Coverage Report

Generated on 21 Aug 25 11:02 +0000 with gocov-html

Package Overview: agent 75.10%

This is a coverage report created after analysis of the agent package. It has been generated with the following command:

gocov test agent | gocov-html

Here are the stats. Please select a function name to view its implementation and see what's left for testing.

`easyjsonD587a15Encode1(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`28/28`
`FailureWatchdog.RecordFailure(...)`	`agent/watchdog.go`	`100.00%`	`18/18`
`query(...)`	`agent/rbl.go`	`100.00%`	`15/15`
`Agent.ServeLogRBLStat(...)`	`agent/agent.go`	`100.00%`	`13/13`
`CPanelAuthMsg.Unmarshal(...)`	`agent/cpanel.go`	`100.00%`	`13/13`
`License.Signed(...)`	`agent/license.go`	`100.00%`	`11/11`
`LicenseWatcher.validLicense(...)`	`agent/license.go`	`100.00%`	`10/10`
`easyjson3c9d2b01EncodeGithubComUserHello(...)`	`agent/request_easyjson.go`	`100.00%`	`10/10`
`Record.MarshalMsg(...)`	`agent/record_msgp.go`	`100.00%`	`9/9`
`validLicense(...)`	`agent/license.go`	`100.00%`	`8/8`
`NewWhiteList(...)`	`agent/whitelist.go`	`100.00%`	`6/6`
`FailureWatchdogRecord.MarshalMsg(...)`	`agent/watchdog_record_gen.go`	`100.00%`	`6/6`
`WhiteList.reload(...)`	`agent/whitelist.go`	`100.00%`	`6/6`
`Record.Msgsize(...)`	`agent/record_msgp.go`	`100.00%`	`6/6`
`NewFailureWatchdog(...)`	`agent/watchdog.go`	`100.00%`	`6/6`
`LicenseWatcher.notify(...)`	`agent/license.go`	`100.00%`	`4/4`
`@140:8(...)`	`agent/config.go`	`100.00%`	`4/4`
`Database.writeRecord(...)`	`agent/database.go`	`100.00%`	`4/4`
`@43:8(...)`	`agent/conn_tracker.go`	`100.00%`	`3/3`
`License.UnmarshalJSON(...)`	`agent/license_proto_easyjson.go`	`100.00%`	`3/3`
`License.MarshalJSON(...)`	`agent/license_proto_easyjson.go`	`100.00%`	`3/3`
`StatRecord.MarshalJSON(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`3/3`
`LicenseWatcher.Subscribe(...)`	`agent/license.go`	`100.00%`	`3/3`
`StatRecord.UnmarshalJSON(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`3/3`
`LicenseWatcher.readLicenseAndNotify(...)`	`agent/license.go`	`100.00%`	`3/3`
`Request.UnmarshalJSON(...)`	`agent/request_easyjson.go`	`100.00%`	`3/3`
`Request.MarshalJSON(...)`	`agent/request_easyjson.go`	`100.00%`	`3/3`
`SendMessagesApiRequest.MarshalJSON(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`3/3`
`Response.UnmarshalJSON(...)`	`agent/request_easyjson.go`	`100.00%`	`3/3`
`SendMessagesApiRequest.UnmarshalJSON(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`3/3`
`Response.MarshalJSON(...)`	`agent/request_easyjson.go`	`100.00%`	`3/3`
`ConnTracker.TrackActivity(...)`	`agent/conn_tracker.go`	`100.00%`	`2/2`
`LicenseWatcher.Stop(...)`	`agent/license.go`	`100.00%`	`2/2`
`LicenseWatcher.Start(...)`	`agent/license.go`	`100.00%`	`2/2`
`@113:5(...)`	`agent/license.go`	`100.00%`	`2/2`
`Database.WithUserIPWhitelist(...)`	`agent/database.go`	`100.00%`	`2/2`
`Database.WithUserWhitelist(...)`	`agent/database.go`	`100.00%`	`2/2`
`FailureWatchdogRecord.Msgsize(...)`	`agent/watchdog_record_gen.go`	`100.00%`	`2/2`
`FailureWatchdogRecord.DumpToFile(...)`	`agent/watchdog_record.go`	`100.00%`	`2/2`
`FailureWatchdogRecord.Unmarshal(...)`	`agent/watchdog_record.go`	`100.00%`	`2/2`
`FailureWatchdogRecord.Marshal(...)`	`agent/watchdog_record.go`	`100.00%`	`2/2`
`Record.Unmarshal(...)`	`agent/record.go`	`100.00%`	`2/2`
`Record.Marshal(...)`	`agent/record.go`	`100.00%`	`2/2`
`ModuleStringResponse(...)`	`agent/module.go`	`100.00%`	`2/2`
`@80:19(...)`	`agent/rbl.go`	`100.00%`	`2/2`
`UserIPLockConfig.ForgeAutowhitelistLockConfig(...)`	`agent/config.go`	`100.00%`	`1/1`
`NewConnTracker(...)`	`agent/conn_tracker.go`	`100.00%`	`1/1`
`loadLockConfigIP(...)`	`agent/config.go`	`100.00%`	`1/1`
`@23:20(...)`	`agent/utils.go`	`100.00%`	`1/1`
`UserIPLockConfig.IsAutowhitelistEnabled(...)`	`agent/config.go`	`100.00%`	`1/1`
`@49:17(...)`	`agent/api.go`	`100.00%`	`1/1`
`@186:17(...)`	`agent/rbl.go`	`100.00%`	`1/1`
`StatRecord.UnmarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`1/1`
`ConnTracker.Stop(...)`	`agent/conn_tracker.go`	`100.00%`	`1/1`
`init(...)`	`agent/sentry.go`	`100.00%`	`1/1`
`StatRecord.MarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`100.00%`	`1/1`
`Agent.RequestId(...)`	`agent/agent.go`	`100.00%`	`1/1`
`loadLockConfigUser(...)`	`agent/config.go`	`100.00%`	`1/1`
`loadLockConfigUserIP(...)`	`agent/config.go`	`100.00%`	`1/1`
`NewSendMessageAPI(...)`	`agent/api.go`	`100.00%`	`1/1`
`LockConfig.IsEnabled(...)`	`agent/config.go`	`100.00%`	`1/1`
`Config.IsVerboseLoggingMode(...)`	`agent/config.go`	`100.00%`	`1/1`
`UserWhiteList.reset(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`UserWhiteList.loadLine(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`IPWhiteList.reset(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`Config.IsSentryEnabled(...)`	`agent/config.go`	`100.00%`	`1/1`
`Config.IsLogfileEnabled(...)`	`agent/config.go`	`100.00%`	`1/1`
`NewLicenseWatcher(...)`	`agent/license.go`	`100.00%`	`1/1`
`License.signedContent(...)`	`agent/license.go`	`100.00%`	`1/1`
`UserIPWhiteList.reset(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`easyjson2c6259e0Encode1(...)`	`agent/license_proto_easyjson.go`	`97.56%`	`40/41`
`easyjsonD587a15Encode12(...)`	`agent/api_proto_easyjson.go`	`97.56%`	`40/41`
`easyjsonD587a15Encode11(...)`	`agent/api_proto_easyjson.go`	`96.88%`	`31/32`
`Agent.WriteStat(...)`	`agent/agent.go`	`96.43%`	`27/28`
`Database.writeAttempt(...)`	`agent/database.go`	`96.00%`	`24/25`
`readWhiteList(...)`	`agent/whitelist.go`	`92.86%`	`13/14`
`easyjson3c9d2b01EncodeGithubComUserHello1(...)`	`agent/request_easyjson.go`	`92.31%`	`36/39`
`UserIPWhiteList.In(...)`	`agent/whitelist.go`	`92.31%`	`12/13`
`CheckRBL(...)`	`agent/rbl.go`	`91.67%`	`11/12`
`ConnTracker.HandleActivity(...)`	`agent/conn_tracker.go`	`91.67%`	`11/12`
`IPWhiteList.In(...)`	`agent/whitelist.go`	`90.91%`	`10/11`
`rblLookupIP(...)`	`agent/rbl.go`	`90.91%`	`10/11`
`IPWhiteList.loadLine(...)`	`agent/whitelist.go`	`90.00%`	`9/10`
`getOsRelease(...)`	`agent/sentry.go`	`90.00%`	`9/10`
`LicenseWatcher.rereadLicense(...)`	`agent/license.go`	`89.47%`	`17/19`
`UserWhiteList.In(...)`	`agent/whitelist.go`	`88.89%`	`8/9`
`CPanelFtpAuthRecv(...)`	`agent/cpanel.go`	`88.89%`	`8/9`
`@212:20(...)`	`agent/rbl.go`	`88.89%`	`8/9`
`UserIPWhiteList.loadLine(...)`	`agent/whitelist.go`	`88.24%`	`15/17`
`Database.Close(...)`	`agent/database.go`	`87.50%`	`7/8`
`LicenseWatcher.watcher(...)`	`agent/license.go`	`87.50%`	`7/8`
`LoadLicense(...)`	`agent/license.go`	`87.50%`	`7/8`
`Agent.ServeListener(...)`	`agent/agent.go`	`86.67%`	`13/15`
`Agent.Stop(...)`	`agent/agent.go`	`84.85%`	`28/33`
`LoadPublicKey(...)`	`agent/license.go`	`84.62%`	`11/13`
`@417:6(...)`	`agent/agent.go`	`83.33%`	`10/12`
`init(...)`	`agent/agent.go`	`83.33%`	`5/6`
`Agent.Serve(...)`	`agent/agent.go`	`83.33%`	`5/6`
`@169:18(...)`	`agent/agent.go`	`83.33%`	`5/6`
`Agent.ServeSendStat(...)`	`agent/agent.go`	`82.35%`	`14/17`
`NewIPWhiteList(...)`	`agent/whitelist.go`	`81.82%`	`9/11`
`NewUserIPWhiteList(...)`	`agent/whitelist.go`	`80.00%`	`4/5`
`SendMessageAPI.send(...)`	`agent/api.go`	`80.00%`	`4/5`
`loadHostPort(...)`	`agent/config.go`	`80.00%`	`4/5`
`NewUserWhiteList(...)`	`agent/whitelist.go`	`80.00%`	`4/5`
`Database.expireOld(...)`	`agent/database.go`	`79.49%`	`31/39`
`Database.WriteAttempts(...)`	`agent/database.go`	`78.26%`	`18/23`
`FailureWatchdogRecord.ReadFromFile(...)`	`agent/watchdog_record.go`	`77.78%`	`7/9`
`getOwnIP(...)`	`agent/sentry.go`	`77.78%`	`7/9`
`Agent.ProcessModuleRequest(...)`	`agent/module.go`	`76.60%`	`36/47`
`Agent.ProcessCPanelFtpAuthRequest(...)`	`agent/cpanel.go`	`75.64%`	`59/78`
`NewSentryLogger(...)`	`agent/sentry.go`	`75.00%`	`21/28`
`shouldLogError(...)`	`agent/agent.go`	`75.00%`	`6/8`
`WhiteList.isNeedUpdate(...)`	`agent/whitelist.go`	`75.00%`	`6/8`
`Request.CheckSign(...)`	`agent/request.go`	`75.00%`	`3/4`
`GetAgentLicStatus(...)`	`agent/license.go`	`75.00%`	`3/4`
`IsRunningSystemd(...)`	`agent/service.go`	`75.00%`	`3/4`
`Agent.Start(...)`	`agent/agent.go`	`74.32%`	`55/74`
`DatabaseOpen(...)`	`agent/database.go`	`73.33%`	`11/15`
`Database.readRecord(...)`	`agent/database.go`	`73.33%`	`11/15`
`easyjson2c6259e0Decode1(...)`	`agent/license_proto_easyjson.go`	`72.73%`	`32/44`
`Database.RemoveSuccess(...)`	`agent/database.go`	`72.00%`	`18/25`
`easyjsonD587a15Decode1(...)`	`agent/api_proto_easyjson.go`	`71.43%`	`20/28`
`Database.serveExpireOld(...)`	`agent/database.go`	`71.43%`	`10/14`
`ConnProcess(...)`	`agent/utils.go`	`71.43%`	`5/7`
`ConfigLoad(...)`	`agent/config.go`	`71.43%`	`5/7`
`easyjsonD587a15Decode12(...)`	`agent/api_proto_easyjson.go`	`70.45%`	`31/44`
`easyjsonD587a15Decode11(...)`	`agent/api_proto_easyjson.go`	`70.00%`	`28/40`
`Database.CheckLock(...)`	`agent/database.go`	`68.97%`	`20/29`
`Request.calcSign(...)`	`agent/request.go`	`66.67%`	`12/18`
`connProcessPid(...)`	`agent/utils.go`	`66.67%`	`10/15`
`WhiteList.Update(...)`	`agent/whitelist.go`	`66.67%`	`8/12`
`NewRBL(...)`	`agent/rbl.go`	`66.67%`	`6/9`
`SendMessageAPI.SendStats(...)`	`agent/api.go`	`66.67%`	`4/6`
`GetListeners(...)`	`agent/socket.go`	`64.71%`	`11/17`
`FailureWatchdogRecord.UnmarshalMsg(...)`	`agent/watchdog_record_gen.go`	`63.64%`	`21/33`
`easyjson3c9d2b01DecodeGithubComUserHello(...)`	`agent/request_easyjson.go`	`63.64%`	`14/22`
`Agent.ProcessCPanelFtpAuthConn(...)`	`agent/cpanel.go`	`63.64%`	`14/22`
`rbl.Check(...)`	`agent/rbl.go`	`63.64%`	`7/11`
`@68:25(...)`	`agent/api.go`	`61.54%`	`8/13`
`rangeInt(...)`	`agent/config.go`	`60.00%`	`3/5`
`rangeInt64(...)`	`agent/config.go`	`60.00%`	`3/5`
`easyjson3c9d2b01DecodeGithubComUserHello1(...)`	`agent/request_easyjson.go`	`59.62%`	`31/52`
`Record.UnmarshalMsg(...)`	`agent/record_msgp.go`	`59.57%`	`28/47`
`Agent.ProcessModuleConn(...)`	`agent/module.go`	`59.52%`	`25/42`
`FailureWatchdogRecord.DecodeMsg(...)`	`agent/watchdog_record_gen.go`	`53.12%`	`17/32`
`FailureWatchdog.CapturePanic(...)`	`agent/watchdog.go`	`50.00%`	`3/6`
`@91:9(...)`	`agent/watchdog.go`	`50.00%`	`1/2`
`ReverseIP(...)`	`agent/rbl.go`	`46.67%`	`7/15`
`FailureWatchdogRecord.EncodeMsg(...)`	`agent/watchdog_record_gen.go`	`46.15%`	`6/13`
`loadKeyFile(...)`	`agent/config.go`	`44.44%`	`4/9`
`getServerId(...)`	`agent/sentry.go`	`40.00%`	`4/10`
`@182:18(...)`	`agent/agent.go`	`33.33%`	`2/6`
`ToIP(...)`	`agent/agent.go`	`33.33%`	`2/6`
`ModifyDovecotSocket(...)`	`agent/socket.go`	`18.75%`	`3/16`
`main(...)`	`agent/main.go`	`0.00%`	`0/36`
`Request.GetOverdueBy(...)`	`agent/request.go`	`0.00%`	`0/7`
`rateSample.sample(...)`	`agent/sentry.go`	`0.00%`	`0/5`
`disableFtpIntegration(...)`	`agent/watchdog.go`	`0.00%`	`0/5`
`DatabaseDrop(...)`	`agent/database.go`	`0.00%`	`0/5`
`serviceCmd(...)`	`agent/service.go`	`0.00%`	`0/5`
`errHasSuffixRateLimit.IsLimited(...)`	`agent/sentry.go`	`0.00%`	`0/4`
`systemd(...)`	`agent/service.go`	`0.00%`	`0/2`
`TimeoutMS.Duration(...)`	`agent/request.go`	`0.00%`	`0/1`
`loadLockConfig(...)`	`agent/config.go`	`0.00%`	`0/1`
`Response.MarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`TimestampMS.Time(...)`	`agent/request.go`	`0.00%`	`0/1`
`SendMessagesApiRequest.MarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/1`
`Response.UnmarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`ServiceStart(...)`	`agent/service.go`	`0.00%`	`0/1`
`SendMessagesApiRequest.UnmarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/1`
`ServiceStop(...)`	`agent/service.go`	`0.00%`	`0/1`
`ServiceRestart(...)`	`agent/service.go`	`0.00%`	`0/1`
`Request.MarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`License.UnmarshalEasyJSON(...)`	`agent/license_proto_easyjson.go`	`0.00%`	`0/1`
`License.MarshalEasyJSON(...)`	`agent/license_proto_easyjson.go`	`0.00%`	`0/1`
`Request.UnmarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`@137:32(...)`	`agent/license.go`	`100.00%`	`0/0`

func easyjsonD587a15Encode1

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Encode1(out *jwriter.Writer, in StatRecord) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"name\":"
                out.RawString(prefix[1:])
                out.String(string(in.Name))
        }
        {
                const prefix string = ",\"attackers_ip\":"
                out.RawString(prefix)
                out.String(string(in.AttackersIP))
        }
        {
                const prefix string = ",\"rule\":"
                out.RawString(prefix)
                out.Int(int(in.Rule))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        {
                const prefix string = ",\"severity\":"
                out.RawString(prefix)
                out.Int(int(in.Severity))
        }
        {
                const prefix string = ",\"retries\":"
                out.RawString(prefix)
                out.Int(int(in.Retries))
        }
        {
                const prefix string = ",\"timestamp\":"
                out.RawString(prefix)
                out.Int64(int64(in.Timestamp))
        }
        {
                const prefix string = ",\"plugin_id\":"
                out.RawString(prefix)
                out.String(string(in.PluginId))
        }
        out.RawByte('}')
}

func FailureWatchdog.RecordFailure

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog.go:

func (w *FailureWatchdog) RecordFailure(timestamp time.Time) {
        if !w.Enabled {
                return
        }

        var r FailureWatchdogRecord
        if err := r.ReadFromFile(w.path); err != nil && !errors.Is(err, afero.ErrFileNotFound) {
                log.WithError(err).Errorf("failed to read failure watchdog file: %v", err)
                return
        }

        timestamps := []int64{}
        for _, t := range r.Timestamps {
                since := timestamp.Sub(time.Unix(0, t))

                if since < w.Period {
                        timestamps = append(timestamps, t)
                }
        }
        timestamps = append(timestamps, timestamp.UnixNano())

        excess := len(timestamps) - w.Limit
        if excess > 0 {
                timestamps = timestamps[excess:]

                defer func() {
                        if err := w.cb(); err != nil {
                                log.WithError(err).Errorf("failed to execute callback: %v", err)
                        }
                }()
        }

        r.Timestamps = timestamps
        r.DumpToFile(w.path)
}

func query

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func query(ctx context.Context, nameserver string, rbl string, host string, r *Result) {
        r.Listed = false

        resolver := net.Resolver{
                PreferGo: true,
        }
        if nameserver != "" {
                resolver.Dial = func(ctx context.Context, network, address string) (net.Conn, error) {
                        d := net.Dialer{}
                        return d.DialContext(ctx, "udp", nameserver)
                }
        }

        lookup := fmt.Sprintf("%s.%s", host, rbl)

        res, err := resolver.LookupHost(ctx, lookup)
        if len(res) > 0 {
                r.Listed = true
                txt, _ := resolver.LookupTXT(ctx, lookup)
                if len(txt) > 0 {
                        r.Text = txt[0]
                }
        }
        if err != nil {
                r.Error = true
                r.ErrorType = err
        }

        return
}

func Agent.ServeLogRBLStat

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) ServeLogRBLStat() {
        defer failureWatchdog.CapturePanic()
        var (
                statsSuccessOld, statsTimeoutOld, statsErrorsOld int64
                stop                                             bool
        )

        for !stop {
                select {
                case <-p.statsRBLCheckStop:
                        stop = true
                case <-time.After(5 * time.Minute):
                }
                statsSuccess := atomic.LoadInt64(&p.statRBLCheck.Success) - statsSuccessOld
                statsTimeout := atomic.LoadInt64(&p.statRBLCheck.Timeout) - statsTimeoutOld
                statsErrors := atomic.LoadInt64(&p.statRBLCheck.Errors) - statsErrorsOld

                if statsTimeout > 0 || statsErrors > 0 {
                        log.WithFields(log.Fields{
                                "fingerprint": []string{"RBLCheckStatsHasErrors"},
                                "success":     statsSuccess,
                                "timeout":     statsTimeout,
                                "errors":      statsErrors,
                        }).Warnf("RBL Check requests stats: success=%d timeout=%d errors=%d",
                                statsSuccess, statsTimeout, statsErrors)
                }

                statsSuccessOld += statsSuccess
                statsTimeoutOld += statsTimeout
                statsErrorsOld += statsErrors
        }
}

func CPanelAuthMsg.Unmarshal

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/cpanel.go:

func (r *CPanelAuthMsg) Unmarshal(b []byte) *CPanelAuthMsg {
        lines := bytes.Split(b, []byte{'\n'})
        for _, line := range lines {
                i := bytes.IndexByte(line, ':')
                if i == -1 {
                        continue
                }
                key := line[:i]
                value := line[i+1:]
                switch string(key) {
                case "account":
                        r.Account = string(value)
                case "password":
                        r.Password = string(value)
                case "peer":
                        r.Peer = string(value)
                case "auth_ok":
                        r.AuthOk = string(value)
                }
        }
        return r
}

func License.Signed

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lic *License) Signed(pubKey *rsa.PublicKey) bool {
        lic.Sign = ""
        signed := lic.signedContent()
        for _, sigB64 := range lic.Signatures {
                sig, err := base64.StdEncoding.DecodeString(sigB64)
                if err != nil {
                        continue
                }
                hashed := sha512.Sum512(signed)
                if err := rsa.VerifyPKCS1v15(pubKey, crypto.SHA512, hashed[:], []byte(sig)); err == nil {
                        lic.Sign = sigB64
                        return true
                }
        }
        return false
}

func LicenseWatcher.validLicense

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) validLicense(lic *License) bool {
        if lic.err != nil {
                return false
        }

        isValid, errPubKey := validLicense(lic, lw.pubKeyPath)
        if isValid {
                return isValid
        }

        isAltValid, errAltPubKey := validLicense(lic, lw.altPubKeyPath)
        if errAltPubKey == nil {
                return isAltValid
        }

        lic.err = errors.Join(errPubKey, errAltPubKey)
        return false
}

func easyjson3c9d2b01EncodeGithubComUserHello

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func easyjson3c9d2b01EncodeGithubComUserHello(out *jwriter.Writer, in Response) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"action\":"
                out.RawString(prefix[1:])
                out.String(string(in.Action))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        out.RawByte('}')
}

func Record.MarshalMsg

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/record_msgp.go:

func (z *Record) MarshalMsg(b []byte) (o []byte, err error) {
        o = msgp.Require(b, z.Msgsize())
        // map header, size 2
        // string "e"
        o = append(o, 0x82, 0xa1, 0x65)
        o = msgp.AppendInt64(o, z.LockExpireAt)
        // string "a"
        o = append(o, 0xa1, 0x61)
        o = msgp.AppendMapHeader(o, uint32(len(z.Attempts)))
        for za0001, za0002 := range z.Attempts {
                o = msgp.AppendString(o, za0001)
                o = msgp.AppendInt64(o, za0002)
        }
        return
}

func validLicense

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func validLicense(lic *License, pubKeyPath string) (bool, error) {
        f, err := appFs.Open(pubKeyPath)
        if err != nil {
                return false, fmt.Errorf("fs.Open(%#v) failed: %v", pubKeyPath, err)
        }
        defer f.Close()
        pubKey, err := LoadPublicKey(f)
        if err != nil {
                return false, fmt.Errorf("LoadPublicKey() failed: %s", err)
        }
        // NOTE: we do not check if license is expired, which may be wrong,
        // but that is what agent does at the moment.
        return lic.Signed(pubKey), nil
}

func NewWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func NewWhiteList(fileNameList []string, ResetHandler func(), LoadLineHandler func(line string)) *WhiteList {
        wl := &WhiteList{
                file:            make(map[string]time.Time, len(fileNameList)),
                lastCheckTime:   make(chan time.Time, 1),
                ResetHandler:    ResetHandler,
                LoadLineHandler: LoadLineHandler,
        }

        for _, fileName := range fileNameList {
                wl.file[fileName] = time.Time{}
        }
        wl.reload()
        wl.lastCheckTime <- time.Now()
        return wl
}

func FailureWatchdogRecord.MarshalMsg

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record_gen.go:

func (z *FailureWatchdogRecord) MarshalMsg(b []byte) (o []byte, err error) {
        o = msgp.Require(b, z.Msgsize())
        // map header, size 1
        // string "timestamps"
        o = append(o, 0x81, 0xaa, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73)
        o = msgp.AppendArrayHeader(o, uint32(len(z.Timestamps)))
        for za0001 := range z.Timestamps {
                o = msgp.AppendInt64(o, z.Timestamps[za0001])
        }
        return
}

func WhiteList.reload

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *WhiteList) reload() {
        if wl.ResetHandler != nil {
                wl.ResetHandler()
        }
        for fileName, _ := range wl.file {
                fileModTime, err := readWhiteList(fileName, wl.LoadLineHandler)
                if err == nil {
                        wl.file[fileName] = fileModTime
                }
        }
}

func Record.Msgsize

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/record_msgp.go:

func (z *Record) Msgsize() (s int) {
        s = 1 + 2 + msgp.Int64Size + 2 + msgp.MapHeaderSize
        if z.Attempts != nil {
                for za0001, za0002 := range z.Attempts {
                        _ = za0002
                        s += msgp.StringPrefixSize + len(za0001) + msgp.Int64Size
                }
        }
        return
}

func NewFailureWatchdog

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog.go:

func NewFailureWatchdog(period time.Duration, limit int, enabled bool) FailureWatchdog {
        failureWatchdog := FailureWatchdog{
                DefaultFailureWatchdogPeriod,
                DefaultFailureWatchdogLimit,
                enabled,
                failureWatchdogFilepath,
                disableFtpIntegration,
        }
        if limit >= 0 {
                failureWatchdog.Limit = limit
        }

        if period >= 0 {
                failureWatchdog.Period = period
        }
        return failureWatchdog
}

func LicenseWatcher.notify

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) notify(lic *License, valid bool) {
        lw.lock.Lock()
        for _, f := range lw.subs {
                f(*lic, valid)
        }
        lw.lock.Unlock()
}

func @140:8

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func() []string {
                        rbl := i.Section("").Key("rbl").Strings(",")
                        if len(rbl) > 0 {
                                return rbl
                        }
                        return []string{"net-brute.rbl.imunify.com"}
                }

func Database.writeRecord

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db Database) writeRecord(batch *leveldb.Batch, key string, record *Record) {
        if record.LockExpireAt == 0 && len(record.Attempts) == 0 {
                batch.Delete([]byte(key))
        }
        batch.Put([]byte(key), record.Marshal())

        log.WithField("record", record).Tracef("---[db]->> %v", key)
}

func @43:8

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/conn_tracker.go:

func() {
                timer.Stop()
                close(ct.idleChan)
                close(ct.Done)
        }

func License.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license_proto_easyjson.go:

func (v *License) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjson2c6259e0Decode1(&r, v)
        return r.Error()
}

func License.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license_proto_easyjson.go:

func (v License) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjson2c6259e0Encode1(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func StatRecord.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func (v StatRecord) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjsonD587a15Encode1(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) Subscribe(f LicenseListener) {
        lw.lock.Lock()
        lw.subs = append(lw.subs, f)
        lw.lock.Unlock()
}

func StatRecord.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func (v *StatRecord) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjsonD587a15Decode1(&r, v)
        return r.Error()
}

func LicenseWatcher.readLicenseAndNotify

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) readLicenseAndNotify() {
        if lic := lw.rereadLicense(); lic != nil {
                lw.notify(lic, lw.validLicense(lic))
        }
        readLicenseAndNotifyDone()
}

func Request.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func (v *Request) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjson3c9d2b01DecodeGithubComUserHello1(&r, v)
        return r.Error()
}

func Request.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func (v Request) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjson3c9d2b01EncodeGithubComUserHello1(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func SendMessagesApiRequest.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func (v SendMessagesApiRequest) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjsonD587a15Encode11(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func Response.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func (v *Response) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjson3c9d2b01DecodeGithubComUserHello(&r, v)
        return r.Error()
}

func SendMessagesApiRequest.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func (v *SendMessagesApiRequest) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjsonD587a15Decode11(&r, v)
        return r.Error()
}

func Response.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func (v Response) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjson3c9d2b01EncodeGithubComUserHello(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func ConnTracker.TrackActivity

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/conn_tracker.go:

func (ct *ConnTracker) TrackActivity(isIdle bool) {
        if ct.isClosed.Load() == false {
                ct.idleChan <- isIdle
        }
}

func LicenseWatcher.Stop

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

211	`func (lw *LicenseWatcher) Stop() {`
212	`close(lw.done)`
213	`lw.wg.Wait()`
214	`}`

func LicenseWatcher.Start

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) Start() {
        lw.wg.Add(1)
        go func() {
                defer failureWatchdog.CapturePanic()
                lw.watcher()
        }()
}

func @113:5

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

113	`func() {`
114	`defer failureWatchdog.CapturePanic()`
115	`lw.watcher()`
116	`}`

func Database.WithUserIPWhitelist

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

75	`func (db Database) WithUserIPWhitelist(wl UserIPWhiteList) *Database {`
76	`db.userIPWhitelist = wl`
77	`return db`
78	`}`

func Database.WithUserWhitelist

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

70	`func (db Database) WithUserWhitelist(wl UserWhiteList) *Database {`
71	`db.usersWhitelist = wl`
72	`return db`
73	`}`

func FailureWatchdogRecord.Msgsize

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record_gen.go:

143	`func (z *FailureWatchdogRecord) Msgsize() (s int) {`
144	`s = 1 + 11 + msgp.ArrayHeaderSize + (len(z.Timestamps) * (msgp.Int64Size))`
145	`return`
146	`}`

func FailureWatchdogRecord.DumpToFile

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record.go:

42	`func (r *FailureWatchdogRecord) DumpToFile(path string) error {`
43	`data := r.Marshal()`
44	`return afero.WriteFile(appFs, path, data, 0o644)`
45	`}`

func FailureWatchdogRecord.Unmarshal

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record.go:

18	`func (r *FailureWatchdogRecord) Unmarshal(data []byte) error {`
19	`_, err := r.UnmarshalMsg(data)`
20	`return err`
21	`}`

func FailureWatchdogRecord.Marshal

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record.go:

13	`func (r FailureWatchdogRecord) Marshal() []byte {`
14	`b, _ := r.MarshalMsg(nil)`
15	`return b`
16	`}`

func Record.Unmarshal

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/record.go:

15	`func (r *Record) Unmarshal(data []byte) error {`
16	`_, err := r.UnmarshalMsg(data)`
17	`return err`
18	`}`

func Record.Marshal

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/record.go:

10	`func (r Record) Marshal() []byte {`
11	`b, _ := r.MarshalMsg(nil)`
12	`return b`
13	`}`

func ModuleStringResponse

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/module.go:

107	`func ModuleStringResponse(action, message string) []byte {`
108	`b, _ := Response{Action: action, Message: message}.MarshalJSON()`
109	`return b`
110	`}`

func @80:19

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

80	`func(ctx context.Context, network, address string) (net.Conn, error) {`
81	`d := net.Dialer{}`
82	`return d.DialContext(ctx, "udp", nameserver)`
83	`}`

func UserIPLockConfig.ForgeAutowhitelistLockConfig

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func (l UserIPLockConfig) ForgeAutowhitelistLockConfig() LockConfig {
        return LockConfig{
                Timeout:  l.AutowhitelistTimeout,
                Attempts: 1,
                Period:   l.AutowhitelistTimeout,
        }
}

func NewConnTracker

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/conn_tracker.go:

func NewConnTracker(duration time.Duration) *ConnTracker {
        return &ConnTracker{
                Duration: duration,
                Done:     make(chan struct{}),
                idleChan: make(chan bool, idleChanBufferSize),
                stop:     make(chan struct{}),
        }
}

func loadLockConfigIP

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func loadLockConfigIP(s *ini.Section, defaultWhitelist string, defaultIncludeList string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,
                Attempts:          rangeInt(s.Key("IP_LOCK_ATTEMPTS"), 10, 0, 100),
                Period:            rangeInt64(s.Key("IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,
                WhitelistFileName: s.Key("whitelisted_ips_path").MustString(defaultWhitelist) + "," + s.Key("whitelisted_ips_include").MustString(defaultIncludeList),
        }
}

func @23:20

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/utils.go:

23	`func(fd uintptr) {`
24	`cred, err = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)`
25	`}`

func UserIPLockConfig.IsAutowhitelistEnabled

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

75	`func (l UserIPLockConfig) IsAutowhitelistEnabled() bool {`
76	`return l.AutowhitelistTimeout > 0`
77	`}`

func @49:17

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api.go:

49	`func(counts gobreaker.Counts) bool {`
50	`return counts.ConsecutiveFailures >= 3`
51	`}`

func @186:17

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

186	`func() {`
187	`err = value.err`
188	`}`

func StatRecord.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

132	`func (v StatRecord) UnmarshalEasyJSON(l jlexer.Lexer) {`
133	`easyjsonD587a15Decode1(l, v)`
134	`}`

func ConnTracker.Stop

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/conn_tracker.go:

69	`func (ct *ConnTracker) Stop() {`
70	`close(ct.stop)`
71	`}`

func init

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

21	`func init() {`
22	`rand.Seed(time.Now().UnixNano())`
23	`}`

func StatRecord.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

120	`func (v StatRecord) MarshalEasyJSON(w *jwriter.Writer) {`
121	`easyjsonD587a15Encode1(w, v)`
122	`}`

func Agent.RequestId

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

440	`func (p *Agent) RequestId() uint {`
441	`return uint(atomic.AddUint32(&p.requestId, 1))`
442	`}`

func loadLockConfigUser

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func loadLockConfigUser(s *ini.Section, defaultWhitelist string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("USER_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,
                Attempts:          rangeInt(s.Key("USER_LOCK_ATTEMPTS"), 10, 0, 100),
                Period:            rangeInt64(s.Key("USER_LOCK_MINUTES"), 5, 0, 9999999) * 60,
                WhitelistFileName: s.Key("whitelisted_users_path").MustString(defaultWhitelist),
        }
}

func loadLockConfigUserIP

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func loadLockConfigUserIP(s *ini.Section, defaultWhitelist string) UserIPLockConfig {
        return UserIPLockConfig{
                LockConfig: LockConfig{
                        Timeout:           rangeInt64(s.Key("USER_IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,
                        Attempts:          rangeInt(s.Key("USER_IP_LOCK_ATTEMPTS"), 10, 0, 100),
                        Period:            rangeInt64(s.Key("USER_IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,
                        WhitelistFileName: s.Key("whitelisted_user_ip_path").MustString(defaultWhitelist),
                },
                AutowhitelistTimeout: rangeInt64(s.Key("USER_IP_LOCK_AUTOWHITELIST_TIMEOUT"), 20160, 0, 9999999) * 60,
        }
}

func NewSendMessageAPI

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api.go:

func NewSendMessageAPI(apiURL string, agentVersion string, timeout time.Duration) *SendMessageAPI {
        return &SendMessageAPI{
                agentVersion: agentVersion,
                client:       &http.Client{Timeout: timeout},
                baseURL:      apiURL,
                cb: gobreaker.NewCircuitBreaker(gobreaker.Settings{
                        Name:     "SendMessageAPIBreaker",
                        Interval: timeout * 5,
                        Timeout:  timeout * 2,
                        ReadyToTrip: func(counts gobreaker.Counts) bool {
                                return counts.ConsecutiveFailures >= 3
                        },
                }),
        }
}

func LockConfig.IsEnabled

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

71	`func (l LockConfig) IsEnabled() bool {`
72	`return l.Timeout > 0 && l.Attempts > 0 && l.Period > 0`
73	`}`

func Config.IsVerboseLoggingMode

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

55	`func (cfg *Config) IsVerboseLoggingMode() bool {`
56	`return cfg.IsLogfileEnabled()`
57	`}`

func UserWhiteList.reset

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *UserWhiteList) reset() {
        // root user is the must have default
        wl.users = map[string]struct{}{
                "root": struct{}{},
        }
}

func UserWhiteList.loadLine

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

141	`func (wl *UserWhiteList) loadLine(line string) {`
142	`wl.users[line] = struct{}{}`
143	`}`

func IPWhiteList.reset

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

190	`func (wl *IPWhiteList) reset() {`
191	`wl.ipRanger = cidranger.NewPCTrieRanger()`
192	`}`

func Config.IsSentryEnabled

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

51	`func (cfg *Config) IsSentryEnabled() bool {`
52	`return cfg.Sentry != "" && cfg.Sentry != "off"`
53	`}`

func Config.IsLogfileEnabled

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

47	`func (cfg *Config) IsLogfileEnabled() bool {`
48	`return cfg.LogFilename != ""`
49	`}`

func NewLicenseWatcher

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func NewLicenseWatcher(licPath, pubKeyPath, altPubKeyPath string, interval time.Duration) *LicenseWatcher {
        return &LicenseWatcher{
                done:          make(chan struct{}),
                interval:      interval,
                licPath:       licPath,
                pubKeyPath:    pubKeyPath,
                altPubKeyPath: altPubKeyPath,
                subs:          make([]LicenseListener, 0, 1),
        }
}

func License.signedContent

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

60	`func (lic License) signedContent() []byte {`
61	`return []byte(fmt.Sprintf("%s%s%s%d%d%d", lic.ID, lic.Status, lic.Group, lic.Limit, lic.TokenCreatedUTC, lic.TokenExpireUTC))`
62	`}`

func UserIPWhiteList.reset

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

247	`func (wl *UserIPWhiteList) reset() {`
248	`wl.users = make(map[string]cidranger.Ranger)`
249	`}`

func easyjson2c6259e0Encode1

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license_proto_easyjson.go:

func easyjson2c6259e0Encode1(out *jwriter.Writer, in License) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"group\":"
                out.RawString(prefix[1:])
                out.String(string(in.Group))
        }
        {
                const prefix string = ",\"id\":"
                out.RawString(prefix)
                out.String(string(in.ID))
        }
        {
                const prefix string = ",\"limit\":"
                out.RawString(prefix)
                out.Int(int(in.Limit))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        {
                const prefix string = ",\"sign\":"
                out.RawString(prefix)
                out.String(string(in.Sign))
        }
        {
                const prefix string = ",\"signatures\":"
                out.RawString(prefix)
                if in.Signatures == nil && (out.Flags&jwriter.NilSliceAsEmpty) == 0 {
                        out.RawString("null")
                } else {
                        out.RawByte('[')
                        for v2, v3 := range in.Signatures {
                                if v2 > 0 {
                                        out.RawByte(',')
                                }
                                out.String(string(v3))
                        }
                        out.RawByte(']')
                }
        }
        {
                const prefix string = ",\"status\":"
                out.RawString(prefix)
                out.String(string(in.Status))
        }
        {
                const prefix string = ",\"token_created_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenCreatedUTC))
        }
        {
                const prefix string = ",\"token_expire_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenExpireUTC))
        }
        {
                const prefix string = ",\"upgrade_url\":"
                out.RawString(prefix)
                out.String(string(in.UpgradeURL))
        }
        out.RawByte('}')
}

func easyjsonD587a15Encode12

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Encode12(out *jwriter.Writer, in License) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"group\":"
                out.RawString(prefix[1:])
                out.String(string(in.Group))
        }
        {
                const prefix string = ",\"id\":"
                out.RawString(prefix)
                out.String(string(in.ID))
        }
        {
                const prefix string = ",\"limit\":"
                out.RawString(prefix)
                out.Int(int(in.Limit))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        {
                const prefix string = ",\"sign\":"
                out.RawString(prefix)
                out.String(string(in.Sign))
        }
        {
                const prefix string = ",\"signatures\":"
                out.RawString(prefix)
                if in.Signatures == nil && (out.Flags&jwriter.NilSliceAsEmpty) == 0 {
                        out.RawString("null")
                } else {
                        out.RawByte('[')
                        for v5, v6 := range in.Signatures {
                                if v5 > 0 {
                                        out.RawByte(',')
                                }
                                out.String(string(v6))
                        }
                        out.RawByte(']')
                }
        }
        {
                const prefix string = ",\"status\":"
                out.RawString(prefix)
                out.String(string(in.Status))
        }
        {
                const prefix string = ",\"token_created_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenCreatedUTC))
        }
        {
                const prefix string = ",\"token_expire_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenExpireUTC))
        }
        {
                const prefix string = ",\"upgrade_url\":"
                out.RawString(prefix)
                out.String(string(in.UpgradeURL))
        }
        out.RawByte('}')
}

func easyjsonD587a15Encode11

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Encode11(out *jwriter.Writer, in SendMessagesApiRequest) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"rpm_ver\":"
                out.RawString(prefix[1:])
                out.String(string(in.AgentVersion))
        }
        if true {
                const prefix string = ",\"license\":"
                out.RawString(prefix)
                easyjsonD587a15Encode12(out, in.License)
        }
        if in.Method != "" {
                const prefix string = ",\"method\":"
                out.RawString(prefix)
                out.String(string(in.Method))
        }
        {
                const prefix string = ",\"ver\":"
                out.RawString(prefix)
                out.String(string(in.ProtocolVersion))
        }
        if in.ServerID != "" {
                const prefix string = ",\"server_id\":"
                out.RawString(prefix)
                out.String(string(in.ServerID))
        }
        {
                const prefix string = ",\"payload\":"
                out.RawString(prefix)
                if in.Payload == nil && (out.Flags&jwriter.NilSliceAsEmpty) == 0 {
                        out.RawString("null")
                } else {
                        out.RawByte('[')
                        for v2, v3 := range in.Payload {
                                if v2 > 0 {
                                        out.RawByte(',')
                                }
                                (v3).MarshalEasyJSON(out)
                        }
                        out.RawByte(']')
                }
        }
        out.RawByte('}')
}

func Agent.WriteStat

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) WriteStat(success bool, service, ip, username, password string) {
        if p.cfg.SendStats == false || ip == "127.0.0.1" {
                return
        }

        now := time.Now()
        p.statLock.Lock()
        if success {
                message := fmt.Sprintf("%s s_ip %s - %s:e res:true", service, ip, username)
                record, ok := p.statSuccessfulRecords[message]
                if !ok {
                        p.statSuccessfulRecords[message] = &StatRecord{
                                Name:        "pam_imunify info",
                                AttackersIP: ip,
                                Rule:        77777,
                                Message:     message,
                                Severity:    1,
                                Retries:     1,
                                Timestamp:   now.Unix(),
                                PluginId:    "pam_imunify",
                        }
                } else {
                        record.Retries++
                }

                if p.statSuccessfulTime.IsZero() {
                        p.statSuccessfulTime = now
                } else if p.statSuccessfulTime.Add(time.Duration(p.cfg.SendStatsSuccessfulAggTime) * time.Second).Before(now) {
                        p.statSuccessfulTime = time.Time{}
                        p.statCh <- p.statSuccessfulRecords
                        p.statSuccessfulRecords = make(map[string]*StatRecord)
                }
        } else {
                message := fmt.Sprintf("%s s_ip %s - %s:%s res:false", service, ip, username, password)
                record, ok := p.statUnsuccessfulRecords[message]
                if !ok {
                        p.statUnsuccessfulRecords[message] = &StatRecord{
                                Name:        "pam_imunify info",
                                AttackersIP: ip,
                                Rule:        77777,
                                Message:     message,
                                Severity:    1,
                                Retries:     1,
                                Timestamp:   now.Unix(),
                                PluginId:    "pam_imunify",
                        }
                } else {
                        record.Retries++
                }

                if p.statUnsuccessfulTime.IsZero() {
                        p.statUnsuccessfulTime = now
                } else if p.statUnsuccessfulTime.Add(time.Duration(p.cfg.SendStatsUnsuccessfulAggTime) * time.Second).Before(now) {
                        p.statUnsuccessfulTime = time.Time{}
                        p.statCh <- p.statUnsuccessfulRecords
                        p.statUnsuccessfulRecords = make(map[string]*StatRecord)
                }
        }

        p.statLock.Unlock()

}

func Database.writeAttempt

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) writeAttempt(batch *leveldb.Batch, key, hash string, cfg *LockConfig) error {
        var changed bool

        if !cfg.IsEnabled() {
                return nil
        }

        record, err := db.readRecord(key)
        if err != nil {
                return err
        }

        ts := time.Now().Unix()

        // Remove expired attempts first
        for hash, expiredAt := range record.Attempts {
                if expiredAt < ts {
                        delete(record.Attempts, hash)
                        changed = true
                }
        }

        // Write current attempt if not exist
        if _, ok := record.Attempts[hash]; !ok {
                if record.Attempts == nil {
                        record.Attempts = make(map[string]int64, 1)
                }

                record.Attempts[hash] = ts + cfg.Period
                changed = true
        }

        // Remove lock if expired
        if record.LockExpireAt != 0 && record.LockExpireAt < ts {
                record.LockExpireAt = 0
                changed = true
        }

        // Lock if no lock and attempts too much
        if record.LockExpireAt == 0 && len(record.Attempts) >= cfg.Attempts {
                record.LockExpireAt = ts + cfg.Timeout
                changed = true
        }

        // Write changes if needed
        if changed {
                db.writeRecord(batch, key, &record)
        }

        return nil
}

func readWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func readWhiteList(fileName string, lineHandler func(line string)) (fileModTime time.Time, err error) {
        var (
                file *os.File
                info os.FileInfo
        )

        file, err = os.Open(fileName)
        if err != nil {
                return
        }

        info, err = file.Stat()
        if err != nil {
                return
        }

        fileModTime = info.ModTime()

        sc := bufio.NewScanner(file)
        for sc.Scan() {
                if line := strings.TrimSpace(sc.Text()); line != "" {
                        lineHandler(line)
                }
        }

        err = sc.Err()
        return
}

func easyjson3c9d2b01EncodeGithubComUserHello1

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func easyjson3c9d2b01EncodeGithubComUserHello1(out *jwriter.Writer, in Request) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"type\":"
                out.RawString(prefix[1:])
                out.String(string(in.Type))
        }
        {
                const prefix string = ",\"service\":"
                out.RawString(prefix)
                out.String(string(in.Service))
        }
        {
                const prefix string = ",\"user\":"
                out.RawString(prefix)
                out.String(string(in.User))
        }
        {
                const prefix string = ",\"host\":"
                out.RawString(prefix)
                out.String(string(in.Host))
        }
        {
                const prefix string = ",\"hash\":"
                out.RawString(prefix)
                if in.Hash == nil && (out.Flags&jwriter.NilSliceAsEmpty) == 0 {
                        out.RawString("null")
                } else {
                        out.RawByte('[')
                        for v2, v3 := range in.Hash {
                                if v2 > 0 {
                                        out.RawByte(',')
                                }
                                out.String(string(v3))
                        }
                        out.RawByte(']')
                }
        }
        {
                const prefix string = ",\"timestamp\":"
                out.RawString(prefix)
                if in.Timestamp == nil {
                        out.RawString("null")
                } else {
                        out.Int64(int64(*in.Timestamp))
                }
        }
        {
                const prefix string = ",\"timeout\":"
                out.RawString(prefix)
                if in.Timeout == nil {
                        out.RawString("null")
                } else {
                        out.Int64(int64(*in.Timeout))
                }
        }
        {
                const prefix string = ",\"sign\":"
                out.RawString(prefix)
                out.String(string(in.Sign))
        }
        out.RawByte('}')
}

func UserIPWhiteList.In

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *UserIPWhiteList) In(user string, ip string) bool {
        if wl == nil {
                return false
        }

        wl.Update()

        ipNet := net.ParseIP(ip)

        var exist bool
        if wl.users != nil && ipNet != nil {
                wl.RLock()
                item, got := wl.users[user]
                if got {
                        contains, err := item.Contains(ipNet)
                        exist = (err == nil) && (contains == true)
                }
                wl.RUnlock()
        }

        return exist
}

func CheckRBL

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func CheckRBL(nameserver string, rbl []string, ip string, timeout time.Duration) (bool, error) {
        if ip == "" || ip == "127.0.0.1" {
                return false, nil
        }

        ctx, cancel := context.WithTimeout(context.Background(), timeout)
        defer cancel()

        var e error = nil
        for _, server := range rbl {
                r := rblLookupIP(ctx, nameserver, server, ip)
                for _, res := range r.Results {
                        if res.Error == false {
                                return true, nil
                        } else {
                                e = res.ErrorType
                        }
                }
        }

        return false, e
}

func ConnTracker.HandleActivity

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/conn_tracker.go:

func (ct *ConnTracker) HandleActivity() {
        timer := time.NewTimer(ct.Duration)
        defer func() {
                timer.Stop()
                close(ct.idleChan)
                close(ct.Done)
        }()
        for {
                select {
                case isIdle := <-ct.idleChan:
                        timer.Stop()
                        if isIdle {
                                timer.Reset(ct.Duration)
                        }
                case <-timer.C:
                        select {
                        case <-ct.idleChan:
                                timer.Reset(ct.Duration)
                        default:
                                ct.Done <- struct{}{}
                        }
                case <-ct.stop:
                        ct.isClosed.Store(true)
                        return
                }
        }
}

func IPWhiteList.In

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *IPWhiteList) In(ipString string) bool {
        if wl == nil {
                return false
        }

        wl.Update()

        ip := net.ParseIP(ipString)

        var exist bool
        if wl.ipRanger != nil && ip != nil {
                wl.RLock()
                contains, err := wl.ipRanger.Contains(ip)
                exist = (err == nil) && (contains == true)
                wl.RUnlock()
        }

        return exist
}

func rblLookupIP

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func rblLookupIP(ctx context.Context, nameserver string, rbl string, targetIP string) (r RBLResults) {
        r.List = rbl
        r.Host = targetIP

        res := Result{}
        res.Address = targetIP

        ip := net.ParseIP(targetIP)
        if ip == nil {
                return
        }

        addr := ReverseIP(ip)

        query(ctx, nameserver, rbl, addr, &res)

        r.Results = append(r.Results, res)

        return
}

func IPWhiteList.loadLine

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *IPWhiteList) loadLine(item string) {
        if strings.Contains(item, "/") == true {
                _, ipNet, err := net.ParseCIDR(item)
                if err == nil {
                        wl.ipRanger.Insert(cidranger.NewBasicRangerEntry(*ipNet))
                }
        } else {
                ip := net.ParseIP(item)
                if ip != nil {
                        mask := net.CIDRMask(32, 32)
                        if ip.To4() == nil {
                                mask = net.CIDRMask(128, 128)
                        }
                        wl.ipRanger.Insert(cidranger.NewBasicRangerEntry(net.IPNet{IP: ip, Mask: mask}))
                }
        }
}

func getOsRelease

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

func getOsRelease() (os_release string, err error) {
        var f *os.File
        f, err = os.Open("/etc/os-release")
        if err != nil {
                return
        }
        defer f.Close()

        data, _ := ioutil.ReadAll(f)

        matches := regexp.MustCompile(`PRETTY_NAME=(.+)`).FindSubmatch(data)
        if len(matches) > 1 {
                os_release = strings.Trim(string(matches[1]), "\"")
        }

        return
}

func LicenseWatcher.rereadLicense

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) rereadLicense() *License {
        fi, err := os.Stat(lw.licPath)
        dummy := &License{}
        if err != nil {
                dummy.err = fmt.Errorf("fs.Stat(%#v) failed: %v", lw.licPath, err)
                return dummy
        }
        mt := fi.ModTime()
        if !mt.After(lw.lastModified) {
                return nil
        }
        f, err := os.Open(lw.licPath)
        if err != nil {
                dummy.err = fmt.Errorf("fs.Open(%#v) failed: %v", lw.licPath, err)
                return dummy
        }
        defer f.Close()
        lic, err := LoadLicense(f)
        if err != nil {
                dummy.err = fmt.Errorf("LoadLicense() failed: %v", err)
                return dummy
        }
        lw.lastModified = mt
        return &lic
}

func UserWhiteList.In

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *UserWhiteList) In(key string) bool {
        if wl == nil {
                return false
        }

        wl.Update()

        var exist bool
        wl.RLock()
        if wl.users != nil {
                _, exist = wl.users[key]
        }
        wl.RUnlock()
        return exist
}

func CPanelFtpAuthRecv

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/cpanel.go:

func CPanelFtpAuthRecv(conn net.Conn) ([]byte, error) {
        var rb []byte
        reader := bufio.NewReader(conn)
        for {
                b, err := reader.ReadBytes('\n')
                if err != nil {
                        return nil, err
                }

                rb = append(rb, b...)

                if bytes.Equal([]byte("end\n"), b) {
                        return rb, nil
                }
        }
}

func @212:20

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func(key interface{}) (interface{}, *time.Duration, error) {
                        s, ok := key.(string)
                        if !ok {
                                return nil, nil, fmt.Errorf("LRU Cache: Bad key value type")
                        }
                        value, err := CheckRBL(r.cfg.ResolverAddr, r.cfg.RBLServers, s, r.cfg.RequestTimeout)
                        if value {
                                return value, &r.cfg.CacheInRBLTimeout, nil
                        }
                        if err == nil || strings.HasSuffix(err.Error(), "no such host") {
                                return false, &r.cfg.CacheNotInRBLTimeout, nil
                        }
                        return &rblError{err: err}, &r.cfg.CacheErrorTimeout, nil
                }

func UserIPWhiteList.loadLine

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *UserIPWhiteList) loadLine(item string) {
        fields := strings.Fields(item)
        if len(fields) < 2 {
                return
        }

        user := fields[0]
        if _, ok := wl.users[user]; !ok {
                wl.users[user] = cidranger.NewPCTrieRanger()
        }

        for _, item := range fields[1:] {
                if strings.Contains(item, "/") == true {
                        _, ipNet, err := net.ParseCIDR(item)
                        if err == nil {
                                wl.users[user].Insert(cidranger.NewBasicRangerEntry(*ipNet))
                        }
                } else {
                        ip := net.ParseIP(item)
                        if ip != nil {
                                mask := net.CIDRMask(32, 32)
                                if ip.To4() == nil {
                                        mask = net.CIDRMask(128, 128)
                                }
                                wl.users[user].Insert(cidranger.NewBasicRangerEntry(net.IPNet{IP: ip, Mask: mask}))
                        }
                }
        }
}

func Database.Close

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) Close() error {
        db.lock.Lock()
        defer db.lock.Unlock()

        if atomic.LoadInt64(&db.closed) == 0 {
                atomic.SwapInt64(&db.closed, 1)
                db.stopExpireOld <- true
                db.waitExpireOld.Wait()
                return db.db.Close()
        }
        return nil
}

func LicenseWatcher.watcher

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func (lw *LicenseWatcher) watcher() {
        defer lw.wg.Done()

        ticker := time.NewTicker(lw.interval)
        defer ticker.Stop()

        lw.readLicenseAndNotify()
        for {
                select {
                case <-lw.done:
                        return
                case <-ticker.C:
                        lw.readLicenseAndNotify()
                }
        }
}

func LoadLicense

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func LoadLicense(r io.Reader) (License, error) {
        var lic License
        b, err := io.ReadAll(r)
        if err != nil {
                return lic, err
        }
        err = json.Unmarshal(b, &lic)
        if err != nil {
                return lic, fmt.Errorf("%s: '%s'", err, string(b))
        } else {
                return lic, nil
        }
}

func Agent.ServeListener

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) ServeListener(l net.Listener, connCallback func(c net.Conn)) {
        defer failureWatchdog.CapturePanic()
        for {
                c, err := l.Accept()
                if err != nil {
                        if shouldLogError(err) {
                                log.WithError(err).Errorf("accept: %v", err)
                        }
                        break
                }

                p.connListLock.Lock()
                p.connList[c] = struct{}{}
                if p.Tracker != nil {
                        p.Tracker.TrackActivity(false)
                }
                p.connListLock.Unlock()

                p.connRoutinesWait.Add(1)
                //go p.ServeConn(c, connCallback)
                go func(c net.Conn, connCallback func(c net.Conn)) {
                        defer failureWatchdog.CapturePanic()
                        connCallback(c)

                        p.connListLock.Lock()
                        if _, ok := p.connList[c]; ok {
                                delete(p.connList, c)
                                err := c.Close()
                                if err != nil {
                                        log.WithError(err).Errorf("connection close: %v", err)
                                }
                        }
                        if len(p.connList) == 0 && p.Tracker != nil {
                                p.Tracker.TrackActivity(true)
                        }
                        p.connListLock.Unlock()

                        p.connRoutinesWait.Done()
                }(c, connCallback)
        }
        p.acceptRoutineWait.Done()
}

func Agent.Stop

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) Stop() error {
        // Stop accepting new connections
        for path := range p.acceptList {
                listener := p.acceptList[path]
                _ = listener.Close()
        }
        p.acceptRoutineWait.Wait()

        // Close all opened connections
        p.connListLock.Lock()
        for conn := range p.connList {
                _ = conn.Close()
                delete(p.connList, conn)
        }
        p.connListLock.Unlock()
        p.connRoutinesWait.Wait()
        if p.Tracker != nil {
                p.Tracker.Stop()
        }

        if p.cfg.RBLTimeout > 0 {
                p.statsRBLCheckStop <- struct{}{}
        }

        if p.cfg.SendStats {
                p.statLock.Lock()
                p.statCh <- p.statSuccessfulRecords
                p.statCh <- p.statUnsuccessfulRecords
                p.statLock.Unlock()
                close(p.statCh)
                p.statWait.Wait()
                p.lw.Stop()
        }

        err := p.db.Close()
        if err != nil {
                return fmt.Errorf("database close: %w", err)
        }

        if p.syslog != nil {
                p.syslog.Close()
        }

        if sentryLoggerHook != nil {
                sentryLoggerHook.Flush()
                sentryLoggerHook.SetEnabled(false)
        }

        log.SetLevel(log.InfoLevel)
        log.SetOutput(os.Stderr)

        return nil
}

func LoadPublicKey

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func LoadPublicKey(r io.Reader) (*rsa.PublicKey, error) {
        p, err := io.ReadAll(r)
        if err != nil {
                return nil, err
        }
        block, _ := pem.Decode(p)
        if block == nil {
                return nil, fmt.Errorf("failed to load PEM data")
        }
        key, err := x509.ParsePKIXPublicKey(block.Bytes)
        if err != nil {
                return nil, err
        }
        pubKey, ok := key.(*rsa.PublicKey)
        if !ok {
                return nil, fmt.Errorf("public key is not RSA: %v", key)
        }
        return pubKey, nil
}

func @417:6

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func(c net.Conn, connCallback func(c net.Conn)) {
                        defer failureWatchdog.CapturePanic()
                        connCallback(c)

                        p.connListLock.Lock()
                        if _, ok := p.connList[c]; ok {
                                delete(p.connList, c)
                                err := c.Close()
                                if err != nil {
                                        log.WithError(err).Errorf("connection close: %v", err)
                                }
                        }
                        if len(p.connList) == 0 && p.Tracker != nil {
                                p.Tracker.TrackActivity(true)
                        }
                        p.connListLock.Unlock()

                        p.connRoutinesWait.Done()
                }

func init

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func init() {
        sentryLogger, err := NewSentryLogger(filepath.Base(os.Args[0]), PackageVersion)
        if err == nil {
                sentryLoggerHook = sentryLogger
                sentryLoggerHook.SetEnabled(false)
                log.AddHook(sentryLogger)
        } else {
                log.WithError(err).Errorf("sentry reporting will be disabled: %v", err)
        }
}

func Agent.Serve

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) Serve(path string, connCallback func(c net.Conn)) error {
        listener := p.acceptList[path]
        if listener == nil {
                return fmt.Errorf("no listener at %s ", path)
        }

        p.acceptRoutineWait.Add(1)
        go p.ServeListener(listener, connCallback)
        return nil
}

func @169:18

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func(l License, valid bool) {
                        var lic *License
                        if valid {
                                lic = &l
                                log.Info("Detected a valid license.")
                        } else {
                                log.WithFields(log.Fields{
                                        log.ErrorKey:       l.err,
                                        "agent_lic_status": GetAgentLicStatus(),
                                }).Warnf("INVALID license has been detected.")
                        }
                        atomic.StorePointer((*unsafe.Pointer)(unsafe.Pointer(&p.license)), unsafe.Pointer(lic))
                }

func Agent.ServeSendStat

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) ServeSendStat() {
        defer failureWatchdog.CapturePanic()
        for statsMap := range p.statCh {
                if len(statsMap) == 0 {
                        continue
                }
                stats := make([]StatRecord, 0, len(statsMap))
                for _, v := range statsMap {
                        stats = append(stats, *v)
                }

                license := (*License)(atomic.LoadPointer((*unsafe.Pointer)(unsafe.Pointer(&p.license))))
                err := p.sendMessageAPI.SendStats(license, stats)
                if err != nil {
                        if errors.Is(err, errInvalidLicense) {
                                log.WithFields(log.Fields{
                                        log.ErrorKey:       err,
                                        "records_num":      len(stats),
                                        "agent_lic_status": GetAgentLicStatus(),
                                }).Warnf("Send stats for %d records error: %v", len(stats), err)
                        } else {
                                log.WithFields(log.Fields{
                                        log.ErrorKey:       err,
                                        "records_num":      len(stats),
                                        "agent_lic_status": GetAgentLicStatus(),
                                }).Errorf("Send stats for %d records error: %v", len(stats), err)
                        }
                        continue
                }
                log.Infof("Send stats for %d records success", len(stats))
                log.WithField("records", stats).Debug("Send stats records")
        }
        p.statWait.Done()
}

func NewIPWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func NewIPWhiteList(file string) (*IPWhiteList, error) {
        if file == "" {
                return nil, nil
        }

        var (
                err       error
                fileNames []string
        )

        // Split file paths by ','
        r := csv.NewReader(strings.NewReader(file))
        r.Comma = ','
        fileNames, err = r.Read()
        if err != nil {
                return nil, err
        }

        wl := &IPWhiteList{}
        wl.WhiteList = NewWhiteList(fileNames, wl.reset, wl.loadLine)
        return wl, err
}

func NewUserIPWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func NewUserIPWhiteList(file string) *UserIPWhiteList {
        if file == "" {
                return nil
        }
        wl := &UserIPWhiteList{}
        wl.WhiteList = NewWhiteList([]string{file}, wl.reset, wl.loadLine)
        return wl
}

func SendMessageAPI.send

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api.go:

func (ca *SendMessageAPI) send(requestBody MarshalJSON) error {
        b, err := requestBody.MarshalJSON()
        if err != nil {
                return err
        }

        _, err = ca.cb.Execute(func() (interface{}, error) {
                res, err := ca.client.Post(ca.baseURL+sendMessageURL, sendMessageContentTypeJSON, bytes.NewReader(b))
                if err != nil {
                        return nil, err
                }
                defer res.Body.Close()

                body, err := ioutil.ReadAll(res.Body)
                if err != nil {
                        return nil, err
                }

                switch res.StatusCode {
                case http.StatusOK:
                        return body, nil
                case http.StatusUnauthorized:
                        if bytes.Contains(bytes.ToLower(body), invalidLicenseSlice) {
                                return body, fmt.Errorf("%w: %s, %s", errInvalidLicense, res.Status, string(body))
                        }
                        fallthrough
                default:
                        return body, fmt.Errorf("error response: %d, %s", res.StatusCode, string(body))
                }
        })

        return err
}

func loadHostPort

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func loadHostPort(k *ini.Key, defaultVal string, defaultPort string) string {
        addr := k.MustString(defaultVal)
        i := strings.IndexByte(addr, ':')
        if i < 0 {
                return fmt.Sprintf("%s:%s", addr, defaultPort)
        }
        return addr
}

func NewUserWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func NewUserWhiteList(file string) *UserWhiteList {
        if file == "" {
                return nil
        }

        wl := &UserWhiteList{}
        wl.WhiteList = NewWhiteList([]string{file}, wl.reset, wl.loadLine)
        return wl
}

func Database.expireOld

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) expireOld() (nextExpiration int64, err error) {
        if atomic.LoadInt64(&db.closed) != 0 {
                return 0, ErrClosed
        }

        ts := time.Now().Unix()

        batch := new(leveldb.Batch)

        db.lock.Lock()
        defer db.lock.Unlock()

        iter := db.db.NewIterator(nil, nil)
        for iter.Next() {
                var (
                        changed bool
                        record  Record
                )

                key := iter.Key()
                value := iter.Value()

                err := record.Unmarshal(value)
                if err != nil {
                        // Cleanup bad records
                        batch.Delete(key)
                        log.Tracef("---[db]->> del %v", key)
                }

                // Remove expired attempts
                for hash, expiredAt := range record.Attempts {
                        if expiredAt < ts {
                                delete(record.Attempts, hash)
                                changed = true
                                continue
                        }
                        if nextExpiration > expiredAt {
                                nextExpiration = expiredAt
                        }
                }

                // Remove lock if expired
                if record.LockExpireAt != 0 && record.LockExpireAt < ts {
                        record.LockExpireAt = 0
                        changed = true
                }

                if record.LockExpireAt != 0 && record.LockExpireAt < nextExpiration {
                        nextExpiration = record.LockExpireAt
                }

                if changed {
                        db.writeRecord(batch, string(key), &record)
                }
        }
        iter.Release()

        err = iter.Error()
        if err != nil {
                return 0, fmt.Errorf("iterator: %v", err)
        }

        if batch.Len() == 0 {
                return
        }

        err = db.db.Write(batch, nil)
        if err != nil {
                err = fmt.Errorf("batch write: %v", err)
        }

        return
}

func Database.WriteAttempts

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) WriteAttempts(ip string, user string, hash string) error {
        batch := new(leveldb.Batch)

        if atomic.LoadInt64(&db.closed) != 0 {
                return ErrClosed
        }

        db.lock.Lock()
        defer db.lock.Unlock()

        if user != "" {
                err := db.writeAttempt(batch, user, hash, &db.cfg.UserLock)
                if err != nil {
                        return fmt.Errorf("USER_LOCK: %v", err)
                }
        }

        if ip != "" && ip != "127.0.0.1" {
                err := db.writeAttempt(batch, ip, hash, &db.cfg.IPLock)
                if err != nil {
                        return fmt.Errorf("IP_LOCK: %v", err)
                }
        }

        if user != "" && ip != "" {
                err := db.writeAttempt(batch, ip+"/"+user, hash, &db.cfg.UserIPLock.LockConfig)
                if err != nil {
                        return fmt.Errorf("USER_IP_LOCK: %v", err)
                }
        }

        if batch.Len() == 0 {
                return nil
        }

        err := db.db.Write(batch, nil)
        if err != nil {
                return fmt.Errorf("batch write: %v", err)
        }

        return nil
}

func FailureWatchdogRecord.ReadFromFile

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record.go:

func (r *FailureWatchdogRecord) ReadFromFile(path string) error {
        data, err := afero.ReadFile(appFs, path)
        if err != nil {
                return err
        }

        // The file is empty
        if len(data) < 1 {
                return nil
        }

        err = r.Unmarshal(data)
        if err != nil {
                return err
        }

        return nil
}

func getOwnIP

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

func getOwnIP() (ip string, err error) {
        client := &http.Client{
                Timeout: 2 * time.Second,
        }

        resp, err := client.Get("https://api.ipify.org")
        if err != nil {
                return "", err
        }

        defer resp.Body.Close()
        body, err := ioutil.ReadAll(resp.Body)
        if err != nil {
                return "", err
        }

        return string(body), nil
}

func Agent.ProcessModuleRequest

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/module.go:

func (p *Agent) ProcessModuleRequest(r Request, name string) []byte {
        r.Host = ToIP(r.Host)

        switch r.Type {
        case "check":
                isWhitelisted, err := whitelist.Query(r.Host)
                if err != nil {
                        log.WithError(err).Errorf("failed to query wafd: %v", err)
                } else if isWhitelisted {
                        return ResponseOK
                }

                result, err := p.db.CheckLock(r.Host, r.User)
                if err != nil {
                        log.WithError(err).Errorf("check lock: %v", err)
                        return ResponseFailure
                }

                var response string

                if result&UserLock != NoLock {
                        response = fmt.Sprintf(
                                "[IM360_UL] The account %s has been temporarily locked by Imunify PAM(%s)",
                                r.User, r.Host)
                }
                if result&IPLock != NoLock {
                        response = fmt.Sprintf("[IM360_IPL] The IP %s has been locked by Imunify PAM", r.Host)
                }
                if result&UserIPLock != NoLock {
                        response = fmt.Sprintf(
                                "[IM360_IPUL] The account %s has been locked for the attacker IP %s",
                                r.User, r.Host)
                }

                if p.cfg.RBLTimeout > 0 && p.rbl != nil {
                        value, err := p.rbl.Check(r.Host)
                        if err != nil {
                                noSuchHost := strings.HasSuffix(err.Error(), "no such host")
                                if !noSuchHost {
                                        if dnsErr, isDNSErr := err.(*net.DNSError); isDNSErr && dnsErr.IsTimeout {
                                                atomic.AddInt64(&p.statRBLCheck.Timeout, 1)
                                        } else {
                                                atomic.AddInt64(&p.statRBLCheck.Errors, 1)
                                                log.WithError(err).Errorf("RBL check: %v", err)
                                        }
                                } else {
                                        atomic.AddInt64(&p.statRBLCheck.Success, 1)
                                }
                        } else {
                                atomic.AddInt64(&p.statRBLCheck.Success, 1)
                        }
                        if value {
                                response = fmt.Sprintf(
                                        "[IM360_RBL] The IP %s has been locked due to Imunify RBL", r.Host)
                        }
                }

                if len(response) > 0 {
                        return ModuleStringResponse(actionBlocked, response)
                }

                return ResponseOK
        case "failed":
                for _, hash := range r.Hash {
                        err := p.db.WriteAttempts(r.Host, r.User, hash)
                        if err != nil {
                                log.WithError(err).Errorf("write filed attempt: %v", err)
                        }
                        p.WriteStat(false, fmt.Sprintf("%s[%s]", r.Service, name), r.Host, r.User, hash)
                }
                return nil
        case "success":
                err := p.db.RemoveSuccess(r.Host, r.User)
                if err != nil {
                        log.WithError(err).Errorf("write filed attempt: %v", err)
                        return ResponseFailure
                }
                p.WriteStat(true, fmt.Sprintf("%s[%s]", r.Service, name), r.Host, r.User, "e")
                return nil
        }

        return nil
}

func Agent.ProcessCPanelFtpAuthRequest

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/cpanel.go:

func (p *Agent) ProcessCPanelFtpAuthRequest(data []byte, name string) []byte {
        var request CPanelAuthMsg
        request.Unmarshal(data)
        if request.Account == "" || request.Password == "" {
                log.WithField("data", string(data)).Warnf("parse request: No user credentials")
                return nil
        }
        request.Peer = ToIP(request.Peer)

        isWhitelisted, err := whitelist.Query(request.Peer)
        if err != nil {
                log.WithError(err).Errorf("failed to query wafd: %v", err)
        }

        if request.Peer == "" || isWhitelisted == false {
                result, err := p.db.CheckLock(request.Peer, request.Account)
                if err != nil {
                        log.WithError(err).Errorf("check lock: %v", err)
                }

                if result&UserLock != NoLock {
                        msg := fmt.Sprintf(
                                "pam_imunify(cpanel_ftp_auth:auth): [IM360_UL] The account %s has been temporarily locked by Imunify PAM(%s)",
                                request.Account, request.Peer)
                        if p.syslog != nil {
                                p.syslog.Err(msg)
                        } else {
                                log.WithFields(log.Fields{
                                        "type": "syslog",
                                }).Info(msg)
                        }
                        return ResponseCPanelAuthFtpdReject
                }
                if result&IPLock != NoLock {
                        msg := fmt.Sprintf(
                                "pam_imunify(cpanel_ftp_auth:auth): [IM360_IPL] The IP %s has been locked by Imunify PAM",
                                request.Peer)
                        if p.syslog != nil {
                                p.syslog.Err(msg)
                        } else {
                                log.WithFields(log.Fields{
                                        "type": "syslog",
                                }).Info(msg)
                        }
                        return ResponseCPanelAuthFtpdReject
                }
                if result&UserIPLock != NoLock {
                        msg := fmt.Sprintf(
                                "pam_imunify(cpanel_ftp_auth:auth): [IM360_IPUL] The account %s has been locked for the attacker IP %s",
                                request.Account, request.Peer)
                        if p.syslog != nil {
                                p.syslog.Err(msg)
                        } else {
                                log.WithFields(log.Fields{
                                        "type": "syslog",
                                }).Info(msg)
                        }
                        return ResponseCPanelAuthFtpdReject
                }

                if result&UserLock != NoLock || result&IPLock != NoLock || result&UserIPLock != NoLock {

                }

                if request.Peer != "" && p.cfg.RBLTimeout > 0 && p.rbl != nil {
                        value, err := p.rbl.Check(request.Peer)
                        if err != nil {
                                noSuchHost := strings.HasSuffix(err.Error(), "no such host")
                                if !noSuchHost {
                                        if dnsErr, isDNSErr := err.(*net.DNSError); isDNSErr && dnsErr.IsTimeout {
                                                atomic.AddInt64(&p.statRBLCheck.Timeout, 1)
                                        } else {
                                                atomic.AddInt64(&p.statRBLCheck.Errors, 1)
                                                log.WithError(err).Errorf("RBL check: %v", err)
                                        }
                                } else {
                                        atomic.AddInt64(&p.statRBLCheck.Success, 1)
                                }
                        } else {
                                atomic.AddInt64(&p.statRBLCheck.Success, 1)
                        }
                        if value {
                                msg := fmt.Sprintf(
                                        "pam_imunify(cpanel_ftp_auth:auth): [IM360_RBL] The IP %s has been locked due to Imunify RBL",
                                        request.Peer)
                                if p.syslog != nil {
                                        p.syslog.Err(msg)
                                } else {
                                        log.WithFields(log.Fields{
                                                "type": "syslog",
                                        }).Info(msg)
                                }
                                return ResponseCPanelAuthFtpdReject
                        }
                }
        }

        cpanelConn, err := net.DialTimeout("unix", p.cfg.CPanelFtpAuthOutSocket, time.Duration(p.cfg.CPanelFtpAuthOutTimeout)*time.Second)
        if err != nil {
                log.WithError(err).Errorf("CPanel auth ftpd connect: %v", err)
                return nil
        }
        defer cpanelConn.Close()

        _ = cpanelConn.SetDeadline(time.Now().Add(time.Duration(p.cfg.CPanelFtpAuthOutTimeout) * time.Second))

        _, err = cpanelConn.Write(data)
        if err != nil {
                log.WithError(err).Errorf("CPanel auth ftpd write: %v", err)
                return nil
        }

        var responseData []byte
        responseData, err = CPanelFtpAuthRecv(cpanelConn)
        if err != nil {
                log.WithError(err).Errorf("CPanel auth ftpd read: %v", err)
                return nil
        }

        var response CPanelAuthMsg
        response.Unmarshal(responseData)

        switch response.AuthOk {
        case "1":
                err := p.db.RemoveSuccess(request.Peer, request.Account)
                if err != nil {
                        log.WithError(err).Errorf("write filed attempt: %v", err)
                }
                p.WriteStat(true, fmt.Sprintf("cpanel_ftp_auth[%s]", name), request.Peer, request.Account, "e")
        case "-1", "0":
                hash := fmt.Sprintf("%x", xxh3.HashString(request.Account+request.Password))
                err := p.db.WriteAttempts(request.Peer, request.Account, hash)
                if err != nil {
                        log.WithError(err).Errorf("write filed attempt: %v", err)
                }
                p.WriteStat(false, fmt.Sprintf("cpanel_ftp_auth[%s]", name), request.Peer, request.Account, hash)
        default:
                log.WithFields(log.Fields{
                        "response_auth": response.AuthOk,
                        "response":      string(responseData),
                }).Errorf("CPanel auth ftpd: bad auth response \"%s\"", response.AuthOk)
        }

        return responseData
}

func NewSentryLogger

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

func NewSentryLogger(pkgName string, pkgVersion string) (*logrus_sentry.SentryHook, error) {
        transport := sentry.NewHTTPSyncTransport()
        transport.Configure(sentry.ClientOptions{
                Dsn: SentryDsn,
        })
        client, err := sentry.NewClient(sentry.ClientOptions{
                Dsn:       SentryDsn,
                Transport: transport,
        })
        if err != nil {
                log.Errorf("failed to create sentry client: %v", err)
        }

        scope := SentryScope
        scope.SetTag("name", pkgName)
        scope.SetTag("version", pkgVersion)

        serverIP, err := getOwnIP()
        if err != nil {
                log.Errorf("failed to retrieve server IP: %v", err)

                // recording the err for more informative server_ip breakdown
                scope.SetTag("server_ip", fmt.Sprintf("%v", err))
        } else if serverIP != "" {
                scope.SetTag("server_ip", serverIP)
        }

        serverID, err := getServerId()
        if err != nil {
                log.Errorf("failed to retrieve server ID: %v", err)
                scope.SetUser(sentry.User{
                        ID: "N/A",
                })
        } else if serverID != "" {
                scope.SetUser(sentry.User{
                        ID: serverID,
                })
        } else {
                scope.SetUser(sentry.User{
                        ID: "N/A",
                })
        }

        osRelease, err := getOsRelease()
        if err != nil {
                log.Errorf("failed to retrieve OS release: %v", err)
        } else if osRelease != "" {
                scope.SetTag("os.version", osRelease)
        }

        errorRateLimitList := []logrus_sentry.ErrorRateLimiter{
                &errHasSuffixRateLimit{
                        err: syscall.ENOSPC,
                        rs:  rateSample(enospcSamplingRate),
                },
                &errHasSuffixRateLimit{
                        err: syscall.EPERM,
                        rs:  rateSample(epermSamplingRate),
                },
        }

        return logrus_sentry.NewSentryHook(client, scope, &logrus_sentry.SentryHookConfiguration{
                Levels:                 log.AllLevels,
                ReportLevels:           log.ErrorLevel,
                BreadcrumbLevels:       log.InfoLevel,
                IncludeErrorBreadcrumb: true,
                StacktraceEnable:       true,
                StacktraceLevel:        log.ErrorLevel,
                LimitErrors:            errorRateLimitList,
        })
}

func shouldLogError

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func shouldLogError(err error) bool {
        if err == nil {
                return false
        }

        if err == io.EOF {
                return false
        }

        str := err.Error()
        if strings.Contains(str, "use of closed network connection") {
                return false
        }

        return true
}

func WhiteList.isNeedUpdate

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *WhiteList) isNeedUpdate() bool {
        for fileName, fileModTime := range wl.file {
                info, err := os.Stat(fileName)
                if err != nil || info == nil {
                        if !fileModTime.IsZero() {
                                return true
                        }
                } else if !info.ModTime().Equal(fileModTime) {
                        return true
                }
        }
        return false
}

func Request.CheckSign

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request.go:

func (r Request) CheckSign(secret, key string) bool {
        sign, err := hex.DecodeString(r.Sign)
        if err != nil {
                return false
        }
        return bytes.Equal(r.calcSign(secret, key), sign)
}

func GetAgentLicStatus

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

func GetAgentLicStatus() string {
        status, err := exec.Command("/usr/bin/imunify360-agent", "rstatus").Output()
        if err != nil {
                return fmt.Sprintf("%v", err)
        } else {
                return strings.TrimSpace(string(status))
        }
}

func IsRunningSystemd

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/service.go:

func IsRunningSystemd() bool {
        fi, err := os.Lstat("/run/systemd/system")
        if err != nil {
                return false
        }
        return fi.IsDir()
}

func Agent.Start

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func (p *Agent) Start(cfg *Config) (err error) {
        p.cfg = cfg

        // For tests purpose
        if p.apiURL == "" {
                p.apiURL = apiURL
        }

        if p.cfg.IsLogfileEnabled() {
                var logfile *os.File
                logfile, err = os.OpenFile(p.cfg.LogFilename, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0660)
                if err != nil {
                        return fmt.Errorf("log open: %v", err)
                }
                log.SetOutput(logfile)
        }

        if sentryLoggerHook != nil {
                if len(p.cfg.RBL) == 0 {
                        SentryScope.SetTag("rbl0", "nil")
                } else {
                        for i, rbl := range p.cfg.RBL {
                                SentryScope.SetTag(fmt.Sprintf("rbl%d", i), rbl)
                        }
                }
                SentryScope.SetTag("rbl_timeout", strconv.FormatInt(p.cfg.RBLTimeout, 10))
                SentryScope.SetTag("rbl_cache_ttl", strconv.FormatInt(p.cfg.RBLCacheTTL, 10))
                SentryScope.SetTag("rbl_cache_size", strconv.Itoa(p.cfg.RBLCacheSize))

                if p.cfg.IsSentryEnabled() {
                        sentryLoggerHook.SetEnabled(true)
                        log.Info("sentry error reporting is enabled.")
                } else {
                        sentryLoggerHook.SetEnabled(false)
                        log.Info("sentry error reporting is disabled.")
                }
        }

        if p.cfg.IsVerboseLoggingMode() {
                log.SetLevel(log.TraceLevel)
        } else {
                log.SetLevel(log.InfoLevel)
        }

        p.syslog, err = syslog.New(syslog.LOG_AUTHPRIV, "pam_imunify")
        if err != nil {
                log.WithError(err).Errorf("new syslog instance: %v", err)
        }

        p.db, err = DatabaseOpen(p.cfg)
        if err != nil {
                dbOpenErr := err

                // Plan B: start from scratch
                err = DatabaseDrop(p.cfg)
                if err == nil {
                        p.db, err = DatabaseOpen(p.cfg)
                }
                if err != nil {
                        return fmt.Errorf("database failover: %v", err)
                } else {
                        log.WithError(dbOpenErr).Warnf("database failover success: %v", dbOpenErr)
                }
        }

        if p.cfg.SendStats {
                p.statSuccessfulRecords = make(map[string]*StatRecord)
                p.statUnsuccessfulRecords = make(map[string]*StatRecord)
                p.statCh = make(chan map[string]*StatRecord)

                p.sendMessageAPI = NewSendMessageAPI(apiURL, PackageVersion, sendMessageAPITimeout)

                p.lw = NewLicenseWatcher(p.cfg.LicensePath, p.cfg.PublicKeyPath, p.cfg.AltPublicKeyPath, licenseReadInterval)
                p.lw.Subscribe(func(l License, valid bool) {
                        var lic *License
                        if valid {
                                lic = &l
                                log.Info("Detected a valid license.")
                        } else {
                                log.WithFields(log.Fields{
                                        log.ErrorKey:       l.err,
                                        "agent_lic_status": GetAgentLicStatus(),
                                }).Warnf("INVALID license has been detected.")
                        }
                        atomic.StorePointer((*unsafe.Pointer)(unsafe.Pointer(&p.license)), unsafe.Pointer(lic))
                })
                p.lw.Subscribe(func(l License, valid bool) {
                        if valid {
                                // Leave a chance to flip sentry reporting back.
                                sentryLoggerHook.SetEnabled(p.cfg.IsSentryEnabled())
                        } else {
                                if l.err != nil {
                                        sentryLoggerHook.SetEnabled(false)
                                        if p.cfg.IsSentryEnabled() {
                                                log.WithFields(log.Fields{
                                                        log.ErrorKey:       l.err,
                                                        "agent_lic_status": GetAgentLicStatus(),
                                                }).Errorf("sentry error reporting is disabled (because of INVALID license error)")
                                        }
                                }
                        }
                })
                p.lw.Start()

                p.statWait.Add(1)
                go p.ServeSendStat()
        }

        p.wlUser = NewUserWhiteList(p.cfg.UserLock.WhitelistFileName)
        p.wlUserIP = NewUserIPWhiteList(p.cfg.UserIPLock.LockConfig.WhitelistFileName)

        p.db.WithUserWhitelist(p.wlUser).WithUserIPWhitelist(p.wlUserIP)

        if p.cfg.RBLTimeout > 0 {
                p.rbl = NewRBL(RBLConfig{
                        ResolverAddr:         p.cfg.ResolvConf,
                        RBLServers:           p.cfg.RBL,
                        RequestTimeout:       time.Duration(p.cfg.RBLTimeout) * time.Second,
                        CacheSize:            p.cfg.RBLCacheSize,
                        CacheInRBLTimeout:    time.Duration(p.cfg.RBLCacheTTL) * time.Second,
                        CacheNotInRBLTimeout: 1 * time.Minute,
                        CacheErrorTimeout:    1 * time.Minute,
                })
                p.statsRBLCheckStop = make(chan struct{})
                go p.ServeLogRBLStat()
        }

        p.connList = make(map[net.Conn]struct{})

        listeners, err := GetListeners(p.cfg.Socket, p.cfg.CPanelFtpAuthInSocket)
        if err != nil {
                return fmt.Errorf("failed to listen on sockets: %w", err)
        }
        if err := ModifyDovecotSocket(p.cfg.Socket); err != nil {
                return fmt.Errorf("failed to modify dovecot socket %s: %w", p.cfg.Socket, err)
        }

        p.acceptList = listeners

        idleTimeout := cfg.IdleTimeout
        if idleTimeout > 0 && IsRunningSystemd() {
                p.Tracker = NewConnTracker(time.Duration(idleTimeout) * time.Second)
                go p.Tracker.HandleActivity()
        }

        err = p.Serve(p.cfg.Socket, p.ProcessModuleConn)
        if err != nil {
                return fmt.Errorf("listen: %v", err)
        }

        if p.cfg.CPanelFtpAuthInSocket != "" && p.cfg.CPanelFtpAuthOutSocket != "" && p.cfg.CPanelFtpAuthOutTimeout > 0 {
                err = p.Serve(p.cfg.CPanelFtpAuthInSocket, p.ProcessCPanelFtpAuthConn)
                if err != nil {
                        return fmt.Errorf("listen: %v", err)
                }
        }
        return
}

func DatabaseOpen

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func DatabaseOpen(cfg *Config) (db *Database, err error) {
        var database *leveldb.DB

        path := filepath.Join(cfg.Database, "/leveldb")
        database, err = leveldb.OpenFile(path, nil)
        if err != nil {
                return
        }

        db = &Database{
                cfg:           cfg,
                path:          path,
                db:            database,
                stopExpireOld: make(chan bool, 1),
        }

        var nextExpire int64
        nextExpire, err = db.expireOld()
        if err == nil {
                db.waitExpireOld.Add(1)
                go db.serveExpireOld(nextExpire)
                return
        }

        err = fmt.Errorf("expire old: %v", err)
        _ = db.db.Close()
        return nil, err
}

func Database.readRecord

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db Database) readRecord(key string) (record Record, err error) {
        var data []byte
        data, err = db.db.Get([]byte(key), nil)
        if err == leveldb.ErrNotFound {
                err = nil
                log.WithField("record", "nil").Tracef("<--[db]--- %v", key)
                return
        }
        if err != nil {
                err = fmt.Errorf("get record: %v", err)
                return
        }

        err = record.Unmarshal(data)
        if err != nil {
                err = fmt.Errorf("unmarshal: %v", err)
                return
        }

        log.WithField("record", record).Tracef("<--[db]--- %v", key)
        return
}

func easyjson2c6259e0Decode1

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license_proto_easyjson.go:

func easyjson2c6259e0Decode1(in *jlexer.Lexer, out *License) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "group":
                        out.Group = string(in.String())
                case "id":
                        out.ID = string(in.String())
                case "limit":
                        out.Limit = int(in.Int())
                case "message":
                        out.Message = string(in.String())
                case "sign":
                        out.Sign = string(in.String())
                case "signatures":
                        if in.IsNull() {
                                in.Skip()
                                out.Signatures = nil
                        } else {
                                in.Delim('[')
                                if out.Signatures == nil {
                                        if !in.IsDelim(']') {
                                                out.Signatures = make([]string, 0, 4)
                                        } else {
                                                out.Signatures = []string{}
                                        }
                                } else {
                                        out.Signatures = (out.Signatures)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v1 string
                                        v1 = string(in.String())
                                        out.Signatures = append(out.Signatures, v1)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                case "status":
                        out.Status = string(in.String())
                case "token_created_utc":
                        out.TokenCreatedUTC = int(in.Int())
                case "token_expire_utc":
                        out.TokenExpireUTC = int(in.Int())
                case "upgrade_url":
                        out.UpgradeURL = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Database.RemoveSuccess

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) RemoveSuccess(ip string, user string) error {
        batch := new(leveldb.Batch)
        userIPLockAutowhitelist := false // to keep USER_LOCK and IP_LOCK as is

        if user != "" && ip != "" && db.cfg.UserIPLock.IsAutowhitelistEnabled() {
                record, err := db.readRecord(ip + "/" + user + "|SUCCESS")
                if err != nil {
                        return fmt.Errorf("read user/ip autowhitelist record: %v", err)
                }
                if record.LockExpireAt >= time.Now().Unix() {
                        userIPLockAutowhitelist = true
                }
        }

        if user != "" && !userIPLockAutowhitelist {
                batch.Delete([]byte(user))
                log.Tracef("---[db]->> del %v", user)
        }
        if user != "" && ip != "" {
                if !userIPLockAutowhitelist {
                        batch.Delete([]byte(ip + "/" + user))
                        log.Tracef("---[db]->> del %v", ip+"/"+user)
                }

                var cfg LockConfig = db.cfg.UserIPLock.ForgeAutowhitelistLockConfig()
                db.writeAttempt(batch, ip+"/"+user+"|SUCCESS", "", &cfg)
        }

        if batch.Len() == 0 {
                return nil
        }

        db.lock.Lock()
        defer db.lock.Unlock()

        err := db.db.Write(batch, nil)
        if err != nil {
                return fmt.Errorf("batch write: %v", err)
        }

        return nil
}

func easyjsonD587a15Decode1

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Decode1(in *jlexer.Lexer, out *StatRecord) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "name":
                        out.Name = string(in.String())
                case "attackers_ip":
                        out.AttackersIP = string(in.String())
                case "rule":
                        out.Rule = int(in.Int())
                case "message":
                        out.Message = string(in.String())
                case "severity":
                        out.Severity = int(in.Int())
                case "retries":
                        out.Retries = int(in.Int())
                case "timestamp":
                        out.Timestamp = int64(in.Int64())
                case "plugin_id":
                        out.PluginId = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Database.serveExpireOld

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) serveExpireOld(nextExpire int64) {
        defer failureWatchdog.CapturePanic()
        defer db.waitExpireOld.Done()
        var err error
        for {
                ts := time.Now().Unix()

                if nextExpire < ts+60 {
                        nextExpire = 60
                } else {
                        nextExpire -= ts
                }

                timer := time.NewTimer(time.Duration(nextExpire) * time.Second)

                select {
                case <-db.stopExpireOld:
                        return
                case <-timer.C:
                        nextExpire, err = db.expireOld()
                        if err != nil {
                                return
                        }
                }
        }
}

func ConnProcess

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/utils.go:

func ConnProcess(conn net.Conn) (*process.Process, error) {
        pid, err := connProcessPid(conn)
        if err != nil {
                return nil, err
        }

        proc, err := process.NewProcess(pid)
        if err != nil {
                return nil, err
        }

        return proc, nil
}

func ConfigLoad

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func ConfigLoad(path string) (cfg *Config, err error) {
        var i *ini.File

        i, err = ini.Load(path)
        if err != nil {
                err = fmt.Errorf("fail to read config: %v", err)
                return
        }

        cfg = &Config{
                LogFilename: i.Section("").
                        Key("log").
                        MustString(""),

                Sentry: i.Section("").
                        Key("sentry").
                        MustString("https://sentry.cloudlinux.com/sentry/i360-pam-imunify/"),

                Database: i.Section("").
                        Key("mod_db_path").
                        MustString("/opt/i360_pam_imunify/db"),

                Socket: i.Section("").
                        Key("socket").
                        MustString("/opt/i360_pam_imunify/pam_imunify360.sock"),

                ResolvConf: loadHostPort(i.Section("").Key("RBL_nameserver"),
                        "ns1-rbl.imunify.com:53", "53"),

                SharedKey: loadKeyFile(i.Section("").
                        Key("shared_key_file").
                        MustString("/opt/i360_pam_imunify/key"), "7raXUdtFcBSr2Bes"),

                PublicKeyPath: i.Section("").
                        Key("public_key_path").
                        MustString("/usr/share/imunify360/cln-pub.key"),
                AltPublicKeyPath: i.Section("").
                        Key("alt_public_key_path").
                        MustString("/usr/share/imunify360/alt-license-pub.key"),

                LicensePath: i.Section("").
                        Key("license_path").
                        MustString("/var/imunify360/license.json"),

                SendStats: i.Section("").
                        Key("send_stats").MustBool(true),

                SendStatsSuccessfulAggTime: i.Section("").
                        Key("send_stats_success_agg_time").MustInt64(30 * 60),

                SendStatsUnsuccessfulAggTime: i.Section("").
                        Key("send_stats_unsuccess_agg_time").MustInt64(60),

                RBL: func() []string {
                        rbl := i.Section("").Key("rbl").Strings(",")
                        if len(rbl) > 0 {
                                return rbl
                        }
                        return []string{"net-brute.rbl.imunify.com"}
                }(),
                RBLTimeout: i.Section("").
                        Key("RBL_timeout").MustInt64(1),
                RBLCacheTTL: i.Section("").
                        Key("RBL_cache_ttl").MustInt64(600),
                RBLCacheSize: i.Section("").
                        Key("RBL_cache_size").MustInt(65535),
                UserLock: loadLockConfigUser(i.Section(""), "/var/i360_pam_imunify/users/users.txt"),
                IPLock: loadLockConfigIP(i.Section(""),
                        "/var/i360_pam_imunify/wl/ips.txt",
                        "/etc/apache2/conf.d/modsec_vendor_configs/imunify360_full_apache/rbl_whitelist,"+
                                "/etc/httpd/conf/modsecurity.d/rules/custom/rbl_whitelist"),
                UserIPLock: loadLockConfigUserIP(i.Section(""), ""),

                CPanelFtpAuthInSocket: i.Section("").
                        Key("cpanel_ftp_auth_in_socket").
                        MustString("/var/run/ftpd.imunify360.sock"),
                CPanelFtpAuthOutSocket: i.Section("").
                        Key("cpanel_ftp_auth_out_socket").
                        MustString("/var/run/ftpd.sock"),
                CPanelFtpAuthOutTimeout: i.Section("").
                        Key("cpanel_ftp_auth_out_timeout").MustInt64(15),

                IdleTimeout: i.Section("").
                        Key("idle_timeout").MustInt64(10 * 60),

                FailureWatchdogEnabled: i.Section("").
                        Key("failure_watchdog_enabled").MustBool(true),
                FailureWatchdogLimit: i.Section("").
                        Key("failure_watchdog_limit").MustInt(10),
                FailureWatchdogPeriod: i.Section("").
                        Key("failure_watchdog_period").MustInt64(3600),
        }

        return
}

func easyjsonD587a15Decode12

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Decode12(in *jlexer.Lexer, out *License) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "group":
                        out.Group = string(in.String())
                case "id":
                        out.ID = string(in.String())
                case "limit":
                        out.Limit = int(in.Int())
                case "message":
                        out.Message = string(in.String())
                case "sign":
                        out.Sign = string(in.String())
                case "signatures":
                        if in.IsNull() {
                                in.Skip()
                                out.Signatures = nil
                        } else {
                                in.Delim('[')
                                if out.Signatures == nil {
                                        if !in.IsDelim(']') {
                                                out.Signatures = make([]string, 0, 4)
                                        } else {
                                                out.Signatures = []string{}
                                        }
                                } else {
                                        out.Signatures = (out.Signatures)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v4 string
                                        v4 = string(in.String())
                                        out.Signatures = append(out.Signatures, v4)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                case "status":
                        out.Status = string(in.String())
                case "token_created_utc":
                        out.TokenCreatedUTC = int(in.Int())
                case "token_expire_utc":
                        out.TokenExpireUTC = int(in.Int())
                case "upgrade_url":
                        out.UpgradeURL = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func easyjsonD587a15Decode11

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Decode11(in *jlexer.Lexer, out *SendMessagesApiRequest) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "rpm_ver":
                        out.AgentVersion = string(in.String())
                case "license":
                        easyjsonD587a15Decode12(in, &out.License)
                case "method":
                        out.Method = string(in.String())
                case "ver":
                        out.ProtocolVersion = string(in.String())
                case "server_id":
                        out.ServerID = string(in.String())
                case "payload":
                        if in.IsNull() {
                                in.Skip()
                                out.Payload = nil
                        } else {
                                in.Delim('[')
                                if out.Payload == nil {
                                        if !in.IsDelim(']') {
                                                out.Payload = make([]StatRecord, 0, 0)
                                        } else {
                                                out.Payload = []StatRecord{}
                                        }
                                } else {
                                        out.Payload = (out.Payload)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v1 StatRecord
                                        (v1).UnmarshalEasyJSON(in)
                                        out.Payload = append(out.Payload, v1)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Database.CheckLock

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func (db *Database) CheckLock(ip string, user string) (LockStatus, error) {
        if atomic.LoadInt64(&db.closed) != 0 {
                return NoLock, ErrClosed
        }

        ts := time.Now().Unix()

        var (
                record     Record
                err        error
                lockStatus LockStatus
        )

        if db.cfg.UserIPLock.IsAutowhitelistEnabled() {
                record, err = db.readRecord(ip + "/" + user + "|SUCCESS")
                if err != nil {
                        return NoLock, fmt.Errorf("read user/ip autowhitelist record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        return lockStatus, nil
                }
        }

        if db.cfg.UserLock.IsEnabled() && !db.usersWhitelist.In(user) {
                record, err = db.readRecord(user)
                if err != nil {
                        return NoLock, fmt.Errorf("read user record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        lockStatus |= UserLock
                }
        }

        if db.cfg.IPLock.IsEnabled() && ip != "" {
                record, err = db.readRecord(ip)
                if err != nil {
                        return NoLock, fmt.Errorf("read ip record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        lockStatus |= IPLock
                }
        }

        if db.cfg.UserIPLock.LockConfig.IsEnabled() && ip != "" && !db.userIPWhitelist.In(user, ip) {
                record, err = db.readRecord(ip + "/" + user)
                if err != nil {
                        return NoLock, fmt.Errorf("read user/ip record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        lockStatus |= UserIPLock
                }
        }

        return lockStatus, nil
}

func Request.calcSign

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request.go:

func (r Request) calcSign(secret, key string) []byte {
        hash := sha256.New()
        hash.Write([]byte(secret))
        hash.Write([]byte(r.Type))
        hash.Write([]byte(r.Service))
        hash.Write([]byte(r.User))
        hash.Write([]byte(r.Host))
        for _, v := range r.Hash {
                hash.Write([]byte(v))
        }
        if r.Timestamp != nil {
                a := make([]byte, 8)
                binary.LittleEndian.PutUint64(a, uint64(*r.Timestamp))
                hash.Write(a)
        }
        if r.Timeout != nil {
                a := make([]byte, 8)
                binary.LittleEndian.PutUint64(a, uint64(*r.Timeout))
                hash.Write(a)
        }
        hash.Write([]byte(key))
        return hash.Sum(nil)
}

func connProcessPid

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/utils.go:

func connProcessPid(conn net.Conn) (int32, error) {
        sock, ok := conn.(*net.UnixConn)
        if !ok {
                return 0, fmt.Errorf("pointer cast error: %#v", conn)
        }

        raw, err := sock.SyscallConn()
        if err != nil {
                return 0, err
        }

        var cred *syscall.Ucred
        err = raw.Control(func(fd uintptr) {
                cred, err = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
        })
        if err != nil {
                return 0, fmt.Errorf("GetsockoptUcred: %v", err)
        }
        if cred == nil {
                return 0, fmt.Errorf("Something went wrong: cred = nil")
        }
        if cred.Pid == 0 {
                return 0, fmt.Errorf("Something went wrong: cred.Pid = 0")
        }

        return cred.Pid, nil
}

func WhiteList.Update

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/whitelist.go:

func (wl *WhiteList) Update() {
        select {
        case lastCheckTime := <-wl.lastCheckTime:
                timeNow := time.Now()
                if timeNow.Before(lastCheckTime.Add(1 * time.Second)) {
                        wl.lastCheckTime <- lastCheckTime
                        return
                }

                if !wl.isNeedUpdate() {
                        wl.lastCheckTime <- timeNow
                        return
                }

                wl.Lock()
                wl.reload()
                wl.Unlock()

                wl.lastCheckTime <- timeNow
        default:
        }
}

func NewRBL

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func NewRBL(config RBLConfig) RBL {
        r := &rbl{
                cfg: config,
        }
        if config.CacheSize <= 0 || config.CacheInRBLTimeout <= 0 {
                return r
        }
        if r.cfg.CacheNotInRBLTimeout <= 0 {
                r.cfg.CacheNotInRBLTimeout = 1 * time.Minute
        }
        if r.cfg.CacheErrorTimeout <= 0 {
                r.cfg.CacheErrorTimeout = 1 * time.Minute
        }
        r.cache = gcache.New(config.CacheSize).
                Expiration(config.CacheInRBLTimeout).ARC().
                LoaderExpireFunc(func(key interface{}) (interface{}, *time.Duration, error) {
                        s, ok := key.(string)
                        if !ok {
                                return nil, nil, fmt.Errorf("LRU Cache: Bad key value type")
                        }
                        value, err := CheckRBL(r.cfg.ResolverAddr, r.cfg.RBLServers, s, r.cfg.RequestTimeout)
                        if value {
                                return value, &r.cfg.CacheInRBLTimeout, nil
                        }
                        if err == nil || strings.HasSuffix(err.Error(), "no such host") {
                                return false, &r.cfg.CacheNotInRBLTimeout, nil
                        }
                        return &rblError{err: err}, &r.cfg.CacheErrorTimeout, nil
                }).Build()
        return r
}

func SendMessageAPI.SendStats

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api.go:

func (ca *SendMessageAPI) SendStats(license *License, messages []StatRecord) error {
        if license == nil {
                return errInvalidLicense
        }

        if len(messages) == 0 {
                return errNoPayload
        }

        r := SendMessagesApiRequest{
                AgentVersion:    ca.agentVersion,
                ServerID:        license.ID,
                Method:          sendMessageMethod,
                License:         *license,
                Payload:         messages,
                ProtocolVersion: sendMessageProtocolVersion,
        }

        return ca.send(r)
}

func GetListeners

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/socket.go:

func GetListeners(paths ...string) (map[string]net.Listener, error) {
        listenerMap := make(map[string]net.Listener, len(paths))

        listeners, err := activation.Listeners()

        switch {
        case err != nil:
                log.Debugf("failed to listen on activation sockets %v", err)
        case !IsRunningSystemd():
                log.Debugf("running on non-systemd booted OS")
        case len(listeners) != len(paths):
                log.Debugf("activation sockets and paths mismatch. paths %v: listeners: %v", paths, listeners)
        default:
                for i, path := range paths {
                        listenerMap[path] = listeners[i]
                }
                return listenerMap, nil
        }

        listenerMap = make(map[string]net.Listener, len(paths))
        for _, path := range paths {
                _ = os.Remove(path)

                l, err := net.Listen("unix", path)
                if err != nil {
                        return listenerMap, fmt.Errorf("failed to listen on unix domain socket: %w", err)
                }

                listenerMap[path] = l
        }

        return listenerMap, nil
}

func FailureWatchdogRecord.UnmarshalMsg

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record_gen.go:

func (z *FailureWatchdogRecord) UnmarshalMsg(bts []byte) (o []byte, err error) {
        var field []byte
        _ = field
        var zb0001 uint32
        zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
        if err != nil {
                err = msgp.WrapError(err)
                return
        }
        for zb0001 > 0 {
                zb0001--
                field, bts, err = msgp.ReadMapKeyZC(bts)
                if err != nil {
                        err = msgp.WrapError(err)
                        return
                }
                switch msgp.UnsafeString(field) {
                case "timestamps":
                        var zb0002 uint32
                        zb0002, bts, err = msgp.ReadArrayHeaderBytes(bts)
                        if err != nil {
                                err = msgp.WrapError(err, "Timestamps")
                                return
                        }
                        if cap(z.Timestamps) >= int(zb0002) {
                                z.Timestamps = (z.Timestamps)[:zb0002]
                        } else {
                                z.Timestamps = make([]int64, zb0002)
                        }
                        for za0001 := range z.Timestamps {
                                z.Timestamps[za0001], bts, err = msgp.ReadInt64Bytes(bts)
                                if err != nil {
                                        err = msgp.WrapError(err, "Timestamps", za0001)
                                        return
                                }
                        }
                default:
                        bts, err = msgp.Skip(bts)
                        if err != nil {
                                err = msgp.WrapError(err)
                                return
                        }
                }
        }
        o = bts
        return
}

func easyjson3c9d2b01DecodeGithubComUserHello

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func easyjson3c9d2b01DecodeGithubComUserHello(in *jlexer.Lexer, out *Response) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "action":
                        out.Action = string(in.String())
                case "message":
                        out.Message = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Agent.ProcessCPanelFtpAuthConn

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/cpanel.go:

func (p *Agent) ProcessCPanelFtpAuthConn(c net.Conn) {
        proc, err := ConnProcess(c)
        var processName string
        if err != nil {
                processName = fmt.Sprintf("<procNameErr: %v>", err)
        } else {
                processName, err = proc.Name()
                if err != nil {
                        processName = fmt.Sprintf("<procNameErr: %v>", err)
                }
        }

        b, err := CPanelFtpAuthRecv(c)
        if err != nil {
                if shouldLogError(err) {
                        log.WithError(err).Errorf("read: %v", err)
                }
                return
        }

        requestId := p.RequestId()

        log.WithFields(log.Fields{
                "request_id": requestId,
                "request":    string(b),
        }).Debugf("--[svc:%d]->>\n%v", requestId, string(b))

        resp := p.ProcessCPanelFtpAuthRequest(b, processName)
        if resp == nil {
                return
        }

        log.WithFields(log.Fields{
                "request_id": requestId,
                "response":   string(resp),
        }).Debugf("<-[svc:%d]---\n%v", requestId, string(resp))

        _, err = c.Write(resp)
        if err != nil {
                log.WithError(err).Errorf("connection serve: %v", err)
                return
        }
}

func rbl.Check

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func (r rbl) Check(ip string) (bool, error) {
        if r.cache == nil {
                return CheckRBL(r.cfg.ResolverAddr, r.cfg.RBLServers, ip, r.cfg.RequestTimeout)
        }
        v, err := r.cache.Get(ip)
        switch value := v.(type) {
        case bool:
                return value, err
        case *rblError:
                err = nil
                value.once.Do(func() {
                        err = value.err
                })
                return false, err
        }
        if err != nil {
                return false, err
        }
        return false, fmt.Errorf("unknown type of cached value: type=%s, values=%v", reflect.TypeOf(v).String(), v)
}

func @68:25

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api.go:

func() (interface{}, error) {
                res, err := ca.client.Post(ca.baseURL+sendMessageURL, sendMessageContentTypeJSON, bytes.NewReader(b))
                if err != nil {
                        return nil, err
                }
                defer res.Body.Close()

                body, err := ioutil.ReadAll(res.Body)
                if err != nil {
                        return nil, err
                }

                switch res.StatusCode {
                case http.StatusOK:
                        return body, nil
                case http.StatusUnauthorized:
                        if bytes.Contains(bytes.ToLower(body), invalidLicenseSlice) {
                                return body, fmt.Errorf("%w: %s, %s", errInvalidLicense, res.Status, string(body))
                        }
                        fallthrough
                default:
                        return body, fmt.Errorf("error response: %d, %s", res.StatusCode, string(body))
                }
        }

func rangeInt

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func rangeInt(k *ini.Key, defaultVal, min, max int) int {
        val := k.MustInt(defaultVal)
        if val < min || val > max {
                log.Warnf("Value in config file is out of range %d", val)
                return defaultVal
        }
        return val
}

func rangeInt64

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func rangeInt64(k *ini.Key, defaultVal, min, max int64) int64 {
        val := k.MustInt64(defaultVal)
        if val < min || val > max {
                log.Warnf("Value in config file is out of range %d", val)
                return defaultVal
        }
        return val
}

func easyjson3c9d2b01DecodeGithubComUserHello1

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

func easyjson3c9d2b01DecodeGithubComUserHello1(in *jlexer.Lexer, out *Request) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "type":
                        out.Type = string(in.String())
                case "service":
                        out.Service = string(in.String())
                case "user":
                        out.User = string(in.String())
                case "host":
                        out.Host = string(in.String())
                case "hash":
                        if in.IsNull() {
                                in.Skip()
                                out.Hash = nil
                        } else {
                                in.Delim('[')
                                if out.Hash == nil {
                                        if !in.IsDelim(']') {
                                                out.Hash = make([]string, 0, 4)
                                        } else {
                                                out.Hash = []string{}
                                        }
                                } else {
                                        out.Hash = (out.Hash)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v1 string
                                        v1 = string(in.String())
                                        out.Hash = append(out.Hash, v1)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                case "timestamp":
                        if in.IsNull() {
                                in.Skip()
                                out.Timestamp = nil
                        } else {
                                if out.Timestamp == nil {
                                        out.Timestamp = new(TimestampMS)
                                }
                                *out.Timestamp = TimestampMS(in.Int64())
                        }
                case "timeout":
                        if in.IsNull() {
                                in.Skip()
                                out.Timeout = nil
                        } else {
                                if out.Timeout == nil {
                                        out.Timeout = new(TimeoutMS)
                                }
                                *out.Timeout = TimeoutMS(in.Int64())
                        }
                case "sign":
                        out.Sign = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Record.UnmarshalMsg

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/record_msgp.go:

func (z *Record) UnmarshalMsg(bts []byte) (o []byte, err error) {
        var field []byte
        _ = field
        var zb0001 uint32
        zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
        if err != nil {
                err = msgp.WrapError(err)
                return
        }
        for zb0001 > 0 {
                zb0001--
                field, bts, err = msgp.ReadMapKeyZC(bts)
                if err != nil {
                        err = msgp.WrapError(err)
                        return
                }
                switch msgp.UnsafeString(field) {
                case "e":
                        z.LockExpireAt, bts, err = msgp.ReadInt64Bytes(bts)
                        if err != nil {
                                err = msgp.WrapError(err, "LockExpireAt")
                                return
                        }
                case "a":
                        var zb0002 uint32
                        zb0002, bts, err = msgp.ReadMapHeaderBytes(bts)
                        if err != nil {
                                err = msgp.WrapError(err, "Attempts")
                                return
                        }
                        if z.Attempts == nil {
                                z.Attempts = make(map[string]int64, zb0002)
                        } else if len(z.Attempts) > 0 {
                                for key := range z.Attempts {
                                        delete(z.Attempts, key)
                                }
                        }
                        for zb0002 > 0 {
                                var za0001 string
                                var za0002 int64
                                zb0002--
                                za0001, bts, err = msgp.ReadStringBytes(bts)
                                if err != nil {
                                        err = msgp.WrapError(err, "Attempts")
                                        return
                                }
                                za0002, bts, err = msgp.ReadInt64Bytes(bts)
                                if err != nil {
                                        err = msgp.WrapError(err, "Attempts", za0001)
                                        return
                                }
                                z.Attempts[za0001] = za0002
                        }
                default:
                        bts, err = msgp.Skip(bts)
                        if err != nil {
                                err = msgp.WrapError(err)
                                return
                        }
                }
        }
        o = bts
        return
}

func Agent.ProcessModuleConn

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/module.go:

func (p *Agent) ProcessModuleConn(c net.Conn) {
        b := make([]byte, 2048)
        for {
                n, err := c.Read(b)
                if err != nil {
                        if shouldLogError(err) {
                                log.WithError(err).Errorf("read: %v", err)
                        }
                        break
                }

                var processName, processPath string
                requestId := p.RequestId()
                proc, procErr := ConnProcess(c)
                if procErr != nil {
                        processName = fmt.Sprintf("%v", procErr)
                        processPath = fmt.Sprintf("ConnProcessError: %v", err)
                } else {
                        processName, procErr = proc.Name()
                        if procErr != nil {
                                processName = fmt.Sprintf("ProcessNameError: %v", err)
                        }

                        processPath, procErr = proc.Exe()
                        if procErr != nil {
                                processPath = fmt.Sprintf("ProcessPathError: %v", procErr)
                        }
                }
                log.WithField("process_name", processName).Debugf("--[svc:%d]->> %v", requestId, string(b[:n]))

                var r Request
                err = r.UnmarshalJSON(b[:n])
                if err != nil {
                        log.WithFields(log.Fields{
                                log.ErrorKey: err,
                                "data":       string(b[:n]),
                                "len":        n,
                        }).Errorf("parse request: %v", err)
                        break
                }

                if !r.CheckSign(Secret, p.cfg.SharedKey) {
                        log.WithFields(log.Fields{
                                "data":         string(b[:n]),
                                "request":      r,
                                "process_name": processName,
                                "process_path": processPath,
                        }).Errorf("Incorrect signature")
                        break
                }

                resp := p.ProcessModuleRequest(r, processName)
                if resp == nil {
                        break
                }

                log.WithField("process_name", processName).Debugf("<-[svc:%d]--- %v", requestId, string(resp))
                _, err = c.Write(resp)
                if err != nil {
                        var processIsRunning bool
                        if proc != nil {
                                processIsRunning, _ = proc.IsRunning()
                        }
                        fields := log.Fields{
                                log.ErrorKey:    err,
                                "overdue_by":    r.GetOverdueBy().Milliseconds(),
                                "process_name":  processName,
                                "process_path":  processPath,
                                "process_exist": processIsRunning,
                        }

                        if errors.Is(err, syscall.EPIPE) {
                                log.WithFields(fields).Debugf("connection serve: %v", err)
                        } else {
                                log.WithFields(fields).Errorf("connection serve: %v", err)
                        }
                        break
                }
        }
}

func FailureWatchdogRecord.DecodeMsg

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record_gen.go:

func (z *FailureWatchdogRecord) DecodeMsg(dc *msgp.Reader) (err error) {
        var field []byte
        _ = field
        var zb0001 uint32
        zb0001, err = dc.ReadMapHeader()
        if err != nil {
                err = msgp.WrapError(err)
                return
        }
        for zb0001 > 0 {
                zb0001--
                field, err = dc.ReadMapKeyPtr()
                if err != nil {
                        err = msgp.WrapError(err)
                        return
                }
                switch msgp.UnsafeString(field) {
                case "timestamps":
                        var zb0002 uint32
                        zb0002, err = dc.ReadArrayHeader()
                        if err != nil {
                                err = msgp.WrapError(err, "Timestamps")
                                return
                        }
                        if cap(z.Timestamps) >= int(zb0002) {
                                z.Timestamps = (z.Timestamps)[:zb0002]
                        } else {
                                z.Timestamps = make([]int64, zb0002)
                        }
                        for za0001 := range z.Timestamps {
                                z.Timestamps[za0001], err = dc.ReadInt64()
                                if err != nil {
                                        err = msgp.WrapError(err, "Timestamps", za0001)
                                        return
                                }
                        }
                default:
                        err = dc.Skip()
                        if err != nil {
                                err = msgp.WrapError(err)
                                return
                        }
                }
        }
        return
}

func FailureWatchdog.CapturePanic

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog.go:

func (w *FailureWatchdog) CapturePanic() {
        r := recover()
        if r == nil || !w.Enabled {
                return
        }

        log.Debugf("Failure: %v", r)
        w.RecordFailure(time.Now())

        // Propagate panic
        panic(r)
}

func @91:9

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog.go:

func() {
                        if err := w.cb(); err != nil {
                                log.WithError(err).Errorf("failed to execute callback: %v", err)
                        }
                }

func ReverseIP

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/rbl.go:

func ReverseIP(ip net.IP) string {
        if ip.To4() != nil {
                splitAddress := strings.Split(ip.String(), ".")

                for i, j := 0, len(splitAddress)-1; i < len(splitAddress)/2; i, j = i+1, j-1 {
                        splitAddress[i], splitAddress[j] = splitAddress[j], splitAddress[i]
                }

                return strings.Join(splitAddress, ".")
        } else if ip.To16() != nil {
                ipv6 := ip.To16()
                hexDigit := "0123456789abcdef"

                s := make([]string, len(ipv6)*2)
                for i := 0; i < net.IPv6len; i += 1 {
                        s[i*2], s[i*2+1] = string(hexDigit[ipv6[i]>>4]), string(hexDigit[ipv6[i]&0xf])
                }
                for i, j := 0, len(s)-1; i < j; i, j = i+1, j-1 {
                        s[i], s[j] = s[j], s[i]
                }
                return strings.Join(s, ".")
        }
        return ""
}

func FailureWatchdogRecord.EncodeMsg

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog_record_gen.go:

func (z *FailureWatchdogRecord) EncodeMsg(en *msgp.Writer) (err error) {
        // map header, size 1
        // write "timestamps"
        err = en.Append(0x81, 0xaa, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73)
        if err != nil {
                return
        }
        err = en.WriteArrayHeader(uint32(len(z.Timestamps)))
        if err != nil {
                err = msgp.WrapError(err, "Timestamps")
                return
        }
        for za0001 := range z.Timestamps {
                err = en.WriteInt64(z.Timestamps[za0001])
                if err != nil {
                        err = msgp.WrapError(err, "Timestamps", za0001)
                        return
                }
        }
        return
}

func loadKeyFile

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func loadKeyFile(filename, defaultKey string) string {
        b, err := os.ReadFile(filename)
        if err != nil {
                log.WithFields(log.Fields{
                        log.ErrorKey: err,
                        "filename":   filename,
                }).Warnf("Key file %s read error (default value used): %v", filename, err)
                return defaultKey
        }

        b = bytes.TrimSpace(b)
        if len(b) == 0 {
                log.WithFields(log.Fields{
                        log.ErrorKey: err,
                        "filename":   filename,
                }).Warnf("Key file %s read error (default value used): empty", filename)
                return defaultKey
        }

        return string(b)
}

func getServerId

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

func getServerId() (id string, err error) {
        var f *os.File
        f, err = os.Open("/var/imunify360/license.json")
        if err != nil {
                return
        }
        defer f.Close()

        data, _ := ioutil.ReadAll(f)

        var license Im360License
        json.Unmarshal(data, &license)

        id = license.Id
        return
}

func @182:18

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func(l License, valid bool) {
                        if valid {
                                // Leave a chance to flip sentry reporting back.
                                sentryLoggerHook.SetEnabled(p.cfg.IsSentryEnabled())
                        } else {
                                if l.err != nil {
                                        sentryLoggerHook.SetEnabled(false)
                                        if p.cfg.IsSentryEnabled() {
                                                log.WithFields(log.Fields{
                                                        log.ErrorKey:       l.err,
                                                        "agent_lic_status": GetAgentLicStatus(),
                                                }).Errorf("sentry error reporting is disabled (because of INVALID license error)")
                                        }
                                }
                        }
                }

func ToIP

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/agent.go:

func ToIP(host string) string {
        if host == "" || net.ParseIP(host) != nil {
                return host
        }

        ips, err := net.LookupIP(host)
        if err != nil || len(ips) == 0 {
                return ""
        }

        return ips[0].String()
}

func ModifyDovecotSocket

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/socket.go:

func ModifyDovecotSocket(path string) error {
        grp, err := user.LookupGroup("dovecot")
        if err != nil {
                return nil
        }

        gid, err := strconv.Atoi(grp.Gid)
        if err != nil {
                return fmt.Errorf("failed to get 'dovecot' group id sock '%s': %w", path, err)
        }

        err = os.Chown(path, -1, gid)
        if err != nil {
                return fmt.Errorf("failed to set 'dovecot' group for sock '%s': %w", path, err)
        }

        info, err := os.Stat(path)
        if err != nil {
                return fmt.Errorf("failed to get file info for sock '%s': %w", path, err)
        }

        err = os.Chmod(path, info.Mode().Perm()|0060)
        if err != nil {
                return fmt.Errorf("failed to set group perms for sock '%s': %w", path, err)
        }

        return nil
}

func main

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/main.go:

func main() {
        defer failureWatchdog.CapturePanic()

        var (
                done    bool
                cfgPath string
        )

        flag.StringVar(&cfgPath, "f", DefaultIniPath, "ini file path")
        flag.Parse()

        sigs := make(chan os.Signal, 1)
        signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)

        for !done {
                cfg, err := ConfigLoad(cfgPath)
                if err != nil {
                        failureWatchdog.RecordFailure(time.Now())
                        log.WithError(err).Fatalf("start: %v", err)
                }

                failureWatchdog.Limit = cfg.FailureWatchdogLimit
                failureWatchdog.Period = time.Second * time.Duration(cfg.FailureWatchdogPeriod)
                failureWatchdog.Enabled = cfg.FailureWatchdogEnabled

                p := new(Agent)

                err = p.Start(cfg)
                if err != nil {
                        failureWatchdog.RecordFailure(time.Now())
                        log.WithError(err).Fatalf("start: %v", err)
                }

                // Listen for idle alerts from ConnTracker
                idleDone := make(chan struct{})
                if p.Tracker != nil {
                        idleDone = p.Tracker.Done
                }

                log.Debug("Starting imunify360-pam")
                select {
                case sig := <-sigs:
                        if sig == syscall.SIGINT || sig == syscall.SIGTERM {
                                log.Debugf("Stopping imunify360-pam due to signal %v", sig)
                                done = true
                        }
                        if sig == syscall.SIGHUP {
                                log.Debug("Received SIGHUP, rereading config file")
                        }
                case <-idleDone:
                        log.Debug("Stopping imunify360-pam due to idleness")
                        done = true
                }

                if err := p.Stop(); err != nil {
                        failureWatchdog.RecordFailure(time.Now())
                        log.WithError(err).Fatalf("stop: %v", err)
                }

                p = nil
                runtime.GC()
        }
}

func Request.GetOverdueBy

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request.go:

func (r Request) GetOverdueBy() time.Duration {
        if r.Timestamp == nil || r.Timeout == nil {
                return 0
        }
        now := time.Now()
        timeout := r.Timestamp.Time().Add(r.Timeout.Duration())
        if now.After(timeout) {
                return now.Sub(timeout)
        }
        return 0
}

func rateSample.sample

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

func (s rateSample) sample() bool {
        if s < 0 || s > 1.0 {
                return false
        }
        if rand.Float64() < float64(s) {
                return true
        }
        return false
}

func disableFtpIntegration

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/watchdog.go:

func disableFtpIntegration() error {
        log.Debugf("Disabling ftp integration")

        ctx, cancel := context.WithTimeout(context.Background(), agentBinTimeout)
        defer cancel()

        cmd := exec.CommandContext(ctx, "/usr/bin/imunify360-agent", "config", "update", "{\"PAM\": {\"ftp_protection\": false}}")
        return cmd.Run()
}

func DatabaseDrop

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/database.go:

func DatabaseDrop(cfg *Config) error {
        path := filepath.Join(cfg.Database, "/leveldb")

        err := os.RemoveAll(path)
        if err != nil {
                return fmt.Errorf("rm -rf %s: %v", path, err)
        }

        return nil
}

func serviceCmd

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/service.go:

func serviceCmd(name, action string) error {
        var cmd *exec.Cmd
        if systemd() {
                cmd = exec.Command(systemctlPath, action, name)
        } else {
                cmd = exec.Command("service", name, action)
        }
        return cmd.Run()
}

func errHasSuffixRateLimit.IsLimited

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/sentry.go:

func (e *errHasSuffixRateLimit) IsLimited(err error) bool {
        if strings.HasSuffix(err.Error(), e.err.Error()) {
                if e.rs.sample() {
                        return true
                }
        }
        return false
}

func systemd

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/service.go:

22	`func systemd() bool {`
23	`_, err := os.Stat(systemctlPath)`
24	`return err == nil`
25	`}`

func TimeoutMS.Duration

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request.go:

39	`func (ts TimeoutMS) Duration() time.Duration {`
40	`return time.Duration(int64(ts) * (1000 * 1000))`
41	`}`

func loadLockConfig

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/config.go:

func loadLockConfig(s *ini.Section, defaultWhitelist string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("timeout"), 300, 0, 9999999),
                Attempts:          rangeInt(s.Key("attempts"), 10, 0, 100),
                Period:            rangeInt64(s.Key("period"), 300, 0, 9999999),
                WhitelistFileName: s.Key("whitelist").MustString(defaultWhitelist),
        }
}

func Response.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

78	`func (v Response) MarshalEasyJSON(w *jwriter.Writer) {`
79	`easyjson3c9d2b01EncodeGithubComUserHello(w, v)`
80	`}`

func TimestampMS.Time

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request.go:

33	`func (ts TimestampMS) Time() time.Time {`
34	`return time.Unix(int64(ts)/1000, (int64(ts)%1000)(10001000))`
35	`}`

func SendMessagesApiRequest.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

253	`func (v SendMessagesApiRequest) MarshalEasyJSON(w *jwriter.Writer) {`
254	`easyjsonD587a15Encode11(w, v)`
255	`}`

func Response.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

90	`func (v Response) UnmarshalEasyJSON(l jlexer.Lexer) {`
91	`easyjson3c9d2b01DecodeGithubComUserHello(l, v)`
92	`}`

func ServiceStart

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/service.go:

37	`func ServiceStart(name string) error {`
38	`return serviceCmd(name, "start")`
39	`}`

func SendMessagesApiRequest.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/api_proto_easyjson.go:

265	`func (v SendMessagesApiRequest) UnmarshalEasyJSON(l jlexer.Lexer) {`
266	`easyjsonD587a15Decode11(l, v)`
267	`}`

func ServiceStop

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/service.go:

41	`func ServiceStop(name string) error {`
42	`return serviceCmd(name, "stop")`
43	`}`

func ServiceRestart

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/service.go:

45	`func ServiceRestart(name string) error {`
46	`return serviceCmd(name, "restart")`
47	`}`

func Request.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

249	`func (v Request) MarshalEasyJSON(w *jwriter.Writer) {`
250	`easyjson3c9d2b01EncodeGithubComUserHello1(w, v)`
251	`}`

func License.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license_proto_easyjson.go:

178	`func (v License) UnmarshalEasyJSON(l jlexer.Lexer) {`
179	`easyjson2c6259e0Decode1(l, v)`
180	`}`

func License.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license_proto_easyjson.go:

166	`func (v License) MarshalEasyJSON(w *jwriter.Writer) {`
167	`easyjson2c6259e0Encode1(w, v)`
168	`}`

func Request.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/request_easyjson.go:

261	`func (v Request) UnmarshalEasyJSON(l jlexer.Lexer) {`
262	`easyjson3c9d2b01DecodeGithubComUserHello1(l, v)`
263	`}`

func @137:32

Back

In /builddir/build/BUILD/imunify360-pam-6.4.11/src/agent/license.go:

137	`func() {}`

agent

75.10%

65	`func easyjsonD587a15Encode1(out *jwriter.Writer, in StatRecord) {`
66	`out.RawByte('{')`
67	`first := true`
68	`_ = first`
69	`{`
70	`const prefix string = ",\"name\":"`
71	`out.RawString(prefix[1:])`
72	`out.String(string(in.Name))`
73	`}`
74	`{`
75	`const prefix string = ",\"attackers_ip\":"`
76	`out.RawString(prefix)`
77	`out.String(string(in.AttackersIP))`
78	`}`
79	`{`
80	`const prefix string = ",\"rule\":"`
81	`out.RawString(prefix)`
82	`out.Int(int(in.Rule))`
83	`}`
84	`{`
85	`const prefix string = ",\"message\":"`
86	`out.RawString(prefix)`
87	`out.String(string(in.Message))`
88	`}`
89	`{`
90	`const prefix string = ",\"severity\":"`
91	`out.RawString(prefix)`
92	`out.Int(int(in.Severity))`
93	`}`
94	`{`
95	`const prefix string = ",\"retries\":"`
96	`out.RawString(prefix)`
97	`out.Int(int(in.Retries))`
98	`}`
99	`{`
100	`const prefix string = ",\"timestamp\":"`
101	`out.RawString(prefix)`
102	`out.Int64(int64(in.Timestamp))`
103	`}`
104	`{`
105	`const prefix string = ",\"plugin_id\":"`
106	`out.RawString(prefix)`
107	`out.String(string(in.PluginId))`
108	`}`
109	`out.RawByte('}')`
110	`}`

353	`func (p *Agent) ServeLogRBLStat() {`
354	`defer failureWatchdog.CapturePanic()`
355	`var (`
356	`statsSuccessOld, statsTimeoutOld, statsErrorsOld int64`
357	`stop bool`
358	`)`
359
360	`for !stop {`
361	`select {`
362	`case <-p.statsRBLCheckStop:`
363	`stop = true`
364	`case <-time.After(5 * time.Minute):`
365	`}`
366	`statsSuccess := atomic.LoadInt64(&p.statRBLCheck.Success) - statsSuccessOld`
367	`statsTimeout := atomic.LoadInt64(&p.statRBLCheck.Timeout) - statsTimeoutOld`
368	`statsErrors := atomic.LoadInt64(&p.statRBLCheck.Errors) - statsErrorsOld`
369
370	`if statsTimeout > 0 \|\| statsErrors > 0 {`
371	`log.WithFields(log.Fields{`
372	`"fingerprint": []string{"RBLCheckStatsHasErrors"},`
373	`"success": statsSuccess,`
374	`"timeout": statsTimeout,`
375	`"errors": statsErrors,`
376	`}).Warnf("RBL Check requests stats: success=%d timeout=%d errors=%d",`
377	`statsSuccess, statsTimeout, statsErrors)`
378	`}`
379
380	`statsSuccessOld += statsSuccess`
381	`statsTimeoutOld += statsTimeout`
382	`statsErrorsOld += statsErrors`
383	`}`
384	`}`

236	`func (r CPanelAuthMsg) Unmarshal(b []byte) CPanelAuthMsg {`
237	`lines := bytes.Split(b, []byte{'\n'})`
238	`for _, line := range lines {`
239	`i := bytes.IndexByte(line, ':')`
240	`if i == -1 {`
241	`continue`
242	`}`
243	`key := line[:i]`
244	`value := line[i+1:]`
245	`switch string(key) {`
246	`case "account":`
247	`r.Account = string(value)`
248	`case "password":`
249	`r.Password = string(value)`
250	`case "peer":`
251	`r.Peer = string(value)`
252	`case "auth_ok":`
253	`r.AuthOk = string(value)`
254	`}`
255	`}`
256	`return r`
257	`}`

191	`func (lw LicenseWatcher) validLicense(lic License) bool {`
192	`if lic.err != nil {`
193	`return false`
194	`}`
195
196	`isValid, errPubKey := validLicense(lic, lw.pubKeyPath)`
197	`if isValid {`
198	`return isValid`
199	`}`
200
201	`isAltValid, errAltPubKey := validLicense(lic, lw.altPubKeyPath)`
202	`if errAltPubKey == nil {`
203	`return isAltValid`
204	`}`
205
206	`lic.err = errors.Join(errPubKey, errAltPubKey)`
207	`return false`
208	`}`

223	`func validLicense(lic *License, pubKeyPath string) (bool, error) {`
224	`f, err := appFs.Open(pubKeyPath)`
225	`if err != nil {`
226	`return false, fmt.Errorf("fs.Open(%#v) failed: %v", pubKeyPath, err)`
227	`}`
228	`defer f.Close()`
229	`pubKey, err := LoadPublicKey(f)`
230	`if err != nil {`
231	`return false, fmt.Errorf("LoadPublicKey() failed: %s", err)`
232	`}`
233	`// NOTE: we do not check if license is expired, which may be wrong,`
234	`// but that is what agent does at the moment.`
235	`return lic.Signed(pubKey), nil`
236	`}`

66	`func (w *FailureWatchdog) RecordFailure(timestamp time.Time) {`
67	`if !w.Enabled {`
68	`return`
69	`}`
70
71	`var r FailureWatchdogRecord`
72	`if err := r.ReadFromFile(w.path); err != nil && !errors.Is(err, afero.ErrFileNotFound) {`
73	`log.WithError(err).Errorf("failed to read failure watchdog file: %v", err)`
74	`return`
75	`}`
76
77	`timestamps := []int64{}`
78	`for _, t := range r.Timestamps {`
79	`since := timestamp.Sub(time.Unix(0, t))`
80
81	`if since < w.Period {`
82	`timestamps = append(timestamps, t)`
83	`}`
84	`}`
85	`timestamps = append(timestamps, timestamp.UnixNano())`
86
87	`excess := len(timestamps) - w.Limit`
88	`if excess > 0 {`
89	`timestamps = timestamps[excess:]`
90
91	`defer func() {`
92	`if err := w.cb(); err != nil {`
93	`log.WithError(err).Errorf("failed to execute callback: %v", err)`
94	`}`
95	`}()`
96	`}`
97
98	`r.Timestamps = timestamps`
99	`r.DumpToFile(w.path)`
100	`}`

73	`func query(ctx context.Context, nameserver string, rbl string, host string, r *Result) {`
74	`r.Listed = false`
75
76	`resolver := net.Resolver{`
77	`PreferGo: true,`
78	`}`
79	`if nameserver != "" {`
80	`resolver.Dial = func(ctx context.Context, network, address string) (net.Conn, error) {`
81	`d := net.Dialer{}`
82	`return d.DialContext(ctx, "udp", nameserver)`
83	`}`
84	`}`
85
86	`lookup := fmt.Sprintf("%s.%s", host, rbl)`
87
88	`res, err := resolver.LookupHost(ctx, lookup)`
89	`if len(res) > 0 {`
90	`r.Listed = true`
91	`txt, _ := resolver.LookupTXT(ctx, lookup)`
92	`if len(txt) > 0 {`
93	`r.Text = txt[0]`
94	`}`
95	`}`
96	`if err != nil {`
97	`r.Error = true`
98	`r.ErrorType = err`
99	`}`
100
101	`return`
102	`}`

43	`func (lic License) Signed(pubKey rsa.PublicKey) bool {`
44	`lic.Sign = ""`
45	`signed := lic.signedContent()`
46	`for _, sigB64 := range lic.Signatures {`
47	`sig, err := base64.StdEncoding.DecodeString(sigB64)`
48	`if err != nil {`
49	`continue`
50	`}`
51	`hashed := sha512.Sum512(signed)`
52	`if err := rsa.VerifyPKCS1v15(pubKey, crypto.SHA512, hashed[:], []byte(sig)); err == nil {`
53	`lic.Sign = sigB64`
54	`return true`
55	`}`
56	`}`
57	`return false`
58	`}`

53	`func easyjson3c9d2b01EncodeGithubComUserHello(out *jwriter.Writer, in Response) {`
54	`out.RawByte('{')`
55	`first := true`
56	`_ = first`
57	`{`
58	`const prefix string = ",\"action\":"`
59	`out.RawString(prefix[1:])`
60	`out.String(string(in.Action))`
61	`}`
62	`{`
63	`const prefix string = ",\"message\":"`
64	`out.RawString(prefix)`
65	`out.String(string(in.Message))`
66	`}`
67	`out.RawByte('}')`
68	`}`

10	`func (z *Record) MarshalMsg(b []byte) (o []byte, err error) {`
11	`o = msgp.Require(b, z.Msgsize())`
12	`// map header, size 2`
13	`// string "e"`
14	`o = append(o, 0x82, 0xa1, 0x65)`
15	`o = msgp.AppendInt64(o, z.LockExpireAt)`
16	`// string "a"`
17	`o = append(o, 0xa1, 0x61)`
18	`o = msgp.AppendMapHeader(o, uint32(len(z.Attempts)))`
19	`for za0001, za0002 := range z.Attempts {`
20	`o = msgp.AppendString(o, za0001)`
21	`o = msgp.AppendInt64(o, za0002)`
22	`}`
23	`return`
24	`}`

53	`func NewWhiteList(fileNameList []string, ResetHandler func(), LoadLineHandler func(line string)) *WhiteList {`
54	`wl := &WhiteList{`
55	`file: make(map[string]time.Time, len(fileNameList)),`
56	`lastCheckTime: make(chan time.Time, 1),`
57	`ResetHandler: ResetHandler,`
58	`LoadLineHandler: LoadLineHandler,`
59	`}`
60
61	`for _, fileName := range fileNameList {`
62	`wl.file[fileName] = time.Time{}`
63	`}`
64	`wl.reload()`
65	`wl.lastCheckTime <- time.Now()`
66	`return wl`
67	`}`

81	`func (z *FailureWatchdogRecord) MarshalMsg(b []byte) (o []byte, err error) {`
82	`o = msgp.Require(b, z.Msgsize())`
83	`// map header, size 1`
84	`// string "timestamps"`
85	`o = append(o, 0x81, 0xaa, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73)`
86	`o = msgp.AppendArrayHeader(o, uint32(len(z.Timestamps)))`
87	`for za0001 := range z.Timestamps {`
88	`o = msgp.AppendInt64(o, z.Timestamps[za0001])`
89	`}`
90	`return`
91	`}`

83	`func (wl *WhiteList) reload() {`
84	`if wl.ResetHandler != nil {`
85	`wl.ResetHandler()`
86	`}`
87	`for fileName, _ := range wl.file {`
88	`fileModTime, err := readWhiteList(fileName, wl.LoadLineHandler)`
89	`if err == nil {`
90	`wl.file[fileName] = fileModTime`
91	`}`
92	`}`
93	`}`

93	`func (z *Record) Msgsize() (s int) {`
94	`s = 1 + 2 + msgp.Int64Size + 2 + msgp.MapHeaderSize`
95	`if z.Attempts != nil {`
96	`for za0001, za0002 := range z.Attempts {`
97	`_ = za0002`
98	`s += msgp.StringPrefixSize + len(za0001) + msgp.Int64Size`
99	`}`
100	`}`
101	`return`
102	`}`

35	`func NewFailureWatchdog(period time.Duration, limit int, enabled bool) FailureWatchdog {`
36	`failureWatchdog := FailureWatchdog{`
37	`DefaultFailureWatchdogPeriod,`
38	`DefaultFailureWatchdogLimit,`
39	`enabled,`
40	`failureWatchdogFilepath,`
41	`disableFtpIntegration,`
42	`}`
43	`if limit >= 0 {`
44	`failureWatchdog.Limit = limit`
45	`}`
46
47	`if period >= 0 {`
48	`failureWatchdog.Period = period`
49	`}`
50	`return failureWatchdog`
51	`}`

43	`func() {`
44	`timer.Stop()`
45	`close(ct.idleChan)`
46	`close(ct.Done)`
47	`}`

217	`func (lw *LicenseWatcher) Subscribe(f LicenseListener) {`
218	`lw.lock.Lock()`
219	`lw.subs = append(lw.subs, f)`
220	`lw.lock.Unlock()`
221	`}`

183	`func (lw LicenseWatcher) notify(lic License, valid bool) {`
184	`lw.lock.Lock()`
185	`for _, f := range lw.subs {`
186	`f(*lic, valid)`
187	`}`
188	`lw.lock.Unlock()`
189	`}`

140	`func() []string {`
141	`rbl := i.Section("").Key("rbl").Strings(",")`
142	`if len(rbl) > 0 {`
143	`return rbl`
144	`}`
145	`return []string{"net-brute.rbl.imunify.com"}`
146	`}`

420	`func (db Database) writeRecord(batch leveldb.Batch, key string, record Record) {`
421	`if record.LockExpireAt == 0 && len(record.Attempts) == 0 {`
422	`batch.Delete([]byte(key))`
423	`}`
424	`batch.Put([]byte(key), record.Marshal())`
425
426	`log.WithField("record", record).Tracef("---[db]->> %v", key)`
427	`}`

171	`func (v *License) UnmarshalJSON(data []byte) error {`
172	`r := jlexer.Lexer{Data: data}`
173	`easyjson2c6259e0Decode1(&r, v)`
174	`return r.Error()`
175	`}`

159	`func (v License) MarshalJSON() ([]byte, error) {`
160	`w := jwriter.Writer{}`
161	`easyjson2c6259e0Encode1(&w, v)`
162	`return w.Buffer.BuildBytes(), w.Error`
163	`}`

113	`func (v StatRecord) MarshalJSON() ([]byte, error) {`
114	`w := jwriter.Writer{}`
115	`easyjsonD587a15Encode1(&w, v)`
116	`return w.Buffer.BuildBytes(), w.Error`
117	`}`

125	`func (v *StatRecord) UnmarshalJSON(data []byte) error {`
126	`r := jlexer.Lexer{Data: data}`
127	`easyjsonD587a15Decode1(&r, v)`
128	`return r.Error()`
129	`}`

139	`func (lw *LicenseWatcher) readLicenseAndNotify() {`
140	`if lic := lw.rereadLicense(); lic != nil {`
141	`lw.notify(lic, lw.validLicense(lic))`
142	`}`
143	`readLicenseAndNotifyDone()`
144	`}`

254	`func (v *Request) UnmarshalJSON(data []byte) error {`
255	`r := jlexer.Lexer{Data: data}`
256	`easyjson3c9d2b01DecodeGithubComUserHello1(&r, v)`
257	`return r.Error()`
258	`}`

242	`func (v Request) MarshalJSON() ([]byte, error) {`
243	`w := jwriter.Writer{}`
244	`easyjson3c9d2b01EncodeGithubComUserHello1(&w, v)`
245	`return w.Buffer.BuildBytes(), w.Error`
246	`}`

246	`func (v SendMessagesApiRequest) MarshalJSON() ([]byte, error) {`
247	`w := jwriter.Writer{}`
248	`easyjsonD587a15Encode11(&w, v)`
249	`return w.Buffer.BuildBytes(), w.Error`
250	`}`

83	`func (v *Response) UnmarshalJSON(data []byte) error {`
84	`r := jlexer.Lexer{Data: data}`
85	`easyjson3c9d2b01DecodeGithubComUserHello(&r, v)`
86	`return r.Error()`
87	`}`

258	`func (v *SendMessagesApiRequest) UnmarshalJSON(data []byte) error {`
259	`r := jlexer.Lexer{Data: data}`
260	`easyjsonD587a15Decode11(&r, v)`
261	`return r.Error()`
262	`}`

71	`func (v Response) MarshalJSON() ([]byte, error) {`
72	`w := jwriter.Writer{}`
73	`easyjson3c9d2b01EncodeGithubComUserHello(&w, v)`
74	`return w.Buffer.BuildBytes(), w.Error`
75	`}`

31	`func (ct *ConnTracker) TrackActivity(isIdle bool) {`
32	`if ct.isClosed.Load() == false {`
33	`ct.idleChan <- isIdle`
34	`}`
35	`}`

111	`func (lw *LicenseWatcher) Start() {`
112	`lw.wg.Add(1)`
113	`go func() {`
114	`defer failureWatchdog.CapturePanic()`
115	`lw.watcher()`
116	`}()`
117	`}`

79	`func (l UserIPLockConfig) ForgeAutowhitelistLockConfig() LockConfig {`
80	`return LockConfig{`
81	`Timeout: l.AutowhitelistTimeout,`
82	`Attempts: 1,`
83	`Period: l.AutowhitelistTimeout,`
84	`}`
85	`}`

21	`func NewConnTracker(duration time.Duration) *ConnTracker {`
22	`return &ConnTracker{`
23	`Duration: duration,`
24	`Done: make(chan struct{}),`
25	`idleChan: make(chan bool, idleChanBufferSize),`
26	`stop: make(chan struct{}),`
27	`}`
28	`}`

232	`func loadLockConfigIP(s *ini.Section, defaultWhitelist string, defaultIncludeList string) LockConfig {`
233	`return LockConfig{`
234	`Timeout: rangeInt64(s.Key("IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,`
235	`Attempts: rangeInt(s.Key("IP_LOCK_ATTEMPTS"), 10, 0, 100),`
236	`Period: rangeInt64(s.Key("IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,`
237	`WhitelistFileName: s.Key("whitelisted_ips_path").MustString(defaultWhitelist) + "," + s.Key("whitelisted_ips_include").MustString(defaultIncludeList),`
238	`}`
239	`}`

223	`func loadLockConfigUser(s *ini.Section, defaultWhitelist string) LockConfig {`
224	`return LockConfig{`
225	`Timeout: rangeInt64(s.Key("USER_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,`
226	`Attempts: rangeInt(s.Key("USER_LOCK_ATTEMPTS"), 10, 0, 100),`
227	`Period: rangeInt64(s.Key("USER_LOCK_MINUTES"), 5, 0, 9999999) * 60,`
228	`WhitelistFileName: s.Key("whitelisted_users_path").MustString(defaultWhitelist),`
229	`}`
230	`}`