def destroy(self, request, *args, **kwargs): """ 删除镜像信息 :param request: :param args: :param kwargs: :return: """ user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) network = self.get_object() count = LayoutServiceNetwork.objects.filter(network_id=network).count() if count == 0: try: docker_network = client.networks.get( network.net_work_client_id) docker_network.remove() except Exception as e: try: network_list = client.networks.list() for network in network_list: network_configs = network.attrs['IPAM']['Config'] if len(network_configs) > 0: subnet = network_configs[0]['Subnet'] if subnet != network.net_work_subnet: continue network.remove() except Exception as e: pass network.delete() return JsonResponse(R.ok()) else: return JsonResponse( R.build(msg="网卡 %s 正在使用无法删除" % (network.net_work_subnet, )))
def get_layout(self, request, pk=None): if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) user = request.user if user.is_superuser: layout_info = Layout.objects.filter(layout_id=pk).first() else: layout_info = Layout.objects.filter(layout_id=pk, is_release=True).first() if not layout_info: return JsonResponse(R.build(msg="环境不存在或未发布")) layout_path = os.path.join(DOCKER_COMPOSE, str(layout_info.layout_id)) layout_data = LayoutData.objects.filter(layout_id=layout_info, file_path="docker-compose" + layout_path.replace(DOCKER_COMPOSE, ""), ).first() open_host_list = [] is_run = False if layout_data and layout_data.status == 'running': service_container_list = LayoutServiceContainer.objects.filter(layout_user_id=layout_data) for service_container in service_container_list: service_info = service_container.service_id container_host = service_container.container_host if service_info.is_exposed: if container_host: open_host_list.extend(container_host.split(",")) is_run = True result_data = { "layout": { "name": layout_info.layout_name, "desc": layout_info.layout_desc, }, "open": open_host_list, "is_run": is_run } return JsonResponse(R.ok(data=result_data))
def del_comment(self, request, pk=None): user = request.user if not pk: return JsonResponse(R.build(msg="参数不能为空")) comment_info = Comment.objects.filter(comment_id=pk).first() if not comment_info: return JsonResponse(R.build(msg="评论不存在")) if not user.is_superuser and comment_info.user != user: return JsonResponse(R.build(msg="权限不足")) comment_info.delete() return JsonResponse(R.ok())
def delete_image(self, request, pk=None): user = request.user if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) try: layout = Layout.objects.filter(layout_id=pk).first() if not layout: return JsonResponse(R.build(msg="环境不存在")) layout_name = layout.layout_name layout_id = str(layout.layout_id) layout_path = os.path.join(DOCKER_COMPOSE, layout_id) with transaction.atomic(): _tmp_file_path = "docker-compose" + layout_path.replace( DOCKER_COMPOSE, "") layout_data = LayoutData.objects.filter( layout_id=layout, file_path=_tmp_file_path).first() if layout_data and layout_data.status == 'running': return JsonResponse(R.build(msg="环境正在运行中,请首先停止运行")) # 删除分数 LayoutServiceContainerScore.objects.filter( layout_id=layout).delete() # 删除容器 if layout_data: LayoutServiceContainer.objects.filter( layout_user_id=layout_data) # 删除服务网卡 service_list = LayoutService.objects.filter(layout_id=layout) if len(service_list) > 0: for service in service_list: # service_id = service.service_id LayoutServiceNetwork.objects.filter( service_id=service).delete() # 删除服务 LayoutService.objects.filter(layout_id=layout).delete() # 删除内容 layout.delete() # 删除文件和文件夹 shutil.rmtree(layout_path) request_ip = get_request_ip(request) sys_log = SysLog(user_id=user.id, operation_type="编排环境", operation_name="删除", operation_value=layout_name, operation_args=json.dumps( LayoutSerializer(layout).data), ip=request_ip) sys_log.save() except Exception as e: traceback.print_exc() return JsonResponse(R.err()) return JsonResponse(R.ok())
def update(self, request, *args, **kwargs): user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) new_pwd = request.data.get("pwd", "") new_pwd = new_pwd.strip() if len(new_pwd) < 6: return JsonResponse(R.build(msg="密码格式不正确")) user_info = self.get_object() user_info.set_password(new_pwd) user_info.save() return JsonResponse(R.ok())
def flag_layout(self, request, pk=None): if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) user = request.user layout_info = Layout.objects.filter(layout_id=pk, is_release=True).first() if not layout_info: return JsonResponse(R.build(msg="环境不存在或未发布")) flag = str(request.GET.get("flag", "")) if not flag: return JsonResponse(R.build(msg="Flag 不能为空")) if not flag.startswith("flag-{bmh"): return JsonResponse(R.build(msg="Flag 格式不正确")) layout_path = os.path.join(DOCKER_COMPOSE, str(layout_info.layout_id)) layout_data = LayoutData.objects.filter( layout_id=layout_info, file_path="docker-compose" + layout_path.replace(DOCKER_COMPOSE, ""), ).first() service_container = LayoutServiceContainer.objects.filter( layout_user_id=layout_data, container_flag=flag).first() if not service_container: return JsonResponse(R.build(msg="Flag 不正确")) service_container_score = LayoutServiceContainerScore.objects.filter( user_id=user.id, flag=flag, service_container_id=service_container).first() if not service_container_score: service_info = service_container.service_id image_info = service_container.image_id service_container_score = LayoutServiceContainerScore( layout_service_container_score_id=uuid.uuid4(), user_id=user.id, layout_id=layout_info, layout_data_id=layout_data, service_id=service_info, image_id=image_info, create_date=timezone.now(), service_container_id=service_container, flag=flag, update_date=timezone.now()) service_container_score.save() request_ip = get_request_ip(request) sys_log = SysLog(user_id=user.id, operation_type="编排环境", operation_name="提交Flag", operation_value=layout_info.layout_name, operation_args=json.dumps({"flag": flag}), ip=request_ip) sys_log.save() return JsonResponse(R.ok())
def release_layout(self, request, pk=None): """ 发布环境 """ if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) layout_info = Layout.objects.filter(layout_id=pk).first() if not layout_info: return JsonResponse(R.build(msg="环境不存在")) layout_info.is_release = True layout_info.save() return JsonResponse(R.ok())
def create_container_task(container_vul, user_info, request_ip): """ 创建漏洞容器 :param container_vul: container vul :param user_info: user info :param request_ip: request ip :return: """ image_info = container_vul.image_id user_id = user_info.id task_id = create_run_container_task(container_vul, user_info) if user_info.is_superuser or user_id == container_vul.user_id: operation_args = ImageInfoSerializer(image_info).data sys_log = SysLog(user_id=user_id, operation_type="容器", operation_name="启动", ip=request_ip, operation_value=operation_args["image_vul_name"], operation_args=json.dumps(operation_args)) sys_log.save() setting_config = get_setting_config() try: countdown = int(setting_config["time"]) except: countdown = int(DEFAULT_CONFIG["time"]) if countdown == 0: run_container.delay(container_vul.container_id, user_id, task_id, countdown) elif countdown != 0 and countdown > 60: # run_container(container_vul.container_id, user_id, task_id, countdown) setting_config = get_setting_config() if 'del_container' in setting_config: del_container = setting_config['del_container'] if not del_container or del_container == 0 or del_container == '0': add_chain_sig = chain(run_container.s(container_vul.container_id, user_id, task_id, countdown) | stop_container.s().set(countdown=countdown)) else: add_chain_sig = chain(run_container.s(container_vul.container_id, user_id, task_id, countdown) | delete_container.s().set(countdown=countdown)) add_chain_sig.apply_async() else: task_info = TaskInfo.objects.filter(task_id=task_id).first() task_info.task_msg = json.dumps(R.build(msg="停止时间最小为 1 分钟")) task_info.task_status = 4 task_info.update_date = timezone.now() task_info.save() else: task_info = TaskInfo.objects.filter(task_id=task_id).first() task_info.task_msg = json.dumps(R.build(msg="权限不足")) task_info.task_status = 3 task_info.update_date = timezone.now() task_info.save() return task_id
def create(self, request, *args, **kwargs): user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) now_time = datetime.datetime.now() data = request.data notice_data = data['notice_content'] title = data["title"] if not notice_data: return JsonResponse({"code": 400, "message": "公告内容不能为空"}) if not title: return JsonResponse({"code": 400, "message": "公告标题不能为空"}) if "update_notice" in data and data["update_notice"] == True: notice_id = data['notice_id'] update_noticeinfo = Notice.objects.filter(notice_id=notice_id, is_public=False).first() update_noticeinfo.update_date = now_time update_noticeinfo.notice_content = json.dumps(notice_data) update_noticeinfo.title = title update_noticeinfo.save() return JsonResponse({"code": 200, "msg": "公告修改成功"}) else: notice_info = Notice(notice_id=str(uuid.uuid4()), title=title, notice_content=json.dumps(notice_data), create_date=now_time) notice_info.save() return JsonResponse({"code": 200, "msg": "提交成功"})
def delete_container_task(container_vul, user_info, request_ip): """ 删除漏洞容器 :param container_vul: container vul :param user_info: user info :param request_ip: request ip :return: """ user_id = user_info.id task_id = create_delete_container_task(container_vul=container_vul, user_info=user_info) if user_info.is_superuser or user_id == container_vul.user_id: operation_args = ContainerVulSerializer(container_vul).data sys_log = SysLog(user_id=user_id, operation_type="容器", operation_name="删除", ip=request_ip, operation_value=operation_args["vul_name"], operation_args=json.dumps(operation_args)) sys_log.save() # 下发停止容器任务 delete_container.delay(task_id) else: task_info = TaskInfo.objects.filter(task_id=task_id).first() task_info.task_msg = json.dumps(R.build(msg="权限不足")) task_info.task_status = 3 task_info.update_date = timezone.now() task_info.save() return task_id
def rank_layout(self, request, pk=None): """ 排行 """ user = request.user page_no = int(request.GET.get("page", 1)) if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) layout_info = Layout.objects.filter(layout_id=pk, is_release=True).first() if not layout_info: return JsonResponse(R.build(msg="环境不存在")) score_list = LayoutServiceContainerScore.objects.filter(layout_id=layout_info).values('user_id').annotate( score=Sum("image_id__rank")).values('user_id', 'score').order_by("-score") try: pages = Paginator(score_list, 20) page = pages.page(page_no) except Exception as e: return JsonResponse(R.err()) current_rank = 0 current_score = 0 for i, _score in enumerate(score_list): user_id = _score["user_id"] if user.id != user_id: continue current_rank = i + 1 current_score = _score["score"] break layout_path = os.path.join(DOCKER_COMPOSE, str(layout_info.layout_id)) layout_data = LayoutData.objects.filter(layout_id=layout_info, file_path="docker-compose" + layout_path.replace(DOCKER_COMPOSE, ""), ).first() score_count = LayoutServiceContainerScore.objects.filter(layout_id=layout_info, user_id=user.id).count() score_total_count = LayoutServiceContainer.objects.filter(layout_user_id=layout_data).count() result = [] for _data in list(page): user_info = UserProfile.objects.filter(id=_data["user_id"]).first() username = "" if user_info: username = user_info.username result.append({"score": _data["score"], "username": username}) return JsonResponse({ "result": result, "count": pages.count, "current": current_rank, "progress": "%s/%s" % (score_count, score_total_count,), "score": current_score })
def stop_layout(self, request, pk=None): if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) layout_info = Layout.objects.filter(layout_id=pk, is_release=True).first() if not layout_info: return JsonResponse(R.build(msg="环境不存在或未发布")) layout_id = str(layout_info.layout_id) layout_path = os.path.join(DOCKER_COMPOSE, layout_id) layout_data = LayoutData.objects.filter( layout_id=layout_info, file_path="docker-compose" + layout_path.replace(DOCKER_COMPOSE, ""), ).first() if not layout_data: return JsonResponse(R.build(msg="环境未启动,无法停止")) if not os.path.exists(layout_path): return JsonResponse(R.ok()) if layout_data.status == "stop": return JsonResponse(R.ok()) try: with transaction.atomic(): container_list = get_project(layout_path).stop() if container_list: for container in container_list: container_id = container.id LayoutServiceContainer.objects.filter(docker_container_id=container_id) \ .update(container_status="stop") LayoutServiceContainer.objects.filter( layout_user_id=layout_data).update(container_status="stop") layout_data.status = "stop" layout_data.save() except Exception as e: return JsonResponse(R.err()) request_ip = get_request_ip(request) sys_log = SysLog(user_id=user.id, operation_type="编排环境", operation_name="停止", operation_value=layout_info.layout_name, operation_args=json.dumps( LayoutSerializer(layout_info).data), ip=request_ip) sys_log.save() return JsonResponse(R.ok())
def create_image(task_id): """ 创建镜像名称 """ task_info = TaskInfo.objects.filter(task_id=task_id, task_status=1).first() if not task_info: return operation_args = task_info.operation_args args = json.loads(operation_args) image_name = args["image_name"].strip() image_desc = args["image_desc"].strip() image_rank = args["rank"] image_vul_name = args["image_vul_name"].strip() image_info = ImageInfo.objects.filter(image_name=image_name).first() if not image_info: image_info = ImageInfo(image_name=image_name, image_desc=image_desc, rank=image_rank, image_vul_name=image_vul_name) image = None msg = {} try: image = client.images.get(image_name) except Exception as e: image_info.is_ok = False image_info.save() try: images = client.images.pull(image_name) if Image == type(images): image = images else: if len(images) > 0: image = images[0] except ImageNotFound: msg = R.build(msg="%s 不存在") except Exception: traceback.print_exc() msg = R.err(msg="%s 添加失败" % (image_name, )) if image: config = image.attrs["ContainerConfig"] port_list = [] if "ExposedPorts" in config: port_list = config["ExposedPorts"] ports = [] for port in port_list: port = port.replace("/", "").replace("tcp", "").replace("udp", "") ports.append(port) image_port = ",".join(ports) image_info.image_port = image_port image_info.is_ok = True image_info.save() msg = R.ok(msg="%s 添加成功" % (image_name, ), data=json.dumps({"image_port": image_port})) task_info.task_status = 3 else: task_info.task_status = 4 task_info.task_msg = json.dumps(msg) task_info.save()
def upload_img(request): """ 上传文件图片 """ user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) img = request.data["img"] if not img: return JsonResponse(R.build(msg="请上传图片")) img_name = img.name img_suffix = img_name.split(".")[-1] if img_suffix not in ALLOWED_IMG_SUFFIX: return JsonResponse( R.build(msg="不支持此格式图片文件,请上传%s格式文件" % ("、".join(ALLOWED_IMG_SUFFIX), ))) image_name = str(uuid.uuid4()).replace('-', '') + "." + img_suffix with open(os.path.join(BASE_DIR, "static", image_name), "wb") as f: for chunk in img.chunks(): f.write(chunk) return JsonResponse(R.ok(data=image_name))
def publish_notice(request): user = request.user if not user.is_superuser: return JsonResponse(R.build("权限不足")) if "id" in request.data: try: notice_info = Notice.objects.filter(notice_id=request.data["id"]).first() notice_info.is_public = True notice_info.is_newest = True notice_info.save() notify.send(request.user, recipient=UserProfile.objects.all(), verb="public notice", target=notice_info) return JsonResponse({"code": 200, "message": "发布成功"}) except Exception as e: return JsonResponse({"code": 400, "message": "发布失败"}) return JsonResponse({"code": 400, "message": "发布失败"})
def destroy(self, request, *args, **kwargs): user = request.user if not user.is_superuser: return JsonResponse(R.build("权限不足")) if "id" in request.data: notice_id = request.data["id"] else: notice = self.get_object() notice_id = notice.notice_id if notice_id: notice_instance = Notice.objects.filter(notice_id=notice_id).first() notice_instance.delete() notifications = Notification.objects.all() for single_notification in notifications: if single_notification.target_object_id ==notice_id: single_notification.delete() return JsonResponse({"code": 200, "message": "删除成功"}) return JsonResponse({"code": 400, "message": "删除失败"})
def get_queryset(self): user = self.request.user if not user.is_superuser: return JsonResponse(R.build("权限不足")) query = self.request.GET.get("query", "") if query: query = query.strip() seven_days_ago = datetime.datetime.now()-datetime.timedelta(days=7) nots = Notice.objects.filter(title__contains=query).all() for single_not in nots: if single_not.update_date < seven_days_ago: single_not.is_newest = False return nots else: seven_days_ago = datetime.datetime.now() - datetime.timedelta(days=7) nots = Notice.objects.all() for single_not in nots: if single_not.update_date < seven_days_ago: single_not.is_newest = False return nots
def create_image_task(image_info, user_info, request_ip, image_file=None): """ 创建镜像任务 """ user_id = user_info.id task_id = create_create_image_task(image_info=image_info, user_info=user_info) if user_info.is_superuser: image_name = image_info.image_name image_desc = image_info.image_desc image_vul_name = image_info.image_vul_name image_rank = image_info.rank task_info = TaskInfo.objects.filter(task_id=task_id).first() if image_file: task_msg = {} try: file_info = image_file.read() images = client.images.load(file_info) image = images[0] repo_tags = image.attrs["RepoTags"] if len(repo_tags) == 0: # 移除本地镜像 try: client.images.remove(image.id) except Exception as e: pass task_msg = R.build(msg="文件镜像 Tag 不能为空") else: config = image.attrs["ContainerConfig"] port_list = [] if "ExposedPorts" in config: port_list = config["ExposedPorts"] ports = [] for port in port_list: port = port.replace("/", "").replace("tcp", "").replace("udp", "") ports.append(port) image_name = repo_tags[0] image_port = ",".join(ports) image_info = ImageInfo.objects.filter(image_name=image_name).first() if not image_info: image_info = ImageInfo() image_info.image_name = image_name image_info.image_port = image_port # image_vul_name image_info.image_vul_name = image_name.replace("vulfocus/","") if not image_vul_name else image_vul_name # image_desc image_info.image_desc = image_name.replace("vulfocus/","") if not image_desc else image_desc # rank image_info.rank = 2.5 if image_rank > 5 or image_rank < 0.5 else image_rank image_info.is_ok = True image_info.save() task_info.task_name = "拉取镜像:"+image_name task_info.task_status = 3 task_msg = R.ok(data="%s 添加成功" % (image_name, )) except Exception as e: traceback.print_exc() task_msg = R.err() try: image_info.delete() except: pass task_info.task_status = 4 finally: task_info.task_msg = json.dumps(task_msg) task_info.update_date = timezone.now() task_info.save() elif image_name: # 创建任务 # create_image(task_id=task_id) create_image.delay(task_id) else: R.build(msg="镜像文件或镜像名称不能为空") operation_args = ImageInfoSerializer(image_info).data sys_log = SysLog(user_id=user_id, operation_type="镜像", operation_name="创建", ip=request_ip, operation_value=operation_args["image_vul_name"], operation_args=json.dumps(operation_args)) sys_log.save() else: task_info = TaskInfo.objects.filter(task_id=task_id).first() task_info.task_msg = json.dumps(R.build(msg="权限不足")) task_info.task_status = 3 task_info.update_date = timezone.now() task_info.save() return task_id
def run_container(container_id, user_id, tmp_task_id, countdown): """ 运行 docker 容器 :param container_id: 漏洞容器数据库 id :param user_id: 用户ID :param tmp_task_id: 任务ID :param countdown 定时 """ # docker container id container_vul = ContainerVul.objects.filter(container_id=container_id).first() user_info = UserProfile.objects.filter(id=user_id).first() container_id = container_vul.docker_container_id image_info = container_vul.image_id image_name = image_info.image_name image_port = image_info.image_port user_id = user_info.id docker_container = None msg = {} """ 创建启动任务 """ args = { "image_name": image_name, "user_id": user_id, "image_port": image_port } task_id = "" task_info = TaskInfo.objects.filter(task_id=tmp_task_id).first() # run container execute command command = "" vul_flag = container_vul.container_flag container_port = container_vul.container_port vul_port = {} if container_vul.vul_port: vul_port = json.loads(container_vul.vul_port) vul_host = container_vul.vul_host if container_id: # check container check_rsp = check_container(container_id) if check_rsp["flag"]: docker_container = check_rsp["container"] # set container_flag vul_flag = container_vul.container_flag # if container by delete , create a container if not docker_container: port_list = image_port.split(",") port_dict = {} random_list = [] for port in port_list: random_port = '' for i in range(20): # random port random_port = str(random.randint(8000, 65536)) if random_port in random_list or ContainerVul.objects.filter(container_port=random_port).first(): continue break if not random_port: msg = R.err(msg="端口无效") break random_list.append(random_port) port_dict['%s/tcp' % (port,)] = int(random_port) # 端口重复,无法进行创建 if len(msg) > 0 or msg: task_info.task_msg = json.dumps(msg) task_info.update_date = timezone.now() # except task_info.task_status = 4 task_info.save() return str(task_info.task_id) container_port = ",".join(random_list) """ random port """ for tmp_port in port_dict: tmp_random_port = port_dict[tmp_port] tmp_port = tmp_port.replace("/tcp", "") vul_port[tmp_port] = str(tmp_random_port) try: client.images.get(image_name) except Exception as e: msg = R.build(msg="镜像不存在") task_info.task_msg = json.dumps(msg) task_info.update_date = timezone.now() # except task_info.task_status = 4 task_info.save() image_info.is_ok = False image_info.save() return str(task_info.task_id) vul_flag = "flag-{bmh%s}" % (uuid.uuid4(),) if container_vul.container_flag: vul_flag = container_vul.container_flag try: docker_container = client.containers.run(image_name, ports=port_dict, detach=True, environment={"vul_flag": vul_flag}) except ImageNotFound: msg = R.build(msg="镜像不存在") task_info.task_msg = json.dumps(msg) task_info.update_date = timezone.now() # except task_info.task_status = 4 task_info.save() image_info.is_ok = False image_info.save() return str(task_info.task_id) command = 'touch /tmp/%s' % (vul_flag,) vul_host = get_local_ip() + ":" + container_port task_start_date = timezone.now() if countdown != 0 and countdown >= 60: task_end_date = task_start_date + datetime.timedelta(seconds=countdown) elif countdown == 0: task_end_date = None else: countdown = int(DEFAULT_CONFIG["time"]) task_end_date = task_start_date + datetime.timedelta(seconds=countdown) if "running" == docker_container.status: msg_data = R.ok(data={ "host": container_vul.vul_host, "port": container_vul.vul_port, "id": str(container_vul.container_id), "status": "running", "start_date": int(task_start_date.timestamp()), "end_date": 0 if not task_end_date else int(task_end_date.timestamp()) }) search_task = TaskInfo.objects.filter(user_id=user_id, task_msg=json.dumps(msg_data), operation_type=2, operation_args=json.dumps(args), task_end_date=task_end_date, task_name="运行容器:" + image_name).order_by("-create_date").first() if not search_task: task_info.task_status = 3 task_info.task_msg = json.dumps(msg_data) task_info.update_date = timezone.now() task_info.operation_args = json.dumps(args) task_info.save() task_id = str(task_info.task_id) else: task_info.delete() search_task.task_id = tmp_task_id search_task.task_status = 3 search_task.update_date = timezone.now() search_task.save() task_id = str(search_task.task_id) else: task_info.save() docker_container.start() msg = docker_container_run(docker_container, command=command) if msg["status"] == HTTP_ERR: try: container_vul.delete() except Exception: pass # except task_info.task_status = 4 else: container_status = msg["data"]["status"] msg["data"]["host"] = vul_host msg["data"]["port"] = vul_port msg["data"]["id"] = str(container_vul.container_id) msg["data"]["status"] = container_status msg["data"]["start_date"] = int(task_start_date.timestamp()) msg["data"]["end_date"] = 0 if not task_end_date else int(task_end_date.timestamp()) # 容器状态 container_vul.container_status = container_status # 容器 id container_vul.docker_container_id = str(docker_container.id) # 漏洞 HOST container_vul.vul_host = vul_host # 漏洞端口 container_vul.vul_port = json.dumps(vul_port) # 容器端口映射关系 container_vul.container_port = container_port # 验证 flag container_vul.container_flag = vul_flag container_vul.save() task_start_date = timezone.now() # start 时间 task_info.task_start_date = task_start_date task_info.task_end_date = task_end_date task_info.task_status = 3 task_info.task_msg = json.dumps(msg) task_info.update_date = timezone.now() task_info.save() task_id = str(task_info.task_id) print("启动漏洞容器成功,任务ID:%s" % (task_id, )) return create_stop_container_task(container_vul,user_info)
def create(self, request, *args, **kwargs): data_dict = request.data user_id = request.user.id try: net_work_name = data_dict['net_work_name'] except Exception as e: return Response(R.build(msg="网卡名称不能为空")) try: net_work_subnet = data_dict['net_work_subnet'] except Exception as e: return Response(R.build(msg="子网不能为空")) try: net_work_gateway = data_dict['net_work_gateway'] except Exception as e: return Response(R.build(msg="网关不能为空")) try: net_work_scope = data_dict['net_work_scope'] except Exception as e: net_work_scope = 'local' try: net_work_driver = data_dict['net_work_driver'] except Exception as e: net_work_driver = 'bridge' try: enable_ipv6 = data_dict['enable_ipv6'] except Exception as e: enable_ipv6 = False try: rs = NetWorkInfo.objects.filter(net_work_name=net_work_name) if len(rs) > 0: return Response(R.build(msg="网卡名称不能重复")) rs = NetWorkInfo.objects.filter(net_work_subnet=net_work_subnet) if len(rs) > 0: return Response(R.build(msg="子网不能重复")) rs = NetWorkInfo.objects.filter(net_work_gateway=net_work_gateway) if len(rs) > 0: return Response(R.build(msg="网关不能重复")) except Exception as e: print(e) if not net_work_subnet: network_list = client.networks.list() for network in network_list: network_configs = network.attrs['IPAM']['Config'] if len(network_configs) > 0: subnet = network_configs[0]['Subnet'] net_work_gateway = network_configs[0]['Gateway'] if subnet != net_work_subnet: continue net_work_client_id = network.attrs["Id"] net_work_scope = network.attrs["Scope"] net_work_driver = network.attrs["Driver"] enable_ipv6 = network.attrs["EnableIPv6"] break else: if net_work_subnet == "192.168.10.10/24": return JsonResponse(R.err(msg="该网段已在服务器内部使用,请更换网段")) if net_work_gateway == "192.168.10.10": return JsonResponse(R.err(msg="该网关已在服务器内部使用,请更换网关")) try: ipam_pool = docker.types.IPAMPool(subnet=net_work_subnet, gateway=net_work_gateway) ipam_config = docker.types.IPAMConfig(pool_configs=[ipam_pool]) if not net_work_name: return JsonResponse(R.err(msg="网卡名称不能为空")) try: net_work = client.networks.create(net_work_name, driver=net_work_driver, ipam=ipam_config, scope=net_work_scope) except Exception as e: return JsonResponse(R.err(msg="子网或者网关设置错误")) net_work_client_id = str(net_work.id) if not net_work_gateway: net_work_gateway = net_work.attrs['IPAM']['Config'][ 'Gateway'] except Exception as e: traceback.print_exc() return JsonResponse(R.err(msg="服务器内部错误")) network_info = NetWorkInfo(net_work_id=str(uuid.uuid4()), net_work_client_id=net_work_client_id, create_user=user_id, net_work_name=net_work_name, net_work_driver=net_work_driver, net_work_subnet=net_work_subnet, net_work_gateway=net_work_gateway, net_work_scope=net_work_scope, enable_ipv6=enable_ipv6) network_info.save() data = NetWorkInfoSerializer(network_info).data return JsonResponse(R.ok(data=data))
def create_image(task_id): """ 创建镜像名称 """ task_info = TaskInfo.objects.filter(task_id=task_id, task_status=1).first() if not task_info: return operation_args = task_info.operation_args args = json.loads(operation_args) image_name = args["image_name"].strip() image_info = ImageInfo.objects.filter(image_name=image_name).first() if not image_info: image_desc = image_name image_rank = 2.5 image_vul_name = image_desc image_info = ImageInfo(image_name=image_name, image_desc=image_desc, rank=image_rank, image_vul_name=image_vul_name) image = None msg = {} try: image = client.images.get(image_name) except Exception as e: image_info.is_ok = False image_info.save() try: last_info = {} progress_info = { "total": 0, "progress_count": 0, "progress": round(0.0, 2), } black_list = ["total", "progress_count", "progress"] for line in api_docker_client.pull(image_name, stream=True, decode=True): if "status" in line and "progressDetail" in line and "id" in line: id = line["id"] status = line["status"] if len(line["progressDetail"]) > 0: try: current = line["progressDetail"]["current"] total = line["progressDetail"]["total"] line["progress"] = round((current / total) * 100, 2) if (current / total) > 1: line["progress"] = round(0.99 * 100, 2) except: line["progress"] = round(1 * 100, 2) else: if (("Download" in status or "Pull" in status) and ("complete" in status)) or ("Verifying" in status) or \ ("Layer" in status and "already" in status and "exists" in status): line["progress"] = round(100.00, 2) else: line["progress"] = round(0.00, 2) progress_info[id] = line progress_info["total"] = len(progress_info) - len(black_list) progress_count = 0 for key in progress_info: if key in black_list: continue if 100.00 != progress_info[key]["progress"]: continue progress_count += 1 progress_info["progress_count"] = progress_count progress_info["progress"] = round((progress_count/progress_info["total"])*100, 2) r.set(str(task_id), json.dumps(progress_info,ensure_ascii=False)) print(json.dumps(progress_info, ensure_ascii=False)) last_info = line if "status" in last_info and ("Downloaded newer image for" in last_info["status"] or "Image is up to date for" in last_info["status"]): image = client.images.get(image_name) else: raise Exception except ImageNotFound: msg = R.build(msg="%s 不存在" % (image_name,)) except Exception: traceback.print_exc() msg = R.err(msg="%s 添加失败" % (image_name,)) if image: config = image.attrs["ContainerConfig"] port_list = [] if "ExposedPorts" in config: port_list = config["ExposedPorts"] ports = [] for port in port_list: port = port.replace("/", "").replace("tcp", "").replace("udp", "") ports.append(port) image_port = ",".join(ports) image_info.image_port = image_port image_info.is_ok = True image_info.save() msg = R.ok(msg="%s 添加成功" % (image_name,), data=json.dumps({"image_port": image_port})) task_info.task_status = 3 else: task_info.task_status = 4 task_info.task_msg = json.dumps(msg) task_info.save()
def run_layout(self, request, pk=None): if not pk or pk == "undefined": return JsonResponse(R.build(msg="环境不存在")) """ 运行环境 """ user = request.user if not user.is_superuser: return JsonResponse(R.build(msg="权限不足")) layout_info = Layout.objects.filter(layout_id=pk, is_release=True).first() if not layout_info: return JsonResponse(R.build(msg="环境不存在或未发布")) yml_content = layout_info.yml_content env_content = layout_info.env_content layout_id = str(layout_info.layout_id) layout_path = os.path.join(DOCKER_COMPOSE, layout_id) try: env_content = get_random_port(env_content) except Exception as e: return JsonResponse(R.build(msg=str(e))) open_host_list = [] raw_con = json.loads(layout_info.raw_content) network_list = client.networks.list() net_list = [] network_names = [ item['attrs']['name'] for item in raw_con['nodes'] if item['name'] == "Network" ] for i in network_list: net_list.append(i.attrs['Name']) for network_name in network_names: if network_name in net_list: pass else: try: network_det = NetWorkInfo.objects.filter( net_work_name=network_name).first() ipam_pool = docker.types.IPAMPool( subnet=network_det.net_work_subnet, gateway=network_det.net_work_gateway) ipam_config = docker.types.IPAMConfig( pool_configs=[ipam_pool]) net_work = client.networks.create( network_det.net_work_name, driver=network_det.net_work_driver, ipam=ipam_config, scope=network_det.net_work_scope) net_work_client_id = str(net_work.id) if not network_det.net_work_gateway: net_work_gateway = net_work.attrs['IPAM']['Config'][ 'Gateway'] network_det.net_work_gateway = net_work_gateway network_det.net_work_client_id = net_work_client_id network_det.save() except Exception as e: return JsonResponse(R.build(msg=str(e))) try: with transaction.atomic(): _tmp_file_path = "docker-compose" + layout_path.replace( DOCKER_COMPOSE, "") layout_data = LayoutData.objects.filter( layout_id=layout_info, file_path=_tmp_file_path).first() if not layout_data: layout_data = LayoutData( layout_user_id=uuid.uuid4(), create_user_id=user.id, layout_id=layout_info, status="running", file_path="docker-compose" + layout_path.replace(DOCKER_COMPOSE, ""), create_date=timezone.now(), update_date=timezone.now()) else: layout_data.status = "running" if not os.path.exists(layout_path): os.makedirs(layout_path) docker_compose_file = os.path.join(layout_path, "docker-compose.yml") with open(docker_compose_file, "w", encoding="utf-8") as f: f.write(yml_content) env_file = os.path.join(layout_path, ".env") with open(env_file, "w", encoding="utf-8") as f: f.write("\n".join(env_content)) # 启动 container_list = get_project(layout_path).up() # 保存 layout_data.save() for container in container_list: docker_container_id = container.id service_id = container.service container_host = "" container_port = "" container_flag = "flag-{bmh%s}" % (uuid.uuid4(), ) docker_container = client.containers.get(container.id) service_info = LayoutService.objects.filter( service_name=service_id, layout_id=layout_info).first() if not service_info: raise Exception("环境服务不存在") image_info = service_info.image_id service_container = LayoutServiceContainer.objects.filter( service_id=service_info, user_id=user.id, layout_user_id=layout_data, image_id=image_info).first() if not service_container: service_container = LayoutServiceContainer( service_container_id=uuid.uuid4(), user_id=user.id, service_id=service_info, layout_user_id=layout_data, image_id=image_info, container_flag=container_flag, create_date=timezone.now()) else: container_flag = service_container.container_flag """ 写入 flag """ command = 'touch /tmp/%s' % (container_flag, ) execute_result = tasks.docker_container_run( docker_container, command) if execute_result["status"] == 500: raise Exception(execute_result["msg"]) container_ports = container.ports if len(container_ports) == 0: try: container_ports = docker_container.attrs[ "NetworkSettings"]["Ports"] except Exception as e: pass vul_host_list = [] if service_info.is_exposed: vul_ip = tasks.get_local_ip() else: vul_ip = "127.0.0.1" port_dict = {} if len(container_ports) > 0: for _tmp_port in container_ports: source_port = str(_tmp_port).replace( "/", "").replace("tcp", "").replace("udp", "") if container_ports[_tmp_port]: target_port = container_ports[_tmp_port][0][ "HostPort"] else: target_port = source_port port_dict[source_port] = target_port vul_host_list.append(vul_ip + ":" + target_port) if len(vul_host_list) > 0: container_host = ",".join(vul_host_list) if service_info.is_exposed: open_host_list.extend(vul_host_list) if len(port_dict) > 0: container_port = json.dumps(port_dict, ensure_ascii=False) # 连接 host service_container.container_host = container_host # 连接 端口 service_container.container_port = container_port container_status = execute_result["data"]["status"] service_container.docker_container_id = docker_container_id service_container.container_status = container_status service_container.update_date = timezone.now() service_container.save() except Exception as e: traceback.print_exc() return JsonResponse(R.build(msg=str(e))) result_data = { "layout": { "name": layout_info.layout_name, "desc": layout_info.layout_desc, }, "open": open_host_list } request_ip = get_request_ip(request) sys_log = SysLog(user_id=user.id, operation_type="编排环境", operation_name="启动", operation_value=layout_info.layout_name, operation_args=json.dumps( LayoutSerializer(layout_info).data), ip=request_ip) sys_log.save() return JsonResponse(R.ok(data=result_data))
def share_image(task_id): """ 贡献镜像 :param task_id: 任务 id :return: """ task_info = TaskInfo.objects.filter(task_id=task_id, task_status=1).first() operation_args = task_info.operation_args args = json.loads(operation_args) share_username = args["share_username"].strip() image_name = args["image_name"].strip() username = args["username"].strip() password = args["pwd"].strip() msg = R.ok(msg="分享成功") try: client.login(username, password) new_image_name = image_name.split(":")[0]+":"+share_username if new_image_name.rfind("/") > -1: r_image_info = new_image_name[:new_image_name.rfind("/")] if r_image_info.rfind("/") > -1: repo_tmp = r_image_info[:r_image_info.rfind("/")] repo_name = "/".join([repo_tmp, username, new_image_name[new_image_name.rfind("/")+1:]]) else: repo_name = "/".join([username, new_image_name[new_image_name.rfind("/")+1:]]) else: repo_name = "/".join([username, new_image_name]) new_image_name = repo_name tag_flag = api_docker_client.tag(image_name, new_image_name) if tag_flag: last_info = {} progress_info = { "total": 0, "progress_count": 0, "progress": round(0.0, 2), } black_list = ["total", "progress_count", "progress"] for line in api_docker_client.push(new_image_name, stream=True, decode=True, auth_config={"username": username, "password": password}): if "status" in line and "progressDetail" in line and "id" in line: id = line["id"] status = line["status"] if len(line["progressDetail"]) > 0: try: current = line["progressDetail"]["current"] total = line["progressDetail"]["total"] line["progress"] = round((current / total) * 100, 2) if (current / total) > 1: line["progress"] = round(0.99 * 100, 2) except: line["progress"] = round(1 * 100, 2) else: if ("Pushed" in status) or ("Verifying" in status) or \ ("Layer" in status and "already" in status and "exists" in status) or ("Mounted" in status and "from" in status): line["progress"] = round(100.00, 2) else: line["progress"] = round(0.00, 2) progress_info[id] = line progress_info["total"] = len(progress_info) - len(black_list) progress_count = 0 for key in progress_info: if key in black_list: continue if 100.00 != progress_info[key]["progress"]: continue progress_count += 1 progress_info["progress_count"] = progress_count progress_info["progress"] = round((progress_count/progress_info["total"])*100, 2) r.set(str(task_id), json.dumps(progress_info,ensure_ascii=False)) print(json.dumps(progress_info, ensure_ascii=False)) last_info = line # print("last_info") # print("==========================") # print(json.dumps(last_info, ensure_ascii=False)) if "error" in last_info and last_info["error"]: task_info.task_msg = R.build(msg="原%s构建新镜像%s失败,错误信息:%s" % (image_name, new_image_name, str(last_info["error"]),)) task_info.task_status = 4 elif "progressDetail" in last_info and "aux" in last_info and share_username in last_info["aux"]["Tag"]: image_info = ImageInfo.objects.filter(image_name=image_name).first() if image_info: image_info.is_share = True image_info.save() msg = R.ok(msg="%s 分享成功" % (image_name,)) else: msg = R.build(msg="%s 分享失败" % (image_name,)) else: task_info.task_msg = R.build(msg="原%s构建新镜像%s失败" % (image_name, new_image_name,)) task_info.task_status = 4 except docker.errors.APIError as api_error: msg = R.build(msg="Dockerhub 用户名或 Dockerhub Token 错误") task_info.task_status = 4 except Exception as e: msg = R.build(msg="%s 分享失败,错误信息:%s" % (image_name, str(e),)) task_info.task_status = 4 task_info.task_status = 3 task_info.task_msg = json.dumps(msg) task_info.save()
def create(self, request, *args, **kwargs): """ 创建编排环境信息 """ user = request.user if user.is_superuser: data = request.POST.get("data", "") id = request.POST.get("id", "") name = request.POST.get("name", "") if not name: return JsonResponse(R.build(msg="名称不能为空")) desc = request.POST.get("desc", "") img = request.POST.get("img", "") if not data: return JsonResponse(R.build(msg="参数不能为空")) topo_data = json.loads(data) if topo_data == {}: return JsonResponse(R.build(msg="编排环境不能为空")) nodes = topo_data["nodes"] if not nodes or len(nodes) == 0: return JsonResponse(R.build(msg="节点不能为空")) connectors = topo_data["connectors"] check_open = False container_list = [] network_dict = {} check_network_name_list = [] for node in nodes: node_id = node["id"] node_type = node["type"] node_attrs = node["attrs"] if len(node_attrs) == 0: return JsonResponse(R.build(msg="节点属性不能为空")) if node_type == "Container": node_open = node_attrs["open"] node_port = node_attrs["port"] if node_open and node_port: check_open = True container_list.append(node) elif node_type == "Network": network_name = node_attrs["name"] if not network_name: return JsonResponse(R.build(msg="网卡不能为空")) if network_name in check_network_name_list: return JsonResponse(R.build(msg="不能重复设置网卡")) check_network_name_list.append(network_name) network_dict[node_id] = node if node_attrs == {}: return JsonResponse(R.build(msg="网卡或容器属性不能为空")) if not check_open: return JsonResponse(R.build(msg="请开放可访问入口")) if len(container_list) == 0: return JsonResponse(R.build(msg="容器环境不能为空")) if len(network_dict) == 0: for container in container_list: if not container["attrs"]["open"]: return JsonResponse( R.build(msg="在不配置网卡段情况下请保证所有的环境开放访问权限")) else: if not connectors or len(connectors) == 0: return JsonResponse(R.build(msg="在配置网卡的情况下连接点不能为空")) try: yml_content = build_yml(container_list=container_list, network_dict=network_dict, connector_list=connectors) yml_data = yml_content["content"] env_data = yml_content["env"] env_content = "" if len(env_data) > 0: env_content = "\n".join(env_data) with transaction.atomic(): operation_name = "创建" if id: layout = Layout.objects.filter(layout_id=id).first() operation_name = "修改" else: layout = Layout(layout_id=uuid.uuid4(), create_date=timezone.now(), update_date=timezone.now()) layout_data = LayoutData.objects.filter( layout_id=layout).first() if layout_data and layout_data.status == 'running': return JsonResponse(R.build(msg="环境正在运行中,请首先停止运行")) layout.layout_name = name layout.layout_desc = desc layout.create_user_id = user.id layout.image_name = img layout.raw_content = json.dumps(topo_data, ensure_ascii=False) layout.yml_content = yaml.dump(yml_content["content"]) layout.env_content = env_content # 保存到数据库中 layout.save() # 删除相关原有的服务数据 layout_service_list = list( LayoutService.objects.filter( layout_id=layout).values("service_id")) # 删除网卡相关数据 services = yml_data["services"] for service_name in services: service = services[service_name] image = service["image"] image_info = ImageInfo.objects.filter( image_name=image).first() if not image_info: return JsonResponse( R.build(msg="%s 镜像不存在" % (image, ))) is_exposed = False ports = "" if "ports" in service and len(service["ports"]) > 0: is_exposed = True if image_info.image_port: ports = ",".join( str(image_info.image_port).split(",")) layout_service = LayoutService.objects.filter( layout_id=layout, service_name=service_name).first() if not layout_service: layout_service = LayoutService( service_id=uuid.uuid4(), layout_id=layout, service_name=service_name, create_date=timezone.now(), update_date=timezone.now()) if { "service_id": layout_service.service_id } in layout_service_list: layout_service_list.remove( {"service_id": layout_service.service_id}) layout_service.image_id = image_info layout_service.service_name = service_name layout_service.is_exposed = is_exposed layout_service.exposed_source_port = ports layout_service.save() if "networks" not in service: continue networks = service["networks"] service_network_list = list( LayoutServiceNetwork.objects.filter( service_id=layout_service).values( 'layout_service_network_id')) for network in networks: network_info = NetWorkInfo.objects.filter( net_work_name=network).first() if not network_info: return JsonResponse( R.build(msg="%s 网卡不存在" % (network, ))) service_network = LayoutServiceNetwork.objects.filter( service_id=layout_service, network_id=network_info, ).first() if not service_network: service_network = LayoutServiceNetwork( layout_service_network_id=uuid.uuid4(), service_id=layout_service, network_id=network_info, create_date=timezone.now(), update_date=timezone.now()) if { "layout_service_network_id": service_network.layout_service_network_id } in service_network_list: service_network_list.remove({ "layout_service_network_id": service_network.layout_service_network_id }) service_network.save() # 删除已经不存在的网卡 if len(service_network_list) > 0: for service_network in service_network_list: LayoutServiceNetwork.objects.filter( layout_service_network_id=service_network[ 'layout_service_network_id']).delete() # 删除服务数据 for layout_service in layout_service_list: service_id = layout_service['service_id'] # 删除服务数据 LayoutService.objects.filter( service_id=service_id, layout_id=layout).delete() if layout_data: # 删除启动容器 LayoutServiceContainer.objects.filter(service_id=service_id, layout_user_id=layout_data). \ delete() # 删除分数 LayoutServiceContainerScore.objects.filter( layout_id=layout, layout_data_id=layout_data, service_id=service_id).delete() else: # 删除启动容器 LayoutServiceContainer.objects.filter( service_id=service_id).delete() # 删除分数 LayoutServiceContainerScore.objects.filter( layout_id=layout, service_id=service_id).delete() request_ip = get_request_ip(request) sys_log = SysLog(user_id=user.id, operation_type="编排环境", operation_name=operation_name, operation_value=name, operation_args=json.dumps( LayoutSerializer(layout).data), ip=request_ip) sys_log.save() except Exception as e: return JsonResponse(R.err(msg="服务器内部错误,请联系管理员")) return JsonResponse(R.ok()) else: return JsonResponse(R.build(msg="权限不足"))