22

✏️ Editing: modsec_vendor

#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/modsec_vendor                   Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

package scripts::modsec_vendor;

use strict;

use IO::Interactive ();

use Cpanel::CLIProgress ();
use Cpanel::Exception   ();
use Cpanel::Hooks       ();
use Cpanel::Locale 'lh';
use Cpanel::Logger                      ();
use Cpanel::HttpUtils::ApRestart::Defer ();
use Whostmgr::ModSecurity               ();
use Whostmgr::ModSecurity::VendorList   ();
use Whostmgr::ModSecurity::Vendor       ();

# All functions in this script, including run, return true on success and false on failure.
# The conversion to exit status happens here only.
unless (caller) {
    exit( run(@ARGV) ? 0 : 1 );
}

sub run {
    my ( $command, @args ) = @_;

if ( !Whostmgr::ModSecurity::has_modsecurity_installed() ) {
        _logger()->info( lh()->maketext(q{You do not have [asis,ModSecurity] installed. There is no work to do.}) );
        return 1;
    }

if ( $command eq 'list' ) {
        return list(@args);
    }
    elsif ( $command eq 'add' ) {
        return add(@args);
    }
    elsif ( $command eq 'remove' ) {
        return remove(@args);
    }
    elsif ( $command eq 'update' ) {
        return update(@args);
    }
    elsif ( $command eq 'enable' ) {
        return enable(@args);
    }
    elsif ( $command eq 'disable' ) {
        return disable(@args);
    }
    elsif ( $command eq 'enable-updates' ) {
        return enable_updates(@args);
    }
    elsif ( $command eq 'disable-updates' ) {
        return disable_updates(@args);
    }
    elsif ( $command eq 'enable-configs' ) {
        return enable_configs(@args);
    }
    elsif ( $command eq 'disable-configs' ) {
        return disable_configs(@args);
    }
    else {
        _die_usage();
    }
    return 1;
}

sub list {
    my @args = @_;
    _die_usage() if @args;
    my $vendors = Whostmgr::ModSecurity::VendorList::list_detail_and_provided();

if ( !@$vendors ) {
        _logger()->info( lh()->maketext(q{There are no vendors.}) );
        return 1;
    }

for my $vendor_info (@$vendors) {
        print _format_vendor_info($vendor_info);
    }

return 1;
}

sub add {
    my @args = @_;
    _die_usage() if @args < 1;
    my $all_ok = 1;

_trigger_hook( "pre", "modsec_vendor::add" );

for my $url (@args) {
        local $@;
        my $vendor_info = eval { Whostmgr::ModSecurity::VendorList::add($url); };
        my $ex          = $@;
        if ($ex) {
            _logger()->warn( lh()->maketext( q{The system failed to add the vendor from the URL “[_1]”: [_2]}, $url, _format_exception($ex) ) );
            $all_ok = 0;
        }
        else {
            _logger()->info( lh()->maketext( q{You have added the vendor “[_1]”.}, $vendor_info->{name} ) );
            print "\n" . _format_vendor_info($vendor_info);
        }
    }

_trigger_hook( "post", "modsec_vendor::add" );

return $all_ok;
}

sub remove {
    my @args = @_;
    _die_usage() if @args < 1;
    my $all_ok = 1;

_trigger_hook( "pre", "modsec_vendor::remove" );

for my $vendor_id (@args) {
        local $@;
        eval {
            my $vendor = Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id );
            $vendor->uninstall;
        };
        my $ex = $@;
        if ($ex) {
            _logger()->warn( lh()->maketext( q{The system failed to remove the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
            $all_ok = 0;
        }
        else {
            _logger()->info( lh()->maketext( q{You have removed the vendor “[_1]”.}, $vendor_id ) );
        }
    }

_trigger_hook( "post", "modsec_vendor::remove" );

return $all_ok;
}

sub update {
    my @args = @_;
    _die_usage() if @args != 1;

my $all_ok = 1;

_trigger_hook( "pre", "modsec_vendor::update" );

for my $to_update (@args) {

my @urls;
        if ( $to_update =~ /^http:/ ) {
            push @urls, $to_update;
        }
        elsif ( $to_update eq '--auto' ) {
            _logger()->info( lh()->maketext(q{Updates are in progress for all of the installed [asis,ModSecurity] vendors with automatic updates enabled.}) );
            for my $vendor_detail ( @{ Whostmgr::ModSecurity::VendorList::list_detail() } ) {
                my ( $vendor_id, $update, $enabled ) = @$vendor_detail{qw(vendor_id update enabled)};
                my $vendor = Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id );
                if ( !$update ) {
                    _logger()->info( lh()->maketext( q{You have not configured the vendor “[_1]” to receive automatic updates.}, $vendor_id ) );
                    next;
                }
                if ( !$enabled ) {
                    _logger()->info( lh()->maketext( q{You have not enabled the vendor “[_1]”. The vendor will not receive automatic updates.}, $vendor_id ) );
                    next;
                }
                if ( $vendor->{is_pkg} ) {
                    push @urls, \$vendor->{is_pkg};
                }
                else {
                    push @urls, $vendor->installed_from || die lh()->maketext( q{The system could not determine the [asis,installed_from] URL for the vendor “[_1]”.}, $vendor_id ) . "\n";
                }
            }
        }
        else {
            my $vendor = Whostmgr::ModSecurity::Vendor->load( vendor_id => $to_update );
            if ( $vendor->{is_pkg} ) {
                push @urls, \$vendor->{is_pkg};
            }
            else {
                push @urls, $vendor->installed_from || die lh()->maketext( q{The system could not determine the [asis,installed_from] URL for the vendor “[_1]”.}, $to_update ) . "\n";
            }
        }

my $defer = Cpanel::HttpUtils::ApRestart::Defer->new( 'lexical' => 1 );
        $defer->block_restarts();

for my $url (@urls) {
            local $@;
            if ( ref($url) ) {
                my $pkg = ${$url};

# we disable excludes because:
                #  * --auto will have not added to @urls i.e. update-disabled packages won’t make it here
                #  * the manual direct arg is intended to allow them to update a rule set at will even if they have it disabled (i.e. a controlled update)
                require Cpanel::PackMan;
                $defer->allow_restarts();    # this locks httpd.conf which means universal hooks bits will wait for that lock
                eval { Cpanel::PackMan->instance->sys->upgrade( $pkg => "--disableexcludes=main" ) };
                warn "Failed to upgrade “$pkg”, this will need done manually.\n" if $@;
                $defer->block_restarts();
                next;
            }
            my $result    = eval { Whostmgr::ModSecurity::VendorList::update( $url, 1 ); };
            my $exception = $@;
            if ($exception) {
                if ( 'Cpanel::Exception::ModSecurity::VendorUpdateUnnecessary' eq ref $exception && '--auto' eq $to_update ) {
                    _logger()->info( lh()->maketext( q{The vendor “[_1]” is already up to date.}, $exception->vendor_id ) );
                    next;
                }
                $all_ok = 0;
                my $err = lh()->maketext( q{The system failed to update the vendor from the URL “[_1]”: [_2]}, $url, _format_exception($exception) );
                print $err . "\n";    #this is to ensure that scripts/maintenance sees the error and adds it to
                _logger()->warn($err);
            }
            else {
                my $vendor_info = $result->{vendor};
                _logger()->info( lh()->maketext( q{You have updated the vendor “[_1]”.}, $vendor_info->{name} ) );
                my $diagnostics = $result->{diagnostics};
                if ( @{ $diagnostics->{added_configs} } ) {
                    _logger()->info( lh()->maketext( q{You have added the following configuration files: [_1]}, @{ $diagnostics->{added_configs} } ) );
                }
                if ( @{ $diagnostics->{deleted_configs} } ) {
                    _logger()->info( lh()->maketext( q{You have removed the following configuration files: [_1]}, @{ $diagnostics->{deleted_configs} } ) );
                }
                print "\n" . _format_vendor_info($vendor_info);
            }
        }

$defer->allow_restarts();
    }

_trigger_hook( "post", "modsec_vendor::update" );

return $all_ok;
}

sub enable {
    my @args = @_;
    _die_usage() if @args != 1;
    my ($vendor_id) = @args;

_trigger_hook( "pre", "modsec_vendor::enable" );

local $@;
    if ( eval { Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id )->enable() } ) {
        _logger()->info( lh()->maketext( q{You have enabled the vendor “[_1]”.}, $vendor_id ) );

_trigger_hook( "post", "modsec_vendor::enable" );

return 1;
    }

my $ex = $@;
    _logger()->warn( lh()->maketext( q{The system could not enable the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
    return 0;
}

sub disable {
    my @args = @_;
    _die_usage() if @args != 1;
    my ($vendor_id) = @args;

_trigger_hook( "pre", "modsec_vendor::disable" );

local $@;
    if ( eval { Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id )->disable() } ) {
        _logger()->info( lh()->maketext( q{You have disabled the vendor “[_1]”.}, $vendor_id ) );

_trigger_hook( "post", "modsec_vendor::disable" );

return 1;
    }

my $ex = $@;
    _logger()->warn( lh()->maketext( q{The system could not disable the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
    return 0;
}

sub enable_updates {
    my @args = @_;
    _die_usage() if @args != 1;
    my ($vendor_id) = @args;

_trigger_hook( "pre", "modsec_vendor::enable_updates" );

local $@;
    if ( eval { Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id )->enable_updates() } ) {
        _logger()->info( lh()->maketext( q{You have enabled updates for the vendor “[_1]”.}, $vendor_id ) );
        _trigger_hook( "post", "modsec_vendor::enable_updates" );
        return 1;
    }

my $ex = $@;
    _logger()->warn( lh()->maketext( q{The system could not enable updates for the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
    return 0;
}

sub disable_updates {
    my @args = @_;
    _die_usage() if @args != 1;
    my ($vendor_id) = @args;

_trigger_hook( "pre", "modsec_vendor::disable_updates" );

local $@;
    if ( eval { Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id )->disable_updates() } ) {
        _logger()->info( lh()->maketext( q{You have disabled updates for the vendor “[_1]”.}, $vendor_id ) );
        _trigger_hook( "post", "modsec_vendor::disable_updates" );
        return 1;
    }

my $ex = $@;
    _logger()->warn( lh()->maketext( q{The system could not disable updates for the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
    return 0;
}

sub enable_configs {
    my @args = @_;
    _die_usage() if @args != 1;
    my ($vendor_id) = @args;

my $progress_bar = Cpanel::CLIProgress->new( width => 30 );

_trigger_hook( "pre", "modsec_vendor::enable_configs" );

local $@;
    my ( $ok, $outcomes ) = eval { Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id, progress_bar => $progress_bar )->enable_configs() };
    if ($ok) {
        _logger()->info( lh()->maketext( q{You have enabled all of the configuration files for the vendor “[_1]”.}, $vendor_id ) );

_trigger_hook( "post", "modsec_vendor::enable_configs" );

return 1;
    }

my $ex = $@;
    _logger()->warn( lh()->maketext( q{The system could not enable all of the configuration files for the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
    return 0;
}

sub disable_configs {
    my @args = @_;
    _die_usage() if @args != 1;
    my ($vendor_id) = @args;

my $progress_bar = Cpanel::CLIProgress->new( width => 30 );

_trigger_hook( "pre", "modsec_vendor::disable_configs" );

local $@;
    my ( $ok, $outcomes ) = eval { Whostmgr::ModSecurity::Vendor->load( vendor_id => $vendor_id, progress_bar => $progress_bar )->disable_configs() };
    if ($ok) {
        _logger()->info( lh()->maketext( q{You have disabled all of the configuration files for the vendor “[_1]”.}, $vendor_id ) );
        _trigger_hook( "post", "modsec_vendor::disable_configs" );
        return 1;
    }

my $ex = $@;
    _logger()->warn( lh()->maketext( q{The system could not disable all of the configuration files for the vendor “[_1]”: [_2]}, $vendor_id, _format_exception($ex) ) );
    return 0;
}

sub _format_vendor_info {
    my ($vendor_info) = @_;

my ( $vert_divider, $wrap_heading );
    if ( IO::Interactive::is_interactive() ) {
        $vert_divider = "\033[7m \033[m";
        $wrap_heading = sub { "\033[7m" . shift . "\033[m" };
    }
    else {
        $vert_divider = '|';
        $wrap_heading = sub { shift };
    }

my $output = $wrap_heading->(
        sprintf(
            '[%s] %s',
            @$vendor_info{qw(vendor_id name)},
        )
    ) . ( !$vendor_info->{installed} ? ' (not installed)' : '' ) . "\n";

for my $k ( sort keys %$vendor_info ) {
        my $v = $vendor_info->{$k};
        if ( 'ARRAY' eq ref $v ) {
            $v = sprintf( "(%d)", scalar(@$v) );    # just the count
        }
        $output .= sprintf( "% 16s %s %s\n", $k, $vert_divider, $v );
    }
    $output .= "\n\n";
    return $output;
}

sub _format_exception {
    my $exception = shift;
    chomp( $exception = Cpanel::Exception::get_string($exception) );
    return $exception;
}

my $logger;

sub _logger {
    $logger ||= Cpanel::Logger->new();
    return $logger;
}

sub _die_usage {
    die <<EOU;
usage: $0 <list | add | remove | update> ...

list
  - Lists the currently-installed vendors

add <vendor metadata YAML URL>
  - Installs a new vendor

remove <vendor_id>
  - Removes the vendor with the specified vendor id

update <vendor_id | vendor metadata YAML URL | --auto>
  - If a vendor_id is provided, this command updates the vendor specified by that id
    from the same URL or package that was used to install it.
  - If a URL is provided, this command updates an existing vendor from the specified URL.
    The URL need not be the same as the one used to originally install the vendor.
  - If --auto is specified, updates all installed vendors for which auto-update is enabled
    using the URLs or packages from which they were originally installed.

enable <vendor_id>
  - Enables a vendor

disable <vendor_id>
  - Disables a vendor

enable-updates <vendor_id>
  - Enables automatic updates for a vendor

disable-updates <vendor_id>
  - Disables automatic updates for a vendor

enable-configs <vendor_id>
  - Enables all configs for a vendor

disable-configs <vendor_id>
  - Disables all configs for a vendor
EOU
}

#-------------------------------------------------------------------------------------------------
# Scope:
#   private
# Name:
#   _trigger_hook
# Desc:
#   This function triggers the hook on scripts/modsec_vendor
# Arguments:
#   - pre_or_post - a string that should be only "pre" or "post".
#   - event - a string that is the name of the api call.
#        example: modsec_vendor::add
# Returns:
#   - Nothing is returned.
#-------------------------------------------------------------------------------------------------
sub _trigger_hook {
    my ( $pre_or_post, $event ) = @_;

Cpanel::Hooks::hook(
        {
            'category' => 'scripts',
            'event'    => $event,
            'stage'    => $pre_or_post,
        },
    );

return;
}

MR SKB