
    ogfp                        d Z dZdZdZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddlZddlmZmZ ddlmZmZmZ 	 dd	lmZ dd
lmZmZ ddlmZ ddlmZmZm Z  ddl!m"Z"m#Z# ddl$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*  e(d      Z+d"dZ,d Z-d#dZ.d$dZ/d Z0d Z1d Z2 G d de      Z3d Z4 G d de5      Z6 G d de5      Z7 G d d e5      Z8d! Z9y# e$ r dZY w xY w)%z
Fail2Ban  reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

This tools can test regular expressions for "fail2ban".
zFail2Ban DevelopersaI  Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
Many contributions by Yaroslav O. Halchenko, Steven Hiscocks, Sergey G. Brester (sebres).GPL    N)OptionParserOption)NoOptionErrorNoSectionErrorMissingSectionHeaderError   )FilterSystemd)versionnormVersion   )FilterReader)FilterFileContainerMyTime)RegexRegexException)str2LogLevelgetVerbosityFormatFormatterWithTraceBack	getLoggerextractOptions
PREFER_ENCfail2banc                     t        j                  ||      | dd}|rd|d<   dt        j                  j	                  |      z   S )N)useDnspython)restrflavormflagszhttps://www.debuggex.com/?)r   _resolveHostTagurllibparse	urlencode)sampleregex	multiliner   argss        ?/usr/lib/python3/dist-packages/fail2ban/client/fail2banregex.pydebuggexURLr,   ?   sF    eF3		
 stG}$v||'='=d'CCC    c                     t        |        y N)printr*   s    r+   outputr2   H   s	    tr-   c                 8    t        |       |kD  r| d|dz
   dz   S | S )zReturn shortened string
	N   ...)len)sls     r+   shortstrr9   K   s(     FQJ	
4AaC5	r-   c                 v    t        |       sy |rd|z  }nd}t        |dz   dj                  |       z   dz          y )Nz|- %s
 z|  z
|  z
`-)r6   r2   join)r8   headerr7   s      r+   pprint_listr>   R   s<    A
&!!UW\\!_	$v	-/r-   c              #   z   K   	 	 |j                         }|sy | j                  |       (# t        $ r Y 4w xY wwr/   )get_nextOSErrorformatJournalEntry)flt	myjournalentrys      r+   journal_lines_genrF   [   sM     5 
u%%  
 s   ;, ;	8;8;c                  T    t        t                      t        j                  d       y Nr   )r2   r   sysexitr1   s    r+   dumpNormVersionrK   e   s    !r-   c                  .    dt         j                  d   z  S )Nz(%s [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]r   )rI   argv r-   r+   <lambda>rO   i   s    :SXXa[H r-   c                       e Zd Zd Zy)_f2bOptParserc                     d| _         dt               z   dz   t        z   dz   t        j                  | g|i |z   dz   t        z   dz   S )z, Overwritten format helper with full ussage.r;   zUsage: 
a  
LOG:
  string                a string representing a log line
  filename              path to a log file (/var/log/auth.log)
  systemd-journal       search systemd journal (systemd-python required),
                        optionally with backend parameters, see `man jail.conf`
                        for usage and examples (systemd-journal[journalflags=1]).

REGEX:
  string                a string representing a 'failregex'
  filter                name of filter, optionally with options (sshd[mode=aggressive])
  filename              path to a filter file (filter.d/sshd.conf)

IGNOREREGEX:
  string                a string representing an 'ignoreregex'
  filename              path to a filter file (filter.d/sshd.conf)

z>

Report bugs to https://github.com/fail2ban/fail2ban/issues

)usage__doc__r   format_help__copyright__)selfr*   kwargss      r+   rV   z_f2bOptParser.format_helpl   si    $*	UW	t	#g	- 1 
  	  777!
8 ;!
$ %
$ %
 r-   N)__name__
__module____qualname__rV   rN   r-   r+   rQ   rQ   k   s    r-   rQ   c                     t        t               dt        z         } | j                  t	        dddd      t	        dd	d
      t	        dddd d      t	        ddt
        d      t	        ddddd      t	        ddd d      t	        ddt        dd      t	        d d!d"      t	        d#d$d%d&d'(      t	        d)d*t        d+,      t	        d-d.d/d0dd12      t	        d3dd0t        d45      t	        d6d7dd89      t	        d:d;dd<9      t	        d=d>d?d@dA2      t	        dBdCddDd dE2      t	        dFddG9      t	        dHddI9      t	        dJddK9      t	        dLddM9      t	        dNddO9      t	        dPdQddR9      t	        dSddT9      g       | S )UNz%prog )rT   r   z-cz--configz/etc/fail2banzset alternate config directory)defaulthelpz-dz--datepatternz+set custom pattern used to match date/times)r_   z
--timezonez--TZstorez)set time-zone used by convert time format)actionr^   r_   z-ez
--encodingz%File encoding. Default: system localez-rz--raw
store_trueFzRaw hosts, don't resolve dnsz--usednszpDNS specified replacement of tags <HOST> in regexp ('yes' - matches all form of hosts, 'no' - IP addresses only)z-Lz
--maxlinesr   zmaxlines for multi-line regex.)typer^   r_   z-mz--journalmatchzGjournalctl style matches overriding filter file. "systemd-journal" onlyz-lz--log-level	log_levelcriticalz(Log level for the Fail2Ban logger to use)destr^   r_   z-Vcallbackz,get version in machine-readable short format)ra   rg   r_   z-vz	--verbosecountverbosezIncrease verbosity)ra   rf   r^   r_   z--verbosityz'Set numerical level of verbosity (0..4))ra   rf   rc   r_   z--verbose-datez--VDz%Verbose date patterns/regex in output)ra   r_   z-Dz
--debuggexz-Produce debuggex.com urls for debugging therez--no-check-allstore_falsecheckAllRegexTzDisable check for all regex'sz-oz--outoutzaSet token to print failure information only (row, id, ip, msg, host, ip4, ip6, dns, matches, ...)z--print-no-missedzDo not print any missed linesz--print-no-ignoredzDo not print any ignored linesz--print-all-matchedzPrint all matched linesz--print-all-missedz*Print all missed lines, no matter how manyz--print-all-ignoredz+Print all ignored lines, no matter how manyz-tz--log-tracebackz.Enrich log-messages with compressed tracebacksz--full-tracebackzBEither to make the tracebacks full, not compressed (as by default))rQ   rT   r   add_optionsr   r   intrK   )ps    r+   get_opt_parserrp      s   
'w  z?+-8:vgt68|Z24w|U)+GTKL 	|#q+-!" 	}57 	j?9;{7! 	wYS46	6,24|L:<	-ot*,wwUDnp	\*,	l+-	|$&	l79	|8: ;=	LOQe4 4l 	
r-   c                   6    e Zd Zd Zd Zd Zd Zd Zd Zd Z	y)		RegexStatc                 >    d| _         || _        t               | _        y rH   )_stats
_failregexlist_ipList)rX   	failregexs     r+   __init__zRegexStat.__init__   s    $+$/$,r-   c                 d    d| j                   | j                  | j                  | j                  fz  S )Nz%s(%r) %d failed: %s)	__class__ru   rt   rw   rX   s    r+   __str__zRegexStat.__str__   s-    	~~tT\\B
C Cr-   c                 .    | xj                   dz  c_         y Nr   rt   r|   s    r+   inczRegexStat.inc   s    +++r-   c                     | j                   S r/   r   r|   s    r+   getStatszRegexStat.getStats   s    	r-   c                     | j                   S r/   )ru   r|   s    r+   getFailRegexzRegexStat.getFailRegex   s    	r-   c                 :    | j                   j                  |       y r/   )rw   append)rX   values     r+   appendIPzRegexStat.appendIP   s    ,,er-   c                     | j                   S r/   )rw   r|   s    r+   	getIPListzRegexStat.getIPList   s    	r-   N)
rZ   r[   r\   ry   r}   r   r   r   r   r   rN   r-   r+   rr   rr      s&    
Cr-   rr   c                   "    e Zd ZdZd Zd Zd Zy)	LineStatsz(Just a convenience container for stats
	c                     dx| _         | _        g | _        d| _        g | _        d| _        g | _        |j                  rg | _        g | _	        g | _
        y y rH   )testedmatchedmatched_linesmissedmissed_linesignoredignored_linesdebuggexmatched_lines_timeextractedmissed_lines_timeextractedignored_lines_timeextracted)rX   optss     r+   ry   zLineStats.__init__   sZ      $+$$+$$,$	]]&(4#%'4"&(4# r-   c                     d| z  S )NzM%(tested)d lines, %(ignored)d ignored, %(matched)d matched, %(missed)d missedrN   r|   s    r+   r}   zLineStats.__str__   s    	X[_	__r-   c                 6    t        | |      rt        | |      S dS )Nr;   )hasattrgetattr)rX   keys     r+   __getitem__zLineStats.__getitem__   s    &tS1s	9r9r-   N)rZ   r[   r\   rU   ry   r}   r   rN   r-   r+   r   r      s    
)`:r-   r   c                   h    e Zd Zd Zd Zd Zd Zd Zd Zd Z	d Z
d	 ZddZd Zd Zd Zd Zd Zy
)Fail2banRegexc                    | j                   j                  t        d |j                   j                         D                     || _        d| _        d| _        d | _        t               | _        t        d       | _
        d| _        t               | _        t               | _        t               | _        d | _        t#        |      | _        |j&                  r| j)                  |j&                         nd| _        |j,                  .| j/                  t1        j2                  |j,                               |j4                  r%| j                  j7                  |j4                         d| j                  _        	 t;        j<                  d       ddlm }  |        |jB                  r| jE                  |jB                         |jF                  r%| j                  jI                  |jF                         |jJ                  | j                  _&        |jN                  xr |jP                   | j                  _'        tS        |jP                        | j                  _*        | jV                  | j                  _,        d| _-        y )Nc              3   0   K   | ]  \  }}d |z   |f  yw)_NrN   ).0ovs      r+   	<genexpr>z)Fail2banRegex.__init__.<locals>.<genexpr>   s     G#!ASU1IGs   Fr      r	   )_updateTimeREauto).__dict__updatedictitems_opts_maxlines_set_datepattern_set_journalmatchshare_configr   _filter_prefREMatchedrv   _prefREGroups_ignoreregexru   _time_elapsedr   _line_statsmaxlinessetMaxLines	_maxlinesjournalmatchsetJournalMatchshlexsplittimezonesetLogTimeZonecheckFindTimer   setAlternateNowserver.strptimer   datepatternsetDatePatternusedns	setUseDnsrawreturnRawHostrk   rl   boolignorePending_onIgnoreRegexonIgnoreRegex_backend)rX   r   r   s      r+   ry   zFail2banRegex.__init__   s   --tG1D1D1FGGH$*$$$F$$,$v$f$F$/$t_$	]]DMM"4>	"D$5$567	]]<<t}}-$$,,		!.?	t''(	[[<<$++&#xx$,,#11B$((l$,,#DHH~$,,#22$,,$-r-   c                 H    | j                   j                  st        |       y y r/   )r   rl   r2   rX   lines     r+   r2   zFail2banRegex.output!  s    	r-   c                 :    |j                  | j                  d      S )Nignore)encode	_encodingr   s     r+   encode_linezFail2banRegex.encode_line$  s    	T^^X	..r-   c                     | j                   sX| j                  j                  |       d| _         |3| j                  d|d| j                  j	                         d          y y y )NTzUse      datepattern : z : r   )r   r   r   r2   getDatePattern)rX   patterns     r+   r   zFail2banRegex.setDatePattern'  s]    			<<w'4KKdll))+A.2 4  
r-   c                     | j                   sX| j                  j                  t        |             d| _         | j	                  d| j                  j                         z         y y )NTzUse         maxlines : %d)r   r   r   rn   r2   getMaxLinesrX   r   s     r+   r   zFail2banRegex.setMaxLines/  sM    			<<CF#4;;+dll.F.F.HHJ 
r-   c                     || _         y r/   )r   r   s     r+   r   zFail2banRegex.setJournalMatch5  s
    $r-   c                     i }|j                         }ddgt        |j                               z   D ]!  }	 ||v r||   n|j                  d|      ||<   # | j                  d|z         y # t        $ r Y Dw xY w)Nlogtyper   
DefinitionzReal  filter options : %r)getCombinedrv   keysgetr   r2   )rX   readerfltOptrealoptscomboptsks         r+   _dumpRealOptionszFail2banRegex._dumpRealOptions8  s    (!(}%V[[](;; 	a	!"h(1+FJJ|Q4OHQK		 ++)H45  		s   A**	A65A6c                    |dv sJ |dz   }| j                   j                  }|}d }i }|dk(  rt        j                  d|      r	 t	        |      \  }}d|dd  v r|f}n||dz   |dz   f}|D ]  }d	|vret
        j                  j                  |      d
k(  r!t
        j                  j                  ||      }nAt
        j                  j                  |d
|      }nt
        j                  j                  |      }t
        j                  j                  |      r nd } ||| j                   j                  k(  s-t
        j                  j                  |      d
k(  sd|dd  vrd	|vrt
        j                  j                  |      d
k(  rt
        j                  j                  |      }t
        j                  j                  t
        j                  j                  |            d   }| j                  d|dd|d|       nX| j                  d|dd|       d }t
        j                  j!                  |      st
        j                  j#                  |      }|r| j                  d|z         t%        |d|| j&                  |      }
d }	 ||
j)                         }n!|
j+                  d        |
j-                         }|st        d|z         y|
j/                  | j0                         |
j3                  d        | j                  dkD  s%t4        j7                         t8        j:                  k  r| j=                  |
|       |
j?                         }i }|D ]L  }|d   dk(  r|d   }n|d   dk(  r|dd  }n!	 |d   dk(  r|D ]  }|| j@                  _!         n	|d   dk(  rD|jE                  d      }|stG               x}|d<   |D ]  }|jI                  tK        |              n|d   d k(  rD|jE                  d!      }|stG               x}|d!<   |D ]  }|jI                  tK        |              nq|d   d"k(  r|D ]  }| jM                  |        nP|d   d#k(  r|D ]  }| jO                  |        n/|d   d$k(  r'| j                   jP                  | jS                  |       O n/| j                  d|dd)tW        |             |tK        |      gi}|jY                         D ]\  \  }}|dz   }t[        | d*|z   |       |D ]=  } t]        | j@                  d+|j_                         z        |ja                                ? ^ y,# t        $ r=}	t        dt        |	             t        d|       | j                  r|	Y d }	~	yd }	~	ww xY w# t        $ r0}	t        dt        |	             | j                  r|	Y d }	~	d }	~	ww xY w# tT        $ r%}	t        d%|d   d&|d'|d(|	       Y d }	~	 yd }	~	ww xY w)-N)failr   r(   r   z"(?ms)^/{0,3}[\w/_\-.]+(?:\[.*\])?$.iz.confz.local/zfilter.dz%ERROR: Wrong filter name or options: z       while parsing: Fr   zUse z>11z filter file : z, basedir: z file : zUse   filter options : %rzfail2ban-regex-jail)r   basedirzWrong config file: zERROR: failed to load filter %sr   z	multi-setr4   setr	   	prefregexaddfailregexaddignoreregexr   r   r   addjournalmatchzERROR: Invalid value for z (z) read from : z line : r   z
add%sRegexT)1r   configr   searchr   ospathbasenamer<   dirnameisfile	Exceptionr2   r   _verbosesplitextisabsabspathr   r   read
setBaseDirreadexplicitapplyAutoOptionsr   
getOptionslogSysgetEffectiveLevelloggingDEBUGr   convertr   	prefRegexr   rv   r   rr   r   r   r   r   
ValueErrorr9   r   setattrr   titler   )rX   r   	regextyper(   r   fltNamefltFiler   tryNameser   retreadercommandsregex_valuesoptoptvalstors                    r+   	readRegexzFail2banRegex.readRegexE  s   	(	()	(
g
%JJ'''&&ii5u=%e,_Wfwrs|h7W,g.@Ah 
G^
''

7
#z
1'',,w0'',,w
G<)w		 g
" $**###	ww J.723<Cw$6 
ww J.www'Wggrww//89!<GKKUGWUW 	KK8:G77==!www'WKK,v57"7dN_N_ipq6	3	;;=S t S 
-57	4==)	T
mma6335w}}D&&)NN$>< #s
1v!fV	Q5!"gVA+ '& &t||'
a&N
"f%d74,v. &&{{9V$%& a&$
$h'd4694,x0 &&{{9V$%& a&J
  & 
a&M
! #&6"#
a&%
%		 	 	(F#?#L ;;x?Ay/01<!-!3!3!5 =iw5
4ul+ =u'G	\\IOO%%'','9'9';=== 
E  QAB%12Qx	B  
c!f./}}Ah}b  !!ffeQ8 :sJ   CU 
4V 7D+W
	V3VV	W%WW
	W8W33W8c                 L    d| _         | j                  |   j                          y )NT)_lineIgnoredr   r   )rX   idxignoreRegexs      r+   r   zFail2banRegex._onIgnoreRegex  s!    $Cr-   Nc                    | j                   j                  }| j                   j                         dkD  r|d d  }t        |      | j                   j                         k\  }dx}| _        	 | j                   j                  ||      }g }g }|D ]  }	| j                  j                  sP|	j                  t        |      dkD         | j                  |	d      }
|
j                          |
j                  |	       |	d   j                  d      s|j                  |	       d} | j                  j                  rd |d fS | j                   j                  r| j                   j                  }|j                         r| xj                  dz  c_        | j                   rt        | j"                        | j$                  k  r*| j"                  j                  |j'                                n=t        | j"                        | j$                  k(  r| j"                  j                  d       | j                   j                         dkD  r|t-        |      d  D ]  }|| j                   j                  vs	 | j.                  j0                  j3                  | j.                  j0                  j5                  d
j7                  |                   | j8                  r]| j.                  j:                  j3                  | j.                  j:                  j5                  d
j7                  |d d d                      | j>                  r[| j8                  s5| j.                  j@                  j                  d
j7                  |             n|j                  |d   |d   z          | j.                  xjB                  dz  c_!        | j.                  xjD                  dz  c_"         |r:|j                  | j                   jG                                dj7                  |      }|||xs | j                  fS # t(        $ r}t+        d|z         Y d }~y	d }~ww xY w# t<        $ r Y 'w xY w)Nr   Fr   r4   nofailTr5   	ERROR: %s)Nr   Nr;   r	   rS   )$r   _Filter__lineBufferr   r6   r   processLiner   rl   r   ru   r   r   r   r  
hasMatchedr   r  r   r   	getGroupsr   r2   rn   r   r   popindexr<   	_debuggexr   r  _print_all_matchedr   r   r   processedLine)rX   r   dateorgLineBuffer
fullBuffer
is_ignoredfoundlinesr  matchr(   prer  bufLines                 r+   	testRegexzFail2banRegex.testRegex  sr   ,,22-	\\!# #==!T\\%=%=%??*#((*t <<##D$/55	3 u::>> \\#c(1*__U1X&U
YY[
^^E8<<!ZZZ jjnnd?
ll
,,
 
 C
~~	A	T	 4>>	1  1
d  
!T^^
3!!%( 
\\!#J 01 "wdll666
##''$$**2777+;<>	22663399	1		 ! 	^^%%,,RWWW-=>||GAJ+,	"	!%"& <<**,-
))E
4	sZ44#4#4	555 
 	;?
  
s3   )CP  9C&P  )C Q 	Q)P<<Q	QQc                     | j                   j                  dv rd }|S dk(  rd }|S dk(  rd }|S dk(  rd }|S d	vrfd
}|S ddlmmm d fd}|S )zOPrepares output- and fetch-function corresponding given '--out' option (format))idfidc                 .    | D ]  }t        |d           y r   )r2   r  rs     r+   _outz+Fail2banRegex._prepaireOutput.<locals>._out  s     AaD\r-   ipc                 T    | D ]#  }t        |d   j                  d|d                % y )Nr4   r@  r   r2   r   r=  s     r+   r?  z+Fail2banRegex._prepaireOutput.<locals>._out  s,     "AaDHHT1Q4 !"r-   msgc                     | D ]N  }|d   j                  d      D ]5  }t        |t              sdj                  d |D              }t	        |       7 P y )Nr4   matchesr;   c              3       K   | ]  }|  y wr/   rN   r   r>  s     r+   r   z>Fail2banRegex._prepaireOutput.<locals>._out.<locals>.<genexpr>       .1.   )r   
isinstancer   r<   r2   r=  s     r+   r?  z+Fail2banRegex._prepaireOutput.<locals>._out  sP     dhhy! 377.a. qQir-   rowc                     | D ]>  }t        d|d   d|d   dt        d |d   j                         D              d       @ y )N[r   z,	r	   c              3   6   K   | ]  \  }}|d k7  s||f  yw)rE  NrN   )r   r   r   s      r+   r   z>Fail2banRegex._prepaireOutput.<locals>._out.<locals>.<genexpr>  s!     /a$!QRSW`R`1/as   	r4   z],)r2   r   r   r=  s     r+   r?  z+Fail2banRegex._prepaireOutput.<locals>._out  s?     d1ad4/a!A$**,/a+abcdr-   <c                 N    | D ]  }t        |d   j                               ! y )Nr4   rB  )r  r>  ofmts     r+   r?  z+Fail2banRegex._prepaireOutput.<locals>._out  s&     AaDHHTNr-   r	   )ActionsCommandAction	BanTicketc                 2    | dvr|j                  dd      S |S )N)rC   z\x00)replace)tr   s     r+   _escOutz.Fail2banRegex._prepaireOutput.<locals>._escOut$  s     IIfg&&Hr-   c                    g }ddi| D ]j   	d   d   d         }j                  |      }fd}||d<   
j                  |	      }d   r|j                  |f       `t        |       l |D ]c  \  }d   j	                  d
      D ]G  t        t              sdj                  d D              |j                  d      t               I e y )NNLr   r   r	   r4   )timedatac                 f    d   s&t        d   j                  dg             dk  r| d   S dd<   y)Nr[  r4   rE  r    msg )r6   r   )rX   r>  wraps    r+   _get_msgz=Fail2banRegex._prepaireOutput.<locals>._out.<locals>._get_msg0  s;    $ZC!B 78A=9otDzr-   rC  )	escapeValrE  r;   c              3       K   | ]  }|  y wr/   rN   rG  s     r+   r   z>Fail2banRegex._prepaireOutput.<locals>._out.<locals>.<genexpr>A  rH  rI  r_  )	
ActionInforeplaceDynamicTagsr   r2   r   rJ  r   r<   rW  )r  rowsticketaInfora  r   r>  r`  rR  rT  rS  rY  rQ  s         @@r+   r?  z+Fail2banRegex._prepaireOutput.<locals>._out)  s    D8D !1Q4ad3V'U U5\		)	)$	)	IQT

kk1a&AY!$  1dhhy! 377.a. q
))M1
%aQi	r-   )r   rl   server.actionsrR  rS  rT  )rX   r?  rR  rT  rS  rY  rQ  s     @@@@@r+   _prepaireOutputzFail2banRegex._prepaireOutput  s    	$	]p 
+k t|"h 
+c u}` 
+U u}dR 
+M $J 
+C BA
 6 
+r-   c                 P   t        j                          }| j                  j                  r| j                         }|D ]  }t	        |t
              r1| j                  |d   |d         \  }}}dj                  |d         }n:|j                  d      }|j                  d      s|sj| j                  |      \  }}}| j                  j                  rt        |      dkD  r
|s |       |r| j                  xj                  dz  c_        | j                  s| j                  s'| j                  j                  | j                  dz   k  r| j                  j                   j#                  |       | j$                  rk| j                  j&                  j#                  |       nDt        |      dkD  r| j                  xj(                  dz  c_        | j*                  r
| j                  j,                  j#                  |       | j$                  r| j                  j.                  j#                  |       n| j                  xj0                  dz  c_        | j2                  s| j4                  s&| j                  j0                  | j                  dz   k  rV| j                  j6                  j#                  |       | j$                  r%| j                  j8                  j#                  |       | j                  xj:                  dz  c_         t        j                          |z
  | _        y )Nr   r   r;   z
#)r\  r   rl   rj  rJ  tupler8  r<   rstrip
startswithr6   r   r   _print_no_ignored_print_all_ignoredr   r   r   r,  r   r   r-  r   r   r   _print_no_missed_print_all_missedr   r   r   r   )rX   
test_linest0rl   r   line_datetimestrippedr  r2  s           r+   processzFail2banRegex.processG  sg   yy{"	ZZ^^				3 ! du-1^^DGT!W-M*3
7747D;;vDs4-1^^D-A*3

jjnn
3x!|JC!!!t'>'>$BRBRBZBZ^b^l^lop^pBp	##**40
2299:OPC1!	##**40
2299:OPq   d&<&<@P@P@W@W[_[i[ilm[m@m	""))$/
11889NOaC! F yy{R'$r-   c           
      8   | j                   }|j                  |j                  |j                  |j                  z   z
  k(  sJ ||   }||dz      }| j
                  j                         dkD  }|r|j                         d}| j                  r|dk(  s|dk(  r| j                  }n| j                  }||dz      }|| j                  k  st        | d|z         rg g}||fD ]  }	|D 
cg c]  }
|	D ]  }|
|gz   
  }}
}  |D cg c]g  }|d   d	z   |d   j                         z   d
z   t        | j                  |d         |d   j                         || j                   j"                        z   i }}t%        |D 
cg c]  }
|
j'                          c}
|       y t)        d|||fz         y || j                  k  st        | d|z         r)t%        |D 
cg c]  }
|
j'                          c}
|       y t)        d|||fz         y y c c}}
w c c}w c c}
w c c}
w )N_linesr   z	 line(s):r   r   _lines_timeextracted_print_all_r   z | z |  z?%s too many to print.  Use --print-all-%s to print all %d lines)r   r   r   r   r   r   r   
capitalizer,  ru   r   r   r   r   r,   r   r   r   r>   rn  r2   )rX   ltypelstatsr4  r8   r)   r=   	regexlistansargxyabs                 r+   
printLineszFail2banRegex.printLinesp  s(   &	&--6>>FNN+JK	KL	K
-%UX!ll&&(1,)
"--/16
nnEY.Y""Yu--.At~~}u/D!E4SI 2"1!C1qa1#g1g1c12 /2
3)* A$%-!A$++-
-
6$""1Q4(!A$*;*;*=$**##%% 
3Q 
3 a(!((*(&1  #)5%"89 ;'$0E"FQ''0
 "(%!78 :-  2
3 )
 (s   'HA,H;HHc                 4     j                   j                  ryt        d       t        d       t        d        fd} j                  j                  r} j                  j                  }|j                         g} j                  r% j                  D ]  }|j                  d|        t        dd j                  fz         t        |        |d	 j                        } |d
 j                        } j                  j                  t        d       g } j                  j                  j                  D ]  } j                  s|j                  s|j                  d|j                  |j                   fz          j"                  sS|j                  d|j$                  |j&                  j$                  t)        |dd      fz         |j                  dt)        |dd              t        |d       t        d j*                  z          j,                  t        d j,                  z         t        d        j.                  r j1                  d        j2                  s j1                  d        j4                  s j1                  d       y)NTr;   Resultsz=======c           
      &   dg }}t        |      D ]  \  }}|j                         }||z  }|s
j                  r(|j                  d|dz   ||j	                         fz         
j                  s^t        |j                               sx|j                         D ]W  }t        j                  |d         }t        j                  d|      }	|j                  d|d   d|	|d   xr d	xs d
       Y  t        d| |fz         t        |d       |S )Nr   z%2d) [%d] %sr   r	   z%a %b %d %H:%M:%S %Y    z  z (multiple regex matched)r;   
%s: %d totalz" #) [# of hits] regular expression)	enumerater   r  r   r   r6   r   r\  	localtimestrftimer2   r>   )r  failregexestotalrl   cntrx   r5  r@  	timeTuple
timeStringrX   s             r+   print_failregexesz3Fail2banRegex.printStats.<locals>.print_failregexes  s   2#5";/ 7~sI E	UNEZZ#a%	0F0F0H!IIJ}}Y0023""$ 7..A'i==!7Cj	jj
1
2..4"46777  
uen,.s89
<r-   r  r  	Prefregex	FailregexIgnoreregexz
Date template hits:z[%d] %sz&    # weight: %.3f (%.3f), pattern: %sr   z    # regex:   r(   z[# of hits] date formatz

Lines: %sz[processed in %.2f sec]r   r   r   )r   rl   r2   r   r  getRegexr  r   r   r   r>   ru   r   dateDetector	templateshitsname_verbose_dateweighttemplater   r   r   r-  r  rp  rr  )rX   r  r6  rl   grpr  r   r  s   `       r+   
printStatszFail2banRegex.printStats  s   	ZZ^^D",))0 
\\			3
,,.	3
mm!! #ZZC!"#	{D,?,?@@Bs K
9%t'8'89! 
\\*	"$	3<<,,66 Jx}}ZZ	X]]HMM::;	jj9))00xB'=* * + 
jj'2(FHIJ s-.-$**
*-	#	$t'9'99<",	??9			??9			??8	r-   c           	      (   |d d \  }}|j                  d      rd| _        	 | j                  |d      syt        |      dk(  r| j                  |d   d      syt        j                  j                  |      rM	 t        || j                  d	
      }| j                  d|z         | j                  d| j                  z         n|j                  d      rt        st        d       y| j                  d       | j                  d| j                  z         t        |      \  }}t        di |}|j                  | j                         |j                         }	| j                   }
| j#                  d        |
r4|j%                  |
       | j                  ddj'                  |
      z         t)        ||	      }n| j*                  j-                         dk  r5d|vr1| j                  dt/        |j1                  dd            z         |g}n|j3                  d      }| j                  dt        |      z         t5        |      D ]A  \  }}|dk\  r| j                  d        n&| j                  d|dz   ddt/        |             C | j                  d       | j                  d       | j7                  |       | j9                         syy	# t        $ r}t        d|z         Y d }~yd }~ww xY w# t        $ r}t        |       Y d }~yd }~ww xY w)Nr	   zsystemd-journalsystemdr   Fr4   r   r%  T)doOpenzUse         log file : %szUse         encoding : %sz,Error: systemd library not found. Exiting...zUse         systemd journalzUse    journal match : %s r   rS   zUse      single line : %sz\nz Use      multi line : %s line(s)   z| ...z| z>2.2r   z`-r;   r/   )ro  r   r  r6   r   r2   r   r   r   r   r   IOErrorr
   r   setLogEncodinggetJournalReaderr   r   addJournalMatchr<   rF   r   r   r9   rW  r   r  rw  r  )rX   r*   cmd_log	cmd_regexr  rt  backendbeArgsrC   rD   r   ir8   s                r+   startzFail2banRegex.start  s   BQx'9)*4=
..F
+	$i1nT^^DGX>
 WW^^GwtDJKK,w68KK,t~~=? +,

:<;;-/;;+dnn<>#G,?7F		&v	&3dnn%##%9$$<t%KK,sxx/EEG!#y1: ll A%$g*=KK,xe8T/UUWJt$JKK3c*oEG*% 71	Q
kk7e	[[1Q3467 	KK++r,,z		
	e 
 	;?
  
AKs5   K #K 9A
K3 	K0K++K03	L<LLr/   )rZ   r[   r\   ry   r2   r   r   r   r   r   r  r   r8  rj  rw  r  r  r  rN   r-   r+   r   r      sV    (T&/4K6}~>6@<~'(R:>FP>r-   r   c                     dt         _        t               } |j                  |  \  }} g }|j                  r|j
                  r|j                  d       |j                  r|j                  r|j                  d       t        |       dvr|j                  d       |rY|j                          t        j                  j                  ddj                  |      z   dz          t        j                  d       |j                   s,t#        d       t#        d	       t#        d
       t#        d       t%        |j&                        |_        t(        j+                  |j&                         t        j,                  t        j.                        }|j0                  dk  rdnd}|j2                  rt4        }|j6                  xr dxs d|z   }nt         j8                  }|j;                   |t=        |j0                  |                   t(        j?                  |       	 tA        |      }jK                  |       st        j                  d       y y # tB        $ rv}|j0                  s%t(        jE                         t         jF                  k  rt(        jI                  |d       nt#        d|z         t        j                  d       Y d }~d }~ww xY w)NTzGERROR: --print-no-missed and --print-all-missed are mutually exclusive.zIERROR: --print-no-ignored and --print-all-ignored are mutually exclusive.)r	   r4   z&ERROR: provide both <LOG> and <REGEX>.rS      r;   zRunning testsz=============r   z%(levelname)-1.1s: %(message)sz %(message)sz %(tb)sz %(tbc)s)exc_infor%  )&r  exitOnIOErrorrp   
parse_argsprint_no_missedprint_all_missedr   print_no_ignoredprint_all_ignoredr6   
print_helprI   stderrwriter<   rJ   rl   r2   r   rd   r
  setLevelStreamHandlerstdoutri   log_tracebackr   full_traceback	FormattersetFormatterr   
addHandlerr   r   r  r  re   r  )	r*   parserr   errorsr  fmtr  fail2banRegexr  s	            r+   exec_command_liner    s   

!!!4($
T22--YZd44--[\ 	D	V--89
**4$))F++d23((3-",//", t~~.  




++/<<1+<'.$)				*	8jC?#) Y1$,,DEF6%- 	D!((3- 	" 	 	\\V--/>	??1t?$	;?((3--s   I
 
	K	A,KK	)Fyes)5   r/   ):rU   
__author__rW   __license__getoptr  r   r   r   rI   r\  urllib.requestr$   urllib.parseurllib.erroroptparser   r   configparserr   r   r   server.filtersystemdr
   ImportErrorr   r   filterreaderr   server.filterr   r   r   server.failregexr   r   helpersr   r   r   r   r   r   r
  r,   r2   r9   r>   rF   rK   rT   rQ   rp   objectrr   r   r   r  rN   r-   r+   <module>r     s   & #
]    	 	  
  1 1 ) Q Q1 + & 9 9 4  
:	D
0& 	IL 2<
~ 6: :.`F `F5M  s   C CC