From 1b9385e4157f9cdde26f716e29e34926c3236c4b Mon Sep 17 00:00:00 2001 From: Pierre Dubouilh Date: Mon, 11 May 2026 23:26:45 +0200 Subject: [PATCH] whitelist => blacklist --- .github/workflows/deploy.yml | 2 +- Makefile | 11 ++++++++--- src/clf.rs | 12 ++++++------ src/jail.rs | 2 +- src/json.rs | 12 ++++++------ src/main.rs | 10 +++++----- src/utils.rs | 6 +++--- 7 files changed, 30 insertions(+), 25 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index cec627d..f021c0f 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -29,4 +29,4 @@ jobs: allowUpdates: true artifacts: "builds/*" bodyFile: "builds/buildout" - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/Makefile b/Makefile index e75df57..2828c23 100644 --- a/Makefile +++ b/Makefile @@ -1,8 +1,8 @@ -BLOCKFAST_VERS := $(shell date '+%Y-%m-%d') / $(shell git rev-parse --short HEAD) +BLOCKFAST_VERS := $(shell git show -s --format=%cd --date=format:%Y-%m-%d HEAD) / $(shell git rev-parse --short HEAD) export BLOCKFAST_VERS build:: - echo $(BLOCKFAST_VERS) + @echo $(BLOCKFAST_VERS) cargo build cargo clippy --all cargo fmt --all @@ -21,14 +21,19 @@ ci:: test build-all:: mkdir -p builds - rustc --version > builds/buildout cross build --release --target x86_64-unknown-linux-musl cross build --release --target aarch64-unknown-linux-musl cross build --release --target armv7-unknown-linux-musleabihf cp target/x86_64-unknown-linux-musl/release/blockfast builds/blockfast-x86_64-linux cp target/aarch64-unknown-linux-musl/release/blockfast builds/blockfast-aarch64-linux cp target/armv7-unknown-linux-musleabihf/release/blockfast builds/blockfast-arm7-linux + chmod +x builds/blockfast-* + echo '```' > builds/buildout + echo $(BLOCKFAST_VERS) >> builds/buildout + rustc --version >> builds/buildout sha256sum builds/* >> builds/buildout + echo '```' >> builds/buildout + cat builds/buildout watch:: ls src/*.rs | entr -rc -- make run diff --git a/src/clf.rs b/src/clf.rs index 36760c9..2e6783d 100644 --- a/src/clf.rs +++ b/src/clf.rs @@ -10,7 +10,7 @@ lazy_static! { } #[allow(clippy::bind_instead_of_map)] -pub fn parse(line: &str, valid_statuses: &[u32]) -> Result { +pub fn parse(line: &str, invalid_statuses: &[u32]) -> Result { let ip = RE_IP .captures(line) .and_then(|c| c.get(1)) @@ -25,8 +25,8 @@ pub fn parse(line: &str, valid_statuses: &[u32]) -> Result { .and_then(|e| e.parse::().ok()) .ok_or_else(|| anyhow!("cant parse clf line - status"))?; - let is_good_status = valid_statuses.iter().any(|s| s == &status); - if !is_good_status { + let is_bad_status = invalid_statuses.iter().any(|s| s == &status); + if is_bad_status { return Ok(ParsingStatus::BadEntry(ip)); } @@ -45,7 +45,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e, &vec![200, 404]).unwrap(); + let ret = parse(*e, &vec![401, 429]).unwrap(); match ret { ParsingStatus::BadEntry(_) => {} _ => panic!("bad parsing"), @@ -61,7 +61,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e, &vec![200, 404]).unwrap(); + let ret = parse(*e, &vec![401, 429]).unwrap(); match ret { ParsingStatus::OkEntry => {} _ => panic!("bad parsing"), @@ -77,7 +77,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e, &vec![200, 404]); + let ret = parse(*e, &vec![429, 401]); assert!(ret.is_err()); }) } diff --git a/src/jail.rs b/src/jail.rs index c7d3916..87b1bdd 100644 --- a/src/jail.rs +++ b/src/jail.rs @@ -11,7 +11,7 @@ pub struct Jail { name: String, allowance: u8, jailtime: u32, - remand: Mutex>, + remand: Mutex>, // ip -> (hits, timestamp) } fn exec(program: &str, cmd: &str, err: &str) -> Result<(), Error> { diff --git a/src/json.rs b/src/json.rs index 5752fb9..eee1fa6 100644 --- a/src/json.rs +++ b/src/json.rs @@ -2,7 +2,7 @@ use crate::utils::ParsingStatus; use anyhow::*; use std::{net::IpAddr, str::FromStr}; -pub fn parse(line: &str, valid_statuses: &[u32]) -> Result { +pub fn parse(line: &str, invalid_statuses: &[u32]) -> Result { let json: serde_json::Value = serde_json::from_str(line)?; let remote_ip = json @@ -17,8 +17,8 @@ pub fn parse(line: &str, valid_statuses: &[u32]) -> Result { .and_then(|r| r.as_u64()) .ok_or_else(|| anyhow!("cant parse json line - status"))?; - let is_good_status = valid_statuses.iter().any(|s| s == &(status as u32)); - if !is_good_status { + let is_bad_status = invalid_statuses.iter().any(|s| s == &(status as u32)); + if is_bad_status { return Ok(ParsingStatus::BadEntry(remote_ip)); } @@ -37,7 +37,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e, &vec![200, 404]).unwrap(); + let ret = parse(*e, &vec![429, 401]).unwrap(); match ret { ParsingStatus::BadEntry(_) => {} _ => panic!("bad parsing"), @@ -53,7 +53,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e, &vec![200, 404]).unwrap(); + let ret = parse(*e, &vec![429, 401]).unwrap(); match ret { ParsingStatus::OkEntry => {} _ => panic!("bad parsing"), @@ -68,7 +68,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e, &vec![200, 404]); + let ret = parse(*e, &vec![429, 401]); assert!(ret.is_err()); }) } diff --git a/src/main.rs b/src/main.rs index 82fc09f..51d8c87 100644 --- a/src/main.rs +++ b/src/main.rs @@ -19,9 +19,9 @@ async fn run() -> Result<()> { let mut ml = MuxedLines::new()?; // HTTP statuses - let ok_statuses = args.valid_http_statuses.clone(); - let ok_statuses_parsed = parse_statuses(&ok_statuses)?; - let ok_statuses_ref = ok_statuses_parsed.as_ref(); + let invalid_statuses = args.invalid_http_statuses.clone(); + let invalid_statuses_parsed = parse_statuses(&invalid_statuses)?; + let invalid_statuses_ref = invalid_statuses_parsed.as_ref(); // generic parser let generic_path = args.generic_logpath.as_ref(); @@ -81,9 +81,9 @@ async fn run() -> Result<()> { let (target, ret) = if path == sshd_logpath { ("sshd", sshd::parse(payload)?) } else if path == clf_logpath { - ("clf", clf::parse(payload, ok_statuses_ref)?) + ("clf", clf::parse(payload, invalid_statuses_ref)?) } else if path == json_logpath { - ("json", json::parse(payload, ok_statuses_ref)?) + ("json", json::parse(payload, invalid_statuses_ref)?) } else if path == generic_path { ( "generic", diff --git a/src/utils.rs b/src/utils.rs index 4b92b58..73e7917 100644 --- a/src/utils.rs +++ b/src/utils.rs @@ -136,7 +136,7 @@ pub struct Args { #[clap(long)] pub generic_negative: Option, - /// valid http statuses (for CLF and JSON logs). Coma separated list, accepts ranges with XX. - #[clap(long, default_value = "10x,20x,30x,404,408")] - pub valid_http_statuses: String, + /// invalid http statuses (for CLF and JSON logs). Coma separated list, accepts ranges with XX. + #[clap(long, default_value = "400,401,402,403")] + pub invalid_http_statuses: String, }