django-restit 4.2.142__tar.gz → 4.2.144__tar.gz

{django_restit-4.2.142 → django_restit-4.2.144}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.142
+Version: 4.2.144
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

django_restit-4.2.144/incident/extra/abuse.py

@@ -0,0 +1,125 @@
+import requests
+import ipaddress
+from objict import objict
+from rest import settings
+from datetime import datetime
+from enum import Enum
+
+API_KEY = settings.get("ABUSEIPDB_KEY", "")
+
+DEFAULT_HEADERS = {
+    'Accept': 'application/json',
+    'Key': API_KEY
+}
+
+
+class AbuseCategory(Enum):
+    DNS_COMPROMISE = (1, "Altering DNS records resulting in improper redirection.")
+    DNS_POISONING = (2, "Falsifying domain server cache (cache poisoning).")
+    FRAUD_ORDERS = (3, "Fraudulent orders.")
+    DDOS_ATTACK = (4, "Participating in distributed denial-of-service (usually part of botnet).")
+    FTP_BRUTE_FORCE = (5, "FTP Brute-Force")
+    PING_OF_DEATH = (6, "Oversized IP packet.")
+    PHISHING = (7, "Phishing websites and/or email.")
+    FRAUD_VOIP = (8, "Fraud VoIP")
+    OPEN_PROXY = (9, "Open proxy, open relay, or Tor exit node.")
+    WEB_SPAM = (10, "Comment/forum spam, HTTP referer spam, or other CMS spam.")
+    EMAIL_SPAM = (11, "Spam email content, infected attachments, and phishing emails.")
+    BLOG_SPAM = (12, "CMS blog comment spam.")
+    VPN_IP = (13, "Conjunctive category.")
+    PORT_SCAN = (14, "Scanning for open ports and vulnerable services.")
+    HACKING = (15, "Hacking")
+    SQL_INJECTION = (16, "Attempts at SQL injection.")
+    SPOOFING = (17, "Email sender spoofing.")
+    BRUTE_FORCE = (18, "Credential brute-force attacks on webpage logins and services.")
+    BAD_WEB_BOT = (19, "Webpage scraping and crawlers that do not honor robots.txt.")
+    EXPLOITED_HOST = (20, "Host is likely infected with malware and being used for other attacks.")
+    WEB_APP_ATTACK = (21, "Attempts to probe for or exploit installed web applications.")
+    SSH = (22, "Secure Shell (SSH) abuse.")
+    IOT_TARGETED = (23, "Abuse targeted at an 'Internet of Things' type device.")
+
+    def __init__(self, code, description):
+        self.code = code
+        self.description = description
+
+    def __str__(self):
+        return f"{self.name} ({self.code}): {self.description}"
+
+
+def lookup(ip, max_days=0):
+    """
+    {
+      "data": {
+        "ipAddress": "118.25.6.39",
+        "isPublic": true,
+        "ipVersion": 4,
+        "isWhitelisted": false,
+        "abuseConfidenceScore": 100,
+        "countryCode": "CN",
+        "countryName": "China",
+        "usageType": "Data Center/Web Hosting/Transit",
+        "isp": "Tencent Cloud Computing (Beijing) Co. Ltd",
+        "domain": "tencent.com",
+        "hostnames": [],
+        "isTor": false,
+        "totalReports": 1,
+        "numDistinctUsers": 1,
+        "lastReportedAt": "2018-12-20T20:55:14+00:00",
+        "reports": [
+          {
+            "reportedAt": "2018-12-20T20:55:14+00:00",
+            "comment": "Dec 20 20:55:14 srv206 sshd[13937]: Invalid user oracle from 118.25.6.39",
+            "categories": [
+              18,
+              22
+            ],
+            "reporterId": 1,
+            "reporterCountryCode": "US",
+            "reporterCountryName": "United States"
+          }
+        ]
+      }
+    }
+    """
+    if not API_KEY:
+        return objict(errors=[{"detail": "Missing API KEY", "status": 401}])
+    url = 'https://api.abuseipdb.com/api/v2/check'
+    params = dict(ipAddress=ip)
+    if max_days:
+        params["maxAgeInDays"] = max_days
+    response = requests.request(
+        method='GET', url=url, headers=DEFAULT_HEADERS,
+        params=params)
+    return objict.fromJSON(response.text)
+
+
+def reportAbuse(ip, comment, categories):
+    """
+    {
+        "data": {
+            "ipAddress": "127.0.0.1",
+            "abuseConfidenceScore": 52
+        }
+    }
+    """
+    if not API_KEY:
+        return objict(errors=[{"detail": "Missing API KEY", "status": 401}])
+    url = 'https://api.abuseipdb.com/api/v2/report'
+    now_str = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
+    params = dict(ip=ip, comment=comment, timestamp=now_str, categories=categories)
+    response = requests.request(
+        method='POST', url=url,
+        headers=DEFAULT_HEADERS, params=params)
+    return objict.fromJSON(response.text)
+
+
+def isPrivate(ip, ignore_errors=False):
+    if not ignore_errors:
+        ip_obj = ipaddress.ip_address(ip)
+        return ip_obj.is_private
+    try:
+        ip_obj = ipaddress.ip_address(ip)
+        return ip_obj.is_private
+    except Exception:
+        pass
+    return None

{django_restit-4.2.142 → django_restit-4.2.144}/incident/models/event.py

@@ -193,6 +193,7 @@ class Event(JSONMetaData, rm.RestModel):
                     incident.description = self.description
             elif self.category == "ossec":
                 incident.description = f"{self.hostname}: {self.description}"
+                incident.updateAbuseInfo()
             else:
                 incident.description = self.description
             incident.save()

{django_restit-4.2.142 → django_restit-4.2.144}/incident/models/incident.py

@@ -10,6 +10,7 @@ from datetime import datetime, timedelta
 from rest import log
 from ws4redis import client as ws4redis
 import time
+from incident.extra import abuse
 
 logger = log.getLogger("incident", filename="incident.log")
 
@@ -483,6 +484,19 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
                     email_only=True,
                     from_email=INCIDENT_EMAIL_FROM)
 
+    def updateAbuseInfo(self, ip=None):
+        # for now we just check if this ip is in the abuse ip db
+        if ip is None:
+            ip = self.reporter_ip
+        is_priv = abuse.isPrivate(ip, ignore_errors=True)
+        if is_priv is not None:
+            self.setProperty("is_private_ip", is_priv)
+            if is_priv:
+                return
+        info = abuse.lookup(ip, 0)
+        if "errors" not in info:
+            self.setProperty("abuse_info", info)
+
     @classmethod
     def getBundled(cls, rule, event):
         # calculate our bundle start time

{django_restit-4.2.142 → django_restit-4.2.144}/incident/rpc.py

@@ -3,6 +3,7 @@ from rest import views as rv
 from rest import helpers as rh
 from rest import settings
 from . import models as am
+from .extra import abuse 
 from .parsers import ossec
 from taskqueue.models import Task
 import incident
@@ -234,3 +235,20 @@ def rest_firewall_block(request):
 @rd.url('ticket/<int:pk>')
 def rest_on_ticket(request, pk=None):
     return am.Ticket.on_rest_request(request, pk)
+
+
+@rd.urlGET('abuse/lookup')
+@rd.requires_params(["ip"])
+def rest_on_abuse_ip_lookup(request):
+    resp = abuse.lookup(request.DATA.get("ip"), request.DATA.get("max_age", 0))
+    return rv.restReturn(request, resp)
+
+
+@rd.urlPOST('abuse/report')
+@rd.requires_params(["ip", "comment", "categories"])
+def rest_on_report_abuse(request):
+    resp = abuse.reportAbuse(
+        ip=request.DATA.get("ip"),
+        comment=request.DATA.get("comment"),
+        categories=request.DATA.get("categories"))
+    return rv.restReturn(request, resp)

{django_restit-4.2.142 → django_restit-4.2.144}/medialib/utils.py

@@ -7,8 +7,8 @@ import hashlib
 
 EXT_MAP = {
     "V":['mpg', 'mpeg', 'mpe', 'mp4', 'm4v', 'mov', 'qt', '3gp', 'ogv', 'webm', 'flv', 'asf', 'asx', 'wmv', 'mpv', 'mkv', 'avi', 'dat', 'swf'],
-    "I":['jpg', 'jpg', 'jpeg', 'gif', 'png', 'bmp', 'tif', 'tiff'],
-    "T":['txt', 'html'],
+    "I":['jpg', 'jpg', 'jpeg', 'gif', 'png', 'bmp', 'tif', 'tiff', 'webp', 'ico'],
+    "T":['txt', 'html', 'csv', 'md'],
 }
 
 KIND_MAP = {
@@ -27,7 +27,7 @@ def guessBase64Kind(data):
     # look at first 16 bytes for ext
     sample = fromBase64ToBytes(data[:16]).lower() # data[:16]
     # sample = self.base64_data[:16].decode('base64').lower()
-    for ext in ["png", "jpg", "jpeg", "jfif", "bmp", "gif", "tif"]:
+    for ext in ["png", "jpg", "jpeg", "jfif", "bmp", "gif", "tif", "webp"]:
         if toBytes(ext) in sample:
             if ext == "jfif":
                 ext = "jpg"

{django_restit-4.2.142 → django_restit-4.2.144}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.142"
+version = "4.2.144"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.2.142 → django_restit-4.2.144}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.142"
+__version__ = "4.2.144"

{django_restit-4.2.142 → django_restit-4.2.144}/rest/rpc.py

@@ -81,6 +81,7 @@ def on_get_system_info(request):
     out = hostinfo.getHostInfo(
         include_versions=request.DATA.get("versions") and SOFTWARE_VERSIONS,
         include_blocked=request.DATA.get("blocked"))
+    out["redist_pool"] = redis.getPoolStatus()
     return views.restGet(request, out)
 
 

{django_restit-4.2.142 → django_restit-4.2.144}/ws4redis/connection.py

@@ -286,7 +286,7 @@ class WebsocketConnection():
             if bool(self.last_msg):
                 self.on_ws_msg(self.last_msg)
         except Exception:
-            logger.exception()
+            # logger.exception()
             logger.error("unable to recv on ws... flushing")
             self.websocket.flush()
 

{django_restit-4.2.142 → django_restit-4.2.144}/ws4redis/redis.py

@@ -168,6 +168,7 @@ class RedisStore():
         if self.pubsub and self.pubsub.subscribed:
             self.pubsub.unsubscribe()
             self.pubsub.reset()
+        self.connection = None
 
     def __enter__(self):
         return self