wafaHell 1.0.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

wafaHell/panel.py

@@ -1,11 +1,14 @@
+from .model import AdminUser, WafLog, Whitelist, get_session, Blocked
+from .globals import waf_cache
+from .utils import Dashboard, admin
 from datetime import datetime, timedelta, timezone
-from flask import render_template_string, request, jsonify, make_response, flash, session, redirect, render_template
-from model import AdminUser, WafLog, get_session, Blocked
+import re
+from flask import request, jsonify, make_response, flash, session, redirect, render_template
 from sqlalchemy import func
 import csv
 import io
-from utils import Admin, Dashboard, admin
 from werkzeug.security import check_password_hash
+
 dashboard = Dashboard()
 
 def get_logs_and_stats(ip_filter=None, type_filter=None, limit=100):
@@ -67,9 +70,9 @@ def setup_dashboard(app, custom_path=None):
         if request.method == "POST":
             username = request.form.get("user")
             password = request.form.get("password")
-            db = get_session()
+            db_session = get_session()
             try:
-                admin = db.query(AdminUser).filter(AdminUser.login == username).first()
+                admin = db_session.query(AdminUser).filter(AdminUser.login == username).first()
 
                 # 3. Valida (Aqui você deveria usar hash, mas vamos focar na lógica)
                 if admin and check_password_hash(admin.password, password):
@@ -80,7 +83,7 @@ def setup_dashboard(app, custom_path=None):
                     flash("Acesso Negado: Credenciais Inválidas", "error")
                     return redirect(request.url)
             finally:
-                db.close()
+                db_session.close()
 
         return render_template("login.html")
     
@@ -104,43 +107,48 @@ def setup_dashboard(app, custom_path=None):
     @app.route(target_path + '/export/csv')
     @admin
     def export_csv():
-
-        ip_filter = request.args.get('ip')
-        type_filter = request.args.get('type')
-        
-        session = get_session()
-        query = session.query(WafLog)
-        
-        if ip_filter:
-            query = query.filter(WafLog.ip == ip_filter)
-        if type_filter:
-            query = query.filter(WafLog.attack_type == type_filter)
+        try:
+            ip_filter = request.args.get('ip')
+            type_filter = request.args.get('type')
             
-        logs = query.order_by(WafLog.timestamp.desc()).all()
-        session.close()
+            session = get_session()
+            query = session.query(WafLog)
+            
+            if ip_filter:
+                query = query.filter(WafLog.ip == ip_filter)
+            if type_filter:
+                query = query.filter(WafLog.attack_type == type_filter)
+                
+            logs = query.order_by(WafLog.timestamp.desc()).all()
+            session.close()
 
-        # Criamos o CSV em memória
-        output = io.StringIO()
-        writer = csv.writer(output)
-        
-        # Cabeçalho
-        writer.writerow(['Data/Hora', 'Tipo', 'IP', 'Endpoint', 'Metodo', 'Payload'])
-        
-        for log in logs:
-            writer.writerow([
-                log.timestamp,
-                log.attack_type,
-                log.ip,
-                log.path,
-                log.method,
-                log.payload
-            ])
-
-        response = make_response(output.getvalue())
-        response.headers["Content-Disposition"] = f"attachment; filename=waf_logs_{datetime.now().strftime('%Y%m%d_%H%M')}.csv"
-        response.headers["Content-type"] = "text/csv"
-        return response
+            # Criamos o CSV em memória
+            output = io.StringIO()
+            writer = csv.writer(output)
+            
+            # Cabeçalho
+            writer.writerow(['Data/Hora', 'Tipo', 'IP', 'Endpoint', 'Metodo', 'Payload'])
+            
+            for log in logs:
+                writer.writerow([
+                    log.timestamp,
+                    log.attack_type,
+                    log.ip,
+                    log.path,
+                    log.method,
+                    log.payload
+                ])
 
+            response = make_response(output.getvalue())
+            response.headers["Content-Disposition"] = f"attachment; filename=waf_logs_{datetime.now().strftime('%Y%m%d_%H%M')}.csv"
+            response.headers["Content-type"] = "text/csv"
+            return response
+        except Exception as e:
+            session.rollback()
+            return jsonify({"status": "error", "message": str(e)}), 500
+        finally:
+            session.close()
+    
     @app.route(target_path + '/block_ip', methods=['POST'])
     @admin
     def block_ip() -> bool:
@@ -178,6 +186,47 @@ def setup_dashboard(app, custom_path=None):
         finally:
             session.close()
 
+    @app.route(target_path + '/blocked_list', methods=['GET'])
+    @admin
+    def get_blocked_list():
+        session = get_session()
+        try:
+            # Pega todos os IPs bloqueados que ainda não expiraram
+            now = datetime.now(timezone.utc)
+            blocks = session.query(Blocked).filter(Blocked.blocked_until > now).all()
+            
+            data = []
+            for b in blocks:
+                # Calcula tempo restante
+                remaining = b.blocked_until.replace(tzinfo=timezone.utc) - now
+                mins, secs = divmod(remaining.total_seconds(), 60)
+                
+                data.append({
+                    "ip": b.ip,
+                    "user_agent": b.user_agent[:30] + '...' if len(b.user_agent) > 30 else b.user_agent,
+                    "expires_in": f"{int(mins)}m {int(secs)}s"
+                })
+            return jsonify(data)
+        finally:
+            session.close()
+
+    @app.route(target_path + '/unblock_ip', methods=['POST'])
+    @admin
+    def manual_unblock():
+        data = request.get_json()
+        ip = data.get('ip')
+        session = get_session()
+        try:
+            # Remove da tabela
+            session.query(Blocked).filter(Blocked.ip == ip).delete()
+            session.commit()
+            
+            return jsonify({"status": "success"})
+        except Exception as e:
+            return jsonify({"error": str(e)}), 500
+        finally:
+            session.close()
+
     @app.route(target_path + '/graphs', methods=['GET'])
     @admin
     def graphs():
@@ -187,6 +236,171 @@ def setup_dashboard(app, custom_path=None):
     @admin
     def api_stats():
         return jsonify(dashboard.dashboard_setup())
+    
+    @app.route(target_path + '/vars', methods=['GET'])
+    @admin
+    def get_vars():
+        from middleware import Wafahell
+        waf = Wafahell()
+
+        output = {}
+        allowed_types = (str, int, float, bool, list, dict)
+        blacklisted_keys = {'app', 'log', 'recent_blocks_cache', '_instance', 'initialized', 'dashboard_path', 'rules_sqli', 'rules_xss'}
+
+        for key, value in vars(waf).items():
+            if key not in blacklisted_keys and isinstance(value, allowed_types):
+                output[key] = value
+                
+        return output
+
+    @app.route(target_path + '/vars/change', methods=['POST'])
+    @admin
+    def vars_change():
+        data = request.json
+        key = data.get('key')
+        value = data.get('value')
+
+        from middleware import Wafahell
+        waf = Wafahell()
+
+        if hasattr(waf, key):
+            
+            setattr(waf, key, value)
+            
+            print(f" * [WafaHell] Variable '{key}' changed to: {value}")
+            
+            return {"status": "success", "message": f"{key} updated", "newValue": value}
+        
+        return {"status": "error", "message": "Invalid variable"}, 400
+    
+    @app.route(target_path + '/import_blacklist', methods=['POST'])
+    @admin
+    def import_blacklist():
+        data = request.get_json()
+        raw_ips = data.get('ips', [])
+        
+        if not raw_ips:
+            return jsonify({"status": "error", "message": "Nenhum IP fornecido."}), 400
+
+        # 1. Validação e Limpeza (Regex IPv4)
+        # Usamos set() para remover duplicatas enviadas no mesmo arquivo
+        ip_regex = re.compile(r"^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$")
+        valid_ips = set(ip for ip in raw_ips if ip_regex.match(ip))
+        
+        if not valid_ips:
+            return jsonify({"status": "error", "message": "Nenhum IP válido encontrado."}), 400
+
+        session = get_session()
+        try:
+            # 2. Filtragem de Duplicatas no Banco
+            # Descobre quais desses IPs já estão bloqueados para não dar erro de Unique Key
+            existing_query = session.query(Blocked.ip).filter(Blocked.ip.in_(valid_ips)).all()
+            existing_ips = {row.ip for row in existing_query}
+            
+            # Apenas os novos IPs
+            ips_to_insert = valid_ips - existing_ips
+            
+            if not ips_to_insert:
+                return jsonify({"status": "success", "message": "Todos os IPs já estavam na blacklist."})
+
+            # 3. Preparação dos Dados (Bulk)
+            # Definimos um tempo padrão de 30 dias para importações manuais de lista
+            now = datetime.now(timezone.utc)
+            until = now + timedelta(days=3600) 
+            
+            bulk_data = []
+            for ip in ips_to_insert:
+                bulk_data.append({
+                    "ip": ip,
+                    "user_agent": "MANUAL_IMPORT_LIST",
+                    # Mantendo o formato string que você usa no Model
+                    "blocked_at": now.strftime("%H:%M:%S"), 
+                    "blocked_until": until
+                })
+                
+                # 4. Atualização IMEDIATA do Cache (Fast Path)
+                # Isso garante que o bloqueio funcione no milissegundo seguinte,
+                # sem precisar esperar a próxima query no banco.
+                waf_cache.set(f"blocked_{ip}", True, expire=60)
+
+            # 5. Inserção em Massa (Muito Rápido)
+            session.bulk_insert_mappings(Blocked, bulk_data)
+            session.commit()
+            
+            count = len(ips_to_insert)
+            print(f" * [WafaHell] Blacklist importada: {count} novos IPs.")
+            
+            return jsonify({
+                "status": "success", 
+                "message": f"Sucesso! {count} novos IPs adicionados à Blacklist."
+            })
+
+        except Exception as e:
+            session.rollback()
+            print(f"Erro na importação: {e}")
+            return jsonify({"status": "error", "message": str(e)}), 500
+        finally:
+            session.close()
+
+    @app.route(target_path + '/import_whitelist', methods=['POST'])
+    @admin
+    def import_whitelist():
+        data = request.get_json()
+        raw_ips = data.get('ips', [])
+        
+        if not raw_ips:
+            return jsonify({"status": "error", "message": "Nenhum IP fornecido."}), 400
+
+        # 1. Validação (Regex)
+        ip_regex = re.compile(r"^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$")
+        valid_ips = set(ip for ip in raw_ips if ip_regex.match(ip))
+        
+        if not valid_ips:
+            return jsonify({"status": "error", "message": "Nenhum IP válido encontrado."}), 400
+
+        session = get_session()
+        try:
+            # 2. Verifica Duplicatas no Banco
+            # Como sua coluna 'ip' é unique=True, precisamos filtrar o que já existe
+            existing_query = session.query(Whitelist.ip).filter(Whitelist.ip.in_(valid_ips)).all()
+            existing_ips = {row.ip for row in existing_query}
+            
+            ips_to_insert = valid_ips - existing_ips
+            
+            if not ips_to_insert:
+                return jsonify({"status": "success", "message": "Todos os IPs já estavam na whitelist."})
+
+            # 3. Prepara Bulk Insert e Cache
+            now_str = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+            bulk_data = []
+            
+            for ip in ips_to_insert:
+                bulk_data.append({
+                    "ip": ip,
+                    "added_at": now_str
+                })
+                # Cache Warm-up: Marca o IP como "VIP" no cache por 1 hora
+                # Isso evita consulta ao banco quando este IP acessar
+                waf_cache.set(f"whitelist_{ip}", True, expire=3600)
+
+            # 4. Grava no Banco
+            session.bulk_insert_mappings(Whitelist, bulk_data)
+            session.commit()
+            
+            count = len(ips_to_insert)
+            print(f" * [WafaHell] Whitelist importada: {count} novos IPs.")
+            
+            return jsonify({
+                "status": "success", 
+                "message": f"Sucesso! {count} IPs adicionados à Whitelist."
+            })
+
+        except Exception as e:
+            session.rollback()
+            print(f"Erro whitelist: {e}")
+            return jsonify({"status": "error", "message": str(e)}), 500
+        finally:
+            session.close()
 
     print(f" * [WafaHell] Dashboard e API de dados prontos em: {target_path}")