1 # ruff: noqa: B019 https://docs.astral.sh/ruff/rules/cached-instance-method/
2 import os.path
3 import ssl
4 from collections import namedtuple
5 from functools import lru_cache
6
7 from pcs import settings
8 from pcs.common.validate import is_integer, is_port_number
9
10 try:
11 from pcs.daemon.app import webui
12 except ImportError:
13 webui = None
14
15 # Relative location instead of system location is used for development purposes.
16 LOCAL_PUBLIC_DIR = os.path.realpath(
17 os.path.dirname(os.path.abspath(__file__)) + "/../../pcsd/public"
18 )
19 LOCAL_WEBUI_DIR = os.path.join(LOCAL_PUBLIC_DIR, "ui")
20 WEBUI_FALLBACK_FILE = "ui_instructions.html"
21
22 PCSD_PORT = "PCSD_PORT"
23 PCSD_SSL_CIPHERS = "PCSD_SSL_CIPHERS"
24 PCSD_SSL_OPTIONS = "PCSD_SSL_OPTIONS"
25 PCSD_BIND_ADDR = "PCSD_BIND_ADDR"
26 NOTIFY_SOCKET = "NOTIFY_SOCKET"
27 PCSD_DEBUG = "PCSD_DEBUG"
28 PCSD_SESSION_LIFETIME = "PCSD_SESSION_LIFETIME"
29 PCSD_DEV = "PCSD_DEV"
30 WEBUI_DIR = "WEBUI_DIR"
31 WEBUI_FALLBACK = "WEBUI_FALLBACK"
32 PCSD_WORKER_COUNT = "PCSD_WORKER_COUNT"
33 PCSD_WORKER_RESET_LIMIT = "PCSD_WORKER_RESET_LIMIT"
34 PCSD_MAX_WORKER_COUNT = "PCSD_MAX_WORKER_COUNT"
35 PCSD_DEADLOCK_THRESHOLD_TIMEOUT = "PCSD_DEADLOCK_THRESHOLD_TIMEOUT"
36 PCSD_CHECK_INTERVAL_MS = "PCSD_CHECK_INTERVAL_MS"
37 PCSD_TASK_ABANDONED_TIMEOUT = "PCSD_TASK_ABANDONED_TIMEOUT"
38 PCSD_TASK_UNRESPONSIVE_TIMEOUT = "PCSD_TASK_UNRESPONSIVE_TIMEOUT"
39 PCSD_TASK_DELETION_TIMEOUT = "PCSD_TASK_DELETION_TIMEOUT"
40
41 Env = namedtuple(
42 "Env",
43 [
44 PCSD_PORT,
45 PCSD_SSL_CIPHERS,
46 PCSD_SSL_OPTIONS,
47 PCSD_BIND_ADDR,
48 NOTIFY_SOCKET,
49 PCSD_DEBUG,
50 PCSD_SESSION_LIFETIME,
51 WEBUI_DIR,
52 WEBUI_FALLBACK,
53 PCSD_DEV,
54 PCSD_WORKER_COUNT,
55 PCSD_WORKER_RESET_LIMIT,
56 PCSD_MAX_WORKER_COUNT,
57 PCSD_DEADLOCK_THRESHOLD_TIMEOUT,
58 PCSD_CHECK_INTERVAL_MS,
59 PCSD_TASK_ABANDONED_TIMEOUT,
60 PCSD_TASK_UNRESPONSIVE_TIMEOUT,
61 PCSD_TASK_DELETION_TIMEOUT,
62 "has_errors",
63 ],
64 )
65
66
67 def prepare_env(environ, logger=None):
68 loader = EnvLoader(environ)
69 loader.check_webui()
70 env = Env(
71 loader.port(),
72 loader.ssl_ciphers(),
73 loader.ssl_options(),
74 loader.bind_addresses(),
75 loader.notify_socket(),
76 loader.pcsd_debug(),
77 loader.session_lifetime(),
78 loader.webui_dir(),
79 loader.webui_fallback(),
80 loader.pcsd_dev(),
81 loader.pcsd_worker_count(),
82 loader.pcsd_worker_reset_limit(),
83 loader.pcsd_max_worker_count(),
84 loader.pcsd_deadlock_threshold_timeout(),
85 loader.pcsd_check_interval_ms(),
86 loader.pcsd_task_abandoned_timeout(),
87 loader.pcsd_task_unresponsive_timeout(),
88 loader.pcsd_task_deletion_timeout(),
89 loader.has_errors(),
90 )
91 if logger:
92 for error in loader.errors:
93 logger.error(error)
94 for warning in loader.warnings:
95 logger.warning(warning)
96 return env
97
98
99 def str_to_ssl_options(ssl_options_string, reports):
100 ssl_options = 0
101 # We are tolerant to trailing whitespaces and trailing comas.
102 raw_ssl_options = ssl_options_string.strip(" ,")
103 if not raw_ssl_options: # raw_ssl_options.split(",") == [""]
104 return ssl_options
105 for raw_option in raw_ssl_options.split(","):
106 option = raw_option.strip()
107 if option == "OP_NO_RENEGOTIATION" and not hasattr(ssl, option):
108 # OP_NO_RENEGOTIATION is for a prevention of DoS attacks.
109 # See https://bugzilla.redhat.com/show_bug.cgi?id=1566430
110 #
111 # OP_NO_RENEGOTIATION is new in python 3.7. `pcs` supports python
112 # 3.6+ but even with python 3.6 it is possible to use this option if
113 # the underlying openssl has version 1.1.0h+.
114 ssl_options |= 1073741824
115 elif option.startswith("OP_") and hasattr(ssl, option):
116 ssl_options |= getattr(ssl, option)
117 else:
118 reports.append(f"Ignoring unknown SSL option '{option}'")
119 return ssl_options
120
121
122 class EnvLoader:
123 def __init__(self, environ):
124 self.environ = environ
125 self.errors = []
126 self.warnings = []
127
128 def has_errors(self):
129 return len(self.errors) > 0
130
131 @lru_cache(maxsize=5)
132 def port(self):
133 port = self.environ.get(PCSD_PORT, settings.pcsd_default_port)
134 if not is_port_number(port):
135 self.errors.append(f"Invalid port number '{port}', use 1..65535")
136 return port
137
138 def ssl_ciphers(self):
139 ssl_ciphers = self.environ.get(
140 PCSD_SSL_CIPHERS, settings.default_ssl_ciphers
141 )
142 try: # validate ciphers
|
CID (unavailable; MK=522facae9245118cb5e6d8bf6b642485) (#1 of 1): Certificate verification disabled (SIGMA.certificate_verification_disabled): |
|
(1) Event Sigma main event: |
Certificate validation has been disabled for the `ssl.SSLContext` instance. This allows for the acceptance of a rogue certificate and the potential for a manipulator-in-the-middle (MITM) attack. |
|
(2) Event remediation: |
Modify the `ssl.SSLContext` instance to enable certificate validation: * Explicitly set `ssl.SSLContext.verify_mode` to `ssl.CERT_REQUIRED` or set `ssl.SSLContext.check_hostname` to `True` as enabling `check_hostname` will automatically change the default from `CERT_NONE` to `CERT_REQUIRED`. * Explicitly set `protocol` to `ssl.PROTOCOL_TLS_SERVER` or `ssl.PROTOCOL_TLS_CLIENT`. |
143 ssl.SSLContext().set_ciphers(ssl_ciphers)
144 except ssl.SSLError as e:
145 self.errors.append(f"Invalid ciphers: '{e}'")
146 return ssl_ciphers
147
148 def ssl_options(self):
149 if PCSD_SSL_OPTIONS in self.environ:
150 # User knows about underlying system. If there is a wrong option it
151 # may be a typo - let them correct it. They are able to correct it
152 # in pcsd.conf.
153 return str_to_ssl_options(
154 self.environ[PCSD_SSL_OPTIONS], self.errors
155 )
156 # Vanilla pcsd should run even on an "exotic" system. If there is
157 # a wrong option it is not probably a typo... User should not be
158 # forced to modify source code (settings.py).
159 return str_to_ssl_options(settings.default_ssl_options, self.warnings)
160
161 def bind_addresses(self):
162 if PCSD_BIND_ADDR not in self.environ:
163 return {None}
164
165 raw_bind_addresses = self.environ[PCSD_BIND_ADDR]
166 if not raw_bind_addresses.strip():
167 return {""}
168
169 return {a.strip() for a in raw_bind_addresses.split(",")}
170
171 def notify_socket(self):
172 return self.environ.get(NOTIFY_SOCKET, None)
173
174 def session_lifetime(self):
175 session_lifetime = self.environ.get(
176 PCSD_SESSION_LIFETIME, settings.gui_session_lifetime_seconds
177 )
178 try:
179 return int(session_lifetime)
180 except ValueError:
181 self.errors.append(
182 f"Invalid PCSD_SESSION_LIFETIME value '{session_lifetime}'"
183 " (it must be an integer)"
184 )
185 return session_lifetime
186
187 def pcsd_debug(self):
188 return self.__has_true_in_environ(PCSD_DEBUG)
189
190 def check_webui(self):
191 if webui and not (
192 os.path.exists(self.webui_dir())
193 or os.path.exists(self.webui_fallback())
194 ):
195 self.errors.append(
196 f"Webui assets directory '{self.webui_dir()}'"
197 + f" or fallback html '{self.webui_fallback()}' does not exist"
198 )
199
200 @lru_cache(maxsize=5)
201 def webui_dir(self):
202 return LOCAL_WEBUI_DIR if self.pcsd_dev() else settings.pcsd_webui_dir
203
204 @lru_cache(maxsize=5)
205 def webui_fallback(self):
206 return os.path.join(
207 LOCAL_PUBLIC_DIR if self.pcsd_dev() else settings.pcsd_public_dir,
208 WEBUI_FALLBACK_FILE,
209 )
210
211 @lru_cache(maxsize=5)
212 def pcsd_dev(self):
213 return self.__has_true_in_environ(PCSD_DEV)
214
215 def _get_positive_int(self, key: str, default: int) -> int:
216 value = self.environ.get(key, default)
217 if not is_integer(value, at_least=1):
218 self.errors.append(
219 f"Value '{value}' for '{key}' is not a positive integer"
220 )
221 return default
222 return int(value)
223
224 def _get_non_negative_int(self, key: str, default: int) -> int:
225 value = self.environ.get(key, default)
226 if not is_integer(value, at_least=0):
227 self.errors.append(
228 f"Value '{value}' for '{key}' is not a non-negative integer"
229 )
230 return default
231 return int(value)
232
233 @lru_cache(maxsize=1)
234 def pcsd_worker_count(self) -> int:
235 return self._get_positive_int(
236 PCSD_WORKER_COUNT, settings.pcsd_worker_count
237 )
238
239 @lru_cache(maxsize=1)
240 def pcsd_worker_reset_limit(self) -> int:
241 return self._get_positive_int(
242 PCSD_WORKER_RESET_LIMIT, settings.pcsd_worker_reset_limit
243 )
244
245 @lru_cache(maxsize=1)
246 def pcsd_max_worker_count(self) -> int:
247 return self._get_positive_int(
248 PCSD_MAX_WORKER_COUNT,
249 self.pcsd_worker_count() + settings.pcsd_temporary_workers,
250 )
251
252 @lru_cache(maxsize=1)
253 def pcsd_deadlock_threshold_timeout(self) -> int:
254 return self._get_non_negative_int(
255 PCSD_DEADLOCK_THRESHOLD_TIMEOUT,
256 settings.pcsd_deadlock_threshold_timeout,
257 )
258
259 @lru_cache(maxsize=1)
260 def pcsd_check_interval_ms(self) -> int:
261 return self._get_positive_int(
262 PCSD_CHECK_INTERVAL_MS, settings.async_api_scheduler_interval_ms
263 )
264
265 @lru_cache(maxsize=1)
266 def pcsd_task_abandoned_timeout(self) -> int:
267 return self._get_positive_int(
268 PCSD_TASK_ABANDONED_TIMEOUT, settings.task_abandoned_timeout_seconds
269 )
270
271 @lru_cache(maxsize=1)
272 def pcsd_task_unresponsive_timeout(self) -> int:
273 return self._get_positive_int(
274 PCSD_TASK_UNRESPONSIVE_TIMEOUT,
275 settings.task_unresponsive_timeout_seconds,
276 )
277
278 @lru_cache(maxsize=1)
279 def pcsd_task_deletion_timeout(self) -> int:
280 return self._get_non_negative_int(
281 PCSD_TASK_DELETION_TIMEOUT, settings.task_deletion_timeout_seconds
282 )
283
284 def __has_true_in_environ(self, environ_key):
285 return self.environ.get(environ_key, "").lower() == "true"
286