test

Cargo.lock

@@ -20,6 +20,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "anyhow"
+version = "1.0.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61604a8f862e1d5c3229fdd78f8b02c68dcf73a4c4b05fd636d12240aaa242c1"
+
 [[package]]
 name = "atty"
 version = "0.2.14"
@@ -47,6 +53,7 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 name = "blockfast"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "clap",
  "lazy_static",
  "linemux",

Cargo.toml

@@ -11,4 +11,5 @@ linemux = "0.2"
 tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
 lazy_static = "1.4.0"
 regex = "1.5.4"
-clap = "2.33.3"
+clap = "2.33.3"
+anyhow = "1.0.44"

README.md

@@ -10,4 +10,3 @@ features:
   - libmusl static release builds, no libc dependency
   - lighter alternative to fail2ban
 
-Todo: more granular CLI args to filter HTTP Status codes (e.g. 5 401 leads to a block, but 30 404 before a block) ?

src/clf.rs

@@ -1,28 +1,31 @@
-use std::net::IpAddr;
+use crate::utils::ParsingStatus;
-
+use anyhow::Result;
 use lazy_static::lazy_static;
+use std::net::IpAddr;
 
 // TODO: allow user-provided list
 // TODO: match different error-levels (10 404, but only 5 401, etc...)
 lazy_static! {
-    static ref BAD_STATUSES: [&'static str; 2] = ["401", "429"];
+    static ref BAD_STATUSES: [u32; 2] = [401, 429];
 }
 
-pub fn parse(line: &str) -> Option<IpAddr> {
+pub fn parse(line: &str) -> Result<ParsingStatus> {
     // TODO: Use a proper parser ?
     let elts: Vec<&str> = line.split_whitespace().collect();
-    let ip = elts[0].parse::<IpAddr>().ok();
-    let http_code = elts[elts.len() - 2] as &str;
 
-    BAD_STATUSES.iter().find_map(
+    let ip_str = elts[0];
-        |bad_status| {
+    let ip = ip_str.parse::<IpAddr>()?;
-            if http_code == *bad_status {
+
-                ip
+    let http_code_str = elts[elts.len() - 2] as &str;
-            } else {
+    let http_code = http_code_str.parse::<u32>()?;
-                None
+
-            }
+    for status in BAD_STATUSES.iter() {
-        },
+        if *status == http_code {
-    )
+            return Ok(ParsingStatus::BadEntry(ip));
+        }
+    }
+
+    Ok(ParsingStatus::OkEntry)
 }
 
 #[cfg(test)]
@@ -36,7 +39,13 @@ mod tests {
             "8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 429 923",
         ];
 
-        vectors.iter().for_each(|e| assert!(parse(*e).is_some()))
+        vectors.iter().for_each(|e| {
+            let ret = parse(*e).unwrap();
+            match ret {
+                ParsingStatus::BadEntry(_) => {}
+                _ => panic!("bad parsing"),
+            }
+        })
     }
 
     #[test]
@@ -46,6 +55,25 @@ mod tests {
             "8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 404 923",
         ];
 
-        vectors.iter().for_each(|e| assert!(parse(*e).is_none()))
+        vectors.iter().for_each(|e| {
+            let ret = parse(*e).unwrap();
+            match ret {
+                ParsingStatus::OkEntry => {}
+                _ => panic!("bad parsing"),
+            }
+        })
+    }
+
+    #[test]
+    fn malformed() {
+        let vectors = [
+            "8.8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\" 200 923",
+            "8.8.8.8 - p [25/Sep/2021:13:49:56 +0200] \"POST /some/rpc HTTP/2.0\"",
+        ];
+
+        vectors.iter().for_each(|e| {
+            let ret = parse(*e);
+            assert!(ret.is_err());
+        })
     }
 }

src/jail.rs

@@ -1,70 +1,26 @@
 use std::collections::HashMap;
 use std::net::IpAddr;
-use std::panic::panic_any;
 use std::process::Command;
 use std::sync::Mutex;
 
+use std::ffi::CString;
+
+use anyhow::*;
+
+use crate::utils::JailStatus;
+
 pub struct Jail {
     jailtime: u32,
     allowance: u8,
+    ipset_ptr: *const u8, // opaque C ptr to struct ipset
     remand: Mutex<HashMap<IpAddr, u8>>,
 }
 
-const JAIL_NAME: &str = "blockfast_jail";
+
-const GENERAL_PANIC_MSG: &str =
+const ERR_MSG: &str =
     "error using ipset/iptables, maybe it's not installed, this program isn't running as root ?";
 
-fn ipset_init() -> Option<()> {
+fn ipset_block(jailtime: u32, ip: IpAddr) -> Result<()> {
-    let init0 = format!("ipset create {} hash:ip timeout 0", JAIL_NAME);
-    let init1 = format!(
-        "iptables -I INPUT 1 -m set -j DROP --match-set {} src",
-        JAIL_NAME
-    );
-    let init2 = format!(
-        "iptables -I FORWARD 1 -m set -j DROP --match-set {} src",
-        JAIL_NAME
-    );
-
-    let args0: Vec<&str> = init0.split_whitespace().collect();
-    let args1: Vec<&str> = init1.split_whitespace().collect();
-    let args2: Vec<&str> = init2.split_whitespace().collect();
-
-    // create
-    let out = Command::new("sudo").args(args0).output().ok()?;
-
-    if out.status.code()? != 0 {
-        let already_exists = std::str::from_utf8(&out.stderr)
-            .ok()?
-            .contains("set with the same name already exists");
-
-        if already_exists {
-            return None;
-        } else {
-            eprintln!("{:?}", out);
-            panic_any(GENERAL_PANIC_MSG);
-        }
-    }
-
-    // setup input
-    let out_input = Command::new("sudo").args(args1).output().ok()?;
-
-    if out_input.status.code()? != 0 {
-        eprintln!("{:?}", out_input);
-        panic_any(GENERAL_PANIC_MSG);
-    }
-
-    // setup fwd
-    let out_fwd = Command::new("sudo").args(args2).output().ok()?;
-
-    if out_fwd.status.code()? != 0 {
-        eprintln!("{:?}", out_fwd);
-        panic_any(GENERAL_PANIC_MSG);
-    }
-
-    None
-}
-
-fn ipset_block(jailtime: u32, ip: IpAddr) -> Option<()> {
     let sentence = format!(
         "ipset add {} {} timeout {}",
         JAIL_NAME,
@@ -73,36 +29,51 @@ fn ipset_block(jailtime: u32, ip: IpAddr) -> Option<()> {
     );
     let sentence_sl: Vec<&str> = sentence.split_whitespace().collect();
 
-    let out = Command::new("sudo").args(sentence_sl).output().ok()?;
+    let out = Command::new("sudo").args(sentence_sl).output()?;
-
+    if out.status.code() != Some(0) {
-    if out.status.code()? != 0 {
+        eprintln!("{:?}", out);
-        return None;
+        bail!("error executing ipset ban");
     }
 
-    Some(())
+    Ok(())
+}
+
+const JAIL_NAME: &str = "blockfast_jail";
+const IPSET_SETNAME: u32 = 1;
+const IPSET_OPT_FAMILY: u32 = 3;
+const IPSET_OPT_IP: u32 = 4;
+const IPSET_OPT_TIMEOUT: u32 = 10;
+
+
+#[link(name = "ipset")]
+extern "C" {
+    fn ipset_init() -> *const u8; //
+    fn ipset_session_data_set(ipset_struct: *const u8, target: u32, name: CString);
 }
 
 impl Jail {
-    pub fn new(allowance: u8, jailtime: u32) -> Jail {
+    pub fn new(allowance: u8, jailtime: u32) -> Result<Jail> {
-        if ipset_init().is_some() {
+        let ipset_ptr = unsafe { ipset_init() };
-            panic_any(GENERAL_PANIC_MSG);
-        };
 
-        eprintln!(
+        if ipset_ptr.is_null() {
-            "+ jail setup, allowing {} offences, jailtime: {}s",
+            bail!(ERR_MSG);
-            allowance, jailtime
+        }
-        );
 
-        Jail {
+        let JAIL_NAME_C = CString::new("blockfast_thisisatest").unwrap();
+
+        let a = unsafe { ipset_session_data_set(ipset_ptr, IPSET_SETNAME, JAIL_NAME_C) };
+
+        Ok(Jail {
             allowance,
             jailtime,
+            ipset_ptr,
             remand: Mutex::new(HashMap::new()),
-        }
+        })
     }
 
-    pub fn probe(&self, ip: IpAddr) -> Option<()> {
+    pub fn probe(&self, ip: IpAddr) -> Result<JailStatus> {
         let should_ban = {
-            let mut locked_map = self.remand.lock().ok()?;
+            let mut locked_map = self.remand.lock().map_err(|_| anyhow!("cant lock"))?;
 
             // TODO: set time of last offence, and add grace
             let hits = *locked_map.entry(ip).and_modify(|e| *e += 1).or_insert(1);
@@ -116,12 +87,10 @@ impl Jail {
         };
 
         if should_ban {
-            match ipset_block(self.jailtime, ip) {
+            ipset_block(self.jailtime, ip)?;
-                Some(_) => eprintln!("~ {} going to jail", ip),
+            Ok(JailStatus::Jailed(ip))
-                None => eprintln!("! ERR {} going to jail", ip),
+        } else {
-            }
+            Ok(JailStatus::Remand)
         }
-
-        None
     }
 }

src/main.rs

@@ -1,3 +1,4 @@
+use anyhow::*;
 use linemux::MuxedLines;
 
 mod clf;
@@ -6,29 +7,68 @@ mod utils;
 
 mod jail;
 use crate::jail::Jail;
+use crate::utils::*;
 
-async fn run() -> Option<()> {
+fn judge(
+    path_sshd: &str,
+    path_clf: &str,
+    payload: &str,
+    path: &str,
+    jail: &Jail,
+) -> Result<Judgment> {
+    let do_sshd = !path_sshd.is_empty();
+    let do_clf = !path_clf.is_empty();
+    let mut target = "";
+
+    let ret_parse = if do_sshd && path.ends_with(path_sshd) {
+        target = "sshd";
+        sshd::parse(payload)
+    } else if do_clf && path.ends_with(path_clf) {
+        target = "clf ";
+        clf::parse(payload)
+    } else {
+        Err(anyhow!("cant locate file !"))
+    };
+
+    let ip = match ret_parse? {
+        ParsingStatus::OkEntry => return Ok(Judgment::Good),
+        ParsingStatus::BadEntry(ip) => ip,
+    };
+
+    match jail.probe(ip)? {
+        JailStatus::Remand => Ok(Judgment::Remand),
+        JailStatus::Jailed(ip) => Ok(Judgment::Bad(target, ip)),
+    }
+}
+
+async fn run() -> Result<()> {
     let args = utils::cli().get_matches();
-    let mut lines = MuxedLines::new().ok()?;
+    let mut lines = MuxedLines::new().context("parsing cli args")?;
 
     // jail
-    let jailtime: u32 = args.value_of("jailtime")?.parse().ok()?;
+    let jailtime_str = args.value_of("jailtime").unwrap_or("");
-    let allowance: u8 = args.value_of("allowance")?.parse().ok()?;
+    let jailtime = jailtime_str.parse().context("parsing jailtime")?;
-    let jail = Jail::new(allowance, jailtime);
+
+    let allowance_str = args.value_of("allowance").unwrap_or("");
+    let allowance = allowance_str.parse().context("parsing allowance")?;
+
+    let jail = Jail::new(allowance, jailtime).context("init jail")?;
+    eprintln!(
+        "+ jail setup, offences allowed: {}, jailtime {}s",
+        allowance, jailtime
+    );
 
     // sshd
     let path_sshd = args.value_of("sshd_logpath").unwrap_or("");
-    let do_sshd = !path_sshd.is_empty();
+    if !path_sshd.is_empty() {
-    if do_sshd {
+        lines.add_file(path_sshd).await?;
-        lines.add_file(path_sshd).await.ok()?;
         eprintln!("+ starting with sshd parsing at {}", path_sshd);
     }
 
     // common log format
     let path_clf = args.value_of("clf_logpath").unwrap_or("");
-    let do_clf = !path_clf.is_empty();
+    if !path_clf.is_empty() {
-    if do_clf {
+        lines.add_file(path_clf).await.context("opening log file")?;
-        lines.add_file(path_clf).await.ok()?;
         eprintln!("+ starting with clf parsing at {}", path_clf);
     }
 
@@ -36,22 +76,24 @@ async fn run() -> Option<()> {
         let payload = line.line();
         let path = line.source().display().to_string();
 
-        if do_sshd && path.ends_with(path_sshd) {
+        match judge(path_sshd, path_clf, payload, &path, &jail) {
-            sshd::parse(payload).and_then(|ip| jail.probe(ip));
+            Err(err) => eprintln!("! ERR {:?} - file {}", err, path),
-        } else if do_clf && path.ends_with(path_clf) {
+            Ok(Judgment::Good) => {}
-            clf::parse(payload).and_then(|ip| jail.probe(ip));
+            Ok(Judgment::Remand) => {}
-        } else {
+            Ok(Judgment::Bad(target, ip)) => {
-            eprintln!("! unknown logline: {}", path);
+                eprintln!("~ {} jailtime for: {}", target, ip)
-        }
+            }
+        };
     }
 
-    Some(())
+    Ok(())
 }
 
 #[tokio::main]
-async fn main() -> std::io::Result<()> {
+async fn main() -> Result<()> {
-    let _ = run().await;
+    let ret = run().await;
-    eprintln!("! ERR");
+    let _ = ret.map_err(|e| eprintln!("! ERROR {:?}", e));
+    eprintln!("\n");
     let _ = utils::cli().print_help();
     Ok(())
 }

src/sshd.rs

@@ -1,7 +1,10 @@
-use std::net::IpAddr;
+use anyhow::*;
-
 use lazy_static::lazy_static;
 use regex::Regex;
+use std::net::IpAddr;
+use std::str::FromStr;
+
+use crate::utils::ParsingStatus;
 
 struct Rule {
     matcher: String,
@@ -15,7 +18,7 @@ lazy_static! {
             extractor: Regex::new(r"(from.)(.*)(.port)").unwrap(),
         },
         Rule {
-            matcher: "Invalid user".to_string(),
+            matcher: "Invalid user ".to_string(),
             extractor: Regex::new(r"(from.)(.*)").unwrap(),
         },
         Rule {
@@ -25,16 +28,28 @@ lazy_static! {
     ];
 }
 
-pub fn parse(line: &str) -> Option<IpAddr> {
+pub fn parse(line: &str) -> Result<ParsingStatus> {
-    let ret = SSHD_BAD.iter().find_map(|rule| {
+    let hits = SSHD_BAD.iter().find_map(|rule| {
         if line.contains(&rule.matcher) {
-            rule.extractor.captures(line)?.get(2)
+            rule.extractor.captures(line)
         } else {
             None
         }
-    })?;
+    });
 
-    ret.as_str().parse::<IpAddr>().ok()
+    if hits.is_none() {
+        return Ok(ParsingStatus::OkEntry);
+    }
+
+    let ip = hits
+        .and_then(|c| c.get(2))
+        .and_then(|m| Some(m.as_str()))
+        .ok_or(anyhow!("sshd cant extract ip"))?;
+
+    match IpAddr::from_str(ip) {
+        Ok(ip) => Ok(ParsingStatus::BadEntry(ip)),
+        Err(_) => Err(anyhow!("cant parse sshd entry")),
+    }
 }
 
 #[cfg(test)]
@@ -49,7 +64,13 @@ mod tests {
             "Sep 26 06:25:32 livecompute sshd[23254]: Invalid user neal from 35.184.211.144"
         ];
 
-        vectors.iter().for_each(|e| assert!(parse(*e).is_some()))
+        vectors.iter().for_each(|e| {
+            let ret = parse(*e).unwrap();
+            match ret {
+                ParsingStatus::BadEntry(_) => {}
+                _ => panic!("bad parsing"),
+            }
+        })
     }
 
     #[test]
@@ -60,6 +81,25 @@ mod tests {
             "Sep 26 06:25:32 livecompute sshd[23254]: very good user neal from 35.184.211.144"
         ];
 
-        vectors.iter().for_each(|e| assert!(parse(*e).is_none()))
+        vectors.iter().for_each(|e| {
+            let ret = parse(*e).unwrap();
+            match ret {
+                ParsingStatus::OkEntry => {}
+                _ => panic!("bad parsing"),
+            }
+        })
+    }
+
+    #[test]
+    fn malformed() {
+        let vectors = [
+            "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195.232 port 41883 ssh2",
+            "Sep 26 06:26:14 livecompute sshd[23292]: pam_unix(sshd:auth): authentication failure; logname= u =0 tty=ssh ruser= rhost=",
+        ];
+
+        vectors.iter().for_each(|e| {
+            let ret = parse(*e);
+            assert!(ret.is_err());
+        })
     }
 }

src/utils.rs

@@ -1,4 +1,20 @@
 use clap::{App, Arg};
+use std::net::IpAddr;
+
+pub enum ParsingStatus {
+    OkEntry,
+    BadEntry(IpAddr),
+}
+pub enum Judgment {
+    Good,
+    Remand,
+    Bad(&'static str, IpAddr),
+}
+
+pub enum JailStatus {
+    Remand,
+    Jailed(IpAddr),
+}
 
 pub fn cli() -> App<'static, 'static> {
     App::new("ban internets scanner fast 🍶")
@@ -13,14 +29,14 @@ pub fn cli() -> App<'static, 'static> {
             Arg::with_name("jailtime")
                 .short("j")
                 .help("jail time (seconds)")
-                .default_value("3600")
+                .default_value("7200")
                 .takes_value(true),
         )
         .arg(
             Arg::with_name("allowance")
                 .short("a")
                 .help("how many offences allowed (max 255")
-                .default_value("5")
+                .default_value("6")
                 .takes_value(true),
         )
         .arg(