~fǕ d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
ddlmZ ddlmZ ddlmZmZmZmZ ej e Z G d d
Z G d d ZdS )
z1Collector for WordPress CVE protection incidents. N)Path) defaultdict)WPSite) get_data_dir)IncidentFileParser)upsert_wordpress_incident bulk_create_wordpress_incidentsbuild_incident_dictcountry_readerc h e Zd ZdZ ddededefdZd Zd
ed ed ee ef fd
Z
d
ed efdZ dS )IncidentRateLimitera
Rate limiter to prevent DoS attacks via incident flooding.
Implements per-rule-per-IP rate limiting as per spec:
- Maximum 100 incidents for each rule from the same IP within 15 minutes
Memory-optimized implementation with bounded entry count using LRU eviction.
d ' max_incidents_per_rule_per_iptime_window_secondsmax_unique_entriesc || _ || _ || _ t t | _ d| _ t j | _ dS )aI
Initialize the rate limiter.
Args:
max_incidents_per_rule_per_ip: Max incidents per rule per IP (default: 100)
time_window_seconds: Time window in seconds (default: 900 = 15 minutes)
max_unique_entries: Max unique (rule_id, IP) combinations to track (default: 10000)
< N) max_per_rule_per_ip time_windowr r listincident_timescleanup_intervaltime last_cleanup)selfr r r s a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_collector.py__init__z IncidentRateLimiter.__init__# sK $A ."4 *$ / / " IKK c ~ t j }|| j z
g }| j D ]5\ }} fd|D }|r || j |< | | 6|D ]
}| j |= t | j | j k rt | j d }t dt | j t | j dz z
}|d| D ]
\ }}| j |= t d| j | || _ dS )zHRemove records older than the time window and enforce max entries limit.c g | ]
}|k | S r# .0tscutoffs r
z.D ===Rfbr c 2 | d r| d d ndS )N r r# )xs r z:IncidentRateLimiter._cleanup_old_records..S s 1 4ad1gg1 r )keyr+ g?NzARate limiter exceeded max entries (%d), removed %d oldest entries)
r r r itemsappendlenr sortedmaxintloggerwarningr )
r nowkeys_to_deleter.
timestampsrecententries_by_age
num_to_remove_r' s
@r _cleanup_old_recordsz(IncidentRateLimiter._cleanup_old_records; s ikkt'' # 2 8 8 : : + +OC====:===F
++1#C(( %%c****! ) )C#C(( t" # #d&= = = ##))++44 N D'((3t/F/L+M+MM M ) - 8
-
-Q',, NN'
r rule_id attacker_ipreturnc t j | j z
| j k r| t j }|| j z
||f}|| j v rB| j | } fd|D }|r|| j |< t
| }n
| j |= d}nd}|| j k r#| j dz }dd| d| d| d| j d | d
fS d S ) z
Check if adding an incident would exceed rate limits.
Args:
rule_id: Rule identifier
attacker_ip: IP address of the attacker
Returns:
Tuple of (allowed: bool, reason: str)
c g | ]
}|k | S r# r# r$ s r r( z8IncidentRateLimiter.check_rate_limit.. r) r r r Fz Rate limit exceeded for rule z from IP z: /z within z minutes)TOK)r r r r> r r r1 r )
r r? r@ r7 r. r9 r: recent_countwindow_minutesr' s
@r check_rate_limitz$IncidentRateLimiter.check_rate_limitg sF 9;;* *T-B B B % % ' ' 'ikkt'' $ $% % % ,S1J====:===F
!+1#C( "6{{ ', L 43 3 3 ! - 3N1G 1 1#1 1$1 1'+'?1 1 '1 1 1
zr c t j }||f}|| j vr
|g| j |< dS | j | }t | | j k r| d | | dS )z
Record that an incident was added.
Args:
rule_id: Rule identifier
attacker_ip: IP address
r N)r r r1 r popr0 )r r? r@ r7 r. r9 s r record_incidentz#IncidentRateLimiter.record_incident s ikk $ d) ) )(+uD $ $ $ ,S1J:$":::q!!! c " " " " "r N)r r r ) __name__
__module__ __qualname____doc__r4 r r> strtupleboolrH rK r# r r r
r
s .1#&"' ( ('*( !( ( ( ( (0* * * X22),2 tSy 2 2 2 2h#s # # # # # # #r r
c t e Zd ZdZd dedz fdZ d dededefd Z d d
ee dedefd Z
e d e dee fd
Z
ej d Ze de defd Zdededz dedefdZdededz fdZdee dededz dedef
dZdedededz defdZdedededz dededef dZdS ) IncidentCollectorzM
Collect and persist WordPress incidents from plugin incident files.
N rate_limiterc V |p
t | _ t | _ dS )z
Initialize the incident collector.
Args:
rate_limiter: Optional rate limiter (creates default if not provided)
N)r
rU r parser)r rU s r r zIncidentCollector.__init__ s) ) A,?,A,A(** r Tsitedelete_after_processingrA c K g } t | d{V }t d|| | s t d| g S | | }t d|| |s t d| g S t dt | | | | }|D ]5}| |||| d{V }| | 6n3# t $ r&} t
d|| Y d} ~ nd} ~ ww xY wt dt | | |S ) ab
Collect incidents from a single WordPress site.
Args:
site: WordPress site to collect incidents from
ruleset_version: Version of the ruleset being used
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
Nz Data directory for site %s: %sz)Data directory does not exist for site %s Incident files for site %s: %sz#No incident files found for site %sz%Found %d incident file(s) for site %sz*Error collecting incidents for site %s: %sz$Collected %d incident(s) for site %s) r r5 debugexists_get_incident_filesr1 _get_site_username
_process_fileextend Exceptionerrorinfo)
r rX rY collected_incidentsdata_dirincident_filesusername
incident_filefile_incidentses
r collect_incidents_for_sitez,IncidentCollector.collect_incidents_for_site s !% )$ / ///////H LL94 J J J??$$
H$OOO ! 5 5h ? ?N LL0$
"
BDIII LL7N##
..t44H!/
;
;
'+'9'9! + ( ( " " " " " " $**>::::
; LL<
2 # $ $
#"s& A!D/ (AD/ 8A6D/ /
E 9 EE sitesc K g }|D ]3}| || d{V }| | 4|r6t dt | t | |S )a
Collect incidents from multiple WordPress sites.
Args:
sites: List of WordPress sites
delete_after_processing: Whether to delete incident files after processing
Returns:
List of collected Incident objects
Nz2Collected %d WordPress incident(s) from %d site(s))rl ra r5 rd r1 )r rm rY all_collected_incidentsrX site_incidentss r collect_incidents_for_sitesz-IncidentCollector.collect_incidents_for_sites s #% ; ;D#'#B#B'$ $ N
$ * *> : : : : " KKD+,,E
'&r rf c |dz }t d|| | r| s t d| g S g }| D ]k} t j | }n# t $ r Y $w xY wt j |j
r*| | r| | lt d|| |S )a
Get all incident files in the incidents directory.
Only returns files older than one hour to give the WordPress plugin
time to process and finalize the incident data before collection.
Args:
data_dir: Path to the imunify-security data directory
Returns:
List of incident file paths, sorted by modification time
incidentsz#Incidents directory for site %s: %sz.Incidents directory does not exist for site %sr[ )
r5 r\ r] is_diriterdiroslstatOSError stat_moduleS_ISREGst_mode_is_incident_filer0 )clsrf
incidents_dirrg fsts r r^ z%IncidentCollector._get_incident_files# s0 !;.
18]
##%% ]-A-A-C-C LL@(
I &&(( ) )A
Xa[[
"2:..
)33H3H3K3K
) %%a((( ,h
s B
B"!B"z ^\d{4}-\d{2}-\d{2}-\d{2}\.php$ file_pathc Z t | j |j S )z
Check if a file is an incident file based on naming pattern.
Args:
file_path: Path to the file to check
Returns:
True if file matches pattern yyyy-mm-dd-hh.php
)rR
_FILE_PATTERNmatchname)r} r s r r| z#IncidentCollector._is_incident_fileM s% C%++IN;;<<"> " # # '
N $$$555 8-:LMMM& & LLC "
IIIIII s% AC BC
D*#D
DDc t j |j }|j S # t $ r-}t
d|j || Y d }~d S d }~ww xY w)Nz.Failed to get username for uid=%d, site %s: %s)pwdgetpwuiduidpw_namerb r5 rc )r rX user_infork s r r_ z$IncidentCollector._get_site_username ss
TX..I $ $ LL@
44444 s "
A"AArs incident_file_namec g }d}t 5 }|D ]}| dd } | d p| dd }
| j | |
\ } } | s"t d|| |dz
}|j |j ||j d}
t ||
| }|
| | j | |
d d d n # 1 swxY w Y g }|rD t | }n3# t $ r&}t d
|| Y d }~nd }~ww xY wt d |t! | | |S ) Nr r? unknown REMOTE_ADDRr@ #Rate limit exceeded for site %s: %sr+ domain site_pathrh user_id)
geo_readerz+Failed to bulk insert incidents from %s: %sz(Processed file %s: %d stored, %d dropped)r getrU rH r5 r6 r docrootr r
r0 rK r rb rc rd r1 )r rs rX rh r incidents_to_insert
dropped_countr incidentr? r@ allowedreason site_info
incident_datacreated_incidentsrk s r r z)IncidentCollector._process_file_incidents sZ !
! H %
H
H",,y)<< &ll= 9 9 X\\!9> > #'"3"D"D # #
NN=
"Q&M #k!% ( #x !4 iJ! ! !
$**=999!11';GGGGA
H! H ! H ! H ! H ! H ! H ! H ! H ! H ! H ! H ! H ! H ! H ! HH
$C'% %!!
A&
6 ! " "
! s* C!DDDD! !
E+ E Er c 4 | dd }| d p| dd }| j || \ }}|s t d|| d S | |||||| S )Nr? r r r@ r )r rU rH r5 r6 _store_incident) r r rX rh r r? r@ r r s r _process_incidentz#IncidentCollector._process_incident s ,,y)44 ll=11
X\\ 96
6
+<<
NN5
4##
r r? r@ c |j |j ||j d}t || }| j || |S # t $ r'}t d|| Y d }~d S d }~ww xY w)Nr z$Failed to store incident from %s: %s) r r r r rU rK rb r5 rc ) r r rX rh r? r@ r r rk s r r z!IncidentCollector._store_incident s + !\ $ 8 I 1 H
- -g{ C C CO LL6"
44444
s AA
A6 A11A6)N)T)rL rM rN rO r
r r rR r rl rq classmethodr r^ recompiler r| rP r` r_ dictr r r r# r r rT rT s + +%84%? + + + + )-?# ?#?# "&?#
?# ?# ?# ?#H )- ' 'F| ' "& '
' ' ' 'B $ 4 $ DJ $ $ $ [$ N BJ @AAM
=$
=4
=
=
= [
=/ / * /
"& /
/ / / /b v #* C!:C! C! * C!
C!
C! C! C! C!J
*
D *
r rT ) rO loggingrv r statry r r pathlibr collectionsr defence360agent.model.wordpressr defence360agent.wordpress.clir )defence360agent.wordpress.incident_parserr (defence360agent.model.wordpress_incidentr r r
r getLoggerrL r5 r
rT r# r r r s[ 7 7
# # # # # # 2 2 2 2 2 2 6 6 6 6 6 6 H H H H H H
8 $ $V# V# V# V# V# V# V# V#rk k k k k k k k k kr