/// <summary>
/// Get the local ip address of the local machine
/// </summary>
/// <param name="dns">Dns lookup</param>
/// <param name="addressFamily">Desired address family</param>
/// <returns>Local ip address or null if unable to determine. If no address family match, falls back to an ipv6 attempt.</returns>
public static async Task <System.Net.IPAddress> GetLocalIPAddress(this IDnsLookup dns, System.Net.Sockets.AddressFamily addressFamily = System.Net.Sockets.AddressFamily.InterNetwork)
{
try
{
// append ipv4 first, then the ipv6 then the remote ip
System.Net.IPAddress[] ips = await dns.GetHostAddressesAsync(Dns.GetHostName());
foreach (System.Net.IPAddress ip in ips)
{
if (ip.AddressFamily == addressFamily)
{
return(ip);
}
}
foreach (System.Net.IPAddress ip in ips)
{
if (ip.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6)
{
return(ip);
}
}
}
catch
{
}
return(null);
}
/// <summary>
/// Get the local ip addresses of the local machine
/// </summary>
/// <param name="dns">Dns lookup</param>
/// <param name="addressFamily">Desired address family or null for all</param>
/// <returns>Local ip address or empty array if unable to determine. If no address family match, falls back to an ipv6 attempt.</returns>
public static async Task <System.Net.IPAddress[]> GetLocalIPAddressesAsync(this IDnsLookup dns, System.Net.Sockets.AddressFamily?addressFamily = System.Net.Sockets.AddressFamily.InterNetwork)
{
try
{
// append ipv4 first, then the ipv6 then the remote ip
return((await dns.GetHostAddressesAsync(dns.GetHostName())).Union(localHostIP).Where(i => addressFamily is null || i.AddressFamily == addressFamily).ToArray());
}
catch
{
}
return(new System.Net.IPAddress[0]);
}
/// <summary>
/// Get the ip addresses of the local machine
/// </summary>
/// <param name="dns">Dns lookup</param>
/// <param name="allowLocal">Whether to return localhost ip</param>
/// <param name="addressFamily">Desired address family or null for all</param>
/// <returns>Local ip address or empty array if unable to determine. If no address family match, falls back to an ipv6 attempt.</returns>
public static async Task <System.Net.IPAddress[]> GetLocalIPAddressesAsync(this IDnsLookup dns, bool allowLocal = true, System.Net.Sockets.AddressFamily?addressFamily = System.Net.Sockets.AddressFamily.InterNetwork)
{
try
{
// append ipv4 first, then the ipv6 then the remote ip
List <IPAddress> ips = new List <IPAddress>();
ips.AddRange(await dns.GetHostAddressesAsync(dns.GetHostName()));
if (allowLocal)
{
ips.AddRange(localHostIP);
}
return(ips.Where(ip => (allowLocal || ip.IsLocalHost()) ||
(addressFamily is null || ip.AddressFamily == addressFamily)).ToArray());
}
catch
{
}
return(new System.Net.IPAddress[0]);
}
/// <summary>
/// Get the ip addresses of the local machine
/// </summary>
/// <param name="dns">Dns lookup</param>
/// <param name="allowLocal">Whether to return localhost ip</param>
/// <param name="addressFamily">Desired address family or null for all</param>
/// <returns>Local ip address or empty array if unable to determine. If no address family match, falls back to an ipv6 attempt.</returns>
public static async Task <System.Net.IPAddress[]> GetLocalIPAddressesAsync(this IDnsLookup dns, bool allowLocal = true, System.Net.Sockets.AddressFamily?addressFamily = System.Net.Sockets.AddressFamily.InterNetwork)
{
try
{
// append ipv4 first, then the ipv6 then the remote ip
List <IPAddress> ips = new List <IPAddress>();
string hostName = await dns.GetHostNameAsync();
IPAddress[] hostAddresses = await dns.GetHostAddressesAsync(hostName);
ips.AddRange(hostAddresses);
// sort ipv4 first
ips.Sort((ip1, ip2) =>
{
int compare = ip1.AddressFamily.CompareTo(ip2.AddressFamily);
if (compare == 0)
{
compare = ip1.CompareTo(ip2);
}
return(compare);
});
if (allowLocal)
{
ips.AddRange(localHostIP);
}
return(ips.Where(ip => (allowLocal || !ip.IsLocalHost()) ||
(addressFamily is null || ip.AddressFamily == addressFamily)).ToArray());
}
catch
{
// eat exception, delicious
}
return(new System.Net.IPAddress[0]);
}
private void PopulateList(HashSet <System.Net.IPAddress> set,
HashSet <IPAddressRange> ranges,
HashSet <string> others,
ref Regex regex,
string setValue,
string regexValue)
{
setValue = (setValue ?? string.Empty).Trim();
regexValue = (regexValue ?? string.Empty).Replace("*", @"[0-9A-Fa-f:]+?").Trim();
set.Clear();
regex = null;
if (!string.IsNullOrWhiteSpace(setValue))
{
foreach (string entry in setValue.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries).Select(e => e.Trim()))
{
string entryWithoutComment = entry;
int pos = entryWithoutComment.IndexOf('?');
if (pos >= 0)
{
entryWithoutComment = entryWithoutComment.Substring(0, pos);
}
entryWithoutComment = entryWithoutComment.Trim();
if (!ignoreListEntries.Contains(entryWithoutComment))
{
if (IPAddressRange.TryParse(entryWithoutComment, out IPAddressRange range))
{
if (range.Begin.Equals(range.End))
{
set.Add(range.Begin);
}
else
{
ranges.Add(range);
}
}
else if (Uri.CheckHostName(entryWithoutComment) != UriHostNameType.Unknown)
{
try
{
// add entries for each ip address that matches the dns entry
IPAddress[] addresses = null;
ExtensionMethods.Retry(() => addresses = dns.GetHostAddressesAsync(entryWithoutComment).Sync());
foreach (IPAddress adr in addresses)
{
set.Add(adr);
}
}
catch (Exception ex)
{
Logger.Error(ex, "Unable to resolve dns for {0}", entryWithoutComment);
// eat exception, nothing we can do
others.Add(entryWithoutComment);
}
}
else
{
others.Add(entryWithoutComment);
}
}
}
}
if (!string.IsNullOrWhiteSpace(regexValue))
{
regex = ParseRegex(regexValue);
}
}
private void PopulateList(HashSet <System.Net.IPAddress> set,
HashSet <IPAddressRange> ranges,
HashSet <string> others,
ref Regex regex,
string setValue,
string regexValue)
{
setValue = (setValue ?? string.Empty).Trim();
regexValue = (regexValue ?? string.Empty).Replace("*", @"[0-9A-Fa-f]+?").Trim();
set.Clear();
regex = null;
if (!string.IsNullOrWhiteSpace(setValue))
{
List <string> entries = new List <string>();
foreach (string entry in setValue.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries).Select(e => e.Trim()))
{
string entryWithoutComment = entry;
int pos = entryWithoutComment.IndexOf('?');
if (pos >= 0)
{
entryWithoutComment = entryWithoutComment.Substring(0, pos);
}
entryWithoutComment = entryWithoutComment.Trim();
entries.Add(entryWithoutComment);
}
List <Task> entryTasks = new List <Task>();
// iterate in parallel for performance
foreach (string entry in entries)
{
string entryWithoutComment = entry;
entryTasks.Add(Task.Run(async() =>
{
bool isUserName;
if (entryWithoutComment.StartsWith("user:"******"user:"******"Unable to resolve dns for {0}: {1}", entryWithoutComment, ex.Message);
lock (others)
{
// eat exception, nothing we can do
others.Add(entryWithoutComment);
}
}
}
else
{
lock (others)
{
others.Add(entryWithoutComment);
}
}
}
private void PopulateList(HashSet <System.Net.IPAddress> set,
HashSet <IPAddressRange> ranges,
HashSet <string> others,
ref Regex regex,
string setValue,
string regexValue)
{
setValue = (setValue ?? string.Empty).Trim();
regexValue = (regexValue ?? string.Empty).Replace("*", @"[0-9A-Fa-f]+?").Trim();
set.Clear();
regex = null;
void AddIPAddressRange(IPAddressRange range)
{
if (range.Begin.Equals(range.End))
{
lock (set)
{
set.Add(range.Begin);
}
}
else
{
lock (ranges)
{
ranges.Add(range);
}
}
}
if (!string.IsNullOrWhiteSpace(setValue))
{
List <string> entries = new List <string>();
foreach (string entry in setValue.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries).Select(e => e.Trim()))
{
string entryWithoutComment = entry;
int pos = entryWithoutComment.IndexOf('?');
if (pos >= 0)
{
entryWithoutComment = entryWithoutComment.Substring(0, pos);
}
entryWithoutComment = entryWithoutComment.Trim();
entries.Add(entryWithoutComment);
}
List <Task> entryTasks = new List <Task>();
// iterate in parallel for performance
foreach (string entry in entries)
{
string entryWithoutComment = entry;
entryTasks.Add(Task.Run(async() =>
{
bool isUserName;
if (entryWithoutComment.StartsWith("user:"******"user:"******"https://", StringComparison.OrdinalIgnoreCase) ||
entryWithoutComment.StartsWith("http://", StringComparison.OrdinalIgnoreCase)))
{
try
{
if (httpRequestMaker != null)
{
// assume url list of ips, newline delimited
byte[] ipListBytes = null;
Uri uri = new Uri(entryWithoutComment);
await ExtensionMethods.RetryAsync(async() => ipListBytes = await httpRequestMaker.MakeRequestAsync(uri, null, ipListHeaders));
string ipList = Encoding.UTF8.GetString(ipListBytes);
if (!string.IsNullOrWhiteSpace(ipList))
{
foreach (string item in ipList.Split('\n'))
{
if (IPAddressRange.TryParse(item.Trim(), out IPAddressRange ipRangeFromUrl))
{
AddIPAddressRange(ipRangeFromUrl);
}
}
}
}
}
catch (Exception ex)
{
Logger.Error(ex, "Failed to get ip list from url {0}", entryWithoutComment);
}
}
else if (!isUserName && Uri.CheckHostName(entryWithoutComment) != UriHostNameType.Unknown)
{
try
{
// add entries for each ip address that matches the dns entry
IPAddress[] addresses = null;
await ExtensionMethods.RetryAsync(async() => addresses = await dns.GetHostAddressesAsync(entryWithoutComment),
exceptionRetry: _ex =>
{
// ignore host not found errors
return(!(_ex is System.Net.Sockets.SocketException socketEx) ||
socketEx.SocketErrorCode != System.Net.Sockets.SocketError.HostNotFound);
});
lock (set)
{
foreach (IPAddress adr in addresses)
{
set.Add(adr);
}
}
}
catch (Exception ex)
{
Logger.Debug("Unable to resolve dns for {0}: {1}", entryWithoutComment, ex.Message);
lock (others)
{
// eat exception, nothing we can do
others.Add(entryWithoutComment);
}
}
}
else
{
lock (others)
{
others.Add(entryWithoutComment);
}
}
}
/// <summary>
/// Get an ip address and user name out of text using regex. Regex may contain groups named source_[sourcename] to override the source.
/// </summary>
/// <param name="regex">Regex</param>
/// <param name="text">Text</param>
/// <param name="ipAddress">Found ip address or null if none</param>
/// <param name="userName">Found user name or null if none</param>
/// <param name="timestampFormat">Timestamp format</param>
/// <param name="eventType">Event type</param>
/// <param name="dns">Dns lookup to resolve ip addresses</param>
/// <returns>Set of matches from text</returns>
public static IEnumerable <IPAddressLogEvent> GetIPAddressEventsFromRegex(Regex regex, string text,
string timestampFormat = null, IPAddressEventType eventType = IPAddressEventType.FailedLogin, IDnsLookup dns = null)
{
const string customSourcePrefix = "source_";
// if no regex or no text, we are done
if (regex is null || string.IsNullOrWhiteSpace(text))
{
yield break;
}
// remove control chars
text = new string(text.Where(c => c == '\n' || c == '\t' || !char.IsControl(c)).ToArray()).Trim();
// go through all the matches and pull out event info
foreach (Match match in regex.Matches(text))
{
string userName = null;
string ipAddress = null;
string source = null;
DateTime timestamp = default;
// check for a user name
Group userNameGroup = match.Groups["username"];
if (userNameGroup != null && userNameGroup.Success)
{
userName = (userName ?? userNameGroup.Value.Trim(regexTrimChars));
}
// check for source
Group sourceGroup = match.Groups["source"];
if (sourceGroup != null && sourceGroup.Success)
{
source = (source ?? sourceGroup.Value.Trim(regexTrimChars));
}
// check for groups with a custom source name
foreach (Group group in match.Groups)
{
if (group.Success && group.Name != null &&
string.IsNullOrWhiteSpace(source) && group.Name.StartsWith(customSourcePrefix))
{
source = group.Name.Substring(customSourcePrefix.Length);
}
}
// check for timestamp group
Group timestampGroup = match.Groups["timestamp"];
if (timestampGroup != null && timestampGroup.Success)
{
string toParse = timestampGroup.Value.Trim(regexTrimChars);
if (string.IsNullOrWhiteSpace(timestampFormat) ||
!DateTime.TryParseExact(toParse, timestampFormat.Trim(), CultureInfo.InvariantCulture,
DateTimeStyles.AssumeLocal | DateTimeStyles.AdjustToUniversal, out timestamp))
{
DateTime.TryParse(toParse, CultureInfo.InvariantCulture,
DateTimeStyles.AssumeLocal | DateTimeStyles.AdjustToUniversal, out timestamp);
}
}
// check if the regex had an ipadddress group
Group ipAddressGroup = match.Groups["ipaddress"];
if (ipAddressGroup is null || !ipAddressGroup.Success)
{
ipAddressGroup = match.Groups["ipaddress_exact"];
}
if (ipAddressGroup != null && ipAddressGroup.Success && !string.IsNullOrWhiteSpace(ipAddressGroup.Value))
{
string tempIPAddress = ipAddressGroup.Value.Trim();
// in case of IP:PORT format, try a second time, stripping off the :PORT, saves having to do this in all
// the different ip regex.
int lastColon = tempIPAddress.LastIndexOf(':');
bool isValidIPAddress = IPAddress.TryParse(tempIPAddress, out IPAddress tmp);
if (isValidIPAddress || (lastColon >= 0 && IPAddress.TryParse(tempIPAddress.Substring(0, lastColon), out tmp)))
{
ipAddress = tmp.ToString();
}
// if we are parsing anything as ip address (including dns names)
if (ipAddress is null && dns != null && ipAddressGroup.Name == "ipaddress" &&
tempIPAddress != Environment.MachineName && tempIPAddress != "-")
{
// Check Host by name
Logger.Info("Parsing as IP failed, checking dns '{0}'", tempIPAddress);
try
{
IPAddress[] ipAddresses = dns.GetHostAddressesAsync(tempIPAddress).Sync();
if (ipAddresses != null && ipAddresses.Length > 0)
{
ipAddress = ipAddresses.FirstOrDefault().ToString();
Logger.Info("Dns result '{0}' = '{1}'", tempIPAddress, ipAddress);
break;
}
}
catch
{
Logger.Info("Parsing as dns failed '{0}'", tempIPAddress);
}
}
}
// see if there is a repeat indicator in the message
int repeatCount = ExtractRepeatCount(match, text);
// return an event for this match
yield return(new IPAddressLogEvent(ipAddress, userName, source, repeatCount, eventType, timestamp));
}
}