server/api/pages/rules.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
########################################################################
# OPENAPI-URI: /api/rules
########################################################################
# delete:
#   requestBody:
#     content:
#       application/json:
#         schema:
#           $ref: '#/components/schemas/Ruleset'
#     description: Removes a rule entry
#     required: true
#   responses:
#     '200':
#       content:
#         application/json:
#           schema:
#             $ref: '#/components/schemas/ActionCompleted'
#       description: Removal successful
#     default:
#       content:
#         application/json:
#           schema:
#             $ref: '#/components/schemas/Error'
#       description: unexpected error
#   security:
#   - cookieAuth: []
#   summary: Remove a rule entry
# get:
#   responses:
#     '200':
#       content:
#         application/json:
#           schema:
#             $ref: '#/components/schemas/Empty'
#       description: 200 response
#     default:
#       content:
#         application/json:
#           schema:
#             $ref: '#/components/schemas/Error'
#       description: unexpected error
#   security:
#   - cookieAuth: []
#   summary: Displays the current ruleset entries
# put:
#   requestBody:
#     content:
#       application/json:
#         schema:
#           $ref: '#/components/schemas/Ruleset'
#     description: Ruleset to add/modify
#     required: true
#   responses:
#     '200':
#       content:
#         application/json:
#           schema:
#             $ref: '#/components/schemas/ActionCompleted'
#       description: Ruleset added
#     default:
#       content:
#         application/json:
#           schema:
#             $ref: '#/components/schemas/Error'
#       description: unexpected error
#   summary: Adds or overrides a ruleset
#
########################################################################





"""
This is the ruleset handler for Blocky/2
"""

import json
import re
import time
import bcrypt
import hashlib
import plugins.worker
import uuid

def run(API, environ, indata, session):
    global WHITE_CACHE, WHITE_TS
    method = environ['REQUEST_METHOD']

    # Adding a new entry?
    if method == "PUT":
        rid = indata.get('rid')
        submitter = environ.get('HTTP_PROXY_USER', 'Admin')
        name = indata.get('name')
        rtype = indata.get('type')
        span = indata.get('span')
        limit = indata.get('limit')
        query = indata.get('query')

        # all good? Okay, add the entry then
        entry = {
            'name': name,
            'type': rtype,
            'query': query,
            'span': span,
            'limit': limit
        }
        if not rid:
            rid = str(uuid.uuid4())
            plugins.worker.addnote(session.DB, 'manual', "%s made a new ruleset %s (%s)" % (submitter, rid, name))
        else:
            plugins.worker.addnote(session.DB, 'manual', "%s updated ruleset %s (%s)" % (submitter, rid, name))

        session.DB.ES.index(index=session.DB.dbname, doc_type = 'rule', id = rid, body = entry, refresh = 'wait_for')
        yield json.dumps({"message": "Ruleset added!"})
        return

    # Delete an entry
    if method == "DELETE":
        rid = indata.get('rid')
        submitter = environ.get('HTTP_PROXY_USER', 'Admin')
        if re.match(r"^[-a-f0-9]+$", rid):
            if session.DB.ES.exists(index=session.DB.dbname, doc_type='rule', id = rid):
                doc = session.DB.ES.get(index=session.DB.dbname, doc_type='rule', id = rid)['_source']
                plugins.worker.addnote(session.DB, 'manual', "Ruleset %s (%s) removed by %s" % (rid, doc.get('name', '??'), submitter))
                session.DB.ES.delete(index=session.DB.dbname, doc_type='rule', id = rid, refresh = 'wait_for')
            yield json.dumps({"message": "Entry removed"})
            return
        yield API.exception(400, "Invalid rule ID passed!")

    # Display the current ruleset entries
    if method == "GET":
        rules = []
        res = session.DB.ES.search(
                index=session.DB.dbname,
                doc_type="rule",
                size = 5000,
                body = {
                    'query': {
                        'match_all': {}
                    }
                }
            )

        for hit in res['hits']['hits']:
            doc = hit['_source']
            doc['rid'] = hit['_id']
            rules.append(doc)
        JSON_OUT = {
            'rules': rules
        }
        yield json.dumps(JSON_OUT)
        return

    # Finally, if we hit a method we don't know, balk!
    yield API.exception(400, "I don't know this request method!!")