763 lines
25 KiB
Python
763 lines
25 KiB
Python
"""File-based fail2ban configuration service.
|
|
|
|
Provides functions to list, read, and write files in the fail2ban
|
|
configuration directory (``jail.d/``, ``filter.d/``, ``action.d/``).
|
|
|
|
All file operations are synchronous (wrapped in
|
|
:func:`app.utils.async_utils.run_blocking` by callers that need async
|
|
behaviour) because the config files are small and infrequently touched — the
|
|
overhead of async I/O is not warranted here.
|
|
|
|
Security note: every path-related helper validates that the resolved path
|
|
stays strictly inside the configured config directory to prevent directory
|
|
traversal attacks.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
from app.utils.async_utils import run_blocking
|
|
from app.exceptions import (
|
|
ConfigDirError,
|
|
ConfigFileExistsError,
|
|
ConfigFileNameError,
|
|
ConfigFileNotFoundError,
|
|
ConfigFileWriteError,
|
|
)
|
|
import configparser
|
|
import re
|
|
from pathlib import Path
|
|
from typing import TYPE_CHECKING
|
|
|
|
import structlog
|
|
|
|
from app.models.file_config import (
|
|
ConfFileContent,
|
|
ConfFileCreateRequest,
|
|
ConfFileEntry,
|
|
ConfFilesResponse,
|
|
ConfFileUpdateRequest,
|
|
JailConfigFile,
|
|
JailConfigFileContent,
|
|
JailConfigFilesResponse,
|
|
)
|
|
from app.services.config_file_helpers import (
|
|
_CONF_EXTENSIONS,
|
|
_assert_within,
|
|
_create_conf_file,
|
|
_list_conf_files,
|
|
_read_conf_file,
|
|
_resolve_subdir,
|
|
_validate_content,
|
|
_write_conf_file,
|
|
)
|
|
|
|
if TYPE_CHECKING:
|
|
from app.models.config import (
|
|
ActionConfig,
|
|
ActionConfigUpdate,
|
|
FilterConfig,
|
|
FilterConfigUpdate,
|
|
JailFileConfig,
|
|
JailFileConfigUpdate,
|
|
)
|
|
|
|
log: structlog.stdlib.BoundLogger = structlog.get_logger()
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Internal helpers — INI parsing / patching
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def _parse_enabled(path: Path) -> bool:
|
|
"""Return the ``enabled`` value for the primary section in *path*.
|
|
|
|
Reads the INI file with :mod:`configparser` and looks for an ``enabled``
|
|
key in the section whose name matches the file stem (or in ``DEFAULT``).
|
|
Returns ``True`` if the key is absent (fail2ban's own default).
|
|
|
|
Args:
|
|
path: Path to a ``.conf`` or ``.local`` jail config file.
|
|
|
|
Returns:
|
|
``True`` if the jail is (or defaults to) enabled, ``False`` otherwise.
|
|
"""
|
|
cp = configparser.ConfigParser(
|
|
# Treat all keys case-insensitively; interpolation disabled because
|
|
# fail2ban uses %(variables)s which would confuse configparser.
|
|
interpolation=None,
|
|
)
|
|
try:
|
|
cp.read(str(path), encoding="utf-8")
|
|
except configparser.Error:
|
|
return True # Unreadable files are treated as enabled (safe default).
|
|
|
|
jail_name = path.stem
|
|
# Prefer the jail-specific section; fall back to DEFAULT.
|
|
for section in (jail_name, "DEFAULT"):
|
|
if cp.has_option(section, "enabled"):
|
|
raw = cp.get(section, "enabled").strip().lower()
|
|
return raw in ("true", "1", "yes")
|
|
return True
|
|
|
|
|
|
def _set_enabled_in_content(content: str, enabled: bool) -> str:
|
|
"""Return *content* with the first ``enabled = …`` line replaced.
|
|
|
|
If no ``enabled`` line exists, appends one to the last ``[section]`` block
|
|
found in the file.
|
|
|
|
Args:
|
|
content: Current raw file content.
|
|
enabled: New value for the ``enabled`` key.
|
|
|
|
Returns:
|
|
Modified file content as a string.
|
|
"""
|
|
value = "true" if enabled else "false"
|
|
# Try to replace an existing "enabled = ..." line (inside any section).
|
|
pattern = re.compile(
|
|
r"^(\s*enabled\s*=\s*).*$",
|
|
re.MULTILINE | re.IGNORECASE,
|
|
)
|
|
if pattern.search(content):
|
|
return pattern.sub(rf"\g<1>{value}", content, count=1)
|
|
|
|
# No existing enabled line. Find the last [section] header and append
|
|
# the enabled setting right after it.
|
|
section_pattern = re.compile(r"^\[([^\[\]]+)\]\s*$", re.MULTILINE)
|
|
matches = list(section_pattern.finditer(content))
|
|
if matches:
|
|
# Insert after the last section header line.
|
|
last_match = matches[-1]
|
|
insert_pos = last_match.end()
|
|
return content[:insert_pos] + f"\nenabled = {value}" + content[insert_pos:]
|
|
|
|
# No section found at all — prepend a minimal block.
|
|
return f"[DEFAULT]\nenabled = {value}\n\n" + content
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Public API — jail config files (Task 4a)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
async def list_jail_config_files(config_dir: str) -> JailConfigFilesResponse:
|
|
"""List all jail config files in ``<config_dir>/jail.d/``.
|
|
|
|
Only ``.conf`` and ``.local`` files are returned. The ``enabled`` state
|
|
is parsed from each file's content.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
|
|
Returns:
|
|
:class:`~app.models.file_config.JailConfigFilesResponse`.
|
|
|
|
Raises:
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> JailConfigFilesResponse:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d")
|
|
if not jail_d.is_dir():
|
|
log.warning("jail_d_not_found", config_dir=config_dir)
|
|
return JailConfigFilesResponse(files=[], total=0)
|
|
|
|
files: list[JailConfigFile] = []
|
|
for path in sorted(jail_d.iterdir()):
|
|
if not path.is_file():
|
|
continue
|
|
if path.suffix not in _CONF_EXTENSIONS:
|
|
continue
|
|
_assert_within(jail_d.resolve(), path.resolve())
|
|
files.append(
|
|
JailConfigFile(
|
|
name=path.stem,
|
|
filename=path.name,
|
|
enabled=_parse_enabled(path),
|
|
)
|
|
)
|
|
log.info("jail_config_files_listed", count=len(files))
|
|
return JailConfigFilesResponse(files=files, total=len(files))
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def get_jail_config_file(config_dir: str, filename: str) -> JailConfigFileContent:
|
|
"""Return the content and metadata of a single jail config file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
filename: The filename (e.g. ``sshd.conf``) — must end in ``.conf`` or ``.local``.
|
|
|
|
Returns:
|
|
:class:`~app.models.file_config.JailConfigFileContent`.
|
|
|
|
Raises:
|
|
ConfigFileNameError: If *filename* is unsafe.
|
|
ConfigFileNotFoundError: If the file does not exist.
|
|
ConfigDirError: If the config directory does not exist.
|
|
"""
|
|
|
|
def _do() -> JailConfigFileContent:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d").resolve()
|
|
if not jail_d.is_dir():
|
|
raise ConfigFileNotFoundError(filename)
|
|
|
|
path = (jail_d / filename).resolve()
|
|
_assert_within(jail_d, path)
|
|
if path.suffix not in _CONF_EXTENSIONS:
|
|
raise ConfigFileNameError(
|
|
f"Invalid file extension for {filename!r}. "
|
|
"Only .conf and .local files are supported."
|
|
)
|
|
if not path.is_file():
|
|
raise ConfigFileNotFoundError(filename)
|
|
|
|
content = path.read_text(encoding="utf-8", errors="replace")
|
|
return JailConfigFileContent(
|
|
name=path.stem,
|
|
filename=path.name,
|
|
enabled=_parse_enabled(path),
|
|
content=content,
|
|
)
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def set_jail_config_enabled(
|
|
config_dir: str,
|
|
filename: str,
|
|
enabled: bool,
|
|
) -> None:
|
|
"""Set the ``enabled`` flag in a jail config file.
|
|
|
|
Reads the file, modifies (or inserts) the ``enabled`` key, and writes it
|
|
back. The update preserves all other content including comments.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
filename: The filename (e.g. ``sshd.conf``).
|
|
enabled: New value for the ``enabled`` key.
|
|
|
|
Raises:
|
|
ConfigFileNameError: If *filename* is unsafe.
|
|
ConfigFileNotFoundError: If the file does not exist.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If the config directory does not exist.
|
|
"""
|
|
|
|
def _do() -> None:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d").resolve()
|
|
if not jail_d.is_dir():
|
|
raise ConfigFileNotFoundError(filename)
|
|
|
|
path = (jail_d / filename).resolve()
|
|
_assert_within(jail_d, path)
|
|
if path.suffix not in _CONF_EXTENSIONS:
|
|
raise ConfigFileNameError(
|
|
f"Only .conf and .local files are supported, got {filename!r}."
|
|
)
|
|
if not path.is_file():
|
|
raise ConfigFileNotFoundError(filename)
|
|
|
|
original = path.read_text(encoding="utf-8", errors="replace")
|
|
updated = _set_enabled_in_content(original, enabled)
|
|
try:
|
|
path.write_text(updated, encoding="utf-8")
|
|
except OSError as exc:
|
|
raise ConfigFileWriteError(
|
|
f"Cannot write {filename!r}: {exc}"
|
|
) from exc
|
|
log.info(
|
|
"jail_config_file_enabled_set",
|
|
filename=filename,
|
|
enabled=enabled,
|
|
)
|
|
|
|
await run_blocking( _do)
|
|
|
|
|
|
async def create_jail_config_file(
|
|
config_dir: str,
|
|
req: ConfFileCreateRequest,
|
|
) -> str:
|
|
"""Create a new jail.d config file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
req: :class:`~app.models.file_config.ConfFileCreateRequest`.
|
|
|
|
Returns:
|
|
The filename that was created.
|
|
|
|
Raises:
|
|
ConfigFileExistsError: If a file with that name already exists.
|
|
ConfigFileNameError: If the name is invalid.
|
|
ConfigFileWriteError: If the file cannot be created.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> str:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d")
|
|
filename = _create_conf_file(jail_d, req.name, req.content)
|
|
log.info("jail_config_file_created", filename=filename)
|
|
return filename
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def write_jail_config_file(
|
|
config_dir: str,
|
|
filename: str,
|
|
req: ConfFileUpdateRequest,
|
|
) -> None:
|
|
"""Overwrite an existing jail.d config file with new raw content.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
filename: Filename including extension (e.g. ``sshd.conf``).
|
|
req: :class:`~app.models.file_config.ConfFileUpdateRequest` with new
|
|
content.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If the file does not exist.
|
|
ConfigFileNameError: If *filename* is unsafe or has a bad extension.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> None:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d").resolve()
|
|
if not jail_d.is_dir():
|
|
raise ConfigFileNotFoundError(filename)
|
|
path = (jail_d / filename).resolve()
|
|
_assert_within(jail_d, path)
|
|
if path.suffix not in _CONF_EXTENSIONS:
|
|
raise ConfigFileNameError(
|
|
f"Only .conf and .local files are supported, got {filename!r}."
|
|
)
|
|
if not path.is_file():
|
|
raise ConfigFileNotFoundError(filename)
|
|
try:
|
|
path.write_text(req.content, encoding="utf-8")
|
|
except OSError as exc:
|
|
raise ConfigFileWriteError(
|
|
f"Cannot write {filename!r}: {exc}"
|
|
) from exc
|
|
log.info("jail_config_file_written", filename=filename)
|
|
|
|
await run_blocking( _do)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Public API — filter files (Task 4d)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
async def list_filter_files(config_dir: str) -> ConfFilesResponse:
|
|
"""List all filter definition files in ``<config_dir>/filter.d/``.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
|
|
Returns:
|
|
:class:`~app.models.file_config.ConfFilesResponse`.
|
|
|
|
Raises:
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> ConfFilesResponse:
|
|
filter_d = _resolve_subdir(config_dir, "filter.d")
|
|
result = _list_conf_files(filter_d)
|
|
log.info("filter_files_listed", count=result.total)
|
|
return result
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def get_filter_file(config_dir: str, name: str) -> ConfFileContent:
|
|
"""Return the content of a filter definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name (with or without ``.conf``/``.local`` extension).
|
|
|
|
Returns:
|
|
:class:`~app.models.file_config.ConfFileContent`.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> ConfFileContent:
|
|
filter_d = _resolve_subdir(config_dir, "filter.d")
|
|
return _read_conf_file(filter_d, name)
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def write_filter_file(
|
|
config_dir: str,
|
|
name: str,
|
|
req: ConfFileUpdateRequest,
|
|
) -> None:
|
|
"""Overwrite an existing filter definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name of the file to update (with or without extension).
|
|
req: :class:`~app.models.file_config.ConfFileUpdateRequest` with new content.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> None:
|
|
filter_d = _resolve_subdir(config_dir, "filter.d")
|
|
_write_conf_file(filter_d, name, req.content)
|
|
log.info("filter_file_written", name=name)
|
|
|
|
await run_blocking( _do)
|
|
|
|
|
|
async def create_filter_file(
|
|
config_dir: str,
|
|
req: ConfFileCreateRequest,
|
|
) -> str:
|
|
"""Create a new filter definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
req: :class:`~app.models.file_config.ConfFileCreateRequest`.
|
|
|
|
Returns:
|
|
The filename that was created.
|
|
|
|
Raises:
|
|
ConfigFileExistsError: If a file with that name already exists.
|
|
ConfigFileNameError: If the name is invalid.
|
|
ConfigFileWriteError: If the file cannot be created.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> str:
|
|
filter_d = _resolve_subdir(config_dir, "filter.d")
|
|
filename = _create_conf_file(filter_d, req.name, req.content)
|
|
log.info("filter_file_created", filename=filename)
|
|
return filename
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Public API — action files (Task 4e)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
async def list_action_files(config_dir: str) -> ConfFilesResponse:
|
|
"""List all action definition files in ``<config_dir>/action.d/``.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
|
|
Returns:
|
|
:class:`~app.models.file_config.ConfFilesResponse`.
|
|
|
|
Raises:
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> ConfFilesResponse:
|
|
action_d = _resolve_subdir(config_dir, "action.d")
|
|
result = _list_conf_files(action_d)
|
|
log.info("action_files_listed", count=result.total)
|
|
return result
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def get_action_file(config_dir: str, name: str) -> ConfFileContent:
|
|
"""Return the content of an action definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name (with or without ``.conf``/``.local`` extension).
|
|
|
|
Returns:
|
|
:class:`~app.models.file_config.ConfFileContent`.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> ConfFileContent:
|
|
action_d = _resolve_subdir(config_dir, "action.d")
|
|
return _read_conf_file(action_d, name)
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def write_action_file(
|
|
config_dir: str,
|
|
name: str,
|
|
req: ConfFileUpdateRequest,
|
|
) -> None:
|
|
"""Overwrite an existing action definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name of the file to update.
|
|
req: :class:`~app.models.file_config.ConfFileUpdateRequest` with new content.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> None:
|
|
action_d = _resolve_subdir(config_dir, "action.d")
|
|
_write_conf_file(action_d, name, req.content)
|
|
log.info("action_file_written", name=name)
|
|
|
|
await run_blocking( _do)
|
|
|
|
|
|
async def create_action_file(
|
|
config_dir: str,
|
|
req: ConfFileCreateRequest,
|
|
) -> str:
|
|
"""Create a new action definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
req: :class:`~app.models.file_config.ConfFileCreateRequest`.
|
|
|
|
Returns:
|
|
The filename that was created.
|
|
|
|
Raises:
|
|
ConfigFileExistsError: If a file with that name already exists.
|
|
ConfigFileNameError: If the name is invalid.
|
|
ConfigFileWriteError: If the file cannot be created.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
|
|
def _do() -> str:
|
|
action_d = _resolve_subdir(config_dir, "action.d")
|
|
filename = _create_conf_file(action_d, req.name, req.content)
|
|
log.info("action_file_created", filename=filename)
|
|
return filename
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Public API — structured (parsed) filter files (Task 2.1)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
async def get_parsed_filter_file(config_dir: str, name: str) -> FilterConfig:
|
|
"""Parse a filter definition file and return its structured representation.
|
|
|
|
Reads the raw ``.conf``/``.local`` file from ``filter.d/``, parses it with
|
|
:func:`~app.utils.conffile_parser.parse_filter_file`, and returns the
|
|
result.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name with or without extension.
|
|
|
|
Returns:
|
|
:class:`~app.models.config.FilterConfig`.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
from app.utils.conffile_parser import parse_filter_file # avoid circular imports
|
|
|
|
def _do() -> FilterConfig:
|
|
filter_d = _resolve_subdir(config_dir, "filter.d")
|
|
raw = _read_conf_file(filter_d, name)
|
|
result = parse_filter_file(raw.content, name=raw.name, filename=raw.filename)
|
|
log.debug("filter_file_parsed", name=raw.name)
|
|
return result
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def update_parsed_filter_file(
|
|
config_dir: str,
|
|
name: str,
|
|
update: FilterConfigUpdate,
|
|
) -> None:
|
|
"""Apply a structured partial update to a filter definition file.
|
|
|
|
Reads the existing file, merges *update* onto it, serializes to INI format,
|
|
and writes the result back to disk.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name of the file to update.
|
|
update: Partial fields to apply.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
from app.utils.conffile_parser import ( # avoid circular imports
|
|
merge_filter_update,
|
|
parse_filter_file,
|
|
serialize_filter_config,
|
|
)
|
|
|
|
def _do() -> None:
|
|
filter_d = _resolve_subdir(config_dir, "filter.d")
|
|
raw = _read_conf_file(filter_d, name)
|
|
current = parse_filter_file(raw.content, name=raw.name, filename=raw.filename)
|
|
merged = merge_filter_update(current, update)
|
|
new_content = serialize_filter_config(merged)
|
|
_validate_content(new_content)
|
|
_write_conf_file(filter_d, name, new_content)
|
|
log.info("filter_file_updated_parsed", name=name)
|
|
|
|
await run_blocking( _do)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Public API — structured (parsed) action files (Task 3.1)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
async def get_parsed_action_file(config_dir: str, name: str) -> ActionConfig:
|
|
"""Parse an action definition file and return its structured representation.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name with or without extension.
|
|
|
|
Returns:
|
|
:class:`~app.models.config.ActionConfig`.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
from app.utils.conffile_parser import parse_action_file # avoid circular imports
|
|
|
|
def _do() -> ActionConfig:
|
|
action_d = _resolve_subdir(config_dir, "action.d")
|
|
raw = _read_conf_file(action_d, name)
|
|
result = parse_action_file(raw.content, name=raw.name, filename=raw.filename)
|
|
log.debug("action_file_parsed", name=raw.name)
|
|
return result
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def update_parsed_action_file(
|
|
config_dir: str,
|
|
name: str,
|
|
update: ActionConfigUpdate,
|
|
) -> None:
|
|
"""Apply a structured partial update to an action definition file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
name: Base name of the file to update.
|
|
update: Partial fields to apply.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
from app.utils.conffile_parser import ( # avoid circular imports
|
|
merge_action_update,
|
|
parse_action_file,
|
|
serialize_action_config,
|
|
)
|
|
|
|
def _do() -> None:
|
|
action_d = _resolve_subdir(config_dir, "action.d")
|
|
raw = _read_conf_file(action_d, name)
|
|
current = parse_action_file(raw.content, name=raw.name, filename=raw.filename)
|
|
merged = merge_action_update(current, update)
|
|
new_content = serialize_action_config(merged)
|
|
_validate_content(new_content)
|
|
_write_conf_file(action_d, name, new_content)
|
|
log.info("action_file_updated_parsed", name=name)
|
|
|
|
await run_blocking( _do)
|
|
|
|
|
|
async def get_parsed_jail_file(config_dir: str, filename: str) -> JailFileConfig:
|
|
"""Parse a jail.d config file into a structured :class:`~app.models.config.JailFileConfig`.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
filename: Filename including extension (e.g. ``"sshd.conf"``).
|
|
|
|
Returns:
|
|
:class:`~app.models.config.JailFileConfig`.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
from app.utils.conffile_parser import parse_jail_file # avoid circular imports
|
|
|
|
def _do() -> JailFileConfig:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d")
|
|
raw = _read_conf_file(jail_d, filename)
|
|
result = parse_jail_file(raw.content, filename=raw.filename)
|
|
log.debug("jail_file_parsed", filename=raw.filename)
|
|
return result
|
|
|
|
return await run_blocking( _do)
|
|
|
|
|
|
async def update_parsed_jail_file(
|
|
config_dir: str,
|
|
filename: str,
|
|
update: JailFileConfigUpdate,
|
|
) -> None:
|
|
"""Apply a structured partial update to a jail.d config file.
|
|
|
|
Args:
|
|
config_dir: Path to the fail2ban configuration directory.
|
|
filename: Filename including extension (e.g. ``"sshd.conf"``).
|
|
update: Partial fields to apply.
|
|
|
|
Raises:
|
|
ConfigFileNotFoundError: If no matching file is found.
|
|
ConfigFileWriteError: If the file cannot be written.
|
|
ConfigDirError: If *config_dir* does not exist.
|
|
"""
|
|
from app.utils.conffile_parser import ( # avoid circular imports
|
|
merge_jail_file_update,
|
|
parse_jail_file,
|
|
serialize_jail_file_config,
|
|
)
|
|
|
|
def _do() -> None:
|
|
jail_d = _resolve_subdir(config_dir, "jail.d")
|
|
raw = _read_conf_file(jail_d, filename)
|
|
current = parse_jail_file(raw.content, filename=raw.filename)
|
|
merged = merge_jail_file_update(current, update)
|
|
new_content = serialize_jail_file_config(merged)
|
|
_validate_content(new_content)
|
|
_write_conf_file(jail_d, filename, new_content)
|
|
log.info("jail_file_updated_parsed", filename=filename)
|
|
|
|
await run_blocking( _do)
|