$6L`s d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
ddlmZmZ ddlmZmZmZ dd lmZmZmZmZ dd
lmZ dd lm Z dd l m Z m Z m Z dd
l!m"Z"m#Z# ddl$m%Z% ddl&m'Z'm(Z(m)Z) ddl*m+Z+ ddl,m-Z-m.Z. ddl/m0Z0m1Z1 ddl2m3Z4 ddl5m6Z6m7Z7 ddl8m9Z9 ej: e; Z< e d Z= G d d Z> G d de Z? G d d Z@d ZAd ZBdS ) ztThis plugin periodically checks set of rules and ipsets,
and recreates it if needed, process block/unblock messages. N)suppress)Path)Set)g)log_error_and_ignoretimeit)DAY ServiceBase
rate_limit)FirewallNetworkInterfaceDOS EnhancedDOS) Protector) Webshield)IPSetNoRedirectPortRuleSet ip_versions)
IPSetError$IPSetCannotBeSwappedIncompatibleType) get_firewall)FirewallBatchCommandError
FirewallErrorFirewallTemporaryError) IPSetCountry) IPSetStaticIPSetStaticRemoteProxy) InputPortBlockingDenyModeIPSet OutputPortBlockingDenyModeIPSet)Mode)IP IPVersion)
smtp_blockingz(/var/imunify360/.rules_check_in_progressc e Zd Zd ZdS ) VersionStatec > d| _ d| _ d| _ d| _ d S )NFr g T)transient_error_on_createerrors
next_try_timerunningselfs J/opt/imunify360/venv/lib/python3.11/site-packages/im360/utils/lazy_init.py__init__zVersionState.__init__3 s$ ).& N)__name__
__module__ __qualname__r. r/ r- r% r% 2 s# r/ r% c e Zd ZdZ eej dd ZdZ dZ
dZ dZ dZ
eZej dhej d hiZ fd
Zd(d)dZ ee e d Zd(dZ d(deded d
fdZ d(d e fdZ d*dZ de de de de!e" de!e" d e!e" d e fd Z# d(de de d e fd Z$de d d
fd Z%de d d
fd!Z&de d e fd"Z' d+d#Z(d,d)d$Z)d,d)d%Z*d(d&Z+e,d' Z- xZ.S )- RulesCheckerz=Periodically checks if rules exist and if not, recreate them. IMUNIFY360_RULE_CHECK_INTERVAL
i Ti, z i360.ipv4.whitelist.host_ipsz i360.ipv6.whitelist.host_ipsc t | t | _ t j | _ t j | _ d t j D | _ d | j D | _
d t j D | _ t j | _ d S )Nc , i | ]}|t S r3 )r% .0vers r-
z)RulesChecker.__init__..Y s JJJlnnJJJr/ c 6 i | ]}|t j S r3 )asyncioEventr; s r- r> z)RulesChecker.__init__..Z s- (
(
(
%(C (
(
(
r/ c , i | ]}|t S r3 )setr; s r- r> z)RulesChecker.__init__..] s H H HsSUU H H Hr/ )superr. r rulesetConfigRULE_EDIT_LOCKlock_rules_create_destroyr
get_interface_confactive_interface_confr allversions_ipsets_outdated_eventsoutdated_ipsetsr@ Lock
ipset_lock)r, loop __class__s r- r. zRulesChecker.__init__M s
yy *0)>&%5%H%J%J"JJ 8I8IJJJ
(
(
,0M(
(
(
$ I Hko6G6G H H H !,..r/ FreturnNc K | j 4 d {V t j }|| j k s;t d | | j d {V nM| j D ]3\ }}| j | j r |
|| d {V 4| || d {V || _ d d d d {V d S # 1 d {V swxY w Y d S )Nz>Target & ignore interfaces config was changed,recreating rules) rH r
rI rJ loggerinfo_destroy_rules_and_setsrL itemsr' %_RulesChecker__check_ipset_consistent$_ensure_rules_exist_for_all_versions)r, recreate_any_waynew_confversionstates r- recreate_rules_if_neededz%RulesChecker.recreate_rules_if_needed` s 1 2 2 2 2 2 2 2 2':< K | d {V d S N)_check_ipsets_consistentr+ s r- check_ipsets_consistentz$RulesChecker.check_ipsets_consistents s2 ++-----------r/ c K | j 4 d {V | j D ]"\ }}| ||| d {V # d d d d {V d S # 1 d {V swxY w Y d S rb )rH rL rX rY )r, check_allr] r^ s r- rc z%RulesChecker._check_ipsets_consistentx sI 1 O O O O O O O O"&-"5"5"7"7
O
O33GUINNNNNNNNNN
O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O Os =A!!
A+.A+r] r^ c Z K t d| t j 5 |j r| j | | j |< | j || d {V x}rWt d |D }| j | | t
| d nz8RulesChecker.__check_ipset_consistent.. s5 * **2
* * * * * *r/ z# ipsets are outdated. Recreate themzOnly host ipsets z, z will be updated)
r rU rV r* HOST_IPSETSrN rE get_outdated_ipsetsrC updatewarningjoinrM )r, r] r^ rf outdatedrN s r- __check_ipset_consistentz%RulesChecker.__check_ipset_consistent} s 999v{
K
K
K < <}
<040@0I$W-%)\%E%EY& & 8 '* * *6>* * * ' 'O (188 IIINN#HHH KK& IId&6w&? @ @& & &
,W599;;;+ < < < < < < < < < < < < < < < < < d }~wt$ $ r}t j | } | rd} j | xj dz
c_ j | j j k rIt j | r5
j z j | _ t d| n
j z j | _ t d | rd
nd || Y d }~$d }~ww xY w|o| S ) Nc 3 p K | ]0}t j | sj | j k ,|V 1d S rb )r
is_enabledrL r) )r< r] nowr, s r- rm z-RulesChecker._ensure_rules.. s[
&w//
=)7#==
>===
r/ FTr z %s firewall support is enabledz8Transient error while creating firewall rules for %s: %s zB%s firewall support is disabled due to multiple consecutive errorsz/Failed to recreate firewall rules for %s %s: %senableddisabled)time monotonicrC r rK rL r* rP _ensure_forr( r' rw enablerU rV r r
isinstancer ERROR_THRESHOLDdisableRETRY_INTERVALr) rq ) r, interface_confr[ target_versions
recreated_any
has_failedr] rexcenabled_ip_versionrx s ` @r-
_ensure_ruleszRulesChecker._ensure_rules s n
&?,,
& 0 K 0 KG-2DM' " *.
K ? " . . 1A A !. 2
H 26
g&.01
g&-CH
g&@"-g66 K &w///KK @'JJJQ +J7
!
c:.. LGKDM'*D N
!
%0%;G%D%D"% !%JM'*11Q611}W-48LLL&.w77 #d&9 9 !M' 2 @ #KK!B ' d 11 M'*8 E!3CII '
D /Z /sJ !
D-. B D-
B( (D-+B( ,D--I4>AF
I4CI//I4c K |p| j }| || d {V r t d d S d S )Nz=Rules and sets successfully recreated for enabled ip versions)rJ r rU rV )r, r r[ s r- rZ z1RulesChecker._ensure_rules_exist_for_all_versions sm (E4+E##N4DEE E E E E E E KKO
r/
ip_versionr recreate_ipsetsrN missing_ipsetsredundant_ipsetsrecreate_rulesc 0 K | j || }|s|rRt d| t j 5 | || d {V d d d n # 1 swxY w Y |rXt d| t j 5 | j || d {V d d d n # 1 swxY w Y n| j | |rWt d| t j 5 | j || d {V d d d n # 1 swxY w Y |s|rRt d| t j 5 | || d {V d d d n # 1 swxY w Y |rt dt j 5 | j
|| d {V n# t $ r t d | || d {V | j || d {V | j || d {V | || d {V Y nw xY wd d d d S # 1 swxY w Y d S d S )NzDestroying rules for rh z Destroying redundant ipsets: zCreating missing ipsets: zRecreating rules for zRecreating ipsetszrOutdated ipset has incompatible type, so it cannot be swapped. Ipset needs to be recreated after destroying rules.)
rE has_ipset_to_destroyr rU rV _destroy_rulesdestroy_ipsets clean_previously_failed_ipsets fill_ipsets
_create_rulesr r rq ) r, r r r rN r r r we_have_ipsets_to_destroys r-
_recreate_forzRulesChecker._recreate_for s, %)L$E$E (%
%
! F 6 F<
<<&+NNN
F
F)).*EEEEEEEEE
F
F
F
F
F
F
F
F
F
F
F
F
F
F
F DB0@BBK
P
P l11*>NOOOOOOOOO
P
P
P
P
P
P
P
P
P
P
P
P
P
P
P
L 7 7
C C C KJJJJJJJJJ
K
K
K
K
K
K
K
K
K
K
K
K
K
K
K
E 6 E<
<<&+NNN
E
E(( DDDDDDDDD
E
E
E
E
E
E
E
E
E
E
E
E
E
E
E I+===
I
II ,66"O < I I INN-
--njIIIIIIIII ,55"O ,22:OOOOOOOOO ,,^ZHHHHHHHHHHH I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I I Is A))A-0A-"CC C"D66D:=D:# F FF4J 6!GJ B I96J 8I99J J
J
c K | j | d{V }| j | }| }| j ||| }||k o"| j | o| }||z
} ||z }|r"||k r t || t j |
|| d{V }
| j | | z
|z
|z } t j
d rt d| t d| t d| t d| t d| t d ||
rd
nd |rd
nd | |
r|r|r|s>| j | | j | t d ||
rd
nd |rd
nd | | ||| | | ||
p|
d{V dS dS )a Creates imunify360 ruleset for given IP version in iptables.
If all required ipsets, rules and chains exist, does nothing.
Otherwise recreates everything as required.
Returns True if rules or sets has been (re-)created, False
otherwise.Nr r ri DEBUGzRequired ipsets: %szExisting ipsets: %szMissing ipsets: %szRedundant ipsets: %szOutdated ipsets: %sz>dbg Rules status for %s [rules: %s], [ipset: %s], [forced: %s]okbadz:Rules status for %s [rules: %s], [ipset: %s], [forced: %s])r rN r r r TF)rE existing_ipsetsrequired_ipsetscopyipsets_to_refillrM is_set_log_ipsets_mismatchrU rq _rules_okrN r getrV clearr ) r, r r r[ r r r to_refill_ipsets ipsets_okr rules_okrN s r- r~ zRulesChecker._ensure_for s !% < >
KK- ? ? ? KK- ? ? ? KK,n = = = KK.0@ A A A KK- ? ? ? KK +e!,u
Y /?
9,Z8>>@@@$Z066888 KKL +e!,u
$$ $-
/!1 -#+| ?/? %
4ur/ c K t d| t | d {V 4 d {V }| j | D ]I}t t 5 | | d {V d d d n # 1 swxY w Y J| j ||| d {V }| | d {V d d d d {V d S # 1 d {V swxY w Y d S )NzCreating rules for %s) rU rV r rE persistent_chain_commandsr r commitcreate_commands)r, r r firewallcmdsbatchs r- r zRulesChecker._create_rulesm s +Z888%j11111111 ) ) ) ) ) ) )X >>xHH
0
0 788 0 0"//$/////////0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ,66.* E //%(( ( ( ( ( ( ( ( ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) )s6 1C.* B C.B C.B AC..
C8;C8c K t d| t | d {V 4 d {V }| j ||| D ]I}t t 5 | | d {V d d d n # 1 swxY w Y J d d d d {V d S # 1 d {V swxY w Y d S )NzDestroying rules for %s)rU rV r rE destroy_commandsr r r )r, r r r r s r- r zRulesChecker._destroy_rulesz s -z:::%j11111111 1 1 1 1 1 1 1X 66.*
1
1 788 1 1"//%0000000001 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1s5 3B4, B B4B B4B B44
B>B>c K t | d {V 4 d {V }| j ||| d {V } | | d {V n"# t $ r Y d d d d {V dS w xY w| j || d {V }| j || d {V }|o|cd d d d {V S # 1 d {V swxY w Y d S NF)r rE check_commandsr r check_input_ordercheck_output_order)r, r r r actionsinput_order_okoutput_order_oks r- r zRulesChecker._rules_ok s/ %j11111111 6 6 6 6 6 6 6X L 7 7.* G
oog..........,
6 6 6 6 6 6 6 6 6 6 6 6 6 6
$(<#A#A*$ $ N %)L$C$C*% % O "5o 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s6 #CA C
A=(C<A==AC
C"%C"c K g }t j D ]}d| j | _ |r | || d {V |r"| j || d {V X# t $ r }| | Y d }~|d }~ww xY w|sd S t | dk r|d t | dk r|d |d J d )NF)forcery r zmax 2 ip versions expected)
r rz rL r* r rE r Exceptionappendlen)r, r
destroy_rulesr force_destroy_ipsetr( r es r- rW z$RulesChecker._destroy_rules_and_sets sP %-//
!
!J05DM* % -
! J --njIIIIIIIII! ,55"*= 6
!
!
!
a
! 3 F
[[A
)O
[[A
) * 22 2 21s AA00
B:BBc K |p| j }| j 4 d {V | |d d {V d d d d {V d S # 1 d {V swxY w Y d S )NT)r rJ rH rW r, r s r- clear_everythingz RulesChecker.clear_everything s 'E4+E1 .. D /
A
AAc K |p| j }| j 4 d {V | |d d {V d d d d {V d S # 1 d {V swxY w Y d S )NF)r r r s r- clear_ruleszRulesChecker.clear_rules s 'E4+E1 .. u /
r c 4 K t j }|r| | sd S t j d {V sd S t j d {V rt j d {V d S t j | d {V d S rb )r# read_SMTP_settings_is_smtp_settings_changedis_SMTP_blocking_supportedconflicts_exist reset_rules_for_all_versionssync_rules_for_all_versions)r, check_settings new_settingss r- check_smtp_state_and_resetz'RulesChecker.check_smtp_state_and_reset s $799 $"@"@ "N"N F"=???????? F .00 0 0 0 0 0 0 <>> > > > > > > > F7 EEEEEEEEEEEr/ c \ t fdt j D S )Nc 3 $ K | ]
}|k V d S rb r3 )r< active_settingsr s r- rm z9RulesChecker._is_smtp_settings_changed.. s<
| +
r/ )anyr# get_active_settings_list)r s `r- r z&RulesChecker._is_smtp_settings_changed sD
#0#I#K#K
r/ )FrS Nr )TTFrb )/r0 r1 r2 __doc__intosenvironr RULE_CHECK_INTERVALCONSECUTIVE_ERROR_LIMITr r CAPTURE_CSF_LOCKCSF_LOCK_TIMEOUTr IPSETS_CHECK_INTERVALr! V4V6rn r. r_ r r rd rc r% rY boolr rZ r" dictr strr r~ r r r rW r r r staticmethodr
__classcell__)rR s @r- r5 r5 : s6 GG #
7<< !ON ./
./K
) ) ) ) )&2 2 2 2 2& Z,---. . .-.O O O O "%+"D1D 4 4 6 6
,
( ):)<)< = = # & "
r/ c t j t j t j t j t j t j t j t j fS rb ) r TCP_IN_IPV4 TCP_OUT_IPV4 UDP_IN_IPV4 UDP_OUT_IPV4 TCP_IN_IPV6 TCP_OUT_IPV6 UDP_IN_IPV6 UDP_OUT_IPV6r+ s r- r z1RealProtector._get_port_blocking_deny_mode_values s< ! ! ! !
r/ c H K | j j 4 d {V t d t t fD ]0}| r| d {V 1 d d d d {V d S # 1 d {V swxY w Y d S )Nz!Applying global white list update)r rH rU rV r r rw reset)r, ipsets r- process_global_whitelist_updatez-RealProtector.process_global_whitelist_update s> &@ ( ( ( ( ( ( ( ( KK; < < <%--)?)A)AB
(
(##%% ( ++--'''''''
( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (s A(B
B BrS Nc ( K | j j 4 d {V t d t j D ])}t
| d {V * d d d d {V d S # 1 d {V swxY w Y d S )Nz%Updating ipset rules on geo ip update)r rH rU rV r rz r restore)r, r s r- process_country_list_updatez)RealProtector.process_country_list_update s- &@ 9 9 9 9 9 9 9 9 KK? @ @ @ ) 1 3 3
9
9
"nn,,Z8888888888
9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9 9s AB
B B c K d}t j t j t j t j t j f}|| j k r*t d| j | || _ d}t j }| j |k r*t d| j | || _ d}t j p t j }| j |k r*t d| j | || _ d}| j dk }|rw| j d d {V t d |r6| d {V r t d d S d S d S | d {V r t d
d S d S ) NFzWebshield status (Webshield.ENABLE, WebshieldMode.wants_redirect, Webshield.SPLASH_SCREEN, Webshield.PANEL_PROTECTION) changed from %s to %sTz)Ports blocking mode changed from %s to %szSEffective DoS protection status changed from %s to %s. Triggering rules recreation.DENY)r[ z,Firewall rules recreated due to ConfigUpdatez Blocked ports ipsets reffiledz/Blocked ports deny mode updated on ConfigUpdate)r r r r r r r r rU rV r r r r r r r r r_ _refill_port_blocking_ipsets0_update_port_blocking_deny_mode_ipsets_if_needed)r, messagerecreatecurrent_statuscurrent_port_blocking_modecurrent_dos_enabledrefill_bp_ipests r- _on_config_update_unlockedz(RealProtector._on_config_update_unlocked s3 ( ):)<)< = = # &
T 3 3 3 KKD &
&4D "H%-%@" #'A A A KK;(*
(BD $H !k @[-@ 3 3 3 KK>!#
!4D H 2f<
K%>>!% ?
KKF G G G
=)J)J)L)L#L#L#L#L#L#L
= ;<<<<<
=
=
=
= GGII I I I I I I K
KKI J J J J J K Kr/ c K d}| }|| j k r\t dt | j t | || _ | d {V }|S )NFz-Port blocking deny mode changed from %s to %s)r r rU rV
_format_portsr )r, updatednew_ports_blocking_valuess r- r z>RealProtector._update_port_blocking_deny_mode_ipsets_if_needed: s $($L$L$N$N! $(L L L KK? d BCC 788
4MD 0 = = ? ???????Gr/ c K d}| j j 4 d {V t t t g}|D ]} | t j d {V | t j d {V N# t $ r2}t d|j j
| d}Y d }~d }~ww xY w d d d d {V n# 1 d {V swxY w Y |S )NTz Failed to update ipset %s: %sF)r rH r r r r r! r r r rU errorrR r0 )r, r setsip_setr s r- r z*RealProtector._refill_port_blocking_ipsetsH s &@ .00/11#%%D
..///////// ..//////////! LL7 (1
$G HHHH
& s< .C#A
BC#
C
(CC#C
C##
C-0C-r ) r0 r1 r2 r5 __annotations__r. r r r r r r r3 r/ r- r r s
( ( (9 9 9 9 0K 0K 0Kd r/ r c | s|sJ |ddt | z dt | o| z dt | z d| t | z d| t | z dS )z Report missing/redundant ipsets.z6Detected %s%s%s ipsets while ensuring ipsets/rules%s%smissing/ redundantz; missing ipsets: z; redundant ipsets: N)r r s r- r r ` s - --- -C@D ((( d>6&6777d+,,,-^--^0D0DD1 /11D9I4J4JJ
r/ c d d}t j t t || S )zFormat ports for logging.)r r r r r r r r )jsondumpsr zip)portsnamess r- r r m s-
E :d3ue,,-- . ..r/ )Cr r@ r& loggingr r|
contextlibr pathlibr typingr &defence360agent.internals.global_scoper defence360agent.utilsr r defence360agent.utils.commonr r
r im360.contracts.configr r
r r r rF r im360.internals.corer r r #im360.internals.core.ipset.libipsetr r im360.internals.core.firewallr "im360.internals.core.firewall.baser r r "im360.internals.core.ipset.countryr im360.internals.core.ipset.ipr r $im360.internals.core.ipset.port_denyr r im360.subsys.webshield_moder r defence360agent.utils.validater! r" im360.subsysr# getLoggerr0 rU RULES_CHECK_IN_PROGRESSr% r5 r r r r3 r/ r- r? s ? ? 4 4 4 4 4 4 > > > > > > > > E E E E E E E E E E O O O O O O O O O O O O 6 6 6 6 6 6 , , , , , , J J J J J J J J J J 7 6 6 6 6 6
< ; ; ; ; ; > = = = = = 8 8 8 8 8 8 8 8 & & & & & & 8 $ $ $ IJJ ]
]
]
]
]
; ]
]
]
@
C C C C C C C CL
/
/
/
/
/r/