You've already forked caddy-opnsense-blocker
Build initial caddy-opnsense-blocker daemon
This commit is contained in:
412
internal/service/service.go
Normal file
412
internal/service/service.go
Normal file
@@ -0,0 +1,412 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net"
|
||||
"os"
|
||||
"strings"
|
||||
"sync"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"git.dern.ovh/infrastructure/caddy-opnsense-blocker/internal/caddylog"
|
||||
"git.dern.ovh/infrastructure/caddy-opnsense-blocker/internal/config"
|
||||
"git.dern.ovh/infrastructure/caddy-opnsense-blocker/internal/engine"
|
||||
"git.dern.ovh/infrastructure/caddy-opnsense-blocker/internal/model"
|
||||
"git.dern.ovh/infrastructure/caddy-opnsense-blocker/internal/opnsense"
|
||||
"git.dern.ovh/infrastructure/caddy-opnsense-blocker/internal/store"
|
||||
)
|
||||
|
||||
type Service struct {
|
||||
cfg *config.Config
|
||||
store *store.Store
|
||||
evaluator *engine.Evaluator
|
||||
blocker opnsense.AliasClient
|
||||
logger *log.Logger
|
||||
}
|
||||
|
||||
func New(cfg *config.Config, db *store.Store, blocker opnsense.AliasClient, logger *log.Logger) *Service {
|
||||
if logger == nil {
|
||||
logger = log.New(io.Discard, "", 0)
|
||||
}
|
||||
return &Service{
|
||||
cfg: cfg,
|
||||
store: db,
|
||||
evaluator: engine.NewEvaluator(),
|
||||
blocker: blocker,
|
||||
logger: logger,
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) Run(ctx context.Context) error {
|
||||
var wg sync.WaitGroup
|
||||
for _, source := range s.cfg.Sources {
|
||||
source := source
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
s.runSource(ctx, source)
|
||||
}()
|
||||
}
|
||||
<-ctx.Done()
|
||||
wg.Wait()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Service) GetOverview(ctx context.Context, limit int) (model.Overview, error) {
|
||||
return s.store.GetOverview(ctx, limit)
|
||||
}
|
||||
|
||||
func (s *Service) ListEvents(ctx context.Context, limit int) ([]model.Event, error) {
|
||||
return s.store.ListRecentEvents(ctx, limit)
|
||||
}
|
||||
|
||||
func (s *Service) ListIPs(ctx context.Context, limit int, state string) ([]model.IPState, error) {
|
||||
return s.store.ListIPStates(ctx, limit, state)
|
||||
}
|
||||
|
||||
func (s *Service) GetIPDetails(ctx context.Context, ip string) (model.IPDetails, error) {
|
||||
normalized, err := normalizeIP(ip)
|
||||
if err != nil {
|
||||
return model.IPDetails{}, err
|
||||
}
|
||||
return s.store.GetIPDetails(ctx, normalized, 100, 100, 100)
|
||||
}
|
||||
|
||||
func (s *Service) ForceBlock(ctx context.Context, ip string, actor string, reason string) error {
|
||||
return s.applyManualOverride(ctx, ip, model.ManualOverrideForceBlock, model.IPStateBlocked, actor, defaultReason(reason, "manual block"), "block")
|
||||
}
|
||||
|
||||
func (s *Service) ForceAllow(ctx context.Context, ip string, actor string, reason string) error {
|
||||
return s.applyManualOverride(ctx, ip, model.ManualOverrideForceAllow, model.IPStateAllowed, actor, defaultReason(reason, "manual allow"), "unblock")
|
||||
}
|
||||
|
||||
func (s *Service) ClearOverride(ctx context.Context, ip string, actor string, reason string) error {
|
||||
normalized, err := normalizeIP(ip)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
reason = defaultReason(reason, "manual override cleared")
|
||||
state, err := s.store.ClearManualOverride(ctx, normalized, reason)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return s.store.AddDecision(ctx, &model.DecisionRecord{
|
||||
EventID: state.LastEventID,
|
||||
IP: normalized,
|
||||
SourceName: state.LastSourceName,
|
||||
Kind: "manual",
|
||||
Action: model.DecisionActionNone,
|
||||
Reason: reason,
|
||||
Actor: defaultActor(actor),
|
||||
Enforced: false,
|
||||
CreatedAt: time.Now().UTC(),
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Service) runSource(ctx context.Context, source config.SourceConfig) {
|
||||
s.pollSource(ctx, source)
|
||||
ticker := time.NewTicker(source.PollInterval.Duration)
|
||||
defer ticker.Stop()
|
||||
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-ticker.C:
|
||||
s.pollSource(ctx, source)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) pollSource(ctx context.Context, source config.SourceConfig) {
|
||||
lines, err := s.readNewLines(ctx, source)
|
||||
if err != nil {
|
||||
s.logger.Printf("source %s: %v", source.Name, err)
|
||||
return
|
||||
}
|
||||
if len(lines) == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
profile := s.cfg.Profiles[source.Profile]
|
||||
for _, line := range lines {
|
||||
record, err := caddylog.ParseLine(line)
|
||||
if err != nil {
|
||||
if errors.Is(err, caddylog.ErrEmptyLine) {
|
||||
continue
|
||||
}
|
||||
s.logger.Printf("source %s: parse line: %v", source.Name, err)
|
||||
continue
|
||||
}
|
||||
if record.Status < profile.MinStatus || record.Status > profile.MaxStatus {
|
||||
continue
|
||||
}
|
||||
if err := s.processRecord(ctx, source, profile, record); err != nil {
|
||||
s.logger.Printf("source %s: process record: %v", source.Name, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Service) processRecord(ctx context.Context, source config.SourceConfig, profile config.ProfileConfig, record model.AccessLogRecord) error {
|
||||
state, found, err := s.store.GetIPState(ctx, record.ClientIP)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
override := model.ManualOverrideNone
|
||||
if found {
|
||||
override = state.ManualOverride
|
||||
}
|
||||
|
||||
decision := s.evaluator.Evaluate(record, profile, override)
|
||||
event := model.Event{
|
||||
SourceName: source.Name,
|
||||
ProfileName: source.Profile,
|
||||
OccurredAt: record.OccurredAt,
|
||||
RemoteIP: record.RemoteIP,
|
||||
ClientIP: record.ClientIP,
|
||||
Host: record.Host,
|
||||
Method: record.Method,
|
||||
URI: record.URI,
|
||||
Path: record.Path,
|
||||
Status: record.Status,
|
||||
UserAgent: record.UserAgent,
|
||||
Decision: decision.Action,
|
||||
DecisionReason: decision.PrimaryReason(),
|
||||
DecisionReasons: append([]string(nil), decision.Reasons...),
|
||||
Enforced: false,
|
||||
RawJSON: record.RawJSON,
|
||||
CreatedAt: time.Now().UTC(),
|
||||
}
|
||||
|
||||
var backendAction *model.OPNsenseAction
|
||||
if decision.Action == model.DecisionActionBlock && s.blocker != nil {
|
||||
result, blockErr := s.blocker.AddIPIfMissing(ctx, record.ClientIP)
|
||||
backendAction = &model.OPNsenseAction{
|
||||
IP: record.ClientIP,
|
||||
Action: "block",
|
||||
CreatedAt: time.Now().UTC(),
|
||||
}
|
||||
if blockErr != nil {
|
||||
backendAction.Result = "error"
|
||||
backendAction.Message = blockErr.Error()
|
||||
} else {
|
||||
backendAction.Result = result
|
||||
backendAction.Message = decision.PrimaryReason()
|
||||
event.Enforced = true
|
||||
}
|
||||
}
|
||||
|
||||
if err := s.store.RecordEvent(ctx, &event); err != nil {
|
||||
return err
|
||||
}
|
||||
if decision.Action != model.DecisionActionNone {
|
||||
if err := s.store.AddDecision(ctx, &model.DecisionRecord{
|
||||
EventID: event.ID,
|
||||
IP: record.ClientIP,
|
||||
SourceName: source.Name,
|
||||
Kind: "automatic",
|
||||
Action: decision.Action,
|
||||
Reason: strings.Join(decision.Reasons, ", "),
|
||||
Actor: "engine",
|
||||
Enforced: event.Enforced,
|
||||
CreatedAt: time.Now().UTC(),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if backendAction != nil {
|
||||
if err := s.store.AddBackendAction(ctx, backendAction); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Service) readNewLines(ctx context.Context, source config.SourceConfig) ([]string, error) {
|
||||
info, err := os.Stat(source.Path)
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrNotExist) {
|
||||
return nil, nil
|
||||
}
|
||||
return nil, fmt.Errorf("stat source path %q: %w", source.Path, err)
|
||||
}
|
||||
inode := fileIdentity(info)
|
||||
size := info.Size()
|
||||
|
||||
offset, found, err := s.store.GetSourceOffset(ctx, source.Name)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !found {
|
||||
start := int64(0)
|
||||
if source.InitialPosition == "end" {
|
||||
start = size
|
||||
}
|
||||
offset = model.SourceOffset{
|
||||
SourceName: source.Name,
|
||||
Path: source.Path,
|
||||
Inode: inode,
|
||||
Offset: start,
|
||||
UpdatedAt: time.Now().UTC(),
|
||||
}
|
||||
if err := s.store.SaveSourceOffset(ctx, offset); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if start >= size {
|
||||
return nil, nil
|
||||
}
|
||||
} else if offset.Inode != inode || size < offset.Offset {
|
||||
offset = model.SourceOffset{
|
||||
SourceName: source.Name,
|
||||
Path: source.Path,
|
||||
Inode: inode,
|
||||
Offset: 0,
|
||||
UpdatedAt: time.Now().UTC(),
|
||||
}
|
||||
}
|
||||
|
||||
file, err := os.Open(source.Path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open source path %q: %w", source.Path, err)
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
if _, err := file.Seek(offset.Offset, io.SeekStart); err != nil {
|
||||
return nil, fmt.Errorf("seek source path %q: %w", source.Path, err)
|
||||
}
|
||||
|
||||
reader := bufio.NewReader(file)
|
||||
lines := make([]string, 0, source.BatchSize)
|
||||
currentOffset := offset.Offset
|
||||
|
||||
for len(lines) < source.BatchSize {
|
||||
line, err := reader.ReadString('\n')
|
||||
if err != nil {
|
||||
if errors.Is(err, io.EOF) {
|
||||
break
|
||||
}
|
||||
return nil, fmt.Errorf("read source path %q: %w", source.Path, err)
|
||||
}
|
||||
currentOffset += int64(len(line))
|
||||
lines = append(lines, strings.TrimRight(line, "\r\n"))
|
||||
}
|
||||
|
||||
offset.Path = source.Path
|
||||
offset.Inode = inode
|
||||
offset.Offset = currentOffset
|
||||
offset.UpdatedAt = time.Now().UTC()
|
||||
if err := s.store.SaveSourceOffset(ctx, offset); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return lines, nil
|
||||
}
|
||||
|
||||
func (s *Service) applyManualOverride(ctx context.Context, ip string, override model.ManualOverride, state model.IPStateStatus, actor string, reason string, backendAction string) error {
|
||||
normalized, err := normalizeIP(ip)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
enforced := false
|
||||
var backendRecord *model.OPNsenseAction
|
||||
if s.blocker != nil {
|
||||
backendRecord = &model.OPNsenseAction{
|
||||
IP: normalized,
|
||||
Action: backendAction,
|
||||
CreatedAt: time.Now().UTC(),
|
||||
}
|
||||
switch override {
|
||||
case model.ManualOverrideForceBlock:
|
||||
result, callErr := s.blocker.AddIPIfMissing(ctx, normalized)
|
||||
if callErr != nil {
|
||||
backendRecord.Result = "error"
|
||||
backendRecord.Message = callErr.Error()
|
||||
} else {
|
||||
backendRecord.Result = result
|
||||
backendRecord.Message = reason
|
||||
enforced = true
|
||||
}
|
||||
case model.ManualOverrideForceAllow:
|
||||
result, callErr := s.blocker.RemoveIPIfPresent(ctx, normalized)
|
||||
if callErr != nil {
|
||||
backendRecord.Result = "error"
|
||||
backendRecord.Message = callErr.Error()
|
||||
} else {
|
||||
backendRecord.Result = result
|
||||
backendRecord.Message = reason
|
||||
enforced = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
current, err := s.store.SetManualOverride(ctx, normalized, override, state, reason)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.store.AddDecision(ctx, &model.DecisionRecord{
|
||||
EventID: current.LastEventID,
|
||||
IP: normalized,
|
||||
SourceName: current.LastSourceName,
|
||||
Kind: "manual",
|
||||
Action: actionForOverride(override),
|
||||
Reason: reason,
|
||||
Actor: defaultActor(actor),
|
||||
Enforced: enforced,
|
||||
CreatedAt: time.Now().UTC(),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if backendRecord != nil {
|
||||
if err := s.store.AddBackendAction(ctx, backendRecord); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func normalizeIP(ip string) (string, error) {
|
||||
parsed := net.ParseIP(strings.TrimSpace(ip))
|
||||
if parsed == nil {
|
||||
return "", fmt.Errorf("invalid ip address %q", ip)
|
||||
}
|
||||
return parsed.String(), nil
|
||||
}
|
||||
|
||||
func fileIdentity(info os.FileInfo) string {
|
||||
if stat, ok := info.Sys().(*syscall.Stat_t); ok {
|
||||
return fmt.Sprintf("%d:%d", stat.Dev, stat.Ino)
|
||||
}
|
||||
return fmt.Sprintf("fallback:%d:%d", info.ModTime().UnixNano(), info.Size())
|
||||
}
|
||||
|
||||
func actionForOverride(override model.ManualOverride) model.DecisionAction {
|
||||
switch override {
|
||||
case model.ManualOverrideForceBlock:
|
||||
return model.DecisionActionBlock
|
||||
case model.ManualOverrideForceAllow:
|
||||
return model.DecisionActionAllow
|
||||
default:
|
||||
return model.DecisionActionNone
|
||||
}
|
||||
}
|
||||
|
||||
func defaultActor(actor string) string {
|
||||
if strings.TrimSpace(actor) == "" {
|
||||
return "web-ui"
|
||||
}
|
||||
return strings.TrimSpace(actor)
|
||||
}
|
||||
|
||||
func defaultReason(reason string, fallback string) string {
|
||||
if strings.TrimSpace(reason) == "" {
|
||||
return fallback
|
||||
}
|
||||
return strings.TrimSpace(reason)
|
||||
}
|
||||
Reference in New Issue
Block a user