | � | j d2 t | | � qmWq�Wq�Wd S(9 NR� s j-mail-whois-linessS mail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s", s logpath="s testcase01.logs
s s testcase01a.logs8 ", _whois_command="echo '-- information about <ip> --'"]s; The IP 87.142.124.10 has just been banned by Fail2Ban afters( 100 attempts against j-mail-whois-lines.s. Here is more information about 87.142.124.10 :s% -- information about 87.142.124.10 --s2 Lines containing failures of 87.142.124.10 (max 2)se testcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10se testcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10s ip4-bans j-sendmail-whois-linesso sendmail-whois-lines[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd='testmail -f "<sender>" "<dest>"', s, 100 attempts against j-sendmail-whois-lines.s j-complain-abusesu complain[name=%(__name__)s, grepopts="-m 1", grepmax=2, mailcmd="mail -s 'Hostname: <ip-host>, family: <family>' - ",s debug=1,s ", ]s6 try to resolve 10.124.142.87.abuse-contacts.abusix.orgsy mail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-serversh try to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgs0 Lines containing failures of 2001:db8::1 (max 2)sw mail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-servers ip6-bans j-xarf-abusesA xarf-login-attack[name=%(__name__)s, mailcmd="mail", mailargs="",s debug=1t ]s8 We have detected abuse from the IP address 87.142.124.10sV Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10sU Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10s8 mail abuse-1@abuse-test-server abuse-2@abuse-test-servers6 We have detected abuse from the IP address 2001:db8::1i s
87.142.124.10s 2001:db8::1s # R� i2 s
# == %-44s ==s - s # === %s ===id R� ( s; The IP 87.142.124.10 has just been banned by Fail2Ban afters( 100 attempts against j-mail-whois-lines.s. Here is more information about 87.142.124.10 :s% -- information about 87.142.124.10 --s2 Lines containing failures of 87.142.124.10 (max 2)se testcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10se testcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10( s; The IP 87.142.124.10 has just been banned by Fail2Ban afters, 100 attempts against j-sendmail-whois-lines.s. Here is more information about 87.142.124.10 :s% -- information about 87.142.124.10 --s2 Lines containing failures of 87.142.124.10 (max 2)se testcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10se testcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10( s6 try to resolve 10.124.142.87.abuse-contacts.abusix.orgs2 Lines containing failures of 87.142.124.10 (max 2)se testcase01.log:Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10se testcase01a.log:Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10sy mail -s Hostname: test-host, family: inet4 - Abuse from 87.142.124.10 abuse-1@abuse-test-server abuse-2@abuse-test-server( sh try to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgs0 Lines containing failures of 2001:db8::1 (max 2)sw mail -s Hostname: test-host, family: inet6 - Abuse from 2001:db8::1 abuse-1@abuse-test-server abuse-2@abuse-test-server( s6 try to resolve 10.124.142.87.abuse-contacts.abusix.orgs8 We have detected abuse from the IP address 87.142.124.10sV Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 87.142.124.10sU Dec 31 11:55:01 [sshd] error: PAM: Authentication failure for test from 87.142.124.10s8 mail abuse-1@abuse-test-server abuse-2@abuse-test-server( sh try to resolve 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.abuse-contacts.abusix.orgs6 We have detected abuse from the IP address 2001:db8::1s8 mail abuse-1@abuse-test-server abuse-2@abuse-test-server(! R] R^ R� R� Rr R� R� R� R R$ R� R� R4 R3 R� R R R R� R� R� R� R� R, R� R t
setAttemptt
setMatchesR� R� R� R R� ( R R� R# R% R� R9 R� R� R� R5 RK R� R� R� R� R� Rx R t testR� R� ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt testComplexMailActionMultiLogD s� 9
9
=
%
( R R R� R" R* R� R� R� R� R� R� R� R� R� ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyR� � s
" 3 � � � (A t
__author__t
__copyright__t __license__R] R` Ro Rr R� R RJ t server.failregexR R R R# R R� t
server.serverR t server.ipdnsR t server.jailR t server.jailthreadR t
server.ticketR t server.utilsR
t dummyjailR t utilsR R
R t helpersR R R R� R R R R1 R� R� t dirnamet __file__R� R( R� R R RQ R3 t TestCaseRq Ru R� R� t clientreadertestcaseR� R� R� R� ( ( ( sA /usr/lib/python2.7/site-packages/fail2ban/tests/servertestcase.pyt <module> sR
! [� � � } U*
Mini Shell