
    0h                         d dl Z d dlZd dlZd dlZd dlmZmZmZmZ d dl	m
Z
  ej                  ej                  d        ej                  e      Z G d d      Zy)    N)ListDictAnyOptional)CountermeasurePluginz4%(asctime)s - %(name)s - %(levelname)s - %(message)s)levelformatc                   ~   e Zd ZdZddefdZdeeeef      fdZ	dede
fdZd	eeef   d
edeeeef      fdZd	eeef   deeeef      d
edeeeef      fdZdeeeef      d	eeef   d
edeeeef      fdZdeeeef      deeef   defdZded
ed	eeef   dedeeef   f
dZdeeef   deeef   fdZy)
RuleEngineuC   
    规则引擎，负责解析规则并触发反制动作。
    audit_log_filec                 .    g | _         i | _        || _        y )N)rulescountermeasuresr   )selfr   s     $D:\code\IVE2\IVE\core\rule_engine.py__init__zRuleEngine.__init__   s    +-
@B,    r   c                 V    || _         t        j                  dt        |       d       y)u   加载反制规则zLoaded z rules.N)r   loggerinfolen)r   r   s     r   
load_ruleszRuleEngine.load_rules   s"    
gc%j\12r   namepluginc                 R    || j                   |<   t        j                  d|        y)u   注册反制动作插件z"Registered countermeasure plugin: N)r   r   r   )r   r   r   s      r   register_countermeasurez"RuleEngine.register_countermeasure   s&    %+T"8?@r   request_contextenvironment_idreturnc                 <    | j                  | j                  ||      S )u  
        评估请求上下文并执行匹配的反制动作 (使用引擎内部加载的全局规则)
        :param request_context: 请求上下文信息
        :param environment_id: 触发反制的环境ID
        :return: 执行的反制动作结果列表
        )_evaluate_and_execute_rulesr   )r   r   r   s      r   evaluate_and_executezRuleEngine.evaluate_and_execute#   s     //

O^\\r   environment_rulesc                 (    | j                  |||      S )uP  
        评估请求上下文并执行匹配的反制动作 (使用为特定环境指定的规则)
        :param request_context: 请求上下文信息
        :param environment_rules: 为该环境指定的规则列表
        :param environment_id: 触发反制的环境ID
        :return: 执行的反制动作结果列表
        )r!   )r   r   r#   r   s       r   $evaluate_and_execute_for_environmentz/RuleEngine.evaluate_and_execute_for_environment-   s     //0A?Tbccr   rules_to_evaluatec           
      `   g }|D ]  }|j                  dd      s| j                  |j                  dg       |      s9|j                  d      }| j                  j                  |      }|rj	 |j                         }|j                  di       |d<   |j	                  |      }	|d   ||	d}
|j                  |
       | j                  |d   ||||	       t        j                  d| d|d            |S # t        $ r,}t        j                  d| d	|d    d
|        Y d}~#d}~ww xY w)u  
        内部方法：执行规则评估和反制动作
        :param rules_to_evaluate: 要评估的规则列表
        :param request_context: 请求上下文信息
        :param environment_id: 触发反制的环境ID
        :return: 执行的反制动作结果列表
        enabledT
conditionsactionconfigid)rule_idr*   resultzError executing countermeasure z
 for rule z: NzCountermeasure plugin 'z' not found for rule )get_match_conditionsr   copyexecuteappend
_log_audit	Exceptionr   errorwarning)r   r&   r   r   resultsruleaction_name	cm_plugincontext_with_configr.   execution_resultes               r   r!   z&RuleEngine._evaluate_and_execute_rules8   sQ    %D88It,%%dhh|R&@/R"hhx0 0044[A	q.=.B.B.D+8<28N+H5!*!2!23F!G'+Dz&1&,,(
  '78 T
NOU`bhi
 NN%<[MI^_cdh_i^j#kl9 &<  % q'F{mS]^bcg^h]iiklmkn%oppqs   -A(C88	D-!D((D-r)   contextc                 ~    |D ]8  }d}|j                         D ]  \  }}||v r||   |k7  rd} n
||vsd} n |s8 y y)u   匹配规则条件TF)items)r   r)   r?   	conditionmatchkeyvalues          r   r0   zRuleEngine._match_conditionsa   s_     $IE'oo/
U'>gcle&;!E'!E 0  $ r   r-   r*   r.   c                    t        j                          ||| j                  |      ||d}	 t        j                  j	                  | j
                        }|rt        j                  |d       t        | j
                  dd      5 }|j                  t        j                  |      dz          ddd       y# 1 sw Y   yxY w# t        $ r"}	t        j                  d	|	        Y d}	~	yd}	~	ww xY w)
u   记录审计日志)	timestampr-   r   requestr*   r.   T)exist_okazutf-8)encoding
NzFailed to write audit log: )time_sanitize_contextospathdirnamer   makedirsopenwritejsondumpsr5   r   r6   )
r   r-   r   r   r*   r.   	log_entrylog_dirfr>   s
             r   r4   zRuleEngine._log_auditu   s     ,--o>
			<ggood&9&9:GGd3d))3AQ

9-45 BAA 	<LL6qc:;;	<s6   AC (B7.C 7C <C  C 	C.C))C.c                 &    |j                         }|S )u?   对请求上下文进行脱敏处理，避免记录敏感信息)r1   )r   r?   	sanitizeds      r   rN   zRuleEngine._sanitize_context   s     LLN	 r   N)zlogs/countermeasure_audit.log)__name__
__module____qualname____doc__strr   r   r   r   r   r   r   r"   r%   r!   boolr0   r4   rN    r   r   r   r      s   -s -
3T#s(^ 4 3
AC A9M A
]DcN ]TW ]\`aefiknfnao\p ]	dDcN 	dgklpqtvyqylzg{ 	d  NQ 	d  VZ  [_  `c  eh  `h  [i  Vj 	d'T$sCx.=Q 'dhilnqiqdr '  EH '  MQ  RV  WZ  \_  W_  R`  Ma 'RDc3h,@ 4PSUXPX> ^b (<# <s <TRUWZRZ^ <eh <rvwz|w  sA <,c3h DcN r   r   )rM   rU   loggingrO   typingr   r   r   r   pluginsr   basicConfigINFO	getLoggerr\   r   r   rb   r   r   <module>ri      sS       	 , , (   ',,/e f			8	$B Br   