
    1h                         S SK r S SKrS SKrS SKrS SKJrJrJrJr  S SK	J
r
  \R                  " \R                  SS9  \R                  " \5      r " S S5      rg)    N)ListDictAnyOptional)CountermeasurePluginz4%(asctime)s - %(name)s - %(levelname)s - %(message)s)levelformatc                      \ rS rSrSrSS\4S jjrS\\\\	4      4S jr
S\S\4S	 jrS
\\\	4   S\S\\\\	4      4S jrS
\\\	4   S\\\\	4      S\S\\\\	4      4S jrS\\\\	4      S
\\\	4   S\S\\\\	4      4S jrS\\\\	4      S\\\	4   S\4S jrS\S\S
\\\	4   S\S\\\	4   4
S jrS\\\	4   S\\\	4   4S jrSrg)
RuleEngine   u;   
规则引擎，负责解析规则并触发反制动作。
audit_log_filec                 ,    / U l         0 U l        Xl        g )N)rulescountermeasuresr   )selfr   s     core/rule_engine.py__init__RuleEngine.__init__   s    +-
@B,    r   c                 T    Xl         [        R                  S[        U5       S35        g)u   加载反制规则zLoaded z rules.N)r   loggerinfolen)r   r   s     r   
load_rulesRuleEngine.load_rules   s     
gc%j\12r   namepluginc                 P    X R                   U'   [        R                  SU 35        g)u   注册反制动作插件z"Registered countermeasure plugin: N)r   r   r   )r   r   r   s      r   register_countermeasure"RuleEngine.register_countermeasure   s$    %+T"8?@r   request_contextenvironment_idreturnc                 :    U R                  U R                  X5      $ )u   
评估请求上下文并执行匹配的反制动作 (使用引擎内部加载的全局规则)
:param request_context: 请求上下文信息
:param environment_id: 触发反制的环境ID
:return: 执行的反制动作结果列表
)_evaluate_and_execute_rulesr   )r   r!   r"   s      r   evaluate_and_executeRuleEngine.evaluate_and_execute#   s     //

O\\r   environment_rulesc                 &    U R                  X!U5      $ )u   
评估请求上下文并执行匹配的反制动作 (使用为特定环境指定的规则)
:param request_context: 请求上下文信息
:param environment_rules: 为该环境指定的规则列表
:param environment_id: 触发反制的环境ID
:return: 执行的反制动作结果列表
)r%   )r   r!   r(   r"   s       r   $evaluate_and_execute_for_environment/RuleEngine.evaluate_and_execute_for_environment-   s     //0ATbccr   rules_to_evaluatec           
         / nU GH   nUR                  SS5      (       d  M  U R                  UR                  S/ 5      U5      (       d  MF  UR                  S5      nU R                  R                  U5      nU(       ai   UR                  5       nUR                  S0 5      US'   UR	                  U5      n	US   UU	S.n
UR                  U
5        U R                  US   X2Xi5        M  [        R                  SU SUS    35        GM     U$ ! [         a-  n[        R                  SU S	US    S
U 35         SnAGM9  SnAff = f)u   
内部方法：执行规则评估和反制动作
:param rules_to_evaluate: 要评估的规则列表
:param request_context: 请求上下文信息
:param environment_id: 触发反制的环境ID
:return: 执行的反制动作结果列表
enabledT
conditionsactionconfigid)rule_idr0   resultzError executing countermeasure z
 for rule z: NzCountermeasure plugin 'z' not found for rule )get_match_conditionsr   copyexecuteappend
_log_audit	Exceptionr   errorwarning)r   r,   r!   r"   resultsruleaction_name	cm_plugincontext_with_configr4   execution_resultes               r   r%   &RuleEngine._evaluate_and_execute_rules8   sR    %D88It,,%%dhh|R&@/RR"hhx0 0044[A	q.=.B.B.D+8<28N+H5!*!2!23F!G'+Dz&1&,,(
  '78 T
NU`i
 NN%<[MI^_cdh_i^j#kl9 &<  % q'F{mS]^bcg^h]iiklmkn%oppqs   ?A&D
E!D>>Er/   contextc                     U HA  nSnUR                  5        H  u  pVXR;   a  X%   U:w  a  Sn  OXR;  d  M  Sn  O   U(       d  MA    g   g)u   匹配规则条件TF)items)r   r/   rF   	conditionmatchkeyvalues          r   r6   RuleEngine._match_conditionsa   sY     $IE'oo/
>gle&;!E'!E 0 u $ r   r3   r0   r4   c                    [         R                   " 5       UUU R                  U5      UUS.n [        R                  R	                  U R
                  5      nU(       a  [        R                  " USS9  [        U R
                  SSS9 nUR                  [        R                  " U5      S-   5        SSS5        g! , (       d  f       g= f! [         a"  n	[        R                  S	U	 35         Sn	A	gSn	A	ff = f)
u   记录审计日志)	timestampr3   r"   requestr0   r4   T)exist_okazutf-8)encoding
NzFailed to write audit log: )time_sanitize_contextospathdirnamer   makedirsopenwritejsondumpsr;   r   r<   )
r   r3   r"   r!   r0   r4   	log_entrylog_dirfrD   s
             r   r:   RuleEngine._log_auditu   s     ,--o>
			<ggood&9&9:GGd3d))3AQ

9-45 BAA 	<LL6qc:;;	<s6   AC
 )B90C
 9
CC
 C
 

C6C11C6c                 &    UR                  5       nU$ )u?   对请求上下文进行脱敏处理，避免记录敏感信息)r7   )r   rF   	sanitizeds      r   rV   RuleEngine._sanitize_context   s     LLN	 r   )r   r   r   N)zlogs/countermeasure_audit.log)__name__
__module____qualname____firstlineno____doc__strr   r   r   r   r   r   r   r&   r*   r%   boolr6   r:   rV   __static_attributes__ r   r   r   r      s   -s -
3T#s(^ 4 3
AC A9M A
]DcN ]TW ]\`aefiknfnao\p ]	dDcN 	dgklpqtvyqylzg{ 	d  NQ 	d  VZ  [_  `c  eh  `h  [i  Vj 	d'T$sCx.=Q 'dhilnqiqdr '  EH '  MQ  RV  WZ  \_  W_  R`  Ma 'RDc3h,@ 4PSUXPX> ^b (<# <s <TRUWZRZ^ <eh <rvwz|w  sA <,c3h DcN r   r   )rU   r]   loggingrW   typingr   r   r   r   pluginsr   basicConfigINFO	getLoggerrf   r   r   rn   r   r   <module>ru      sO       	 , , (   ',,/e f			8	$B Br   