Mini Shell

# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
# vi: set ft=python sts=4 ts=4 sw=4 noet :
#
# This file is part of Fail2Ban.
#
# Fail2Ban is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# Fail2Ban is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Fail2Ban; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
__author__ = "Fail2Ban Developers"
__copyright__ = "Copyright (c) 2004-2008 Cyril Jaquier, 2012-2014 Yaroslav Halchenko, 2014-2016 Serg G. Brester"
__license__ = "GPL"

import os
import shlex
import signal
import socket
import sys
import time

import threading
from threading import Thread

from ..version import version
from .csocket import CSocket
from .beautifier import Beautifier
from .fail2bancmdline import Fail2banCmdLine, ServerExecutionException, ExitException, \
	logSys, exit, output

from ..server.utils import Utils

PROMPT = "fail2ban> "


def _thread_name():
	return threading.current_thread().__class__.__name__

def input_command(): # pragma: no cover
	return input(PROMPT)

##
#
# @todo This class needs cleanup.

class Fail2banClient(Fail2banCmdLine, Thread):

	def __init__(self):
		Fail2banCmdLine.__init__(self)
		Thread.__init__(self)
		self._alive = True
		self._server = None
		self._beautifier = None

	def dispInteractive(self):
		output("Fail2Ban v" + version + " reads log file that contains password failure report")
		output("and bans the corresponding IP addresses using firewall rules.")
		output("")

	def __sigTERMhandler(self, signum, frame): # pragma: no cover
		# Print a new line because we probably come from wait
		output("")
		logSys.warning("Caught signal %d. Exiting" % signum)
		exit(255)

	def __ping(self, timeout=0.1):
		return self.__processCmd([["ping"] + ([timeout] if timeout != -1 else [])],
			False, timeout=timeout)

	@property
	def beautifier(self):
		if self._beautifier:
			return self._beautifier
		self._beautifier = Beautifier()
		return self._beautifier

	def __processCmd(self, cmd, showRet=True, timeout=-1):
		client = None
		try:
			beautifier = self.beautifier
			streamRet = True
			for c in cmd:
				beautifier.setInputCmd(c)
				try:
					if not client:
						client = CSocket(self._conf["socket"], timeout=timeout)
					elif timeout != -1:
						client.settimeout(timeout)
					if self._conf["verbose"] > 2:
						logSys.log(5, "CMD: %r", c)
					ret = client.send(c)
					if ret[0] == 0:
						logSys.log(5, "OK : %r", ret[1])
						if showRet or c[0] in ('echo', 'server-status'):
							output(beautifier.beautify(ret[1]))
					else:
						logSys.error("NOK: %r", ret[1].args)
						if showRet:
							output(beautifier.beautifyError(ret[1]))
						streamRet = False
				except socket.error as e:
					if showRet or self._conf["verbose"] > 1:
						if showRet or c[0] != "ping":
							self.__logSocketError(e, c[0] == "ping")
						else:
							logSys.log(5, " -- %s failed -- %r", c, e)
					return False
				except Exception as e: # pragma: no cover
					if showRet or self._conf["verbose"] > 1:
						if self._conf["verbose"] > 1:
							logSys.exception(e)
						else:
							logSys.error(e)
					return False
		finally:
			# prevent errors by close during shutdown (on exit command):
			if client:
				try :
					client.close()
				except Exception as e: # pragma: no cover
					if showRet or self._conf["verbose"] > 1:
						logSys.debug(e)
			if showRet or c[0] in ('echo', 'server-status'):
				sys.stdout.flush()
		return streamRet

	def __logSocketError(self, prevError="", errorOnly=False):
		try:
			if os.access(self._conf["socket"], os.F_OK): # pragma: no cover
				# This doesn't check if path is a socket,
				#  but socket.error should be raised
				if os.access(self._conf["socket"], os.W_OK):
					# Permissions look good, but socket.error was raised
					if errorOnly:
						logSys.error(prevError)
					else:
						logSys.error("%sUnable to contact server. Is it running?", 
							("[%s] " % prevError) if prevError else '')
				else:
					logSys.error("Permission denied to socket: %s,"
								 " (you must be root)", self._conf["socket"])
			else:
				logSys.error("Failed to access socket path: %s."
							 " Is fail2ban running?",
							 self._conf["socket"])
		except Exception as e: # pragma: no cover
			logSys.error("Exception while checking socket access: %s",
						 self._conf["socket"])
			logSys.error(e)

	##
	def __prepareStartServer(self):
		if self.__ping():
			logSys.error("Server already running")
			return None

		# Read the config
		ret, stream = self.readConfig()
		# Do not continue if configuration is not 100% valid
		if not ret:
			return None

		# Check already running
		if not self._conf["force"] and os.path.exists(self._conf["socket"]):
			logSys.error("Fail2ban seems to be in unexpected state (not running but the socket exists)")
			return None

		return [["server-stream", stream], ['server-status']]

	def _set_server(self, s):
		self._server = s

	##
	def __startServer(self, background=True):
		from .fail2banserver import Fail2banServer
		# read configuration here (in client only, in server we do that in the config-thread):
		stream = self.__prepareStartServer()
		self._alive = True
		if not stream:
			return False
		# Start the server or just initialize started one:
		try:
			if background:
				# Start server daemon as fork of client process (or new process):
				Fail2banServer.startServerAsync(self._conf)
				# Send config stream to server:
				if not self.__processStartStreamAfterWait(stream, False):
					return False
			else:
				# In foreground mode we should make server/client communication in different threads:
				phase = dict()
				self.configureServer(phase=phase, stream=stream)
				# Mark current (main) thread as daemon:
				self.daemon = True
				# Start server direct here in main thread (not fork):
				self._server = Fail2banServer.startServerDirect(self._conf, False, self._set_server)
				if not phase.get('done', False):
					if self._server: # pragma: no cover
						self._server.quit()
						self._server = None
					exit(255)
		except ExitException: # pragma: no cover
			raise
		except Exception as e: # pragma: no cover
			output("")
			logSys.error("Exception while starting server " + ("background" if background else "foreground"))
			if self._conf["verbose"] > 1:
				logSys.exception(e)
			else:
				logSys.error(e)
			return False

		return True

	##
	def configureServer(self, nonsync=True, phase=None, stream=None):
		# if asynchronous start this operation in the new thread:
		if nonsync:
			if phase is not None:
				# event for server ready flag:
				def _server_ready():
					phase['start-ready'] = True
					logSys.log(5, '  server phase %s', phase)
				# notify waiting thread if server really ready
				self._conf['onstart'] = _server_ready
			th = Thread(target=Fail2banClient.configureServer, args=(self, False, phase, stream))
			th.daemon = True
			th.start()
			# if we need to read configuration stream:
			if stream is None and phase is not None:
				# wait, do not continue if configuration is not 100% valid:
				Utils.wait_for(lambda: phase.get('ready', None) is not None, self._conf["timeout"], 0.001)
				logSys.log(5, '  server phase %s', phase)
				if not phase.get('start', False):
					raise ServerExecutionException('Async configuration of server failed')
			return True
		# prepare: read config, check configuration is valid, etc.:
		if phase is not None:
			phase['start'] = True
			logSys.log(5, '  client phase %s', phase)
		if stream is None:
			stream = self.__prepareStartServer()
		if phase is not None:
			phase['ready'] = phase['start'] = (True if stream else False)
			logSys.log(5, '  client phase %s', phase)
		if not stream:
			return False
		# wait a little bit for phase "start-ready" before enter active waiting:
		if phase is not None:
			Utils.wait_for(lambda: phase.get('start-ready', None) is not None, 0.5, 0.001)
			phase['configure'] = (True if stream else False)
			logSys.log(5, '  client phase %s', phase)
		# configure server with config stream:
		ret = self.__processStartStreamAfterWait(stream, False)
		if phase is not None:
			phase['done'] = ret
		return ret

	##
	# Process a command line.
	#
	# Process one command line and exit.
	# @param cmd the command line

	def __processCommand(self, cmd):
		# wrap tuple to list (because could be modified here):
		if not isinstance(cmd, list):
			cmd = list(cmd)
		# process:
		if len(cmd) == 1 and cmd[0] == "start":

			ret = self.__startServer(self._conf["background"])
			if not ret:
				return False
			return ret

		elif len(cmd) >= 1 and cmd[0] == "restart":
			# if restart jail - re-operate via "reload --restart ...":
			if len(cmd) > 1:
				cmd[0:1] = ["reload", "--restart"]
				return self.__processCommand(cmd)
			# restart server:
			if self._conf.get("interactive", False):
				output('  ## stop ... ')
			self.__processCommand(['stop'])
			if not self.__waitOnServer(False): # pragma: no cover
				logSys.error("Could not stop server")
				return False
			# in interactive mode reset config, to make full-reload if there something changed:
			if self._conf.get("interactive", False):
				output('  ## load configuration ... ')
				self.resetConf()
				ret = self.initCmdLine(self._argv)
				if ret is not None:
					return ret
			if self._conf.get("interactive", False):
				output('  ## start ... ')
			return self.__processCommand(['start'])

		elif len(cmd) >= 1 and cmd[0] == "reload":
			# reload options:
			opts = []
			while len(cmd) >= 2:
				if cmd[1] in ('--restart', "--unban", "--if-exists"):
					opts.append(cmd[1])
					del cmd[1]
				else:
					if len(cmd) > 2:
						logSys.error("Unexpected argument(s) for reload: %r", cmd[1:])
						return False
					# stop options - jail name or --all
					break
			if self.__ping(timeout=-1):
				if len(cmd) == 1 or cmd[1] == '--all':
					jail = '--all'
					ret, stream = self.readConfig()
				else:
					jail = cmd[1]
					ret, stream = self.readConfig(jail)
				# Do not continue if configuration is not 100% valid
				if not ret:
					return False
				if self._conf.get("interactive", False):
					output('  ## reload ... ')
				# Reconfigure the server
				return self.__processCmd([['reload', jail, opts, stream]], True)
			else:
				logSys.error("Could not find server")
				return False

		elif len(cmd) > 1 and cmd[0] == "ping":
			return self.__processCmd([cmd], timeout=float(cmd[1]))

		else:
			return self.__processCmd([cmd])


	def __processStartStreamAfterWait(self, *args):
		ret = False
		try:
			# Wait for the server to start
			if not self.__waitOnServer(): # pragma: no cover
				logSys.error("Could not find server, waiting failed")
				return False
				# Configure the server
			ret = self.__processCmd(*args)
		except ServerExecutionException as e: # pragma: no cover
			if self._conf["verbose"] > 1:
				logSys.exception(e)
			logSys.error("Could not start server. Maybe an old "
						 "socket file is still present. Try to "
						 "remove " + self._conf["socket"] + ". If "
						 "you used fail2ban-client to start the "
						 "server, adding the -x option will do it")

		if not ret and self._server: # stop on error (foreground, config read in another thread):
			self._server.quit()
			self._server = None
		return ret

	def __waitOnServer(self, alive=True, maxtime=None):
		if maxtime is None:
			maxtime = self._conf["timeout"]
		# Wait for the server to start (the server has 30 seconds to answer ping)
		starttime = time.time()
		logSys.log(5, "__waitOnServer: %r", (alive, maxtime))
		sltime = 0.0125 / 2
		test = lambda: os.path.exists(self._conf["socket"]) and self.__ping(timeout=sltime)
		with VisualWait(self._conf["verbose"]) as vis:
			while self._alive:
				runf = test()
				if runf == alive:
					return True
				waittime = time.time() - starttime
				logSys.log(5, "  wait-time: %s", waittime)
				# Wonderful visual :)
				if waittime > 1:
					vis.heartbeat()
				# f end time reached:
				if waittime >= maxtime:
					raise ServerExecutionException("Failed to start server")
				# first 200ms faster:
				sltime = min(sltime * 2, 0.5 if waittime > 0.2 else 0.1)
				time.sleep(sltime)
		return False

	def start(self, argv):
		# Install signal handlers
		_prev_signals = {}
		if _thread_name() == '_MainThread':
			for s in (signal.SIGTERM, signal.SIGINT):
				_prev_signals[s] = signal.getsignal(s)
				signal.signal(s, self.__sigTERMhandler)
		try:
			# Command line options
			if self._argv is None:
				ret = self.initCmdLine(argv)
				if ret is not None:
					if ret:
						return True
					raise ServerExecutionException("Init of command line failed")

			# Commands
			args = self._args

			# Interactive mode
			if self._conf.get("interactive", False):
				try:
					import readline
				except ImportError:
					raise ServerExecutionException("Readline not available")
				try:
					ret = True
					if len(args) > 0:
						ret = self.__processCommand(args)
					if ret:
						readline.parse_and_bind("tab: complete")
						self.dispInteractive()
						while True:
							cmd = input_command()
							if cmd == "exit" or cmd == "quit":
								# Exit
								return True
							if cmd == "help":
								self.dispUsage()
							elif not cmd == "":
								try:
									self.__processCommand(shlex.split(cmd))
								except Exception as e: # pragma: no cover
									if self._conf["verbose"] > 1:
										logSys.exception(e)
									else:
										logSys.error(e)
				except (EOFError, KeyboardInterrupt): # pragma: no cover
					output("")
					raise
			# Single command mode
			else:
				if len(args) < 1:
					self.dispUsage()
					return False
				return self.__processCommand(args)
		except Exception as e:
			if self._conf["verbose"] > 1:
				logSys.exception(e)
			else:
				logSys.error(e)
			return False
		finally:
			self._alive = False
			for s, sh in _prev_signals.items():
				signal.signal(s, sh)


class _VisualWait:
	"""Small progress indication (as "wonderful visual") during waiting process
	"""
	pos = 0
	delta = 1
	def __init__(self, maxpos=10):
		self.maxpos = maxpos
	def __enter__(self):
		return self
	def __exit__(self, *args):
		if self.pos:
			sys.stdout.write('\r'+(' '*(35+self.maxpos))+'\r')
			sys.stdout.flush()
	def heartbeat(self):
		"""Show or step for progress indicator
		"""
		if not self.pos:
			sys.stdout.write("\nINFO   [#" + (' '*self.maxpos) + "] Waiting on the server...\r\x1b[8C")
		self.pos += self.delta
		if self.delta > 0:
			s = " #\x1b[1D" if self.pos > 1 else "# \x1b[2D"
		else:
			s = "\x1b[1D# \x1b[2D"
		sys.stdout.write(s)
		sys.stdout.flush()
		if self.pos > self.maxpos:
			self.delta = -1
		elif self.pos < 2:
			self.delta = 1
class _NotVisualWait:
	"""Mockup for invisible progress indication (not verbose)
	"""
	def __enter__(self):
		return self
	def __exit__(self, *args):
		pass
	def heartbeat(self):
		pass

def VisualWait(verbose, *args, **kwargs):
	"""Wonderful visual progress indication (if verbose)
	"""
	return _VisualWait(*args, **kwargs) if verbose > 1 else _NotVisualWait()


def exec_command_line(argv):
	client = Fail2banClient()
	# Exit with correct return value
	if client.start(argv):
		exit(0)
	else:
		exit(255)