
    Bdp                        d Z dZdZdZddlZddlZddlZddlZddlZddl	Z	ddl
Z
ddlZddlZddlZddlmZmZ ddlmZmZmZ 	 dd	lmZ n# e$ r dZY nw xY wdd
lmZmZ ddlmZ ddlmZmZm Z  ddl!m"Z"m#Z# ddl$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*  e(d          Z+d%dZ,d Z-d&dZ.d'dZ/d Z0d Z1d Z2 G d de          Z3d Z4 G d de5          Z6 G d  d!e5          Z7 G d" d#e5          Z8d$ Z9dS )(z
Fail2Ban  reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

This tools can test regular expressions for "fail2ban".
zFail2Ban DevelopersaI  Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
Many contributions by Yaroslav O. Halchenko, Steven Hiscocks, Sergey G. Brester (sebres).GPL    N)OptionParserOption)NoOptionErrorNoSectionErrorMissingSectionHeaderError   )FilterSystemd)versionnormVersion   )FilterReader)FilterFileContainerMyTime)RegexRegexException)str2LogLevelgetVerbosityFormatFormatterWithTraceBack	getLoggerextractOptions
PREFER_ENCfail2banFyesc                     t          j        ||          | dd}|rd|d<   dt          j                            |          z   S )N)useDnspython)restrflavormflagszhttps://www.debuggex.com/?)r   _resolveHostTagurllibparse	urlencode)sampleregex	multiliner   argss        ?/usr/lib/python3/dist-packages/fail2ban/client/fail2banregex.pydebuggexURLr-   ?   sR    eF333		 	
 "stG}$v|'='=d'C'CCC    c                 $    t          |            d S N)printr+   s    r,   outputr3   H   s    tr.   5   c                 L    t          |           |k    r| d|dz
           dz   S | S )zReturn shortened string
	N   ...)len)sls     r,   shortstrr;   K   s.     FFQJJ	
4AaC45	r.   c                     t          |           sd S |rd|z  }nd}t          |dz   d                    |           z   dz              d S )Nz|- %s
 z|  z
|  z
`-)r8   r3   join)r:   headerr9   s      r,   pprint_listr@   R   sZ    A 	&
 	&!!!UW\\!__	$v	-/////r.   c              #      K   	 	 |                                 }n# t          $ r Y #w xY w|sd S |                     |          V  Br0   )get_nextOSErrorformatJournalEntry)flt	myjournalentrys      r,   journal_lines_genrH   [   so      &55	   8	 	5u%%%%%&s    
''c                  d    t          t                                 t          j        d           d S Nr   )r3   r   sysexitr2   s    r,   dumpNormVersionrM   e   s%    !r.   c                  ,    dt           j        d         z  S )Nz(%s [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]r   )rK   argv r.   r,   <lambda>rQ   i   s    :SXa[H r.   c                       e Zd Zd ZdS )_f2bOptParserc                     d| _         dt                      z   dz   t          z   dz   t          j        | g|R i |z   dz   t          z   dz   S )z, Overwritten format helper with full ussage.r=   zUsage: 
a  
LOG:
  string                a string representing a log line
  filename              path to a log file (/var/log/auth.log)
  systemd-journal       search systemd journal (systemd-python required),
                        optionally with backend parameters, see `man jail.conf`
                        for usage and examples (systemd-journal[journalflags=1]).

REGEX:
  string                a string representing a 'failregex'
  filter                name of filter, optionally with options (sshd[mode=aggressive])
  filename              path to a filter file (filter.d/sshd.conf)

IGNOREREGEX:
  string                a string representing an 'ignoreregex'
  filename              path to a filter file (filter.d/sshd.conf)

z>

Report bugs to https://github.com/fail2ban/fail2ban/issues

)usage__doc__r   format_help__copyright__)selfr+   kwargss      r,   rX   z_f2bOptParser.format_helpl   sq    $*	UWW	t	#g	- 1 
  	 777777!
8 ;!
$ %
$ %
 r.   N)__name__
__module____qualname__rX   rP   r.   r,   rS   rS   k   s#            r.   rS   c                     t          t                      dt          z             } |                     t	          dddd          t	          dd	d
          t	          dddd d          t	          ddt
          d          t	          ddddd          t	          ddd d          t	          ddt          dd          t	          d d!d"          t	          d#d$d%d&d'(          t	          d)d*t          d+,          t	          d-d.d/d0dd12          t	          d3dd0t          d45          t	          d6d7dd89          t	          d:d;dd<9          t	          d=d>d?d@dA2          t	          dBdCddDd dE2          t	          dFddG9          t	          dHddI9          t	          dJddK9          t	          dLddM9          t	          dNddO9          t	          dPdQddR9          t	          dSddT9          g           | S )UNz%prog )rV   r   z-cz--configz/etc/fail2banzset alternate config directory)defaulthelpz-dz--datepatternz+set custom pattern used to match date/times)ra   z
--timezonez--TZstorez)set time-zone used by convert time format)actionr`   ra   z-ez
--encodingz%File encoding. Default: system localez-rz--raw
store_trueFzRaw hosts, don't resolve dnsz--usednszpDNS specified replacement of tags <HOST> in regexp ('yes' - matches all form of hosts, 'no' - IP addresses only)z-Lz
--maxlinesr   zmaxlines for multi-line regex.)typer`   ra   z-mz--journalmatchzGjournalctl style matches overriding filter file. "systemd-journal" onlyz-lz--log-level	log_levelcriticalz(Log level for the Fail2Ban logger to use)destr`   ra   z-Vcallbackz,get version in machine-readable short format)rc   ri   ra   z-vz	--verbosecountverbosezIncrease verbosity)rc   rh   r`   ra   z--verbosityz'Set numerical level of verbosity (0..4))rc   rh   re   ra   z--verbose-datez--VDz%Verbose date patterns/regex in output)rc   ra   z-Dz
--debuggexz-Produce debuggex.com urls for debugging therez--no-check-allstore_falsecheckAllRegexTzDisable check for all regex'sz-oz--outoutzaSet token to print failure information only (row, id, ip, msg, host, ip4, ip6, dns, matches, ...)z--print-no-missedzDo not print any missed linesz--print-no-ignoredzDo not print any ignored linesz--print-all-matchedzPrint all matched linesz--print-all-missedz*Print all missed lines, no matter how manyz--print-all-ignoredz+Print all ignored lines, no matter how manyz-tz--log-tracebackz.Enrich log-messages with compressed tracebacksz--full-tracebackzBEither to make the tracebacks full, not compressed (as by default))rS   rV   r   add_optionsr   r   intrM   )ps    r,   get_opt_parserrr      s   
''w      z?+- - -8: : :vgt68 8 8|Z24 4 4w|U)+ + +GTKL L L 	|#q+- - -!" " " 	}57 7 7 	j?9; ; ;{7! ! ! 	wYS46 6 6	6,24 4 4|L:< < <	-ot*, , ,wwUDnp p p	\*, , ,	l+- - -	|$& & &	l79 9 9	|8: : : ;= = =	LOQ Q Qe4 4 4 4l 	
r.   c                   8    e Zd Zd Zd Zd Zd Zd Zd Zd Z	dS )		RegexStatc                 H    d| _         || _        t                      | _        d S rJ   )_stats
_failregexlist_ipList)rZ   	failregexs     r,   __init__zRegexStat.__init__   s    $+$/$,,,r.   c                 <    d| j         | j        | j        | j        fz  S )Nz%s(%r) %d failed: %s)	__class__rw   rv   ry   rZ   s    r,   __str__zRegexStat.__str__   s%    	~tT\B
C Cr.   c                 &    | xj         dz  c_         d S Nr   rv   r~   s    r,   inczRegexStat.inc   s    ++++++r.   c                     | j         S r0   r   r~   s    r,   getStatszRegexStat.getStats   s
    	r.   c                     | j         S r0   )rw   r~   s    r,   getFailRegexzRegexStat.getFailRegex   s
    	r.   c                 :    | j                             |           d S r0   )ry   append)rZ   values     r,   appendIPzRegexStat.appendIP   s    ,er.   c                     | j         S r0   )ry   r~   s    r,   	getIPListzRegexStat.getIPList   s
    	r.   N)
r\   r]   r^   r{   r   r   r   r   r   r   rP   r.   r,   rt   rt      s          
C C C            r.   rt   c                   $    e Zd ZdZd Zd Zd ZdS )	LineStatsz(Just a convenience container for stats
	c                     dx| _         | _        g | _        d| _        g | _        d| _        g | _        |j        rg | _        g | _	        g | _
        d S d S rJ   )testedmatchedmatched_linesmissedmissed_linesignoredignored_linesdebuggexmatched_lines_timeextractedmissed_lines_timeextractedignored_lines_timeextracted)rZ   optss     r,   r{   zLineStats.__init__   sh      $+$$+$$,$	] )&(4#%'4"&(4###) )r.   c                     d| z  S )NzM%(tested)d lines, %(ignored)d ignored, %(matched)d matched, %(missed)d missedrP   r~   s    r,   r   zLineStats.__str__   s    	X[_	__r.   c                 F    t          | |          rt          | |          ndS )Nr=   )hasattrgetattr)rZ   keys     r,   __getitem__zLineStats.__getitem__   s&    &tS11	9s			r9r.   N)r\   r]   r^   rW   r{   r   r   rP   r.   r,   r   r      sN         
) 
) 
)` ` `: : : : :r.   r   c                   j    e Zd Zd Zd Zd Zd Zd Zd Zd Z	d Z
d	 ZddZd Zd Zd Zd Zd Zd
S )Fail2banRegexc                    | j                             t          d |j                                         D                                  || _        d| _        d| _        d | _        t                      | _        t          d           | _
        d| _        t                      | _        t                      | _        t                      | _        d | _        t#          |          | _        |j        r|                     |j                   nd| _        |j        ,|                     t1          j        |j                             |j        r| j
                            |j                   d| j
        _        	 t;          j        d           ddlm }  |             |j!        r| "                    |j!                   |j#        r| j
        $                    |j#                   |j%        | j
        _&        |j'        o|j(         | j
        _'        tS          |j(                  | j
        _*        | j+        | j
        _,        d| _-        d S )	Nc              3   *   K   | ]\  }}d |z   |fV  dS )_NrP   ).0ovs      r,   	<genexpr>z)Fail2banRegex.__init__.<locals>.<genexpr>   s.      GG#!ASU1IGGGGGGr.   Fr      Tr	   )_updateTimeREauto).__dict__updatedictitems_opts_maxlines_set_datepattern_set_journalmatchshare_configr   _filter_prefREMatchedrx   _prefREGroups_ignoreregexrw   _time_elapsedr   _line_statsmaxlinessetMaxLines	_maxlinesjournalmatchsetJournalMatchshlexsplittimezonesetLogTimeZonecheckFindTimer   setAlternateNowserver.strptimer   datepatternsetDatePatternusedns	setUseDnsrawreturnRawHostrm   rn   boolignorePending_onIgnoreRegexonIgnoreRegex_backend)rZ   r   r   s      r,   r{   zFail2banRegex.__init__   s   -tGG1D1D1F1FGGGGGHHH$*$$$FF$$,$vv$ff$FF$/$t__$	] DM""""4>	"D$566777	] .<t}---$$,	!......=???	 )t'(((	[ '<$+&&&#x$,#1B$(l$,#DH~~$,#2$,$---r.   c                 @    | j         j        st          |           d S d S r0   )r   rn   r3   rZ   lines     r,   r3   zFail2banRegex.output!  s     	%%%r.   c                 8    |                     | j        d          S )Nignore)encode	_encodingr   s     r,   encode_linezFail2banRegex.encode_line$  s    	T^X	.	..r.   c                     | j         s]| j                            |           d| _         |<|                     d|d| j                                        d                    d S d S d S )NTzUse      datepattern : z : r   )r   r   r   r3   getDatePattern)rZ   patterns     r,   r   zFail2banRegex.setDatePattern'  s    		 4<w'''4KKKWWdl))++A..2 4 4 4 4 4	4 4 r.   c                     | j         s_| j                            t          |                     d| _         |                     d| j                                        z             d S d S )NTzUse         maxlines : %d)r   r   r   rp   r3   getMaxLinesrZ   r   s     r,   r   zFail2banRegex.setMaxLines/  sj    		 K<CFF###4;;+dl.F.F.H.HHJJJJJK Kr.   c                     || _         d S r0   )r   r   s     r,   r   zFail2banRegex.setJournalMatch5  s    $r.   c                     i }|                                 }ddgt          |                                          z   D ]8}	 ||v r||         n|                    d|          ||<   )# t          $ r Y 5w xY w|                     d|z             d S )Nlogtyper   
DefinitionzReal  filter options : %r)getCombinedrx   keysgetr   r3   )rZ   readerfltOptrealoptscomboptsks         r,   _dumpRealOptionszFail2banRegex._dumpRealOptions8  s    (!!(}%V[[]](;(;; 	 	a	!"h(1++FJJ|Q4O4OHQKK
 	 	 	D	++)H455555s    %A&&
A32A3c                    |dv sJ |dz   }| j         j        }|}d }i }|dk    rHt          j        d|          r2	 t	          |          \  }}d|dd          v r|f}n||dz   |dz   f}|D ]}d	|vrft
          j                            |          d
k    r!t
          j                            ||          }nAt
          j                            |d
|          }nt
          j        	                    |          }t
          j        
                    |          r nd }nR# t          $ rE}	t          dt          |	                     t          d|           | j        r|	Y d }	~	dS d }	~	ww xY w|b|| j         j        k    s3t
          j                            |          d
k    sd|dd          vrd	|vrt
          j                            |          d
k    rt
          j        	                    |          }t
          j                            t
          j                            |                    d         }|                     d|dd|d|           n\|                     d|dd|           d }t
          j                            |          st
          j                            |          }|r|                     d|z             t%          |d|| j        |          }
d }	 ||
                                }n)|
                    d            |
                                }n?# t          $ r2}	t          dt          |	                     | j        r|	Y d }	~	nd }	~	ww xY w|st          d|z             dS |
                    | j                   |
                    d            | j        dk    s't4                                          t8          j        k    r|                     |
|           |
                                }i }|D ]}|d         dk    r	|d         }n|d         dk    r|dd          }n0	 |d         dk    r|D ]}|| j         _!        n7|d         dk    rR|"                    d          }|stG                      x}|d<   |D ]$}|$                    tK          |                     %n|d         d k    rR|"                    d!          }|stG                      x}|d!<   |D ]$}|$                    tK          |                     %n{|d         d"k    r|D ]}| &                    |           nT|d         d#k    r|D ]}| '                    |           n-|d         d$k    r!| j         j(        | )                    |           # tT          $ r-}	t          d%|d         d&|d'|d(|	           Y d }	~	 dS d }	~	ww xY wn;|                     d|dd)tW          |                     |tK          |          gi}|,                                D ]h\  }}|dz   }t[          | d*|z   |           |D ]G} t]          | j         d+|/                                z            |0                                           Hid,S )-N)failr   r)   r   z"(?ms)^/{0,3}[\w/_\-.]+(?:\[.*\])?$.iz.confz.local/zfilter.dz%ERROR: Wrong filter name or options: z       while parsing: Fr   zUse z>11z filter file : z, basedir: z file : zUse   filter options : %rzfail2ban-regex-jail)r   basedirzWrong config file: zERROR: failed to load filter %sr   z	multi-setr6   setr	   	prefregexaddfailregexaddignoreregexr   r   r   addjournalmatchzERROR: Invalid value for z (z) read from : z line : r   z
add%sRegexT)1r   configr   searchr   ospathbasenamer>   dirnameisfile	Exceptionr3   r    _verbosesplitextisabsabspathr   r   read
setBaseDirreadexplicitapplyAutoOptionsr   
getOptionslogSysgetEffectiveLevelloggingDEBUGr   convertr   	prefRegexr   rx   r   rt   r   r   r   r   
ValueErrorr;   r   setattrr   titler   )rZ   r   	regextyper)   r   fltNamefltFiler   tryNameser   retreadercommandsregex_valuesoptoptvalstors                    r,   	readRegexzFail2banRegex.readRegexE  s   	(	(	(	(	(
g
%J'''&&i5u== %e,,_Wfwrss|hh7W,g.@Ah 
 
G^^
'

7
#
#z
1
1',,w00',,w
G<<))w		 	  ugg   VQABBBV%%1222QxEEEEE	 $*###	w  J..7233<Cw$6$6 
w  J..ww''Wgrw//8899!<GKKKUUUUGGGWWUWWWW 	KKK8:::G7==!! (ww''W 8KK,v5777"7dN_ipqqq6	3	;;==SS t  S
   
Fc!fff.///}Ah  
-57775	4=)))	T
ma63355w}DD&&)))NN$$>< # #s
1v!fVV	Q5!""gVVA+ ' '& &t|'
a&N
"
"f%%d774,v. & &&{{9V$$%%%%& a&$
$
$h''d946694,x0 & &&{{9V$$%%%%& a&J

    & 
a&M
!
! # #&6""""#
a&%
%
%		 	(F###   V!!ffffffeeeQQ8 : : :EEEEEEA#L ;;;x?AAAy//01<!-!3!3!5!5 = =iw5
4ul+++ = =u'G	\IOO%%%' '','9'9';';= = = == 
sJ   CD 
E*%:E%%E*)A L* *
M&4(M!!M&?EV
W!!W		Wc                 R    d| _         | j        |                                          d S )NT)_lineIgnoredr   r   )rZ   idxignoreRegexs      r,   r   zFail2banRegex._onIgnoreRegex  s*    $Cr.   Nc                 (   | j         j        }| j                                         dk    r
|d d          }t          |          | j                                         k    }dx}| _        	 | j                             ||          }g }g }|D ]}	| j        j        sb|	                    t          |          dk               | j	        |	d                  }
|

                                 |
                    |	           |	d                             d          s|                    |	           d}| j        j        rd |d fS | j         j        r| j         j        }|                                r| xj        dz  c_        | j        rt          | j                  | j        k     r-| j                            |                                           n7t          | j                  | j        k    r| j                            d           n*# t(          $ r}t+          d|z             Y d }~d	S d }~ww xY w| j                                         dk    rz|t-          |          d          D ]a}|| j         j        vrO	 | j        j                            | j        j                            d
                    |                               | j        rX| j        j                            | j        j                            d
                    |d d d                                        n# t<          $ r Y nw xY w| j        r^| j        s3| j        j                             d
                    |                     n$|                    |d         |d         z              | j        xj!        dz  c_!        | j        xj"        dz  c_"        c|rA|                    | j         #                                           d                    |          }|||p| j        fS )Nr   Fr   r6   nofailTr7   	ERROR: %s)Nr   Nr=   r	   rU   )$r   _Filter__lineBufferr   r8   r"  processLiner   rn   r   rw   r   r   r   r  
hasMatchedr   r  r   r   	getGroupsr   r3   rp   r   r   popindexr>   	_debuggexr   r  _print_all_matchedr   r   r   processedLine)rZ   r   dateorgLineBuffer
fullBuffer
is_ignoredfoundlinesr  matchr)   prer  bufLines                 r,   	testRegexzFail2banRegex.testRegex  s   ,2-	\!## #==!!T\%=%=%?%??*#((*t <##D$//55	3  u:>  \\#c((1*_U1X&U
YY[[[
^^E8<<!! ZZZZ
jn d?
l 	)
,
 C
~~ )	A )	T	 	 4>	1	1  1111
d 
!
!T^
3
3!!%(((	   	;?
----- 
\!##J 0 01 " "wdl666
#''$**2777+;+;<<> > >	 !266399	1			  	 ! ! !    
d 	 -^ -%,,RWWW-=-=>>>>||GAJ+,,,	"	!
 <<**,,---
))E

4	sZ44#4	55s3   (CH >CH 
H*H%%H*5B.L$$
L10L1c                     | j         j        dv rd }n>dk    rd }n4dk    rd }n*dk    rd }n d	vrfd
}nddlmmm d fd}|S )zOPrepares output- and fetch-function corresponding given '--out' option (format))idfidc                 :    | D ]}t          |d                    d S r   )r3   r  rs     r,   _outz+Fail2banRegex._prepaireOutput.<locals>._out  s,      AaD\\\\ r.   ipc                 n    | D ]1}t          |d                             d|d                              2d S )Nr6   rB  r   r3   r   r?  s     r,   rA  z+Fail2banRegex._prepaireOutput.<locals>._out  sB     " "AaDHHT1Q4  !!!!" "r.   msgc                     | D ]c}|d                              d          D ]E}t          |t                    sd                    d |D                       }t	          |           Fdd S )Nr6   matchesr=   c              3      K   | ]}|V  d S r0   rP   r   r@  s     r,   r   z>Fail2banRegex._prepaireOutput.<locals>._out.<locals>.<genexpr>        ..1......r.   )r   
isinstancer    r>   r3   r?  s     r,   rA  z+Fail2banRegex._prepaireOutput.<locals>._out  sy      dhhy!!  3 !77..a...  qQiiii r.   rowc                     | D ]V}t          d|d         d|d         dt          d |d                                         D                       d           Wd S )N[r   z,	r	   c              3   0   K   | ]\  }}|d k    ||fV  dS )rG  NrP   )r   r   r   s      r,   r   z>Fail2banRegex._prepaireOutput.<locals>._out.<locals>.<genexpr>  s6      /a/a$!QRSW`R`R`1R`R`R`R`/a/ar.   r6   z],)r3   r   r   r?  s     r,   rA  z+Fail2banRegex._prepaireOutput.<locals>._out  sr     d dV1addd4/a/a!A$**,,/a/a/a+a+a+a+abccccd dr.   <c                 b    | D ]*}t          |d                                                  +d S )Nr6   rD  )r  r@  ofmts     r,   rA  z+Fail2banRegex._prepaireOutput.<locals>._out  s;      AaDHHTNN r.   r	   )ActionsCommandAction	BanTicketc                 :    | dvr|                     dd          S |S )N)rE   z\x00)replace)tr   s     r,   _escOutz.Fail2banRegex._prepaireOutput.<locals>._escOut$  s&    IIfg&&&Hr.   c                 .   g }ddi| D ] 	d         d         d                   }                     |          }fd}||d<   
                    |	          }d         r|                    |f           zt          |           |D ]|\  }d                             d
          D ][t          t                    sd                    d D                       |                    d          t                     \}d S )NNLr   r   r	   r6   )timedatac                     d         s5t          d                             dg                     dk    r| d         S dd<   dS )Nr\  r6   rG  r    msg )r8   r   )rZ   r@  wraps    r,   _get_msgz=Fail2banRegex._prepaireOutput.<locals>._out.<locals>._get_msg0  sK    $Z C!B 7 788A==9otDzmr.   rE  )	escapeValrG  r=   c              3      K   | ]}|V  d S r0   rP   rI  s     r,   r   z>Fail2banRegex._prepaireOutput.<locals>._out.<locals>.<genexpr>A  rJ  r.   r`  )	
ActionInforeplaceDynamicTagsr   r3   r   rK  r    r>   rX  )r  rowsticketaInforb  r   r@  ra  rS  rU  rT  rZ  rR  s         @@r,   rA  z+Fail2banRegex._prepaireOutput.<locals>._out)  sZ   D8D  i!1Q4ad333V''U      U5\		)	)$	)	I	IQT
 
kk1a&AYYYY  1dhhy!!  3 !77..a...  q
))M1
%
%aQiiii	 r.   )r   rn   server.actionsrS  rT  rU  )rZ   rA  rS  rU  rT  rZ  rR  s     @@@@@r,   _prepaireOutputzFail2banRegex._prepaireOutput  s   	$	]    t||" " " " u}}    u}}d d d d $      BAAAAAAAAA  
        6 
+r.   c                 ^   t          j                     }| j        j        r|                                 }|D ]Z}t	          |t
                    rB|                     |d         |d                   \  }}}d                    |d                   }nF|                    d          }|	                    d          s|s|                     |          \  }}}| j        j        r!t          |          dk    r|s ||           |r| j        xj        dz  c_        | j        sd| j        s| j        j        | j        dz   k    rE| j        j                            |           | j        r| j        j                            |           nt          |          dk    rb| j        xj        dz  c_        | j        rE| j        j                            |           | j        r| j        j                            |           n| j        xj        dz  c_        | j        sd| j        s| j        j        | j        dz   k    rE| j        j                            |           | j        r| j        j                            |           | j        xj        dz  c_        \t          j                     |z
  | _        d S )Nr   r   r=   z
#)r]  r   rn   rk  rK  tupler:  r>   rstrip
startswithr8   r   r   _print_no_ignored_print_all_ignoredr   r   r   r.  r   r   r/  r   r   r   _print_no_missed_print_all_missedr   r   r   r   )rZ   
test_linest0rn   r   line_datetimestrippedr  r4  s           r,   processzFail2banRegex.processG  s   y{{"	Z^  					3 !  ! du B-1^^DGT!W-M-M*3
7747DD;;vDs 4 -1^^D-A-A*3

jn 
3xx!||J|C P!! Qt'> Q$BRBZ^b^lop^pBpBp	#**4000 Q
299:OPPPC1! Q	#**4000 Q
299:OPPPq   Pd&< P@P@W[_[ilm[m@m@m	"))$/// P
1889NOOOay{{R'$r.   c                    	
  j         }|j        |j        |j        |j        z   z
  k    sJ ||         }||dz            } j                                        dk    
|r|                                d} j        r|dk    s|dk    r j	        }n j
        }||dz            }| j        k     st           d|z             rCg g}||fD ]		fd|D             }
 fd	|D             }t          d
 |D             |           d S t          d|||fz             d S | j        k     st           d|z             rt          d |D             |           d S t          d|||fz             d S d S )N_linesr   z	 line(s):r   r   _lines_timeextracted_print_all_c                 &    g | ]}D ]}||gz   	S rP   rP   )r   xyargs      r,   
<listcomp>z,Fail2banRegex.printLines.<locals>.<listcomp>  s,    111!C11qa1#g1111r.   c           	          g | ]y}|d          dz   |d                                          z   dz   t                              |d                    |d                                          j        j                  z   zS )r   z | r   z |  )r   r-   r   r   r   )r   ar*   rZ   s     r,   r  z,Fail2banRegex.printLines.<locals>.<listcomp>  s     
3 
3 
3)* A$%-!A$++--
-
6$""1Q4((!A$*;*;*=*=$*#% %% 
3 
3 
3r.   c                 6    g | ]}|                                 S rP   ro  r   r~  s     r,   r  z,Fail2banRegex.printLines.<locals>.<listcomp>  s     (((!((**(((r.   z?%s too many to print.  Use --print-all-%s to print all %d linesc                 6    g | ]}|                                 S rP   r  r  s     r,   r  z,Fail2banRegex.printLines.<locals>.<listcomp>  s     ''''''r.   )r   r   r   r   r   r   r   
capitalizer.  rw   r   r   r   r@   r3   )rZ   ltypelstatsr6  r:   r?   	regexlistansbr  r*   s   `        @@r,   
printLineszFail2banRegex.printLinesp  s   &	&-6>FN+JK	K	K	K	K
-%UX!l&&((1,)
 :"--////16
n :EY..YY"Yu--.At~}u/D!E!E4SI 2 21111s111cc
3 
3 
3 
3 
3.1
3 
3 
3Q ((a(((&11111  #)5%"89 ; ; ; ; ;'$0E"F"F''Q'''00000
 "(%!78 : : : : :-: :r.   c                      j         j        rdS t          d           t          d           t          d            fd} j        j        rr j        j        }|                                g} j        r" j        D ]}|                    d|           t          dd j	        fz             t          |            |d	 j                  } |d
 j                  } j        j        t          d           g } j        j        j        D ]} j        s|j        r|                    d|j        |j        fz              j        r`|                    d|j        |j        j        t)          |dd          fz             |                    dt)          |dd                     t          |d           t          d j        z              j        t          d j        z             t          d            j        r                     d            j        s                     d            j        s                     d           dS )NTr=   Resultsz=======c           
      \   dg }}t          |          D ]\  }}|                                }||z  }|s
j        r0|                    d|dz   ||                                fz             
j        rt          |                                          rs|                                D ]^}t          j        |d                   }t          j	        d|          }	|                    d|d         d|	|d         rd	pd
           _t          d| |fz             t          |d           |S )Nr   z%2d) [%d] %sr   r	   z%a %b %d %H:%M:%S %Y    z  z (multiple regex matched)r=   
%s: %d totalz" #) [# of hits] regular expression)	enumerater   r  r   r   r8   r   r]  	localtimestrftimer3   r@   )r  failregexestotalrn   cntrz   r7  rB  	timeTuple
timeStringrZ   s             r,   print_failregexesz3Fail2banRegex.printStats.<locals>.print_failregexes  s_   2#5";// 7 7~sI  E	UNE K KZZ#a%	0F0F0H0H!IIJJJ} 7Y002233 7""$$ 7 7.A''i=!7CCj	jjj
1

2..4"467 7 7 7 
uen,...s8999
<r.   r  r  	Prefregex	FailregexIgnoreregexz
Date template hits:z[%d] %sz&    # weight: %.3f (%.3f), pattern: %sr   z    # regex:   r)   z[# of hits] date formatz

Lines: %sz[processed in %.2f sec]r   r   r   )r   rn   r3   r   r  getRegexr  r   r   r   r@   rw   r   dateDetector	templateshitsname_verbose_dateweighttemplater   r   r   r/  r  rq  rs  )rZ   r  r8  rn   grpr  r   r  s   `       r,   
printStatszFail2banRegex.printStats  s   	Z^ DD",,,))    0 
\ 		3
,,..	3
m #! # #ZZZCC!""""	{D,?@@BBBs 
K
9
9%t'899! 
\*	"$$$	3<,6 J Jx} J JZZ	X]HM::;;; J	jj9)0xB''=* * + + + 
jjj'2(F(F(FHIIIs-...-$*
*---	#	$t'99<<<",,,	 ??9		 ??9		 ??8	r.   c           	      :   |d d         \  }}|                     d          rd| _        	 |                     |d          sdS t          |          dk    r|                     |d         d          sdS n*# t          $ r}t          d|z             Y d }~dS d }~ww xY wt          j                            |          rv	 t          || j
        d	
          }|                     d|z             |                     d| j
        z             nN# t          $ r}t          |           Y d }~dS d }~ww xY w|                     d          rt          st          d           dS |                     d           |                     d| j
        z             t          |          \  }}t          di |}|                    | j
                   |                                }	| j        }
|                     d            |
r@|                    |
           |                     dd                    |
          z             t)          ||	          }n| j                                        dk    rAd|vr=|                     dt/          |                    dd                    z             |g}n|                    d          }|                     dt          |          z             t5          |          D ]N\  }}|dk    r|                     d            n-|                     d|dz   ddt/          |                     O|                     d           |                     d           |                     |           |                                 sdS d	S )Nr	   zsystemd-journalsystemdr   Fr6   r   r'  T)doOpenzUse         log file : %szUse         encoding : %sz,Error: systemd library not found. Exiting...zUse         systemd journalzUse    journal match : %s r   rU   zUse      single line : %sz\nz Use      multi line : %s line(s)   z| ...z| z>2.2r   z`-r=   r0   )rp  r   r   r8   r   r3   r   r   r  r   r   IOErrorr
   r   setLogEncodinggetJournalReaderr   r   addJournalMatchr>   rH   r   r   r;   rX  r   r  rx  r  )rZ   r+   cmd_log	cmd_regexr  ru  backendbeArgsrE   rF   r   ir:   s                r,   startzFail2banRegex.start  s   BQBx'9)** 4=
..F
+
+ 5	$ii1nnT^^DGX>>n5	   	;?
%%%%% W^^G %wtDDDJKK,w6888KK,t~=????
   
AKKK55555 +,, 
 
:<<<5;;-///;;+dn<>>>#G,,?7F		&	&v	&	&3dn%%%##%%9$<t H%%%KK,sxx/E/EEGGG!#y11:: l  A%%$g*=*=KK,xe8T8T/U/UUWWWJJt$$JKK3c*ooEGGG*%% 7 71	Q
kk7ee	[[[1Q333346666KK++r,,z			 
%	s6   A5 /A5 5
B?BB?AD 
D1D,,D1r0   )r\   r]   r^   r{   r3   r   r   r   r   r   r   r   r:  rk  rx  r  r  r  rP   r.   r,   r   r      s	       ( ( (T& & &/ / /4 4 4K K K  6 6 6} } }~  >6 >6 >6 >6@< < <~'( '( '(R: : :>F F FP> > > > >r.   r   c                     dt           _        t                      } |j        |  \  }} g }|j        r|j        r|                    d           |j        r|j        r|                    d           t          |           dvr|                    d           |r`|
                                 t          j                            dd                    |          z   dz              t          j        d           |j        s<t#          d           t#          d	           t#          d
           t#          d           t%          |j                  |_        t(                              |j                   t          j        t          j                  }|j        dk    rdnd}|j        rt4          }|j        rdpd|z   }nt           j        }|                     |t=          |j        |                               t(                              |           	 tA          |          }n# tB          $ r{}|j        s't(          "                                t           j#        k    rt(          $                    |d           nt#          d|z             t          j        d           Y d }~nd }~ww xY w|%                    |           st          j        d           d S d S )NTzGERROR: --print-no-missed and --print-all-missed are mutually exclusive.zIERROR: --print-no-ignored and --print-all-ignored are mutually exclusive.)r	   r6   z&ERROR: provide both <LOG> and <REGEX>.rU      r=   zRunning testsz=============r   z%(levelname)-1.1s: %(message)sz %(message)sz %(tb)sz %(tbc)s)exc_infor'  )&r  exitOnIOErrorrr   
parse_argsprint_no_missedprint_all_missedr   print_no_ignoredprint_all_ignoredr8   
print_helprK   stderrwriter>   rL   rn   r3   r   rf   r  setLevelStreamHandlerstdoutrk   log_tracebackr   full_traceback	FormattersetFormatterr   
addHandlerr   r  r  r  rg   r  )	r+   parserr   errorsr  fmtr  fail2banRegexr  s	            r,   exec_command_liner    s   


!!4($
 [T2 [--YZZZ ]d4 ]--[\\\ 	D		V--8999
 *4$))F+++d2333(3--- ",,,//",,, t~..    


+
++/<1+<+<''.  $)			*	8jC?##) YY1$,DDEEFFF6%%--   	\ V--//>>	??1t?$$$$	;?(3-------- 	D!! (3----- s   H% %
J*/A1J%%J*)Fr   )r4   r0   ):rW   
__author__rY   __license__getoptr  r   r   r   rK   r]  urllib.requestr%   urllib.parseurllib.erroroptparser   r   configparserr   r   r   server.filtersystemdr
   ImportErrorr   r   filterreaderr   server.filterr   r   r   server.failregexr   r   helpersr   r   r   r   r   r   r  r-   r3   r;   r@   rH   rM   rV   rS   rr   objectrt   r   r   r  rP   r.   r,   <module>r     s  &  #
]    				 				  



  1 1 1 1 1 1 1 1 1 1 1 1 ) ) ) ) ) ) ) ) Q Q Q Q Q Q Q Q Q Q1111111    + * * * * * * * & & & & & & 9 9 9 9 9 9 9 9 9 9 4 4 4 4 4 4 4 4                
:		D D D D  
 
 
 
0 0 0 0& & &   	IH    L   2<
 <
 <
~       6: : : : : : : :.` ` ` ` `F ` ` `F5 5 5 5 5s   A AA