rename

baddiefinder/baddiefinder/__main__.py

@@ -0,0 +1,29 @@
+#
+#
+#
+
+import netdb
+
+
+from argparse import ArgumentParser as AP
+
+from . import settings
+from . import filter
+from . import processor
+
+def main():
+    ap = AP()
+    ap.add_argument("--settings", default="baddies.ini")
+
+    args = ap.parse_args()
+    s = settings.load(args.settings)
+    fmax = s.get("thresholds", "max_floodfills_per_ip", fallback=5)
+    f = filter.FloodfillFilter(fmax)
+    p = processor.BaddieProcessor([f])
+    netdb.inspect(p.hook)
+    with open(s.get("output", "file", fallback="baddies.txt"), 'w') as f:
+        print ('wrote {} blocklist entries'.format(p.write_blocklist(f)))
+        
+
+if __name__ == "__main__":
+    main()

baddiefinder/baddiefinder/filter.py

@@ -0,0 +1,33 @@
+
+from . import util
+
+class Filter:
+
+    name = "unnamed filter"
+    
+    def process(self, info):
+        """
+        process an info and return a string representation of a reason to add to blocklist
+        any other return value will cause this info to NOT be added to blocklist
+        """
+
+class FloodfillFilter(Filter):
+
+    name = "floodfill sybil detector"
+    
+    def __init__(self, fmax):
+        self._floodfills = dict()
+        self.fmax = int(fmax)
+
+    def process(self, info):
+        caps = util.getcaps(info)
+        if not caps:
+            return 
+        if b'f' not in caps:
+            return 
+        h = util.getaddress(info)
+        if h not in self._floodfills:
+            self._floodfills[h] = 0
+        self._floodfills[h] += 1
+        if self._floodfills[h] > self.fmax:
+            return '{} > {} floodfills per ip'.format(self._floodfills[h], self.fmax)

baddiefinder/baddiefinder/processor.py

@@ -0,0 +1,29 @@
+from . import util
+
+import datetime
+
+class BaddieProcessor:
+
+    def __init__(self, filters):
+        self._filters = filters
+        self._baddies = dict()
+
+        
+    def hook(self, entry):
+        now = datetime.datetime.now()
+        for f in self._filters:
+            reason = f.process(entry)
+            if reason is not None:
+                self.add_baddie(entry, 'detected by {} on {} ({})'.format(f.name, now.strftime("%c").replace(":",'-'), reason))
+
+    def add_baddie(self, entry, reason):
+        addr = util.getaddress(entry).decode('ascii')
+        self._baddies[addr] = reason 
+
+    def write_blocklist(self, f):
+        wrote = 0
+        f.write('# baddies blocklist generated on {}\n'.format(datetime.datetime.now()))
+        for k in self._baddies:
+            f.write('{}:{}\n'.format(self._baddies[k], k))
+            wrote += 1
+        return wrote

baddiefinder/baddiefinder/settings.py

@@ -0,0 +1,11 @@
+#
+# baddiefinder settings wrapper
+#
+
+from configparser import ConfigParser
+
+def load(fname):
+    c = ConfigParser()
+    with open(fname) as f:
+        c.read_file(f, fname)
+    return c

baddiefinder/baddiefinder/util.py

@@ -0,0 +1,17 @@
+def getaddress(info):
+    """
+    get ip address from router info dict
+    """
+    for addr in info.addrs:
+        opts = addr.options
+        if b'host' in opts:
+            h = opts[b'host']
+            if b':' not in h:
+                return h
+
+def getcaps(info):
+    """
+    extract router caps
+    """
+    if b'caps' in info.options:
+        return info.options[b'caps']