pynetworkintel 0.2.0__py3-none-any.whl

pynetworkintel/core.py

@@ -0,0 +1,170 @@
+"""Core scanner and analyzer classes."""
+
+import logging
+import time
+from typing import Optional, List
+from datetime import datetime
+
+from pynetworkintel.models import ScanResult, Device
+from pynetworkintel.discovery import DeviceScanner, SSHConfigGrabber
+from pynetworkintel.analysis import RuleChecker, CVEChecker, LLMAnalyzer
+
+logger = logging.getLogger(__name__)
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",
+)
+
+
+class Scanner:
+    """High-level device discovery scanner."""
+
+    def __init__(
+        self,
+        nmap_path: str = "nmap",
+        ssh_username: str = "root",
+        ssh_key_path: Optional[str] = None,
+        ssh_password: Optional[str] = None,
+    ):
+        self.device_scanner = DeviceScanner(nmap_path)
+        self.ssh_grabber = SSHConfigGrabber(ssh_username, ssh_key_path, ssh_password)
+
+    def scan(self, target: str, grab_configs: bool = True) -> ScanResult:
+        """
+        Scan network for devices and gather configuration.
+
+        Args:
+            target: IP address, CIDR range, or hostname
+            grab_configs: Whether to attempt SSH config grab (requires credentials)
+
+        Returns:
+            ScanResult with discovered devices
+        """
+        start_time = time.time()
+
+        logger.info(f"Starting network scan for {target}")
+        devices = self.device_scanner.discover(target)
+
+        if grab_configs and devices:
+            logger.info(f"Attempting to grab configs from {len(devices)} devices")
+            for device in devices:
+                if self.ssh_grabber.grab_configs(device):
+                    logger.debug(f"Successfully grabbed configs from {device.ip}")
+                else:
+                    logger.debug(f"Could not grab configs from {device.ip}")
+
+        duration = time.time() - start_time
+
+        result = ScanResult(devices=devices, scan_duration_seconds=duration)
+
+        logger.info(
+            f"Scan complete: {len(devices)} devices in {duration:.1f} seconds"
+        )
+
+        return result
+
+
+class Analyzer:
+    """Security analyzer for scan results."""
+
+    def __init__(self, anthropic_api_key: Optional[str] = None):
+        self.rule_checker = RuleChecker()
+        self.cve_checker = CVEChecker()
+        self.llm_analyzer = LLMAnalyzer(anthropic_api_key)
+
+    def analyze(self, scan_result: ScanResult) -> ScanResult:
+        """
+        Perform full security analysis on scan results.
+
+        Args:
+            scan_result: Results from scanner
+
+        Returns:
+            Updated ScanResult with findings
+        """
+        logger.info("Starting security analysis")
+
+        for device in scan_result.devices:
+            logger.debug(f"Analyzing device {device.ip}")
+
+            # Check configuration rules
+            rule_findings = self.rule_checker.check_device(device)
+            scan_result.findings.extend(rule_findings)
+
+            # Check for known CVEs
+            cve_findings = self.cve_checker.check_device(device)
+            scan_result.findings.extend(cve_findings)
+
+        logger.info(f"Analysis complete: {len(scan_result.findings)} findings")
+
+        return scan_result
+
+    def summarize(self, scan_result: ScanResult) -> str:
+        """
+        Generate plain English summary of findings.
+
+        Args:
+            scan_result: Analyzed scan results
+
+        Returns:
+            Plain English summary
+        """
+        logger.info("Generating AI summary")
+        return self.llm_analyzer.summarize_findings(scan_result)
+
+    def get_summary(self, scan_result: ScanResult) -> dict:
+        """Get structured summary of findings."""
+        return scan_result.summary()
+
+
+class Pipeline:
+    """Full scanning and analysis pipeline."""
+
+    def __init__(
+        self,
+        nmap_path: str = "nmap",
+        ssh_username: str = "root",
+        ssh_key_path: Optional[str] = None,
+        ssh_password: Optional[str] = None,
+        anthropic_api_key: Optional[str] = None,
+    ):
+        self.scanner = Scanner(nmap_path, ssh_username, ssh_key_path, ssh_password)
+        self.analyzer = Analyzer(anthropic_api_key)
+
+    def run(self, target: str, grab_configs: bool = True, summarize: bool = False) -> dict:
+        """
+        Run complete scan and analysis pipeline.
+
+        Args:
+            target: Network target to scan
+            grab_configs: Whether to grab device configs
+            summarize: Whether to generate LLM summary
+
+        Returns:
+            Dictionary with results
+        """
+        logger.info("Starting PyNetworkIntel pipeline")
+
+        # Scan
+        scan_result = self.scanner.scan(target, grab_configs)
+
+        # Analyze
+        scan_result = self.analyzer.analyze(scan_result)
+
+        result = {
+            "devices": [d.to_dict() for d in scan_result.devices],
+            "findings": [f.to_dict() for f in scan_result.findings],
+            "summary": self.analyzer.get_summary(scan_result),
+            "scan_time": scan_result.scan_time.isoformat(),
+            "scan_duration_seconds": scan_result.scan_duration_seconds,
+        }
+
+        # Generate summary if requested
+        if summarize:
+            result["ai_summary"] = self.analyzer.summarize(scan_result)
+
+        logger.info("Pipeline complete")
+
+        return result

pynetworkintel/db.py

@@ -0,0 +1,218 @@
+"""Database models and ORM configuration."""
+
+from datetime import datetime
+from typing import Optional, List
+from sqlalchemy import create_engine, Column, Integer, String, DateTime, Boolean, Float, ForeignKey, Text, JSON, Index
+from sqlalchemy.ext.declarative import declarative_base
+from sqlalchemy.orm import sessionmaker, relationship, Session
+from sqlalchemy.pool import StaticPool
+
+Base = declarative_base()
+
+
+class ScanSession(Base):
+    """Represents a network scan execution."""
+
+    __tablename__ = "scan_sessions"
+
+    id = Column(Integer, primary_key=True)
+    scan_time = Column(DateTime, default=datetime.utcnow, index=True)
+    duration_seconds = Column(Float)
+    target = Column(String(255))
+    device_count = Column(Integer, default=0)
+    finding_count = Column(Integer, default=0)
+    status = Column(String(50), default="completed")  # completed, failed, in_progress
+    error_message = Column(Text, nullable=True)
+
+    devices = relationship("Device", back_populates="scan", cascade="all, delete-orphan")
+    findings = relationship("Finding", back_populates="scan", cascade="all, delete-orphan")
+
+    __table_args__ = (Index("idx_scan_time", "scan_time"), Index("idx_target", "target"))
+
+
+class Device(Base):
+    """Network device discovered during scan."""
+
+    __tablename__ = "devices"
+
+    id = Column(Integer, primary_key=True)
+    scan_id = Column(Integer, ForeignKey("scan_sessions.id"), index=True)
+    ip = Column(String(45), index=True)  # IPv4 or IPv6
+    hostname = Column(String(255), nullable=True)
+    os = Column(String(255), nullable=True)
+    device_type = Column(String(50), default="linux")
+    is_online = Column(Boolean, default=True)
+    last_seen = Column(DateTime, default=datetime.utcnow, index=True)
+    first_seen = Column(DateTime, default=datetime.utcnow)
+
+    scan = relationship("ScanSession", back_populates="devices")
+    services = relationship("Service", back_populates="device", cascade="all, delete-orphan")
+    configs = relationship("DeviceConfig", back_populates="device", cascade="all, delete-orphan")
+
+    __table_args__ = (Index("idx_device_ip_scan", "ip", "scan_id"),)
+
+
+class Service(Base):
+    """Network service running on a device."""
+
+    __tablename__ = "services"
+
+    id = Column(Integer, primary_key=True)
+    device_id = Column(Integer, ForeignKey("devices.id"), index=True)
+    port = Column(Integer)
+    name = Column(String(100))
+    version = Column(String(255), nullable=True)
+    protocol = Column(String(10), default="tcp")
+    state = Column(String(50), default="open")
+    first_seen = Column(DateTime, default=datetime.utcnow)
+    last_seen = Column(DateTime, default=datetime.utcnow)
+
+    device = relationship("Device", back_populates="services")
+
+    __table_args__ = (Index("idx_service_device_port", "device_id", "port"),)
+
+
+class DeviceConfig(Base):
+    """Configuration file content from device."""
+
+    __tablename__ = "device_configs"
+
+    id = Column(Integer, primary_key=True)
+    device_id = Column(Integer, ForeignKey("devices.id"), index=True)
+    path = Column(String(500))
+    content = Column(Text)
+    device_type = Column(String(50))
+    captured_at = Column(DateTime, default=datetime.utcnow)
+
+    device = relationship("Device", back_populates="configs")
+
+
+class Finding(Base):
+    """Security finding from analysis."""
+
+    __tablename__ = "findings"
+
+    id = Column(Integer, primary_key=True)
+    scan_id = Column(Integer, ForeignKey("scan_sessions.id"), index=True)
+    device_ip = Column(String(45), index=True)
+    device_hostname = Column(String(255), nullable=True)
+    finding_type = Column(String(50))  # configuration, cve, exposure, performance
+    severity = Column(String(20), index=True)  # critical, high, medium, low, info
+    title = Column(String(500))
+    description = Column(Text)
+    evidence = Column(Text)
+    recommendation = Column(Text)
+    business_impact = Column(Text)
+    cve_id = Column(String(50), nullable=True, index=True)
+    cvss_score = Column(Float, nullable=True)
+    exploit_available = Column(Boolean, default=False)
+    found_at = Column(DateTime, default=datetime.utcnow, index=True)
+    resolved_at = Column(DateTime, nullable=True)
+
+    scan = relationship("ScanSession", back_populates="findings")
+
+    __table_args__ = (
+        Index("idx_finding_severity_scan", "severity", "scan_id"),
+        Index("idx_finding_device_ip", "device_ip"),
+    )
+
+
+class VulnerabilityChange(Base):
+    """Track when vulnerabilities appear/disappear."""
+
+    __tablename__ = "vulnerability_changes"
+
+    id = Column(Integer, primary_key=True)
+    device_ip = Column(String(45), index=True)
+    cve_id = Column(String(50), index=True)
+    title = Column(String(500))
+    appeared_at = Column(DateTime, default=datetime.utcnow, index=True)
+    resolved_at = Column(DateTime, nullable=True)
+    severity = Column(String(20))
+
+    __table_args__ = (Index("idx_vuln_device_cve", "device_ip", "cve_id"),)
+
+
+class DeviceChange(Base):
+    """Track device inventory changes."""
+
+    __tablename__ = "device_changes"
+
+    id = Column(Integer, primary_key=True)
+    ip = Column(String(45), index=True)
+    hostname = Column(String(255), nullable=True)
+    change_type = Column(String(50))  # discovered, removed, online, offline
+    detected_at = Column(DateTime, default=datetime.utcnow, index=True)
+    details = Column(JSON, nullable=True)
+
+    __table_args__ = (Index("idx_device_change_ip", "ip"),)
+
+
+class Alert(Base):
+    """Security alert/notification."""
+
+    __tablename__ = "alerts"
+
+    id = Column(Integer, primary_key=True)
+    alert_type = Column(String(50))  # new_vulnerability, device_offline, config_change
+    severity = Column(String(20))
+    title = Column(String(500))
+    description = Column(Text)
+    device_ip = Column(String(45), nullable=True)
+    cve_id = Column(String(50), nullable=True)
+    created_at = Column(DateTime, default=datetime.utcnow, index=True)
+    sent_at = Column(DateTime, nullable=True)
+    acknowledged_at = Column(DateTime, nullable=True)
+    status = Column(String(50), default="pending")  # pending, sent, acknowledged, resolved
+
+    __table_args__ = (
+        Index("idx_alert_status", "status"),
+        Index("idx_alert_created", "created_at"),
+    )
+
+
+class Database:
+    """Database connection and session management."""
+
+    def __init__(self, database_url: str = "sqlite:///pynetworkintel.db"):
+        self.database_url = database_url
+        self.engine = create_engine(
+            database_url,
+            echo=False,
+            # Use StaticPool for SQLite to avoid threading issues
+            poolclass=StaticPool if database_url.startswith("sqlite") else None,
+        )
+        self.SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=self.engine)
+
+    def create_all(self):
+        """Create all database tables."""
+        Base.metadata.create_all(bind=self.engine)
+
+    def get_session(self) -> Session:
+        """Get a new database session."""
+        return self.SessionLocal()
+
+    def close(self):
+        """Close all connections."""
+        self.engine.dispose()
+
+
+# Singleton database instance
+_db_instance: Optional[Database] = None
+
+
+def init_db(database_url: str = "sqlite:///pynetworkintel.db") -> Database:
+    """Initialize database singleton."""
+    global _db_instance
+    _db_instance = Database(database_url)
+    _db_instance.create_all()
+    return _db_instance
+
+
+def get_db() -> Database:
+    """Get singleton database instance."""
+    global _db_instance
+    if _db_instance is None:
+        _db_instance = Database()
+        _db_instance.create_all()
+    return _db_instance

pynetworkintel/discovery/__init__.py

@@ -0,0 +1,6 @@
+"""Device discovery engines."""
+
+from pynetworkintel.discovery.scanner import DeviceScanner, NmapScanner, ARPScanner
+from pynetworkintel.discovery.ssh_config import SSHConfigGrabber
+
+__all__ = ["DeviceScanner", "NmapScanner", "ARPScanner", "SSHConfigGrabber"]

pynetworkintel/discovery/scanner.py

@@ -0,0 +1,243 @@
+"""Network device discovery engine."""
+
+import subprocess
+import json
+import logging
+import socket
+from typing import List, Optional, Set
+from datetime import datetime
+import xml.etree.ElementTree as ET
+
+from pynetworkintel.models import Device, Service
+
+logger = logging.getLogger(__name__)
+
+
+class NmapScanner:
+    """Wrapper around nmap for service discovery."""
+
+    def __init__(self, nmap_path: str = "nmap"):
+        self.nmap_path = nmap_path
+        self._check_nmap_available()
+
+    def _check_nmap_available(self):
+        try:
+            subprocess.run([self.nmap_path, "-V"], capture_output=True, timeout=5)
+        except (subprocess.TimeoutExpired, FileNotFoundError):
+            logger.warning(f"nmap not found at {self.nmap_path}. Some discovery features will be limited.")
+
+    def scan(self, target: str) -> List[Device]:
+        """
+        Scan target subnet/host for active devices and services.
+
+        Args:
+            target: IP address, CIDR range (10.0.0.0/24), or hostname
+
+        Returns:
+            List of discovered devices with service information
+        """
+        devices = []
+
+        try:
+            cmd = [
+                self.nmap_path,
+                "-sV",
+                "--script=smb-os-discovery",
+                "-oX",
+                "-",
+                target,
+            ]
+
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
+
+            if result.returncode not in (0, 1):
+                logger.error(f"nmap scan failed: {result.stderr}")
+                return devices
+
+            devices = self._parse_nmap_xml(result.stdout)
+
+        except subprocess.TimeoutExpired:
+            logger.error(f"nmap scan timeout for {target}")
+        except Exception as e:
+            logger.error(f"nmap scan error: {e}")
+
+        return devices
+
+    def _parse_nmap_xml(self, xml_output: str) -> List[Device]:
+        """Parse nmap XML output and extract device information."""
+        devices = []
+
+        try:
+            root = ET.fromstring(xml_output)
+        except ET.ParseError:
+            logger.error("Failed to parse nmap XML output")
+            return devices
+
+        for host in root.findall(".//host"):
+            status = host.find("status")
+            if status is None or status.get("state") != "up":
+                continue
+
+            device = self._parse_host(host)
+            if device:
+                devices.append(device)
+
+        return devices
+
+    def _parse_host(self, host_elem: ET.Element) -> Optional[Device]:
+        """Parse individual host element from nmap XML."""
+        address_elem = host_elem.find("address")
+        if address_elem is None:
+            return None
+
+        ip = address_elem.get("addr")
+        if not ip:
+            return None
+
+        device = Device(ip=ip, is_online=True)
+
+        # Get OS information
+        os_elem = host_elem.find(".//os/osmatch")
+        if os_elem is not None:
+            device.os = os_elem.get("name")
+
+        # Get hostname
+        hostnames = host_elem.findall(".//hostname")
+        if hostnames:
+            device.hostname = hostnames[0].get("name")
+
+        # Parse services
+        ports = host_elem.findall(".//port")
+        for port_elem in ports:
+            service_data = self._parse_service(port_elem)
+            if service_data:
+                device.add_service(**service_data)
+
+        return device
+
+    def _parse_service(self, port_elem: ET.Element) -> Optional[dict]:
+        """Parse service information from port element."""
+        state = port_elem.find("state")
+        if state is None or state.get("state") != "open":
+            return None
+
+        port = int(port_elem.get("portid"))
+        protocol = port_elem.get("protocol", "tcp")
+
+        service_elem = port_elem.find("service")
+        service_name = "unknown"
+        service_version = None
+
+        if service_elem is not None:
+            service_name = service_elem.get("name", "unknown")
+            service_version = service_elem.get("version")
+
+        return {
+            "port": port,
+            "name": service_name,
+            "version": service_version,
+            "protocol": protocol,
+        }
+
+
+class ARPScanner:
+    """Simple ARP-based device discovery for local networks."""
+
+    def scan_local(self, interface: Optional[str] = None) -> List[str]:
+        """
+        Discover active devices on local network via ARP.
+
+        Args:
+            interface: Network interface to scan (e.g., 'eth0', 'en0'). Auto-detect if None.
+
+        Returns:
+            List of discovered IP addresses
+        """
+        ips = []
+
+        try:
+            if interface is None:
+                interface = self._get_default_interface()
+
+            cmd = ["arp-scan", "-l", "-I", interface]
+            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
+
+            for line in result.stdout.split("\n"):
+                if "\t" in line:
+                    parts = line.split("\t")
+                    if len(parts) > 0:
+                        ip = parts[0].strip()
+                        if self._is_valid_ip(ip):
+                            ips.append(ip)
+
+        except (subprocess.TimeoutExpired, FileNotFoundError):
+            logger.warning("arp-scan not available, using nmap ping discovery instead")
+
+        return ips
+
+    def _get_default_interface(self) -> str:
+        """Get default network interface."""
+        try:
+            result = subprocess.run(
+                ["ip", "route", "show"],
+                capture_output=True,
+                text=True,
+                timeout=5,
+            )
+            for line in result.stdout.split("\n"):
+                if "default" in line:
+                    parts = line.split()
+                    if len(parts) > 4:
+                        return parts[4]
+        except Exception:
+            pass
+
+        return "eth0"
+
+    @staticmethod
+    def _is_valid_ip(ip: str) -> bool:
+        try:
+            socket.inet_aton(ip)
+            return True
+        except socket.error:
+            return False
+
+
+class DeviceScanner:
+    """High-level device discovery orchestrator."""
+
+    def __init__(self, nmap_path: str = "nmap"):
+        self.nmap_scanner = NmapScanner(nmap_path)
+        self.arp_scanner = ARPScanner()
+
+    def discover(self, target: str) -> List[Device]:
+        """
+        Discover devices in target network.
+
+        Args:
+            target: IP address, CIDR range, or hostname
+
+        Returns:
+            List of discovered devices
+        """
+        logger.info(f"Starting device discovery for {target}")
+
+        devices = self.nmap_scanner.scan(target)
+
+        logger.info(f"Discovered {len(devices)} devices")
+
+        return devices
+
+    def discover_local(self) -> List[Device]:
+        """Discover devices on local network."""
+        logger.info("Starting local network discovery via ARP")
+
+        ips = self.arp_scanner.scan_local()
+        logger.info(f"Found {len(ips)} local devices via ARP")
+
+        devices = []
+        for ip in ips:
+            device = Device(ip=ip, is_online=True)
+            devices.append(device)
+
+        return devices