pynetworkintel 0.2.0__py3-none-any.whl

pynetworkintel/analysis/rules.py

@@ -0,0 +1,247 @@
+"""Configuration rule engine for security analysis."""
+
+import logging
+import re
+from typing import List, Dict, Any, Optional
+from dataclasses import dataclass
+
+from pynetworkintel.models import Device, SecurityFinding, Severity, FindingType
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class Rule:
+    name: str
+    device_type: str
+    severity: Severity
+    description: str
+    recommendation: str
+    business_impact: str
+    checks: List[Dict[str, Any]]
+
+
+class RuleChecker:
+    """Evaluate configuration rules against devices."""
+
+    def __init__(self):
+        self.rules = self._load_default_rules()
+
+    def _load_default_rules(self) -> List[Rule]:
+        """Load default security rules."""
+        return [
+            Rule(
+                name="SSH with password authentication enabled",
+                device_type="linux",
+                severity=Severity.HIGH,
+                description="SSH allows password-based login instead of key-only authentication",
+                recommendation="Set 'PasswordAuthentication no' in /etc/ssh/sshd_config, require SSH keys only",
+                business_impact="Brute-force attack vulnerability on critical infrastructure",
+                checks=[
+                    {
+                        "config_key": "/etc/ssh/sshd_config",
+                        "regex": r"PasswordAuthentication\s+yes",
+                    }
+                ],
+            ),
+            Rule(
+                name="SSH with weak cipher algorithms",
+                device_type="linux",
+                severity=Severity.MEDIUM,
+                description="SSH is configured with weak encryption ciphers below recommended standards",
+                recommendation="Configure strong ciphers in sshd_config: aes256-gcm, aes256-ctr, or stronger",
+                business_impact="Encrypted connection could be compromised with advanced attack methods",
+                checks=[
+                    {
+                        "config_key": "/etc/ssh/sshd_config",
+                        "regex": r"Ciphers.*aes128",
+                    }
+                ],
+            ),
+            Rule(
+                name="SSH root login enabled",
+                device_type="linux",
+                severity=Severity.HIGH,
+                description="Direct SSH login as root is allowed, increasing compromise risk",
+                recommendation="Set 'PermitRootLogin no' in /etc/ssh/sshd_config, use sudo for elevated access",
+                business_impact="Attacker can directly access system with highest privilege if SSH is compromised",
+                checks=[
+                    {
+                        "config_key": "/etc/ssh/sshd_config",
+                        "regex": r"PermitRootLogin\s+yes",
+                    }
+                ],
+            ),
+            Rule(
+                name="Telnet service is accessible",
+                device_type="linux",
+                severity=Severity.CRITICAL,
+                description="Telnet is an unencrypted remote access protocol that transmits passwords in plaintext",
+                recommendation="Disable Telnet immediately, use SSH for encrypted remote access",
+                business_impact="Credentials and all communication visible to anyone on the network",
+                checks=[
+                    {
+                        "config_key": "/etc/iptables/rules",
+                        "regex": r"ACCEPT.*port 23",
+                    }
+                ],
+            ),
+            Rule(
+                name="FTP service is accessible",
+                device_type="linux",
+                severity=Severity.CRITICAL,
+                description="FTP is an unencrypted file transfer protocol that transmits credentials in plaintext",
+                recommendation="Disable FTP, use SFTP or SCP for secure file transfer",
+                business_impact="Credentials and file transfers visible to anyone on the network",
+                checks=[
+                    {
+                        "config_key": "/etc/iptables/rules",
+                        "regex": r"ACCEPT.*port 21",
+                    }
+                ],
+            ),
+            Rule(
+                name="Database port exposed to subnet",
+                device_type="linux",
+                severity=Severity.HIGH,
+                description="Database port (MySQL/PostgreSQL) accessible from internal network, not just app servers",
+                recommendation="Restrict database access using firewall rules to specific application server IPs only",
+                business_impact="Lateral movement risk - any compromised device in subnet can access database",
+                checks=[
+                    {
+                        "config_key": "/etc/iptables/rules",
+                        "regex": r"ACCEPT.*sport (3306|5432)",
+                    }
+                ],
+            ),
+            Rule(
+                name="HTTP access without HTTPS redirect",
+                device_type="linux",
+                severity=Severity.MEDIUM,
+                description="HTTP (port 80) is accessible without automatic redirect to HTTPS",
+                recommendation="Configure web server to redirect all HTTP traffic to HTTPS (port 443)",
+                business_impact="User credentials or session data could be intercepted if not redirected",
+                checks=[
+                    {
+                        "config_key": "/etc/iptables/rules",
+                        "regex": r"ACCEPT.*dport 80",
+                    }
+                ],
+            ),
+            Rule(
+                name="Firewall allows wide open access",
+                device_type="linux",
+                severity=Severity.CRITICAL,
+                description="Firewall rule allows access from all sources (0.0.0.0/0) to sensitive port",
+                recommendation="Restrict firewall rules to specific source IPs or networks only",
+                business_impact="Any attacker on the internet can attempt to exploit this port",
+                checks=[
+                    {
+                        "config_key": "/etc/iptables/rules",
+                        "regex": r"ACCEPT.*0\.0\.0\.0\/0.*dport (22|3306|5432)",
+                    }
+                ],
+            ),
+            Rule(
+                name="SNMP with default community string",
+                device_type="linux",
+                severity=Severity.HIGH,
+                description="SNMP is configured with default community strings (public/private)",
+                recommendation="Change SNMP community strings to strong, unique values or disable if not needed",
+                business_impact="Attackers can query device for system information and configuration details",
+                checks=[
+                    {
+                        "config_key": "/etc/snmp/snmpd.conf",
+                        "regex": r"rocommunity\s+(public|private)",
+                    }
+                ],
+            ),
+            Rule(
+                name="No SSH key-based authentication enforcement",
+                device_type="linux",
+                severity=Severity.MEDIUM,
+                description="SSH allows multiple authentication methods, not strictly key-based",
+                recommendation="Configure SSH to use only key-based authentication, disable passwords and other methods",
+                business_impact="Reduces effectiveness of SSH key security if weaker auth methods are available",
+                checks=[
+                    {
+                        "config_key": "/etc/ssh/sshd_config",
+                        "regex": r"PubkeyAuthentication\s+no|AuthenticationMethods\s+password",
+                    }
+                ],
+            ),
+        ]
+
+    def check_device(self, device: Device) -> List[SecurityFinding]:
+        """
+        Check device against all applicable rules.
+
+        Args:
+            device: Device to check
+
+        Returns:
+            List of security findings
+        """
+        findings = []
+
+        for rule in self.rules:
+            if rule.device_type not in ("any", device.device_type):
+                continue
+
+            if self._rule_matches(device, rule):
+                finding = SecurityFinding(
+                    device=f"{device.ip} ({device.hostname or 'unknown'})",
+                    finding_type=FindingType.CONFIGURATION,
+                    severity=rule.severity,
+                    title=rule.name,
+                    description=rule.description,
+                    evidence=self._extract_evidence(device, rule),
+                    recommendation=rule.recommendation,
+                    business_impact=rule.business_impact,
+                )
+                findings.append(finding)
+
+        return findings
+
+    def _rule_matches(self, device: Device, rule: Rule) -> bool:
+        """Check if device violates any condition in rule."""
+        for check in rule.checks:
+            if self._check_matches(device, check):
+                return True
+        return False
+
+    def _check_matches(self, device: Device, check: Dict[str, Any]) -> bool:
+        """Evaluate a single check condition against device."""
+        config_key = check.get("config_key")
+        regex = check.get("regex")
+
+        if not config_key or not regex:
+            return False
+
+        for config in device.configs:
+            if config.path == config_key:
+                if re.search(regex, config.content, re.MULTILINE | re.IGNORECASE):
+                    return True
+
+        return False
+
+    def _extract_evidence(self, device: Device, rule: Rule) -> str:
+        """Extract matching evidence from device configuration."""
+        for check in rule.checks:
+            config_key = check.get("config_key")
+            regex = check.get("regex")
+
+            if not config_key or not regex:
+                continue
+
+            for config in device.configs:
+                if config.path == config_key:
+                    matches = re.finditer(regex, config.content, re.MULTILINE | re.IGNORECASE)
+                    for match in matches:
+                        return f"Found in {config_key}: {match.group(0)}"
+
+        return f"Check failed for {rule.name}"
+
+    def add_rule(self, rule: Rule):
+        """Add custom rule to checker."""
+        self.rules.append(rule)

pynetworkintel/changes.py

@@ -0,0 +1,221 @@
+"""Device and vulnerability change detection."""
+
+import logging
+from datetime import datetime
+from typing import List, Dict, Any, Optional
+from sqlalchemy.orm import Session
+
+from pynetworkintel.models import Device, ScanResult
+from pynetworkintel.db import (
+    Database, DeviceChange, VulnerabilityChange, Finding,
+    Device as DBDevice, Finding as DBFinding
+)
+
+logger = logging.getLogger(__name__)
+
+
+class ChangeDetector:
+    """Detect changes in network state."""
+
+    def __init__(self, db: Database):
+        self.db = db
+
+    def detect_device_changes(self, current_devices: List[Device], scan_id: int) -> List[Dict[str, Any]]:
+        """
+        Detect device additions, removals, and status changes.
+
+        Returns:
+            List of change dictionaries
+        """
+        changes = []
+        session = self.db.get_session()
+
+        try:
+            current_ips = {d.ip for d in current_devices}
+
+            # Find previously seen devices
+            previous_ips = set(
+                ip[0] for ip in session.query(DBDevice.ip).distinct().all()
+            )
+
+            # New devices
+            for ip in current_ips - previous_ips:
+                device = next(d for d in current_devices if d.ip == ip)
+                change = {
+                    "type": "device_discovered",
+                    "ip": ip,
+                    "hostname": device.hostname,
+                    "os": device.os,
+                    "timestamp": datetime.utcnow(),
+                }
+                changes.append(change)
+                self._record_device_change(session, ip, "discovered", device.hostname, device.os)
+
+            # Removed devices (were online, now offline)
+            for ip in previous_ips - current_ips:
+                change = {
+                    "type": "device_removed",
+                    "ip": ip,
+                    "timestamp": datetime.utcnow(),
+                }
+                changes.append(change)
+                self._record_device_change(session, ip, "removed", None, None)
+
+            session.commit()
+
+        finally:
+            session.close()
+
+        return changes
+
+    def detect_vulnerability_changes(self, current_findings: List, previous_findings_by_ip: Dict) -> List[Dict[str, Any]]:
+        """
+        Detect new vulnerabilities and resolved vulnerabilities.
+
+        Returns:
+            List of change dictionaries
+        """
+        changes = []
+        session = self.db.get_session()
+
+        try:
+            # Group current findings by device IP and CVE
+            current_by_ip_cve = {}
+            for finding in current_findings:
+                if finding.cve_id:
+                    key = (finding.device, finding.cve_id)
+                    current_by_ip_cve[key] = finding
+
+            # Check for new vulnerabilities
+            for (device_ip, cve_id), finding in current_by_ip_cve.items():
+                previous = previous_findings_by_ip.get((device_ip, cve_id))
+                if not previous:
+                    change = {
+                        "type": "vulnerability_discovered",
+                        "device_ip": device_ip,
+                        "cve_id": cve_id,
+                        "severity": finding.severity.value,
+                        "title": finding.title,
+                        "timestamp": datetime.utcnow(),
+                    }
+                    changes.append(change)
+                    self._record_vulnerability_change(
+                        session,
+                        device_ip,
+                        cve_id,
+                        finding.title,
+                        finding.severity.value,
+                    )
+
+            # Check for resolved vulnerabilities
+            for (device_ip, cve_id), previous_finding in previous_findings_by_ip.items():
+                if (device_ip, cve_id) not in current_by_ip_cve:
+                    change = {
+                        "type": "vulnerability_resolved",
+                        "device_ip": device_ip,
+                        "cve_id": cve_id,
+                        "timestamp": datetime.utcnow(),
+                    }
+                    changes.append(change)
+                    self._mark_vulnerability_resolved(session, device_ip, cve_id)
+
+            session.commit()
+
+        finally:
+            session.close()
+
+        return changes
+
+    def get_previous_scan_findings(self) -> Dict[tuple, Any]:
+        """Get findings from previous scan grouped by (device_ip, cve_id)."""
+        session = self.db.get_session()
+
+        try:
+            findings = session.query(DBFinding).order_by(DBFinding.found_at.desc()).all()
+
+            # Keep only the most recent findings for each device
+            grouped = {}
+            for finding in findings:
+                key = (finding.device_ip, finding.cve_id)
+                if key not in grouped:
+                    grouped[key] = finding
+
+            return grouped
+
+        finally:
+            session.close()
+
+    def _record_device_change(self, session: Session, ip: str, change_type: str, hostname: Optional[str], os: Optional[str]):
+        """Record a device change in database."""
+        change = DeviceChange(
+            ip=ip,
+            hostname=hostname,
+            change_type=change_type,
+            details={"os": os} if os else None,
+        )
+        session.add(change)
+
+    def _record_vulnerability_change(self, session: Session, device_ip: str, cve_id: str, title: str, severity: str):
+        """Record a vulnerability discovery."""
+        vuln_change = VulnerabilityChange(
+            device_ip=device_ip,
+            cve_id=cve_id,
+            title=title,
+            severity=severity,
+        )
+        session.add(vuln_change)
+
+    def _mark_vulnerability_resolved(self, session: Session, device_ip: str, cve_id: str):
+        """Mark a vulnerability as resolved."""
+        change = session.query(VulnerabilityChange).filter(
+            VulnerabilityChange.device_ip == device_ip,
+            VulnerabilityChange.cve_id == cve_id,
+            VulnerabilityChange.resolved_at.is_(None),
+        ).first()
+
+        if change:
+            change.resolved_at = datetime.utcnow()
+            session.add(change)
+
+
+class ChangeReporter:
+    """Report detected changes in human-readable format."""
+
+    @staticmethod
+    def summarize_changes(changes: List[Dict[str, Any]]) -> str:
+        """Generate summary of detected changes."""
+        if not changes:
+            return "No changes detected since last scan."
+
+        summary = ["Changes Detected Since Previous Scan:\n"]
+
+        device_discovered = [c for c in changes if c["type"] == "device_discovered"]
+        device_removed = [c for c in changes if c["type"] == "device_removed"]
+        vuln_discovered = [c for c in changes if c["type"] == "vulnerability_discovered"]
+        vuln_resolved = [c for c in changes if c["type"] == "vulnerability_resolved"]
+
+        if device_discovered:
+            summary.append(f"+ New Devices: {len(device_discovered)}")
+            for change in device_discovered[:3]:
+                summary.append(f"  - {change['ip']} ({change.get('hostname', 'unknown')})")
+            if len(device_discovered) > 3:
+                summary.append(f"  ... and {len(device_discovered) - 3} more")
+
+        if device_removed:
+            summary.append(f"- Removed Devices: {len(device_removed)}")
+            for change in device_removed[:3]:
+                summary.append(f"  - {change['ip']}")
+            if len(device_removed) > 3:
+                summary.append(f"  ... and {len(device_removed) - 3} more")
+
+        if vuln_discovered:
+            summary.append(f"! New Vulnerabilities: {len(vuln_discovered)}")
+            for change in vuln_discovered[:3]:
+                summary.append(f"  - {change['cve_id']} ({change['severity'].upper()}): {change['title'][:50]}")
+            if len(vuln_discovered) > 3:
+                summary.append(f"  ... and {len(vuln_discovered) - 3} more")
+
+        if vuln_resolved:
+            summary.append(f"✓ Resolved Vulnerabilities: {len(vuln_resolved)}")
+
+        return "\n".join(summary)