def run(self): ip = self.params['IP'] data_info = dict() data_info['DescribeIPFirewallProtectData'] = dict() firewall = Firewall(self.application.ccfirewall) protect_dict = firewall.query_protect_serial_number(ip) try: param_set = self.application.param_set_dict[ protect_dict['param_set']] port_tcp = self.application.port_tcp_dict[protect_dict['PortTCP']] except KeyError: res = sc(code.IPNotExist) res.result = res.result % ip raise gen.Return(res) # if param_set == '0': # result = 'loose' # elif param_set == '1': # result = 'medium' # elif param_set == '2': # result = 'tight' if int(param_set) > 2: param_set = 'Not in correct global protect level' if int(port_tcp) > 2: port_tcp = 'Not in correct web protect level' data_info['DescribeIPFirewallProtectData'][ 'GlobalProtectLevel'] = param_set data_info['DescribeIPFirewallProtectData'][ 'WebProtectLevel'] = port_tcp res = sc(code.Success) res.redata = data_info raise gen.Return(res)
def delete_firewall_configs(self, ip): fw_condition = {} firewall = Firewall(self.application.ccfirewall) if len(firewall.query_protect_serial_number(ip)) > 1: if firewall.set_protect_serial_number(ip, param_set='0', set_tcp='0'): pass else: fw_condition['cc防护'] = '删除CC防护配置失败' return fw_condition
def reset_block( self, source_ip, remote_ip, operator, ): firewall = Firewall(operator) if firewall.reset_block_list(source_ip, remote_ip): return 200 else: return 408
def delete_white_list(operator, hostname): zhifirewalllist = ['ctc', 'cmcc'] firewall = ZhiFirewall( operator) if operator in zhifirewalllist else Firewall(operator) if netutil.is_valid_ip(hostname) is True: return firewall.del_white_list(hostname) else: return firewall.del_domain_name(hostname)
def select_domain(self, operator, hostname): firewall = ZhiFirewall( operator ) if operator in self.application.zhifirewalllist else Firewall( operator) # firewall = Firewall(operator) if firewall.query_domain_name(hostname): return hostname + ':域名在白名单' else: return hostname + ':域名不在名单'
def select_ip(self, operator, hostname): firewall = ZhiFirewall( operator ) if operator in self.application.zhifirewalllist else Firewall( operator) result = firewall.select_white_list(hostname) if result == 'white': return hostname + ':IP在白名单' elif result == 'black': return hostname + ':IP在黑名单' else: return hostname + ':IP不在名单'
def add_domain(self, operator, hostname, data_add, user_dict): firewall = ZhiFirewall( operator ) if operator in self.application.zhifirewalllist else Firewall( operator) if data_add: if str(user_dict)[:-1] in str(data_add[0]): # 本人加的 if firewall.add_domain_name(hostname): return hostname + ':域名添加至白名单' else: return sc(code.FirewallConnFail).result % hostname else: return sc(code.DomainError).result % hostname else: # 没有人有加 if firewall.add_domain_name(hostname): return hostname + ':域名添加至白名单' else: return sc(code.FirewallConnFail).result % hostname
def run(self): res = sc(code.Success) res.result = 'Success' action = self.params['Action'] ts = self.application.ts_begin ip_s = self.params['IP'] ip_l = self.params['IP'].split(',') user_org = self.params['AccessKeyId'] user_end = self.params['IPUserID'] if 'IPUserID' in self.params else None protect_base = self.params['guaranteeProtectGroupID'] protect_max = self.params['elasticProtectGroupID'] bandtype = self.params['BandwithType'] region = self.params['Region'] zone = self.params['Zone'] sql = 'SELECT ip FROM t_ip_protect where ip in %s and status=True' data = self.application.dbcur.queryall_dict(sql, (tuple(self.makeinet(x) for x in ip_l),)) ip_check = [x['ip'].addr for x in data] if ip_check: res = sc(code.IPConflict) res.result = res.result % ','.join(ip_check) raise gen.Return(res) gua_sql = "SELECT id FROM t_protect WHERE protect_id=%s" ela_sql = "SELECT id FROM t_protect WHERE protect_id=%s" gua_id = self.application.dbcur.queryone(gua_sql, (protect_base,)) ela_id = self.application.dbcur.queryone(ela_sql, (protect_max,)) if gua_id[0] > ela_id[0]: res = sc(code.ParamError) res.result = res.result % '保底需小于弹性' raise gen.Return(res) for ip in ip_l: t_ip_protect_data = {} t_ip_protect_data['ip'] = self.makeinet(ip) t_ip_protect_data['user_org'] = user_org t_ip_protect_data['user_end'] = user_end if user_end else None t_ip_protect_data['protect_base'] = \ self.application.dbcur.queryone( "select protect from v_protect where protect_id=%s and bandtype_id=%s;", (protect_base, bandtype))[0] t_ip_protect_data['protect_max'] = \ self.application.dbcur.queryone( "select protect from v_protect where protect_id=%s and bandtype_id=%s;", (protect_max, bandtype))[0] t_ip_protect_data['protect_state'] = 2 t_ip_protect_data['ts_open'] = ts t_ip_protect_data['region'] = \ self.application.dbcur.queryone("select id from t_region where region_id=%s;", (region,))[0] t_ip_protect_data['zone'] = \ self.application.dbcur.queryone("select id from t_zone where zone_id=%s;", (zone,))[0] serialnum = str(uuid.uuid1()) t_ip_protect_data['serialnum'] = serialnum t_ip_protect_data['iptype'] = 0 t_ip_protect_data['status'] = True t_ip_protect_data['bandtype'] = self.application.dbcur.queryone( "select id from t_bandtype where bandtype_id=%s;", (bandtype,))[0] self.application.dbcur.insert_dict('t_ip_protect', t_ip_protect_data) self.application.dbcurflow.execute('delete from t_ip_credit where ip=%s;',(t_ip_protect_data['ip'],)) self.application.dbcurflow.execute('insert into t_ip_credit(uts,ip,points) values(%s,%s,%s)',(ts,t_ip_protect_data['ip'],self.application.dbcur.queryone('select max_bps_in/1000/1000/1000 from t_protect where id=%s;',(t_ip_protect_data['protect_base'],))[0])) firewall = Firewall(self.application.ccfirewall) firewall.set_protect_serial_number(ip, param_set='0') # sql = 'insert into t_ip_protect_his(ip,user_org,user_end,protect_base,protect_max,protect_state,ts_open,ts_shut,metric_pct_bps,metric_pct_pps,region,zone,serialnum,cts,actions,iptype,bandtype) select ip,user_org,user_end,protect_base,protect_max,protect_state,ts_open,ts_shut,metric_pct_bps,metric_pct_pps,region,zone,serialnum,%s,%s,iptype,bandtype from t_ip_protect where serialnum=%s;' # self.application.dbcur.execute(sql, (ts, action, serialnum)) self.application.history_backup_t_ip_protect(column_extra_value=",'{cts}','{action}'".format(cts=ts, action=action), filter="serialnum='{serialnum}'".format(serialnum=serialnum)) raise gen.Return(res)
def run(self): operator = self.params['Operator'] hostname = self.params['Hostname'] user_org = self.params['AccessKeyId'] user_end = self.params['IPUserID'] ip = self.params['IP'] if 'IP' in self.params else None package_id = self.params['PackageID'] if 'PackageID' in self.params else None ts = self.application.ts_begin sql = "select user_org,user_end,ip,package_protect_id,status from t_firewall WHERE hostname=%s and status>0" data_add = self.application.dbcur.queryall_dict(sql, (hostname,)) if netutil.is_valid_ip(hostname): res = sc(code.ParamError) res.result = res.result % hostname raise gen.Return(res) if len(data_add) == 0: res = sc(code.PermissionDenied) res.result = res.result % hostname raise gen.Return(res) if ip is None and package_id is None: res = sc(code.ParamError) res.result = res.result % 'IP与包ID至少择一提交' raise gen.Return(res) data_info = {} data_status = {} thread_list = [] status_num = data_add[0]['status'] user_dict = {'user_org': user_org, 'user_end': user_end, 'ip': ip, 'package_protect_id': package_id} condition = 0 fw_list = self.application.firewalllist if operator == 'bgp' else [self.application.ccfirewall, operator] for i in fw_list: fw_num = ZhiFirewall(i) if i in self.application.zhifirewalllist else Firewall(i) condition += 2**fw_num.number if condition != status_num: res = sc(code.ParamError) res.result = res.result % operator raise gen.Return(res) for i in fw_list: t = MyThread(self.del_domain, args=(i, hostname, data_add, user_dict)) thread_list.append(t) for t in thread_list: t.start() for t in thread_list: t.join() for index, item in enumerate(thread_list): data_status[fw_list[index]] = item.get_result() for k, v in data_status.items(): if '删除' in v: firewall = ZhiFirewall(k) if k in self.application.zhifirewalllist else Firewall(k) status_num = status_num ^ 2**firewall.number if ip is None: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE user_org=%s AND user_end=%s AND hostname=%s AND ip IS NULL AND package_protect_id=%s' self.application.dbcur.execute(update_sql, (status_num, ts, user_org, user_end, hostname, package_id,)) elif package_id is None: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE user_org=%s AND user_end=%s AND hostname=%s AND ip=%s AND package_protect_id IS NULL' self.application.dbcur.execute(update_sql, (status_num, ts, user_org, user_end, hostname, ip,)) else: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE user_org=%s AND user_end=%s AND hostname=%s AND ip=%s AND package_protect_id=%s' self.application.dbcur.execute(update_sql, (status_num, ts, user_org, user_end, hostname, ip, package_id,)) else: condition = '' if isinstance(condition, int): data_info['DeleteDomainWhiteList'] = operator + ':域名从白名单删除' res = sc(code.Success) res.redata = data_info else: data_info['DeleteDomainWhiteList'] = operator + ':此域名已被他人配置' res = sc(code.ChangeFail) res.result = res.result % data_info raise gen.Return(res)
def run(self): ip = self.params['IP'] # ip = '45.126.122.111' user_org = self.params['AccessKeyId'] user_end = self.params[ 'IPUserID'] if 'IPUserID' in self.params else None ps_level = self.params[ 'GlobalProtectLevel'] if 'GlobalProtectLevel' in self.params else None pt_level = self.params[ 'WebProtectLevel'] if 'WebProtectLevel' in self.params else None sql = "SELECT user_end FROM t_ip_protect WHERE user_org=%s AND ip=%s AND status=TRUE;" userid_list = self.application.dbcur.queryall_dict( sql, ( user_org, ip, )) userid = userid_list[0]['user_end'] if len(userid_list) == 0: res = sc(code.NotInCorrectStatus) res.result = res.result % ip firewall = Firewall(self.application.ccfirewall) if ps_level is None: protect_dict = firewall.query_protect_serial_number(ip) ps_level = protect_dict['param_set'] else: try: ps_level_int = int(ps_level) except ValueError: res = sc(code.ProetctLevelNotExist) res.result = res.result % ps_level raise gen.Return(res) if ps_level_int < 0 or ps_level_int > 2: res = sc(code.ProetctLevelNotExist) res.result = res.result % ps_level_int raise gen.Return(res) v = list(self.application.param_set_dict.values()) k = list(self.application.param_set_dict.keys()) ps_level = k[v.index(ps_level)] if pt_level is None: protect_dict = firewall.query_protect_serial_number(ip) pt_level = protect_dict['PortTCP'] else: try: pt_level_int = int(pt_level) except ValueError: res = sc(code.ProetctLevelNotExist) res.result = res.result % pt_level raise gen.Return(res) if pt_level_int < 0 or pt_level_int > 2: res = sc(code.ProetctLevelNotExist) res.result = res.result % pt_level_int raise gen.Return(res) v = list(self.application.port_tcp_dict.values()) k = list(self.application.port_tcp_dict.keys()) pt_level = k[v.index(pt_level)] data_info = dict() data_info['SetIPFirewallProtectData'] = [] if userid is None or userid == user_end: if firewall.set_protect_serial_number(ip, param_set=ps_level, set_tcp=pt_level): data_info['SetIPFirewallProtectData'].append(ip + '防护策略已设置') res = sc(code.Success) res.redata = data_info else: res = sc(code.IPNotExist) res.result = res.result % ip else: res = sc(code.PermissionDenied) res.result = res.result % ip raise gen.Return(res)
def run(self): operator = self.params['Operator'] hostname = self.params['Hostname'] user_org = self.params['AccessKeyId'] user_end = self.params['IPUserID'] ip = self.params['IP'] if 'IP' in self.params else None package_id = self.params['PackageID'] if 'PackageID' in self.params else None ts = self.application.ts_begin sql = "select user_org,user_end,ip,package_protect_id,status from t_firewall WHERE hostname=%s and status>0" data_add = self.application.dbcur.queryall_dict(sql, (hostname,)) if not netutil.is_valid_ip(hostname): res = sc(code.ParamError) res.result = res.result % hostname raise gen.Return(res) if ip is None and package_id is None: res = sc(code.ParamError) res.result = res.result % 'IP与包ID至少择一提交' raise gen.Return(res) num_sql = "SELECT count(1) FROM t_firewall WHERE user_end=%s AND types=1 AND status>0 " if ip is None: num_sql = num_sql + "AND package_protect_id=%s;" num_data = self.application.dbcur.queryall_dict(num_sql, (user_end, package_id,)) elif package_id is None: num_sql = num_sql + "AND ip=%s;" num_data = self.application.dbcur.queryall_dict(num_sql, (user_end, ip,)) else: num_sql = num_sql + "AND ip=%s AND package_protect_id=%s;" num_data = self.application.dbcur.queryall_dict(num_sql, (user_end, ip, package_id,)) if num_data[0]['count'] > self.application.wlmaxvalue[0]: res = sc(code.MaxWhiteList) raise gen.Return(res) data_info = {} data_status = {} thread_list = [] status_num = 0 user_dict = {'user_org': user_org, 'user_end': user_end, 'ip': ip, 'package_protect_id': package_id} condition = 0 fw_list = self.application.firewalllist if operator == 'bgp' else [self.application.ccfirewall, operator] for i in fw_list: firewall = ZhiFirewall(i) if i in self.application.zhifirewalllist else Firewall(i) condition += 2 ** firewall.number if len(data_add) != 0: if condition != data_add[0]['status']: res = sc(code.ParamError) res.result = res.result % operator raise gen.Return(res) for i in fw_list: t = MyThread(self.add_ip, args=(i, hostname, data_add, user_dict)) thread_list.append(t) for t in thread_list: t.start() for t in thread_list: t.join() for index, item in enumerate(thread_list): data_status[fw_list[index]] = item.get_result() for k, v in data_status.items(): if '添加至' in v: firewall = ZhiFirewall(k) if k in self.application.zhifirewalllist else Firewall(k) status_num = status_num ^ 2**firewall.number sql = "select user_org,user_end,ip,package_protect_id from t_firewall WHERE hostname=%s" data = self.application.dbcur.queryall_dict(sql, (hostname,)) if user_dict in data: if ip is None: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE user_org=%s AND user_end=%s AND hostname=%s AND ip IS NULL AND package_protect_id=%s' self.application.dbcur.execute(update_sql, (status_num, ts, user_org, user_end, hostname, package_id,)) elif package_id is None: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE user_org=%s AND user_end=%s AND hostname=%s AND ip=%s AND package_protect_id IS NULL' self.application.dbcur.execute(update_sql, (status_num, ts, user_org, user_end, hostname, ip,)) else: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE user_org=%s AND user_end=%s AND hostname=%s AND ip=%s AND package_protect_id=%s' self.application.dbcur.execute(update_sql, (status_num, ts, user_org, user_end, hostname, ip, package_id,)) else: white_info = {'user_org': user_org, 'user_end': user_end, 'ip': ip, 'package_protect_id': package_id, 'hostname': hostname, 'types': 1, 'status': status_num, 'createdt': ts} self.application.dbcur.insert_dict('t_firewall', white_info) else: condition = '' if isinstance(condition, int): data_info['AddIPWhiteList'] = operator + ':IP添加至白名单' res = sc(code.Success) res.redata = data_info else: res = sc(code.ChangeFail) res.result = res.result % {operator + ':此IP已被他人配置'} raise gen.Return(res)
def add_ip(self, operator, hostname, data_add, user_dict): firewall = ZhiFirewall(operator) if operator in self.application.zhifirewalllist else Firewall(operator) if firewall.select_white_list(hostname) == 'black': return hostname + ':IP已在黑名单,请联系运维人员' if data_add: if str(user_dict)[:-1] in str(data_add[0]): # 本人加的 if firewall.add_white_list(hostname): return hostname + ':IP添加至白名单' else: return sc(code.FirewallConnFail).result % hostname else: return sc(code.IPError).result % hostname else: # 没有人有加 if firewall.add_white_list(hostname): return hostname + ':IP添加至白名单' else: return sc(code.FirewallConnFail).result % hostname
def run(self): res = sc(code.Success) res.result = 'Success' action = self.params['Action'] packageid = self.params['PackageID'] ip_l = self.params['IP'].split(',') ts = self.application.ts_begin user_org = self.params['AccessKeyId'] user_end = self.params[ 'IPUserID'] if 'IPUserID' in self.params else None sql = 'select id from t_package_protect where package_protect_id=%s and user_org=%s and user_end=%s and protect_state in (1,2) and status=True; ' package = self.application.dbcur.queryall( sql, (packageid, user_org, user_end)) if not package: res = sc(code.PackageStatusError) res.result = res.result % '请先改变高防包服务状态' raise gen.Return(res) sql = 'select (select ipnums from t_package_protect where package_protect_id=%s and status=True)-count(ip)-%s from t_ip_protect where package=%s and user_org=%s and user_end=%s and status=True;' self.application.dbcur.execute( sql, (packageid, len(ip_l), package[0][0], user_org, user_end)) ip_left = self.application.dbcur.fetchall() if ip_left[0][0] < 0: res = sc(code.IPNumsError) res.result = res.result % '添加ip数量超过上限' raise gen.Return(res) sql = 'SELECT host(ip) AS ip FROM t_ip_protect WHERE ip in %s and status=True;' data = self.application.dbcur.queryall_dict( sql, (tuple(self.makeinet(x) for x in ip_l), )) if data: ip_r = [x['ip'] for x in data] if ip_r: res = sc(code.NotCorrectStatus) res.result = res.result % ip_r raise gen.Return(res) for ip in ip_l: t_ip_protect_data = {} t_ip_protect_data['ip'] = self.makeinet(ip) t_ip_protect_data['user_org'] = user_org t_ip_protect_data['user_end'] = user_end if user_end else None t_ip_protect_data['protect_base'] = \ self.application.dbcur.queryone( "select protect_base from t_package_protect where package_protect_id=%s;", (packageid,))[0] t_ip_protect_data['protect_max'] = \ self.application.dbcur.queryone( "select protect_max from t_package_protect where package_protect_id=%s;", (packageid,))[0] t_ip_protect_data['protect_state'] = 2 t_ip_protect_data['ts_open'] = ts serialnum = str(uuid.uuid1()) t_ip_protect_data['serialnum'] = serialnum t_ip_protect_data['iptype'] = 0 t_ip_protect_data['status'] = True band_type = self.application.dbcur.queryone( "select bandtype from t_protect where id=%s;", (t_ip_protect_data['protect_base'], ))[0] t_ip_protect_data['bandtype'] = band_type t_ip_protect_data['package'] = package[0][0] self.application.dbcur.insert_dict('t_ip_protect', t_ip_protect_data) self.application.history_backup_t_ip_protect( column_extra_value=",'{cts}','{action}'".format(cts=ts, action=action), filter="serialnum='{serialnum}'".format(serialnum=serialnum)) # sql = 'insert into t_ip_protect_his(ip,package,user_org,user_end,protect_base,protect_max,protect_state,ts_open,ts_shut,metric_pct_bps,metric_pct_pps,region,zone,serialnum,cts,actions,iptype,bandtype) select ip,package,user_org,user_end,protect_base,protect_max,protect_state,ts_open,ts_shut,metric_pct_bps,metric_pct_pps,region,zone,serialnum,%s,%s,iptype,bandtype from t_ip_protect where serialnum=%s;' # self.application.dbcur.execute(sql, (ts, action, serialnum)) self.application.dbcurflow.execute( 'delete from t_ip_credit where ip=%s;', (t_ip_protect_data['ip'], )) self.application.dbcurflow.execute( 'insert into t_ip_credit(uts,ip,points) values(%s,%s,%s)', (ts, t_ip_protect_data['ip'], self.application.dbcur.queryone( 'select max_bps_in/1000/1000/1000 from t_protect where id=%s;', (t_ip_protect_data['protect_base'], ))[0])) firewall = Firewall(self.application.ccfirewall) firewall.set_protect_serial_number(ip, param_set='0') raise gen.Return(res)
def del_ip(self, operator, hostname, data_add, user_dict): firewall = ZhiFirewall(operator) if operator in self.application.zhifirewalllist else Firewall(operator) if str(user_dict)[:-1] in str(data_add[0]): if firewall.del_white_list(hostname): return hostname + ':IP从白名单删除' else: return sc(code.FirewallConnFail).result % hostname else: return sc(code.IPError).result % hostname
def select_block(self, operator, ip): firewall = Firewall(operator) return firewall.select_block_list(ip)
def delete_ip_white_list(): zhifirewalllist = ['ctc', 'cmcc'] postgre = PostgreSQLDB(CONFIG.PostgreSQLDB.host, CONFIG.PostgreSQLDB.port, CONFIG.PostgreSQLDB.user, CONFIG.PostgreSQLDB.pwd, CONFIG.PostgreSQLDB.dbname) sql = "SELECT p5,p1,p2 FROM t_job WHERE actions='DeleteWhiteList' AND ts_actions<=now();" data = postgre.dbcur.queryall_dict(sql) if data: for i in data: wl_condition = {} ipOrPackage = i['p5'] hostname = i['p1'] status_num = int(i['p2']) thread_list = [] if status_num == 15: firewalllist = ['ctc', 'cmcc', 'cnc', 'cc'] elif status_num == 12: firewalllist = ['ctc', 'cc'] elif status_num == 10: firewalllist = ['cmcc', 'cc'] elif status_num == 9: firewalllist = ['cnc', 'cc'] else: break for j in firewalllist: t = MyThread(delete_white_list, args=(j, hostname)) thread_list.append(t) for t in thread_list: t.start() for t in thread_list: t.join() for index, item in enumerate(thread_list): wl_condition[firewalllist[index]] = item.get_result() for k, v in wl_condition.items(): if v is True: firewall = ZhiFirewall( k) if k in zhifirewalllist else Firewall(k) status_num = status_num ^ 2**firewall.number if len(ipOrPackage) > 20: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE hostname=%s AND package_protect_id=%s;' postgre.dbcur.execute(update_sql, ( status_num, datetime.datetime.now(), hostname, str(ipOrPackage), )) else: update_sql = 'UPDATE t_firewall SET status=%s, updatedt=%s WHERE hostname=%s AND ip=%s;' postgre.dbcur.execute(update_sql, ( status_num, datetime.datetime.now(), hostname, str(ipOrPackage), )) update_sql = 'UPDATE t_job SET p2=%s WHERE p1=%s AND p5=%s;' postgre.dbcur.execute(update_sql, ( status_num, hostname, ipOrPackage, )) postgre.dbcur.execute( "DELETE FROM t_job WHERE actions='DeleteWhiteList' AND p2='0';") postgre.dbconn.commit()