ZHu d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dlm Z d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZmZmZm Z m Z d d l m Z d d l m!Z! d d
l"m#Z# d dl$m%Z%m&Z& d dl'm(Z(m)Z) d dl*m+Z+m,Z, d dl-m.Z. dZ/dZ0 e dd Z1 ed xZ23 s* ed xZ23 s ed Z2 e)e(e j4 e j5 Z6 e)e(e j4 e j5 Z7 G d de8 Z9 G d d Z:d Z;d edS )" N)suppress)JSONDecodeError)Path)TimeoutExpired)Optional)OperationalError)is_cpanel_installed)sentry)ANTIVIRUS_MODECore
CustomBillingint_from_envvarlogger) HookEvent)g)get_plesk_upgrade_urls)retry_on timed_cache)HOUR
rate_limit)APIError IPEchoAPI)IP IMUNIFYAVi&IMUNIFY360_CACHE_LICENSE_TOKEN_TIMEOUTiX z /opt/alt/openssl11/bin/opensslz /opt/alt/openssl/bin/opensslz/usr/bin/openssl)periodon_dropc e Zd ZdZdS ) LicenseErrorz9Used to communicate that some function requires a licenseN)__name__
__module__ __qualname____doc__ V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/contracts/license.pyr r @ s CCCCr% r c e Zd ZdZdZeedZdZdZdZdZ dZ
d Z d
Z d Z
g d Zi Zd
Ze eed dedededeeeee f fd Zed6de defd Z edeeee f deee ef fd Z ed Z e e e!j" e# d de$fd Z%edee fd Z&ed Z'ed Z(ed! Z)ed7d" Z*ed7d#efd$ Z+ed% Z,ed& Z-ed' Z.ed( Z/ed) Z0ed*ee dee fd+ Z1ed, Z2ed- Z3ed. Z4edefd/ Z5edefd0 Z6edefd1 Z7edefd2 Z8edefd3 Z9ed4 Z:edefd5 Z;d
S )8
LicenseCLN)idstatusgrouplimittoken_created_utctoken_expire_utc)r) r* r, r- r. group_id permissions) z!/usr/share/imunify360/cln-pub.key)z)/usr/share/imunify360/alt-license-pub.keyz /var/imunify360/license.jsonz!/var/imunify360/license-free.jsonz9https://cln.cloudlinux.com/console/purchase/ImunifyAvPlusz8https://www.cloudlinux.com/upgrade-imunify-{user_count}/z6../../../scripts14/purchase_imunifyavplus_init_IMUNIFYz3../../../scripts14/purchase_imunify360_init_IMUNIFY)r1 Nr2 ) max_tries pubkey_pathcontent signaturereturnc $ g }d}t j d 5 }| | | t ddd| d|j g} t
j |t j t j |d }|j d
k rd}nb|
d |j d |j d
|j n4# t $ r'}|
d|j Y d}~nd}~ww xY wddd n # 1 swxY w Y ||pdfS )zVerify that `content` is correctly signed with public key from file
`pubkey_path` with resulting `signature`. Returns a tuple with (success, error_list).
FT)deletedgstz-sha512z-verifyz
-signature )stdoutstderrinputtimeoutr z1Signature verification failed - openssl returned z
. stdout: z
, stderr: z openssl command failed: missing N)tempfileNamedTemporaryFilewriteflush OPENSSL_BINname
subprocessrunPIPE
returncodeappendr> r? FileNotFoundErrorfilename) r6 r7 r8 errorsresultsig_filecmdpes r& _verify_signaturez LicenseCLN._verify_signaturev s
(
5
5
5 NN9 % % % NN
C
N%?%?! <1$$ !FFMMB,-LB B#$8B B78xB B
%
O
O
O
M M MNNNNNNNN
O) @ v~%%s; =D-Cz2LicenseCLN._get_signature_input.. sH ,FH "..H.. r% null)VERIFY_FIELDS_MAP
isinstancedictrL joinitemsstrencode)clslicenserV partskeyvalues r& _get_signature_inputz LicenseCLN._get_signature_input s (1 ) )CCLE%&&
) GG 05
V$$$$ SZZ((((wwu~~$$&&&r% signature_listc F
g
fd}|D ]y\ }}t j | } || }n# t $ r Y >w xY w | j || r|dfc S j D ]} |||| r|dfc c S z
D ]} t
j d| dS )zc
Verify signatures in license
:return: signature, is_alternative, version
c V j | i |\ }}|r | |S N)rU extend)argskwargssuccessrO
all_errorsrg s r& verify_and_collect_errorsz=LicenseCLN._find_signature..verify_and_collect_errors s? 3c 3T DV D DOGV
*!!&)))Nr% )rV FTz%sNF)base64 b64decoderl KeyError _PUBKEY_FILE_ALTERNATIVE_PUBKEY_FILESr warning) rg
license_tokenrm rv signrV r8 r7
alt_pubkeyerrorru s ` @r& _find_signaturezLicenseCLN._find_signature s6 !#
, & &MD' (..I
22!7 3
)()97INN
#U{""" ! ;
&
&
,,Z)LL & :%%%%%&
& ( (E N4 ' ' ' '{s ?
A A c i } t | 5 }t j | }t |t s%t j d| |cddd S | |d | dg D \ }}| d }|rD| ||dfg \ }} |%t d |
dd n(d|v r$|
d t d | t d
|cddd S ||d < ||d < |cddd S # 1 swxY w Y no# t $ r t j
d
Y nOt t t t" t$ j t( f$ r }
t j d|
Y d}
~
nd}
~
ww xY w|S )z
Load license token from file and verify signature
If signature verification successful, put
first valid signature to 'sign' field of license
token
:return: license token
z2Failed to load license. Expected JSON object, got Nc g | ]}|d fS r1 r$ )r[ r s r&
z*LicenseCLN._load_token.. s, q r%
signatures signature_v2r2 z%Failed to verify license signature v2r0 zdLicense missing signature_v2 but contained permissions; stripped (possible tampering or stale token)z"Failed to verify license signaturer is_alternativez'Failed to load license: not registered?zFailed to load license: %s)openjsonloadra rb r r r getthrottled_log_errorpopthrottled_log_no_v2rM infoOSErrorr rz UnicodeDecodeErrorbinasciiError TypeError) rg pathdefaultfr~ r8 r v2_sign_sign_rT s r& _load_tokenzLicenseCLN._load_token s 8 :d )
%q $ !
!-66 #LL(=+ #)
% )
% )
% )
% )
% )
% )
% )
% -0,?,?! $1$5$5lB$G$G - -) > (++N;; " 2 2%! ~ HE1 }+ C &))->>>"m33!%%m444'' $'(LMMM"K)
% )
% )
% )
% )
% )
% )
% )
%N )2
f%2@
./$S)
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
% )
%V ! C C C KA B B B B B N
: : :
L5q 9 9 9 9 9 9 9 9 : sZ E AE E "C E. E ; E E EE EE G ?-G ,GG )seconds)maxsizec i }t r| j | j gn| j g}|D ] }| | }|r|c S |S )z
Get available license.
In Antivirus mode, if main license is unavailable, return free license
:return: license token
)r
_LICENSE_FILE_FREE_LICENSE_FILEr )rg lic_token
license_fileslfs r& get_tokenzLicenseCLN.get_token# sr
%S
6 7 7#$
! !B++I
!
!r% c P | d S )z$
:return: server id
r) r r rg s r&
get_server_idzLicenseCLN.get_server_id: s
}}""4(((r% c D t | S )z1
:return: bool: if we have token
)boolr r s r&
is_registeredzLicenseCLN.is_registeredA s
CMMOO$$$r% c b t o(| o| S )ze
:return: Return true only if we have valid ImunifyAV+ or
Imunify360 license
)r is_validis_freer s r& is_valid_av_pluszLicenseCLN.is_valid_av_plusH s' H#,,..H#++--6GHr% c N t sdS | t k S rw )r r
AV_DEFAULT_IDr s r& r zLicenseCLN.is_freeP s& 5 ""m33r% c R |p| }|sdS t rF| dd d o |d t j k S |d dv o6|d t j k o| j du p| j |d k S ) zLicense check based on license token
return True - if license token is valid for this server
return False - if license token is invalid
Fr* rX okr. r ok-trialNr, )r r r
startswithtime users_countrg tokens r& r zLicenseCLN.is_validV s ( 5 (B''22488 =,-<
(O 1 1
O()TY[[8
O D(MCOuW~,M
r%
permissionc |p| }|sdS || di x}v o || dk S )zLicense check for a specific permission based on a license token
return True - if license token has a given permission for this server
return False - if license token does not have permission
Fr0 ENABLEDr )rg r r perms r& has_permissionzLicenseCLN.has_permissionm sW ( 5
599]B#?#??4 @
.Z I-
r% c ~ | }|s | d |d |d< | j dz }t j t j z t j z }d}t t 5 t j | ddd n # 1 swxY w Y t j
t j ||| d 5 }t j
|| ddd n # 1 swxY w Y t j |dd t j || j | j t% j | t% j | | || dS # t0 $ r Y dS w xY w)
zb
Write new license token to file
:param token: new token
:return:
r, Nsaved_user_limitz.tmpi wroot_imunify)userr+ )r r r osO_WRONLYO_CREATO_EXCLr rM unlinkfdopenr r dumpshutilchownrename cache_clearr
set_server_idr set_product_nameget_product_name
renew_hookr )rg r old_token temp_fileflagsmoder s r& updatezLicenseCLN.update} s MMOO 7UYYw / / ;(-gE$ %%. bj(294
'
(
( ! ! Ii ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
Yrwy%66
<
< IeQ YV:>>>>
)S .///
!!### S . . 0 0111 4 4 6 6777 NN9e , , , , , DD s6 =B B"%B"C44C8;C8F. .
F<;F<c g d} d }| }t fd|D }|r=t j || }ddlm} t j || d d S d S ) N)license_expire_utcr* r, r) r c h g | ].} | | k /S r$ r )r[ elemr r s r& r z)LicenseCLN.renew_hook.. s4 O O OUYYt__
d 3 3
3 O O Or% )exp_timerh r )
execute_hooksT)return_exceptions) r fill_license_typeanyr LicenseRenewed defence360agent.hooks.executer asynciogather) rg r r important_keysr license_type conditionlicense_updatedr s `` r& r zLicenseCLN.renew_hook s HHH99 122,,U33 O O O O O O O O
' 6!< O
D C C C C C N
o..$
r% c 6 t t 5 t j | j ddd n # 1 swxY w Y | j t j d t j |
dS )zY
Delete license token along with old-style license data
:return:
N) r rM r r r r r r
r r r r s r& r; zLicenseCLN.delete s '
(
( ) ) Ic' ( ( ( ) ) ) ) ) ) ) ) ) ) ) ) ) ) )
!!### T""" 4 4 6 677777s
;??c d | d }ddddd}| | S )Nr*
imunify360imunify360Trial imunifyAV
imunifyAVPlus)r r ok-avok-avpr )rg r r license_type_to_products r& r z LicenseCLN.fill_license_type sB yy** ) % #
#
'**<888r% c | }| dd d rdS dS )Nr) rX zip-TF)r r lowerr r s r& is_ip_license_typez LicenseCLN.is_ip_license_type sI
99T2 $ $ & & 1 1% 8 8 4ur% url_templatec < |s|S | j }t j dd }|d}n| j D ] }||k r|} n
d}| dt | }| d| }| dt ||nd }|S ) a& Format upgrade URL template with available parameters.
Args:
url_template: URL template string that may contain
{user_count}, {iaid}, and {users} placeholders
Returns:
Formatted URL with placeholders replaced with actual values
iaidrX Nr1 unlimitedz {user_count}z{iaid}z{users})r r r VERSION_THRESHOLDSreplacere )rg r nr
user_count thresholds r& format_upgrade_urlz LicenseCLN.format_upgrade_url s OuVR
9JJ 3
)
) >>!*JE " )
#++NC
OOLL #++Hd;; #++ s
11155
r% c 6 |dk rdS |dk rdS |dk rdS dS )z1Get recommended license tier based on user count.r1 z Single userr3 zUp to 30 usersr4 zUp to 250 userszUnlimited usersr$ )rg r s r& _get_license_tier_recommendationz+LicenseCLN._get_license_tier_recommendation s: ?? =
2
##
3
$$$$r% c b | dS | | }|dk rdnd}d| d| d| d S )
z ? ? ?
% 5
B -1AA
r% c | | o(| o| S rp )r& r r, r s r& r z(LicenseCLN.is_eligible_for_imunify_patch s;
JJLL
8
855777
r% c t s t j S | dd }|dk rdS |dv rdS t j d| dS ) Nr* rX r z
imunify.av)r r r z imunify.av+zUnknown license %szUnknown license)r r NAMEr r r r )rg license_statuss r& r zLicenseCLN.get_product_name si 9 ,,Xr:: W $ $ <
;
;
; = L-~ > > >$$r% c @ t j d S )Nz/var/imunify360/demo)r r isfiler s r& r zLicenseCLN.is_demo s w~~ 4555r% c h | }| dd t k S )Nr, r )r r UNLIMITED_USERS_COUNTr s r& is_unlimitedzLicenseCLN.is_unlimited s)
yy!$$(===r% c | j | j d S | j D ]*}| j |k r | j | c S +| j d S )Nr1 )r r )r IM360_BUY_URL_TEMPLATEformatr )rg r s r& get_im360_buy_urlz LicenseCLN.get_im360_buy_url s ? "-444BB B / O OI)++188I8NNNNN ,)00K0HHHr% r rp ) &
FK
Xn***)&)&#()&5:)& tXd3i(( ))& )& )& +* \)&V ' 'C ' ' ' ' ['" %,0sCx ,A% x}d" #% % % [%N C C [CJ [#?@@@! $ [& )hsm ) ) ) [) % % [% I I [I 4 4 [4
[
,
[
[ B [$ 8 8 [ 8 9 9 [9 [ hsm
[ D % % [ %
[
& Z Z [Zx Dt D D D [D
d
[
d
[
% % % % [ % 6 6 6 6 [6 > > [> I# I I I [I I Ir% r( c B t j } t j dd }t rt
j t j k rt | s t j S d}d} t j }t j
| r|}nt j d| n,# t $ r }t j d| Y d }~nd }~ww xY w| dk rd| }nd| }||z S t d | z d
| t' | z z S ) Nr rX z???uu G s A A98A9)?r rx r rC r r r rH rB r
contextlibr r pathlibr r typingr peeweer 3defence360agent.application.determine_hosting_panelr defence360agent.contractsr
defence360agent.contracts.configr r r
r r %defence360agent.contracts.hook_eventsr &defence360agent.internals.global_scoper 0defence360agent.subsys.panels.plesk.upgrade_urlsr defence360agent.utilsr r defence360agent.utils.commonr r defence360agent.utils.ipechor r defence360agent.utils.validater r r4 rE rF existsr} r r r Exceptionr r( r re r rG r$ r% r& re s_
% % % % % % # # # # # # - , , , , , < ; ; ; ; ; 4 4 4 4 4 4 8 7 7 7 7 7 7 7 9 9 9 9 9 9 9 9 < < < < < < < < - - - - - -
" /, t <=== EEGG / 4 >?? ?K G G I I /d-.. EjjfnEEE
L FjjfnEEE
L
D D D D D9 D D Df I f I f I f I f I f I f I f IR5 5 5p
#
$
r%