416 lines
12 KiB
Ruby
416 lines
12 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
# Rule - WAF rule management with NetworkRange integration
|
|
#
|
|
# Rules define actions to take for matching traffic conditions.
|
|
# Network rules are associated with NetworkRange objects for rich context.
|
|
class Rule < ApplicationRecord
|
|
# Rule types and actions
|
|
RULE_TYPES = %w[network rate_limit path_pattern].freeze
|
|
ACTIONS = %w[allow deny rate_limit redirect log].freeze
|
|
SOURCES = %w[manual auto:scanner_detected auto:rate_limit_exceeded auto:bot_detected imported default manual:surgical_block manual:surgical_exception].freeze
|
|
|
|
# Associations
|
|
belongs_to :user
|
|
belongs_to :network_range, optional: true
|
|
|
|
# Validations
|
|
validates :rule_type, presence: true, inclusion: { in: RULE_TYPES }
|
|
validates :action, presence: true, inclusion: { in: ACTIONS }
|
|
validates :conditions, presence: true, unless: :network_rule?
|
|
validates :enabled, inclusion: { in: [true, false] }
|
|
validates :source, inclusion: { in: SOURCES }
|
|
|
|
# Custom validations
|
|
validate :validate_conditions_by_type
|
|
validate :validate_metadata_by_action
|
|
validate :network_range_required_for_network_rules
|
|
validate :validate_network_consistency, if: :network_rule?
|
|
|
|
# Scopes
|
|
scope :enabled, -> { where(enabled: true) }
|
|
scope :disabled, -> { where(enabled: false) }
|
|
scope :active, -> { enabled.where("expires_at IS NULL OR expires_at > ?", Time.current) }
|
|
scope :expired, -> { where("expires_at IS NOT NULL AND expires_at <= ?", Time.current) }
|
|
scope :by_type, ->(type) { where(rule_type: type) }
|
|
scope :network_rules, -> { where(rule_type: "network") }
|
|
scope :rate_limit_rules, -> { where(rule_type: "rate_limit") }
|
|
scope :path_pattern_rules, -> { where(rule_type: "path_pattern") }
|
|
scope :by_source, ->(source) { where(source: source) }
|
|
scope :surgical_blocks, -> { where(source: "manual:surgical_block") }
|
|
scope :surgical_exceptions, -> { where(source: "manual:surgical_exception") }
|
|
|
|
# Sync queries
|
|
scope :since, ->(timestamp) { where("updated_at >= ?", Time.at(timestamp)).order(:updated_at, :id) }
|
|
scope :sync_order, -> { order(:updated_at, :id) }
|
|
|
|
# Callbacks
|
|
before_validation :set_defaults
|
|
before_validation :parse_json_fields
|
|
before_save :calculate_priority_for_network_rules
|
|
|
|
# Rule type checks
|
|
def network_rule?
|
|
rule_type == "network"
|
|
end
|
|
|
|
def rate_limit_rule?
|
|
rule_type == "rate_limit"
|
|
end
|
|
|
|
def path_pattern_rule?
|
|
rule_type == "path_pattern"
|
|
end
|
|
|
|
# Network-specific methods
|
|
def cidr
|
|
network_rule? ? network_range&.cidr : conditions&.dig("cidr")
|
|
end
|
|
|
|
def prefix_length
|
|
network_rule? ? network_range&.prefix_length : cidr&.split("/")&.last&.to_i
|
|
end
|
|
|
|
def network_intelligence
|
|
return {} unless network_rule? && network_range
|
|
|
|
network_range.inherited_intelligence
|
|
end
|
|
|
|
def network_address
|
|
network_rule? ? network_range&.network_address : nil
|
|
end
|
|
|
|
# Surgical block methods
|
|
def surgical_block?
|
|
source == "manual:surgical_block"
|
|
end
|
|
|
|
def surgical_exception?
|
|
source == "manual:surgical_exception"
|
|
end
|
|
|
|
def related_surgical_rules
|
|
if surgical_block?
|
|
# Find the corresponding exception rule
|
|
surgical_exceptions.where(
|
|
conditions: { cidr: network_address ? "#{network_address}/32" : nil }
|
|
)
|
|
elsif surgical_exception?
|
|
# Find the parent block rule
|
|
surgical_blocks.joins(:network_range).where(
|
|
network_ranges: { network: parent_cidr }
|
|
)
|
|
else
|
|
Rule.none
|
|
end
|
|
end
|
|
|
|
# Rule lifecycle
|
|
def active?
|
|
enabled? && !expired?
|
|
end
|
|
|
|
def expired?
|
|
expires_at.present? && expires_at <= Time.current
|
|
end
|
|
|
|
def activate!
|
|
update!(enabled: true)
|
|
end
|
|
|
|
def deactivate!
|
|
update!(enabled: false)
|
|
end
|
|
|
|
def disable!(reason: nil)
|
|
update!(
|
|
enabled: false,
|
|
metadata: metadata.merge(
|
|
disabled_at: Time.current.iso8601,
|
|
disabled_reason: reason
|
|
)
|
|
)
|
|
end
|
|
|
|
def extend_expiry!(duration)
|
|
new_expiry = Time.current + duration
|
|
update!(expires_at: new_expiry)
|
|
end
|
|
|
|
# Agent serialization
|
|
def to_agent_format
|
|
format = {
|
|
id: id,
|
|
rule_type: rule_type,
|
|
waf_action: action, # Agents expect 'waf_action' field
|
|
conditions: agent_conditions,
|
|
priority: agent_priority,
|
|
expires_at: expires_at&.to_i, # Agents expect Unix timestamps
|
|
enabled: enabled,
|
|
source: source,
|
|
metadata: metadata || {},
|
|
created_at: created_at.to_i, # Agents expect Unix timestamps
|
|
updated_at: updated_at.to_i # Agents expect Unix timestamps
|
|
}
|
|
|
|
# For network rules, resolve the network range to actual IP data
|
|
if network_rule? && network_range
|
|
begin
|
|
ip_range = IPAddr.new(network_range.cidr)
|
|
range = ip_range.to_range
|
|
|
|
if ip_range.ipv4?
|
|
format[:network_start] = range.first.to_i
|
|
format[:network_end] = range.last.to_i
|
|
else
|
|
# IPv6 - use binary representation
|
|
format[:network_start] = range.first.hton
|
|
format[:network_end] = range.last.hton
|
|
end
|
|
|
|
format[:network_prefix] = network_range.prefix_length
|
|
format[:network_intelligence] = network_intelligence
|
|
rescue => e
|
|
Rails.logger.error "Failed to resolve network range #{network_range.cidr}: #{e.message}"
|
|
# Fallback to CIDR format
|
|
format[:conditions] = { cidr: network_range.cidr }
|
|
end
|
|
end
|
|
|
|
format
|
|
end
|
|
|
|
# Class methods for rule creation
|
|
def self.create_network_rule(cidr, action: 'deny', user: nil, **options)
|
|
network_range = NetworkRange.find_or_create_by_cidr(cidr, user: user, source: 'user_created')
|
|
|
|
create!(
|
|
rule_type: 'network',
|
|
action: action,
|
|
network_range: network_range,
|
|
user: user,
|
|
**options
|
|
)
|
|
end
|
|
|
|
def self.create_surgical_block(ip_address, parent_cidr, user: nil, reason: nil, **options)
|
|
# Create block rule for parent range
|
|
network_range = NetworkRange.find_or_create_by_cidr(parent_cidr, user: user, source: 'user_created')
|
|
|
|
block_rule = create!(
|
|
rule_type: 'network',
|
|
action: 'deny',
|
|
network_range: network_range,
|
|
source: 'manual:surgical_block',
|
|
user: user,
|
|
metadata: {
|
|
reason: reason,
|
|
surgical_block: true,
|
|
original_ip: ip_address,
|
|
**options[:metadata]
|
|
},
|
|
**options.except(:metadata)
|
|
)
|
|
|
|
# Create exception rule for specific IP
|
|
ip_network_range = NetworkRange.find_or_create_by_cidr("#{ip_address}/#{ip_address.include?(':') ? '128' : '32'}", user: user, source: 'user_created')
|
|
|
|
exception_rule = create!(
|
|
rule_type: 'network',
|
|
action: 'allow',
|
|
network_range: ip_network_range,
|
|
source: 'manual:surgical_exception',
|
|
user: user,
|
|
priority: ip_network_range.prefix_length, # Higher priority = more specific
|
|
metadata: {
|
|
reason: "Exception for #{ip_address} in surgical block of #{parent_cidr}",
|
|
surgical_exception: true,
|
|
parent_rule_id: block_rule.id,
|
|
**options[:metadata]
|
|
},
|
|
**options.except(:metadata)
|
|
)
|
|
|
|
[block_rule, exception_rule]
|
|
end
|
|
|
|
def self.create_rate_limit_rule(cidr, limit:, window:, user: nil, **options)
|
|
network_range = NetworkRange.find_or_create_by_cidr(cidr, user: user, source: 'user_created')
|
|
|
|
create!(
|
|
rule_type: 'rate_limit',
|
|
action: 'rate_limit',
|
|
network_range: network_range,
|
|
conditions: { cidr: cidr, scope: 'ip' },
|
|
metadata: {
|
|
limit: limit,
|
|
window: window,
|
|
**options[:metadata]
|
|
},
|
|
user: user,
|
|
**options.except(:metadata)
|
|
)
|
|
end
|
|
|
|
# Sync and versioning
|
|
def self.latest_version
|
|
max_time = maximum(:updated_at)
|
|
max_time ? max_time.to_i : Time.current.to_i
|
|
end
|
|
|
|
def self.active_for_agent
|
|
active.sync_order.map(&:to_agent_format)
|
|
end
|
|
|
|
# Analytics methods
|
|
def matching_events(limit: 100)
|
|
return Event.none unless network_rule? && network_range
|
|
|
|
# This would need efficient IP range queries
|
|
# For now, simple IP match
|
|
Event.where(ip_address: network_range.network_address)
|
|
.recent
|
|
.limit(limit)
|
|
end
|
|
|
|
def effectiveness_stats
|
|
return {} unless network_rule?
|
|
|
|
events = matching_events
|
|
{
|
|
total_events: events.count,
|
|
blocked_events: events.blocked.count,
|
|
allowed_events: events.allowed.count,
|
|
block_rate: events.count > 0 ? (events.blocked.count.to_f / events.count * 100).round(2) : 0
|
|
}
|
|
end
|
|
|
|
private
|
|
|
|
def set_defaults
|
|
self.enabled = true if enabled.nil?
|
|
self.conditions ||= {}
|
|
self.metadata ||= {}
|
|
self.source ||= "manual"
|
|
|
|
# Set system user for auto-generated rules if no user is set
|
|
if source&.start_with?('auto:') || source == 'default'
|
|
self.user ||= User.find_by(role: 1) # admin role
|
|
end
|
|
end
|
|
|
|
def calculate_priority_for_network_rules
|
|
if network_rule? && network_range
|
|
self.priority = network_range.prefix_length
|
|
end
|
|
end
|
|
|
|
def agent_conditions
|
|
if network_rule?
|
|
{ cidr: cidr }
|
|
else
|
|
conditions || {}
|
|
end
|
|
end
|
|
|
|
def agent_priority
|
|
if network_rule?
|
|
prefix_length || 0
|
|
else
|
|
priority || 0
|
|
end
|
|
end
|
|
|
|
def validate_conditions_by_type
|
|
case rule_type
|
|
when "network"
|
|
# Network rules don't need conditions in DB - stored in network_range
|
|
true
|
|
when "rate_limit"
|
|
validate_rate_limit_conditions
|
|
when "path_pattern"
|
|
validate_path_pattern_conditions
|
|
end
|
|
end
|
|
|
|
def validate_rate_limit_conditions
|
|
scope = conditions&.dig("scope")
|
|
cidr_value = conditions&.dig("cidr")
|
|
|
|
if scope.blank?
|
|
errors.add(:conditions, "must include 'scope' for rate_limit rules")
|
|
end
|
|
|
|
unless metadata&.dig("limit").present? && metadata&.dig("window").present?
|
|
errors.add(:metadata, "must include 'limit' and 'window' for rate_limit rules")
|
|
end
|
|
end
|
|
|
|
def validate_path_pattern_conditions
|
|
patterns = conditions&.dig("patterns")
|
|
|
|
if patterns.blank? || !patterns.is_a?(Array)
|
|
errors.add(:conditions, "must include 'patterns' array for path_pattern rules")
|
|
end
|
|
end
|
|
|
|
def validate_metadata_by_action
|
|
case action
|
|
when "redirect"
|
|
unless metadata&.dig("redirect_url").present?
|
|
errors.add(:metadata, "must include 'redirect_url' for redirect action")
|
|
end
|
|
when "rate_limit"
|
|
unless metadata&.dig("limit").present? && metadata&.dig("window").present?
|
|
errors.add(:metadata, "must include 'limit' and 'window' for rate_limit action")
|
|
end
|
|
end
|
|
end
|
|
|
|
def network_range_required_for_network_rules
|
|
if network_rule? && network_range.nil?
|
|
errors.add(:network_range, "is required for network rules")
|
|
end
|
|
end
|
|
|
|
def validate_network_consistency
|
|
return unless network_rule? && network_range
|
|
|
|
# For network rules, we don't use conditions - the network_range handles everything
|
|
# So we can skip this validation for now
|
|
true
|
|
end
|
|
|
|
def parent_cidr
|
|
return nil unless network_range
|
|
|
|
# Find a broader network range that contains this one
|
|
network_range.parent_ranges.first&.cidr
|
|
end
|
|
|
|
def parse_json_fields
|
|
# Parse conditions if it's a string
|
|
if conditions.is_a?(String) && conditions.present?
|
|
begin
|
|
self.conditions = JSON.parse(conditions) if conditions != "{}"
|
|
rescue JSON::ParserError
|
|
self.conditions = {}
|
|
end
|
|
end
|
|
|
|
# Parse metadata if it's a string
|
|
if metadata.is_a?(String) && metadata.present?
|
|
begin
|
|
self.metadata = JSON.parse(metadata) if metadata != "{}"
|
|
rescue JSON::ParserError
|
|
self.metadata = {}
|
|
end
|
|
end
|
|
|
|
# Ensure they are hashes
|
|
self.conditions ||= {}
|
|
self.metadata ||= {}
|
|
end
|
|
|
|
end |