gerberos

README

gerberos

gerberos scans sources for lines matching regular expressions and containing IPv4 or IPv6 addresses and performs actions on those addresses. Possible sources are (not necessarily existant) non-directory files, systemd journals, kernel messages, and standard outputs of arbitrary processes. Addresses can be logged or added to ipsets or nft rulesets that gerberos will manage autonomously.

Minimal additional logic is applied. This is to adhere to the Unix philosophy, but impacts gerberos' out-of-the-box usefulness for specific use cases when compared to tools like fail2ban.

Requirements

ipset backend

• ipset 6.34
• iptables 1.6.1

nft backend

• nftables v0.9.3 (tested on Ubuntu 20.04)

Development only

• Go 1.18
• GNU Make 4.3 (optional)
• pgrep (system tests only, optional)

Build

make build

Test

Unit tests only

make test

Unit and system tests

Requires ipset, iptables, and nftables to be installed.

make test_system

Example configuration file (TOML)

See gerberos.toml.

Example systemd service file

See gerberos.service.

Documentation

Index

• Variables
• func NewDefaultExecutor() *defaultExecutor
• func NewTestFaultyExecutor(output string, exitCode int, err error, name string, args ...string) *testFaultyExecutor
• func RegisterAction(name string, afn func() Action)
• func RegisterBackend(name string, bfn func(*Runner) Backend)
• func RegisterSource(name string, fn func() Source)
• type Action
  • func NewBanAction() Action
  • func NewLogAction() Action
  • func NewTestAction() Action
• type Backend
  • func NewIpsetBackend(rn *Runner) Backend
  • func NewNftBackend(rn *Runner) Backend
  • func NewTestBackend(rn *Runner) Backend
• type Configuration
  • func (c *Configuration) Read(r io.Reader) error
  • func (c *Configuration) ReadFile(path string) error
• type Executor
• type Match
  • func (m Match) String() string
  • func (m Match) StringExtended() string
• type Rule
  • func (r *Rule) Match(line string) (*Match, error)
  • func (r *Rule) MatchAggregate(line string) (*Match, error)
  • func (r *Rule) MatchSimple(line string) (*Match, error)
  • func (r *Rule) ProcessScanner(name string, args ...string) (chan *Match, error)
• type Runner
  • func NewRunner(c *Configuration) *Runner
  • func (rn *Runner) Ban(ip string, ipv6 bool, d time.Duration) error
  • func (rn *Runner) Finalize() error
  • func (rn *Runner) Initialize() error
  • func (rn *Runner) Run(requeueWorkers bool)
  • func (rn *Runner) Stop()
• type Source
  • func NewFileSource() Source
  • func NewKernelSource() Source
  • func NewProcessSource() Source
  • func NewSystemdSource() Source
  • func NewTestSource() Source

Variables

var (
	DefaultChainName  = "gerberos"
	DefaultTable4Name = "gerberos4"
	DefaultTable6Name = "gerberos6"
)

var (
	ErrMissingSource            = errors.New("missing source")
	ErrEmptySource              = errors.New("empty source")
	ErrUnknownSource            = errors.New("unknown source")
	ErrMissingAction            = errors.New("missing action")
	ErrEmptyAction              = errors.New("empty action")
	ErrUnknownAction            = errors.New("unknown action")
	ErrMissingIntervalParameter = errors.New("missing interval parameter")
	ErrInvalidIntervalParameter = errors.New("failed to parse interval parameter")
	ErrMissingRegexp            = errors.New("missing regexp")
	ErrEmptyRegexp              = errors.New("empty regexp")
	ErrMissingCountParameter    = errors.New("missing count parameter")
	ErrInvalidCountParameter    = errors.New("failed to parse count parameter")
)

Functions

func NewDefaultExecutor

func NewDefaultExecutor() *defaultExecutor

func NewTestFaultyExecutor

func NewTestFaultyExecutor(output string, exitCode int, err error, name string, args ...string) *testFaultyExecutor

func RegisterAction

func RegisterAction(name string, afn func() Action)

func RegisterBackend

func RegisterBackend(name string, bfn func(*Runner) Backend)

func RegisterSource

func RegisterSource(name string, fn func() Source)

Types

type Action

type Action interface {
	Initialize(r *Rule) error
	Perform(m *Match) error
}

func NewBanAction

func NewBanAction() Action

func NewLogAction

func NewLogAction() Action

func NewTestAction

func NewTestAction() Action

type Backend

type Backend interface {
	Initialize() error
	Ban(ip string, ipv6 bool, d time.Duration) error
	Finalize() error
}

func NewIpsetBackend

func NewIpsetBackend(rn *Runner) Backend

func NewNftBackend

func NewNftBackend(rn *Runner) Backend

func NewTestBackend

func NewTestBackend(rn *Runner) Backend

type Configuration

type Configuration struct {
	Verbose      bool
	Backend      string
	SaveFilePath string
	Rules        map[string]*Rule
}

func (*Configuration) Read

func (c *Configuration) Read(r io.Reader) error

func (*Configuration) ReadFile

func (c *Configuration) ReadFile(path string) error

type Executor

type Executor interface {
	Execute(name string, args ...string) (string, int, error)
	ExecuteWithStd(stdin io.Reader, stdout io.Writer, name string, args ...string) (string, int, error)
}

type Match

type Match struct {
	Time   time.Time
	Line   string
	IP     string
	IPv6   bool
	Regexp *regexp.Regexp
}

func (Match) String

func (m Match) String() string

func (Match) StringExtended

func (m Match) StringExtended() string

type Rule

type Rule struct {
	Source      []string
	Regexp      []string
	Action      []string
	Aggregate   []string
	Occurrences []string
	// contains filtered or unexported fields
}

func (*Rule) Match

func (r *Rule) Match(line string) (*Match, error)

func (*Rule) MatchAggregate

func (r *Rule) MatchAggregate(line string) (*Match, error)

func (*Rule) MatchSimple

func (r *Rule) MatchSimple(line string) (*Match, error)

func (*Rule) ProcessScanner

func (r *Rule) ProcessScanner(name string, args ...string) (chan *Match, error)

type Runner

type Runner struct {
	Configuration *Configuration

	Executor Executor
	// contains filtered or unexported fields
}

func NewRunner

func NewRunner(c *Configuration) *Runner

func (*Runner) Ban

func (rn *Runner) Ban(ip string, ipv6 bool, d time.Duration) error

func (*Runner) Finalize

func (rn *Runner) Finalize() error

func (*Runner) Initialize

func (rn *Runner) Initialize() error

func (*Runner) Run

func (rn *Runner) Run(requeueWorkers bool)

func (*Runner) Stop

func (rn *Runner) Stop()

type Source

type Source interface {
	Initialize(r *Rule) error
	Matches() (chan *Match, error)
}

func NewFileSource

func NewFileSource() Source

func NewKernelSource

func NewKernelSource() Source

func NewProcessSource

func NewProcessSource() Source

func NewSystemdSource

func NewSystemdSource() Source

func NewTestSource

func NewTestSource() Source