)zX d Z ddlZddlZddlZddlZddlZddlZddlZ ddl
m Z m Z ddl
mZ ddlmZmZmZmZ erddlZ ee ZdZdedefd Z G d
d e Z G d d
Z G d de Z G d de Z G d dej j Z! G d dej j" Z# G d de j$ j% Z& G d de j$ j' Z( G d d Z)dS ) av Networking transport helpers for urllib.
This module provides a small abstraction on top of urllib.request so that
callers can keep using urllib.request.Request, but routing of connections
can be customized:
- hostname resolution is handled in user code;
- selected IP may be randomized or chosen using any complex logic;
- for HTTPS: connects to a chosen IP but keeps correct SNI and certificate
hostname validation for the original hostname (NOT the IP).
Examples:
Default behavior (plain urllib):
from defence360agent.utils.net_transport import UrlTransport
transport = UrlTransport()
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Randomize target IP on each connection (A/AAAA -> random choice):
from defence360agent.utils.net_transport import UrlTransport, RandomIpChooser
chooser = RandomIpChooser()
transport = UrlTransport(ip_chooser=chooser)
req = urllib.request.Request(
"https://files.imunify360.com/static/sigs/v1/description.json"
)
with transport.open(req, timeout=10) as resp:
body = resp.read()
Notes:
- HTTPS: connects to the chosen IP but keeps SNI/cert checks against original
hostname.
- HTTP: Host header stays original hostname because urllib builds it from the
URL.
N)ABCabstractmethod) getLogger)DictOptionalTuple
TYPE_CHECKINGg r@ipreturnc ~ t t j | t j S # t $ r Y dS w xY w)z~Return True if *ip* is an IPv4 address string.
Implementation relies solely on ipaddress.ip_address for correctness.
F)
isinstance ipaddress
ip_address IPv4Address
ValueError)r
s X/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/utils/net_transport.py_is_ipv4r C sG
).r22I4IJJJ uus +.
<<c J e Zd ZdZedededefd ZdededefdZdS ) IpChooserzSelect an IP address to connect to for a given hostname and port.
Implementations may be stateful and can keep caches/metrics inside.
hostnameportr c t )z6Return an IP address (v4 or v6) for *hostname*:*port*.)NotImplementedErrorselfr r s r choosezIpChooser.chooseT s
"! c . | || S N)r r s r __call__zIpChooser.__call__Y s {{8T***r N) __name__
__module__ __qualname____doc__r strintr r r r r r N s|
"s "# "# " " " ^"+ +C +C + + + + + +r r c X e Zd ZdZej eddedefdZ de
dede e
d f fd
Z d S ) DnsCacheResolverzDNS cache for socket.getaddrinfo() results.
It caches per (hostname, port, family). This is intentionally small and
local: it is meant only to avoid excessive getaddrinfo() calls.
)family ttl_secondsr* r+ c ` || _ || _ i | _ t j | _ d S r )_family _ttl_seconds_cache threadingLock_lock)r r* r+ s r __init__zDnsCacheResolver.__init__d s4 '
^%%
r r r r .c , ||| j f}t j }| j 5 | j | }|;|\ }}||k r0t
d||| j |cd d d S d d d n # 1 swxY w Y t
d||| j t j ||| j t j }g }|D ])\ } } } } }
|
d } | |vr|
| *|s#t d || t | } | j 5 || j z | f| j |< d d d n # 1 swxY w Y t
d||| j | | S )Nz0DnsCacheResolver cache hit for %s:%s (family=%s)z9DnsCacheResolver cache miss/expired for %s:%s (family=%s)r zNo IPs resolved for {}:{}z1DnsCacheResolver resolved %s:%s (family=%s) to %s)r- timer2 r/ getloggerdebugsocket getaddrinfo SOCK_STREAMappendOSErrorformattupler. )
r r r keynowcached
expires_atipsinfos_sockaddrr
ips_ts
r get_ipszDnsCacheResolver.get_ipsq sn t|,ikk
Z [__S))F!"(
C##LLJ G L
" L
$) Aq!Q!B}}
2 N5<z7RandomIpChooserWithIPv6Toggle.choose.. s- ::Xb\\:::::::r z No IPv4 IPs resolved for {}:{}zKRandomIpChooserWithIPv6Toggle selected IPv4 IP %s for %s:%s (IPv6 disabled)) rS rI rW rV choicerX r7 r8 r? r= r> )r r r rD chosenipv4_ipss r r z$RandomIpChooserWithIPv6Toggle.choose s n$$Xt44
Y%%c**F "DM LL!
M::c::::: 077$GG
!!(++
r r N)r! r" r# r$ r r) rT rU re r3 r\ r^ r` r% rb rf r& r r' r r rN rN s 04'+ !
,
,
, +,
, fm
$
,
,
,
,
," " " "# # # #" " " " " # >$ > > > > s # # r rN c ` e Zd ZdZddddee deej fdZde de
d e fd
Z dS ) RandomIpChooserzAResolve hostname and select a random IP from resolved candidates.N)rO rP rO rP c d |p
t | _ |pt j | _ d S r )r) rS rT rU rV )r rO rP s r r3 zRandomIpChooser.__init__ s- "7%5%7%7*6=?? r r r r c | j || }| j | }t d||| |S )Nz(RandomIpChooser selected IP %s for %s:%s)rS rI rV rk r7 r8 )r r r rD rl s r r zRandomIpChooser.choose sW n$$Xt44!!#&& 6
r ) r! r" r# r$ r r) rT rU r3 r% r& r r' r r rp rp s KK
04'+ + + + +,+ fm
$ + + + + s # # r rp c Z e Zd ZdZ d
ej dddedee de f fdZ
d d Z xZ S ) ForcedIPHTTPConnectionzHTTPConnection that connects to a chosen IP.
Important: urllib builds the request URL with the original hostname,
therefore the Host header stays correct.
Ntimeoutsource_addressr r
ip_chooserc ` t |||| || _ d S )N)r rv rw superr3 _ip_chooser)r r r rx rv rw __class__s r r3 z ForcedIPHTTPConnection.__init__ sB )
&r r c | j pd}| j | j | }t d||| j t
j ||f| j | j | _
d S )NP z:ForcedIPHTTPConnection connecting to %s:%s for hostname %s) r r| r hostr7 r8 r9 create_connectionrv rw sock)r r r
s r connectz ForcedIPHTTPConnection.connect sw yB
$
$TY
5
5 H I
,
J L
r r rn
r! r" r# r$ r9 _GLOBAL_DEFAULT_TIMEOUTr% r r& r r3 r
__classcell__r} s @r rt rt s #& .& & && sm&
& & & & & &"
r rt c
^ e Zd ZdZ d ej dddedee de ddf fd Z
d
d Z xZ S )ForcedIPHTTPSConnectionzHTTPSConnection that connects to a chosen IP.
TLS details:
- Uses original hostname for SNI (server_hostname in wrap_socket)
- Certificate hostname validation is performed for the original hostname
Nru r r rx contextssl.SSLContextc b t ||||| || _ d S )N)r r rv rw rz )r r r rx r rv rw r} s r r3 z ForcedIPHTTPSConnection.__init__3 sE )
&r r c ~ | j pd}| j | j | }t d||| j t
j ||f| j | j }| j
r"|| _ | | j }| j
|| j | _ d S )Ni z;ForcedIPHTTPSConnection connecting to %s:%s for hostname %s)server_hostname)r r| r r r7 r8 r9 r rv rw _tunnel_hostr _tunnel_context wrap_socket)r r r
raw_socks r r z ForcedIPHTTPSConnection.connectF s y C
$
$TY
5
5 I I
+
J L
! DI LLNNNyHM-- I .
r r rn r r s @r r r + s #& .& & && sm&
& "
& & & & & &&
r r c H e Zd ZdZdef fd Zdej j fdZ xZ
S )ForcedIPHTTPHandlerz3urllib handler that creates ForcedIPHTTPConnection.rx c V t || _ d S r rz )r rx r} s r r3 z ForcedIPHTTPHandler.__init__d s'
%r r c : fd} || S )Nc X t | j | d S )Nrv )rx rv )rt r| r6 r kwargsr s r factoryz.ForcedIPHTTPHandler.http_open..factoryi s2 ) +
9--
r do_openr reqr s ` r http_openz ForcedIPHTTPHandler.http_openh s2 ||GS)))r ) r! r" r# r$ r r3 httpclient HTTPResponser r r s @r r r a sj ==&i & & & & & &* 8 * * * * * * * *r r c L e Zd ZdZdeddf fd Zdej j fdZ xZ
S )ForcedIPHTTPSHandlerz4urllib handler that creates ForcedIPHTTPSConnection.rx r r c h t | || _ || _ d S )N)r )r{ r3 r| r )r rx r r} s r r3 z ForcedIPHTTPSHandler.__init__v s1
)))%
r r c : fd} || S )Nc d t | j j | d S )Nrv )rx r rv )r r| r r6 r s r r z0ForcedIPHTTPSHandler.https_open..factory| s7 * +
9--
r r r s ` r
https_openz ForcedIPHTTPSHandler.https_open{ s2 ||GS)))r ) r! r" r# r$ r r3 r r r r r r s @r r r s sr >> i :J
*!9 * * * * * * * *r r c e Zd ZdZddddee ded fdZddd ej j d
ee
d e j j
fd ZdS )
UrlTransporta Single entrypoint for opening urllib requests.
If *ip_chooser* is provided, the transport will connect to the selected IP
address, while keeping correct Host/SNI/cert validation for the original
hostname. If *ip_chooser* is not provided, it behaves like plain urllib.
N)rx ssl_contextrx r r c dd l }|p| | _ |%t j | _ d S t j t | t || j | _ d S )Nr )rx )rx r ) sslcreate_default_context _ssl_contexturllibrequest build_opener_openerr r )r rx r _ssls r r3 zUrlTransport.__init__ s ' H4+F+F+H+H !>6688DLLL!>66#z:::$ ) - DLLLr rv r rv r c r || j | S | j || S )Nr )r open)r r rv s r r zUrlTransport.open s: ?<$$S)) )| g 666r )r! r" r# r$ r r r3 r r RequestrL r r r r r' r r r r s +/26 Y' ./ 2 $( 7 7 7
^
#7 % 7
! 7 7 7 7 7 7r r )*r$ http.clientr r rT r9 r0 r5 urllib.requestr abcr r loggingr typingr r r r r r! r7 rK r% re r r r) rN rp r HTTPConnectionrt HTTPSConnectionr r HTTPHandlerr HTTPSHandlerr r r' r r r s , ,\
# # # # # # # # 7 7 7 7 7 7 7 7 7 7 7 7 JJJ 8 ! + + + + + + + + G G G G G G G GT@ @ @ @ @I @ @ @F i 0&
&
&
&
&
T[ 7 &
&
&
R3
3
3
3
3
dk 9 3
3
3
l* * * * *&.4 * * *$* * * * *6>6 * * *(%7 %7 %7 %7 %7 %7 %7 %7 %7 %7r