| Server IP : 162.241.219.206 / Your IP : 216.73.216.30 Web Server : Apache System : Linux box5669.bluehost.com 5.14.0-687.15.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jun 11 08:51:45 EDT 2026 x86_64 User : signavd5 ( 2863) PHP Version : 8.3.32 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /usr/libexec/kcare/python/kcarectl/__pycache__/ |
Upload File : |
a
��;j*: � @ s d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
Z
d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ ddlmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+ ddl m,Z,m-Z-m.Z. dd l/m0Z0m1Z1m2Z2m3Z3m4Z4 d
Z5d Z6d Z7d
Z8dZ9dZ:dZ;dZ<e�=dej>�Z?e�=d�Z@ejA�Bd��r�e jA�Cd d� ejDdeEd� e$jL�MejN� dd� ZOdd� ZPdd � ZQd d � ZRd d � ZSd�d!d"�ZTd#d$� ZUd%d&� ZVd'd(� ZWd)d*� ZXd+d,� ZYd-d.� ZZG d/d0� d0e[�Z\G d1d2� d2e,�Z]G d3d4� d4e,�Z^G d5d6� d6e,�Z_d7d8� Z`ed9d:� �Zad�d;d<�Zbd=d>� Zcd?d@� Zdi ZedAdB� Zfefe2jg_heie dCd��sz8d dljZkd dllZmekjn�oemjp�ekjn�odD�k �r�eqdE��W n eq�y� Y n80 dFdG� Zre2jsZtG dHdI� dIeu�ZvG dJdK� dKe2js�Zwewe2_sdLdM� Zxe jyfdNdO�ZzdPdQ� Z{dRdS� Z|G dTdU� dUeu�Z}dVdW� Z~dXdY� Zd�d[d\�Z�d]d^� Z�d_d`� Z�d�dadb�Z�dcdd� Z�dedf� Z�dgdh� Z�didj� Z�dkdl� Z�dmdn� Z�dodp� Z�dqdr� Z�dsdt� Z�dudv� Z�dwdx� Z�dydz� Z�d{d|� Z�d}d~� Z�dd�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e&j�d�d�d���Z�d�d�� Z�d�d�� Z�G d�d�� d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e j�e jyfd�d��Z�d�d�� Z�e&j�e*��d��e j�fd�d����Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�dS )�� )�print_functionN)�ArgumentParser)�contextmanager)�datetime� )�anomaly�auth� capabilities�config�config_handlers� constants�doctor�errors�fetch�
http_utils� ipv6_support�kcare�libcare� log_utils�platform_utils�
process_utils�selinux� server_info�serverid� update_utils�utils)�
KcareError�NotFound�SafeExceptionWrapper)� HTTPError�URLError�httplib�json_loads_nstr� urlencode�c Zv3)Z12hZ24hZ48h�testz./etc/sysconfig/kcare/freezer.modules.blacklistz /usr/libexec/kcare/kcdoctor.sh)z latest.v3� latest.v2z /etc/sysconfig/kcare/sysctl.conf�
z$==BLACKLIST==
(.*)==END BLACKLIST==
z'(kpatch.*|ksplice.*|kpatch_livepatch.*)z/usr/libexec/kcare/python�ignore)�categoryc C s@ t � } tj�t�r<ttd�}|D ]}| �|�� � q |�� | S )N�r) �set�os�path�isfile�FREEZER_BLACKLIST�open�add�rstrip�close)�result�f�line� r7 �./usr/libexec/kcare/python/kcarectl/__init__.py�get_freezer_blacklistS s
r9 c C sB |� d�}| r(d�|d | |d g�}nd�|d |d g�}|S )N�.r ���)�split�join)�ptype�filenameZ
name_partsr7 r7 r8 � _apply_ptype] s
r@ c C sJ t | tj�t_t | tj�t_t | tj�t_t | tj�t_t | tj�t_d S �N)r@ r
� PATCH_BIN�
PATCH_INFO�BLACKLIST_FILE� FIXUPS_FILE�
PATCH_DONE)r> r7 r7 r8 � apply_ptypef s
rG c C s� t �� \} }}d}t|t�r^t|t�s^z d|jt�|j�|jf }W q� t t
fyZ Y q�0 nNt|t t
t f�r�t|t�s�d| }n*t|t
�r�|jp�t|j�} |jp�d|j }t�� }tjt�� |d |d t| dt| ��|d�t�|d��t|dd�d �S )
N� z[Errno %i] %s: '%s'z%sr r �__name__�d �attempts)Z
agent_versionZpython_version�distroZdistro_version�error�details� tracebackrK ) �sys�exc_info�
isinstance�OSErrorr �errnor, �strerrorr? �AttributeError� TypeError�KeyError�IOErrorr �etype�type�innerrN r �
get_distror �VERSIONZget_python_version�getattr�strr= rO Z format_tb)rZ �value�tbZdetails_sanitizedrL r7 r7 r8 � format_exception_without_detailsn s,
�rc c C st t jr
d S t�t� �} t�t�t� | ���}t�
d�d | }t � |t
�� �}zt �|� W n tyn Y n0 d S )Nz/api/kcarectl-tracez?trace=)r
�UPDATE_FROM_LOCAL�json�dumpsrc r �nstr�base64Zurlsafe_b64encodeZbstr�get_patch_server_urlr Z http_requestr Zget_http_auth_stringZ urlopen_base� Exception)ZtraceZ
encoded_trace�urlZrequestr7 r7 r8 �send_exc� s rl c C s� t �� }|dkr t �|d� dS t �� t �� }|dkrBt �d� t �d� ttjd��0}t � |�
� d� t � |�
� d� W d � n1 s�0 Y |r�t � |� z
| � W n( t
y� tj�d� t �d� Y n0 t �d� dS )z�
Run func in a fork in an own process group
(will stay alive after kcarectl process death).
:param func: function to execute
:return:
r N�ar � zWait exception)r, �fork�waitpid�setsid�_exitr3 r0 r ZLOG_FILE�dup2�fileno�time�sleeprj r �kcarelog� exception)�funcrv �pid�fdr7 r7 r8 �
nohup_fork� s(
.
r| c C s� t j�tjd�} t j�| �r�t| d��P}z,t|�� �}|t j
t � � krRt || ��W n t
yf Y n0 W d � n1 s|0 Y t�| t�� � dS )a Check the fact that there was a failed patching attempt.
If anchor file not exists we should create an anchor with
timestamp and schedule its deletion at $timeout.
If anchor exists and its timestamp more than $timeout from now
we should raise an error.
�.kcareprev.lockr* N)r, r- r= r � PATCH_CACHEr. r0 �int�readr
�SUCCESS_TIMEOUTru � PreviousPatchFailedException�
ValueErrorr � atomic_write�
timestamp_str)Zanchor_filepathZafile� timestampr7 r7 r8 � touch_anchor� s $r� c C st zt �t j�tjd�� W n ty, Y n0 td| � tj �
� zt dd� W n t yn t
j�d� Y n0 dS )z�
See touch_anchor() for detailed explanation of anchor mechanics.
See KPT-730 for details about action registration.
:param state_data: dict with current level, kernel_id etc.
r} �done��reasonzCannot send update info!N)r, �remover- r= r r~ rS �register_actionr �get_loaded_modules�clear�get_latest_patch_levelrj r rw rx ��
state_datar7 r7 r8 �
commit_update� s
r� c C s( t jtj�tjd�t�| |d�d� d S )N�patchesrH )Z exclude_path) r �clean_directoryr, r- r= r r~ r �get_cache_path)�khashZplevelr7 r7 r8 � clear_cache� s r� c C s> t jpd}d�|| g�}tjd|f}|r2||f7 }tjj|� S )N�none�-�modules)r
�PREFIXr= r r~ r, r- )r� �fname�prefixZ
module_dirr4 r7 r7 r8 �get_current_level_path� s
r� c C s t jt| d�t|�dd� d S )N�latestT)Z
ensure_dir)r r� r� r` )r� � patch_levelr7 r7 r8 �save_cache_latest� s r� c C sV t | d�}tj�|�rRz$tt|d��� �� �}t� | |�W S t
t fyP Y n0 d S )Nr� r* ) r� r, r- r. r r0 r� �stripr �LegacyKernelPatchLevelr� rW )r� Zpath_with_latest�plr7 r7 r8 �get_cache_latest� s
r� c @ s e Zd ZdS )�CertificateErrorN)rI �
__module__� __qualname__r7 r7 r7 r8 r� s r� c s e Zd ZdZ� fdd�Z� ZS )�UnknownKernelExceptionzunknown kernelc s: d� t�� d t�� t�� �}tt| �j |fi |�� d S )N�LNew kernel detected ({0} {1} {2}).
There are no updates for this kernel yet.r )
�formatr r] �platform�releaser �get_kernel_hash�superr� �__init__)�self�kwargs�msg�� __class__r7 r8 r� s �z UnknownKernelException.__init__)rI r� r� �statusr� �
__classcell__r7 r7 r� r8 r� s r� c s( e Zd ZdZ� fdd�Zdd� Z� ZS )�ApplyPatchErrorzpatch apply errorc sJ t t| �j|i |�� || _|| _|| _|| _t�� d | _ t
� � | _ d S �Nr ) r� r� r� �code�
freezer_style�level�
patch_filer r] rL r� r� )r� r� r� r� r� �argsr� r� r7 r8 r� s zApplyPatchError.__init__c C s0 d� | j| j| j| j| jd�dd� | jD ���S )Nz0Unable to apply patch ({0} {1} {2} {3} {4}, {5})�, c S s g | ] }t |��qS r7 )r` )�.0�ir7 r7 r8 �
<listcomp>- � z+ApplyPatchError.__str__.<locals>.<listcomp>)r� r� r� r� rL r� r= r� �r� r7 r7 r8 �__str__& s �zApplyPatchError.__str__�rI r� r� r� r� r� r� r7 r7 r� r8 r� s r� c s( e Zd ZdZ� fdd�Zdd� Z� ZS )r� zprevious patch failedc s& t t| �j|i |�� || _|| _d S rA )r� r� r� r� �anchor)r� r� r� r� r� r� r7 r8 r� 5 s z%PreviousPatchFailedException.__init__c C s d}|� | j| j�S )Nz�It seems, the latest patch, applying at {0}, crashed, and further attempts will be suspended. To force patch applying, remove `{1}` file)r� r� r� )r� �messager7 r7 r8 r� : s �z$PreviousPatchFailedException.__str__r� r7 r7 r� r8 r� 2 s r� c
C s� t �� d�| � }z|t�|�}t�t�|�� ��}t |d �}|dkrRt�
d� n8|dkrft�
d� n$|dkrzt�
d� nt�
d �|�� |W S t y� } zt �
||� W Y d }~n
d }~0 0 d
S ) Nz"/nagios/register_key.plain?key={0}r� r zKey successfully registeredr zWrong key format or sizern z!No KernelCare license for that IPzUnknown error {0}r; )r �get_registration_urlr� r �urlopenr � data_as_dictrg r� r �
print_wrapperr r �print_cln_http_error)�keyrk �response�resr� �er7 r7 r8 �!set_monitoring_key_for_ip_licenseC s
"r� c
c sT t jrtjt jdd� z d V W t jrPtjt jdd� nt jrNtjt jdd� 0 d S )NT)�shell)r
ZBEFORE_UPDATE_COMMANDr � run_commandZAFTER_UPDATE_COMMANDr7 r7 r7 r8 �
execute_hooksW s �r� c C s� t � }|j}|j}t�� }| dkrht|�tjt� � t
� � |t t
�� �|d�}t�d� t�t�|�� njt�d� t�t|�� t�dt|� � t�tj� t�t� � � t�t
� � � t�|� t�t
�� � dS )a1
The output will consist of:
Ignore output up to the line with "--START--"
Line 1: show if update is needed:
0 - updated to latest,
1 - update available,
2 - unknown kernel
3 - kernel doesn't need patches
4 - no license, cannot determine
Line 2: licensing message (can be skipped, can be more then one line)
Line 3: LICENSE: CODE: 1: license present, 2: trial license present, 0: no license
Line 4: Update mode (True - auto-update, False, no auto update)
Line 5: Effective kernel version
Line 6: Real kernel version
Line 7: Patchset Installed # --> If None, no patchset installed
Line 8: Uptime (in seconds)
If *format* is 'json' return the results in JSON format.
Any other output means error retrieving info
:return:
re )Z
updateCodeZ
autoUpdateZeffectiveKernelZ
realKernelZloadedPatchLevelZuptime�licensez --START--z LICENSE: N)�_patch_level_infor� � applied_lvlr � license_infor` r
� AUTO_UPDATEr � kcare_unamer� r� r r Z
get_uptimer r� re rf )�fmt�pliZ update_codeZ loaded_plZlicense_info_resultZresultsr7 r7 r8 � plugin_infoc s.
�
r� c C s` t �� } ztdd�}W n ty6 tjr.dnd Y S 0 | d u rDdS | |krPdS t�� r\dS dS )N�infor� r � r rn )r �loaded_patch_levelr� r� r
�IGNORE_UNKNOWN_KERNELr Zstatus_gap_passed)�
current_levelZlatest_patch_levelr7 r7 r8 �get_update_status� s r� c C s2 t �� d d� \} }| dkr*|�d�r*dS dS d S )Nrn Z
CloudLinuxz7.�extrarH )r r] �
startswith)rL �versionr7 r7 r8 �edf_fallback_ptype� s r� c C sl | j | jf}t�||�}t�|| j�| _| j�tj tj
d� |tvrZ| j� � dd� t|< | j rh| �
� dS )z�Function remembers IP address of host connected to
and uses it for later connections.
Replaces stdlib version of httplib.HTTPConnection.connect
r Nrn )�hostZport�CONNECTION_STICKY_MAP�get�socketZcreate_connectionZtimeout�sockZ
setsockoptZ IPPROTO_TCPZ TCP_NODELAYZ getpeername� _tunnel_hostZ_tunnel)r� ZaddrZ
resolved_addrr7 r7 r8 �sticky_connect� s r� ZHAS_SNIz0.13z%No pyOpenSSL module with SNI ability.c G s dS )NTr7 )r� r7 r7 r8 �dummy_verify_callback� s r� c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�SSLSockc C s || _ d| _d S r� )� _ssl_conn�_makefile_refs)r� r� r7 r7 r8 r� � s zSSLSock.__init__c G s( | j d7 _ tj| jg|�R ddi�S )Nr r3 T)r� r� Z _fileobjectr� �r� r� r7 r7 r8 �makefile� s zSSLSock.makefilec C s | j s | jr | j�� d | _d S rA )r� r� r3 r� r7 r7 r8 r3 � s
z
SSLSock.closec G s | j j|� S rA )r� �sendallr� r7 r7 r8 r� � s zSSLSock.sendallN)rI r� r� r� r� r3 r� r7 r7 r7 r8 r� � s r� c @ s e Zd Zdd� ZdS )�PyOpenSSLHTTPSConnectionc C s� t j�| � tj�tjj�}|�tjjtjj B � t
j rJ|� tjj
t� n|� tjjt� |�� tj�|| j�}|�� | jp�| j}|�|�� � |�� t
j r�t|�� |� t|�| _d S rA ) r! �HTTPConnection�connect�OpenSSLZSSLZContextZ
SSLv23_METHODZ set_optionsZ OP_NO_SSLv2Z OP_NO_SSLv3r
�CHECK_SSL_CERTSZ
set_verifyZ VERIFY_PEERr� Z VERIFY_NONEZset_default_verify_pathsZ
Connectionr� Zset_connect_stater� r� Zset_tlsext_host_name�encodeZ do_handshake�match_hostnameZget_peer_certificater� )r� �ctxZconnZ server_hostr7 r7 r8 r� � s z PyOpenSSLHTTPSConnection.connectN)rI r� r� r� r7 r7 r7 r8 r� � s r� c C s� t jr&t�| |�}t�tj�|dd�S |dv}t jo6|}d|fd|fdfD �]l\}}t j |||d�} t j
| |d�}
|r�d� |
�}
t�| t ||��d |
}d
} |s�|r�t
|�| kr�|r�d nd } t�d
� | �� qJz~t�tj�|dd�}
t j�rFt�| ��rFt�| �}t�|�}|�r*tjd� |�dd� ntjddd� |�rF|�� |
W S t�y� } zN|�sl|�r�|jdv �s�|jdk�r�t�d� |�� W Y d }~qJ� W Y d }~qJd }~0 0 qJd S )NF��
check_license)z latest.v1r& T)FF)�secure_boot_info� perf_metrics)� b64_encodingzinfo={0}�?iX zsecure boot infoz perf metricsz/Check-in URL param is too large, discarding {0}z:Automatic kernel anomaly report uploaded successfully: {0}�Z print_msg�$Failed to send kernel anomaly report)i� i� i� zCCheck-in request failed with error: {0}, retrying with reduced info)r
rd r Zget_kernel_prefixed_urlr Zwrap_with_cache_keyr � urlopen_authZSEND_PERF_METRICSr Zencode_checkin_payloadr� �stickyfy�lenr �logwarnZ KERNEL_ANOMALY_REPORT_ENABLEr Zdetect_anomaly� prepare_kernel_anomaly_report�send_data_package�loginfo�remove_archiver r� )r� r� r� �moderk r Z perf_enabledr r ZsinfoZ
request_paramZmax_url_lengthZ discard_infor4 � data_package� upload_name�exr7 r7 r8 �_fetch_patch_level_request sD
�
$ r c C s> t �� }tjd ur$t �|ttj��S tD �]}z�t||| |�}t� |j
� t � t �
|�� ��� }tjd�| |�dd� |r�|�d�r�t|�}|�dg �}t�|�s�t�d��t �||d |d |d �W S t �|t|��W S ty� Y q( t �y0 } z"|j d
v �rt d ��� W Y d }~q(d }~0 0 q(t � �d S ) Nz;fetch patch level, reason: {0}, kernel latest response: {1}Fr �{r zeLatest KernelCare patchset is incompatible with the current kernecare package version, please upgrader� �baseurlr� )i� i� zKC licence is required) r r� r
� PATCH_LEVELr� r � PATCH_LATESTr r Z set_feature_flags_from_headers�headers�update_all_kmod_paramsr rg r� r� r r
r� r� r" r� r Zhas_kc_capabilitiesr �CapabilitiesMismatchZKernelPatchLevelr r r� r r� ) r� r r� r� r� r� Z latest_infoZrequired_capabilitiesr r7 r7 r8 �fetch_patch_level; s4
�" r c
C sB | � t|tj��}tj�d�|�� ztj |ddd� W dS t
y` tj�d�|�� Y dS t y� } z$tj� d�|t
|��� W Y d }~n
d }~0 0 | � t|tj�tj �}tj�d�|�� ztj |dd� W nd t
�y tj�d�|�� Y dS t�y< } z$tj�d �|t
|��� W Y d }~n
d }~0 0 dS )
NzProbing patch URL: {0}F�HEAD)r �methodTz{0} is not available: 404zFHEAD request for {0} raised an error, fallback to the GET request: {1}r� z{0} is not available: {1})�file_urlr@ r
rB r rw r� r� r r r rj �debugr` r ZSIGr )r� r> Zbin_urlr rk r7 r7 r8 � probe_patch\ s( ..r c C sF |t jkr| �t j�}n
| �|�}| �|�}tj||tjt� | �d�S )N)Z hash_checker)
r �KMOD_BINZkmod_urlr �
cache_pathr Z fetch_urlr
�
USE_SIGNATUREZget_hash_checker)r� �namerk Zdstr7 r7 r8 � fetch_and_verify_kernel_fileu s
r% c @ s> e Zd Zddd�Zdd� Zdd� Zdd � Zd
d � Zd d
� ZdS )� PatchFetcherNc C s
|| _ d S rA )r� )r� r� r7 r7 r8 r� � s zPatchFetcher.__init__c C s t | j|�S rA )r% r� )r� r$ r7 r7 r8 �_fetch� s zPatchFetcher._fetchc C sr | j �tj�}| j �tj�}| j �tj�}| j �tj�}tdd� ||||fD ��opt j
� |�dkopt j
� |�dkS )Nc s s | ]}t j�|�V qd S rA )r, r- r. )r� r- r7 r7 r8 � <genexpr>� r� z0PatchFetcher.is_patch_fetched.<locals>.<genexpr>r ) r� r" r
rF rB rC r r! �allr, r- �getsize)r� Zpatch_done_pathZpatch_bin_pathZpatch_info_pathZ
kmod_bin_pathr7 r7 r8 �is_patch_fetched� s ��z PatchFetcher.is_patch_fetchedc C s0 | j d u rtd��| j s | j S | �� r6t�d� | j S t�d� t| j tj�r�z tj | j �
t j �dd�}W n t
y| Y n(0 |j�dd �}|r�| j �t�|��| _ z| �t j � W n. t
y� td�| j t jp�d�d d
��Y n0 | �t j� | �tj� | �� tj| j � t j �d d d
� t � tj � | j S )Nz+Cannot fetch patch as no patch level is setzUpdates already downloadedzDownloading updatesr )r � KC-Base-UrlzfThe `{0}` patch level is not found for `{1}` patch type. Please select valid patch type or patch level�defaultzpatch level not found�r� r� �wb�r )!r� r� r+ r r
rR r r� r r r r
rB r r r� �upgrader rg r' r r� �
PATCH_TYPErC r r! �extract_blacklistr� r" rF r �restore_selinux_contextr~ )r� �respr r7 r7 r8 � fetch_patch� s>
�� zPatchFetcher.fetch_patchc C sJ t | j�tj�d��� }|rFt�|�}|rFt� | j�tj
�|� d�� d S )Nr* r ) r0 r� r" r
rC r� � BLACKLIST_RE�searchr r� rD �group)r� ZbufZmor7 r7 r8 r3 � s
z PatchFetcher.extract_blacklistc C s� |du r dS zt |tj�}W n ty0 Y dS 0 |j�dd�}|rT|�t�|��}|� tj�}t
|d��&}t dd� |� � D ��}W d � n1 s�0 Y |D ]}t ||� q�t
�tj� dS )z�
Download fixup files for defined patch level
:param level: download fixups for this patch level (usually it's a level of loaded patch)
:return: None
Nr, r* c S s g | ] }|� � �qS r7 )r� )r� �fixupr7 r7 r8 r� � r� z-PatchFetcher.fetch_fixups.<locals>.<listcomp>)r% r
rE r r r� r1 r rg r" r0 r+ � readlinesr r4 r r~ )r� r� r5 r Z fixups_fnamer5 �fixupsr: r7 r7 r8 � fetch_fixups� s 4 zPatchFetcher.fetch_fixups)N) rI r� r� r� r' r+ r6 r3 r= r7 r7 r7 r8 r& ~ s
)r& c C s8 t � } t�| j� | jtjkr*t�d� n
t�d� d S )Nr r ) r� r r� r� r� �PLI�PATCH_NEED_UPDATErP �exit)r� r7 r7 r8 � kcare_check� s
rA c C sZ t � } t| �}z t�� }W n ty0 i }Y n0 t�� }d}|d urZt�|d �� d�}t�
� }|� dg �}t t
j|dd��}t |�}dd� |D �} t t
j| d d��}
td
d � |D ��} || } t�� }
|
s�t
�d � n
t
�d
� t
�d�|�� t
�d�|�� |dk�r t
�d�|�� |
dk�r8t
�d�|
�� | dk�rLt
�d� t
�d� d S )NZUnknown�tsz%Y-%m-%dr� z
kpatch-cve)Z cve_fieldc S s" g | ]}|� d g �D ]}|�qqS )r� )r� )r� �rec�patchr7 r7 r8 r� � r� z%show_generic_info.<locals>.<listcomp>Zcvec s s | ]}t |�d g ��V qdS )r� N)r r� )r� rC r7 r7 r8 r( � r� z$show_generic_info.<locals>.<genexpr>z$KernelCare live patching is disabledz"KernelCare live patching is activez - Last updated on {0}z - Effective kernel version {0}r z* - {0} kernel vulnerabilities live patchedz- - {0} userspace vulnerabilities live patchedz% - This system has no applied patchesz(Type kcarectl --patch-info to learn more)r� �_kcare_patch_info_jsonr Zlibcare_patch_info_basicr r Z get_stater Z
fromtimestamp�strftimer� r� r r Zextract_unique_cves�sumr� r� r� )r� �
kcare_info� libcare_info�stateZ
latest_updateZeffective_versionZkernel_patchesZkernel_vulnerabilitiesZkernel_patches_countZuserspace_patchesZuserspace_vulnerabilitiesZuserspace_patches_countZtotal_patches_countr� r7 r7 r8 �show_generic_info� s>
rK Fc
C s� z�t dtjd�}|st�|�tj�}t�t �
|�� � �}| r�g i }}|� d�D ]0}t�
|�}|rvd|v rv|�|� qP|�|� qP||d< t�|�}t�|� W nN ty� } z t�||j� W Y d}~dS d}~0 ty� t�d� Y n0 d S )
z�
Retrieve and output to STDOUT latest patch info, so it is easy to get
list of CVEs in use. More info at
https://cloudlinux.atlassian.net/browse/KCARE-952
:return: None
r� )r� �policy�
� kpatch-namer� Nr zNo patches availabler )r� r �
POLICY_REMOTEr� r r
rC r rg r r r� r< r� �append�updatere rf r� r r r� rk ) �is_jsonr� rk �
patch_infor� r4 �chunk�datar� r7 r7 r8 �kcare_latest_patch_info s,
rV c C s� d| j i}| jd ur�t| �}g }|�d�D ]0}t�|�}|rPd|v rP|�|� q*|�|� q*||d< t� � }|rx|d nd|d< |S )Nr� rM rN r� r� �unknown)
r� r� �_kcare_patch_infor< r r� rP rQ r Z read_dumped_kernel_patch_level)r� r4 rS r� rT rU Zsaved_patch_levelr7 r7 r8 rE 4 s
rE c C sT t �� }t �|| jtj�}tj�|�s2t ddd��t
|d�� � }|rPt �
d|�}|S )NzvCan't find information due to the absent patch information file. Please, run /usr/bin/kcarectl --update and try again.zpatch info not foundr. r* rH )r r� r� r� r
rC r, r- r. r r0 r� r7 �sub)r� r� r" r� r7 r7 r8 rX H s � rX c C sZ t � }| s>|jdkr t�|j� |jd u r.d S t�t|�� nt�tjt |�dd�� d S )Nr T)Z sort_keys)
r� r� r r� r� r� rX re rf rE �rR r� r7 r7 r8 rS W s
rS c C s: t jd| g}t�|�}t�� }d}t�||�t�||�kS )Nz file-infozkpatch-build-time)r �
KPATCH_CTLr � check_outputr � _patch_infoZget_patch_value)�new_patch_filer� Znew_patch_infoZcurrent_patch_infoZbuild_time_labelr7 r7 r8 �
is_same_patchc s
r_ c C sL |dkr dS | r || k r dS | |kr(dS t �t �� |tj�}t|�sHdS dS )Nr FT)r r� r� r
rB r_ )�
applied_level� new_levelr^ r7 r7 r8 �kcare_need_updatek s rb c C sp t jrltj�t�r t�ttj�s6tj �
d� t�� d S t j
dddtgdd�\} }}| dkrltj �
d� | �� d S ) Nz-File {0} does not exist or has no read accessz /sbin/sysctl�-qz-pT�� catch_stdoutr z%Unable to load kcare sysctl.conf: {0})r
ZUPDATE_SYSCTL_CONFIGr, r- r. �
SYSCTL_CONFIG�access�R_OKr rw �warningr� r r� )r� �_r7 r7 r8 �
update_sysctl} s rk c s� t j�t�sttd��� t �tt j�s>tj �
d� t�� dS ttd��l}|� � }|�
d� |D ]$� t� fdd�| D ��s`|�� � q`|D ]}|�|d � q�|�� W d � n1 s�0 Y dS ) z*Update SYSCTL_CONFIG accordingly the editsrm zFile {0} has no read accessNzr+r c 3 s | ]}� � |�V qd S rA )r� )r� r* �r6 r7 r8 r( � r� z#edit_sysctl_conf.<locals>.<genexpr>�
)r, r- r. rf r0 r3 rg rh r rw ri r� r; �seek�any�write�truncate)r� rP Zsysctl�linesrm r7 rl r8 �edit_sysctl_conf� s
rs c C s* | D ] }t �|�rtd�|�dd��qd S )NzDDetected '{0}' kernel module loaded. Please unload that module firstzconflicting kernel moduler. )�CONFLICTING_MODULES_RE�matchr r� )r� �moduler7 r7 r8 �detect_conflicting_modules� s
�rw c C s d� t�� �S )Nz /lib/modules/{0}/extra/kcare.ko)r� r Zget_system_unamer7 r7 r7 r8 �get_kcare_kmod_link� s rx c C sp t dd�} t�t�� | tj�}tj�|�s.d S t |d��$}|�
� dd � dkW d � S 1 sb0 Y d S )Nr� r� �rbi��s ~Module signature appended~
) r� r r� r� r r! r, r- r. r0 r� )r� Z kmod_fileZvfdr7 r7 r8 �kmod_is_signed� s
rz c s4 t �d�� � d u rd S ddg} t� fdd�| D ��S )Nz
/proc/keysZ(12ff0613c0f80cfba3b2f8eba71ebc27c5a76170Z(69a6d9eed3f620d5c2e13a1d211c46510a5ad9f5c 3 s | ]}|� v V qd S rA r7 )r� r� �Z system_keysr7 r8 r( � r� z'kcare_certs_enrolled.<locals>.<genexpr>)r Z try_to_readro )Z
kcare_keysr7 r{ r8 �kcare_certs_enrolled� s
�r| c K s` d| g}|� � D ]\}}|�d�||�� qtj|dd�\}}}|dkr\td�| |�dd��d S ) Nz /sbin/insmodz{0}={1}Trd r zLUnable to load kmod ({0} {1}). Try to run with `--check-compatibility` flag.zkmod load errorr. )�itemsrP r� r r� r )Zkmodr� �cmdr� ra r� rj r7 r7 r8 � load_kmod� s
�r c C sT t �� r,t� du rtd��t� du r,td��t �� sDt �� sDt �� rPtddd��d S )NFz4Secure boot is enabled. Not supported by KernelCare.z<Secure boot is enabled. No KernelCare certificates enrolled.zWYou are running inside a container. Kernelcare should be executed on host side instead.zrunning in containerr. )r Zis_secure_bootrz r r| Zinside_vz_containerZinside_lxc_containerZinside_docker_containerr7 r7 r7 r8 �check_compatibility� s
�r� c C sP t �d�}t j|dgddd�d dk}|rL| dv rLt�d�| �� t�d� d S ) NZmodinfoZkmodlveT�re � catch_stderrr ��freer� z3{0} patch type conflicts with kmodlve kernel moduler )r Zfind_cmdr� r �logerrorr� rP r@ )r> r~ Z has_kmodlver7 r7 r8 � check_patch_type_compatibility� s
r� c C sL t �ddd| g�}g }|�d�D ]&}|�� r |�d�\}}}|�|� q |S )Nz
/sbin/modinfoz-FZparmrm �:)r r\ r< r� � partitionrP )�
kcare_link�stdoutZavailable_paramsr6 Z
param_namerj r7 r7 r8 �get_kmod_available_params� s r� c C sL t jr
dndt jrdndt jr$t jndtt jt�r8t jndt jrDdndd�S )Nr r rH )� kpatch_debugZ kmsg_outputZ kcore_outputZ
kdumps_dirZenable_crashreporter) r
� KPATCH_DEBUGZ KMSG_OUTPUTZ KCORE_OUTPUTZKCORE_OUTPUT_SIZErR �
KDUMPS_DIRr` ZENABLE_CRASHREPORTERr7 r7 r7 r8 �make_kmod_new_params� s �r� c C sB t jr tj�t j�s t�t j� t� �� D ]\} }t| |� q*d S rA ) r
r� r, r- �exists�makedirsr� r} �update_kmod_param)Zparam�valr7 r7 r8 r � s r c C s� d}t j�|| �}t j�|�s"d S z<t|d�� }|�t|�� W d � n1 sR0 Y W n" ty� tj �
d| |� Y n0 d S )Nz /sys/module/kcare/parameters�wz!failed to set %s kmod param to %s) r, r- r= r� r0 rp r` rj r rw rM )Zkmod_param_nameZ param_valueZ params_rootZ
param_pathr5 r7 r7 r8 r� s 0 r� c s� t � }t�| |tj�}zt�||� W n ty< |}Y n0 tj r^t
j � tj �s^t
�
tj � t� }t|�� t� fdd�|�� D ��}t|fi |�� t� d S )Nc 3 s" | ]\}}|� v r||fV qd S rA r7 )r� �k�v�Zavailable_kmod_paramsr7 r8 r( ! r� z"load_kcare_kmod.<locals>.<genexpr>)rx r r� r r! �shutil�copyrj r
r� r, r- r� r� r� r� �dictr} r �
update_depmod)r� r� r� Z
kcare_fileZ kmod_paramsr7 r� r8 �load_kcare_kmod s
r� c C sX dg}| d ur |� d| g� tj|ddd�\}}}|rTtjd�d�|�||�dd� d S ) Nz /sbin/depmodz-aTr� z%Running of `{0}` failed with {1}: {2}� Fr )�extendr r� r r� r� r= )�unamer~ r� rj �stderrr7 r7 r8 r� ' s �r� c C s8 t jd| gdd�\}}}|dkr4td�| |�dd��d S )Nz /sbin/rmmodTrd r z Unable to unload {0} kmod {1}zkmod unload errorr. )r r� r r� )�modnamer� rj r7 r7 r8 � unload_kmod3 s r� c C sP g }dg| D ]<}t �| |d�|��}tj�|�rt|� |�d�|�� q|S )NZvmlinuxz fixup_{0}.koz fixup_{0})r r� r� r, r- r� r rP )r� r� r� Zloaded�mod�modpathr7 r7 r8 � apply_fixups9 s r� c C s> | D ]4}z t |� W q ty6 tj�d| � Y q0 qd S )Nz$Exception while unloading module %s.)r� rj r rw rx )r< r� r7 r7 r8 �
remove_fixupsC s
r� c C s� | r
| }n6t jrt j}n(t� �|�r2d| t jdfS d| t jdfS dddddd�}|�� }||v rj|| }ntd�|| t jd�d d
��|| t jdfS ) NZfreeze_conflictTr- FZ freeze_noneZ
freeze_all)ZNONEZNOFREEZEZFULLZFREEZEZSMARTz3Unable to detect freezer style ({0}, {1}, {2}, {3})z freezer style detection errorr. )r
Z PATCH_METHODr9 � intersection�upperr r� )�freezerr� r Zpatch_method_mapr7 r7 r8 �get_freezer_styleK s* �
�r� rH c s� | ||d�� t d� � t�� }t�� }t|� t||�}t�| |tj�}t | |� d�
|tj t �
� t�|��} d|v }
|
o�t�| |�} |d u} | o�t|�o�t�| �}
� �|| d�� |
r�t d� � d S | �rt d� � t| ||�}t d� � t|� t d � � t|� | �r"t d
� � td� d }
|
�s<t d � � t| |� |�rHt� t d
� � t|| || |� t� t� d�
|t� � �� t � � t d� � t � fdd�tj!d� d S )N)r� Zfuturer �startz{0}-{1}:{2};{3}r )Zcurrent� kmod_changedr� Zfxp�unpatchZunfxp�unloadF�loadrD z5Patch level {0} applied. Effective kernel version {1}�waitc s t � �S rA )r� r7 r� r7 r8 �<lambda>� r� z kcare_load.<locals>.<lambda>)rv )"r� r r� r� rw r� r� r
rB r� r� r2 r r� Z parse_unameZis_kmod_version_changedr_ Z kcare_update_effective_versionrQ r� �kpatch_ctl_unpatchr� r� r� r� �kpatch_ctl_patchrk r r
r� r Ztouch_status_gap_filer| r� )r� r� r r� �
use_anchorr� r� r� r� � descriptionZ kmod_loadedr� Z patch_loadedZ
same_patchr< r7 r� r8 �
kcare_loadm sT
�
r� c C s� t jg}t�||tj�}tj�|�r2|� d|g� |� dd|g� |� d|d g� |�
| � t j |dd�\}}}|dkr�t
|||| ��d S )Nz-brD z-d�-mr Trd )r r[ r r� r
rD r, r- r� r� rP r r� r� ) r� r� r� r� r� r� Zblacklist_filer� rj r7 r7 r8 r� � s
r� c C s^ t jtjdd| d gddd�\}}}|dkrZtjd�||�dd� td �|t| ��d
d ��d S ) Nr� r� r Tr� �4Error unpatching, kpatch_ctl stdout:
{0}
stderr:
{1}Fr �Error unpatching [{0}] {1}�
unpatch errorr. ) r r� r r[ r r� r� r r` )r� r� r� r� r7 r7 r8 r� � s � r� c C s8 | |d< t t�� �|d< t�tj�tjd�t |�� d S )N�actionrB z kcare.state)
r ru r r� r, r- r= r r~ r` )r� r� r7 r7 r8 r� � s r� c C sl d}t j�|�sd S t �|�D ]H}t j�||dd�}t j�|�sBq t �|�}|| kr t �|� t|� q d S )Nz/usr/lib/modules/z weak-updateszkcare.ko) r, r- �isdir�listdirr= �islink�readlink�unlinkr� )� kmod_linkZ modules_path�entryZ
sym_link_pathZ target_pathr7 r7 r8 �update_weak_modules� s
r� c
C sb t �� }t� }z|�|� W n: tyV } z"|sBtd�|�dd��W Y d }~n
d }~0 0 t �� }t| |�}t � �� d|v �r|d u}|r�t
t � � ||�}t j
tjdd|d gddd �\} }
} t|� | dkr�tjd
�|
| �d d � td
�| t|��dd��tjt�t�dtd�t�d� t� } tj � | ��r6t� | � t | � W d � n1 �sT0 Y d S )Nz�Unable to retrieve fixups: '{0}'. The unloading of patches has been interrupted. To proceed without fixups, use the --force flag.zfixups retrieval errorr. r r� r� r Tr� r� Fr r� r� r )�count�delay) r r� r& r= rj r r� r� r� r� r� r� r r� r r[ r� r r� r` r Zretryr Z check_exc�UNLOAD_RETRY_DELAYr� rx r, r- r. r� r� )
r� �forcer� �pf�errr� r� Z need_unpatchr< r� r� r� r� r7 r7 r8 � kcare_unload� sB ��
� �
r� c C s8 t � }| rt|�S |jdkr"|jS |jd ur4t�� S d S r� )r� �_kcare_info_jsonr� r� r� r r] rZ r7 r7 r8 rH s
rH c C sR d| j i}| jd ur>|�t�t�� �� |�t�|�d��� | j |d< t
� |�S )Nr� zkpatch-descriptionz kpatch-state) r� r� rQ r r� r r] Zparse_patch_descriptionr� rJ re rf )r� r4 r7 r7 r8 r� s
r� c @ s$ e Zd ZdZdZdZdZdd� ZdS )r> r r rn r� c C s" || _ || _|| _|| _|| _d S rA )r� r� �
remote_lvlr� rJ )r� r� r� r� r� rJ r7 r7 r8 r� % s
z PLI.__init__N)rI r� r� r r? �PATCH_UNAVALIABLE�PATCH_NOT_NEEDEDr� r7 r7 r7 r8 r> s
r> c C s� t �� } z�tdd�}| rJt| |�r6tjdd }}}qxtjdd }}}n.|dkrftjdd }}}ntjd d }}}t|||| |�}W nj ty� tj }t
j r�d
� t
j t
�� d t�� �}n d � t
�� d t�� t �� �}t||d d d �}Y n0 |S )
Nr� r� z*Update available, run 'kcarectl --update'.Zappliedz The latest patch is applied.r z(This kernel doesn't require any patches.ZunsetzDNo patches applied, but some are available, run 'kcarectl --update'.zuInvalid sticky patch tag {0} for kernel ({1} {2}). Please check /etc/sysconfig/kcare/kcare.conf STICKY_PATCH settingsr� Z unavailable)r r� r� rb r> r? r r� r� r� r
� STICKY_PATCHr� r r] r� r� r� )Zcurrent_patch_levelZnew_patch_levelr� r� rJ r� r7 r7 r8 r� - sF
� � � �
���r� c
C s� d}zZt �� }td|fd| fg�}t�� d�|� }t�|�}t� t�
|� � ��}t |d �W S t
y� } zt�||� W Y d}~dS d}~0 ty� } zt�||� W Y d}~dS d}~0 t� y� } z t�d�|�� W Y d}~d S d}~0 0 dS )
z�
Request to tag server from ePortal. See KCARE-947 for more info
:param tag: String used to tag the server
:return: 0 on success, -1 on wrong server id, other values otherwise
N� server_id�tagz/tag_server.plain?{0}r� ������zInternal Error {0}���)r � get_serveridr# r r� r� r r� r r� rg r� r r r r� r rj r� ) r� rk r� Zqueryr� r� r� ZueZeer7 r7 r8 �
tag_server_ s"
r� c C s� t �d�} t�d�| �� t}t�� ��}z:t� | |j
�}t � t �
| �|j
� t�|j
|� |j
}W n4 ty� } z t�d�|�� W Y d }~n
d }~0 0 tjd|t�� gdd�\}}}|r�td�||�dd ��W d � n1 s�0 Y d S )
Nz doctor.shz#Requesting doctor script from `{0}`z3Kcare doctor error: {0}. Fallback to the local one.ZbashT)r� z Script failed with '{0}' {1}zdoctor script failedr. )r ri r Zlogdebugr� �KCDOCTOR�tempfileZNamedTemporaryFiler Zfetch_signaturer$ Z save_to_filer r� Zcheck_gpg_signaturerj r� r r� r Zget_patch_serverr )Z
doctor_urlZdoctor_filenameZ
doctor_dstZ signaturer� r� rj r� r7 r7 r8 �kcdoctorz s
& r� c C sB t �d�t��} zt�| � W n ty2 Y dS 0 t�d� dS )Nz{0}-new-versionFzwA new version of the KernelCare package is available. To continue to get kernel updates, please install the new versionT) r ri r� �EFFECTIVE_LATESTr r� r r r
)rk r7 r7 r8 �check_new_kc_version� s �r� c
C s t �� }t|�}|tjkp*|tjko*|du }zt| |�}W n� tjy� } z4|du rV� t �
t |�� t �
d� tj }W Y d}~nFd}~0 t
y� } z&|r�� nt j�d�|�� W Y d}~n
d}~0 0 |tjkr�|} n@|} |du �r|tj kr�t �|d�} n|tjk�r|} ntd��| S )a�
Get patch level to apply.
:param reason: what was the source of request (update, info etc.)
:param policy: REMOTE -- get latest patch_level from patchserver,
LOCAL -- use cached latest,
LOCAL_FIRST -- if cached level is None get latest from patchserver, use cache otherwise
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:return: patch_level string
Nz#Using previously downloaded patcheszUnable to send data: {0}r z9Unknown policy, choose one of: REMOTE, LOCAL, LOCAL_FIRST)r r� r� r rO ZPOLICY_LOCAL_FIRSTr r r r r
r` Z POLICY_LOCALrj rw ri r� r� r )
r� rL r r� Z cached_levelZconsider_remote_exZ remote_levelr� r r� r7 r7 r8 r� � s2
(
r� c C s� | dkr d S | dkrdn| t _ttdd�t j�r�tjt jd� t jdv rnt�� rnt jpXt }t
dd d
� |�f� t �
d � | �� ntd � | �d
d��d S )N�edfr- rH Zprober� �r2 r� )zfs.enforce_symlinksifownerzfs.symlinkown_gidz fs.enforce_symlinksifowner=1zfs.symlinkown_gid={0}z'{0}' patch type selectedz/'{0}' patch type is unavailable for your kernelzpatch type unavailabler. )r
r2 r r r �
update_configr Z is_cpanelZ FORCE_GID�
CPANEL_GIDrs r� r r
r )r> �gidr7 r7 r8 �update_patch_type� s
�r� Zkernelc
C s� t tj� |tjkrt� ztd||d�}W n^ ty� } zF|tjtj fv rttj
rtt |�}t j
�|� W Y d}~dS � W Y d}~n
d}~0 0 t�� }|tjkr�tjs�dS t|�}|�� t||d�s�t �d� dS z(tjtjddd� tjtjdd d� W n t�y t j
�d
� Y n0 t�� }t � �2 |� |� t |||| |tj kd � W d � n1 �sd0 Y t� |� t ||� dS ) ax
:param mode: constants.UPDATE_MODE_MANUAL, constants.UPDATE_MODE_AUTO or constants.UPDATE_MODE_SMART
:param policy: REMOTE -- download latest and patches from patchserver,
LOCAL -- use cached files,
LOCAL_FIRST -- download latest and patches if cached level is None, use cache in other cases
:param freezer: freezer mode
rQ )r� rL r N)r` ra z%No updates are needed for this kernelr� z kcore*.dump)Zkeep_n�patternz kmsg*.logz#Error during crash reporter cleanup)r� )!r� r
r2 r rO r� r� r� �UPDATE_MODE_AUTO�UPDATE_MODE_SMARTr� r` r rw ri r r� r� r& r6 rb r
r r� r� rj rx r� r� r= r� Zdump_kernel_patch_levelr� ) r� r rL r� r� r� r� r� r� r7 r7 r8 � do_update� s<
8
r� c C s� t ttj�ttjptj�ttjp$tj�f�}|dkr@tddd��tjrLtjS | t j
krptjp`tj}tjpltj}n tj}tj}|r�|S |r�d| S d S )Nr z�Invalid configuration: conflicting settings STICKY_PATCH, [AUTO_]UPDATE_DELAY or [AUTO_]STICKY_PATCHSET. There should be only one of themzconflicting sticky settingsr. zrelease-) rG �boolr
r� Z UPDATE_DELAYZAUTO_UPDATE_DELAYZSTICKY_PATCHSETZAUTO_STICKY_PATCHSETr r �UPDATE_MODE_MANUAL)r r� r� Zpatchsetr7 r7 r8 �
get_sticky s, ���
r� c C s | d | S )Nr: r7 )r� r� r7 r7 r8 � _stickyfy< s r� c
C s" t |�}|s| S |dkr"t|| �S t�� }|sDtj�d� t�d� z t �
t � � d�
|� �}W n< ty� } z$t�||j� t�d� W Y d}~n
d}~0 0 t�t�|�� ��}t|d �}|dkr�t|d | �S |d
kr�| S |d k�r tj�d � t�d
� tj�d|d � t�d� dS )z�
Used to add sticky prefix to satisfy KCARE-953
:param file: name of the file to stickify
:return: stickified file.
�KEYzHPatch set to STICKY_PATCH=KEY, but server is not registered with the keyr� z!/sticky_patch.plain?server_id={0}r� Nr� r r� r rn zEServer ID is not recognized. Please check if the server is registeredr; zError: r� r� )r� r� r r� r rw r� rP r@ r r� r r� r� r r� rk r r� rg r� r )�filer �sr� r� r� r� r� r7 r7 r8 r @ s2
r c
C s� g }| s dS | � d�}|d }|dd� }|�d�}||krLtdt| � ��|s`| �� |�� kS |dkrt|�d� n>|�d �s�|�d �r�|�t�|�� n|�t�|�� d
d �� |D ]}|�t�|�� q�t�
d d
� |� d tj �} | �
|�S )zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
Fr: r r N�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)r< r� r� �repr�lowerrP r� �re�escape�replace�compiler= �
IGNORECASEru )
Zdn�hostnameZ
max_wildcardsZpats�piecesZleftmostZ remainderZ wildcardsZfragZpatr7 r7 r8 �_dnsname_matchl s(
r� c C s g }t | �� �D ]2}| �|�}|�� dkrdd� t|��d�D �}q| sPtd��g }|D ]*\}}|dkrXt||�rx d S |�|� qX|s�| � � j
}t||�r�d S |�|� t |�dkr�t d�
|d �tt|�����n*t |�dkr�t d
�
||d ���nt d ��d S )
NZsubjectAltNamec S s g | ]}|� � �d d��qS )r� r )r� r< )r� �itr7 r7 r8 r� � r� z"match_hostname.<locals>.<listcomp>�,ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZDNSr z(hostname {0} doesn't match either of {1}r� z hostname {0} doesn't match {1}r z=no appropriate commonName or subjectAltName fields were found)�rangeZget_extension_countZ
get_extensionZget_short_namer` r< r� r� rP Z get_subjectZ
commonNamer r� r� r= �mapr� ) Zcertr� Zsanr� r� Zdnsnamesr� ra Zcnr7 r7 r8 r� � s2
�
r� c C s� t ddd�} | jdddd� | jdd d
dd� | jd d dd� | jd
dddd� | jdddd� | jdddd� | jdddd� | jdddd� | jdddd� | jd d d d� | jd d dd� | jd!d"dd� | jd#d$dd� | jd%d&dd� | jd'd(d)d� | jd*d+dd� | jd,d-dd� | jd.d/dd� | jd0d1dd� | jd2d3dd� | jd4d5d6d� | jd7d8d9d� | jd:d;dd� | jd<d=d)d� | jd>d?dd� | jd@dAdd� | jdBdCdd� | jdDdEddFdG� | jdHdIdd� | jdJdKdd� | jdLdMdd� | jdNdOdd� | jdPdQdd� | jdRdSdd� | jdTdUdd� | jdVdWdd� | jdXdYdd� | jdZd[d\td d]d^� | jd_d`dd� | jdadbdd� | �� }|jdcddd\d� |jdedfdd� |jdgdhdd� | jdidjd\d d]dk� | jdldmdndd]do� | jdpdqdr� | jdsdtdd� | jdudvdwdxdy� tj�s | jdzd{d|d}d]d~� | jdd�d|d}d�d~� | jd�d�dd� | jd�d�d�dd� | jd�d�d�dd� | jd�ddd� | jd�d�d�dd� | jd�d�d�dd� | jd�d�d�d�d� | jd�d�d�dd�d�� | jd�d�dd� | jd�d�dd� | jd�d�d6d�d\d d]d�� | �� }t�� tj�sFt j d�g7 _ |j
d u�rzt t d |j
�
d�����tj ��rvd�S d�S |j�s�|j�r�tj�r�tjt_ntjt_n|j�r�tjt_|j�s�t�� d�k�r�td�t j d�� d�S t j }|j�r�t j }n|j�rt j!}t"�#|� tj$�s t�%� |j&�r,t'�(� |j)�rn|j)d�k�r\t*|j)�t_+tj,tj+d�� nd t_+tj,dd�� |j-d u�r�tj,|j-d�� |j-t_.|j/�r�d]t_0|j1�r�d]t_2|j3�r�d�t_4|j5�r�t5� |j6�r�t7�8d�t9� n8|j:�rtj;d�k�rtj<d�k�rdntj<�p d�|_=d�|_>|j?�r&|j?t_@|jA�r@t7�8d�t9� d�t_@tj@�Bd��t_@tj@�r~tj@tCv�r~t"jD�Ed��Ftj@d��GtC��� |jH�r�d�t_Id�|jH t_J|j=�r�tK|j=� tj;d�k�r�tL� t_;t7�8d��Ftj;�p�d��t9� |jM�r�t'�NtOjM|jPd��� d S |jQ�r$tQjQd�d�d�d��}t'�NtP�R|�� d S tStj;� |jT�rJtTjUtV|jWd�� d S |jX�r�tY�ZtQjQd�d�d�d���}d��F|j[�}|j\�r�t'�N|� nRtY�]|�}|�r�t"�^d��F|�� nt"j_d�d�d�� |j`�r�t'�N|� n|�r�|�a� |jb�r |jP�r�tbd�d�� ntb� d S |jc�rtj,d�d�� d S |jd�r0tj,d�d�� d S |je�rHt�f|je� d S |jg�rZth|jg�S |ji�rjtj�i� |jk�r�tj;d�k�r�tj,d�d tj�k|jk|jl�S |jm�r�tj�m� d�k�r�d�S d�S |jnd u�r�to|jn�S |jp�r�t'�Ntjq� tr|d|d �d u� rts�t|ju� d�S tj�
s�|jv� r d�|jvini }|jw� r2ts�x� S |jy� rZtsjzf i |��d u� rZt"�^dġ |j{� rztsjzf d�tj|i|�� n|j}� r�ts�~� t"�^dơ |j� r�ts��� t"�^dǡ |j�� r�t'�Nts��� � |j�� r�t'�Nts��� � |j�� r�ts��� � r�t'�Nts��|j��� |j�d u�
rn|j�dk�
r0tj��
p,t�ts��� ��� �} nd�dɄ |j��
d��D �} tsjzf d�t�| �i|��d u�
rnt"�^dġ |j��
r�tsjzf tj|d d˜|�� |j��
r�t'�Nt�|jPd��� d}
|j��
r�t7�8d�t9� d�}
|j��
r�|j�}
|j��
r�t�|
tj�tj�d |j>� r t�|
tj�dύ t"�^dС |j� r"t'�Nt���� � |j�� rBt�|
|j�dэ t"�^dҡ |j� rpd]t_�t���t���d�dӡ� t�|
tj|dύ |j�� r�t�|jPd�� |j�� r�t�� S |j�� r�t�|jPd�� |j�� r�t�� t�t j��d�k� r�t�� d S )�NZkcarectlz)Manage KernelCare patches for your kernel)Zprogr� z--debugrH Z
store_true)�helpr� z-iz--infoz]Display information about KernelCare. Use with --json parameter to get result in JSON format.z
--app-infozcDisplay information about KernelCare agent. Use with --json parameter to get result in JSON format.z-uz--updatez<Download latest patches and apply them to the current kernelz--unloadzUnload patchesz--smart-updatez,Patch kernel based on UPDATE POLICY settingsz
--auto-updatez-Check if update is available, if so -- updatez--localzNUpdate from a server local directory; accepts a path where patches are located�PATH)r� �metavarz --patch-infoz"Return the list of applied patchesz --freezerz)Freezer type: full (default), smart, noner� z
--nofreezez/[deprecated] Don't freeze tasks before patchingz--unamezReturn safe kernel versionz--license-infozReturn current license infoz--statuszReturn status of updatesz
--registerz Register using KernelCare Keyr� z--register-autoretryz=Retry registering indefinitely if failed on the first attemptz --unregisterz7Unregister from KernelCare (for key-based servers only)z--checkz Check if new update availablez--latest-patch-infoziReturn patch info for the latest available patch. Use with --json parameter to get result in JSON format.z--testz&[deprecated] Use --prefix=test insteadz--tagz7Tag server with custom metadata, for ePortal users onlyZTAGz--prefixzpPatch source prefix used to test different builds by downloading builds from different locations based on prefixr� z
--nosignaturezDo not check signaturez--set-monitoring-keyzPSet monitoring key for IP based licenses. 16 to 32 characters, alphanumeric onlyz--doctorz@Submits a vitals report to CloudLinux for analysis and bug-fixesz
--fallbackzNWith --doctor, force the legacy kcdoctor.sh flow instead of the v2 upload pathz--kernel-anomaly-reportzHSubmits a kernel anomaly report to CloudLinux for analysis and bug-fixesz --no-sendzSkip sending artifacts� save_only)r� r� �destz --keep-localz:Don't delete generated kernel anomaly report after sendingz--enable-auto-updatezEnable auto updatesz--disable-auto-updatezDisable auto updatesz
--plugin-infozProvides the information shown in control panel plugins for KernelCare. Use with --json parameter to get result in JSON format.z
--server-infoz3Provides information about the host in JSON format.z--jsonzoReturn '--plugin-info', '--latest-patch-info', '--patch-info', '--app-info' and '--info' results in JSON formatz --versionz(Return the current version of KernelCarez--kpatch-debugzEnable the debug modez--no-check-certz2Disable the patch server SSL certificates checkingz--set-patch-levelzBSet patch level to be applied. To select latest patch level set -1ZstoreF)r� r� r[ r- �requiredz--check-compatibilityzCheck compatibility.z
--clear-cachezClear all cached filesz--set-patch-typez@Set patch type feed. To select default feed use 'default' optionz
--edf-enabledz"Enable exploit detection frameworkz--edf-disabledz#Disable exploit detection frameworkz--set-sticky-patchzjSet patch to stick to date in DDMMYY format, or retrieve it from KEY if set to KEY. Leave empty to unstick)r� r� r- r rc z--quietz=Suppress messages, provide only errors and warnings to stderr)r� r� r z --has-flagszCheck agent features)r� z--forcez-Force action and ignore several restristions.z --set-configzChange configuration optionrP z KEY=VALUE)r� r� r� z--disable-libcarezDisable libcare services�enable_libcareZ store_const)r� r r� �constz--enable-libcarezEnable libcare servicesTz --lib-updatezIDownload latest patches and apply them to the current userspace librariesz --lib-unloadz--userspace-unloadzUnload userspace patchesz--lib-repluginz--userspace-repluginz Reload libcare-server pluginz--lib-auto-updatez
--lib-infoz--userspace-infoz&Display information about KernelCare+.z--lib-patch-infoz--userspace-patch-infoz,Return the list of applied userspace patchesz
--lib-versionz--userspace-versionzReturn safe package versionZ PACKAGENAMEz--userspace-update�USERSPACE_PATCHESr zODownload latest patches and apply them to the corresponding userspace processes)r� Znargsr r� z--userspace-auto-updatez--userspace-statusz"Return status of userspace updatesz --lib-tagz--userspace-tagz�Apply userspace patches for a specific tag (DDMMYY, YYYY-MM-DD, Nd, Nh, release-<NAME>) into an isolated cache, leaving the default storage untouched. Use together with --lib-update or --userspace-update.)r� r� r� r- r zlibcare-enabledr� r r zPlease run as root)r� )r )r� zTFlag --edf-enabled has been deprecated and will be not available in future releases.r� r- zMFlag --test has been deprecated and will be not available in future releases.r% �/z(Prefix `{0}` is not in expected one {1}.r� zfile:z+edf patches are deprecated. Fallback to {0})rR r )r� r r )Zforce_fallbackz)Kernel anomaly report file generated: {0}z0Kernel anomaly report uploaded successfully: {0}r r re )r� ZYES)r� ZNOr� r� r� r� z Userspace patches are applied.r z Userspace patches are unloaded.zLibcare plugin reloaded.c S s g | ]}|� � �� �qS r7 )r� r� )r� Zptchr7 r7 r8 r� 5 r� zmain.<locals>.<listcomp>�limit)r r zQFlag --nofreeze has been deprecated and will be not available in future releases.r� )r rL r0 zKernel is safe)r� z=KernelCare protection disabled. Your kernel might not be safe�< )�r Z add_argumentr Z add_mutually_exclusive_groupr
ZLIBCARE_DISABLEDZ
parse_argsr Z set_settings_from_config_file�FLAGSZ has_flagsr+ �filterr< �issubset�quietZ auto_updateZSILENCE_ERRORSr ZPRINT_CRITICALZ PRINT_LEVELZ PRINT_ERRORr Z PRINT_DEBUGr� r, �getuid�printrP r� �logging�INFOZWARNING�DEBUGr Zinitialize_loggingZIGNORE_FEATURE_FLAGSZ set_feature_flags_from_cacher� r Zclear_all_cacheZset_patch_levelr` r r� Zset_sticky_patchr� Z nosignaturer# Z
no_check_certr� r� r� r� Z edf_enabled�warnings�warn�DeprecationWarningZ edf_disabledr2 ZPREV_PATCH_TYPEZset_patch_typerQ r� r� r% r� �EXPECTED_PREFIXrw ri r� r= Zlocalrd Z PATCH_SERVERr� r� Zapp_infor� r re r rf rG r
Zsend_doctor_reportr� ZfallbackZkernel_anomaly_reportr r Z archive_pathr� r r
r
Z
keep_localr r� Zenable_auto_updateZdisable_auto_updateZ
set_configZupdate_config_from_argsZset_monitoring_keyr� Z
unregisterr �registerZregister_autoretryr� r� r� r� r^ r_ r Zset_libcare_statusr Zlib_tagZuserspace_statusZget_userspace_update_statusZ
lib_updateZdo_userspace_updateZlib_auto_updater� Z
lib_unloadZlibcare_unloadZ lib_repluginZlibcare_repluginZlib_inforI Zlib_patch_infoZlibcare_patch_infoZ lib_versionZlibcare_server_startedZlibcare_versionZuserspace_updater �listZget_userspace_map�keys�sortedZuserspace_auto_updater� rH Znofreezer� Z smart_updater� r� Z
UPDATE_POLICYr� r r� r� r� r� ZCHECK_CLN_LICENSE_STATUSru rv �randomZuniformrS r� r� Zlatest_patch_inforV ZcheckrA r �argvrK ) ZparserZexclusive_groupr� r� r� r Zlocal_path_messager Z
lib_tag_kwr r� r7 r7 r8 �main� s� ���������������
�
�
������
�
r )N)N)F)F)N)rH F)rH F)r )�Z
__future__r rh re r r, r� r r� r� r� ZsslrP r� ru rO r Zargparser �
contextlibr r rH r r r r
r r r
r r r r r r r r r r r r r r r r r Zpy23r r r! r" r# r� r� r r/ r� r rf r� r� �DOTALLr7 rt r- r� �insert�filterwarningsr �Any�Dict�Optional�Set�Tuple�Unionrw ZsetLevelr r9 r@ rG rc rl r| r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r_ Zdistutils.versionZ distutilsZ OpenSSL.SSLr� r� Z
StrictVersion� __version__� ImportErrorr� ZHTTPSConnectionZPureHTTPSConnection�objectr� r� r r� r r r% r& rA rK rV rE rX rS r_ rb rk rs rw rx rz r| r r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� Zlog_all_parent_processesr� rH r� r> r� r� r� r� rO r� r� Ztrack_update_statusr� r� r� r r� r� r r7 r7 r7 r8 �<module> s \
&
4
-! b +
"
?
- 2
.= ,
3)