zٳZ \ d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlm Z d dl
m Z d dl m
Z
d dlmZmZmZmZmZ d dlmZ d dlmZmZmZ d d lmZm Z m Z d d
l m Z m Z d d l!m"Z" d d l#m$Z$m%Z% d d
l&m'Z' d dl(m)Z) ej* e+ Z,dZ-dZ.dZ/dZ0dZ1 G d de Z2 G d de Z3 G d d Z4d Z5 e4 Z6d Z7d ee8 fd Z9 G d d e Z: G d d!e Z; G d" d#e Z< G d$ d%e< Z= G d& d'e< Z> G d( d)e Z?dS )* N)ABCabstractmethod)
ContextVar)chain)Path)DictListOptionalSetTuple)Core)
AbstractPanelModsecVendorsErrorPanelException)apache_modulesapache_runninglitespeed_running)async_lru_cachefinally_happened)files)RBL_WHITELIST_FILEModsec)$get_shared_disabled_modsec_rules_ids)
ModSecLockapachenginx litespeed
openlitespeedz/imunify360-{ruleset_suffix}-{webserver}-{panel}c e Zd ZdZdS ) ModsecImunifyVendorNotInstalledz:
Raises when there is no imunify vendor installed
N__name__
__module__ __qualname____doc__ M/opt/imunify360/venv/lib/python3.11/site-packages/im360/subsys/panels/base.pyr r * Dr' r c e Zd ZdZdS )ModsecNotInstalledVendorsz:
Raises when there is no vendors installed at all
Nr! r& r' r( r+ r+ 2 r) r' r+ c ( e Zd Z e Zd ZdS )
_ModSecLockerc J t j fd }|S )Nc K j 4 d {V | i | d {V cd d d d {V S # 1 d {V swxY w Y d S N)LOCK)argskwargscoroselfs r( wrapperz'_ModSecLocker.__call__..wrapper> s y
3
3
3
3
3
3
3
3 !T4 26 2 2222222
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3
3s 2
<<) functoolswraps)r5 r4 r6 s `` r( __call__z_ModSecLocker.__call__= s> 3 3 3 3 3
3 r' N)r" r# r$ r r1 r9 r& r' r( r- r- : s. :< t j S r0 )r- r1 lockedr& r' r( is_modsec_lockedr< F s $ $ & &&r' c fd}|S )z.Skip the call if ModSecurity is not installed.c K | d {V s t d d S | g|R i | d {V S )Nz ModSecurity is not installed)installed_modsecloggerwarning)clsr2 r3 funcs r( r6 z-skip_if_not_installed_modsec..wrapperP sw ))++++++++ NN9 : : : FT#/////////////r' r& )rC r6 s ` r( skip_if_not_installed_modsecrD M s# 0 0 0 0 0 Nr' returnc x K d } t | dd d {V }|t d |S )Nc ^ K t rt S t rt S d S r0 )r LITESPEEDr APACHEr& r' r( get_web_serverz'_get_web_server..get_web_serverZ s2
Mtr' ) max_triesdelayz&Couldn't detect any Web Server running)r r@ rA )rJ results r( _get_web_serverrP Y sZ $NbJJJ
J
J
J
J
J
JF
~?@@@ Mr' c e Zd Zedefd ZdefdZdee fdZ dee fdZ
de fdZ de
e fdZd Zd S )
PanelInterfacerE c
K d S r0 r& r5 s r( _get_all_admin_emailsz$PanelInterface._get_all_admin_emailsh r' c K | d{V S # t j $ r t $ rD}t d t | Y d}~nd}~ww xY wg S )z-
Return admin contact emails
Nz2Something went wrong while getting admin email: {})rU asyncioCancelledError Exceptionr@ rA formatstr)r5 es r( get_admin_emailsz PanelInterface.get_admin_emailsl s 3355555555 5% NNDKKFF
s A;:A66A;c t S )z+
Return panel's http ports
setrT s r(
http_portszPanelInterface.http_ports|
uu r' c t S )z,
Return panel's https ports
r` rT s r( https_portszPanelInterface.https_ports rc r' c dS )NFr& rT s r( remoteip_supportedz!PanelInterface.remoteip_supported s ur' c . K t d {V S r0 rP rT s r( rJ z PanelInterface.get_web_server s$ $&&&&&&&&&r' c t S r0 )dictrT s r( get_webshield_protected_portsz,PanelInterface.get_webshield_protected_ports s vv
r' N)r" r# r$ r listrU r^ r intrb re boolrg r
r\ rJ rl r& r' r( rR rR g s
T
^
CH SX D 'hsm ' ' ' ' r' rR c e Zd ZU dZdZ edd Zee ed< e e
d Z e
d0d Z e
d0d
Ze
d Ze
d Ze
d0d
Ze e
d Ze e
defd Ze e
defd Ze e
d1d Ze e
dededefd Ze dedefd Ze defd Ze defd Z e d Z e e
d Z e d Z e e
d Z e e
d Z!e e
defd Z"e e
defd Z#e e
d e$eef fd! Z%e d" Z&e de'e fd# Z(e e)d$% de'e* fd& Z+e d' Z,e de-e fd( Z.e defd) Z/e de-e fd* Z0e e
d+ Z1e defd, Z2e d-e*d.e*de3fd/ Z4dS )2ModSecurityInterfaceNz i360-app-based-excludes.confinstalling_settingsF)defaultinstalling_settings_varc
K dS )zR
Check if ModSecurity installed and enabled
:return: bool
Nr& rB s r( r? z%ModSecurityInterface.installed_modsec s
r' Tc
K d S r0 r& r5 reload_wafds r( _install_settingsz&ModSecurityInterface._install_settings rV r' c R K | j d } | | d{V | j | | d{V dS # | j | | d{V w xY w)zJ
Install ModSecurity vendors and patch ModSecurity config
T)ry N)rt ra rz reset"invalidate_installed_vendors_cache)r5 ry tokens r( install_settingsz%ModSecurityInterface.install_settings s
,0066 <(([(AA A A A A A A A ( . .u 5 5 599;; ; ; ; ; ; ; ; ; ;
( . .u 5 5 599;; ; ; ; ; ; ; ; ;s A0 06B&c
K dS )zK
Reset ModSecurity settings to values chosen by Imunify360
Nr& rT s r( reset_modsec_directivesz,ModSecurityInterface.reset_modsec_directives
r' c
K dS )zK
Reset ModSecurity rulesets to values chosen by Imunify360
Nr& rT s r( reset_modsec_rulesetsz*ModSecurityInterface.reset_modsec_rulesets r r' c
K dS )zi
Uninstall previously installedModSecurity vendors and
revert ModSecurity config
Nr& rx s r( revert_settingsz$ModSecurityInterface.revert_settings
r' c dS )z`
Detects Comodo ModSecurity Rule Set installed as Plugin
:return: bool:
Nr& rv s r( detect_cwafz ModSecurityInterface.detect_cwaf
r' rE c
K dS )z/Return a list of installed ModSecurity vendors.Nr& rv s r( modsec_vendor_listz'ModSecurityInterface.modsec_vendor_list
r' c
K dS )z-Return a list of enabled ModSecurity vendors.Nr& rv s r( enabled_modsec_vendor_listz/ModSecurityInterface.enabled_modsec_vendor_list r r' c
K dS )zl
Example:
>>> modsec_interface.modsec_get_directive("SecRuleEngine")
'Off'
Nr& )rB directive_namers s r( modsec_get_directivez)ModSecurityInterface.modsec_get_directive r r' vendorfilenamec K t )z&Return path to a specified vendor file)NotImplementedError)rB r r s r( build_vendor_file_pathz+ModSecurityInterface.build_vendor_file_path s "!r' c > K | |d d{V S )z-Return path to Imunify360 vendor VERSION fileVERSIONN)r )rB r s r( build_version_file_pathz,ModSecurityInterface.build_version_file_path s0 // BBBBBBBBBr' c > K | d{V }n.# t $ r!}t t | d}~ww xY w|st d t d |D d }|#t
dd | |S )zA
Return a name of Imunify360 ModSecurity vendor.
NzNo vendors installedc 3 X K | ]%}| t j !|V &d S r0 )
startswithr
PRODUCT).0vs r( z. s5 H H1Q\\$,-G-G HQ H H H H H Hr' z7Imunify360 vendor is not installed, all vendors are :%s )r r r r\ r+ nextr join)rB installed_vendorsr] names r( get_i360_vendor_namez)ModSecurityInterface.get_i360_vendor_name s
-&)&<&<&>&> > > > > > > - - -$SVV,, , - ! D+,BCC C H H) H H H$
<1I*++
s
A
AA
c K | d{V }| | d{V } | 5 }| cddd S # 1 swxY w Y dS # t
$ r'}t
d | d}~ww xY w)zH
Return a version of the Imunify360 ModSecurity vendor.
Nz)Cannot read Imunify360 vendor version: {})r r openreadstripOSErrorr r[ )rB r version_fileferrs r( get_i360_vendor_versionz,ModSecurityInterface.get_i360_vendor_version
s
//11111111 8 8 @ @@@@@@@ ""$$
(vvxx~~''
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
( $;BB3GG
s; B
&B 3 B
BB
BB
B>"B99B>c " K t | j d r| j t | j d r| j t | j d r| j d S d S )N cache_clear)hasattrr r _get_release_info_from_filer rv s r( r} z7ModSecurityInterface.invalidate_installed_vendors_cache s 3)= 9 9 1 " . . 0 0 0 32M B B : + 7 7 9 9 9 31= A A 9 * 6 6 8 8 8 8 8 9 9r' c
K dS )a
:param list updates: [
{
"groups": [
"cpanel",
"litespeed"
],
...
"name": "imunify360-litespeed-meta",
"url": "https://files.imunify360.com/.../meta_imunify360_litespeed.yaml"
},
{
"groups": [
"cpanel",
"apache",
"litespeed"
],
...
"name": "imunify360-rules-meta",
"url": "https://files.imunify360.com/.../meta_imunify360_rules.yaml"
}]
Nr& rv s r( _apply_modsec_files_updatez/ModSecurityInterface._apply_modsec_files_update" s
2
r' c r K | d {V | d {V d S r0 )r r} rv s r( apply_modsec_files_updatez.ModSecurityInterface.apply_modsec_files_update= sT ,,.........4466666666666r' c dS )zR
Returns path to ModSecurity audit log file
:return: srt:
Nr& rv s r( get_audit_log_pathz'ModSecurityInterface.get_audit_log_pathB r r' c dS )ze
Returns path to ModSecurity audit log dir for concurrent mode
:return: srt:
Nr& rv s r( get_audit_logdir_pathz*ModSecurityInterface.get_audit_logdir_pathK r r' c dS )a
Disable mod_security rules on global level.
Rebuild httpd conf and restart httpd server is caller
method responsibility.
:param list rule_list: list of rules to disable
:return: True if config was changed, False otherwise
Nr& rB rule_lists r( write_global_disabled_rulesz0ModSecurityInterface.write_global_disabled_rulesT s r' c
K dS )z
Disable mod_security rules on global level
This method should be idempotent
:param list rule_list: list of rules to disable
:return: True if config was changed, False otherwise
Nr& r s r( sync_global_disabled_rulesz/ModSecurityInterface.sync_global_disabled_rules_ r r' domain_rules_mapc
K dS )z
Disable mod_security rules on domain level for each domain
specified in a map. This method should be idempotent.
Nr& )rB r s r( sync_disabled_rules_for_domainsz4ModSecurityInterface.sync_disabled_rules_for_domainsi r r' c d}d}d t |t D }|r6| d t | }|S )Nz
SecRuleRemoveById {rules_list}
modsecurity_rules 'SecRuleRemoveById {rules_list}'
c , h | ]}t | S r& )r\ )r id_s r( zFModSecurityInterface.generate_disabled_rules_config..} s.
HH
r' r )
rules_list)r r r[ r sorted)rB r tplcontent rules_idss r( generate_disabled_rules_configz3ModSecurityInterface.generate_disabled_rules_configs s{
466
IjjCHHVI5F5F,G,GjHHGr' c K | d{V }| |t d{V S # t $ r&}t d| Y d}~dS d}~ww xY w)zQReturn RBL whitelist path.
Return None on modsec vendor errors.
Nz;Can't get RBL whitelist path. ModSecurity ruleset error: %s)r r r r r@ rA )rB r r] s r( get_rbl_whitelist_pathz+ModSecurityInterface.get_rbl_whitelist_path s 3355555555F 33F K | d {V }|r~ d |d |d |d d|d dk z S # t $ r&}t d | Y d }~d S d }~ww xY wd S )
Nz,{vendor}-{modsec3}{ruleset_type}-{webserver}r ruleset_type webserverzmodsec3-modsec_version )r r r modsec3z?Release file with info about ruleset is broken: %s is not found)r r[ lowerKeyErrorr@ rA )rB release_dictr s r( #get_modsec_vendor_from_release_filez8ModSecurityInterface.get_modsec_vendor_from_release_file s < < > >>>>>>>
ELL'1!-n!= *; 7 &,7G*HA*M N M
%''
'
ttttt
4s A A* *
B4BBc d S r0 r& rv s r( get_modsec_active_conf_filesz1ModSecurityInterface.get_modsec_active_conf_files r' c d S r0 r& rv s r( get_modsec_engine_modez+ModSecurityInterface.get_modsec_engine_mode r r' c d S r0 r& rv s r( get_modsec_vendor_updatesz.ModSecurityInterface.get_modsec_vendor_updates r r' c d S r0 r& rv s r(
_get_conf_dirz"ModSecurityInterface._get_conf_dir s
r' c t | }t j || j S )z
Return rules config path if WAF Rules Set configurator is supported
for this hosting panel, raise NotImplementedError otherwise
)r ospathr APP_BASED_EXCLUDE_CONF_NAME)rB conf_dirs r( get_app_specific_waf_configz0ModSecurityInterface.get_app_specific_waf_config s. $$&&w||Hc&EFFFr' enabled_users_domainsdisabled_users_domainsc " K t S )zu
Disable/enable extra modsecurity rules for specific domains.
Return set of updated domains.
r` )rB r r s r( (apply_myimunify_modsec_rules_for_domainsz=ModSecurityInterface.apply_myimunify_modsec_rules_for_domains s uu r' )Tr0 )5r" r# r$ REBUILD_HTTPDCONF_CMDr r rt ro __annotations__ classmethodr r? rz rD r r r r r rm r r r r\ r r r r r r} r r r r r r r r r r
r r rk r r r r r r r r ra r r& r' r( rq rq sm "@ 0:
u1 1 1Z -
^ [
^
"
<
<
< "!
< ^
^
^
^ [
^ [
^ [
^ [ "# " " " " " ^ [" C3 C4 C C C [C 3 [. c [ 9 9 [9
^ [
2 7 7 [7
^ [
^ [
t ^ [ D ^ [ #CI ^ [ [(
Xd^
[
_Q (4. [ [(
T#Y
[
s
[
$s)
[
^ [
GC G G G [G '+EI [ r' rq c : e Zd Zed Zed ZdS )ModSecSettingInterfacec
K dS )z9
Installs and enabled ModSecurity Vendor
Nr& rT s r( applyz ModSecSettingInterface.apply s
r' c
K dS )z
Removes and disables ModSecurity Vendor
:param kwargs: previous_value: values that was applied before
Nr& )r5 r3 s r( revertz ModSecSettingInterface.revert r r' N)r" r# r$ r r r r& r' r( r r sH
^
^
r' r c e Zd ZeZd Zedee fd Z e
d Z e
d Z e
d Z
d Zd Zd S )
FilesVendorc F || _ | | _ dS )a
:param dict item: e.g.
{
"groups": [
"cpanel",
"apache"
"configserver"
],
"obsoletes": [
"imunify360_rules",
"comodo_apache",
],
"url": "https://files.imunify360.com/.../meta_imunify360_apache.yaml"
}
N)_item
_vendor_id vendor_id)r5 items r( __init__zFilesVendor.__init__ s "
**r' rE c . K t d {V S r0 ri rv s r( rP zFilesVendor._get_web_server $ $&&&&&&&&&r' c
K d S r0 r& rT s r( r zFilesVendor.apply
rV r' c
K d S r0 r& r& r' r( _remove_vendorzFilesVendor._remove_vendor rV r' c d S r0 r& rT s r( r zFilesVendor._vendor_id r r' c K | d{V r<| d{V t d| j dS dS )z9
Removes and disables ModSecurity vendor
Nz Successfully removed vendor %r.)
_is_installedr r@ infor rT s r( r zFilesVendor.revert s| ##%% % % % % % % K%%'' ' ' ' ' ' ' ' KK94> J J J J J K Kr' c V K | j d {V }| j |v S r0 )modsec_interfacer r )r5 r s r( r zFilesVendor._is_installed s; "&"7"J"J"L"L L L L L L L~!222r' N)r" r# r$ rq r r r r
r\ rP r r r r r r r& r' r( r r s ++ + +( 'hsm ' ' ' ['
^
^
^
K K K3 3 3 3 3r' r c
e Zd Z G d de Z dZeZeZ e
d Z e
e d Z
e
e d Ze
dee fd Ze
defd Ze
d
Zed ZdS ) FilesVendorListc e Zd ZdZdS )'FilesVendorList.CompatiblityCheckFailedz;
>>> e.args[0]
{conflicting items}
Nr! r& r' r( CompatiblityCheckFailedr $ s
r' r Nc | K | j d {V | d {V d S r0 )r r} install_or_updaterv s r( r zFilesVendorList.apply3 sW "EEGGGGGGGGG##%%%%%%%%%%%r' c d S r0 r& )rB r s r( vendor_fit_panelz FilesVendorList.vendor_fit_panel8 s r' c
K d S r0 r& )rB r s r( _get_compatible_namez$FilesVendorList._get_compatible_name= s
r' rE c . K t d {V S r0 ri rv s r( rP z FilesVendorList._get_web_serverB r r' c 4 K t j t j }| j d{V } | | d{V n3# | j $ r&}t d| Y d}~dS d}~ww xY w t fd|
D }n,# t $ r t d Y dS w xY w| |d |d< |
| }|
D ]J}|
| }|j |v r*|j |j k r| d{V K| d{V dS ) z
Installs and enabled ModSecurity vendor list.
Returns True if ModSecurity vendor was installed, False otherwise.
Nz No vendor can be installed: %sFc 3 4 K | ]}|d k |V dS )r Nr& )r icompatible_names r( r z4FilesVendorList.install_or_update..V s: AfI ,H,H,H,H,H,H r' z Vendor %s not found in indexurl
local_pathT)r IndexMODSECr r r r r@ rA r items
StopIteration
localfilepath files_vendorr r r ) rB indexr r] r vendor_to_installr# r r$ s @r( r z!FilesVendorList.install_or_updateF s EL))"%"6"I"I"K"K K K K K K K $'$<$<=N$O$O O O O O O OOO* NN;Q ? ? ?55555 ;;== DD NN9? K K K55 # 0 0e = =\ , ,T 2 2 ! !A ##A 000K#4#>>>hhjj %%'''''''''ts* A
B(B B-C %C)(C)c K t j t j }| D ]D}| | r-| | d{V EdS )z>
Removes and disables ModSecurity vendor list
N)r r' r( r) r r, r )rB _r- r s r( r zFilesVendorList.revertk s
EL))KKMM 6 6D##D))
6&&t,,33555555555 6 6r' c > t j S r0 )r RULESETr r& r' r( get_ruleset_suffixz"FilesVendorList.get_ruleset_suffixu s ~##%%%r' )r" r# r$ RuntimeErrorr
config_keyr r, rq r r r r r r r
r\ rP ro r r staticmethodr3 r& r' r( r r # sA
,
J L+& & [& ^ [ ^ [ 'hsm ' ' ' [' " " " " ["H 6 6 [6 & & \& & &r' r c e Zd ZU dZdZeedf ed< ede fd Z
ede e fd Z
d Zd Zd
S ) RemoteIPInterfacezThis class implements panel-specific methods for activating and
deactivating mod_remoteip or similar functionality.
Concrete panel implementation may or may not derive from this class
as a means of signaling of support for this functionality.)s mod_remoteips remoteip_module._REMOTEIP_MODULE_NAMESrE c
K dS )z/Checks if remoteip feature is already activatedFr& rT s r( remoteip_activatedz$RemoteIPInterface.remoteip_activated s
ur' c
K dS )zActivates/ installs remoteip feature.
Returns a path to installation log file or None if no log file
is produced.Nr& rT s r( remoteip_installz"RemoteIPInterface.remoteip_install s
tr' c
K d S r0 r& rT s r( remoteip_customize_loggingz,RemoteIPInterface.remoteip_customize_logging s tr' c x K t d {V sdS t fd| j D S )NTc 3 K | ]}|v V d S r0 r& )r r moduless r( r z9RemoteIPInterface._is_loaded_to_apache.. s' KKt47?KKKKKKr' )r anyr9 )r5 rB s @r( _is_loaded_to_apachez&RemoteIPInterface._is_loaded_to_apache sW &(((((((( 4KKKKt/JKKKKKKr' N)r" r# r$ r% r9 r bytesr r ro r; r
r\ r= r? rD r& r' r( r8 r8 z s B B 1E%* -
$ ^
^ L L L L Lr' r8 )@rX r7 r loggingr abcr r contextvarsr itertoolsr pathlibr typingr r r
r r defence360agent.contracts.configr
"defence360agent.subsys.panels.baser r r !defence360agent.subsys.web_serverr r r defence360agent.utilsr r im360r im360.contracts.configr r "im360.subsys.shared_disabled_rulesr im360.utilsr getLoggerr" r@ rI NGINXrH
OPENLITESPEEDMODSEC_NAME_TEMPLATEr r+ r- r< use_modsec_lockrD r\ rP rR rq r r r r8 r& r' r( rY s # # # # # # # # " " " " " " 3 3 3 3 3 3 3 3 3 3 3 3 3 3 1 1 1 1 1 1
D C C C C C C C = = = = = = = = # " " " " " 8 $ $
I &8 2 ' ' ' -// x} ( ( ( ( (] ( ( (VI I I I I3 I I IX
S
"13 13 13 13 13( 13 13 13hT& T& T& T& T&, T& T& T&n L L L L L L L L L Lr'