# Cloudflare API를 사용한 DDoS 방어 자동화 - Python
import requests
import json
from datetime import datetime, timedelta

class CloudflareDDoSDefense:
    """Cloudflare API를 통한 DDoS 방어 자동화"""

    def __init__(self, api_token: str, zone_id: str):
        self.api_token = api_token
        self.zone_id = zone_id
        self.base_url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}"
        self.headers = {
            "Authorization": f"Bearer {api_token}",
            "Content-Type": "application/json"
        }

    def get_analytics(self, minutes: int = 60):
        """트래픽 분석 데이터 조회"""
        since = (datetime.utcnow() - timedelta(minutes=minutes)).isoformat() + "Z"

        response = requests.get(
            f"{self.base_url}/analytics/dashboard",
            headers=self.headers,
            params={"since": since, "continuous": "true"}
        )

        return response.json()

    def get_ddos_events(self):
        """DDoS 공격 이벤트 조회"""
        response = requests.get(
            f"{self.base_url}/security/events",
            headers=self.headers,
            params={
                "action": "challenge,block,managed_challenge",
                "source": "l7ddos",
                "limit": 100
            }
        )

        return response.json()

    def create_rate_limit_rule(self, path: str, threshold: int, period: int):
        """Rate Limit 규칙 생성"""
        rule = {
            "description": f"Rate limit for {path}",
            "match": {
                "request": {
                    "url": f"*{path}*",
                    "schemes": ["HTTP", "HTTPS"],
                    "methods": ["GET", "POST"]
                }
            },
            "threshold": threshold,
            "period": period,
            "action": {
                "mode": "challenge",
                "timeout": 3600
            }
        }

        response = requests.post(
            f"{self.base_url}/rate_limits",
            headers=self.headers,
            json=rule
        )

        return response.json()

    def create_firewall_rule(self, expression: str, action: str = "block"):
        """방화벽 규칙 생성"""
        # 먼저 필터 생성
        filter_response = requests.post(
            f"{self.base_url}/filters",
            headers=self.headers,
            json=[{"expression": expression}]
        )

        if not filter_response.json()["success"]:
            return filter_response.json()

        filter_id = filter_response.json()["result"][0]["id"]

        # 방화벽 규칙 생성
        rule_response = requests.post(
            f"{self.base_url}/firewall/rules",
            headers=self.headers,
            json=[{
                "filter": {"id": filter_id},
                "action": action,
                "description": f"Auto-created rule: {expression[:50]}"
            }]
        )

        return rule_response.json()

    def enable_under_attack_mode(self):
        """Under Attack Mode 활성화 (긴급 상황)"""
        response = requests.patch(
            f"{self.base_url}/settings/security_level",
            headers=self.headers,
            json={"value": "under_attack"}
        )

        return response.json()

    def disable_under_attack_mode(self):
        """Under Attack Mode 비활성화"""
        response = requests.patch(
            f"{self.base_url}/settings/security_level",
            headers=self.headers,
            json={"value": "high"}  # 또는 medium, low
        )

        return response.json()

    def block_ip(self, ip: str, note: str = ""):
        """특정 IP 차단"""
        response = requests.post(
            f"{self.base_url}/firewall/access_rules/rules",
            headers=self.headers,
            json={
                "mode": "block",
                "configuration": {
                    "target": "ip",
                    "value": ip
                },
                "notes": note or f"Blocked by automation at {datetime.utcnow()}"
            }
        )

        return response.json()

    def block_country(self, country_code: str):
        """특정 국가 차단"""
        response = requests.post(
            f"{self.base_url}/firewall/access_rules/rules",
            headers=self.headers,
            json={
                "mode": "block",
                "configuration": {
                    "target": "country",
                    "value": country_code
                },
                "notes": f"Country block: {country_code}"
            }
        )

        return response.json()

    def get_bot_management_analytics(self):
        """Bot Management 분석"""
        response = requests.get(
            f"{self.base_url}/bot_management/summary",
            headers=self.headers
        )

        return response.json()


# 자동 방어 스크립트 예시
def auto_defend(cf: CloudflareDDoSDefense):
    """트래픽 분석 및 자동 방어"""

    # 최근 5분 분석
    analytics = cf.get_analytics(minutes=5)

    # 요청 수 급증 감지
    total_requests = analytics["result"]["totals"]["requests"]["all"]
    avg_requests = analytics["result"]["totals"]["requests"]["cached"] + \
                   analytics["result"]["totals"]["requests"]["uncached"]

    # 임계값 초과 시 Under Attack Mode
    THRESHOLD = 100000  # 5분 내 10만 요청

    if total_requests > THRESHOLD:
        print(f"[ALERT] High traffic detected: {total_requests} requests")
        cf.enable_under_attack_mode()

        # Slack/PagerDuty 알림 (실제 구현 필요)
        # notify_team(f"DDoS Alert: {total_requests} requests in 5 min")

    # DDoS 이벤트 확인
    events = cf.get_ddos_events()
    if events.get("result"):
        for event in events["result"][:10]:
            print(f"DDoS Event: {event['action']} from {event.get('clientIP', 'unknown')}")


if __name__ == "__main__":
    cf = CloudflareDDoSDefense(
        api_token="your-api-token",
        zone_id="your-zone-id"
    )

    # Under Attack Mode 긴급 활성화
    # cf.enable_under_attack_mode()

    # 특정 패턴 차단
    cf.create_firewall_rule(
        expression='(http.request.uri.path contains "/wp-login.php") and (cf.threat_score gt 10)',
        action="block"
    )

    # API Rate Limiting
    cf.create_rate_limit_rule(
        path="/api/",
        threshold=100,  # 100 요청
        period=60       # 60초당
    )

# AWS Shield Advanced + WAF 설정 - CloudFormation

AWSTemplateFormatVersion: '2010-09-09'
Description: 'DDoS Protection with AWS Shield Advanced and WAF'

Parameters:
  Environment:
    Type: String
    Default: production
  ApplicationName:
    Type: String
    Default: my-app

Resources:
  # WAF WebACL
  WebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub '${ApplicationName}-webacl'
      Description: DDoS and Bot Protection
      Scope: REGIONAL  # CLOUDFRONT for CloudFront
      DefaultAction:
        Allow: {}
      VisibilityConfig:
        CloudWatchMetricsEnabled: true
        MetricName: !Sub '${ApplicationName}-webacl'
        SampledRequestsEnabled: true

      Rules:
        # 1. AWS Managed Rules - Common Rule Set
        - Name: AWSManagedRulesCommonRuleSet
          Priority: 1
          OverrideAction:
            None: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesCommon
            SampledRequestsEnabled: true
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet

        # 2. AWS Managed Rules - Known Bad Inputs
        - Name: AWSManagedRulesKnownBadInputsRuleSet
          Priority: 2
          OverrideAction:
            None: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesKnownBadInputs
            SampledRequestsEnabled: true
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesKnownBadInputsRuleSet

        # 3. Rate Limiting Rule
        - Name: RateLimitRule
          Priority: 3
          Action:
            Block: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitRule
            SampledRequestsEnabled: true
          Statement:
            RateBasedStatement:
              Limit: 2000  # 5분간 2000 요청
              AggregateKeyType: IP

        # 4. API 엔드포인트 강화된 Rate Limit
        - Name: APIRateLimitRule
          Priority: 4
          Action:
            Block: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: APIRateLimitRule
            SampledRequestsEnabled: true
          Statement:
            RateBasedStatement:
              Limit: 500  # 5분간 500 요청
              AggregateKeyType: IP
              ScopeDownStatement:
                ByteMatchStatement:
                  FieldToMatch:
                    UriPath: {}
                  PositionalConstraint: STARTS_WITH
                  SearchString: '/api/'
                  TextTransformations:
                    - Priority: 0
                      Type: LOWERCASE

        # 5. Geo Blocking (특정 국가 차단)
        - Name: GeoBlockRule
          Priority: 5
          Action:
            Block: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: GeoBlockRule
            SampledRequestsEnabled: true
          Statement:
            GeoMatchStatement:
              CountryCodes:
                - XX  # 차단할 국가 코드

        # 6. Bot Control (추가 비용)
        - Name: AWSManagedRulesBotControlRuleSet
          Priority: 6
          OverrideAction:
            None: {}
          VisibilityConfig:
            CloudWatchMetricsEnabled: true
            MetricName: BotControl
            SampledRequestsEnabled: true
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesBotControlRuleSet

  # ALB에 WebACL 연결
  WebACLAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: !Ref ApplicationLoadBalancer
      WebACLArn: !GetAtt WebACL.Arn

  # Shield Advanced Protection (구독 필요: $3000/월)
  # ShieldProtection:
  #   Type: AWS::Shield::Protection
  #   Properties:
  #     Name: !Sub '${ApplicationName}-shield'
  #     ResourceArn: !Ref ApplicationLoadBalancer

  # CloudWatch 알람 - DDoS 탐지
  DDoSAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub '${ApplicationName}-ddos-detected'
      AlarmDescription: 'Potential DDoS attack detected'
      MetricName: BlockedRequests
      Namespace: AWS/WAFV2
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1000
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: WebACL
          Value: !Sub '${ApplicationName}-webacl'
        - Name: Region
          Value: !Ref AWS::Region
        - Name: Rule
          Value: RateLimitRule
      AlarmActions:
        - !Ref AlertSNSTopic

  # SNS Topic for Alerts
  AlertSNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub '${ApplicationName}-ddos-alerts'

Outputs:
  WebACLArn:
    Description: WebACL ARN
    Value: !GetAtt WebACL.Arn
  WebACLId:
    Description: WebACL ID
    Value: !Ref WebACL