json & generic parser support

also added verbose flag and configurable HTTP statuses

src/utils.rs

@@ -1,5 +1,10 @@
-use clap::{App, Arg};
-use std::net::IpAddr;
+use anyhow::{anyhow, Context, Result};
+use clap::Parser;
+use regex::Regex;
+use std::{
+    net::IpAddr,
+    path::{Path, PathBuf},
+};
 
 #[derive(Debug)]
 pub enum ParsingStatus {
@@ -15,57 +20,97 @@ pub fn get_epoch() -> u64 {
 macro_rules! log{
     ($first:expr) => {
         let ts = crate::utils::get_epoch();
-        eprintln!("{} ~ {}", ts, $first);
+        eprintln!("{} - {}", ts, $first);
     };
     ($first:expr, $($others:expr),+) => {
         let ts = crate::utils::get_epoch();
         let formatted = format!($first, $($others), *);
-        eprintln!("{} ~ {}", ts, formatted);
+        eprintln!("{} - {}", ts, formatted);
     };
 }
 
+pub fn resolve_path(a: &str) -> Result<PathBuf> {
+    let p = Path::new(a);
+    if !p.exists() {
+        return Err(anyhow!("path {:?} does not exist", p));
+    }
+    let p = std::fs::canonicalize(p)?;
+    Ok(p)
+}
+
+pub fn parse_regex(a: &str) -> Result<Regex> {
+    println!("a {:?}", a);
+    let r: Regex = Regex::new(a).context("invalid regexp for generic parser")?;
+    Ok(r)
+}
+
 pub(crate) use log;
 
-pub fn cli() -> App<'static, 'static> {
-    App::new("ban internets scanner fast 🍶")
-        .version(env!("CARGO_PKG_VERSION"))
-        .author("pierre dubouilh <pldubouilh@gmail.com>")
-        // .arg(Arg::with_name("prune")
-        //     .short("prune")
-        //     .help("prune current logfiles to prefill banlist")
-        //     .default_value("false")
-        //     .takes_value(true))
-        .arg(
-            Arg::with_name("jailtime")
-                .short("j")
-                .help("jail time (seconds)")
-                .default_value("21600") // 6 hours
-                .takes_value(true),
-        )
-        .arg(
-            Arg::with_name("allowance")
-                .short("a")
-                .help("how many offences allowed (max 255")
-                .default_value("5")
-                .takes_value(true),
-        )
-        .arg(
-            Arg::with_name("sshd_logpath")
-                .short("sshd_logpath")
-                .help("path of sshd logfile (disable with empty path)")
-                .default_value("/var/log/auth.log")
-                .takes_value(true),
-        )
-        .arg(
-            Arg::with_name("clf_logpath")
-                .short("clf_logpath")
-                .help("path of Common-Log-Format (Apache, etc..) logfile")
-                .default_value("")
-                .takes_value(true),
-        )
-    // .arg(Arg::with_name("clf_bad_http_codes")
-    //     .short("cb")
-    //     .help("bad http statuses for CLF")
-    //     .default_value([401, 429])
-    //     .takes_value(true))
+#[derive(Parser, Debug)]
+#[command(
+    name = "Blockfast",
+    author = "pierre dubouilh <pldubouilh@gmail.com>",
+    arg_required_else_help = true,
+    version,
+    long_about = None,
+    about = "
+Blockfast - block internets scanners fast 🍶
+Author: pierre dubouilh <pldubouilh@gmail.com>
+
+Blockfast reads logs from various sources and blocks the offending IPs using iptables and ipset.
+It supports logs from sshd, Common-Log-Format (Apache, etc..), JSON (Caddy) and a generic logs parser.
+
+Example:
+    # block invalid sshd attempts & invalid http statuses from caddy
+    ./blockfast -s=/var/log/auth.log -j=/caddy/logs
+
+    # generic log parser example with a positive text, and a regex to parse the offending IP.
+    ./blockfast --generic-logpath=/tmp/generictest --generic-positive='Failed password' --generic-ip='from ([0-9a-fA-F:.]+) port'",
+    verbatim_doc_comment,
+)]
+
+pub struct Args {
+    /// jail time (seconds)
+    #[clap(long, default_value = "21600")]
+    pub jailtime: u32,
+
+    /// how many offences allowed (max 255)
+    #[clap(long, default_value = "5")]
+    pub allowance: u8,
+
+    /// log all offences
+    #[clap(short, long)]
+    pub verbose: bool,
+
+    /// path of sshd logfile
+    #[clap(short, long, value_parser = resolve_path)]
+    pub sshd_logpath: Option<PathBuf>,
+
+    /// path of Common-Log-Format logfile (Apache, etc..)
+    #[clap(short, long, value_parser = resolve_path)]
+    pub clf_logpath: Option<PathBuf>,
+
+    /// path of JSON logfile (works with Caddy)
+    #[clap(short, long, value_parser = resolve_path)]
+    pub json_logpath: Option<PathBuf>,
+
+    /// generic parser log file path
+    #[clap(long, value_parser = resolve_path)]
+    pub generic_logpath: Option<PathBuf>,
+
+    /// generic parser ip regex
+    #[clap(long , value_parser = parse_regex)]
+    pub generic_ip: Option<Regex>,
+
+    /// generic parser positive - if a logline contains this, it is considered bad, the rest is good
+    #[clap(long)]
+    pub generic_positive: Option<String>,
+
+    /// generic parser negative - if a logline contains this, it is considered good, the rest is bad
+    #[clap(long)]
+    pub generic_negative: Option<String>,
+
+    /// valid http statuses (for CLF and JSON logs)
+    #[clap(long, default_values_t = [200,101])]
+    pub valid_http_statuses: Vec<u32>,
 }