(only users with permission "a" or "A" can see this message)
' H_CONN_KEEPALIVE = "Connection: Keep-Alive" H_CONN_CLOSE = "Connection: Close" @@ -5625,7 +5626,13 @@ class HttpCli(object): no304=self.no304(), k304vis=self.args.k304 > 0, no304vis=self.args.no304 > 0, - msg=BADXFFB if hasattr(self, "bad_xff") else "", + msg=( + BADVER + if self.conn.hsrv.bad_ver and self.can_admin + else BADXFFB + if hasattr(self, "bad_xff") + else "" + ), ver=S_VERSION if show_ver else "", chpw=self.args.chpw and self.uname != "*", ahttps="" if self.is_https else "https://" + self.host + self.req, diff --git a/copyparty/httpsrv.py b/copyparty/httpsrv.py index ea89a0aa..a830f5c5 100644 --- a/copyparty/httpsrv.py +++ b/copyparty/httpsrv.py @@ -143,6 +143,7 @@ class HttpSrv(object): self.name = "hsrv" + nsuf self.mutex = threading.Lock() self.u2mutex = threading.Lock() + self.bad_ver = False self.stopping = False self.tp_nthr = 0 # actual @@ -239,6 +240,9 @@ class HttpSrv(object): except: pass + def set_bad_ver(self) -> None: + self.bad_ver = True + def set_netdevs(self, netdevs: dict[str, Netdev]) -> None: ips = set() for ip, _ in self.bound: diff --git a/copyparty/svchub.py b/copyparty/svchub.py index 929392f7..7b69afcd 100644 --- a/copyparty/svchub.py +++ b/copyparty/svchub.py @@ -4,6 +4,7 @@ from __future__ import print_function, unicode_literals import argparse import atexit import errno +import json import logging import os import re @@ -27,6 +28,7 @@ if True: # pylint: disable=using-constant-test from typing import Any, Optional, Union from .__init__ import ANYWIN, EXE, MACOS, PY2, TYPE_CHECKING, E, EnvParams, unicode +from .__version__ import S_VERSION, VERSION from .authsrv import BAD_CFG, AuthSrv, derive_args, n_du_who, n_ver_who from .bos import bos from .cert import ensure_cert @@ -75,6 +77,7 @@ from .util import ( mp, odfusion, pybin, + read_utf8, start_log_thrs, start_stackmon, termsize, @@ -95,6 +98,11 @@ if TYPE_CHECKING: if PY2: range = xrange # type: ignore +if PY2: + from urllib2 import Request, urlopen +else: + from urllib.request import Request, urlopen + VER_IDP_DB = 1 VER_SESSION_DB = 1 @@ -1382,6 +1390,8 @@ class SvcHub(object): Daemon(self.tcpsrv.netmon, "netmon") Daemon(self.thr_httpsrv_up, "sig-hsrv-up2") + if self.args.vc_url: + Daemon(self.check_ver, "ver-chk") sigs = [signal.SIGINT, signal.SIGTERM] if not ANYWIN: @@ -1778,3 +1788,79 @@ class SvcHub(object): zb = gzip.compress(zb) zs = ub64enc(zb).decode("ascii") self.log("stacks", zs) + + def check_ver(self) -> None: + next_chk = 0 + # self.args.vc_age = 2 / 60 + fpath = os.path.join(self.E.cfg, "vuln_advisory.json") + while not self.stopping: + now = time.time() + if now < next_chk: + time.sleep(min(999, next_chk - now)) + continue + + age = 0 + jtxt = "" + src = "[cache] " + try: + mtime = os.path.getmtime(fpath) + age = time.time() - mtime + if age < self.args.vc_age * 3600 - 69: + zs, jtxt = read_utf8(None, fpath, True).split("\n", 1) + if zs != self.args.vc_url: + jtxt = "" + except Exception as e: + t = "will download advisory because cache-file %r could not be read: %s" + self.log("ver-chk", t % (fpath, e), 6) + + if not jtxt: + src = "" + age = 0 + try: + req = Request(self.args.vc_url) + with urlopen(req, timeout=30) as f: + jtxt = f.read().decode("utf-8") + try: + with open(fpath, "wb") as f: + zs = self.args.vc_url + "\n" + jtxt + f.write(zs.encode("utf-8")) + except Exception as e: + t = "failed to write advisory to cache; %s" + self.log("ver-chk", t % (e,), 3) + except Exception as e: + t = "failed to fetch vulnerability advisory; %s" + self.log("ver-chk", t % (e,), 1) + + next_chk = time.time() + 699 + if not jtxt: + continue + + try: + advisories = json.loads(jtxt) + for adv in advisories: + if adv.get("state") == "closed": + continue + vuln = {} + for x in adv["vulnerabilities"]: + if x["package"]["name"].lower() == "copyparty": + vuln = x + break + if not vuln: + continue + sver = vuln["patched_versions"].strip(".v") + tver = tuple([int(x) for x in sver.split(".")]) + if VERSION < tver: + zs = json.dumps(adv, indent=2) + t = "your version (%s) has a vulnerability! please upgrade:\n%s" + self.log("ver-chk", t % (S_VERSION, zs), 1) + self.broker.say("httpsrv.set_bad_ver") + if self.args.vc_exit: + self.shutdown() + return + else: + t = "%sok; v%s and newer is safe" + self.log("ver-chk", t % (src, sver), 2) + next_chk = time.time() + self.args.vc_age * 3600 - age + except Exception as e: + t = "failed to process vulnerability advisory; %s" + self.log("ver-chk", t % (min_ex()), 1) diff --git a/docs/chungus.conf b/docs/chungus.conf index aea1fabf..e2742ca0 100644 --- a/docs/chungus.conf +++ b/docs/chungus.conf @@ -57,6 +57,15 @@ # show versions and exit version + + # url to check against for vulnerable versions (default disabled); setting this will enable automatic + # vulnerability checks. the notification, in case you are running a vulnerable version, is shown on the + # admin panel (/?h) and only for users with admin permissions. you can choose between the value given here, + # or alternatively use https://api.copyparty.eu/security-advisories, or your own custom endpoint + vc-url: https://api.github.com/repos/9001/copyparty/security-advisories + + # how many seconds to wait between vulnerability checks; default is 86400 (= 1 day). + vc-interval: 86400 ###000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\ ###// qr options \\000000000000000000000000000000000000000000000000000000000000000000000000000\