Wj1 d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl m
Z
m Z ddl m
Z
ddlmZ ddlmZ ddlmZmZ ddlmZmZ dd lmZ dd
lm Z m Z m Z m Z m Z dd l!m"Z"m#Z#m$Z$ ej% d Z& ej' d
Z(dZ)dZ* ej+ e, Z- e
Z.dZ/dZ0 ej' d Z1de2e3e3f fdZ4de3de5fdZ6de7de7fdZ8de3de3fdZ9de:de5d ede2e3e3f fd Z;d ej d e,de3fd Zd ej d&e3de3fd'Z?d ej de3fd(Z@d ej ddfd)ZAd+d*ZBdS ),z@
This module contains X-Ray User Manager service implementation
N)Lockcurrent_thread)get_locale_from_envars)gettext)BoundedThreadExecutor)Runner
get_runner)user_agent_loguser_agent_sock) XRayError)check_for_rooterror_response
extract_creds
pack_responseunpack_request)configure_logging
create_socket read_sys_id
user_agentz0^[a-zA-Z]{1,5}(_[a-zA-Z]{2})?(\.[a-zA-Z0-9-]+)?$2 i i s! [ \t\r\n]*\{[ \t\r\n]*(?:["}]|\Z)returnc f t d } t | dfS )zN
General format of message in case of errors during manager execution
z[X-Ray User Plugin failed to execute your request. Please, contact your server administrator )_r encode)_errs F/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/user_agent.pygeneral_exec_errorr , s1
j k kD $ & & ( (# --r orig_msgc R t j dd| S )zL
Cut data field from the original message, because it could be huge
z (?<="data": {).+(?=}, "result")z...)resubdecode)r s r log_truncater% 4 s# 63UHOO)
startswithsplitappend)r& redactedtokenopts r
redact_cmdr1 ; s H # # D ! ! #cUll++c1%%a(C OOs / / / 0 0 0 0 OOE " " " " Or c 4 d }t j d|| S )zA
Extend warning 'Task is duplicated by URL' for end user
c J d}| d }|dk r||z S |S )zM
Add more text for duplicate warning, leave others unchanged
s . In case if you do not see running task for the same URL in your list of tasks below, contact your server administrator and ask him to check whether the requested URL is in the tasks list of X-Ray Admin Plugin or is scheduled for continuous tracing.r s Task is duplicated by URL)group)m
additionalwarns r genz#duplicate_warning_cast..genQ s7 V
wwqzz / / /*$ $ r s (?<="warning": ").+(?="}))r" r# )r r8 s r duplicate_warning_castr9 L s(
6.X > >>r commanduserrunnerc (
j dk r1 t | d< n # t $ r t cY S w xY wfdd
d}d}||g| | }| |t }t
|t rt | st pd}|r0 | }dj
d | || d
g}n dj
| d
g}|
fd |
D ||d } t d
t! | t | t# j |d| dd }
n6# t& t( t* t" j f$ r t cY S w xY w|
j |
j } } | r:t dt5 j t7 | | r:t dt5 j t7 | t9 | | fS )zA
Trigger runner.target utility with requested parameters
manager system_idc F | j v r j | | n| S )z0runner may define a special cast for each option) option_cast)r0 r< s r runner_cast_optz(execute_manager..runner_cast_optk s. /2f6H/H/H&v!#&s+++cQr c | du rdnd| S )z=Hide True value from cmd representation for bool-flag optionsT r) )vs r
hide_true_valz&execute_manager..hide_true_valo s $YYrrGGG+r api_versionlangzC.UTF-8z
/usr/sbin/r( r: c T g | ]$\ }}||v d | | %S )r( rE ).0krF rG rB skip_optionss r
z#execute_manager.. sQ www1[\wabjvavav;__Q''; q)9)9;;avavavr ) XRAYEXEC_UIDLANGz*Going to execute: %s, with environment: %sTx F)capture_outputenvtimeoutcheckz%[%s] Proxied command stdout: %d bytesz%[%s] Proxied command stderr: %d bytes) namer r r getr
isinstancestr
_LOCALE_REmatchtargetpopextenditemsloggerinfor1
subprocessrunOSError
ValueError TypeErrorSubprocessErrorstdoutstripstderrr lenr9 )r: r; r< api_version_key
locale_optionrH
target_localecasted_api_versionr& with_envpbyte_outbyte_errrG rB rM s ` @@@r execute_managerrt a s {i (#.==GK ( ( (%'' ' ' ' (R R R R R, , , $OM $]3L++o..K KK
/E/G/GHHM mS ) ) >1A1A-1P1P >.00=I
E ,__ = =+FM++-F2D-F-F U\U`U`ajUkUkl+FM++W[[-C-CD JJwwwwww
wwwxxx $m<>+;+;hH c ;^=M=M=RTWX`TaTabbb c ;^=M=M=RTWX`TaTabbb !( + +X 55s # >> F# #0GG
connectionsizec t }t | |k r@| |t | z
}|sn||z
}t | |k @t | S )a
Read exactly `size` bytes, or fewer if the peer stops sending before that
The bytes are gathered in a bytearray: appending to an immutable `bytes`
copies everything read so far on every recv(), which makes a request
delivered in tiny pieces cost quadratic CPU.
) bytearrayrk recvbytes)ru rv datachunks r
_recv_exactlyr} so ;;D
d))d
s4yy 011
d))d
;;r r| depth in_stringescapedc t | D ]O\ }}|rd}
|r|dk rd}|dk rd} |dk rd}'|dk r|dz
}3|dk r|dz }|dk r ||||dz fc S P|||d fS )
a~
Advance a brace-depth scan over `chunk`, resuming from the given state
Returns the state after the chunk plus the offset just past the top-level
object's closing brace, or -1 if it has not closed yet. Braces are scanned
as raw bytes on purpose: `{`, `}`, `"` and `\` cannot appear inside a
UTF-8 multi-byte sequence, so no decoding is needed to find them.
F\ T" { r* } r ) enumerate)r| r~ r r indexbytes r _scan_json_objectr s !'' < < t <GG
<t|| !
T\\ II
T\\ QJEE
T\\ QJEzz i%!);;;; )Wb ((r headc t | }|}d\ }}} t |||| \ }}}}|dk r7t |dt | t | z
|z S t | t k r"t
dt dS | t t t t | z
}|st | S ||z
})aC
Read a request that carries no length prefix, `head` being its first bytes
Such a client sends the payload alone and then waits for the reply without
closing its side, so there is no EOF to read up to: the request ends where
its JSON object ends, and the brace depth is what finds that. Each byte is
looked at once and copied once - only the newly received chunk is scanned,
and the request is gathered in a bytearray - so a caller cannot make the
reader do more work by pacing the bytes; validating the result stays
`unpack_request`'s job.
)r FFTr Nz,Unframed request exceeds %i bytes, rejectingr )
rx r rz rk _MAX_REQUEST_SIZEr` warningry min_READ_CHUNK_SIZE)ru r r{ r| r~ r r ends r _recv_unframedr s T??D E / E9g):5%T[)\)\&y'3 !88 <D CJJ 6 < <=>> > t99) ) ) NNIK\ ] ] ]3 $46G#d))6S T TUU ;;
r c t | d }t | dk rdS t j d| d }d|cxk r t k r*n n't | | }t | |k r|ndS t
| sdS t d t | | S )a
Read one request, accepting both framings clients send
Current clients prefix the payload with its 4-byte big-endian length
(`pack_request`, `ApiSocket::send`). AccelerateWP plugin builds up to
3.23-1.1-46 send bare JSON: they predate the prefix and cannot fetch
their own fix through the socket they are unable to talk to, so the
agent keeps answering them (CLOS-7023).
Telling the two apart is exact, not heuristic: a length within
`_MAX_REQUEST_SIZE` leaves 0x00 in the first byte, while JSON starts with
a printable ASCII byte, so the first four bytes of a bare payload always
decode to a length far above the cap (`{"ru` -> 2065855093).
r z>Ir z9Request carries no length prefix, reading it as bare JSON)
r} rk structunpackr _BARE_JSON_HEAD_REr[ r` ra r )ru r msglenbodys r read_requestr s Q ' 'D
4yy1}}s
]4
&
&q
)F6&&&&&&&&&& Z004yyF**tt3 # #D ) )
s
KKKLLL *d + ++r c t j dt d id }| 5 | d t | \ }}}t | rB| t | ddd dS t 5 t |d t k r4t d| ddd ddd dS t |xx d z
cc< ddd n # 1 swxY w Y t | }|s[ t 5 t |xx d z cc< t | dk rt |= ddd n # 1 swxY w Y ddd dS t! | }n# t j t$ f$ r}| t t j dt' | id Y d}~t 5 t |xx d z cc< t | dk rt |= ddd n # 1 swxY w Y ddd dS d}~ww xY w t) | d
}n# t, $ r}| t t' | Y d}~t 5 t |xx d z cc< t | dk rt |= ddd n # 1 swxY w Y ddd dS d}~ww xY w | | n# t0 $ r}| t t' | Y d}~t 5 t |xx d z cc< t | dk rt |= ddd n # 1 swxY w Y ddd dS d}~ww xY wt3 |t' | | \ } }
| t | p|
np# t4 t6 f$ r\ Y t 5 t |xx d z cc< t | dk rt |= ddd n # 1 swxY w Y ddd dS w xY w t 5 t |xx d z cc< t | dk rt |= ddd n # 1 swxY w Y nR# t 5 t |xx d z cc< t | dk rt |= ddd w # 1 swxY w Y w xY wddd dS # 1 swxY w Y dS ) z
Handle incoming connection
:param connection: socket object usable to
send and receive data on the connection
resultz#Commands from root are not acceptedF) ensure_asciig @Nr z6Too many concurrent connections from uid=%s, rejectingr* r< ) jsondumpsr
settimeoutr r
sendallr r _uid_connections_lock_uid_connectionsrW _MAX_CONNECTIONS_PER_UIDr` r r r JSONDecodeErrorUnicodeDecodeErrorrY r r] r validator
SystemExitrt TimeoutErrorrd ) ru
root_error_pid_uid_gidr{ argser< _outr s r handler
s Xq)N'O'O P_deeeJ ,/ ,/ c"""(44dD $ }Z->->-@-@ A A B B B ,/ ,/ ,/ ,/ ,/ ,/ ,/ ,/ # ( ( ##D!,,0HHH WY]^^^ ( ( ( ( ( (,/ ,/ ,/ ,/ ,/ ,/ ,/ ,/
T " " "a ' " " " ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( /
++D
2 '
/
/ &&&!+&&&#D)Q..(.
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/S,/ ,/ ,/ ,/ ,/ ,/ ,/ ,/$
%d++(*<=
""=Xs1vvV ST!V /T V T V T V !U0)/U$ U0$U(
(U0+U(
,U00V VVc t t t t 5 } t t
d 5 } | \ }} | t | nC# t j
$ r1 t d |
Y nw xY wx# 1 swxY w Y ddd dS # 1 swxY w Y dS )z
Run listening service
r ) max_workers maxqueuesizeTz(Connection rejected: thread pool is fullN)r r
r r r _MAX_WORKERSacceptsubmitr queueFullr` errorclose)spoolconnr s r rc rc @ s> n%%% ' ' 1.CP\kl.m.m.m qu hhjjGD!
FD)))):
GHHH
sS C B:A65B:6=B63B:5B66B::B> >CB> CCC)r N)C__doc__ collectionsr loggingr r" socketr rb threadingr r clcommon.clwpos_libr xrayr r xray.agent.executorr #xray.console_utils.run_user.runnersr r xray.internal.constantsr
r xray.internal.exceptionsr xray.internal.user_plugin_utilsr
r r r r xray.internal.utilsr r r getLoggerr` compilerZ r r defaultdictintr r r r r tuplerz r rY r% listr1 r9 dictrt r} boolr r r r rc rE r r r sy
* * * * * * * * 6 6 6 6 6 6 5 5 5 5 5 5 B B B B B B B B C C C C C C C C . . . . . . x x x x x x x x x x x x x x M M M M M M M M M M < ( (
RZK
L
L
*;*3// RZ EFF .E%, / . . . .O5 OS O O O OD T "?U ?u ? ? ? ?*66T 66 66f 66ue|AT 66 66 66 66rfm 3 5 ")U )3 )4 )$ )SXY\^bdhjmYmSn ) ) ) )8 v} E e @ ,V] ,u , , , ,F3/v} 3/ 3/ 3/ 3/ 3/l r