Coverage Report

Generated on 27 Oct 20 10:38 -0400 with gocov-html

Package Overview: agent 26.90%

This is a coverage report created after analysis of the agent package. It has been generated with the following command:

gocov test agent | gocov-html

Here are the stats. Please select a function name to view its implementation and see what's left for testing.

`UserIPWhiteList.In(...)`	`agent/whitelist.go`	`100.00%`	`13/13`
`License.Signed(...)`	`agent/license.go`	`100.00%`	`11/11`
`LicenseWatcher.validLicense(...)`	`agent/license.go`	`100.00%`	`10/10`
`UserWhiteList.In(...)`	`agent/whitelist.go`	`100.00%`	`9/9`
`Record.MarshalMsg(...)`	`agent/record_msgp.go`	`100.00%`	`9/9`
`NewWhiteList(...)`	`agent/whitelist.go`	`100.00%`	`6/6`
`WhiteList.reload(...)`	`agent/whitelist.go`	`100.00%`	`6/6`
`Record.Msgsize(...)`	`agent/record_msgp.go`	`100.00%`	`6/6`
`@118:8(...)`	`agent/config.go`	`100.00%`	`4/4`
`LicenseWatcher.notify(...)`	`agent/license.go`	`100.00%`	`4/4`
`License.UnmarshalJSON(...)`	`agent/license_proto_easyjson.go`	`100.00%`	`3/3`
`LicenseWatcher.readLicenseAndNotify(...)`	`agent/license.go`	`100.00%`	`3/3`
`LicenseWatcher.Subscribe(...)`	`agent/license.go`	`100.00%`	`3/3`
`Response.MarshalJSON(...)`	`agent/request_easyjson.go`	`100.00%`	`3/3`
`Record.Marshal(...)`	`agent/record.go`	`100.00%`	`2/2`
`ModuleStringResponse(...)`	`agent/module.go`	`100.00%`	`2/2`
`errlog.Errorf(...)`	`agent/errlog.go`	`100.00%`	`2/2`
`Record.Unmarshal(...)`	`agent/record.go`	`100.00%`	`2/2`
`errlog.Warnf(...)`	`agent/errlog.go`	`100.00%`	`2/2`
`loadLockConfigIP(...)`	`agent/config.go`	`100.00%`	`1/1`
`NewLicenseWatcher(...)`	`agent/license.go`	`100.00%`	`1/1`
`IPWhiteList.reset(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`LockConfig.IsEnabled(...)`	`agent/config.go`	`100.00%`	`1/1`
`UserIPWhiteList.reset(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`UserWhiteList.reset(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`UserWhiteList.loadLine(...)`	`agent/whitelist.go`	`100.00%`	`1/1`
`loadLockConfigUserIP(...)`	`agent/config.go`	`100.00%`	`1/1`
`loadLockConfigUser(...)`	`agent/config.go`	`100.00%`	`1/1`
`License.signedContent(...)`	`agent/license.go`	`100.00%`	`1/1`
`IPWhiteList.In(...)`	`agent/whitelist.go`	`90.91%`	`10/11`
`IPWhiteList.loadLine(...)`	`agent/whitelist.go`	`90.00%`	`9/10`
`LicenseWatcher.rereadLicense(...)`	`agent/license.go`	`88.89%`	`16/18`
`UserIPWhiteList.loadLine(...)`	`agent/whitelist.go`	`88.24%`	`15/17`
`easyjson3c9d2b01Encode1(...)`	`agent/request_easyjson.go`	`87.50%`	`14/16`
`readWhiteList(...)`	`agent/whitelist.go`	`85.71%`	`12/14`
`LoadPublicKey(...)`	`agent/license.go`	`84.62%`	`11/13`
`Database.writeAttempt(...)`	`agent/database.go`	`84.00%`	`21/25`
`LoadLicense(...)`	`agent/license.go`	`83.33%`	`5/6`
`Database.CheckLock(...)`	`agent/database.go`	`82.61%`	`19/23`
`NewIPWhiteList(...)`	`agent/whitelist.go`	`81.82%`	`9/11`
`NewUserIPWhiteList(...)`	`agent/whitelist.go`	`80.00%`	`4/5`
`NewUserWhiteList(...)`	`agent/whitelist.go`	`80.00%`	`4/5`
`Database.WriteAttempts(...)`	`agent/database.go`	`78.26%`	`18/23`
`Database.writeRecord(...)`	`agent/database.go`	`75.00%`	`3/4`
`DatabaseOpen(...)`	`agent/database.go`	`73.33%`	`11/15`
`Database.readRecord(...)`	`agent/database.go`	`73.33%`	`11/15`
`ConfigLoad(...)`	`agent/config.go`	`71.43%`	`5/7`
`easyjson2c6259e0Decode1(...)`	`agent/license_proto_easyjson.go`	`65.91%`	`29/44`
`Database.serveExpireOld(...)`	`agent/database.go`	`61.54%`	`8/13`
`rangeInt64(...)`	`agent/config.go`	`60.00%`	`3/5`
`rangeInt(...)`	`agent/config.go`	`60.00%`	`3/5`
`Record.UnmarshalMsg(...)`	`agent/record_msgp.go`	`59.57%`	`28/47`
`ReverseIP(...)`	`agent/rbl.go`	`46.67%`	`7/15`
`loadKeyFile(...)`	`agent/config.go`	`44.44%`	`4/9`
`WhiteList.Update(...)`	`agent/whitelist.go`	`41.67%`	`5/12`
`Database.expireOld(...)`	`agent/database.go`	`30.77%`	`12/39`
`sentrySend(...)`	`agent/errlog.go`	`22.22%`	`2/9`
`Process.ProcessCPanelFtpAuthRequest(...)`	`agent/cpanel.go`	`0.00%`	`0/58`
`Process.Start(...)`	`agent/main.go`	`0.00%`	`0/57`
`easyjson3c9d2b01Encode11(...)`	`agent/request_easyjson.go`	`0.00%`	`0/49`
`Process.ProcessModuleRequest(...)`	`agent/module.go`	`0.00%`	`0/47`
`easyjsonD587a15Decode12(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/44`
`easyjson2c6259e0Encode1(...)`	`agent/license_proto_easyjson.go`	`0.00%`	`0/41`
`easyjsonD587a15Encode12(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/41`
`easyjsonD587a15Decode11(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/40`
`easyjson3c9d2b01Decode11(...)`	`agent/request_easyjson.go`	`0.00%`	`0/40`
`easyjsonD587a15Encode11(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/31`
`easyjsonD587a15Encode1(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/28`
`easyjsonD587a15Decode1(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/28`
`Process.WriteStat(...)`	`agent/main.go`	`0.00%`	`0/28`
`Process.Stop(...)`	`agent/main.go`	`0.00%`	`0/26`
`easyjson3c9d2b01Decode1(...)`	`agent/request_easyjson.go`	`0.00%`	`0/22`
`Process.ProcessModuleConn(...)`	`agent/module.go`	`0.00%`	`0/17`
`NewSentryLogger(...)`	`agent/sentry_logger.go`	`0.00%`	`0/16`
`main(...)`	`agent/main.go`	`0.00%`	`0/16`
`getOwnIP(...)`	`agent/sentry_logger.go`	`0.00%`	`0/15`
`Database.RemoveSuccess(...)`	`agent/database.go`	`0.00%`	`0/15`
`query(...)`	`agent/rbl.go`	`0.00%`	`0/15`
`Process.ProcessCPanelFtpAuthConn(...)`	`agent/cpanel.go`	`0.00%`	`0/15`
`CPanelAuthMsg.Unmarshal(...)`	`agent/cpanel.go`	`0.00%`	`0/13`
`Request.CheckSign(...)`	`agent/request.go`	`0.00%`	`0/13`
`Process.ServeListener(...)`	`agent/main.go`	`0.00%`	`0/12`
`CheckRBL(...)`	`agent/rbl.go`	`0.00%`	`0/12`
`Process.ServeSendStat(...)`	`agent/main.go`	`0.00%`	`0/12`
`rblLookupIP(...)`	`agent/rbl.go`	`0.00%`	`0/11`
`getServerId(...)`	`agent/sentry_logger.go`	`0.00%`	`0/10`
`@63:25(...)`	`agent/api.go`	`0.00%`	`0/10`
`@191:14(...)`	`agent/rbl.go`	`0.00%`	`0/10`
`getOsRelease(...)`	`agent/sentry_logger.go`	`0.00%`	`0/10`
`@294:6(...)`	`agent/main.go`	`0.00%`	`0/9`
`CPanelFtpAuthRecv(...)`	`agent/cpanel.go`	`0.00%`	`0/9`
`LicenseWatcher.watcher(...)`	`agent/license.go`	`0.00%`	`0/8`
`WhiteList.isNeedUpdate(...)`	`agent/whitelist.go`	`0.00%`	`0/8`
`@120:24(...)`	`agent/sentry_logger.go`	`0.00%`	`0/8`
`Database.Close(...)`	`agent/database.go`	`0.00%`	`0/8`
`shouldLogError(...)`	`agent/main.go`	`0.00%`	`0/8`
`rbl.Check(...)`	`agent/rbl.go`	`0.00%`	`0/7`
`Process.Serve(...)`	`agent/main.go`	`0.00%`	`0/7`
`ToIP(...)`	`agent/main.go`	`0.00%`	`0/6`
`DatabaseDrop(...)`	`agent/database.go`	`0.00%`	`0/5`
`SendMessageAPI.send(...)`	`agent/api.go`	`0.00%`	`0/5`
`NewRBL(...)`	`agent/rbl.go`	`0.00%`	`0/5`
`SendMessageAPI.SendStats(...)`	`agent/api.go`	`0.00%`	`0/4`
`@138:18(...)`	`agent/main.go`	`0.00%`	`0/4`
`packageVersion(...)`	`agent/pkg_version.go`	`0.00%`	`0/4`
`collectOutput(...)`	`agent/pkg_version.go`	`0.00%`	`0/4`
`Request.MarshalJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/3`
`Request.UnmarshalJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/3`
`StatRecord.MarshalJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/3`
`Response.UnmarshalJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/3`
`License.MarshalJSON(...)`	`agent/license_proto_easyjson.go`	`0.00%`	`0/3`
`SendMessagesApiRequest.MarshalJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/3`
`SendMessagesApiRequest.UnmarshalJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/3`
`StatRecord.UnmarshalJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/3`
`@78:19(...)`	`agent/rbl.go`	`0.00%`	`0/2`
`errlog.Fatalf(...)`	`agent/errlog.go`	`0.00%`	`0/2`
`Database.WithUserWhitelist(...)`	`agent/database.go`	`0.00%`	`0/2`
`Database.WithUserIPWhitelist(...)`	`agent/database.go`	`0.00%`	`0/2`
`SentryLogger.Write(...)`	`agent/sentry_logger.go`	`0.00%`	`0/2`
`LicenseWatcher.Stop(...)`	`agent/license.go`	`0.00%`	`0/2`
`LicenseWatcher.Start(...)`	`agent/license.go`	`0.00%`	`0/2`
`NewSendMessageAPI(...)`	`agent/api.go`	`0.00%`	`0/1`
`Request.UnmarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`Request.MarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`getRPMVersion(...)`	`agent/pkg_version.go`	`0.00%`	`0/1`
`@44:17(...)`	`agent/api.go`	`0.00%`	`0/1`
`SentryLogger.Flush(...)`	`agent/sentry_logger.go`	`0.00%`	`0/1`
`Config.IsVerboseLoggingMode(...)`	`agent/config.go`	`0.00%`	`0/1`
`Config.IsSentryEnabled(...)`	`agent/config.go`	`0.00%`	`0/1`
`Response.UnmarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`Config.IsLogfileEnabled(...)`	`agent/config.go`	`0.00%`	`0/1`
`SendMessagesApiRequest.UnmarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/1`
`@105:5(...)`	`agent/license.go`	`0.00%`	`0/1`
`SendMessagesApiRequest.MarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/1`
`Response.MarshalEasyJSON(...)`	`agent/request_easyjson.go`	`0.00%`	`0/1`
`StatRecord.UnmarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/1`
`getDEBVersion(...)`	`agent/pkg_version.go`	`0.00%`	`0/1`
`StatRecord.MarshalEasyJSON(...)`	`agent/api_proto_easyjson.go`	`0.00%`	`0/1`
`errlog.Configure(...)`	`agent/errlog.go`	`0.00%`	`0/1`
`License.MarshalEasyJSON(...)`	`agent/license_proto_easyjson.go`	`0.00%`	`0/1`
`License.UnmarshalEasyJSON(...)`	`agent/license_proto_easyjson.go`	`0.00%`	`0/1`
`Process.RequestId(...)`	`agent/main.go`	`0.00%`	`0/1`
`loadLockConfig(...)`	`agent/config.go`	`0.00%`	`0/1`
`@128:32(...)`	`agent/license.go`	`0.00%`	`0/0`
`agent`		`26.90%`	`408/1517`

func UserIPWhiteList.In

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *UserIPWhiteList) In(user string, ip string) bool {
        if wl == nil {
                return false
        }

        wl.Update()

        ipNet := net.ParseIP(ip)

        var exist bool
        if wl.users != nil && ipNet != nil {
                wl.RLock()
                item, got := wl.users[user]
                if got {
                        contains, err := item.Contains(ipNet)
                        exist = (err == nil) && (contains == true)
                }
                wl.RUnlock()
        }

        return exist
}

func License.Signed

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lic *License) Signed(pubKey *rsa.PublicKey) bool {
        lic.Sign = ""
        signed := lic.signedContent()
        for _, sigB64 := range lic.Signatures {
                sig, err := base64.StdEncoding.DecodeString(sigB64)
                if err != nil {
                        continue
                }
                hashed := sha512.Sum512(signed)
                if err := rsa.VerifyPKCS1v15(pubKey, crypto.SHA512, hashed[:], []byte(sig)); err == nil {
                        lic.Sign = sigB64
                        return true
                }
        }
        return false
}

func LicenseWatcher.validLicense

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) validLicense(lic *License) bool {
        f, err := os.Open(lw.pubKeyPath)
        if err != nil {
                Errlog.Errorf("fs.Open(%#v) failed: %v", lw.pubKeyPath, err)
                return false
        }
        defer f.Close()
        pubKey, err := LoadPublicKey(f)
        if err != nil {
                Errlog.Errorf("LoadPublicKey() failed: %s", err)
                return false
        }
        // NOTE: we do not check if license is expired, which may be wrong,
        // but that is what agent does at the moment.
        return lic.Signed(pubKey)
}

func UserWhiteList.In

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *UserWhiteList) In(key string) bool {
        if wl == nil {
                return false
        }

        wl.Update()

        var exist bool
        wl.RLock()
        if wl.users != nil {
                _, exist = wl.users[key]
        }
        wl.RUnlock()
        return exist
}

func Record.MarshalMsg

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/record_msgp.go:

func (z *Record) MarshalMsg(b []byte) (o []byte, err error) {
        o = msgp.Require(b, z.Msgsize())
        // map header, size 2
        // string "e"
        o = append(o, 0x82, 0xa1, 0x65)
        o = msgp.AppendInt64(o, z.LockExpireAt)
        // string "a"
        o = append(o, 0xa1, 0x61)
        o = msgp.AppendMapHeader(o, uint32(len(z.Attempts)))
        for za0001, za0002 := range z.Attempts {
                o = msgp.AppendString(o, za0001)
                o = msgp.AppendInt64(o, za0002)
        }
        return
}

func NewWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func NewWhiteList(fileNameList []string, ResetHandler func(), LoadLineHandler func(line string)) *WhiteList {
        wl := &WhiteList{
                file:            make(map[string]time.Time, len(fileNameList)),
                lastCheckTime:   make(chan time.Time, 1),
                ResetHandler:    ResetHandler,
                LoadLineHandler: LoadLineHandler,
        }

        for _, fileName := range fileNameList {
                wl.file[fileName] = time.Time{}
        }
        wl.reload()
        wl.lastCheckTime <- time.Now()
        return wl
}

func WhiteList.reload

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *WhiteList) reload() {
        if wl.ResetHandler != nil {
                wl.ResetHandler()
        }
        for fileName, _ := range wl.file {
                fileModTime, err := readWhiteList(fileName, wl.LoadLineHandler)
                if err == nil {
                        wl.file[fileName] = fileModTime
                }
        }
}

func Record.Msgsize

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/record_msgp.go:

func (z *Record) Msgsize() (s int) {
        s = 1 + 2 + msgp.Int64Size + 2 + msgp.MapHeaderSize
        if z.Attempts != nil {
                for za0001, za0002 := range z.Attempts {
                        _ = za0002
                        s += msgp.StringPrefixSize + len(za0001) + msgp.Int64Size
                }
        }
        return
}

func @118:8

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func() []string {
                        rbl := i.Section("").Key("rbl").Strings(",")
                        if len(rbl) > 0 {
                                return rbl
                        }
                        return []string{"net-brute.rbl.imunify.com"}
                }

func LicenseWatcher.notify

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) notify(lic *License, valid bool) {
        lw.lock.Lock()
        for _, f := range lw.subs {
                f(*lic, valid)
        }
        lw.lock.Unlock()
}

func License.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license_proto_easyjson.go:

func (v *License) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjson2c6259e0Decode1(&r, v)
        return r.Error()
}

func LicenseWatcher.readLicenseAndNotify

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) readLicenseAndNotify() {
        if lic := lw.rereadLicense(); lic != nil {
                lw.notify(lic, lw.validLicense(lic))
        }
        readLicenseAndNotifyDone()
}

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) Subscribe(f LicenseListener) {
        lw.lock.Lock()
        lw.subs = append(lw.subs, f)
        lw.lock.Unlock()
}

func Response.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func (v Response) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjson3c9d2b01Encode1(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func Record.Marshal

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/record.go:

10	`func (r Record) Marshal() []byte {`
11	`b, _ := r.MarshalMsg(nil)`
12	`return b`
13	`}`

func ModuleStringResponse

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/module.go:

45	`func ModuleStringResponse(action, message string) []byte {`
46	`b, _ := Response{Action: action, Message: message}.MarshalJSON()`
47	`return b`
48	`}`

func errlog.Errorf

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/errlog.go:

25	`func (*errlog) Errorf(format string, args ...interface{}) {`
26	`log.Errorf(format, args...)`
27	`sentrySend(format, args...)`
28	`}`

func Record.Unmarshal

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/record.go:

15	`func (r *Record) Unmarshal(data []byte) error {`
16	`_, err := r.UnmarshalMsg(data)`
17	`return err`
18	`}`

func errlog.Warnf

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/errlog.go:

20	`func (*errlog) Warnf(format string, args ...interface{}) {`
21	`log.Warnf(format, args...)`
22	`sentrySend(format, args...)`
23	`}`

func loadLockConfigIP

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func loadLockConfigIP(s *ini.Section, defaultWhitelist string, defaultIncludeList string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,
                Attempts:          rangeInt(s.Key("IP_LOCK_ATTEMPTS"), 10, 0, 100),
                Period:            rangeInt64(s.Key("IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,
                WhitelistFileName: s.Key("whitelisted_ips_path").MustString(defaultWhitelist),
                WhitelistInclude:  s.Key("whitelisted_ips_include").MustString(defaultIncludeList),
        }
}

func NewLicenseWatcher

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func NewLicenseWatcher(licPath, pubKeyPath string, interval time.Duration) *LicenseWatcher {
        return &LicenseWatcher{
                done:       make(chan struct{}),
                interval:   interval,
                licPath:    licPath,
                pubKeyPath: pubKeyPath,
                subs:       make([]LicenseListener, 0, 1),
        }
}

func IPWhiteList.reset

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

190	`func (wl *IPWhiteList) reset() {`
191	`wl.ipRanger = cidranger.NewPCTrieRanger()`
192	`}`

func LockConfig.IsEnabled

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

63	`func (l LockConfig) IsEnabled() bool {`
64	`return l.Timeout > 0 && l.Attempts > 0 && l.Period > 0`
65	`}`

func UserIPWhiteList.reset

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

247	`func (wl *UserIPWhiteList) reset() {`
248	`wl.users = make(map[string]cidranger.Ranger)`
249	`}`

func UserWhiteList.reset

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *UserWhiteList) reset() {
        // root user is the must have default
        wl.users = map[string]struct{}{
                "root": struct{}{},
        }
}

func UserWhiteList.loadLine

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

141	`func (wl *UserWhiteList) loadLine(line string) {`
142	`wl.users[line] = struct{}{}`
143	`}`

func loadLockConfigUserIP

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func loadLockConfigUserIP(s *ini.Section, defaultWhitelist string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("USER_IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,
                Attempts:          rangeInt(s.Key("USER_IP_LOCK_ATTEMPTS"), 10, 0, 100),
                Period:            rangeInt64(s.Key("USER_IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,
                WhitelistFileName: s.Key("whitelisted_user_ip_path").MustString(defaultWhitelist),
        }
}

func loadLockConfigUser

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func loadLockConfigUser(s *ini.Section, defaultWhitelist string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("USER_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,
                Attempts:          rangeInt(s.Key("USER_LOCK_ATTEMPTS"), 10, 0, 100),
                Period:            rangeInt64(s.Key("USER_LOCK_MINUTES"), 5, 0, 9999999) * 60,
                WhitelistFileName: s.Key("whitelisted_users_path").MustString(defaultWhitelist),
        }
}

func License.signedContent

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

58	`func (lic License) signedContent() []byte {`
59	`return []byte(fmt.Sprintf("%s%s%s%d%d%d", lic.ID, lic.Status, lic.Group, lic.Limit, lic.TokenCreatedUTC, lic.TokenExpireUTC))`
60	`}`

func IPWhiteList.In

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *IPWhiteList) In(ipString string) bool {
        if wl == nil {
                return false
        }

        wl.Update()

        ip := net.ParseIP(ipString)

        var exist bool
        if wl.ipRanger != nil && ip != nil {
                wl.RLock()
                contains, err := wl.ipRanger.Contains(ip)
                exist = (err == nil) && (contains == true)
                wl.RUnlock()
        }

        return exist
}

func IPWhiteList.loadLine

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *IPWhiteList) loadLine(item string) {
        if strings.Contains(item, "/") == true {
                _, ipNet, err := net.ParseCIDR(item)
                if err == nil {
                        wl.ipRanger.Insert(cidranger.NewBasicRangerEntry(*ipNet))
                }
        } else {
                ip := net.ParseIP(item)
                if ip != nil {
                        mask := net.CIDRMask(32, 32)
                        if ip.To4() == nil {
                                mask = net.CIDRMask(128, 128)
                        }
                        wl.ipRanger.Insert(cidranger.NewBasicRangerEntry(net.IPNet{IP: ip, Mask: mask}))
                }
        }
}

func LicenseWatcher.rereadLicense

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) rereadLicense() *License {
        fi, err := os.Stat(lw.licPath)
        if err != nil {
                Errlog.Errorf("fs.Stat(%#v) failed: %s", lw.licPath, err)
                return nil
        }
        mt := fi.ModTime()
        if !mt.After(lw.lastModified) {
                return nil
        }
        f, err := os.Open(lw.licPath)
        if err != nil {
                Errlog.Errorf("fs.Open(%#v) failed: %s", lw.licPath, err)
                return nil
        }
        defer f.Close()
        lic, err := LoadLicense(f)
        if err != nil {
                Errlog.Errorf("LoadLicense() failed: %s", err)
                return nil
        }
        lw.lastModified = mt
        return &lic
}

func UserIPWhiteList.loadLine

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *UserIPWhiteList) loadLine(item string) {
        fields := strings.Fields(item)
        if len(fields) < 2 {
                return
        }

        user := fields[0]
        if _, ok := wl.users[user]; !ok {
                wl.users[user] = cidranger.NewPCTrieRanger()
        }

        for _, item := range fields[1:] {
                if strings.Contains(item, "/") == true {
                        _, ipNet, err := net.ParseCIDR(item)
                        if err == nil {
                                wl.users[user].Insert(cidranger.NewBasicRangerEntry(*ipNet))
                        }
                } else {
                        ip := net.ParseIP(item)
                        if ip != nil {
                                mask := net.CIDRMask(32, 32)
                                if ip.To4() == nil {
                                        mask = net.CIDRMask(128, 128)
                                }
                                wl.users[user].Insert(cidranger.NewBasicRangerEntry(net.IPNet{IP: ip, Mask: mask}))
                        }
                }
        }
}

func easyjson3c9d2b01Encode1

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func easyjson3c9d2b01Encode1(out *jwriter.Writer, in Response) {
        out.RawByte('{')
        first := true
        _ = first
        if in.Action != "" {
                const prefix string = ",\"action\":"
                first = false
                out.RawString(prefix[1:])
                out.String(string(in.Action))
        }
        if in.Message != "" {
                const prefix string = ",\"message\":"
                if first {
                        first = false
                        out.RawString(prefix[1:])
                } else {
                        out.RawString(prefix)
                }
                out.String(string(in.Message))
        }
        out.RawByte('}')
}

func readWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func readWhiteList(fileName string, lineHandler func(line string)) (fileModTime time.Time, err error) {
        var (
                file *os.File
                info os.FileInfo
        )

        file, err = os.Open(fileName)
        if err != nil {
                return
        }

        info, err = file.Stat()
        if err != nil {
                return
        }

        fileModTime = info.ModTime()

        sc := bufio.NewScanner(file)
        for sc.Scan() {
                if line := strings.TrimSpace(sc.Text()); line != "" {
                        lineHandler(line)
                }
        }

        err = sc.Err()
        return
}

func LoadPublicKey

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func LoadPublicKey(r io.Reader) (*rsa.PublicKey, error) {
        p, err := ioutil.ReadAll(r)
        if err != nil {
                return nil, err
        }
        block, _ := pem.Decode(p)
        if block == nil {
                return nil, fmt.Errorf("failed to load PEM data")
        }
        key, err := x509.ParsePKIXPublicKey(block.Bytes)
        if err != nil {
                return nil, err
        }
        pubKey, ok := key.(*rsa.PublicKey)
        if !ok {
                return nil, fmt.Errorf("public key is not RSA: %v", key)
        }
        return pubKey, nil
}

func Database.writeAttempt

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) writeAttempt(batch *leveldb.Batch, key, hash string, cfg *LockConfig) error {
        var changed bool

        if !cfg.IsEnabled() {
                return nil
        }

        record, err := db.readRecord(key)
        if err != nil {
                return err
        }

        ts := time.Now().Unix()

        // Remove expired attempts first
        for hash, expiredAt := range record.Attempts {
                if expiredAt < ts {
                        delete(record.Attempts, hash)
                        changed = true
                }
        }

        // Write current attempt if not exist
        if _, ok := record.Attempts[hash]; !ok {
                if record.Attempts == nil {
                        record.Attempts = make(map[string]int64, 1)
                }

                record.Attempts[hash] = ts + cfg.Period
                changed = true
        }

        // Remove lock if expired
        if record.LockExpireAt != 0 && record.LockExpireAt < ts {
                record.LockExpireAt = 0
                changed = true
        }

        // Lock if no lock and attempts too much
        if record.LockExpireAt == 0 && len(record.Attempts) >= cfg.Attempts {
                record.LockExpireAt = ts + cfg.Timeout
                changed = true
        }

        // Write changes if needed
        if changed {
                db.writeRecord(batch, key, &record)
        }

        return nil
}

func LoadLicense

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func LoadLicense(r io.Reader) (License, error) {
        var lic License
        b, err := ioutil.ReadAll(r)
        if err != nil {
                return lic, err
        }
        err = json.Unmarshal(b, &lic)
        return lic, err
}

func Database.CheckLock

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) CheckLock(ip string, user string) (LockStatus, error) {
        if atomic.LoadInt64(&db.closed) != 0 {
                return NoLock, ErrClosed
        }

        ts := time.Now().Unix()

        var (
                record     Record
                err        error
                lockStatus LockStatus
        )

        if db.cfg.UserLock.IsEnabled() && !db.usersWhitelist.In(user) {
                record, err = db.readRecord(user)
                if err != nil {
                        return NoLock, fmt.Errorf("read user record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        lockStatus |= UserLock
                }
        }

        if db.cfg.IPLock.IsEnabled() && ip != "" {
                record, err = db.readRecord(ip)
                if err != nil {
                        return NoLock, fmt.Errorf("read ip record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        lockStatus |= IPLock
                }
        }

        if db.cfg.UserIPLock.IsEnabled() && ip != "" && !db.userIPWhitelist.In(user, ip) {
                record, err = db.readRecord(ip + "/" + user)
                if err != nil {
                        return NoLock, fmt.Errorf("read user/ip record: %v", err)
                }
                if record.LockExpireAt >= ts {
                        lockStatus |= UserIPLock
                }
        }

        return lockStatus, nil
}

func NewIPWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func NewIPWhiteList(file string) (*IPWhiteList, error) {
        if file == "" {
                return nil, nil
        }

        var (
                err       error
                fileNames []string
        )

        // Split file paths by ','
        r := csv.NewReader(strings.NewReader(file))
        r.Comma = ','
        fileNames, err = r.Read()
        if err != nil {
                return nil, err
        }

        wl := &IPWhiteList{}
        wl.WhiteList = NewWhiteList(fileNames, wl.reset, wl.loadLine)
        return wl, err
}

func NewUserIPWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func NewUserIPWhiteList(file string) *UserIPWhiteList {
        if file == "" {
                return nil
        }
        wl := &UserIPWhiteList{}
        wl.WhiteList = NewWhiteList([]string{file}, wl.reset, wl.loadLine)
        return wl
}

func NewUserWhiteList

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func NewUserWhiteList(file string) *UserWhiteList {
        if file == "" {
                return nil
        }

        wl := &UserWhiteList{}
        wl.WhiteList = NewWhiteList([]string{file}, wl.reset, wl.loadLine)
        return wl
}

func Database.WriteAttempts

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) WriteAttempts(ip string, user string, hash string) error {
        batch := new(leveldb.Batch)

        if atomic.LoadInt64(&db.closed) != 0 {
                return ErrClosed
        }

        db.lock.Lock()
        defer db.lock.Unlock()

        if user != "" {
                err := db.writeAttempt(batch, user, hash, &db.cfg.UserLock)
                if err != nil {
                        return fmt.Errorf("USER_LOCK: %v", err)
                }
        }

        if ip != "" && ip != "127.0.0.1" {
                err := db.writeAttempt(batch, ip, hash, &db.cfg.IPLock)
                if err != nil {
                        return fmt.Errorf("IP_LOCK: %v", err)
                }
        }

        if user != "" && ip != "" {
                err := db.writeAttempt(batch, ip+"/"+user, hash, &db.cfg.UserIPLock)
                if err != nil {
                        return fmt.Errorf("USER_IP_LOCK: %v", err)
                }
        }

        if batch.Len() == 0 {
                return nil
        }

        err := db.db.Write(batch, nil)
        if err != nil {
                return fmt.Errorf("batch write: %v", err)
        }

        return nil
}

func Database.writeRecord

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db Database) writeRecord(batch *leveldb.Batch, key string, record *Record) {
        if record.LockExpireAt == 0 && len(record.Attempts) == 0 {
                batch.Delete([]byte(key))
        }
        batch.Put([]byte(key), record.Marshal())

        log.WithField("record", record).Tracef("---[db]->> %v", key)
}

func DatabaseOpen

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func DatabaseOpen(cfg *Config) (db *Database, err error) {
        var database *leveldb.DB

        path := filepath.Join(cfg.Database, "/leveldb")
        database, err = leveldb.OpenFile(path, nil)
        if err != nil {
                return
        }

        db = &Database{
                cfg:           cfg,
                path:          path,
                db:            database,
                stopExpireOld: make(chan bool, 1),
        }

        var nextExpire int64
        nextExpire, err = db.expireOld()
        if err == nil {
                db.waitExpireOld.Add(1)
                go db.serveExpireOld(nextExpire)
                return
        }

        err = fmt.Errorf("expire old: %v", err)
        _ = db.db.Close()
        return nil, err
}

func Database.readRecord

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db Database) readRecord(key string) (record Record, err error) {
        var data []byte
        data, err = db.db.Get([]byte(key), nil)
        if err == leveldb.ErrNotFound {
                err = nil
                log.WithField("record", "nil").Tracef("<--[db]--- %v", key)
                return
        }
        if err != nil {
                err = fmt.Errorf("get record: %v", err)
                return
        }

        err = record.Unmarshal(data)
        if err != nil {
                err = fmt.Errorf("unmarshal: %v", err)
                return
        }

        log.WithField("record", record).Tracef("<--[db]--- %v", key)
        return
}

func ConfigLoad

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func ConfigLoad(path string) (cfg *Config, err error) {
        var i *ini.File

        i, err = ini.Load(path)
        if err != nil {
                err = fmt.Errorf("fail to read config: %v", err)
                return
        }

        cfg = &Config{
                LogFilename: i.Section("").
                        Key("log").
                        MustString(""),

                Sentry: i.Section("").
                        Key("sentry").
                        MustString("https://sentry.cloudlinux.com/sentry/i360-pam-imunify/"),

                Database: i.Section("").
                        Key("mod_db_path").
                        MustString("/opt/i360_pam_imunify/db"),

                Socket: i.Section("").
                        Key("socket").
                        MustString("/opt/i360_pam_imunify/pam_imunify360.sock"),

                ResolvConf: i.Section("").
                        Key("RBL_nameserver").
                        MustString("ns1-rbl.imunify.com:53"),

                SharedKey: loadKeyFile(i.Section("").
                        Key("shared_key_file").
                        MustString("/opt/i360_pam_imunify/key"), "7raXUdtFcBSr2Bes"),

                PublicKeyPath: i.Section("").
                        Key("public_key_path").
                        MustString("/opt/alt/python35/share/imunify360/cln-pub.key"),

                LicensePath: i.Section("").
                        Key("license_path").
                        MustString("/var/imunify360/license.json"),

                SendStats: i.Section("").
                        Key("send_stats").MustBool(true),

                SendStatsSuccessfulAggTime: i.Section("").
                        Key("send_stats_success_agg_time").MustInt64(30 * 60),

                SendStatsUnsuccessfulAggTime: i.Section("").
                        Key("send_stats_unsuccess_agg_time").MustInt64(60),

                RBL: func() []string {
                        rbl := i.Section("").Key("rbl").Strings(",")
                        if len(rbl) > 0 {
                                return rbl
                        }
                        return []string{"net-brute.rbl.imunify.com"}
                }(),
                RBLTimeout: i.Section("").
                        Key("RBL_timeout").MustInt64(5),
                RBLCacheTTL: i.Section("").
                        Key("RBL_cache_ttl").MustInt64(600),
                RBLCacheSize: i.Section("").
                        Key("RBL_cache_size").MustInt(65535),
                UserLock: loadLockConfigUser(i.Section(""), "/var/i360_pam_imunify/users/users.txt"),
                IPLock: loadLockConfigIP(i.Section(""),
                        "/var/i360_pam_imunify/wl/ips.txt",
                        "/etc/apache2/conf.d/modsec_vendor_configs/imunify360_full_apache/rbl_whitelist,"+
                                "/etc/httpd/conf/modsecurity.d/rules/custom/rbl_whitelist"),
                UserIPLock: loadLockConfigUserIP(i.Section(""), ""),

                CPanelFtpAuthInSocket: i.Section("").
                        Key("cpanel_ftp_auth_in_socket").
                        MustString("/var/run/ftpd.imunify360.sock"),
                CPanelFtpAuthOutSocket: i.Section("").
                        Key("cpanel_ftp_auth_out_socket").
                        MustString("/var/run/ftpd.sock"),
                CPanelFtpAuthOutTimeout: i.Section("").
                        Key("cpanel_ftp_auth_out_timeout").MustInt64(15),
        }

        return
}

func easyjson2c6259e0Decode1

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license_proto_easyjson.go:

func easyjson2c6259e0Decode1(in *jlexer.Lexer, out *License) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "group":
                        out.Group = string(in.String())
                case "id":
                        out.ID = string(in.String())
                case "limit":
                        out.Limit = int(in.Int())
                case "message":
                        out.Message = string(in.String())
                case "sign":
                        out.Sign = string(in.String())
                case "signatures":
                        if in.IsNull() {
                                in.Skip()
                                out.Signatures = nil
                        } else {
                                in.Delim('[')
                                if out.Signatures == nil {
                                        if !in.IsDelim(']') {
                                                out.Signatures = make([]string, 0, 4)
                                        } else {
                                                out.Signatures = []string{}
                                        }
                                } else {
                                        out.Signatures = (out.Signatures)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v1 string
                                        v1 = string(in.String())
                                        out.Signatures = append(out.Signatures, v1)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                case "status":
                        out.Status = string(in.String())
                case "token_created_utc":
                        out.TokenCreatedUTC = int(in.Int())
                case "token_expire_utc":
                        out.TokenExpireUTC = int(in.Int())
                case "upgrade_url":
                        out.UpgradeURL = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Database.serveExpireOld

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) serveExpireOld(nextExpire int64) {
        defer db.waitExpireOld.Done()
        var err error
        for {
                ts := time.Now().Unix()

                if nextExpire < ts+60 {
                        nextExpire = 60
                } else {
                        nextExpire -= ts
                }

                timer := time.NewTimer(time.Duration(nextExpire) * time.Second)

                select {
                case <-db.stopExpireOld:
                        return
                case <-timer.C:
                        nextExpire, err = db.expireOld()
                        if err != nil {
                                return
                        }
                }
        }
}

func rangeInt64

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func rangeInt64(k *ini.Key, defaultVal, min, max int64) int64 {
        val := k.MustInt64(defaultVal)
        if val < min || val > max {
                Errlog.Errorf("Value in config file is out of range %d", val)
                return defaultVal
        }
        return val
}

func rangeInt

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func rangeInt(k *ini.Key, defaultVal, min, max int) int {
        val := k.MustInt(defaultVal)
        if val < min || val > max {
                Errlog.Errorf("Value in config file is out of range %d", val)
                return defaultVal
        }
        return val
}

func Record.UnmarshalMsg

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/record_msgp.go:

func (z *Record) UnmarshalMsg(bts []byte) (o []byte, err error) {
        var field []byte
        _ = field
        var zb0001 uint32
        zb0001, bts, err = msgp.ReadMapHeaderBytes(bts)
        if err != nil {
                err = msgp.WrapError(err)
                return
        }
        for zb0001 > 0 {
                zb0001--
                field, bts, err = msgp.ReadMapKeyZC(bts)
                if err != nil {
                        err = msgp.WrapError(err)
                        return
                }
                switch msgp.UnsafeString(field) {
                case "e":
                        z.LockExpireAt, bts, err = msgp.ReadInt64Bytes(bts)
                        if err != nil {
                                err = msgp.WrapError(err, "LockExpireAt")
                                return
                        }
                case "a":
                        var zb0002 uint32
                        zb0002, bts, err = msgp.ReadMapHeaderBytes(bts)
                        if err != nil {
                                err = msgp.WrapError(err, "Attempts")
                                return
                        }
                        if z.Attempts == nil {
                                z.Attempts = make(map[string]int64, zb0002)
                        } else if len(z.Attempts) > 0 {
                                for key := range z.Attempts {
                                        delete(z.Attempts, key)
                                }
                        }
                        for zb0002 > 0 {
                                var za0001 string
                                var za0002 int64
                                zb0002--
                                za0001, bts, err = msgp.ReadStringBytes(bts)
                                if err != nil {
                                        err = msgp.WrapError(err, "Attempts")
                                        return
                                }
                                za0002, bts, err = msgp.ReadInt64Bytes(bts)
                                if err != nil {
                                        err = msgp.WrapError(err, "Attempts", za0001)
                                        return
                                }
                                z.Attempts[za0001] = za0002
                        }
                default:
                        bts, err = msgp.Skip(bts)
                        if err != nil {
                                err = msgp.WrapError(err)
                                return
                        }
                }
        }
        o = bts
        return
}

func ReverseIP

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func ReverseIP(ip net.IP) string {
        if ip.To4() != nil {
                splitAddress := strings.Split(ip.String(), ".")

                for i, j := 0, len(splitAddress)-1; i < len(splitAddress)/2; i, j = i+1, j-1 {
                        splitAddress[i], splitAddress[j] = splitAddress[j], splitAddress[i]
                }

                return strings.Join(splitAddress, ".")
        } else if ip.To16() != nil {
                ipv6 := ip.To16()
                hexDigit := "0123456789abcdef"

                s := make([]string, len(ipv6)*2)
                for i := 0; i < net.IPv6len; i += 1 {
                        s[i*2], s[i*2+1] = string(hexDigit[ipv6[i]>>4]), string(hexDigit[ipv6[i]&0xf])
                }
                for i, j := 0, len(s)-1; i < j; i, j = i+1, j-1 {
                        s[i], s[j] = s[j], s[i]
                }
                return strings.Join(s, ".")
        }
        return ""
}

func loadKeyFile

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func loadKeyFile(filename, defaultKey string) string {
        b, err := ioutil.ReadFile(filename)
        if err != nil {
                Errlog.Warnf("Key file %s read error (default value used): %v", filename, err)
                return defaultKey
        }

        b = bytes.TrimSpace(b)
        if len(b) == 0 {
                Errlog.Warnf("Key file %s read error (default value used): empty", filename)
                return defaultKey
        }

        return string(b)
}

func WhiteList.Update

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *WhiteList) Update() {
        select {
        case lastCheckTime := <-wl.lastCheckTime:
                timeNow := time.Now()
                if timeNow.Before(lastCheckTime.Add(1 * time.Second)) {
                        wl.lastCheckTime <- lastCheckTime
                        return
                }

                if !wl.isNeedUpdate() {
                        wl.lastCheckTime <- timeNow
                        return
                }

                wl.Lock()
                wl.reload()
                wl.Unlock()

                wl.lastCheckTime <- timeNow
        default:
        }
}

func Database.expireOld

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) expireOld() (nextExpiration int64, err error) {
        if atomic.LoadInt64(&db.closed) != 0 {
                return 0, ErrClosed
        }

        ts := time.Now().Unix()

        batch := new(leveldb.Batch)

        db.lock.Lock()
        defer db.lock.Unlock()

        iter := db.db.NewIterator(nil, nil)
        for iter.Next() {
                var (
                        changed bool
                        record  Record
                )

                key := iter.Key()
                value := iter.Value()

                err := record.Unmarshal(value)
                if err != nil {
                        // Cleanup bad records
                        batch.Delete(key)
                        log.Tracef("---[db]->> del %v", key)
                }

                // Remove expired attempts
                for hash, expiredAt := range record.Attempts {
                        if expiredAt < ts {
                                delete(record.Attempts, hash)
                                changed = true
                                continue
                        }
                        if nextExpiration > expiredAt {
                                nextExpiration = expiredAt
                        }
                }

                // Remove lock if expired
                if record.LockExpireAt != 0 && record.LockExpireAt < ts {
                        record.LockExpireAt = 0
                        changed = true
                }

                if record.LockExpireAt != 0 && record.LockExpireAt < nextExpiration {
                        nextExpiration = record.LockExpireAt
                }

                if changed {
                        db.writeRecord(batch, string(key), &record)
                }
        }
        iter.Release()

        err = iter.Error()
        if err != nil {
                return 0, fmt.Errorf("iterator: %v", err)
        }

        if batch.Len() == 0 {
                return
        }

        err = db.db.Write(batch, nil)
        if err != nil {
                err = fmt.Errorf("batch write: %v", err)
        }

        return
}

func sentrySend

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/errlog.go:

func sentrySend(format string, args ...interface{}) {
        if !Errlog.isSentryEnabled {
                return
        }

        scope := sentry.CurrentHub().PushScope()
        defer sentry.CurrentHub().PopScope()
        scope.SetFingerprint([]string{format})
        scope.SetExtra("format", format)
        for i, arg := range args {
                // Here we use 'a', 'b', ... mnemonics for func fmt.Sprintf argument list
                scope.SetTag(string('a' + byte(i)), fmt.Sprintf("%v", arg))
        }
        sentry.CaptureMessage(fmt.Sprintf(format, args...))
}

func Process.ProcessCPanelFtpAuthRequest

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/cpanel.go:

func (p *Process) ProcessCPanelFtpAuthRequest(data []byte) []byte {
        var request CPanelAuthMsg
        request.Unmarshal(data)
        if request.Account == "" || request.Password == "" {
                Errlog.Errorf("parse request: No user credentials")
                return nil
        }
        request.Peer = ToIP(request.Peer)

        if request.Peer == "" || p.wlIP.In(request.Peer) == false {
                result, err := p.db.CheckLock(request.Peer, request.Account)
                if err != nil {
                        Errlog.Errorf("check lock: %v", err)
                }

                if result&UserLock != NoLock {
                        p.syslog.Err(fmt.Sprintf(
                                "pam_imunify(cpanel_ftp_auth:auth): [IM360_UL] The account %s has been temporarily locked by Imunify PAM(%s)",
                                request.Account, request.Peer))
                        return ResponseCPanelAuthFtpdReject
                }
                if result&IPLock != NoLock {
                        p.syslog.Err(fmt.Sprintf(
                                "pam_imunify(cpanel_ftp_auth:auth): [IM360_IPL] The IP %s has been locked by Imunify PAM",
                                request.Peer))
                        return ResponseCPanelAuthFtpdReject
                }
                if result&UserIPLock != NoLock {
                        p.syslog.Err(fmt.Sprintf(
                                "pam_imunify(cpanel_ftp_auth:auth): [IM360_IPUL] The account %s has been locked for the attacker IP %s",
                                request.Account, request.Peer))
                        return ResponseCPanelAuthFtpdReject
                }

                if result&UserLock != NoLock || result&IPLock != NoLock || result&UserIPLock != NoLock {

                }

                if request.Peer != "" && p.cfg.RBLTimeout > 0 && p.rbl != nil {
                        value, err := p.rbl.Check(request.Peer)
                        if err != nil {
                                noSuchHost := strings.HasSuffix(err.Error(), "no such host")
                                if _, ok := err.(*net.DNSError); !ok || err.(*net.DNSError).IsTimeout || !noSuchHost {
                                        log.Errorf("RBL check: %v", err)
                                }
                        }
                        if value {
                                p.syslog.Err(fmt.Sprintf(
                                        "pam_imunify(cpanel_ftp_auth:auth): [IM360_RBL] The IP %s has been locked due to Imunify RBL",
                                        request.Peer))
                                return ResponseCPanelAuthFtpdReject
                        }
                }
        }

        cpanelConn, err := net.DialTimeout("unix", p.cfg.CPanelFtpAuthOutSocket, time.Duration(p.cfg.CPanelFtpAuthOutTimeout)*time.Second)
        if err != nil {
                Errlog.Errorf("CPanel auth ftpd connect: %v", err)
                return nil
        }
        defer cpanelConn.Close()

        _ = cpanelConn.SetDeadline(time.Now().Add(time.Duration(p.cfg.CPanelFtpAuthOutTimeout) * time.Second))

        _, err = cpanelConn.Write(data)
        if err != nil {
                Errlog.Errorf("CPanel auth ftpd write: %v", err)
                return nil
        }

        var responseData []byte
        responseData, err = CPanelFtpAuthRecv(cpanelConn)
        if err != nil {
                Errlog.Errorf("CPanel auth ftpd read: %v", err)
                return nil
        }

        var response CPanelAuthMsg
        response.Unmarshal(responseData)

        switch response.AuthOk {
        case "1":
                err := p.db.RemoveSuccess(request.Peer, request.Account)
                if err != nil {
                        Errlog.Errorf("write filed attempt: %v", err)
                }
                p.WriteStat(true, "cpanel_ftp_auth", request.Peer, request.Account, "e")
        case "-1", "0":
                hash := fmt.Sprintf("%x", xxh3.HashString(request.Account+request.Password))
                err := p.db.WriteAttempts(request.Peer, request.Account, hash)
                if err != nil {
                        Errlog.Errorf("write filed attempt: %v", err)
                }
                p.WriteStat(false, "cpanel_ftp_auth", request.Peer, request.Account, hash)
        default:
                Errlog.Errorf("CPanel auth ftpd: bad auth response \"%s\"", response.AuthOk)
        }

        return responseData
}

func Process.Start

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func (p *Process) Start(iniPath string) (err error) {
        p.cfg, err = ConfigLoad(iniPath)
        if err != nil {
                return fmt.Errorf("config load: %v", err)
        }

        if p.cfg.IsLogfileEnabled() {
                var logfile *os.File
                logfile, err = os.OpenFile(p.cfg.LogFilename, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0660)
                if err != nil {
                        return fmt.Errorf("log open: %v", err)
                }
                log.SetOutput(logfile)
        } else if p.cfg.IsSentryEnabled() {
                p.sentryLogger, err = NewSentryLogger(filepath.Base(os.Args[0]), PackageVersion)
                if err == nil {
                        Errlog.Configure(p.cfg.IsSentryEnabled())
                } else {
                        Errlog.Errorf("sentry reporting will be disabled: %v", err)
                }
        }

        if p.cfg.IsVerboseLoggingMode() {
                log.SetLevel(log.TraceLevel)
        } else {
                log.SetLevel(log.InfoLevel)
        }

        p.syslog, err = syslog.New(syslog.LOG_AUTHPRIV, "pam_imunify")

        p.db, err = DatabaseOpen(p.cfg)
        if err != nil {
                dbOpenErr := err

                // Plan B: start from scratch
                err = DatabaseDrop(p.cfg)
                if err == nil {
                        p.db, err = DatabaseOpen(p.cfg)
                }
                if err != nil {
                        return fmt.Errorf("database failover: %v", err)
                } else {
                        Errlog.Warnf("database failover success: %v", dbOpenErr)
                }
        }

        if p.cfg.SendStats {
                p.statSuccessfulRecords = make(map[string]*StatRecord)
                p.statUnsuccessfulRecords = make(map[string]*StatRecord)
                p.statCh = make(chan map[string]*StatRecord)

                ver, err := packageVersion(agentPackageName)
                if err != nil {
                        Errlog.Warnf("failed to detect version of %s package: %s", agentPackageName, err)
                        ver = "unknown"
                }

                p.sendMessageAPI = NewSendMessageAPI(apiURL, ver, sendMessageAPITimeout)

                p.lw = NewLicenseWatcher(p.cfg.LicensePath, p.cfg.PublicKeyPath, licenseReadInterval)
                p.lw.Subscribe(func(l License, valid bool) {
                        var lic *License
                        if valid {
                                lic = &l
                        }
                        atomic.StorePointer((*unsafe.Pointer)(unsafe.Pointer(&p.license)), unsafe.Pointer(lic))
                })
                p.lw.Start()

                p.statWait.Add(1)
                go p.ServeSendStat()
        }

        p.wlUser = NewUserWhiteList(p.cfg.UserLock.WhitelistFileName)
        p.wlIP, _ = NewIPWhiteList(p.cfg.IPLock.WhitelistFileName + "," + p.cfg.IPLock.WhitelistInclude)
        p.wlUserIP = NewUserIPWhiteList(p.cfg.UserIPLock.WhitelistFileName)

        p.db.WithUserWhitelist(p.wlUser).WithUserIPWhitelist(p.wlUserIP)

        if p.cfg.RBLTimeout > 0 {
                p.rbl = NewRBL(RBLConfig{
                        ResolverAddr:   p.cfg.ResolvConf,
                        RBLServers:     p.cfg.RBL,
                        RequestTimeout: time.Duration(p.cfg.RBLTimeout) * time.Second,
                        CacheSize:      p.cfg.RBLCacheSize,
                        CacheTimeout:   time.Duration(p.cfg.RBLCacheTTL) * time.Second,
                })
        }

        p.acceptList = make(map[net.Listener]struct{})
        p.connList = make(map[net.Conn]struct{})

        err = p.Serve("unix", p.cfg.Socket, p.ProcessModuleConn)
        if err != nil {
                return fmt.Errorf("listen: %v", err)
        }

        if p.cfg.CPanelFtpAuthInSocket != "" && p.cfg.CPanelFtpAuthOutSocket != "" && p.cfg.CPanelFtpAuthOutTimeout > 0 {
                err = p.Serve("unix", p.cfg.CPanelFtpAuthInSocket, p.ProcessCPanelFtpAuthConn)
                if err != nil {
                        return fmt.Errorf("listen: %v", err)
                }
        }
        return
}

func easyjson3c9d2b01Encode11

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func easyjson3c9d2b01Encode11(out *jwriter.Writer, in Request) {
        out.RawByte('{')
        first := true
        _ = first
        if in.Type != "" {
                const prefix string = ",\"type\":"
                first = false
                out.RawString(prefix[1:])
                out.String(string(in.Type))
        }
        if in.Service != "" {
                const prefix string = ",\"service\":"
                if first {
                        first = false
                        out.RawString(prefix[1:])
                } else {
                        out.RawString(prefix)
                }
                out.String(string(in.Service))
        }
        if in.User != "" {
                const prefix string = ",\"user\":"
                if first {
                        first = false
                        out.RawString(prefix[1:])
                } else {
                        out.RawString(prefix)
                }
                out.String(string(in.User))
        }
        if in.Host != "" {
                const prefix string = ",\"host\":"
                if first {
                        first = false
                        out.RawString(prefix[1:])
                } else {
                        out.RawString(prefix)
                }
                out.String(string(in.Host))
        }
        if len(in.Hash) != 0 {
                const prefix string = ",\"hash\":"
                if first {
                        first = false
                        out.RawString(prefix[1:])
                } else {
                        out.RawString(prefix)
                }
                {
                        out.RawByte('[')
                        for v2, v3 := range in.Hash {
                                if v2 > 0 {
                                        out.RawByte(',')
                                }
                                out.String(string(v3))
                        }
                        out.RawByte(']')
                }
        }
        if in.Sign != "" {
                const prefix string = ",\"sign\":"
                if first {
                        first = false
                        out.RawString(prefix[1:])
                } else {
                        out.RawString(prefix)
                }
                out.String(string(in.Sign))
        }
        out.RawByte('}')
}

func Process.ProcessModuleRequest

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/module.go:

func (p *Process) ProcessModuleRequest(data []byte) []byte {
        var r Request
        err := r.UnmarshalJSON(data)
        if err != nil {
                Errlog.Errorf("parse request: %v", err)
                return nil
        }

        if !r.CheckSign(Secret, p.cfg.SharedKey) {
                Errlog.Errorf("Incorrect signature from %s:%s", r.Host, r.User)
                return nil
        }

        r.Host = ToIP(r.Host)

        switch r.Type {
        case "check":
                if r.Host != "" && p.wlIP.In(r.Host) {
                        return ResponseOK
                }

                result, err := p.db.CheckLock(r.Host, r.User)
                if err != nil {
                        Errlog.Errorf("check lock: %v", err)
                        return ResponseFailure
                }

                var response string

                if result&UserLock != NoLock {
                        response = fmt.Sprintf(
                                "[IM360_UL] The account %s has been temporarily locked by Imunify PAM(%s)",
                                r.User, r.Host)
                }
                if result&IPLock != NoLock {
                        response = fmt.Sprintf("[IM360_IPL] The IP %s has been locked by Imunify PAM", r.Host)
                }
                if result&UserIPLock != NoLock {
                        response = fmt.Sprintf(
                                "[IM360_IPUL] The account %s has been locked for the attacker IP %s",
                                r.User, r.Host)
                }

                if p.cfg.RBLTimeout > 0 && p.rbl != nil {
                        value, err := p.rbl.Check(r.Host)
                        if err != nil {
                                noSuchHost := strings.HasSuffix(err.Error(), "no such host")
                                if _, ok := err.(*net.DNSError); !ok || err.(*net.DNSError).IsTimeout || !noSuchHost {
                                        log.Errorf("RBL check: %v", err)
                                }
                        }
                        if value {
                                response = fmt.Sprintf(
                                        "[IM360_RBL] The IP %s has been locked due to Imunify RBL", r.Host)
                        }
                }

                if len(response) > 0 {
                        return ModuleStringResponse("I360_BLOCKED", response)
                }

                return ResponseOK
        case "failed":
                for _, hash := range r.Hash {
                        err := p.db.WriteAttempts(r.Host, r.User, hash)
                        if err != nil {
                                Errlog.Errorf("write filed attempt: %v", err)
                        }
                        p.WriteStat(false, r.Service, r.Host, r.User, hash)
                }
                return nil
        case "success":
                err := p.db.RemoveSuccess(r.Host, r.User)
                if err != nil {
                        Errlog.Errorf("write filed attempt: %v", err)
                        return ResponseFailure
                }
                p.WriteStat(true, r.Service, r.Host, r.User, "e")
                return nil
        }

        return nil
}

func easyjsonD587a15Decode12

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Decode12(in *jlexer.Lexer, out *License) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "group":
                        out.Group = string(in.String())
                case "id":
                        out.ID = string(in.String())
                case "limit":
                        out.Limit = int(in.Int())
                case "message":
                        out.Message = string(in.String())
                case "sign":
                        out.Sign = string(in.String())
                case "signatures":
                        if in.IsNull() {
                                in.Skip()
                                out.Signatures = nil
                        } else {
                                in.Delim('[')
                                if out.Signatures == nil {
                                        if !in.IsDelim(']') {
                                                out.Signatures = make([]string, 0, 4)
                                        } else {
                                                out.Signatures = []string{}
                                        }
                                } else {
                                        out.Signatures = (out.Signatures)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v4 string
                                        v4 = string(in.String())
                                        out.Signatures = append(out.Signatures, v4)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                case "status":
                        out.Status = string(in.String())
                case "token_created_utc":
                        out.TokenCreatedUTC = int(in.Int())
                case "token_expire_utc":
                        out.TokenExpireUTC = int(in.Int())
                case "upgrade_url":
                        out.UpgradeURL = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func easyjson2c6259e0Encode1

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license_proto_easyjson.go:

func easyjson2c6259e0Encode1(out *jwriter.Writer, in License) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"group\":"
                out.RawString(prefix[1:])
                out.String(string(in.Group))
        }
        {
                const prefix string = ",\"id\":"
                out.RawString(prefix)
                out.String(string(in.ID))
        }
        {
                const prefix string = ",\"limit\":"
                out.RawString(prefix)
                out.Int(int(in.Limit))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        {
                const prefix string = ",\"sign\":"
                out.RawString(prefix)
                out.String(string(in.Sign))
        }
        {
                const prefix string = ",\"signatures\":"
                out.RawString(prefix)
                if in.Signatures == nil && (out.Flags&jwriter.NilSliceAsEmpty) == 0 {
                        out.RawString("null")
                } else {
                        out.RawByte('[')
                        for v2, v3 := range in.Signatures {
                                if v2 > 0 {
                                        out.RawByte(',')
                                }
                                out.String(string(v3))
                        }
                        out.RawByte(']')
                }
        }
        {
                const prefix string = ",\"status\":"
                out.RawString(prefix)
                out.String(string(in.Status))
        }
        {
                const prefix string = ",\"token_created_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenCreatedUTC))
        }
        {
                const prefix string = ",\"token_expire_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenExpireUTC))
        }
        {
                const prefix string = ",\"upgrade_url\":"
                out.RawString(prefix)
                out.String(string(in.UpgradeURL))
        }
        out.RawByte('}')
}

func easyjsonD587a15Encode12

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Encode12(out *jwriter.Writer, in License) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"group\":"
                out.RawString(prefix[1:])
                out.String(string(in.Group))
        }
        {
                const prefix string = ",\"id\":"
                out.RawString(prefix)
                out.String(string(in.ID))
        }
        {
                const prefix string = ",\"limit\":"
                out.RawString(prefix)
                out.Int(int(in.Limit))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        {
                const prefix string = ",\"sign\":"
                out.RawString(prefix)
                out.String(string(in.Sign))
        }
        {
                const prefix string = ",\"signatures\":"
                out.RawString(prefix)
                if in.Signatures == nil && (out.Flags&jwriter.NilSliceAsEmpty) == 0 {
                        out.RawString("null")
                } else {
                        out.RawByte('[')
                        for v5, v6 := range in.Signatures {
                                if v5 > 0 {
                                        out.RawByte(',')
                                }
                                out.String(string(v6))
                        }
                        out.RawByte(']')
                }
        }
        {
                const prefix string = ",\"status\":"
                out.RawString(prefix)
                out.String(string(in.Status))
        }
        {
                const prefix string = ",\"token_created_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenCreatedUTC))
        }
        {
                const prefix string = ",\"token_expire_utc\":"
                out.RawString(prefix)
                out.Int(int(in.TokenExpireUTC))
        }
        {
                const prefix string = ",\"upgrade_url\":"
                out.RawString(prefix)
                out.String(string(in.UpgradeURL))
        }
        out.RawByte('}')
}

func easyjsonD587a15Decode11

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Decode11(in *jlexer.Lexer, out *SendMessagesApiRequest) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "rpm_ver":
                        out.AgentVersion = string(in.String())
                case "license":
                        easyjsonD587a15Decode12(in, &out.License)
                case "method":
                        out.Method = string(in.String())
                case "ver":
                        out.ProtocolVersion = string(in.String())
                case "server_id":
                        out.ServerID = string(in.String())
                case "payload":
                        if in.IsNull() {
                                in.Skip()
                                out.Payload = nil
                        } else {
                                in.Delim('[')
                                if out.Payload == nil {
                                        if !in.IsDelim(']') {
                                                out.Payload = make([]StatRecord, 0, 0)
                                        } else {
                                                out.Payload = []StatRecord{}
                                        }
                                } else {
                                        out.Payload = (out.Payload)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v1 StatRecord
                                        (v1).UnmarshalEasyJSON(in)
                                        out.Payload = append(out.Payload, v1)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func easyjson3c9d2b01Decode11

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func easyjson3c9d2b01Decode11(in *jlexer.Lexer, out *Request) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "type":
                        out.Type = string(in.String())
                case "service":
                        out.Service = string(in.String())
                case "user":
                        out.User = string(in.String())
                case "host":
                        out.Host = string(in.String())
                case "hash":
                        if in.IsNull() {
                                in.Skip()
                                out.Hash = nil
                        } else {
                                in.Delim('[')
                                if out.Hash == nil {
                                        if !in.IsDelim(']') {
                                                out.Hash = make([]string, 0, 4)
                                        } else {
                                                out.Hash = []string{}
                                        }
                                } else {
                                        out.Hash = (out.Hash)[:0]
                                }
                                for !in.IsDelim(']') {
                                        var v1 string
                                        v1 = string(in.String())
                                        out.Hash = append(out.Hash, v1)
                                        in.WantComma()
                                }
                                in.Delim(']')
                        }
                case "sign":
                        out.Sign = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func easyjsonD587a15Encode11

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Encode11(out *jwriter.Writer, in SendMessagesApiRequest) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"rpm_ver\":"
                out.RawString(prefix[1:])
                out.String(string(in.AgentVersion))
        }
        if true {
                const prefix string = ",\"license\":"
                out.RawString(prefix)
                easyjsonD587a15Encode12(out, in.License)
        }
        if in.Method != "" {
                const prefix string = ",\"method\":"
                out.RawString(prefix)
                out.String(string(in.Method))
        }
        {
                const prefix string = ",\"ver\":"
                out.RawString(prefix)
                out.String(string(in.ProtocolVersion))
        }
        if in.ServerID != "" {
                const prefix string = ",\"server_id\":"
                out.RawString(prefix)
                out.String(string(in.ServerID))
        }
        if len(in.Payload) != 0 {
                const prefix string = ",\"payload\":"
                out.RawString(prefix)
                {
                        out.RawByte('[')
                        for v2, v3 := range in.Payload {
                                if v2 > 0 {
                                        out.RawByte(',')
                                }
                                (v3).MarshalEasyJSON(out)
                        }
                        out.RawByte(']')
                }
        }
        out.RawByte('}')
}

func easyjsonD587a15Encode1

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Encode1(out *jwriter.Writer, in StatRecord) {
        out.RawByte('{')
        first := true
        _ = first
        {
                const prefix string = ",\"name\":"
                out.RawString(prefix[1:])
                out.String(string(in.Name))
        }
        {
                const prefix string = ",\"attackers_ip\":"
                out.RawString(prefix)
                out.String(string(in.AttackersIP))
        }
        {
                const prefix string = ",\"rule\":"
                out.RawString(prefix)
                out.Int(int(in.Rule))
        }
        {
                const prefix string = ",\"message\":"
                out.RawString(prefix)
                out.String(string(in.Message))
        }
        {
                const prefix string = ",\"severity\":"
                out.RawString(prefix)
                out.Int(int(in.Severity))
        }
        {
                const prefix string = ",\"retries\":"
                out.RawString(prefix)
                out.Int(int(in.Retries))
        }
        {
                const prefix string = ",\"timestamp\":"
                out.RawString(prefix)
                out.Int64(int64(in.Timestamp))
        }
        {
                const prefix string = ",\"plugin_id\":"
                out.RawString(prefix)
                out.String(string(in.PluginId))
        }
        out.RawByte('}')
}

func easyjsonD587a15Decode1

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func easyjsonD587a15Decode1(in *jlexer.Lexer, out *StatRecord) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "name":
                        out.Name = string(in.String())
                case "attackers_ip":
                        out.AttackersIP = string(in.String())
                case "rule":
                        out.Rule = int(in.Int())
                case "message":
                        out.Message = string(in.String())
                case "severity":
                        out.Severity = int(in.Int())
                case "retries":
                        out.Retries = int(in.Int())
                case "timestamp":
                        out.Timestamp = int64(in.Int64())
                case "plugin_id":
                        out.PluginId = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Process.WriteStat

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func (p *Process) WriteStat(success bool, service, ip, username, password string) {
        if p.cfg.SendStats == false || ip == "127.0.0.1" {
                return
        }

        now := time.Now()
        p.statLock.Lock()
        if success {
                message := fmt.Sprintf("%s s_ip %s - %s:e res:true", service, ip, username)
                record, ok := p.statSuccessfulRecords[message]
                if !ok {
                        p.statSuccessfulRecords[message] = &StatRecord{
                                Name:        "pam_imunify info",
                                AttackersIP: ip,
                                Rule:        77777,
                                Message:     message,
                                Severity:    1,
                                Retries:     1,
                                Timestamp:   now.Unix(),
                                PluginId:    "pam_imunify",
                        }
                } else {
                        record.Retries++
                }

                if p.statSuccessfulTime.IsZero() {
                        p.statSuccessfulTime = now
                } else if p.statSuccessfulTime.Add(time.Duration(p.cfg.SendStatsSuccessfulAggTime) * time.Second).Before(now) {
                        p.statSuccessfulTime = time.Time{}
                        p.statCh <- p.statSuccessfulRecords
                        p.statSuccessfulRecords = make(map[string]*StatRecord)
                }
        } else {
                message := fmt.Sprintf("%s s_ip %s - %s:%s res:false", service, ip, username, password)
                record, ok := p.statUnsuccessfulRecords[message]
                if !ok {
                        p.statUnsuccessfulRecords[message] = &StatRecord{
                                Name:        "pam_imunify info",
                                AttackersIP: ip,
                                Rule:        77777,
                                Message:     message,
                                Severity:    1,
                                Retries:     1,
                                Timestamp:   now.Unix(),
                                PluginId:    "pam_imunify",
                        }
                } else {
                        record.Retries++
                }

                if p.statUnsuccessfulTime.IsZero() {
                        p.statUnsuccessfulTime = now
                } else if p.statUnsuccessfulTime.Add(time.Duration(p.cfg.SendStatsUnsuccessfulAggTime) * time.Second).Before(now) {
                        p.statUnsuccessfulTime = time.Time{}
                        p.statCh <- p.statUnsuccessfulRecords
                        p.statUnsuccessfulRecords = make(map[string]*StatRecord)
                }
        }

        p.statLock.Unlock()

}

func Process.Stop

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func (p *Process) Stop() {
        // Stop accepting new connections
        for listener := range p.acceptList {
                _ = listener.Close()
                delete(p.acceptList, listener)
        }
        p.acceptRoutineWait.Wait()

        // Close all opened connections
        p.connListLock.Lock()
        for conn := range p.connList {
                _ = conn.Close()
                delete(p.connList, conn)
        }
        p.connListLock.Unlock()
        p.connRoutinesWait.Wait()

        if p.cfg.SendStats {
                p.statLock.Lock()
                p.statCh <- p.statSuccessfulRecords
                p.statCh <- p.statUnsuccessfulRecords
                p.statLock.Unlock()
                close(p.statCh)
                p.statWait.Wait()
                p.lw.Stop()
        }

        err := p.db.Close()
        if err != nil {
                Errlog.Fatalf("database close: %v", err)
        }

        p.syslog.Close()

        if p.sentryLogger != nil {
                p.sentryLogger.Flush()
        }

        log.SetLevel(log.InfoLevel)
        log.SetOutput(os.Stderr)
}

func easyjson3c9d2b01Decode1

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func easyjson3c9d2b01Decode1(in *jlexer.Lexer, out *Response) {
        isTopLevel := in.IsStart()
        if in.IsNull() {
                if isTopLevel {
                        in.Consumed()
                }
                in.Skip()
                return
        }
        in.Delim('{')
        for !in.IsDelim('}') {
                key := in.UnsafeFieldName(false)
                in.WantColon()
                if in.IsNull() {
                        in.Skip()
                        in.WantComma()
                        continue
                }
                switch key {
                case "action":
                        out.Action = string(in.String())
                case "message":
                        out.Message = string(in.String())
                default:
                        in.SkipRecursive()
                }
                in.WantComma()
        }
        in.Delim('}')
        if isTopLevel {
                in.Consumed()
        }
}

func Process.ProcessModuleConn

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/module.go:

func (p *Process) ProcessModuleConn(c net.Conn) {
        b := make([]byte, 2048)
        for {
                n, err := c.Read(b)
                if err != nil {
                        if shouldLogError(err) {
                                Errlog.Errorf("read: %v", err)
                        }
                        break
                }

                requestId := p.RequestId()

                log.Debugf("--[svc:%d]->> %v", requestId, string(b[:n]))

                resp := p.ProcessModuleRequest(b[:n])
                if resp == nil {
                        break
                }

                log.Debugf("<-[svc:%d]--- %v", requestId, string(resp))

                _, err = c.Write(resp)
                if err != nil {
                        Errlog.Errorf("connection serve: %v", err)
                        break
                }
        }
}

func NewSentryLogger

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

func NewSentryLogger(package_name string, package_version string) (s *SentryLogger,
                                                                       err error) {
        s = new(SentryLogger)
        s.dsn = SENTRY_DSN

        httpsync_transport := sentry.NewHTTPSyncTransport()
        httpsync_transport.Configure(sentry.ClientOptions{
                Dsn: SENTRY_DSN,
        })
        sentry.Init(sentry.ClientOptions{
                Dsn: SENTRY_DSN,
                Transport: httpsync_transport,
        })

        server_ip, err := getOwnIP()
        if err != nil {
                Errlog.Errorf("failed to retrieve server IP: %v", err)
        }
        server_id, err := getServerId()
        if err != nil {
                return nil, fmt.Errorf("failed to retrieve server ID: %v", err)
        }
        os_release, err := getOsRelease()
        if err != nil {
                Errlog.Errorf("failed to retrieve OS release: %v", err)
        }

        sentry.ConfigureScope(func(scope *sentry.Scope) {
                scope.SetTag("name", package_name)
                scope.SetTag("version", package_version)
                if server_ip != nil {
                        scope.SetTag("server_ip", server_ip.String())
                }
                if server_id != "" {
                        scope.SetUser(sentry.User{
                                ID: server_id,
                        })
                }
                if os_release != "" {
                        scope.SetTag("os.version", os_release)
                }
        })

        return s, nil
}

func main

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func main() {
        var (
                done    bool
                cfgPath string
                err     error
        )

        flag.StringVar(&cfgPath, "f", DefaultIniPath, "ini file path")
        flag.Parse()

        sigs := make(chan os.Signal, 1)
        signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)

        for !done {
                p := new(Process)

                err = p.Start(cfgPath)
                if err != nil {
                        Errlog.Fatalf("start: %v", err)
                }

                switch <-sigs {
                case syscall.SIGINT, syscall.SIGTERM:
                        done = true
                        break
                case syscall.SIGHUP:
                }

                p.Stop()

                p = nil
                runtime.GC()
        }
}

func getOwnIP

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

func getOwnIP() (ip net.IP, err error) {
        var ifaces []net.Interface
        ifaces, err = net.Interfaces()

        for _, i := range ifaces {
                if i.Flags&net.FlagUp == 0 {
                        continue
                }

                var addrs []net.Addr
                addrs, err = i.Addrs()

                for _, addr := range addrs {
                        switch v := addr.(type) {
                        case *net.IPNet:
                                ip = v.IP
                        case *net.IPAddr:
                                ip = v.IP
                        }

                        if ip == nil || ip.To4() == nil || ip.IsLoopback() {
                                ip = nil
                        } else {
                                break
                        }
                }
        }
        return
}

func Database.RemoveSuccess

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) RemoveSuccess(ip string, user string) error {
        batch := new(leveldb.Batch)

        if user != "" {
                batch.Delete([]byte(user))
                log.Tracef("---[db]->> del %v", user)
        }
        if user != "" && ip != "" {
                batch.Delete([]byte(ip + "/" + user))
                log.Tracef("---[db]->> del %v", ip+"/"+user)
        }

        if batch.Len() == 0 {
                return nil
        }

        db.lock.Lock()
        defer db.lock.Unlock()

        err := db.db.Write(batch, nil)
        if err != nil {
                return fmt.Errorf("batch write: %v", err)
        }

        return nil
}

func query

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func query(ctx context.Context, nameserver string, rbl string, host string, r *Result) {
        r.Listed = false

        resolver := net.Resolver{
                PreferGo: true,
        }
        if nameserver != "" {
                resolver.Dial = func(ctx context.Context, network, address string) (net.Conn, error) {
                        d := net.Dialer{}
                        return d.DialContext(ctx, "udp", nameserver)
                }
        }

        lookup := fmt.Sprintf("%s.%s", host, rbl)

        res, err := resolver.LookupHost(ctx, lookup)
        if len(res) > 0 {
                r.Listed = true
                txt, _ := resolver.LookupTXT(ctx, lookup)
                if len(txt) > 0 {
                        r.Text = txt[0]
                }
        }
        if err != nil {
                r.Error = true
                r.ErrorType = err
        }

        return
}

func Process.ProcessCPanelFtpAuthConn

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/cpanel.go:

func (p *Process) ProcessCPanelFtpAuthConn(c net.Conn) {
        b, err := CPanelFtpAuthRecv(c)
        if err != nil {
                if shouldLogError(err) {
                        Errlog.Errorf("read: %v", err)
                }
                return
        }

        requestId := p.RequestId()

        log.Debugf("--[svc:%d]->>\n%v", requestId, string(b))

        resp := p.ProcessCPanelFtpAuthRequest(b)
        if resp == nil {
                return
        }

        log.Debugf("<-[svc:%d]---\n%v", requestId, string(resp))

        _, err = c.Write(resp)
        if err != nil {
                Errlog.Errorf("connection serve: %v", err)
                return
        }
}

func CPanelAuthMsg.Unmarshal

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/cpanel.go:

func (r *CPanelAuthMsg) Unmarshal(b []byte) *CPanelAuthMsg {
        lines := bytes.Split(b, []byte{'\n'})
        for _, line := range lines {
                i := bytes.IndexByte(line, ':')
                if i == -1 {
                        continue
                }
                key := line[:i]
                value := line[i+1:]
                switch string(key) {
                case "account":
                        r.Account = string(value)
                case "password":
                        r.Password = string(value)
                case "peer":
                        r.Peer = string(value)
                case "auth_ok":
                        r.AuthOk = string(value)
                }
        }
        return r
}

func Request.CheckSign

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request.go:

func (r Request) CheckSign(secret, key string) bool {
        hash := sha256.New()
        hash.Write([]byte(secret))
        hash.Write([]byte(r.Type))
        hash.Write([]byte(r.Service))
        hash.Write([]byte(r.User))
        hash.Write([]byte(r.Host))
        for _, v := range r.Hash {
                hash.Write([]byte(v))
        }
        hash.Write([]byte(key))
        sign, err := hex.DecodeString(r.Sign)
        if err != nil {
                return false
        }
        return bytes.Equal(hash.Sum(nil), sign)
}

func Process.ServeListener

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func (p *Process) ServeListener(l net.Listener, connCallback func(c net.Conn)) {
        for {
                c, err := l.Accept()
                if err != nil {
                        if shouldLogError(err) {
                                Errlog.Errorf("accept: %v", err)
                        }
                        break
                }

                p.connListLock.Lock()
                p.connList[c] = struct{}{}
                p.connListLock.Unlock()

                p.connRoutinesWait.Add(1)
                //go p.ServeConn(c, connCallback)
                go func(c net.Conn, connCallback func(c net.Conn)) {
                        connCallback(c)

                        p.connListLock.Lock()
                        if _, ok := p.connList[c]; ok {
                                delete(p.connList, c)
                                err := c.Close()
                                if err != nil {
                                        Errlog.Errorf("connection close: %v", err)
                                }
                        }
                        p.connListLock.Unlock()

                        p.connRoutinesWait.Done()
                }(c, connCallback)
        }
        p.acceptRoutineWait.Done()
}

func CheckRBL

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func CheckRBL(r string, rbl []string, ip string, timeout time.Duration) (bool, error) {
        if ip == "" || ip == "127.0.0.1" {
                return false, nil
        }

        ctx, cancel := context.WithTimeout(context.Background(), timeout)
        defer cancel()

        var e error = nil
        for _, server := range rbl {
                r := rblLookupIP(ctx, r, server, ip)
                for _, res := range r.Results {
                        if res.Error == false {
                                return true, nil
                        } else {
                                e = res.ErrorType
                        }
                }
        }

        return false, e
}

func Process.ServeSendStat

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func (p *Process) ServeSendStat() {
        for statsMap := range p.statCh {
                stats := make([]StatRecord, 0, len(statsMap))
                for _, v := range statsMap {
                        stats = append(stats, *v)
                }

                license := (*License)(atomic.LoadPointer((*unsafe.Pointer)(unsafe.Pointer(&p.license))))
                err := p.sendMessageAPI.SendStats(license, stats)
                if err != nil {
                        Errlog.Errorf("Send stats for %d records error: %v", len(stats), err)
                        continue
                }
                log.Infof("Send stats for %d records success", len(stats))
                log.WithField("Records", stats).Debug("Send stats records")
        }
        p.statWait.Done()
}

func rblLookupIP

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func rblLookupIP(ctx context.Context, resolver string, rblList string, targetIP string) (r RBLResults) {
        r.List = rblList
        r.Host = targetIP

        res := Result{}
        res.Address = targetIP

        ip := net.ParseIP(targetIP)
        if ip == nil {
                return
        }

        addr := ReverseIP(ip)

        query(ctx, resolver, rblList, addr, &res)

        r.Results = append(r.Results, res)

        return
}

func getServerId

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

func getServerId() (id string, err error) {
        var f *os.File
        f, err = os.Open("/var/imunify360/license.json")
        if err != nil {
                return
        }
        defer f.Close()

        data, _ := ioutil.ReadAll(f)

        var license Im360License
        json.Unmarshal(data, &license)

        id = license.Id
        return
}

func @63:25

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api.go:

func() (interface{}, error) {
                res, err := ca.client.Post(ca.baseURL+sendMessageURL, sendMessageContentTypeJSON, bytes.NewReader(b))
                if err != nil {
                        return nil, err
                }
                defer res.Body.Close()

                body, err := ioutil.ReadAll(res.Body)
                if err != nil {
                        return nil, err
                }

                if res.StatusCode != http.StatusOK {
                        return body, fmt.Errorf("error response: %d, %s", res.StatusCode, string(body))
                }

                return body, nil
        }

func @191:14

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func(key interface{}) (interface{}, error) {
                        s, ok := key.(string)
                        if !ok {
                                return nil, fmt.Errorf("LRU Cache: Bad key value type")
                        }
                        value, err := CheckRBL(r.resolverAddr, r.rblServers, s, r.requestTimeout)
                        if value || err == nil {
                                return value, nil
                        }
                        noSuchHost := strings.HasSuffix(err.Error(), "no such host")
                        if _, ok := err.(*net.DNSError); !ok || err.(*net.DNSError).IsTimeout || !noSuchHost {
                                return nil, err
                        }
                        return value, nil
                }

func getOsRelease

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

func getOsRelease() (os_release string, err error) {
        var f *os.File
        f, err = os.Open("/etc/os-release")
        if err != nil {
                return
        }
        defer f.Close()

        data, _ := ioutil.ReadAll(f)

        matches := regexp.MustCompile(`PRETTY_NAME=(.+)`).FindSubmatch(data)
        if len(matches) > 1 {
                os_release = strings.Trim(string(matches[1]), "\"")
        }

        return
}

func @294:6

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func(c net.Conn, connCallback func(c net.Conn)) {
                        connCallback(c)

                        p.connListLock.Lock()
                        if _, ok := p.connList[c]; ok {
                                delete(p.connList, c)
                                err := c.Close()
                                if err != nil {
                                        Errlog.Errorf("connection close: %v", err)
                                }
                        }
                        p.connListLock.Unlock()

                        p.connRoutinesWait.Done()
                }

func CPanelFtpAuthRecv

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/cpanel.go:

func CPanelFtpAuthRecv(conn net.Conn) ([]byte, error) {
        var rb []byte
        reader := bufio.NewReader(conn)
        for {
                b, err := reader.ReadBytes('\n')
                if err != nil {
                        return nil, err
                }

                rb = append(rb, b...)

                if bytes.Equal([]byte("end\n"), b) {
                        return rb, nil
                }
        }
}

func LicenseWatcher.watcher

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) watcher() {
        defer lw.wg.Done()

        ticker := time.NewTicker(lw.interval)
        defer ticker.Stop()

        lw.readLicenseAndNotify()
        for {
                select {
                case <-lw.done:
                        return
                case <-ticker.C:
                        lw.readLicenseAndNotify()
                }
        }
}

func WhiteList.isNeedUpdate

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/whitelist.go:

func (wl *WhiteList) isNeedUpdate() bool {
        for fileName, fileModTime := range wl.file {
                info, err := os.Stat(fileName)
                if err != nil || info == nil {
                        if !fileModTime.IsZero() {
                                return true
                        }
                } else if !info.ModTime().Equal(fileModTime) {
                        return true
                }
        }
        return false
}

func @120:24

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

func(scope *sentry.Scope) {
                scope.SetTag("name", package_name)
                scope.SetTag("version", package_version)
                if server_ip != nil {
                        scope.SetTag("server_ip", server_ip.String())
                }
                if server_id != "" {
                        scope.SetUser(sentry.User{
                                ID: server_id,
                        })
                }
                if os_release != "" {
                        scope.SetTag("os.version", os_release)
                }
        }

func Database.Close

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func (db *Database) Close() error {
        db.lock.Lock()
        defer db.lock.Unlock()

        if atomic.LoadInt64(&db.closed) == 0 {
                atomic.SwapInt64(&db.closed, 1)
                db.stopExpireOld <- true
                db.waitExpireOld.Wait()
                return db.db.Close()
        }
        return nil
}

func shouldLogError

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func shouldLogError(err error) bool {
        if err == nil {
                return false
        }

        if err == io.EOF {
                return false
        }

        str := err.Error()
        if strings.Contains(str, "use of closed network connection") {
                return false
        }

        return true
}

func rbl.Check

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func (r rbl) Check(ip string) (bool, error) {
        if r.cache == nil {
                return CheckRBL(r.resolverAddr, r.rblServers, ip, r.requestTimeout)
        }
        v, err := r.cache.Get(ip)
        value, ok := v.(bool)
        if !ok {
                return false, err
        }
        return value, err
}

func Process.Serve

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func (p *Process) Serve(network, address string, connCallback func(c net.Conn)) error {
        l, err := net.Listen(network, address)
        if err != nil {
                return err
        }

        p.acceptList[l] = struct{}{}
        p.acceptRoutineWait.Add(1)
        go p.ServeListener(l, connCallback)
        return nil
}

func ToIP

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func ToIP(host string) string {
        if host == "" || net.ParseIP(host) != nil {
                return host
        }

        ips, err := net.LookupIP(host)
        if err != nil || len(ips) == 0 {
                return ""
        }

        return ips[0].String()
}

func DatabaseDrop

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

func DatabaseDrop(cfg *Config) error {
        path := filepath.Join(cfg.Database, "/leveldb")

        err := os.RemoveAll(path)
        if err != nil {
                return fmt.Errorf("rm -rf %s: %v", path, err)
        }

        return nil
}

func SendMessageAPI.send

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api.go:

func (ca *SendMessageAPI) send(requestBody MarshalJSON) error {
        b, err := requestBody.MarshalJSON()
        if err != nil {
                return err
        }

        _, err = ca.cb.Execute(func() (interface{}, error) {
                res, err := ca.client.Post(ca.baseURL+sendMessageURL, sendMessageContentTypeJSON, bytes.NewReader(b))
                if err != nil {
                        return nil, err
                }
                defer res.Body.Close()

                body, err := ioutil.ReadAll(res.Body)
                if err != nil {
                        return nil, err
                }

                if res.StatusCode != http.StatusOK {
                        return body, fmt.Errorf("error response: %d, %s", res.StatusCode, string(body))
                }

                return body, nil
        })

        return err
}

func NewRBL

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

func NewRBL(config RBLConfig) RBL {
        r := &rbl{
                resolverAddr:   config.ResolverAddr,
                rblServers:     config.RBLServers,
                requestTimeout: config.RequestTimeout,
        }
        if config.CacheSize <= 0 || config.CacheTimeout <= 0 {
                return r
        }
        r.cache = gcache.New(config.CacheSize).
                Expiration(config.CacheTimeout).ARC().
                LoaderFunc(func(key interface{}) (interface{}, error) {
                        s, ok := key.(string)
                        if !ok {
                                return nil, fmt.Errorf("LRU Cache: Bad key value type")
                        }
                        value, err := CheckRBL(r.resolverAddr, r.rblServers, s, r.requestTimeout)
                        if value || err == nil {
                                return value, nil
                        }
                        noSuchHost := strings.HasSuffix(err.Error(), "no such host")
                        if _, ok := err.(*net.DNSError); !ok || err.(*net.DNSError).IsTimeout || !noSuchHost {
                                return nil, err
                        }
                        return value, nil
                }).
                Build()
        return r
}

func SendMessageAPI.SendStats

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api.go:

func (ca *SendMessageAPI) SendStats(license *License, messages []StatRecord) error {
        if license == nil {
                return errInvalidLicense
        }

        r := SendMessagesApiRequest{
                AgentVersion:    ca.agentVersion,
                ServerID:        license.ID,
                Method:          sendMessageMethod,
                License:         *license,
                Payload:         messages,
                ProtocolVersion: sendMessageProtocolVersion,
        }

        return ca.send(r)
}

func @138:18

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

func(l License, valid bool) {
                        var lic *License
                        if valid {
                                lic = &l
                        }
                        atomic.StorePointer((*unsafe.Pointer)(unsafe.Pointer(&p.license)), unsafe.Pointer(lic))
                }

func packageVersion

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/pkg_version.go:

func packageVersion(name string) (string, error) {
        v, err := getRPMVersion(name)
        if err != nil {
                v, err = getDEBVersion(name)
        }
        return v, err
}

func collectOutput

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/pkg_version.go:

func collectOutput(name string, args ...string) (string, error) {
        out, err := exec.Command(name, args...).Output()
        if err != nil {
                return "", err
        }
        return string(out), nil
}

func Request.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func (v Request) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjson3c9d2b01Encode11(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func Request.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func (v *Request) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjson3c9d2b01Decode11(&r, v)
        return r.Error()
}

func StatRecord.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func (v StatRecord) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjsonD587a15Encode1(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func Response.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

func (v *Response) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjson3c9d2b01Decode1(&r, v)
        return r.Error()
}

func License.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license_proto_easyjson.go:

func (v License) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjson2c6259e0Encode1(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func SendMessagesApiRequest.MarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func (v SendMessagesApiRequest) MarshalJSON() ([]byte, error) {
        w := jwriter.Writer{}
        easyjsonD587a15Encode11(&w, v)
        return w.Buffer.BuildBytes(), w.Error
}

func SendMessagesApiRequest.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func (v *SendMessagesApiRequest) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjsonD587a15Decode11(&r, v)
        return r.Error()
}

func StatRecord.UnmarshalJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

func (v *StatRecord) UnmarshalJSON(data []byte) error {
        r := jlexer.Lexer{Data: data}
        easyjsonD587a15Decode1(&r, v)
        return r.Error()
}

func @78:19

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/rbl.go:

78	`func(ctx context.Context, network, address string) (net.Conn, error) {`
79	`d := net.Dialer{}`
80	`return d.DialContext(ctx, "udp", nameserver)`
81	`}`

func errlog.Fatalf

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/errlog.go:

30	`func (*errlog) Fatalf(format string, args ...interface{}) {`
31	`log.Fatalf(format, args...)`
32	`sentrySend(format, args...)`
33	`}`

func Database.WithUserWhitelist

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

70	`func (db Database) WithUserWhitelist(wl UserWhiteList) *Database {`
71	`db.usersWhitelist = wl`
72	`return db`
73	`}`

func Database.WithUserIPWhitelist

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/database.go:

75	`func (db Database) WithUserIPWhitelist(wl UserIPWhiteList) *Database {`
76	`db.userIPWhitelist = wl`
77	`return db`
78	`}`

func SentryLogger.Write

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

139	`func (s *SentryLogger) Write(data []byte) (n int, err error) {`
140	`sentry.CaptureMessage(string(data))`
141	`return len(data), nil`
142	`}`

func LicenseWatcher.Stop

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

188	`func (lw *LicenseWatcher) Stop() {`
189	`close(lw.done)`
190	`lw.wg.Wait()`
191	`}`

func LicenseWatcher.Start

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

func (lw *LicenseWatcher) Start() {
        lw.wg.Add(1)
        go func() {
                lw.watcher()
        }()
}

func NewSendMessageAPI

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api.go:

func NewSendMessageAPI(apiURL string, agentVersion string, timeout time.Duration) *SendMessageAPI {
        return &SendMessageAPI{
                agentVersion: agentVersion,
                client:       &http.Client{Timeout: timeout},
                baseURL:      apiURL,
                cb: gobreaker.NewCircuitBreaker(gobreaker.Settings{
                        Name:     "SendMessageAPIBreaker",
                        Interval: timeout * 5,
                        Timeout:  timeout * 2,
                        ReadyToTrip: func(counts gobreaker.Counts) bool {
                                return counts.ConsecutiveFailures >= 3
                        },
                }),
        }
}

func Request.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

253	`func (v Request) UnmarshalEasyJSON(l jlexer.Lexer) {`
254	`easyjson3c9d2b01Decode11(l, v)`
255	`}`

func Request.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

241	`func (v Request) MarshalEasyJSON(w *jwriter.Writer) {`
242	`easyjson3c9d2b01Encode11(w, v)`
243	`}`

func getRPMVersion

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/pkg_version.go:

21	`func getRPMVersion(name string) (string, error) {`
22	`return collectOutput("rpm", "-q", "--queryformat=%{VERSION}-%{RELEASE}", name)`
23	`}`

func @44:17

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api.go:

44	`func(counts gobreaker.Counts) bool {`
45	`return counts.ConsecutiveFailures >= 3`
46	`}`

func SentryLogger.Flush

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/sentry_logger.go:

144	`func (s *SentryLogger) Flush() {`
145	`sentry.Flush(time.Second * 5)`
146	`}`

func Config.IsVerboseLoggingMode

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

48	`func (cfg *Config) IsVerboseLoggingMode() bool {`
49	`return cfg.IsLogfileEnabled()`
50	`}`

func Config.IsSentryEnabled

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

44	`func (cfg *Config) IsSentryEnabled() bool {`
45	`return cfg.Sentry != "" && cfg.Sentry != "off"`
46	`}`

func Response.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

96	`func (v Response) UnmarshalEasyJSON(l jlexer.Lexer) {`
97	`easyjson3c9d2b01Decode1(l, v)`
98	`}`

func Config.IsLogfileEnabled

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

40	`func (cfg *Config) IsLogfileEnabled() bool {`
41	`return cfg.LogFilename != ""`
42	`}`

func SendMessagesApiRequest.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

263	`func (v SendMessagesApiRequest) UnmarshalEasyJSON(l jlexer.Lexer) {`
264	`easyjsonD587a15Decode11(l, v)`
265	`}`

func @105:5

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

105	`func() {`
106	`lw.watcher()`
107	`}`

func SendMessagesApiRequest.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

251	`func (v SendMessagesApiRequest) MarshalEasyJSON(w *jwriter.Writer) {`
252	`easyjsonD587a15Encode11(w, v)`
253	`}`

func Response.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/request_easyjson.go:

84	`func (v Response) MarshalEasyJSON(w *jwriter.Writer) {`
85	`easyjson3c9d2b01Encode1(w, v)`
86	`}`

func StatRecord.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

132	`func (v StatRecord) UnmarshalEasyJSON(l jlexer.Lexer) {`
133	`easyjsonD587a15Decode1(l, v)`
134	`}`

func getDEBVersion

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/pkg_version.go:

16	`func getDEBVersion(name string) (string, error) {`
17	`return collectOutput("dpkg-query", "--showformat=${Version}", "--show", name)`
18	`}`

func StatRecord.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/api_proto_easyjson.go:

120	`func (v StatRecord) MarshalEasyJSON(w *jwriter.Writer) {`
121	`easyjsonD587a15Encode1(w, v)`
122	`}`

func errlog.Configure

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/errlog.go:

16	`func (*errlog) Configure(isSentryEnabled bool) {`
17	`Errlog.isSentryEnabled = isSentryEnabled`
18	`}`

func License.MarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license_proto_easyjson.go:

166	`func (v License) MarshalEasyJSON(w *jwriter.Writer) {`
167	`easyjson2c6259e0Encode1(w, v)`
168	`}`

func License.UnmarshalEasyJSON

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license_proto_easyjson.go:

178	`func (v License) UnmarshalEasyJSON(l jlexer.Lexer) {`
179	`easyjson2c6259e0Decode1(l, v)`
180	`}`

func Process.RequestId

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/main.go:

313	`func (p *Process) RequestId() uint {`
314	`return uint(atomic.AddUint32(&p.requestId, 1))`
315	`}`

func loadLockConfig

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/config.go:

func loadLockConfig(s *ini.Section, defaultWhitelist string) LockConfig {
        return LockConfig{
                Timeout:           rangeInt64(s.Key("timeout"), 300, 0, 9999999),
                Attempts:          rangeInt(s.Key("attempts"), 10, 0, 100),
                Period:            rangeInt64(s.Key("period"), 300, 0, 9999999),
                WhitelistFileName: s.Key("whitelist").MustString(defaultWhitelist),
        }
}

func @128:32

Back

In /builddir/build/BUILD/imunify360-pam-5.3.0/src/agent/license.go:

128	`func() {}`

agent

26.90%

281	`func (wl *UserIPWhiteList) In(user string, ip string) bool {`
282	`if wl == nil {`
283	`return false`
284	`}`
285
286	`wl.Update()`
287
288	`ipNet := net.ParseIP(ip)`
289
290	`var exist bool`
291	`if wl.users != nil && ipNet != nil {`
292	`wl.RLock()`
293	`item, got := wl.users[user]`
294	`if got {`
295	`contains, err := item.Contains(ipNet)`
296	`exist = (err == nil) && (contains == true)`
297	`}`
298	`wl.RUnlock()`
299	`}`
300
301	`return exist`
302	`}`

170	`func (lw LicenseWatcher) validLicense(lic License) bool {`
171	`f, err := os.Open(lw.pubKeyPath)`
172	`if err != nil {`
173	`Errlog.Errorf("fs.Open(%#v) failed: %v", lw.pubKeyPath, err)`
174	`return false`
175	`}`
176	`defer f.Close()`
177	`pubKey, err := LoadPublicKey(f)`
178	`if err != nil {`
179	`Errlog.Errorf("LoadPublicKey() failed: %s", err)`
180	`return false`
181	`}`
182	`// NOTE: we do not check if license is expired, which may be wrong,`
183	`// but that is what agent does at the moment.`
184	`return lic.Signed(pubKey)`
185	`}`

145	`func (wl *UserWhiteList) In(key string) bool {`
146	`if wl == nil {`
147	`return false`
148	`}`
149
150	`wl.Update()`
151
152	`var exist bool`
153	`wl.RLock()`
154	`if wl.users != nil {`
155	`_, exist = wl.users[key]`
156	`}`
157	`wl.RUnlock()`
158	`return exist`
159	`}`

93	`func (z *Record) Msgsize() (s int) {`
94	`s = 1 + 2 + msgp.Int64Size + 2 + msgp.MapHeaderSize`
95	`if z.Attempts != nil {`
96	`for za0001, za0002 := range z.Attempts {`
97	`_ = za0002`
98	`s += msgp.StringPrefixSize + len(za0001) + msgp.Int64Size`
99	`}`
100	`}`
101	`return`
102	`}`

162	`func (lw LicenseWatcher) notify(lic License, valid bool) {`
163	`lw.lock.Lock()`
164	`for _, f := range lw.subs {`
165	`f(*lic, valid)`
166	`}`
167	`lw.lock.Unlock()`
168	`}`

41	`func (lic License) Signed(pubKey rsa.PublicKey) bool {`
42	`lic.Sign = ""`
43	`signed := lic.signedContent()`
44	`for _, sigB64 := range lic.Signatures {`
45	`sig, err := base64.StdEncoding.DecodeString(sigB64)`
46	`if err != nil {`
47	`continue`
48	`}`
49	`hashed := sha512.Sum512(signed)`
50	`if err := rsa.VerifyPKCS1v15(pubKey, crypto.SHA512, hashed[:], []byte(sig)); err == nil {`
51	`lic.Sign = sigB64`
52	`return true`
53	`}`
54	`}`
55	`return false`
56	`}`

10	`func (z *Record) MarshalMsg(b []byte) (o []byte, err error) {`
11	`o = msgp.Require(b, z.Msgsize())`
12	`// map header, size 2`
13	`// string "e"`
14	`o = append(o, 0x82, 0xa1, 0x65)`
15	`o = msgp.AppendInt64(o, z.LockExpireAt)`
16	`// string "a"`
17	`o = append(o, 0xa1, 0x61)`
18	`o = msgp.AppendMapHeader(o, uint32(len(z.Attempts)))`
19	`for za0001, za0002 := range z.Attempts {`
20	`o = msgp.AppendString(o, za0001)`
21	`o = msgp.AppendInt64(o, za0002)`
22	`}`
23	`return`
24	`}`

53	`func NewWhiteList(fileNameList []string, ResetHandler func(), LoadLineHandler func(line string)) *WhiteList {`
54	`wl := &WhiteList{`
55	`file: make(map[string]time.Time, len(fileNameList)),`
56	`lastCheckTime: make(chan time.Time, 1),`
57	`ResetHandler: ResetHandler,`
58	`LoadLineHandler: LoadLineHandler,`
59	`}`
60
61	`for _, fileName := range fileNameList {`
62	`wl.file[fileName] = time.Time{}`
63	`}`
64	`wl.reload()`
65	`wl.lastCheckTime <- time.Now()`
66	`return wl`
67	`}`

83	`func (wl *WhiteList) reload() {`
84	`if wl.ResetHandler != nil {`
85	`wl.ResetHandler()`
86	`}`
87	`for fileName, _ := range wl.file {`
88	`fileModTime, err := readWhiteList(fileName, wl.LoadLineHandler)`
89	`if err == nil {`
90	`wl.file[fileName] = fileModTime`
91	`}`
92	`}`
93	`}`

118	`func() []string {`
119	`rbl := i.Section("").Key("rbl").Strings(",")`
120	`if len(rbl) > 0 {`
121	`return rbl`
122	`}`
123	`return []string{"net-brute.rbl.imunify.com"}`
124	`}`

171	`func (v *License) UnmarshalJSON(data []byte) error {`
172	`r := jlexer.Lexer{Data: data}`
173	`easyjson2c6259e0Decode1(&r, v)`
174	`return r.Error()`
175	`}`

130	`func (lw *LicenseWatcher) readLicenseAndNotify() {`
131	`if lic := lw.rereadLicense(); lic != nil {`
132	`lw.notify(lic, lw.validLicense(lic))`
133	`}`
134	`readLicenseAndNotifyDone()`
135	`}`

194	`func (lw *LicenseWatcher) Subscribe(f LicenseListener) {`
195	`lw.lock.Lock()`
196	`lw.subs = append(lw.subs, f)`
197	`lw.lock.Unlock()`
198	`}`

77	`func (v Response) MarshalJSON() ([]byte, error) {`
78	`w := jwriter.Writer{}`
79	`easyjson3c9d2b01Encode1(&w, v)`
80	`return w.Buffer.BuildBytes(), w.Error`
81	`}`

185	`func loadLockConfigIP(s *ini.Section, defaultWhitelist string, defaultIncludeList string) LockConfig {`
186	`return LockConfig{`
187	`Timeout: rangeInt64(s.Key("IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,`
188	`Attempts: rangeInt(s.Key("IP_LOCK_ATTEMPTS"), 10, 0, 100),`
189	`Period: rangeInt64(s.Key("IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,`
190	`WhitelistFileName: s.Key("whitelisted_ips_path").MustString(defaultWhitelist),`
191	`WhitelistInclude: s.Key("whitelisted_ips_include").MustString(defaultIncludeList),`
192	`}`
193	`}`

92	`func NewLicenseWatcher(licPath, pubKeyPath string, interval time.Duration) *LicenseWatcher {`
93	`return &LicenseWatcher{`
94	`done: make(chan struct{}),`
95	`interval: interval,`
96	`licPath: licPath,`
97	`pubKeyPath: pubKeyPath,`
98	`subs: make([]LicenseListener, 0, 1),`
99	`}`
100	`}`

134	`func (wl *UserWhiteList) reset() {`
135	`// root user is the must have default`
136	`wl.users = map[string]struct{}{`
137	`"root": struct{}{},`
138	`}`
139	`}`

195	`func loadLockConfigUserIP(s *ini.Section, defaultWhitelist string) LockConfig {`
196	`return LockConfig{`
197	`Timeout: rangeInt64(s.Key("USER_IP_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,`
198	`Attempts: rangeInt(s.Key("USER_IP_LOCK_ATTEMPTS"), 10, 0, 100),`
199	`Period: rangeInt64(s.Key("USER_IP_LOCK_MINUTES"), 5, 0, 9999999) * 60,`
200	`WhitelistFileName: s.Key("whitelisted_user_ip_path").MustString(defaultWhitelist),`
201	`}`
202	`}`

176	`func loadLockConfigUser(s *ini.Section, defaultWhitelist string) LockConfig {`
177	`return LockConfig{`
178	`Timeout: rangeInt64(s.Key("USER_LOCK_TIMEOUT"), 5, 0, 9999999) * 60,`
179	`Attempts: rangeInt(s.Key("USER_LOCK_ATTEMPTS"), 10, 0, 100),`
180	`Period: rangeInt64(s.Key("USER_LOCK_MINUTES"), 5, 0, 9999999) * 60,`
181	`WhitelistFileName: s.Key("whitelisted_users_path").MustString(defaultWhitelist),`
182	`}`
183	`}`

212	`func (wl *IPWhiteList) In(ipString string) bool {`
213	`if wl == nil {`
214	`return false`
215	`}`
216
217	`wl.Update()`
218
219	`ip := net.ParseIP(ipString)`
220
221	`var exist bool`
222	`if wl.ipRanger != nil && ip != nil {`
223	`wl.RLock()`
224	`contains, err := wl.ipRanger.Contains(ip)`
225	`exist = (err == nil) && (contains == true)`
226	`wl.RUnlock()`
227	`}`
228
229	`return exist`
230	`}`

194	`func (wl *IPWhiteList) loadLine(item string) {`
195	`if strings.Contains(item, "/") == true {`
196	`_, ipNet, err := net.ParseCIDR(item)`
197	`if err == nil {`
198	`wl.ipRanger.Insert(cidranger.NewBasicRangerEntry(*ipNet))`
199	`}`
200	`} else {`
201	`ip := net.ParseIP(item)`
202	`if ip != nil {`
203	`mask := net.CIDRMask(32, 32)`
204	`if ip.To4() == nil {`
205	`mask = net.CIDRMask(128, 128)`
206	`}`
207	`wl.ipRanger.Insert(cidranger.NewBasicRangerEntry(net.IPNet{IP: ip, Mask: mask}))`
208	`}`
209	`}`
210	`}`

137	`func (lw LicenseWatcher) rereadLicense() License {`
138	`fi, err := os.Stat(lw.licPath)`
139	`if err != nil {`
140	`Errlog.Errorf("fs.Stat(%#v) failed: %s", lw.licPath, err)`
141	`return nil`
142	`}`
143	`mt := fi.ModTime()`
144	`if !mt.After(lw.lastModified) {`
145	`return nil`
146	`}`
147	`f, err := os.Open(lw.licPath)`
148	`if err != nil {`
149	`Errlog.Errorf("fs.Open(%#v) failed: %s", lw.licPath, err)`
150	`return nil`
151	`}`
152	`defer f.Close()`
153	`lic, err := LoadLicense(f)`
154	`if err != nil {`
155	`Errlog.Errorf("LoadLicense() failed: %s", err)`
156	`return nil`
157	`}`
158	`lw.lastModified = mt`
159	`return &lic`
160	`}`

251	`func (wl *UserIPWhiteList) loadLine(item string) {`
252	`fields := strings.Fields(item)`
253	`if len(fields) < 2 {`
254	`return`
255	`}`
256
257	`user := fields[0]`
258	`if _, ok := wl.users[user]; !ok {`
259	`wl.users[user] = cidranger.NewPCTrieRanger()`
260	`}`
261
262	`for _, item := range fields[1:] {`
263	`if strings.Contains(item, "/") == true {`
264	`_, ipNet, err := net.ParseCIDR(item)`
265	`if err == nil {`
266	`wl.users[user].Insert(cidranger.NewBasicRangerEntry(*ipNet))`
267	`}`
268	`} else {`
269	`ip := net.ParseIP(item)`
270	`if ip != nil {`
271	`mask := net.CIDRMask(32, 32)`
272	`if ip.To4() == nil {`
273	`mask = net.CIDRMask(128, 128)`
274	`}`
275	`wl.users[user].Insert(cidranger.NewBasicRangerEntry(net.IPNet{IP: ip, Mask: mask}))`
276	`}`
277	`}`
278	`}`
279	`}`

53	`func easyjson3c9d2b01Encode1(out *jwriter.Writer, in Response) {`
54	`out.RawByte('{')`
55	`first := true`
56	`_ = first`
57	`if in.Action != "" {`
58	`const prefix string = ",\"action\":"`
59	`first = false`
60	`out.RawString(prefix[1:])`
61	`out.String(string(in.Action))`
62	`}`
63	`if in.Message != "" {`
64	`const prefix string = ",\"message\":"`
65	`if first {`
66	`first = false`
67	`out.RawString(prefix[1:])`
68	`} else {`
69	`out.RawString(prefix)`
70	`}`
71	`out.String(string(in.Message))`
72	`}`
73	`out.RawByte('}')`
74	`}`

24	`func readWhiteList(fileName string, lineHandler func(line string)) (fileModTime time.Time, err error) {`
25	`var (`
26	`file *os.File`
27	`info os.FileInfo`
28	`)`
29
30	`file, err = os.Open(fileName)`
31	`if err != nil {`
32	`return`
33	`}`
34
35	`info, err = file.Stat()`
36	`if err != nil {`
37	`return`
38	`}`
39
40	`fileModTime = info.ModTime()`
41
42	`sc := bufio.NewScanner(file)`
43	`for sc.Scan() {`
44	`if line := strings.TrimSpace(sc.Text()); line != "" {`
45	`lineHandler(line)`
46	`}`
47	`}`
48
49	`err = sc.Err()`
50	`return`
51	`}`

20	`func LoadPublicKey(r io.Reader) (*rsa.PublicKey, error) {`
21	`p, err := ioutil.ReadAll(r)`
22	`if err != nil {`
23	`return nil, err`
24	`}`
25	`block, _ := pem.Decode(p)`
26	`if block == nil {`
27	`return nil, fmt.Errorf("failed to load PEM data")`
28	`}`
29	`key, err := x509.ParsePKIXPublicKey(block.Bytes)`
30	`if err != nil {`
31	`return nil, err`
32	`}`
33	`pubKey, ok := key.(*rsa.PublicKey)`
34	`if !ok {`
35	`return nil, fmt.Errorf("public key is not RSA: %v", key)`
36	`}`
37	`return pubKey, nil`
38	`}`

318	`func (db Database) writeAttempt(batch leveldb.Batch, key, hash string, cfg *LockConfig) error {`
319	`var changed bool`
320
321	`if !cfg.IsEnabled() {`
322	`return nil`
323	`}`
324
325	`record, err := db.readRecord(key)`
326	`if err != nil {`
327	`return err`
328	`}`
329
330	`ts := time.Now().Unix()`
331
332	`// Remove expired attempts first`
333	`for hash, expiredAt := range record.Attempts {`
334	`if expiredAt < ts {`
335	`delete(record.Attempts, hash)`
336	`changed = true`
337	`}`
338	`}`
339
340	`// Write current attempt if not exist`
341	`if _, ok := record.Attempts[hash]; !ok {`
342	`if record.Attempts == nil {`
343	`record.Attempts = make(map[string]int64, 1)`
344	`}`
345
346	`record.Attempts[hash] = ts + cfg.Period`
347	`changed = true`
348	`}`
349
350	`// Remove lock if expired`
351	`if record.LockExpireAt != 0 && record.LockExpireAt < ts {`
352	`record.LockExpireAt = 0`
353	`changed = true`
354	`}`
355
356	`// Lock if no lock and attempts too much`
357	`if record.LockExpireAt == 0 && len(record.Attempts) >= cfg.Attempts {`
358	`record.LockExpireAt = ts + cfg.Timeout`
359	`changed = true`
360	`}`
361
362	`// Write changes if needed`
363	`if changed {`
364	`db.writeRecord(batch, key, &record)`
365	`}`
366
367	`return nil`
368	`}`

63	`func LoadLicense(r io.Reader) (License, error) {`
64	`var lic License`
65	`b, err := ioutil.ReadAll(r)`
66	`if err != nil {`
67	`return lic, err`
68	`}`
69	`err = json.Unmarshal(b, &lic)`
70	`return lic, err`
71	`}`

128	`func (db *Database) CheckLock(ip string, user string) (LockStatus, error) {`
129	`if atomic.LoadInt64(&db.closed) != 0 {`
130	`return NoLock, ErrClosed`
131	`}`
132
133	`ts := time.Now().Unix()`
134
135	`var (`
136	`record Record`
137	`err error`
138	`lockStatus LockStatus`
139	`)`
140
141	`if db.cfg.UserLock.IsEnabled() && !db.usersWhitelist.In(user) {`
142	`record, err = db.readRecord(user)`
143	`if err != nil {`
144	`return NoLock, fmt.Errorf("read user record: %v", err)`
145	`}`
146	`if record.LockExpireAt >= ts {`
147	`lockStatus \|= UserLock`
148	`}`
149	`}`
150
151	`if db.cfg.IPLock.IsEnabled() && ip != "" {`
152	`record, err = db.readRecord(ip)`
153	`if err != nil {`
154	`return NoLock, fmt.Errorf("read ip record: %v", err)`
155	`}`
156	`if record.LockExpireAt >= ts {`
157	`lockStatus \|= IPLock`
158	`}`
159	`}`
160
161	`if db.cfg.UserIPLock.IsEnabled() && ip != "" && !db.userIPWhitelist.In(user, ip) {`
162	`record, err = db.readRecord(ip + "/" + user)`
163	`if err != nil {`
164	`return NoLock, fmt.Errorf("read user/ip record: %v", err)`
165	`}`
166	`if record.LockExpireAt >= ts {`
167	`lockStatus \|= UserIPLock`
168	`}`
169	`}`
170
171	`return lockStatus, nil`
172	`}`

167	`func NewIPWhiteList(file string) (*IPWhiteList, error) {`
168	`if file == "" {`
169	`return nil, nil`
170	`}`
171
172	`var (`
173	`err error`
174	`fileNames []string`
175	`)`
176
177	`// Split file paths by ','`
178	`r := csv.NewReader(strings.NewReader(file))`
179	`r.Comma = ','`
180	`fileNames, err = r.Read()`
181	`if err != nil {`
182	`return nil, err`
183	`}`
184
185	`wl := &IPWhiteList{}`
186	`wl.WhiteList = NewWhiteList(fileNames, wl.reset, wl.loadLine)`
187	`return wl, err`
188	`}`

238	`func NewUserIPWhiteList(file string) *UserIPWhiteList {`
239	`if file == "" {`
240	`return nil`
241	`}`
242	`wl := &UserIPWhiteList{}`
243	`wl.WhiteList = NewWhiteList([]string{file}, wl.reset, wl.loadLine)`
244	`return wl`
245	`}`

124	`func NewUserWhiteList(file string) *UserWhiteList {`
125	`if file == "" {`
126	`return nil`
127	`}`
128
129	`wl := &UserWhiteList{}`
130	`wl.WhiteList = NewWhiteList([]string{file}, wl.reset, wl.loadLine)`
131	`return wl`
132	`}`

275	`func (db *Database) WriteAttempts(ip string, user string, hash string) error {`
276	`batch := new(leveldb.Batch)`
277
278	`if atomic.LoadInt64(&db.closed) != 0 {`
279	`return ErrClosed`
280	`}`
281
282	`db.lock.Lock()`
283	`defer db.lock.Unlock()`
284
285	`if user != "" {`
286	`err := db.writeAttempt(batch, user, hash, &db.cfg.UserLock)`
287	`if err != nil {`
288	`return fmt.Errorf("USER_LOCK: %v", err)`
289	`}`
290	`}`
291
292	`if ip != "" && ip != "127.0.0.1" {`
293	`err := db.writeAttempt(batch, ip, hash, &db.cfg.IPLock)`
294	`if err != nil {`
295	`return fmt.Errorf("IP_LOCK: %v", err)`
296	`}`
297	`}`
298
299	`if user != "" && ip != "" {`
300	`err := db.writeAttempt(batch, ip+"/"+user, hash, &db.cfg.UserIPLock)`
301	`if err != nil {`
302	`return fmt.Errorf("USER_IP_LOCK: %v", err)`
303	`}`
304	`}`
305
306	`if batch.Len() == 0 {`
307	`return nil`
308	`}`
309
310	`err := db.db.Write(batch, nil)`
311	`if err != nil {`
312	`return fmt.Errorf("batch write: %v", err)`
313	`}`
314
315	`return nil`
316	`}`

393	`func (db Database) writeRecord(batch leveldb.Batch, key string, record Record) {`
394	`if record.LockExpireAt == 0 && len(record.Attempts) == 0 {`
395	`batch.Delete([]byte(key))`
396	`}`
397	`batch.Put([]byte(key), record.Marshal())`
398
399	`log.WithField("record", record).Tracef("---[db]->> %v", key)`
400	`}`

30	`func DatabaseOpen(cfg Config) (db Database, err error) {`
31	`var database *leveldb.DB`
32
33	`path := filepath.Join(cfg.Database, "/leveldb")`
34	`database, err = leveldb.OpenFile(path, nil)`
35	`if err != nil {`
36	`return`
37	`}`
38
39	`db = &Database{`
40	`cfg: cfg,`
41	`path: path,`
42	`db: database,`
43	`stopExpireOld: make(chan bool, 1),`
44	`}`
45
46	`var nextExpire int64`
47	`nextExpire, err = db.expireOld()`
48	`if err == nil {`
49	`db.waitExpireOld.Add(1)`
50	`go db.serveExpireOld(nextExpire)`
51	`return`
52	`}`
53
54	`err = fmt.Errorf("expire old: %v", err)`
55	`_ = db.db.Close()`
56	`return nil, err`
57	`}`