Skip to content

Explicitly specify busybox date command #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tievolu wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Explicitly specify busybox date command #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9085a94
Adapt regex for case when root login is not allowed
Sep 14, 2017
d3cb2da
Explicitly specify busybox date command
tievolu Sep 20, 2021
583c2f3
Merge pull request #1 from br101/master
tievolu Aug 18, 2022
7516c5b
Merge branch 'master' into patch-1
tievolu Aug 18, 2022
a825178
Use specify busybox date
tievolu Aug 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions bearDropper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,14 +190,14 @@ logLine () {
getLogTime () {
local logDateString=`echo "$1" | sed -n \
's/^[A-Z][a-z]* \([A-Z][a-z]* *[0-9][0-9]* *[0-9][0-9]*:[0-9][0-9]:[0-9][0-9] [0-9][0-9]*\) .*$/\1/p'`
date -d"$logDateString" -D"$formatLogDate" +%s || logLine 1 \
busybox date -d"$logDateString" -D"$formatLogDate" +%s || logLine 1 \
"Error: logDateString($logDateString) malformed line ($1)"
}

# extra validation, fails safe. Args: $1=log line
getLogIP () {
local logLine="$1"
local ebaPID=`echo "$logLine" | sed -n 's/^.*authpriv.info \(dropbear\[[0-9]*\]:\) Exit before auth:.*/\1/p'`
local ebaPID=`echo "$logLine" | sed -n 's/^.*authpriv.info \(dropbear\[[0-9]*\]:\) Exit before auth.*/\1/p'`
[ -n "$ebaPID" ] && logLine=`$cmdLogreadEba | fgrep "${ebaPID} Child connection from "`
echo "$logLine" | sed -n 's/^.*[^0-9]\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*$/\1/p'
}
Expand Down Expand Up @@ -260,7 +260,7 @@ wipeFirewall () {
# state db should be more resiliant than the firewall in practice.
#
bddbCheckStatusAll () {
local now=`date +%s`
local now=`busybox date +%s`
bddbGetAllIPs | while read ip ; do
if [ `bddbGetStatus $ip` -eq 1 ] ; then
logLine 3 "bddbCheckStatusAll($ip) testing banLength:$banLength + bddbGetTimes:`bddbGetTimes $ip` vs. now:$now"
Expand Down Expand Up @@ -344,14 +344,14 @@ saveState () {
if [ $bddbStateChange -gt 0 ] ; then
logLine 3 "saveState() saving to temp state file"
bddbSave "$fileStateTempPrefix" "$fileStateType"
logLine 3 "saveState() now=`date +%s` lPSW=$lastPersistentStateWrite pSWP=$persistentStateWritePeriod fP=$forcePersistent"
logLine 3 "saveState() now=`busybox date +%s` lPSW=$lastPersistentStateWrite pSWP=$persistentStateWritePeriod fP=$forcePersistent"
fi
if [ $persistentStateWritePeriod -gt 1 ] || [ $persistentStateWritePeriod -eq 0 -a $forcePersistent -eq 1 ] ; then
if [ $((`date +%s` - lastPersistentStateWrite)) -ge $persistentStateWritePeriod ] || [ $forcePersistent -eq 1 ] ; then
if [ $((`busybox date +%s` - lastPersistentStateWrite)) -ge $persistentStateWritePeriod ] || [ $forcePersistent -eq 1 ] ; then
if [ ! -f "$fileStatePersist" ] || ! cmp -s "$fileStateTemp" "$fileStatePersist" ; then
logLine 2 "saveState() writing to persistent state file"
bddbSave "$fileStatePersistPrefix" "$fileStateType"
lastPersistentStateWrite="`date +%s`"
lastPersistentStateWrite="`busybox date +%s`"
fi ; fi ; fi
}

Expand Down Expand Up @@ -429,8 +429,8 @@ exitStatus=0
fileRegex="/tmp/bearDropper.$$.regex"
uciLoad logRegex 's/[`$"'\\\'']//g' '/has invalid shell, rejected$/d' \
'/^[A-Za-z ]+[0-9: ]+authpriv.warn dropbear\[.+([0-9]+\.){3}[0-9]+/p' \
'/^[A-Za-z ]+[0-9: ]+authpriv.info dropbear\[.+:\ Exit before auth:.*/p' > "$fileRegex"
lastPersistentStateWrite="`date +%s`"
'/^[A-Za-z ]+[0-9: ]+authpriv.info dropbear\[.+:\ Exit before auth.*/p' > "$fileRegex"
lastPersistentStateWrite="`busybox date +%s`"
loadState
bddbCheckStatusAll

Expand All @@ -455,7 +455,7 @@ if [ "$logMode" = follow ] ; then
[ -n "$line" ] && processLogLine "$line"
logLine 3 "ReadComp:$readsSinceSave/$worstCaseReads"
if [ $((++readsSinceSave)) -ge $worstCaseReads ] ; then
now="`date +%s`"
now="`busybox date +%s`"
if [ $((now - lastCheckAll)) -ge $followModeCheckInterval ] ; then
bddbCheckStatusAll
lastCheckAll="$now"
Expand All @@ -476,7 +476,7 @@ elif [ "$logMode" = entire ] ; then
elif [ "$logMode" = today ] ; then
logLine 1 "Running in today mode"
# merge the egrep into sed with -e /^$formatTodayLogDateRegex/!d
$cmdLogread | egrep "`date +\'$formatTodayLogDateRegex\'`" | sed -nEf "$fileRegex" | while read line ; do
$cmdLogread | egrep "`busybox date +\'$formatTodayLogDateRegex\'`" | sed -nEf "$fileRegex" | while read line ; do
processLogLine "$line"
saveState
done
Expand All @@ -486,7 +486,7 @@ elif [ "$logMode" = today ] ; then
elif isValidBindTime "$logMode" ; then
logInterval=`expandBindTime $logMode`
logLine 1 "Running in interval mode (reviewing $logInterval seconds of log entries)..."
timeStart=$((`date +%s` - logInterval))
timeStart=$((`busybox date +%s` - logInterval))
$cmdLogread | sed -nEf "$fileRegex" | while read line ; do
timeWhen=`getLogTime "$line"`
[ $timeWhen -ge $timeStart ] && processLogLine "$line"
Expand Down
22 changes: 11 additions & 11 deletions src/bearDropper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,14 +101,14 @@ logLine () {
getLogTime () {
local logDateString=`echo "$1" | sed -n \
's/^[A-Z][a-z]* \([A-Z][a-z]* *[0-9][0-9]* *[0-9][0-9]*:[0-9][0-9]:[0-9][0-9] [0-9][0-9]*\) .*$/\1/p'`
date -d"$logDateString" -D"$formatLogDate" +%s || logLine 1 \
busybox date -d"$logDateString" -D"$formatLogDate" +%s || logLine 1 \
"Error: logDateString($logDateString) malformed line ($1)"
}

# extra validation, fails safe. Args: $1=log line
getLogIP () {
local logLine="$1"
local ebaPID=`echo "$logLine" | sed -n 's/^.*authpriv.info \(dropbear\[[0-9]*\]:\) Exit before auth:.*/\1/p'`
local ebaPID=`echo "$logLine" | sed -n 's/^.*authpriv.info \(dropbear\[[0-9]*\]:\) Exit before auth.*/\1/p'`
[ -n "$ebaPID" ] && logLine=`$cmdLogreadEba | fgrep "${ebaPID} Child connection from "`
echo "$logLine" | sed -n 's/^.*[^0-9]\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\).*$/\1/p'
}
Expand Down Expand Up @@ -171,7 +171,7 @@ wipeFirewall () {
# state db should be more resiliant than the firewall in practice.
#
bddbCheckStatusAll () {
local now=`date +%s`
local now=`busybox date +%s`
bddbGetAllIPs | while read ip ; do
if [ `bddbGetStatus $ip` -eq 1 ] ; then
logLine 3 "bddbCheckStatusAll($ip) testing banLength:$banLength + bddbGetTimes:`bddbGetTimes $ip` vs. now:$now"
Expand Down Expand Up @@ -255,14 +255,14 @@ saveState () {
if [ $bddbStateChange -gt 0 ] ; then
logLine 3 "saveState() saving to temp state file"
bddbSave "$fileStateTempPrefix" "$fileStateType"
logLine 3 "saveState() now=`date +%s` lPSW=$lastPersistentStateWrite pSWP=$persistentStateWritePeriod fP=$forcePersistent"
logLine 3 "saveState() now=`busybox date +%s` lPSW=$lastPersistentStateWrite pSWP=$persistentStateWritePeriod fP=$forcePersistent"
fi
if [ $persistentStateWritePeriod -gt 1 ] || [ $persistentStateWritePeriod -eq 0 -a $forcePersistent -eq 1 ] ; then
if [ $((`date +%s` - lastPersistentStateWrite)) -ge $persistentStateWritePeriod ] || [ $forcePersistent -eq 1 ] ; then
if [ $((`busybox date +%s` - lastPersistentStateWrite)) -ge $persistentStateWritePeriod ] || [ $forcePersistent -eq 1 ] ; then
if [ ! -f "$fileStatePersist" ] || ! cmp -s "$fileStateTemp" "$fileStatePersist" ; then
logLine 2 "saveState() writing to persistent state file"
bddbSave "$fileStatePersistPrefix" "$fileStateType"
lastPersistentStateWrite="`date +%s`"
lastPersistentStateWrite="`busybox date +%s`"
fi ; fi ; fi
}

Expand Down Expand Up @@ -340,8 +340,8 @@ exitStatus=0
fileRegex="/tmp/bearDropper.$$.regex"
uciLoad logRegex 's/[`$"'\\\'']//g' '/has invalid shell, rejected$/d' \
'/^[A-Za-z ]+[0-9: ]+authpriv.warn dropbear\[.+([0-9]+\.){3}[0-9]+/p' \
'/^[A-Za-z ]+[0-9: ]+authpriv.info dropbear\[.+:\ Exit before auth:.*/p' > "$fileRegex"
lastPersistentStateWrite="`date +%s`"
'/^[A-Za-z ]+[0-9: ]+authpriv.info dropbear\[.+:\ Exit before auth.*/p' > "$fileRegex"
lastPersistentStateWrite="`busybox date +%s`"
loadState
bddbCheckStatusAll

Expand All @@ -366,7 +366,7 @@ if [ "$logMode" = follow ] ; then
[ -n "$line" ] && processLogLine "$line"
logLine 3 "ReadComp:$readsSinceSave/$worstCaseReads"
if [ $((++readsSinceSave)) -ge $worstCaseReads ] ; then
now="`date +%s`"
now="`busybox date +%s`"
if [ $((now - lastCheckAll)) -ge $followModeCheckInterval ] ; then
bddbCheckStatusAll
lastCheckAll="$now"
Expand All @@ -387,7 +387,7 @@ elif [ "$logMode" = entire ] ; then
elif [ "$logMode" = today ] ; then
logLine 1 "Running in today mode"
# merge the egrep into sed with -e /^$formatTodayLogDateRegex/!d
$cmdLogread | egrep "`date +\'$formatTodayLogDateRegex\'`" | sed -nEf "$fileRegex" | while read line ; do
$cmdLogread | egrep "`busybox date +\'$formatTodayLogDateRegex\'`" | sed -nEf "$fileRegex" | while read line ; do
processLogLine "$line"
saveState
done
Expand All @@ -397,7 +397,7 @@ elif [ "$logMode" = today ] ; then
elif isValidBindTime "$logMode" ; then
logInterval=`expandBindTime $logMode`
logLine 1 "Running in interval mode (reviewing $logInterval seconds of log entries)..."
timeStart=$((`date +%s` - logInterval))
timeStart=$((`busybox date +%s` - logInterval))
$cmdLogread | sed -nEf "$fileRegex" | while read line ; do
timeWhen=`getLogTime "$line"`
[ $timeWhen -ge $timeStart ] && processLogLine "$line"
Expand Down
2 changes: 1 addition & 1 deletion src/config/bearDropper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ config bearDropper
list logRegex '/has invalid shell, rejected$/d' # delete (/d) - use to filter out
# print (/p) - use to filter in
list logRegex '/^[A-Za-z ]+[0-9: ]+authpriv.warn dropbear\[.+([0-9]+\.){3}[0-9]+/p'
list logRegex '/^[A-Za-z ]+[0-9: ]+authpriv.info dropbear\[.+:\ Exit before auth:.*/p'
list logRegex '/^[A-Za-z ]+[0-9: ]+authpriv.info dropbear\[.+:\ Exit before auth.*/p'

# whitelist entries do not work yet; as a temporary workaround, put in a firewall rule upstream
#
Expand Down