mikopbx /
Core
| Total Complexity | 41 |
| Total Lines | 436 |
| Duplicated Lines | 0 % |
| Changes | 1 | ||
| Bugs | 0 | Features | 0 |
Complex classes like Fail2BanConf often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use Fail2BanConf, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 34 | class Fail2BanConf extends Injectable |
||
| 35 | { |
||
| 36 | private const FILTER_PATH = '/etc/fail2ban/filter.d'; |
||
| 37 | private const ACTION_PATH = '/etc/fail2ban/action.d'; |
||
| 38 | private const JAILS_DIR = '/etc/fail2ban/jail.d'; |
||
| 39 | private const PID_FILE = '/var/run/fail2ban/fail2ban.pid'; |
||
| 40 | public const FAIL2BAN_DB_PATH = '/var/lib/fail2ban/fail2ban.sqlite3'; |
||
| 41 | |||
| 42 | public bool $fail2ban_enable; |
||
| 43 | private array $allPbxSettings; |
||
| 44 | |||
| 45 | /** |
||
| 46 | * Fail2Ban constructor. |
||
| 47 | */ |
||
| 48 | public function __construct() |
||
| 49 | { |
||
| 50 | $this->allPbxSettings = PbxSettings::getAllPbxSettings(); |
||
| 51 | $fail2ban_enable = $this->allPbxSettings['PBXFail2BanEnabled']; |
||
| 52 | $this->fail2ban_enable = ($fail2ban_enable === '1'); |
||
| 53 | } |
||
| 54 | |||
| 55 | /** |
||
| 56 | * Check fail2ban service and restart it died |
||
| 57 | */ |
||
| 58 | public static function checkFail2ban(): void |
||
| 59 | { |
||
| 60 | $fail2ban = new self(); |
||
| 61 | if ($fail2ban->fail2ban_enable |
||
| 62 | && ! $fail2ban->fail2banIsRunning()) { |
||
| 63 | $fail2ban->fail2banStart(); |
||
| 64 | } |
||
| 65 | } |
||
| 66 | |||
| 67 | /** |
||
| 68 | * Check fail2ban service status |
||
| 69 | * |
||
| 70 | * @return bool |
||
| 71 | */ |
||
| 72 | private function fail2banIsRunning(): bool |
||
| 73 | { |
||
| 74 | $fail2banPath = Util::which('fail2ban-client'); |
||
| 75 | $res_ping = Processes::mwExec("{$fail2banPath} ping"); |
||
| 76 | $res_stat = Processes::mwExec("{$fail2banPath} status"); |
||
| 77 | |||
| 78 | $result = false; |
||
| 79 | if ($res_ping === 0 && $res_stat === 0) { |
||
| 80 | $result = true; |
||
| 81 | } |
||
| 82 | |||
| 83 | return $result; |
||
| 84 | } |
||
| 85 | |||
| 86 | /** |
||
| 87 | * Start fail2ban service |
||
| 88 | */ |
||
| 89 | public function fail2banStart(): void |
||
| 90 | { |
||
| 91 | if (Util::isSystemctl() && ! Util::isDocker()) { |
||
| 92 | $systemctlPath = Util::which('systemctl'); |
||
| 93 | Processes::mwExec("{$systemctlPath} restart fail2ban"); |
||
| 94 | |||
| 95 | return; |
||
| 96 | } |
||
| 97 | Processes::killByName('fail2ban-server'); |
||
| 98 | $fail2banPath = Util::which('fail2ban-client'); |
||
| 99 | $cmd_start = "{$fail2banPath} -x start"; |
||
| 100 | $command = "($cmd_start;) > /dev/null 2>&1 &"; |
||
| 101 | Processes::mwExec($command); |
||
| 102 | } |
||
| 103 | |||
| 104 | /** |
||
| 105 | * Applies iptables settings and restart firewall |
||
| 106 | */ |
||
| 107 | public static function reloadFail2ban(): void |
||
| 108 | { |
||
| 109 | $fail2banPath = Util::which('fail2ban-client'); |
||
| 110 | if(file_exists(self::PID_FILE)){ |
||
| 111 | $pid = file_get_contents(self::PID_FILE); |
||
| 112 | }else{ |
||
| 113 | $pid = Processes::getPidOfProcess('fail2ban-server'); |
||
| 114 | } |
||
| 115 | $fail2ban = new self(); |
||
| 116 | if($fail2ban->fail2ban_enable && !empty($pid)){ |
||
| 117 | $fail2ban->generateModulesFilters(); |
||
| 118 | $fail2ban->generateModulesJailsLocal(); |
||
| 119 | // Перезагрузка конфигов без рестарта конфига. |
||
| 120 | Processes::mwExecBg("{$fail2banPath} reload"); |
||
| 121 | } |
||
| 122 | } |
||
| 123 | |||
| 124 | /** |
||
| 125 | * Checks whether BANS table exists in DB or not |
||
| 126 | * |
||
| 127 | * @param SQLite3 $db |
||
| 128 | * |
||
| 129 | * @return bool |
||
| 130 | */ |
||
| 131 | public function tableBanExists(SQLite3 $db): bool |
||
| 132 | { |
||
| 133 | $q_check = 'SELECT name FROM sqlite_master WHERE type = "table" AND name="bans"'; |
||
| 134 | $result_check = $db->query($q_check); |
||
| 135 | |||
| 136 | return (false !== $result_check && $result_check->fetchArray(SQLITE3_ASSOC) !== false); |
||
| 137 | } |
||
| 138 | |||
| 139 | /** |
||
| 140 | * Shutdown fail2ban service |
||
| 141 | */ |
||
| 142 | public function fail2banStop(): void |
||
| 143 | { |
||
| 144 | if (Util::isSystemctl() && ! Util::isDocker()) { |
||
| 145 | $systemctlPath = Util::which('systemctl'); |
||
| 146 | Processes::mwExec("{$systemctlPath} stop fail2ban"); |
||
| 147 | } else { |
||
| 148 | $fail2banPath = Util::which('fail2ban-client'); |
||
| 149 | Processes::mwExec("{$fail2banPath} -x stop"); |
||
| 150 | } |
||
| 151 | } |
||
| 152 | |||
| 153 | /** |
||
| 154 | * Create fail2ban dirs and DB if it does not exists |
||
| 155 | * |
||
| 156 | * @return string |
||
| 157 | */ |
||
| 158 | public function fail2banMakeDirs(): string |
||
| 159 | { |
||
| 160 | $res_file = self::FAIL2BAN_DB_PATH; |
||
| 161 | $filename = basename($res_file); |
||
| 162 | |||
| 163 | $old_dir_db = '/cf/fail2ban'; |
||
| 164 | $dir_db = $this->di->getShared('config')->path('core.fail2banDbDir'); |
||
| 165 | if (empty($dir_db)) { |
||
| 166 | $dir_db = '/var/spool/fail2ban'; |
||
| 167 | } |
||
| 168 | Util::mwMkdir($dir_db); |
||
| 169 | // Создаем рабочие каталоги. |
||
| 170 | $db_bd_dir = dirname($res_file); |
||
| 171 | Util::mwMkdir($db_bd_dir); |
||
| 172 | |||
| 173 | $create_link = false; |
||
| 174 | |||
| 175 | // Символическая ссылка на базу данных. |
||
| 176 | if (file_exists($res_file)){ |
||
| 177 | if (filetype($res_file) !== 'link') { |
||
| 178 | unlink($res_file); |
||
| 179 | $create_link = true; |
||
| 180 | } elseif (readlink($res_file) === "$old_dir_db/$filename") { |
||
| 181 | unlink($res_file); |
||
| 182 | $create_link = true; |
||
| 183 | if (file_exists("$old_dir_db/$filename")) { |
||
| 184 | // Перемещаем файл в новое местоположение. |
||
| 185 | $mvPath = Util::which('mv'); |
||
| 186 | Processes::mwExec("{$mvPath} '$old_dir_db/$filename' '$dir_db/$filename'"); |
||
| 187 | } |
||
| 188 | } |
||
| 189 | }else{ |
||
| 190 | $sqlite3Path = Util::which('sqlite3'); |
||
| 191 | Processes::mwExec("{$sqlite3Path} {$dir_db}/{$filename} 'vacuum'"); |
||
| 192 | $create_link = true; |
||
| 193 | } |
||
| 194 | |||
| 195 | if ($create_link === true) { |
||
| 196 | Util::createUpdateSymlink("$dir_db/$filename", $res_file); |
||
| 197 | } |
||
| 198 | |||
| 199 | return $res_file; |
||
| 200 | } |
||
| 201 | |||
| 202 | /** |
||
| 203 | * Записываем конфиг для fail2ban. Описываем правила блокировок. |
||
| 204 | */ |
||
| 205 | public function writeConfig(): void |
||
| 295 | } |
||
| 296 | |||
| 297 | private function generateActions(): void |
||
| 298 | { |
||
| 299 | $path = self::ACTION_PATH; |
||
| 300 | $conf = "[INCLUDES]".PHP_EOL. |
||
| 301 | "before = iptables-common.conf".PHP_EOL. |
||
| 302 | "[Definition]".PHP_EOL. |
||
| 303 | "actionstart = <iptables> -N f2b-<name>".PHP_EOL. |
||
| 304 | " <iptables> -A f2b-<name> -j <returntype>".PHP_EOL. |
||
| 305 | " <iptables> -I <chain> -p tcp -m multiport --dports <port> -j f2b-<name>".PHP_EOL. |
||
| 306 | " <iptables> -I <chain> -p udp -m multiport --dports <port> -j f2b-<name>".PHP_EOL. |
||
| 307 | "actionstop = <iptables> -D <chain> -p tcp -m multiport --dports <port> -j f2b-<name>".PHP_EOL. |
||
| 308 | " <iptables> -D <chain> -p udp -m multiport --dports <port> -j f2b-<name>".PHP_EOL. |
||
| 309 | " <actionflush>".PHP_EOL. |
||
| 310 | " <iptables> -X f2b-<name>".PHP_EOL. |
||
| 311 | "actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \\t]'".PHP_EOL. |
||
| 312 | "actionban = <iptables> -I f2b-<name> 1 -s <ip> -p tcp -m multiport --dports <port> -j <blocktype>".PHP_EOL. |
||
| 313 | " <iptables> -I f2b-<name> 1 -s <ip> -p udp -m multiport --dports <port> -j <blocktype>".PHP_EOL. |
||
| 314 | "actionunban = <iptables> -D f2b-<name> -s <ip> -p tcp -m multiport --dports <port> -j <blocktype>".PHP_EOL. |
||
| 315 | " <iptables> -D f2b-<name> -s <ip> -p udp -m multiport --dports <port> -j <blocktype>".PHP_EOL. |
||
| 316 | "[Init]".PHP_EOL.PHP_EOL; |
||
| 317 | file_put_contents("{$path}/miko-iptables-multiport-all.conf", $conf); |
||
| 318 | } |
||
| 319 | |||
| 320 | |||
| 321 | /** |
||
| 322 | * Creates additional rules |
||
| 323 | */ |
||
| 324 | private function generateJails(): void |
||
| 325 | { |
||
| 326 | $filterPath = self::FILTER_PATH; |
||
| 327 | |||
| 328 | $conf = "[INCLUDES]\n" . |
||
| 329 | "before = common.conf\n" . |
||
| 330 | "[Definition]\n" . |
||
| 331 | "_daemon = [\S\W\s]+web_auth\n" . |
||
| 332 | 'failregex = \sFrom:\s<HOST>\sUserAgent:(\S|\s)*Wrong password$' . "\n" . |
||
| 333 | ' ^(\S|\s)*nginx:\s+\d+/\d+/\d+\s+(\S|\s)*status\s+403(\S|\s)*client:\s+<HOST>(\S|\s)*' . "\n" . |
||
| 334 | ' \[error\] \d+#\d+: \*\d+ user "(?:[^"]+|.*?)":? (?:password mismatch|was not found in "[^\"]*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$' . "\n" . |
||
| 335 | "ignoreregex =\n"; |
||
| 336 | file_put_contents("{$filterPath}/mikopbx-www.conf", $conf); |
||
| 337 | |||
| 338 | $conf = "[INCLUDES]\n" . |
||
| 339 | "before = common.conf\n" . |
||
| 340 | "[Definition]\n" . |
||
| 341 | "_daemon = (authpriv.warn )?dropbear\n" . |
||
| 342 | 'prefregex = ^%(__prefix_line)s<F-CONTENT>(?:[Ll]ogin|[Bb]ad|[Ee]xit).+</F-CONTENT>$' . "\n" . |
||
| 343 | 'failregex = ^[Ll]ogin attempt for nonexistent user (\'.*\' )?from <HOST>:\d+$' . "\n" . |
||
| 344 | ' ^[Bb]ad (PAM )?password attempt for .+ from <HOST>(:\d+)?$' . "\n" . |
||
| 345 | ' ^[Ee]xit before auth \(user \'.+\', \d+ fails\): Max auth tries reached - user \'.+\' from <HOST>:\d+\s*$' . "\n" . |
||
| 346 | "ignoreregex =\n"; |
||
| 347 | file_put_contents("{$filterPath}/dropbear.conf", $conf); |
||
| 348 | |||
| 349 | $conf = "[INCLUDES]".PHP_EOL. |
||
| 350 | "before = common.conf".PHP_EOL.PHP_EOL. |
||
| 351 | "[Definition]".PHP_EOL.PHP_EOL. |
||
| 352 | "_daemon = asterisk".PHP_EOL.PHP_EOL. |
||
| 353 | "__pid_re = (?:\[\d+\])".PHP_EOL. |
||
| 354 | "_c_ooooo = (\[C-\d+[a-z]*\]?)".PHP_EOL.PHP_EOL. |
||
| 355 | "log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?%(_c_ooooo)s?:? \S+:\d*( in \w+:)?".PHP_EOL.PHP_EOL. |
||
| 356 | "failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'\$".PHP_EOL. |
||
| 357 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s(?:\sHost)? <HOST> failed to authenticate as '[^']*'\$".PHP_EOL.PHP_EOL. |
||
| 358 | "ignoreregex =".PHP_EOL.PHP_EOL; |
||
| 359 | file_put_contents("{$filterPath}/asterisk-ami.conf", $conf); |
||
| 360 | |||
| 361 | $conf = "[INCLUDES]".PHP_EOL. |
||
| 362 | "before = common.conf".PHP_EOL.PHP_EOL. |
||
| 363 | "[Definition]".PHP_EOL.PHP_EOL. |
||
| 364 | "_daemon = asterisk".PHP_EOL.PHP_EOL. |
||
| 365 | "__pid_re = (?:\[\d+\])".PHP_EOL. |
||
| 366 | "_c_ooooo = (\[C-\d+[a-z]*\]?)".PHP_EOL.PHP_EOL. |
||
| 367 | "log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?%(_c_ooooo)s?:? \S+:\d*( in \w+:)?".PHP_EOL.PHP_EOL. |
||
| 368 | "failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)\$".PHP_EOL. |
||
| 369 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)\$".PHP_EOL. |
||
| 370 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)\$".PHP_EOL. |
||
| 371 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*\$".PHP_EOL. |
||
| 372 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*\$".PHP_EOL. |
||
| 373 | ' ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$'.PHP_EOL. |
||
| 374 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s <HOST> tried to authenticate with nonexistent user".PHP_EOL. |
||
| 375 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Request (?:'[^']*' )?from '(?:[^']*|.*?)' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*\$".PHP_EOL. |
||
| 376 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s\s*(anonymous:\s)?Call\s(from)*\s*\((\w*:)?<HOST>:\d+\) to extension '\S*' rejected because extension not found in context 'public-direct-dial'\.\$".PHP_EOL. |
||
| 377 | ' ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)"(?:(?:,(?!RemoteAddress=)\w+="[^"]*")*|.*?),RemoteAddress="IPV[46]/[^/"]+/<HOST>/\d+"(?:,(?!RemoteAddress=)\w+="[^"]*")*$'.PHP_EOL. |
||
| 378 | " ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s ^hacking attempt detected '<HOST>'\$".PHP_EOL.PHP_EOL. |
||
| 379 | 'ignoreregex = Service="AMI"'.PHP_EOL.PHP_EOL; |
||
| 380 | file_put_contents("{$filterPath}/asterisk-main.conf", $conf); |
||
| 381 | |||
| 382 | $this->generateModulesFilters(); |
||
| 383 | } |
||
| 384 | |||
| 385 | /** |
||
| 386 | * Generate additional modules filter files |
||
| 387 | */ |
||
| 388 | private function generateModulesFilters(): void |
||
| 389 | { |
||
| 390 | $filterPath = self::FILTER_PATH; |
||
| 391 | $rmPath = Util::which('rm'); |
||
| 392 | Processes::mwExec("{$rmPath} -rf {$filterPath}/module_*.conf"); |
||
| 393 | |||
| 394 | |||
| 395 | // Add additional modules routes |
||
| 396 | $configClassObj = new ConfigClass(); |
||
| 397 | $additionalModulesJails = $configClassObj->hookModulesMethodWithArrayResult(ConfigClass::GENERATE_FAIL2BAN_JAILS); |
||
| 398 | foreach ($additionalModulesJails as $moduleUniqueId=>$moduleJailText) { |
||
| 399 | $fileName = Text::uncamelize($moduleUniqueId,'_').'.conf'; |
||
| 400 | file_put_contents("{$filterPath}/{$fileName}", $moduleJailText); |
||
| 401 | } |
||
| 402 | } |
||
| 403 | |||
| 404 | /** |
||
| 405 | * @param $max_retry |
||
| 406 | * @param $find_time |
||
| 407 | * @param $ban_time |
||
| 408 | */ |
||
| 409 | private function generateModulesJailsLocal($max_retry = 0, $find_time = 0, $ban_time = 0): void |
||
| 437 | } |
||
| 438 | } |
||
| 439 | |||
| 440 | /** |
||
| 441 | * @return array |
||
| 442 | */ |
||
| 443 | private function initProperty(): array{ |
||
| 470 | } |
||
| 471 | |||
| 472 | } |
