| """Position awareness: what this instance can see decides what it is. |
| |
| roles = detect(inputs) # inputs: what the operator wired up (flows? http? host listeners? chain rpc?) |
| |
| Roles (several at once are normal): |
| edge-waf HTTP requests arrive (reverse proxy / log tail / inline) -> HTTP tiers, challenge, rate limit |
| host-firewall runs on the host that is protected (can list listeners, can call the firewall) -> posture + block |
| net-sensor sees NetFlow / IPFIX / sFlow or VPC flow logs of a network -> entity stream for every source |
| chain-node sees JSON-RPC and P2P of a blockchain node -> RPC method abuse, peer floods, mempool spam |
| lb-embedded runs inside a Go load balancer (the Go runtime) -> fast path only, decisions from the sidecar |
| The result also says what the layer can *do* here (actions available) so the policy is interpreted correctly. |
| """ |
| from __future__ import annotations |
|
|
| import os |
| import shutil |
| import socket |
|
|
| from dibaguard.shield.policy import KNOWN_SERVICES |
|
|
| CAPABILITIES = { |
| "edge-waf": ["score_http", "challenge", "rate_limit", "block_at_proxy"], |
| "host-firewall": ["posture_audit", "block_at_host", "close_port"], |
| "net-sensor": ["score_flows", "entity_risk", "site_pressure", "report_upstream"], |
| "chain-node": ["score_rpc", "peer_flood", "mempool_spam", "rate_limit_rpc"], |
| "lb-embedded": ["score_http_fast", "block_at_proxy", "rate_limit"], |
| } |
|
|
|
|
| def _listening_ports() -> list[dict]: |
| """TCP/UDP listeners on this host without psutil: /proc/net on Linux, `netstat -ano` on Windows, `ss` if present.""" |
| out = [] |
| if os.path.exists("/proc/net/tcp"): |
| for proto, path in (("tcp", "/proc/net/tcp"), ("tcp6", "/proc/net/tcp6"), ("udp", "/proc/net/udp")): |
| try: |
| with open(path) as f: |
| next(f) |
| for line in f: |
| parts = line.split() |
| local, state = parts[1], parts[3] |
| if proto.startswith("tcp") and state != "0A": |
| continue |
| addr, port = local.rsplit(":", 1) |
| out.append({"proto": proto[:3], "port": int(port, 16), "addr": addr, "public": addr not in ("0100007F", "00000000000000000000000001000000")}) |
| except OSError: |
| continue |
| elif os.name == "nt" and shutil.which("netstat"): |
| import subprocess |
|
|
| try: |
| txt = subprocess.run(["netstat", "-ano"], capture_output=True, text=True, timeout=15).stdout |
| except Exception: |
| txt = "" |
| for line in txt.splitlines(): |
| p = line.split() |
| if len(p) >= 4 and p[0] in ("TCP", "UDP") and (p[0] == "UDP" or p[3] == "LISTENING"): |
| addr, _, port = p[1].rpartition(":") |
| if port.isdigit(): |
| out.append({"proto": p[0].lower(), "port": int(port), "addr": addr, "public": addr not in ("127.0.0.1", "[::1]")}) |
| seen, uniq = set(), [] |
| for l in out: |
| k = (l["proto"], l["port"], l["public"]) |
| if k not in seen: |
| seen.add(k) |
| uniq.append(dict(l, service=KNOWN_SERVICES.get(l["port"], ""))) |
| return uniq |
|
|
|
|
| def detect(inputs: dict | None = None) -> dict: |
| """inputs: {"flows": bool, "http": bool, "host": bool, "rpc": bool, "lb": bool} (None = probe what is possible here)""" |
| inputs = dict(inputs or {}) |
| host_ok = inputs.get("host") |
| if host_ok is None: |
| host_ok = os.path.exists("/proc/net/tcp") or (os.name == "nt") |
| roles = [] |
| if inputs.get("http"): |
| roles.append("edge-waf") |
| if host_ok: |
| roles.append("host-firewall") |
| if inputs.get("flows"): |
| roles.append("net-sensor") |
| if inputs.get("rpc"): |
| roles.append("chain-node") |
| if inputs.get("lb"): |
| roles.append("lb-embedded") |
| listeners = _listening_ports() if host_ok else [] |
| if not inputs.get("rpc") and any(l["service"] in ("eth-rpc", "eth-ws", "cosmos-rpc", "bitcoin-rpc") for l in listeners): |
| roles.append("chain-node") |
| fw = "nftables" if shutil.which("nft") else "iptables" if shutil.which("iptables") else "windows" if os.name == "nt" else "none" |
| caps = sorted({c for r in roles for c in CAPABILITIES[r]}) |
| if fw == "none": |
| caps = [c for c in caps if c not in ("block_at_host", "close_port")] |
| return {"hostname": socket.gethostname(), "roles": roles, "capabilities": caps, "firewall": fw, |
| "listeners": listeners, "inputs": inputs} |
|
|
