VULN_CHECK_I913V6 7< ddlZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z ddl m Z m Z ddlmZddlmZddlmZmZmZmZmZddlmZmZmZmZddlmZdd lm Z dd l!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,dd l-m.Z.dd l/m0Z0ddl1m2Z2edZ3e4gdZ5ej6dZ7de8fdZ9Gddej:j;Z<Gddej=Z>dZ?dZ@eGddZAdeBfdZCdZDd-dZEd-de eAfdZFd-d ZGd!ZHd"ZId#ZJd$ZKd%ZLd&ZMd'ZNd(ZOePd)kreQejRZSe3Td*eSee&eS5ed+e d,e#ejejUe?ejejVe@ejWZXeXYeOddddS#1swxYwYdSdS).N)datetime timedelta)ListOptional) dataclass)or_) ScrapeResult DomainAlertssetup_database session_scopecleanup_old_data) get_domains setup_loggersave_pid_and_lock intersect)init_sentry_client)get_pkg_version)PING_TIMEOUT_STATUS_CODE SENTRY_DNS!ERROR_DOMAINS_PING_RETRY_INTERVALERROR_DOMAINS_ALERT_INTERVAL WMT_LOCK_FILEPING_CONNECTIONS&LICENSE_EXPIRED_FAREWELL_LETTER_MARKERLICENSE_CHECK_PAUSE)NotifierSupportedNotificationTypes) ErrorReport)cfg)CloudlinuxLicenseLib wmt_scanner) is_loopback is_private is_link_local is_reservedz 100.64.0.0/10returnc tj|n#t$rYdSwxYwtdd}||t fdt DrdSjdkr tvrdSdS)z True if `host` is a literal IP in a non-routable / blocked range. Hostnames return False -- they are filtered after resolution by _SafeResolver. F ipv4_mappedNc38K|]}t|VdSN)getattr).0propips /builddir/build/BUILDROOT/cl-web-monitoring-tool-3.2.6-1.el10.cloudlinux.x86_64/opt/cloudlinux/venv/lib/python3.11/site-packages/wmt/main.py z!_is_blocked_ip..Bs- @ @72t   @ @ @ @ @ @T) ipaddress ip_address ValueErrorr+any_BLOCKED_IP_PROPERTIESversion_CGNAT_NETWORK)hostmappedr.s @r/_is_blocked_ipr<4s   !$ ' ' uuR - -F   @ @ @ @)? @ @ @@@t zQ2//t 5s  &&c&eZdZdZdZddZdZdS) _SafeResolverz Wraps aiohttp's ThreadedResolver and drops any resolved address that falls in a blocked range, closing the DNS-rebinding-to-internal-host vector. c2tj|i||_dSr*)aiohttpThreadedResolver _resolver)selfargskwargss r/__init__z_SafeResolver.__init__Os 14B6BBr1rNcK|"|j||d{V}n"|j|||d{V}d|D}|std||S)Nc<g|]}t|d|S)r:)r<)r,hs r/ z)_SafeResolver.resolve..Ws)BBBaqy(A(ABBBBr1zNo routable address for )rBresolveOSError)rCr:portfamilyhostssafes r/rKz_SafeResolver.resolveRs >.00t<<<<<<<r>IsS CCC%%%%%r1r>c$eZdZdZdfd ZxZS)_SafeTCPConnectorz Rejects IP-literal hosts in a blocked range before connecting. aiohttp's stock _resolve_host short-circuits IP literals and skips the resolver, which would otherwise leave redirect targets like http://169.254.169.254/ unfiltered. NcKt|rtd|t|||d{VS)NzBlocked non-routable address: )traces)r<rLsuper _resolve_host)rCr:rMr[ __class__s r/r]z_SafeTCPConnector._resolve_hostgs` $   CA4AABB BWW**4f*EEEEEEEEEr1r*)rSrTrUrVr] __classcell__)r^s@r/rYrY`sQ FFFFFFFFFFr1rYctjdtjD}tdt |dS)Nc&i|]\}}|dk ||S) report_emailrW)r,kvs r/ zreload_conf..os(PPP41aA._fetchsIKKE G";;z<;HHD18u1E1E UDH :I+!),TTY[[55H-I)J)J%2 N N N' 6N9E9LNNNNNN,8 G G G( #FFFFFF Gs;B<A!B)B<) B33B<6B37B<<.D,$DDzhttps://zhttp://) startswithlenryrw) rvrr semaphorer https_urlhttp_url https_result http_results `` r/pingrs'&&&&&&&& G G G G G G( >>* % % 'I 3s:'7'7#88HH ^^I & & '"SY%99IHH(3((I&H#VI........ '* $  % , ,E&&&&&&&&&&&&&&H#F8,,,,,,,, &) #M&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&sBC%9C%% C/2C/c#Kt}||t|z}tdt ||D]*}t j|st||||V+dS)z ping_timeout: specified in config timeout time (s) for request semaphore: semaphore obj to handle asyncio tasks ping_target_domains: mostly needed for re-pinging error domains Nz Those domains will be pinged: %s)rsetridebugrkris_domain_ignoredr)rrrping_target_domainsdomainsdomains r/ executorsrs mmG&3*+++ LL3S\\BBBAA$V,, Av|Wi@@ @ @ @AAr1cKtt||||}t|dkrgSd|D} tjtj||d{VS#tj$rjg}|D]*}|s|+|D]3} | |d{V#tj $rY0wxYw|cYSwxYw)Nrc6g|]}tj|SrW)asyncio create_task)r,coros r/rJz scrape_sites..s# > > >4W  & & > > >r1r) listrrrwait_forgatherrdonecancelappendCancelledError) ping_site_timeout ping_intervalrrr coroutinestasksresultstasks r/ scrape_sitesrs1i 17IGZ[[\\J :! > >: > > >E %gne&D,,D03D0:*F11F58F5c tjttz }t |5}|t jt j t| tt j |kt jdk}d|DcdddS#1swxYwYdS)z - gets websites that must NOT be included in alert email: less than ERROR_DOMAINS_ALERT_INTERVAL passed or is_resolved marker was not changed from last alerting )hoursFcg|] }|j SrWrr,rows r/rJz%get_recent_alerts..s888 888r1N)rnowrrr rr rrrrkeysr alert_timer)r alert_domainsrepeat_intervalrrecently_alerteds r/get_recent_alertsr s lnny7S'T'T'TTO v  9'"==)=>> VL(,,T-2D2D2F2F-G-GHH //A$0E9;;<< 98'7888 999999999999999999sB%C++C/2C/c Ztdtt|d|D}t tjtj d|itj  |S)z prepares needed error report object with error domains to be alerted and sends this mail returns alerted domains zAlerts will be sent for %sc g|]W\}}t|dttt |t |XS)z, )rvcode count_errors)rjoinmaprkrr)r,rcodess r/rJzalert..$sh FE 3sCJJ//00U   r1 error_report target_email from_emailreportnotification_type) rirjrkrrrhrrrrrALERTnotify) domains_datars r/alertrs  KK,D**,,--..000 *//11 L %> L 5: <<< =CFHHH r1c `t||fd|D}|sOtdt t |tdSt|tj }t|5}| ttj}d|D}|D]}||vr^| ttj|kt'|dd|t|| ddddS#1swxYwYdS)aJ - gets recently alerted domains (those that must not be alerted again) and does not include them for alerting - calls alerting for left domains - updates DomainAlerts table: if website was not alerted -> adds new record if website was alerted before -> updates alert time and is_resolved marker c$i|] \}}|v || SrWrW)r,rcrdrs r/rez flush_alerts..@s*\\\A!K[B[B[1B[B[B[r1zDAll domains "%s" were alerted or still not resolved in last %d hoursNcg|] }|j SrWrrs r/rJz flush_alerts..Ns000 000r1F)rr)rr)rrhrirjrkrrrrrrr rr with_entitiesrallrrrr) rrdomains_to_alertrrwebsitesurlsrrs @r/ flush_alertsr6s)??\\\\)<)<)>)>\\\  Z]//1122330 2 2 2   ,..C v   J'==.. ]</ 0 0 SUU 10x000& J JF~~ l++VL0F:;;VDCUCCCDDDD LCHHHIIII  J J J J J J J J J J J J J J J J J J Js4C!F##F'*F'c0|rtjjrdSdS)NTF)ralert_notifications_enabled) error_domainss r/should_be_repingedrXs <t 5r1ctjtr5tdtjtdSdS)NzCloudLinux license was updated)ospathexistsrrirjremoverWr1r/cleanup_farewell_letter_markerr^sM w~~<==: 4555 899999::r1cd tjts_tdt tjtj itj  dSdS#t$rtdYdSwxYw)z@ Sends farewell letter once (if it was not sent before) z/Going to send last email about expired license!rz$Error while managing farewell letterN)rrrrriwarningrrrrrFAREWELLr Exception exceptionrWr1r/manage_license_farewellrds Aw~~DEE P NNL M M M  ->"<"E  G G GHNvxxxxx  P P AAA?@@@@@@AsBB$B/.B/c Ktj}tjjdz} tt |t }t tjddrtj|}nt|t}tj |4d{V}tj |}ttjj|||d{V}t!||} t#| rt$dt)|  tjjdz}|t*krtj|z } tjt/t1t*| z d d d{V| t*krottjj||||  d{V} t!|| | } t5| | } nnt5|| } | }n| rWt$d t)t7| t9|| ng} dddd{Vn#1d{VswxYwYn*#t:$rt$dYnwxYw tjjdz}tj|z }t/t1||z d d }tj|d{V||krnmns# tjjdz}tj|z }t/t1||z d d }tj|d{V||krnmwxYw|S)aF Scanner logic: 1. Scrapes domains and obtains ping results; 2. Manage ping results (e.g: saving to DB) 3. In case error domains found -> start re-pinging Re-pinging: - in min(ping_interval, 5 mins) - flush alerts if needed 4. Sleep for ping_interval until next ping iteration <allow_private_targetsF)limit)r resolver) connectorNz8Those domains are unsuccessful: %s Try to re-ping themTr )rz1Domains with unsuccessful status code found: "%s"zError during ping iteration!)rrrrr rr+r@ TCPConnectorrYr> ClientSessionr Semaphorerrrrrirjrkrsleepminrrrrrrr)previously_erroredrrping_interval_secondsconnections_limitr rr ping_resultrelapsed_for_pingping_retry_result retry_errorsrelapsed sleep_times r/scrape_iterationrts IKKEG1B6<&(((   022 373U ; ; ],3DEEEII)0AMOO\\\I(9===* (* (* (* (* (* (* ()*;<(%m$EHX$XZ[ \ \^`aa,.OOO6B # 46KWV_4A4F4F4H4H777111111-,? &(9=;M;M;O;O,,L-6m\,R,RM!P)22Dm(T(T -:*/2!8KK S #D););)=)=$>$> ? ?AAA 777&("'U* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (* (V 9997888889 $'G$9B$> !ikkE)GS!6!@!DDbIIJ- ++ + + + + + + +...     $'G$9B$> !ikkE)GS!6!@!DDbIIJ- ++ + + + + + + +...       sPBK?G$J6$K6 KKKKM!$K/,M!.K//M!!A0OcKt}g}d} trd}t||d{V}n~|dz }|dkrtd|dkrt d}tjjdz}t|t}tj |d{V)z Main loop for wmt_scanner_solo service each 'while: True' iteration returns errored domains (domains that responded with non-200 status code) rTNr~z)Seems your CloudLinux license is expired!r) r r get_license_statusrrirrrrrrrr)rrlicense_attemptrrs r/ scrape_loopr s   FO,  ! ! 4 4 6 6 ,O'78JF'S'S!S!S!S!S!S!S   q O!##JKKK!##')))"#$'G$9B$> !24GHHJ- ++ + + + + + + +,r1__main__zPID: %szweb-monitoring-toolzcl-web-monitoring-toolr*)Zrr3rrqr@signalrconcurrent.futuresrrrtypingrr dataclassesr sqlalchemyrwmt.dbr r r r r wmt.common.utilsrrrrclsentryrclsentry.utilsrwmt.common.constrrrrrrrrwmt.common.notificationrrwmt.common.reportr wmt.commonr cllicenser ri frozensetr7 ip_networkr9boolr<abcAbstractResolverr>r rYrorsrur{rrrrrrrrrrrrr rSrkgetpidpidrjSIGUSR1SIGTERMget_event_looplooprun_until_completerWr1r/r<s:  ((((((((!!!!!!!!!!!!!!UTTTTTTTTTTT''''''******                    IHHHHHHH))))))****** m $ $##`#`#`aa&%o66D*%%%%%GK0%%%. F F F F F, F F F999  ******* *c///d A A A AjnokA(''''T 9 9 94JJJD ::: A A A KKK\,,,6 z #ibikk  C KK 3  =# . .//0*?+CDD% ' ' '  fnk222 fnh///%w%''  ...//////////////////s;A/G77G;>G;