$M/ D d dl mZ d dlmZmZmZmZmZmZ d dl m
Z
d dl m Z d Z
G d de Z G d de Z G d d
ee Z G d d e Z G d
dee Z G d dee Z G d dee Z G d deee Z G d de Z G d de Z G d dee Z G d d ee Z G d d e Z G d d ee Z G d! d"ee Z G d# d$ee Z G d% d&ee Z G d' d(e Z G d) d*e Z G d+ d,ee Z! G d- d.ee Z" G d/ d0ee Z# G d1 d2e Z$ G d3 d4e Z% G d5 d6e Z& G d7 d8e Z'd9S ): )utils)
AccumulatableMessage MessageListReceived
ReportableShortenReprListMixin)
WebShieldData)IPc e Zd ZdZdZeZdS )StrategyChangez8The message is generated when an IDS change is detected.STRATEGY_CHANGEN__name__
__module__ __qualname____doc__DEFAULT_METHODHIGHEST_PRIORITYPRIORITY M/opt/imunify360/venv/lib/python3.11/site-packages/im360/contracts/messages.pyr
r
s BB&N HHHr r
c e Zd ZdZdZdS )SensorIncidentz+Single incident, e.g. user auth failed onceINCIDENTNr r r r r r r r r r s 55 NNNr r c e Zd ZdZdZdS )SensorIncidentListzAggregated incident list
INCIDENT_LISTNr r r r r r s ""$NNNr r c e Zd ZdZdZdS ) UnreportableLocalIncidentListz=Aggregate local incident list that are not reported to serverLOCALINCIDENT_LISTNr r r r r" r" # s GG)NNNr r" c e Zd ZdZdZdS )LocalIncidentListz4Aggregate local incident list - where no ip providedr Nr r r r r% r% ) s >>$NNNr r% c 0 e Zd ZdZdZdZed ZdS ) SensorAlertz9Alert incident, e.g. user auth failures reached thresholdALERT c N | }| j |d< | di |S )z/When generate ALERT from INCIDENT change methodmethodr )copyr )clsmessage new_messages r
from_incidentzSensorAlert.from_incident5 s4 llnn # 2 H s!![!!!r N)r r r r r r classmethodr0 r r r r' r' / s= CC NH" " [" " "r r' c e Zd ZdZeZdS )
ClientUnblockUNBLOCKN)r r r r r r r r r r3 r3 = s N HHHr r3 c e Zd ZdZdS )CaptchaEventList CAPTCHA_LISTNr r r r r r r r6 r6 B s #NNNr r6 c 8 e Zd ZdZdZdZdZeZe d Z
dS ) CaptchaEventCAPTCHAFAILEDPASSED REQUESTEDc |j j t j k rd S | |j |j t j |j j |j j d S )Ncaptcha) timestamp attackers_ipeventuser_id plugin_id) webshr@ r
NArA ipCaptchaNamerD )r- parcels r from_parcelzCaptchaEvent.from_parcelO sb < =#3 3 34s & ',,V\-ABBL(
r N) r r r r r< r= r> r6
LIST_CLASSr1 rL r r r r: r: F sF N
F
FI!J
[
r r: c e Zd ZdZdZdS )CaptchaDosAlertCAPTCHA_DOS_ALERTr) N)r r r r r r r r rO rO \ s (NHHHr rO c e Zd ZdZdZej d fd Ze de
de fd Z xZ
S ) SynclistResponseSYNCLIST z/SynclistResponse{str->IP.adopt_to_ipvX_network})actionc t j |i | dD ])}d | | D | |< *dS )z
Do str -> Union[IPv4Network, IPv6Network]
conversion only once per SynclistResponse message processing
:raise ValueError: if str keys to IPv4Network,
IPv6Network conversion fails
) blocklist unblocklistc > i | ]\ }}t j | |S r )r adopt_to_ipvX_network).0ip_strdict_s r
z-SynclistResponse.__init__..s s9 !FE (00% r N)super__init__items)selfargskwargsfield __class__s r r` zSynclistResponse.__init__e sn $)&)))1 E %)%[%6%6%8%8 DKK r ips action_typec L fd| r| ng D S )zGiven [un]blocklist *ips* with their properties return ips
matching given *action_type*.
ip without an action type set matches any action type.
c 3 F K | ]\ }}|rd |vs |d k |V dS )rh Nr )r[ rH prh s r z4SynclistResponse.filter_blocklist.. sZ
A
A%% ;..
/...
r )ra )rg rh s `r filter_blocklistz!SynclistResponse.filter_blocklistx s?
),4#))+++"
r )r r r r r r synctimefunr` staticmethoddictstrrm
__classcell__)rf s @r rR rR a s NH
Z@
d
C
\
r rR c e Zd ZdZdS )SynclistRequestrS Nr8 r r r ru ru s NNNr ru c e Zd ZdZdZeZdS )BlockUnblockLista/ Used internally for block/unblock ip from lists
{
"blocklist": {(IPNetwork, "listname"): {"expiration": int}},
"unblocklist": [(IPNetwork,"listname")] ,
}
If ip is present in both lists: first unblock then block it
(upsert semantics if applicable).
BLOCK_UNBLOCKNr r r r rw rw s$ %N HHHr rw c e Zd ZdZdS )ProactiveQueueListPROACTIVE_QUEUE_LISTNr8 r r r rz rz s +NNNr rz c e Zd ZdZdZdS ) RuleDisabledz#
Rule disabled by customer
RULE_DISABLEDNr r r r r} r} s %NNNr r} c e Zd ZdZdZdS ) RuleEnabledz
Rule enabled back
RULE_ENABLEDNr r r r r r s $NNNr r c e Zd ZdZdgZdS ) ConfigSetz Updates to the agent's config.
CONFIG_SETN)r r r r RECEIVED_ACTIONSr r r r r s (($~r r c e Zd ZdZdZdS )UpdateCustomListsz^
Send message for class RealProtector for updating custom ip white and
black list
UPDATE_CUSTOM_LISTSNr r r r r r s
+NNNr r c e Zd ZdZdZdS )
IPListsUpdatezI
Send message for iplists plugin for updating IPs purposed lists
IP_LISTS_UPDATENr r r r r r s 'NNNr r c e Zd ZdZdS ) GroupIPSync
GROUP_SYNCNr8 r r r r r !NNNr r c e Zd ZdZdS )GroupIPSyncPushr Nr8 r r r r r r r r c e Zd ZdZdS )EnduserPasswordResetENDUSER_PASSWORD_RESETNr8 r r r r r s -NNNr r c e Zd ZdZdZdS )WhitelistCacheUpdatezQReceiveing this message indicates that resident part should clear whitelist cacheWHITELIST_CACHE_UPDATENr r r r r r s [[-NNNr r c e Zd ZdZdZdS ) IpsetUpdatezTReceiveing this message indicates that resident part should check ipsets consistency IPSET_UPDATENr r r r r r s ^^#NNNr r c e Zd ZdZdZdS )BlockedPortUpdatezNReceiveing this message indicates that resident part should update blockedportBLOCKED_PORT_UPDATENr r r r r r s XX*NNNr r c e Zd ZdZdZdS )BlockedPortIPUpdatezPReceiveing this message indicates that resident part should update blockedportipBLOCKED_PORT_IP_UPDATENr r r r r r s ZZ-NNNr r N)(defence360agentr "defence360agent.contracts.messagesr r r r r r im360.contracts.message_pb2r
defence360agent.utils.validater r r
r r r" r% r' r3 r6 r: rO rR ru rw rz r} r r r r r r r r r r r r r r r s ! ! ! ! ! ! 6 5 5 5 5 5 - - - - - - W W % % % % %j % % % * * * * *K * * * % % % % % Z % % % " " " " "': " " " GZ
$ $ $ $ $+Wj $ $ $
=
, g
%
%
%
%
%
w %
%
%
P gz
w
, , , , ,j , , ,% % % % %7J % % %$ $ $ $ $': $ $ $& & & & & & & & + + + + + + + +' ' ' ' 'G ' ' '" " " " "': " " "" " " " "gx " " ". . . . .7H . . .. . . . .7 . . . $ $ $ $ $' $ $ $ + + + + + + + + . . . . .' . . . . .r