<s> """<STR_LIT>""" <EOL> from security_monkey . watchers . elb import ELB <EOL> from security_monkey . auditor import Auditor <EOL> from security_monkey . auditors . security_group import _check_rfc_1918 <EOL> from security_monkey . datastore import NetworkWhitelistEntry <EOL> from security_monkey . datastore import Item <EOL> import ipaddr <EOL> DEPRECATED_CIPHERS = [ <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' <EOL> ] <EOL> EXPORT_CIPHERS = [ <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' <EOL> ] <EOL> NOTRECOMMENDED_CIPHERS = [ <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' <EOL> ] <EOL> class ELBAuditor ( Auditor ) : <EOL> index = ELB . index <EOL> i_am_singular = ELB . i_am_singular <EOL> i_am_plural = ELB . i_am_plural <EOL> network_whitelist = [ ] <EOL> def __init__ ( self , accounts = None , debug = False ) : <EOL> super ( ELBAuditor , self ) . __init__ ( accounts = accounts , debug = debug ) <EOL> def prep_for_audit ( self ) : <EOL> self . network_whitelist = NetworkWhitelistEntry . query . all ( ) <EOL> def _check_inclusion_in_network_whitelist ( self , cidr ) : <EOL> for entry in self . network_whitelist : <EOL> if ipaddr . IPNetwork ( cidr ) in ipaddr . IPNetwork ( str ( entry . cidr ) ) : <EOL> return True <EOL> return False <EOL> def check_internet_scheme ( self , elb_item ) : <EOL> """<STR_LIT>""" <EOL> scheme = elb_item . config . get ( '<STR_LIT>' , None ) <EOL> vpc = elb_item . config . get ( '<STR_LIT>' , None ) <EOL> if scheme and scheme == u"<STR_LIT>" and not vpc : <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , elb_item ) <EOL> elif scheme and scheme == u"<STR_LIT>" and vpc : <EOL> security_groups = elb_item . config . get ( '<STR_LIT>' , [ ] ) <EOL> for sgid in security_groups : <EOL> sg = Item . query . filter ( Item . name . ilike ( '<STR_LIT:%>' + sgid + '<STR_LIT:%>' ) ) . first ( ) <EOL> if not sg : <EOL> continue <EOL> sg_cidrs = [ ] <EOL> config = sg . revisions [ <NUM_LIT:0> ] . config <EOL> for rule in config . get ( '<STR_LIT>' , [ ] ) : <EOL> cidr = rule . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> if rule . get ( '<STR_LIT>' , None ) == '<STR_LIT>' and cidr : <EOL> if not _check_rfc_1918 ( cidr ) and not self . _check_inclusion_in_network_whitelist ( cidr ) : <EOL> sg_cidrs . append ( cidr ) <EOL> if sg_cidrs : <EOL> notes = '<STR_LIT>' . format ( <EOL> sgname = sg . name , <EOL> cidr = '<STR_LIT:U+002CU+0020>' . join ( sg_cidrs ) <EOL> ) <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , elb_item , notes = notes ) <EOL> def check_listener_reference_policy ( self , elb_item ) : <EOL> """<STR_LIT>""" <EOL> listeners = elb_item . config . get ( '<STR_LIT>' ) <EOL> for listener in listeners : <EOL> for policy in listener [ '<STR_LIT>' ] : <EOL> policy_type = policy . get ( "<STR_LIT:type>" , None ) <EOL> if policy_type and policy_type == "<STR_LIT>" : <EOL> reference_policy = policy . get ( '<STR_LIT>' , None ) <EOL> self . _process_reference_policy ( reference_policy , policy [ '<STR_LIT:name>' ] , listener [ '<STR_LIT>' ] , elb_item ) <EOL> if not reference_policy : <EOL> self . _process_custom_listener_policy ( policy , listener [ '<STR_LIT>' ] , elb_item ) <EOL> def check_logging ( self , elb_item ) : <EOL> """<STR_LIT>""" <EOL> logging = elb_item . config . get ( '<STR_LIT>' ) <EOL> if not logging : <EOL> self . add_issue ( <NUM_LIT:1> , '<STR_LIT>' , elb_item ) <EOL> def _process_reference_policy ( self , reference_policy , policy_name , port , elb_item ) : <EOL> notes = "<STR_LIT>" . format ( policy_name , port ) <EOL> if reference_policy is None : <EOL> self . add_issue ( <NUM_LIT:8> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> return <EOL> if reference_policy == '<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> return <EOL> if reference_policy == '<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> return <EOL> if reference_policy == '<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> return <EOL> if reference_policy == '<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:0> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> return <EOL> if reference_policy == '<STR_LIT>' : <EOL> self . add_issue ( <NUM_LIT:0> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> return <EOL> if reference_policy == '<STR_LIT>' : <EOL> return <EOL> notes = reference_policy <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> def _process_custom_listener_policy ( self , policy , port , elb_item ) : <EOL> """<STR_LIT>""" <EOL> notes = "<STR_LIT>" . format ( policy [ '<STR_LIT:name>' ] , port ) <EOL> if policy . get ( '<STR_LIT>' , None ) : <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> if policy . get ( '<STR_LIT>' , None ) : <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> server_defined_cipher_order = policy . get ( '<STR_LIT>' , None ) <EOL> if server_defined_cipher_order is False : <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = notes ) <EOL> for cipher in policy [ '<STR_LIT>' ] : <EOL> if cipher in EXPORT_CIPHERS : <EOL> c_notes = "<STR_LIT>" . format ( notes , cipher ) <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = c_notes ) <EOL> if cipher in DEPRECATED_CIPHERS : <EOL> c_notes = "<STR_LIT>" . format ( notes , cipher ) <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = c_notes ) <EOL> if cipher in NOTRECOMMENDED_CIPHERS : <EOL> c_notes = "<STR_LIT>" . format ( notes , cipher ) <EOL> self . add_issue ( <NUM_LIT:10> , "<STR_LIT>" , elb_item , notes = c_notes ) </s>
