Wj~G
n U d Z ddlZddlZddlZddlZddlZ ej e ZdZ e
e d< dZ e
e d< dZdZd Zd
Zd e
dz d e
dz fd
Zd efdZd efdZd efdZde
de
de
d e
dz fdZde
d e
dz fdZde
d e
dz fdZde
de
d e
dz fdZd e
dz fdZ d e
fd Z d de
de
d e
dz d ee
fd Z dS )!u Connect-target resolution for the per-domain phpinfo probe.
The probe in :mod:`xray.internal.phpinfo_utils` fetches a temporary file from a
vhost hosted on THIS machine. The hostname is tenant-controlled and resolves via
public DNS, so following DNS would let a tenant repoint their domain at an
arbitrary host and turn the root daemon's probe into an SSRF primitive
(CLPRO-3179 finding F-08 — the repo also uses a bare "F-08" for an unrelated
CLPRO-3240 finding in `cron/xray-tasks`, so this one is always qualified here).
The probe therefore never resolves the hostname: it connects to an address this
module returns and passes the domain in the ``Host`` header.
Pinning to 127.0.0.1 *alone* (the original CLPRO-3179 F-08 fix) silently assumed the local
webserver routes purely by name. That holds for a wildcard listener (the
nginx-fronted default) but NOT for the per-IP vhosts DirectAdmin and cPanel
generate by default::
# the account's vhost
Listen 80 # but the server listens everywhere
A request arriving on the loopback address falls into the ``127.0.0.1:80``
address bucket, matches no vhost there, and is answered by that bucket's default
vhost (whose DocumentRoot is the server's, not the tenant's) — so the probe file
is not found and the probe 404s. Hence the probe needs a list of candidate
addresses, not a single hardcoded one.
Every address returned here is either loopback or an address CONFIGURED ON THIS
MACHINE, so the CLPRO-3179 F-08 property is preserved by construction: a tenant who repoints
public DNS, or who tampers with the ``ip=`` line of their own panel domain conf,
cannot steer the probe off-box — an address this machine does not own is dropped
before any socket is opened.
Nz 127.0.0.1LOOPBACK_ADDRESS MAX_CANDIDATESz/etc/userdatadomainsz(/var/cpanel/userdata/{username}/{domain}zB/usr/local/directadmin/data/users/{username}/domains/{domain}.conf)dockerzbr-virbrvethpodmanzcni-lxcbrkuberawreturnc | sdS t | dd d } t j | }n# t
$ r Y dS w xY w|j s|j s|j rdS t | S )a Canonical text form of an IP address, or None when unusable.
Rejects anything that is not a literal IP address, so a hostname or a
garbage value read out of a panel conf can never become a connect target.
Link-local, unspecified and multicast addresses are dropped too: a vhost is
never usefully reachable through them, and IPv6 link-local additionally
needs a scope id we deliberately do not carry into a URL.
N% r ) strstripsplit ipaddress
ip_address
ValueError
is_link_localis_unspecified is_multicast)r candidateparseds R/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/internal/probe_targets.py_normalize_addressr U s tC &&sA..q1I%i00 tt
v 4 8K t v;;s A
A$#A$c t t j } n4# t $ r'}t d| g cY d}~S d}~ww xY wg }| D ]W\ }}|D ]O}|j t j t j fvr"t |j }|| ||f PX|S )uw (interface name, address) for every IP configured on THIS machine.
Derived from the machine itself and never from anything a tenant can write —
``psutil.net_if_addrs()`` reads the kernel's interface table directly. The
interface name is carried so the sweep can skip container bridges while
validation still accepts every address the host really owns.
zFUnable to enumerate local addresses, falling back to loopback only: %sN)
psutil net_if_addrs ExceptionloggerwarningitemsfamilysocketAF_INETAF_INET6r addressappend)
interfacesefoundnameentriesentryr) s r _interface_addressesr1 k s (**
_abccc
E#))++ . .
g . .E|FNFO#DDD( 77G" dG_--- . Ls
A AAAc ^ t t hd t D z S )a/ Every IP address configured on an interface of THIS machine.
This is the allowlist that keeps the probe on-box. It is deliberately the FULL
set, container bridges included: if a panel record names such an address the
panel is asserting the vhost is there, and refusing it would fail closed on a
legitimate target. Only the blind sweep filters them (see `connect_candidates`).
Loopback is always included, so a total enumeration failure degrades to the
pre-existing loopback-only behaviour instead of leaving no candidate at all.
c h | ]\ }}|S r4 ).0_namer) s r z"local_addresses.. s *`*`*`~ug7*`*`*` ) frozensetr r1 r4 r8 r local_addressesr: s1 &'*`*`I]I_I_*`*`*`` a aar8 c 2 d t D S )zCLocal addresses worth probing blind, container/VM bridges excluded.c L g | ]!\ }}| t |"S r4 )
startswith _NON_HOSTING_INTERFACE_PREFIXES)r5 r. r) s r
z(_sweepable_addresses.. s. x x x
gtWvGwGw xG x x xr8 )r1 r4 r8 r _sweepable_addressesr@ s x x)=)?)? x x xxr8 pathkey separatorc \ ||z } t | dd 5 }|D ]e}| | s|t | d }| d pdc cddd S ddd n # 1 swxY w Y n# t $ r Y dS w xY wdS )u First value of a top-level ```` line in ``path``.
Deliberately line-based rather than a full YAML/conf parse: we need one
scalar out of two different panel formats and must not gain a parser
dependency on this path. The key is required to start at column 0, so an
indented key nested under some other mapping cannot be mistaken for the
top-level one. A missing or unreadable file yields None — the caller simply
loses one candidate.
NB: not `clcommon.clconfpars.load_fast`, which clcommon does apply to these
same files. Three behaviours here are deliberate and it does not share them:
it returns the LAST match rather than the first, it strips the key so an
INDENTED `ip:` under another mapping would be accepted (rejecting that is
pinned by a test), and it lets OSError propagate where we want one lost
candidate rather than a failed collection.
utf-8replaceencodingerrorsNz'")openr= lenr OSError)rA rB rC prefixfhlinevalues r _read_conf_valuerQ s2 " 9_F
$
;
;
;
2r
2
2v..
S[[]]+1133 {{5))1T11
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2 tt 4s; B A B5 B B BB BB
B)(B)domainc t t dd 5 }|D ]}| d \ }}}|r| | k r6| d }t | dk r ddd dS |d dd d
d pdc cddd S ddd n # 1 swxY w Y n# t $ r Y dS w xY wdS ) un The vhost address cPanel's flat domain index records for ``domain``.
`/etc/userdatadomains` has one line per domain of EVERY type (main, addon,
parked, sub), which is what makes it the right cPanel source — the per-domain
userdata file exists for main domains only. Format, per clcommon's own reader
(`cpapi/plugins/cpanel._parse_userdatadomains`)::
sub.example.com: owner==reseller==sub==example.com==/home/o/docroot==10.0.0.8:80==10.0.0.8:443==...
i.e. ``: `` then ``==``-separated fields, of which index 5 is the HTTP
``ip:port``. We parse it here rather than calling that helper: it is private,
it is callback-shaped (it hands every line to a `parser` argument), and it
walks a ';'-separated path list we do not want. Index 5 missing or empty is
normal for a partially provisioned domain, so it just yields None.
rE rF rG z: z== N:r r z[])rJ _CPANEL_USERDATADOMAINS partitionr r rK rsplitrL )rR rN rO r. rC r fieldss r _cpanel_userdatadomains_addressrZ s
)GI
N
N
N
GRT
G
G'+~~d';';$i DJJLLF$:$: **400v;;!##
G
G
G
G
G
G
G
G ay''Q//288>>F$FF
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G tt 4sG C8 A4C,
C8 8C, C8 C8 ,C00C8 3C04C8 8
DD conf_pathc j | r t j | sdS t | dd S )a The ``ip=`` a DirectAdmin per-domain conf records, read from a given path.
Exposed for `manager/directadmin.py`, which has already resolved the RIGHT
conf for the requested name: DirectAdmin stores a subdomain's and an alias's
address in the PARENT domain's conf, and only the manager knows that mapping
(its `all_sites` maps both to the parent's file). Rebuilding the path from the
domain name here would look for `domains/.conf`, which never exists.
Nip=)osrA isfilerQ )r[ s r directadmin_conf_addressra s8 BGNN9 5 5 t ItS 1 11r8 usernamec | |fD ]}|rd|v s|dv r dS t | }|r|S t dft dffD ]S\ }}| | | }t j | s '', a custom panel
raising NotSupported) degrades to "no candidate from this source".
r )
get_server_ipNz1Control panel did not report a main server IP: %s)clcommon.cpapirn r! r" debug)rn r, s r server_main_addressrq sk 000000 }&$& H!LLLttttts
A?Ar) c F t j | }|j |j fS )zHNumeric, family-grouped ordering so the candidate list is deterministic.)r r versionpacked)r) r s r _sort_keyru . s!
!'
*
*F NFM **r8
panel_addressc ( t t gdt dz dt ddffd } ||pt | d |t d t t
t t D ](}t j
| j r ||d )t t k r9t d
t t t d= S ) u5 Ordered connect targets to try for ``domain``'s phpinfo probe.
Ordering is by decreasing confidence, so the common case resolves on the
first or second attempt:
1. ``127.0.0.1`` — unchanged first attempt; the only target a
wildcard-listener vhost needs.
2. the panel's per-domain address — on a per-IP-vhost host, the exact
address whose bucket holds this account's vhost. Taken from
``panel_address`` when the caller resolved it (DirectAdmin must: it records
a subdomain's address in the parent domain's conf), else looked up here.
3. the panel's main server address — right on a single-address host, and on
a multi-address host when the domain sits on the primary.
4. this machine's remaining addresses — the panel-independent safety net
that covers Plesk and custom panels (no per-domain record to read) and a
stale panel record. Container/VM bridges are excluded from this blind
sweep; a panel record naming one is still honoured via source 2.
Sources 2 and 3 are panel-reported and therefore validated against
:func:`local_addresses` before being accepted; source 4 is drawn from it. So
every returned address is one this machine owns and no off-box address is
ever connected to, whatever a panel record or DNS says.
r Nsourcer
c t | }|d S |vr t d|| d S |vr | d S d S )NzIIgnoring %s address %s for domain %s probe: not configured on this server)r r" r# r* )r rx r)
candidatesrR locals r acceptz"connect_candidates..acceptO s} $S)) ? F %
NN[
F * $ $ g & & & & & % $r8 zpanel per-domainzpanel main server)rB zlocal interfaceznProbing only the first %d of %d connect candidates for domain %s; the vhost address may be among those dropped)r: r r rl rq sortedsetr@ ru r r is_loopbackrK r r" r# )rb rR rv r| r) rz r{ s ` @@r connect_candidatesr 4 sG 0
E"#J'C$J ' ' ' ' ' ' ' ' ' '& F= B 06 B BDVWWW
F "5666# 2 4 4559EEE + +
( ( 4 w)****
: ''
;
OO
~ ' r8 )N) __doc__r loggingr_ r& r getLogger__name__r" r r __annotations__r intrV rf rg r> r listr1 r9 r: r@ rQ rZ ra rl rq ru r r4 r8 r r sb
@
8 $ $ $ # # # # 1 F %i ! #h C$J 3: ,d 2 b b b b b yd y y y y
3 S S S4Z F C C$J B 2 2d
2 2 2 2 03 0 0d
0 0 0 0fS4Z $+s + + + + F F Fc F#* FX\]`Xa F F F F F Fr8