← Back
Editing: banmanager.py
# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*- # vi: set ft=python sts=4 ts=4 sw=4 noet : # This file is part of Fail2Ban. # # Fail2Ban is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # Fail2Ban is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with Fail2Ban; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # Author: Cyril Jaquier # __author__ = "Cyril Jaquier" __copyright__ = "Copyright (c) 2004 Cyril Jaquier" __license__ = "GPL" from threading import Lock from .ticket import BanTicket from .mytime import MyTime from ..helpers import getLogger, logging # Gets the instance of the logger. logSys = getLogger(__name__) ## # Banning Manager. # # Manage the banned IP addresses. Convert FailTicket to BanTicket. # This class is mainly used by the Action class. class BanManager: ## # Constructor. # # Initialize members with default values. def __init__(self): ## Mutex used to protect the ban list. self.__lock = Lock() ## The ban list. self.__banList = dict() ## The amount of time an IP address gets banned. self.__banTime = 600 ## Total number of banned IP address self.__banTotal = 0 ## The time for next unban process (for performance and load reasons): self._nextUnbanTime = BanTicket.MAX_TIME ## # Set the ban time. # # Set the amount of time an IP address get banned. # @param value the time def setBanTime(self, value): self.__banTime = int(value) ## # Get the ban time. # # Get the amount of time an IP address get banned. # @return the time def getBanTime(self): return self.__banTime ## # Set the total number of banned address. # # @param value total number def setBanTotal(self, value): self.__banTotal = value ## # Get the total number of banned address. # # @return the total number def getBanTotal(self): return self.__banTotal ## # Returns a copy of the IP list. # # @return IP list def getBanList(self, ordered=False, withTime=False): if not ordered: return list(self.__banList.keys()) with self.__lock: lst = [] for ticket in self.__banList.values(): eob = ticket.getEndOfBanTime(self.__banTime) lst.append((ticket,eob)) lst.sort(key=lambda t: t[1]) t2s = MyTime.time2str if withTime: return ['%s \t%s + %d = %s' % ( t[0].getID(), t2s(t[0].getTime()), t[0].getBanTime(self.__banTime), t2s(t[1]) ) for t in lst] return [t[0].getID() for t in lst] ## # Returns a iterator to ban list (used in reload, so idle). # # @return ban list iterator def __iter__(self): # ensure iterator is safe - traverse over the list in snapshot created within lock (GIL): return iter(list(self.__banList.values())) ## # Returns normalized value # # @return value or "unknown" if value is None or empty string @staticmethod def handleBlankResult(value): if value is None or len(value) == 0: return "unknown" else: return value ## # Returns Cymru DNS query information # # @return {"asn": [], "country": [], "rir": []} dict for self.__banList IPs def getBanListExtendedCymruInfo(self, timeout=10): return_dict = {"asn": [], "country": [], "rir": []} if not hasattr(self, 'dnsResolver'): global dns try: import dns.exception import dns.resolver resolver = dns.resolver.Resolver() resolver.lifetime = timeout resolver.timeout = timeout / 2 self.dnsResolver = resolver except ImportError as e: # pragma: no cover logSys.error("dnspython package is required but could not be imported") return_dict["error"] = repr(e) return_dict["asn"].append("error") return_dict["country"].append("error") return_dict["rir"].append("error") return return_dict # get ips in lock: with self.__lock: banIPs = [banData.getIP() for banData in list(self.__banList.values())] # get cymru info: try: for ip in banIPs: # Reference: https://www.team-cymru.com/IP-ASN-mapping.html#dns question = ip.getPTR( "origin.asn.cymru.com" if ip.isIPv4 else "origin6.asn.cymru.com" ) try: resolver = self.dnsResolver answers = resolver.query(question, "TXT") if not answers: raise ValueError("No data retrieved") asns = set() countries = set() rirs = set() for rdata in answers: asn, net, country, rir, changed =\ [answer.strip("'\" ") for answer in rdata.to_text().split("|")] asn = self.handleBlankResult(asn) country = self.handleBlankResult(country) rir = self.handleBlankResult(rir) asns.add(self.handleBlankResult(asn)) countries.add(self.handleBlankResult(country)) rirs.add(self.handleBlankResult(rir)) return_dict["asn"].append(', '.join(sorted(asns))) return_dict["country"].append(', '.join(sorted(countries))) return_dict["rir"].append(', '.join(sorted(rirs))) except dns.resolver.NXDOMAIN: return_dict["asn"].append("nxdomain") return_dict["country"].append("nxdomain") return_dict["rir"].append("nxdomain") except (dns.exception.DNSException, dns.resolver.NoNameservers, dns.exception.Timeout) as dnse: # pragma: no cover logSys.error("DNSException %r querying Cymru for %s TXT", dnse, question) if logSys.level <= logging.DEBUG: logSys.exception(dnse) return_dict["error"] = repr(dnse) break except Exception as e: # pragma: no cover logSys.error("Unhandled Exception %r querying Cymru for %s TXT", e, question) if logSys.level <= logging.DEBUG: logSys.exception(e) return_dict["error"] = repr(e) break except Exception as e: # pragma: no cover logSys.error("Failure looking up extended Cymru info: %s", e) if logSys.level <= logging.DEBUG: logSys.exception(e) return_dict["error"] = repr(e) return return_dict ## # Returns list of Banned ASNs from Cymru info # # Use getBanListExtendedCymruInfo() to provide cymru_info # # @return list of Banned ASNs def geBanListExtendedASN(self, cymru_info): try: return [asn for asn in cymru_info["asn"]] except Exception as e: logSys.error("Failed to lookup ASN") logSys.exception(e) return [] ## # Returns list of Banned Countries from Cymru info # # Use getBanListExtendedCymruInfo() to provide cymru_info # # @return list of Banned Countries def geBanListExtendedCountry(self, cymru_info): try: return [country for country in cymru_info["country"]] except Exception as e: logSys.error("Failed to lookup Country") logSys.exception(e) return [] ## # Returns list of Banned RIRs from Cymru info # # Use getBanListExtendedCymruInfo() to provide cymru_info # # @return list of Banned RIRs def geBanListExtendedRIR(self, cymru_info): try: return [rir for rir in cymru_info["rir"]] except Exception as e: logSys.error("Failed to lookup RIR") logSys.exception(e) return [] ## # Add a ban ticket. # # Add a BanTicket instance into the ban list. # @param ticket the ticket # @return True if the IP address is not in the ban list def addBanTicket(self, ticket, reason={}): eob = ticket.getEndOfBanTime(self.__banTime) if eob < MyTime.time(): reason['expired'] = 1 return False with self.__lock: # check already banned fid = ticket.getID() oldticket = self.__banList.get(fid) if oldticket: reason['ticket'] = oldticket # if new time for end of ban is larger than already banned end-time: if eob > oldticket.getEndOfBanTime(self.__banTime): # we have longest ban - set new (increment) ban time reason['prolong'] = 1 btm = ticket.getBanTime(self.__banTime) # if not permanent: if btm != -1: diftm = ticket.getTime() - oldticket.getTime() if diftm > 0: btm += diftm oldticket.setBanTime(btm) return False # not yet banned - add new one: self.__banList[fid] = ticket self.__banTotal += 1 ticket.incrBanCount() # correct next unban time: if self._nextUnbanTime > eob: self._nextUnbanTime = eob return True ## # Get the size of the ban list. # # @return the size def size(self): return len(self.__banList) ## # Check if a ticket is in the list. # # Check if a BanTicket with a given IP address is already in the # ban list. # @param ticket the ticket # @return True if a ticket already exists def _inBanList(self, ticket): return ticket.getID() in self.__banList ## # Get the list of IP address to unban. # # Return a list of BanTicket which need to be unbanned. # @param time the time # @return the list of ticket to unban def unBanList(self, time, maxCount=0x7fffffff): with self.__lock: # Check next unban time: nextUnbanTime = self._nextUnbanTime if nextUnbanTime > time: return list() # Gets the list of ticket to remove (thereby correct next unban time). unBanList = {} nextUnbanTime = BanTicket.MAX_TIME for fid,ticket in self.__banList.items(): # current time greater as end of ban - timed out: eob = ticket.getEndOfBanTime(self.__banTime) if time > eob: unBanList[fid] = ticket if len(unBanList) >= maxCount: # stop search cycle, so reset back the next check time nextUnbanTime = self._nextUnbanTime break elif nextUnbanTime > eob: nextUnbanTime = eob self._nextUnbanTime = nextUnbanTime # Removes tickets. if len(unBanList): if len(unBanList) / 2.0 <= len(self.__banList) / 3.0: # few as 2/3 should be removed - remove particular items: for fid in unBanList.keys(): del self.__banList[fid] else: # create new dictionary without items to be deleted: self.__banList = dict((fid,ticket) for fid,ticket in self.__banList.items() \ if fid not in unBanList) # return list of tickets: return list(unBanList.values()) ## # Flush the ban list. # # Get the ban list and initialize it with an empty one. # @return the complete ban list def flushBanList(self): with self.__lock: uBList = list(self.__banList.values()) self.__banList = dict() return uBList ## # Gets the ticket for the specified ID (most of the time it is IP-address). # # @return the ticket or False. def getTicketByID(self, fid): with self.__lock: try: # Return the ticket after removing (popping) # if from the ban list. return self.__banList.pop(fid) except KeyError: pass return None # if none found
Save File
Cancel