....................................../////.===Hehe-Here===./////................................................ > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < ------------------------------------------------------------------------------------------------------------------- /////////////////////////////////////////////////////////////////////////////////////////////////////////////////// RIFF¤ WEBPVP8 ˜ ðÑ *ôô>‘HŸK¥¤"§£±¨àð enü¹%½_F‘åè¿2ºQú³íªú`N¿­3ÿƒügµJžaÿ¯ÿ°~¼ÎùnúîÞÖô•òíôÁÉß®Sm¥Ü/ ‡ó˜f£Ùà<˜„xëJ¢Ù€SO3x<ªÔ©4¿+ç¶A`q@Ì“Úñè™ÍÿJÌ´ª-˜ÆtÊÛL]Ïq*‘Ý”ì#ŸÌÏãY]@ê`¿ /ªfkØB4·®£ó z—Üw¥Pxù–ÞLШKÇN¾AkÙTf½è'‰g gÆv›Øuh~ a˜Z— ïj*á¥t d£“uÒ ¨`K˜¹ßþ]b>˜]_ÏÔ6W—è2r4x•íÖ…"ƒÖNîä!¦å Ú}ýxGøÌ —@ ;ÆÚŠ=ɾ1ý8lªË¥ô ^yf®Œ¢u&2©nÙÇ›ñÂñŒ³ aPo['½»øFùà­+4ê“$!lövlüÞ=;N®3ð‚õ›DÉKòÞ>ÄÍ ¥ˆuߤ#ˆ$6ù™¥îŠ‡y’ÍB¼ çxÛ;X"WL£R÷͝*ó-¶Zu}º.s¸sšXqù–DþÿvªhüïwyŸ ¯é³lÀ:KCûÄ£Ëá\…­ ~—ýóî ¼ûûÜTÓüÇy…ŽÆvc»¾×U ñ¸žþоP÷¦ó:Ò¨¨5;Ð#&#ÖúñläÿÁœ GxÉ­/ñ‡áQðìYÉtÒwŽ¼GÔ´zàÒò ð*ëzƒ•4~H]Ø‹f ñÓÈñ`NåWçs'ÆÏW^ø¹!XžµmQ5ÃËoLœÎ: ÞËÍ¥J ù…î èo£ßPÎñ¶ž8.Œ]ʵ~5›ÙË-ù*8ÙÖß±~ ©¹rÓê‚j¶d¸{^Q'˜±Crß ÚH—#¥¥QlÀ×ëã‡DÜ«èî þ&Çæžî;ŽÏºò6ÒLÃXy&ZŒ'j‚¢Ù€IßÚù+–MGi‰*jE€‘JcÜ ÓÌ EÏÚj]o˜ Þr <¾U ûŪæÍ/šÝH¥˜b”¼ ÁñßX GP›ï2›4WŠÏà×£…íÓk†¦H·ÅíMh–*nó÷à]ÁjCº€b7<ب‹¨5車bp2:Á[UªM„QŒçiNMa#<5›áËó¸HýÊ"…×Éw¹¦ì2º–x<›»a±¸3Weü®FÝ⑱ö–î–³|LPÈ~çð~Çå‡|º kD¢µÏàÆAI %1À% ¹Ò – ”ϝS¦‰4&¶£°à Öý”û_Ò Áw°A«Å€?mÇÛgHÉ/8)á¾ÛìáöŽP í¨PŸNÙµº¦‡§Ùš"ÿ«>+ªÕ`Ê÷‡‚ß Õû˜þãÇ-PÍ.¾XV‘€ dÜ"þ4¹ ±Oú‘©t¥¦FªÄÃÄ•b‚znýu½—#cDs˜ÃiÑOˆñ×QO=*IAÊ,¶ŽZƒ;‡wøXè%EÐk:F±Ú” .Ѽ+Áu&Ç`."pÈÉw o&¿dE6‘’EqTuK@Ì¥ã™À(Êk(h‰,H}RÀIXÛš3µ1©_OqÚÒJAñ$ÊÙÜ;D3çŒ[þùœh¬Ã³™ö6ç†NY".Ú‰ï[ªŸŒ '²Ð öø_¨ÂÉ9u鶳ÒŠõTàîMØ#û¯gN‡bÙ놚X„ö …ÉeüÌ^J ‹€.œ$Æ)βÄeæW#óüßĺŸ€ ÀzwV 9oä»f4V*uB «Ë†¹ì¯žR霓æHXa=&“I4K;¯ç‹h×·"UŠ~<•â•ªVêª&ÍSÃÆÅ?ÔqÎ*mTM ˜›µwêd#[C¡©§‘D<©àb†–ÁœøvH/,í:¯( ²£|4-„Æövv„Yͼ™^Á$ˆ„¢Û[6yB.åH*V¨æ?$=˜Ñ€•î¦ñ·­(VlŸ‘ nÀt8W÷´Bûba?q9ú¶Xƒl«ÿ\ù¶’þòUÐj/õ¢Ìµ³g$ƒÎR!¸»|Oߍë’BhîÚÑ¢ñåŒJ„®„£2Ð3•ô02Nt…!£Í]Ïc½Qÿ?ˆ<&ÃA¾Ú,JˆijÌ#5yz„‰Î|ÊŽ5QÏ:‹ÐaóVÔxW—CpeÏzÐïíçôÿÅ_[hãsÐ_/ŽTÝ?BîˆííV$<¿i>²F¬_Eß¿ †bÊŒº­ÿ®Z H“C}”¬,Mp ý/Bá£w>˜YV°aƒúh+cŠ- r/[%|üUMHäQ°X»|û/@|°¥Ð !BÔ Ç¢Ä©š+Õì D«7ìN¶ŽðÔ " ƶ’ÖçtA‰Û×}{tþz­¾GÍ›k¹OEJR$ Â׃ «ëÁ"oÉôž$oUK(Ä)Ãz³Ê-‹êN[Ò3Œñbï8P 4ƒ×q¢bo|?<ÛX¬òÄÍ°L–±›(™ûG?ýË©ÚÄ–ÂDØÐ_Ç¡ô ¾–ÄÏø ×e8Ë©$ÄF¹Å‹ì[©óìl:F¾f´‹‹Xì²ï®\¬ôùƒ ÿat¥óèÒùHß0äe‚;ü×h:ÆWðHž=Ã8骣"kœ'Y?³}Tûè€>?0l›e1Lòñ„aæKÆw…hÖŠùW…ÈÆÄ0ši·›[pcwËþñiêíY/~-Á5˜!¿†A›™Mÿþ(±“t@â“ö2­´TG5yé]çå僳 .·ÍïçÝ7UÚ±Ð/Nè»,_Ï ùdj7\ï Wì4›„»c¸àešg#ÒÊ⥭áØo5‘?ÌdÝô¯ ¹kzsƒ=´#ëÉK›Ø´±-¥eW?‡çßtòTã…$Ý+qÿ±ƒ÷_3Ô¥í÷:æ–ž<·Ö‡‰Å¢ š‡%Ô—utÌÈìðžgÖÀz²À—ï÷Óîäõ{K'´È÷³yaÏÁjƒô}ž§®æÊydÕÈë5¯èˆõvÕ©ã*çD„ “z„Ó‡^^xÂ3M§A´JG‚öï 3W'ˆ.OvXè¡ÊÕª?5º7†˜(˜Ç¶#çê’¶!ÌdZK§æ 0fãaN]òY³RV ™î$®K2R¨`W!1Ôó\;Ý ýB%qæK•&ÓÈe9È0êI±žeŸß -ú@žQr¦ ö4»M¼Áè¹µmw 9 EÆE_°2ó„ŸXKWÁ×Hóì^´²GѝF©óäR†¦‰ç"V»eØ<3ùd3ÿÚ¤Žú“Gi" —‘_ÙËÎ~Üö¯¥½Î»üŸEÚŽåmÞþí ;ÞólËΦMzA"Âf(´òá;Éï(/7½ûñÌ­cïÕçлþÝz¾-ÍvÑ“pH­–ðÓj$¸Äû¤‚‘ãUBË-n“2åPkS5&‹Â|+g^œ®Ì͆d!OïäîU«c;{Û!ÅŽ«ëZ9Ókóˆ]¯ƒ›né `ÇÒ+tÆš (ØKá¾—=3œ®•vuMñg²\ï Ec€ 05±d™‡×iÇ×›UúvÌ¢£Èþ¡ÕØô¶ßÎA"ß±#Ö²ˆÊŸ¦*Ä~ij|àø.-¼'»Ú¥£h ofº¦‡VsR=N½„Î v˜Z*SÌ{=jÑB‹tê…;’HžH¯8–îDù8ñ¢|Q•bÛçš–‹m³“ê¨ åÏ^m¬Žãþ©ïêO‡½6] µÆ„Ooòü ²x}N¦Ë3ïé¿»€›HA˜m%çÞ/¿í7Fø“‹léUk)É°Œµ8Q8›:ÀŠeT*šõ~ôڝG6 ¢}`ùH­–”¡k ‰P1>š†®9z11!X wKfmÁ¦xÑ,N1Q”–æB¶M…ÒÃv6SMˆhU¬ÊPŽï‘öj=·CŒ¯u¹ƒVIЃsx4’ömÛýc塶7ßŠß 57^\wÒÐÆ k§h,Œý î«q^R½3]J¸ÇðN ‚çU¬ôº^Áì} ³f©Õœ§ˆã:FÄÈ‚é(€™?àýÓüè1Gô£¼éj‚OÅñ  #>×—ßtà 0G¥Åa뀐kßhc™À_ÉñÞ#±)GD" YîäË-ÿÙ̪ ¹™a¯´¢E\ÝÒö‚;™„ë]_ p8‰o¡ñ+^÷ 3‘'dT4œŽ ðVë½° :¬víÑ«£tßÚS-3¶“þ2 †üüʨòrš¹M{É_¤`Û¨0ìjœøJ‡:÷ÃáZ˜†@GP&œÑDGÏs¡þ¦þDGú‘1Yá9Ôþ¼ ûø…§÷8&–ÜÑnÄ_m®^üÆ`;ÉVÁJ£?â€-ßê}suÍ2sõA NÌúA磸‘îÿÚ»ƒìö·á¿±tÑÐ"Tÿü˜[@/äj¬€uüªìù¥Ý˜á8Ý´sõj 8@rˆð äþZÇD®ÿUÏ2ùôõrBzÆÏÞž>Ì™xœ“ wiÎ×7_… ¸ \#€MɁV¶¥üÕÿPÔ9Z‡ø§É8#H:ƒ5ÀÝå9ÍIŒ5åKÙŠ÷qÄ>1AÈøžj"µÂд/ªnÀ qªã}"iŸBå˜ÓÛŽ¦…&ݧ;G@—³b¯“•"´4í¨ôM¨åñC‹ïùÉó¯ÓsSH2Ý@ßáM‡ˆKÀªÛUeø/4\gnm¥‹ŸŒ qÄ b9ÞwÒNÏ_4Ég³ú=܆‚´ •â¥õeíþkjz>éÚyU«Íӝ݃6"8/ø{=Ô¢»G¥ äUw°W«,ô—¿ãㆅү¢³xŠUû™yŒ (øSópÐ 9\åTâ»—*oG$/×ÍT†Y¿1¤Þ¢_‡ ¼ „±ÍçèSaÓ 3ÛMÁBkxs‰’R/¡¤ˆÙçª(*õ„üXÌ´ƒ E§´¬EF"Ù”R/ÐNyÆÂ^°?™6¡œïJ·±$§?º>ÖüœcNÌù¯G ‹ñ2ŠBB„^·úìaz¨k:#¨Æ¨8LÎõލ£^§S&cŒÐU€ü(‡F±Š¼&P>8ÙÁ ‰ p5?0ÊƃZl¸aô š¼¡}gÿ¶zÆC²¹¬ÎÖG*HB¡O<º2#ñŒAƒ–¡B˜´É$¥›É:FÀÔx¾u?XÜÏÓvN©RS{2ʈãk9rmP¼Qq̳ è¼ÐFׄ^¡Öì fE“F4A…!ì/…¦Lƒ… … $%´¾yã@CI¬ á—3PþBÏNÿ<ý°4Ü ËÃ#ØÍ~âW«rEñw‹eùMMHß²`¬Öó½íf³:‹k˜¯÷}Z!ã¿<¥,\#öµÀ¯aÒNÆIé,Ћ–lŽ#Àæ9ÀÒS·I’½-Ïp Äz¤Š Â* ­íÄ9­< h>׍3ZkËU¹§˜ŒŠ±f­’¤º³Q ÏB?‹#µíÃ¥®@(Gs«†vI¥Mµ‹Á©e~2ú³ÁP4ìÕi‚²Ê^ö@-DþÓàlÜOÍ]n"µã:žpsŽ¢:! Aõ.ç~ÓBûH÷JCÌ]õVƒd «ú´QÙEA–¯¯Œ!.ˆˆëQ±ù œ·Ì!Õâ )ùL„ÅÀlÚè5@B…o´Æ¸XÓ&Û…O«˜”_#‡ƒ„ûÈt!¤ÁÏ›ÎÝŠ?c9 â\>lÓÁVÄÑ™£eØY]:fÝ–—ù+p{™ðè û³”g±OƒÚSù£áÁÊ„ä,ï7š²G ÕÌBk)~ÑiCµ|h#u¤¶îK¨² #²vݯGãeÖ϶ú…¾múÀ¶þÔñ‚Š9'^($¤§ò “š½{éúp÷J›ušS¹áªCÂubÃH9™D™/ZöØÁ‡¦ÝÙŸ·kð*_”.C‹{áXó€‡c¡c€§/šò/&éš÷,àéJþ‰X›fµ“C¨œ®r¬"kL‰Â_q…Z–.ÉL~O µ›zn‚¹À¦Öª7\àHµšÖ %»ÇníV[¥*Õ;ƒ#½¾HK-ÖIÊdÏEÚ#=o÷Óò³´Š: Ç?{¾+9›–‘OEáU·S€˜j"ÄaÜ ŒÛWt› á–c#a»pÔZÞdŽtWê=9éöÊ¢µ~ ë ;Öe‡Œ®:bî3±ýê¢wà¼îpêñ¹¾4 zc¾ðÖÿzdêŒÑÒŝÀ‰s6¤í³ÎÙB¿OZ”+F¤á‡3@Ñëäg©·Ž ˆèª<ù@É{&S„œÕúÀA)‰h:YÀ5^ÂÓŒ°õäU\ ùËÍû#²?Xe¬tu‰^zÒÔãë¼ÛWtEtû …‚g¶Úüâî*moGè¨7%u!]PhÏd™Ý%Îx: VÒ¦ôÊD3ÀŽKÛËãvÆî…N¯ä>Eró–ð`5 Œ%u5XkñÌ*NU%¶áœÊ:Qÿú»“úzyÏ6å-၇¾ ´ ÒÊ]y žO‘w2Äøæ…H’²f±ÎÇ.ª|¥'gîV•Ü .̘¯€šòü¤U~Ù†*¢!?ò wý,}´°ÔÞnïoKq5µb!áÓ3"vAßH¡³¡·G(ÐÎ0Îò¼MG!/ài®@—¬04*`…«é8ªøøló“ˆÊ”èù¤…ßÊoÿé'ËuÌÖ5×È¡§ˆˆfŽë9}hìâ_!!¯  B&Ëö¶‰ÀAÙNVŸ Wh›¸®XÑJì¨ú“¿÷3uj²˜¨ÍÎìë±aúŠÝå¯ð*Ó¨ôJ“yºØ)m°WýOè68†ŸÏ2—‰Ïüꪫٚ¥‹l1 ø ÏÄFjêµvÌbü¦èÝx:X±¢H=MÐß—,ˆÉÇ´(9ú¾^ÅÚ4¿m‡$âX‘å%(AlZo@½¨UOÌÕ”1ø¸jÎÀÃÃ_ µ‘Ü.œº¦Ut: Æï’!=¯uwû#,“pþÇúŒø(é@?³ü¥‘Mo §—s@Œ#)§ŒùkL}NOÆêA›¸~r½¼ÙA—HJ«eˆÖ´*¡ÓpÌŸö.m<-"³ûÈ$¬_6­åf£ïÚâj1y§ÕJ½@dÞÁr&Í\Z%D£Íñ·AZ Û³øüd/ªAi†/Й~  ‡âĮҮÏh§°b—›Û«mJžòG'[ÈYýŒ¦9psl ýÁ ®±f¦x,‰½tN ‚Xª9 ÙÖH.«Lo0×?͹m¡å†Ѽ+›2ƒF ±Ê8 7Hցϓ²Æ–m9…òŸï]Â1äN†VLâCˆU .ÿ‰Ts +ÅÎx(%¦u]6AF Š ØF鈄‘ |¢¶c±soŒ/t[a¾–û:s·`i햍ê›ËchÈ…8ßÀUÜewŒðNOƒõD%q#éû\9¤x¹&UE×G¥ Í—™$ð E6-‡¼!ýpãÔM˜ Âsìe¯ñµK¢Ç¡ùôléœ4Ö£”À Š®Ðc ^¨À}ÙËŸ§›ºê{ÊuÉC ×Sr€¤’fÉ*j!úÓ’Gsùìoîßîn%ò· àc Wp÷$¨˜)û»H ×8ŽÒ€Zj¤3ÀÙºY'Ql¦py{-6íÔCeiØp‘‡XÊîÆUߢ܂ž£Xé¼Y8þ©ëgñß}é.ÎógÒ„ÃØËø¯»™§Xýy M%@NŠ À(~áÐvu7&•,Ù˜ó€uP‡^^®=_E„jt’ 403WebShell
403Webshell
Server IP : 159.198.67.129  /  Your IP : 216.73.216.244
Web Server : LiteSpeed
System : Linux server166.web-hosting.com 4.18.0-513.18.1.lve.el8.x86_64 #1 SMP Thu Feb 22 12:55:50 UTC 2024 x86_64
User : trooaisr ( 4033)
PHP Version : 7.4.33
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /opt/cpanel/ea-ruby27/src/passenger-release-6.1.2/src/agent/Core/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /opt/cpanel/ea-ruby27/src/passenger-release-6.1.2/src/agent/Core/SecurityUpdateChecker.h
/*
 *  Phusion Passenger - https://www.phusionpassenger.com/
 *  Copyright (c) 2017-2025 Asynchronous B.V.
 *
 *  "Passenger", "Phusion Passenger" and "Union Station" are registered
 *  trademarks of Asynchronous B.V.
 *
 *  Permission is hereby granted, free of charge, to any person obtaining a copy
 *  of this software and associated documentation files (the "Software"), to deal
 *  in the Software without restriction, including without limitation the rights
 *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 *  copies of the Software, and to permit persons to whom the Software is
 *  furnished to do so, subject to the following conditions:
 *
 *  The above copyright notice and this permission notice shall be included in
 *  all copies or substantial portions of the Software.
 *
 *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 *  THE SOFTWARE.
 */
#ifndef _PASSENGER_SECURITY_UPDATE_CHECKER_H_
#define _PASSENGER_SECURITY_UPDATE_CHECKER_H_

#include <string>
#include <boost/config.hpp>
#include <boost/scoped_ptr.hpp>
#include <oxt/thread.hpp>
#include <oxt/backtrace.hpp>

#include <SecurityKit/Crypto.h>
#include <ServerKit/llversion.h>
#include <ResourceLocator.h>
#include <Exceptions.h>
#include <StaticString.h>
#include <ConfigKit/ConfigKit.h>
#include <Utils/Curl.h>
#include <modp_b64.h>

#if BOOST_OS_MACOS
	#include <sys/syslimits.h>
	#include <unistd.h>
	#include <Availability.h>
	#ifndef __MAC_10_13
		#define __MAC_10_13 101300
	#endif
	#define PRE_HIGH_SIERRA (__MAC_OS_X_VERSION_MIN_REQUIRED < __MAC_10_13)
	#if !PRE_HIGH_SIERRA
		#include <openssl/err.h>
	#endif
#endif

namespace Passenger {

using namespace std;
using namespace oxt;


#define MIN_CHECK_BACKOFF_SEC (12 * 60 * 60)
#define MAX_CHECK_BACKOFF_SEC (7 * 24 * 60 * 60)

#if PRE_HIGH_SIERRA
// Password for the .p12 client certificate (because .p12 is required to be pwd protected on some
// implementations). We're OK with hardcoding because the certs are not secret anyway, and they're not used
// for client id/auth (just to easily deflect unrelated probes from the server endpoint).
#define CLIENT_CERT_PWD "p6PBhK8KtorrhMxHnH855MvF"
#define CLIENT_CERT_LABEL "Phusion Passenger Open Source"
#endif

#define POSSIBLE_MITM_RESOLUTION "(if this error persists check your connection security or try upgrading " SHORT_PROGRAM_NAME ")"

/**
 * If started, this class periodically (default: daily, immediate start) checks whether there are any important
 * security updates available (updates that don't fix security issues are not reported). The result is logged
 * (level 3:notice if no update, level 1:error otherwise), and all further action is left to the user (there is
 * no auto-update mechanism).
 */
class SecurityUpdateChecker {
public:
	/*
	 * BEGIN ConfigKit schema: Passenger::SecurityUpdateChecker::Schema
	 * (do not edit: following text is automatically generated
	 * by 'rake configkit_schemas_inline_comments')
	 *
	 *   certificate_path     string             -          -
	 *   disabled             boolean            -          default(false)
	 *   interval             unsigned integer   -          default(86400)
	 *   proxy_url            string             -          -
	 *   server_identifier    string             required   -
	 *   url                  string             -          default("https://securitycheck.phusionpassenger.com/v1/check.json")
	 *   web_server_version   string             -          -
	 *
	 * END
	 */
	class Schema: public ConfigKit::Schema {
	private:
		static void validateInterval(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
			unsigned int interval = config["interval"].asUInt();
			if (interval < MIN_CHECK_BACKOFF_SEC || interval > MAX_CHECK_BACKOFF_SEC) {
				errors.push_back(ConfigKit::Error("'{{interval}}' must be between " +
					toString(MIN_CHECK_BACKOFF_SEC) + " and " + toString(MAX_CHECK_BACKOFF_SEC)));
			}
		}

		static void validateProxyUrl(const ConfigKit::Store &config, vector<ConfigKit::Error> &errors) {
			if (config["proxy_url"].isNull()) {
				return;
			}
			if (config["proxy_url"].asString().empty()) {
				errors.push_back(ConfigKit::Error("'{{proxy_url}}', if specified, may not be empty"));
				return;
			}

			try {
				prepareCurlProxy(config["proxy_url"].asString());
			} catch (const ArgumentException &e) {
				errors.push_back(ConfigKit::Error(
					P_STATIC_STRING("'{{proxy_url}}': ")
					+ e.what()));
			}
		}

	public:
		Schema() {
			using namespace ConfigKit;

			add("disabled", BOOL_TYPE, OPTIONAL, false);
			add("url", STRING_TYPE, OPTIONAL, "https://securitycheck.phusionpassenger.com/v1/check.json");
			// Should be in the form: scheme://user:password@proxy_host:proxy_port
			add("proxy_url", STRING_TYPE, OPTIONAL);
			add("certificate_path", STRING_TYPE, OPTIONAL);
			add("interval", UINT_TYPE, OPTIONAL, 24 * 60 * 60);
			// Should be one of { nginx, apache, standalone nginx, standalone builtin }
			add("server_identifier", STRING_TYPE, REQUIRED);
			// The version of Nginx or Apache, if relevant (otherwise empty)
			add("web_server_version", STRING_TYPE, OPTIONAL);

			addValidator(validateInterval);
			addValidator(validateProxyUrl);

			finalize();
		}
	};

	struct ConfigRealization {
		CurlProxyInfo proxyInfo;
		string url;
		string certificatePath;

		ConfigRealization(const ConfigKit::Store &config)
			: proxyInfo(prepareCurlProxy(config["proxy_url"].asString())),
			  url(config["url"].asString()),
			  certificatePath(config["certificate_path"].asString())
			{ }

		void swap(ConfigRealization &other) BOOST_NOEXCEPT_OR_NOTHROW {
			proxyInfo.swap(other.proxyInfo);
			url.swap(other.url);
			certificatePath.swap(other.certificatePath);
		}
	};

	struct ConfigChangeRequest {
		boost::scoped_ptr<ConfigKit::Store> config;
		boost::scoped_ptr<ConfigRealization> configRlz;
	};

private:
	/*
	 * Since the security update checker runs in a separate thread,
	 * and the configuration can change while the checker is active,
	 * we make a copy of the current configuration at the beginning
	 * of each check.
	 */
	struct SessionState {
		ConfigKit::Store config;
		ConfigRealization configRlz;

		SessionState(const ConfigKit::Store &currentConfig,
			const ConfigRealization &currentConfigRlz)
			: config(currentConfig),
			  configRlz(currentConfigRlz)
			{ }
	};

	mutable boost::mutex configSyncher;
	ConfigKit::Store config;
	ConfigRealization configRlz;

	oxt::thread *updateCheckThread;
	string clientCertPath; // client cert (PKCS#12), checked by server
	string serverPubKeyPath; // for checking signature
	Crypto crypto;

	void threadMain() {
		TRACE_POINT();
		// Sleep for a short while to allow interruption during the Apache integration
		// double startup procedure, this prevents running the update check twice
		boost::this_thread::sleep_for(boost::chrono::seconds(2));
		while (!boost::this_thread::interruption_requested()) {
			UPDATE_TRACE_POINT();
			int backoffMin = 0;
			try {
				backoffMin = checkAndLogSecurityUpdate();
			} catch (const tracable_exception &e) {
				P_ERROR(e.what() << "\n" << e.backtrace());
			}

			UPDATE_TRACE_POINT();
			unsigned int checkIntervalSec;
			{
				boost::lock_guard<boost::mutex> l(configSyncher);
				checkIntervalSec = config["interval"].asUInt();
			}
			long backoffSec = checkIntervalSec + (backoffMin * 60);
			if (backoffSec < MIN_CHECK_BACKOFF_SEC) {
				backoffSec = MIN_CHECK_BACKOFF_SEC;
			}
			if (backoffSec > MAX_CHECK_BACKOFF_SEC) {
				backoffSec = MAX_CHECK_BACKOFF_SEC;
			}
			boost::this_thread::sleep_for(boost::chrono::seconds(backoffSec));
		}
	}


	void logUpdateFailCurl(const SessionState &sessionState, CURLcode code) {
		// At this point anything could be wrong, from unloadable certificates to server not found, etc.
		// Let's try to enrich the log message in case there are known solutions or workarounds (e.g. "use proxy").
		string error = curl_easy_strerror(code);

		switch (code) {
			case CURLE_SSL_CERTPROBLEM:
				error.append(" at " + clientCertPath + " (try upgrading or reinstalling " SHORT_PROGRAM_NAME ")");
				break;

			case CURLE_COULDNT_RESOLVE_HOST:
				error.append(" while connecting to " + sessionState.configRlz.url + " (check your DNS)");
				break;

			case CURLE_COULDNT_CONNECT:
				if (sessionState.config["proxy_url"].isNull()) {
					error.append(" for " + sessionState.configRlz.url + " " POSSIBLE_MITM_RESOLUTION);
				} else {
					error.append(" for " + sessionState.configRlz.url + " using proxy "
						+ sessionState.config["proxy_url"].asString() +
						" (if this error persists check your firewall and/or proxy settings)");
				}
				break;

			case CURLE_COULDNT_RESOLVE_PROXY:
				error.append(" for proxy address " + sessionState.config["proxy_url"].asString());
				break;

#if LIBCURL_VERSION_NUM < 0x073e00
			case CURLE_SSL_CACERT:
				// Peer certificate cannot be authenticated with given / known CA certificates. This would happen
				// for MITM but could also be a truststore issue.
#endif
			case CURLE_PEER_FAILED_VERIFICATION:
				// The remote server's SSL certificate or SSH md5 fingerprint was deemed not OK.
				error.append(" while connecting to " + sessionState.configRlz.url
					+ "; check that your connection is secure and that the"
					" truststore is valid. If the problem persists, you can also try upgrading"
					" or reinstalling " PROGRAM_NAME);
				break;

			case CURLE_SSL_CACERT_BADFILE:
				error.append(" while connecting to " + sessionState.configRlz.url + " ");
				if (!sessionState.config["proxy_url"].isNull()) {
					error.append("using proxy ");
					error.append(sessionState.config["proxy_url"].asString());
					error.append(" ");
				}
				error.append("; this might happen if the nss backend is installed for"
					" libcurl instead of GnuTLS or OpenSSL. If the problem persists, you can also try upgrading"
					" or reinstalling " PROGRAM_NAME);
				break;

			// Fallthroughs to default:
			case CURLE_SSL_CONNECT_ERROR:
				// A problem occurred somewhere in the SSL/TLS handshake. Not sure what's up, but in this case the
				// error buffer (printed in DEBUG) should pinpoint the problem slightly more.
			case CURLE_OPERATION_TIMEDOUT:
				// This is not a normal connect timeout, there are some refs to it occurring while downloading large
				// files, but we don't do that so fall through to default.
			default:
				error.append(" while connecting to " + sessionState.configRlz.url + " ");
				if (!sessionState.config["proxy_url"].isNull()) {
					error.append("using proxy ");
					error.append(sessionState.config["proxy_url"].asString());
					error.append(" ");
				}
				error.append(POSSIBLE_MITM_RESOLUTION);
				break;
		}

		logUpdateFail(error);

#if !(BOOST_OS_MACOS && PRE_HIGH_SIERRA)
		unsigned long cryptoErrorCode = ERR_get_error();
		if (cryptoErrorCode == 0) {
			logUpdateFailAdditional("CURLcode" + toString(code));
		} else {
			char buf[500];
			ERR_error_string(cryptoErrorCode, buf);
			logUpdateFailAdditional("CURLcode: " + toString(code) + ", Crypto: " + toString(cryptoErrorCode)
				+ " " + buf);
		}
#endif
	}

	void logUpdateFailHttp(const SessionState &sessionState, int httpCode) {
		string error;

		switch (httpCode) {
			case 404:
				error.append("url not found: " + sessionState.configRlz.url + " " POSSIBLE_MITM_RESOLUTION);
				break;
			case 403:
				error.append("request forbidden by server " POSSIBLE_MITM_RESOLUTION);
				break;
			case 503:
				error.append("server temporarily unavailable, try again later");
				break;
			case 429:
				error.append("rate limit hit for your IP, try again later");
				break;
			case 400:
				error.append("request corrupted or not understood " POSSIBLE_MITM_RESOLUTION);
				break;
			case 422:
				error.append("request content was corrupted or not understood " POSSIBLE_MITM_RESOLUTION);
				break;
			default:
				error = "HTTP " + toString(httpCode) + " while connecting to " + sessionState.configRlz.url
					+ " " POSSIBLE_MITM_RESOLUTION;
			break;
		}
		logUpdateFail(error);
	}

	void logUpdateFailResponse(string error, string responseData) {
		logUpdateFail("error in server response (" + error +
				"). If this error persists, check your connection security and try upgrading " SHORT_PROGRAM_NAME);
		logUpdateFailAdditional(responseData);
	}


	/**
	 * POST a bodyJsonString using a client certificate, and receive the response in responseData.
	 *
	 * May allocate chunk data for setting Content-Type, receiver should deallocate with curl_slist_free_all().
	 */
	CURLcode prepareCurlPOST(CURL *curl, SessionState &sessionState, const string &bodyJsonString,
		string *responseData, struct curl_slist **chunk)
	{
		CURLcode code;

		// Hint for advanced debugging: curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);

		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_URL, sessionState.configRlz.url.c_str()))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_HTTPGET, 0))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_POSTFIELDS, bodyJsonString.c_str()))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, bodyJsonString.length()))) {
			return code;
		}
		*chunk = curl_slist_append(NULL, "Content-Type: application/json");
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_HTTPHEADER, *chunk))) {
			return code;
		}

#if BOOST_OS_MACOS && PRE_HIGH_SIERRA
		// preauth the security update check key in the user's keychain (this is for libcurl's benefit because they don't bother to authorize themselves to use the keys they import)
		if (!crypto.preAuthKey(clientCertPath.c_str(), CLIENT_CERT_PWD, CLIENT_CERT_LABEL)) {
			return CURLE_SSL_CERTPROBLEM;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "P12"))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSLCERTPASSWD, CLIENT_CERT_PWD))) {
		 	return code;
		}
#else
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM"))) {
			return code;
		}
#endif

		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSLCERT, clientCertPath.c_str()))) {
			return code;
		}

		// These should be on by default, but make sure.
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L))) {
			return code;
		}

		// Technically we could use CURLOPT_SSL_VERIFYSTATUS to check for server cert revocation, but
		// we want to support older versions. We don't trust the server purely based on the server cert
		// anyway (it needs to prove by signature later on).

		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, receiveResponseBytes))) {
			return code;
		}
		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_WRITEDATA, responseData))) {
			return code;
		}
		if (CURLE_OK != (code = setCurlProxy(curl, sessionState.configRlz.proxyInfo))) {
			return code;
		}

		// setopt failure(s) below don't abort the check.
		curl_easy_setopt(curl, CURLOPT_TIMEOUT, 180);

		return CURLE_OK;
	}

	bool verifyFileReadable(char *filename) {
		FILE *fhnd = fopen(filename, "rb");
		if (fhnd == NULL) {
			return false;
		}
		fclose(fhnd);
		return true;
	}

	static size_t receiveResponseBytes(void *buffer, size_t size, size_t nmemb, void *userData) {
		string *responseData = (string *) userData;
		responseData->append((const char *) buffer, size * nmemb);
		return size * nmemb;
	}

public:
	// Dependencies
	ResourceLocator *resourceLocator;

	SecurityUpdateChecker(const Schema &schema, const Json::Value &initialConfig,
		const ConfigKit::Translator &translator = ConfigKit::DummyTranslator())
		: config(schema, initialConfig, translator),
		  configRlz(config),
		  updateCheckThread(NULL),
		  resourceLocator(NULL)
		{ }

	virtual ~SecurityUpdateChecker() {
		if (updateCheckThread != NULL) {
			updateCheckThread->interrupt_and_join();
			delete updateCheckThread;
		}
	}

	void initialize() {
		if (resourceLocator == NULL) {
			throw RuntimeException("resourceLocator must be non-NULL");
		}

		#if BOOST_OS_MACOS && PRE_HIGH_SIERRA
			clientCertPath = resourceLocator->getResourcesDir() + "/update_check_client_cert.p12";
		#else
			clientCertPath = resourceLocator->getResourcesDir() + "/update_check_client_cert.pem";
		#endif
		serverPubKeyPath = resourceLocator->getResourcesDir() + "/update_check_server_pubkey.pem";
	}

	/**
	 * Starts a periodic check, as dictated by the "interval" config option. For each check, the
	 * server may increase/decrease (within limits) the period until the next check (using the
	 * backoff parameter in the response).
	 *
	 * Assumes curl_global_init() was already performed.
	 */
	void start() {
		updateCheckThread = new oxt::thread(
			boost::bind(&SecurityUpdateChecker::threadMain, this),
			"Security update checker",
			1024 * 512
		);
	}

	/**
	 * All error log methods eventually lead here, except for the additional below.
	 */
	virtual void logUpdateFail(string error) {
		unsigned int checkIntervalSec;
		{
			boost::lock_guard<boost::mutex> l(configSyncher);
			checkIntervalSec = config["interval"].asUInt();
		}
		P_ERROR("Security update check failed: " << error << " (next check in "
			<< (checkIntervalSec / (60*60)) << " hours)");
	}

	/**
	 * Logs additional information at a lower loglevel so that it only spams when explicitely requested via loglevel.
	 */
	virtual void logUpdateFailAdditional(string additional) {
		P_DEBUG(additional);
	}

	virtual void logUpdateSuccess(int update, string success) {
		if (update == 0) {
			P_NOTICE(success);
		} else {
			P_ERROR(success);
		}
	}

	virtual void logUpdateSuccessAdditional(string additional) {
		P_ERROR(additional);
	}

	virtual CURLcode sendAndReceive(CURL *curl, string *responseData, long *responseCode) {
		CURLcode code;
		if (CURLE_OK != (code = curl_easy_perform(curl))) {
			return code;
		}
		return curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, responseCode);
	}

	virtual bool fillNonce(string &nonce) {
		return crypto.generateAndAppendNonce(nonce);
	}

	/**
	 * Sends POST to the configured URL (via SSL, with client cert) containing:
	 * {"version":"<passenger version>", "nonce":"<random nonce>"}
	 * The response will be:
	 * {"data":base64(data), "signature":base64(signature)}, where:
	 * - signature should be from server we trust and match base64(data),
	 * - data is {"nonce":"<reflected>", "update":0 or 1, "version":"<version>", "log": "<log msg>", "backoff":"<backoff>"}
	 * - reflected nonce should match what we POSTed
	 * - if update is 1 then <version> is logged as the recommended version to upgrade to
	 * - <log msg> (if present) is written to the log
	 * - <backoff> (minutes) is added to our default next check time
	 */
	int checkAndLogSecurityUpdate() {
		int backoffMin = 0;

		// 0. Copy current configuration
		boost::unique_lock<boost::mutex> l(configSyncher);
		SessionState sessionState(config, configRlz);
		l.unlock();

		if (sessionState.config["disabled"].asBool()) {
			P_INFO("Security update checking disabled; skipping check");
			return backoffMin;
		}

		// 1. Assemble data to send
		Json::Value bodyJson;

		bodyJson["passenger_version"] = PASSENGER_VERSION;

		bodyJson["server_integration"] = sessionState.config["server_identifier"];

		if (bodyJson["server_integration"].asString() == "standalone" &&
			sessionState.config["web_server_version"].isNull()) {
			P_INFO("Config web server version was Null while using standalone integration, assuming builtin engine.");
			bodyJson["server_version"] = llhttp_version();
		}else {
			bodyJson["server_version"] = sessionState.config["web_server_version"];
		}

		bodyJson["curl_static"] = isCurlStaticallyLinked();

		string nonce;
		if (!fillNonce(nonce)) {
			logUpdateFail("fillNonce() error");
			return backoffMin;
		}
		bodyJson["nonce"] = nonce; // against replay attacks

		// 2. Send and get response
		CURL *curl = curl_easy_init();
		if (curl == NULL) {
			logUpdateFail("curl_easy_init() error");
			return backoffMin;
		}

		struct curl_slist *chunk = NULL;
		char *signatureChars = NULL;
		char *dataChars = NULL;
		do { // for resource cleanup
			string responseData;
			long responseCode;
			CURLcode code;

			if (!verifyFileReadable(const_cast<char *>(clientCertPath.c_str()))) {
				logUpdateFail("File not readable: " + clientCertPath);
				break;
			}

			if (CURLE_OK != (code = setCurlDefaultCaInfo(curl))) {
				logUpdateFailCurl(sessionState, code);
				break;
			}

			if (!sessionState.configRlz.certificatePath.empty()) {
				curl_easy_setopt(curl, CURLOPT_CAINFO, sessionState.configRlz.certificatePath.c_str());
			}

			string bodyJsonString = bodyJson.toStyledString();
			if (CURLE_OK != (code = prepareCurlPOST(curl, sessionState, bodyJsonString,
				&responseData, &chunk)))
			{
				logUpdateFailCurl(sessionState, code);
				break;
			}

			P_DEBUG("sending: " << bodyJsonString);
			if (CURLE_OK != (code = sendAndReceive(curl, &responseData, &responseCode))) {
				logUpdateFailCurl(sessionState, code);
				break;
			}

			// 3a. Verify response: HTTP code
			if (responseCode != 200) {
				logUpdateFailHttp(sessionState, (int) responseCode);
				break;
			}

			Json::Reader reader;
			Json::Value responseJson;
			if (!reader.parse(responseData, responseJson, false)) {
				logUpdateFailResponse("json parse", responseData);
				break;
			}
			P_DEBUG("received: " << responseData);

			// 3b. Verify response: signature
			if (!responseJson.isObject() || !responseJson["data"].isString() || !responseJson["signature"].isString()) {
				logUpdateFailResponse("missing response fields", responseData);
				break;
			}

			string signature64 = responseJson["signature"].asString();
			string data64 = responseJson["data"].asString();

			signatureChars = (char *)malloc(modp_b64_decode_len(signature64.length()));
			dataChars = (char *)malloc(modp_b64_decode_len(data64.length()) + 1);
			if (signatureChars == NULL || dataChars == NULL) {
				logUpdateFailResponse("out of memory", responseData);
				break;
			}
			int signatureLen;
			signatureLen = modp_b64_decode(signatureChars, signature64.c_str(), signature64.length());
			if (signatureLen <= 0) {
				logUpdateFailResponse("corrupted signature", responseData);
				break;
			}

			if (!crypto.verifySignature(serverPubKeyPath, signatureChars, signatureLen, data64)) {
				logUpdateFailResponse("untrusted or forged signature", responseData);
				break;
			}

			// 3c. Verify response: check required fields, nonce
			int dataLen;
			dataLen = modp_b64_decode(dataChars, data64.c_str(), data64.length());
			if (dataLen <= 0) {
				logUpdateFailResponse("corrupted data", data64.c_str());
				break;
			}
			dataChars[dataLen] = '\0';

			Json::Value responseDataJson;
			if (!reader.parse(dataChars, responseDataJson, false)) {
				logUpdateFailResponse("unparseable data", dataChars);
				break;
			}
			P_DEBUG("data content (signature OK): " << responseDataJson.toStyledString());

			if (!responseDataJson.isObject() || !responseDataJson["update"].isInt() || !responseDataJson["nonce"].isString()) {
				logUpdateFailResponse("missing data fields", responseData);
				break;
			}

			if (nonce != responseDataJson["nonce"].asString()) {
				logUpdateFailResponse("nonce mismatch, possible replay attack", responseData);
				break;
			}

			// 4. The main point: is there an update, and when is the next check?
			int update = responseDataJson["update"].asInt();

			if (responseDataJson["backoff"].isInt()) {
				backoffMin = responseDataJson["backoff"].asInt();
			}

			if (update == 1 && !responseDataJson["version"].isString()) {
				logUpdateFailResponse("update available, but version field missing", responseData);
				break;
			}

			if (update == 0) {
				unsigned int checkIntervalSec;
				{
					boost::lock_guard<boost::mutex> l(configSyncher);
					checkIntervalSec = config["interval"].asUInt();
				}
				logUpdateSuccess(update, "Security update check: no update found (next check in "
					+ toString(checkIntervalSec / (60*60)) + " hours)");
			} else {
				logUpdateSuccess(update, "A security update is available for your version (" PASSENGER_VERSION
					") of " PROGRAM_NAME ". We strongly recommend upgrading to version " +
					responseDataJson["version"].asString() + ".");
			}

			// 5. Shown independently of whether there is an update so that the server can provide general warnings
			// (e.g. about server-side detected MITM attack)
			if (responseDataJson["log"].isString()) {
				string additional = responseDataJson["log"].asString();
				if (additional.length() > 0) {
					logUpdateSuccessAdditional("Additional security update check information: " + additional);
				}
			}
		} while (false);

#if BOOST_OS_MACOS && PRE_HIGH_SIERRA
		// remove the security update check key from the user's keychain so that if we are stopped/crash and are upgraded or reinstalled before restarting we don't have permission problems
		crypto.killKey(CLIENT_CERT_LABEL);
#endif

		if (signatureChars) {
			free(signatureChars);
		}
		if (dataChars) {
			free(dataChars);
		}
		curl_slist_free_all(chunk);
		curl_easy_cleanup(curl);

		return backoffMin;
	}

	bool prepareConfigChange(const Json::Value &updates,
		vector<ConfigKit::Error> &errors, ConfigChangeRequest &req)
	{
		{
			boost::lock_guard<boost::mutex> l(configSyncher);
			req.config.reset(new ConfigKit::Store(config, updates, errors));
		}
		if (errors.empty()) {
			req.configRlz.reset(new ConfigRealization(*req.config));
		}
		return errors.empty();
	}

	void commitConfigChange(ConfigChangeRequest &req) BOOST_NOEXCEPT_OR_NOTHROW {
		boost::lock_guard<boost::mutex> l(configSyncher);
		config.swap(*req.config);
		configRlz.swap(*req.configRlz);
	}

	Json::Value inspectConfig() const {
		boost::lock_guard<boost::mutex> l(configSyncher);
		return config.inspect();
	}
};

} // namespace Passenger

#endif /* _PASSENGER_SECURITY_UPDATE_CHECKER_H_ */

Youez - 2016 - github.com/yon3zu
LinuXploit