zwitschi
9f8ab0f61c
- Implemented a new utility for querying WHOIS information and consolidating IP addresses by subnet. - Added caching mechanism for WHOIS responses to improve performance. - Introduced functions for loading and saving the WHOIS cache, querying subnets, and consolidating IPs based on a threshold. feat: create Flask web UI for intrusion detection system - Developed a Flask web application to manage the intrusion detection system. - Implemented routes for scanning, reports, blocklist management, and firewall configuration. - Added helper functions for reading files and handling requests. feat: define routes for web UI - Registered routes for various web pages and API endpoints in the Flask application. - Implemented functionality for scanning, reporting, blocklist management, and firewall state retrieval. feat: implement background scan runner for web UI - Created a background scan runner to handle scan jobs in a separate thread. - Managed an in-memory job store for tracking scan jobs and their statuses. - Added persistence for scan jobs to maintain state across application restarts. chore: update start script for Flask application - Enhanced the PowerShell start script to check for the existence of the virtual environment. - Added comments and structured the script for better readability and usability.
129 lines
3.7 KiB
Python
129 lines
3.7 KiB
Python
#!/usr/bin/env python3
|
|
"""WHOIS subnet querying and IP consolidation."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import ipaddress
|
|
import json
|
|
import os
|
|
import re
|
|
from typing import Iterable
|
|
|
|
from .constants import (
|
|
SUBNET_THRESHOLD,
|
|
WHOIS_CACHE_PATH,
|
|
WHOIS_PORT,
|
|
WHOIS_SERVER,
|
|
WHOIS_TIMEOUT,
|
|
)
|
|
from .ip_utils import ip_version, parse_ip
|
|
|
|
_whois_cache: dict[str, str] = {}
|
|
|
|
|
|
def load_whois_cache() -> None:
|
|
global _whois_cache
|
|
if not _whois_cache and os.path.exists(WHOIS_CACHE_PATH):
|
|
try:
|
|
with open(WHOIS_CACHE_PATH, "r", encoding="utf-8") as f:
|
|
_whois_cache = json.load(f)
|
|
except Exception:
|
|
_whois_cache = {}
|
|
|
|
|
|
def save_whois_cache() -> None:
|
|
if _whois_cache:
|
|
os.makedirs(os.path.dirname(WHOIS_CACHE_PATH), exist_ok=True)
|
|
try:
|
|
with open(WHOIS_CACHE_PATH, "w", encoding="utf-8") as f:
|
|
json.dump(_whois_cache, f, indent=2)
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
def query_whois_subnet(ip: str) -> str | None:
|
|
"""Query whois.radb.net for the route/subnet of an IP address."""
|
|
addr = parse_ip(ip)
|
|
if addr is None:
|
|
return None
|
|
|
|
load_whois_cache()
|
|
if ip in _whois_cache:
|
|
return _whois_cache[ip] or None
|
|
|
|
import socket
|
|
try:
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.settimeout(WHOIS_TIMEOUT)
|
|
s.connect((WHOIS_SERVER, WHOIS_PORT))
|
|
s.sendall(f"{ip}\r\n".encode())
|
|
res = ""
|
|
while True:
|
|
chunk = s.recv(4096).decode(errors="ignore")
|
|
if not chunk:
|
|
break
|
|
res += chunk
|
|
s.close()
|
|
|
|
routes = re.findall(r"^(?:route|route6):\s*(\S+)",
|
|
res, re.IGNORECASE | re.MULTILINE)
|
|
if routes:
|
|
routes_parsed = []
|
|
for r in routes:
|
|
try:
|
|
routes_parsed.append(ipaddress.ip_network(r))
|
|
except ValueError:
|
|
continue
|
|
if routes_parsed:
|
|
best_route = max(routes_parsed, key=lambda n: n.prefixlen)
|
|
subnet_str = str(best_route)
|
|
_whois_cache[ip] = subnet_str
|
|
save_whois_cache()
|
|
return subnet_str
|
|
|
|
except Exception:
|
|
pass
|
|
|
|
subnet_str = f"{ip}/32" if addr.version == 4 else f"{ip}/128"
|
|
_whois_cache[ip] = subnet_str
|
|
save_whois_cache()
|
|
return subnet_str
|
|
|
|
|
|
def consolidate_by_subnet(ips: Iterable[str],
|
|
threshold: int = SUBNET_THRESHOLD) -> set[str]:
|
|
"""Group IPs by WHOIS subnet; if >= threshold IPs in a subnet, block the subnet.
|
|
|
|
Otherwise, block individual IPs.
|
|
"""
|
|
ip_list = list(ips)
|
|
subnet_to_ips: dict[str, set[str]] = {}
|
|
ip_to_subnet: dict[str, str] = {}
|
|
|
|
for ip in ip_list:
|
|
subnet = query_whois_subnet(ip)
|
|
if subnet:
|
|
try:
|
|
net = ipaddress.ip_network(subnet, strict=False)
|
|
addr = ipaddress.ip_address(ip)
|
|
if addr in net:
|
|
subnet_to_ips.setdefault(subnet, set()).add(ip)
|
|
ip_to_subnet[ip] = subnet
|
|
continue
|
|
except ValueError:
|
|
pass
|
|
fallback_net = f"{ip}/32" if ip_version(ip) == 4 else f"{ip}/128"
|
|
subnet_to_ips.setdefault(fallback_net, set()).add(ip)
|
|
ip_to_subnet[ip] = fallback_net
|
|
|
|
blocked_targets: set[str] = set()
|
|
for subnet, mapped_ips in subnet_to_ips.items():
|
|
if len(mapped_ips) >= threshold:
|
|
blocked_targets.add(subnet)
|
|
else:
|
|
for ip in mapped_ips:
|
|
blocked_targets.add(
|
|
f"{ip}/32" if ip_version(ip) == 4 else f"{ip}/128")
|
|
|
|
return blocked_targets
|