IZ i R d dl Z d dlZd dlmZmZmZmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZmZmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZm Z m Z m Z d dl m Z d d l!m"Z"m#Z# d
d d d
d
dddddddddd dZ$ G d de
Z% G d de Z& G d de Z' G d de Z(dS ) N)DictListOptionalSet) JOINCase CharField CompositeKey
FloatFieldForeignKeyField IntegerFieldIntegrityErrorPrimaryKeyField TextFieldprefetch)
model_to_dict)Modelinstance)apply_order_by)ControlPanelProtector CpHulkSensor ModsecSensor OssecSensor)Country)IPList
IPListPurpose )r# r" r! r r r r
c e Zd Z fdZ xZS )_SafeCharFieldc p t | dd S )Nzutf-8ignore)errors)superadaptencode)selfvalue __class__s I/opt/imunify360/venv/lib/python3.11/site-packages/im360/model/incident.pyr2 z_SafeCharField.adapt3 s) ww}}U\\'(\ C CDDD )__name__
__module__ __qualname__r2
__classcell__)r6 s @r7 r- r- 2 sA E E E E E E E E Er8 r- c f e Zd ZdZ edd Z ed Z ed Z e d Z
ed Z ed Z ed Z
ed Z ed Z edd Z edd Z G d d
Z G d d Zed
Ze dd Zedeeee f fd Z e dde e dee e deeee f fd Z e d Z ed Z!dS )Incidentz4Security-related events that happened on the server.T) primary_keynullr@
country_id)r@ column_nameN)r@ defaultc ( e Zd Zej ZdZdZdZdS )
Incident.Metaincident))) timestampF))countryFresidentN) r9 r: r; r dbdatabasedb_tableindexesschema r8 r7 MetarF c s( ;
r8 rQ c $ e Zd Zed ZdS )Incident.OrderByc
t t t fdt D } t t j t j t t j
| d ft j t t j
| d ft j t j
ffd fS )Nc 3 D K | ]\ }}||d z |z
d z z z fV dS )r# NrP ).0ossecmodsecmax_ossec_severitys r7 z,Incident.OrderBy.severity..q sd
"E6 )A-5)A-//
r8 r d )
maxossec_to_modsec_severitykeystupleitemsr r> pluginr PLUGIN_IDseverityr r ) ossec_casesrY s @r7 rc zIncident.OrderBy.severitym s !$%=%B%B%D%D!E!E
&>%C%C%E%E
K O ( 1 !2K C C
) 2 !2K C C &/1BC
r8 N)r9 r: r; staticmethodrc rP r8 r7 OrderByrS l s-
r8 rf c * | j t j k | j t j k z | j t j k z | j |k z | j t j k | j t | k z z | j z S N) ra r rb r r rc r r] is_null)clsrc s r7 _accept_severityzIncident._accept_severity s
Z;#88z%:%DDFz\%;;= <8+ - | 55<#;H#EEG
l""$$
%
r8 c
|t j }t t t t t
j t j t j k t j
|k | | z t j
|k z t j
}
| "|
t j | z }
|
|
t j |
t j |
z t j |
z t j |
z }
|2|
t j | }
|#|
t j |k }
| #|
t j | k }
| d |D nd}d}|d |
t j D }| || }d | D }|sg S |
t j |z }
| t1 | | |
}
||
| }
||
| }
t7 |
}| | d |D d }t7 | || S )a
:param by_country_code: country code in form 'US => United States'
:param integer since: unixtime when records is began
:param integer to: unixtime when records is ended
:param str by_abuser_ip: full or part of IP, used for filtering
results by abuser's IP
:param str by_list: List of names of the appropriate ip list. Could be
'gray', 'white', 'black'.
:param int limit: limits the output with specified number of
incidents. The number greater than zero
:param int offset: offset for pagination
:param int severity: min log level (severity) to return.
:param str search: filter results by ip, name, description
:param list order_by: sorting orders
:param list of str by_domains: filter by panel user domains
:param str by_plugin: filter by plugin name, e.g. 'modsec', 'ossec'.
N)onc 6 h | ]}| S rP )upper)rV lns r7 z4Incident.get_sorted_incident_list.. s * * *BRXXZZ * * *r8 c * h | ]}|j |j S rP abuserrV rows r7 rq z4Incident.get_sorted_incident_list.. s2 ! ! !:!
! ! !r8 c h | ] \ }}||
S rh rP )rV arp s r7 rq z4Incident.get_sorted_incident_list.. s$ a"....r8 c * h | ]}|j |j S rP rs )rV rs r7 rq z4Incident.get_sorted_incident_list.. s! 444a184444r8 ) timer> selectr joinr
LEFT_OUTERrI idwhererH rk order_bydescdomainnamecontains descriptionrt codera distinct_resolve_abuser_listnamesr` r offsetlimitlistmk_incident_iterator)rj sinceto by_abuser_ipby_listr r rc by_country_code
by_domainssearchr by_pluginquerylistname_filterabuser_listnamecandidate_abusersmatched_abusersrowss r7 get_sorted_incident_listz!Incident.get_sorted_incident_list s% B :B
OOHg . .
T h.>'*.L U#u,&&x001%+-
Xh(--//
0
0 !KK: =>>E KK
&&v..&//778/**6223 /**6223 E #KK 8 8 F FGGE &KK ?@@E KK9 <==E /6.A * *' * * * *t ?C &! ! <<88AACC! ! !
" ; ;!? O . 4 4 6 6 O #
KK? BCCE "8S%88E LL((E KK&&EE{{ " ! ; ;444444d O C,,T?CCDDDr8 r c # K |D ]}|j r| |j nd }|r| nd }|rt j | j nd }|j |j |j |j |j
|j |j |j
|j |||j r't t! j |j ni |j d
V d S )N)r )
r ra rulerH timesrc r r rt listnamepurposerI r )rt getlowerr listname2purposer5 r ra r rH retriesrc r r rI r r r )rj r r rv ln_upperr r s r7 r z Incident.mk_incident_iterator s C:=*N**3:666$H+3=x~~'''H
.x88>>
f * ] L " * $"; = )D)D)DEEE *
r8 abusersr returnc |si S t j t j t j t j t j t j }|?| t j t | }d t j
D fd|D }i }|D ]s} t j | }n# t $ r d||< Y )w xY wd\ }} |j }
|D ]2\ } } }
| j |
k r|
| k r| | r| |
} }3|||< t|S )uE Return ``{abuser_ip: highest-priority IPList listname covering it}``.
``None`` value if the abuser is not in any (allowed) list. One SQL
fetch of the candidate IPList rows + Python containment via
:py:meth:`ipaddress.IPv4Network.subnet_of` — avoids issuing one DB
query per abuser.
Nc i | ]\ }}|| S rP rP )rV prp s r7
z6Incident._resolve_abuser_listnames..O s AAAeaBAAAr8 c ` g | ]*}|j |j |j d f+S ))
ip_networkr r )rV rv prioritys r7
z6Incident._resolve_abuser_listnames..P sD
^S\8<< b+I+I J
r8 )Nr )r r| network_addressnetmaskversionr r
is_expiredin_r IP_LIST_PRIORITIES ipaddressr
ValueError subnet_of)rj r r qiplist_entriesresultrt
abuser_netbest best_prioabuser_versionrow_net row_listnamerow_prior s @r7 r z"Incident._resolve_abuser_listnames3 s I M " N N O
%"$$$
%
%
&++D ,A,ABBCCA
BAv'@AAA
,. " "F
& 1& 9 9
!%v
'OD) ' /N3A
=
=/ x?n44 y(( ''00 =&2H)D !F6NN
s C++C=<C=c * d}t j 5 t dt | | D ]9}t
| |||z : d d d d S # 1 swxY w Y d S )N2 r )r rK atomicrangelenr> insert_manyexecute)datanum_rowsidxs r7 save_incident_listzIncident.save_incident_listh s
[
!
! K K QD 844
K
K$$T#h*>%?@@HHJJJJ
K K K K K K K K K K K K K K K K K K Ks ABB B c d d|v r$| | j |d k }d|v r$| | j |d k }d|v r$| | j |d k }d|v r3| | j |d }|S )Nr ip attack_typer )r r rt r r r )rj r kwargss r7 _add_common_filtersz Incident._add_common_filtersp s v KK
fX.> >??E 6>>KK
fTl :;;E F " "KKF=,A ABBE F " "KK((
)>?? E r8 ) NNNNNNNNNNNNrh )"r9 r: r; __doc__r
r r ra r r rH r rc r r- r rt rI r r rQ rf classmethodrk r r strr r r r re r r rP r8 r7 r> r> 7 sz >>
$T 2 2 2B
YD
!
!
!F 9$ D
%%%I l%%%G
|&&&H 9$ D .d+++K
YD
!
!
!FiT|<< /32 2S2 "#c(+2
c8C= ! 2 2 2 [2h K K \K [ r8 r> c " e Zd ZdZ G d d Z e Z ed Z ed Z e
d Z e de
e fd Ze dd Ze d
Ze d Ze dd
Ze d ZdS ) DisabledRulez'Provides a way to ignore certain rules.c $ e Zd Zej ZdZdZdS )DisabledRule.Metadisabled_rules))ra rule_idTN)r9 r: r; r rK rL rM rN rP r8 r7 rQ r s ;#2r8 rQ FrA r c D fd D S )Nc z g | ]7}j j |j j j |j j j |j i8S rP )ra r r )rV r rj s r7 r z(DisabledRule.as_list.. sO
$,
ty
r8 )r| )rj s `r7 as_listzDisabledRule.as_list s8
r8 Nc | || }|j r|d |j D v S dS # | j $ r Y nw xY wdS )Nr c 3 $ K | ] }|j V d S rh r rV ds r7 rZ z/DisabledRule.is_rule_ignored.. s$ !?!?q!(!?!?!?!?!?!?r8 TF)r domains DoesNotExist)rj ra r r drs r7 is_rule_ignoredz DisabledRule.is_rule_ignored so 88Bz
!?!?BJ!?!?!???t D us 05
AAc | | j t t j | j |k t j d z z }d |D S )Nc g | ]
}|d S r rP ru s r7 r z4DisabledRule.get_global_disabled.. 0003I000r8 )
r| r r} DisabledRuleDomainr r~ r ra r dicts)rj ra r s r7 get_global_disabledz DisabledRule.get_global_disabled st
JJs{ # #
T$do
6
6
Uv%*<*Ct*KL UWW
10%0000r8 c | | j t | j |k t j |k }d |D S )Nc g | ]
}|d S r rP ru s r7 r z4DisabledRule.get_domain_disabled.. r r8 )r| r r} r r ra r r )rj ra r r s r7 get_domain_disabledz DisabledRule.get_domain_disabled sf
JJs{ # #
T$
%
%
U3:');)Bf)L
M
M
UWW 10%0000r8 r c | | j | j | | }|t
|| | }t }t || }g }| d }|D ]H} | j | j | j
d d}
| j rd | j D |
d< | |
I||fS )NT) clear_limit)ra r r r c g | ] }|j
S rP r r s r7 r z&DisabledRule.fetch.. s "B"B"B18"B"B"Br8 r )
r| r ra r r r r r r countr r append) rj r r r rules_query
domains_queryrules_with_domains_queryr max_countr items r7 fetchzDisabledRule.fetch s
JJLL
Xcj#+
.
.
U5\\
VF^^ (3 DDK*1133
#+K #G#G %%$%77 ,
D +l D |
C"B"BT\"B"B"BY MM$ & r8 c t ||| }|D ] }t || d S # t
$ r t || }|r)|D ]#}t |j | $Y d S t
t j |j k Y d S w xY w)N)ra r r )disabled_rule_id_idr r ) r insertr r creater r
create_or_getr deleter r )r4 ra r r r inserted_idr r s r7 storezDisabledRule.store s9 &-- r . gii
"))(3A *
!!!< r r rP r8 r7 r sx , , , , , , , , , , , , . - - - - - 1 1 1 1 1 1 1 1 ? ? ? ? ? ? ( ' ' ' ' ' 6 6 6 6 6 6 6 6 &E E E E EY E E E
E E E E Eu E E EP
n n n n n5 n n nbD D D D D D D D D Dr8