Sid Gifari From Gifari Industries - BD Cyber Security Team
Home
/
opt
/
cloudlinux
/
venv
/
lib
/
python3.11
/
site-packages
/
xray
/
internal
/
__pycache__
/
✏️
Editing: probe_targets.cpython-311.pyc
� W��j~G � �n � U d Z ddlZddlZddlZddlZddlZ ej e� � ZdZ e e d< dZ e e d< dZdZd Zd Zd e dz d e dz fd �Zd efd�Zd efd�Zd efd�Zde de de d e dz fd�Zde d e dz fd�Zde d e dz fd�Zde de d e dz fd�Zd e dz fd�Z d e fd �Z d de de d e dz d ee fd �Z dS )!u� Connect-target resolution for the per-domain phpinfo probe. The probe in :mod:`xray.internal.phpinfo_utils` fetches a temporary file from a vhost hosted on THIS machine. The hostname is tenant-controlled and resolves via public DNS, so following DNS would let a tenant repoint their domain at an arbitrary host and turn the root daemon's probe into an SSRF primitive (CLPRO-3179 finding F-08 — the repo also uses a bare "F-08" for an unrelated CLPRO-3240 finding in `cron/xray-tasks`, so this one is always qualified here). The probe therefore never resolves the hostname: it connects to an address this module returns and passes the domain in the ``Host`` header. Pinning to 127.0.0.1 *alone* (the original CLPRO-3179 F-08 fix) silently assumed the local webserver routes purely by name. That holds for a wildcard listener (the nginx-fronted default) but NOT for the per-IP vhosts DirectAdmin and cPanel generate by default:: <VirtualHost 178.250.40.254:80 > # the account's vhost Listen 80 # but the server listens everywhere A request arriving on the loopback address falls into the ``127.0.0.1:80`` address bucket, matches no vhost there, and is answered by that bucket's default vhost (whose DocumentRoot is the server's, not the tenant's) — so the probe file is not found and the probe 404s. Hence the probe needs a list of candidate addresses, not a single hardcoded one. Every address returned here is either loopback or an address CONFIGURED ON THIS MACHINE, so the CLPRO-3179 F-08 property is preserved by construction: a tenant who repoints public DNS, or who tampers with the ``ip=`` line of their own panel domain conf, cannot steer the probe off-box — an address this machine does not own is dropped before any socket is opened. � Nz 127.0.0.1�LOOPBACK_ADDRESS� �MAX_CANDIDATESz/etc/userdatadomainsz(/var/cpanel/userdata/{username}/{domain}zB/usr/local/directadmin/data/users/{username}/domains/{domain}.conf)�dockerzbr-�virbr�veth�podmanzcni-�lxcbr�kube�raw�returnc � � | sdS t | � � � � � � dd� � d } t j |� � }n# t $ r Y dS w xY w|j s|j s|j rdS t |� � S )a� Canonical text form of an IP address, or None when unusable. Rejects anything that is not a literal IP address, so a hostname or a garbage value read out of a panel conf can never become a connect target. Link-local, unspecified and multicast addresses are dropped too: a vhost is never usefully reachable through them, and IPv6 link-local additionally needs a scope id we deliberately do not carry into a URL. N�%� r ) �str�strip�split� ipaddress� ip_address� ValueError� is_link_local�is_unspecified� is_multicast)r � candidate�parseds �R/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/probe_targets.py�_normalize_addressr U s� � � � ��t��C����� � �&�&�s�A�.�.�q�1�I���%�i�0�0���� � � � ��t�t����� �� �v� 4� ��8K� ��t� �v�;�;�s �A � A$�#A$c �t � t j � � } n4# t $ r'}t � d|� � g cY d}~S d}~ww xY wg }| � � � D ]W\ }}|D ]O}|j t j t j fvr�"t |j � � }|�|� ||f� � �P�X|S )uw (interface name, address) for every IP configured on THIS machine. Derived from the machine itself and never from anything a tenant can write — ``psutil.net_if_addrs()`` reads the kernel's interface table directly. The interface name is carried so the sweep can skip container bridges while validation still accepts every address the host really owns. zFUnable to enumerate local addresses, falling back to loopback only: %sN) �psutil� net_if_addrs� Exception�logger�warning�items�family�socket�AF_INET�AF_INET6r �address�append)� interfaces�e�found�name�entries�entryr) s r �_interface_addressesr1 k s� � ���(�*�*� � �� � � � ����_�ab�c�c�c�� � � � � � ��������� �E�#�)�)�+�+� .� .� ��g� � .� .�E��|�F�N�F�O�#D�D�D��(�� �7�7�G��"�� � �d�G�_�-�-�-�� .� �Ls � � A� A�A�Ac �^ � t t hd� t � � D � � z � � S )a/ Every IP address configured on an interface of THIS machine. This is the allowlist that keeps the probe on-box. It is deliberately the FULL set, container bridges included: if a panel record names such an address the panel is asserting the vhost is there, and refusing it would fail closed on a legitimate target. Only the blind sweep filters them (see `connect_candidates`). Loopback is always included, so a total enumeration failure degrades to the pre-existing loopback-only behaviour instead of leaving no candidate at all. c � � h | ]\ }}|��S � r4 )�.0�_namer) s r � <setcomp>z"local_addresses.<locals>.<setcomp>� s � �*`�*`�*`�~�u�g�7�*`�*`�*`� )� frozensetr r1 r4 r8 r �local_addressesr: � s1 � � �&�'�*`�*`�I]�I_�I_�*`�*`�*`�`� a� a�ar8 c �2 � d� t � � D � � S )zCLocal addresses worth probing blind, container/VM bridges excluded.c �L � g | ]!\ }}|� t � � � |��"S r4 )� startswith� _NON_HOSTING_INTERFACE_PREFIXES)r5 r. r) s r � <listcomp>z(_sweepable_addresses.<locals>.<listcomp>� s. � � x� x� x� ��g�t���Wv�Gw�Gw� x�G� x� x� xr8 )r1 r4 r8 r �_sweepable_addressesr@ � s � � x� x�)=�)?�)?� x� x� x�xr8 �path�key� separatorc �\ � ||z } t | dd�� � 5 }|D ]e}|� |� � s�|t |� � d� � � � }|� d� � pdc cddd� � S ddd� � n # 1 swxY w Y n# t $ r Y dS w xY wdS )u� First value of a top-level ``<key><separator><value>`` line in ``path``. Deliberately line-based rather than a full YAML/conf parse: we need one scalar out of two different panel formats and must not gain a parser dependency on this path. The key is required to start at column 0, so an indented key nested under some other mapping cannot be mistaken for the top-level one. A missing or unreadable file yields None — the caller simply loses one candidate. NB: not `clcommon.clconfpars.load_fast`, which clcommon does apply to these same files. Three behaviours here are deliberate and it does not share them: it returns the LAST match rather than the first, it strips the key so an INDENTED `ip:` under another mapping would be accepted (rejecting that is pinned by a test), and it lets OSError propagate where we want one lost candidate rather than a failed collection. �utf-8�replace��encoding�errorsNz'")�openr= �lenr �OSError)rA rB rC �prefix�fh�line�values r �_read_conf_valuerQ � s2 � �" �9�_�F� � �$��� ;� ;� ;� 2�r�� 2� 2�����v�.�.� � � �S��[�[�]�]�+�1�1�3�3�� �{�{�5�)�)�1�T�1�1� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2� 2���� 2� 2� 2� 2��� � � � ��t�t����� �4s; �B �A B�5 B � B �B�B �B�B � B)�(B)�domainc � � t t dd�� � 5 }|D ]�}|� d� � \ }}}|r|� � � | k r�6|� � � � d� � }t |� � dk r ddd� � dS |d � dd � � d � d � � pdc cddd� � S ddd� � n # 1 swxY w Y n# t $ r Y dS w xY wdS ) un The vhost address cPanel's flat domain index records for ``domain``. `/etc/userdatadomains` has one line per domain of EVERY type (main, addon, parked, sub), which is what makes it the right cPanel source — the per-domain userdata file exists for main domains only. Format, per clcommon's own reader (`cpapi/plugins/cpanel._parse_userdatadomains`):: sub.example.com: owner==reseller==sub==example.com==/home/o/docroot==10.0.0.8:80==10.0.0.8:443==... i.e. ``<domain>: `` then ``==``-separated fields, of which index 5 is the HTTP ``ip:port``. We parse it here rather than calling that helper: it is private, it is callback-shaped (it hands every line to a `parser` argument), and it walks a ';'-separated path list we do not want. Index 5 missing or empty is normal for a partially provisioned domain, so it just yields None. rE rF rG z: z==� N�:r r z[])rJ �_CPANEL_USERDATADOMAINS� partitionr r rK �rsplitrL )rR rN rO r. rC r �fieldss r � _cpanel_userdatadomains_addressrZ � s� � � � �)�G�I� N� N� N� G�RT�� G� G��'+�~�~�d�';�';�$��i�� � �D�J�J�L�L�F�$:�$:� � �����*�*�4�0�0���v�;�;�!�#�#� � G� G� G� G� G� G� G� G� �a�y�'�'��Q�/�/��2�8�8��>�>�F�$�F�F� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G���� G� G� G� G��� � � � ��t�t����� �4sG �C8 �A4C,� C8 �8C,� C8 � C8 �,C0�0C8 �3C0�4C8 �8 D�D� conf_pathc �j � | r t j � | � � sdS t | dd� � S )a� The ``ip=`` a DirectAdmin per-domain conf records, read from a given path. Exposed for `manager/directadmin.py`, which has already resolved the RIGHT conf for the requested name: DirectAdmin stores a subdomain's and an alias's address in the PARENT domain's conf, and only the manager knows that mapping (its `all_sites` maps both to the parent's file). Rebuilding the path from the domain name here would look for `domains/<subdomain>.conf`, which never exists. N�ip�=)�osrA �isfilerQ )r[ s r �directadmin_conf_addressra � s8 � � � �B�G�N�N�9� 5� 5� ��t� �I�t�S� 1� 1�1r8 �usernamec � � | |fD ]}|rd|v s|dv r dS �t |� � }|r|S t dft dffD ]S\ }}|� | |�� � }t j � |� � s�<t |d|� � }|r|c S �TdS )u� The address the control panel bound ``domain``'s vhost to, if recorded. This is the most precise candidate available: on a per-IP-vhost host it is the one address whose bucket actually contains the account's vhost. Read straight from the panel's own records, keyed by the panel-resolved ``username`` — never by globbing every account, so one tenant's domain name cannot select another account's record. Sources, in order: cPanel's flat index (every domain type), cPanel's per-domain userdata file (main domains — kept as a fallback for a domain the flat index has not caught up with), then DirectAdmin's per-domain conf (main domains; its subdomains and aliases arrive as `panel_address` from the manager, see :func:`directadmin_conf_address`). Plesk holds the address in the psa database and the custom-panel API does not expose it at all; both are covered by the local-address fallback in :func:`connect_candidates`, which needs no panel-specific lookup. Returns None when no record exists. The value is NOT trusted as reachable: callers must still validate it against :func:`local_addresses`. �/)�.z..NrU r^ )rb rR r] )rZ �_CPANEL_USERDATA_TEMPLATE�!_DIRECTADMIN_DOMAIN_CONF_TEMPLATE�formatr_ rA r` rQ )rb rR � component� from_index�templaterC rA rP s r �panel_domain_addressrl � s� � �< ��'� � � �� �C�9� ,� ,� �[�0H�0H��4�4� 1I� 1��8�8�J�� ��� #�C�(� *�C�0� � � ���)� ������@�@���w�~�~�d�#�#� � � ��t�Y�7�7�� � ��L�L�L� � �4r8 c � � ddl m} | � � pdS # t $ r&}t � d|� � Y d}~dS d}~ww xY w)a� The address the control panel considers this server's main one. Second-best candidate: on the common single-address host it IS the address every vhost is bound to. Imported lazily so this module stays importable in contexts where the panel API is not usable, and every panel failure mode (Plesk's DB unreachable, DirectAdmin's ip.list absent -> '', a custom panel raising NotSupported) degrades to "no candidate from this source". r )� get_server_ipNz1Control panel did not report a main server IP: %s)�clcommon.cpapirn r! r" �debug)rn r, s r �server_main_addressrq sk � ��0�0�0�0�0�0� �}���&�$�&�� � � � �� � �H�!�L�L�L��t�t�t�t�t��������s � � A�?�Ar) c �F � t j | � � }|j |j fS )zHNumeric, family-grouped ordering so the candidate list is deterministic.)r r �version�packed)r) r s r � _sort_keyru . s! � � � !�'� *� *�F� �N�F�M� *�*r8 � panel_addressc �( ���� t � � �t g�dt dz dt ddf���fd� } ||pt | �� � d� � |t � � d� � t t t � � � � t �� � D ](}t j |� � j r� ||d � � �)t �� � t k r9t � d t t �� � �� � �t d�= �S ) u5 Ordered connect targets to try for ``domain``'s phpinfo probe. Ordering is by decreasing confidence, so the common case resolves on the first or second attempt: 1. ``127.0.0.1`` — unchanged first attempt; the only target a wildcard-listener vhost needs. 2. the panel's per-domain address — on a per-IP-vhost host, the exact address whose bucket holds this account's vhost. Taken from ``panel_address`` when the caller resolved it (DirectAdmin must: it records a subdomain's address in the parent domain's conf), else looked up here. 3. the panel's main server address — right on a single-address host, and on a multi-address host when the domain sits on the primary. 4. this machine's remaining addresses — the panel-independent safety net that covers Plesk and custom panels (no per-domain record to read) and a stale panel record. Container/VM bridges are excluded from this blind sweep; a panel record naming one is still honoured via source 2. Sources 2 and 3 are panel-reported and therefore validated against :func:`local_addresses` before being accepted; source 4 is drawn from it. So every returned address is one this machine owns and no off-box address is ever connected to, whatever a panel record or DNS says. r N�sourcer c � �� t | � � }|�d S |�vr t � d||�� � d S |�vr�� |� � d S d S )NzIIgnoring %s address %s for domain %s probe: not configured on this server)r r" r# r* )r rx r) � candidatesrR �locals ���r �acceptz"connect_candidates.<locals>.acceptO s} �� �$�S�)�)�� �?� �F� �%� � � �N�N�[���� � � � �F� �*� $� $� � � �g� &� &� &� &� &� %� $r8 zpanel per-domainzpanel main server)rB zlocal interfaceznProbing only the first %d of %d connect candidates for domain %s; the vhost address may be among those dropped)r: r r rl rq �sorted�setr@ ru r r � is_loopbackrK r r" r# )rb rR rv r| r) rz r{ s ` @@r �connect_candidatesr� 4 sG ���� �0 � � �E�"�#�J�'�C�$�J� '�� '�� '� '� '� '� '� '� '� '�& �F�=� B� 0��6� B� B�DV�W�W�W� �F� � � �"5�6�6�6��#� 2� 4� 4�5�5�9�E�E�E� +� +�� � �� (� (� 4� � ���w�)�*�*�*�*� �:��� �'�'� ��� ;� � � �O�O� � � � � �~��� '� �r8 )N) �__doc__r �loggingr_ r& r � getLogger�__name__r" r r �__annotations__r �intrV rf rg r> r �listr1 r9 r: r@ rQ rZ ra rl rq ru r� r4 r8 r �<module>r� sb �� � � �@ � � � � ���� � � � � � � � � � � � � �� �8� $� $�� $� �#� #� #� #� ��� � � � 1� � F� � %i� !� #h� ��C�$�J� �3��:� � � � �,�d� � � � �2 b�� b� b� b� b� y�d� y� y� y� y� �3� �S� �S� �S�4�Z� � � � �F �C� �C�$�J� � � � �B 2�� 2��d� � 2� 2� 2� 2� 0�3� 0�� 0��d� � 0� 0� 0� 0�f�S�4�Z� � � � �$+�s� +� +� +� +� F� F�� F�c� F�#��*� F�X\�]`�Xa� F� F� F� F� F� Fr8
💾 Save
❌ Cancel
