File: //lib/python3.6/site-packages/fail2ban/server/__pycache__/actions.cpython-36.opt-1.pyc
3
TB(d=a �
@ s� d Z dZdZddlZddlZddlZddlZyddlmZ W n e k
r\ ddl
mZ Y nX ddl
m Z ddl m
Z
mZ dd lmZ dd
lmZ dd lmZmZmZ dd lmZ dd
lmZ ddlm Z ddl m Z e e �Z G dd� dee�Z!dS )z
Cyril Jaquierz Copyright (c) 2004 Cyril JaquierZGPL� N)�Mapping)� OrderedDict� )�
BanManager� BanTicket)�IPAddr)�
JailThread)�
ActionBase�
CommandAction�
CallingMap)�MyTime)� Observers)�Utils� )� getLoggerc @ s e Zd ZdZdd� Zedd� �Zd?dd �Zd@d d �Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � ZdAd d �Zd!d"� ZdBd#d$�ZdCd%d&�Zd'd(� ZG d)d*� d*e�Zd+d,� ZdDd.d/�ZdEd0d1�ZdFd2d3�Z d4d5� Z dGd6d7�Z dHd8d9�Z dId:d;�Z dJd=d>�Z!dS )K�Actionsa� Handles jail actions.
This class handles the actions of the jail. Creation, deletion or to
actions must be done through this class. This class is based on the
Mapping type, and the `add` method must be used to add new actions.
This class also starts and stops the actions, and fetches bans from
the jail executing these bans via the actions.
Parameters
----------
jail: Jail
The jail of which the actions belongs to.
Attributes
----------
daemon
ident
name
status
active : bool
Control the state of the thread.
idle : bool
Control the idle state of the thread.
sleeptime : int
The time the thread sleeps for in the loop.
c C sL t j| d|j d� || _t� | _t� | _d| _d| _ d| _
| j
d | _ d S )Nzf2b/a.)�namer �
r ) r �__init__r �_jailr �_actionsr �
banManager�banEpoch� _Actions__lastConsistencyCheckTM�
banPrecedence�
unbanMaxCount)�self�jail� r � /usr/lib/python3.6/actions.pyr N s zActions.__init__c C sF t j| �}t|d�s"td| ��n t|jt�sBtd| |jjf ��|S )N�Actionz&%s module does not have 'Action' classz0%s module %s does not implement required methods)r Zload_python_module�hasattr� RuntimeError�
issubclassr r �__name__)� pythonModule�modr r r �_load_python_module\ s
zActions._load_python_moduleNFc C s� || j krN|std| ��| j | }t|d�rNt|d�rJ|j� || j|< dS |dkrdt| j|�}n | j|�}|j| j|f|�}|| j |< dS )a� Adds a new action.
Add a new action if not already present, defaulting to standard
`CommandAction`, or specified Python module.
Parameters
----------
name : str
The name of the action.
pythonModule : str, optional
Path to Python file which must contain `Action` class.
Default None, which means `CommandAction` is used.
initOpts : dict, optional
Options for Python Action, used as keyword arguments for
initialisation. Default None.
Raises
------
ValueError
If action name already exists.
RuntimeError
If external Python module does not have `Action` class
or does not implement necessary methods as per `ActionBase`
abstract class.
zAction %s already exists�reload�clearAllParamsN) r �
ValueErrorr! r) �_reload_actionsr
r r' r )r r r% �initOptsr( �actionZcustomActionModuler r r �addi s
z Actions.addTc s� |rt � � _n�t� d�r�x:� jj� D ],\}}|� jkr$� j| jf |rJ|ni � q$W t� fdd�� jj� D ��}t|�r�� jd|dd� � j |d� t
� d� dS ) z@ Begin or end of reloading resp. refreshing of all parameters
r+ c 3 s$ | ] \}}|� j kr||fV qd S )N)r+ )�.0r r- )r r r � <genexpr>� s z!Actions.reload.<locals>.<genexpr>FT)�db�actions�stop)r2 N) �dictr+ r! �itemsr r( r �len�_Actions__flushBan� stopActions�delattr)r Zbeginr r, Zdelactsr )r r r( � s
zActions.reloadc C s0 y
| j | S tk
r* td| ��Y nX d S )NzInvalid Action name: %s)r �KeyError)r r r r r � __getitem__� s
zActions.__getitem__c C s2 y | j |= W n tk
r, td| ��Y nX d S )NzInvalid Action name: %s)r r: )r r r r r � __delitem__� s zActions.__delitem__c C s
t | j�S )N)�iterr )r r r r �__iter__� s zActions.__iter__c C s
t | j�S )N)r6 r )r r r r �__len__� s zActions.__len__c C s dS )NFr )r �otherr r r �__eq__� s zActions.__eq__c C s t | �S )N)�id)r r r r �__hash__� s zActions.__hash__c C s( t j|�}| jj|� tjd| � d S )Nz
banTime: %s)r Z str2secondsr �
setBanTime�logSys�info)r �valuer r r rD � s
zActions.setBanTimec C s
| j j� S )N)r �
getBanTime)r r r r rH � s zActions.getBanTimec sD | j j� � |s� S t|�dkr2|d � kr.dS dS � fdd�|D �S )Nr r c s g | ]}|� krd nd�qS )r r r )r/ �ip)�lstr r �
<listcomp>� s z%Actions.getBanned.<locals>.<listcomp>)r �
getBanListr6 )r Zidsr )rJ r � getBanned� s
zActions.getBannedc C s | j jd|d�S )zkReturns the list of banned IP addresses.
Returns
-------
list
The list of banned IP addresses.
T)Zordered�withTime)r rL )r rN r r r rL � s zActions.getBanListc s< t j� � t|t�r&� fdd�|D �}n t|� �f}| j|�S )zBan an IP or list of IPs.c 3 s | ]}t |� �V qd S )N)r )r/ rI )�unixTimer r r0 � s z&Actions.addBannedIP.<locals>.<genexpr>)r �time�
isinstance�listr �_Actions__checkBan)r rI �ticketsr )rO r � addBannedIP� s
zActions.addBannedIPc C s8 |dkr| j |�S t|ttf�r�g }d}xF|D ]>}y|| j|||�7 }W q. tk
rj |sf|j|� Y q.X q.W |r�td| ��|S |r�| jjdk r�| jjj | j|� | j
j |�}|dk r�| j |� nnt|t
��s t
|�}|j�s tt|j| j
j� ��} | �r | j| ||�S d| }
tjtj|
� |�r,dS t|
��dS )aO Removes banned IP calling actions' unban method
Remove a banned IP now, rather than waiting for it to expire,
even if set to never expire.
Parameters
----------
ip : list, str, IPAddr or None
The IP address (or multiple IPs as list) to unban or all IPs if None
Raises
------
ValueError
If `ip` is not banned
Nr znot banned: %rz%s is not bannedr )r7 rQ rR �tuple�removeBannedIPr* �appendr �database�delBanr Z
getTicketByID�_Actions__unBanr ZisSingle�filter�containsrL rE �log�loggingZMSG) r rI r1 ZifexistsZmissed�cnt�i�ticketZipaZips�msgr r r rW � s>
zActions.removeBannedIPc C s� |dkr| j }x�tt|j� ��D ]t\}}y |j� W nD tk
rx } z(tjd| jj ||tj
� t j kd� W Y dd}~X nX | j |= tj
d| jj |� q W dS )z>Stops the actions in reverse sequence (optionally filtered)
Nz(Failed to stop jail '%s' action '%s': %s)�exc_infoz%s: action %s terminated)r �reversedrR r5 r3 � ExceptionrE �errorr r �getEffectiveLevelr_ �DEBUG�debug)r r2 r r- �er r r r8 / s
$zActions.stopActionsc s� d}xh� j j� D ]Z\}}y |j� W q tk
rh } z(tjd� jj||tj� t j
kd� W Y dd}~X qX qW �xZ� j �rʐy� j r�tj
d� tj� fdd�dd� � j� tj
d � wrd}t� j� jjtj� �}tjd
d |� j� tj� fd d�|��r
� j� }||7 }| �s |� jk�r�� j �r||d
9 }tjd
d|�rL|� jk �rL|n� j|� j� � j|�rt|� jk �rt|n� j� d}W qr tk
�r� } z&tjd� jj|tj� t j
kd� W Y dd}~X qrX qrW � jdd� � j � dS )z�Main loop for Threading.
This function is the main loop of the thread. It checks the jail
queue and executes commands when an IP address is banned.
Returns
-------
bool
True when the thread exits nicely.
r z)Failed to start jail '%s' action '%s': %s)rd NzActions: enter idle modec s � j p� j S )N)�active�idler )r r r �<lambda>V s z Actions.run.<locals>.<lambda>c S s dS )NFr r r r r rn W s zActions: leave idle mode� z1Actions: wait for pending tickets %s (default %s)c s � j p� jjS )N)rl r ZhasFailTicketsr )r r r rn ^ s r z+Actions: check-unban %s, bancnt %s, max: %sz*[%s] unhandled error in actions thread: %sT)r3 ) r r5 �startrf rE rg r r rh r_ ri rl rm rj r Zwait_forZ sleeptime�minr Z_nextUnbanTimer rP r^ rS r r �_Actions__checkUnBanr7 r8 )r r` r r- rk ZbancntZwtr )r r �run? sF
(
,"( z Actions.runc @ s� e Zd Zd(Zdd� dd� dd� dd� dd� d d� d
d� d d� d d� d
d� dd� d)dd�dd� dd� dd� dd� dd� dd� dd� dd� dd� d�Zejd* Zdd efd d �Zd!d"� Zd#d$� Z d+d&d'�Z
dS ),zActions.ActionInfo�fid�
raw-ticketc C s
| j j� S )N)�_ActionInfo__ticketZgetIP)r r r r rn w s zActions.ActionInfo.<lambda>c C s
| d j S )NrI )Z familyStr)r r r r rn x s c C s | d j d�S )NrI � )ZgetPTR)r r r r rn y s c C s | d j � S )NrI )ZgetHost)r r r r rn z s c C s
| j j� S )N)rv �getID)r r r r rn { s c C s
| j j� S )N)rv �
getAttempt)r r r r rn | s c C s
| j j� S )N)rv �getTime)r r r r rn } s c C s | j � S )N)� _getBanTime)r r r r rn ~ s c C s
| j j� S )N)rv Z getBanCount)r r r r rn s c C s dj | jj� �S )N�
)�joinrv �
getMatches)r r r r rn � s c C s | j jr dS dS )Nr r )rv �restored)r r r r rn � s Nc C s | j j|�S )N)rv ZgetData)r �tagr r r rn � s c C s dj | jd�j� �S )Nr| T)r} �_mi4ipr~ )r r r r rn � s c C s dj | j� j� �S )Nr| )r} r� r~ )r r r r rn � s c C s | j d�j� S )NT)r� ry )r r r r rn � s c C s | j � j� S )N)r� ry )r r r r rn � s c C s
t | j�S )N)�reprrv )r r r r rn � s c C s | j jjj� S )N)�_ActionInfo__jailr2 r �size)r r r r rn � s c C s | j jjj� S )N)r� r2 r � getBanTotal)r r r r rn � s c C s | j jjj� S )N)r� r\ � failManagerr� )r r r r rn � s c C s | j jjj� S )N)r� r\ r� Z getFailTotal)r r r r rn � s )rI Zfamilyzip-revzip-hostrt ZfailuresrP ZbantimeZbancountZmatchesr zF-*Z ipmatchesZ
ipjailmatchesZ
ipfailuresZipjailfailuresz
raw-ticketz jail.bannedzjail.banned_totalz
jail.foundzjail.found_total�__ticket�__jail�__mi4ipTc C s$ || _ || _t� | _|| _|| _d S )N)rv r� r4 Zstorage� immutable�data)r rb r r� r� r r r r � s
zActions.ActionInfo.__init__c C s | j | j| j| j| jj� �S )N)� __class__rv r� r� r� �copy)r r r r r� � s zActions.ActionInfo.copyc C s& | j j� }|d kr | jjj� }t|�S )N)rv rH r� r2 �int)r �btimer r r r{ � s
z Actions.ActionInfo._getBanTimeFc C s� t | d�si | _| j}|r dnd}||krD|| dk r>|| S | jS yR| j}| d }d||< |jsh| jS |r�|jj|d�||< n|jj||d�||< W nB tk
r� } z&tjd||j |tj
� t j kd � W Y dd}~X nX || dk r�|| S | jS )
a� Gets bans merged once, a helper for lambda(s), prevents stop of executing action by any exception inside.
This function never returns None for ainfo lambdas - always a ticket (merged or single one)
and prevents any errors through merging (to guarantee ban actions will be executed).
[TODO] move merging to observer - here we could wait for merge and read already merged info from a database
Parameters
----------
overalljails : bool
switch to get a merged bans :
False - (default) bans merged for current jail only
True - bans merged for all jails of current ip address
Returns
-------
BanTicket
merged or self ticket only
r� �allr NrI )rI )rI r z+Failed to get %s bans merged, jail '%s': %s)rd )
r! Z_ActionInfo__mi4iprv r� rY Z
getBansMergedrf rE rg r rh r_ ri )r Z overalljailsZmi�idxr rI rk r r r r� � s*
$zActions.ActionInfo._mi4ip)rt ru )N)r� r� r� )F) r$ �
__module__� __qualname__Z
CM_REPR_ITEMSZAI_DICTr � __slots__r r� r{ r� r r r r �
ActionInfor s6
r� c C s$ |st dtj� �}tj|| j�}|S )Nrw )r r rP r r� r )r rb �aInfor r r �_getActionInfo� s zActions._getActionInfo�d c c s4 d}x*||k r.| j j� }|s P |V |d7 }qW dS )zAGenerator to get maximal count failure tickets from fail-manager.r r N)r Z
getFailTicket)r �countr` rb r r r Z__getFailTickets� s
zActions.__getFailTicketsc s� d}|s| j | j�}d}�x�|D �]v}tj|�� |j| jj� �}� j� }| j� �}i }| jj� |d��r^|d7 }t j
dk r�� j r�t j
j d� | j
|� tjd| j
j� j s�dnd|� x�| jj� D ]�\} }
y0� j r�t|
d d
�r�w�|js�|j� |
j|� W q� tk
�r@ } z*tjd | j
j| || tj� tjkd � W Y dd} ~ X q�X q�W d
� _ | j �r�| j � _ q |j dd��r�tj d| j
j|� q |j d� �� � j �r�|j � � j � } | dk �r�tjn| dk �r�tj!ntj"}
tj#|
d| j
j|� � j | j k�rF| dk�rF| �rFt$j%� | j&d k�rFt$j%� | _&x(| jj'� D ]}
t(|
d��r(|
j)� �q(W � j | j k �r�|�svt*� fdd�| jj� D ��}|| j+� |d�7 }q || j+� �7 }q W |�r�tj,d|| jj-� | jj.� | j
j� |S )a Check for IP address to ban.
If tickets are not specified look in the jail queue for FailTicket. If a ticket is available,
it executes the "ban" command and adds a ticket to the BanManager.
Returns
-------
bool
True if an IP address get banned.
r N)�reasonr ZbanFoundz
[%s] %sBan %srw zRestore �
norestoredFz9Failed to execute ban jail '%s' action '%s' info '%r': %s)rd TZexpiredz [%s] Ignore %s, expired bantimerb � �< z[%s] %s already banned�consistencyCheckc 3 s& | ] \}}|j � j kr||fV qd S )N)r )r/ r r- )�bTicketr r r0 ( s z%Actions.__checkBan.<locals>.<genexpr>)r2 z"Banned %s / %s, %s ticket(s) in %r)/�_Actions__getFailTicketsr r ZwraprH r rx r� Z addBanTicketr
ZMainr r. r rE �noticer r r5 �getattrr� �resetZbanrf rg rh r_ ri �bannedr �getrF rz ZNOTICEZWARNINGr^ r rP r �valuesr! r� r4 �_Actions__reBanrj r� r� )r rT r` Z rebanactsrb r� rI r� r� r r- rk ZdiftmZllr )r� r Z
__checkBan� sp
(
zActions.__checkBanc C s� |p| j }|j� }| j|�}|rTtjd| jj|t|�dkrNdt|j � �d nd� x�|j
� D ]~\}}y0tj d| jj||� |j s�|j
� |j|� W q^ tk
r� } z(tjd| jj|||tj� tjkd� dS d }~X q^X q^W d
|_| jr�| j|_dS ) z�Repeat bans for the ticket.
Executes the actions in order to reban the host given in the
ticket.
Parameters
----------
ticket : Ticket
Ticket to reban
z[%s] Reban %s%sr z , action %rr rw z[%s] action %r: reban %sz;Failed to execute reban jail '%s' action '%s' info '%r': %s)rd NT)r rx r� rE r� r r r6 rR �keysr5 rj r� r� Zrebanrf rg rh r_ ri r� r ) r rb r2 r^ rI r� r r- rk r r r Z__reBan4 s*
4 zActions.__reBanc C s� | j j|�sd S d }x�| jj� D ]�\}}yJ|jr>t|dd�r>w |jsFw |d krX| j|�}|jsf|j � |j
|� W q t k
r� } z*t j
d| jj|||t j� tjkd� W Y d d }~X q X q W d S )Nr� Fz9Failed to execute ban jail '%s' action '%s' info '%r': %s)rd )r Z
_inBanListr r5 r r� Z _prolongabler� r� r� Zprolongrf rE rg r r rh r_ ri )r rb r� r r- rk r r r � _prolongBanV s&
zActions._prolongBanc C sT | j jtj� |�}x|D ]}| j|� qW t|�}|rPtjd|| j j� | j j
� |S )zKCheck for IP address to unban.
Unban IP addresses which are outdated.
z Unbanned %s, %s ticket(s) in %r) r Z unBanListr rP r[ r6 rE rj r� r r )r ZmaxCountrJ rb r` r r r Z __checkUnBanm s
zActions.__checkUnBanc s� d}|dkr"t jd� | jj� }nd}t| j�}d}i }x�|dk rF|n| jj� D ]�\}� y<t� d�r�t� t � sv� j
r�t j d| j j
|� � j� r�wPW nt tk
�r } zVt jd| j j
|| t j� tjkd � t jd
� t� d �r�� �fd d
�}
� j|
� wPW Y dd} ~ X nX t jd� � ||< qPW |}|�rR| j jdk �rRt jd� | j jj| j � x&|D ] } | j| ||d� |d7 }�qXW t jd|| jj� | j j
� |S )z�Flush the ban list.
Unban all IP address which are still in the banning list.
If actions specified, don't flush list - just execute unban for
given actions (reload, obsolete resp. removed actions).
TNz Flush ban listFr �flushz [%s] Flush ticket(s) with %sz1Failed to flush bans in jail '%s' action '%s': %s)rd z'No flush occurred, do consistency checkr� c s$ �r t � dd � r tjd� dS dS )NZactionrepair_on_unbanz,Invariant check failed. Flush is impossible.FT)r� rE rg r )r- r3 r r �
_beforeRepair� s
z)Actions.__flushBan.<locals>._beforeRepairz Unban tickets each individualyz Flush jail in database)r2 r^ r z! Unbanned %s, %s ticket(s) in %r)rE rj r Z flushBanListr= r r5 r! rQ r
Z actionflushr� r r r� rf rg rh r_ ri rF r� rY rZ r[ r� ) r r1 r2 r3 r^ rJ r` �
unbactionsr rk r� rb r )r- r3 r Z
__flushBan{ sF
zActions.__flushBanc
C s� |dkr| j }n|}|j� }| j|�}|r<tjd| jj|� x�|j� D ]�\}}y0tjd| jj||� |j sr|j
� |j |� W qF t k
r� } z*tj
d| jj||| tj� tjkd� W Y dd} ~ X qFX qFW dS )z�Unbans host corresponding to the ticket.
Executes the actions in order to unban the host given in the
ticket.
Parameters
----------
ticket : FailTicket
Ticket of failures of which to unban
Nz
[%s] Unban %sz[%s] action %r: unban %sz;Failed to execute unban jail '%s' action '%s' info '%r': %s)rd )r rx r� rE r� r r r5 rj r� r� Zunbanrf rg rh r_ ri )
r rb r2 r^ r� rI r� r r- rk r r r Z__unBan� s$
zActions.__unBan�basicc C s� dddg}|dks||kr,t jd||f � |dkrH| jj� }t|�}n
| jj� }d|fd| jj� fg}|dkr~|d|fg7 }|dkr�| jj� }|d | jj|�fd
| jj |�fd | jj
|�fg7 }|S ) zEStatus of current and total ban counts and current banned IP list.
Zshortr� ZcymruNz9Unsupported extended jail status flavor %r. Supported: %szCurrently bannedz Total bannedzBanned IP listzBanned ASN listzBanned Country listzBanned RIR list) rE Zwarningr rL r6 r� r� ZgetBanListExtendedCymruInfoZgeBanListExtendedASNZgeBanListExtendedCountryZgeBanListExtendedRIR)r ZflavorZsupported_flavorsr� r` �retZ
cymru_infor r r �status� s$
zActions.status)NNF)T)F)NTF)N)r� )N)NT)N)FNF)NT)r� )"r$ r� r� �__doc__r � staticmethodr' r. r( r; r< r> r? rA rC rD rH rM rL rU rW r8 rs r r� r� r� rS r� r� rr r7 r[ r� r r r r r 2 s:
.
:
3]
U
"
6
r )"�
__author__Z
__copyright__Z __license__r_ �os�sysrP �collections.abcr � ImportError� collectionsr Z
banmanagerr r Zipdnsr Z
jailthreadr r- r r
r Zmytimer Zobserverr
Zutilsr Zhelpersr r$ rE r r r r r �<module> s*