mirror of
https://framagit.org/ppom/reaction
synced 2024-06-02 16:42:11 +02:00
Compare commits
82 commits
Author | SHA1 | Date | |
---|---|---|---|
014a53fe94 | |||
e070e96827 | |||
d7e794acc1 | |||
e757c8116c | |||
9fd9fc5e2c | |||
c2c6e6269a | |||
04eece0644 | |||
a608ed1fd3 | |||
131d8eced9 | |||
ae2fd3dfa5 | |||
c0b080ea27 | |||
c3641c2693 | |||
936cebd643 | |||
e8e3f4715b | |||
18c40b7b9a | |||
66c397e62f | |||
c87595a90f | |||
350dd261f2 | |||
0766bdb3b5 | |||
5598c79841 | |||
170462ee1e | |||
3784e4f1be | |||
4634bbcb8e | |||
a2be0c2ac6 | |||
92ea6acfa7 | |||
95c79a9dca | |||
aec50ed54e | |||
b26a763cb0 | |||
11cff7fb05 | |||
d2617d0d9f | |||
674764ed05 | |||
aa944cf05c | |||
3d697a5003 | |||
38000b102f | |||
196e157e46 | |||
76a2ecaecf | |||
57b72a04e8 | |||
2930a67f89 | |||
d9303c6249 | |||
13395a37f5 | |||
dffd369427 | |||
2b548ffb11 | |||
c354d9812f | |||
ad7091e6e7 | |||
8e1c67cead | |||
3ee48fa08e | |||
86bd75b926 | |||
0b4030905b | |||
8afa6281f4 | |||
c076177d2b | |||
bff697dc17 | |||
bfe0128764 | |||
0a1614ea4d | |||
03862b33a6 | |||
48fb6a85a5 | |||
b8032acf97 | |||
ea29a0467a | |||
73dc9f63d6 | |||
84d40b3eda | |||
58b624e0b9 | |||
fe7806c4d7 | |||
af2f092b71 | |||
2b2275c547 | |||
bc13342e06 | |||
e1ff702cd1 | |||
ed809f4f98 | |||
52dbbdcdb2 | |||
b441e91f84 | |||
9ce589b07d | |||
592b60172a | |||
ec60a3d506 | |||
8874454a0f | |||
c2723d3829 | |||
9b766aa2b8 | |||
f662a485b9 | |||
f6f26f283e | |||
b834e02755 | |||
380599c80a | |||
50e214c403 | |||
9d847657d1 | |||
7afe7e9b6f | |||
55d098c69c |
8
.gitignore
vendored
8
.gitignore
vendored
|
@ -1,5 +1,13 @@
|
|||
/reaction
|
||||
/ip46tables
|
||||
/nft46
|
||||
/reaction*.db
|
||||
/reaction*.sock
|
||||
/result
|
||||
/wiki
|
||||
/deb
|
||||
*.deb
|
||||
*.minisig
|
||||
*.qcow2
|
||||
debian-packaging/*
|
||||
*.swp
|
||||
|
|
15
.gitlab-ci.yml
Normal file
15
.gitlab-ci.yml
Normal file
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
image: golang:1.20-bookworm
|
||||
stages:
|
||||
- build
|
||||
|
||||
variables:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
|
||||
test_building:
|
||||
stage: build
|
||||
before_script:
|
||||
- apt-get -qq -y update
|
||||
- apt-get -qq -y install build-essential devscripts debhelper quilt wget
|
||||
script:
|
||||
- make reaction ip46tables nft46
|
52
Makefile
52
Makefile
|
@ -1,9 +1,51 @@
|
|||
all: reaction ip46tables
|
||||
CC ?= gcc
|
||||
PREFIX ?= /usr/local
|
||||
BINDIR = $(PREFIX)/bin
|
||||
SYSTEMDDIR ?= /etc/systemd
|
||||
|
||||
all: reaction ip46tables nft46
|
||||
|
||||
clean:
|
||||
rm -f reaction ip46tables
|
||||
ip46tables: ip46tables.d/ip46tables.c
|
||||
gcc -static ip46tables.d/ip46tables.c -o ip46tables
|
||||
rm -f reaction ip46tables nft46 reaction*.deb reaction.minisig ip46tables.minisig nft46.minisig reaction*.deb.minisig
|
||||
rm -rf debian-packaging
|
||||
|
||||
ip46tables: helpers_c/ip46tables.c
|
||||
$(CC) -s -static helpers_c/ip46tables.c -o ip46tables
|
||||
|
||||
nft46: helpers_c/nft46.c
|
||||
$(CC) -s -static helpers_c/nft46.c -o nft46
|
||||
|
||||
reaction: app/* reaction.go go.mod go.sum
|
||||
CGO_ENABLED=0 go build -buildvcs=false .
|
||||
CGO_ENABLED=0 go build -buildvcs=false -ldflags "-s -X main.version=`git tag --sort=v:refname | tail -n1` -X main.commit=`git rev-parse --short HEAD`"
|
||||
|
||||
reaction_%-1_amd64.deb:
|
||||
apt-get -qq -y update
|
||||
apt-get -qq -y install build-essential devscripts debhelper quilt wget
|
||||
if [ -e debian-packaging ]; then rm -rf debian-packaging; fi
|
||||
mkdir debian-packaging
|
||||
wget "https://framagit.org/ppom/reaction/-/archive/v${*}/reaction-v${*}.tar.gz" -O "debian-packaging/reaction_${*}.orig.tar.gz"
|
||||
cd debian-packaging && tar xf "reaction_${*}.orig.tar.gz"
|
||||
cp -r debian "debian-packaging/reaction-v${*}"
|
||||
if [ -e "debian/changelog" ]; then \
|
||||
cd "debian-packaging/reaction-v${*}" && \
|
||||
DEBFULLNAME=ppom DEBEMAIL=reaction@ppom.me dch --package reaction --newversion "${*}-1" "New upstream release."; \
|
||||
else \
|
||||
cd "debian-packaging/reaction-v${*}" && \
|
||||
DEBFULLNAME=ppom DEBEMAIL=reaction@ppom.me dch --create --package reaction --newversion "${*}-1" "Initial release."; \
|
||||
fi
|
||||
cd "debian-packaging/reaction-v${*}" && DEBFULLNAME=ppom DEBEMAIL=reaction@ppom.me dch --release --distribution stable --urgency low ""
|
||||
cd "debian-packaging/reaction-v${*}" && debuild --prepend-path=/go/bin:/usr/local/go/bin -us -uc
|
||||
cp "debian-packaging/reaction-v${*}/debian/changelog" debian/
|
||||
cp "debian-packaging/reaction_${*}-1_amd64.deb" .
|
||||
|
||||
signatures_%: reaction_%-1_amd64.deb reaction ip46tables nft46
|
||||
minisign -Sm nft46 ip46tables reaction reaction_${*}-1_amd64.deb
|
||||
|
||||
install: all
|
||||
install -m755 reaction $(DESTDIR)$(BINDIR)
|
||||
install -m755 ip46tables $(DESTDIR)$(BINDIR)
|
||||
install -m755 nft46 $(DESTDIR)$(BINDIR)
|
||||
|
||||
install_systemd: install
|
||||
install -m644 config/reaction.example.service $(SYSTEMDDIR)/system/reaction.service
|
||||
sed -i 's#/usr/bin#$(DESTDIR)$(BINDIR)#' $(SYSTEMDDIR)/system/reaction.service
|
||||
|
|
76
README.md
76
README.md
|
@ -28,7 +28,7 @@ both are extensions of JSON, so JSON is transitively supported.
|
|||
|
||||
- See [reaction.yml](./app/example.yml) or [reaction.jsonnet](./config/example.jsonnet) for a fully explained reference
|
||||
- See [server.jsonnet](./config/server.jsonnet) for a real-world configuration
|
||||
- See [reaction.service](./config/reaction.service) for a systemd service file
|
||||
- See [reaction.example.service](./config/reaction.example.service) for a systemd service file
|
||||
- This quick example shows what's needed to prevent brute force attacks on an ssh server:
|
||||
|
||||
<details open>
|
||||
|
@ -97,9 +97,9 @@ local banFor(time) = {
|
|||
iptables([ '-I', 'INPUT', '-p', 'all', '-j', 'reaction' ]),
|
||||
],
|
||||
stop: [
|
||||
iptables([ '-D,', 'INPUT', '-p', 'all', '-j', 'reaction' ]),
|
||||
iptables([ '-F,', 'reaction' ]),
|
||||
iptables([ '-X,', 'reaction' ]),
|
||||
iptables([ '-D', 'INPUT', '-p', 'all', '-j', 'reaction' ]),
|
||||
iptables([ '-F', 'reaction' ]),
|
||||
iptables([ '-X', 'reaction' ]),
|
||||
],
|
||||
streams: {
|
||||
ssh: {
|
||||
|
@ -142,37 +142,81 @@ It will execute `iptables` when detecting ipv4, `ip6tables` when detecting ipv6
|
|||
|
||||
## Wiki
|
||||
|
||||
You'll find more ressources, service configurations, etc. on the [Wiki](https://framagit.org/ppom/reaction-wiki)!
|
||||
You'll find more ressources, service configurations, etc. on the [Wiki](https://reaction.ppom.me)!
|
||||
|
||||
## Installation
|
||||
|
||||
[![Packaging status](https://repology.org/badge/vertical-allrepos/reaction-fail2ban.svg)](https://repology.org/project/reaction-fail2ban/versions)
|
||||
|
||||
### Binaries
|
||||
|
||||
Executables are provided [here](https://u.ppom.me/reaction/releases/), for a standard x86-64 linux machine.
|
||||
Executables are provided [here](https://framagit.org/ppom/reaction/-/releases/), for a standard x86-64 linux machine.
|
||||
|
||||
A standard place to put such executables is `/usr/local/bin/`.
|
||||
|
||||
> Provided binaries in the previous section are compiled this way:
|
||||
```shell
|
||||
$ docker run -it --rm -e HOME=/tmp/ -v $(pwd):/tmp/code -w /tmp/code -u $(id -u) golang:1.20 make clean reaction.deb
|
||||
$ make signaturese
|
||||
```
|
||||
#### Signature verification
|
||||
|
||||
Starting at v1.0.3, all binaries are signed with public key `RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX`. You can check their authenticity with minisign:
|
||||
```bash
|
||||
minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m nft46
|
||||
minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m ip46tables
|
||||
minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m reaction
|
||||
# or
|
||||
minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m reaction.deb
|
||||
```
|
||||
|
||||
#### Debian
|
||||
|
||||
The releases also contain a `reaction.deb` file, which packages reaction & ip46tables.
|
||||
You can install it using `sudo apt install ./reaction.deb`.
|
||||
You'll have to create a configuration at `/etc/reaction.jsonnet`.
|
||||
|
||||
If you want to use another configuration format (YAML or JSON), you can override systemd's `ExecStart` command in `/etc/systemd/system/reaction.service` like this:
|
||||
```systemd
|
||||
[Service]
|
||||
# First an empty directive to reset the default one
|
||||
ExecStart=
|
||||
# Then put what you want
|
||||
ExecStart=/usr/bin/reaction start -c /etc/reaction.yml
|
||||
```
|
||||
|
||||
#### NixOS
|
||||
|
||||
- [ package ](https://framagit.org/ppom/nixos/-/blob/main/pkgs/reaction/default.nix)
|
||||
- [ module ](https://framagit.org/ppom/nixos/-/blob/main/modules/common/reaction.nix)
|
||||
|
||||
#### OpenBSD
|
||||
|
||||
[wiki](https://reaction.ppom.me/configs/openbsd.html)
|
||||
|
||||
### Compilation
|
||||
|
||||
You'll need the go (>= 1.20) toolchain for reaction and a c compiler for ip46tables.
|
||||
```shell
|
||||
$ make
|
||||
```
|
||||
Don't hesitate to take a look at the `Makefile` to understand what's happening!
|
||||
|
||||
Alternatively,
|
||||
### Installation
|
||||
|
||||
To install the binaries
|
||||
```shell
|
||||
# creates ./reaction
|
||||
$ go build .
|
||||
# creates ./ip46tables
|
||||
$ gcc ip46tables.d/ip46tables.c -o ip46tables
|
||||
make install
|
||||
```
|
||||
|
||||
Provided binaries in the previous section are compiled this way:
|
||||
To install the systemd file as well
|
||||
```shell
|
||||
$ docker run -it --rm -v $(pwd):/code -w /code -e CGO_ENABLED=0 golang:1.20 make
|
||||
make install_systemd
|
||||
```
|
||||
|
||||
### NixOS
|
||||
## Development
|
||||
|
||||
- [ package ](https://framagit.org/ppom/nixos/-/blob/main/pkgs/reaction/default.nix)
|
||||
- [ module ](https://framagit.org/ppom/nixos/-/blob/main/modules/common/reaction.nix)
|
||||
Contributions are welcome. For any substantial feature, please file an issue first, to be assured that we agree on the feature, and to avoid unnecessary work.
|
||||
|
||||
This is a free time project, so I'm not working on schedule.
|
||||
However, if you're willing to fund the project, I can priorise and plan paid work. This includes features, documentation and specific JSONnet configurations.
|
||||
|
|
377
app/client.go
377
app/client.go
|
@ -8,30 +8,35 @@ import (
|
|||
"net"
|
||||
"os"
|
||||
"regexp"
|
||||
"slices"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"framagit.org/ppom/reaction/logger"
|
||||
"sigs.k8s.io/yaml"
|
||||
)
|
||||
|
||||
const (
|
||||
Show = 0
|
||||
Info = 0
|
||||
Flush = 1
|
||||
)
|
||||
|
||||
type Request struct {
|
||||
Request int
|
||||
Pattern string
|
||||
Flush PSF
|
||||
}
|
||||
|
||||
type Response struct {
|
||||
Err error
|
||||
ClientStatus ClientStatus
|
||||
Err error
|
||||
// Config Conf
|
||||
Matches MatchesMap
|
||||
Actions ActionsMap
|
||||
}
|
||||
|
||||
func SendAndRetrieve(data Request) Response {
|
||||
conn, err := net.Dial("unix", *SocketPath)
|
||||
if err != nil {
|
||||
logger.Fatalln("Error opening connection top daemon:", err)
|
||||
logger.Fatalln("Error opening connection to daemon:", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
|
@ -52,7 +57,7 @@ type PatternStatus struct {
|
|||
Matches int `json:"matches,omitempty"`
|
||||
Actions map[string][]string `json:"actions,omitempty"`
|
||||
}
|
||||
type MapPatternStatus map[string]*PatternStatus
|
||||
type MapPatternStatus map[Match]*PatternStatus
|
||||
type MapPatternStatusFlush MapPatternStatus
|
||||
|
||||
type ClientStatus map[string]map[string]MapPatternStatus
|
||||
|
@ -76,107 +81,313 @@ func (csf ClientStatusFlush) MarshalJSON() ([]byte, error) {
|
|||
return json.Marshal(ret)
|
||||
}
|
||||
|
||||
// end block
|
||||
|
||||
func usage(err string) {
|
||||
fmt.Println("Usage: reactionc")
|
||||
fmt.Println("Usage: reactionc flush <PATTERN>")
|
||||
logger.Fatalln(err)
|
||||
func pfMatches(streamName string, filterName string, regexes map[string]*regexp.Regexp, match Match, filter *Filter) bool {
|
||||
// Check stream and filter match
|
||||
if streamName != "" && streamName != filter.Stream.Name {
|
||||
return false
|
||||
}
|
||||
if filterName != "" && filterName != filter.Name {
|
||||
return false
|
||||
}
|
||||
// Check that all user requested patterns are in this filter
|
||||
var nbMatched int
|
||||
var localMatches = match.Split()
|
||||
// For each pattern of this filter
|
||||
for i, pattern := range filter.Pattern {
|
||||
// Check that this pattern has user requested name
|
||||
if reg, ok := regexes[pattern.Name]; ok {
|
||||
// Check that the PF.p[i] matches user requested pattern
|
||||
if reg.MatchString(localMatches[i]) {
|
||||
nbMatched++
|
||||
}
|
||||
}
|
||||
}
|
||||
if len(regexes) != nbMatched {
|
||||
return false
|
||||
}
|
||||
// All checks passed
|
||||
return true
|
||||
}
|
||||
|
||||
func ClientShow(format, stream, filter string, regex *regexp.Regexp) {
|
||||
response := SendAndRetrieve(Request{Show, ""})
|
||||
if response.Err != nil {
|
||||
logger.Fatalln("Received error from daemon:", response.Err)
|
||||
func addMatchToCS(cs ClientStatus, pf PF, times map[time.Time]struct{}) {
|
||||
patterns, streamName, filterName := pf.P, pf.F.Stream.Name, pf.F.Name
|
||||
if cs[streamName] == nil {
|
||||
cs[streamName] = make(map[string]MapPatternStatus)
|
||||
}
|
||||
// Limit to stream, filter if exists
|
||||
if stream != "" {
|
||||
exists := false
|
||||
for streamName := range response.ClientStatus {
|
||||
if stream == streamName {
|
||||
if filter != "" {
|
||||
for filterName := range response.ClientStatus[streamName] {
|
||||
if filter == filterName {
|
||||
exists = true
|
||||
} else {
|
||||
delete(response.ClientStatus[streamName], filterName)
|
||||
}
|
||||
}
|
||||
} else {
|
||||
exists = true
|
||||
}
|
||||
} else {
|
||||
delete(response.ClientStatus, streamName)
|
||||
}
|
||||
}
|
||||
if !exists {
|
||||
logger.Println(logger.WARN, "No matching stream.filter items found. This does not mean it doesn't exist, maybe it just didn't receive any match.")
|
||||
os.Exit(1)
|
||||
}
|
||||
if cs[streamName][filterName] == nil {
|
||||
cs[streamName][filterName] = make(MapPatternStatus)
|
||||
}
|
||||
// Limit to pattern
|
||||
if regex != nil {
|
||||
for streamName := range response.ClientStatus {
|
||||
for filterName := range response.ClientStatus[streamName] {
|
||||
for patternName := range response.ClientStatus[streamName][filterName] {
|
||||
if !regex.MatchString(patternName) {
|
||||
delete(response.ClientStatus[streamName][filterName], patternName)
|
||||
}
|
||||
}
|
||||
if len(response.ClientStatus[streamName][filterName]) == 0 {
|
||||
delete(response.ClientStatus[streamName], filterName)
|
||||
}
|
||||
}
|
||||
if len(response.ClientStatus[streamName]) == 0 {
|
||||
delete(response.ClientStatus, streamName)
|
||||
}
|
||||
}
|
||||
cs[streamName][filterName][patterns] = &PatternStatus{len(times), nil}
|
||||
}
|
||||
|
||||
func addActionToCS(cs ClientStatus, pa PA, times map[time.Time]struct{}) {
|
||||
patterns, streamName, filterName, actionName := pa.P, pa.A.Filter.Stream.Name, pa.A.Filter.Name, pa.A.Name
|
||||
if cs[streamName] == nil {
|
||||
cs[streamName] = make(map[string]MapPatternStatus)
|
||||
}
|
||||
if cs[streamName][filterName] == nil {
|
||||
cs[streamName][filterName] = make(MapPatternStatus)
|
||||
}
|
||||
if cs[streamName][filterName][patterns] == nil {
|
||||
cs[streamName][filterName][patterns] = new(PatternStatus)
|
||||
}
|
||||
ps := cs[streamName][filterName][patterns]
|
||||
if ps.Actions == nil {
|
||||
ps.Actions = make(map[string][]string)
|
||||
}
|
||||
for then := range times {
|
||||
ps.Actions[actionName] = append(ps.Actions[actionName], then.Format(time.DateTime))
|
||||
}
|
||||
}
|
||||
|
||||
func printClientStatus(cs ClientStatus, format string) {
|
||||
var text []byte
|
||||
var err error
|
||||
if format == "json" {
|
||||
text, err = json.MarshalIndent(response.ClientStatus, "", " ")
|
||||
text, err = json.MarshalIndent(cs, "", " ")
|
||||
} else {
|
||||
text, err = yaml.Marshal(response.ClientStatus)
|
||||
text, err = yaml.Marshal(cs)
|
||||
}
|
||||
if err != nil {
|
||||
logger.Fatalln("Failed to convert daemon binary response to text format:", err)
|
||||
}
|
||||
fmt.Println(string(text))
|
||||
os.Exit(0)
|
||||
|
||||
fmt.Println(strings.ReplaceAll(string(text), "\\0", " "))
|
||||
}
|
||||
|
||||
func ClientFlush(pattern, streamfilter, format string) {
|
||||
response := SendAndRetrieve(Request{Flush, pattern})
|
||||
func compileKVPatterns(kvpatterns []string) map[string]*regexp.Regexp {
|
||||
var regexes map[string]*regexp.Regexp
|
||||
regexes = make(map[string]*regexp.Regexp)
|
||||
for _, p := range kvpatterns {
|
||||
// p syntax already checked in Main
|
||||
key, value, found := strings.Cut(p, "=")
|
||||
if !found {
|
||||
logger.Printf(logger.ERROR, "Bad argument: no `=` in %v", p)
|
||||
logger.Fatalln("Patterns must be prefixed by their name (e.g. ip=1.1.1.1)")
|
||||
}
|
||||
if regexes[key] != nil {
|
||||
logger.Fatalf("Bad argument: same pattern name provided multiple times: %v", key)
|
||||
}
|
||||
compiled, err := regexp.Compile(fmt.Sprintf("^%v$", value))
|
||||
if err != nil {
|
||||
logger.Fatalf("Bad argument: Could not compile: `%v`: %v", value, err)
|
||||
}
|
||||
regexes[key] = compiled
|
||||
}
|
||||
return regexes
|
||||
}
|
||||
|
||||
func ClientShow(format, stream, filter string, kvpatterns []string) {
|
||||
response := SendAndRetrieve(Request{Info, PSF{}})
|
||||
if response.Err != nil {
|
||||
logger.Fatalln("Received error from daemon:", response.Err)
|
||||
}
|
||||
|
||||
cs := make(ClientStatus)
|
||||
|
||||
var regexes map[string]*regexp.Regexp
|
||||
|
||||
if len(kvpatterns) != 0 {
|
||||
regexes = compileKVPatterns(kvpatterns)
|
||||
}
|
||||
|
||||
var found bool
|
||||
|
||||
// Painful data manipulation
|
||||
for pf, times := range response.Matches {
|
||||
// Check this PF is not empty
|
||||
if len(times) == 0 {
|
||||
continue
|
||||
}
|
||||
if !pfMatches(stream, filter, regexes, pf.P, pf.F) {
|
||||
continue
|
||||
}
|
||||
addMatchToCS(cs, pf, times)
|
||||
found = true
|
||||
}
|
||||
|
||||
// Painful data manipulation
|
||||
for pa, times := range response.Actions {
|
||||
// Check this PF is not empty
|
||||
if len(times) == 0 {
|
||||
continue
|
||||
}
|
||||
if !pfMatches(stream, filter, regexes, pa.P, pa.A.Filter) {
|
||||
continue
|
||||
}
|
||||
addActionToCS(cs, pa, times)
|
||||
found = true
|
||||
}
|
||||
|
||||
if !found {
|
||||
logger.Println(logger.WARN, "No matching stream.filter items found. This does not mean it doesn't exist, maybe it just didn't receive any match.")
|
||||
os.Exit(1)
|
||||
}
|
||||
var text []byte
|
||||
var err error
|
||||
if format == "json" {
|
||||
text, err = json.MarshalIndent(ClientStatusFlush(response.ClientStatus), "", " ")
|
||||
} else {
|
||||
text, err = yaml.Marshal(ClientStatusFlush(response.ClientStatus))
|
||||
}
|
||||
if err != nil {
|
||||
logger.Fatalln("Failed to convert daemon binary response to text format:", err)
|
||||
}
|
||||
fmt.Println(string(text))
|
||||
|
||||
printClientStatus(cs, format)
|
||||
|
||||
os.Exit(0)
|
||||
}
|
||||
|
||||
func Match(reg *regexp.Regexp, line string) {
|
||||
if reg.MatchString(line) {
|
||||
fmt.Printf("\033[32mmatching\033[0m: %v\n", line)
|
||||
} else {
|
||||
fmt.Printf("\033[31mno match\033[0m: %v\n", line)
|
||||
// TODO : Show values we just flushed - for now we got no details :
|
||||
/*
|
||||
* % ./reaction flush -l ssh.failedlogin login=".*t"
|
||||
* ssh:
|
||||
* failedlogin:
|
||||
* actions:
|
||||
* unban:
|
||||
* - "2024-04-30 15:27:28"
|
||||
* - "2024-04-30 15:27:28"
|
||||
* - "2024-04-30 15:27:28"
|
||||
* - "2024-04-30 15:27:28"
|
||||
*
|
||||
*/
|
||||
func ClientFlush(format, streamName, filterName string, patterns []string) {
|
||||
requestedPatterns := compileKVPatterns(patterns)
|
||||
|
||||
// Remember which Filters are compatible with the query
|
||||
filterCompatibility := make(map[SF]bool)
|
||||
isCompatible := func(filter *Filter) bool {
|
||||
sf := SF{filter.Stream.Name, filter.Name}
|
||||
compatible, ok := filterCompatibility[sf]
|
||||
|
||||
// already tested
|
||||
if ok {
|
||||
return compatible
|
||||
}
|
||||
|
||||
for k := range requestedPatterns {
|
||||
if -1 == slices.IndexFunc(filter.Pattern, func(pattern *Pattern) bool {
|
||||
return pattern.Name == k
|
||||
}) {
|
||||
filterCompatibility[sf] = false
|
||||
return false
|
||||
}
|
||||
}
|
||||
filterCompatibility[sf] = true
|
||||
return true
|
||||
}
|
||||
|
||||
// match functions
|
||||
kvMatch := func(filter *Filter, filterPatterns []string) bool {
|
||||
// For each user requested pattern
|
||||
for k, v := range requestedPatterns {
|
||||
// Find its index on the Filter.Pattern
|
||||
for i, pattern := range filter.Pattern {
|
||||
if k == pattern.Name {
|
||||
// Test the match
|
||||
if !v.MatchString(filterPatterns[i]) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
var found bool
|
||||
fullMatch := func(filter *Filter, match Match) bool {
|
||||
// Test if we limit by stream
|
||||
if streamName == "" || filter.Stream.Name == streamName {
|
||||
// Test if we limit by filter
|
||||
if filterName == "" || filter.Name == filterName {
|
||||
found = true
|
||||
filterPatterns := match.Split()
|
||||
return isCompatible(filter) && kvMatch(filter, filterPatterns)
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
response := SendAndRetrieve(Request{Info, PSF{}})
|
||||
if response.Err != nil {
|
||||
logger.Fatalln("Received error from daemon:", response.Err)
|
||||
}
|
||||
|
||||
commands := make([]PSF, 0)
|
||||
|
||||
cs := make(ClientStatus)
|
||||
|
||||
for pf, times := range response.Matches {
|
||||
if fullMatch(pf.F, pf.P) {
|
||||
commands = append(commands, PSF{pf.P, pf.F.Stream.Name, pf.F.Name})
|
||||
addMatchToCS(cs, pf, times)
|
||||
}
|
||||
}
|
||||
|
||||
for pa, times := range response.Actions {
|
||||
if fullMatch(pa.A.Filter, pa.P) {
|
||||
commands = append(commands, PSF{pa.P, pa.A.Filter.Stream.Name, pa.A.Filter.Name})
|
||||
addActionToCS(cs, pa, times)
|
||||
}
|
||||
}
|
||||
|
||||
if !found {
|
||||
logger.Println(logger.WARN, "No matching stream.filter items found. This does not mean it doesn't exist, maybe it just didn't receive any match.")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
for _, psf := range commands {
|
||||
response := SendAndRetrieve(Request{Flush, psf})
|
||||
if response.Err != nil {
|
||||
logger.Fatalln("Received error from daemon:", response.Err)
|
||||
}
|
||||
}
|
||||
|
||||
printClientStatus(cs, format)
|
||||
os.Exit(0)
|
||||
}
|
||||
|
||||
func MatchStdin(reg *regexp.Regexp) {
|
||||
scanner := bufio.NewScanner(os.Stdin)
|
||||
for scanner.Scan() {
|
||||
Match(reg, scanner.Text())
|
||||
func TestRegex(confFilename, regex, line string) {
|
||||
conf := parseConf(confFilename)
|
||||
|
||||
// Code close to app/startup.go
|
||||
var usedPatterns []*Pattern
|
||||
for _, pattern := range conf.Patterns {
|
||||
if strings.Contains(regex, pattern.nameWithBraces) {
|
||||
usedPatterns = append(usedPatterns, pattern)
|
||||
regex = strings.Replace(regex, pattern.nameWithBraces, pattern.Regex, 1)
|
||||
}
|
||||
}
|
||||
reg, err := regexp.Compile(regex)
|
||||
if err != nil {
|
||||
logger.Fatalln("ERROR the specified regex is invalid: %v", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
// Code close to app/daemon.go
|
||||
match := func(line string) {
|
||||
var ignored bool
|
||||
if matches := reg.FindStringSubmatch(line); matches != nil {
|
||||
if usedPatterns != nil {
|
||||
var result []string
|
||||
for _, p := range usedPatterns {
|
||||
match := matches[reg.SubexpIndex(p.Name)]
|
||||
result = append(result, match)
|
||||
if !p.notAnIgnore(&match) {
|
||||
ignored = true
|
||||
}
|
||||
}
|
||||
if !ignored {
|
||||
fmt.Printf("\033[32mmatching\033[0m %v: %v\n", WithBrackets(result), line)
|
||||
} else {
|
||||
fmt.Printf("\033[33mignore matching\033[0m %v: %v\n", WithBrackets(result), line)
|
||||
}
|
||||
} else {
|
||||
fmt.Printf("\033[32mmatching\033[0m [%v]:\n", line)
|
||||
}
|
||||
} else {
|
||||
fmt.Printf("\033[31mno match\033[0m: %v\n", line)
|
||||
}
|
||||
}
|
||||
|
||||
if line != "" {
|
||||
match(line)
|
||||
} else {
|
||||
logger.Println(logger.INFO, "no second argument: reading from stdin")
|
||||
scanner := bufio.NewScanner(os.Stdin)
|
||||
for scanner.Scan() {
|
||||
match(scanner.Text())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
183
app/daemon.go
183
app/daemon.go
|
@ -62,6 +62,12 @@ func runCommands(commands [][]string, moment string) bool {
|
|||
}
|
||||
|
||||
func (p *Pattern) notAnIgnore(match *string) bool {
|
||||
for _, regex := range p.compiledIgnoreRegex {
|
||||
if regex.MatchString(*match) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
for _, ignore := range p.Ignore {
|
||||
if ignore == *match {
|
||||
return false
|
||||
|
@ -71,105 +77,143 @@ func (p *Pattern) notAnIgnore(match *string) bool {
|
|||
}
|
||||
|
||||
// Whether one of the filter's regexes is matched on a line
|
||||
func (f *Filter) match(line *string) string {
|
||||
func (f *Filter) match(line *string) Match {
|
||||
for _, regex := range f.compiledRegex {
|
||||
|
||||
if matches := regex.FindStringSubmatch(*line); matches != nil {
|
||||
|
||||
match := matches[regex.SubexpIndex(f.pattern.name)]
|
||||
|
||||
if f.pattern.notAnIgnore(&match) {
|
||||
logger.Printf(logger.INFO, "%s.%s: match [%v]\n", f.stream.name, f.name, match)
|
||||
return match
|
||||
if f.Pattern != nil {
|
||||
var result []string
|
||||
for _, p := range f.Pattern {
|
||||
match := matches[regex.SubexpIndex(p.Name)]
|
||||
if p.notAnIgnore(&match) {
|
||||
result = append(result, match)
|
||||
}
|
||||
}
|
||||
if len(result) == len(f.Pattern) {
|
||||
logger.Printf(logger.INFO, "%s.%s: match %s", f.Stream.Name, f.Name, WithBrackets(result))
|
||||
return JoinMatch(result)
|
||||
}
|
||||
} else {
|
||||
logger.Printf(logger.INFO, "%s.%s: match [.]\n", f.Stream.Name, f.Name)
|
||||
// No pattern, so this match will never actually be used
|
||||
return "."
|
||||
}
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (f *Filter) sendActions(match string, at time.Time) {
|
||||
func (f *Filter) sendActions(match Match, at time.Time) {
|
||||
for _, a := range f.Actions {
|
||||
actionsC <- PAT{match, a, at.Add(a.afterDuration)}
|
||||
}
|
||||
}
|
||||
|
||||
func (a *Action) exec(match string) {
|
||||
wgActions.Add(1)
|
||||
go func() {
|
||||
defer wgActions.Done()
|
||||
func (a *Action) exec(match Match) {
|
||||
defer wgActions.Done()
|
||||
|
||||
var computedCommand []string
|
||||
|
||||
if a.Filter.Pattern != nil {
|
||||
computedCommand = make([]string, 0, len(a.Cmd))
|
||||
matches := match.Split()
|
||||
|
||||
computedCommand := make([]string, 0, len(a.Cmd))
|
||||
for _, item := range a.Cmd {
|
||||
computedCommand = append(computedCommand, strings.ReplaceAll(item, a.filter.pattern.nameWithBraces, match))
|
||||
for i, p := range a.Filter.Pattern {
|
||||
item = strings.ReplaceAll(item, p.nameWithBraces, matches[i])
|
||||
}
|
||||
computedCommand = append(computedCommand, item)
|
||||
}
|
||||
} else {
|
||||
computedCommand = a.Cmd
|
||||
}
|
||||
|
||||
logger.Printf(logger.INFO, "%s.%s.%s: run %s\n", a.filter.stream.name, a.filter.name, a.name, computedCommand)
|
||||
logger.Printf(logger.INFO, "%s.%s.%s: run %s\n", a.Filter.Stream.Name, a.Filter.Name, a.Name, computedCommand)
|
||||
|
||||
cmd := exec.Command(computedCommand[0], computedCommand[1:]...)
|
||||
cmd := exec.Command(computedCommand[0], computedCommand[1:]...)
|
||||
|
||||
if ret := cmd.Run(); ret != nil {
|
||||
logger.Printf(logger.ERROR, "%s.%s.%s: run %s, code %s\n", a.filter.stream.name, a.filter.name, a.name, computedCommand, ret)
|
||||
}
|
||||
}()
|
||||
if ret := cmd.Run(); ret != nil {
|
||||
logger.Printf(logger.ERROR, "%s.%s.%s: run %s, code %s\n", a.Filter.Stream.Name, a.Filter.Name, a.Name, computedCommand, ret)
|
||||
}
|
||||
}
|
||||
|
||||
func ActionsManager() {
|
||||
func ActionsManager(concurrency int) {
|
||||
// concurrency init
|
||||
execActionsC := make(chan PA)
|
||||
if concurrency > 0 {
|
||||
for i := 0; i < concurrency; i++ {
|
||||
go func() {
|
||||
var pa PA
|
||||
for {
|
||||
pa = <-execActionsC
|
||||
pa.A.exec(pa.P)
|
||||
}
|
||||
}()
|
||||
}
|
||||
} else {
|
||||
go func() {
|
||||
var pa PA
|
||||
for {
|
||||
pa = <-execActionsC
|
||||
go func(pa PA) {
|
||||
pa.A.exec(pa.P)
|
||||
}(pa)
|
||||
}
|
||||
}()
|
||||
}
|
||||
execAction := func(a *Action, p Match) {
|
||||
wgActions.Add(1)
|
||||
execActionsC <- PA{p, a}
|
||||
}
|
||||
|
||||
// main
|
||||
pendingActionsC := make(chan PAT)
|
||||
for {
|
||||
select {
|
||||
case pat := <-actionsC:
|
||||
pa := PA{pat.p, pat.a}
|
||||
pattern, action, then := pat.p, pat.a, pat.t
|
||||
pa := PA{pat.P, pat.A}
|
||||
pattern, action, then := pat.P, pat.A, pat.T
|
||||
now := time.Now()
|
||||
// check if must be executed now
|
||||
if then.Compare(now) <= 0 {
|
||||
action.exec(pattern)
|
||||
execAction(action, pattern)
|
||||
} else {
|
||||
actionsLock.Lock()
|
||||
if actions[pa] == nil {
|
||||
actions[pa] = make(map[time.Time]struct{})
|
||||
}
|
||||
actions[PA{pattern, action}][then] = struct{}{}
|
||||
actionsLock.Unlock()
|
||||
actions[pa][then] = struct{}{}
|
||||
go func(insidePat PAT, insideNow time.Time) {
|
||||
time.Sleep(insidePat.t.Sub(insideNow))
|
||||
time.Sleep(insidePat.T.Sub(insideNow))
|
||||
pendingActionsC <- insidePat
|
||||
}(pat, now)
|
||||
}
|
||||
case pat := <-pendingActionsC:
|
||||
pa := PA{pat.p, pat.a}
|
||||
pattern, action, then := pat.p, pat.a, pat.t
|
||||
actionsLock.Lock()
|
||||
pa := PA{pat.P, pat.A}
|
||||
pattern, action, then := pat.P, pat.A, pat.T
|
||||
if actions[pa] != nil {
|
||||
if _, ok := actions[pa][then]; ok {
|
||||
delete(actions[pa], then)
|
||||
action.exec(pattern)
|
||||
}
|
||||
delete(actions[pa], then)
|
||||
execAction(action, pattern)
|
||||
}
|
||||
actionsLock.Unlock()
|
||||
action.exec(pattern)
|
||||
case fo := <-flushToActionsC:
|
||||
ret := make(ActionsMap)
|
||||
actionsLock.Lock()
|
||||
for pa := range actions {
|
||||
if pa.p == fo.p {
|
||||
if fo.S == pa.A.Filter.Stream.Name &&
|
||||
fo.F == pa.A.Filter.Name &&
|
||||
fo.P == pa.P {
|
||||
for range actions[pa] {
|
||||
pa.a.exec(pa.p)
|
||||
execAction(pa.A, pa.P)
|
||||
}
|
||||
ret[pa] = actions[pa]
|
||||
delete(actions, pa)
|
||||
break
|
||||
}
|
||||
}
|
||||
actionsLock.Unlock()
|
||||
fo.ret <- ret
|
||||
case _, _ = <-stopActions:
|
||||
actionsLock.Lock()
|
||||
for pat := range actions {
|
||||
if pat.a.OnExit {
|
||||
pat.a.exec(pat.p)
|
||||
for pa := range actions {
|
||||
if pa.A.OnExit {
|
||||
for range actions[pa] {
|
||||
execAction(pa.A, pa.P)
|
||||
}
|
||||
}
|
||||
}
|
||||
actionsLock.Unlock()
|
||||
wgActions.Done()
|
||||
return
|
||||
}
|
||||
|
@ -177,7 +221,7 @@ func ActionsManager() {
|
|||
}
|
||||
|
||||
func MatchesManager() {
|
||||
var fo FlushMatchOrder
|
||||
var fo PSF
|
||||
var pft PFT
|
||||
end := false
|
||||
|
||||
|
@ -200,7 +244,7 @@ func MatchesManager() {
|
|||
matchesManagerHandleFlush(fo)
|
||||
case pft = <-matchesC:
|
||||
|
||||
entry := LogEntry{pft.t, 0, pft.p, pft.f.stream.name, pft.f.name, 0, false}
|
||||
entry := LogEntry{pft.T, 0, pft.P, pft.F.Stream.Name, pft.F.Name, 0, false}
|
||||
|
||||
entry.Exec = matchesManagerHandleMatch(pft)
|
||||
|
||||
|
@ -209,29 +253,25 @@ func MatchesManager() {
|
|||
}
|
||||
}
|
||||
|
||||
func matchesManagerHandleFlush(fo FlushMatchOrder) {
|
||||
ret := make(MatchesMap)
|
||||
func matchesManagerHandleFlush(fo PSF) {
|
||||
matchesLock.Lock()
|
||||
for pf := range matches {
|
||||
if fo.p == pf.p {
|
||||
if fo.ret != nil {
|
||||
ret[pf] = matches[pf]
|
||||
}
|
||||
if fo.S == pf.F.Stream.Name &&
|
||||
fo.F == pf.F.Name &&
|
||||
fo.P == pf.P {
|
||||
delete(matches, pf)
|
||||
break
|
||||
}
|
||||
}
|
||||
matchesLock.Unlock()
|
||||
if fo.ret != nil {
|
||||
fo.ret <- ret
|
||||
}
|
||||
}
|
||||
|
||||
func matchesManagerHandleMatch(pft PFT) bool {
|
||||
matchesLock.Lock()
|
||||
defer matchesLock.Unlock()
|
||||
|
||||
filter, pattern, then := pft.f, pft.p, pft.t
|
||||
pf := PF{pft.p, pft.f}
|
||||
filter, patterns, then := pft.F, pft.P, pft.T
|
||||
pf := PF{pft.P, pft.F}
|
||||
|
||||
if filter.Retry > 1 {
|
||||
// make sure map exists
|
||||
|
@ -255,7 +295,7 @@ func matchesManagerHandleMatch(pft PFT) bool {
|
|||
|
||||
if filter.Retry <= 1 || len(matches[pf]) >= filter.Retry {
|
||||
delete(matches, pf)
|
||||
filter.sendActions(pattern, then)
|
||||
filter.sendActions(patterns, then)
|
||||
return true
|
||||
}
|
||||
return false
|
||||
|
@ -263,7 +303,7 @@ func matchesManagerHandleMatch(pft PFT) bool {
|
|||
|
||||
func StreamManager(s *Stream, endedSignal chan *Stream) {
|
||||
defer wgStreams.Done()
|
||||
logger.Printf(logger.INFO, "%s: start %s\n", s.name, s.Cmd)
|
||||
logger.Printf(logger.INFO, "%s: start %s\n", s.Name, s.Cmd)
|
||||
|
||||
lines := cmdStdout(s.Cmd)
|
||||
for {
|
||||
|
@ -287,7 +327,6 @@ func StreamManager(s *Stream, endedSignal chan *Stream) {
|
|||
|
||||
var actions ActionsMap
|
||||
var matches MatchesMap
|
||||
var actionsLock sync.Mutex
|
||||
var matchesLock sync.Mutex
|
||||
|
||||
var stopStreams chan bool
|
||||
|
@ -322,10 +361,10 @@ var logsC chan LogEntry
|
|||
var actionsC chan PAT
|
||||
|
||||
// SocketManager, DatabaseManager → MatchesManager
|
||||
var flushToMatchesC chan FlushMatchOrder
|
||||
var flushToMatchesC chan PSF
|
||||
|
||||
// SocketManager → ActionsManager
|
||||
var flushToActionsC chan FlushActionOrder
|
||||
var flushToActionsC chan PSF
|
||||
|
||||
// SocketManager → DatabaseManager
|
||||
var flushToDatabaseC chan LogEntry
|
||||
|
@ -337,8 +376,8 @@ func Daemon(confFilename string) {
|
|||
matchesC = make(chan PFT)
|
||||
logsC = make(chan LogEntry)
|
||||
actionsC = make(chan PAT)
|
||||
flushToMatchesC = make(chan FlushMatchOrder)
|
||||
flushToActionsC = make(chan FlushActionOrder)
|
||||
flushToMatchesC = make(chan PSF)
|
||||
flushToActionsC = make(chan PSF)
|
||||
flushToDatabaseC = make(chan LogEntry)
|
||||
stopActions = make(chan bool)
|
||||
stopStreams = make(chan bool)
|
||||
|
@ -349,7 +388,7 @@ func Daemon(confFilename string) {
|
|||
|
||||
go DatabaseManager(conf)
|
||||
go MatchesManager()
|
||||
go ActionsManager()
|
||||
go ActionsManager(conf.Concurrency)
|
||||
|
||||
// Ready to start
|
||||
|
||||
|
@ -364,12 +403,12 @@ func Daemon(confFilename string) {
|
|||
go StreamManager(stream, endSignals)
|
||||
}
|
||||
|
||||
go SocketManager(conf.Streams)
|
||||
go SocketManager(conf)
|
||||
|
||||
for {
|
||||
select {
|
||||
case finishedStream := <-endSignals:
|
||||
logger.Printf(logger.ERROR, "%s stream finished", finishedStream.name)
|
||||
logger.Printf(logger.ERROR, "%s stream finished", finishedStream.Name)
|
||||
nbStreamsInExecution--
|
||||
if nbStreamsInExecution == 0 {
|
||||
quit(conf, false)
|
||||
|
|
|
@ -1,4 +1,11 @@
|
|||
---
|
||||
# This example configuration file is a good starting point, but you're
|
||||
# strongly encouraged to take a look at the full documentation: https://reaction.ppom.me
|
||||
#
|
||||
# This file is using the well-established YAML configuration language.
|
||||
# Note that the more powerful JSONnet configuration language is also supported
|
||||
# and that the documentation uses JSONnet
|
||||
|
||||
# definitions are just a place to put chunks of conf you want to reuse in another place
|
||||
# using YAML anchors `&name` and pointers `*name`
|
||||
# definitions are not readed by reaction
|
||||
|
@ -8,24 +15,35 @@ definitions:
|
|||
# ip46tables is a minimal C program (only POSIX dependencies) present as a subdirectory.
|
||||
# it permits to handle both ipv4/iptables and ipv6/ip6tables commands
|
||||
|
||||
# if set to a positive number → max number of concurrent actions
|
||||
# if set to a negative number → no limit
|
||||
# if not specified or set to 0 → defaults to the number of CPUs on the system
|
||||
concurrency: 0
|
||||
|
||||
# patterns are substitued in regexes.
|
||||
# when a filter performs an action, it replaces the found pattern
|
||||
patterns:
|
||||
ip:
|
||||
# reaction regex syntax is defined here: https://github.com/google/re2/wiki/Syntax
|
||||
regex: '(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})'
|
||||
# simple version: regex: '(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})'
|
||||
regex: '(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))'
|
||||
ignore:
|
||||
- 127.0.0.1
|
||||
- ::1
|
||||
# Patterns can be ignored based on regexes, it will try to match the whole string detected by the pattern
|
||||
# ignoreregex:
|
||||
# - '10\.0\.[0-9]{1,3}\.[0-9]{1,3}'
|
||||
|
||||
# Those commands will be executed in order at start, before everything else
|
||||
start:
|
||||
- [ 'ip46tables', '-w', '-N', 'reaction' ]
|
||||
- [ 'ip46tables', '-w', '-I', 'INPUT', '-p', 'all', '-j', 'reaction' ]
|
||||
- [ 'ip46tables', '-w', '-I', 'FORWARD', '-p', 'all', '-j', 'reaction' ]
|
||||
|
||||
# Those commands will be executed in order at stop, after everything else
|
||||
stop:
|
||||
- [ 'ip46tables', '-w,', '-D', 'INPUT', '-p', 'all', '-j', 'reaction' ]
|
||||
- [ 'ip46tables', '-w,', '-D', 'FORWARD', '-p', 'all', '-j', 'reaction' ]
|
||||
- [ 'ip46tables', '-w', '-F', 'reaction' ]
|
||||
- [ 'ip46tables', '-w', '-X', 'reaction' ]
|
||||
|
||||
|
@ -49,7 +67,7 @@ streams:
|
|||
# ip's regex is inserted in the following regex
|
||||
- 'authentication failure;.*rhost=<ip>'
|
||||
- 'Failed password for .* from <ip>'
|
||||
- 'Connection reset by authenticating user .* <ip>'
|
||||
- 'Connection (reset|closed) by (authenticating|invalid) user .* <ip>'
|
||||
# if retry and retryperiod are defined,
|
||||
# the actions will only take place if a same pattern is
|
||||
# found `retry` times in a `retryperiod` interval
|
||||
|
|
99
app/main.go
99
app/main.go
|
@ -5,7 +5,6 @@ import (
|
|||
"flag"
|
||||
"fmt"
|
||||
"os"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"framagit.org/ppom/reaction/logger"
|
||||
|
@ -49,10 +48,6 @@ func addLevelFlag(f *flag.FlagSet) *string {
|
|||
return addStringFlag([]string{"l", "loglevel"}, "INFO", f)
|
||||
}
|
||||
|
||||
func addPatternFlag(f *flag.FlagSet) *string {
|
||||
return addStringFlag([]string{"p", "pattern"}, "", f)
|
||||
}
|
||||
|
||||
func subCommandParse(f *flag.FlagSet, maxRemainingArgs int) {
|
||||
help := addBoolFlag([]string{"h", "help"}, f)
|
||||
f.Parse(os.Args[2:])
|
||||
|
@ -60,7 +55,8 @@ func subCommandParse(f *flag.FlagSet, maxRemainingArgs int) {
|
|||
basicUsage()
|
||||
os.Exit(0)
|
||||
}
|
||||
if len(f.Args()) > maxRemainingArgs {
|
||||
// -1 = no limit to remaining args
|
||||
if maxRemainingArgs > -1 && len(f.Args()) > maxRemainingArgs {
|
||||
fmt.Printf("ERROR unrecognized argument(s): %v\n", f.Args()[maxRemainingArgs:])
|
||||
basicUsage()
|
||||
os.Exit(1)
|
||||
|
@ -72,7 +68,11 @@ func basicUsage() {
|
|||
bold = "\033[1m"
|
||||
reset = "\033[0m"
|
||||
)
|
||||
fmt.Print(bold + `reaction start` + reset + `
|
||||
fmt.Print(
|
||||
bold + `reaction help` + reset + `
|
||||
# print this help message
|
||||
|
||||
` + bold + `reaction start` + reset + `
|
||||
# start the daemon
|
||||
|
||||
# options:
|
||||
|
@ -85,36 +85,50 @@ func basicUsage() {
|
|||
` + bold + `reaction example-conf` + reset + `
|
||||
# print a configuration file example
|
||||
|
||||
` + bold + `reaction show` + reset + `
|
||||
# show current matches and which actions are still to be run
|
||||
` + bold + `reaction show` + reset + ` [NAME=PATTERN...]
|
||||
# show current matches and which actions are still to be run for the specified PATTERN regexe(s)
|
||||
# (e.g know what is currenly banned)
|
||||
|
||||
reaction show
|
||||
reaction show "ip=192.168.1.1"
|
||||
reaction show "ip=192\.168\..*" login=root
|
||||
|
||||
# options:
|
||||
-s/--socket SOCKET # path to the client-daemon communication socket
|
||||
-f/--format yaml|json # (default: yaml)
|
||||
-l/--limit STREAM[.FILTER] # only show items related to this STREAM (or STREAM.FILTER)
|
||||
-p/--pattern PATTERN # only show items matching the PATTERN regex
|
||||
|
||||
` + bold + `reaction flush` + reset + ` TARGET
|
||||
# run currently active matches and pending actions for the specified TARGET
|
||||
` + bold + `reaction flush` + reset + ` NAME=PATTERN [NAME=PATTERN...]
|
||||
# remove currently active matches and run currently pending actions for the specified PATTERN regexe(s)
|
||||
# (then show flushed matches and actions)
|
||||
|
||||
reaction flush "ip=192.168.1.1"
|
||||
reaction flush "ip=192\.168\..*" login=root
|
||||
|
||||
# options:
|
||||
-s/--socket SOCKET # path to the client-daemon communication socket
|
||||
-f/--format yaml|json # (default: yaml)
|
||||
-l/--limit STREAM.FILTER # flush only items related to this STREAM.FILTER
|
||||
|
||||
` + bold + `reaction test-regex` + reset + ` REGEX LINE # test REGEX against LINE
|
||||
cat FILE | ` + bold + `reaction test-regex` + reset + ` REGEX # test REGEX against each line of FILE
|
||||
|
||||
# options:
|
||||
-c/--config CONFIG_FILE # configuration file in json, jsonnet or yaml format
|
||||
# optional: permits to use configured patterns like <ip> in regex
|
||||
|
||||
` + bold + `reaction version` + reset + `
|
||||
# print version information
|
||||
|
||||
see usage examples, service configurations and good practices
|
||||
on the ` + bold + `wiki` + reset + `: https://framagit.org/ppom/reaction-wiki
|
||||
on the ` + bold + `wiki` + reset + `: https://reaction.ppom.me
|
||||
`)
|
||||
}
|
||||
|
||||
//go:embed example.yml
|
||||
var exampleConf string
|
||||
|
||||
func Main() {
|
||||
func Main(version, commit string) {
|
||||
if len(os.Args) <= 1 {
|
||||
logger.Fatalln("No argument provided. Try `reaction help`")
|
||||
basicUsage()
|
||||
|
@ -125,6 +139,9 @@ func Main() {
|
|||
case "help", "-h", "-help", "--help":
|
||||
basicUsage()
|
||||
|
||||
case "version", "-v", "--version":
|
||||
fmt.Printf("reaction version %v commit %v\n", version, commit)
|
||||
|
||||
case "example-conf":
|
||||
subCommandParse(f, 0)
|
||||
fmt.Print(exampleConf)
|
||||
|
@ -152,12 +169,9 @@ func Main() {
|
|||
SocketPath = addSocketFlag(f)
|
||||
queryFormat := addFormatFlag(f)
|
||||
limit := addLimitFlag(f)
|
||||
pattern := addPatternFlag(f)
|
||||
subCommandParse(f, 0)
|
||||
subCommandParse(f, -1)
|
||||
if *queryFormat != "yaml" && *queryFormat != "json" {
|
||||
logger.Fatalln("only yaml and json formats are supported")
|
||||
f.PrintDefaults()
|
||||
os.Exit(1)
|
||||
}
|
||||
stream, filter := "", ""
|
||||
if *limit != "" {
|
||||
|
@ -169,57 +183,44 @@ func Main() {
|
|||
logger.Fatalln("-l/--limit: only one . separator is supported")
|
||||
}
|
||||
}
|
||||
var regex *regexp.Regexp
|
||||
var err error
|
||||
if *pattern != "" {
|
||||
regex, err = regexp.Compile(*pattern)
|
||||
if err != nil {
|
||||
logger.Fatalln("-p/--pattern: ", err)
|
||||
}
|
||||
}
|
||||
ClientShow(*queryFormat, stream, filter, regex)
|
||||
ClientShow(*queryFormat, stream, filter, f.Args())
|
||||
|
||||
case "flush":
|
||||
SocketPath = addSocketFlag(f)
|
||||
queryFormat := addFormatFlag(f)
|
||||
limit := addLimitFlag(f)
|
||||
subCommandParse(f, 1)
|
||||
subCommandParse(f, -1)
|
||||
if *queryFormat != "yaml" && *queryFormat != "json" {
|
||||
logger.Fatalln("only yaml and json formats are supported")
|
||||
f.PrintDefaults()
|
||||
os.Exit(1)
|
||||
}
|
||||
if f.Arg(0) == "" {
|
||||
logger.Fatalln("subcommand flush takes one TARGET argument")
|
||||
basicUsage()
|
||||
os.Exit(1)
|
||||
if len(f.Args()) == 0 {
|
||||
logger.Fatalln("subcommand flush takes at least one TARGET argument")
|
||||
}
|
||||
stream, filter := "", ""
|
||||
if *limit != "" {
|
||||
logger.Fatalln("for now, -l/--limit is not supported")
|
||||
os.Exit(1)
|
||||
splitSF := strings.Split(*limit, ".")
|
||||
stream = splitSF[0]
|
||||
if len(splitSF) == 2 {
|
||||
filter = splitSF[1]
|
||||
} else if len(splitSF) > 2 {
|
||||
logger.Fatalln("-l/--limit: only one . separator is supported")
|
||||
}
|
||||
}
|
||||
ClientFlush(f.Arg(0), *limit, *queryFormat)
|
||||
ClientFlush(*queryFormat, stream, filter, f.Args())
|
||||
|
||||
case "test-regex":
|
||||
// socket not needed, no interaction with the daemon
|
||||
confFilename := addConfFlag(f)
|
||||
subCommandParse(f, 2)
|
||||
if *confFilename == "" {
|
||||
logger.Println(logger.WARN, "no configuration file provided. Can't make use of registered patterns.")
|
||||
}
|
||||
if f.Arg(0) == "" {
|
||||
logger.Fatalln("subcommand test-regex takes at least one REGEX argument")
|
||||
basicUsage()
|
||||
os.Exit(1)
|
||||
}
|
||||
regex, err := regexp.Compile(f.Arg(0))
|
||||
if err != nil {
|
||||
logger.Fatalln("ERROR the specified regex is invalid: %v", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
if f.Arg(1) == "" {
|
||||
logger.Println(logger.INFO, "no second argument: reading from stdin")
|
||||
|
||||
MatchStdin(regex)
|
||||
} else {
|
||||
Match(regex, f.Arg(1))
|
||||
}
|
||||
TestRegex(*confFilename, f.Arg(0), f.Arg(1))
|
||||
|
||||
default:
|
||||
logger.Fatalf("subcommand %v not recognized. Try `reaction help`", os.Args[1])
|
||||
|
|
|
@ -125,7 +125,7 @@ func rotateDB(c *Conf, logDec *gob.Decoder, flushDec *gob.Decoder, logEnc *gob.E
|
|||
defer func() {
|
||||
for sf, t := range discardedEntries {
|
||||
if t > 0 {
|
||||
logger.Printf(logger.WARN, "info discarded %v times from the DBs: stream/filter not found: %s.%s\n", t, sf.s, sf.f)
|
||||
logger.Printf(logger.WARN, "info discarded %v times from the DBs: stream/filter not found: %s.%s\n", t, sf.S, sf.F)
|
||||
}
|
||||
}
|
||||
if malformedEntries > 0 {
|
||||
|
@ -134,7 +134,7 @@ func rotateDB(c *Conf, logDec *gob.Decoder, flushDec *gob.Decoder, logEnc *gob.E
|
|||
}()
|
||||
|
||||
// pattern, stream, fitler → last flush
|
||||
flushes := make(map[PSF]time.Time)
|
||||
flushes := make(map[*PSF]time.Time)
|
||||
for {
|
||||
var entry LogEntry
|
||||
var filter *Filter
|
||||
|
@ -160,7 +160,7 @@ func rotateDB(c *Conf, logDec *gob.Decoder, flushDec *gob.Decoder, logEnc *gob.E
|
|||
}
|
||||
|
||||
// store
|
||||
flushes[PSF{entry.Pattern, entry.Stream, entry.Filter}] = entry.T
|
||||
flushes[&PSF{entry.Pattern, entry.Stream, entry.Filter}] = entry.T
|
||||
}
|
||||
|
||||
lastTimeCpt := int64(0)
|
||||
|
@ -186,8 +186,8 @@ func rotateDB(c *Conf, logDec *gob.Decoder, flushDec *gob.Decoder, logEnc *gob.E
|
|||
discardedEntries[SF{"", ""}]++
|
||||
continue
|
||||
}
|
||||
entry.Stream = sf.s
|
||||
entry.Filter = sf.f
|
||||
entry.Stream = sf.S
|
||||
entry.Filter = sf.F
|
||||
}
|
||||
if stream := c.Streams[entry.Stream]; stream != nil {
|
||||
filter = stream.Filters[entry.Filter]
|
||||
|
@ -200,9 +200,14 @@ func rotateDB(c *Conf, logDec *gob.Decoder, flushDec *gob.Decoder, logEnc *gob.E
|
|||
readSF2int[entry.SF] = SF{entry.Stream, entry.Filter}
|
||||
}
|
||||
|
||||
// check if number of patterns is in sync
|
||||
if len(entry.Pattern.Split()) != len(filter.Pattern) {
|
||||
continue
|
||||
}
|
||||
|
||||
// check if it hasn't been flushed
|
||||
lastGlobalFlush := flushes[PSF{entry.Pattern, "", ""}].Unix()
|
||||
lastLocalFlush := flushes[PSF{entry.Pattern, entry.Stream, entry.Filter}].Unix()
|
||||
lastGlobalFlush := flushes[&PSF{entry.Pattern, "", ""}].Unix()
|
||||
lastLocalFlush := flushes[&PSF{entry.Pattern, entry.Stream, entry.Filter}].Unix()
|
||||
entryTime := entry.T.Unix()
|
||||
if lastLocalFlush > entryTime || lastGlobalFlush > entryTime {
|
||||
continue
|
||||
|
@ -226,7 +231,7 @@ func rotateDB(c *Conf, logDec *gob.Decoder, flushDec *gob.Decoder, logEnc *gob.E
|
|||
// replay executions
|
||||
if entry.Exec && entry.T.Add(*filter.longuestActionDuration).Unix() > now.Unix() {
|
||||
if startup {
|
||||
flushToMatchesC <- FlushMatchOrder{entry.Pattern, nil}
|
||||
flushToMatchesC <- PSF{entry.Pattern, entry.Stream, entry.Filter}
|
||||
filter.sendActions(entry.Pattern, entry.T)
|
||||
}
|
||||
|
||||
|
|
68
app/pipe.go
68
app/pipe.go
|
@ -2,58 +2,15 @@ package app
|
|||
|
||||
import (
|
||||
"encoding/gob"
|
||||
"errors"
|
||||
"net"
|
||||
"os"
|
||||
"path"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"framagit.org/ppom/reaction/logger"
|
||||
)
|
||||
|
||||
func genClientStatus(local_actions ActionsMap, local_matches MatchesMap, local_actionsLock, local_matchesLock *sync.Mutex) ClientStatus {
|
||||
cs := make(ClientStatus)
|
||||
local_matchesLock.Lock()
|
||||
|
||||
// Painful data manipulation
|
||||
for pf, times := range local_matches {
|
||||
pattern, filter := pf.p, pf.f
|
||||
if cs[filter.stream.name] == nil {
|
||||
cs[filter.stream.name] = make(map[string]MapPatternStatus)
|
||||
}
|
||||
if cs[filter.stream.name][filter.name] == nil {
|
||||
cs[filter.stream.name][filter.name] = make(MapPatternStatus)
|
||||
}
|
||||
cs[filter.stream.name][filter.name][pattern] = &PatternStatus{len(times), nil}
|
||||
}
|
||||
|
||||
local_matchesLock.Unlock()
|
||||
local_actionsLock.Lock()
|
||||
|
||||
// Painful data manipulation
|
||||
for pa, times := range local_actions {
|
||||
pattern, action := pa.p, pa.a
|
||||
if cs[action.filter.stream.name] == nil {
|
||||
cs[action.filter.stream.name] = make(map[string]MapPatternStatus)
|
||||
}
|
||||
if cs[action.filter.stream.name][action.filter.name] == nil {
|
||||
cs[action.filter.stream.name][action.filter.name] = make(MapPatternStatus)
|
||||
}
|
||||
if cs[action.filter.stream.name][action.filter.name][pattern] == nil {
|
||||
cs[action.filter.stream.name][action.filter.name][pattern] = new(PatternStatus)
|
||||
}
|
||||
ps := cs[action.filter.stream.name][action.filter.name][pattern]
|
||||
if ps.Actions == nil {
|
||||
ps.Actions = make(map[string][]string)
|
||||
}
|
||||
for then := range times {
|
||||
ps.Actions[action.name] = append(ps.Actions[action.name], then.Format(time.DateTime))
|
||||
}
|
||||
}
|
||||
local_actionsLock.Unlock()
|
||||
return cs
|
||||
}
|
||||
|
||||
func createOpenSocket() net.Listener {
|
||||
err := os.MkdirAll(path.Dir(*SocketPath), 0755)
|
||||
if err != nil {
|
||||
|
@ -75,7 +32,8 @@ func createOpenSocket() net.Listener {
|
|||
}
|
||||
|
||||
// Handle connections
|
||||
func SocketManager(streams map[string]*Stream) {
|
||||
//func SocketManager(streams map[string]*Stream) {
|
||||
func SocketManager(conf *Conf) {
|
||||
ln := createOpenSocket()
|
||||
defer ln.Close()
|
||||
for {
|
||||
|
@ -96,20 +54,20 @@ func SocketManager(streams map[string]*Stream) {
|
|||
}
|
||||
|
||||
switch request.Request {
|
||||
case Show:
|
||||
response.ClientStatus = genClientStatus(actions, matches, &actionsLock, &matchesLock)
|
||||
case Info:
|
||||
// response.Config = *conf
|
||||
response.Matches = matches
|
||||
response.Actions = actions
|
||||
case Flush:
|
||||
le := LogEntry{time.Now(), 0, request.Pattern, "", "", 0, false}
|
||||
matchesC := FlushMatchOrder{request.Pattern, make(chan MatchesMap)}
|
||||
actionsC := FlushActionOrder{request.Pattern, make(chan ActionsMap)}
|
||||
flushToMatchesC <- matchesC
|
||||
flushToActionsC <- actionsC
|
||||
le := LogEntry{time.Now(), 0, request.Flush.P, request.Flush.S, request.Flush.F, 0, false}
|
||||
|
||||
flushToMatchesC <- request.Flush
|
||||
flushToActionsC <- request.Flush
|
||||
flushToDatabaseC <- le
|
||||
|
||||
var lock sync.Mutex
|
||||
response.ClientStatus = genClientStatus(<-actionsC.ret, <-matchesC.ret, &lock, &lock)
|
||||
default:
|
||||
logger.Println(logger.ERROR, "Invalid Message from cli: unrecognised Request type")
|
||||
logger.Println(logger.ERROR, "Invalid Message from cli: unrecognised command type")
|
||||
response.Err = errors.New("unrecognised command type")
|
||||
return
|
||||
}
|
||||
|
||||
|
|
|
@ -5,6 +5,8 @@ import (
|
|||
"fmt"
|
||||
"os"
|
||||
"regexp"
|
||||
"runtime"
|
||||
"slices"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
|
@ -14,11 +16,21 @@ import (
|
|||
)
|
||||
|
||||
func (c *Conf) setup() {
|
||||
if c.Concurrency == 0 {
|
||||
c.Concurrency = runtime.NumCPU()
|
||||
}
|
||||
|
||||
for patternName := range c.Patterns {
|
||||
// Assure we iterate through c.Patterns map in reproductible order
|
||||
sortedPatternNames := make([]string, 0, len(c.Patterns))
|
||||
for k := range c.Patterns {
|
||||
sortedPatternNames = append(sortedPatternNames, k)
|
||||
}
|
||||
slices.Sort(sortedPatternNames)
|
||||
|
||||
for _, patternName := range sortedPatternNames {
|
||||
pattern := c.Patterns[patternName]
|
||||
pattern.name = patternName
|
||||
pattern.nameWithBraces = fmt.Sprintf("<%s>", pattern.name)
|
||||
pattern.Name = patternName
|
||||
pattern.nameWithBraces = fmt.Sprintf("<%s>", pattern.Name)
|
||||
|
||||
if pattern.Regex == "" {
|
||||
logger.Fatalf("Bad configuration: pattern's regex %v is empty!", patternName)
|
||||
|
@ -26,14 +38,25 @@ func (c *Conf) setup() {
|
|||
|
||||
compiled, err := regexp.Compile(fmt.Sprintf("^%v$", pattern.Regex))
|
||||
if err != nil {
|
||||
logger.Fatalf("Bad configuration: pattern %v doesn't compile!", patternName)
|
||||
logger.Fatalf("Bad configuration: pattern %v: %v", patternName, err)
|
||||
}
|
||||
c.Patterns[patternName].Regex = fmt.Sprintf("(?P<%s>%s)", patternName, pattern.Regex)
|
||||
pattern.Regex = fmt.Sprintf("(?P<%s>%s)", patternName, pattern.Regex)
|
||||
for _, ignore := range pattern.Ignore {
|
||||
if !compiled.MatchString(ignore) {
|
||||
logger.Fatalf("Bad configuration: pattern ignore '%v' doesn't match pattern %v! It should be fixed or removed.", ignore, pattern.nameWithBraces)
|
||||
}
|
||||
}
|
||||
|
||||
// Compile ignore regexes
|
||||
for _, regex := range pattern.IgnoreRegex {
|
||||
// Enclose the regex to make sure that it matches the whole detected string
|
||||
compiledRegex, err := regexp.Compile("^" + regex + "$")
|
||||
if err != nil {
|
||||
logger.Fatalf("Bad configuration: in ignoreregex of pattern %s: %v", pattern.Name, err)
|
||||
}
|
||||
|
||||
pattern.compiledIgnoreRegex = append(pattern.compiledIgnoreRegex, *compiledRegex)
|
||||
}
|
||||
}
|
||||
|
||||
if len(c.Streams) == 0 {
|
||||
|
@ -42,86 +65,81 @@ func (c *Conf) setup() {
|
|||
for streamName := range c.Streams {
|
||||
|
||||
stream := c.Streams[streamName]
|
||||
stream.name = streamName
|
||||
stream.Name = streamName
|
||||
|
||||
if strings.Contains(stream.name, ".") {
|
||||
logger.Fatalf("Bad configuration: character '.' is not allowed in stream names: '%v'", stream.name)
|
||||
if strings.Contains(stream.Name, ".") {
|
||||
logger.Fatalf("Bad configuration: character '.' is not allowed in stream names: '%v'", stream.Name)
|
||||
}
|
||||
|
||||
if len(stream.Filters) == 0 {
|
||||
logger.Fatalf("Bad configuration: no filters configured in %v", stream.name)
|
||||
logger.Fatalf("Bad configuration: no filters configured in %v", stream.Name)
|
||||
}
|
||||
for filterName := range stream.Filters {
|
||||
|
||||
filter := stream.Filters[filterName]
|
||||
filter.stream = stream
|
||||
filter.name = filterName
|
||||
filter.Stream = stream
|
||||
filter.Name = filterName
|
||||
|
||||
if strings.Contains(filter.name, ".") {
|
||||
logger.Fatalf("Bad configuration: character '.' is not allowed in filter names: '%v'", filter.name)
|
||||
if strings.Contains(filter.Name, ".") {
|
||||
logger.Fatalf("Bad configuration: character '.' is not allowed in filter names: '%v'", filter.Name)
|
||||
}
|
||||
// Parse Duration
|
||||
if filter.RetryPeriod == "" {
|
||||
if filter.Retry > 1 {
|
||||
logger.Fatalf("Bad configuration: retry but no retryperiod in %v.%v", stream.name, filter.name)
|
||||
logger.Fatalf("Bad configuration: retry but no retryperiod in %v.%v", stream.Name, filter.Name)
|
||||
}
|
||||
} else {
|
||||
retryDuration, err := time.ParseDuration(filter.RetryPeriod)
|
||||
if err != nil {
|
||||
logger.Fatalf("Bad configuration: Failed to parse retry time in %v.%v: %v", stream.name, filter.name, err)
|
||||
logger.Fatalf("Bad configuration: Failed to parse retry time in %v.%v: %v", stream.Name, filter.Name, err)
|
||||
}
|
||||
filter.retryDuration = retryDuration
|
||||
}
|
||||
|
||||
if len(filter.Regex) == 0 {
|
||||
logger.Fatalf("Bad configuration: no regexes configured in %v.%v", stream.name, filter.name)
|
||||
logger.Fatalf("Bad configuration: no regexes configured in %v.%v", stream.Name, filter.Name)
|
||||
}
|
||||
// Compute Regexes
|
||||
// Look for Patterns inside Regexes
|
||||
for _, regex := range filter.Regex {
|
||||
for patternName, pattern := range c.Patterns {
|
||||
// iterate through patterns in reproductible order
|
||||
for _, patternName := range sortedPatternNames {
|
||||
pattern := c.Patterns[patternName]
|
||||
if strings.Contains(regex, pattern.nameWithBraces) {
|
||||
|
||||
if filter.pattern == nil {
|
||||
filter.pattern = pattern
|
||||
} else if filter.pattern == pattern {
|
||||
// no op
|
||||
} else {
|
||||
logger.Fatalf(
|
||||
"Bad configuration: Can't mix different patterns (%s, %s) in same filter (%s.%s)\n",
|
||||
filter.pattern.name, patternName, streamName, filterName,
|
||||
)
|
||||
if !slices.Contains(filter.Pattern, pattern) {
|
||||
filter.Pattern = append(filter.Pattern, pattern)
|
||||
}
|
||||
|
||||
// FIXME should go in the `if filter.pattern == nil`?
|
||||
regex = strings.Replace(regex, pattern.nameWithBraces, pattern.Regex, 1)
|
||||
}
|
||||
}
|
||||
// TODO regexp.Compile and show proper message if it doesn't instead of panicing
|
||||
filter.compiledRegex = append(filter.compiledRegex, *regexp.MustCompile(regex))
|
||||
compiledRegex, err := regexp.Compile(regex)
|
||||
if err != nil {
|
||||
logger.Fatalf("Bad configuration: regex of filter %s.%s: %v", stream.Name, filter.Name, err)
|
||||
}
|
||||
filter.compiledRegex = append(filter.compiledRegex, *compiledRegex)
|
||||
}
|
||||
|
||||
if len(filter.Actions) == 0 {
|
||||
logger.Fatalln("Bad configuration: no actions configured in", stream.name, ".", filter.name)
|
||||
logger.Fatalln("Bad configuration: no actions configured in", stream.Name, ".", filter.Name)
|
||||
}
|
||||
for actionName := range filter.Actions {
|
||||
|
||||
action := filter.Actions[actionName]
|
||||
action.filter = filter
|
||||
action.name = actionName
|
||||
action.Filter = filter
|
||||
action.Name = actionName
|
||||
|
||||
if strings.Contains(action.name, ".") {
|
||||
logger.Fatalln("Bad configuration: character '.' is not allowed in action names", action.name)
|
||||
if strings.Contains(action.Name, ".") {
|
||||
logger.Fatalln("Bad configuration: character '.' is not allowed in action names", action.Name)
|
||||
}
|
||||
// Parse Duration
|
||||
if action.After != "" {
|
||||
afterDuration, err := time.ParseDuration(action.After)
|
||||
if err != nil {
|
||||
logger.Fatalln("Bad configuration: Failed to parse after time in ", stream.name, ".", filter.name, ".", action.name, ":", err)
|
||||
logger.Fatalln("Bad configuration: Failed to parse after time in ", stream.Name, ".", filter.Name, ".", action.Name, ":", err)
|
||||
}
|
||||
action.afterDuration = afterDuration
|
||||
} else if action.OnExit {
|
||||
logger.Fatalln("Bad configuration: Cannot have `onexit: true` without an `after` directive in", stream.name, ".", filter.name, ".", action.name)
|
||||
logger.Fatalln("Bad configuration: Cannot have `onexit: true` without an `after` directive in", stream.Name, ".", filter.Name, ".", action.Name)
|
||||
}
|
||||
if filter.longuestActionDuration == nil || filter.longuestActionDuration.Milliseconds() < action.afterDuration.Milliseconds() {
|
||||
filter.longuestActionDuration = &action.afterDuration
|
||||
|
@ -140,13 +158,11 @@ func parseConf(filename string) *Conf {
|
|||
|
||||
var conf Conf
|
||||
if filename[len(filename)-4:] == ".yml" || filename[len(filename)-5:] == ".yaml" {
|
||||
logger.Println(logger.DEBUG, "yaml")
|
||||
err = jsonnet.NewYAMLToJSONDecoder(data).Decode(&conf)
|
||||
if err != nil {
|
||||
logger.Fatalln("Failed to parse yaml configuration file:", err)
|
||||
}
|
||||
} else {
|
||||
logger.Println(logger.DEBUG, "json")
|
||||
var jsondata string
|
||||
jsondata, err = jsonnet.MakeVM().EvaluateFile(filename)
|
||||
if err == nil {
|
||||
|
|
158
app/types.go
158
app/types.go
|
@ -1,24 +1,31 @@
|
|||
package app
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/gob"
|
||||
"fmt"
|
||||
"os"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
type Conf struct {
|
||||
Patterns map[string]*Pattern `json:"patterns"`
|
||||
Streams map[string]*Stream `json:"streams"`
|
||||
Start [][]string `json:"start"`
|
||||
Stop [][]string `json:"stop"`
|
||||
Concurrency int `json:"concurrency"`
|
||||
Patterns map[string]*Pattern `json:"patterns"`
|
||||
Streams map[string]*Stream `json:"streams"`
|
||||
Start [][]string `json:"start"`
|
||||
Stop [][]string `json:"stop"`
|
||||
}
|
||||
|
||||
type Pattern struct {
|
||||
Regex string `json:"regex"`
|
||||
Ignore []string `json:"ignore"`
|
||||
|
||||
name string `json:"-"`
|
||||
IgnoreRegex []string `json:"ignoreregex"`
|
||||
compiledIgnoreRegex []regexp.Regexp `json:"-"`
|
||||
|
||||
Name string `json:"-"`
|
||||
nameWithBraces string `json:"-"`
|
||||
}
|
||||
|
||||
|
@ -26,19 +33,37 @@ type Pattern struct {
|
|||
// They're always referenced through pointers
|
||||
|
||||
type Stream struct {
|
||||
name string `json:"-"`
|
||||
Name string `json:"-"`
|
||||
|
||||
Cmd []string `json:"cmd"`
|
||||
Filters map[string]*Filter `json:"filters"`
|
||||
}
|
||||
type LilStream struct {
|
||||
Name string
|
||||
}
|
||||
|
||||
func (s *Stream) GobEncode() ([]byte, error) {
|
||||
var buf bytes.Buffer
|
||||
enc := gob.NewEncoder(&buf)
|
||||
err := enc.Encode(LilStream{s.Name})
|
||||
return buf.Bytes(), err
|
||||
}
|
||||
|
||||
func (s *Stream) GobDecode(b []byte)(error) {
|
||||
var ls LilStream
|
||||
dec := gob.NewDecoder(bytes.NewReader(b))
|
||||
err := dec.Decode(&ls)
|
||||
s.Name = ls.Name
|
||||
return err
|
||||
}
|
||||
|
||||
type Filter struct {
|
||||
stream *Stream `json:"-"`
|
||||
name string `json:"-"`
|
||||
Stream *Stream `json:"-"`
|
||||
Name string `json:"-"`
|
||||
|
||||
Regex []string `json:"regex"`
|
||||
compiledRegex []regexp.Regexp `json:"-"`
|
||||
pattern *Pattern `json:"-"`
|
||||
Pattern []*Pattern `json:"-"`
|
||||
|
||||
Retry int `json:"retry"`
|
||||
RetryPeriod string `json:"retryperiod"`
|
||||
|
@ -48,9 +73,34 @@ type Filter struct {
|
|||
longuestActionDuration *time.Duration
|
||||
}
|
||||
|
||||
// those small versions are needed to prevent infinite recursion in gob because of
|
||||
// data cycles: Stream <-> Filter, Filter <-> Action
|
||||
type LilFilter struct {
|
||||
Stream *Stream
|
||||
Name string
|
||||
Pattern []*Pattern
|
||||
}
|
||||
|
||||
func (f *Filter) GobDecode(b []byte)(error) {
|
||||
var lf LilFilter
|
||||
dec := gob.NewDecoder(bytes.NewReader(b))
|
||||
err := dec.Decode(&lf)
|
||||
f.Stream = lf.Stream
|
||||
f.Name = lf.Name
|
||||
f.Pattern = lf.Pattern
|
||||
return err
|
||||
}
|
||||
|
||||
func (f *Filter) GobEncode() ([]byte, error) {
|
||||
var buf bytes.Buffer
|
||||
enc := gob.NewEncoder(&buf)
|
||||
err := enc.Encode(LilFilter{f.Stream, f.Name, f.Pattern})
|
||||
return buf.Bytes(), err
|
||||
}
|
||||
|
||||
type Action struct {
|
||||
filter *Filter `json:"-"`
|
||||
name string `json:"-"`
|
||||
Filter *Filter `json:"-"`
|
||||
Name string `json:"-"`
|
||||
|
||||
Cmd []string `json:"cmd"`
|
||||
|
||||
|
@ -59,11 +109,31 @@ type Action struct {
|
|||
|
||||
OnExit bool `json:"onexit"`
|
||||
}
|
||||
type LilAction struct {
|
||||
Filter *Filter
|
||||
Name string
|
||||
}
|
||||
|
||||
func (a *Action) GobEncode() ([]byte, error) {
|
||||
var buf bytes.Buffer
|
||||
enc := gob.NewEncoder(&buf)
|
||||
err := enc.Encode(LilAction{a.Filter, a.Name})
|
||||
return buf.Bytes(), err
|
||||
}
|
||||
|
||||
func (a *Action) GobDecode(b []byte)(error) {
|
||||
var la LilAction
|
||||
dec := gob.NewDecoder(bytes.NewReader(b))
|
||||
err := dec.Decode(&la)
|
||||
a.Filter = la.Filter
|
||||
a.Name = la.Name
|
||||
return err
|
||||
}
|
||||
|
||||
type LogEntry struct {
|
||||
T time.Time
|
||||
S int64
|
||||
Pattern string
|
||||
Pattern Match
|
||||
Stream, Filter string
|
||||
SF int
|
||||
Exec bool
|
||||
|
@ -82,33 +152,49 @@ type WriteDB struct {
|
|||
type MatchesMap map[PF]map[time.Time]struct{}
|
||||
type ActionsMap map[PA]map[time.Time]struct{}
|
||||
|
||||
// Helper structs made to carry information
|
||||
type SF struct{ s, f string }
|
||||
type PSF struct{ p, s, f string }
|
||||
type PF struct {
|
||||
p string
|
||||
f *Filter
|
||||
// This is a "\x00" Joined string
|
||||
// which contains all matches on a line.
|
||||
type Match string
|
||||
|
||||
func (m *Match) Split() []string {
|
||||
return strings.Split(string(*m), "\x00")
|
||||
}
|
||||
type PFT struct {
|
||||
p string
|
||||
f *Filter
|
||||
t time.Time
|
||||
func JoinMatch(mm []string) Match {
|
||||
return Match(strings.Join(mm, "\x00"))
|
||||
}
|
||||
type PA struct {
|
||||
p string
|
||||
a *Action
|
||||
}
|
||||
type PAT struct {
|
||||
p string
|
||||
a *Action
|
||||
t time.Time
|
||||
func WithBrackets(mm []string) string {
|
||||
var b strings.Builder
|
||||
for _, match := range mm {
|
||||
fmt.Fprintf(&b, "[%s]", match)
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
|
||||
type FlushMatchOrder struct {
|
||||
p string
|
||||
ret chan MatchesMap
|
||||
// Helper structs made to carry information
|
||||
// Stream, Filter
|
||||
type SF struct{ S, F string }
|
||||
|
||||
// Pattern, Stream, Filter
|
||||
type PSF struct {
|
||||
P Match
|
||||
S, F string
|
||||
}
|
||||
type FlushActionOrder struct {
|
||||
p string
|
||||
ret chan ActionsMap
|
||||
|
||||
type PF struct {
|
||||
P Match
|
||||
F *Filter
|
||||
}
|
||||
type PFT struct {
|
||||
P Match
|
||||
F *Filter
|
||||
T time.Time
|
||||
}
|
||||
type PA struct {
|
||||
P Match
|
||||
A *Action
|
||||
}
|
||||
type PAT struct {
|
||||
P Match
|
||||
A *Action
|
||||
T time.Time
|
||||
}
|
||||
|
|
|
@ -1,13 +1,28 @@
|
|||
// This file is using JSONNET, a complete configuration language based on JSON
|
||||
// This file is using JSONnet, a complete configuration language based on JSON
|
||||
// See https://jsonnet.org
|
||||
// JSONNET is a superset of JSON, so one can write plain JSON files if wanted.
|
||||
// JSONnet is a superset of JSON, so one can write plain JSON files if wanted.
|
||||
// Note that YAML is also supported, see ./example.yml
|
||||
|
||||
// JSONNET functions
|
||||
// This example configuration file is a good starting point, but you're
|
||||
// strongly encouraged to take a look at the full documentation: https://reaction.ppom.me
|
||||
|
||||
// JSONnet functions
|
||||
local iptables(args) = ['ip46tables', '-w'] + args;
|
||||
// ip46tables is a minimal C program (only POSIX dependencies) present in a subdirectory of this repo.
|
||||
// ip46tables is a minimal C program (only POSIX dependencies) present in a
|
||||
// subdirectory of this repo.
|
||||
// it permits to handle both ipv4/iptables and ipv6/ip6tables commands
|
||||
|
||||
// See meaning and usage of this function around L106
|
||||
local banFor(time) = {
|
||||
ban: {
|
||||
cmd: iptables(['-A', 'reaction', '-s', '<ip>', '-j', 'DROP']),
|
||||
},
|
||||
unban: {
|
||||
after: time,
|
||||
cmd: iptables(['-D', 'reaction', '-s', '<ip>', '-j', 'DROP']),
|
||||
},
|
||||
};
|
||||
|
||||
{
|
||||
// patterns are substitued in regexes.
|
||||
// when a filter performs an action, it replaces the found pattern
|
||||
|
@ -15,27 +30,37 @@ local iptables(args) = ['ip46tables', '-w'] + args;
|
|||
ip: {
|
||||
// reaction regex syntax is defined here: https://github.com/google/re2/wiki/Syntax
|
||||
// jsonnet's @'string' is for verbatim strings
|
||||
regex: @'(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})',
|
||||
// simple version: regex: @'(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3})|(?:[0-9a-fA-F:]{2,90})',
|
||||
regex: @'(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))',
|
||||
ignore: ['127.0.0.1', '::1'],
|
||||
// Patterns can be ignored based on regexes, it will try to match the whole string detected by the pattern
|
||||
// ignoreregex: [@'10\.0\.[0-9]{1,3}\.[0-9]{1,3}'],
|
||||
},
|
||||
},
|
||||
|
||||
// if set to a positive number → max number of concurrent actions
|
||||
// if set to a negative number → no limit
|
||||
// if not specified or set to 0 → defaults to the number of CPUs on the system
|
||||
concurrency: 0,
|
||||
|
||||
// Those commands will be executed in order at start, before everything else
|
||||
start: [
|
||||
// Create an iptables chain for reaction
|
||||
iptables(['-N', 'reaction']),
|
||||
// Insert this chain as the first item of the INPUT chain (for incoming connections)
|
||||
// Insert this chain as the first item of the INPUT & FORWARD chains (for incoming connections)
|
||||
iptables(['-I', 'INPUT', '-p', 'all', '-j', 'reaction']),
|
||||
iptables(['-I', 'FORWARD', '-p', 'all', '-j', 'reaction']),
|
||||
],
|
||||
|
||||
// Those commands will be executed in order at stop, after everything else
|
||||
stop: [
|
||||
// Remove the chain from the INPUT chain
|
||||
iptables(['-D,', 'INPUT', '-p', 'all', '-j', 'reaction']),
|
||||
// Remove the chain from the INPUT & FORWARD chains
|
||||
iptables(['-D', 'INPUT', '-p', 'all', '-j', 'reaction']),
|
||||
iptables(['-D', 'FORWARD', '-p', 'all', '-j', 'reaction']),
|
||||
// Empty the chain
|
||||
iptables(['-F,', 'reaction']),
|
||||
iptables(['-F', 'reaction']),
|
||||
// Delete the chain
|
||||
iptables(['-X,', 'reaction']),
|
||||
iptables(['-X', 'reaction']),
|
||||
],
|
||||
|
||||
// streams are commands
|
||||
|
@ -58,7 +83,7 @@ local iptables(args) = ['ip46tables', '-w'] + args;
|
|||
// ip's regex is inserted in the following regex
|
||||
@'authentication failure;.*rhost=<ip>',
|
||||
@'Failed password for .* from <ip>',
|
||||
@'Connection reset by authenticating user .* <ip>',
|
||||
@'Connection (reset|closed) by (authenticating|invalid) user .* <ip>',
|
||||
],
|
||||
// if retry and retryperiod are defined,
|
||||
// the actions will only take place if a same pattern is
|
||||
|
@ -85,6 +110,8 @@ local iptables(args) = ['ip46tables', '-w'] + args;
|
|||
// (with the stop commands)
|
||||
},
|
||||
},
|
||||
// or use the banFor function defined at the beginning!
|
||||
// actions: banFor('48h'),
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
|
@ -7,6 +7,8 @@ patterns:
|
|||
ignore:
|
||||
- 1.0.0.1
|
||||
|
||||
concurrency: 0
|
||||
|
||||
streams:
|
||||
tailDown1:
|
||||
cmd: [ 'sh', '-c', 'sleep 2; seq 100010 | while read i; do echo found $(($i % 100)); done' ]
|
||||
|
@ -18,9 +20,9 @@ streams:
|
|||
retryperiod: 1m
|
||||
actions:
|
||||
damn:
|
||||
cmd: [ 'echo', '<num>' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
undamn:
|
||||
cmd: [ 'echo', 'undamn', '<num>' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
after: 1m
|
||||
onexit: false
|
||||
tailDown2:
|
||||
|
@ -33,9 +35,9 @@ streams:
|
|||
retryperiod: 1m
|
||||
actions:
|
||||
damn:
|
||||
cmd: [ 'echo', '<num>' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
undamn:
|
||||
cmd: [ 'echo', 'undamn', '<num>' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
after: 1m
|
||||
onexit: false
|
||||
tailDown3:
|
||||
|
@ -48,9 +50,9 @@ streams:
|
|||
retryperiod: 2m
|
||||
actions:
|
||||
damn:
|
||||
cmd: [ 'true' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
undamn:
|
||||
cmd: [ 'true' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
after: 1m
|
||||
onexit: false
|
||||
tailDown4:
|
||||
|
@ -63,8 +65,8 @@ streams:
|
|||
retryperiod: 2m
|
||||
actions:
|
||||
damn:
|
||||
cmd: [ 'echo', '<num>' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
undamn:
|
||||
cmd: [ 'echo', 'undamn', '<num>' ]
|
||||
cmd: [ 'sleep', '0.<num>' ]
|
||||
after: 1m
|
||||
onexit: false
|
||||
|
|
|
@ -1,10 +1,16 @@
|
|||
# vim: ft=systemd
|
||||
[Unit]
|
||||
Description=A daemon that scans program outputs for repeated patterns, and takes action.
|
||||
Documentation=https://reaction.ppom.me
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
# Ensure reaction will insert its chain after docker has inserted theirs. Only useful when iptables & docker are used
|
||||
# After=docker.service
|
||||
|
||||
# See `man systemd.exec` and `man systemd.service` for most options below
|
||||
[Service]
|
||||
ExecStart=/path/to/reaction start -c /etc/reaction.yml
|
||||
ExecStart=/usr/bin/reaction start -c /etc/reaction.jsonnet
|
||||
|
||||
# Ask systemd to create /var/lib/reaction (/var/lib/ is implicit)
|
||||
StateDirectory=reaction
|
|
@ -15,7 +15,9 @@ local banFor(time) = {
|
|||
// IPs can be IPv4 or IPv6
|
||||
// ip46tables (C program also in this repo) handles running the good commands
|
||||
ip: {
|
||||
regex: @'(([0-9]{1,3}\.){3}[0-9]{1,3})|([0-9a-fA-F:]{2,90})',
|
||||
regex: @'(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}|(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))',
|
||||
// Ignore all from 192.168.1.1 to 192.168.1.255
|
||||
ignore: std.makeArray(255, function(i) '192.168.1.' + (i + 1)),
|
||||
},
|
||||
},
|
||||
|
||||
|
@ -37,7 +39,7 @@ local banFor(time) = {
|
|||
failedlogin: {
|
||||
regex: [
|
||||
@'authentication failure;.*rhost=<ip>',
|
||||
@'Connection reset by authenticating user .* <ip>',
|
||||
@'Connection (reset|closed) by (authenticating|invalid) user .* <ip>',
|
||||
@'Failed password for .* from <ip>',
|
||||
],
|
||||
retry: 3,
|
||||
|
@ -115,7 +117,7 @@ local banFor(time) = {
|
|||
// Ban hosts presenting themselves as bots of ChatGPT
|
||||
gptbot: {
|
||||
regex: [@'^<ip>.*GPTBot/1.0'],
|
||||
action: banFor('720h'),
|
||||
actions: banFor('720h'),
|
||||
},
|
||||
|
||||
// Ban hosts failing to connect to slskd
|
||||
|
@ -150,7 +152,7 @@ local banFor(time) = {
|
|||
// Do not include this if a client must retrieve a config.json file ;)
|
||||
@'^<ip>.*"GET /(?:[^/" ]*/)*config\.json ',
|
||||
],
|
||||
action: banFor('720h'),
|
||||
actions: banFor('720h'),
|
||||
},
|
||||
},
|
||||
},
|
||||
|
|
|
@ -2,28 +2,26 @@
|
|||
patterns: {
|
||||
num: {
|
||||
regex: '[0-9]+',
|
||||
ignore: ['1'],
|
||||
// ignoreregex: ['2.?'],
|
||||
},
|
||||
letter: {
|
||||
regex: '[a-z]+',
|
||||
ignore: ['b'],
|
||||
// ignoreregex: ['b.?'],
|
||||
},
|
||||
},
|
||||
|
||||
start: [
|
||||
['err'],
|
||||
['sleep', '1'],
|
||||
],
|
||||
|
||||
stop: [
|
||||
['sleep', '1'],
|
||||
// ['false'],
|
||||
['true'],
|
||||
],
|
||||
|
||||
streams: {
|
||||
tailDown1: {
|
||||
cmd: ['sh', '-c', "echo 1 2 3 4 5 | tr ' ' '\n' | while read i; do sleep 2; echo found $(($i % 10)); done"],
|
||||
// cmd: ['sh', '-c', "echo 1 2 3 4 5 1 2 3 4 5 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 1 2 3 4 | tr ' ' '\n' | while read i; do sleep 2; echo found $(($i % 10)); done"],
|
||||
cmd: ['sh', '-c', "echo 1_abc 2_abc 3_abc abc_1 abc_2 abc_3 | tr ' ' '\n' | while read i; do sleep 1; echo found $i; done; sleep 30"],
|
||||
filters: {
|
||||
findIP: {
|
||||
regex: ['^found <num>$'],
|
||||
retry: 3,
|
||||
regex: [
|
||||
'^found <num>_<letter>$',
|
||||
'^found <letter>_<num>$',
|
||||
],
|
||||
retry: 2,
|
||||
retryperiod: '30s',
|
||||
actions: {
|
||||
damn: {
|
||||
|
@ -31,32 +29,35 @@
|
|||
},
|
||||
undamn: {
|
||||
cmd: ['echo', 'undamn', '<num>'],
|
||||
after: '30s',
|
||||
after: '28s',
|
||||
onexit: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
tailDown2: {
|
||||
cmd: ['sh', '-c', "echo 1_abc 2_abc 3_abc abc_1 abc_2 abc_3 | tr ' ' '\n' | while read i; do sleep 1; echo found $i; done; sleep 30"],
|
||||
filters: {
|
||||
findIP: {
|
||||
regex: [
|
||||
'^found <num>_<letter>$',
|
||||
'^found <letter>_<num>$',
|
||||
],
|
||||
retry: 2,
|
||||
retryperiod: '30s',
|
||||
actions: {
|
||||
damn: {
|
||||
cmd: ['echo', '<num>'],
|
||||
},
|
||||
undamn: {
|
||||
cmd: ['echo', 'undamn', '<num>'],
|
||||
after: '28s',
|
||||
onexit: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
// tailDown2: {
|
||||
// cmd: ['sh', '-c', 'echo coucou; sleep 2m'],
|
||||
// filters: {
|
||||
// findIP: {
|
||||
// regex: ['^found <num>$'],
|
||||
// retry: 3,
|
||||
// retryperiod: '30s',
|
||||
// actions: {
|
||||
// damn: {
|
||||
// cmd: ['echo', '<num>'],
|
||||
// },
|
||||
// undamn: {
|
||||
// cmd: ['echo', 'undamn', '<num>'],
|
||||
// after: '30s',
|
||||
// onexit: true,
|
||||
// },
|
||||
// },
|
||||
// },
|
||||
// },
|
||||
// },
|
||||
},
|
||||
}
|
||||
|
|
11
debian/changelog
vendored
Normal file
11
debian/changelog
vendored
Normal file
|
@ -0,0 +1,11 @@
|
|||
reaction (1.4.0-1) stable; urgency=low
|
||||
|
||||
* New upstream release.
|
||||
|
||||
-- ppom <reaction@ppom.me> Wed, 29 May 2024 11:37:16 +0000
|
||||
|
||||
reaction (1.3.1-1) stable; urgency=low
|
||||
|
||||
* Initial release.
|
||||
|
||||
-- ppom <reaction@ppom.me> Sat, 06 Apr 2024 18:59:13 +0000
|
23
debian/control
vendored
Normal file
23
debian/control
vendored
Normal file
|
@ -0,0 +1,23 @@
|
|||
Source: reaction
|
||||
Maintainer: Luc Didry <luc.reaction@didry.org>
|
||||
Section: utils
|
||||
Priority: optional
|
||||
Standards-Version: 4.6.2
|
||||
Build-Depends: debhelper-compat (= 13)
|
||||
Homepage: https://framagit.org/ppom/reaction
|
||||
|
||||
Package: reaction
|
||||
Architecture: any
|
||||
Package-Type: deb
|
||||
Depends: ${shlibs:Depends}, ${misc:Depends}
|
||||
Description: daemon that scans program outputs for patterns, and takes action
|
||||
A common use of reaction is to scan ssh and web server logs,
|
||||
and ban hosts that cause multiple authentication errors.
|
||||
reaction doesn't have all the features of the honorable fail2ban,
|
||||
but it's ~10x faster and easier to configure.
|
||||
Tag: admin::automation, admin::logging, admin::monitoring,
|
||||
interface::commandline, interface::daemon,
|
||||
network::firewall, protocol::ip, role::program,
|
||||
security::authentication, security::firewall, security::ids,
|
||||
security::log-analyzer, use::login, use::monitor,
|
||||
works-with-format::plaintext, works-with::logfile, works-with::text
|
678
debian/copyright
vendored
Normal file
678
debian/copyright
vendored
Normal file
|
@ -0,0 +1,678 @@
|
|||
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
|
||||
Source: https://framagit.org/ppom/reaction
|
||||
Upstream-Name: reaction
|
||||
Upstream-Contact: ppom <reaction@ppom.me>
|
||||
License: AGPL-3
|
||||
|
||||
Files:
|
||||
*
|
||||
Copyright: 2023 ppom
|
||||
License: AGPL-3
|
||||
|
||||
Files:
|
||||
debian/*
|
||||
Copyright: 2024 Luc Didry
|
||||
License: AGPL-3
|
||||
|
||||
License: AGPL-3
|
||||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
Version 3, 19 November 2007
|
||||
.
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
.
|
||||
Preamble
|
||||
.
|
||||
The GNU Affero General Public License is a free, copyleft license for
|
||||
software and other kinds of works, specifically designed to ensure
|
||||
cooperation with the community in the case of network server software.
|
||||
.
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
our General Public Licenses are intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users.
|
||||
.
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
.
|
||||
Developers that use our General Public Licenses protect your rights
|
||||
with two steps: (1) assert copyright on the software, and (2) offer
|
||||
you this License which gives you legal permission to copy, distribute
|
||||
and/or modify the software.
|
||||
.
|
||||
A secondary benefit of defending all users' freedom is that
|
||||
improvements made in alternate versions of the program, if they
|
||||
receive widespread use, become available for other developers to
|
||||
incorporate. Many developers of free software are heartened and
|
||||
encouraged by the resulting cooperation. However, in the case of
|
||||
software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and
|
||||
letting the public access it on a server without ever releasing its
|
||||
source code to the public.
|
||||
.
|
||||
The GNU Affero General Public License is designed specifically to
|
||||
ensure that, in such cases, the modified source code becomes available
|
||||
to the community. It requires the operator of a network server to
|
||||
provide the source code of the modified version running there to the
|
||||
users of that server. Therefore, public use of a modified version, on
|
||||
a publicly accessible server, gives the public access to the source
|
||||
code of the modified version.
|
||||
.
|
||||
An older license, called the Affero General Public License and
|
||||
published by Affero, was designed to accomplish similar goals. This is
|
||||
a different license, not a version of the Affero GPL, but Affero has
|
||||
released a new version of the Affero GPL which permits relicensing under
|
||||
this license.
|
||||
.
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
.
|
||||
TERMS AND CONDITIONS
|
||||
.
|
||||
0. Definitions.
|
||||
.
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
.
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
.
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
.
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
.
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
.
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
.
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
.
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
.
|
||||
1. Source Code.
|
||||
.
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
.
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
.
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
.
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
.
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
.
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
.
|
||||
2. Basic Permissions.
|
||||
.
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
.
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
.
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
.
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
.
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
.
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
.
|
||||
4. Conveying Verbatim Copies.
|
||||
.
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
.
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
.
|
||||
5. Conveying Modified Source Versions.
|
||||
.
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
.
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
.
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
.
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
.
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
.
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
.
|
||||
6. Conveying Non-Source Forms.
|
||||
.
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
.
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
.
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
.
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
.
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
.
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
.
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
.
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
.
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
.
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
.
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
.
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
.
|
||||
7. Additional Terms.
|
||||
.
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
.
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
.
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
.
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
.
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
.
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
.
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
.
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
.
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
.
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
.
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
.
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
.
|
||||
8. Termination.
|
||||
.
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
.
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
.
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
.
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
.
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
.
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
.
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
.
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
.
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
.
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
.
|
||||
11. Patents.
|
||||
.
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
.
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
.
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
.
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
.
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
.
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
.
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
.
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
.
|
||||
12. No Surrender of Others' Freedom.
|
||||
.
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
.
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
.
|
||||
Notwithstanding any other provision of this License, if you modify the
|
||||
Program, your modified version must prominently offer all users
|
||||
interacting with it remotely through a computer network (if your version
|
||||
supports such interaction) an opportunity to receive the Corresponding
|
||||
Source of your version by providing access to the Corresponding Source
|
||||
from a network server at no charge, through some standard or customary
|
||||
means of facilitating copying of software. This Corresponding Source
|
||||
shall include the Corresponding Source for any work covered by version 3
|
||||
of the GNU General Public License that is incorporated pursuant to the
|
||||
following paragraph.
|
||||
.
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the work with which it is combined will remain governed by version
|
||||
3 of the GNU General Public License.
|
||||
.
|
||||
14. Revised Versions of this License.
|
||||
.
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU Affero General Public License from time to time. Such new versions
|
||||
will be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
.
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU Affero General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU Affero General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
.
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU Affero General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
.
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
.
|
||||
15. Disclaimer of Warranty.
|
||||
.
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
.
|
||||
16. Limitation of Liability.
|
||||
.
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
.
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
.
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
.
|
||||
END OF TERMS AND CONDITIONS
|
||||
.
|
||||
How to Apply These Terms to Your New Programs
|
||||
.
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
.
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
.
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
.
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU Affero General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
.
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU Affero General Public License for more details.
|
||||
.
|
||||
You should have received a copy of the GNU Affero General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
.
|
||||
If your software can interact with users remotely through a computer
|
||||
network, you should also make sure that it provides a way for users to
|
||||
get its source. For example, if your program is a web application, its
|
||||
interface could display a "Source" link that leads users to an archive
|
||||
of the code. There are many ways you could offer source, and different
|
||||
solutions will be better for different programs; see section 13 for the
|
||||
specific requirements.
|
||||
.
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU AGPL, see
|
||||
<http://www.gnu.org/licenses/>.
|
3
debian/reaction.dirs
vendored
Normal file
3
debian/reaction.dirs
vendored
Normal file
|
@ -0,0 +1,3 @@
|
|||
usr/bin
|
||||
usr/sbin
|
||||
lib/systemd/system
|
1
debian/reaction.lintian-overrides
vendored
Normal file
1
debian/reaction.lintian-overrides
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
reaction: initial-upload-closes-no-bugs
|
13
debian/reaction@.service
vendored
Normal file
13
debian/reaction@.service
vendored
Normal file
|
@ -0,0 +1,13 @@
|
|||
# vim: ft=systemd
|
||||
[Unit]
|
||||
Description=A daemon that scans program outputs for repeated patterns, and takes action.
|
||||
Documentation=https://framagit.org/ppom/reaction-wiki
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/reaction start -c /etc/%i
|
||||
StateDirectory=reaction
|
||||
RuntimeDirectory=reaction
|
||||
WorkingDirectory=/var/lib/reaction
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
8
debian/rules
vendored
Executable file
8
debian/rules
vendored
Executable file
|
@ -0,0 +1,8 @@
|
|||
#!/usr/bin/make -f
|
||||
%:
|
||||
dh $@
|
||||
|
||||
override_dh_auto_install:
|
||||
install -m755 reaction $$(pwd)/debian/reaction/usr/bin
|
||||
install -m755 nft46 $$(pwd)/debian/reaction/usr/sbin
|
||||
install -m755 ip46tables $$(pwd)/debian/reaction/usr/sbin
|
1
debian/source/format
vendored
Normal file
1
debian/source/format
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
3.0 (quilt)
|
2
go.mod
2
go.mod
|
@ -1,6 +1,6 @@
|
|||
module framagit.org/ppom/reaction
|
||||
|
||||
go 1.20
|
||||
go 1.21
|
||||
|
||||
require (
|
||||
github.com/google/go-jsonnet v0.20.0
|
||||
|
|
5
go.sum
5
go.sum
|
@ -1,9 +1,8 @@
|
|||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
|
||||
github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
|
||||
github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
|
||||
gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
|
||||
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
|
||||
sigs.k8s.io/yaml v1.1.0 h1:4A07+ZFc2wgJwo8YNlQpr1rVlgUDlxXHhPJciaPY5gs=
|
||||
|
|
97
helpers_c/nft46.c
Normal file
97
helpers_c/nft46.c
Normal file
|
@ -0,0 +1,97 @@
|
|||
#include<ctype.h>
|
||||
#include<errno.h>
|
||||
#include<stdio.h>
|
||||
#include<stdlib.h>
|
||||
#include<string.h>
|
||||
#include<unistd.h>
|
||||
|
||||
// nft46 'add element inet reaction ipvXbans { 1.2.3.4 }' → nft 'add element inet reaction ipv4bans { 1.2.3.4 }'
|
||||
// nft46 'add element inet reaction ipvXbans { a:b::c:d }' → nft 'add element inet reaction ipv6bans { a:b::c:d }'
|
||||
//
|
||||
// the character X is replaced by 4 or 6 depending on the address family of the specified IP
|
||||
//
|
||||
// Limitations:
|
||||
// - nft46 must receive exactly one argument
|
||||
// - only one IP must be given per command
|
||||
// - the IP must be between { braces }
|
||||
|
||||
int isIPv4(char *tab, int len) {
|
||||
int i;
|
||||
// IPv4 addresses are at least 7 chars long
|
||||
if (len < 7 || !isdigit(tab[0]) || !isdigit(tab[len-1])) {
|
||||
return 0;
|
||||
}
|
||||
// Each char must be a digit or a dot between 2 digits
|
||||
for (i=1; i<len-1; i++) {
|
||||
if (!isdigit(tab[i]) && !(tab[i] == '.' && isdigit(tab[i-1]) && isdigit(tab[i+1]))) {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int isIPv6(char *tab, int len) {
|
||||
int i;
|
||||
// IPv6 addresses are at least 3 chars long
|
||||
if (len < 3) {
|
||||
return 0;
|
||||
}
|
||||
// Each char must be a digit, :, a-f, or A-F
|
||||
for (i=0; i<len; i++) {
|
||||
if (!isdigit(tab[i]) && tab[i] != ':' && tab[i] != '.' && !(tab[i] >= 'a' && tab[i] <= 'f') && !(tab[i] >= 'A' && tab[i] <= 'F')) {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
int findchar(char *tab, char c, int i, int len) {
|
||||
while (i < len && tab[i] != c) i++;
|
||||
if (i == len) {
|
||||
printf("nft46: one %c must be present", c);
|
||||
exit(1);
|
||||
}
|
||||
return i;
|
||||
}
|
||||
|
||||
void adapt_args(char *tab) {
|
||||
int i, len, X, startIP, endIP, startedIP;
|
||||
X = startIP = endIP = -1;
|
||||
startedIP = 0;
|
||||
len = strlen(tab);
|
||||
i = 0;
|
||||
X = i = findchar(tab, 'X', i, len);
|
||||
startIP = i = findchar(tab, '{', i, len);
|
||||
while (startIP + 1 <= (i = findchar(tab, ' ', i, len))) startIP = i + 1;
|
||||
i = startIP;
|
||||
endIP = i = findchar(tab, ' ', i, len) - 1;
|
||||
|
||||
if (isIPv4(tab+startIP, endIP-startIP+1)) {
|
||||
tab[X] = '4';
|
||||
return;
|
||||
}
|
||||
|
||||
if (isIPv6(tab+startIP, endIP-startIP+1)) {
|
||||
tab[X] = '6';
|
||||
return;
|
||||
}
|
||||
|
||||
printf("nft46: no IP address found\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
int exec(char *str, char **argv) {
|
||||
argv[0] = str;
|
||||
execvp(str, argv);
|
||||
// returns only if fails
|
||||
printf("nft46: exec failed %d\n", errno);
|
||||
}
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
if (argc != 2) {
|
||||
printf("nft46: Exactly one argument must be given\n");
|
||||
exit(1);
|
||||
}
|
||||
adapt_args(argv[1]);
|
||||
exec("nft", argv);
|
||||
}
|
|
@ -76,6 +76,5 @@ func Fatalln(args ...any) {
|
|||
}
|
||||
|
||||
func Fatalf(format string, args ...any) {
|
||||
level := FATAL
|
||||
log.Fatalf(level.String()+format, args)
|
||||
log.Fatalf(FATAL.String()+format, args...)
|
||||
}
|
||||
|
|
|
@ -5,5 +5,12 @@ import (
|
|||
)
|
||||
|
||||
func main() {
|
||||
app.Main()
|
||||
app.Main(version, commit)
|
||||
}
|
||||
|
||||
var (
|
||||
// Must be passed when building
|
||||
// go build -ldflags "-X app.commit XXX -X app.version XXX"
|
||||
version string
|
||||
commit string
|
||||
)
|
||||
|
|
40
release.sh
Executable file
40
release.sh
Executable file
|
@ -0,0 +1,40 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -exu
|
||||
|
||||
git push --tags
|
||||
|
||||
TAG="$(git tag --sort=v:refname | tail -n1)"
|
||||
|
||||
docker run -it --rm -e HOME=/tmp/ -v "$(pwd)":/tmp/code -w /tmp/code golang:1.21-bullseye sh -c "git config --global --add safe.directory . && make reaction_${TAG:1}-1_amd64.deb reaction ip46tables nft46"
|
||||
|
||||
make "signatures_${TAG:1}"
|
||||
|
||||
rsync -avz -e 'ssh -J pica01' ./ip46tables ./nft46 ./reaction ./reaction_${TAG:1}-1_amd64.deb ./nft46.minisig ./ip46tables.minisig ./reaction.minisig ./reaction_${TAG:1}-1_amd64.deb.minisig akesi:/var/www/static/reaction/releases/"$TAG"
|
||||
|
||||
TOKEN="$(rbw get framagit.org token)"
|
||||
|
||||
DATA='{
|
||||
"tag_name":"'"$TAG"'",
|
||||
"description": "**Changes**\n\n**Download**\n\n```bash\nwget https://static.ppom.me/reaction/releases/'"$TAG"'/nft46 \\\n https://static.ppom.me/reaction/releases/'"$TAG"'/reaction \\\n https://static.ppom.me/reaction/releases/'"$TAG"'/ip46tables \\\n https://static.ppom.me/reaction/releases/'"$TAG"'/nft46.minisig \\\n https://static.ppom.me/reaction/releases/'"$TAG"'/reaction.minisig \\\n https://static.ppom.me/reaction/releases/'"$TAG"'/ip46tables.minisig\nfor i in nft46 ip46tables reaction; do\n minisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m $i &&\n rm $i.minisig\ndone\n```\n\n**Debian Installation**\n\n```bash\nwget https://static.ppom.me/reaction/releases/'"$TAG"'/reaction_'"${TAG:1}"'-1_amd64.deb \\\n https://static.ppom.me/reaction/releases/'"$TAG"'/reaction_'"${TAG:1}"'-1_amd64.deb.minisig\nminisign -VP RWSpLTPfbvllNqRrXUgZzM7mFjLUA7PQioAItz80ag8uU4A2wtoT2DzX -m reaction_'"${TAG:1}"'-1_amd64.deb &&\n rm reaction_'"${TAG:1}"'-1_amd64.deb.minisig &&\n apt install ./reaction_'"${TAG:1}"'-1_amd64.deb\n```",
|
||||
"assets":{"links":[
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/nft46", "name": "nft46 (x86-64)", "link_type": "package"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/reaction", "name": "reaction (x86-64)", "link_type": "package"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/ip46tables", "name": "ip46tables (x86-64)", "link_type": "package"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/reaction_'"${TAG:1}"'-1_amd64.deb", "name": "reaction_'"${TAG:1}"'-1_amd64.deb (x86-64)", "link_type": "package"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/nft46.minisig", "name": "nft46.minisig", "link_type": "other"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/reaction.minisig", "name": "reaction.minisig", "link_type": "other"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/ip46tables.minisig", "name": "ip46tables.minisig", "link_type": "other"},
|
||||
{"url": "https://static.ppom.me/reaction/releases/'"$TAG"'/reaction_'"${TAG:1}"'-1_amd64.deb.minisig", "name": "reaction_'"${TAG:1}"'-1_amd64.deb.minisig", "link_type": "other"}
|
||||
]}}'
|
||||
|
||||
curl \
|
||||
--fail-with-body \
|
||||
--location \
|
||||
-X POST \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "PRIVATE-TOKEN: $TOKEN" \
|
||||
'https://framagit.org/api/v4/projects/90566/releases' \
|
||||
--data "$DATA"
|
||||
|
||||
make clean
|
Loading…
Reference in a new issue