Update to v7.43.0

script/cron_scaning.py

@@ -0,0 +1,31 @@
+import os,sys
+panel_path = '/www/server/panel'
+if not os.name in ['nt']:
+    os.chdir(panel_path)
+if not 'class/' in sys.path:
+    sys.path.insert(0, 'class/')
+if not 'class_v2/' in sys.path:
+    sys.path.insert(0, 'class_v2/')
+sys.path.insert(0, '.')
+import public
+from mod.base.push_mod import system
+
+class main:
+
+
+    def run(self):
+        msg_list = []
+        from panel_site_v2 import panelSite
+        site_obj = panelSite()
+        res = site_obj.get_Scan(None)
+        if int(res['loophole_num']):
+            msg_list.append('Scan the website {} and find {} vulnerabilities'.format(res['site_num'], res['loophole_num']))
+        else:
+            msg_list.append('Scan the website [{}], status is [Security]'.format(res['site_num']))
+        return {"msg_list": msg_list}
+
+
+if __name__ == '__main__':
+    main = main()
+    msg = main.run()
+    system.push_by_task_keyword("vulnerability_scanning", "vulnerability_scanning", push_data=msg)

script/restart_services.py

@@ -6,7 +6,7 @@ import sys
 import time
 from functools import wraps
 from typing import Optional, Dict
-# import asyncio
+
 import fcntl
 
 os.chdir("/www/server/panel")
@@ -51,13 +51,13 @@ SERVICES_MAP = {
 
 def manual_flag(server_name: str = None, open_: str = None) -> Optional[dict]:
     if not server_name:  # only read
-        return DaemonManager.safe_read()
+        return DaemonManager.manual_safe_read()
     # 人为干预
     if open_ in ["start", "restart"]:  # 激活服务检查
         return DaemonManager.active_daemon(server_name)
     elif open_ == "stop":  # 跳过服务检查
         return DaemonManager.skip_daemon(server_name)
-    return DaemonManager.safe_read()
+    return DaemonManager.manual_safe_read()
 
 
 class DaemonManager:
@@ -66,10 +66,13 @@ class DaemonManager:
         if not os.path.exists(DAEMON_SERVICE_LOCK):
             with open(DAEMON_SERVICE_LOCK, "w") as _:
                 pass
+        os.makedirs(os.path.dirname(MANUAL_FLAG), exist_ok=True)
         if not os.path.exists(MANUAL_FLAG):
-            public.writeFile(MANUAL_FLAG, json.dumps({}))
+            with open(MANUAL_FLAG, "w") as fm:
+                fm.write(json.dumps({}))
         if not os.path.exists(DAEMON_SERVICE):
-            public.writeFile(DAEMON_SERVICE, json.dumps([]))
+            with open(DAEMON_SERVICE, "w") as fm:
+                fm.write(json.dumps([]))
 
     @staticmethod
     def read_lock(func):
@@ -164,12 +167,23 @@ class DaemonManager:
     @staticmethod
     @read_lock
     def safe_read():
+        """服务守护进程服务列表"""
         try:
             res = public.readFile(DAEMON_SERVICE)
             return json.loads(res) if res else []
         except:
             return []
 
+    @staticmethod
+    @read_lock
+    def manual_safe_read():
+        """手动干预服务字典, 0: 需要干预, 1: 被手动关闭的"""
+        try:
+            manual = public.readFile(MANUAL_FLAG)
+            return json.loads(manual) if manual else {}
+        except:
+            return {}
+
 
 class RestartServices:
     COUNT = 30
@@ -230,6 +244,17 @@ class RestartServices:
                 public.WriteLog(
                     "Service Daemon", f"Failed to {act} {self.nick_name}, error: {result.stderr.strip()}"
                 )
+                # todo 暂时解决公共安装脚本无法启动mongodb的问题
+                mg_path = f"{SETUP_PATH}/mongodb"
+                if act == "restart" and self.nick_name == "mongodb" and os.path.exists(f"{mg_path}/bin/mongod"):
+                    try:
+                        public.ExecShell(f"rm -f {mg_path}/log/configsvr.pid")
+                        public.ExecShell("rm -f /tmp/mongodb-27017.sock")
+                        public.ExecShell(f"chown -R mongo:mongo {mg_path}")
+                        public.ExecShell(f"sudo -u mongo {mg_path}/bin/mongod -f {mg_path}/config.conf")
+                    except:
+                        pass
+
         except subprocess.TimeoutExpired as t:
             public.WriteLog(
                 "Service Daemon", f"Failed to {act} {self.nick_name}, error: time out, {t}"

script/upgrade_firewall.py

@@ -143,10 +143,11 @@ def ufw_batch_remove_ip_rule(rule_dict):
 
             chain = 'INPUT' if direction == 'in' else 'OUTPUT' if direction == 'out' else None
             strategy = 'DROP' if action == 'deny' else 'ACCEPT' if action == 'allow' else None
-
-            if (ip in rule_dict and
-                    chain.upper() == rule_dict[ip]['Chain'].upper() and
-                    strategy.upper() == rule_dict[ip]['Strategy'].upper()):
+            if chain and strategy and all([
+                ip in rule_dict,
+                chain.upper() == rule_dict[ip]['Chain'].upper(),
+                strategy.upper() == rule_dict[ip]['Strategy'].upper(),
+            ]):
                 # 如果匹配，跳过这三行（即删除）
                 i += 3
             else:
@@ -196,6 +197,10 @@ def upgrade_countrys(commodel):
     country_list = public.M('firewall_country').select()
     if len(country_list) == 0:
         return
+
+    from safeModelV2.firewallModel import main as firewallModel
+    firewallmodel = firewallModel()
+
     print("-* Area rule data being migrated...")
     for country in country_list:
         ports = country['ports']
@@ -212,15 +217,20 @@ def upgrade_countrys(commodel):
                 )
         else:
             if not ports:
-                public.ExecShell(
+                o, e = public.ExecShell(
                     "firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 -m set --match-set {} src -j {}".format(
-                        brief, types.upper())
-                )
+                        brief, types.upper()))
+                if e != '':
+                    public.ExecShell(
+                        'firewall-cmd --permanent --remove-rich-rule=\'rule source ipset="{}" {}\''.format(brief,
+                                                                                                           types.upper()))
             else:
-                public.ExecShell(
+                o, e = public.ExecShell(
                     'firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 -m set --match-set {} src -p tcp --dport {} -j {}'.format(
-                        brief, ports, types.upper())
-                )
+                        brief, ports, types.upper()))
+                if e != '':
+                    public.ExecShell(
+                        'firewall-cmd --permanent --remove-rich-rule=\'rule source ipset="' + brief + '" port port="' + ports + '" protocol=tcp ' + types.upper() + '\'')
 
     commodel.firewall.reload()
     for country in country_list:
@@ -229,24 +239,48 @@ def upgrade_countrys(commodel):
         types = country['types']
 
         print("Rules for relocation areas:{}".format(brief))
-        public.ExecShell("ipset destroy " + brief)
+        o, e = public.ExecShell("ipset destroy " + brief)
+        if e != '':
+            public.ExecShell("firewall-cmd --permanent --delete-ipset=" + brief)
 
         tmp_file = "/tmp/firewall_{}.txt".format(brief)
-        command = '''grep -q "in_bt_country" {filename} || awk '{{print "add in_bt_country_" $2, $3}}' {filename} > {filename}.tmp && mv {filename}.tmp {filename}'''.format(
-            filename=tmp_file)
-        public.ExecShell(command)
 
-        _ipset = "in_bt_country_" + brief
-        public.ExecShell('ipset create {} hash:net maxelem 1000000; ipset restore -f {}'.format(_ipset, tmp_file))
+        if os.path.exists(tmp_file):  # bt 9.5.0之后
+            command = '''grep -q "in_bt_country" {filename} || awk '{{print "add in_bt_country_" $2, $3}}' {filename} > {filename}.tmp && mv {filename}.tmp {filename}'''.format(
+                filename=tmp_file
+            )
+            public.ExecShell(command)
 
-        if ports:
+            _ipset = "in_bt_country_" + brief
             public.ExecShell(
-                'iptables -I IN_BT_Country -m set --match-set {} src -p tcp --destination-port {} -j {}'.format(_ipset,
-                                                                                                                ports,
-                                                                                                                types.upper()))
-        else:
-            public.ExecShell('iptables -I IN_BT_Country -m set --match-set {} src -j {}'.format(_ipset, types.upper()))
-    public.ExecShell("systemctl reload BT-FirewallServices")
+                'ipset create {} hash:net maxelem 1000000; ipset restore -f {}'.format(_ipset, tmp_file)
+            )
+
+            if ports:
+                public.ExecShell(
+                    'iptables -I IN_BT_Country -m set --match-set {} src -p tcp --destination-port {} -j {}'.format(
+                        _ipset,
+                        ports,
+                        types.upper())
+                )
+            else:
+                public.ExecShell(
+                    'iptables -I IN_BT_Country -m set --match-set {} src -j {}'.format(_ipset, types.upper())
+                )
+            public.ExecShell("systemctl reload BT-FirewallServices")
+
+        else:  # bt 9.5.0之前
+            public.M("firewall_country").where("id=?", (country['id'],)).delete()
+            get_tmp = public.dict_obj()
+            get_tmp.country = country['country']
+            get_tmp.types = country['types']
+            get_tmp.ports = country['ports']
+            get_tmp.choose = "all"
+            get_tmp.is_update = True
+            res = firewallmodel.create_countrys(get_tmp)
+            if res['status'] is False:
+                print(f"[ {brief} ] Area rule migrated fail : {res['message']}")
+
     print("-* Area rule data migration completed...")
 
 

script/webshell_detection_task.py

@@ -0,0 +1,36 @@
+import os,sys
+panel_path = '/www/server/panel'
+if not os.name in ['nt']:
+    os.chdir(panel_path)
+if not 'class/' in sys.path:
+    sys.path.insert(0, 'class/')
+if not 'class_v2/' in sys.path:
+    sys.path.insert(0, 'class_v2/')
+sys.path.insert(0, '.')
+from projectModelV2 import safecloudModel
+from mod.base.push_mod import system
+
+class main:
+
+    def run(self):
+        try:
+            safecloud = safecloudModel.main()
+            # 调用 webshell_detection 函数
+            res = safecloud.webshell_detection({'is_task': 'true'})
+            push_list = []
+            if res['status']:
+                if res['detected']:
+                    push_list.append(res['msg']+', Please handle it as soon as possible!')
+                    for i in res['detected']:
+                        push_list.append(f'file:{i}')
+            return {"msg_list": push_list}
+        except Exception as e:
+            print(e)
+            return {"msg_list": []}
+
+
+if __name__ == '__main__':
+    main_obj = main()
+    msg = main_obj.run()
+    if msg['msg_list']:
+        system.push_by_task_keyword("safe_cloud_hinge", "safe_cloud_hinge", push_data=msg)