ci

.github/workflows/rust.yml

@@ -0,0 +1,20 @@
+name: Rust
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Run CI
+      run: make ci

Cargo.lock

@@ -20,12 +20,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "anyhow"
-version = "1.0.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61604a8f862e1d5c3229fdd78f8b02c68dcf73a4c4b05fd636d12240aaa242c1"
-
 [[package]]
 name = "atty"
 version = "0.2.14"
@@ -53,7 +47,6 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 name = "blockfast"
 version = "0.1.0"
 dependencies = [
- "anyhow",
  "clap",
  "lazy_static",
  "linemux",

Cargo.toml

@@ -11,5 +11,4 @@ linemux = "0.2"
 tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
 lazy_static = "1.4.0"
 regex = "1.5.4"
-clap = "2.33.3"
-anyhow = "1.0.44"
+clap = "2.33.3"

README.md

@@ -10,3 +10,4 @@ features:
   - libmusl static release builds, no libc dependency
   - lighter alternative to fail2ban
 
+Todo: more granular CLI args to filter HTTP Status codes (e.g. 5 401 leads to a block, but 30 404 before a block) ?

src/clf.rs

@@ -1,31 +1,28 @@
-use crate::utils::ParsingStatus;
-use anyhow::Result;
-use lazy_static::lazy_static;
 use std::net::IpAddr;
 
+use lazy_static::lazy_static;
+
 // TODO: allow user-provided list
 // TODO: match different error-levels (10 404, but only 5 401, etc...)
 lazy_static! {
-    static ref BAD_STATUSES: [u32; 2] = [401, 429];
+    static ref BAD_STATUSES: [&'static str; 2] = ["401", "429"];
 }
 
-pub fn parse(line: &str) -> Result<ParsingStatus> {
+pub fn parse(line: &str) -> Option<IpAddr> {
     // TODO: Use a proper parser ?
     let elts: Vec<&str> = line.split_whitespace().collect();
+    let ip = elts[0].parse::<IpAddr>().ok();
+    let http_code = elts[elts.len() - 2] as &str;
 
-    let ip_str = elts[0];
-    let ip = ip_str.parse::<IpAddr>()?;
-
-    let http_code_str = elts[elts.len() - 2] as &str;
-    let http_code = http_code_str.parse::<u32>()?;
-
-    for status in BAD_STATUSES.iter() {
-        if *status == http_code {
-            return Ok(ParsingStatus::BadEntry(ip));
-        }
-    }
-
-    Ok(ParsingStatus::OkEntry)
+    BAD_STATUSES.iter().find_map(
+        |bad_status| {
+            if http_code == *bad_status {
+                ip
+            } else {
+                None
+            }
+        },
+    )
 }
 
 #[cfg(test)]
@@ -39,13 +36,7 @@ mod tests {
             "8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 429 923",
         ];
 
-        vectors.iter().for_each(|e| {
-            let ret = parse(*e).unwrap();
-            match ret {
-                ParsingStatus::BadEntry(_) => {}
-                _ => panic!("bad parsing"),
-            }
-        })
+        vectors.iter().for_each(|e| assert!(parse(*e).is_some()))
     }
 
     #[test]
@@ -55,25 +46,6 @@ mod tests {
             "8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 404 923",
         ];
 
-        vectors.iter().for_each(|e| {
-            let ret = parse(*e).unwrap();
-            match ret {
-                ParsingStatus::OkEntry => {}
-                _ => panic!("bad parsing"),
-            }
-        })
-    }
-
-    #[test]
-    fn malformed() {
-        let vectors = [
-            "8.8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 200 923",
-            "8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\"",
-        ];
-
-        vectors.iter().for_each(|e| {
-            let ret = parse(*e);
-            assert!(ret.is_err());
-        })
+        vectors.iter().for_each(|e| assert!(parse(*e).is_none()))
     }
 }

src/jail.rs

@@ -1,26 +1,70 @@
 use std::collections::HashMap;
 use std::net::IpAddr;
+use std::panic::panic_any;
 use std::process::Command;
 use std::sync::Mutex;
 
-use std::ffi::CString;
-
-use anyhow::*;
-
-use crate::utils::JailStatus;
-
 pub struct Jail {
     jailtime: u32,
     allowance: u8,
-    ipset_ptr: *const u8, // opaque C ptr to struct ipset
     remand: Mutex<HashMap<IpAddr, u8>>,
 }
 
-
-const ERR_MSG: &str =
+const JAIL_NAME: &str = "blockfast_jail";
+const GENERAL_PANIC_MSG: &str =
     "error using ipset/iptables, maybe it's not installed, this program isn't running as root ?";
 
-fn ipset_block(jailtime: u32, ip: IpAddr) -> Result<()> {
+fn ipset_init() -> Option<()> {
+    let init0 = format!("ipset create {} hash:ip timeout 0", JAIL_NAME);
+    let init1 = format!(
+        "iptables -I INPUT 1 -m set -j DROP --match-set {} src",
+        JAIL_NAME
+    );
+    let init2 = format!(
+        "iptables -I FORWARD 1 -m set -j DROP --match-set {} src",
+        JAIL_NAME
+    );
+
+    let args0: Vec<&str> = init0.split_whitespace().collect();
+    let args1: Vec<&str> = init1.split_whitespace().collect();
+    let args2: Vec<&str> = init2.split_whitespace().collect();
+
+    // create
+    let out = Command::new("sudo").args(args0).output().ok()?;
+
+    if out.status.code()? != 0 {
+        let already_exists = std::str::from_utf8(&out.stderr)
+            .ok()?
+            .contains("set with the same name already exists");
+
+        if already_exists {
+            return None;
+        } else {
+            eprintln!("{:?}", out);
+            panic_any(GENERAL_PANIC_MSG);
+        }
+    }
+
+    // setup input
+    let out_input = Command::new("sudo").args(args1).output().ok()?;
+
+    if out_input.status.code()? != 0 {
+        eprintln!("{:?}", out_input);
+        panic_any(GENERAL_PANIC_MSG);
+    }
+
+    // setup fwd
+    let out_fwd = Command::new("sudo").args(args2).output().ok()?;
+
+    if out_fwd.status.code()? != 0 {
+        eprintln!("{:?}", out_fwd);
+        panic_any(GENERAL_PANIC_MSG);
+    }
+
+    None
+}
+
+fn ipset_block(jailtime: u32, ip: IpAddr) -> Option<()> {
     let sentence = format!(
         "ipset add {} {} timeout {}",
         JAIL_NAME,
@@ -29,51 +73,36 @@ fn ipset_block(jailtime: u32, ip: IpAddr) -> Result<()> {
     );
     let sentence_sl: Vec<&str> = sentence.split_whitespace().collect();
 
-    let out = Command::new("sudo").args(sentence_sl).output()?;
-    if out.status.code() != Some(0) {
-        eprintln!("{:?}", out);
-        bail!("error executing ipset ban");
+    let out = Command::new("sudo").args(sentence_sl).output().ok()?;
+
+    if out.status.code()? != 0 {
+        return None;
     }
 
-    Ok(())
-}
-
-const JAIL_NAME: &str = "blockfast_jail";
-const IPSET_SETNAME: u32 = 1;
-const IPSET_OPT_FAMILY: u32 = 3;
-const IPSET_OPT_IP: u32 = 4;
-const IPSET_OPT_TIMEOUT: u32 = 10;
-
-
-#[link(name = "ipset")]
-extern "C" {
-    fn ipset_init() -> *const u8; //
-    fn ipset_session_data_set(ipset_struct: *const u8, target: u32, name: CString);
+    Some(())
 }
 
 impl Jail {
-    pub fn new(allowance: u8, jailtime: u32) -> Result<Jail> {
-        let ipset_ptr = unsafe { ipset_init() };
+    pub fn new(allowance: u8, jailtime: u32) -> Jail {
+        if ipset_init().is_some() {
+            panic_any(GENERAL_PANIC_MSG);
+        };
 
-        if ipset_ptr.is_null() {
-            bail!(ERR_MSG);
-        }
+        eprintln!(
+            "+ jail setup, allowing {} offences, jailtime: {}s",
+            allowance, jailtime
+        );
 
-        let JAIL_NAME_C = CString::new("blockfast_thisisatest").unwrap();
-
-        let a = unsafe { ipset_session_data_set(ipset_ptr, IPSET_SETNAME, JAIL_NAME_C) };
-
-        Ok(Jail {
+        Jail {
             allowance,
             jailtime,
-            ipset_ptr,
             remand: Mutex::new(HashMap::new()),
-        })
+        }
     }
 
-    pub fn probe(&self, ip: IpAddr) -> Result<JailStatus> {
+    pub fn probe(&self, ip: IpAddr) -> Option<()> {
         let should_ban = {
-            let mut locked_map = self.remand.lock().map_err(|_| anyhow!("cant lock"))?;
+            let mut locked_map = self.remand.lock().ok()?;
 
             // TODO: set time of last offence, and add grace
             let hits = *locked_map.entry(ip).and_modify(|e| *e += 1).or_insert(1);
@@ -87,10 +116,12 @@ impl Jail {
         };
 
         if should_ban {
-            ipset_block(self.jailtime, ip)?;
-            Ok(JailStatus::Jailed(ip))
-        } else {
-            Ok(JailStatus::Remand)
+            match ipset_block(self.jailtime, ip) {
+                Some(_) => eprintln!("~ {} going to jail", ip),
+                None => eprintln!("! ERR {} going to jail", ip),
+            }
         }
+
+        None
     }
 }

src/main.rs

@@ -1,4 +1,3 @@
-use anyhow::*;
 use linemux::MuxedLines;
 
 mod clf;
@@ -7,68 +6,29 @@ mod utils;
 
 mod jail;
 use crate::jail::Jail;
-use crate::utils::*;
 
-fn judge(
-    path_sshd: &str,
-    path_clf: &str,
-    payload: &str,
-    path: &str,
-    jail: &Jail,
-) -> Result<Judgment> {
-    let do_sshd = !path_sshd.is_empty();
-    let do_clf = !path_clf.is_empty();
-    let mut target = "";
-
-    let ret_parse = if do_sshd && path.ends_with(path_sshd) {
-        target = "sshd";
-        sshd::parse(payload)
-    } else if do_clf && path.ends_with(path_clf) {
-        target = "clf ";
-        clf::parse(payload)
-    } else {
-        Err(anyhow!("cant locate file !"))
-    };
-
-    let ip = match ret_parse? {
-        ParsingStatus::OkEntry => return Ok(Judgment::Good),
-        ParsingStatus::BadEntry(ip) => ip,
-    };
-
-    match jail.probe(ip)? {
-        JailStatus::Remand => Ok(Judgment::Remand),
-        JailStatus::Jailed(ip) => Ok(Judgment::Bad(target, ip)),
-    }
-}
-
-async fn run() -> Result<()> {
+async fn run() -> Option<()> {
     let args = utils::cli().get_matches();
-    let mut lines = MuxedLines::new().context("parsing cli args")?;
+    let mut lines = MuxedLines::new().ok()?;
 
     // jail
-    let jailtime_str = args.value_of("jailtime").unwrap_or("");
-    let jailtime = jailtime_str.parse().context("parsing jailtime")?;
-
-    let allowance_str = args.value_of("allowance").unwrap_or("");
-    let allowance = allowance_str.parse().context("parsing allowance")?;
-
-    let jail = Jail::new(allowance, jailtime).context("init jail")?;
-    eprintln!(
-        "+ jail setup, offences allowed: {}, jailtime {}s",
-        allowance, jailtime
-    );
+    let jailtime: u32 = args.value_of("jailtime")?.parse().ok()?;
+    let allowance: u8 = args.value_of("allowance")?.parse().ok()?;
+    let jail = Jail::new(allowance, jailtime);
 
     // sshd
     let path_sshd = args.value_of("sshd_logpath").unwrap_or("");
-    if !path_sshd.is_empty() {
-        lines.add_file(path_sshd).await?;
+    let do_sshd = !path_sshd.is_empty();
+    if do_sshd {
+        lines.add_file(path_sshd).await.ok()?;
         eprintln!("+ starting with sshd parsing at {}", path_sshd);
     }
 
     // common log format
     let path_clf = args.value_of("clf_logpath").unwrap_or("");
-    if !path_clf.is_empty() {
-        lines.add_file(path_clf).await.context("opening log file")?;
+    let do_clf = !path_clf.is_empty();
+    if do_clf {
+        lines.add_file(path_clf).await.ok()?;
         eprintln!("+ starting with clf parsing at {}", path_clf);
     }
 
@@ -76,24 +36,22 @@ async fn run() -> Result<()> {
         let payload = line.line();
         let path = line.source().display().to_string();
 
-        match judge(path_sshd, path_clf, payload, &path, &jail) {
-            Err(err) => eprintln!("! ERR {:?} - file {}", err, path),
-            Ok(Judgment::Good) => {}
-            Ok(Judgment::Remand) => {}
-            Ok(Judgment::Bad(target, ip)) => {
-                eprintln!("~ {} jailtime for: {}", target, ip)
-            }
-        };
+        if do_sshd && path.ends_with(path_sshd) {
+            sshd::parse(payload).and_then(|ip| jail.probe(ip));
+        } else if do_clf && path.ends_with(path_clf) {
+            clf::parse(payload).and_then(|ip| jail.probe(ip));
+        } else {
+            eprintln!("! unknown logline: {}", path);
+        }
     }
 
-    Ok(())
+    Some(())
 }
 
 #[tokio::main]
-async fn main() -> Result<()> {
-    let ret = run().await;
-    let _ = ret.map_err(|e| eprintln!("! ERROR {:?}", e));
-    eprintln!("\n");
+async fn main() -> std::io::Result<()> {
+    let _ = run().await;
+    eprintln!("! ERR");
     let _ = utils::cli().print_help();
     Ok(())
 }

src/sshd.rs

@@ -1,10 +1,7 @@
-use anyhow::*;
+use std::net::IpAddr;
+
 use lazy_static::lazy_static;
 use regex::Regex;
-use std::net::IpAddr;
-use std::str::FromStr;
-
-use crate::utils::ParsingStatus;
 
 struct Rule {
     matcher: String,
@@ -18,7 +15,7 @@ lazy_static! {
             extractor: Regex::new(r"(from.)(.*)(.port)").unwrap(),
         },
         Rule {
-            matcher: "Invalid user ".to_string(),
+            matcher: "Invalid user".to_string(),
             extractor: Regex::new(r"(from.)(.*)").unwrap(),
         },
         Rule {
@@ -28,28 +25,16 @@ lazy_static! {
     ];
 }
 
-pub fn parse(line: &str) -> Result<ParsingStatus> {
-    let hits = SSHD_BAD.iter().find_map(|rule| {
+pub fn parse(line: &str) -> Option<IpAddr> {
+    let ret = SSHD_BAD.iter().find_map(|rule| {
         if line.contains(&rule.matcher) {
-            rule.extractor.captures(line)
+            rule.extractor.captures(line)?.get(2)
         } else {
             None
         }
-    });
+    })?;
 
-    if hits.is_none() {
-        return Ok(ParsingStatus::OkEntry);
-    }
-
-    let ip = hits
-        .and_then(|c| c.get(2))
-        .and_then(|m| Some(m.as_str()))
-        .ok_or(anyhow!("sshd cant extract ip"))?;
-
-    match IpAddr::from_str(ip) {
-        Ok(ip) => Ok(ParsingStatus::BadEntry(ip)),
-        Err(_) => Err(anyhow!("cant parse sshd entry")),
-    }
+    ret.as_str().parse::<IpAddr>().ok()
 }
 
 #[cfg(test)]
@@ -64,13 +49,7 @@ mod tests {
             "Sep 26 06:25:32 livecompute sshd[23254]: Invalid user neal from 35.184.211.144"
         ];
 
-        vectors.iter().for_each(|e| {
-            let ret = parse(*e).unwrap();
-            match ret {
-                ParsingStatus::BadEntry(_) => {}
-                _ => panic!("bad parsing"),
-            }
-        })
+        vectors.iter().for_each(|e| assert!(parse(*e).is_some()))
     }
 
     #[test]
@@ -81,25 +60,6 @@ mod tests {
             "Sep 26 06:25:32 livecompute sshd[23254]: very good user neal from 35.184.211.144"
         ];
 
-        vectors.iter().for_each(|e| {
-            let ret = parse(*e).unwrap();
-            match ret {
-                ParsingStatus::OkEntry => {}
-                _ => panic!("bad parsing"),
-            }
-        })
-    }
-
-    #[test]
-    fn malformed() {
-        let vectors = [
-            "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195.232 port 41883 ssh2",
-            "Sep 26 06:26:14 livecompute sshd[23292]: pam_unix(sshd:auth): authentication failure; logname= u =0 tty=ssh ruser= rhost=",
-        ];
-
-        vectors.iter().for_each(|e| {
-            let ret = parse(*e);
-            assert!(ret.is_err());
-        })
+        vectors.iter().for_each(|e| assert!(parse(*e).is_none()))
     }
 }

src/utils.rs

@@ -1,20 +1,4 @@
 use clap::{App, Arg};
-use std::net::IpAddr;
-
-pub enum ParsingStatus {
-    OkEntry,
-    BadEntry(IpAddr),
-}
-pub enum Judgment {
-    Good,
-    Remand,
-    Bad(&'static str, IpAddr),
-}
-
-pub enum JailStatus {
-    Remand,
-    Jailed(IpAddr),
-}
 
 pub fn cli() -> App<'static, 'static> {
     App::new("ban internets scanner fast 🍶")
@@ -29,14 +13,14 @@ pub fn cli() -> App<'static, 'static> {
             Arg::with_name("jailtime")
                 .short("j")
                 .help("jail time (seconds)")
-                .default_value("7200")
+                .default_value("3600")
                 .takes_value(true),
         )
         .arg(
             Arg::with_name("allowance")
                 .short("a")
                 .help("how many offences allowed (max 255")
-                .default_value("6")
+                .default_value("5")
                 .takes_value(true),
         )
         .arg(