Y
2 years ago
18 changed files with 956 additions and 460 deletions
Split View
Diff Options
-
+12 -0Changelog.md
-
+3 -1README.md
-
+52 -29doc/configure.md
-
+1 -1doc/dnat.md
-
+3 -1doc/install.md
-
+1 -1doc/intro_func.md
-
+4 -2doc/intro_tech.md
-
+104 -8doc/logandban.md
-
+468 -331extra/examples/full_pyruse.json
-
+9 -5extra/examples/get-systemd-stats.sh
-
+3 -0extra/systemd/action_ipsetBan.conf
-
+37 -0pyruse/actions/action_ipsetBan.py
-
+17 -75pyruse/actions/action_nftBan.py
-
+85 -0pyruse/ban.py
-
+147 -0tests/action_ipsetBan.py
-
+5 -5tests/action_nftBan.py
-
+2 -1tests/main.py
-
+3 -0tests/pyruse.json
+ 12
- 0
Changelog.md
View File
| @ -0,0 +1,12 @@ | |||
| # Changelog | |||
| This file is not intended as a dupplicate of Git logs. | |||
| Its purpose is to warn of important changes between version, that users should be aware of. | |||
| ## v2.0 | |||
| After this version is installed, the following command should be run on the `action_nftBan.py.json` file: | |||
| ```bash | |||
| $ sudo sed -i s/nftSet/nfSet/g action_nftBan.py.json | |||
| ``` | |||
+ 3
- 1
README.md
View File
+ 52
- 29
doc/configure.md
View File
+ 1
- 1
doc/dnat.md
View File
+ 3
- 1
doc/install.md
View File
+ 1
- 1
doc/intro_func.md
View File
+ 4
- 2
doc/intro_tech.md
View File
+ 104
- 8
doc/logandban.md
View File
+ 468
- 331
extra/examples/full_pyruse.json
File diff suppressed because it is too large
View File
+ 9
- 5
extra/examples/get-systemd-stats.sh
View File
+ 3
- 0
extra/systemd/action_ipsetBan.conf
View File
| @ -0,0 +1,3 @@ | |||
| [Unit] | |||
| Requires=iptables.service | |||
| After=iptables.service | |||
+ 37
- 0
pyruse/actions/action_ipsetBan.py
View File
| @ -0,0 +1,37 @@ | |||
| # pyruse is intended as a replacement to both fail2ban and epylog | |||
| # Copyright © 2017–2018 Y. Gablin | |||
| # Full licensing information in the LICENSE file, or gnu.org/licences/gpl-3.0.txt if the file is missing. | |||
| import os | |||
| import subprocess | |||
| from pyruse import ban, base, config | |||
| class Action(base.Action, ban.NetfilterBan): | |||
| _storage = config.Config().asMap().get("storage", "/var/lib/pyruse") \ | |||
| + "/" + os.path.basename(__file__) + ".json" | |||
| _ipset = config.Config().asMap().get("ipsetBan", {}).get("ipset", ["/usr/bin/ipset", "-exist", "-quiet"]) | |||
| def __init__(self, args): | |||
| base.Action.__init__(self) | |||
| ban.NetfilterBan.__init__(self, Action._storage) | |||
| if args is None: | |||
| return # on-boot configuration | |||
| ipv4Set = args["ipSetIPv4"] | |||
| ipv6Set = args["ipSetIPv6"] | |||
| field = args["IP"] | |||
| banSeconds = args.get("banSeconds", None) | |||
| self.initSelf(ipv4Set, ipv6Set, field, banSeconds) | |||
| def act(self, entry): | |||
| ban.NetfilterBan.act(self, entry) | |||
| def setBan(self, nfSet, ip, seconds): | |||
| cmd = list(Action._ipset) | |||
| cmd.extend(["add", nfSet, ip]) | |||
| if seconds > 0: | |||
| cmd.extend(["timeout", str(seconds)]) | |||
| subprocess.run(cmd) | |||
| def cancelBan(self, nfSet, ip): | |||
| cmd = list(Action._ipset) | |||
| cmd.extend(["del", nfSet, ip]) | |||
| subprocess.run(cmd) | |||
+ 17
- 75
pyruse/actions/action_nftBan.py
View File
| @ -1,97 +1,39 @@ | |||
| # pyruse is intended as a replacement to both fail2ban and epylog | |||
| # Copyright © 2017–2018 Y. Gablin | |||
| # Full licensing information in the LICENSE file, or gnu.org/licences/gpl-3.0.txt if the file is missing. | |||
| import datetime | |||
| import json | |||
| import os | |||
| import subprocess | |||
| from pyruse import base, config | |||
| from pyruse import ban, base, config | |||
| class Action(base.Action): | |||
| class Action(base.Action, ban.NetfilterBan): | |||
| _storage = config.Config().asMap().get("storage", "/var/lib/pyruse") \ | |||
| + "/" + os.path.basename(__file__) + ".json" | |||
| _nft = config.Config().asMap().get("nftBan", {}).get("nft", ["/usr/bin/nft"]) | |||
| def __init__(self, args): | |||
| super().__init__() | |||
| base.Action.__init__(self) | |||
| ban.NetfilterBan.__init__(self, Action._storage) | |||
| if args is None: | |||
| return # on-boot configuration | |||
| self.ipv4Set = args["nftSetIPv4"] | |||
| self.ipv6Set = args["nftSetIPv6"] | |||
| self.field = args["IP"] | |||
| self.banSeconds = args.get("banSeconds", None) | |||
| ipv4Set = args["nftSetIPv4"] | |||
| ipv6Set = args["nftSetIPv6"] | |||
| field = args["IP"] | |||
| banSeconds = args.get("banSeconds", None) | |||
| self.initSelf(ipv4Set, ipv6Set, field, banSeconds) | |||
| def act(self, entry): | |||
| ip = entry[self.field] | |||
| nftSet = self.ipv6Set if ":" in ip else self.ipv4Set | |||
| newBan = {"IP": ip, "nftSet": nftSet} | |||
| ban.NetfilterBan.act(self, entry) | |||
| now = datetime.datetime.utcnow() | |||
| bans = [] | |||
| previousTS = None | |||
| try: | |||
| with open(Action._storage) as dataFile: | |||
| for ban in json.load(dataFile): | |||
| if ban["timestamp"] > 0 and ban["timestamp"] <= now.timestamp(): | |||
| continue | |||
| elif {k: ban[k] for k in newBan.keys()} == newBan: | |||
| # should not happen, since the IP is banned… | |||
| previousTS = ban["timestamp"] | |||
| else: | |||
| bans.append(ban) | |||
| except IOError: | |||
| pass # new file | |||
| if previousTS is not None: | |||
| try: | |||
| cmd = list(Action._nft) | |||
| cmd.append("delete element %s {%s}" % (nftSet, ip)) | |||
| subprocess.run(cmd) | |||
| except Exception: | |||
| pass # too late: not a problem | |||
| if self.banSeconds: | |||
| until = now + datetime.timedelta(seconds = self.banSeconds) | |||
| newBan["timestamp"] = until.timestamp() | |||
| timeout = self.banSeconds | |||
| else: | |||
| newBan["timestamp"] = 0 | |||
| timeout = 0 | |||
| self._doBan(timeout, ip, nftSet) | |||
| bans.append(newBan) | |||
| with open(Action._storage, "w") as dataFile: | |||
| json.dump(bans, dataFile) | |||
| def boot(self): | |||
| now = datetime.datetime.utcnow() | |||
| bans = [] | |||
| try: | |||
| with open(Action._storage) as dataFile: | |||
| for ban in json.load(dataFile): | |||
| if ban["timestamp"] == 0: | |||
| self._doBan(0, ban["IP"], ban["nftSet"]) | |||
| bans.append(ban) | |||
| elif ban["timestamp"] <= now.timestamp(): | |||
| continue | |||
| else: | |||
| until = datetime.datetime.utcfromtimestamp(ban["timestamp"]) | |||
| timeout = (until - now).total_seconds() | |||
| self._doBan(int(timeout), ban["IP"], ban["nftSet"]) | |||
| bans.append(ban) | |||
| except IOError: | |||
| pass # no file | |||
| with open(Action._storage, "w") as dataFile: | |||
| json.dump(bans, dataFile) | |||
| def _doBan(self, seconds, ip, nftSet): | |||
| if seconds < 0: | |||
| return # can happen when the threshold is crossed while computing the duration | |||
| def setBan(self, nfSet, ip, seconds): | |||
| if seconds == 0: | |||
| timeout = "" | |||
| else: | |||
| timeout = " timeout %ss" % seconds | |||
| cmd = list(Action._nft) | |||
| cmd.append("add element %s {%s%s}" % (nftSet, ip, timeout)) | |||
| cmd.append("add element %s {%s%s}" % (nfSet, ip, timeout)) | |||
| subprocess.run(cmd) | |||
| def cancelBan(self, nfSet, ip): | |||
| cmd = list(Action._nft) | |||
| cmd.append("delete element %s {%s}" % (nfSet, ip)) | |||
| subprocess.run(cmd) | |||
+ 85
- 0
pyruse/ban.py
View File
| @ -0,0 +1,85 @@ | |||
| # pyruse is intended as a replacement to both fail2ban and epylog | |||
| # Copyright © 2017–2018 Y. Gablin | |||
| # Full licensing information in the LICENSE file, or gnu.org/licences/gpl-3.0.txt if the file is missing. | |||
| import abc | |||
| import datetime | |||
| import json | |||
| class NetfilterBan(abc.ABC): | |||
| def __init__(self, storage): | |||
| self.storage = storage | |||
| def initSelf(self, ipv4Set, ipv6Set, ipField, banSeconds): | |||
| self.ipv4Set = ipv4Set | |||
| self.ipv6Set = ipv6Set | |||
| self.field = ipField | |||
| self.banSeconds = banSeconds | |||
| @abc.abstractmethod | |||
| def setBan(self, nfSet, ip, seconds): | |||
| pass | |||
| @abc.abstractmethod | |||
| def cancelBan(self, nfSet, ip): | |||
| pass | |||
| def act(self, entry): | |||
| ip = entry[self.field] | |||
| nfSet = self.ipv6Set if ":" in ip else self.ipv4Set | |||
| newBan = {"IP": ip, "nfSet": nfSet} | |||
| now = datetime.datetime.utcnow() | |||
| bans = [] | |||
| previousTS = None | |||
| try: | |||
| with open(self.storage) as dataFile: | |||
| for ban in json.load(dataFile): | |||
| if ban["timestamp"] > 0 and ban["timestamp"] <= now.timestamp(): | |||
| continue | |||
| elif {k: ban[k] for k in newBan.keys()} == newBan: | |||
| # should not happen, since the IP is banned… | |||
| previousTS = ban["timestamp"] | |||
| else: | |||
| bans.append(ban) | |||
| except IOError: | |||
| pass # new file | |||
| if previousTS is not None: | |||
| try: | |||
| self.cancelBan(nfSet, ip) | |||
| except Exception: | |||
| pass # too late: not a problem | |||
| if self.banSeconds: | |||
| until = now + datetime.timedelta(seconds = self.banSeconds) | |||
| newBan["timestamp"] = until.timestamp() | |||
| timeout = self.banSeconds | |||
| else: | |||
| newBan["timestamp"] = 0 | |||
| timeout = 0 | |||
| self.setBan(nfSet, ip, timeout) | |||
| bans.append(newBan) | |||
| with open(self.storage, "w") as dataFile: | |||
| json.dump(bans, dataFile) | |||
| def boot(self): | |||
| now = int(datetime.datetime.utcnow().timestamp()) | |||
| bans = [] | |||
| try: | |||
| with open(self.storage) as dataFile: | |||
| for ban in json.load(dataFile): | |||
| if ban["timestamp"] == 0: | |||
| self.setBan(ban["nfSet"], ban["IP"], 0) | |||
| bans.append(ban) | |||
| elif int(ban["timestamp"]) <= now: | |||
| continue | |||
| else: | |||
| timeout = int(ban["timestamp"]) - now | |||
| self.setBan(ban["nfSet"], ban["IP"], timeout) | |||
| bans.append(ban) | |||
| except IOError: | |||
| pass # no file | |||
| with open(self.storage, "w") as dataFile: | |||
| json.dump(bans, dataFile) | |||
+ 147
- 0
tests/action_ipsetBan.py
View File
| @ -0,0 +1,147 @@ | |||
| # pyruse is intended as a replacement to both fail2ban and epylog | |||
| # Copyright © 2017–2018 Y. Gablin | |||
| # Full licensing information in the LICENSE file, or gnu.org/licences/gpl-3.0.txt if the file is missing. | |||
| import json | |||
| import os | |||
| import time | |||
| from pyruse.actions.action_ipsetBan import Action | |||
| ipBanCmd = "ipsetBan.cmd" | |||
| ipBanState = "action_ipsetBan.py.json" | |||
| def _clean(): | |||
| if os.path.exists(ipBanCmd): | |||
| os.remove(ipBanCmd) | |||
| if os.path.exists(ipBanState): | |||
| os.remove(ipBanState) | |||
| def whenBanIPv4ThenAddToIPv4Set(): | |||
| _clean() | |||
| Action({"IP": "ip", "ipSetIPv4": "I4ban", "ipSetIPv6": "I6ban"}).act({"ip": "10.0.0.1"}) | |||
| assert os.path.exists(ipBanCmd) | |||
| assert os.path.exists(ipBanState) | |||
| nbLines = 0 | |||
| with open(ipBanCmd, "rt") as c: | |||
| for line in c: | |||
| assert line == "add I4ban 10.0.0.1\n", line | |||
| nbLines += 1 | |||
| assert nbLines == 1, nbLines | |||
| nbBans = 0 | |||
| with open(ipBanState) as s: | |||
| for ban in json.load(s): | |||
| assert ban["IP"] == "10.0.0.1" and ban["nfSet"] == "I4ban", str(ban) | |||
| nbBans += 1 | |||
| assert nbBans == 1, nbBans | |||
| _clean() | |||
| def whenBanIPv6ThenAddToIPv6Set(): | |||
| _clean() | |||
| Action({"IP": "ip", "ipSetIPv4": "I4ban", "ipSetIPv6": "I6ban"}).act({"ip": "::1"}) | |||
| assert os.path.exists(ipBanCmd) | |||
| assert os.path.exists(ipBanState) | |||
| nbLines = 0 | |||
| with open(ipBanCmd, "rt") as c: | |||
| for line in c: | |||
| assert line == "add I6ban ::1\n", line | |||
| nbLines += 1 | |||
| assert nbLines == 1, nbLines | |||
| nbBans = 0 | |||
| with open(ipBanState) as s: | |||
| for ban in json.load(s): | |||
| assert ban["IP"] == "::1" and ban["nfSet"] == "I6ban", str(ban) | |||
| nbBans += 1 | |||
| assert nbBans == 1, nbBans | |||
| _clean() | |||
| def whenBanTwoIPThenTwoLinesInState(): | |||
| _clean() | |||
| action = Action({"IP": "ip", "ipSetIPv4": "I4ban", "ipSetIPv6": "I6ban"}) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| action.act({"ip": "::1"}) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| assert os.path.exists(ipBanState) | |||
| nbBans = 0 | |||
| with open(ipBanState) as s: | |||
| for ban in json.load(s): | |||
| if ban["IP"] == "10.0.0.1": | |||
| assert ban["nfSet"] == "I4ban", str(ban) | |||
| elif ban["IP"] == "::1": | |||
| assert ban["nfSet"] == "I6ban", str(ban) | |||
| else: | |||
| assert false, str(ban) | |||
| nbBans += 1 | |||
| assert nbBans == 2, nbBans | |||
| _clean() | |||
| def whenBanAnewThenNoDuplicate(): | |||
| _clean() | |||
| action = Action({"IP": "ip", "ipSetIPv4": "I4ban", "ipSetIPv6": "I6ban"}) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| assert os.path.exists(ipBanCmd) | |||
| assert os.path.exists(ipBanState) | |||
| lineCount = 0 | |||
| with open(ipBanCmd, "rt") as c: | |||
| for line in c: | |||
| lineCount += 1 | |||
| if lineCount == 1: | |||
| assert line == "add I4ban 10.0.0.1\n", line | |||
| elif lineCount == 2: | |||
| assert line == "del I4ban 10.0.0.1\n", line | |||
| elif lineCount == 3: | |||
| assert line == "add I4ban 10.0.0.1\n", line | |||
| assert lineCount == 3, lineCount | |||
| nbBans = 0 | |||
| with open(ipBanState) as s: | |||
| for ban in json.load(s): | |||
| if ban["IP"] == "10.0.0.1": | |||
| assert ban["nfSet"] == "I4ban", str(ban) | |||
| nbBans += 1 | |||
| assert nbBans == 1, nbBans | |||
| _clean() | |||
| def whenFinishedBanThenAsIfNotThere(): | |||
| _clean() | |||
| action = Action({"IP": "ip", "ipSetIPv4": "I4ban", "ipSetIPv6": "I6ban", "banSeconds": 1}) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| time.sleep(1) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| assert os.path.exists(ipBanCmd) | |||
| lineCount = 0 | |||
| with open(ipBanCmd, "rt") as c: | |||
| for line in c: | |||
| lineCount += 1 | |||
| if lineCount == 1: | |||
| assert line == "add I4ban 10.0.0.1 timeout 1\n", line | |||
| elif lineCount == 2: | |||
| assert line == "add I4ban 10.0.0.1 timeout 1\n", line | |||
| assert lineCount == 2, lineCount | |||
| _clean() | |||
| def whenUnfinishedBanThenTimeoutReset(): | |||
| _clean() | |||
| action = Action({"IP": "ip", "ipSetIPv4": "I4ban", "ipSetIPv6": "I6ban", "banSeconds": 2}) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| time.sleep(1) | |||
| action.act({"ip": "10.0.0.1"}) | |||
| assert os.path.exists(ipBanCmd) | |||
| lineCount = 0 | |||
| with open(ipBanCmd, "rt") as c: | |||
| for line in c: | |||
| lineCount += 1 | |||
| if lineCount == 1: | |||
| assert line == "add I4ban 10.0.0.1 timeout 2\n", line | |||
| elif lineCount == 2: | |||
| assert line == "del I4ban 10.0.0.1\n", line | |||
| elif lineCount == 3: | |||
| assert line == "add I4ban 10.0.0.1 timeout 2\n", line | |||
| assert lineCount == 3, lineCount | |||
| _clean() | |||
| def unitTests(): | |||
| whenBanIPv4ThenAddToIPv4Set() | |||
| whenBanIPv6ThenAddToIPv6Set() | |||
| whenBanTwoIPThenTwoLinesInState() | |||
| whenBanAnewThenNoDuplicate() | |||
| whenFinishedBanThenAsIfNotThere() | |||
| whenUnfinishedBanThenTimeoutReset() | |||