blockfast/src/sshd.rs

use std::net::IpAddr;

use lazy_static::lazy_static;
use regex::Regex;

struct Rule {
    matcher: String,
    extractor: Regex,
}

lazy_static! {
    static ref SSHD_BAD: [Rule; 3] = [
        Rule {
            matcher: "Failed password".to_string(),
            extractor: Regex::new(r"(from.)(.*)(.port)").unwrap(),
        },
        Rule {
            matcher: "Invalid user".to_string(),
            extractor: Regex::new(r"(from.)(.*)").unwrap(),
        },
        Rule {
            matcher: "authentication failure".to_string(),
            extractor: Regex::new(r"(rhost=)(.*)").unwrap()
        },
    ];
}

pub fn parse(line: &str) -> Option<IpAddr> {
    let ret = SSHD_BAD.iter().find_map(|rule| {
        if line.contains(&rule.matcher) {
            rule.extractor.captures(line)?.get(2)
        } else {
            None
        }
    })?;

    ret.as_str().parse::<IpAddr>().ok()
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn positive() {
        let vectors = [
            "Sep 26 06:25:19 livecompute sshd[23246]: Failed password for root from 179.124.36.195 port 41883 ssh2",
            "Sep 26 06:26:14 livecompute sshd[23292]: pam_unix(sshd:auth): authentication failure; logname= u =0 tty=ssh ruser= rhost=5.101.107.190",
            "Sep 26 06:25:32 livecompute sshd[23254]: Invalid user neal from 35.184.211.144"
        ];

        vectors.iter().for_each(|e| assert!(parse(*e).is_some()))
    }

    #[test]
    fn negative() {
        let vectors = [
            "Sep 26 06:25:19 livecompute sshd[23246]: successful login 179.124.36.195 port 41883 ssh2",
            "Sep 26 06:26:14 livecompute sshd[23292]: pam_unix(sshd:auth): authentication total success; logname= u =0 tty=ssh ruser= rhost=5.101.107.190",
            "Sep 26 06:25:32 livecompute sshd[23254]: very good user neal from 35.184.211.144"
        ];

        vectors.iter().for_each(|e| assert!(parse(*e).is_none()))
    }
}