ڷݘ
d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
c m Z d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZm Z m Z m Z m Z m Z m!Z! d dl"Z"d d l#m$Z$ d d
l%m&Z&m'Z' d d l(m)Z) d d l*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d d
l3m4Z4 e5ej6 7 dd Z8 dZ9 ed Z:dZ;dZ ej? d Z@ eAd eBejC D ZDdZE ejF eG ZH G d deI ZJ G d d eI ZK G d d ZLd ZMd ZNd!e eO fd"ZPd!eQfd#ZR eS d$d%ZTd& ZUd' ZVd( ZW dId*e g ef d+e5fd,ZXd- ZYd!e eO fd.ZZd!e e!eO fd/Z[d!e!eO fd0Z\d!e!eO fd1Z] ed2 Z^d3eOd!e_fd4Z`dJd5Za e4jb e8 dJd6 ZcdJd7Zdd8 Zed9 ZfdKd;Zgd< Zhd=eQd!e eQ fd>Zid? Zjd@ Zk e+dAB dC Zl e1 e e5ej6 7 dDdE F G dH ZmdS )L N)suppress)
ContextVar) timedelta)Version)Path)
check_callDEVNULL)AnyCallableListOptionalSetTupleIterable)IntegrationConfig)is_generic_panel_installedis_plesk_installed)g)async_lru_cacheatomic_rewrite check_runget_system_user_names
OsReleaseInfo
CheckRunError
TimedCacheBACKUP_EXTENSION)webserver_gracefull_restart!IM360_GRACEFUL_RESTART_MIN_PERIODi, z*/usr/local/cpanel/scripts/restartsrv_httpdz/tmp/lshttpd/lshttpd.pid)z /usr/local/lsws/bin/lswsctrl condrestartz%/usr/local/lsws/conf/httpd_config.xmlz/usr/sbin/apache2z/usr/sbin/httpdz Server version:.*(\d+\.\d+\.\d+)c # > K | ]}| V d S N)encode).0xs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/web_server.py r& 5 s* @@1AHHJJ@@@@@@ apachec e Zd ZdZdS )NotRunningErrorz[
Error for cases when the web server is expected to be running but it
is not.
N__name__
__module__ __qualname____doc__ r' r% r* r* ; s r' r* c e Zd ZdZdS )ConfigInvalidErrorzO
Error used to indicate that the web server config is having error(s).
Nr+ r0 r' r% r2 r2 C s r' r2 c e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
e fd Z
d e fd
Zd
eeeef fdZd Zd
efdZdS )LiteSpeedConfiguseIpInProxyHeadersecurity
accessControlallowdenyr c 8 t j | | _ d S r! )ET
fromstringconfig)selfcontents r% __init__zLiteSpeedConfig.__init__S s mG,, r' returnc | j | j }||j s| j S t |j S r! )r? findCLIENT_IP_IN_HEADER_TAGtext CLIENT_IP_IN_HEADER_DISABLEDintr@ elements r% client_ip_in_headerz#LiteSpeedConfig.client_ip_in_headerV s> +""4#?@@ ?',?4 47< r' valuec | j | j }|3t j | j }| j | t
| |_ d S r! )r? rE rF r= ElementappendstrrG )r@ rM rK s r% set_client_ip_in_headerz'LiteSpeedConfig.set_client_ip_in_header\ sX +""4#?@@ ?j!=>>G K w ' ' '5zz r' c | j d d| j | j | j g }|*|j r#d |j D S t S )N/.c h | ]R}| d D ]:}|| d r
|dd n|| d f;SS ),TN)splitendswith)r# sitems r% z>LiteSpeedConfig.access_control_allowed_list..o s} GGCLL "mmC 0 0:crcdDMM#zCLiteSpeedConfig.set_access_control_allowed_list..x s1 KKK4$q'6a3 tAwKKKr' rW rT rU )
r_ r? rE r` ra rb r= rO rP rG )r@ alloweditemsrM rK access_controlr6 s r% set_access_control_allowed_listz/LiteSpeedConfig.set_access_control_allowed_listw sL KK7KKK+"" HH%+3
?j!@AAG ![ - - ) / N %!#D,C!D!D ;++D,=>># !z$*; < .is_generic_panel_on_apache s. % ' ' P$( }EEO Our' exeNr z#Can't determine apache bin path: %s)r r r r APACHE2_BIN_PATHHTTPD_BIN_PATHrc r _apache_running_process_infoospathsamefiler} r r )r r r sys_usersr httpd_process_exeexcs r% r r s# "
-"66 # # : : < <# % " )++,,}|j V HdS )r N)z/httpdz/apache2usernamer r[ )r# pr s r% r& z/_apache_running_process_info.. sp
u
1 F5M 2 23I J J 2 F: .) ; ; F < ; ; ;
r' )namer r uidsgidsattrsN)ranger
IndexErrornextr process_iter)r _s ` r% r r s
1XX
j
!
!
# 0 I I I
s 1A''A+ .A+ c t dh }|st d t j | |d d |d d dS )z&Make web server user/group own *path*.rootr z5Can't find running apache process without root owner.r r r N)r r* r chown)r r s r% r r s] "& : : :D
C
HT4<?DLO44444r' c ` t d t j g d D d S )z;Return path to a running nginx binary or None if not found.c 3 K | ]i}|j d Z|j d d r:|j d -d|j d v r |j d dv Z|j d V jdS )r Nnginxr r )r zwww-datar )r# r s r% r& z%find_running_nginx.. s
v*F6N++G44 +F5M-qve},,F:&*???
F5M @???
r' )r r r r N)r r r r0 r' r% find_running_nginxr sJ
(/J/J/JKKK
r'
webserver_running_cb granularityc K |dk sJ t | D ]/} | }|r|c S t j ||z d {V 0|S )Nr )r asynciosleep)r timeout_secr r results r% check_with_timeoutr / sz
????
;
%%'' MMMmK+ 56666666666
r' c @ t j d S )z8
though, available != running
:return bool:
z/etc/cpanel/ea4/is_ea4)r r isfiler0 r' r% is_EA4_availabler ? s
7>>2 3 33r' c t j t }|r|gS t j t j z r#dddt j | gS | ddgS )a{
:return list: command which can be passed to check_call(..., shell=False)
'apache2 -k graceful' will not work for Ubuntu
and will produce
'Invalid Mutex directory in argument file:${APACHE_LOCK_DIR}' error.
https://serverfault.com/questions/558283/apache2-config-variable-is-not-defined
That is why this specialization for Ubuntu graceful restart.
systemctlreloadz --job-mode=replace-irreversiblyz-kgraceful) shutilwhich CPANEL_RESTART_APACHE_SCRIPTr r r r r basename) apachectlrestartsrv_httpds r% _apache_graceful_restart_cmdr G sv |$@AA " !! !55 -
- G Y ' '
4,,r' c t j r t j d d } | s t d d S | }t j |d r|S t d| n*# t $ r t d Y nw xY wd S )Nr graceful_restart_scriptz'graceful_restart_script option is emptyr z,Web server restart script does not exist: %sz;Integration config is missing graceful_restart_script field) r r to_dictr r rZ r r KeyError)restart_scriptcmds r% +_graceful_restart_cmd_from_integration_confr a s !! . 6 8 8 F) N "
= t &&((Cw~~c!f%%
NN>
NNM
" 4s B) )$CCc 6 g } t j d x}r
| |ddddgz
} t }|| t | z S t r| t t
z S t
x}r| t | z S t d )z Gracefully restart a web server.z systemd-runz-pzSendSIGKILL=noz--slice=graceful_restartz--N Could not detect a web server) r r r listr LITESPEED_RESTART_CMDr r RuntimeError)prefix systemd_runr r s r% _graceful_restart_cmdr } s F l=111{
&
6
7
7C
S !! 4 23333"$$$y @4Y????
6
7
77r' c r t r= t j dd } | r| S n# t $ r Y nw xY wt x}r(t
j t j z rddgS |dgS t rddgS t x}r|dgS t d )Nr config_test_scriptr
configtest-t litespeedr ) r r r rZ r r r r r r r r )r
apache_bin nginx_bins r% _configtest_cmdr s !## #' 6JKKC
#yy{{"
# D $%%%z ! " "]%9 9 / . .D!! !T""(** * !4
6
7
77s *<
A A graceful_restart_caller
new_configc
K t j t z fd
t j }t || sdS fd t
d d{V t n=# t $ r0}t
d| Y d}~dS d}~ww xY wt j
fd } t j t |
t }t# j d }t& |j } | d{V t& | n # t& | w xY wt d dS # t0 $ r/}t
d
| Y d}~nd}~ww xY wdS )a
Update Web-server config with fallback in case of an error happens.
It tries to do all the best but because of graceful_restart() the
faulty config might still be applied but in practice it is barely
probable (because of premature config check).
1. The new config is checked before to be applied.
2. The new config (if checked valid) is atomically applied.
3. The graceful Web-server restart is scheduled. It may hold the actual
restart for some time, but it is a required workaround
of a litespeed issue.
4. If the Web-server failed to restart the config is reverted.
Return value: True if no errors (at least up to the server restart),
False if There was an error and config was reverted.
Note: It is possible that the config may be reverted even when return
value is True. It is because the graceful_restart may delay the actual
restart and config may be reverted on that (delayed) stage.
c t t 5 t j d d d d S # 1 swxY w Y d S r! )r FileNotFoundErrorr unlink)config_backup_paths r%
remove_backupz)safe_update_config..remove_backup s
'
(
( * * I( ) ) ) * * * * * * * * * * * * * * * * * *s 8<<)backupTc t j d S # t $ r& t d Y d S w xY w)Nw)r renamer openclose)r config_paths r% revertz"safe_update_config..revert sa + I(+ 6 6 6 6 6 + + + c " " ( ( * * * * * * +s ,A
A
raise_exceptionNz*Failed to get graceful restart command: %sFc d }d }| s| t d| t d } | | t } | | d S d S )Nc | sD| 2t d| d S d S d S )Nz'The reverted config seems to be invalidexc_info cancelled exceptionr criticalfuts r% log_config_errorzFsafe_update_config..restart_callback..log_config_error sb }} 3==??+FOOA!$ $ +F+Fr' c | sD| 2t d| d S d S d S )Nzuncaught exceptionr r r s r% log_uncaught_exceptionzLsafe_update_config..restart_callback..log_uncaught_exception sa }} 3==??+FOO,s}} $ +F+Fr' z7Web server failed to start... Revert changes back. (%s)Tr )r r
r error create_taskr add_done_callback_graceful_restart)taskr r loopr restart_cmdr s r% restart_callbackz,safe_update_config..restart_callback s
>>##
(8(8(D MNN$$ ''
4(H(H(HII&&'7888''(9+(F(FGG&&'=>>>>>
r' )
done_callbackr: z)Successfully scheduled web server restartz Web server config is invalid: %s)r fspathr r r r r r r r r r get_running_loopr coalesce_callsGRACEFUL_RESTART_MIN_PERIODr inspectstack_graceful_restart_callerrc functionresetr r2 )
r r make_backuper graceful_restart caller_frame
context_tokenr r r r r s
` @@@@@r% safe_update_configr( sh * ;//2BB* * * * * '..--K +z+ F F F t+ + + + + +6..........
/11KK LLEq I I I FHHH55555
')) 8
6E '7G
}q) 044\5JKK
:"";// / / / / / / / $ * *= 9 9 9 9 $ * *= 9 9 9 9 ?@@@ti 7;;;j 5s< $F+ ;B
C%B??CE0 0 F +
G$5%G G$c K t t | p
t d{V t d dS # t
$ r&}t d| Y d}~dS d}~ww xY w)]
Gracefully restart a web server.
If web server cannot be detected, do nothing.
N!Successfully restarted web server"Could not restart a Web server: %s)_log_graceful_restart_startr r r r r r )r errs r% r r s !!!9 >'<'>'>????????? 788888 B B B;SAAAAAAAAABs #A
BA<<Bc K t | }|t _ | d {V t j d S # t j d w xY w)Nweb_server_restart_task)r r r0 pop)r r s r% _graceful_restart_coalescedr2 s] [ ) )D $A )zzzzzz '(((('((((s < Ac K t j d }t |j } t | d{V }t | n # t | w xY w|S )r* r: N)r r r rc r! r2 r" )r r& r' r s r% r% r% ) s =??1%L,00 1FGGM62;???????? &&}5555 &&}5555 Ms A, , Bc p t d } t d| d S )Nunknownz/Performing web server graceful restart, from %s)r r r r )callers r% r- r- 9 s0
%
)
))
4
4F
KKA6JJJJJr' c t j d } t | j } t t | n # t | w xY w t t t t t d dS # t $ r&}t
d| Y d}~dS d}~ww xY w)zk
Gracefully restart a web server synchronously.
If web server cannot be detected, do nothing.
r: )r stderrr+ r, N)r r r rc r! r- r" r r r r r r r )r& r' r. s r% graceful_restart_syncr9 > s =??1%L,00 1FGGM6#%%% &&}5555 &&}55559(**77KKKK 788888 B B B;SAAAAAAAAABs# A# # A?(C
C7C22C7Fc K t d t t t d{V dS # t
$ r8}t d| | rt d |Y d}~dS d}~ww xY w)z\
Check web server's config file.
If web server cannot be detected, do nothing.
z!Performing web server config test) raise_excNz Could not run configtest: %szFailed to check config)r r r r r2 r r )r r. s r% r r S s KK3444H))5GHHHHHHHHHHHH H H H5s;;; H$%=>>C G H H H H H HHs (A
B
-BB
c t | }|"t | d S t d | )Nr: z)Failed to parse apache version string: {})apache_version_regexpsearchr groupr~ r )outputmatchs r% _parse_apache_version_outputrB b sV ! ( ( 0 0E u{{1~~&&& 7 > >v F F
r' r@ c > d | D S )a:
Parse response of httpd -M
:param output: stdout of httpd -M (with spaces before module name)
Output example:
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
mpm_prefork_module (shared)
:return: list with installed modules
c g | ]H}| t | d IS )r )
startswith BYTE_SPACESstriprZ )r# lines r% rg z-_parse_apache_module_list..x sS ??; ' '
Q r' )
splitlines)r@ s r% _parse_apache_module_listrJ l s/ %%'' r' c g }| d D ]L}| d }|dk r/| ||d M|S )N
rT r )decoderZ rE rP rG )dumpincludesrH indexs r% _parse_includesrQ sp H
##D)) 2 2 # 199 OODL . . 0 0 1 1 1 Or' c t K t t g d d {V S # t $ r g cY S w xY w)N)r r z-D
DUMP_INCLUDES)rQ r r r0 r' r%
dump_includesrT sg F F FGG G G G G G G
s #( 77r: )maxsizec K t } | t d t | dg d {V }t | }t
d| |S )Nr z-vzApache %s version detected)r r* r rB rM r r )r outversions r% apache_versionrY sy !!J 5666:t,--
-
-
-
-
-
-C*3::<<88G
KK,g666 Nr' 'IMUNIFY360_APACHE_MODULES_CACHE_TIMEOUTiX )seconds)
expirationc N K t d d {V } t | S )Nz-M)r rJ )r s r% apache_modulesr^ s5 &d++
+
+
+
+
+
+F $V , ,,r' )r r r! )F)nr r ro loggingr rer r stringxml.etree.ElementTreeetreerq r=
contextlibr contextvarsr datetimer packaging.versionr pathlibr
subprocessr r typingr
r r r
r r r r $defence360agent.api.integration_confr 3defence360agent.application.determine_hosting_panelr r &defence360agent.internals.global_scoper defence360agent.utilsr r r r r r r r defence360agent.utils.commonr rI environr r r r r LITESPEED_CONF_PATHr r compiler= tupler
whitespacerF r getLoggerr, r r r* r2 r4 r r rQ r r{ r frozensetr r r r r r r r r r r rz r( r r r2 r% r- r9 r rB rJ rQ rT rY r^ r0 r' r% rw sO
" " " " " " " " " " " " " " " % % % % % % * * * * * * * * F F F F F F F F F F F F F F F F F F
B B B B B B 5 4 4 4 4 4 E D D D D D !cJNN6?? L $ 9:: G = & ""
#FGG e@@V->(?(?@@@@@ 8 $ $ l T T T T T T T T n9 9 9 /
/ / / /u 2 .7Y[[ ' ' ' ' 'T (5 5 5 (
"2s7+
4 4 4-tCy - - - -4Xhsm5L 88x} 8 8 8 868# 8 8 8 8( &:&?@@ ^c ^d ^ ^ ^ ^B 9 9 9 9 , +,GHH) ) ) IH)
K K K
9 9 9* H H H H
e U & y JNNDc J J
- - - - -r'