first

src/sshd.rs

@@ -0,0 +1,65 @@
+use std::net::IpAddr;
+
+use lazy_static::lazy_static;
+use regex::Regex;
+
+struct Rule {
+    matcher: String,
+    extractor: Regex,
+}
+
+lazy_static! {
+    static ref SSHD_BAD: [Rule; 3] = [
+        Rule {
+            matcher: "Failed password".to_string(),
+            extractor: Regex::new(r"(from.)(.*)(.port)").unwrap(),
+        },
+        Rule {
+            matcher: "Invalid user".to_string(),
+            extractor: Regex::new(r"(from.)(.*)").unwrap(),
+        },
+        Rule {
+            matcher: "authentication failure".to_string(),
+            extractor: Regex::new(r"(rhost=)(.*)").unwrap()
+        },
+    ];
+}
+
+pub fn parse(line: &str) -> Option<IpAddr> {
+    let ret = SSHD_BAD.iter().find_map(|rule| {
+        if line.contains(&rule.matcher) {
+            rule.extractor.captures(line)?.get(2)
+        } else {
+            None
+        }
+    })?;
+
+    ret.as_str().parse::<IpAddr>().ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn positive() {
+        let vectors = [
+            "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195 port 41883 ssh2",
+            "Sep 26 06:26:14 livecompute sshd[23292]: pam_unix(sshd:auth): authentication failure; logname= u =0 tty=ssh ruser= rhost=5.101.107.190",
+            "Sep 26 06:25:32 livecompute sshd[23254]: Invalid user neal from 35.184.211.144"
+        ];
+
+        vectors.iter().for_each(|e| assert!(parse(*e).is_some()))
+    }
+
+    #[test]
+    fn negative() {
+        let vectors = [
+            "Sep 26 06:25:19 livecompute sshd[23246]: successful login 179.124.36.195 port 41883 ssh2",
+            "Sep 26 06:26:14 livecompute sshd[23292]: pam_unix(sshd:auth): authentication total success; logname= u =0 tty=ssh ruser= rhost=5.101.107.190",
+            "Sep 26 06:25:32 livecompute sshd[23254]: very good user neal from 35.184.211.144"
+        ];
+
+        vectors.iter().for_each(|e| assert!(parse(*e).is_none()))
+    }
+}