ok
Mini Shell
import datetime
import ipaddress
import json
from peewee import DoesNotExist
from defence360agent.rpc_tools.utils import (
generate_warnings,
run_in_executor_decorator,
)
from defence360agent.contracts.plugins import (
MessageSink,
MessageSource,
expect,
)
from im360.api.ips import (
IgnoredByPortAPI,
IPApi,
PortAPI,
GroupIPSyncSender,
IPApiWithIdempotentAdd,
)
from defence360agent.contracts.messages import MessageType
from im360.model.firewall import (
IPList,
Purpose,
)
from im360.subsys.whitelist_rbl import create_rbl_whitelist
from im360.model.firewall import (
BlockedPort,
)
from defence360agent.rpc_tools import ValidationError
class ManageLists(MessageSink, MessageSource):
async def create_sink(self, loop):
self._loop = loop
async def create_source(self, loop, sink):
self._loop = loop
self._sink = sink
async def _delete_ip_from(self, items, listname):
"""Unblock from *listname*"""
to_ignore, to_unblock = [], []
not_affected = []
for ip in items:
net = ipaddress.ip_network(ip)
supernets = IPList.find_closest_ip_nets(
net, listname=[listname], limit=1
)
# all(a.subnet_of(b) for a, b in zip([net]+supernets, supernets))
if supernets:
if supernets[0].ip_network != net:
# net is a part of supernet(s)
to_ignore.append(net)
else: # the first supernet == net
to_unblock.append(net)
else: # net is not a subnet
not_affected.append(
{
"rec": net,
"listname": IPList.get_field("listname", ip=ip),
}
)
for ip in to_ignore:
# no way to unblock IP, because it a part of blocked supernets so,
# sending ClientUnblock in order to put it in ignore list
await self._sink.process_message(
MessageType.ClientUnblock(
attackers_ip=ip, plugin_id="imunify360"
)
)
affected, not_unblocked = await IPApi.unblock(
to_unblock, listname=listname
)
affected += to_ignore
not_affected += not_unblocked
return affected, not_affected
async def _ip_delete_local(self, items, listname):
group_ip_sender = await GroupIPSyncSender().collect(items)
affected, not_affected = await self._delete_ip_from(items, listname)
if listname == IPList.GRAY:
splash_affected, splash_not_affected = await self._delete_ip_from(
items, IPList.GRAY_SPLASHSCREEN
)
affected += [
addr for addr in splash_affected if addr not in affected
]
na = []
not_affected_lists = (not_affected, splash_not_affected)
for not_affected_list in not_affected_lists:
na += [
net
for net in not_affected_list
if (net["rec"] not in affected) and (net not in na)
]
not_affected = na
await group_ip_sender.filter(affected).send("del")
generate_warnings(
affected,
not_affected,
dest_listname=listname,
all_list=items,
success_warning="{}/{} ip(s) were successfully deleted",
failure_warning="Noop: unable to delete {} from {}",
in_another_list_warning="IP {} is already in {} list",
)
async def _ip_add_idempotent(
self,
listname,
items,
comment=None,
expiration=0,
full_access=None,
scope=None,
comment_autogenerated=False,
):
assert listname in [IPList.BLACK, IPList.WHITE, IPList.GRAY]
if comment is None:
now = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
auto_generated_comment = "Manually added on %s" % now
comment = auto_generated_comment
comment_autogenerated = True
group_ip_sender = GroupIPSyncSender()
if scope == IPList.SCOPE_LOCAL:
await group_ip_sender.collect(items)
affected, not_affected = await IPApiWithIdempotentAdd.block(
listname=listname,
items=items,
comment=comment,
full_access=full_access,
expiration=expiration,
scope=scope,
# "whitelist ip add" doesn't remove expired manually blacklisted
# subnets
keep_manual_expired_subnets=(listname == IPList.WHITE),
manual=True,
comment_autogenerated=comment_autogenerated,
)
if scope == IPList.SCOPE_LOCAL:
await group_ip_sender.filter(affected).send("del")
await (await GroupIPSyncSender().collect(affected)).send("add")
generate_warnings(
affected,
not_affected,
dest_listname=listname,
all_list=items,
success_warning="{}/{} ip(s) were successfully added",
failure_warning="Noop: unable to add {} to {}",
in_another_list_warning="IP {} is already in {} list",
)
@expect(MessageType.IPListsUpdate)
async def update_local_iplist(self, message):
action = message["action"]
transport = message.get("transport")
response = {}
if transport:
message.pop("transport")
try:
if action == "add":
await self.ip_list_local_add(message)
elif action == "delete":
await self.ip_list_local_delete(message)
except ValidationError as exc:
response = {"error": "ValidationError", "message": str(exc)}
except Exception as exc:
response = {"error": "Exception", "message": str(exc)}
finally:
self._respond_to_transport(transport, json.dumps(response))
def _respond_to_transport(self, transport, message):
"""Writes the provided message to the transport if it exists"""
if transport:
transport.write(message.encode() + b"\n")
async def ip_list_local_add(self, message):
"""replacements for old
whitelist/graylist/blacklist ip list/add/delete/edit,
With changes:
new add will include functionality of old add/edit/move"""
list_name = Purpose.listname(message["purpose"])
_ips = message["items"].pop("items")
await self._ip_add_idempotent(
listname=list_name,
items=[ipaddress.ip_network(_ip) for _ip in _ips],
comment=message["items"].get("comment"),
expiration=message["items"].get("expiration", 0),
full_access=message["items"].get("full_access"),
scope=message["items"].get("scope"),
)
async def ip_list_local_delete(self, message):
"""Used for removing record from IPList table, same as old
rpc calls: `[white/black/gray]list ip delete`, but now also
splachscreen is allowed to delete
"""
list_name = Purpose.listname(message["purpose"])
await self._ip_delete_local(
listname=list_name,
items=[ipaddress.ip_network(_ip) for _ip in message["items"]],
)
@expect(MessageType.UpdateCustomLists)
async def update_custom_lists(self, message):
await create_rbl_whitelist()
@expect(MessageType.BlockedPortUpdate)
async def blocked_port_update(self, message):
transport = message.pop("transport", None)
response = {}
try:
if message.action == "add":
await self._blocked_port_add(
message["items"], message["ips"], message["comment"]
)
elif message.action == "delete":
await self._blocked_port_delete(message["items"])
elif message.action == "edit":
await self._blocked_port_edit(
message["items"], message["comment"]
)
except ValidationError as exc:
response = {"error": "ValidationError", "message": str(exc)}
except Exception as exc:
response = {"error": "Exception", "message": str(exc)}
finally:
self._respond_to_transport(transport, json.dumps(response))
@expect(MessageType.BlockedPortIPUpdate)
async def blocked_port_ip_update(self, message):
transport = message.pop("transport", None)
response = {}
try:
ips = [ipaddress.ip_network(ip) for ip in message["ips"]]
if message.action == "add":
await self._ignored_by_port_add_ip(
message["items"], ips, message["comment"]
)
elif message.action == "delete":
await self._ignored_by_port_delete_ip(message["items"], ips)
elif message.action == "edit":
await self._ignored_by_port_edit_ip(
message["items"], ips, message["comment"]
)
except ValidationError as exc:
response = {"error": "ValidationError", "message": str(exc)}
except Exception as exc:
response = {"error": "Exception", "message": str(exc)}
finally:
self._respond_to_transport(transport, json.dumps(response))
async def _blocked_port_add(self, items, ips, comment=None):
affected, not_affected = await PortAPI.block(items, comment=comment)
for ip in [ipaddress.ip_network(ip) for ip in ips]:
for port, proto in affected:
await IgnoredByPortAPI.block([ip], port=port, proto=proto)
return generate_warnings(
affected,
not_affected,
dest_listname=None,
all_list=items,
success_warning="{}/{} port(s) were successfully added",
failure_warning="Noop: unable to add {}",
)
async def _blocked_port_delete(self, items):
affected, not_affected = await PortAPI.unblock(items)
return generate_warnings(
affected,
not_affected,
dest_listname=None,
all_list=items,
success_warning="{}/{} port(s) were successfully deleted",
failure_warning="Noop: unable to delete {}",
)
async def _blocked_port_edit(self, items, comment):
affected, not_affected = await PortAPI.edit(items, comment)
return generate_warnings(
affected,
not_affected,
dest_listname=None,
all_list=items,
success_warning="{}/{} port(s) were successfully edited",
failure_warning="Noop: unable to edit {}",
)
async def _ignored_by_port_add_ip(self, items, ips, comment=None):
for port, proto in items:
if not await self.check_port_proto(port, proto):
raise ValidationError(
"Port and proto does not exist {}:{}".format(port, proto)
)
affected, not_affected = [], []
for port, proto in items:
_affected, _not_affected = await IgnoredByPortAPI.block(
items=ips, port=port, proto=proto, comment=comment
)
affected.extend(_affected)
not_affected.extend(_not_affected)
return generate_warnings(
affected,
not_affected,
dest_listname=None,
all_list=ips,
success_warning="{}/{} ip(s) were successfully added",
failure_warning="Noop: unable to add {}",
)
async def _ignored_by_port_edit_ip(self, items, ips, comment=None):
for port, proto in items:
if not await self.check_port_proto(port, proto):
raise ValidationError(
"Port and proto does not exist {}:{}".format(port, proto)
)
affected, not_affected = [], []
for port, proto in items:
_affected, _not_affected = await IgnoredByPortAPI.edit(
items=ips, port=port, proto=proto, comment=comment
)
affected.extend(_affected)
not_affected.extend(_not_affected)
return generate_warnings(
affected,
not_affected,
dest_listname=None,
all_list=ips,
success_warning="{}/{} ip(s) were successfully edited",
failure_warning="Noop: unable to edit {}",
)
async def _ignored_by_port_delete_ip(self, items, ips):
for port, proto in items:
if not await self.check_port_proto(port, proto):
raise ValidationError(
"Port and proto does not exist {}:{}".format(port, proto)
)
affected, not_affected = [], []
for port, proto in items:
_affected, _not_affected = await IgnoredByPortAPI.unblock(
items=ips, port=port, proto=proto
)
affected.extend(_affected)
not_affected.extend(_not_affected)
return generate_warnings(
affected,
not_affected,
dest_listname=None,
all_list=ips,
success_warning="{}/{} ip(s) were successfully deleted",
failure_warning="Noop: unable to delete {}",
)
@run_in_executor_decorator
def check_port_proto(self, port, proto):
try:
BlockedPort.get(port=port, proto=proto)
except DoesNotExist:
return False
return True
Zerion Mini Shell 1.0