diff --git a/Cargo.lock b/Cargo.lock index f069022..cc2cc54 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -12,12 +12,53 @@ dependencies = [ ] [[package]] -name = "ansi_term" -version = "0.12.1" +name = "anstream" +version = "0.6.18" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2" +checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b" dependencies = [ - "winapi", + "anstyle", + "anstyle-parse", + "anstyle-query", + "anstyle-wincon", + "colorchoice", + "is_terminal_polyfill", + "utf8parse", +] + +[[package]] +name = "anstyle" +version = "1.0.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9" + +[[package]] +name = "anstyle-parse" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9" +dependencies = [ + "utf8parse", +] + +[[package]] +name = "anstyle-query" +version = "1.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c" +dependencies = [ + "windows-sys 0.59.0", +] + +[[package]] +name = "anstyle-wincon" +version = "3.0.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e" +dependencies = [ + "anstyle", + "once_cell", + "windows-sys 0.59.0", ] [[package]] @@ -26,17 +67,6 @@ version = "1.0.62" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1485d4d2cc45e7b201ee3767015c96faa5904387c9d87c6efdd0fb511f12d305" -[[package]] -name = "atty" -version = "0.2.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8" -dependencies = [ - "hermit-abi", - "libc", - "winapi", -] - [[package]] name = "autocfg" version = "1.1.0" @@ -58,6 +88,7 @@ dependencies = [ "lazy_static", "linemux", "regex", + "serde_json", "tokio", ] @@ -75,19 +106,50 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" [[package]] name = "clap" -version = "2.34.0" +version = "4.5.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c" +checksum = "769b0145982b4b48713e01ec42d61614425f27b7058bda7180a3a41f30104796" dependencies = [ - "ansi_term", - "atty", - "bitflags", - "strsim", - "textwrap", - "unicode-width", - "vec_map", + "clap_builder", + "clap_derive", ] +[[package]] +name = "clap_builder" +version = "4.5.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1b26884eb4b57140e4d2d93652abfa49498b938b3c9179f9fc487b0acc3edad7" +dependencies = [ + "anstream", + "anstyle", + "clap_lex", + "strsim", +] + +[[package]] +name = "clap_derive" +version = "4.5.24" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "54b755194d6389280185988721fffba69495eed5ee9feeee9a599b53db80318c" +dependencies = [ + "heck", + "proc-macro2", + "quote", + "syn 2.0.96", +] + +[[package]] +name = "clap_lex" +version = "0.7.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6" + +[[package]] +name = "colorchoice" +version = "1.0.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990" + [[package]] name = "crossbeam-channel" version = "0.5.6" @@ -108,6 +170,12 @@ dependencies = [ "once_cell", ] +[[package]] +name = "dtoa" +version = "0.4.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56899898ce76aaf4a0f24d914c97ea6ed976d42fec6ad33fcbb0a1103e07b2b0" + [[package]] name = "filetime" version = "0.2.17" @@ -117,7 +185,7 @@ dependencies = [ "cfg-if", "libc", "redox_syscall", - "windows-sys", + "windows-sys 0.36.1", ] [[package]] @@ -145,6 +213,12 @@ dependencies = [ "slab", ] +[[package]] +name = "heck" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" + [[package]] name = "hermit-abi" version = "0.1.19" @@ -174,6 +248,18 @@ dependencies = [ "libc", ] +[[package]] +name = "is_terminal_polyfill" +version = "1.70.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf" + +[[package]] +name = "itoa" +version = "0.3.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8324a32baf01e2ae060e9de58ed0bc2320c9a2833491ee36cd3b4c414de4db8c" + [[package]] name = "kqueue" version = "1.0.6" @@ -242,7 +328,7 @@ dependencies = [ "libc", "log", "wasi", - "windows-sys", + "windows-sys 0.36.1", ] [[package]] @@ -262,6 +348,24 @@ dependencies = [ "winapi", ] +[[package]] +name = "num-traits" +version = "0.1.43" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "92e5113e9fd4cc14ded8e499429f396a20f98c772a47cc8622a736e1ec843c31" +dependencies = [ + "num-traits 0.2.19", +] + +[[package]] +name = "num-traits" +version = "0.2.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" +dependencies = [ + "autocfg", +] + [[package]] name = "num_cpus" version = "1.13.1" @@ -274,9 +378,9 @@ dependencies = [ [[package]] name = "once_cell" -version = "1.13.1" +version = "1.20.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "074864da206b4973b84eb91683020dbefd6a8c3f0f38e054d93954e891935e4e" +checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775" [[package]] name = "pin-project-lite" @@ -292,18 +396,18 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" [[package]] name = "proc-macro2" -version = "1.0.43" +version = "1.0.93" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab" +checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99" dependencies = [ "unicode-ident", ] [[package]] name = "quote" -version = "1.0.21" +version = "1.0.38" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179" +checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc" dependencies = [ "proc-macro2", ] @@ -343,6 +447,24 @@ dependencies = [ "winapi-util", ] +[[package]] +name = "serde" +version = "1.0.185" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "be9b6f69f1dfd54c3b568ffa45c310d6973a5e5148fd40cf515acaf38cf5bc31" + +[[package]] +name = "serde_json" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1c62115693d0a9ed8c32d1c760f0fdbe7d4b05cb13c135b9b54137ac0d59fccb" +dependencies = [ + "dtoa", + "itoa", + "num-traits 0.1.43", + "serde", +] + [[package]] name = "slab" version = "0.4.7" @@ -354,9 +476,9 @@ dependencies = [ [[package]] name = "strsim" -version = "0.8.0" +version = "0.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a" +checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" [[package]] name = "syn" @@ -370,12 +492,14 @@ dependencies = [ ] [[package]] -name = "textwrap" -version = "0.11.0" +name = "syn" +version = "2.0.96" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060" +checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80" dependencies = [ - "unicode-width", + "proc-macro2", + "quote", + "unicode-ident", ] [[package]] @@ -401,7 +525,7 @@ checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484" dependencies = [ "proc-macro2", "quote", - "syn", + "syn 1.0.99", ] [[package]] @@ -411,16 +535,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c4f5b37a154999a8f3f98cc23a628d850e154479cd94decf3414696e12e31aaf" [[package]] -name = "unicode-width" -version = "0.1.9" +name = "utf8parse" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973" - -[[package]] -name = "vec_map" -version = "0.8.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191" +checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" [[package]] name = "walkdir" @@ -476,39 +594,112 @@ version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2" dependencies = [ - "windows_aarch64_msvc", - "windows_i686_gnu", - "windows_i686_msvc", - "windows_x86_64_gnu", - "windows_x86_64_msvc", + "windows_aarch64_msvc 0.36.1", + "windows_i686_gnu 0.36.1", + "windows_i686_msvc 0.36.1", + "windows_x86_64_gnu 0.36.1", + "windows_x86_64_msvc 0.36.1", ] +[[package]] +name = "windows-sys" +version = "0.59.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" +dependencies = [ + "windows-targets", +] + +[[package]] +name = "windows-targets" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" +dependencies = [ + "windows_aarch64_gnullvm", + "windows_aarch64_msvc 0.52.6", + "windows_i686_gnu 0.52.6", + "windows_i686_gnullvm", + "windows_i686_msvc 0.52.6", + "windows_x86_64_gnu 0.52.6", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc 0.52.6", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" + [[package]] name = "windows_aarch64_msvc" version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47" +[[package]] +name = "windows_aarch64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" + [[package]] name = "windows_i686_gnu" version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6" +[[package]] +name = "windows_i686_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" + [[package]] name = "windows_i686_msvc" version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024" +[[package]] +name = "windows_i686_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" + [[package]] name = "windows_x86_64_gnu" version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1" +[[package]] +name = "windows_x86_64_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" + [[package]] name = "windows_x86_64_msvc" version = "0.36.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" diff --git a/Cargo.toml b/Cargo.toml index 0cbd2c2..7938c4c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -11,5 +11,6 @@ linemux = "0.2" tokio = { version = "1", features = ["rt-multi-thread", "macros"] } lazy_static = "1.4.0" regex = "1.5.4" -clap = "2.33.3" anyhow = "1.0.44" +serde_json = "=1.0.1" +clap = { version = "4.5.27", features = ["derive"] } diff --git a/Makefile b/Makefile index 2e29f99..0271198 100644 --- a/Makefile +++ b/Makefile @@ -6,7 +6,9 @@ build:: run:: touch /tmp/sshdtest touch /tmp/clftest - cargo run -- -s=/tmp/sshdtest -c=/tmp/clftest + touch /tmp/jsontest + touch /tmp/generictest + cargo run -- -v -s=/tmp/sshdtest -c=/tmp/clftest -j=/tmp/jsontest --generic-logpath=/tmp/generictest --generic-ip='from ([0-9a-fA-F:.]+) port' --generic-positive='Failed password' ci:: test cargo fmt --all -- --check @@ -33,9 +35,21 @@ hit-sshd:: ok-sshd:: echo "Sep 26 06:25:19 livecompute sshd[23246]: successful login 8.124.36.195 port 41883 ssh2" >> /tmp/sshdtest +hit-generic:: + echo "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195 port 41883 ssh2" >> /tmp/generictest + +ok-generic:: + echo "Sep 26 06:25:19 livecompute sshd[23246]: Successful login for root from 179.124.36.195 port 41883 ssh2" >> /tmp/generictest + hit-clf:: echo "1.124.36.195 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 401 923" >> /tmp/clftest ok-clf:: echo "2.124.36.195 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 200 23012" >> /tmp/clftest +hit-json:: + echo "{\"request\":{\"remote_ip\":\"1.124.36.19\"}, \"status\": 400}" >> /tmp/jsontest + +ok-json:: + echo "{\"request\":{\"remote_ip\":\"2.124.36.19\"}, \"status\": 200}" >> /tmp/jsontest + diff --git a/src/clf.rs b/src/clf.rs index b40c532..36760c9 100644 --- a/src/clf.rs +++ b/src/clf.rs @@ -5,13 +5,12 @@ use regex::Regex; use std::{net::IpAddr, str::FromStr}; lazy_static! { - static ref BAD_STATUSES: [u32; 2] = [401, 429]; static ref RE_IP: Regex = Regex::new(r"^(\S+)\s").unwrap(); static ref RE_STATUS: Regex = Regex::new(r"(\d+)\s(\w+)$").unwrap(); } #[allow(clippy::bind_instead_of_map)] -pub fn parse(line: &str) -> Result { +pub fn parse(line: &str, valid_statuses: &[u32]) -> Result { let ip = RE_IP .captures(line) .and_then(|c| c.get(1)) @@ -26,9 +25,8 @@ pub fn parse(line: &str) -> Result { .and_then(|e| e.parse::().ok()) .ok_or_else(|| anyhow!("cant parse clf line - status"))?; - let is_bad_status = BAD_STATUSES.iter().any(|s| s == &status); - - if is_bad_status { + let is_good_status = valid_statuses.iter().any(|s| s == &status); + if !is_good_status { return Ok(ParsingStatus::BadEntry(ip)); } @@ -47,7 +45,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e).unwrap(); + let ret = parse(*e, &vec![200, 404]).unwrap(); match ret { ParsingStatus::BadEntry(_) => {} _ => panic!("bad parsing"), @@ -63,7 +61,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e).unwrap(); + let ret = parse(*e, &vec![200, 404]).unwrap(); match ret { ParsingStatus::OkEntry => {} _ => panic!("bad parsing"), @@ -79,7 +77,7 @@ mod tests { ]; vectors.iter().for_each(|e| { - let ret = parse(*e); + let ret = parse(*e, &vec![200, 404]); assert!(ret.is_err()); }) } diff --git a/src/generic.rs b/src/generic.rs new file mode 100644 index 0000000..86da75a --- /dev/null +++ b/src/generic.rs @@ -0,0 +1,83 @@ +use crate::utils::ParsingStatus; +use anyhow::*; +use regex::Regex; +use std::{net::IpAddr, str::FromStr}; + +#[allow(clippy::bind_instead_of_map)] +pub fn parse( + line: &str, + ip: Option<&Regex>, + positive: Option<&String>, + negative: Option<&String>, +) -> Result { + if let Some(ne) = negative { + if line.contains(ne) { + return Ok(ParsingStatus::OkEntry); + } + } + + if let Some(po) = positive { + if !line.contains(po) { + return Ok(ParsingStatus::OkEntry); + } + } + + let ip = ip.unwrap().captures(line); + + let ip = ip + .and_then(|c| c.get(1)) + .and_then(|g| Some(g.as_str())) + .and_then(|e| IpAddr::from_str(e).ok()) + .ok_or_else(|| anyhow!("cant parse clf line - ip"))?; + + Ok(ParsingStatus::BadEntry(ip)) +} + +#[cfg(test)] +mod tests { + use super::*; + + const FAILED: &str = + "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195 port 41883 ssh2"; + + const SUCCESS: &str = + "Sep 26 06:25:19 livecompute sshd[23246]: Successful login for root from 179.124.36.195 port 41883 ssh2"; + + // generic log positive regex - what's that's flagged by this is considered bad, the rest is good + #[test] + fn positive() { + let positive = "Failed password".to_string(); + let ip = Regex::new(r"from ([0-9a-fA-F:.]+) port").unwrap(); + + let ret = parse(FAILED, Some(&ip), Some(&positive), None).unwrap(); + match ret { + ParsingStatus::BadEntry(_) => {} + _ => panic!("bad parsing"), + } + + let ret = parse(SUCCESS, Some(&ip), Some(&positive), None).unwrap(); + match ret { + ParsingStatus::OkEntry => {} + _ => panic!("bad parsing"), + } + } + + // generic log negative regex - what's that's flagged by this is considered good, the rest is bad + #[test] + fn negative() { + let negative = "Successful login".to_string(); + let ip = Regex::new(r"from ([0-9a-fA-F:.]+) port").unwrap(); + + let ret = parse(SUCCESS, Some(&ip), None, Some(&negative)).unwrap(); + match ret { + ParsingStatus::OkEntry => {} + _ => panic!("bad parsing"), + } + + let ret = parse(FAILED, Some(&ip), None, Some(&negative)).unwrap(); + match ret { + ParsingStatus::BadEntry(_) => {} + _ => panic!("bad parsing"), + } + } +} diff --git a/src/jail.rs b/src/jail.rs index ba77f9d..4246c1b 100644 --- a/src/jail.rs +++ b/src/jail.rs @@ -48,7 +48,7 @@ impl Jail { }) } - pub fn sentence(&self, ip: IpAddr, target: &str) -> Result<()> { + pub fn sentence(&self, ip: IpAddr) -> Result { let now = get_epoch(); let should_ban = { @@ -57,7 +57,8 @@ impl Jail { let (hits, _ts) = *locked_map .entry(ip) .and_modify(|(hits, ts)| { - if *ts + self.jailtime as u64 > now { // reset if we have a hit, but past the defined jailtime + if now > *ts + self.jailtime as u64 { + // reset if we have a hit, but past the defined jailtime *ts = now; *hits = 1; } else { @@ -65,21 +66,20 @@ impl Jail { } }) .or_insert((1, now)); - if hits < self.allowance { false } else { - locked_map.remove_entry(&ip); // preserve space + locked_map.remove_entry(&ip); true } }; if should_ban { - log!("{} jailtime for: {}", target, ip); let cmd = format!("ipset add -exist {} {}", self.name, ip); exec(&cmd, "")?; + return Ok(true); } - Ok(()) + Ok(false) } } diff --git a/src/json.rs b/src/json.rs new file mode 100644 index 0000000..5752fb9 --- /dev/null +++ b/src/json.rs @@ -0,0 +1,75 @@ +use crate::utils::ParsingStatus; +use anyhow::*; +use std::{net::IpAddr, str::FromStr}; + +pub fn parse(line: &str, valid_statuses: &[u32]) -> Result { + let json: serde_json::Value = serde_json::from_str(line)?; + + let remote_ip = json + .get("request") + .and_then(|r| r.get("remote_ip")) + .and_then(|r| r.as_str()) + .and_then(|r| IpAddr::from_str(r).ok()) + .ok_or_else(|| anyhow!("cant parse json line - remote_ip"))?; + + let status = json + .get("status") + .and_then(|r| r.as_u64()) + .ok_or_else(|| anyhow!("cant parse json line - status"))?; + + let is_good_status = valid_statuses.iter().any(|s| s == &(status as u32)); + if !is_good_status { + return Ok(ParsingStatus::BadEntry(remote_ip)); + } + + Ok(ParsingStatus::OkEntry) +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn positive() { + let vectors = [ + r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":429,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#, + r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":401,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#, + ]; + + vectors.iter().for_each(|e| { + let ret = parse(*e, &vec![200, 404]).unwrap(); + match ret { + ParsingStatus::BadEntry(_) => {} + _ => panic!("bad parsing"), + } + }) + } + + #[test] + fn negative() { + let vectors = [ + r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":200,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#, + r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":404,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#, + ]; + + vectors.iter().for_each(|e| { + let ret = parse(*e, &vec![200, 404]).unwrap(); + match ret { + ParsingStatus::OkEntry => {} + _ => panic!("bad parsing"), + } + }) + } + + #[test] + fn malformed() { + let vectors = [ + r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","requeto":"HTTP/1 x86_64; rv:133.0)"],"Server":["Caddy"]}}"#, + ]; + + vectors.iter().for_each(|e| { + let ret = parse(*e, &vec![200, 404]); + assert!(ret.is_err()); + }) + } +} diff --git a/src/main.rs b/src/main.rs index 1700d1a..b51e00a 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1,10 +1,12 @@ -use std::path::PathBuf; use std::result::Result::Ok; use anyhow::*; +use clap::Parser; use linemux::{Line, MuxedLines}; mod clf; +mod generic; +mod json; mod sshd; mod utils; @@ -13,48 +15,91 @@ use crate::jail::Jail; use crate::utils::*; async fn run() -> Result<()> { - let args = utils::cli().get_matches(); + let args = utils::Args::parse(); let mut ml = MuxedLines::new()?; - // jail - let jailtime_str = args.value_of("jailtime").unwrap_or(""); - let jailtime = jailtime_str.parse().context("parsing jailtime")?; - - let allowance_str = args.value_of("allowance").unwrap_or(""); - let allowance = allowance_str.parse().context("parsing allowance")?; - - let jail = Jail::new(allowance, jailtime)?; + // generic parser + let generic_path = args.generic_logpath.as_ref(); + let generic_ip_re = args.generic_ip.as_ref(); + let generic_positive = args.generic_positive.as_ref(); + let generic_negative = args.generic_negative.as_ref(); + if args.generic_ip.is_some() + || args.generic_logpath.is_some() + || args.generic_positive.is_some() + || args.generic_negative.is_some() + { + if args.generic_ip.is_none() || args.generic_logpath.is_none() { + bail!("generic parser needs both ip regex and log file path"); + } + if !(args.generic_positive.is_some() ^ args.generic_negative.is_some()) { + bail!("generic parser requires either a positive or a negative regex"); + } + if let Some(p) = generic_path.as_ref() { + ml.add_file(&p).await?; + log!("starting with generic parsing at {:?}", &p); + } + } // sshd - let mut path_sshd: PathBuf = args.value_of("sshd_logpath").unwrap_or("").into(); - if path_sshd.exists() { - path_sshd = std::fs::canonicalize(path_sshd)?; - ml.add_file(&path_sshd).await?; - log!("starting with sshd parsing at {:?}", &path_sshd); + let sshd_logpath = args.sshd_logpath.as_ref(); + if let Some(p) = sshd_logpath { + ml.add_file(&p).await?; + log!("starting with sshd parsing at {:?}", &p); } // common log format - let mut path_clf: PathBuf = args.value_of("clf_logpath").unwrap_or("").into(); - if path_clf.exists() { - path_clf = std::fs::canonicalize(path_clf)?; - ml.add_file(&path_clf).await?; - log!("starting with clf parsing at {:?}", &path_clf); + let clf_logpath = args.clf_logpath.as_ref(); + if let Some(p) = clf_logpath { + ml.add_file(&p).await?; + log!("starting with clf parsing at {:?}", &p); } + // json + let json_logpath = args.json_logpath.as_ref(); + if let Some(p) = json_logpath { + ml.add_file(&p).await?; + log!("starting with json parsing at {:?}", &p); + } + + if json_logpath.is_none() && clf_logpath.is_none() && sshd_logpath.is_none() { + bail!("no log files to parse, see --help"); + } + + // HTTP statuses + let ok_statuses = args.valid_http_statuses.clone(); + let ok_statuses_ref = ok_statuses.as_ref(); + + // jail + let jail = Jail::new(args.allowance, args.jailtime)?; + let assess_line = |line: Line| { let payload = line.line(); - let path = line.source(); + let path_buf = Some(line.source().to_path_buf()); + let path = path_buf.as_ref(); - let (target, ret) = if path == path_sshd { + let (target, ret) = if path == sshd_logpath { ("sshd", sshd::parse(payload)?) - } else if path == path_clf { - ("clf", clf::parse(payload)?) + } else if path == clf_logpath { + ("clf", clf::parse(payload, ok_statuses_ref)?) + } else if path == json_logpath { + ("json", json::parse(payload, ok_statuses_ref)?) + } else if path == generic_path { + ( + "generic", + generic::parse(payload, generic_ip_re, generic_positive, generic_negative)?, + ) } else { - bail!("file {:?} unknown", path) + bail!("file {:?} unknown ?", path) }; if let ParsingStatus::BadEntry(ip) = ret { - jail.sentence(ip, target)?; + if args.verbose { + log!("{} logged offence for {}", target, ip); + } + let banned = jail.sentence(ip)?; + if banned { + log!("{} jailtime for {}", target, ip); + } } Ok(()) @@ -73,6 +118,5 @@ async fn run() -> Result<()> { async fn main() -> Result<()> { run().await?; eprintln!("\n"); - let _ = utils::cli().print_help(); Ok(()) } diff --git a/src/utils.rs b/src/utils.rs index 44c78ea..0a7a960 100644 --- a/src/utils.rs +++ b/src/utils.rs @@ -1,5 +1,10 @@ -use clap::{App, Arg}; -use std::net::IpAddr; +use anyhow::{anyhow, Context, Result}; +use clap::Parser; +use regex::Regex; +use std::{ + net::IpAddr, + path::{Path, PathBuf}, +}; #[derive(Debug)] pub enum ParsingStatus { @@ -15,57 +20,97 @@ pub fn get_epoch() -> u64 { macro_rules! log{ ($first:expr) => { let ts = crate::utils::get_epoch(); - eprintln!("{} ~ {}", ts, $first); + eprintln!("{} - {}", ts, $first); }; ($first:expr, $($others:expr),+) => { let ts = crate::utils::get_epoch(); let formatted = format!($first, $($others), *); - eprintln!("{} ~ {}", ts, formatted); + eprintln!("{} - {}", ts, formatted); }; } +pub fn resolve_path(a: &str) -> Result { + let p = Path::new(a); + if !p.exists() { + return Err(anyhow!("path {:?} does not exist", p)); + } + let p = std::fs::canonicalize(p)?; + Ok(p) +} + +pub fn parse_regex(a: &str) -> Result { + println!("a {:?}", a); + let r: Regex = Regex::new(a).context("invalid regexp for generic parser")?; + Ok(r) +} + pub(crate) use log; -pub fn cli() -> App<'static, 'static> { - App::new("ban internets scanner fast 🍶") - .version(env!("CARGO_PKG_VERSION")) - .author("pierre dubouilh ") - // .arg(Arg::with_name("prune") - // .short("prune") - // .help("prune current logfiles to prefill banlist") - // .default_value("false") - // .takes_value(true)) - .arg( - Arg::with_name("jailtime") - .short("j") - .help("jail time (seconds)") - .default_value("21600") // 6 hours - .takes_value(true), - ) - .arg( - Arg::with_name("allowance") - .short("a") - .help("how many offences allowed (max 255") - .default_value("5") - .takes_value(true), - ) - .arg( - Arg::with_name("sshd_logpath") - .short("sshd_logpath") - .help("path of sshd logfile (disable with empty path)") - .default_value("/var/log/auth.log") - .takes_value(true), - ) - .arg( - Arg::with_name("clf_logpath") - .short("clf_logpath") - .help("path of Common-Log-Format (Apache, etc..) logfile") - .default_value("") - .takes_value(true), - ) - // .arg(Arg::with_name("clf_bad_http_codes") - // .short("cb") - // .help("bad http statuses for CLF") - // .default_value([401, 429]) - // .takes_value(true)) +#[derive(Parser, Debug)] +#[command( + name = "Blockfast", + author = "pierre dubouilh ", + arg_required_else_help = true, + version, + long_about = None, + about = " +Blockfast - block internets scanners fast 🍶 +Author: pierre dubouilh + +Blockfast reads logs from various sources and blocks the offending IPs using iptables and ipset. +It supports logs from sshd, Common-Log-Format (Apache, etc..), JSON (Caddy) and a generic logs parser. + +Example: + # block invalid sshd attempts & invalid http statuses from caddy + ./blockfast -s=/var/log/auth.log -j=/caddy/logs + + # generic log parser example with a positive text, and a regex to parse the offending IP. + ./blockfast --generic-logpath=/tmp/generictest --generic-positive='Failed password' --generic-ip='from ([0-9a-fA-F:.]+) port'", + verbatim_doc_comment, +)] + +pub struct Args { + /// jail time (seconds) + #[clap(long, default_value = "21600")] + pub jailtime: u32, + + /// how many offences allowed (max 255) + #[clap(long, default_value = "5")] + pub allowance: u8, + + /// log all offences + #[clap(short, long)] + pub verbose: bool, + + /// path of sshd logfile + #[clap(short, long, value_parser = resolve_path)] + pub sshd_logpath: Option, + + /// path of Common-Log-Format logfile (Apache, etc..) + #[clap(short, long, value_parser = resolve_path)] + pub clf_logpath: Option, + + /// path of JSON logfile (works with Caddy) + #[clap(short, long, value_parser = resolve_path)] + pub json_logpath: Option, + + /// generic parser log file path + #[clap(long, value_parser = resolve_path)] + pub generic_logpath: Option, + + /// generic parser ip regex + #[clap(long , value_parser = parse_regex)] + pub generic_ip: Option, + + /// generic parser positive - if a logline contains this, it is considered bad, the rest is good + #[clap(long)] + pub generic_positive: Option, + + /// generic parser negative - if a logline contains this, it is considered good, the rest is bad + #[clap(long)] + pub generic_negative: Option, + + /// valid http statuses (for CLF and JSON logs) + #[clap(long, default_values_t = [200,101])] + pub valid_http_statuses: Vec, }