fail2ban.go

// Package fail2ban contains the Fail2ban mechanism for the plugin.
package fail2ban

import (
	"context"
	"fmt"
	"net/http"
	"os"
	"strings"

	"github.com/tomMoulard/fail2ban/pkg/chain"
	"github.com/tomMoulard/fail2ban/pkg/fail2ban"
	f2bHandler "github.com/tomMoulard/fail2ban/pkg/fail2ban/handler"
	"github.com/tomMoulard/fail2ban/pkg/ipchecking"
	lAllow "github.com/tomMoulard/fail2ban/pkg/list/allow"
	lDeny "github.com/tomMoulard/fail2ban/pkg/list/deny"
	"github.com/tomMoulard/fail2ban/pkg/logger"
	"github.com/tomMoulard/fail2ban/pkg/response/status"
	"github.com/tomMoulard/fail2ban/pkg/rules"
	uAllow "github.com/tomMoulard/fail2ban/pkg/url/allow"
	uDeny "github.com/tomMoulard/fail2ban/pkg/url/deny"
)

// List struct.
type List struct {
	IP    []string
	Files []string
}

// SourceCriterion defines how to determine the client IP for fail2ban evaluation.
type SourceCriterion struct {
	// RequestHeaderName is the HTTP header from which to read the client IP.
	// Useful when running behind a proxy/CDN (e.g. "Cf-Connecting-Ip" for Cloudflare).
	// When empty, r.RemoteAddr is used.
	RequestHeaderName string `yaml:"requestHeaderName"`
}

// Config struct.
type Config struct {
	Denylist        List            `yaml:"denylist"`
	Allowlist       List            `yaml:"allowlist"`
	Rules           rules.Rules     `yaml:"port"`
	SourceCriterion SourceCriterion `yaml:"sourceCriterion"`
	EnableBlockLogs bool            `yaml:"enableBlockLogs"`

	// deprecated
	Blacklist List `yaml:"blacklist"`
	// deprecated
	Whitelist List `yaml:"whitelist"`
}

// CreateConfig populates the Config data object.
func CreateConfig() *Config {
	return &Config{
		Rules: rules.Rules{
			Bantime:  "300s",
			Findtime: "120s",
			Enabled:  true,
		},
		EnableBlockLogs: true,
	}
}

// ImportIP extract all ip from config sources.
func ImportIP(list List) ([]string, error) {
	var rlist []string

	for _, ip := range list.Files {
		content, err := os.ReadFile(ip)
		if err != nil {
			return nil, fmt.Errorf("error when getting file content: %w", err)
		}

		rlist = append(rlist, strings.Split(string(content), "\n")...)
		if len(rlist) > 1 {
			rlist = rlist[:len(rlist)-1]
		}
	}

	rlist = append(rlist, list.IP...)

	return rlist, nil
}

// New instantiates and returns the required components used to handle a HTTP
// request.
func New(_ context.Context, next http.Handler, config *Config, _ string) (http.Handler, error) {
	if !config.Rules.Enabled {
		logger.Info("Plugin: FailToBan is disabled")

		return next, nil
	}

	allowIPs, err := ImportIP(config.Allowlist)
	if err != nil {
		return nil, fmt.Errorf("failed to parse allowlist IPs: %w", err)
	}

	if len(config.Whitelist.IP) > 0 || len(config.Whitelist.Files) > 0 {
		logger.Warn("Plugin: FailToBan: 'whitelist' is deprecated, please use 'allowlist' instead")

		whiteips, err := ImportIP(config.Whitelist)
		if err != nil {
			return nil, fmt.Errorf("failed to parse whitelist IPs: %w", err)
		}

		allowIPs = append(allowIPs, whiteips...)
	}

	allowNetIPs, err := ipchecking.ParseNetIPs(allowIPs)
	if err != nil {
		return nil, fmt.Errorf("failed to parse allowlist IPs: %w", err)
	}

	allowHandler, err := lAllow.New(allowIPs)
	if err != nil {
		return nil, fmt.Errorf("failed to parse allowlist IPs: %w", err)
	}

	denyIPs, err := ImportIP(config.Denylist)
	if err != nil {
		return nil, fmt.Errorf("failed to parse denylist IPs: %w", err)
	}

	if len(config.Blacklist.IP) > 0 || len(config.Blacklist.Files) > 0 {
		logger.Warn("Plugin: FailToBan: 'blacklist' is deprecated, please use 'denylist' instead")

		blackips, err := ImportIP(config.Blacklist)
		if err != nil {
			return nil, fmt.Errorf("failed to parse blacklist IPs: %w", err)
		}

		denyIPs = append(denyIPs, blackips...)
	}

	denyHandler, err := lDeny.New(denyIPs, config.EnableBlockLogs)
	if err != nil {
		return nil, fmt.Errorf("failed to parse denylist IPs: %w", err)
	}

	rules, err := rules.TransformRule(config.Rules)
	if err != nil {
		return nil, fmt.Errorf("error when Transforming rules: %w", err)
	}

	f2b := fail2ban.New(rules, allowNetIPs)

	c := chain.New(
		next,
		config.SourceCriterion.RequestHeaderName,
		denyHandler,
		allowHandler,
		uDeny.New(rules.URLRegexpBan, f2b, config.EnableBlockLogs),
		uAllow.New(rules.URLRegexpAllow),
		f2bHandler.New(f2b, config.EnableBlockLogs),
	)

	if rules.StatusCode != "" {
		statusCodeHandler, err := status.New(next, rules.StatusCode, f2b, config.EnableBlockLogs)
		if err != nil {
			return nil, fmt.Errorf("failed to create status handler: %w", err)
		}

		c.WithStatus(statusCodeHandler)
	}

	return c, nil
}