From b06f05afe6eca4fea770d2013c2208b853711822 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michael=20Sch=C3=B6nbauer?= Date: Thu, 3 Jun 2021 22:33:17 +0200 Subject: [PATCH] version 2.1.2 (Release: June 2021) (#43) * turning up version numbers * fixing a small issue in the license * classify messages about found ips as verbose #44 * a small readability thing * added_start_menu #42 * some beauty fixes for the console (icon..) (#51) * removed dead code * set icon for the app * ability to remove temp bans (#47) * service gets ability to remove temp bans * forgetting IPS needs to ignore re-supplied events * console feature to remove temporary bans * tested and tweaked the server feature to remove temp ban #45 * fixed a bug with forgetting ips fixed a bug where a task will not forget an ip it has already forgotten earlier * replaced "middle finger" with safe for work image (#62) * releasing 2.1.2 --- LICENSE | 2 +- NEWS.md | 10 ++ .../EvlWatcher.WCF/IEvlWatcherService.cs | 4 + Source/EvlWatcher/EvlWatcher/EvlWatcher.cs | 19 +++- Source/EvlWatcher/EvlWatcher/NSIS/make.nsi | 42 ++------ .../EvlWatcher/Properties/AssemblyInfo.cs | 4 +- Source/EvlWatcher/EvlWatcher/license.txt | 2 +- .../EvlWatcher/systemapi/FirewallAPI.cs | 2 +- .../EvlWatcher/tasks/GenericIPBlockingTask.cs | 100 ++++++++++++------ .../EvlWatcher/tasks/IPBlockingLogTask.cs | 2 + .../EvlWatcherConsole.csproj | 35 +++++- .../Model/EvlWatcherModel.cs | 11 +- .../EvlWatcherConsole/Model/EvlWatcherTask.cs | 6 -- .../Properties/AssemblyInfo.cs | 10 +- .../Resources/1200px-ProhibitionSign2.svg.png | Bin 0 -> 48456 bytes .../EvlWatcherConsole/View/MainWindow.xaml | 16 +-- .../ViewModel/MainWindowViewModel.cs | 10 ++ .../EvlWatcherConsole/app.manifest | 2 +- .../v2/EvlWatcher-v2.1.2 release notes.txt | 14 +++ Versions/v2/EvlWatcher-v2.1.2-setup.exe | Bin 0 -> 303968 bytes 20 files changed, 193 insertions(+), 98 deletions(-) delete mode 100644 Source/EvlWatcherConsole/EvlWatcherConsole/Model/EvlWatcherTask.cs create mode 100644 Source/EvlWatcherConsole/EvlWatcherConsole/Resources/1200px-ProhibitionSign2.svg.png create mode 100644 Versions/v2/EvlWatcher-v2.1.2 release notes.txt create mode 100644 Versions/v2/EvlWatcher-v2.1.2-setup.exe diff --git a/LICENSE b/LICENSE index 01ae71a..5ede003 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019 Michael Schönbauer +Copyright (c) 2019 Michael Schoenbauer Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/NEWS.md b/NEWS.md index f176dc5..851180d 100644 --- a/NEWS.md +++ b/NEWS.md @@ -1,5 +1,15 @@ ## NEWS +### 2021-06-03 release of v.2. was completed +- a small typo in the license was fixed +- severity of some messages was adjusted (moved from info to verbose) to keep a cleaner event log +- it contains minor bugfixes and corrections, but nothing interesting apart from that its signed now. +- the console app now has a start menu entry +- the console app had some beauty fixes +- added ability to remove temp bans +- fixes a bug with forgetting ips +- replaces te old 'middle finger' with a more safe for work image + ### 2020-12-28 preparing the release of v2.1 - first, i want to say THANK YOU, to everyone who donated - finally, we have received enough donations, so we can sign the next release. (and afford 3 beers on top of that) diff --git a/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs b/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs index 26d4097..5cb03b8 100644 --- a/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs +++ b/Source/EvlWatcher/EvlWatcher.WCF/IEvlWatcherService.cs @@ -42,5 +42,9 @@ public interface IEvlWatcherService [OperationContract] [FaultContract(typeof(ServiceFaultDTO))] void SaveGlobalConfig(SeverityLevelDTO logLevel, int consoleBackLog, int checkInterval); + + [OperationContract] + [FaultContract(typeof(ServiceFaultDTO))] + void RemoveTemporaryBan(IPAddress address); } } diff --git a/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs b/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs index a5a0c03..2a539bf 100644 --- a/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs +++ b/Source/EvlWatcher/EvlWatcher/EvlWatcher.cs @@ -394,7 +394,6 @@ private void Run() } } - //start monitoring the logs while (true) { @@ -469,7 +468,6 @@ private void Run() _logger.Dump($"Scanning finished in {DateTime.Now.Subtract(scanStart).TotalMilliseconds}[ms] ", SeverityLevel.Debug); - //then supply the events to the requesting tasks foreach (string key in requiredEventTypesToLogTasks.Keys) { @@ -514,7 +512,6 @@ private void Run() List blockedIPs = ipTask.GetTempBanVictims(); - _logger.Dump($"Polled {t.Name} and got {blockedIPs.Count} temporary and {_serviceconfiguration.BlacklistAddresses.Count()} permanent ban(s)", SeverityLevel.Verbose); foreach (IPAddress blockedIP in blockedIPs) @@ -611,6 +608,22 @@ public void SaveGlobalConfig(SeverityLevelDTO logLevel, int consoleBackLog, int _serviceconfiguration.EventLogInterval = checkInterval; } + public void RemoveTemporaryBan(IPAddress address) + { + EnsureClientPrivileges(); + + lock (_syncObject) + { + _logger.Dump($"Removing IP {address} from temporary ban list", SeverityLevel.Info); + foreach (var ipBlockingTask in _logTasks.Where(t => t is IPBlockingLogTask).Select(t => t as IPBlockingLogTask)) + { + ipBlockingTask.Forget(address); + } + _lastPolledTempBans.Remove(address); + PushBanList(); + } + } + #endregion } } diff --git a/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi b/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi index 44015f1..af20e85 100644 --- a/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi +++ b/Source/EvlWatcher/EvlWatcher/NSIS/make.nsi @@ -2,7 +2,7 @@ Name "EvlWatcher" ; The file to write Icon EvlWatcher.ico -OutFile "EvlWatcher-v2.0 setup.exe" +OutFile "EvlWatcher-v2.1.2-setup.exe" ; The default installation directory InstallDir $PROGRAMFILES\EvlWatcher @@ -43,20 +43,12 @@ Section "EvlWatcher Service" ;;;;;;;;MODULES HERE;;;;;;;;;; - Delete $INSTDIR\BlockRDPBruters.dll - Delete $INSTDIR\BlockFTPBruters.dll - Delete $INSTDIR\BlockFTPBruters.cfg - ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; - Delete $INSTDIR\Interop.NetFwTypeLib.dll Delete $INSTDIR\EvlWatcher.exe - Delete $INSTDIR\gpl-3.0.txt Delete $INSTDIR\license.txt - Delete $INSTDIR\source.zip Delete $INSTDIR\config.xml Delete $INSTDIR\EvlWatcherConsole.exe - Delete $INSTDIR\EvlWatcher.ico Delete $INSTDIR\EvlWatcher.WCF.dll ; Set output path to the installation directory. @@ -91,6 +83,13 @@ Section "EvlWatcher Service" SectionEnd +Section "Start Menu Entry" + + CreateDirectory "$SMPROGRAMS\EvlWatcher" + CreateShortCut "$SMPROGRAMS\EvlWatcher\EvlWatcherConsole.lnk" "$INSTDIR\EvlWatcherConsole.exe" + +SectionEnd + ;;;;;;;MODULES HERE;;;;;;;;;; @@ -108,6 +107,9 @@ Section "Uninstall" Sleep 5000 + Delete "$SMPROGRAMS\EvlWatcher\EvlWatcherConsole.lnk" + rmDir "$SMPROGRAMS\EvlWatcher" + ; Remove registry keys DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\EvlWatcher" DeleteRegKey HKLM SOFTWARE\EvlWatcher @@ -116,36 +118,14 @@ Section "Uninstall" ;;;;;;;;MODULES HERE;;;;;;;;;;; - Delete $INSTDIR\BlockRDPBruters.dll - Delete $INSTDIR\BlockFTPBruters.dll - Delete $INSTDIR\BlockFTPBruters.cfg - ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; - Delete $INSTDIR\Interop.NetFwTypeLib.dll Delete $INSTDIR\EvlWatcher.exe - Delete $INSTDIR\gpl-3.0.txt Delete $INSTDIR\license.txt Delete $INSTDIR\config.xml Delete $INSTDIR\EvlWatcherConsole.exe - Delete $INSTDIR\source.zip - Delete $INSTDIR\EvlWatcher.ico Delete $INSTDIR\EvlWatcher.WCF.dll - - Delete $INSTDIR\Source\Constants.cs - Delete $INSTDIR\Source\FirewallAPI.cs - Delete $INSTDIR\Source\Installer.cs - Delete $INSTDIR\Source\IPBlockingLogTask.cs - Delete $INSTDIR\Source\EvlWatcher.cs - Delete $INSTDIR\Source\LogTask.cs - ;;;;;;;;;MODULES HERE;;;;;;;;;;;;;;;; - - Delete $INSTDIR\Source\LogTaskBlockRDPBruters.cs - Delete $INSTDIR\Source\LogTaskBlockFTPBruters.cs - Delete $INSTDIR\Source\BlockFTPBruters.cfg - - ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Delete $INSTDIR\uninstall.exe diff --git a/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs b/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs index ea9317d..e112698 100644 --- a/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs +++ b/Source/EvlWatcher/EvlWatcher/Properties/AssemblyInfo.cs @@ -28,5 +28,5 @@ // Build Number // Revision // -[assembly: AssemblyVersion("2.0.0.0")] -[assembly: AssemblyFileVersion("2.0.0.0")] +[assembly: AssemblyVersion("2.1.2.0")] +[assembly: AssemblyFileVersion("2.1.2.0")] diff --git a/Source/EvlWatcher/EvlWatcher/license.txt b/Source/EvlWatcher/EvlWatcher/license.txt index 6937275..bc4893d 100644 --- a/Source/EvlWatcher/EvlWatcher/license.txt +++ b/Source/EvlWatcher/EvlWatcher/license.txt @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2020 Michael Schönbauer +Copyright (c) 2020 Michael Schoenbauer Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs b/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs index a9abfc8..6beebf6 100644 --- a/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs +++ b/Source/EvlWatcher/EvlWatcher/systemapi/FirewallAPI.cs @@ -64,7 +64,7 @@ private INetFwRule GetOrCreateEvlWatcherRule(bool create) rule.EdgeTraversal = false; rule.LocalAddresses = "*"; rule.Name = "EvlWatcher"; - rule.Profiles = 2147483647; // = means all Profiles + rule.Profiles = int.MaxValue;// = means all Profiles rule.Protocol = 256; policies.Rules.Add(rule); } diff --git a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs index 7627b09..da062db 100644 --- a/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs +++ b/Source/EvlWatcher/EvlWatcher/tasks/GenericIPBlockingTask.cs @@ -36,7 +36,9 @@ internal static GenericIPBlockingTask FromConfiguration(IPersistentTaskConfigura #region private members + private readonly object _syncObject = new object(); private readonly Dictionary _blockedIPsToDate = new Dictionary(); + private readonly Dictionary _forgetIPsToDate = new Dictionary(); private readonly Dictionary _bannedCount = new Dictionary(); private readonly ILogger _logger; @@ -64,40 +66,51 @@ internal GenericIPBlockingTask(ILogger logger) #region public operations public override List GetTempBanVictims() { - List ipsToRemove = new List(); - List ipsToBlock = new List(); - - //also remove IPS from ban list when they have been blocked "long enough" - foreach (KeyValuePair kvp in _blockedIPsToDate) + lock (_syncObject) { - if (kvp.Value.Add(new TimeSpan(0, 0, LockTime)) < System.DateTime.Now) - { - ipsToRemove.Add(kvp.Key); - } - else + List ipsToRemove = new List(); + List ipsToBlock = new List(); + + //also remove IPS from ban list when they have been blocked "long enough" + foreach (KeyValuePair kvp in _blockedIPsToDate) { - ipsToBlock.Add(kvp.Key); + if (kvp.Value.Add(new TimeSpan(0, 0, LockTime)) < DateTime.Now) + { + ipsToRemove.Add(kvp.Key); + } + else + { + ipsToBlock.Add(kvp.Key); + } } - } - foreach (IPAddress ipToRemove in ipsToRemove) - _blockedIPsToDate.Remove(ipToRemove); + //also remove forgotten IPs when its been a while + List removeFromForgottenList = _forgetIPsToDate.Where(p => DateTime.Now.AddHours(-1) > p.Value).Select(p=>p.Key).ToList(); + foreach (var ip in removeFromForgottenList) + removeFromForgottenList.Remove(ip); + + foreach (IPAddress ipToRemove in ipsToRemove) + _blockedIPsToDate.Remove(ipToRemove); - return ipsToBlock; + return ipsToBlock; + } } public override List GetPermaBanVictims() { - List permaList = new List(); - foreach (KeyValuePair kvp in _bannedCount.Where(p=>p.Value>=PermaBanCount)) + lock (_syncObject) { - permaList.Add(kvp.Key); - _logger.Dump($"Permanently banned {kvp.Value} (strike count was over {PermaBanCount}) ", SeverityLevel.Info); - } - foreach (IPAddress ip in permaList) - _bannedCount.Remove(ip); + List permaList = new List(); + foreach (KeyValuePair kvp in _bannedCount.Where(p => p.Value >= PermaBanCount)) + { + permaList.Add(kvp.Key); + _logger.Dump($"Permanently banned {kvp.Value} (strike count was over {PermaBanCount}) ", SeverityLevel.Info); + } + foreach (IPAddress ip in permaList) + _bannedCount.Remove(ip); - return permaList; + return permaList; + } } protected override void OnComputeEvents(List events) @@ -133,32 +146,55 @@ protected override void OnComputeEvents(List events) { if (m.Groups.Count == 2 && IPAddress.TryParse(m.Groups[1].Value, out IPAddress ipAddress)) { + if (_forgetIPsToDate.ContainsKey(ipAddress) && _forgetIPsToDate[ipAddress] > e.TimeCreated ) + { + _logger.Dump($"{Name}: found {ipAddress} but ignored it (was recently removed from autoban list)", SeverityLevel.Info); + continue; + } if (!sourceToCount.ContainsKey(ipAddress)) sourceToCount.Add(ipAddress, 1); else sourceToCount[ipAddress]++; - _logger.Dump($"{Name}: found {ipAddress}, trigger count is {sourceToCount[ipAddress]}", SeverityLevel.Info); + _logger.Dump($"{Name}: found {ipAddress}, trigger count is {sourceToCount[ipAddress]}", SeverityLevel.Verbose); } } } - foreach (KeyValuePair kvp in sourceToCount) + lock (_syncObject) { - if (kvp.Value >= TriggerCount && !_blockedIPsToDate.ContainsKey(kvp.Key)) + foreach (KeyValuePair kvp in sourceToCount) { - _blockedIPsToDate.Add(kvp.Key, DateTime.Now); - if (!_bannedCount.ContainsKey(kvp.Key)) - _bannedCount[kvp.Key] = 1; - else - _bannedCount[kvp.Key] += 1; + if (kvp.Value >= TriggerCount && !_blockedIPsToDate.ContainsKey(kvp.Key)) + { + _blockedIPsToDate.Add(kvp.Key, DateTime.Now); + if (!_bannedCount.ContainsKey(kvp.Key)) + _bannedCount[kvp.Key] = 1; + else + _bannedCount[kvp.Key] += 1; - _logger.Dump($"Temporarily banning {kvp.Key}, this is strike {_bannedCount[kvp.Key]}", SeverityLevel.Info); + _logger.Dump($"Temporarily banning {kvp.Key}, this is strike {_bannedCount[kvp.Key]}", SeverityLevel.Info); + } } } } + public override void Forget(IPAddress address) + { + lock (_syncObject) + { + _blockedIPsToDate.Remove(address); + + if (!_forgetIPsToDate.ContainsKey(address)) + _forgetIPsToDate.Add(address, DateTime.Now); + else + _forgetIPsToDate[address] = DateTime.Now; + + _bannedCount.Remove(address); + } + } + #endregion } } diff --git a/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs b/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs index a4ff253..67b9d2a 100644 --- a/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs +++ b/Source/EvlWatcher/EvlWatcher/tasks/IPBlockingLogTask.cs @@ -10,5 +10,7 @@ public abstract class IPBlockingLogTask : LogTask { public abstract List GetTempBanVictims(); public abstract List GetPermaBanVictims(); + + public abstract void Forget(IPAddress address); } } diff --git a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj index 13c27b8..e357939 100644 --- a/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj +++ b/Source/EvlWatcherConsole/EvlWatcherConsole/EvlWatcherConsole.csproj @@ -20,6 +20,21 @@ SAK SAK SAK + publish\ + true + Disk + false + Foreground + 7 + Days + false + false + true + 0 + 1.0.0.%2a + false + false + true x86 @@ -45,6 +60,9 @@ app.manifest + + Resources\EvlWatcher.ico + ..\..\EvlWatcher\EvlWatcher.WCF\bin\Debug\EvlWatcher.WCF.dll @@ -71,7 +89,6 @@ Designer - @@ -138,7 +155,21 @@ - + + + False + Microsoft .NET Framework 4.7.2 %28x86 and x64%29 + true + + + False + .NET Framework 3.5 SP1 + false + + + + +