LittleDemon WebShell

"""
Usage /opt/imunify360/venv/bin/python3 rules_checker.py <action>
    choose an action from ACTIONS map
    e.g.
    /opt/imunify360/venv/bin/python3 rules_checker.py recreate

    Actions:
        - `recreate` - recreates rules if needed and checks ipsets consistent
        - `clear` - waits RulesChecker stop and destroys all rules and ipsets

    Actions based on lazy_init plugin
        placed in im360.plugins.protector.lazy_init
"""

import asyncio
from pathlib import Path
import pickle
import sys

from defence360agent.model import tls_check
from im360.files import WHITELISTS, Index
from defence360agent.contracts.config import Model, Merger
from defence360agent.model import instance
from im360.internals.core import ip_versions

from defence360agent.internals import logger as lg
from im360.plugins.protector.lazy_init import RulesChecker, RealProtector

from logging import getLogger

logger = getLogger("rules-checker")


async def _check_for_config_change(rc: RulesChecker, rp: RealProtector):
    """Checking that config state is consistent with the current state."""
    rp._rules_checker = rc
    await rp._rules_checker.check_smtp_state_and_reset()
    await rp._on_config_update_unlocked(None)


async def recreate_rules(rc: RulesChecker, rp: RealProtector):
    """Recreates rules if needed and checks ipsets consistent."""
    logger.info("Checking that need to recreate rules")
    await rc.recreate_rules_if_needed()
    await rc.check_ipsets_consistent()
    await _check_for_config_change(rc, rp)
    logger.info("Completed")


async def check_config_update(rc: RulesChecker, rp: RealProtector):
    """Checking config update."""
    logger.info("Checking config update")
    await _check_for_config_change(rc, rp)
    logger.info("Completed")


async def clear_everything(rc: RulesChecker, rp: RealProtector):
    """Clear rules and ipsets on stop."""
    logger.info("Clear rules and ipsets")
    rc.should_stop()
    await rc.wait()
    await rc.clear_everything()
    logger.info("Completed")


def setup_environment():
    """Setup environment for rules checker."""
    lg.reconfigure()
    ip_versions.init()
    instance.db.init(Model.PATH)
    instance.db.execute_sql(
        "ATTACH '{}' AS resident".format(Model.RESIDENT_PATH)
    )
    Index.add_type(WHITELISTS, "whitelist/v2", 0o770, 0o660, all_zip=True)


ACTIONS = {
    "recreate": recreate_rules,
    "clear": clear_everything,
    "config-update": check_config_update,
}
REAL_PROTECTOR_STATE = Path("/var/imunify360/.realprotector.state")


class RealProtectorState:
    """RealProtector state to save and restore."""

    def __init__(self, _ws, _pb_dmv, _pbm):
        self._webshield_status = _ws
        self._port_blocking_deny_mode_values = _pb_dmv
        self._port_blocking_mode = _pbm

    def __str__(self) -> str:
        return (
            "RealProtectorState("
            f"_webshield_status={self._webshield_status}, "
            f"_port_blocking_mode={self._port_blocking_mode}, "
            "_port_blocking_deny_mode_values"
            f"={self._port_blocking_deny_mode_values},)"
        )


def restore_state(rp: RealProtector):
    """Restore RealProtector state."""
    if REAL_PROTECTOR_STATE.exists():
        rp_state = pickle.load(REAL_PROTECTOR_STATE.open("rb"))
        rp._webshield_status = rp_state._webshield_status
        rp._port_blocking_deny_mode_values = (
            rp_state._port_blocking_deny_mode_values
        )
        rp._port_blocking_mode = rp_state._port_blocking_mode
    return rp


def save_state(rp: RealProtector):
    """Save RealProtector state."""
    rp_state = RealProtectorState(
        rp._webshield_status,
        rp._port_blocking_deny_mode_values,
        rp._port_blocking_mode,
    )
    pickle.dump(rp_state, REAL_PROTECTOR_STATE.open("wb"))


def main(action):
    tls_check.reset()
    setup_environment()
    Merger.update_merged_config()
    rp = restore_state(RealProtector())

    if action not in ACTIONS:
        print(
            f"Invalid action: {action}. "
            f"Choose from {', '.join(ACTIONS.keys())}"
        )
        sys.exit(1)

    loop = asyncio.get_event_loop()
    rc = RulesChecker(loop)
    action = ACTIONS[action]
    loop.run_until_complete(action(rc, rp))
    save_state(rp)


if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(
            "Please provide one action as command line argument."
            f" {', '.join(ACTIONS.keys())}"
        )
        sys.exit(1)

    main(sys.argv[1])