parry 0.1.0 → 0.2.0

data/lib/parry/rule_set.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Parry
+  class RuleSet
+    attr_reader :version, :rules, :caught_hosts
+
+    def initialize(rules = [], version = 0, caught_hosts = {})
+      @rules = rules.freeze
+      @version = version
+      @caught_hosts = caught_hosts.freeze
+      @blocklist_rules = rules.select { |rule| rule.kind == "blocklist" }.freeze
+      @safelist_rules = rules.select { |rule| rule.kind == "safelist" }.freeze
+      @throttle_rules = rules.select(&:throttle?).freeze
+      @honeypot_rules = rules.select(&:honeypot?).freeze
+      freeze
+    end
+
+    def self.empty
+      new([], 0, {})
+    end
+
+    attr_reader :blocklist_rules, :safelist_rules, :throttle_rules, :honeypot_rules
+
+    def blocklisted?(ip)
+      !blocklist_rule_for(ip).nil?
+    end
+
+    def safelisted?(ip)
+      !safelist_rule_for(ip).nil?
+    end
+
+    def blocklist_rule_for(ip)
+      @blocklist_rules.find { |rule| rule.matches_ip?(ip) }
+    end
+
+    def safelist_rule_for(ip)
+      @safelist_rules.find { |rule| rule.matches_ip?(ip) }
+    end
+
+    def honeypot_rule_for_path(path)
+      @honeypot_rules.find { |rule| rule.matches_path?(path) }
+    end
+
+    def caught?(ip)
+      !caught_host(ip).nil?
+    end
+
+    def caught_host(ip)
+      @caught_hosts[ip.to_s]
+    end
+
+    def empty?
+      @rules.empty? && @caught_hosts.empty?
+    end
+  end
+end

data/lib/parry/rule_store.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module Parry
+  class RuleStore
+    def all
+      raw = Parry.with_redis { |redis| redis.hgetall(rules_key) }
+      raw.values.filter_map { |json| Rule.from_json(json) }.sort_by { |rule| [rule.created_at || 0, rule.id.to_s] }
+    end
+
+    def where(kind:)
+      all.select { |rule| rule.kind == kind.to_s }
+    end
+
+    def find(id)
+      json = Parry.with_redis { |redis| redis.hget(rules_key, id.to_s) }
+      json && Rule.from_json(json)
+    end
+
+    def count
+      Parry.with_redis { |redis| redis.hlen(rules_key) }
+    end
+
+    def save(rule)
+      rule.id ||= SecureRandom.hex(8)
+      rule.normalize!
+      return false unless rule.valid?
+
+      rule.created_at ||= Time.now.to_i
+      Parry.with_redis do |redis|
+        redis.hset(rules_key, rule.id, rule.to_json)
+        redis.incr(version_key)
+      end
+      rule.persisted = true
+      true
+    end
+
+    def delete(id)
+      deleted = Parry.with_redis do |redis|
+        count = redis.hdel(rules_key, id.to_s)
+        redis.incr(version_key) if count > 0
+        count
+      end
+      deleted > 0
+    end
+
+    def delete_matching_ip(ip, kinds: ["blocklist"])
+      kinds = Array(kinds).map(&:to_s)
+      matching = all.select { |rule| kinds.include?(rule.kind) && rule.matches_ip?(ip) }
+      return matching if matching.empty?
+
+      Parry.with_redis do |redis|
+        redis.hdel(rules_key, matching.map(&:id))
+        redis.incr(version_key)
+      end
+      matching
+    end
+
+    def version
+      Parry.with_redis { |redis| redis.get(version_key) }.to_i
+    end
+
+    def bump_version
+      Parry.with_redis { |redis| redis.incr(version_key) }
+    end
+
+    def rule_set
+      current = version
+      RuleSet.new(all, current, Parry.honeypots.to_h)
+    end
+
+    def clear
+      Parry.with_redis do |redis|
+        redis.del(rules_key)
+        redis.incr(version_key)
+      end
+    end
+
+    def rules_key
+      "#{Parry.config.key_prefix}:rules"
+    end
+
+    def version_key
+      "#{Parry.config.key_prefix}:rules_version"
+    end
+  end
+end

data/lib/parry/rule_transfer.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Parry
+  class RuleTransfer
+    FORMAT = 1
+    MAX_BYTES = 1_048_576
+
+    Result = Struct.new(:imported, :errors, :replaced, keyword_init: true) do
+      def ok?
+        errors.empty?
+      end
+
+      def replaced?
+        !!replaced
+      end
+    end
+
+    class << self
+      def export
+        {
+          "format" => FORMAT,
+          "parry_version" => Parry::VERSION,
+          "exported_at" => Time.now.to_i,
+          "rules" => Parry.store.all.map(&:to_h)
+        }
+      end
+
+      def export_json
+        JSON.pretty_generate(export)
+      end
+
+      def filename(at: Time.now)
+        "parry-rules-#{at.strftime("%Y%m%d-%H%M%S")}.json"
+      end
+
+      def import(payload, replace: false)
+        payload = payload.to_s
+        return failure("The file is empty.") if payload.strip.empty?
+        return failure("The file is bigger than #{MAX_BYTES / 1024}KB.") if payload.bytesize > MAX_BYTES
+
+        data = begin
+          JSON.parse(payload)
+        rescue JSON::ParserError => e
+          return failure("The file is not valid JSON (#{e.message.lines.first.to_s.strip}).")
+        end
+
+        entries = entries_in(data)
+        return failure(%(No rules found. Expected an export with a "rules" list.)) if entries.nil?
+        return failure("The file contains no rules.") if entries.empty?
+
+        apply(entries, replace: replace)
+      end
+
+      private
+
+      def entries_in(data)
+        case data
+        when Hash then data["rules"].is_a?(Array) ? data["rules"] : nil
+        when Array then data
+        end
+      end
+
+      def apply(entries, replace:)
+        snapshot = Parry.with_redis { |redis| redis.hgetall(Parry.store.rules_key) }
+        errors = []
+        imported = 0
+
+        Parry.store.clear if replace
+
+        entries.each_with_index do |attrs, index|
+          rule = build(attrs)
+
+          if rule.nil?
+            errors << "Rule #{index + 1} could not be read."
+          elsif Parry.store.save(rule)
+            imported += 1
+          else
+            errors << "Rule #{index + 1}#{label_for(rule)}: #{rule.errors.full_messages.to_sentence}."
+          end
+        end
+
+        if errors.any?
+          restore(snapshot)
+          return Result.new(imported: 0, errors: errors, replaced: false)
+        end
+
+        Result.new(imported: imported, errors: [], replaced: replace)
+      end
+
+      def build(attrs)
+        return nil unless attrs.is_a?(Hash)
+
+        rule = Rule.from_json(attrs.to_json)
+        rule&.persisted = false
+        rule
+      end
+
+      def label_for(rule)
+        label = rule.label
+        label.present? ? " (#{label})" : ""
+      end
+
+      def restore(snapshot)
+        Parry.with_redis do |redis|
+          redis.del(Parry.store.rules_key)
+          snapshot.each { |id, json| redis.hset(Parry.store.rules_key, id, json) }
+          redis.incr(Parry.store.version_key)
+        end
+      end
+
+      def failure(message)
+        Result.new(imported: 0, errors: [message], replaced: false)
+      end
+    end
+  end
+end

data/lib/parry/tracker.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Parry
+  class Tracker
+    def record(ip:, match_type:, rule: nil, path: nil, at: Time.now)
+      return if ip.nil? || ip.to_s.empty?
+
+      timestamp = at.to_i
+      key = host_key(ip)
+      Parry.with_redis do |redis|
+        redis.multi do |tx|
+          tx.hincrby(key, "hits", 1)
+          tx.hset(key, "ip", ip.to_s, "match_type", match_type.to_s, "last_seen", timestamp.to_s)
+          tx.hsetnx(key, "first_seen", timestamp.to_s)
+          tx.hset(key, "rule", rule.to_s) if rule
+          tx.hset(key, "path", path.to_s) if path
+          tx.zadd(index_key, timestamp, ip.to_s)
+        end
+      end
+      trim!
+    end
+
+    def all(limit: 100)
+      ips = Parry.with_redis { |redis| redis.zrevrange(index_key, 0, limit - 1) }
+      return [] if ips.empty?
+
+      hashes = Parry.with_redis do |redis|
+        redis.pipelined { |pipeline| ips.each { |ip| pipeline.hgetall(host_key(ip)) } }
+      end
+
+      ips.zip(hashes).filter_map { |ip, hash| BlockedHost.from_hash(ip, hash) }
+    end
+
+    def find(ip)
+      hash = Parry.with_redis { |redis| redis.hgetall(host_key(ip)) }
+      BlockedHost.from_hash(ip, hash)
+    end
+
+    def count
+      Parry.with_redis { |redis| redis.zcard(index_key) }
+    end
+
+    def forget(ip)
+      Parry.with_redis do |redis|
+        redis.multi do |tx|
+          tx.zrem(index_key, ip.to_s)
+          tx.del(host_key(ip))
+        end
+      end
+      true
+    end
+
+    def clear
+      Parry.with_redis do |redis|
+        ips = redis.zrange(index_key, 0, -1)
+        redis.del(*ips.map { |ip| host_key(ip) }) unless ips.empty?
+        redis.del(index_key)
+      end
+    end
+
+    def index_key
+      "#{Parry.config.key_prefix}:blocked_hosts"
+    end
+
+    def host_key(ip)
+      "#{Parry.config.key_prefix}:blocked_host:#{ip}"
+    end
+
+    private
+
+    def trim!
+      max = Parry.config.max_tracked_hosts
+      return if max.nil? || max <= 0
+
+      Parry.with_redis do |redis|
+        excess = redis.zcard(index_key) - max
+        next if excess <= 0
+
+        victims = redis.zrange(index_key, 0, excess - 1)
+        next if victims.empty?
+
+        redis.multi do |tx|
+          tx.zrem(index_key, victims)
+          tx.del(*victims.map { |ip| host_key(ip) })
+        end
+      end
+    end
+  end
+end

data/lib/parry/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Parry
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/parry.rb

@@ -1,8 +1,91 @@
 # frozen_string_literal: true
 
+require "logger"
+require "active_support"
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/hash/slice"
+require "rack/attack"
+
 require_relative "parry/version"
+require_relative "parry/configuration"
+require_relative "parry/rule"
+require_relative "parry/rule_set"
+require_relative "parry/rule_store"
+require_relative "parry/rule_transfer"
+require_relative "parry/blocked_host"
+require_relative "parry/caught_host"
+require_relative "parry/honeypot_store"
+require_relative "parry/tracker"
+require_relative "parry/rack_attack_adapter"
 
 module Parry
   class Error < StandardError; end
-  # Your code goes here...
+
+  class << self
+    attr_writer :logger
+
+    def config
+      @config ||= Configuration.new
+    end
+    alias_method :configuration, :config
+
+    def configure
+      yield config
+    end
+
+    def with_redis(&block)
+      client = config.redis
+      client.respond_to?(:with) ? client.with(&block) : yield(client)
+    end
+
+    def store
+      @store ||= RuleStore.new
+    end
+
+    def tracker
+      @tracker ||= Tracker.new
+    end
+
+    def honeypots
+      @honeypots ||= HoneypotStore.new
+    end
+
+    def adapter
+      @adapter ||= RackAttackAdapter.new
+    end
+
+    def install!
+      adapter.install!
+    end
+
+    def rules
+      store.all
+    end
+
+    def unblock(ip)
+      adapter.unblock(ip)
+    end
+
+    def blocked_hosts(limit: 100)
+      tracker.all(limit: limit)
+    end
+
+    def logger
+      @logger ||= if defined?(::Rails) && ::Rails.respond_to?(:logger) && ::Rails.logger
+        ::Rails.logger
+      else
+        ::Logger.new($stderr)
+      end
+    end
+
+    def reset!
+      @store = nil
+      @tracker = nil
+      @honeypots = nil
+      adapter.reset!
+    end
+  end
 end
+
+require_relative "parry/engine" if defined?(::Rails)

metadata

@@ -1,15 +1,101 @@
 --- !ruby/object:Gem::Specification
 name: parry
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Greg Molnar
 bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies: []
-description: Coming soon....
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: activemodel
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: rack-attack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.6'
+- !ruby/object:Gem::Dependency
+  name: redis
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.2'
+description: Parry is a mountable Rails engine to manage Rack::Attack rules (blocklists,
+  safelists and throttles) at runtime, inspect blocked hosts and unblock them. Rules
+  are stored in Redis and applied without a redeploy.
 email:
 - molnargerg@gmail.com
 executables: []
@@ -21,7 +107,30 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- app/controllers/parry/application_controller.rb
+- app/controllers/parry/blocked_hosts_controller.rb
+- app/controllers/parry/rules_controller.rb
+- app/helpers/parry/application_helper.rb
+- app/views/layouts/parry/application.html.erb
+- app/views/parry/blocked_hosts/index.html.erb
+- app/views/parry/rules/_form.html.erb
+- app/views/parry/rules/edit.html.erb
+- app/views/parry/rules/import.html.erb
+- app/views/parry/rules/index.html.erb
+- app/views/parry/rules/new.html.erb
+- config/routes.rb
 - lib/parry.rb
+- lib/parry/blocked_host.rb
+- lib/parry/caught_host.rb
+- lib/parry/configuration.rb
+- lib/parry/engine.rb
+- lib/parry/honeypot_store.rb
+- lib/parry/rack_attack_adapter.rb
+- lib/parry/rule.rb
+- lib/parry/rule_set.rb
+- lib/parry/rule_store.rb
+- lib/parry/rule_transfer.rb
+- lib/parry/tracker.rb
 - lib/parry/version.rb
 - sig/parry.rbs
 homepage: https://github.com/gregmolnar/parry
@@ -46,5 +155,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.3
 specification_version: 4
-summary: Coming soon....
+summary: A Rails engine that provides a GUI for Rack::Attack
 test_files: []