install types / be non interactive

Implements #3, a /ping endpoint

See merge request ruben/jail2ban-pf!5

.gitea/workflows/flake8.yml

@@ -0,0 +1,17 @@
+---
+name: Flake8
+on: [push]
+
+
+# XXX need to do stuff with uv
+jobs:
+  build:
+    runs-on: freebsd
+    strategy:
+      matrix:
+        python-version: ["3.11"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Analyse code with Flake8
+        run: |
+          flake8 $(git ls-files '*.py')

.gitea/workflows/mypy.yml

@@ -0,0 +1,17 @@
+---
+name: Mypy
+on: [push]
+
+
+# XXX need to do stuff with uv
+jobs:
+  build:
+    runs-on: freebsd
+    strategy:
+      matrix:
+        python-version: ["3.11"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Analyse code with Mypy
+        run: |
+          mypy --install-types --non-interactive $(git ls-files '*.py')

.gitea/workflows/pylint.yml

@@ -0,0 +1,17 @@
+---
+name: Pylint
+on: [push]
+
+
+# XXX need to do stuff with uv
+jobs:
+  build:
+    runs-on: freebsd
+    strategy:
+      matrix:
+        python-version: ["3.11"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Analyse code with Pylint
+        run: |
+          pylint $(git ls-files '*.py')

.gitignore

@@ -12,3 +12,6 @@ htmlcov/
 dist/
 build/
 *.egg-info/
+
+coverage.xml
+report.xml

.gitlab-ci.yml

@@ -1,15 +1,47 @@
+---
+run pylint:
+  stage: test
+  image: python:3.11
+  script:
+    - pip install --upgrade pylint
+    - pylint $(git ls-files '*.py')
+  tags:
+    - docker
+
+run flake8:
+  stage: test
+  image: python:3.11
+  script:
+    - pip install --upgrade flake8
+    - flake8 $(git ls-files '*.py')
+  tags:
+    - docker
+
+run mypy:
+  stage: test
+  image: python:3.11
+  script:
+    - pip install --upgrade mypy
+    - mypy --install-types --non-interactive $(git ls-files '*.py')
+  tags:
+    - docker
+
 run tests:
   stage: test
-  image: python:3.8
+  image: python:3.11
   script:
     - pip install pytest pytest-cov pytest-mock pytest-flask
     - pip install Flask-HTTPAuth
-    - coverage run -m pytest
+    - coverage run -m pytest --junitxml=report.xml
     - coverage report
     - coverage xml
   coverage: '/^TOTAL.+?(\d+\%)$/'
   artifacts:
+    when: always
     reports:
-      cobertura: coverage.xml
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage.xml
+      junit: report.xml
   tags:
     - docker

CHANGELOG

@@ -0,0 +1,3 @@
+- 2023.1
+
+* Implement #3, a /ping health check endpoint

README.md

@@ -0,0 +1,131 @@
+[![pipeline status](https://gitlab.niet.verweg.com/ruben/jail2ban-pf/badges/main/pipeline.svg)](https://gitlab.niet.verweg.com/ruben/jail2ban-pf/-/commits/main)
+[![coverage report](https://gitlab.niet.verweg.com/ruben/jail2ban-pf/badges/main/coverage.svg)](https://gitlab.niet.verweg.com/ruben/jail2ban-pf/-/commits/main)
+
+An API to remotely control a pf based fail2ban
+
+## Installation
+
+
+* Install uwsgi 
+
+```
+sudo pkg install www/uwsgi
+```
+
+* Clone this repository
+
+## Configuration
+
+### rc.conf
+
+* Use the following for configuring uwsgi in rc.conf
+
+```
+sudo sysrc uwsgi\_enable="YES"
+sudo sysrc uwsgi\_profiles="jail2ban\_pf"
+sudo sysrc uwsgi\_jail2ban\_pf\_flags="-L -M --uid \_jail2ban --python-path /opt/jail2ban-pf --wsgi-file /opt/jail2ban-pf/wsgi.py --stats 127.0.0.1:9191 --socket 127.0.0.1:3031 --chdir /var/empty --callable app --manage-script-name"
+```
+
+### jail2ban
+
+* Configure <installation root>/instance/config.py
+
+```
+SECRET\_KEY = os.urandom(32).hex()
+AUTHFILE = '/usr/local/etc/jail2ban-pf-users.txt'
+```
+
+### nginx
+
+* Configure a nginx upstream and vhost
+
+_Of course you can listen on ipv4/ipv6 but you want to protect these addresses from inadvertent or malicious probes_
+
+    upstream uwsgi_pf_jail2ban {
+        server 127.0.0.1:3031;
+    }
+
+    server {
+        listen       unix:/path/to/jail_1/var/run/pf2ban/pf_jail2ban.sock;
+        listen       unix:/path/to/jail_2/var/run/pf2ban/pf_jail2ban.sock;
+        listen       unix:/path/to/jail_3/var/run/pf2ban/pf_jail2ban.sock;
+        server_name  _;
+
+        location / {
+            index     index.html index.htm index.php;
+            allow all;
+            include /usr/local/etc/nginx/uwsgi_params-dist;
+            uwsgi_pass uwsgi_pf_jail2ban;
+        }
+    }
+
+### /etc/pf.conf
+
+* Place anchors in pf for jail2ban to use. You probably want to place the early in your existing pf configuration
+
+```
+anchor "f2b/*"
+anchor f2b-jail {
+    anchor "jail1_fqdn" to { <addr_jail1>, <addr_extra_jail1>, <addr_extra6_jail1> }
+    anchor "jail2_fqdn" to { <addr_jail2>, <addr_extra_jail2>, <addr_extra6_jail2> }
+    anchor "jail3_fqdn" to { <addr_jail3>, <addr_extra_jail3>, <addr_extra6_jail3> }
+}
+```
+
+Having seperate anchors per jail makes it possible to have fine grained
+blocking: Something that is harmful to jail2 might be perfectly legit for jail2.
+
+#### Checking rules/tables made with fail2ban/jail2ban
+Fail2ban will (re)create the per anchor rules on startup, and populate the designated address tables with offenders, e.g.:
+
+    sudo pfctl -a f2b-jail/jail1\_fqdn -T show -t f2b-recidive
+    192.0.2.66
+    2001:db8:abad:cafe:0bad:f00d
+
+And the rules referencing these tables
+
+    sudo pfctl -a 'f2b-jail/jail1\_fqdn' -s rules
+    block drop quick proto tcp from <f2b-dovecot> to any port = pop3
+    block drop quick proto tcp from <f2b-dovecot> to any port = pop3s
+    block drop quick proto tcp from <f2b-dovecot> to any port = imap
+    block drop quick proto tcp from <f2b-dovecot> to any port = imaps
+    block drop quick proto tcp from <f2b-dovecot> to any port = submission
+    block drop quick proto tcp from <f2b-dovecot> to any port = smtps
+    block drop quick proto tcp from <f2b-dovecot> to any port = sieve
+    block drop quick proto tcp from <f2b-sendmail-auth> to any port = submission
+    block drop quick proto tcp from <f2b-sendmail-auth> to any port = smtps
+    block drop quick proto tcp from <f2b-sendmail-auth> to any port = smtp
+    block drop quick proto tcp from <f2b-sshd> to any port = ssh
+    block drop quick proto tcp from <f2b-recidive> to any
+    
+### fail2ban
+
+* Create the following action plugin for fail2ban on the jail desiring to use fail2ban/jail2ban
+
+```
+cat <<'EOT' | tee /usr/local/etc/fail2ban/action.d/jail2ban-pf.conf > /dev/null
+Definition]
+actionstart = curl --unix-socket <jail2ban_sock> --basic -u '<jail2ban_user>:<jail2ban_pass>' -XPUT -H 'Content-Type: application/json' -d '{"port":"<actiontype>","name":"<name>","protocol":"<protocol>"}' http://localhost/register
+actionstart_on_demand = false
+actionstop = curl --unix-socket <jail2ban_sock> --basic -u '<jail2ban_user>:<jail2ban_pass>' -XDELETE -H 'Content-Type: application/json' -d '{"port":"<actiontype>","name":"<name>","protocol":"<protocol>"}' http://localhost/register
+actionflush = curl --unix-socket <jail2ban_sock> --basic -u '<jail2ban_user>:<jail2ban_pass>' -X GET http://localhost/flush/<name>
+actioncheck = 
+actionban = curl --unix-socket <jail2ban_sock> --basic -u '<jail2ban_user>:<jail2ban_pass>' -X PUT -H 'Content-Type: application/json' -d '{"name":"<name>","ip":"<ip>"}' http://localhost/ban
+actionunban = curl --unix-socket <jail2ban_sock> --basic -u '<jail2ban_user>:<jail2ban_pass>' -X DELETE -H 'Content-Type: application/json' -d '{"name":"<name>","ip":"<ip>"}' http://localhost/ban
+[Init]
+protocol = tcp
+actiontype = <multiport>
+allports = any
+multiport = any port {<port>}
+jail2ban_sock = /var/run/pf2ban/jail2ban.sock
+jail2ban_user = login as set in password file for jail2ban
+jail2ban_pass = password as set in password file for jail2ban
+```
+
+* Configure jail.local
+
+```
+cat <<'EOT' | tee /usr/local/etc/fail2ban/jail.local > /dev/null
+[DEFAULT]
+banaction = jail2ban-pf
+```

jail2ban/__init__.py

@@ -1,10 +1,17 @@
-from flask import Flask, request, jsonify, current_app
-from flask_httpauth import HTTPBasicAuth
-from werkzeug.security import check_password_hash
-from ipaddress import ip_address
+'''
+An API to remotely control a pf based fail2ban
+'''
+
 import re
-from jail2ban.pfctl import pfctl_table_op, pfctl_cfg_read, pfctl_cfg_write
+from ipaddress import ip_address
+from subprocess import CalledProcessError
+
+from flask import Flask, current_app, jsonify, request
+from flask_httpauth import HTTPBasicAuth  # type: ignore
+from werkzeug.security import check_password_hash
+
 from jail2ban.auth import get_users
+from jail2ban.pfctl import pfctl_cfg_read, pfctl_cfg_write, pfctl_table_op
 
 
 auth = HTTPBasicAuth()
@@ -15,50 +22,59 @@ PAT_PROT = r'^(?:tcp|udp)$'
 PAT_NAME = r'^[\w\-]+$'
 
 
-def untaint(pattern, string):
+def untaint(pattern: str, string: str) -> str:
     '''
     untaint string (as perl does)
     '''
     match = re.match(pattern, string)
     if match:
         return match.string
-    else:
-        raise ValueError(f'"{string}" is tainted')
+    raise ValueError(f'"{string}" is tainted')
 
 
-def create_app(config=None):
+def create_app():
+    '''
+    Create the flask application
+    '''
     app = Flask(__name__, instance_relative_config=True)
 
-    if config is None:
-        # load the instance config, if it exists, when not testing
-        app.config.from_pyfile('config.py', silent=True)
-    else:
-        # load the test config if passed in
-        app.config.from_pyfile(config, silent=True)
+    # load the instance config, if it exists, when not testing
+    app.config.from_pyfile('config.py', silent=True)
 
     @auth.verify_password
-    def verify_password(username, password):
+    def verify_password(username: str, password: str) -> str | None:
         users = get_users()
         current_app.logger.debug(users)
         current_app.logger.debug('Checking password of %s', username)
         if username in users and \
                 check_password_hash(users.get(username), password):
             return username
+        return None
+
+    @app.route("/ping", methods=['GET'])
+    @auth.login_required
+    def ping():
+        remote_user = auth.username()
+        app.logger.info('Received ping for'
+                        ' anchor f2b-jail/%s', remote_user)
+        return jsonify({'anchor': f'f2b-jail/{remote_user}',
+                        'operation': 'ping',
+                        'result': 'pong'})
 
     @app.route("/flush/<name>", methods=['GET'])
     @auth.login_required
     def flush(name):
         remote_user = auth.username()
         name = untaint(PAT_NAME, name)
-        app.logger.info(f'Flushing table f2b-{name}'
-                        f' in anchor f2b-jail/{remote_user}')
+        app.logger.info('Flushing table f2b-%s'
+                        ' in anchor f2b-jail/%s', name, remote_user)
         res = pfctl_table_op('f2b-jail/{remote_user}',
                              table='f2b-{name}',
                              operation='flush')
         return jsonify({'anchor': f'f2b-jail/{remote_user}',
                         'table': f'f2b-{name}',
                         'operation': 'flush',
-                        'result': res})
+                        'result': [x.decode('ascii') for x in res]})
 
     @app.route("/register", methods=['PUT', 'DELETE'])
     @auth.login_required
@@ -80,7 +96,7 @@ def create_app(config=None):
                 ])
             res = pfctl_cfg_write(f'f2b-jail/{remote_user}',
                                   b'\n'.join(cfg) + b'\n')
-        elif request.method == 'DELETE':
+        else:  # 'DELETE':
             cfg = [cfg_line for cfg_line in cfg
                    if cfg_line.find(bytes(f'<f2b-{name}>', 'ascii')) == -1]
             res = pfctl_cfg_write(f'f2b-jail/{remote_user}',
@@ -91,13 +107,12 @@ def create_app(config=None):
             pfctl_table_op(f'f2b-jail/{remote_user}',
                            table=f'f2b-{name}',
                            operation='kill')
-        app.logger.info(f'pfctl -a f2b-jail/{remote_user} -f-')
-        return jsonify({'remote_user': remote_user, 'data': data})
+        app.logger.info('pfctl -a f2b-jail/%s -f-', remote_user)
         return jsonify({'anchor': f'f2b-jail/{remote_user}',
                         'table': f'f2b-{name}',
                         'action': 'start' if request.method == 'PUT'
                         else 'stop',
-                        'result': res})
+                        'result': [x.decode('ascii') for x in res]})
 
     @app.route("/ban", methods=['PUT', 'DELETE'])
     @auth.login_required
@@ -108,15 +123,15 @@ def create_app(config=None):
         name = untaint(PAT_NAME, data['name'])
         ip = ip_address(data['ip'])
         if request.method == 'PUT':
-            app.logger.info(f'Add {ip} to f2b-{name}'
-                            f' in anchor f2b-jail/{remote_user}')
+            app.logger.info('Add %s to f2b-%s'
+                            ' in anchor f2b-jail/%s', ip, name, remote_user)
             res = pfctl_table_op(f'f2b-jail/{remote_user}',
                                  table=f'f2b-{name}',
                                  operation='add',
                                  value=str(ip))
-        elif request.method == 'DELETE':
-            app.logger.info(f'Remove {ip} from f2b-{name}'
-                            f' in anchor f2b-jail/{remote_user}')
+        else:  # 'DELETE':
+            app.logger.info('Remove %s from f2b-%s'
+                            ' in anchor f2b-jail/%s', ip, name, remote_user)
             res = pfctl_table_op(f'f2b-jail/{remote_user}',
                                  table=f'f2b-{name}',
                                  operation='delete',
@@ -135,6 +150,22 @@ def create_app(config=None):
         app.logger.fatal(error)
         return jsonify({'error': str(error)}), 500
 
+    @app.errorhandler(CalledProcessError)
+    def subprocess_err(error):
+        '''
+        Show a json parsable error if the value is illegal
+        '''
+        app.logger.fatal(error)
+        return jsonify({'error': str(error)}), 500
+
+    @app.errorhandler(FileNotFoundError)
+    def filenotfound_err(error):
+        '''
+        Show a json parsable error if the value is illegal
+        '''
+        app.logger.fatal(error)
+        return jsonify({'error': str(error)}), 500
+
     @auth.error_handler
     def auth_error():
         app.logger.error('Access Denied')

jail2ban/auth.py

@@ -1,18 +1,21 @@
-from flask import current_app, g
-import os
+'''
+Authentication backend
+'''
+from flask import current_app
 
 
 def get_users():
-    if 'users' not in g:
-        users = {}
-        authfile = current_app.config['AUTHFILE']
+    '''
+    Load users from password file (AUTHFILE)
+    '''
+    users = {}
+    authfile = current_app.config['AUTHFILE']
 
-        current_app.logger.debug('Reading %s for users', authfile)
+    current_app.logger.debug('Reading %s for users', authfile)
 
-        with current_app.open_resource(os.path.join("..",
-                                                    authfile)) as f:
-            for entry in f:
-                users.update({tuple(entry.decode('ascii').strip().split(':', 1))})
-            g.users = users
-    current_app.logger.debug(g.users)
-    return g.users
+    with current_app.open_resource(authfile) as f:
+        for entry in f:
+            users.update({
+                tuple(entry.decode('ascii').strip().split(':', 1))})
+    current_app.logger.debug(users)
+    return users

jail2ban/pfctl.py

@@ -1,3 +1,6 @@
+'''
+pf table/anchor operations
+'''
 import logging
 from subprocess import run
 
@@ -6,33 +9,43 @@ _PFCTL = '/sbin/pfctl'
 
 
 def pfctl_cfg_read(anchor):
+    '''
+    Read from pf anchor
+    '''
     cmd = [_SUDO, _PFCTL, '-a', anchor, '-sr']
     logging.info('Running %s', cmd)
 
-    res = run(cmd, capture_output=True)
+    res = run(cmd, capture_output=True, check=True)
 
-    if res and res.stdout:
-        logging.info('Result: %s', res)
-        res.check_returncode()
-        return res.stdout.splitlines()
+    logging.info('Result: %s', res)
+    return res.stdout.splitlines()
 
 
 def pfctl_cfg_write(anchor, cfg):
+    '''
+    Apply configuration to pf anchor
+    '''
     cmd = [_SUDO, _PFCTL, '-a', anchor, '-f-']
     logging.info('Running %s', cmd)
     logging.info('Config %s', cfg)
 
     res = run(cmd,
               input=cfg,
+              check=True,
               capture_output=True)
 
-    if res:
-        logging.info('Result: %s', res)
-        res.check_returncode()
-        return res
+    logging.info('Result: %s', res)
+    return res.stdout.splitlines()
 
 
 def pfctl_table_op(anchor, **kwargs):
+    '''
+    pf table operation
+    Parameters:
+    * table: which table to work on
+    * operation: operation used on the table
+    * value (optional): value used for the operation
+    '''
     table = kwargs['table']
     operation = kwargs['operation']
     value = kwargs['value'] if 'value' in kwargs else None
@@ -40,9 +53,9 @@ def pfctl_table_op(anchor, **kwargs):
 
     logging.info('Running %s', cmd)
 
-    res = run([x for x in cmd if x is not None], capture_output=True)
+    res = run([x for x in cmd if x is not None],
+              capture_output=True,
+              check=True)
 
-    if res:
-        logging.debug(res)
-        res.check_returncode()
-        return res.stdout.splitlines()
+    logging.debug(res)
+    return res.stdout.splitlines()

tests/conftest.py

@@ -1,4 +1,10 @@
+'''
+Test fixtures
+'''
+import base64
+
 import pytest
+
 from jail2ban import create_app
 
 
@@ -8,7 +14,7 @@ def app():
     app.config.update({
         "TESTING": True,
         "SECRET_KEY": 'Testing',
-        "AUTHFILE": 'tests/users-test.txt'
+        "AUTHFILE": '../tests/users-test.txt'
     })
 
     # other setup can go here
@@ -20,9 +26,23 @@ def app():
 
 @pytest.fixture()
 def client(app):
+    '''
+    Create a synthetic client
+    '''
     return app.test_client()
 
 
 @pytest.fixture()
 def runner(app):
+    '''
+    Create a synthetic runner
+    '''
     return app.test_cli_runner()
+
+
+@pytest.fixture()
+def valid_credentials():
+    '''
+    Mock authentication for the test
+    '''
+    return base64.b64encode(b"test.example.com:testpassword").decode("utf-8")

tests/test_ban.py

@@ -0,0 +1,120 @@
+'''
+Test banning
+'''
+from types import SimpleNamespace
+
+
+def test_ban_ipv6(client, mocker, valid_credentials):
+    '''
+    Test ban an IPv6 address
+    '''
+    def noop():
+        pass
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'1/1 addresses added.\n'
+    run_res.returncode = 0
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"name": "sshd", "ip": "2001:db8::abad:cafe"}
+    response = client.put("/ban",
+                          json=json_payload,
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.json['operation'] == 'add'
+
+
+def test_ban_ipv4(client, mocker, valid_credentials):
+    '''
+    Test ban an IPv4 address
+    '''
+    def noop():
+        pass
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'1/1 addresses added.\n'
+    run_res.returncode = 0
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"name": "sshd", "ip": "192.0.2.42"}
+    response = client.put("/ban",
+                          json=json_payload,
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.json['operation'] == 'add'
+
+
+def test_ban_invalid(client, mocker, valid_credentials):
+    '''
+    Test ban an invalid address
+    '''
+    def noop():
+        pass
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'1/1 addresses added.\n'
+    run_res.returncode = 0
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"name": "sshd", "ip": "not:an::addr:ess"}
+    response = client.put("/ban",
+                          json=json_payload,
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.json['error'] == "'not:an::addr:ess' does not " \
+                                     "appear to be an IPv4 or IPv6 address"
+
+
+def test_unban_ipv6(client, mocker, valid_credentials):
+    '''
+    Test unbanning an IPv6 address
+    '''
+    def noop():
+        pass
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'1/1 addresses deleted.\n'
+    run_res.returncode = 0
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"name": "sshd", "ip": "2001:db8::abad:cafe"}
+    response = client.delete("/ban",
+                             json=json_payload,
+                             headers={"Authorization":
+                                      "Basic " + valid_credentials})
+
+    assert response.json['operation'] == 'delete'
+
+
+def test_unban_ipv4(client, mocker, valid_credentials):
+    '''
+    Test unbanning an IPv4 address
+    '''
+    def noop():
+        pass
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'1/1 addresses deleted.\n'
+    run_res.returncode = 0
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"name": "sshd", "ip": "192.0.2.42"}
+    response = client.delete("/ban",
+                             json=json_payload,
+                             headers={"Authorization":
+                                      "Basic " + valid_credentials})
+
+    assert response.json['operation'] == 'delete'

tests/test_flush.py

@@ -0,0 +1,92 @@
+'''
+Test flushing pf tables
+'''
+from types import SimpleNamespace
+from subprocess import CalledProcessError
+
+
+def test_flush(client, mocker, valid_credentials):
+    '''
+    Test flushing existing entry
+    '''
+    def noop():
+        pass
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'1/1 addresses deleted.\n'
+    run_res.returncode = 0
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    name = 'sshd'
+    response = client.get(f"/flush/{name}",
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.json['operation'] == 'flush'
+
+
+def test_flush_nonexistent(client, mocker, valid_credentials):
+    '''
+    Test flushing non existing entry
+    '''
+
+    cmd = ['/usr/local/bin/sudo',
+           '/sbin/pfctl', '-a', 'some/anchor',
+           '-t', 'nonexistent', '-T', 'flush']
+
+    side_effect = CalledProcessError(255, cmd, output=b'',
+                                     stderr=b'pfctl: Table does not exist')
+
+    mocker.patch('jail2ban.pfctl.run',
+                 side_effect=side_effect)
+
+    name = 'nonexistent'
+    response = client.get(f"/flush/{name}",
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert 'error' in response.json
+
+
+def test_wrong_method(client, mocker, valid_credentials):
+    '''
+    Test invalid method
+    '''
+
+    cmd = ['/usr/local/bin/sudo',
+           '/sbin/pfctl', '-a', 'some/anchor',
+           '-t', 'nonexistent', '-T', 'flush']
+
+    side_effect = CalledProcessError(255, cmd, output=b'',
+                                     stderr=b'pfctl: Table does not exist')
+
+    mocker.patch('jail2ban.pfctl.run',
+                 side_effect=side_effect)
+
+    name = 'nonexistent'
+    response = client.put(f"/flush/{name}",
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.status_code == 405
+
+
+def test_filenotfound(app, valid_credentials):
+    '''
+    Test for when AUTHFILE cannot be found
+    '''
+
+    app.config.update({
+        "AUTHFILE": '../tests/nonexistent-users-test.txt'
+    })
+
+    client = app.test_client()
+
+    name = 'nonexistent'
+    response = client.get(f"/flush/{name}",
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.status_code == 500

tests/test_ping.py

@@ -0,0 +1,15 @@
+'''
+Test application health check
+'''
+
+
+def test_ping(client, valid_credentials):
+    '''
+    Test application health check
+    '''
+
+    response = client.get("/ping",
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.json['operation'] == 'ping'

tests/test_register.py

@@ -1,37 +1,131 @@
-import base64
-from types import SimpleNamespace
+'''
+Test various registration scenarios
+'''
+from subprocess import CompletedProcess
 
-pfctl_stdout_lines = b'''
+PFCTL_STDOUT_LINES = b'''
 block drop quick proto tcp from <f2b-sendmail-auth> to any port = submission
 block drop quick proto tcp from <f2b-sendmail-auth> to any port = smtps
 block drop quick proto tcp from <f2b-sendmail-auth> to any port = smtp
 block drop quick proto tcp from <f2b-sshd> to any port = ssh
 block drop quick proto tcp from <f2b-recidive> to any
-'''
+'''.strip() + b'\n'
+
+PFCTL_STDOUT_LINES_SCRATCH = b'table <f2b-dovecot> persist counters\n' \
+                             b'block quick proto tcp from <f2b-dovecot>' \
+                             b' to any port ' \
+                             b'{pop3,pop3s,imap,imaps,submission,465,sieve}\n'
 
 
-def test_request_unauth(client):
-    json_payload = {"port": "any port {pop3,pop3s,imap,imaps,submission,465,sieve}", "name": "dovecot", "protocol": "tcp"}
+def test_register_unauth(client):
+    '''
+    Test a registration without being authorized
+    '''
+    json_payload = {"port":
+                    "any port {pop3,pop3s,imap,imaps,submission,465,sieve}",
+                    "name": "dovecot", "protocol": "tcp"}
     response = client.put("/register", json=json_payload)
 
     assert response.json['error'] == 'Access Denied'
 
 
-def test_request_example(client, mocker):
+def test_unregister_valid(client, mocker, valid_credentials):
+    '''
+    Test unregistration
+    '''
     def noop():
         pass
-    run_res = SimpleNamespace()
-    run_res.stdout = pfctl_stdout_lines
+    run_res = CompletedProcess(args=['true'], returncode=0)
+    run_res.stdout = PFCTL_STDOUT_LINES
     run_res.check_returncode = noop
 
     mocker.patch('jail2ban.pfctl.run', return_value=run_res)
 
+    json_payload = {"port":
+                    "any port {pop3,pop3s,imap,imaps,submission,465,sieve}",
+                    "name": "dovecot", "protocol": "tcp"}
+
+    response = client.delete("/register",
+                             json=json_payload,
+                             headers={"Authorization":
+                                      "Basic " + valid_credentials})
+
+    assert response.json['action'] == 'stop'
+
+
+def test_register_valid(client, mocker, valid_credentials):
+    '''
+    Test a registration of a rule
+    '''
+    def noop():
+        pass
+    run_res = CompletedProcess(args=['true'], returncode=0)
+    run_res.stdout = PFCTL_STDOUT_LINES
+    run_res.check_returncode = noop
+
+    pfctl_run = mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"port":
+                    "any port {pop3,pop3s,imap,imaps,submission,465,sieve}",
+                    "name": "dovecot", "protocol": "tcp"}
 
-    valid_credentials = base64.b64encode(b"test.example.com:testpassword").decode("utf-8")
-    json_payload = {"port": "any port {pop3,pop3s,imap,imaps,submission,465,sieve}", "name": "dovecot", "protocol": "tcp"}
     response = client.put("/register",
                           json=json_payload,
-                          headers={"Authorization": "Basic " + valid_credentials})
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    pfctl_run_input_arg = pfctl_run.call_args_list[1][1]['input']
+    for existing_line in PFCTL_STDOUT_LINES.splitlines():
+        assert existing_line in pfctl_run_input_arg.splitlines()
+
+    assert response.json['action'] == 'start'
 
 
-    assert response.json['remote_user'] == 'test.example.com'
+def test_register_valid_from_scratch(client, mocker, valid_credentials):
+    '''
+    Test from scratch point of view
+    '''
+    def noop():
+        pass
+    run_res = CompletedProcess(args=['true'], returncode=0)
+    run_res.stdout = b''
+    run_res.check_returncode = noop
+
+    pfctl_run = mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"port":
+                    "any port {pop3,pop3s,imap,imaps,submission,465,sieve}",
+                    "name": "dovecot", "protocol": "tcp"}
+
+    response = client.put("/register",
+                          json=json_payload,
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    pfctl_run_input_arg = pfctl_run.call_args_list[1][1]['input']
+    assert pfctl_run_input_arg == PFCTL_STDOUT_LINES_SCRATCH
+    assert response.json['action'] == 'start'
+
+
+def test_register_invalid(client, mocker, valid_credentials):
+    '''
+    Test a bogus pf command
+    '''
+    def noop():
+        pass
+    run_res = CompletedProcess(args=['true'], returncode=0)
+    run_res.stdout = PFCTL_STDOUT_LINES
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+
+    json_payload = {"port":
+                    "not a pf statement",
+                    "name": "dovecot", "protocol": "tcp"}
+
+    response = client.put("/register",
+                          json=json_payload,
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.json['error'] == '"not a pf statement" is tainted'

wsgi.py

@@ -0,0 +1,3 @@
+from jail2ban import create_app
+
+app = create_app()