Statistics
| Branch: | Tag: | Revision:

root / flowspec / models.py @ dbdc30ec

History | View | Annotate | Download (13.4 kB)

1
# -*- coding: utf-8 -*- vim:encoding=utf-8:
2
# vim: tabstop=4:shiftwidth=4:softtabstop=4:expandtab
3

    
4
from django.db import models
5
from django.conf import settings
6
from django.contrib.auth.models import User
7
from utils import proxy as PR
8
from ipaddr import *
9
import datetime
10
import logging
11
from time import sleep
12

    
13
import beanstalkc
14
from flowspy.utils.randomizer import id_generator as id_gen
15

    
16
from flowspec.tasks import *
17

    
18
FORMAT = '%(asctime)s %(levelname)s: %(message)s'
19
logging.basicConfig(format=FORMAT)
20
logger = logging.getLogger(__name__)
21
logger.setLevel(logging.DEBUG)
22

    
23

    
24
FRAGMENT_CODES = (
25
    ("dont-fragment", "Don't fragment"),
26
    ("first-fragment", "First fragment"),
27
    ("is-fragment", "Is fragment"),
28
    ("last-fragment", "Last fragment"),
29
    ("not-a-fragment", "Not a fragment")
30
)
31

    
32
THEN_CHOICES = (
33
    ("accept", "Accept"),
34
    ("discard", "Discard"),
35
    ("community", "Community"),
36
    ("next-term", "Next term"),
37
    ("routing-instance", "Routing Instance"),
38
    ("rate-limit", "Rate limit"),
39
    ("sample", "Sample")                
40
)
41

    
42
MATCH_PROTOCOL = (
43
    ("ah", "ah"),
44
    ("egp", "egp"),
45
    ("esp", "esp"),
46
    ("gre", "gre"),
47
    ("icmp", "icmp"),
48
    ("icmp6", "icmp6"),
49
    ("igmp", "igmp"),
50
    ("ipip", "ipip"),
51
    ("ospf", "ospf"),
52
    ("pim", "pim"),
53
    ("rsvp", "rsvp"),
54
    ("sctp", "sctp"),
55
    ("tcp", "tcp"),
56
    ("udp", "udp"),
57
)
58

    
59
ROUTE_STATES = (
60
    ("ACTIVE", "ACTIVE"),
61
    ("ERROR", "ERROR"),
62
    ("EXPIRED", "EXPIRED"),
63
    ("PENDING", "PENDING"),
64
    ("OUTOFSYNC", "OUTOFSYNC"),
65
    ("INACTIVE", "INACTIVE"),
66
    ("ADMININACTIVE", "ADMININACTIVE"),           
67
)
68

    
69

    
70
def days_offset(): return datetime.date.today() + datetime.timedelta(days = settings.EXPIRATION_DAYS_OFFSET)
71
    
72
class MatchPort(models.Model):
73
    port = models.CharField(max_length=24, unique=True)
74
    def __unicode__(self):
75
        return self.port
76
    class Meta:
77
        db_table = u'match_port'    
78

    
79
class MatchDscp(models.Model):
80
    dscp = models.CharField(max_length=24)
81
    def __unicode__(self):
82
        return self.dscp
83
    class Meta:
84
        db_table = u'match_dscp'
85

    
86
class MatchProtocol(models.Model):
87
    protocol = models.CharField(max_length=24, unique=True)
88
    def __unicode__(self):
89
        return self.protocol
90
    class Meta:
91
        db_table = u'match_protocol'
92

    
93
   
94
class ThenAction(models.Model):
95
    action = models.CharField(max_length=60, choices=THEN_CHOICES, verbose_name="Action")
96
    action_value = models.CharField(max_length=255, blank=True, null=True, verbose_name="Action Value")
97
    def __unicode__(self):
98
        ret = "%s:%s" %(self.action, self.action_value)
99
        return ret.rstrip(":")
100
    class Meta:
101
        db_table = u'then_action'
102
        ordering = ['action', 'action_value']
103
        unique_together = ("action", "action_value")
104

    
105
class Route(models.Model):
106
    name = models.SlugField(max_length=128)
107
    applier = models.ForeignKey(User, blank=True, null=True)
108
    source = models.CharField(max_length=32, help_text=u"Network address. Use address/CIDR notation", verbose_name="Source Address")
109
    sourceport = models.ManyToManyField(MatchPort, blank=True, null=True, related_name="matchSourcePort", verbose_name="Source Port")
110
    destination = models.CharField(max_length=32, help_text=u"Network address. Use address/CIDR notation", verbose_name="Destination Address")
111
    destinationport = models.ManyToManyField(MatchPort, blank=True, null=True, related_name="matchDestinationPort", verbose_name="Destination Port")
112
    port = models.ManyToManyField(MatchPort, blank=True, null=True, related_name="matchPort", verbose_name="Port" )
113
    dscp = models.ManyToManyField(MatchDscp, blank=True, null=True, verbose_name="DSCP")
114
    fragmenttype = models.CharField(max_length=20, choices=FRAGMENT_CODES, blank=True, null=True, verbose_name="Fragment Type")
115
    icmpcode = models.CharField(max_length=32, blank=True, null=True, verbose_name="ICMP Code")
116
    icmptype = models.CharField(max_length=32, blank=True, null=True, verbose_name="ICMP Type")
117
    packetlength = models.IntegerField(blank=True, null=True, verbose_name="Packet Length")
118
    protocol = models.ManyToManyField(MatchProtocol, blank=True, null=True, verbose_name="Protocol")
119
    tcpflag = models.CharField(max_length=128, blank=True, null=True, verbose_name="TCP flag")
120
    then = models.ManyToManyField(ThenAction, verbose_name="Then")
121
    filed = models.DateTimeField(auto_now_add=True)
122
    last_updated = models.DateTimeField(auto_now=True)
123
    status = models.CharField(max_length=20, choices=ROUTE_STATES, blank=True, null=True, verbose_name="Status", default="PENDING")
124
#    is_online = models.BooleanField(default=False)
125
#    is_active = models.BooleanField(default=False)
126
    expires = models.DateField(default=days_offset)
127
    response = models.CharField(max_length=512, blank=True, null=True)
128
    comments = models.TextField(null=True, blank=True, verbose_name="Comments")
129

    
130
    
131
    def __unicode__(self):
132
        return self.name
133
    
134
    class Meta:
135
        db_table = u'route'
136
        verbose_name = "Rule"
137
        verbose_name_plural = "Rules"
138
    
139
    def save(self, *args, **kwargs):
140
        if not self.pk:
141
            hash = id_gen()
142
            self.name = "%s_%s" %(self.name, hash)
143
        super(Route, self).save(*args, **kwargs) # Call the "real" save() method.
144

    
145
        
146
    def clean(self, *args, **kwargs):
147
        from django.core.exceptions import ValidationError
148
        if self.destination:
149
            try:
150
                address = IPNetwork(self.destination)
151
                self.destination = address.exploded
152
            except Exception:
153
                raise ValidationError('Invalid network address format at Destination Field')
154
        if self.source:
155
            try:
156
                address = IPNetwork(self.source)
157
                self.source = address.exploded
158
            except Exception:
159
                raise ValidationError('Invalid network address format at Source Field')
160
   
161
    def commit_add(self, *args, **kwargs):
162
        peer = self.applier.get_profile().peer.domain_name
163
        send_message("[%s] Adding rule %s. Please wait..." %(self.applier.username, self.name), peer)
164
        response = add.delay(self)
165
        logger.info("Got add job id: %s" %response)
166
        
167
    def commit_edit(self, *args, **kwargs):
168
        peer = self.applier.get_profile().peer.domain_name
169
        send_message("[%s] Editing rule %s. Please wait..." %(self.applier.username, self.name), peer)
170
        response = edit.delay(self)
171
        logger.info("Got edit job id: %s" %response)
172

    
173
    def commit_delete(self, *args, **kwargs):
174
        reason_text = ''
175
        reason = ''
176
        if "reason" in kwargs:
177
            reason = kwargs['reason']
178
            reason_text = "Reason: %s. " %reason
179
        peer = self.applier.get_profile().peer.domain_name
180
        send_message("[%s] Suspending rule %s. %sPlease wait..." %(self.applier.username, self.name, reason_text), peer)
181
        response = delete.delay(self, reason=reason)
182
        logger.info("Got delete job id: %s" %response)
183

    
184
    def has_expired(self):
185
        today = datetime.date.today()
186
        if today > self.expires:
187
            return True
188
        return False
189
    
190
    def check_sync(self):
191
        if not self.is_synced():
192
            self.status = "OUTOFSYNC"
193
            self.save()
194
    
195
    def is_synced(self):
196
        found = False
197
        get_device = PR.Retriever()
198
        device = get_device.fetch_device()
199
        try:
200
            routes = device.routing_options[0].routes
201
        except Exception as e:
202
            self.status = "EXPIRED"
203
            self.save()
204
            logger.error("No routing options on device. Exception: %s" %e)
205
            return True
206
        for route in routes:
207
            if route.name == self.name:
208
                found = True
209
                logger.info('Found a matching rule name')
210
                devicematch = route.match
211
                try:
212
                    assert(self.destination)
213
                    assert(devicematch['destination'][0])
214
                    if self.destination == devicematch['destination'][0]:
215
                        found = found and True
216
                        logger.info('Found a matching destination')
217
                    else:
218
                        found = False
219
                        logger.info('Destination fields do not match')
220
                except:
221
                    pass
222
                try:
223
                    assert(self.source)
224
                    assert(devicematch['source'][0])
225
                    if self.source == devicematch['source'][0]:
226
                        found = found and True
227
                        logger.info('Found a matching source')
228
                    else:
229
                        found = False
230
                        logger.info('Source fields do not match')
231
                except:
232
                    pass
233
                try:
234
                    assert(self.fragmenttype)
235
                    assert(devicematch['fragment'][0])
236
                    if self.fragmenttype == devicematch['fragment'][0]:
237
                        found = found and True
238
                        logger.info('Found a matching fragment type')
239
                    else:
240
                        found = False
241
                        logger.info('Fragment type fields do not match')
242
                except:
243
                    pass
244
                try:
245
                    assert(self.icmpcode)
246
                    assert(devicematch['icmp-code'][0])
247
                    if self.icmpcode == devicematch['icmp-code'][0]:
248
                        found = found and True
249
                        logger.info('Found a matching icmp code')
250
                    else:
251
                        found = False
252
                        logger.info('Icmp code fields do not match')
253
                except:
254
                    pass
255
                try:
256
                    assert(self.icmptype)
257
                    assert(devicematch['icmp-type'][0])
258
                    if self.icmptype == devicematch['icmp-type'][0]:
259
                        found = found and True
260
                        logger.info('Found a matching icmp type')
261
                    else:
262
                        found = False
263
                        logger.info('Icmp type fields do not match')
264
                except:
265
                    pass
266
                if found and self.status != "ACTIVE":
267
                    logger.error('Rule is applied on device but appears as offline')
268
                    self.status = "ACTIVE"
269
                    self.save()
270
                    found = True
271
            if self.status == "ADMININACTIVE" or self.status == "INACTIVE" or self.status == "EXPIRED":
272
                found = True
273
        return found
274

    
275
    def get_then(self):
276
        ret = ''
277
        then_statements = self.then.all()
278
        for statement in then_statements:
279
            if statement.action_value:
280
                ret = "%s %s:<strong>%s</strong><br/>" %(ret, statement.action, statement.action_value)
281
            else: 
282
                ret = "%s %s<br>" %(ret, statement.action)
283
        return ret.rstrip(',')
284
    
285
    get_then.short_description = 'Then statement'
286
    get_then.allow_tags = True
287
#
288
    def get_match(self):
289
        ret = ''
290
        if self.destination:
291
            ret = '%s Dst Addr:<strong>%s</strong> <br/>' %(ret, self.destination)
292
        if self.fragmenttype:
293
            ret = "%s Fragment Type:<strong>%s</strong><br/>" %(ret, self.fragmenttype)
294
        if self.icmpcode:
295
            ret = "%s ICMP code:<strong>%s</strong><br/>" %(ret, self.icmpcode)
296
        if self.icmptype:
297
            ret = "%s ICMP Type:<strong>%s</strong><br/>" %(ret, self.icmptype)
298
        if self.packetlength:
299
            ret = "%s Packet Length:<strong>%s</strong><br/>" %(ret, self.packetlength)
300
        if self.source:
301
            ret = "%s Src Addr:<strong>%s</strong> <br/>" %(ret, self.source)
302
        if self.tcpflag:
303
            ret = "%s TCP flag:<strong>%s</strong><br/>" %(ret, self.tcpflag)
304
        if self.port:
305
            for port in self.port.all():
306
                    ret = ret + "Port:<strong>%s</strong> <br/>" %(port)
307
        if self.protocol:
308
            for protocol in self.protocol.all():
309
                    ret = ret + "Protocol:<strong>%s</strong> <br/>" %(protocol)
310
        if self.destinationport:
311
            for port in self.destinationport.all():
312
                    ret = ret + "Dst Port:<strong>%s</strong> <br/>" %(port)
313
        if self.sourceport:
314
            for port in self.sourceport.all():
315
                    ret = ret +"Src Port:<strong>%s</strong> <br/>" %(port)
316
        if self.dscp:
317
            for dscp in self.dscp.all():
318
                    ret = ret + "%s Port:<strong>%s</strong> <br/>" %(ret, dscp)
319
        return ret.rstrip('<br/>')
320
        
321
    get_match.short_description = 'Match statement'
322
    get_match.allow_tags = True
323
    
324
    @property
325
    def applier_peer(self):
326
        try:
327
            applier_peer = self.applier.get_profile().peer
328
        except:
329
            applier_peer = None
330
        return applier_peer
331
    
332
    @property
333
    def days_to_expire(self):
334
        if self.status not in ['EXPIRED', 'ADMININACTIVE', 'ERROR', 'INACTIVE']:
335
            expiration_days = (self.expires - datetime.date.today()).days
336
            if expiration_days < settings.EXPIRATION_NOTIFY_DAYS:
337
                return "%s" %expiration_days
338
            else:
339
                return False
340
        else:
341
            return False
342

    
343
def send_message(msg, user):
344
#    username = user.username
345
    peer = user
346
    b = beanstalkc.Connection()
347
    b.use(settings.POLLS_TUBE)
348
    tube_message = json.dumps({'message': str(msg), 'username':peer})
349
    b.put(tube_message)
350
    b.close()