json & generic parser support

also added verbose flag and configurable HTTP statuses
This commit is contained in:
Pierre Dubouilh
2025-02-01 12:15:20 +02:00
parent 9763c1dc7d
commit 61d78a7454
9 changed files with 593 additions and 142 deletions
Generated
+244 -53
View File
@@ -12,12 +12,53 @@ dependencies = [
] ]
[[package]] [[package]]
name = "ansi_term" name = "anstream"
version = "0.12.1" version = "0.6.18"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2" checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
dependencies = [ dependencies = [
"winapi", "anstyle",
"anstyle-parse",
"anstyle-query",
"anstyle-wincon",
"colorchoice",
"is_terminal_polyfill",
"utf8parse",
]
[[package]]
name = "anstyle"
version = "1.0.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
[[package]]
name = "anstyle-parse"
version = "0.2.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
dependencies = [
"utf8parse",
]
[[package]]
name = "anstyle-query"
version = "1.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
dependencies = [
"windows-sys 0.59.0",
]
[[package]]
name = "anstyle-wincon"
version = "3.0.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
dependencies = [
"anstyle",
"once_cell",
"windows-sys 0.59.0",
] ]
[[package]] [[package]]
@@ -26,17 +67,6 @@ version = "1.0.62"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1485d4d2cc45e7b201ee3767015c96faa5904387c9d87c6efdd0fb511f12d305" checksum = "1485d4d2cc45e7b201ee3767015c96faa5904387c9d87c6efdd0fb511f12d305"
[[package]]
name = "atty"
version = "0.2.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
dependencies = [
"hermit-abi",
"libc",
"winapi",
]
[[package]] [[package]]
name = "autocfg" name = "autocfg"
version = "1.1.0" version = "1.1.0"
@@ -58,6 +88,7 @@ dependencies = [
"lazy_static", "lazy_static",
"linemux", "linemux",
"regex", "regex",
"serde_json",
"tokio", "tokio",
] ]
@@ -75,19 +106,50 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]] [[package]]
name = "clap" name = "clap"
version = "2.34.0" version = "4.5.27"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c" checksum = "769b0145982b4b48713e01ec42d61614425f27b7058bda7180a3a41f30104796"
dependencies = [ dependencies = [
"ansi_term", "clap_builder",
"atty", "clap_derive",
"bitflags",
"strsim",
"textwrap",
"unicode-width",
"vec_map",
] ]
[[package]]
name = "clap_builder"
version = "4.5.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1b26884eb4b57140e4d2d93652abfa49498b938b3c9179f9fc487b0acc3edad7"
dependencies = [
"anstream",
"anstyle",
"clap_lex",
"strsim",
]
[[package]]
name = "clap_derive"
version = "4.5.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "54b755194d6389280185988721fffba69495eed5ee9feeee9a599b53db80318c"
dependencies = [
"heck",
"proc-macro2",
"quote",
"syn 2.0.96",
]
[[package]]
name = "clap_lex"
version = "0.7.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
[[package]]
name = "colorchoice"
version = "1.0.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
[[package]] [[package]]
name = "crossbeam-channel" name = "crossbeam-channel"
version = "0.5.6" version = "0.5.6"
@@ -108,6 +170,12 @@ dependencies = [
"once_cell", "once_cell",
] ]
[[package]]
name = "dtoa"
version = "0.4.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "56899898ce76aaf4a0f24d914c97ea6ed976d42fec6ad33fcbb0a1103e07b2b0"
[[package]] [[package]]
name = "filetime" name = "filetime"
version = "0.2.17" version = "0.2.17"
@@ -117,7 +185,7 @@ dependencies = [
"cfg-if", "cfg-if",
"libc", "libc",
"redox_syscall", "redox_syscall",
"windows-sys", "windows-sys 0.36.1",
] ]
[[package]] [[package]]
@@ -145,6 +213,12 @@ dependencies = [
"slab", "slab",
] ]
[[package]]
name = "heck"
version = "0.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
[[package]] [[package]]
name = "hermit-abi" name = "hermit-abi"
version = "0.1.19" version = "0.1.19"
@@ -174,6 +248,18 @@ dependencies = [
"libc", "libc",
] ]
[[package]]
name = "is_terminal_polyfill"
version = "1.70.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
[[package]]
name = "itoa"
version = "0.3.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8324a32baf01e2ae060e9de58ed0bc2320c9a2833491ee36cd3b4c414de4db8c"
[[package]] [[package]]
name = "kqueue" name = "kqueue"
version = "1.0.6" version = "1.0.6"
@@ -242,7 +328,7 @@ dependencies = [
"libc", "libc",
"log", "log",
"wasi", "wasi",
"windows-sys", "windows-sys 0.36.1",
] ]
[[package]] [[package]]
@@ -262,6 +348,24 @@ dependencies = [
"winapi", "winapi",
] ]
[[package]]
name = "num-traits"
version = "0.1.43"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "92e5113e9fd4cc14ded8e499429f396a20f98c772a47cc8622a736e1ec843c31"
dependencies = [
"num-traits 0.2.19",
]
[[package]]
name = "num-traits"
version = "0.2.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
dependencies = [
"autocfg",
]
[[package]] [[package]]
name = "num_cpus" name = "num_cpus"
version = "1.13.1" version = "1.13.1"
@@ -274,9 +378,9 @@ dependencies = [
[[package]] [[package]]
name = "once_cell" name = "once_cell"
version = "1.13.1" version = "1.20.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "074864da206b4973b84eb91683020dbefd6a8c3f0f38e054d93954e891935e4e" checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
[[package]] [[package]]
name = "pin-project-lite" name = "pin-project-lite"
@@ -292,18 +396,18 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
[[package]] [[package]]
name = "proc-macro2" name = "proc-macro2"
version = "1.0.43" version = "1.0.93"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0a2ca2c61bc9f3d74d2886294ab7b9853abd9c1ad903a3ac7815c58989bb7bab" checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
dependencies = [ dependencies = [
"unicode-ident", "unicode-ident",
] ]
[[package]] [[package]]
name = "quote" name = "quote"
version = "1.0.21" version = "1.0.38"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179" checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
dependencies = [ dependencies = [
"proc-macro2", "proc-macro2",
] ]
@@ -343,6 +447,24 @@ dependencies = [
"winapi-util", "winapi-util",
] ]
[[package]]
name = "serde"
version = "1.0.185"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "be9b6f69f1dfd54c3b568ffa45c310d6973a5e5148fd40cf515acaf38cf5bc31"
[[package]]
name = "serde_json"
version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1c62115693d0a9ed8c32d1c760f0fdbe7d4b05cb13c135b9b54137ac0d59fccb"
dependencies = [
"dtoa",
"itoa",
"num-traits 0.1.43",
"serde",
]
[[package]] [[package]]
name = "slab" name = "slab"
version = "0.4.7" version = "0.4.7"
@@ -354,9 +476,9 @@ dependencies = [
[[package]] [[package]]
name = "strsim" name = "strsim"
version = "0.8.0" version = "0.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a" checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
[[package]] [[package]]
name = "syn" name = "syn"
@@ -370,12 +492,14 @@ dependencies = [
] ]
[[package]] [[package]]
name = "textwrap" name = "syn"
version = "0.11.0" version = "2.0.96"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060" checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
dependencies = [ dependencies = [
"unicode-width", "proc-macro2",
"quote",
"unicode-ident",
] ]
[[package]] [[package]]
@@ -401,7 +525,7 @@ checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
dependencies = [ dependencies = [
"proc-macro2", "proc-macro2",
"quote", "quote",
"syn", "syn 1.0.99",
] ]
[[package]] [[package]]
@@ -411,16 +535,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c4f5b37a154999a8f3f98cc23a628d850e154479cd94decf3414696e12e31aaf" checksum = "c4f5b37a154999a8f3f98cc23a628d850e154479cd94decf3414696e12e31aaf"
[[package]] [[package]]
name = "unicode-width" name = "utf8parse"
version = "0.1.9" version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
[[package]]
name = "vec_map"
version = "0.8.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
[[package]] [[package]]
name = "walkdir" name = "walkdir"
@@ -476,39 +594,112 @@ version = "0.36.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2" checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
dependencies = [ dependencies = [
"windows_aarch64_msvc", "windows_aarch64_msvc 0.36.1",
"windows_i686_gnu", "windows_i686_gnu 0.36.1",
"windows_i686_msvc", "windows_i686_msvc 0.36.1",
"windows_x86_64_gnu", "windows_x86_64_gnu 0.36.1",
"windows_x86_64_msvc", "windows_x86_64_msvc 0.36.1",
] ]
[[package]]
name = "windows-sys"
version = "0.59.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
dependencies = [
"windows-targets",
]
[[package]]
name = "windows-targets"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
dependencies = [
"windows_aarch64_gnullvm",
"windows_aarch64_msvc 0.52.6",
"windows_i686_gnu 0.52.6",
"windows_i686_gnullvm",
"windows_i686_msvc 0.52.6",
"windows_x86_64_gnu 0.52.6",
"windows_x86_64_gnullvm",
"windows_x86_64_msvc 0.52.6",
]
[[package]]
name = "windows_aarch64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
[[package]] [[package]]
name = "windows_aarch64_msvc" name = "windows_aarch64_msvc"
version = "0.36.1" version = "0.36.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47" checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
[[package]]
name = "windows_aarch64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
[[package]] [[package]]
name = "windows_i686_gnu" name = "windows_i686_gnu"
version = "0.36.1" version = "0.36.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6" checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
[[package]]
name = "windows_i686_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
[[package]]
name = "windows_i686_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
[[package]] [[package]]
name = "windows_i686_msvc" name = "windows_i686_msvc"
version = "0.36.1" version = "0.36.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024" checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
[[package]]
name = "windows_i686_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
[[package]] [[package]]
name = "windows_x86_64_gnu" name = "windows_x86_64_gnu"
version = "0.36.1" version = "0.36.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1" checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
[[package]]
name = "windows_x86_64_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
[[package]]
name = "windows_x86_64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
[[package]] [[package]]
name = "windows_x86_64_msvc" name = "windows_x86_64_msvc"
version = "0.36.1" version = "0.36.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680" checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
[[package]]
name = "windows_x86_64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+2 -1
View File
@@ -11,5 +11,6 @@ linemux = "0.2"
tokio = { version = "1", features = ["rt-multi-thread", "macros"] } tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
lazy_static = "1.4.0" lazy_static = "1.4.0"
regex = "1.5.4" regex = "1.5.4"
clap = "2.33.3"
anyhow = "1.0.44" anyhow = "1.0.44"
serde_json = "=1.0.1"
clap = { version = "4.5.27", features = ["derive"] }
+15 -1
View File
@@ -6,7 +6,9 @@ build::
run:: run::
touch /tmp/sshdtest touch /tmp/sshdtest
touch /tmp/clftest touch /tmp/clftest
cargo run -- -s=/tmp/sshdtest -c=/tmp/clftest touch /tmp/jsontest
touch /tmp/generictest
cargo run -- -v -s=/tmp/sshdtest -c=/tmp/clftest -j=/tmp/jsontest --generic-logpath=/tmp/generictest --generic-ip='from ([0-9a-fA-F:.]+) port' --generic-positive='Failed password'
ci:: test ci:: test
cargo fmt --all -- --check cargo fmt --all -- --check
@@ -33,9 +35,21 @@ hit-sshd::
ok-sshd:: ok-sshd::
echo "Sep 26 06:25:19 livecompute sshd[23246]: successful login 8.124.36.195 port 41883 ssh2" >> /tmp/sshdtest echo "Sep 26 06:25:19 livecompute sshd[23246]: successful login 8.124.36.195 port 41883 ssh2" >> /tmp/sshdtest
hit-generic::
echo "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195 port 41883 ssh2" >> /tmp/generictest
ok-generic::
echo "Sep 26 06:25:19 livecompute sshd[23246]: Successful login for root from 179.124.36.195 port 41883 ssh2" >> /tmp/generictest
hit-clf:: hit-clf::
echo "1.124.36.195 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 401 923" >> /tmp/clftest echo "1.124.36.195 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 401 923" >> /tmp/clftest
ok-clf:: ok-clf::
echo "2.124.36.195 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 200 23012" >> /tmp/clftest echo "2.124.36.195 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 200 23012" >> /tmp/clftest
hit-json::
echo "{\"request\":{\"remote_ip\":\"1.124.36.19\"}, \"status\": 400}" >> /tmp/jsontest
ok-json::
echo "{\"request\":{\"remote_ip\":\"2.124.36.19\"}, \"status\": 200}" >> /tmp/jsontest
+6 -8
View File
@@ -5,13 +5,12 @@ use regex::Regex;
use std::{net::IpAddr, str::FromStr}; use std::{net::IpAddr, str::FromStr};
lazy_static! { lazy_static! {
static ref BAD_STATUSES: [u32; 2] = [401, 429];
static ref RE_IP: Regex = Regex::new(r"^(\S+)\s").unwrap(); static ref RE_IP: Regex = Regex::new(r"^(\S+)\s").unwrap();
static ref RE_STATUS: Regex = Regex::new(r"(\d+)\s(\w+)$").unwrap(); static ref RE_STATUS: Regex = Regex::new(r"(\d+)\s(\w+)$").unwrap();
} }
#[allow(clippy::bind_instead_of_map)] #[allow(clippy::bind_instead_of_map)]
pub fn parse(line: &str) -> Result<ParsingStatus> { pub fn parse(line: &str, valid_statuses: &[u32]) -> Result<ParsingStatus> {
let ip = RE_IP let ip = RE_IP
.captures(line) .captures(line)
.and_then(|c| c.get(1)) .and_then(|c| c.get(1))
@@ -26,9 +25,8 @@ pub fn parse(line: &str) -> Result<ParsingStatus> {
.and_then(|e| e.parse::<u32>().ok()) .and_then(|e| e.parse::<u32>().ok())
.ok_or_else(|| anyhow!("cant parse clf line - status"))?; .ok_or_else(|| anyhow!("cant parse clf line - status"))?;
let is_bad_status = BAD_STATUSES.iter().any(|s| s == &status); let is_good_status = valid_statuses.iter().any(|s| s == &status);
if !is_good_status {
if is_bad_status {
return Ok(ParsingStatus::BadEntry(ip)); return Ok(ParsingStatus::BadEntry(ip));
} }
@@ -47,7 +45,7 @@ mod tests {
]; ];
vectors.iter().for_each(|e| { vectors.iter().for_each(|e| {
let ret = parse(*e).unwrap(); let ret = parse(*e, &vec![200, 404]).unwrap();
match ret { match ret {
ParsingStatus::BadEntry(_) => {} ParsingStatus::BadEntry(_) => {}
_ => panic!("bad parsing"), _ => panic!("bad parsing"),
@@ -63,7 +61,7 @@ mod tests {
]; ];
vectors.iter().for_each(|e| { vectors.iter().for_each(|e| {
let ret = parse(*e).unwrap(); let ret = parse(*e, &vec![200, 404]).unwrap();
match ret { match ret {
ParsingStatus::OkEntry => {} ParsingStatus::OkEntry => {}
_ => panic!("bad parsing"), _ => panic!("bad parsing"),
@@ -79,7 +77,7 @@ mod tests {
]; ];
vectors.iter().for_each(|e| { vectors.iter().for_each(|e| {
let ret = parse(*e); let ret = parse(*e, &vec![200, 404]);
assert!(ret.is_err()); assert!(ret.is_err());
}) })
} }
+83
View File
@@ -0,0 +1,83 @@
use crate::utils::ParsingStatus;
use anyhow::*;
use regex::Regex;
use std::{net::IpAddr, str::FromStr};
#[allow(clippy::bind_instead_of_map)]
pub fn parse(
line: &str,
ip: Option<&Regex>,
positive: Option<&String>,
negative: Option<&String>,
) -> Result<ParsingStatus> {
if let Some(ne) = negative {
if line.contains(ne) {
return Ok(ParsingStatus::OkEntry);
}
}
if let Some(po) = positive {
if !line.contains(po) {
return Ok(ParsingStatus::OkEntry);
}
}
let ip = ip.unwrap().captures(line);
let ip = ip
.and_then(|c| c.get(1))
.and_then(|g| Some(g.as_str()))
.and_then(|e| IpAddr::from_str(e).ok())
.ok_or_else(|| anyhow!("cant parse clf line - ip"))?;
Ok(ParsingStatus::BadEntry(ip))
}
#[cfg(test)]
mod tests {
use super::*;
const FAILED: &str =
"Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195 port 41883 ssh2";
const SUCCESS: &str =
"Sep 26 06:25:19 livecompute sshd[23246]: Successful login for root from 179.124.36.195 port 41883 ssh2";
// generic log positive regex - what's that's flagged by this is considered bad, the rest is good
#[test]
fn positive() {
let positive = "Failed password".to_string();
let ip = Regex::new(r"from ([0-9a-fA-F:.]+) port").unwrap();
let ret = parse(FAILED, Some(&ip), Some(&positive), None).unwrap();
match ret {
ParsingStatus::BadEntry(_) => {}
_ => panic!("bad parsing"),
}
let ret = parse(SUCCESS, Some(&ip), Some(&positive), None).unwrap();
match ret {
ParsingStatus::OkEntry => {}
_ => panic!("bad parsing"),
}
}
// generic log negative regex - what's that's flagged by this is considered good, the rest is bad
#[test]
fn negative() {
let negative = "Successful login".to_string();
let ip = Regex::new(r"from ([0-9a-fA-F:.]+) port").unwrap();
let ret = parse(SUCCESS, Some(&ip), None, Some(&negative)).unwrap();
match ret {
ParsingStatus::OkEntry => {}
_ => panic!("bad parsing"),
}
let ret = parse(FAILED, Some(&ip), None, Some(&negative)).unwrap();
match ret {
ParsingStatus::BadEntry(_) => {}
_ => panic!("bad parsing"),
}
}
}
+6 -6
View File
@@ -48,7 +48,7 @@ impl Jail {
}) })
} }
pub fn sentence(&self, ip: IpAddr, target: &str) -> Result<()> { pub fn sentence(&self, ip: IpAddr) -> Result<bool> {
let now = get_epoch(); let now = get_epoch();
let should_ban = { let should_ban = {
@@ -57,7 +57,8 @@ impl Jail {
let (hits, _ts) = *locked_map let (hits, _ts) = *locked_map
.entry(ip) .entry(ip)
.and_modify(|(hits, ts)| { .and_modify(|(hits, ts)| {
if *ts + self.jailtime as u64 > now { // reset if we have a hit, but past the defined jailtime if now > *ts + self.jailtime as u64 {
// reset if we have a hit, but past the defined jailtime
*ts = now; *ts = now;
*hits = 1; *hits = 1;
} else { } else {
@@ -65,21 +66,20 @@ impl Jail {
} }
}) })
.or_insert((1, now)); .or_insert((1, now));
if hits < self.allowance { if hits < self.allowance {
false false
} else { } else {
locked_map.remove_entry(&ip); // preserve space locked_map.remove_entry(&ip);
true true
} }
}; };
if should_ban { if should_ban {
log!("{} jailtime for: {}", target, ip);
let cmd = format!("ipset add -exist {} {}", self.name, ip); let cmd = format!("ipset add -exist {} {}", self.name, ip);
exec(&cmd, "")?; exec(&cmd, "")?;
return Ok(true);
} }
Ok(()) Ok(false)
} }
} }
+75
View File
@@ -0,0 +1,75 @@
use crate::utils::ParsingStatus;
use anyhow::*;
use std::{net::IpAddr, str::FromStr};
pub fn parse(line: &str, valid_statuses: &[u32]) -> Result<ParsingStatus> {
let json: serde_json::Value = serde_json::from_str(line)?;
let remote_ip = json
.get("request")
.and_then(|r| r.get("remote_ip"))
.and_then(|r| r.as_str())
.and_then(|r| IpAddr::from_str(r).ok())
.ok_or_else(|| anyhow!("cant parse json line - remote_ip"))?;
let status = json
.get("status")
.and_then(|r| r.as_u64())
.ok_or_else(|| anyhow!("cant parse json line - status"))?;
let is_good_status = valid_statuses.iter().any(|s| s == &(status as u32));
if !is_good_status {
return Ok(ParsingStatus::BadEntry(remote_ip));
}
Ok(ParsingStatus::OkEntry)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn positive() {
let vectors = [
r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":429,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#,
r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":401,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#,
];
vectors.iter().for_each(|e| {
let ret = parse(*e, &vec![200, 404]).unwrap();
match ret {
ParsingStatus::BadEntry(_) => {}
_ => panic!("bad parsing"),
}
})
}
#[test]
fn negative() {
let vectors = [
r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":200,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#,
r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"46884","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"127.0.0.1:8009","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Connection":["keep-alive"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["cross-site"],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"]}},"bytes_read":0,"user_id":"","duration":0.002135063,"size":35133,"status":404,"resp_headers":{"Vary":["Accept, Accept-Encoding"],"Last-Modified":["Tue, 28 Jan 2025 12:40:02 GMT"],"Content-Type":["text/html; charset=utf-8"],"Server":["Caddy"]}}"#,
];
vectors.iter().for_each(|e| {
let ret = parse(*e, &vec![200, 404]).unwrap();
match ret {
ParsingStatus::OkEntry => {}
_ => panic!("bad parsing"),
}
})
}
#[test]
fn malformed() {
let vectors = [
r#"{"level":"info","ts":1738064403.2176833,"logger":"http.log.access.log0","msg":"handled request","requeto":"HTTP/1 x86_64; rv:133.0)"],"Server":["Caddy"]}}"#,
];
vectors.iter().for_each(|e| {
let ret = parse(*e, &vec![200, 404]);
assert!(ret.is_err());
})
}
}
+71 -27
View File
@@ -1,10 +1,12 @@
use std::path::PathBuf;
use std::result::Result::Ok; use std::result::Result::Ok;
use anyhow::*; use anyhow::*;
use clap::Parser;
use linemux::{Line, MuxedLines}; use linemux::{Line, MuxedLines};
mod clf; mod clf;
mod generic;
mod json;
mod sshd; mod sshd;
mod utils; mod utils;
@@ -13,48 +15,91 @@ use crate::jail::Jail;
use crate::utils::*; use crate::utils::*;
async fn run() -> Result<()> { async fn run() -> Result<()> {
let args = utils::cli().get_matches(); let args = utils::Args::parse();
let mut ml = MuxedLines::new()?; let mut ml = MuxedLines::new()?;
// jail // generic parser
let jailtime_str = args.value_of("jailtime").unwrap_or(""); let generic_path = args.generic_logpath.as_ref();
let jailtime = jailtime_str.parse().context("parsing jailtime")?; let generic_ip_re = args.generic_ip.as_ref();
let generic_positive = args.generic_positive.as_ref();
let allowance_str = args.value_of("allowance").unwrap_or(""); let generic_negative = args.generic_negative.as_ref();
let allowance = allowance_str.parse().context("parsing allowance")?; if args.generic_ip.is_some()
|| args.generic_logpath.is_some()
let jail = Jail::new(allowance, jailtime)?; || args.generic_positive.is_some()
|| args.generic_negative.is_some()
{
if args.generic_ip.is_none() || args.generic_logpath.is_none() {
bail!("generic parser needs both ip regex and log file path");
}
if !(args.generic_positive.is_some() ^ args.generic_negative.is_some()) {
bail!("generic parser requires either a positive or a negative regex");
}
if let Some(p) = generic_path.as_ref() {
ml.add_file(&p).await?;
log!("starting with generic parsing at {:?}", &p);
}
}
// sshd // sshd
let mut path_sshd: PathBuf = args.value_of("sshd_logpath").unwrap_or("").into(); let sshd_logpath = args.sshd_logpath.as_ref();
if path_sshd.exists() { if let Some(p) = sshd_logpath {
path_sshd = std::fs::canonicalize(path_sshd)?; ml.add_file(&p).await?;
ml.add_file(&path_sshd).await?; log!("starting with sshd parsing at {:?}", &p);
log!("starting with sshd parsing at {:?}", &path_sshd);
} }
// common log format // common log format
let mut path_clf: PathBuf = args.value_of("clf_logpath").unwrap_or("").into(); let clf_logpath = args.clf_logpath.as_ref();
if path_clf.exists() { if let Some(p) = clf_logpath {
path_clf = std::fs::canonicalize(path_clf)?; ml.add_file(&p).await?;
ml.add_file(&path_clf).await?; log!("starting with clf parsing at {:?}", &p);
log!("starting with clf parsing at {:?}", &path_clf);
} }
// json
let json_logpath = args.json_logpath.as_ref();
if let Some(p) = json_logpath {
ml.add_file(&p).await?;
log!("starting with json parsing at {:?}", &p);
}
if json_logpath.is_none() && clf_logpath.is_none() && sshd_logpath.is_none() {
bail!("no log files to parse, see --help");
}
// HTTP statuses
let ok_statuses = args.valid_http_statuses.clone();
let ok_statuses_ref = ok_statuses.as_ref();
// jail
let jail = Jail::new(args.allowance, args.jailtime)?;
let assess_line = |line: Line| { let assess_line = |line: Line| {
let payload = line.line(); let payload = line.line();
let path = line.source(); let path_buf = Some(line.source().to_path_buf());
let path = path_buf.as_ref();
let (target, ret) = if path == path_sshd { let (target, ret) = if path == sshd_logpath {
("sshd", sshd::parse(payload)?) ("sshd", sshd::parse(payload)?)
} else if path == path_clf { } else if path == clf_logpath {
("clf", clf::parse(payload)?) ("clf", clf::parse(payload, ok_statuses_ref)?)
} else if path == json_logpath {
("json", json::parse(payload, ok_statuses_ref)?)
} else if path == generic_path {
(
"generic",
generic::parse(payload, generic_ip_re, generic_positive, generic_negative)?,
)
} else { } else {
bail!("file {:?} unknown", path) bail!("file {:?} unknown ?", path)
}; };
if let ParsingStatus::BadEntry(ip) = ret { if let ParsingStatus::BadEntry(ip) = ret {
jail.sentence(ip, target)?; if args.verbose {
log!("{} logged offence for {}", target, ip);
}
let banned = jail.sentence(ip)?;
if banned {
log!("{} jailtime for {}", target, ip);
}
} }
Ok(()) Ok(())
@@ -73,6 +118,5 @@ async fn run() -> Result<()> {
async fn main() -> Result<()> { async fn main() -> Result<()> {
run().await?; run().await?;
eprintln!("\n"); eprintln!("\n");
let _ = utils::cli().print_help();
Ok(()) Ok(())
} }
+91 -46
View File
@@ -1,5 +1,10 @@
use clap::{App, Arg}; use anyhow::{anyhow, Context, Result};
use std::net::IpAddr; use clap::Parser;
use regex::Regex;
use std::{
net::IpAddr,
path::{Path, PathBuf},
};
#[derive(Debug)] #[derive(Debug)]
pub enum ParsingStatus { pub enum ParsingStatus {
@@ -15,57 +20,97 @@ pub fn get_epoch() -> u64 {
macro_rules! log{ macro_rules! log{
($first:expr) => { ($first:expr) => {
let ts = crate::utils::get_epoch(); let ts = crate::utils::get_epoch();
eprintln!("{} ~ {}", ts, $first); eprintln!("{} - {}", ts, $first);
}; };
($first:expr, $($others:expr),+) => { ($first:expr, $($others:expr),+) => {
let ts = crate::utils::get_epoch(); let ts = crate::utils::get_epoch();
let formatted = format!($first, $($others), *); let formatted = format!($first, $($others), *);
eprintln!("{} ~ {}", ts, formatted); eprintln!("{} - {}", ts, formatted);
}; };
} }
pub fn resolve_path(a: &str) -> Result<PathBuf> {
let p = Path::new(a);
if !p.exists() {
return Err(anyhow!("path {:?} does not exist", p));
}
let p = std::fs::canonicalize(p)?;
Ok(p)
}
pub fn parse_regex(a: &str) -> Result<Regex> {
println!("a {:?}", a);
let r: Regex = Regex::new(a).context("invalid regexp for generic parser")?;
Ok(r)
}
pub(crate) use log; pub(crate) use log;
pub fn cli() -> App<'static, 'static> { #[derive(Parser, Debug)]
App::new("ban internets scanner fast 🍶") #[command(
.version(env!("CARGO_PKG_VERSION")) name = "Blockfast",
.author("pierre dubouilh <pldubouilh@gmail.com>") author = "pierre dubouilh <pldubouilh@gmail.com>",
// .arg(Arg::with_name("prune") arg_required_else_help = true,
// .short("prune") version,
// .help("prune current logfiles to prefill banlist") long_about = None,
// .default_value("false") about = "
// .takes_value(true)) Blockfast - block internets scanners fast 🍶
.arg( Author: pierre dubouilh <pldubouilh@gmail.com>
Arg::with_name("jailtime")
.short("j") Blockfast reads logs from various sources and blocks the offending IPs using iptables and ipset.
.help("jail time (seconds)") It supports logs from sshd, Common-Log-Format (Apache, etc..), JSON (Caddy) and a generic logs parser.
.default_value("21600") // 6 hours
.takes_value(true), Example:
) # block invalid sshd attempts & invalid http statuses from caddy
.arg( ./blockfast -s=/var/log/auth.log -j=/caddy/logs
Arg::with_name("allowance")
.short("a") # generic log parser example with a positive text, and a regex to parse the offending IP.
.help("how many offences allowed (max 255") ./blockfast --generic-logpath=/tmp/generictest --generic-positive='Failed password' --generic-ip='from ([0-9a-fA-F:.]+) port'",
.default_value("5") verbatim_doc_comment,
.takes_value(true), )]
)
.arg( pub struct Args {
Arg::with_name("sshd_logpath") /// jail time (seconds)
.short("sshd_logpath") #[clap(long, default_value = "21600")]
.help("path of sshd logfile (disable with empty path)") pub jailtime: u32,
.default_value("/var/log/auth.log")
.takes_value(true), /// how many offences allowed (max 255)
) #[clap(long, default_value = "5")]
.arg( pub allowance: u8,
Arg::with_name("clf_logpath")
.short("clf_logpath") /// log all offences
.help("path of Common-Log-Format (Apache, etc..) logfile") #[clap(short, long)]
.default_value("") pub verbose: bool,
.takes_value(true),
) /// path of sshd logfile
// .arg(Arg::with_name("clf_bad_http_codes") #[clap(short, long, value_parser = resolve_path)]
// .short("cb") pub sshd_logpath: Option<PathBuf>,
// .help("bad http statuses for CLF")
// .default_value([401, 429]) /// path of Common-Log-Format logfile (Apache, etc..)
// .takes_value(true)) #[clap(short, long, value_parser = resolve_path)]
pub clf_logpath: Option<PathBuf>,
/// path of JSON logfile (works with Caddy)
#[clap(short, long, value_parser = resolve_path)]
pub json_logpath: Option<PathBuf>,
/// generic parser log file path
#[clap(long, value_parser = resolve_path)]
pub generic_logpath: Option<PathBuf>,
/// generic parser ip regex
#[clap(long , value_parser = parse_regex)]
pub generic_ip: Option<Regex>,
/// generic parser positive - if a logline contains this, it is considered bad, the rest is good
#[clap(long)]
pub generic_positive: Option<String>,
/// generic parser negative - if a logline contains this, it is considered good, the rest is bad
#[clap(long)]
pub generic_negative: Option<String>,
/// valid http statuses (for CLF and JSON logs)
#[clap(long, default_values_t = [200,101])]
pub valid_http_statuses: Vec<u32>,
} }