CHips L MINI SHELL

CHips L pro

Current Path : /proc/self/root/scripts/
Upload File :
Current File : //proc/self/root/scripts/cpuser_port_authority

#!/usr/local/cpanel/3rdparty/bin/perl
# cpanel - scripts/cpuser_port_authority             Copyright 2018 cPanel, Inc.
#                                                           All rights Reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

use strict;
use warnings;

package scripts::cpuser_port_authority;

use Cpanel::JSON                    ();
use Cpanel::Transaction::File::JSON ();
use Cpanel::Config::LoadUserDomains ();
use Cpanel::Debug                   ();
use Cpanel::Validate::Username      ();

our $port_authority_conf = "/etc/cpanel/cpuser_port_authority.json";

my $cmds = {
    give => {
        code     => \&give,
        clue     => "give <user> <number of ports> [--service=my_app]",
        abstract => 'Give a user 1 or more ports.',
        help     => "Give a user 1 or more ports, that only they can run a service on.\n  --service=<NAME>  this will tie a service name, as appropriate for scripts/cpuser_service_manager, to the ports for reference",
    },
    take => {
        code     => \&take,
        clue     => "take <user> <port-number> [<port-number> <port-number> …]",
        abstract => "Take 1 or more ports from a user.",
        help     => "Take 1 or more ports from a user. Errors out completely if any of the given ports do not belong to them.",
    },
    list => {
        code     => \&list,
        clue     => "list [<user>]",
        abstract => "List port assignment information.",
        help     => "List port assignment information. If given a user it lists only that user’s information. The output is in human friendly JSON format.",
    },
    fw => {
        code     => sub { _setup_firewall() },
        clue     => "fw",
        abstract => "Setup Firewall",
        help     => "Setup the firewall rules to match the configured port assignments",
    },
    user => {
        code     => \&user,
        clue     => "user (remove|change) <user> [<new_user>]",
        abstract => "Operate on a given user’s port assignments",
        help     => "Remove all ports owned by the given user. Change port ownership from <user> to <new_user>.",
    },
};

my $hint_blurb = "Usage: `$0 {command} …`.\n\tThis tool supports the following commands:";
my $opts       = {
    'help:pre_hint'  => $hint_blurb,
    'help:pre_help'  => "Various user-assigned-port related admin utilities\n\n$hint_blurb",
    default_commands => "help",
    alias            => { free => "take", firewall => "fw" },
};

run(@ARGV) if !caller;

sub run {
    my (@argv) = @_;
    die "This script should only be called as root\n" if $> != 0;

    local $ENV{TERM} = $ENV{TERM} || "xterm-256color";    # non-CLI modulino avoid needless: Cannot find termcap: TERM not set at …/Term/ReadLine.pm line 373.
    require App::CmdDispatch;
    import App::CmdDispatch;

    # need to have App::CmdDispatch do this automatically see CPANEL-22328
    if ( @argv && grep { defined && m/\A\-\-help\z/ } @argv ) {
        App::CmdDispatch->new( $cmds, $opts )->help();
        exit(0);
    }

    my $orig_command_hint = \&App::CmdDispatch::command_hint;
    no warnings "redefine";
    local *App::CmdDispatch::command_hint = sub {
        $orig_command_hint->(@_);
        exit(1);
    };
    no warnings 'once';
    require App::CmdDispatch::IO;
    local *App::CmdDispatch::IO::print = sub {
        shift;
        if ( ref($@) && $@ =~ m/^App::CmdDispatch::Exception/ ) {
            CORE::print STDERR @_;
            return;
        }
        CORE::print(@_);
        return;
    };
    use warnings 'once';

    # ^^^ /need to have App::CmdDispatch do this automatically see CPANEL-22328

    if ( $ARGV[0] && $ARGV[0] eq 'help' ) {
        require Cpanel::Services::Firewall;
        if ( Cpanel::Services::Firewall::is_firewalld() ) {
            $opts->{'help:post_help'} = _get_firewalld_caveat();
        }
    }

    return App::CmdDispatch->new( $cmds, $opts )->run(@argv);
}

################
#### commands ##
################

sub give {
    my ( $app, $user, $count, @flags ) = @_;
    _validate_user_arg( $app, $user );

    if ( !defined $count || $count !~ m/^[1-9][0-9]*$/ ) {
        _bail( $app, "The number of ports you want assigned must be a whole number greater than 0." );
    }

    my @ports = _get_next_n_ports($count);    # dies if it can't get $count ports
    _add_conf( $app, $user => \@ports, @flags );    # dies if port is already assigned (i.e. raced from _get_next_n_ports()), dies if it can’t save

    for my $port (@ports) {
        print "$port\n";
    }

    _setup_firewall();
    return;
}

sub take {
    my ( $app, $user, @ports ) = @_;
    _validate_user_arg( $app, $user );

    die "No ports given.\n" if !@ports;

    my $transaction = Cpanel::Transaction::File::JSON->new(
        path        => $port_authority_conf,
        permissions => 0640,
    );

    my $data = $transaction->get_data();
    my $hr   = ref($data) eq 'HASH' ? $data : {};

    for my $port (@ports) {
        if ( !defined $port || $port !~ m/^[1-9][0-9]*$/ ) {
            die "Invalid port.\n";
        }
        elsif ( !exists $hr->{$port} ) {
            die "“$port” is not assigned.\n";
        }
        elsif ( $hr->{$port}{owner} ne $user ) {
            die "“$port” is not owned by “$user”.\n";
        }
        else {
            delete $hr->{$port};
        }
    }

    $transaction->set_data($hr);
    _write_transaction($transaction);
    _setup_firewall();
    return;
}

sub user {
    my ( $app, $action, $user, $new_user ) = @_;

    die "invalid action for `user` subcommand\n" if !defined $action || ( $action ne "remove" && $action ne "change" );
    _validate_user_arg( $app, $user );

    if ( $action eq "change" ) {
        die "New username is not valid.\n" if !defined $new_user || !Cpanel::Validate::Username::is_strictly_valid($new_user);
        die "Too many arguments.\n" if @_ > 4;
    }
    else {
        die "Too many arguments.\n" if @_ > 3;
    }

    my $transaction = Cpanel::Transaction::File::JSON->new(
        path        => $port_authority_conf,
        permissions => 0640,
    );

    my $data = $transaction->get_data();
    my $hr   = ref($data) eq 'HASH' ? $data : {};

    my $count = 0;
    for my $port ( sort keys %{$hr} ) {
        if ( $hr->{$port}{owner} eq $user ) {
            $count++;
            if ( $action eq "change" ) {
                $hr->{$port}{owner} = $new_user;
            }
            else {
                delete $hr->{$port};
            }
        }
    }

    if ($count) {
        $transaction->set_data($hr);
        _write_transaction($transaction);
        _setup_firewall();
    }
    else {
        eval { $transaction->close_or_die; };
        warn $@ if $@;
    }

    print "", ( $action eq "change" ? "Updated" : "Removed" ), ": $count\n";
    return;
}

sub list {
    my ( $app, $user ) = @_;

    my $hr = eval { Cpanel::JSON::LoadFile($port_authority_conf) } || {};

    if ( $user || @_ == 2 ) {
        _validate_user_arg( $app, $user );

        for my $port ( keys %{$hr} ) {
            delete $hr->{$port} if $hr->{$port}{owner} ne $user;
        }
    }

    print Cpanel::JSON::pretty_canonical_dump($hr);

    return;
}

###############
#### helpers ##
###############

sub _setup_firewall {

    require Cpanel::Services::Firewall;
    if ( Cpanel::Services::Firewall::is_firewalld() ) {
        warn _get_firewalld_caveat() . "\n";
    }

    print "Setting up firewall …\n";

    require Capture::Tiny;
    my ( $out, $rv ) = Capture::Tiny::capture_merged( \&Cpanel::Services::Firewall::setup_firewall );

    if ($rv) {    # setup_firewall() RV is suitable for exit($rv||0)
        warn "Firewall setup reported a problem. Please run /usr/local/cpanel/scripts/configure_firewall_for_cpanel to ensure the firewall is OK.\n";
        return;
    }
    else {
        print " … done.\n";
    }

    return 1;
}

sub _validate_user_arg {
    my ( $app, $user ) = @_;

    _bail( $app, "The user argument is missing." ) if !$user;

    if ( $user ne "root" ) {
        my $user_lookup = Cpanel::Config::LoadUserDomains::loaduserdomains( undef, 0, 1 );
        _bail( $app, "The given user is not a cPanel user.\n" ) if !$user_lookup->{$user};
    }

    return 1;
}

sub _get_next_n_ports {
    my ($n) = @_;

    my ( $bottom_min, $bottom_max, $top_min, $top_max ) = _get_port_ranges();
    my $port;    # buffer

    my @ports;
    for $port ( $bottom_min .. $bottom_max ) {
        push @ports, $port if !_is_port_assigned($port);
        last if @ports == $n;
    }

    return @ports if @ports == $n;

    if ( defined $top_min ) {
        for $port ( $top_min .. $top_max ) {
            push @ports, $port if !_is_port_assigned($port);
            last if @ports == $n;
        }
    }

    die "Not enough free ports (wanted $n)\n" if @ports != $n;
    return @ports;
}

my $lookup_cache;

sub _add_conf {
    my ( $app, $user, $ports, @flags ) = @_;

    # There is an old unused system (to be deprecated/removed via CPANEL-22447) that uses
    #    /var/cpanel/portassignments.db (YAML) && /etc/portassignments (key: value version of the .db file …)
    # We could import those here if they exist but probably YAGNI.

    my $service;
    for my $flag (@flags) {
        if ( defined $flag && $flag =~ m/^\-\-service/ ) {
            $service = $flag;
            $service =~ s/^\-\-service//;
            $service =~ s/^=//;             # do this sperately in case they just pass `--service` or `--service=`
            if ( $service !~ m/^[\w-]+(?:\.[\w-]+)*$/ ) {    # regexp is $service_name_re from Ubic.pm v1.60
                _bail( $app, "Invalid service name" );
            }
        }
    }

    my $transaction = Cpanel::Transaction::File::JSON->new(
        path        => $port_authority_conf,
        permissions => 0640,
    );

    my $data = $transaction->get_data();
    my $hr   = ref($data) eq 'HASH' ? $data : {};

    for my $port ( @{$ports} ) {
        die "port “$port” already assigned (is someone else logged in as root and running this script?)\n" if exists $hr->{$port};
        $hr->{$port} = { owner => $user };
        $hr->{$port}{service} = $service if $service;
    }

    $transaction->set_data($hr);
    _write_transaction($transaction);

    return;
}

sub _write_transaction {
    my ($transaction) = @_;

    eval {
        $transaction->save_pretty_canonical_or_die();
        $transaction->close_or_die();
    };
    warn $@ if $@;

    $lookup_cache = undef;

    return;
}

sub _get_cmd {
    return $cmds;
}

sub _bail {
    my ( $app, $msg ) = @_;
    chomp($msg);

    die "$msg\n" if $ENV{ __PACKAGE__ . "::bail_die" };    # for API calls, otherwise:

    warn "$msg\n";
    $app->help();
    exit(1);                                               # there is no return()ing from this lol
}

sub _is_port_assigned {
    my ($port) = @_;

    if ( !$lookup_cache ) {
        $lookup_cache = eval { Cpanel::JSON::LoadFile($port_authority_conf) } || {};
    }

    return exists $lookup_cache->{$port};
}

my ( $bottom_min, $bottom_max, $top_min, $top_max );

sub _get_port_ranges {
    if ( !defined $bottom_min ) {

        # even if FTP is disabled ATM, it could be re-enabled (¿TODO/YAGNI? only factor these in if FTP is currently enabled
        my ( $passive_ftp_start, $passive_ftp_end ) = ( 49_152, 65_534 );

        no warnings "redefine";
        local *Cpanel::Debug::log_warn = sub { };    # facepalm …
        require Cpanel::FtpUtils::Config;
        my $ftp_conf          = Cpanel::FtpUtils::Config->new->get_config;
        my $ftp_passive_range = $ftp_conf->{PassivePortRange} || $ftp_conf->{PassivePorts};
        if ($ftp_passive_range) {
            ( $passive_ftp_start, $passive_ftp_end ) = split( /\s+/, $ftp_passive_range );
        }

        my ( $ephemeral_start, $ephemeral_end ) = ( 49_152, 65_535 );    # IANA defaults

        require File::stat;
        if ( File::stat::stat("/proc/sys/net/ipv4/ip_local_port_range") ) {
            require Path::Tiny;
            my $ip_local_port_range_raw = Path::Tiny::path("/proc/sys/net/ipv4/ip_local_port_range")->slurp;
            chomp($ip_local_port_range_raw);
            ( $ephemeral_start, $ephemeral_end ) = split( /\s+/, $ip_local_port_range_raw );

            if ( $ephemeral_start > $passive_ftp_start ) {
                $ephemeral_start = $passive_ftp_start;
            }

            if ( $ephemeral_end < $passive_ftp_end ) {
                $ephemeral_end = $passive_ftp_end;
            }
        }

        $ephemeral_start = 10_001 if $ephemeral_start < 10_001;
        $ephemeral_end = $ephemeral_start + 1 if $ephemeral_end < $ephemeral_start;

        ( $bottom_min, $bottom_max, $top_min, $top_max ) = ( 10_000 => ( $ephemeral_start - 1 ), ( $ephemeral_end + 1 ) => 65535 );

        if ( $ephemeral_end >= 65535 ) {
            ( $top_min, $top_max ) = ( undef, undef );
        }
    }

    return ( $bottom_min, $bottom_max, $top_min, $top_max );
}

sub _silent_sys {
    my (@sys) = @_;
    require Capture::Tiny;
    my ( $out, $exit ) = Capture::Tiny::capture_merged( sub { system(@sys) } );
    die "`@sys` exited unclean ($exit)\n" if $exit;    #TODO/YAGNI: output $out if --verbose
    return;
}

sub _get_firewalld_caveat {

    my $message = <<"END_FIREWALLD";
ℹ️  [Caveat] Currently, firewalld does not respect port ownership assignments.

To enforce port ownership, you must use iptables tables instead.

We will update this system when the functionality is available.
END_FIREWALLD

    require Cpanel::Output::Formatted::Terminal;
    return Cpanel::Output::Formatted::Terminal->new->format_message( "bold black on_blue" => $message );
}

1;

Copyright 2K16 - 2K18 Indonesian Hacker Rulez