grok 0.0.1 → 0.0.2

data/README.rdoc

@@ -3,7 +3,7 @@
 Grok aims to be a replacement for the now antiquated SEC (Simple Event 
 Correlator).
 
-== Usage
+== Getting started
 A simple Grok watcher needs very little in the way of configuration
   require 'grok'
   
@@ -37,8 +37,26 @@ RegExp functionality in the event handlers
     puts "SSH authentication failure for #{username} from #{ip}"
   end
 
-This is a bit better.  You could go further to have it automatically block the 
-IP with iptables if you wanted (see examples/ssh_sentry.rb).
+This is a bit better.  It seems a bit unfair to block someone for a single typo
+though, so why don't we give them three tries before blocking them?
+
+  on /sshd\[\d+\]: Failed password for ([\d\w]+) from ([\d\.]+)/, :times => 3 do |username, ip|
+    puts "SSH authentication failure for #{username} from #{ip}"
+  end
+
+Getting there.  What if our user failed a couple of times over the past month?
+We don't really want to him out for that, so we'll put a time limit on the rule
+so only 3 incorrect login attempts within the past 2 minutes will trigger it.
+
+  on /sshd\[\d+\]: Failed password for ([\d\w]+) from ([\d\.]+)/, :times => 3, :withn => '2m' do |username, ip|
+    puts "SSH authentication failure for #{username} from #{ip}"
+  end
+
+Your time string can be made of any combination of years (y), months (M), 
+weeks (w), days (d), hours (h), minutes (m) and seconds (s).  For example
+
+  '1d2h3s' => 1 day, 2 hours and 3 seconds
+  '2y3m' => 2 years and 3 minutes
 
 == Note on Patches/Pull Requests
  

data/VERSION

@@ -1 +1 @@
-0.0.1
+0.0.2

data/examples/ssh_sentry.rb

@@ -6,6 +6,6 @@ configure do |c|
   c.replay = 0
 end
 
-on /Failed password for root from ([\d\.]+)/ do |ip|
+on /Failed password for root from ([\d\.]+)/, :times => 3, :within => '2m' do |ip|
   ret = `/sbin/iptables -I INPUT --source #{ip} -j REJECT`
 end

data/lib/grok.rb

@@ -1,4 +1,5 @@
 require 'grok/watcher'
+require 'grok/time'
 
 $watcher = Grok::Watcher.new
 

data/lib/grok/time.rb

@@ -0,0 +1,57 @@
+# This bit of code has been shamelessly stolen from rufus-scheduler because
+# it's awesome.
+
+module Grok
+  def Grok.parse_time_string(string)
+    string = string.strip
+    index = -1
+    result = 0.0
+
+    number = ''
+    loop do
+      index = index+1
+
+      if index >= string.length
+        result += (Float(number) / 1000.0) if number.length > 0
+        break
+      end
+
+      c = string[index, 1]
+
+      if (c >= '0' and c <= '9')
+        number += c
+        next
+      end
+
+      value = Integer(number)
+      number = ''
+      multiplier = DURATIONS[c]
+
+      raise "unknown time char '#{c}'" unless multiplier
+
+      result += (value * multiplier)
+    end
+
+    result
+  end
+
+protected
+
+  DURATIONS2M = [
+    [ 'y', 365 * 24 * 3600 ],
+    [ 'M', 30 * 24 * 3600 ],
+    [ 'w', 7 * 24 * 3600 ],
+    [ 'd', 24 * 3600 ],
+    [ 'h', 3600 ],
+    [ 'm', 60 ],
+    [ 's', 1 ]
+  ]
+    
+  DURATIONS2 = DURATIONS2M.dup
+  DURATIONS2.delete_at(1)
+
+  DURATIONS = DURATIONS2M.inject({}) do |r, (k, v)|
+    r[k] = v
+    r
+  end
+end

data/lib/grok/watcher.rb

@@ -9,6 +9,7 @@ module Grok
 
     def initialize(&b)
       @events = {}
+      @event_log = {}
       @config = Config.new("/var/log/messages", 10)
 
       #instance_eval(&b) if block_given?
@@ -21,7 +22,8 @@ module Grok
     def on(match, opts={}, &block)
       event = :log
       match = match.to_s if match.is_a? Integer
-      (@events[event] ||= []) << [Regexp.new(match), block]
+      within = opts[:within] ? Grok.parse_time_string(opts[:within]) : nil
+      (@events[event] ||= []) << [Regexp.new(match), block, opts[:times], within]
     end
 
     def start
@@ -61,9 +63,23 @@ module Grok
 
     def dispatch(event, log)
       if handler = find(event, log)
-        regexp, block = *handler
+        regexp, block, times, within = *handler
         self.match = log.match(regexp).captures
-        invoke block
+        (@event_log[match] ||= []) << Time.now.to_i
+        if @event_log[match].length >= times.to_i
+          if within:
+            times_within_range = @event_log[match].reject { |event_time|
+              event_time < (Time.now.to_i - within)
+            }
+            if times_within_range.length >= times.to_i
+              invoke block
+              @event_log[match].clear
+            end
+          else
+            invoke block
+            @event_log[match].clear
+          end
+        end
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: grok
 version: !ruby/object:Gem::Version 
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors: 
 - Tim Sharpe
@@ -50,6 +50,7 @@ files:
 - VERSION
 - examples/ssh_sentry.rb
 - lib/grok.rb
+- lib/grok/time.rb
 - lib/grok/watcher.rb
 - test/helper.rb
 - test/test_grok.rb