gods

a simple blocklist for ssh
Log | Files | Refs | README | LICENSE

attack.c (1161B)


      1 #include <errno.h>
      2 #include <math.h>
      3 #include <stdio.h>
      4 #include <string.h>
      5 #include <time.h>
      6 #include <unistd.h>
      7 
      8 #include "attack.h"
      9 
     10 extern char *attack_pattern[];
     11 extern int pauth[];
     12 
     13 int
     14 isattack(char *constat, char *preauth)
     15 {
     16 	for (char **p = attack_pattern; *p; ++p)
     17 		if (strstr(constat, *p)) {
     18 			if (pauth[p - attack_pattern]
     19 			&& !strstr(preauth, "[preauth]"))
     20 				return 0;
     21 			return 1;
     22 		}
     23 	return 0;
     24 }
     25 
     26 int
     27 islogin(char *constat)
     28 {
     29 	char *login[] = {
     30 		"Accepted publickey for",
     31 		"Accepted keyboard-interactive/pam for",
     32 		NULL,
     33 	};
     34 
     35 	for (char **p = login; *p; ++p)
     36 		if (strstr(constat, *p))
     37 			return 1;
     38 
     39 	return 0;
     40 }
     41 
     42 int
     43 isexpire(struct attacker *a)
     44 {
     45 	double ban;
     46 
     47 	ban = pow(3, a->nban) * 60;
     48 
     49 	if (difftime(time(NULL), a->last) >= ban)
     50 		return 1;
     51 
     52 	return 0;
     53 }
     54 
     55 int
     56 blacklist(struct attacker *a)
     57 {
     58 	char ip[16];
     59 	int len;
     60 
     61 	strcpy(ip, a->ip);
     62 	len = strlen(ip);
     63 	ip[len] = '\n';
     64 	a->list = BLACK;
     65 	if (write(fd_black, ip, len+1) != len+1) {
     66 		fprintf(stderr, "write failed: %s\n", strerror(errno));
     67 		return -1;
     68 	}
     69 	return 1;
     70 }
     71 
     72 int
     73 whitelist(struct attacker *a)
     74 {
     75 	/* stub */
     76 	fprintf(stderr, "%s whitelisted\n", a->ip);
     77 	return 1;
     78 }