Ic d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
m Z d dl m
Z
d dlmZmZ d dlmZ d d lmZmZmZmZ d d
lmZmZmZm Z m Z m Z d d l m Z d Z!d
Z" ed Z#dZ$dZ% ej& e' Z( G d dej) Z*d Z+d Z, G d de Z- G d de Z. G d de Z/ G d d e Z0dS ) N)suppress)Version)Path)DictOptional)urlparse)
ConfigFileCore)base)
OsReleaseInfoasync_lru_cacheatomic_rewrite check_run)MODSEC_NAME_TEMPLATE FilesVendorFilesVendorListModSecSettingInterfaceModSecurityInterface skip_if_not_installed_modsec)graceful_restartz*/usr/local/psa/admin/sbin/modsecurity_ctl z /usr/local/psa/bin/server_pref z /usr/local/psa/bin/server_prefz"/usr/local/psa/admin/bin/httpdmng customc e Zd ZdS )PleskModSecExceptionN)__name__
__module__ __qualname__ [/opt/imunify360/venv/lib/python3.11/site-packages/im360/subsys/panels/plesk/mod_security.pyr r ' s Dr r c K t d| t | t d {V }| S )NzRunning CMD: %s raise_exc)loggerdebugr splitr decodestrip)cmddatas r run_cmdr* + sb
LL"C(((399;;2FGGG G G G G G GD ;;== r c K ddl m} t | d {V t d k S )Nr Pleskz17.5)#defence360agent.subsys.panels.pleskr- r versionr, s r plesk_supports_custom_vendorsr0 1 sK 999999 (((((( ) )WV__ <z6ModSecSettings.waf_rule_engine_mode..L s. HHDD4G,G,G4,G,G,G,GHHr )r* SERV_PERFiter
splitlinesnext)clsrvstatusr) s @r waf_rule_engine_modez#ModSecSettings.waf_rule_engine_modeG s~ Y)B BCCCCCCCCDOO%%&&
HHHHDHHH$
O
O&R
r c d} t | j 5 }| }d d d n # 1 swxY w Y n# t $ r Y nw xY w|S )N )openUSER_MODSEC_CONF_REDHATreadOSError)r> contentfs r _read_custom_confz ModSecSettings._read_custom_confP s c122
#a&&((
#
#
#
#
#
#
#
#
#
#
#
#
#
#
# D s. A 9 A =A =A
AAc | }| j |vr)|d| j z dz z
}t | j |d d S d S )N
Fbackup)rJ I360_INCLUDE_REDHATr rE r> rH s r _include_modsec_conf_redhatz*ModSecSettings._include_modsec_conf_redhatZ s^ '')) "' 1 1 tc 55< s r _include_modsec_conf_debianz*ModSecSettings._include_modsec_conf_debiana sU J+3
DD s #
11c t j t j z r| d S | d S rS )r id_likeDEBIANrZ rQ rY s r include_modsec_confz"ModSecSettings.include_modsec_confk K " "]%9 9 . + + - - - - - + + - - - - -r c | }| j |v r4| | j d }t | j |d d S d S )NrC FrM )rJ rO replacer rE rP s r _revert_conf_include_redhatz*ModSecSettings._revert_conf_include_redhatr s] '')) "g - - ooc&=rBBG 36 N N N N N N . -r c | j t fD ]B}t t 5 t j | d d d n # 1 swxY w Y Cd S rS )rW PleskModSecurityconf_disable_global_symlinkr FileNotFoundErrorrT unlink)r> confs r _revert_conf_include_debianz*ModSecSettings._revert_conf_include_debiany s
/ 8 8 : :
D +,,
$
s AA A c t j t j z r| d S | d S rS )r r\ r] ri rb rY s r revert_conf_includez"ModSecSettings.revert_conf_include r_ r c K | | d {V x}}|dk r|S d}t d {V r t t |z d {V |S |dz
}t t |z d {V t t
dz d {V t t
dz d {V |S )Noffz. --update-web-app-firewall -waf-rule-engine onz -waf-rule-set crsz!--disable-all-rules --ruleset crsz--uninstall --ruleset crs)r^ rA r0 r* r:
MODSEC_API)r>
prev_valuer@
waf_options r applyzModSecSettings.apply s$ !!!$'$<$<$>$> > > > > > >>
V U??ME
.00 0 0 0 0 0 0 )j011 1 1 1 1 1 1 1 **
i*,---------j#FFGGGGGGGGGj#>>?????????r ro c K | |r2t t d | z d {V d S d S )Nz---update-web-app-firewall -waf-rule-engine {})rk r* r: format)r> ro s r revertzModSecSettings.revert s !!! AHH
r c dS )NTr rY s r
is_enabledzModSecSettings.is_enabled s tr N)r r r rE rO rV rW
config_key classmethodrA rJ rQ rZ r^ rb ri rk rq strrt rv r r r r2 r2 8 sr ML: ? $ !J [ [ O O [O [ . . [. O O [O [ . . [. [0 c [ [ r r2 c e Zd ZdZdZdZdZedefd Z ed Z
ed Z ed e ee
f fd
Zedefd Zedefd Zed
Zed Zed Z ej d$d Zd%dZd Zd Z ej d$d Zed Z e e d d Z ed Z e e d de e! fd Z"edef fd Z#e e d d Z$ed e e d ede%fd! Z&ed" Z'ee(d# Z) xZ*S )&rd z/var/log/modsec_audit.logz/usr/local/cwafz//var/www/vhosts/system/{domain}/conf/siteapp.d/z"zz999-i360-app-based-excludes.confreturnc J t j t j z rdS dS )Nz/etc/apache2/conf-enabledz/etc/httpd/conf.d/r r\ r] rY s r
_get_conf_dirz PleskModSecurity._get_conf_dir s' " "]%9 9 /..##r c J t j t j z rdS dS )Nz/etc/apache2/plesk.conf.dz /etc/httpd/conf/plesk.conf.dr} rY s r _get_global_include_dirz(PleskModSecurity._get_global_include_dir s' " "]%9 9 2..11r c f t j | d S )Nz"zz999_modsec2.imunify_disable.conf)rT pathjoinr~ rY s r re z,PleskModSecurity.conf_disable_global_symlink s, w|| !E
r domain_rules_mapc K | D ]\ }}| j | }t j |d t t j |d | | d t t d | z d {V d S )N)domainTexist_oki360_modsec_disable.confFrM z0--reconfigure-domain {} -skip-broken -no-restart) itemsDOMAIN_INCLUDE_DIR_TMLrs rT makedirsr r r generate_disabled_rules_configr* HTTPDMNG)r> r r rule_listconf_dirs r sync_disabled_rules_for_domainsz0PleskModSecurity.sync_disabled_rules_for_domains s "2!7!7!9!9
FI1888GGH K4 0 0 0 0 X'ABB229==
DKK
r c t j | d t t j | d | | d } t j t j | d | n# t $ r Y nw xY w|S )z
:param list rule_list: rule ids to sync
:raise OSError: if httpd reconfigure returned not zero exit code
:return: True if config was changed, False otherwise
Tr r FrM )
rT r r r r r r rU re rX )r> r changeds r write_global_disabled_rulesz,PleskModSecurity.write_global_disabled_rules s C//11DAAAA GLL++--/I
. .y 9 9
J //113M //11
D s ?AC
C$#C$c 0 K | | S )z=
just alias to write_global_disabled_rules()
)r )r> r s r sync_global_disabled_rulesz+PleskModSecurity.sync_global_disabled_rules s
..y999r c | j S rS )AUDIT_LOG_FILErY s r get_audit_log_pathz#PleskModSecurity.get_audit_log_path s !!r c dS )Nz /var/log/apache2/modsec_auditr rY s r get_audit_logdir_pathz&PleskModSecurity.get_audit_logdir_path s ..r c K t j t sdS t t dz d{V dS # t $ r Y dS w xY w)z6Check if all the panel utilities we use are available.Fr5 NT)rT r isfilern rstripr* r: r rY s r installed_modsecz!PleskModSecurity.installed_modsec s w~~j / / 1 122 5 )&??@@ @ @ @ @ @ @ @ 4 $ 55 s A
A)(A)Tc K t }| D ]6}| d|j | d {V 7t d {V d S )NMOD_SEC)r _get_avalible_settingssetrw rq r self reload_wafdconfigsettings r _install_settingsz"PleskModSecurity._install_settings s 2244 M MG JJy'"4GMMOO6K6K6K6K6K6K L L L L r Nc K t rS NotImplementedError)r directive_namedefaults r modsec_get_directivez%PleskModSecurity.modsec_get_directive !!r c K t rS r r s r reset_modsec_directivesz(PleskModSecurity.reset_modsec_directives r r c K t rS r r s r reset_modsec_rulesetsz&PleskModSecurity.reset_modsec_rulesets! r r c K | d {V s t d d S t }| D ]R}| | d|j d {V | d|j d St d {V d S )Nz r) s r modsec_vendor_listz#PleskModSecurity.modsec_vendor_list; s~ ))++++++++ I Z*; ;<<<<<<<<@@FFFFFFFFFr c , K d | D }t d{V s|S | d{V }|rA | t n# t
$ r Y nw xY w| | |S )a
On new plesk panels we have convert all 'custom' vendors from plesk api
calls to real imunify-vendor names(ex. imunify360-full-apache) as
on this panel 'custom' - is a fixed vendor name for 3rd party
installed vendor. If we will find RELEASE file with real vendor name
in vendor directory, it means it is imunify vendor, we will return
this real name
:param data:
:return: vendor list, example:
['imunify360-full-apache', 'other-vendor']
c g | ]}||S r r )r7 vendors r
zLPleskModSecurity._vendor_list_with_custom_vendor_removed..Q s HHH&HvHHHr N)r< r0 #get_modsec_vendor_from_release_fileremoveCUSTOM_VENDOR_NAME
ValueErrorappend)r> r) vendor_listr s r r z8PleskModSecurity._vendor_list_with_custom_vendor_removedD s IHDOO,=,=HHH 244444444 >>@@@@@@@@ '
""#56666
v & & &s A/ /
A<;A<c K t d {V r | d d d {V }n4| | d {V d d {V } | 5 }t j | }d d d n # 1 swxY w Y |S # t t t j f$ r Y d S w xY w)NRELEASE) r0 build_vendor_file_pathget_i360_vendor_namerD jsonloadrG IOErrorJSONDecodeError)r> modsec_release_file release_f json_datas r _get_release_info_from_filez,PleskModSecurity._get_release_info_from_file_ si /00 0 0 0 0 0 0
),(B(Bi) ) # # # # # # ),(B(B..00000000)) ) # # # # # # $))++
1y Ii 0 0
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1 $"67 44 s6 )B+ =B B+ B""B+ %B"&B+ + C
C c K | d {V }|r | d r|d S t d {V S )Nr/ )r r superget_i360_vendor_version)r> release_dict __class__s r r z(PleskModSecurity.get_i360_vendor_versiont sz < < > >>>>>>> +L , ,Y 7 7 + * *WW44666666666r c K | d{V sg S t t dz d{V }| | d{V S )z-Return a list of enabled ModSecurity vendors.Nz--list-rulesets --enabledr r s r enabled_modsec_vendor_listz+PleskModSecurity.enabled_modsec_vendor_list{ s~ ))++++++++ I Z*E EFFFFFFFF@@FFFFFFFFFr r filenamec d K t t dz d{V }t d{V s|st d |}nU|rL| t
j s-t d |t
j t }t | |z |z S )z
:param vendor: vendor directory: old plesk panels - imunify360-*;
new plesk panels - imunify360-* or None - we will look into custom
directory anyway
:param filename:
:return:
z--rules-base-dirNz2Vendor directory can't be None on old plesk panelszHVendor directory {} should be None or starts with {} on new plesk panels)
r* rn r0 r
startswithr
PRODUCTrs r r )r> r r
rule_base_dir
vendor_dirs r r z'PleskModSecurity.build_vendor_file_path s &j3E&E F FFFFFFF
244444444 ,
H JJ
f / / = =
#VFDL 9 9
,JM""Z/(::r c t t gS rS )r2 PleskFilesVendorListrY s r r z'PleskModSecurity._get_avalible_settings s 455r c | K | d {V t d {V d S rS )"invalidate_installed_vendors_cacher install_or_updaterY s r _apply_modsec_files_updatez+PleskModSecurity._apply_modsec_files_update sV 44666666666"4466666666666r )TrS )+r r r r r r APP_BASED_EXCLUDE_CONF_NAMErx ry r~ r re r listr boolr r r r r r ensure_valid_panelr r r r r r r
r r r dictr r r r r r r r
__classcell__)r s @r rd rd s} 0N - N"F $c $ $ $ [$
2 2 [2
[
#CI [$ t [4 :D : : : [: " " [" / / [/ [ T ! ! ! ! " " " "" " "" " " T ! ! ! ! 9 9 [9 _Q G G [G [4 _Q (4. [& 7c 7 7 7 7 7 [7 _Q G G [G ; c];.1;
; ; ; [;: 6 6 [6 !7 7 "! [7 7 7 7 7r rd c e Zd ZeZej ej d Z
d Z d Z d Z
d ZdefdZd Zd Zd
Zd Zd S )
PleskFilesVendorzi360_modsec_vendor.zipc r K | d {V | d {V d S rS )_remove_obsoleted_add_or_update_vendorr s r rq zPleskFilesVendor.apply sT $$&&&&&&&&&((***********r c K | d{V r<| d{V t d| j dS dS )z
Removes and disables ModSecurity vendor + on new plesk also we will
always delete "custom" ruleset in all cases
Nz Successfully removed vendor %r.)
_is_installed_remove_vendorr# info vendor_idr s r rt zPleskFilesVendor.revert s|
##%% % % % % % % K%%'' ' ' ' ' ' ' ' KK94> J J J J J K Kr c . K t | j d {V }t | j dg }||z D ]8}t
d| | | d {V 9d S )N obsoletesz Removing obsoleted vendor %r)r modsec_interfacer _itemr r# r _remove_vendor_by_id)r enabled_vendors obsoletedr s r r z"PleskFilesVendor._remove_obsoleted s 'BBDD D D D D D D
{B7788 % 1 4 4F KK6 ? ? ?++F33 3 3 3 3 3 3 3 3 4 4r c K | j d {V }| d {V | j |v r"t d| j d S t d| j d S )Nz Successfully updated vendor %r.z!Successfully installed vendor %r.)r r _add_vendorr r# r )r installed_vendorss r r z&PleskFilesVendor._add_or_update_vendor s 'BBDD D D D D D D > . . . KK94> J J J J J KK;T^ L L L L Lr r c K t d {V rmt d t t dz d {V n2# t
$ r%}t d| Y d }~nd }~ww xY wd S t t d|z z d {V t t d|z z d {V d S )Nz,Plesk doesn't support uninstalling rulesets.z.--update-web-app-firewall -waf-rule-engine offz&Couldn't turn WAF rule engine off: %s z --disable-all-rules --ruleset %sz--uninstall --ruleset %s)r0 r# r r* r: Exceptionerrorrn )r r es r r z%PleskFilesVendor._remove_vendor_by_id s? .00 0 0 0 0 0 0 NNI J J J
J FG
J
J
J EqIIIIIIII
J F ;iG G
j#= #IIJJJJJJJJJJJs A
A?A::A?c J K | | j d {V d S rS )r r r s r r z PleskFilesVendor._remove_vendor s4 ''77777777777r c t j t | j d j }t j | \ }}|S )Nurl)rT r basenamer r splitext)r r basename_no_zip_s r
_vendor_idzPleskFilesVendor._vendor_id sI 7##HTZ->$?$?$DEE W - -h 7 7 r c K t d {V r | d {V d S t t d| j d| j d z d {V d S )Nz3--install --with-backup --enable-ruleset --ruleset z --archive-path
local_path)r0 !_install_or_update_custom_rulesetr* rn r r r s r r z PleskFilesVendor._add_vendor s .00 0 0 0 0 0 0 88:: : : : : : : : : : J ~~~tz,'?'?AA
r c K t d{V pd}| j j }|dk s|r|rdn|}t
d|rdndt ||k rd|d|nt | t t d gd
|gz d t d | j d
gz t d{V dS t
d dS )a
Install or update custom ruleset from *TMP_VENDOR_PATH*.
Installation happens iff the "installing_settings" var is true.
Installation turns on the waf rule engine.
The update command preserves waf rule engine mode.
If the war rule engine is off, then the update command is skipped.
Unknown (None/empty) mode is considered to be "off."
Nrm onz'%s %s ruleset, waf-rule-engine mode: %s
InstallingUpdatingz old_mode=z
new_mode=z--update-web-app-firewallz-waf-rule-enginez
-waf-rule-setz-waf-archive-pathr r! zSwaf rule engine remains off. Skip the update command as a workaround for DEF-15857.)
r2 rA r installing_settings_varr r# r r reprr SERVER_PREF_BINr r )r old_mode
installingnew_modes r r z2PleskFilesVendor._install_or_update_custom_ruleset s^ (<<>>>>>>>>G%*BFFHH
u
)7ttxH KK9 *:
" 8++ 3x22X222 h
"=>%x01 $&'J|, /
KKJ
r N)r r r rd r rT r r r
TMPDIRTMP_VENDOR_PATHrq rt r r ry r r r r r r r r r r s 'gll4;0HIIO+ + +K K K4 4 4 M M M KC K K K K"8 8 8
) ) ) ) )r r c B e Zd ZeZeZed Zed Z dS )r c 8 |d d S )Nnameplesk)endswith)r> items r vendor_fit_panelz%PleskFilesVendorList.vendor_fit_panel, s F|$$W---r c K | d {V }|s| d| t j | |d S )NzBWeb-server is not running, skipping imunify360 vendor installationr& )ruleset_suffix webserverpanel)_get_web_serverCompatiblityCheckFailedr rs get_ruleset_suffix)r> r
web_servers r _get_compatible_namez)PleskFilesVendorList._get_compatible_name0 s ..00000000
--1!
$* 1133
r N)
r r r r files_vendorrd r rx r) r2 r r r r r ( sS #L'. . [.
[
r r )1r loggingrT
contextlibr packaging.versionr pathlibr typingr r urllib.parser defence360agent.contracts.configr r
defence360agent.subsys.panelsr defence360agent.utilsr r
r r im360.subsys.panels.baser r r r r r !defence360agent.subsys.web_serverr rn r: r r r getLoggerr r# PanelExceptionr r* r0 r2 rd r r r r r rA s % % % % % % ! ! ! ! ! ! ! ! ! ! ! ! ! ! = = = = = = = = . . . . . . ? > > > > >
9
- $788 / 8 $ $ 4. ! ! ! = = =w w w w w+ w w wtx7 x7 x7 x7 x7+ x7 x7 x7vx x x x x{ x x xv
?
r