cputils.py

#!/usr/bin/env python

# Module with useful functions for scripts using CloudPassage API

import sys
import platform
import os
import datetime
import os.path
import socket
import re
import json
import cpapi

verbose = False
def write_file(directory, scan_time, data, server_info):
    filename = directory + "/output/" + str(scan_time.year) + '/' + str(scan_time.month) + '/' + str(scan_time.day) + "/"
    if server_info:
        filename += data['id'] + '/server_info.json'
    else:
        filename += data['scan']['server_id'] + '/' + data['scan']['module'] + '--' + data['scan']['id'] + '.json'

    if not os.path.exists(os.path.dirname(filename)):
        os.makedirs(os.path.dirname(filename))
    with open(filename, "w") as f:
        json.dump(data,f)
    return None

def check_path_exist(directory, scan_time, server_id):
    exist = False
    filename = directory + "/output/" + str(scan_time.year) + '/' + str(scan_time.month) + '/' + str(scan_time.day) + "/"
    filename += server_id + "/server_info.json"
    if os.path.exists(filename):
        exist = True
    return exist
def verify_module(modules_str, allowedReportTypes):
    modules = modules_str.split(',')
    for module in modules:
        if module not in allowedReportTypes:
            print "Error: There's a typo in the report type. The allowed report types are %s" % allowedReportTypes
            sys.exit(1)
    return None

def checkPythonVersion():
    # This script depends on libraries like json and urllib2 which require 2.6 or 2.7
    #   so test for one of those, and exit if not found.
    pyver = platform.python_version()
    if ((not pyver.startswith('2.6')) and (not pyver.startswith('2.7'))):
        print >> sys.stderr, "Python version %s is not supported, need 2.6.x or 2.7.x" % pyver
        sys.exit(1)


def checkPidRunning(pid):
    if (platform.system() != "Windows"):
        try:
            os.kill(pid, 0)
        except OSError:
            return False
        else:
            return True
    else:
        return True


def checkLockFile(filename):
    pid = str(os.getpid())
    if (os.path.isfile(filename)):
        errMsg = "Lock file (%s) exists" % filename
        pid = file(filename, 'r').readlines()[0].strip()
        if (checkPidRunning(int(pid))):
            print >> sys.stderr, "%s... Exiting" % errMsg
        else:
            print >> sys.stderr, "%s, but PID (%s) not running." % (errMsg, pid)
            print >> sys.stderr, "Deleting stale lock file. Try running script again."
            os.remove(filename)
        sys.exit(1)
    else:
        file(filename, 'w').write(pid)


def convertAuthFilenameToConfig(filename):
    basename = os.path.basename(filename)
    return basename.replace(".auth", ".config")


def processAuthFile(filename, progDir):
    if (not os.path.exists(filename)):
        filename = os.path.join(progDir, filename)
        if (not os.path.exists(filename)):
            return (None, "Auth file %s does not exist" % filename)
    fp = open(filename)
    lines = fp.readlines()
    fp.close()
    credentials = []
    for line in lines:
        str = line.strip()
        if not str.startswith("#"):
            fields = str.split("|")
            if (len(fields) == 2):
                if (len(fields[0]) < 1):
                    print >> sys.stderr, "No ID field found: %s" % str
                elif (len(fields[1]) < 1):
                    print >> sys.stderr, "No secret field found: %s" % str
                elif (len(credentials) < 5):
                    credential = {'id': fields[0], 'secret': fields[1]}
                    credentials.append(credential)
                else:
                    print >> sys.stderr, "Ignoring id=%s, only 5 accounts allowed" % fields[0]
    if (len(credentials) == 0):
        return (None, "Empty auth file, no credentials found in %s" % filename)
    else:
        return (credentials, None)


def validateURL(url):
    url_regex = "https://([-A-Za-z0-9_.]+)[.]([-A-Za-z0-9_]+[.][-A-Za-z0-9_]+)"
    m = re.match(url_regex,url)
    if (m == None):
        return (False, "Illegal URL format")
    hostname = m.group(1)
    domain = m.group(2)
    if (domain != "cloudpassage.com"):
        return (False, "%s is not allowed as domain, must use cloudpassage.com" % domain)
    if (hostname == "www"):
        return (False, "www is not allowed as hostname")
    return (True, "")


def strToDate(str):
    # assumes a UTC/ISO8601 date/time string (e.g. "2012-08-12T21:39:40.740301Z")
    return datetime.datetime.strptime( str, "%Y-%m-%dT%H:%M:%S.%fZ" )


def verifyISO8601(tstr):
    if (tstr == None) or (len(tstr) == 0):
        return (False, "Empty timestamp, ISO8601 format required")
    iso_regex = "(\d{4})-(\d{2})-(\d{2})(T(\d{2}):(\d{2}):(\d{2})(\.\d{1,6})?(Z|[+-]\d{4})?)?$"
    m = re.match(iso_regex, tstr)
    if (m == None):
        return (False, "Timestamp (%s) does not match ISO8601 format" % tstr)
    year = m.group(1)
    month = m.group(2)
    day = m.group(3)
    hour = m.group(5)
    minute = m.group(6)
    second = m.group(7)
    if (year == None) or (int(year) < 1900) or (int(year) > 2100):
        return (False, "Invalid year (%s)" % year)
    if (month == None) or (int(month) < 1) or (int(month) > 12):
        return (False, "Invalid month (%s)" % month)
    if (day == None) or (int(day) < 1) or (int(day) > 31):
        return (False, "Invalid day of month (%s)" % day)
    if (hour != None):
        if (int(hour) < 0) or (int(hour) > 23):
            return (False, "Invalid hour (%s)" % hour)
        if (minute != None):
            if (int(minute) < 0) or (int(minute) > 59):
                return (False, "Invalid minute (%s)" % minute)
            if (second != None):
                if (int(second) < 0) or (int(second) > 59):
                    return (False, "Invalid second (%s)" % second)
    now = getNowAsISO8601()
    if (now < tstr):
        return (False, "Timestamp (%s) is in the future" % tstr)
    return (True, "")


def formatTimeAsISO8601(dt):
    tuple = (dt.year, dt.month, dt.day, dt.hour, dt.minute, dt.second, dt.microsecond)
    return "%04d-%02d-%02dT%02d:%02d:%02d.%06dZ" % tuple


def getNowAsISO8601():
    return formatTimeAsISO8601(datetime.datetime.utcnow())


def getHostname():
    return socket.gethostname()


monthNames = ["???", "Jan", "Feb", "Mar", "Apr",
              "May", "Jun", "Jul", "Aug", "Sep",
              "Oct", "Nov", "Dec"]


def getSyslogTime():
    now = datetime.datetime.now()
    tuple = (monthNames[now.month], now.day, now.hour, now.minute, now.second)
    return "%s %2d %02d:%02d:%02d" % tuple


# Jan  6 19:05:30 percheron cpapi:
def getSyslogPrefix():
    return "%s %s cpapi: " % (getSyslogTime(), getHostname())


###############################################################
## Parsing/Dumping various CP related endpoints (object types)
###############################################################


def isNullOrNot(obj):
    if obj:
        return "is not null"
    else:
        return "is null"

def parseServer(server):
    name = None
    id = None
    ipAddr = None
    if ('hostname' in server):
        name = server['hostname']
    if ('id' in server):
        id = server['id']
    if ('connecting_ip_address' in server):
        ipAddr = server['connecting_ip_address']
    return (name, id, ipAddr)


def dumpServer(server):
    if verbose:
        (name, id, ipAddr) = parseServer(server)
        print "Server: name=%s ip=%s id=%s" % (name, ipAddr, id)


def parseServerGroup(server):
    name = None
    id = None
    if ('name' in server):
        name = server['name']
    if ('id' in server):
        id = server['id']
    return (name, id)


def dumpServerGroup(server):
    if verbose:
        (name, id) = parseServerGroup(server)
        print "ServerGroup: name=%s id=%s" % (name, id)


def parseFirewallPolicy(server):
    name = None
    id = None
    if ('name' in server):
        name = server['name']
    if ('id' in server):
        id = server['id']
    return (name, id)


def dumpFirewallPolicy(server):
    if verbose:
        (name, id) = parseFirewallPolicy(server)
        print "FirewallPolicy: name=%s id=%s" % (name, id)


def dumpFirewallService(service):
    if verbose:
        (serviceName, serviceID, ports, protocol) = parseFirewallService(service)
        print "FirewallService: name=%s id=%s ports=%s/%s" % (serviceName, id, ports, protocol)


def parseFirewallService(service):
    name = None
    id = None
    ports = None
    protocol = None
    if ('name' in service):
        name = service['name']
    if ('id' in service):
        id = service['id']
    if ('port' in service):
        ports = service['port']
    if ('protocol' in service):
        protocol = service['protocol']
    return (name, id, ports, protocol)


###############################################################
## findOrCreate methods for various endpoints
###############################################################


def findHostByNameOrAddress(apiCon, host):
    resultsList = []
    (response, auth_error) = apiCon.getServerList()
    if ('servers' in response):
        serverList = response['servers']
        for server in serverList:
            (serverName, serverID, serverIpAddr) = parseServer(server)
            if ((serverName == host) or (serverIpAddr == host)):
                dumpServer(server)
                resultsList.append(serverID)
    return resultsList


def findHostByID(apiCon, host):
    (response, auth_error) = apiCon.getServerList()
    if ('servers' in response):
        serverList = response['servers']
        for server in serverList:
            (serverName, serverID, serverIpAddr) = parseServer(server)
            if (serverID == host):
                dumpServer(server)
                return server
    return None


def getHostList(apiCon):
    resultsList = []
    (response, auth_error) = apiCon.getServerList()
    if ('servers' in response):
        return response['servers']
    else:
        return None


def findHostInList(serverList, host):
    for server in serverList:
        (serverName, serverID, serverIpAddr) = parseServer(server)
        if (serverID == host):
            dumpServer(server)
            return server
    return None


def findGroupByName(apiCon, gname):
    (response, auth_error) = apiCon.getServerGroupList()
    if ('groups' in response):
        groupList = response['groups']
        for group in groupList:
            (groupName, groupID) = parseServerGroup(group)
            if (groupName.lower() == gname.lower()):
                dumpServerGroup(group)
                return group
    return None


def getFirewallPolicyList(apiCon):
    (response, auth_error) = apiCon.getFirewallPolicyList()
    if ('firewall_policies' in response):
        policyList = response['firewall_policies']
        return policyList
    else:
        return None


def findFirewallPolicyByName(apiCon, fwpName):
    (response, auth_error) = apiCon.getFirewallPolicyList()
    if ('firewall_policies' in response):
        policyList = response['firewall_policies']
        for policy in policyList:
            (policyName, policyID) = parseFirewallPolicy(policy)
            if (policyName.lower() == fwpName.lower()):
                dumpFirewallPolicy(policy)
                return policyID
    return None


def findFirewallPolicyByID(fwpList, fwpID):
    for policy in fwpList:
        if (policy['id'] == fwpID):
            return policy
    return None


def findFirewallServiceByName(fwsName, serviceList):
    for service in serviceList:
        (serviceName, serviceID, ports, protocol) = parseFirewallService(service)
        if (serviceName.lower() == fwsName.lower()):
            dumpFirewallService(service)
            return serviceID
    return None


def findOrCreateFirewallServices(apiCon, desired_list):
    (response, auth_error) = getFirewallServiceList(apiCon)
    if ('firewall_services' in response):
        existing_list = response['firewall_services']
        for svc in desired_list:
            id = findFirewallServiceByName(svc['name'],existing_list)
            if id == None:
                (response, auth_error) = createFirewallService(apiCon,svc)
                if ('firewall_service' in response):
                    fwsData = response['firewall_service']
                    if ('id' in fwsData):
                        id = fwsData['id']
                        svc['id'] = id
            if id == None:
                print >> sys.stderr, "Failed to create service %s" % svc['name']


def createFirewallServiceObj(name,ports,protocol):
    obj = { 'name': name, 'port': ports, 'protocol': protocol }
    return obj


# when creating windows firewall, add these services to rules
drop_svc_list = [ ]
drop_svc_list.append(createFirewallServiceObj('tcp-patch-1-52','1-52','TCP'))
drop_svc_list.append(createFirewallServiceObj('tcp-patch-54-442','54-442','TCP'))
drop_svc_list.append(createFirewallServiceObj('tcp-patch-444-65535','444-65535','TCP'))
drop_svc_list.append(createFirewallServiceObj('udp-patch-1-52','1-52','UDP'))
drop_svc_list.append(createFirewallServiceObj('udp-patch-54-65535','54-65535','UDP'))
accept_svc_list = [ ]
accept_svc_list.append(createFirewallServiceObj('dns AXFR','53','TCP'))
accept_svc_list.append(createFirewallServiceObj('https','443','TCP'))
accept_svc_list.append(createFirewallServiceObj('dns query','53','UDP'))


def findOrCreateFirewallPolicy(apiCon, policyName, platform):
    desiredFirewallPolicy = findFirewallPolicyByName(apiCon,policyName)
    if not (desiredFirewallPolicy):
        print >> sys.stderr, "No %s quarantine policy found, creating: %s" % (platform, policyName)
        findOrCreateFirewallServices(apiCon,drop_svc_list + accept_svc_list)
        policy = createQuarentineFirewallPolicy(policyName, platform, "quarantine fw policy", drop_svc_list, accept_svc_list)
        (response, auth_error) = apiCon.createFirewallPolicy(policy)
        if auth_error:
            print >> sys.stderr, "Firewall Policy Creation FAILED: check that your Halo API key has write priviledges on your account"
            return None
    desiredFirewallPolicy = findFirewallPolicyByName(apiCon,policyName)
    return desiredFirewallPolicy


def checkFwPolicy(group, key, platform, policyList, desiredName):
    if key in group:
        id = group[key]
        policy = findFirewallPolicyByID(policyList, id)
        if (policy) and ('name' in policy):
            if verbose:
                print "%s firewall policy: %s" % (platform, policy['name'])
            return desiredName.lower() == policy['name'].lower()
        else:
            print "%s firewall policy: none" % platform
    return False


def checkGroupFirewallPolicies(group, apiCon, linuxFirewallPolicyName, windowsFirewallPolicyName):
    policyList = getFirewallPolicyList(apiCon)
    linuxOK = checkFwPolicy(group, 'linux_firewall_policy_id', 'linux', policyList, linuxFirewallPolicyName)
    windowsOK = checkFwPolicy(group, 'windows_firewall_policy_id', 'windows', policyList,windowsFirewallPolicyName )
    if not linuxOK:
        newPolicy = findOrCreateFirewallPolicy(apiCon, linuxFirewallPolicyName,'linux')
        apiCon.assignFirewallPolicyToGroup(group['id'], 'linux_firewall_policy_id', newPolicy)
    if not windowsOK:
        newPolicy = findOrCreateFirewallPolicy(apiCon, windowsFirewallPolicyName,'windows')
        apiCon.assignFirewallPolicyToGroup(group['id'], 'windows_firewall_policy_id', newPolicy)


def createFirewallRule(chain, policy, svc = None):
    rule = { "log": False, "active": True }
    rule["chain"] = chain
    rule["action"] = policy
    rule["connection_states"] = None
    rule["firewall_interface"] = None
    rule["firewall_source"] = None
    if svc:
        rule["firewall_service"] = svc["id"]
    else:
        rule["firewall_service"] = None
    return rule


def createQuarentineFirewallPolicy(name, platform, description, drop_svc_list = None, accept_svc_list = None):
    fwPolicy = { "name": name, "platform": platform }
    ruleList = []
    if (platform != "windows"):
        ruleList.append(createFirewallRule("INPUT", "DROP"))
        ruleList.append(createFirewallRule("OUTPUT", "DROP"))
    fwPolicy["firewall_rules"] = ruleList
    fwPolicy["description"] = description
    if (platform == "windows"):
        fwPolicy["log_allowed"] = True;
        fwPolicy["log_dropped"] = True;
        fwPolicy["block_inbound"] = True;
        fwPolicy["block_outbound"] = True;
    return { "firewall_policy": fwPolicy }


def createFirewallService(apiCon,svcObj):
    url = "%s:%d/%s/firewall_services" % (apiCon.base_url, apiCon.port, apiCon.api_ver)
    svcData = { 'firewall_service': svcObj }
    jsonData = json.dumps(svcData)
    # print jsonData # for debugging
    (data, auth_error) = apiCon.doPostRequest(url, apiCon.authToken, jsonData)
    if (data):
        return (json.loads(data), auth_error)
    else:
        return (None, auth_error)


def getFirewallServiceList(apiCon):
    url = "%s:%d/%s/firewall_services/" % (apiCon.base_url, apiCon.port, apiCon.api_ver)
    (data, auth_error) = apiCon.doGetRequest(url, apiCon.authToken)
    if (data):
        return (json.loads(data), auth_error)
    else:
        return (None, auth_error)


def getFirewallZoneList(apiCon):
    url = "%s:%d/%s/firewall_zones/" % (apiCon.base_url, apiCon.port, apiCon.api_ver)
    (data, auth_error) = apiCon.doGetRequest(url, apiCon.authToken)
    if (data):
        return (json.loads(data), auth_error)
    else:
        return (None, auth_error)


def createFirewallZone(apiCon,zoneObj):
    url = "%s:%d/%s/firewall_zones" % (apiCon.base_url, apiCon.port, apiCon.api_ver)
    zoneData = { 'firewall_zone': zoneObj }
    jsonData = json.dumps(zoneData)
    # print jsonData # for debugging
    (data, auth_error) = apiCon.doPostRequest(url, apiCon.authToken, jsonData)
    if (data):
        return (json.loads(data), auth_error)
    else:
        return (None, auth_error)