From 7f7361a2829896a4056d3cc4129cc2ce1bcdcede Mon Sep 17 00:00:00 2001 From: Cyril Jaquier Date: Thu, 14 Sep 2006 22:05:32 +0000 Subject: [PATCH] - Added Gamin (file and directory monitoring system) support - If Gamin is not available, polling is used git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@355 a942ae1a-1317-0410-a47c-b1dcaea8d605 --- CHANGELOG | 1 + MANIFEST | 2 + README | 6 +- server/filter.py | 71 ++--------------- server/filtergamin.py | 132 ++++++++++++++++++++++++++++++++ server/filterpoll.py | 149 ++++++++++++++++++++++++++++++++++++ server/jail.py | 18 ++++- testcases/filtertestcase.py | 8 +- 8 files changed, 312 insertions(+), 75 deletions(-) create mode 100644 server/filtergamin.py create mode 100644 server/filterpoll.py diff --git a/CHANGELOG b/CHANGELOG index a4a0241c..09687626 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -11,6 +11,7 @@ ver. 0.7.3 (2006/??/??) - beta ---------- - Added man pages. Thanks to Yaroslav Halchenko - Added wildcard support for "logpath" +- Added Gamin (file and directory monitoring system) support ver. 0.7.2 (2006/09/10) - beta ---------- diff --git a/MANIFEST b/MANIFEST index 0bdff79c..9e1f6e0b 100644 --- a/MANIFEST +++ b/MANIFEST @@ -18,6 +18,8 @@ client/csocket.py server/ssocket.py server/banticket.py server/filter.py +server/filtergamin.py +server/filterpoll.py server/server.py server/datestrptime.py server/failticket.py diff --git a/README b/README index e80123c1..8e32f1a3 100644 --- a/README +++ b/README @@ -19,7 +19,11 @@ website: http://fail2ban.sourceforge.net Installation: ------------- -Require: python-2.4 (http://www.python.org) +Required: + >=python-2.4 (http://www.python.org) + +Optional: + >=gamin-0.0.21 (http://www.gnome.org/~veillard/gamin) To install, just do: diff --git a/server/filter.py b/server/filter.py index a83a66c7..4e5fc8b4 100644 --- a/server/filter.py +++ b/server/filter.py @@ -68,35 +68,26 @@ class Filter(JailThread): self.findTime = 6000 ## The ignore IP list. self.ignoreIpList = [] + self.modified = False ## The time of the last modification of the file. self.lastModTime = dict() ## The last position of the file. self.lastPos = dict() ## The last date in tht log file. self.lastDate = dict() - self.file404Cnt = dict() self.dateDetector = DateDetector() self.dateDetector.addDefaultTemplate() logSys.info("Created Filter") + ## # Add a log file path # # @param path log file path def addLogPath(self, path): - try: - self.logPath.index(path) - logSys.error(path + " already exists") - except ValueError: - self.logPath.append(path) - # Initialize default values - self.lastDate[path] = 0 - self.lastModTime[path] = 0 - self.lastPos[path] = 0 - self.file404Cnt[path] = 0 - logSys.info("Added logfile = %s" % path) + raise Exception("addLogPath() is abstract") ## # Delete a log path @@ -104,14 +95,7 @@ class Filter(JailThread): # @param path the log file to delete def delLogPath(self, path): - try: - self.logPath.remove(path) - del self.lastDate[path] - del self.lastModTime[path] - del self.lastPos[path] - logSys.info("Removed logfile = %s" % path) - except ValueError: - logSys.error(path + " is not monitored") + raise Exception("delLogPath() is abstract") ## # Get the log file path @@ -236,27 +220,7 @@ class Filter(JailThread): # @return True when the thread exits nicely def run(self): - self.setActive(True) - prevModified = False - while self.isActive(): - if not self.isIdle: - if prevModified: - self.dateDetector.sortTemplate() - prevModified = False - for file in self.logPath: - if self.isModified(file): - self.getFailures(file) - prevModified = True - try: - ticket = self.failManager.toBan() - self.jail.putFailTicket(ticket) - except FailManagerEmpty: - self.failManager.cleanup(time.time()) - time.sleep(self.sleepTime) - else: - time.sleep(self.sleepTime) - logSys.debug(self.jail.getName() + ": filter terminated") - return True + raise Exception("run() is abstract") ## # Add an IP to the ignore list. @@ -311,31 +275,6 @@ class Filter(JailThread): def closeLogFile(self): self.crtFilename = None self.crtHandler.close() - - ## - # Checks if the log file has been modified. - # - # Checks if the log file has been modified using os.stat(). - # @return True if log file has been modified - - def isModified(self, filename): - try: - logStats = os.stat(filename) - self.file404Cnt[filename] = 0 - if self.lastModTime[filename] == logStats.st_mtime: - return False - else: - logSys.debug(filename + " has been modified") - self.lastModTime[filename] = logStats.st_mtime - return True - except OSError: - logSys.error("Unable to get stat on " + filename) - self.file404Cnt[filename] = self.file404Cnt[filename] + 1 - if self.file404Cnt[filename] > 2: - logSys.warn("Too much read error. Set the jail idle") - self.jail.setIdle(True) - self.file404Cnt[filename] = 0 - return False ## # Set the file position. diff --git a/server/filtergamin.py b/server/filtergamin.py new file mode 100644 index 00000000..1ec453bb --- /dev/null +++ b/server/filtergamin.py @@ -0,0 +1,132 @@ +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +# Author: Cyril Jaquier +# +# $Revision$ + +__author__ = "Cyril Jaquier" +__version__ = "$Revision$" +__date__ = "$Date$" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier" +__license__ = "GPL" + +from failmanager import FailManager +from failmanager import FailManagerEmpty +from failticket import FailTicket +from datedetector import DateDetector +from filter import Filter + +import time, logging, gamin + +# Gets the instance of the logger. +logSys = logging.getLogger("fail2ban.filter") + +## +# Log reader class. +# +# This class reads a log file and detects login failures or anything else +# that matches a given regular expression. This class is instanciated by +# a Jail object. + +class FilterGamin(Filter): + + ## + # Constructor. + # + # Initialize the filter object with default values. + # @param jail the jail object + + def __init__(self, jail): + Filter.__init__(self, jail) + + self.monitor = gamin.WatchMonitor() + + logSys.info("Created FilterGamin") + + + def callback(self, path, event): + logSys.debug("Got event: " + `event` + " for " + path) + if event in (gamin.GAMCreated, gamin.GAMChanged, gamin.GAMExists): + logSys.debug("File changed: " + path) + self.getFailures(path) + self.modified = True + + + ## + # Add a log file path + # + # @param path log file path + + def addLogPath(self, path): + try: + self.logPath.index(path) + logSys.error(path + " already exists") + except ValueError: + self.monitor.watch_file(path, self.callback) + self.logPath.append(path) + # Initialize default values + self.lastDate[path] = 0 + self.lastModTime[path] = 0 + self.lastPos[path] = 0 + logSys.info("Added logfile = %s" % path) + + ## + # Delete a log path + # + # @param path the log file to delete + + def delLogPath(self, path): + try: + self.monitor.stop_watch(path) + self.logPath.remove(path) + del self.lastDate[path] + del self.lastModTime[path] + del self.lastPos[path] + logSys.info("Removed logfile = %s" % path) + except ValueError: + logSys.error(path + " is not monitored") + + + ## + # Main loop. + # + # This function is the main loop of the thread. It checks if the + # file has been modified and looks for failures. + # @return True when the thread exits nicely + + def run(self): + self.setActive(True) + while self.isActive(): + if not self.isIdle: + # We cannot block here because we want to be able to + # exit. + if self.monitor.event_pending(): + self.monitor.handle_events() + + if self.modified: + try: + ticket = self.failManager.toBan() + self.jail.putFailTicket(ticket) + except FailManagerEmpty: + self.failManager.cleanup(time.time()) + self.dateDetector.sortTemplate() + self.modified = False + time.sleep(self.sleepTime) + else: + time.sleep(self.sleepTime) + logSys.debug(self.jail.getName() + ": filter terminated") + return True diff --git a/server/filterpoll.py b/server/filterpoll.py new file mode 100644 index 00000000..c53ffa5a --- /dev/null +++ b/server/filterpoll.py @@ -0,0 +1,149 @@ +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +# Author: Cyril Jaquier +# +# $Revision: 354 $ + +__author__ = "Cyril Jaquier" +__version__ = "$Revision: 354 $" +__date__ = "$Date: 2006-09-13 23:31:22 +0200 (Wed, 13 Sep 2006) $" +__copyright__ = "Copyright (c) 2004 Cyril Jaquier" +__license__ = "GPL" + +from failmanager import FailManager +from failmanager import FailManagerEmpty +from failticket import FailTicket +from datedetector import DateDetector +from filter import Filter + +import time, logging, os + +# Gets the instance of the logger. +logSys = logging.getLogger("fail2ban.filter") + +## +# Log reader class. +# +# This class reads a log file and detects login failures or anything else +# that matches a given regular expression. This class is instanciated by +# a Jail object. + +class FilterPoll(Filter): + + ## + # Constructor. + # + # Initialize the filter object with default values. + # @param jail the jail object + + def __init__(self, jail): + Filter.__init__(self, jail) + + self.file404Cnt = dict() + + logSys.info("Created FilterPoll") + + ## + # Add a log file path + # + # @param path log file path + + def addLogPath(self, path): + try: + self.logPath.index(path) + logSys.error(path + " already exists") + except ValueError: + self.logPath.append(path) + # Initialize default values + self.lastDate[path] = 0 + self.lastModTime[path] = 0 + self.lastPos[path] = 0 + self.file404Cnt[path] = 0 + logSys.info("Added logfile = %s" % path) + + ## + # Delete a log path + # + # @param path the log file to delete + + def delLogPath(self, path): + try: + self.logPath.remove(path) + del self.lastDate[path] + del self.lastModTime[path] + del self.lastPos[path] + del self.file404Cnt[path] + logSys.info("Removed logfile = %s" % path) + except ValueError: + logSys.error(path + " is not monitored") + + + ## + # Main loop. + # + # This function is the main loop of the thread. It checks if the + # file has been modified and looks for failures. + # @return True when the thread exits nicely + + def run(self): + self.setActive(True) + while self.isActive(): + if not self.isIdle: + # Get file modification + for file in self.logPath: + if self.isModified(file): + self.getFailures(file) + prevModified = True + + if self.modified: + try: + ticket = self.failManager.toBan() + self.jail.putFailTicket(ticket) + except FailManagerEmpty: + self.failManager.cleanup(time.time()) + self.dateDetector.sortTemplate() + prevModified = False + time.sleep(self.sleepTime) + else: + time.sleep(self.sleepTime) + logSys.debug(self.jail.getName() + ": filter terminated") + return True + + ## + # Checks if the log file has been modified. + # + # Checks if the log file has been modified using os.stat(). + # @return True if log file has been modified + + def isModified(self, filename): + try: + logStats = os.stat(filename) + self.file404Cnt[filename] = 0 + if self.lastModTime[filename] == logStats.st_mtime: + return False + else: + logSys.debug(filename + " has been modified") + self.lastModTime[filename] = logStats.st_mtime + return True + except OSError: + logSys.error("Unable to get stat on " + filename) + self.file404Cnt[filename] = self.file404Cnt[filename] + 1 + if self.file404Cnt[filename] > 2: + logSys.warn("Too much read error. Set the jail idle") + self.jail.setIdle(True) + self.file404Cnt[filename] = 0 + return False diff --git a/server/jail.py b/server/jail.py index 1c77ca6c..d5f11671 100644 --- a/server/jail.py +++ b/server/jail.py @@ -24,17 +24,27 @@ __date__ = "$Date$" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" -from actions import Actions -from filter import Filter -import Queue +import Queue, logging +from actions import Actions + +# Gets the instance of the logger. +logSys = logging.getLogger("fail2ban.jail") class Jail: def __init__(self, name): self.name = name self.queue = Queue.Queue() - self.filter = Filter(self) + try: + import gamin + logSys.info("Gamin available. Using it instead of poller") + from filtergamin import FilterGamin + self.filter = FilterGamin(self) + except ImportError: + logSys.info("Gamin not available. Using poller") + from filterpoll import FilterPoll + self.filter = FilterPoll(self) self.action = Actions(self) def setName(self, name): diff --git a/testcases/filtertestcase.py b/testcases/filtertestcase.py index be62fc5a..2aa92ee1 100644 --- a/testcases/filtertestcase.py +++ b/testcases/filtertestcase.py @@ -25,14 +25,14 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" import unittest, socket -from server.filter import Filter +from server.filterpoll import FilterPoll from server.failmanager import FailManager class IgnoreIP(unittest.TestCase): def setUp(self): """Call before every test case.""" - self.filter = Filter(None) + self.filter = FilterPoll(None) def tearDown(self): """Call after every test case.""" @@ -56,7 +56,7 @@ class LogFile(unittest.TestCase): def setUp(self): """Call before every test case.""" - self.filter = Filter(None) + self.filter = FilterPoll(None) self.filter.addLogPath(LogFile.filename) def tearDown(self): @@ -73,7 +73,7 @@ class GetFailures(unittest.TestCase): def setUp(self): """Call before every test case.""" - self.filter = Filter(None) + self.filter = FilterPoll(None) self.filter.addLogPath("testcases/files/testcase01.log") self.filter.setTimeRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") self.filter.setTimePattern("%b %d %H:%M:%S")