fail2ban_

#!/usr/bin/env python3

"""
=head1 NAME

fail2ban_ - Wildcard plugin to monitor fail2ban blacklists

=head1 ABOUT

Requires Python 2.7
Requires fail2ban 0.9.2

=head1 AUTHOR

Copyright (c) 2015 Lee Clemens

Inspired by fail2ban plugin written by Stig Sandbeck Mathisen

=head1 CONFIGURATION

fail2ban-client needs to be run as root.

Add the following to your @@CONFDIR@@/munin-node:

  [fail2ban_*]
    user root

=head1 LICENSE

GNU GPLv2 or any later version

=begin comment

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.

This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details

You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

=end comment

=head1 BUGS

Transient values (particularly ASNs) come and go...
Better error handling (Popen), logging
Optimize loops and parsing in __get_jail_status() and parse_fail2ban_status()
Cymru ASNs aren't displayed in numerical order (internal name has alpha-prefix)
Use JSON status once fail2ban exposes JSON status data

=head1 MAGIC MARKERS

 #%# family=auto
 #%# capabilities=autoconf suggest

=cut
"""

from collections import Counter
from os import path, stat, access, X_OK, environ
from subprocess import Popen, PIPE
from time import time
import re
import sys


PLUGIN_BASE = "fail2ban_"

CACHE_DIR = environ['MUNIN_PLUGSTATE']
CACHE_MAX_AGE = 120

STATUS_FLAVORS_FIELDS = {
    "basic": ["jail"],
    "cymru": ["asn", "country", "rir"]
}


def __parse_plugin_name():
    if path.basename(__file__).count("_") == 1:
        return path.basename(__file__)[len(PLUGIN_BASE):], ""
    else:
        return (path.basename(__file__)[len(PLUGIN_BASE):].split("_")[0],
                path.basename(__file__)[len(PLUGIN_BASE):].split("_")[1])


def __get_jails_cache_file():
    return "%s/%s.state" % (CACHE_DIR, path.basename(__file__))


def __get_jail_status_cache_file(jail_name):
    return "%s/%s__%s.state" % (CACHE_DIR, path.basename(__file__), jail_name)


def __parse_jail_names(jails_data):
    """
    Parse the jails returned by `fail2ban-client status`:

    Status
    |- Number of jail:	3
    `- Jail list:	apache-badbots, dovecot, sshd
    """
    jails = []
    for line in jails_data.splitlines()[1:]:
        if line.startswith("`- Jail list:"):
            return [jail.strip(" ,\t") for jail in
                    line.split(":", 1)[1].split(" ")]
    return jails


def __get_jail_names():
    """
    Read jails from cache or execute `fail2ban-client status`
     and pass stdout to __parse_jail_names
    """
    cache_filename = __get_jails_cache_file()
    try:
        mtime = stat(cache_filename).st_mtime
    except OSError:
        mtime = 0
    if time() - mtime > CACHE_MAX_AGE:
        p = Popen(["fail2ban-client", "status"], shell=False, stdout=PIPE)
        jails_data = p.communicate()[0]
        with open(cache_filename, 'w') as f:
            f.write(jails_data)
    else:
        with open(cache_filename, 'r') as f:
            jails_data = f.read()
    return __parse_jail_names(jails_data)


def autoconf():
    """
    Attempt to find fail2ban-client in path (using `which`) and ping the client
    """
    p_which = Popen(["which", "fail2ban-client"], shell=False, stdout=PIPE,
                    stderr=PIPE)
    stdout, stderr = p_which.communicate()
    if len(stdout) > 0:
        client_path = stdout.strip()
        if access(client_path, X_OK):
            p_ping = Popen([client_path, "ping"], shell=False)
            p_ping.communicate()
            if p_ping.returncode == 0:
                print("yes")
            else:
                print("no (fail2ban-server does not respond to ping)")
        else:
            print("no (fail2ban-client is not executable)")
    else:
        import os

        print("no (fail2ban-client not found in path: %s)" %
              os.environ["PATH"])


def suggest():
    """
    Iterate all defined flavors (source of data) and fields (graph to display)
    """
    # Just use basic for autoconf/suggest
    flavor = "basic"
    for field in STATUS_FLAVORS_FIELDS[flavor]:
        print("%s_%s" % (flavor, field if len(flavor) > 0 else flavor))


def __get_jail_status(jail, flavor):
    """
    Return cache or execute `fail2ban-client status <jail> <flavor>`
     and save to cache and return
    """
    cache_filename = __get_jail_status_cache_file(jail)
    try:
        mtime = stat(cache_filename).st_mtime
    except OSError:
        mtime = 0
    if time() - mtime > CACHE_MAX_AGE:
        p = Popen(["fail2ban-client", "status", jail, flavor], shell=False,
                  stdout=PIPE)
        jail_status_data = p.communicate()[0]
        with open(cache_filename, 'w') as f:
            f.write(jail_status_data)
    else:
        with open(cache_filename, 'r') as f:
            jail_status_data = f.read()
    return jail_status_data


def __normalize(name):
    name = re.sub("[^a-z0-9A-Z]", "_", name)
    return name


def __count_groups(value_str):
    """
    Helper method to count unique values in the space-delimited value_str
    """
    return Counter([key for key in value_str.split(" ") if key])


def config(flavor, field):
    """
    Print config data (e.g. munin-run config), including possible labels
     by parsing real status data
    """
    print("graph_title fail2ban %s %s" % (flavor, field))
    print("graph_args --base 1000 -l 0")
    print("graph_vlabel Hosts banned")
    print("graph_category security")
    print("graph_info"
          " Number of hosts banned using status flavor %s and field %s" %
          (flavor, field))
    print("graph_total total")
    munin_fields, field_labels, values = parse_fail2ban_status(flavor, field)
    for munin_field in munin_fields:
        print("%s.label %s" % (munin_field, field_labels[munin_field]))


def run(flavor, field):
    """
    Parse the status data and print all values for a given flavor and field
    """
    munin_fields, field_labels, values = parse_fail2ban_status(flavor, field)
    for munin_field in munin_fields:
        print("%s.value %s" % (munin_field, values[munin_field]))


def parse_fail2ban_status(flavor, field):
    """
    Shared method to parse jail status output and determine field names
     and aggregate counts
    """
    field_labels = dict()
    values = dict()
    for jail in __get_jail_names():
        jail_status = __get_jail_status(jail, flavor)
        for line in jail_status.splitlines()[1:]:
            if flavor == "basic":
                if field == "jail":
                    if line.startswith("   |- Currently banned:"):
                        internal_name = __normalize(jail)
                        field_labels[internal_name] = jail
                        values[internal_name] = line.split(":", 1)[1].strip()
                else:
                    raise Exception(
                        "Undefined field %s for flavor %s for jail %s" %
                        (field, flavor, jail))
            elif flavor == "cymru":
                # Determine which line of output we care about
                if field == "asn":
                    search_string = "   |- Banned ASN list:"
                elif field == "country":
                    search_string = "   |- Banned Country list:"
                elif field == "rir":
                    search_string = "   `- Banned RIR list:"
                else:
                    raise Exception(
                        "Undefined field %s for flavor %s for jail %s" %
                        (field, flavor, jail))
                if line.startswith(search_string):
                    prefix = "%s_%s" % (flavor, field)
                    # Now process/aggregate the counts
                    counts_dict = __count_groups(line.split(":", 1)[1].strip())
                    for key in counts_dict:
                        internal_name = "%s_%s" % (prefix, __normalize(key))
                        if internal_name in field_labels:
                            values[internal_name] += counts_dict[key]
                        else:
                            field_labels[internal_name] = key
                            values[internal_name] = counts_dict[key]
            else:
                raise Exception("Undefined flavor: %s for jail %s" %
                                (flavor, jail))
    return sorted(field_labels.keys()), field_labels, values


if __name__ == "__main__":
    if len(sys.argv) > 1:
        command = sys.argv[1]
    else:
        command = ""
    if command == "autoconf":
        autoconf()
    elif command == "suggest":
        suggest()
    elif command == 'config':
        flavor_, field_ = __parse_plugin_name()
        config(flavor_, field_)
    else:
        flavor_, field_ = __parse_plugin_name()
        run(flavor_, field_)