eJ
d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m c m Z
d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZm Z d dl m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ d dl%Z%d d l&m'Z' d d
l(m)Z)m*Z* d d l+m,Z, d d l-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d d
l6m7Z7 e8ej9 : dd Z; dZ< ed Z=dZ>dZ?dZ@dZAdZB ejC d ZD eEd eFe jG D ZHdZI ejJ eK ZL G d deM ZN G d d eM ZO G d d ZPd ZQd! ZRd"e!eS fd#ZTd"eUfd$ZV eW d%d&ZXd' ZYd( ZZd) Z[ dVd+e g e f d,e8fd-Z\d. Z]d"e eS fd/Z^d"e!e$eS fd0Z_d1Z` eja d23 d"ebfd4 Zcd5ebd"e eS fd6ZddWd5ebd"e$eS fd8Zed"ebfd9Zfd"e!eS fd:ZgdXd5ebd"e$eS fd<Zhd"e$eS fd=Zi ed> Zjd?eSd"ebfd@ZkdYdAZl e7jm e; dYdB ZndYdCZodD ZpdE Zqd"ebfdFZrd"ebfdGZsdZdHZtd"ebfdIZudWdJZvdK ZwdLeUd"e eU fdMZxdN ZydO Zz e.d23 dP Z{ e4 e e8ej9 : dQdR S T dU Z|dS )[ N)suppress)
ContextVar) timedelta)Version)Path)CalledProcessError
check_call check_outputDEVNULL)AnyCallableListOptionalSetTupleIterable)IntegrationConfig)is_generic_panel_installedis_plesk_installed)g)async_lru_cacheatomic_rewrite check_runget_system_user_names
OsReleaseInfo
CheckRunError
TimedCacheBACKUP_EXTENSION)webserver_gracefull_restart!IM360_GRACEFUL_RESTART_MIN_PERIODi, z*/usr/local/cpanel/scripts/restartsrv_httpdz/tmp/lshttpd/lshttpd.pid) /usr/local/lsws/bin/lswsctrl condrestart)r! restartz%/usr/local/lsws/conf/httpd_config.xmlz/usr/sbin/apache2z/usr/sbin/httpdz Server version:.*(\d+\.\d+\.\d+)c # > K | ]}| V d S N)encode).0xs V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/subsys/web_server.py r* 9 s* @@1AHHJJ@@@@@@ apachec e Zd ZdZdS )NotRunningErrorz[
Error for cases when the web server is expected to be running but it
is not.
N__name__
__module__ __qualname____doc__ r+ r) r. r. ? s r+ r. c e Zd ZdZdS )ConfigInvalidErrorzO
Error used to indicate that the web server config is having error(s).
Nr/ r4 r+ r) r6 r6 G s r+ r6 c e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
e fd Z
d e fd
Zd
eeeef fdZd Zd
efdZdS )LiteSpeedConfiguseIpInProxyHeadersecurity
accessControlallowdenyr c 8 t j | | _ d S r% )ET
fromstringconfig)selfcontents r) __init__zLiteSpeedConfig.__init__W s mG,, r+ returnc | j | j }||j s| j S t |j S r% )rC findCLIENT_IP_IN_HEADER_TAGtext CLIENT_IP_IN_HEADER_DISABLEDintrD elements r) client_ip_in_headerz#LiteSpeedConfig.client_ip_in_headerZ s> +""4#?@@ ?',?4 47< r+ valuec | j | j }|3t j | j }| j | t
| |_ d S r% )rC rI rJ rA ElementappendstrrK )rD rQ rO s r) set_client_ip_in_headerz'LiteSpeedConfig.set_client_ip_in_header` sX +""4#?@@ ?j!=>>G K w ' ' '5zz r+ c | j d d| j | j | j g }|*|j r#d |j D S t S )N/.c h | ]R}| d D ]:}|| d r
|dd n|| d f;SS ),TN)splitendswith)r' sitems r) z>LiteSpeedConfig.access_control_allowed_list..s s} GGCLL "mmC 0 0:crcdDMM# r r\ r4 )r' ra s r)
zCLiteSpeedConfig.set_access_control_allowed_list..| s1 KKK4$q'6a3 tAwKKKr+ r[ rX rY )
rc rC rI rd re rf rA rS rT rK )rD alloweditemsrQ rO access_controlr: s r) set_access_control_allowed_listz/LiteSpeedConfig.set_access_control_allowed_list{ sL KK7KKK+"" HH%+3
?j!@AAG ![ - - ) / N %!#D,C!D!D ;++D,=>># !z$*; < .is_generic_panel_on_apache s. % ' ' P$( }EEO Our+ exeNr z#Can't determine apache bin path: %s)r r r r APACHE2_BIN_PATHHTTPD_BIN_PATHrg r _apache_running_process_infoospathsamefiler r r )r r r sys_usersr httpd_process_exeexcs r) r r s# "
-"66 # # : : < <# % " )++,,}|j V HdS )r N)z/httpdz/apache2usernamer r_ )r' pr s r) r* z/_apache_running_process_info.. sp
u
1 F5M 2 23I J J 2 F: .) ; ; F < ; ; ;
r+ )namer r uidsgidsattrsN)ranger
IndexErrornextr process_iter)r _s ` r) r r s
1XX
j
!
!
# 0 I I I
s 1A''A+ .A+ c t dh }|st d t j | |d d |d d dS )z&Make web server user/group own *path*.rootr z5Can't find running apache process without root owner.r r r N)r r. r chown)r r s r) r r s] "& : : :D
C
HT4<?DLO44444r+ c ` t d t j g d D d S )z;Return path to a running nginx binary or None if not found.c 3 K | ]i}|j d Z|j d d r:|j d -d|j d v r |j d dv Z|j d V jdS )r Nnginxr r )r zwww-datar )r' r s r) r* z%find_running_nginx..$ s
v*F6N++G44 +F5M-qve},,F:&*???
F5M @???
r+ )r r r r N)r r r r4 r+ r) find_running_nginxr ! sJ
(/J/J/JKKK
r+
webserver_running_cb granularityc K |dk sJ t | D ]/} | }|r|c S t j ||z d {V 0|S )Nr )r asynciosleep)r timeout_secr r results r) check_with_timeoutr 3 sz
????
;
%%'' MMMmK+ 56666666666
r+ c @ t j d S )z8
though, available != running
:return bool:
z/etc/cpanel/ea4/is_ea4)r r isfiler4 r+ r) is_EA4_availabler C s
7>>2 3 33r+ c t j t }|r|gS t j t j z r#dddt j | gS | ddgS )a{
:return list: command which can be passed to check_call(..., shell=False)
'apache2 -k graceful' will not work for Ubuntu
and will produce
'Invalid Mutex directory in argument file:${APACHE_LOCK_DIR}' error.
https://serverfault.com/questions/558283/apache2-config-variable-is-not-defined
That is why this specialization for Ubuntu graceful restart.
systemctlreloadz --job-mode=replace-irreversiblyz-kgraceful) shutilwhich CPANEL_RESTART_APACHE_SCRIPTr r r r r basename) apachectlrestartsrv_httpds r) _apache_graceful_restart_cmdr K sv |$@AA " !! !55 -
- G Y ' '
4,,r+ c t j r t j d d } | s t d d S | }t j |d r|S t d| n*# t $ r t d Y nw xY wd S )Nr graceful_restart_scriptz'graceful_restart_script option is emptyr z,Web server restart script does not exist: %sz;Integration config is missing graceful_restart_script field) r r to_dictr r r^ r r KeyError)restart_scriptcmds r) +_graceful_restart_cmd_from_integration_confr e s !! . 6 8 8 F) N "
= t &&((Cw~~c!f%%
NN>
NNM
" 4s B) )$CC r> )maxsizec B t j d } | sdS t | dgt }n# t
t f$ r Y dS w xY wt j d| }|d uo*t |
d t k S )N systemd-runFz --version)stderrzsystemd\s+(\d+)r> ) r r r
r decoder r researchrM group _SYSTEMD_RUN_WAIT_MIN_VERSION) systemd_runoutmatchs r) _systemd_run_supports_waitr s ,}--K uK5gFFFMMOO ' ( uu I(# . .E EKKNN <<s *A AAwaitc g }t j d x}rC||dddgz
}| r#t r| d | d |S )Nr z-pzSendSIGKILL=noz--slice=graceful_restartz--waitz--)r r r rT )r prefixr s r) _systemd_run_prefixr s| F l=111{ &
$.00 $ MM( # # #
d Mr+ Fc t | }t }||t | z S t r|t t z S t x}r|t
| z S t d )z Gracefully restart a web server.N Could not detect a web server)r r listr LITESPEED_RESTART_CMDr r RuntimeError)r r r r s r) _graceful_restart_cmdr s
&
&F
5
7
7C
S !! 4 23333"$$$y @4Y????
6
7
77r+ c J t j t S r% )r r r LITESPEED_CONF_PATHr4 r+ r) _litespeed_installedr s
7>>- . ..r+ c d} t r7 t j dd }n# t $ r Y dS w xY w|t k rdS d} t j t
j z r4t s| r$t j
t S t j
t S )u systemd unit for this host's Apache, or None when the host is not
Apache-based. Derived from OS/panel, not a running process — recovery
runs precisely when the server is not alive.Fr r NT)r r r r r r r r r r r r r r )on_generic_apacher s r) _apache_systemd_unitr s !## ! +/ mLLKK 44 & 4 -"66 2 2 12 w 0111
7 N + ++s (
66Tc t | }t r|t t z S t j t x}r||dgz S t }|t d |dd|gz S )a- Full (non-graceful) restart to bring a web server back up after a
reload left it down. Detects the server by install/config presence (not a
running process, which may be down) and raises when no safe command is
known (e.g. generic nginx, which has only a graceful integration script).
z --restartNz0No safe hard-restart command for this web serverr r# ) r r r LITESPEED_HARD_RESTART_CMDr r r r r )r r r units r) _hard_restart_cmdr s !
&
&F 9 78888!<(DEEE 8);777 ! !D |MNNN [)T2 22r+ c r t r= t j dd } | r| S n# t $ r Y nw xY wt x}r(t
j t j z rddgS |dgS t rddgS t x}r|dgS t d )Nr config_test_scriptr
configtest-t litespeedr ) r r r r^ r r r r r r r r )r
apache_bin nginx_bins r) _configtest_cmdr s !## #' 6JKKC
#yy{{"
# D $%%%z ! " "]%9 9 / . .D!! !T""(** * !4
6
7
77s *<
A A graceful_restart_caller
new_configc
K t j t z fd
t j }t || sdS fd t
d d{V t n=# t $ r0}t
d| Y d}~dS d}~ww xY wt j
fd } t j t |
t }t# j d }t& |j } | d{V t& | n # t& | w xY wt d dS # t0 $ r/}t
d
| Y d}~nd}~ww xY wdS )a
Update Web-server config with fallback in case of an error happens.
It tries to do all the best but because of graceful_restart() the
faulty config might still be applied but in practice it is barely
probable (because of premature config check).
1. The new config is checked before to be applied.
2. The new config (if checked valid) is atomically applied.
3. The graceful Web-server restart is scheduled. It may hold the actual
restart for some time, but it is a required workaround
of a litespeed issue.
4. If the Web-server failed to restart the config is reverted.
Return value: True if no errors (at least up to the server restart),
False if There was an error and config was reverted.
Note: It is possible that the config may be reverted even when return
value is True. It is because the graceful_restart may delay the actual
restart and config may be reverted on that (delayed) stage.
c t t 5 t j d d d d S # 1 swxY w Y d S r% )r FileNotFoundErrorr unlink)config_backup_paths r)
remove_backupz)safe_update_config..remove_backup s
'
(
( * * I( ) ) ) * * * * * * * * * * * * * * * * * *s 8<<)backupTc t j d S # t $ r& t d Y d S w xY w)Nw)r renamer openclose)r config_paths r) revertz"safe_update_config..revert sa + I(+ 6 6 6 6 6 + + + c " " ( ( * * * * * * +s ,A
A
raise_exceptionNz*Failed to get graceful restart command: %sFc d }d }| s| t d| t d } | | t } | | d S d S )Nc | sD| 2t d| d S d S d S )Nz'The reverted config seems to be invalidexc_info cancelled exceptionr criticalfuts r) log_config_errorzFsafe_update_config..restart_callback..log_config_error2 sb }} 3==??+FOOA!$ $ +F+Fr+ c | sD| 2t d| d S d S d S )Nzuncaught exceptionr$ r& r* s r) log_uncaught_exceptionzLsafe_update_config..restart_callback..log_uncaught_exception9 sa }} 3==??+FOO,s}} $ +F+Fr+ z7Web server failed to start... Revert changes back. (%s)Tr )r' r( r error create_taskr
add_done_callback_graceful_restart)taskr, r. loopr restart_cmdr s r) restart_callbackz,safe_update_config..restart_callback1 s
>>##
(8(8(D MNN$$ ''
4(H(H(HII&&'7888''(9+(F(FGG&&'=>>>>>
r+ )
done_callbackr> z)Successfully scheduled web server restartz Web server config is invalid: %s)r fspathr r r r r
r r r r/ r get_running_loopr coalesce_callsGRACEFUL_RESTART_MIN_PERIODr2 inspectstack_graceful_restart_callerrg functionresetr r6 )
r r make_backuper6 graceful_restart caller_frame
context_tokenr r4 r r5 r s
` @@@@@r) safe_update_configrF sh * ;//2BB* * * * * '..--K +z+ F F F t+ + + + + +6..........
/11KK LLEq I I I FHHH55555
')) 8
6E '7G
}q) 044\5JKK
:"";// / / / / / / / $ * *= 9 9 9 9 $ * *= 9 9 9 9 ?@@@ti 7;;;j 5s< $F+ ;B
C%B??CE0 0 F +
G$5%G G$c K t t | p
t d{V t d dS # t
$ r&}t d| Y d}~dS d}~ww xY w)]
Gracefully restart a web server.
If web server cannot be detected, do nothing.
N!Successfully restarted web server"Could not restart a Web server: %s)_log_graceful_restart_startr r r r r r )r5 errs r) r2 r2 \ s !!!9 >'<'>'>????????? 788888 B B B;SAAAAAAAAABs #A
BA<<Bc K t | }|t _ | d {V t j d S # t j d w xY w)Nweb_server_restart_task)r2 r rN pop)r5 r3 s r) _graceful_restart_coalescedrP k s] [ ) )D $A )zzzzzz '(((('((((s < Ac K t j d }t |j } t | d{V }t | n # t | w xY w|S )rH r> N)r< r= r> rg r? rP r@ )r5 rD rE r s r) rC rC u s =??1%L,00 1FGGM62;???????? &&}5555 &&}5555 Ms A, , Bc p t d } t d| d S )Nunknownz/Performing web server graceful restart, from %s)r> r r r )callers r) rK rK s0
%
)
))
4
4F
KKA6JJJJJr+ c t j d } t | j } t t | n # t | w xY w t t t t t d dS # t $ r&}t
d| Y d}~dS d}~ww xY w)zk
Gracefully restart a web server synchronously.
If web server cannot be detected, do nothing.
r> )r r rI rJ N)r< r= r> rg r? rK r@ r r r r r r r )rD rE rL s r) graceful_restart_syncrV s =??1%L,00 1FGGM6#%%% &&}5555 &&}55559(**77KKKK 788888 B B B;SAAAAAAAAABs# A# # A?(C
C7C22C7c K t j d } t | j } t t | n # t | w xY w t d }n3# t $ r&}t
d| Y d}~dS d}~ww xY wt | d{V r t d dS t
d t d{V t | d{V r t d dS t d{V S )
ay Graceful web-server restart that confirms the reload actually completed
and recovers the server if it did not.
Unlike graceful_restart() it bypasses the coalesce throttle (the
post-update reload must never be dropped); unlike graceful_restart_sync()
it observes the reload outcome instead of returning as soon as systemd-run
queues the transient unit.
r> Tr rJ NFrI zLWeb server reload after update did not complete cleanly; attempting recoveryz-Web server recovered on graceful reload retry)r< r= r> rg r? rK r@ r r r r _reload_confirmedr r/ _log_failed_configtest
_hard_restart)rD rE r rL s r) graceful_restart_confirmedr\ s =??1%L,00 1FGGM6#%%% &&}5555 &&}5555#... ;SAAAuuuuu s
#
####### 7888t
LL !
"
""""""""
s
#
####### CDDDt s# A% % BB
C CCc K t | d{V n:# t t f$ r&}t d| Y d}~dS d}~ww xY wt rdS t
d d{V n# t $ r Y dS w xY wdS )a Run *cmd* and report whether the reload truly succeeded.
With systemd-run --wait the exit code already reflects completion; on
older systemd (no --wait) the reload is fire-and-forget, so fall back to
a config test to detect a broken reload.
Nz'Web server reload returned an error: %sFTr )r r r r r r r
r6 r rL s r) rY rY s nn < ( @#FFFuuuuu "## t........... uu 4s& AA A%A< <
B
B
c K t d d {V d S # t $ r&} t d| Y d } ~ d S d } ~ ww xY w)NTr z.Web server config test failed after update: %s)r
r6 r r/ )rL s r) rZ rZ s L............ L L L EsKKKKKKKKKLs
A AA c j K t d } n3# t $ r&}t d| Y d }~dS d }~ww xY w t | d {V n:# t
t f$ r&}t d| Y d }~dS d }~ww xY wt d dS )NTrX z Cannot recover web server: %sFz"Web server hard restart failed: %sz-Web server hard-restarted after failed reload)r r r r/ r r r r^ s r) r[ r[ s T*** 4c:::uuuuunn < ( 93???uuuuu KK?@@@ 4s,
AA A A B0BBc K t d t t t d{V dS # t
$ r8}t d| | rt d |Y d}~dS d}~ww xY w)z\
Check web server's config file.
If web server cannot be detected, do nothing.
z!Performing web server config test) raise_excNz Could not run configtest: %szFailed to check config)r r r r r6 r r )r! rL s r) r
r
s KK3444H))5GHHHHHHHHHHHH H H H5s;;; H$%=>>C G H H H H H HHs (A
B
-BB
c t | }|"t | d S t d | )Nr> z)Failed to parse apache version string: {})apache_version_regexpr r r r r )outputr s r) _parse_apache_version_outputrf sV ! ( ( 0 0E u{{1~~&&& 7 > >v F F
r+ re c > d | D S )a:
Parse response of httpd -M
:param output: stdout of httpd -M (with spaces before module name)
Output example:
Loaded Modules:
core_module (static)
so_module (static)
http_module (static)
mpm_prefork_module (shared)
:return: list with installed modules
c g | ]H}| t | d IS )r )
startswith BYTE_SPACESstripr^ )r' lines r) rk z-_parse_apache_module_list.. sS ??; ' '
Q r+ )
splitlines)re s r) _parse_apache_module_listrn s/ %%'' r+ c g }| d D ]L}| d }|dk r/| ||d M|S )N
rX r )r r^ rI rT rk )dumpincludesrl indexs r) _parse_includesrt ! sp H
##D)) 2 2 # 199 OODL . . 0 0 1 1 1 Or+ c t K t t g d d {V S # t $ r g cY S w xY w)N)r r z-D
DUMP_INCLUDES)rt r r r4 r+ r)
dump_includesrw * sg F F FGG G G G G G G
s #( 77c K t } | t d t | dg d {V }t | }t
d| |S )Nr z-vzApache %s version detected)r r. r rf r r r )r
r versions r) apache_versionrz 3 sy !!J 5666:t,--
-
-
-
-
-
-C*3::<<88G
KK,g666 Nr+ 'IMUNIFY360_APACHE_MODULES_CACHE_TIMEOUTiX )seconds)
expirationc N K t d d {V } t | S )Nz-M)r rn )r s r) apache_modulesr > s5 &d++
+
+
+
+
+
+F $V , ,,r+ )r r )F)Tr% )rG N)}r functoolsr< rs loggingr r r r stringxml.etree.ElementTreeetreeru rA
contextlibr contextvarsr datetimer packaging.versionr pathlibr
subprocessr r r
r typingr r
r r r r r r $defence360agent.api.integration_confr 3defence360agent.application.determine_hosting_panelr r &defence360agent.internals.global_scoper defence360agent.utilsr r r r r r r r defence360agent.utils.commonr rM environr r; r r r r r r r compilerd tupler
whitespacerj r getLoggerr0 r r r. r6 r8 r r rU r r r frozensetr r r r r r r r r lru_cacher~ r r r r r r r r> rF r2 r: rP rC rK rV r\ rY rZ r[ r
rf rn rt rw rz r r4 r+ r) r s
" " " " " " " " " " " " " " " % % % % % % L L L L L L L L L L L L F F F F F F F F F F F F F F F F F F
B B B B B B 5 4 4 4 4 4 E D D D D D !cJNN6?? L $ 9:: G I = & ""
#FGG e@@V->(?(?@@@@@ 8 $ $ l T T T T T T T T n9 9 9 /
/ / / /u 2 .7Y[[ ' ' ' ' 'T (5 5 5 (
"2s7+
4 4 4-tCy - - - -4Xhsm5L > !$ Q D d tCy "8 8 8# 8 8 8 8"/d / / / /,hsm , , , ,(3 3D 3HSM 3 3 3 3(8# 8 8 8 8( &:&?@@ ^c ^d ^ ^ ^ ^B 9 9 9 9 , +,GHH) ) ) IH)
K K K
9 9 9*$!$ $! $! $! $!ND .L L L L T H H H H
e U & y JNNDc J J
- - - - -r+