private void ReadState(string filename)
{
using (Stream stream = File.Open(filename, FileMode.Open))
using (BinaryReader reader = new BinaryReader(stream))
{
lock (thisLock)
{
int nhistory = reader.ReadInt32();
for (int i = 0; i < nhistory; i++)
{
IPAddress addr = new IPAddress(reader.ReadBytes(16));
IFail fail = null;
switch (history)
{
case HistoryType.ALL: fail = new FailAll(reader, findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.ONE: fail = new FailOne(reader, findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.FIXED: fail = new FailFixed(reader, findtime * TimeSpan.TicksPerSecond, history_fixed_count, history_fixed_decay); break;
case HistoryType.RRD: fail = new FailRRD(reader, findtime * TimeSpan.TicksPerSecond, history_rrd_count, history_rrd_repeat); break;
}
if (fail.Count > 0)
{
data[addr] = fail;
}
}
}
}
}
private void ReadState(string filename)
{
using (Stream stream = File.Open(filename, FileMode.Open))
using (BinaryReader reader = new BinaryReader(stream))
{
lock (thisLock)
{
int nhistory = reader.ReadInt32();
for (int i = 0; i < nhistory; i++)
{
IPAddress addr = new IPAddress(reader.ReadBytes(16));
IFail fail = null;
switch (history)
{
case HistoryType.ALL: fail = new FailAll(reader, findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.ONE: fail = new FailOne(reader, findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.FIXED: fail = new FailFixed(reader, findtime * TimeSpan.TicksPerSecond, history_fixed_count, history_fixed_decay); break;
case HistoryType.RRD: fail = new FailRRD(reader, findtime * TimeSpan.TicksPerSecond, history_rrd_count, history_rrd_repeat); break;
}
if (fail.Count > 0)
{
data[addr] = fail;
}
}
}
}
}
public override string Execute(EventEntry evtlog)
{
// get fail2ban network address for given IP and prefix
IPAddress addr = evtlog.Address;
int prefix = ipv6_prefix;
if (evtlog.Address.IsIPv4MappedToIPv6)
{
prefix = ipv4_prefix;
if (prefix <= 32)
{
prefix += 96;
}
}
if (prefix != 128)
{
addr = Utils.GetNetwork(evtlog.Address, prefix);
}
// fix log event that came from future(?!), _we_ have correct time!
long now = DateTime.Now.Ticks;
long logtime = evtlog.Created.Ticks;
if (logtime > now)
{
// is clock skew too hight!? occasionally log warning
if (logtime > now + 300 * TimeSpan.TicksPerSecond)
{
if (clockskew + 60 * TimeSpan.TicksPerSecond < now)
{
clockskew = now;
Log.Warn("Fail2ban[" + Name + "]: logtime from future ("
+ ((logtime - now) / TimeSpan.TicksPerSecond) + " seconds) for "
+ evtlog.Input + "/" + evtlog.Input.SelectorName
+ " from " + evtlog.Hostname);
}
}
logtime = now;
}
int failcnt = 0;
bool[] tresholdCheck = new bool[tresholds.Count];
lock (thisLock)
{
// update failed login fail2ban data
IFail fail;
if (!data.TryGetValue(addr, out fail))
{
switch (history)
{
case HistoryType.ALL: fail = new FailAll(findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.ONE: fail = new FailOne(findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.FIXED: fail = new FailFixed(findtime * TimeSpan.TicksPerSecond, history_fixed_count, history_fixed_decay); break;
case HistoryType.RRD: fail = new FailRRD(findtime * TimeSpan.TicksPerSecond, history_rrd_count, history_rrd_repeat); break;
}
data[addr] = fail;
}
failcnt = fail.Add(logtime);
for (int i = 0; i < tresholds.Count; i++)
{
tresholdCheck[i] = Check(addr, tresholds[i], failcnt);
}
}
// evaluate all defined tresholds
for (int i = 0; i < tresholds.Count; i++)
{
if (!tresholdCheck[i])
continue;
Treshold treshold = tresholds[i];
int tmpPrefix = prefix;
IPAddress tmpAddr = addr;
long expiration = now + TimeSpan.FromSeconds(treshold.Bantime).Ticks;
if (addr.IsIPv4MappedToIPv6)
{
// workaround for buggy MapToIPv4 implementation
tmpAddr = Fixes.MapToIPv4(addr);
tmpPrefix = prefix - 96;
}
Log.Info("Fail2ban[" + Name + "]: reached treshold "
+ treshold.Name + " (" + treshold.MaxRetry + "&"
+ failcnt + ") for " + tmpAddr + "/" + tmpPrefix);
if (evtlog.HasProcData("Fail2ban.All"))
{
string all = evtlog.GetProcData<string>("Fail2ban.All");
evtlog.SetProcData("Fail2ban.All", all + "," + Name);
}
else
{
evtlog.SetProcData("Fail2ban.All", Name);
}
evtlog.SetProcData("Fail2ban.Last", Name);
evtlog.SetProcData(Name + ".Address", tmpAddr);
evtlog.SetProcData(Name + ".Prefix", tmpPrefix);
evtlog.SetProcData(Name + ".FailCnt", failcnt);
evtlog.SetProcData(Name + ".Bantime", treshold.Bantime);
evtlog.SetProcData(Name + ".Expiration", expiration);
evtlog.SetProcData(Name + ".Treshold", treshold.Name);
// Add to "action" queue
Produce(new EventEntry(evtlog), treshold.Action, EventQueue.Priority.High);
}
return goto_next;
}
public override string Execute(EventEntry evtlog)
{
string strAddress = evtlog.GetProcData <string>(address);
if (string.IsNullOrEmpty(strAddress))
{
Log.Info("Fail2ban[" + Name
+ "]: empty address attribute: " + address);
return(goto_error);
}
IPAddress addr = null;
try
{
addr = IPAddress.Parse(strAddress.Trim()).MapToIPv6();
}
catch (FormatException ex)
{
Log.Info("Fail2ban[" + Name
+ "]: invalid address " + address
+ "[" + strAddress + "]: " + ex.Message);
return(goto_error);
}
// get fail2ban network address for given IP and prefix
int prefix = ipv6_prefix;
if (addr.IsIPv4MappedToIPv6)
{
prefix = ipv4_prefix;
if (prefix <= 32)
{
prefix += 96;
}
}
if (prefix != 128)
{
addr = Utils.GetNetwork(addr, prefix);
}
// fix log event that came from future(?!), _we_ have correct time!
long now = DateTime.Now.Ticks;
long logtime = evtlog.Created.Ticks;
if (logtime > now)
{
// is clock skew too hight!? occasionally log warning
if (logtime > now + 300 * TimeSpan.TicksPerSecond)
{
if (clockskew + 60 * TimeSpan.TicksPerSecond < now)
{
clockskew = now;
Log.Warn("Fail2ban[" + Name + "]: logtime from future ("
+ ((logtime - now) / TimeSpan.TicksPerSecond) + " seconds) for "
+ evtlog.Input + "/" + evtlog.Input.SelectorName
+ " from " + evtlog.Machine);
}
}
logtime = now;
}
int failcnt = 0;
bool[] tresholdCheck = new bool[tresholds.Count];
lock (thisLock)
{
// update failed login fail2ban data
IFail fail;
if (!data.TryGetValue(addr, out fail))
{
switch (history)
{
case HistoryType.ALL: fail = new FailAll(findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.ONE: fail = new FailOne(findtime * TimeSpan.TicksPerSecond); break;
case HistoryType.FIXED: fail = new FailFixed(findtime * TimeSpan.TicksPerSecond, history_fixed_count, history_fixed_decay); break;
case HistoryType.RRD: fail = new FailRRD(findtime * TimeSpan.TicksPerSecond, history_rrd_count, history_rrd_repeat); break;
}
data[addr] = fail;
}
failcnt = fail.Add(logtime);
for (int i = 0; i < tresholds.Count; i++)
{
tresholdCheck[i] = Check(addr, tresholds[i], failcnt);
}
}
// evaluate all defined tresholds
for (int i = 0; i < tresholds.Count; i++)
{
if (!tresholdCheck[i])
{
continue;
}
Treshold treshold = tresholds[i];
int tmpPrefix = prefix;
IPAddress tmpAddr = addr;
long expiration = now + TimeSpan.FromSeconds(treshold.Bantime).Ticks;
if (addr.IsIPv4MappedToIPv6)
{
// workaround for buggy MapToIPv4 implementation
tmpAddr = Fixes.MapToIPv4(addr);
tmpPrefix = prefix - 96;
}
Log.Info("Fail2ban[" + Name + "]: reached treshold "
+ treshold.Name + " (" + treshold.MaxRetry + "&"
+ failcnt + ") for " + tmpAddr + "/" + tmpPrefix);
if (evtlog.HasProcData("Fail2ban.All"))
{
string all = evtlog.GetProcData <string>("Fail2ban.All");
evtlog.SetProcData("Fail2ban.All", all + "," + Name);
}
else
{
evtlog.SetProcData("Fail2ban.All", Name);
}
evtlog.SetProcData("Fail2ban.Last", Name);
evtlog.SetProcData(Name + ".Address", tmpAddr);
evtlog.SetProcData(Name + ".Prefix", tmpPrefix);
evtlog.SetProcData(Name + ".FailCnt", failcnt);
evtlog.SetProcData(Name + ".Bantime", treshold.Bantime);
evtlog.SetProcData(Name + ".Expiration", expiration);
evtlog.SetProcData(Name + ".Treshold", treshold.Name);
// Add to "action" queue
Produce(new EventEntry(evtlog), treshold.Action, EventQueue.Priority.High);
}
return(goto_next);
}
