Merge branch '4-create-a-list-route-for-showing-banned-addresses' into 'develop'

Resolve "Create a /list route for showing banned addresses"

See merge request ruben/jail2ban-pf!7

jail2ban/__init__.py

@@ -81,6 +81,36 @@ def create_app():
                         'operation': 'flush',
                         'result': [x.decode('ascii') for x in res]})
 
+    @app.route("/list/<name>", methods=['GET'])
+    @auth.login_required
+    def list_table(name):
+        remote_user = auth.username()
+        name = untaint(PAT_NAME, name)
+        app.logger.info(f'Flushing table f2b-{name}'
+                        f' in anchor f2b-jail/{remote_user}')
+        reply = {'anchor': f'f2b-jail/{remote_user}',
+                        'table': f'f2b-{name}',
+                        'operation': 'list'}
+        try:
+            res = pfctl_table_op('f2b-jail/{remote_user}',
+                                 table='f2b-{name}',
+                                 operation='show',
+                                 verbose=True)
+        except CalledProcessError as err:
+            if err.stderr.find(b'pfctl: Table does not exist.') > 0:
+                res = []
+                reply.update({'error': f'\'{name}\' is not a known fail2ban jail'})
+            else:
+                raise err
+
+        result = [entry.groupdict() for entry in
+                  re.finditer(_PFCTL_TABLE_PAT,
+                              '\n'.join([x.decode('ascii') for x in res]),
+                              re.MULTILINE|re.VERBOSE)]
+        reply.update({'result': result})
+
+        return jsonify(reply), 200 if len(res) else 404
+
     @app.route("/register", methods=['PUT', 'DELETE'])
     @auth.login_required
     def register():
@@ -161,6 +191,8 @@ def create_app():
         Show a json parsable error if the value is illegal
         '''
         app.logger.fatal(error)
+        app.logger.fatal('stdout: %s', error.stderr)
+        app.logger.fatal('stderr: %s', error.stderr)
         return jsonify({'error': str(error)}), 500
 
     @app.errorhandler(FileNotFoundError)

jail2ban/pfctl.py

@@ -44,7 +44,8 @@ def pfctl_table_op(anchor, **kwargs):
     table = kwargs['table']
     operation = kwargs['operation']
     value = kwargs['value'] if 'value' in kwargs else None
-    cmd = [_SUDO, _PFCTL, '-a', anchor, '-t', table, '-T', operation, value]
+    verbose =  '-v' if 'verbose' in kwargs and kwargs['verbose'] else None
+    cmd = [_SUDO, _PFCTL, '-a', anchor, '-t', table, verbose, '-T', operation, value]
 
     logging.info('Running %s', cmd)
 

tests/test_list.py

@@ -2,6 +2,7 @@
 Tests for /list route
 '''
 from types import SimpleNamespace
+from subprocess import CalledProcessError
 
 
 _PF_TABLE_LIST = b'''   192.0.2.66
@@ -75,7 +76,7 @@ def test_list_single_table(client, mocker, valid_credentials):
                           headers={"Authorization":
                                    "Basic " + valid_credentials})
 
-    assert response.json['anchor'] == 'f2b-sshd/test.example.com'
+    assert response.json['table'] == 'f2b-sshd'
     assert response.json['result'] == _LIST_RESULT
 
 
@@ -88,11 +89,18 @@ def test_list_nonexistent_table(client, mocker, valid_credentials):
 
     run_res = SimpleNamespace()
     run_res.stdout = b''
-    run_res.stderr = b'No ALTQ support in kernel\nALTQ related functions disabled\n'
+    run_res.stderr = b'No ALTQ support in kernel\nALTQ related functions disabled\n' \
+                     b'pfctl: Table does not exist.\n'
     run_res.returncode = 255
     run_res.check_returncode = noop
 
-    mocker.patch('jail2ban.pfctl.run', return_value=run_res)
+    mocker.patch('jail2ban.pfctl.run',
+                 return_value=run_res,
+                 side_effect=CalledProcessError(run_res.returncode,
+                                                'foobar',
+                                                 output=run_res.stdout,
+                                                 stderr=run_res.stderr)
+                 )
 
     response = client.get("/list/nonexistent",
                           headers={"Authorization":
@@ -101,3 +109,32 @@ def test_list_nonexistent_table(client, mocker, valid_credentials):
     assert response.status_code == 404
     assert response.json['error'] == "'nonexistent' is not " \
                                      "a known fail2ban jail"
+
+def test_list_wrong_table_name(client, mocker, valid_credentials):
+    '''
+    Test for an wrong table name that lets pfctl fail. should result in a 500
+    '''
+    def noop():
+        pass
+
+    run_res = SimpleNamespace()
+    run_res.stdout = b''
+    run_res.stderr = b'No ALTQ support in kernel\nALTQ related functions disabled\n' \
+            b'pfctl: Invalid argument.\n'
+    run_res.returncode = 255
+    run_res.check_returncode = noop
+
+    mocker.patch('jail2ban.pfctl.run',
+                 return_value=run_res,
+                 side_effect=CalledProcessError(run_res.returncode,
+                                                'foobar',
+                                                 output=run_res.stdout,
+                                                 stderr=run_res.stderr)
+                 )
+
+    response = client.get("/list/notanerrorbuttestneedstofail",
+                          headers={"Authorization":
+                                   "Basic " + valid_credentials})
+
+    assert response.status_code == 500
+    assert response.json['error'] == "Command 'foobar' returned non-zero exit status 255."