fj * d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
m Z m Z m
Z
d dlmZ d dlmZmZ d dlmZ ddlmZmZ dd lmZmZ dd
l m Z dd l m Z ej d Z!d
Z"de
de#fdZ$de#de
fdZ%de#de#fdZ&ddde#fdZ'ddde e
e
e
f fdZ(d'de)de*fdZ+de e, fdZ-ddde#fd Z.de,dd fd Z/de e* fd Z0d(d Z1d!e
de
fd"Z2d!e
de
fd#Z3d!e
de
fd$Z4d!e
de
fd%Z5d!e
de
fd&Z6dS )) Nwraps)CallableOptionalTupleAny)get_main_username_by_uid)is_cl_solo_editionis_cl_shared_pro_edition)gettext )user_tasks_countfpm_reload_timeout) XRayErrorXRayMissingDomain)FPMReloadController)NginxUserCacheuser_plugin_utilsz>I_inputreturnc t j | }t j t
t
| |z S )z;
Pack input for sending with length-prefix framing
)jsondumpsencodestructpack_formatlen)r datas V/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/user_plugin_utils.py pack_requestr! $ s< :f $ $ & &D ;wD * *T 11 byte_commandc | }t d| t j | S )z!
Unpack incoming command
zCommand requested => %s)decodeloggerinfor loads)r# _commands r unpack_requestr* , s: ""$$H
KK)8444 :h r" msgc t dt | t j t
t | | z S )z-
Prefix message with a 4-byte length
z Packing message of %i length)r& debugr r r r r+ s r
pack_responser/ 5 s< LL/S::: ;wC ) )C //r" sock_objectz
socket objectc d}d}t }| d }|s| | S t j t | d }||k rt d|z t
| |k r>| | }|st d ||z
}t
| |k >|S )z9
Read length-prefixed amount of data from socket
i i r z$Response message too large: %d bytesz.Connection closed before full message received)bytesrecvr unpackr ConnectionErrorr )r0 chunk
max_msglenr+
raw_msglenmsglenparts r unpack_responser< = s
E!J
''C !!!$$J ' &&&
]7J
/
/
2F
2V ;= = = c((V
&& B!@B B
B t c((V
Jr" c d}| t j t j t j | }t j || \ }}} t j | j t j | j }}t d||||| n-# t $ r t d||| Y nw xY w|||fS )z6
Retrieve credentials from SO_PEERCRED option
3iz%Connected by proc %i of %i:%i (%s:%s)z Connected by proc %i of %i:%i)
getsockoptsocket
SOL_SOCKET SO_PEERCREDr calcsizer5 pwdgetpwuidpw_namegrpgetgrgidgr_namer& r' KeyError)r0 r creds_pid_uid_gidusergroups r
extract_credsrQ W s G " "6#4#)#5#)?7#;#;
=
=E }We44D$!l4((0#,t2D2D2Le
;$% ! ! ! ! 3 dD t s 2B, ,'CCrM c 8 | t j } | dk S )z9
Check for execution as root | command from root
Nr )osgeteuid)rM s r check_for_rootrU l s |z|| 19r" c t j d } | :t t | }t d| | |S dS )zK
Retrieve the value of XRAYEXEC_UID env and resolve it to username
XRAYEXEC_UIDNz/Got XRAYEXEC_UID: %s (%s), working in USER_MODE)rS getenvr intr& r' )proxyuid
_proxyusers r get_xray_exec_userr\ u sX y ((H-c(mm<<
E j * * * r" c | d} | d }|st d n||z
}8|S )z*
Read all data from socket object
r" Ti z All data read, connection ended)r4 r& r- )r0 r r7 s r sock_receiver^ sT D && LL: ; ; ;
Kr" zjson strc 2 t j d| id S )zF
Construct an appropriate formatted response in case of error
resultF) ensure_ascii)r r r. s r error_responserb s :xoE : : ::r" c N t } | t | j S dS )z3
Check nginx cache status for current user
N)r\ r
is_enabled) proxyusers r nginx_user_cacherf s. #$$I i((33 r" c t t s)t t t d dS )zL
Check if utility is executed as root and throw error in case if no
z,Only root is allowed to execute this utilityN)rU
SystemExitrb _ r" r root_execution_only_checkrk sH O 1 KLL M MO O OO Or" funcc < t fd }|S )zq
Decorator aimed to verify domain owner in X-Ray Manager user mode
Applies to get_domain_info method
c x t }| | i |S | i |}nC# t $ r6}t t d d|j z }d|_ |dd}~ww xY w|j |k rHt d|| t t d t | z |S )
Wraps func
Nz%s cannot be foundzDomain Tz %s does not belong to user %s)
r\ r r ri domain_name_internal_missing_domainrO r& warningstr)argskwargsre r' eerrrl s r wrapperz'user_mode_verification..wrapper s
'(( 4((( ( 4(((DD " &''*CAM*C*CC C ,0C (4 + , 9 ! ! NN:D) L L L A 2 3 3c$ii ?@@ @ s $
A$1A A$r )rl rx s ` r user_mode_verificationry s6 4[[$ $ $ $ [$L Nr" c F d t fd }|S )z
Decorator aimed to check if user is not hitting limit of running tasks,
set in X-Ray Manager user mode.
Applies to start and continue methods.
Limiting of user's running tasks is applied to Shared PRO only.
c
t d sdS t }|| d j }| }| d }|zt d |D }|t k rXt t d t t t t dS dS dS )zf
If XRAYEXEC_UID exists, check if user does not exceed
limit of running tasks
Tskip_jwt_checkNr r` c D g | ] }| d dk | S )statusrunning)get).0items r
z7user_mode_restricted..check.. s; %F %F %Fd%)XXh%7%79%D%D &*%D%D%Dr" z>Limit of running tasks is {}. You already have {} running task) r r\
ui_api_client
get_task_listr r r r ri formatrs )rt re ui_api_cli_instanseresp
list_of_tasks
running_counts r checkz#user_mode_restricted..check s (t<<< F&(( "&q'"7 &4466D HHX . .M ( # %F %Fm %F %F %F !G !G
$444# ==CVCHXDYDYDGHXDYDY>[ >[\ \] ] ] ! )( 54r" c | | i |S ro rj )rt ru r rl s r rx z%user_mode_restricted..wrapper s%
t tT$V$$$r" r rl rx r s ` @r user_mode_restrictedr sM ] ] ]0 4[[% % % % % [% Nr" c F d t fd }|S )zk
Decorator aimed to restrict frequent reloads of FPM service
Applies to get_domain_info method
c > t d rdS t }|v| j rq|d | }t | r7t
t d t t z d dS dS dS )z
Tr| Nr zhThe X-Ray User service is currently busy. Operation is temporarily not permitted. Try again in %s minuterr )flag)
r
r\ panel_fpmfpm_service_namer restrictr ri rs r )r rt re _fpm_services r r z)with_fpm_reload_restricted..check s
T 2 2 2 F&(( T^ 733D99L"<0099;;
$ / 0 0256H2I2IJ"$ $ $ $ !
$
$r" c ( | i |} | d|i |S )ro r rj )rt ru r' r rl s r rx z+with_fpm_reload_restricted..wrapper s3
tT$V$$
t $ r" r r s ` @r with_fpm_reload_restrictedr sJ $ $ $" 4[[ [ Nr" c V dt fdt fd }|S )Nusernamec n t }|"| |k r t t d dS dS )zI
If exists, check XRAYEXEC_UID against user passed param
NzIncorrect user for request)r\ r ri )r re s r validatez'username_verification..validate* sD '(( X%:%:A : ; ;<< < ! %:%:r" c : |d } | | i |S )Nr rj )rt ru r rl r s r rx z&username_verification..wrapper2 s2 *%tT$V$$$r" )rs r )rl rx r s ` @r username_verificationr ) sV =3 = = = = 4[[% % % % % [%
Nr" c Z dt ddfdt fd }|S )z
Decorator aimed to verify user in X-Ray Smart Advice user mode
Applies to get_detailed_advice method, which takes part in
advice_details and advice_apply methods
r r Nc t } | d d }n*# t $ r t t d w xY w|"||k r t t d dS dS )zU
If exists, check XRAYEXEC_UID against user in metadata of an advice
metadatar z#Requested advice cannot be verifiedNz Requested advice does not exist)r\ rJ r ri )r re r s r verifyz-user_mode_advice_verification..verifyB s '(( FJ'
3HH F F FA C D DEE E F X%:%:A ? @ @AA A ! %:%:s 'Ac 8 | i |\ }} | ||fS r rj )rt ru advice_infori rl r s r rx z.user_mode_advice_verification..wrapperN s7
t.v.. Q{A~ r" )dictr )rl rx r s ` @r user_mode_advice_verificationr ; sc
BT
Bd
B
B
B
B 4[[ [ Nr" )N)r N)7rG r loggingrS rD r@ r functoolsr typingr r r r clcommon.cpapir clcommon.lib.cleditionr
r xrayr ri constantsr r
exceptionsr r fpm_utilsr nginx_utilsr getLoggerr& r r3 r! r* r/ r< rQ rY boolrU rs r\ r^ rb rf rk ry r r r r rj r" r r sS
1 1 1 1 1 1 1 1 1 1 1 1 3 3 3 3 3 3 O O O O O O O O ; ; ; ; ; ; ; ; 4 4 4 4 4 4 4 4 * * * * * * ' ' ' ' ' '
. / /
2 2 2 2 2 2 3 0u 0 0 0 0 0 U 4 5c3 3G * HSM o % ; ;
; ; ; ;4(4. 4 4 4 4O O O O- -h - - - -`(x (H ( ( ( (V X ( F X $ X r"