mirror of https://github.com/fail2ban/fail2ban
235 lines
6.5 KiB
Python
235 lines
6.5 KiB
Python
# This file is part of Fail2Ban.
|
|
#
|
|
# Fail2Ban is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Fail2Ban is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Fail2Ban; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
# Author: Cyril Jaquier
|
|
#
|
|
# $Revision: 1.16 $
|
|
|
|
__author__ = "Cyril Jaquier"
|
|
__version__ = "$Revision: 1.16 $"
|
|
__date__ = "$Date: 2006/01/03 15:13:04 $"
|
|
__copyright__ = "Copyright (c) 2004 Cyril Jaquier"
|
|
__license__ = "GPL"
|
|
|
|
import os, sys, time, re, logging
|
|
|
|
from utils.dns import *
|
|
|
|
# Gets the instance of the logger.
|
|
logSys = logging.getLogger("fail2ban")
|
|
|
|
class LogReader:
|
|
""" Reads a log file and reports information about IP that make password
|
|
failure, bad user or anything else that is considered as doubtful login
|
|
attempt.
|
|
"""
|
|
|
|
def __init__(self, logPath, timeregex, timepattern, failregex,
|
|
maxRetry, findTime):
|
|
self.logPath = logPath
|
|
self.maxRetry = maxRetry
|
|
self.timeregex = timeregex
|
|
self.timepattern = timepattern
|
|
self.failregex = failregex
|
|
self.findTime = findTime
|
|
self.ignoreIpList = []
|
|
self.lastModTime = 0
|
|
self.lastPos = 0
|
|
self.lastDate = 0
|
|
self.logStats = None
|
|
|
|
def getMaxRetry(self):
|
|
""" Gets the maximum number of failures
|
|
"""
|
|
return self.maxRetry
|
|
|
|
def getFindTime(self):
|
|
""" Gets the find time.
|
|
"""
|
|
return self.findTime
|
|
|
|
def addIgnoreIP(self, ip):
|
|
""" Adds an IP to the ignore list.
|
|
"""
|
|
logSys.debug("Add "+ip+" to ignore list")
|
|
self.ignoreIpList.append(ip)
|
|
|
|
def inIgnoreIPList(self, ip):
|
|
""" Checks if IP is in the ignore list.
|
|
"""
|
|
for i in self.ignoreIpList:
|
|
s = i.split('/', 1)
|
|
# IP address without CIDR mask
|
|
if len(s) == 1:
|
|
s.insert(1, '32')
|
|
s[1] = long(s[1])
|
|
a = cidr(s[0], s[1])
|
|
b = cidr(ip, s[1])
|
|
if a == b:
|
|
return True
|
|
return False
|
|
|
|
def openLogFile(self):
|
|
""" Opens the log file specified on init.
|
|
"""
|
|
try:
|
|
fileHandler = open(self.logPath)
|
|
except OSError:
|
|
logSys.error("Unable to open "+self.logPath)
|
|
|
|
return fileHandler
|
|
|
|
def isModified(self):
|
|
""" Checks if the log file has been modified using os.stat().
|
|
"""
|
|
try:
|
|
self.logStats = os.stat(self.logPath)
|
|
if self.lastModTime == self.logStats.st_mtime:
|
|
return False
|
|
else:
|
|
logSys.debug(self.logPath+" has been modified")
|
|
self.lastModTime = self.logStats.st_mtime
|
|
return True
|
|
except OSError:
|
|
logSys.error("Unable to get stat on "+self.logPath)
|
|
return False
|
|
|
|
def setFilePos(self, file):
|
|
""" Sets the file position. We must take care of log file rotation
|
|
and reset the position to 0 in that case. Use the log message
|
|
timestamp in order to detect this.
|
|
"""
|
|
line = file.readline()
|
|
if self.lastDate < self.getTime(line):
|
|
logSys.debug("Date " + `self.lastDate` + " is " + "smaller than " +
|
|
`self.getTime(line)`)
|
|
logSys.debug("Log rotation detected for " + self.logPath)
|
|
self.lastPos = 0
|
|
|
|
logSys.debug("Setting file position to " + `self.lastPos` + " for " +
|
|
self.logPath)
|
|
file.seek(self.lastPos)
|
|
|
|
def getFailures(self):
|
|
""" Gets all the failure in the log file which are
|
|
newer than time.time()-self.findTime.
|
|
|
|
Returns a dict with the IP, the number of failure
|
|
and the latest failure time.
|
|
"""
|
|
ipList = dict()
|
|
logSys.debug(self.logPath)
|
|
logFile = self.openLogFile()
|
|
self.setFilePos(logFile)
|
|
lastLine = None
|
|
for line in logFile:
|
|
if not self.hasTime(line):
|
|
# There is no valid time in this line
|
|
continue
|
|
lastLine = line
|
|
for element in self.findFailure(line):
|
|
ip = element[0]
|
|
unixTime = element[1]
|
|
if unixTime < time.time()-self.findTime:
|
|
break
|
|
if self.inIgnoreIPList(ip):
|
|
logSys.debug("Ignore "+ip)
|
|
continue
|
|
logSys.debug("Found "+ip)
|
|
if ipList.has_key(ip):
|
|
ipList[ip] = (ipList[ip][0]+1, unixTime)
|
|
else:
|
|
ipList[ip] = (1, unixTime)
|
|
self.lastPos = logFile.tell()
|
|
if lastLine:
|
|
self.lastDate = self.getTime(lastLine)
|
|
logFile.close()
|
|
return ipList
|
|
|
|
def findFailure(self, line):
|
|
""" Finds the failure in line. Uses the failregex pattern
|
|
to find it and timeregex in order to find the logging
|
|
time.
|
|
|
|
Returns a dict with IP and timestamp.
|
|
"""
|
|
failList = list()
|
|
match = re.search(self.failregex, line)
|
|
if match:
|
|
timeMatch = re.search(self.timeregex, match.string)
|
|
if timeMatch:
|
|
date = self.getUnixTime(timeMatch.group())
|
|
# Bug fix for Debian #330827
|
|
hostMatch = match.groupdict()
|
|
if len(hostMatch)==0:
|
|
logSys.warn("Must have been using old style of failregex! "
|
|
"Security Breach! Read README.Debian")
|
|
ipMatch = textToIp(match.string)
|
|
else:
|
|
ipMatch = reduce(lambda x,y:x+textToIp(y),
|
|
hostMatch.values(), [])
|
|
|
|
if ipMatch:
|
|
for ip in ipMatch:
|
|
failList.append([ip, date])
|
|
return failList
|
|
|
|
def hasTime(self, line):
|
|
""" Return true if the line contains a date
|
|
"""
|
|
timeMatch = re.search(self.timeregex, line)
|
|
if timeMatch:
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
def getTime(self, line):
|
|
""" Gets the time of a log message.
|
|
"""
|
|
date = 0
|
|
timeMatch = re.search(self.timeregex, line)
|
|
if timeMatch:
|
|
date = self.getUnixTime(timeMatch.group())
|
|
return date
|
|
|
|
def getUnixTime(self, value):
|
|
""" Returns the Unix timestamp of the given value.
|
|
Pattern should describe the date construction of
|
|
value.
|
|
"""
|
|
try:
|
|
# Check if the parsed value is in TAI64N format
|
|
if not self.timepattern.lower() == "tai64n":
|
|
date = list(time.strptime(value, self.timepattern))
|
|
else:
|
|
# extract part of format which represents seconds since epoch
|
|
seconds_since_epoch = value[2:17]
|
|
date = list(time.gmtime(int(seconds_since_epoch, 16)))
|
|
except ValueError, e:
|
|
logSys.error(e)
|
|
logSys.error("Please check the format and your locale settings.")
|
|
return None
|
|
if date[0] < 2000:
|
|
# There is probably no year field in the logs
|
|
date[0] = time.gmtime()[0]
|
|
# Bug fix for #1241756
|
|
# If the date is greater than the current time, we suppose
|
|
# that the log is not from this year but from the year before
|
|
if time.mktime(date) > time.time():
|
|
date[0] -= 1
|
|
unixTime = time.mktime(date)
|
|
return unixTime
|