[pull] main from GreedyBear-Project:main

.github/workflows/README.md

@@ -215,3 +215,15 @@ TODO
 ## [Reusable release and tag workflow](_release_and_tag.yml)
 
 TODO
+
+## [Build and publish Docker images](docker_publish.yml)
+
+This workflow builds the `greedybear` and `greedybear_nginx` images and publishes them to the **GitHub Container Registry (GHCR)** under `ghcr.io/greedybear-project`, decoupling image hosting from the IntelOwl-owned DockerHub account.
+
+It runs on:
+
+* pushes to **main** — tagged `prod`
+* pushes to **develop** — tagged `stag`
+* pushes of a **`X.Y.Z` git tag** — tagged with that version
+
+Each image is built via a job matrix and pushed by [**docker/build-push-action**](https://github.com/docker/build-push-action), with tags/labels derived by [**docker/metadata-action**](https://github.com/docker/metadata-action) and layer caching backed by the GitHub Actions cache.

.github/workflows/docker_publish.yml

@@ -0,0 +1,76 @@
+name: Build and publish Docker images
+
+# Publishes the greedybear and greedybear_nginx images to the 
+# GitHub Container Registry (GHCR) under ghcr.io/greedybear-project.
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+
+# cancel superseded runs for the same ref
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GHCR_NAMESPACE: ghcr.io/greedybear-project
+
+jobs:
+  build-and-push:
+    name: Build and push ${{ matrix.image }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: greedybear
+            dockerfile: docker/Dockerfile
+          - image: greedybear_nginx
+            dockerfile: docker/Dockerfile_nginx
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.GHCR_NAMESPACE }}/${{ matrix.image }}
+          #   main branch    -> prod
+          #   develop branch -> stag
+          #   X.Y.Z git tag  -> X.Y.Z
+          tags: |
+            type=raw,value=prod,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=stag,enable=${{ github.ref == 'refs/heads/develop' }}
+            type=semver,pattern={{version}}
+          flavor: |
+            latest=false
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.image }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image }}

api/apps.py

@@ -1,6 +1,24 @@
 # This file is a part of GreedyBear https://github.com/honeynet/GreedyBear
 # See the file 'LICENSE' for copying permission.
 from django.apps import AppConfig
+from drf_spectacular.extensions import OpenApiAuthenticationExtension
+
+
+class CookieTokenAuthScheme(OpenApiAuthenticationExtension):
+    """Tell drf-spectacular how to represent certego-saas' CookieTokenAuthentication
+    as an OpenAPI security scheme, so authenticated endpoints document the Token
+    header (and get an "Authorize" entry in Swagger UI)."""
+
+    target_class = "certego_saas.apps.auth.backend.CookieTokenAuthentication"
+    name = "tokenAuth"
+
+    def get_security_definition(self, auto_schema):
+        return {
+            "type": "apiKey",
+            "in": "header",
+            "name": "Authorization",
+            "description": "Durin token auth. Use header `Authorization: Token <key>`.",
+        }
 
 
 class ApiConfig(AppConfig):

api/filters.py

@@ -0,0 +1,74 @@
+from datetime import timedelta
+
+import django_filters
+from django.db.models import Count, QuerySet
+from django.utils import timezone
+
+from greedybear.models import IOC
+
+
+class FeedsFilterSet(django_filters.FilterSet):
+    asn = django_filters.NumberFilter(field_name="autonomous_system__asn")
+    min_score = django_filters.NumberFilter(field_name="recurrence_probability", lookup_expr="gte")
+    min_expected_interactions = django_filters.NumberFilter(field_name="expected_interactions", lookup_expr="gte")
+    start_date = django_filters.DateFilter(field_name="last_seen", lookup_expr="gte")
+    end_date = django_filters.DateFilter(field_name="last_seen", lookup_expr="lte")
+    tag_key = django_filters.CharFilter(field_name="tags__key", lookup_expr="iexact")
+    tag_value = django_filters.CharFilter(field_name="tags__value", lookup_expr="icontains")
+
+    attack_type = django_filters.CharFilter(method="filter_attack_type")
+    ioc_type = django_filters.CharFilter(method="filter_ioc_type")
+    port = django_filters.NumberFilter(method="filter_port")
+    country_code = django_filters.CharFilter(method="filter_country_code")
+    min_days_seen = django_filters.NumberFilter(method="filter_min_days_seen")
+    max_age = django_filters.NumberFilter(method="filter_max_age")
+    include_reputation = django_filters.Filter(method="filter_include_reputation")
+    min_credential_count = django_filters.NumberFilter(method="filter_min_credential_count")
+    max_credential_count = django_filters.NumberFilter(method="filter_max_credential_count")
+
+    class Meta:
+        model = IOC
+        fields = []  # all filters are declared explicitly above
+
+    def filter_attack_type(self, queryset: QuerySet, name: str, value: str) -> QuerySet:
+        if value and value != "all":
+            return queryset.filter(**{value: True})
+        return queryset
+
+    def filter_ioc_type(self, queryset: QuerySet, name: str, value: str) -> QuerySet:
+        if value and value != "all":
+            return queryset.filter(type=value)
+        return queryset
+
+    def filter_port(self, queryset: QuerySet, name: str, value: int) -> QuerySet:
+        return queryset.filter(destination_ports__contains=[int(value)])
+
+    def filter_country_code(self, queryset: QuerySet, name: str, value: str) -> QuerySet:
+        return queryset.filter(attacker_country_code=value.upper())
+
+    def filter_min_days_seen(self, queryset: QuerySet, name: str, value: int) -> QuerySet:
+        if value and value > 1:
+            return queryset.filter(number_of_days_seen__gte=value)
+        return queryset
+
+    def filter_include_reputation(self, queryset: QuerySet, name: str, value: list[str]) -> QuerySet:
+        if value:
+            return queryset.filter(ip_reputation__in=value)
+        return queryset
+
+    def filter_min_credential_count(self, queryset: QuerySet, name: str, value: int) -> QuerySet:
+        return self._filter_by_credential_count(queryset, "gte", value)
+
+    def filter_max_credential_count(self, queryset: QuerySet, name: str, value: int) -> QuerySet:
+        return self._filter_by_credential_count(queryset, "lte", value)
+
+    def _filter_by_credential_count(self, queryset: QuerySet, lookup: str, value: int) -> QuerySet:
+        qualifying = IOC.objects.annotate(cc=Count("credentials", distinct=True)).filter(**{f"cc__{lookup}": value}).values("id")
+        return queryset.filter(id__in=qualifying)
+
+    def filter_max_age(self, queryset: QuerySet, name: str, value: int) -> QuerySet:
+        # drop max_age id an explicit date range replaces is set
+        if self.data.get("start_date") or self.data.get("end_date"):
+            return queryset
+        cutoff = timezone.now() - timedelta(days=int(value))
+        return queryset.filter(last_seen__gte=cutoff)

api/mixins.py

@@ -0,0 +1,89 @@
+import logging
+import urllib.parse
+from functools import cached_property
+
+from django.http import HttpResponse
+from rest_framework.request import Request
+from rest_framework.response import Response
+
+from greedybear.cache import Cache, build_versioned_key
+from greedybear.consts import API_CACHE_ALIAS, API_CACHE_TIMEOUT_SECONDS, IOC_DATA_VERSION_KEY
+
+logger = logging.getLogger(__name__)
+
+
+class CachedResponseMixin:
+    """Adds versioned response caching to an APIView.
+    Subclasses opt in by setting cache_namespace."""
+
+    cache = Cache(API_CACHE_ALIAS)
+    cache_namespace: str | None = None
+    cache_version_key: str = IOC_DATA_VERSION_KEY
+    cache_timeout: int = API_CACHE_TIMEOUT_SECONDS
+
+    @cached_property
+    def cache_key(self) -> str | None:
+        """Versioned cache key for this request, or None when caching is disabled.
+        Computed once on first access (during the read)
+        and memoized on the per-request view instance."""
+        if not self._cache_enabled():
+            return None
+        version = self.cache.get_data_version(self.cache_version_key)
+        sorted_params = sorted(self.request.query_params.lists())
+        params_string = urllib.parse.urlencode(sorted_params, doseq=True)
+        key_material = f"{self.__class__.__name__}|{self.request.path}|{params_string}"
+        return build_versioned_key(self.cache_namespace, version, key_material)
+
+    def get_cached_response(self) -> HttpResponse | None:
+        """Return a hit, or None when caching is disabled or on a miss."""
+        if self.cache_key is None:
+            return None
+        cached = self.cache.get(self.cache_key)
+        if cached is None:
+            return None
+        return HttpResponse(cached["content"], content_type=cached["content_type"], status=cached["status"])
+
+    def finalize_response(self, request, response, *args, **kwargs):
+        """Cache the rendered response under the key captured during the read.
+        Runs after DRF has attached the renderer to the response."""
+        response = super().finalize_response(request, response, *args, **kwargs)
+        self._store_api_response(response)
+        return response
+
+    def _cache_enabled(self) -> bool:
+        """Determines if cache was enabled
+        by checking if cache_namespace is set."""
+        return self.cache_namespace is not None
+
+    def _store_api_response(self, response: Response) -> bool:
+        """Store a successful (200) and rendered DRF Response under cache_key."""
+        if self.cache_key is None:
+            return False
+        if not isinstance(response, Response):
+            return False
+        if response.status_code != 200:
+            return False
+        if not response.is_rendered:
+            response.render()
+        self.cache.set(
+            self.cache_key,
+            {
+                "content": response.rendered_content,
+                "content_type": response["content-type"],
+                "status": response.status_code,
+            },
+            timeout=self.cache_timeout,
+        )
+        return True
+
+
+class RequestLoggingMixin:
+    """Emit a access-log line per request for any APIView/ViewSet it is mixed into."""
+
+    EXCLUDED_LOG_PARAMS = frozenset({"reason"})
+
+    def initial(self, request: Request, *args, **kwargs):
+        route = getattr(getattr(request, "resolver_match", None), "route", None) or request.path.lstrip("/")
+        params = {k: v for k, v in request.query_params.items() if k not in self.EXCLUDED_LOG_PARAMS}
+        logger.info(f"request {request.method} /{route} params: {params}")
+        super().initial(request, *args, **kwargs)

api/permissions.py

@@ -0,0 +1,22 @@
+# This file is a part of GreedyBear https://github.com/honeynet/GreedyBear
+# See the file 'LICENSE' for copying permission.
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+THREAT_RESEARCHER_GROUP = "threat_researcher"
+
+
+class IsThreatResearcherOrAdmin(BasePermission):
+    """Allow access only to staff users or members of the ``threat_researcher`` group."""
+
+    def has_permission(self, request, view):
+        user = request.user
+        return user and user.is_authenticated and (user.is_staff or user.groups.filter(name=THREAT_RESEARCHER_GROUP).exists())
+
+
+class IsSuperuserOrReadOnly(BasePermission):
+    """Allow read access to anyone; restrict write access to superusers only."""
+
+    def has_permission(self, request, view):
+        if request.method in SAFE_METHODS:
+            return True
+        return request.user and request.user.is_authenticated and request.user.is_superuser

api/renderers.py

@@ -0,0 +1,90 @@
+import csv
+import io
+
+from django.conf import settings
+from django.db.models import QuerySet
+from rest_framework.renderers import BaseRenderer, JSONRenderer
+
+from api.views.utils import build_feed_dict, build_stix_bundle
+
+
+class FeedJSONRenderer(JSONRenderer):
+    """JSON feed renderer.
+    When the `build_feed_envelope` context flag is set, it shapes the raw IOC
+    rows into the {"iocs": [...], "license": ...} envelope.
+    Any other payload (ASN list, pagination envelope) is rendered as plain JSON.
+    """
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        context = renderer_context or {}
+        if context.get("build_feed_envelope"):
+            data = build_feed_dict(
+                data,
+                verbose=context.get("verbose", False),
+                include_sensors=context.get("include_sensors", False),
+            )
+        return super().render(data, accepted_media_type, renderer_context)
+
+
+class FeedNDJSONRenderer(BaseRenderer):
+    media_type = "application/x-ndjson"
+    format = "ndjson"
+    charset = "utf-8"
+
+    #  FeedNDJSONRenderer exists only for DRF content negotiation, actual streaming is handled via StreamingHttpResponse in render_response().
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        return b""
+
+
+class FeedRendererMixin(BaseRenderer):
+    """Shared safety net for the non-JSON feed renderers."""
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        if not isinstance(data, QuerySet):
+            return JSONRenderer().render(data, accepted_media_type, renderer_context)
+        return self.render_feed(data, accepted_media_type, renderer_context)
+
+    def render_feed(self, data, accepted_media_type=None, renderer_context=None):
+        raise NotImplementedError
+
+
+class FeedTextRenderer(FeedRendererMixin):
+    """Plain-text feed: one IOC value per line, prefixed by the license comment."""
+
+    media_type = "text/plain"
+    format = "txt"
+    charset = None
+
+    def render_feed(self, data, accepted_media_type=None, renderer_context=None):
+        lines = [f"# {settings.FEEDS_LICENSE}"] if settings.FEEDS_LICENSE else []
+        lines += [row[0] for row in data.values_list("name")]
+        return "\n".join(lines).encode("utf-8")
+
+
+class FeedCSVRenderer(FeedRendererMixin):
+    """CSV feed: one IOC value per row, prefixed by the license comment."""
+
+    media_type = "text/csv"
+    format = "csv"
+    charset = None
+
+    def render_feed(self, data, accepted_media_type=None, renderer_context=None):
+        buffer = io.StringIO()
+        writer = csv.writer(buffer, quoting=csv.QUOTE_MINIMAL)
+        if settings.FEEDS_LICENSE:
+            buffer.write("# ")
+            writer.writerow([settings.FEEDS_LICENSE])
+        writer.writerows([list(row) for row in data.values_list("name")])
+        return buffer.getvalue().encode("utf-8")
+
+
+class Stix21Renderer(FeedRendererMixin):
+    """STIX 2.1 bundle feed (served as application/json)."""
+
+    media_type = "application/json"
+    format = "stix21"
+    charset = None
+
+    def render_feed(self, data, accepted_media_type=None, renderer_context=None):
+        request = (renderer_context or {}).get("request")
+        return build_stix_bundle(data, request=request).encode("utf-8")