code.grnet.gr Git - flowspy/blob - flowspec/models.py

   1 # -*- coding: utf-8 -*- vim:encoding=utf-8:
   2 # vim: tabstop=4:shiftwidth=4:softtabstop=4:expandtab
   3
   4 from django.db import models
   5 from django.conf import settings
   6 from django.contrib.auth.models import User
   7 from django.utils.translation import ugettext_lazy as _
   8 from utils import proxy as PR
   9 from ipaddr import *
  10 import datetime
  11 import logging
  12 from time import sleep
  13
  14 import beanstalkc
  15 from flowspy.utils.randomizer import id_generator as id_gen
  16
  17 from flowspec.tasks import *
  18
  19 FORMAT = '%(asctime)s %(levelname)s: %(message)s'
  20 logging.basicConfig(format=FORMAT)
  21 logger = logging.getLogger(__name__)
  22 logger.setLevel(logging.DEBUG)
  23
  24
  25 FRAGMENT_CODES = (
  26     ("dont-fragment", "Don't fragment"),
  27     ("first-fragment", "First fragment"),
  28     ("is-fragment", "Is fragment"),
  29     ("last-fragment", "Last fragment"),
  30     ("not-a-fragment", "Not a fragment")
  31 )
  32
  33 THEN_CHOICES = (
  34     ("accept", "Accept"),
  35     ("discard", "Discard"),
  36     ("community", "Community"),
  37     ("next-term", "Next term"),
  38     ("routing-instance", "Routing Instance"),
  39     ("rate-limit", "Rate limit"),
  40     ("sample", "Sample")
  41 )
  42
  43 MATCH_PROTOCOL = (
  44     ("ah", "ah"),
  45     ("egp", "egp"),
  46     ("esp", "esp"),
  47     ("gre", "gre"),
  48     ("icmp", "icmp"),
  49     ("icmp6", "icmp6"),
  50     ("igmp", "igmp"),
  51     ("ipip", "ipip"),
  52     ("ospf", "ospf"),
  53     ("pim", "pim"),
  54     ("rsvp", "rsvp"),
  55     ("sctp", "sctp"),
  56     ("tcp", "tcp"),
  57     ("udp", "udp"),
  58 )
  59
  60 ROUTE_STATES = (
  61     ("ACTIVE", "ACTIVE"),
  62     ("ERROR", "ERROR"),
  63     ("EXPIRED", "EXPIRED"),
  64     ("PENDING", "PENDING"),
  65     ("OUTOFSYNC", "OUTOFSYNC"),
  66     ("INACTIVE", "INACTIVE"),
  67     ("ADMININACTIVE", "ADMININACTIVE"),
  68 )
  69
  70
  71 def days_offset(): return datetime.date.today() + datetime.timedelta(days = settings.EXPIRATION_DAYS_OFFSET)
  72
  73 class MatchPort(models.Model):
  74     port = models.CharField(max_length=24, unique=True)
  75     def __unicode__(self):
  76         return self.port
  77     class Meta:
  78         db_table = u'match_port'
  79
  80 class MatchDscp(models.Model):
  81     dscp = models.CharField(max_length=24)
  82     def __unicode__(self):
  83         return self.dscp
  84     class Meta:
  85         db_table = u'match_dscp'
  86
  87 class MatchProtocol(models.Model):
  88     protocol = models.CharField(max_length=24, unique=True)
  89     def __unicode__(self):
  90         return self.protocol
  91     class Meta:
  92         db_table = u'match_protocol'
  93
  94
  95 class ThenAction(models.Model):
  96     action = models.CharField(max_length=60, choices=THEN_CHOICES, verbose_name="Action")
  97     action_value = models.CharField(max_length=255, blank=True, null=True, verbose_name="Action Value")
  98     def __unicode__(self):
  99         ret = "%s:%s" %(self.action, self.action_value)
 100         return ret.rstrip(":")
 101     class Meta:
 102         db_table = u'then_action'
 103         ordering = ['action', 'action_value']
 104         unique_together = ("action", "action_value")
 105
 106 class Route(models.Model):
 107     name = models.SlugField(max_length=128, verbose_name=_("Name"))
 108     applier = models.ForeignKey(User, blank=True, null=True)
 109     source = models.CharField(max_length=32, help_text=_("Network address. Use address/CIDR notation"), verbose_name=_("Source Address"))
 110     sourceport = models.ManyToManyField(MatchPort, blank=True, null=True, related_name="matchSourcePort", verbose_name=_("Source Port"))
 111     destination = models.CharField(max_length=32, help_text=_("Network address. Use address/CIDR notation"), verbose_name=_("Destination Address"))
 112     destinationport = models.ManyToManyField(MatchPort, blank=True, null=True, related_name="matchDestinationPort", verbose_name=_("Destination Port"))
 113     port = models.ManyToManyField(MatchPort, blank=True, null=True, related_name="matchPort", verbose_name=_("Port"))
 114     dscp = models.ManyToManyField(MatchDscp, blank=True, null=True, verbose_name="DSCP")
 115     fragmenttype = models.CharField(max_length=20, choices=FRAGMENT_CODES, blank=True, null=True, verbose_name="Fragment Type")
 116     icmpcode = models.CharField(max_length=32, blank=True, null=True, verbose_name="ICMP Code")
 117     icmptype = models.CharField(max_length=32, blank=True, null=True, verbose_name="ICMP Type")
 118     packetlength = models.IntegerField(blank=True, null=True, verbose_name="Packet Length")
 119     protocol = models.ManyToManyField(MatchProtocol, blank=True, null=True, verbose_name=_("Protocol"))
 120     tcpflag = models.CharField(max_length=128, blank=True, null=True, verbose_name="TCP flag")
 121     then = models.ManyToManyField(ThenAction, verbose_name=_("Then"))
 122     filed = models.DateTimeField(auto_now_add=True)
 123     last_updated = models.DateTimeField(auto_now=True)
 124     status = models.CharField(max_length=20, choices=ROUTE_STATES, blank=True, null=True, verbose_name=_("Status"), default="PENDING")
 125 #    is_online = models.BooleanField(default=False)
 126 #    is_active = models.BooleanField(default=False)
 127     expires = models.DateField(default=days_offset, verbose_name=_("Expires"))
 128     response = models.CharField(max_length=512, blank=True, null=True, verbose_name=_("Response"))
 129     comments = models.TextField(null=True, blank=True, verbose_name=_("Comments"))
 130
 131
 132     def __unicode__(self):
 133         return self.name
 134
 135     class Meta:
 136         db_table = u'route'
 137         verbose_name = "Rule"
 138         verbose_name_plural = "Rules"
 139
 140     def save(self, *args, **kwargs):
 141         if not self.pk:
 142             hash = id_gen()
 143             self.name = "%s_%s" %(self.name, hash)
 144         super(Route, self).save(*args, **kwargs) # Call the "real" save() method.
 145
 146
 147     def clean(self, *args, **kwargs):
 148         from django.core.exceptions import ValidationError
 149         if self.destination:
 150             try:
 151                 address = IPNetwork(self.destination)
 152                 self.destination = address.exploded
 153             except Exception:
 154                 raise ValidationError(_('Invalid network address format at Destination Field'))
 155         if self.source:
 156             try:
 157                 address = IPNetwork(self.source)
 158                 self.source = address.exploded
 159             except Exception:
 160                 raise ValidationError(_('Invalid network address format at Source Field'))
 161
 162     def commit_add(self, *args, **kwargs):
 163         peer = self.applier.get_profile().peer.domain_name
 164         send_message("[%s] Adding rule %s. Please wait..." %(self.applier.username, self.name), peer)
 165         response = add.delay(self)
 166         logger.info("Got add job id: %s" %response)
 167
 168     def commit_edit(self, *args, **kwargs):
 169         peer = self.applier.get_profile().peer.domain_name
 170         send_message("[%s] Editing rule %s. Please wait..." %(self.applier.username, self.name), peer)
 171         response = edit.delay(self)
 172         logger.info("Got edit job id: %s" %response)
 173
 174     def commit_delete(self, *args, **kwargs):
 175         reason_text = ''
 176         reason = ''
 177         if "reason" in kwargs:
 178             reason = kwargs['reason']
 179             reason_text = "Reason: %s. " %reason
 180         peer = self.applier.get_profile().peer.domain_name
 181         send_message("[%s] Suspending rule %s. %sPlease wait..." %(self.applier.username, self.name, reason_text), peer)
 182         response = delete.delay(self, reason=reason)
 183         logger.info("Got delete job id: %s" %response)
 184
 185     def has_expired(self):
 186         today = datetime.date.today()
 187         if today > self.expires:
 188             return True
 189         return False
 190
 191     def check_sync(self):
 192         if not self.is_synced():
 193             self.status = "OUTOFSYNC"
 194             self.save()
 195
 196     def is_synced(self):
 197         found = False
 198         get_device = PR.Retriever()
 199         device = get_device.fetch_device()
 200         try:
 201             routes = device.routing_options[0].routes
 202         except Exception as e:
 203             self.status = "EXPIRED"
 204             self.save()
 205             logger.error("No routing options on device. Exception: %s" %e)
 206             return True
 207         for route in routes:
 208             if route.name == self.name:
 209                 found = True
 210                 logger.info('Found a matching rule name')
 211                 devicematch = route.match
 212                 try:
 213                     assert(self.destination)
 214                     assert(devicematch['destination'][0])
 215                     if self.destination == devicematch['destination'][0]:
 216                         found = found and True
 217                         logger.info('Found a matching destination')
 218                     else:
 219                         found = False
 220                         logger.info('Destination fields do not match')
 221                 except:
 222                     pass
 223                 try:
 224                     assert(self.source)
 225                     assert(devicematch['source'][0])
 226                     if self.source == devicematch['source'][0]:
 227                         found = found and True
 228                         logger.info('Found a matching source')
 229                     else:
 230                         found = False
 231                         logger.info('Source fields do not match')
 232                 except:
 233                     pass
 234                 try:
 235                     assert(self.fragmenttype)
 236                     assert(devicematch['fragment'][0])
 237                     if self.fragmenttype == devicematch['fragment'][0]:
 238                         found = found and True
 239                         logger.info('Found a matching fragment type')
 240                     else:
 241                         found = False
 242                         logger.info('Fragment type fields do not match')
 243                 except:
 244                     pass
 245                 try:
 246                     assert(self.icmpcode)
 247                     assert(devicematch['icmp-code'][0])
 248                     if self.icmpcode == devicematch['icmp-code'][0]:
 249                         found = found and True
 250                         logger.info('Found a matching icmp code')
 251                     else:
 252                         found = False
 253                         logger.info('Icmp code fields do not match')
 254                 except:
 255                     pass
 256                 try:
 257                     assert(self.icmptype)
 258                     assert(devicematch['icmp-type'][0])
 259                     if self.icmptype == devicematch['icmp-type'][0]:
 260                         found = found and True
 261                         logger.info('Found a matching icmp type')
 262                     else:
 263                         found = False
 264                         logger.info('Icmp type fields do not match')
 265                 except:
 266                     pass
 267                 if found and self.status != "ACTIVE":
 268                     logger.error('Rule is applied on device but appears as offline')
 269                     self.status = "ACTIVE"
 270                     self.save()
 271                     found = True
 272             if self.status == "ADMININACTIVE" or self.status == "INACTIVE" or self.status == "EXPIRED":
 273                 found = True
 274         return found
 275
 276     def get_then(self):
 277         ret = ''
 278         then_statements = self.then.all()
 279         for statement in then_statements:
 280             if statement.action_value:
 281                 ret = "%s %s:<strong>%s</strong><br/>" %(ret, statement.action, statement.action_value)
 282             else:
 283                 ret = "%s %s<br>" %(ret, statement.action)
 284         return ret.rstrip(',')
 285
 286     get_then.short_description = 'Then statement'
 287     get_then.allow_tags = True
 288 #
 289     def get_match(self):
 290         ret = ''
 291         if self.destination:
 292             ret = '%s Dst Addr:<strong>%s</strong> <br/>' %(ret, self.destination)
 293         if self.fragmenttype:
 294             ret = "%s Fragment Type:<strong>%s</strong><br/>" %(ret, self.fragmenttype)
 295         if self.icmpcode:
 296             ret = "%s ICMP code:<strong>%s</strong><br/>" %(ret, self.icmpcode)
 297         if self.icmptype:
 298             ret = "%s ICMP Type:<strong>%s</strong><br/>" %(ret, self.icmptype)
 299         if self.packetlength:
 300             ret = "%s Packet Length:<strong>%s</strong><br/>" %(ret, self.packetlength)
 301         if self.source:
 302             ret = "%s Src Addr:<strong>%s</strong> <br/>" %(ret, self.source)
 303         if self.tcpflag:
 304             ret = "%s TCP flag:<strong>%s</strong><br/>" %(ret, self.tcpflag)
 305         if self.port:
 306             for port in self.port.all():
 307                     ret = ret + "Port:<strong>%s</strong> <br/>" %(port)
 308         if self.protocol:
 309             for protocol in self.protocol.all():
 310                     ret = ret + "Protocol:<strong>%s</strong> <br/>" %(protocol)
 311         if self.destinationport:
 312             for port in self.destinationport.all():
 313                     ret = ret + "Dst Port:<strong>%s</strong> <br/>" %(port)
 314         if self.sourceport:
 315             for port in self.sourceport.all():
 316                     ret = ret +"Src Port:<strong>%s</strong> <br/>" %(port)
 317         if self.dscp:
 318             for dscp in self.dscp.all():
 319                     ret = ret + "%s Port:<strong>%s</strong> <br/>" %(ret, dscp)
 320         return ret.rstrip('<br/>')
 321
 322     get_match.short_description = 'Match statement'
 323     get_match.allow_tags = True
 324
 325     @property
 326     def applier_peer(self):
 327         try:
 328             applier_peer = self.applier.get_profile().peer
 329         except:
 330             applier_peer = None
 331         return applier_peer
 332
 333     @property
 334     def days_to_expire(self):
 335         if self.status not in ['EXPIRED', 'ADMININACTIVE', 'ERROR', 'INACTIVE']:
 336             expiration_days = (self.expires - datetime.date.today()).days
 337             if expiration_days < settings.EXPIRATION_NOTIFY_DAYS:
 338                 return "%s" %expiration_days
 339             else:
 340                 return False
 341         else:
 342             return False
 343
 344 def send_message(msg, user):
 345 #    username = user.username
 346     peer = user
 347     b = beanstalkc.Connection()
 348     b.use(settings.POLLS_TUBE)
 349     tube_message = json.dumps({'message': str(msg), 'username':peer})
 350     b.put(tube_message)
 351     b.close()