<3414 d dl Z d dlZd dlmZmZ d dlmZmZ d dlm Z m
Z
d dl m Z m
Z
d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
l m Z d dl m Z d dl m!Z!m"Z" d dl#m$Z$m%Z& d dl'm(Z(m)Z)m*Z* d dl+m,Z, d Z-d Z. G d de Z/ G d de/ Z0 G d de0 Z1 G d d e Z2 G d d e/ Z3 G d d!e/ Z4 G d" d#e/ Z5d$ Z6 G d% d& Z7dS )' N)ABCMetaabstractclassmethod)partialwraps) IPv4Network IPv6Network)ListUnion)g)instance)run_in_executor) Protector)BlockUnblockList) MessageType)geo) IPSetCountry)IPSet)IPSetIgnoredByPort IPSetPort) CountryListCountry) BlockedPort
IgnoredByPortIPList)pack_ip_networkc fd}|S )Nc j K | g|R i | d {V \ }}| || d {V S N)_postprocess_records)selfargskwargsaffected not_affctedfuncs B/opt/imunify360/venv/lib/python3.11/site-packages/im360/api/ips.pywrapperz$postprocess_records..wrapper se &*d4&A$&A&A&A&&A&A A A A A A A +..xEEEEEEEEE )r% r' s ` r& postprocess_recordsr* s( F F F F F Nr( c < t fd }|S )Nc K t j 4 d {V | i | d {V cd d d d {V S # 1 d {V swxY w Y d S r )r RULE_EDIT_LOCK)r! r" coros r& r' z$with_rule_edit_lock..wrapper s + / / / / / / / / t.v........ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /s 7
AA)r )r. r' s ` r& with_rule_edit_lockr/ s3
4[[/ / / / [/ Nr( c X e Zd ZdZeed Zeed Zeed Zee d Z
ee d Z ed Z ee
d Zee
d Zee
d
ZdS ) APINc d S r r) )clsr! kwawrgss r& _create_recordzAPI._create_record+
r( c d S r r) r3 r! r" s r& _delete_recordzAPI._delete_record0 r6 r( c
K d S r r) r8 s r& _editz API._edit5 s
r( c K t t j fd d {V \ }}|r) j s
J d j j i d {V |S )Nc j i S r )r5 r! r3 r" s r& zAPI._add..? &C&777 r( &IPSet instance is missing for this API)r
asyncioget_event_loopipsetblock)r3 r! r" _createds ``` r& _addzAPI._add: s + " $ $ 7 7 7 7 7 7
7
39 F F F F F9!#)/42622 2 2 2 2 2 2 2r( c K t t j fd d {V }|r) j s
J d j j i d {V |dk S )Nc j i S r r9 r> s r& r? z API._delete..L r@ r( rA r r
rB rC rD unblock)r3 r! r" num_deleteds ``` r& _deletez API._deleteG s , " $ $ 7 7 7 7 7 7
59 F F F F F9##)#T4V44 4 4 4 4 4 4 4a r( c K ||fS )z1Add some fields in to result list, e.g 'listname'r) )r3 r# not_affecteds r& r zAPI._postprocess_recordsT s %%r( c > K t | j |g|R i | d {V S r ) split_resultrH r3 itemsr! r" s r& rE z API.blockY s< "#(ECDCCCFCCCCCCCCCr( c > K t | j |g|R i | d {V S r )rS rO rT s r& rM z API.unblock^ s< "#+uFtFFFvFFFFFFFFFr( c > K t | j |g|R i | d {V S r )rS r; rT s r& editzAPI.editc < "#)UDTDDDVDDDDDDDDDr( )__name__
__module__ __qualname__rD classmethodr r5 r9 r; r/ rH rO r r* rE rM rX r) r( r& r1 r1 ( sm E
[
[
[
[ [ & & [& D D [D G G [G E E [E E Er( r1 ) metaclassc v e Zd Z e Ze dd Zed Zee d Z
ee d Z ede fd Z
ee dd
Zee dd Ze d dd Zed Zeed ZdS )IPApiNFr c |t j t j t j fv sJ t j 5 t j 5 }t j | |
d ret j t j fD ]L} t j
| | } | dd fc cd d d cd d d S # t j $ r Y Iw xY w| dd }
g } t j
| t j t j t j g|d|
rdnd D ]J\ } }}
| | k r ||k r|
|k s2| | |f t | | K| | }g t j d
| ||||||d|t) j i | R cd d d cd d d S # 1 swxY w Y d d d d S # 1 swxY w Y d S ) N)ipmanualrb listnameFkeep_manual_expired_subnetsT)re
expired_byinclude_itselfrc )rb re
imported_fromcommentcountry full_access
expiration blocklist unblocklistr) )r BLACKWHITEGRAYr db transactionr readerdelete_expiredget DoesNotExistpopfind_net_membersGRAY_SPLASHSCREENappendr` r9 get_id
create_or_getr r )rb re ri rj rl rm r"
geo_readerlist_obj keep_manualrp subnetsubnet_expirationrk s r& r5 zIPApi._create_recordl s; FL&, DDDDD
[
$
$
&
& 7 7
7
!R ( ( ( (zz(##
0 %lFL 9 0 0E0 $jB ? ? ? #E4 /// 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 ". !**%BDIIK K4:4K,KL
& # +5uu
5
5
5
8
80 0 bLL E)))Z77 &&777((777 !''++G% %"/ # # + ) , k S7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 sb HAG* C6G*< HC' $G*&C' 'C*G* H*G. .H1G. 2HH Hc ^ t |t r|g}t j | | S )Nrd )
isinstancestrr delete_from_listrd s r& r9 zIPApi._delete_record s1 h $ $ " zH&"x@@@@r( c K t t j fd d {V }|r2 j s
J d j d {V |dk S )Nc 0 S r rK )r3 rb re s r& r? z IPApi._delete.. s c.@.@X.N.N r( rA r rL )r3 rb re rN s ``` r& rO z
IPApi._delete s , " $ $&N&N&N&N&N&N
29 F F F F F9)##B11 1 1 1 1 1 1 1a r( c K t t j fd d {V \ }}}|r |j rJ |rt |dd }t |t s/t d t | |r5t
|j
t j z
} | dk rd S | d< | j j
gR i d {V | | d {V |S )Nc 0 t j g R i S r )r` r5 )r! rb r" re s r& r? z IPApi._add.. s$ E(XGGGGGG r( rm r "expiration must be integer, got {}timeout)r
rB rC ro getattrr int TypeErrorformattyperm timerD rE _unblock_ips)
r3 rb re r! r" r rG unblock_ipsrm r s
```` r& rH z
IPApi._add sr +: " $ $ G G G G G G G+
+
%
%
%
%
%
%
!Wk :K$9::: A lA66J j#..
8?? Z((
, cnty{{ :;;a<<F$+y!!#)/"h@@@@@@ @ @ @ @ @ @ @ {+++++++++r( ipsc K |r5|j r0|j D ]*\ }}| j || d{V 'dS dS dS )z#Unblock *ips* from ipset/webshield.N)rp rD rM )r3 r rb re s r& r zIPApi._unblock_ips sy 63? 6 #
6
6 Hi''H5555555555 6 6 6 6
6
6r( c
Z K |d |d }}||v rdS t t j t t j |||| d{V }|rI|D ]#}| j || d{V $| j ||| d{V |dk S )a)
https://gerrit.cloudlinux.com/#/c/61260/22/src/handbook/message_processing/client_move.py
* shouldn't move to GRAY* lists
* do not move if already in list
* remove lists which exactly same and leave only one record with
IPList.NEVER expiration
rb listnamesr )rb destsrcrl Nrl ) r
rB rC r r moverD rM rE )r3 rowre rl rb r num_updated src_listnames r& _movez IPApi._move s d)S -C s??1 + " $ $ '
I #
:
: i''L9999999999)//"hK/HH H H H H H H Ha r( c
K d} t }
||s||
d< |||
d< |||
d< |||
d< |
s| S d|
d< d |
d
< t dt | j |||
| d{V \ } } } | r | j rJ | r||t | }
d|
v r |
d |
d< |yt |t s/t d
t | |r,t
|t j
z
}|dk rdS nd}||
d< | j || j
d{V | j j ||fi |
d{V | | d{V | S )z+Implement manual "[ip]list ip edit" commandr Nrj rl rm scopeTrc Fcaptcha_passed)rb re fields
allow_mover r r )dictr
r _edit_recordro r r r r r r rD rM re rE r )r3 rb re rj rl rm r r comment_autogeneratedr r r changed_recordr" r s r& r; z IPApi._edit sB '< 'F9 "$/F= ! !#-F< #F7O x#( 9H ! %
:
:
4
4
4
4
4
4
0 [. :K$9::: :K 3z7Mk222Fv%%'-l';|$%!*c22 #<CC , ,
!*ty{{": ; ;G !|| q $ G$+y!)##B(?@@ @ @ @ @ @ @ @!#)/"h99&99 9 9 9 9 9 9 9 {+++++++++r( return%Tuple[int,Optional[BlockUnblockList]]c
|t j t j t j fv sJ t j 5 g } |rMt | \ }}}t t j
t j |k t j |k t j
|k t j t j t j t j g }t# | dk rH|D ]E} | j |k r8t j | | j g | | | j f Ft# | dk r |d }
n)t j t j | | }
| dd } |
| ryt j | t j |
j | d D ]I\ } }
}| | k r |
j |
k s2| | |
f t2 | |
J|r||
j k r||d< t j d i |
t j |
j k t j |
j k z t j
|
j
k z t j |
j k z }|t9 j i | |
fcd
d
d
S # t j $ r Y d
d
d
d S w xY w# 1 swxY w Y d
S )
z>'{black,white}list ip edit' rpc command db part implemenation. rd r rm T)re rg rh re rn N)r NNr) ) r rq rr rs r rt ru r listselectwherenetwork_addressnetmaskversionre in_executelenr r} ry rx
lives_lessr{ #lists_with_less_or_equal_prioritiesr` r9 updater r )rb re r r rp netmaskr recordsrecrecordnew_expirationr r rF r s r& r zIPApi._edit_recordK s
FL&, DDDDD
[
$
$
&
& J J KH
B)8)<)<&Cw "
" 2c 9 "Nd 2 "Ng 5 "O / /!' v|V[ I ! G 7||q(( $+ G GC "|x 7 7 & 7')S\N!" !" !" !" !, 2 2B 3E F F F7||q((!( % 1 3 33 #Z2 A A AF
"(L!!V^;=!>V^;= "?fo=? WYY 0"$+ IJ J J J J J J J D &
%
%
%$GJ J J J J J J J D
%EJ J J J J J J J J J s8 L7
E&L0EL7L4%L73L44L77L;>L;c
B K g }|D ]}t t j t j t |d t t f r|d n
|d d d{V }| | | | ||fS )z
Adds listname to every IP
:param list of dicts affected:
:param list of dicts not_affected:
:return list of dicts, list of dicts
r rb Nre )
r
rB rC r effective_listr r r r r} )r3 r# rQ not_affected_processeditemre s r& r zIPApi._postprocess_records s "$ 0 0D ,&((% "$u+ [/IJJ+DKK eT*
H
KKK * * * " ) )$ / / / ////r( c > K t | j |g|R i | d {V S r )rS r rT s r& r z
IPApi.move rY r( )NNFr )F)NNNNFF)r r )rZ r[ r\ r rD staticmethodr5 r9 r] r/ rO rH r r r r; r r r* r r) r( r& r` r` i s EGGE
A A A \AF A A \A
[ [2 6%5 6 6 6 [6 [ D
#? ? ? [?B ).O 0O O O \Ob 0 0 [0. E E [E E Er( r` c 2 e Zd ZdZe fd Z xZS )IPApiWithIdempotentAddz
another class to work with iplists,
`_add` method will do same things in one place
that parent class _add/_edit/_move do.
c ~ K | dd } t j ||g|R i | d {V }|r|S | d |t j k rd|d< | dd | dd t j ||g|R d|d| d {V S )Nr Frl rc rf T)r r )rz superrH rx r rr r; )r3 rb re r! r" r rG __class__s r& rH zIPApiWithIdempotentAdd._add s &
+BE J J $ RCDCCCFCCCCCCCC N ::m $ $ ,V\1I1I$)F= !
8T"""
0$777"UWW]
"7
r( )rZ r[ r\ __doc__r] rH
__classcell__)r s @r& r r sN
[
r( r c e Zd Zd ZdS )MockedCountryIpsetc
K d S r r) )r rF __s r& rM zMockedCountryIpset.unblock s r( N)rZ r[ r\ rM r) r( r& r r s#
r( r c | e Zd Z e Zed Zedd Zed Z ed Z
dS )
CountryAPIc V t j | }t j || S )Ncode) CountryModelrx r delete_country)rk re country_objs r& r9 zCountryAPI._delete_record s( "&G444 )+x@@@r( Nc d t j | }t j |j || S )Nr )rk re rj )r rx r r id)rk re rj r" r s r& r5 zCountryAPI._create_record s8 "&G444 ( NXw
r( c ` K t t j fd d {V S )Nc t j t j t j j k S )Nrj r )r r r rk r rx r r )rj rk s r& r? z"CountryAPI._edit.. sG K&w777
U;&,*:*H*H*H*KK
L
L
WYY r( r
rB rC )r3 rk rj s ``r& r; zCountryAPI._edit s] $ " $ $
r( c K g }|D ]Wt t j fd d{V } | | X||fS )z
Adds listname to every Country
:param list of dicts affected:
:param list of dicts not_affected:
:return list of dicts, list of dicts
c 8 t j d S )Nr )r get_listname)r s r& r? z1CountryAPI._postprocess_records.. s 0e== r( Nr )r
rB rC r r} )r3 r# rQ r re r s @r& r z CountryAPI._postprocess_records s "$ 0 0D ,&((==== H
KKK * * * " ) )$ / / / ////r( r ) rZ r[ r\ r rD r r9 r5 r] r; r r) r( r& r r s EA A \A
\
[
0 0 [0 0 0r( r c h e Zd Z e Zed Zedd Zedd Z dS )PortAPIc | \ }}t j t j |k t j |k z S r )r deleter portprotor )r r r s r& r9 zPortAPI._delete_record
sG e
UK$,1Be1KL
M
M
WYY
r( Nc : | \ }}t j ||| S )N)r r rj )r r )r rj r r s r& r5 zPortAPI._create_record s, e(UG
r( c n K |\ t t j fd d {V S )Nc t j t j k t j k z S Nr )r r r r r r )rj r r s r& r? z PortAPI._edit..$ sC K&w777
UK$,1Be1KL
M
M
WYY r( r )r3 r rj r r s `@@r& r; z
PortAPI._edit sl e$ " $ $
r( r )
rZ r[ r\ r rD r r9 r5 r] r; r) r( r& r r
sx IKKE
\
\
[
r( r c h e Zd Z e Zed Zedd Zedd Z dS )IgnoredByPortAPIc F t j || }t | \ }}}t j t j |k t j |k z t j |k z t j |k z
S )Nr r ) r rx r r r r
port_protor r r r )rb r r r r r s r& r9 z IgnoredByPortAPI._delete_record- s D666 ,R 0 0T7 " "
U )T1 0C79 (D02 !(G35 WYY
r( Nc t j || }t j 5 }| | }t j || || cd d d S # 1 swxY w Y d S )Nr )r rb rj rk )r rx r rv r~ r r )rb r r rj r r rk s r& r5 z IgnoredByPortAPI._create_record= s _$e<<<
Z\\ Z ''++G .%"gw s -A$$A(+A(c K t j || t | \ t t j fd d {V S )Nr c t j t j k t j k z t j k z t j k z S r )r r r r r r r r )rj r r r r s r& r? z(IgnoredByPortAPI._edit..M so M(999
U .#5 (D02 (G35 !+z9; WYY r( )r rx r r
rB rC ) r3 rb r r rj r r r r s `@@@@r& r; zIgnoredByPortAPI._editF s _$e<<<
,R 0 0T7$ " $ $
r( r )
rZ r[ r\ r rD r r9 r5 r] r; r) r( r& r r * s{ E
\
\
[
r( r c K t |t t f s J d | g g }}|D ]C} | |g|R i | d{V }|r| | ,| d|i D||fS )z
Split result to affected/not affected records
:param f: executable object
:param list of str records: original iterate object
:return list of str affected,
list of dicts not_affected:
z-items should be list or tuple, instead - "{}"Nr )r r tupler r} )fr r! r" r# rQ r is_affecteds r& rS rS X s $ G G6==gFFG G lH . . Ac 3D 3 3 3F 3 3333333 . OOC - - - - \ !!r( c j e Zd Zd Zd Zdeeeef fdZ deeeef fdZ
dS )GroupIPSyncSenderc d | _ d S r _to_be_sent_to_correlation)r s r& __init__zGroupIPSyncSender.__init__p s *.'''r( c K | j rj|dk rd | j D }n|dk rd | j D }t j t j ||i d {V d S d S )Naddc h g | ]/}t |j |j |j |j |j 0S ))rb rm r rl rj )r rb rm re rl rj .0ip_models r&
z*GroupIPSyncSender.send..v sV ! #;#+#6 % .$,$8 ( 0 r( delc D g | ] }t |j |j S ))rb r )r rb re r s r& r z*GroupIPSyncSender.send.. sD
! #; % . r( )r r sinkprocess_messager GroupIPSync)r actiondatas r& sendzGroupIPSyncSender.sends s * %)$C 5
%)$C &(('
) r( rU c j K t t j fd d {V | _ | S )Nc , t j S r )r fetch_for_group_sync)rU s r& r? z+GroupIPSyncSender.collect.. s F/66 r( )r
rB rC r r rU s `r& collectzGroupIPSyncSender.collect sV 0? " $ $ 6 6 6 61
1
+
+
+
+
+
+
' r( c 8 fd| j D | _ | S )Nc & g | ]
}|j v |S r) )
ip_network)r r rU s r& r z,GroupIPSyncSender.filter.. s0 +
+
+
%''
'''r( r r s `r& filterzGroupIPSyncSender.filter s8 +
+
+
+
7+
+
+
'
r( N) rZ r[ r\ r r r r
r r r r r) r( r& r r o s / / / :4k;.F(G#H D{K'?!@ A r( r )8rB r abcr r functoolsr r ipaddressr r typingr r
&defence360agent.internals.global_scoper defence360agent.modelr $defence360agent.model.simplificationr
im360.contracts.configr im360.contracts.messagesr "defence360agent.contracts.messagesr im360.internalsr "im360.internals.core.ipset.countryr im360.internals.core.ipset.ipr im360.internals.core.ipset.portr r im360.model.countryr r r im360.model.firewallr r r im360.utils.netr r* r/ r1 r` r r r r r rS r r) r( r& r, s! , , , , , , , , $ $ $ $ $ $ $ $ . . . . . . . . 4 4 4 4 4 4 * * * * * * @ @ @ @ @ @ , , , , , , 5 5 5 5 5 5 : : : : : : ; ; ; ; ; ; / / / / / / I I I I I I I I D D D D D D D D C C C C C C C C C C + + + + + + >E >E >E >E >EG >E >E >E >EBOE OE OE OE OEC OE OE OEd
U
:
*0 *0 *0 *0 *0 *0 *0 *0Z
c
@+
+
+
+
+
s +
+
+
\" " ".. . . . . . . . . .r(