wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/app/models/metasploit_data_models/search/operation/port/range.rb

@@ -0,0 +1,79 @@
+# Search operation on an attribute that holds a port number and is being search with a range of port numbers.  The
+# range is specified as `<min>-<max>` with `<min>` being less than `<max>` and both being within
+# {MetasploitDataModels::Search::Operation::Port::Range the valid port range}.
+class MetasploitDataModels::Search::Operation::Port::Range < MetasploitDataModels::Search::Operation::Range
+  #
+  # Validations
+  #
+
+  validate :ports
+
+  #
+  # Instance Methods
+  #
+
+  # Sets `#value` to a range of ports.
+  #
+  # @param formatted_value [#to_s] '\d+-\d+'
+  def value=(formatted_value)
+    super(formatted_value)
+
+    # could not be a `Range` if super conversion failed
+    # setters return the argument, not the return value from the method, so access `#value` directly
+    if value.is_a? Range
+      begin
+        # use Integer() instead of String#to_i as String#to_i will ignore trailing letters (i.e. '1two' -> 1) and turn all
+        # string without an integer in it to 0.
+        integer_begin = Integer(value.begin.to_s)
+        integer_end = Integer(value.end.to_s)
+      rescue ArgumentError
+        # setter returned is ignored in MRI, but do it anyway for other implementation
+        @value
+      else
+        @value = Range.new(integer_begin, integer_end)
+      end
+    else
+      # setter returned is ignored in MRI, but do it anyway for other implementation
+      # return unconvertible value from `super`
+      @value
+    end
+  end
+
+  private
+
+  # @note `#value` should be check to be a `Range` before calling {#port}.
+  #
+  # Validate that either `Range#begin` or `Range#end` is a valid port number in `#value`
+  #
+  # @param extreme [:begin, :end] Which extreme of the `Range` in `value` to validate.
+  # @return [void]
+  def port(extreme)
+    extreme_value = value.send(extreme)
+
+    if extreme_value.is_a? Integer
+      unless MetasploitDataModels::Search::Operation::Port::Number::RANGE.cover?(extreme_value)
+        errors.add(
+            :value,
+            :port_range_extreme_inclusion,
+            extreme: extreme,
+            extreme_value: extreme_value,
+            maximum: MetasploitDataModels::Search::Operation::Port::Number::MAXIMUM,
+            minimum: MetasploitDataModels::Search::Operation::Port::Number::MINIMUM
+        )
+      end
+    else
+      errors.add(:value, :port_range_extreme_not_an_integer, extreme: extreme, extreme_value: extreme_value)
+    end
+  end
+
+  # Validates that the `Range#begin` and `Range#end` of `#value` are valid port numbers.
+  #
+  # @return [void]
+  def ports
+    if value.is_a? Range
+      [:begin, :end].each do |extreme|
+        port(extreme)
+      end
+    end
+  end
+end

data/app/models/metasploit_data_models/search/operation/range.rb

@@ -0,0 +1,56 @@
+# Search operation on a `Range`.
+class MetasploitDataModels::Search::Operation::Range < Metasploit::Model::Search::Operation::Base
+  #
+  # CONSTANTS
+  #
+
+  # Separates beginning from end of the range.
+  SEPARATOR = '-'
+
+  #
+  # Validation
+  #
+
+  validate :ordered
+  validate :range
+
+  #
+  # Instance Methods
+  #
+
+  # Sets `#value` to a `Range` composed by separating `formatted_value` by `-`.
+  #
+  # @param formatted_value [#to_s]
+  # @return [Range<String>]
+  def value=(formatted_value)
+    range_arguments = formatted_value.to_s.split(SEPARATOR, 2)
+
+    begin
+      @value = Range.new(*range_arguments)
+    rescue ArgumentError
+      @value = formatted_value
+    end
+
+    @value
+  end
+
+  private
+
+  # Validates that `#value` is a `Range` with `Range#begin` less than or equal to `Range#begin`
+  #
+  # @return [void]
+  def ordered
+    if value.is_a?(Range) && value.begin > value.end
+      errors.add(:value, :order, begin: value.begin.inspect, end: value.end.inspect)
+    end
+  end
+
+  # Validates that `#value` is a `Range`
+  #
+  # @return [void]
+  def range
+    unless value.is_a? Range
+      errors.add(:value, :range)
+    end
+  end
+end

data/app/models/metasploit_data_models/search/operator/ip_address.rb

@@ -0,0 +1,33 @@
+# Operator for `inet` columns in a PostgreSQL database, which operates on formatted values using
+# {MetasploitDataModels::Search::Operation::IPAddress}.
+class MetasploitDataModels::Search::Operator::IPAddress < Metasploit::Model::Search::Operator::Single
+  #
+  # Attributes
+  #
+
+  # @!attribute [r] attribute
+  #   The attribute on `Metasploit::Model::Search::Operator::Base#klass` that is searchable.
+  #
+  #   @return [Symbol] the attribute name
+  attr_accessor :attribute
+
+  #
+  # Validations
+  #
+
+  validates :attribute,
+            presence: true
+
+  #
+  # Instance Methods
+  #
+
+  alias_method :name, :attribute
+
+  # The class used for `Metasploit::Model::Search::Operator::Single#operate_on`.
+  #
+  # @return [String] `'MetasploitDataModels::Search::Operation::IPAddress'`
+  def operation_class_name
+    @operation_class_name ||= 'MetasploitDataModels::Search::Operation::IPAddress'
+  end
+end

data/app/models/metasploit_data_models/search/operator/multitext.rb

@@ -0,0 +1,73 @@
+require 'shellwords'
+
+# Searches multiple text fields by breaking up the formatted value into words and doing text search for each word across
+# each operator named in {#operator_names}.
+class MetasploitDataModels::Search::Operator::Multitext < Metasploit::Model::Search::Operator::Group::Intersection
+  #
+  # Attributes
+  #
+
+  # @!attribute name
+  #   The name of this operator.
+  #
+  #   @return [Symbol]
+  attr_accessor :name
+
+  # @!attribute operator_names
+  #   The name of the operators to search across.
+  #
+  #   @return [Array<Symbol>]
+  attr_writer :operator_names
+
+  #
+  # Validations
+  #
+
+  validates :operator_names,
+            length: {
+                minimum: 2
+            }
+  validates :name,
+            presence: true
+
+  #
+  # Instance Methods
+  #
+
+  # Breaks `formatted_value` into words using `Shellwords.split`.  Each word is then searched across all {#operators},
+  # where any operator can match for that word.  The search for multiple multiple is intersected, so that additional
+  # words can refine the search.
+  #
+  # @param formatted_value [#to_s]
+  # @return [Array<Metasploit::Model::Search::Operation::Group::Union>] Unions to be intersected.
+  def children(formatted_value)
+    words = Shellwords.split formatted_value.to_s
+
+    words.map { |word|
+      child_operators = operators.map { |operator|
+        operator.operate_on(word)
+      }
+
+      Metasploit::Model::Search::Operation::Group::Union.new(
+          children: child_operators,
+          operator: self
+      )
+    }
+  end
+
+  # The name of the operators to search for each word.
+  #
+  # @return [Array<Symbol>] Default to `[]`
+  def operator_names
+    @operator_names ||= []
+  end
+
+  # Operators with {#operator_names}.
+  #
+  # @return [Array<Metasploit::Model::Search::Operator::Base>]
+  def operators
+    @operators ||= operator_names.map { |operator_name|
+      operator(operator_name)
+    }
+  end
+end

data/app/models/metasploit_data_models/search/operator/port/list.rb

@@ -0,0 +1,67 @@
+# Searches for a network port attribute.  Ports can be given as a single number or range of numbers and either or both
+# forms can be combined into a comma separated list.  Individual port numbers are validated to be greater than 0 and
+class MetasploitDataModels::Search::Operator::Port::List < Metasploit::Model::Search::Operator::Group::Union
+  #
+  # CONSTANTS
+  #
+
+  # Separates port number and/or port ranges
+  SEPARATOR = ','
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] attribute
+  #   Attribute holding port number.
+  #
+  #   @return [Symbol] `:port`
+  attr_writer :attribute
+
+  #
+  # Class Methods
+  #
+
+  # @note Can't be called `name` because it would alias `Class#name`
+  #
+  # Name of this operator.
+  #
+  # @return [String] `'port_list'`
+  def self.operator_name
+    'port_list'
+  end
+
+  #
+  # Instance Methods
+  #
+
+  # Defaults to `:port`.
+  #
+  # @return [Symbol]
+  def attribute
+    @attribute ||= :port
+  end
+
+  # Turns `{#attribute}:<number>,<range>` into the union of port <number> and port <range> searches.
+  #
+  # @param formatted_value [String] comma separated list of port numbers and ranges.
+  # @return [Array<Metasploit::Model::Search::Operation::Base]
+  def children(formatted_value)
+    separated_formatted_values = formatted_value.split(SEPARATOR)
+
+    separated_formatted_values.collect { |separated_formatted_value|
+      operation_class = MetasploitDataModels::Search::Operation::Port::Number
+
+      if separated_formatted_value.include? MetasploitDataModels::Search::Operation::Range::SEPARATOR
+        operation_class = MetasploitDataModels::Search::Operation::Port::Range
+      end
+
+      operation_class.new(
+          value: separated_formatted_value,
+          operator: self
+      )
+    }
+  end
+
+  alias_method :name, :attribute
+end

data/app/models/metasploit_data_models/search/visitor/attribute.rb

@@ -0,0 +1,17 @@
+# Extracts the `Arel::Attribute` objects from `Metasploit::Model::Search::Operator::Base` subclasses.
+class MetasploitDataModels::Search::Visitor::Attribute
+  include Metasploit::Model::Visitation::Visit
+
+  visit 'Metasploit::Model::Search::Operator::Association' do |operator|
+    visit operator.source_operator
+  end
+
+  visit 'Metasploit::Model::Search::Operator::Attribute',
+        'MetasploitDataModels::Search::Operator::IPAddress',
+        'MetasploitDataModels::Search::Operator::Port::List' do |operator|
+    table = operator.klass.arel_table
+    table[operator.attribute]
+  end
+
+  Metasploit::Concern.run(self)
+end

data/app/models/metasploit_data_models/search/visitor/includes.rb

@@ -0,0 +1,47 @@
+# Gathers all the association names to pass to `ActiveRecord::Relation#includes` from a
+# `Metasploit::Model::Search::Query`
+class MetasploitDataModels::Search::Visitor::Includes
+  include Metasploit::Model::Visitation::Visit
+
+  #
+  # Visitors
+  #
+
+  visit 'Metasploit::Model::Search::Group::Base',
+        'Metasploit::Model::Search::Operation::Group::Base' do |parent|
+    parent.children.flat_map { |child|
+      visit child
+    }
+  end
+
+  visit 'Metasploit::Model::Search::Operation::Association' do |operation|
+    association = visit operation.operator
+    nested_associations = visit operation.source_operation
+
+    if nested_associations.empty?
+      [association]
+    else
+      [
+          {
+              association => nested_associations
+          }
+      ]
+    end
+  end
+
+  visit 'Metasploit::Model::Search::Operation::Base' do |operation|
+    visit operation.operator
+  end
+
+  visit 'Metasploit::Model::Search::Operator::Association' do |operator|
+    operator.association
+  end
+
+  visit 'Metasploit::Model::Search::Operator::Attribute',
+        'MetasploitDataModels::Search::Operator::IPAddress',
+        'MetasploitDataModels::Search::Operator::Port::List' do |_operator|
+    []
+  end
+
+  Metasploit::Concern.run(self)
+end

data/app/models/metasploit_data_models/search/visitor/joins.rb

@@ -0,0 +1,67 @@
+# Gathers all the association names to pass to `ActiveRecord::Relation#joins` from a `Metasploit::Model::Search::Query`
+class MetasploitDataModels::Search::Visitor::Joins
+  include Metasploit::Model::Visitation::Visit
+
+  #
+  # Visitors
+  #
+
+  visit 'Metasploit::Model::Search::Group::Intersection',
+        'Metasploit::Model::Search::Operation::Group::Intersection' do |parent|
+    parent.children.flat_map { |child|
+      visit child
+    }
+  end
+
+  visit 'Metasploit::Model::Search::Group::Union',
+        'Metasploit::Model::Search::Operation::Group::Union' do |parent|
+    # A Set<Set> because if all children have multiple joins, but those multiple joins contain the same elements for
+    # all children, then all joins can be counted as common:
+    #
+    #  (a.b:1 && c.d:2) || (a.b:3 && c.d:4) should return [:a, :c] since its common to both
+    #  (a.b:1 && c.d:2 && e.f:3) || (a.b:3 && c.d:4) should return [:a, :c] since its the common _subset_
+    join_set_set = parent.children.each_with_object(Set.new) { |child, set|
+      child_joins = visit child
+      child_join_set = Set.new child_joins
+
+      set.add child_join_set
+    }
+
+    common_join_set = join_set_set.reduce { |common_subset, set|
+      common_subset & set
+    }
+
+    common_join_set.to_a
+  end
+
+  visit 'Metasploit::Model::Search::Operation::Association' do |operation|
+    association = visit operation.operator
+    nested_associations = visit operation.source_operation
+
+    if nested_associations.empty?
+      [association]
+    else
+      [
+          {
+              association => nested_associations
+          }
+      ]
+    end
+  end
+
+  visit 'Metasploit::Model::Search::Operation::Base' do |operation|
+    visit operation.operator
+  end
+
+  visit 'Metasploit::Model::Search::Operator::Association' do |operator|
+    operator.association
+  end
+
+  visit 'Metasploit::Model::Search::Operator::Attribute',
+        'MetasploitDataModels::Search::Operator::IPAddress',
+        'MetasploitDataModels::Search::Operator::Port::List' do |_|
+    []
+  end
+
+  Metasploit::Concern.run(self)
+end

data/app/models/metasploit_data_models/search/visitor/method.rb

@@ -0,0 +1,16 @@
+# Extracts which AREL method to use as a translation for `Metasploit::Model::Search::Group::Base` subclasses.
+class MetasploitDataModels::Search::Visitor::Method
+  include Metasploit::Model::Visitation::Visit
+
+  visit 'Metasploit::Model::Search::Group::Intersection',
+        'Metasploit::Model::Search::Operation::Group::Intersection' do
+    :and
+  end
+
+  visit 'Metasploit::Model::Search::Group::Union',
+        'Metasploit::Model::Search::Operation::Group::Union' do
+    :or
+  end
+
+  Metasploit::Concern.run(self)
+end

data/app/models/metasploit_data_models/search/visitor/relation.rb

@@ -0,0 +1,91 @@
+# Generates a `ActiveRecord::Relation` from an `Metasploit::Model::Search::Query#tree`
+class MetasploitDataModels::Search::Visitor::Relation < Metasploit::Model::Base
+  #
+  # CONSTANTS
+  #
+
+  # `ActiveRecord::Relation` methods that can compute their argument with a visitor under the
+  # {MetasploitDataModels::Search::Visitor} namespace.
+  RELATION_METHODS = [
+      :joins,
+      :includes,
+      :where
+  ]
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] query
+  #   The query to visit.  Query supplies Class with #scope upon which to build `ActiveRecord::Relation`.
+  #
+  #   @return [Metasploit::Model::Search::Query]
+  attr_accessor :query
+
+  #
+  # Validations
+  #
+
+  validate :valid_query
+
+  validates :query,
+            :presence => true
+
+  #
+  # Methods
+  #
+
+  # Visits {#query} tree to produce an `ActiveRecord::Relation` on the `Metasploit::Model::Search::Query#klass`.
+  #
+  # @return [ActiveRecord::Relation]
+  def visit
+    tree = query.tree
+
+    # Enumerable#inject does not support 3 arity for Hashes so need to unpack pair
+    visitor_by_relation_method.inject(query.klass.all) do |relation, pair|
+      relation_method, visitor = pair
+      visited = visitor.visit(tree)
+      relation.send(relation_method, visited)
+    end
+  end
+
+  # Map method on `ActiveRecord::Relation` to visitor that can visit `Metasploit::Model::Search::Query#tree` to
+  # produce the arguments to the method on `ActiveRecord::Relation`.
+  #
+  # @return [Hash{Symbol => #visit}]
+  def visitor_by_relation_method
+    # Enumerable#each_with_object does not support 3 arity for Hashes so need to unpack pair
+    @visitor_by_relation_method ||= self.class.visitor_class_by_relation_method.each_with_object({}) { |pair, visitor_by_relation_method|
+      relation_method, visitor_class = pair
+      visitor_by_relation_method[relation_method] = visitor_class.new
+    }
+  end
+
+  # Maps method on `ActiveRecord::Relation` to the `Class` under {MetasploitDataModels::Search::Visitor} whose
+  # `#visit` method can produce the arguments to the `ActiveRecord::Relation` method.
+  #
+  # @return [Hash{Symbol => Class}]
+  def self.visitor_class_by_relation_method
+    @relation_method_by_visitor_class ||= RELATION_METHODS.each_with_object({}) { |relation_method, relation_method_by_visitor_class|
+      visitor_class_name = "#{parent.name}::#{relation_method.to_s.camelize}"
+      visitor_class = visitor_class_name.constantize
+
+      relation_method_by_visitor_class[relation_method] = visitor_class
+    }
+  end
+
+  private
+
+  # Validates that {#query} is valid.
+  #
+  # @return [void]
+  def valid_query
+    if query and !query.valid?
+      errors.add(:query, :invalid)
+    end
+  end
+
+  private
+
+  Metasploit::Concern.run(self)
+end

data/app/models/metasploit_data_models/search/visitor/where.rb

@@ -0,0 +1,128 @@
+# Generates AREL to pass to `ActiveRecord::Relation#where` from a `Metasploit::Model::Search::Query`.
+class MetasploitDataModels::Search::Visitor::Where
+  include Metasploit::Model::Visitation::Visit
+
+  #
+  # CONSTANTS
+  #
+
+  # `Metasploit::Model::Search::Operation::Base` subclasses that check their value with the equality operator in
+  # AREL
+  EQUALITY_OPERATION_CLASS_NAMES = [
+      'Metasploit::Model::Search::Operation::Boolean',
+      'Metasploit::Model::Search::Operation::Date',
+      'Metasploit::Model::Search::Operation::Integer',
+      'Metasploit::Model::Search::Operation::Set'
+  ]
+
+  #
+  # Visitor
+  #
+
+  visit 'Metasploit::Model::Search::Group::Base',
+        'Metasploit::Model::Search::Operation::Group::Base' do |parent|
+    method = method_visitor.visit parent
+
+    children_arel = parent.children.collect { |child|
+      visit child
+    }
+
+    children_arel.inject { |group_arel, child_arel|
+      group_arel.send(method, child_arel)
+    }
+  end
+
+  visit(*EQUALITY_OPERATION_CLASS_NAMES) do |operation|
+    attribute = attribute_visitor.visit operation.operator
+
+    attribute.eq(operation.value)
+  end
+
+  visit 'Metasploit::Model::Search::Operation::Association' do |operation|
+    visit operation.source_operation
+  end
+
+  visit 'Metasploit::Model::Search::Operation::String' do |operation|
+    attribute = attribute_visitor.visit operation.operator
+    match_value = "%#{operation.value}%"
+
+    attribute.matches(match_value)
+  end
+
+  visit 'MetasploitDataModels::IPAddress::CIDR' do |cidr|
+    cast_to_inet "#{cidr.address}/#{cidr.prefix_length}"
+  end
+
+  visit 'MetasploitDataModels::IPAddress::Range' do |ip_address_range|
+    range = ip_address_range.value
+
+    begin_node = visit range.begin
+    end_node = visit range.end
+
+    # AND nodes should be created with a list
+    Arel::Nodes::And.new([begin_node, end_node])
+  end
+
+  visit 'MetasploitDataModels::IPAddress::V4::Single' do |ip_address|
+    cast_to_inet(ip_address.to_s)
+  end
+
+  visit 'MetasploitDataModels::Search::Operation::IPAddress' do |operation|
+    attribute = attribute_visitor.visit operation.operator
+    value = operation.value
+    value_node = visit value
+
+    case value
+      when MetasploitDataModels::IPAddress::CIDR
+        Arel::Nodes::InfixOperation.new(
+            '<<',
+            attribute,
+            value_node
+        )
+      when MetasploitDataModels::IPAddress::Range
+        Arel::Nodes::Between.new(attribute, value_node)
+      when MetasploitDataModels::IPAddress::V4::Single
+        Arel::Nodes::Equality.new(attribute, value_node)
+      else
+        raise TypeError, "Don't know how to handle #{value.class}"
+    end
+  end
+
+  visit 'MetasploitDataModels::Search::Operation::Port::Range' do |range_operation|
+    attribute = attribute_visitor.visit range_operation.operator
+
+    attribute.between(range_operation.value)
+  end
+
+  #
+  # Methods
+  #
+
+  # Visitor for `Metasploit::Model::Search::Operator::Base` subclasses to generate `Arel::Attributes::Attribute`.
+  #
+  # @return [MetasploitDataModels::Search::Visitor::Attribute]
+  def attribute_visitor
+    @attribute_visitor ||= MetasploitDataModels::Search::Visitor::Attribute.new
+  end
+
+  # Visitor for `Metasploit::Model::Search::Group::Base` subclasses to generate equivalent AREL node methods.
+  #
+  # @return [MetasploitDataModels::Search::Visitor::Method]
+  def method_visitor
+    @method_visitor ||= MetasploitDataModels::Search::Visitor::Method.new
+  end
+
+  private
+
+  # Casts a literal string to INET in AREL.
+  #
+  # @return [Arel::Nodes::NamedFunction]
+  def cast_to_inet(string)
+    cast_argument = Arel::Nodes::As.new(Arel::Nodes.build_quoted(string), Arel::Nodes::SqlLiteral.new('INET'))
+    Arel::Nodes::NamedFunction.new('CAST', [cast_argument])
+  end
+
+  public
+
+  Metasploit::Concern.run(self)
+end

data/config/initializers/arel_helper.rb

@@ -0,0 +1,5 @@
+# Including arel-helpers in all active record models.
+# https://github.com/camertron/arel-helpers
+
+ApplicationRecord.send(:include, ArelHelpers::ArelTable)
+ApplicationRecord.send(:include, ArelHelpers::JoinAssociation)