wafaHell 0.2.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

wafaHell/utils.py

@@ -1,10 +1,416 @@
-from datetime import datetime, timedelta
+from .model import WafLog, Blocked, Whitelist, AdminUser, get_session
+from .globals import waf_cache
+from datetime import datetime, timedelta, timezone
+import secrets
+import socket
+import string
+import time
+import tomllib
+from werkzeug.security import generate_password_hash
+from sqlalchemy.orm import Session
+from sqlalchemy import text, func, case
+from functools import wraps
+from flask import session, redirect, url_for, request
+import geoip2.database
+import os
 
-def is_block_expired(blocked_time_str: str) -> bool:
-    blocked_time = datetime.strptime(blocked_time_str, "%H:%M:%S")
-    now = datetime.now()
-    blocked_time = blocked_time.replace(year=now.year, month=now.month, day=now.day)
+class Admin:
+    @staticmethod
+    def generate_secure_password(length=64):
+        alphabet = string.ascii_letters + string.digits + string.punctuation
+        return ''.join(secrets.choice(alphabet) for _ in range(length))
 
-    diff = now - blocked_time
-    return diff >= timedelta(minutes=1)
+    @staticmethod
+    def create_admin_user(session: Session):
+        admin = session.query(AdminUser).filter_by(login="admin").first()
+        if admin:
+            return
+        raw_password = "admin" #Admin.generate_secure_password(64)
+        hashed_password = generate_password_hash(raw_password)
 
+        admin = AdminUser(
+            login="admin",
+            password=hashed_password
+        )
+
+        session.add(admin)
+        session.commit()
+
+        print("* [WafaHell] Usuario admin criado com sucesso.")
+        print("* [WafaHell] Salve essa senha em um lugar seguro, não será mostrada novamente")
+        print("Senha: ", raw_password)
+
+def admin(fn):
+    @wraps(fn)
+    def wrapper(*args, **kwargs):
+        if not session.get("logged_in"):
+            return redirect(url_for("login", next=request.path))
+        return fn(*args, **kwargs)
+    return wrapper
+
+class Dashboard:
+    def __init__(self):
+        self.geo_db_path = os.path.join(os.path.dirname(__file__), 'GeoLite2-Country.mmdb')
+        
+    def dashboard_setup(self):
+        json = {}
+
+        def get_waf_version():
+            base_path = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+            toml_path = os.path.join(base_path, "pyproject.toml")
+            
+            try:
+                with open(toml_path, "rb") as f:
+                    data = tomllib.load(f)
+                    return data["project"]["version"]
+            except FileNotFoundError:
+                return "v.0.0.0"
+        
+        def get_server_info():
+            server_time = datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z')
+            node_id = socket.gethostname()
+            avg_latency = waf_cache.get('latency_avg', default=0.0)
+            system_status = "critical" if avg_latency > 500 else "degraded" if avg_latency > 200 else "healthy"
+            return {
+                "server_time": server_time,
+                "node_id": node_id,
+                "average_latency_ms": round(float(avg_latency), 2),
+                "system_status": system_status,
+                "version": get_waf_version()
+            }
+        
+        def get_kpis():
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+            prev_24h = now - timedelta(hours=48)
+            session = get_session()
+            
+            try:
+                # --- TOTAIS DE HOJE ---
+                total_today = session.query(func.count(WafLog.id)).filter(WafLog.timestamp >= last_24h).scalar() or 0
+                blocked_today = session.query(func.count(WafLog.id)).filter(
+                    WafLog.timestamp >= last_24h, 
+                    WafLog.attack_type != 'INFO'
+                ).scalar() or 0
+
+                # --- TOTAIS DE ONTEM (Para Tendência) ---
+                total_yesterday = session.query(func.count(WafLog.id)).filter(
+                    WafLog.timestamp >= prev_24h, 
+                    WafLog.timestamp < last_24h
+                ).scalar() or 0
+                
+                blocked_yesterday = session.query(func.count(WafLog.id)).filter(
+                    WafLog.timestamp >= prev_24h, 
+                    WafLog.timestamp < last_24h,
+                    WafLog.attack_type != 'INFO'
+                ).scalar() or 0
+
+                # --- CÁLCULO DE TENDÊNCIA (%) ---
+                def calc_trend(current, previous):
+                    if previous == 0:
+                        return 100.0 if current > 0 else 0.0
+                    return round(((current - previous) / previous * 100), 1)
+
+                trend_total = calc_trend(total_today, total_yesterday)
+                trend_attacks = calc_trend(blocked_today, blocked_yesterday)
+
+                # --- INFOS COMPLEMENTARES ---
+                from globals import waf_cache
+                # Latência e RPS vindos do Cache Global
+                last_second_timestamp = int(time.time()) - 1
+                rps_key = f"rps_{last_second_timestamp}"
+
+                # 2. Lê o valor real do cache para esse segundo específico
+                current_rps = waf_cache.get(rps_key, default=0)
+
+                # 3. Lógica do Pico (Peak)
+                # Aqui continuamos usando uma chave fixa 'rps_peak_hour' para guardar o recorde
+                peak_rps = waf_cache.get('rps_peak_hour', default=0)
+
+                if current_rps > peak_rps:
+                    peak_rps = current_rps
+                    # Atualiza o recorde no cache por 1 hora
+                    waf_cache.set('rps_peak_hour', peak_rps, expire=3600)
+                
+                # Dados da Blacklist
+                total_blacklist = session.query(func.count(Blocked.id)).scalar() or 0
+                # Como blocked_at é String formatada no seu modelo, comparamos com o horário
+                added_today = session.query(func.count(Blocked.id)).filter(
+                    Blocked.blocked_until >= now # Um IP "adicionado hoje" é tecnicamente um ainda bloqueado
+                ).scalar() or 0
+
+                return {
+                    "total_requests_24h": {
+                        "value": total_today,
+                        "trend_percent": trend_total
+                    },
+                    "attacks_mitigated_24h": {
+                        "value": blocked_today,
+                        "trend_percent": trend_attacks # Adicionado aqui
+                    },
+                    "throughput": {
+                        "current_req_per_sec": current_rps,
+                        "peak_last_hour": peak_rps
+                    },
+                    "blacklist_count": {
+                        "total_ips": total_blacklist,
+                        "added_today": added_today
+                    }
+                }
+            
+            except Exception as e:
+                print(f"Erro no Dashboard: {e}")
+            finally:
+                session.close()
+                
+        def get_traffic_chart():
+            now = datetime.now(timezone.utc)
+            start_time = now - timedelta(minutes=40)
+            session = get_session()
+            try:
+                # Query para agrupar por minuto
+                # No SQLite usamos strftime, no Postgres/MySQL seria date_format ou similar
+                query = session.query(
+                    func.strftime('%H:%M', WafLog.timestamp).label('minute'),
+                    func.count(WafLog.id).label('total'),
+                    func.sum(case({WafLog.attack_type == 'INFO': 1}, else_=0)).label('legit'),
+                    func.sum(case({WafLog.attack_type != 'INFO': 1}, else_=0)).label('attacks')
+                ).filter(WafLog.timestamp >= start_time)\
+                .group_by('minute')\
+                .order_by('minute').all()
+
+                labels = []
+                series_legit = []
+                series_attacks = []
+
+                # Preenche os arrays para o gráfico
+                for row in query:
+                    labels.append(row.minute)
+                    series_legit.append(row.legit or 0)
+                    series_attacks.append(row.attacks or 0)
+
+                # Caso não existam dados nos últimos 40 min, retorna arrays vazios para não quebrar o front
+                return {
+                    "labels": labels,
+                    "series_legit": series_legit,
+                    "series_attacks": series_attacks
+                }
+            except Exception as e:
+                print(f"Erro no Dashboard: {e}")
+            finally:
+                session.close()
+
+        def get_distribution_vectors():
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+            session = get_session()
+            try:
+                # 1. Buscamos a contagem agrupada por tipo de ataque
+                # Filtramos para não incluir tráfego legítimo (INFO)
+                query = session.query(
+                    WafLog.attack_type,
+                    func.count(WafLog.id).label('count')
+                ).filter(
+                    WafLog.timestamp >= last_24h,
+                    WafLog.attack_type != 'INFO'
+                ).group_by(WafLog.attack_type).all()
+
+                # 2. Calculamos o total de ataques para obter a porcentagem
+                total_attacks = sum(row.count for row in query)
+                
+                distribution = []
+                
+                for row in query:
+                    percentage = round((row.count / total_attacks * 100), 1) if total_attacks > 0 else 0
+                    distribution.append({
+                        "label": row.attack_type,
+                        "count": row.count,
+                        "percentage": percentage
+                    })
+
+                # Caso não haja ataques, retornamos uma lista vazia ou um placeholder
+                return distribution
+            except Exception as e:
+                print(f"Erro no Dashboard: {e}")
+            finally:
+                session.close()
+
+        def get_top_geo():
+            def resolve_ip(ip):
+                try:         
+                    if not os.path.exists(self.geo_db_path):
+                        print("ERRO: Arquivo GeoLite2-Country.mmdb não encontrado!")
+                        return "XX", "Unknown"
+                        
+                    with geoip2.database.Reader(self.geo_db_path) as reader:
+                        response = reader.country(ip)
+                        return response.country.iso_code, response.country.name
+                except Exception as e:
+                    print(f"Erro na consulta GeoIP: {e}") # Isso vai te dizer se o banco está corrompido ou o IP é inválido
+                    return "XX", "Unknown"
+                
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+            session = get_session()
+            # 1. Busca todos os ataques agrupados por IP
+            try:
+                query = session.query(
+                    WafLog.ip,
+                    func.count(WafLog.id).label('count')
+                ).filter(
+                    WafLog.timestamp >= last_24h,
+                    WafLog.attack_type != 'INFO'
+                ).group_by(WafLog.ip).all()
+
+                geo_stats = {}
+                total_attacks = 0
+
+                # 2. Processa cada IP real usando o GeoIP2
+                for row in query:
+                    code, name = resolve_ip(row.ip)
+                    
+                    if code not in geo_stats:
+                        geo_stats[code] = {"name": name, "count": 0}
+                    
+                    geo_stats[code]["count"] += row.count
+                    total_attacks += row.count
+
+                # 3. Formata o Top 5
+                top_geo = []
+                sorted_geo = sorted(geo_stats.items(), key=lambda x: x[1]['count'], reverse=True)[:5]
+
+                for code, data in sorted_geo:
+                    percentage = round((data["count"] / total_attacks * 100), 1) if total_attacks > 0 else 0
+                    top_geo.append({
+                        "country_code": code,
+                        "country_name": data["name"],
+                        "count": data["count"],
+                        "percentage": percentage
+                    })
+
+                return top_geo
+            except Exception as e:
+                print(f"Erro no Dashboard: {e}")
+            finally:
+                session.close()
+        
+        def get_top_offenders():
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+            session = get_session()
+            # 1. Agrupamos por IP e contamos os hits e os tipos de ataques diferentes
+            # Ignoramos tráfego INFO
+            try:
+                query = session.query(
+                    WafLog.ip,
+                    func.count(WafLog.id).label('hits_count'),
+                    func.count(func.distinct(WafLog.attack_type)).label('unique_vectors')
+                ).filter(
+                    WafLog.timestamp >= last_24h,
+                    WafLog.attack_type != 'INFO'
+                ).group_by(WafLog.ip).order_by(text('hits_count DESC')).limit(5).all()
+
+                offenders = []
+                for row in query:
+                    # 2. Lógica de Risk Score (0 a 100)
+                    # Baseada em volume e diversidade de ataques
+                    # Ex: Cada vetor único vale 20 pontos + 1 ponto para cada 50 hits (até o teto de 100)
+                    vector_points = row.unique_vectors * 20
+                    hit_points = row.hits_count // 50
+                    risk_score = min(100, vector_points + hit_points)
+
+                    offenders.append({
+                        "ip": row.ip,
+                        "risk_score": int(risk_score),
+                        "hits_count": row.hits_count
+                    })
+
+                return offenders
+            except Exception as e:
+                print(f"Erro no Dashboard: {e}")
+            finally:
+                session.close()
+
+        try:
+            json['meta'] = get_server_info()
+            json['kpis'] = get_kpis()
+            json['traffic_chart'] = get_traffic_chart()
+            json['distribution_vectors'] = get_distribution_vectors()
+            json['top_geo'] = get_top_geo()
+            json['top_offenders'] = get_top_offenders()
+            
+            return json
+
+        except Exception as e:
+            print(f"Erro no Dashboard: {e}")
+            return {"error": str(e)}
+        
+def seed_default_whitelist():
+    """
+    Popula a Whitelist com IPs essenciais (Localhost, DNS públicos, etc)
+    Executar na inicialização do app.
+    """
+    # Lista de IPs Padrão (Adicione aqui IPs unitários que confia)
+    DEFAULT_IPS = [
+        # --- Localhost / Loopback (Essencial) ---
+        "127.0.0.1",
+        "::1",
+
+        # Redes Privadas (As gigantes)
+        "10.0.0.0/8",      # 16 milhões de IPs
+        "172.16.0.0/12",   # 1 milhão de IPs
+        "192.168.0.0/16",  # 65 mil IPs
+        
+        # --- DNS Públicos (Google) ---
+        "8.8.8.8",
+        "8.8.4.4",
+        
+        # --- DNS Públicos (Cloudflare) ---
+        "1.1.1.1",
+        "1.0.0.1",
+        
+        # --- DNS Públicos (OpenDNS) ---
+        "208.67.222.222",
+        "208.67.220.220",
+        
+        # --- DNS Públicos (Quad9) ---
+        "9.9.9.9",
+        "149.112.112.112"
+    ]
+
+    session = get_session()
+    try:
+        # 1. Descobre o que já existe no banco para não duplicar
+        existing_query = session.query(Whitelist.ip).filter(Whitelist.ip.in_(DEFAULT_IPS)).all()
+        existing_ips = {row.ip for row in existing_query}
+        
+        # 2. Filtra apenas os novos
+        ips_to_insert = set(DEFAULT_IPS) - existing_ips
+        
+        if not ips_to_insert:
+            print(" * [WafaHell] Whitelist padrão já está atualizada.")
+            return
+
+        # 3. Prepara Bulk Insert e Cache
+        now_str = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+        bulk_data = []
+        
+        for ip in ips_to_insert:
+            bulk_data.append({
+                "ip": ip,
+                "added_at": now_str
+            })
+            # Já coloca no cache para funcionar imediatamente
+            waf_cache.set(f"whitelist_{ip}", True, expire=3600)
+
+        # 4. Grava no Banco
+        session.bulk_insert_mappings(Whitelist, bulk_data)
+        session.commit()
+        
+        print(f" * [WafaHell] Seed Whitelist: {len(ips_to_insert)} IPs padrão adicionados.")
+
+    except Exception as e:
+        session.rollback()
+        print(f"Erro ao semear whitelist: {e}")
+    finally:
+        session.close()

{wafahell-0.2.0.dist-info → wafahell-1.1.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wafaHell
-Version: 0.2.0
+Version: 1.1.0
 Summary: Middleware WAF to Flask
 Author-email: Yago Martins <yagomartins30@gmail.com>
 License: MIT License
@@ -33,6 +33,10 @@ Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: Flask>=2.0
+Requires-Dist: sqlalchemy>=2.0.0
+Requires-Dist: requests
+Requires-Dist: diskcache
+Requires-Dist: geoip2
 Dynamic: license-file
 
 # WafHell

wafahell-1.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+wafaHell/__init__.py,sha256=bdafr3LRK7_frr-V6umEJZUqt8RMrOiLJy72DSQfs2o,60
+wafaHell/app.py,sha256=oZCqS6rwvm3vU1pc56yYiNc_Mh4DOI52H00qnVovt-o,986
+wafaHell/globals.py,sha256=keIe0YCNsb5si0yUhUjd6nlk1s0YgfH5G7lH5-05Zws,160
+wafaHell/logger.py,sha256=_h4ceGM2UYnEQ5SY7nbYtR0rZprCOC0rN1IehtkkM_o,5734
+wafaHell/middleware.py,sha256=DlSGA-1YHaHG-iQ2lBIWJIuzQnxkRITBPMSQogM8hdA,19625
+wafaHell/mock.py,sha256=EgfSCKYV3rUTerKoEyFQPSf47wrOo-E0yqe7JpQUe3w,2105
+wafaHell/model.py,sha256=o3wrIp8H17vlIB1tW28ApYedXtJLIGTbtrB7zKjzbtE,2919
+wafaHell/panel.py,sha256=mq_vUg4LWLaFEWLvXpuDB3_QUw46WHhw3ruKb6hc_Sc,15926
+wafaHell/rateLimiter.py,sha256=p4IDxha-ZrRPROFf8Fa1gRTbbUTQdbD9TgBTmyMR2hQ,664
+wafaHell/utils.py,sha256=nQk1A4J1OeuvDnX5lj8pIE8IyUF5f5wbtXt0XSdsF7A,16810
+wafahell-1.1.0.dist-info/licenses/LICENSE,sha256=6bv9v4HamenV3rqm3mhaGOecwGFrgxtVTW7JPfFDmeY,1086
+wafahell-1.1.0.dist-info/METADATA,sha256=8fF9VBaal86TMs5EwmntQeKPA7wY9bNbo-9VPvEWBEw,2087
+wafahell-1.1.0.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+wafahell-1.1.0.dist-info/top_level.txt,sha256=VGBo2g3pOeTH2qIXfZDJCSblJgijemMHUHmI0bBgrls,9
+wafahell-1.1.0.dist-info/RECORD,,

{wafahell-0.2.0.dist-info → wafahell-1.1.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: setuptools (80.10.2)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

wafaHell/teste.py

@@ -1,16 +0,0 @@
-from middleware import WafaHell
-from flask import Flask
-import logging
-
-app = Flask(__name__)
-waf = WafaHell(app, monitor_mode=True, block_ip=True, rate_limit=True)
-
-# log = logging.getLogger('werkzeug')
-# log.setLevel(logging.ERROR) 
-
-@app.route('/')
-def home():
-    return "Bem-vindo ao site seguro!"
-
-if __name__ == '__main__':
-    app.run(host='0.0.0.0', port=5000, debug=False)

wafahell-0.2.0.dist-info/RECORD

@@ -1,12 +0,0 @@
-wafaHell/__init__.py,sha256=bdafr3LRK7_frr-V6umEJZUqt8RMrOiLJy72DSQfs2o,60
-wafaHell/logger.py,sha256=yMEz5FY6RdNOzQ9RacAiKpfmwtGjnNVha5umeeSotAM,1354
-wafaHell/middleware.py,sha256=nFhfrvoU3yNaS-_yKjAGbP7egdgG9gYwz5pxtFhVmTw,6052
-wafaHell/model.py,sha256=QnnOOgsEvqs0tHWLN6SkxQlnWR6r4KYiutyMxQl1nDo,902
-wafaHell/rateLimiter.py,sha256=_aU3ZORwpH2CCNpRWF44FyVM5slE3QvLyEgqWRcELr4,666
-wafaHell/teste.py,sha256=rnO3lyYQ-d-fJvlX7EQ-qo2T3DkAM6VS_z897Hht77E,399
-wafaHell/utils.py,sha256=htvGKGKY4VLsN8fcDOSQKDYqkTXbq8f3X29MQWq08P0,354
-wafahell-0.2.0.dist-info/licenses/LICENSE,sha256=6bv9v4HamenV3rqm3mhaGOecwGFrgxtVTW7JPfFDmeY,1086
-wafahell-0.2.0.dist-info/METADATA,sha256=v5yAr069OcRN4c3BxogmtQEAA-KKWr96a9ujgjuzbAc,1979
-wafahell-0.2.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-wafahell-0.2.0.dist-info/top_level.txt,sha256=VGBo2g3pOeTH2qIXfZDJCSblJgijemMHUHmI0bBgrls,9
-wafahell-0.2.0.dist-info/RECORD,,