fail2ban-rs 1.0.0

A pure-Rust fail2ban replacement. Single static binary, fast two-phase matching, nftables/iptables firewall backends.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

//! Tests for built-in filter templates.

use crate::filters;
use crate::pattern::expand_host;

#[test]
fn find_sshd() {
    let f = filters::find("sshd").unwrap();
    assert_eq!(f.name, "sshd");
    assert!(!f.patterns.is_empty());
}

#[test]
fn find_nonexistent() {
    assert!(filters::find("nonexistent").is_none());
}

#[test]
fn all_filters_have_host() {
    for f in filters::FILTERS {
        for pattern in f.patterns {
            assert!(
                pattern.contains("<HOST>"),
                "filter {} pattern missing <HOST>: {}",
                f.name,
                pattern
            );
        }
    }
}

#[test]
fn all_patterns_compile() {
    for f in filters::FILTERS {
        for pattern in f.patterns {
            let expanded = expand_host(pattern);
            assert!(
                expanded.is_ok(),
                "filter {} pattern failed to expand: {} — {}",
                f.name,
                pattern,
                expanded.unwrap_err()
            );
            let expanded = expanded.unwrap();
            let re = regex::Regex::new(&expanded);
            assert!(
                re.is_ok(),
                "filter {} expanded pattern failed to compile: {} — {}",
                f.name,
                expanded,
                re.unwrap_err()
            );
        }
    }
}

#[test]
fn gen_config_sshd() {
    let f = filters::find("sshd").unwrap();
    let toml = filters::gen_config(f);
    assert!(toml.contains("[jail.sshd]"));
    assert!(toml.contains("/var/log/auth.log"));
    assert!(toml.contains("syslog"));
    assert!(toml.contains("<HOST>"));
}

#[test]
fn gen_config_all_services() {
    for f in filters::FILTERS {
        let toml = filters::gen_config(f);
        assert!(
            toml.contains(&format!("[jail.{}]", f.name)),
            "gen_config missing jail header for {}",
            f.name
        );
    }
}

#[test]
fn filter_count() {
    assert_eq!(filters::FILTERS.len(), 19, "expected 19 built-in filters");
}

#[test]
fn sshd_patterns_match_real_lines() {
    let f = filters::find("sshd").unwrap();
    let expanded = expand_host(f.patterns[0]).unwrap();
    let re = regex::Regex::new(&expanded).unwrap();

    let line = "sshd[1234]: Failed password for root from 192.168.1.100 port 22";
    let caps = re.captures(line);
    assert!(caps.is_some(), "sshd pattern should match: {line}");
    assert_eq!(&caps.unwrap()["host"], "192.168.1.100");
}