h d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z ddl m
Z
ddlmZ ddlmZ dd lmZmZ dd
lmZ ej e Z G d d e ZdS )
u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)suppress) MessageType)
MessageSource)MalwareScanType)parse_report_json)
ScanResult)InotifyWatcher) create_task_and_log_exceptionsc e Zd ZdZdZ ej d Zd Zd Z d Z
d Z d Z d e
d
efd Zd e
fd Zd
efdZd Zd Zd ZdS )AibolitResultsScanz
Plugin to handle generated ai-bolit scan reports.
Checks the contents of the *RESULT_SCAN_DIR* for the presence ai-bolit
report files that match the *REPORT_FILE_MASK* pattern
processes and deletes them.
z$/var/imunify360/aibolit/resident/outz!^(?P[0-9a-f-]{36})\.report$c " d | _ d | _ d S N)_watcher
_init_taskselfs `/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/aibolit_result_scan.py__init__zAibolitResultsScan.__init__3 s
c d K || _ || _ t | j | j | _ d S r )_loop_sinkr _init_handling_and_setup_watcherr )r loopsinks r
create_sourcez AibolitResultsScan.create_source7 s3
8 J=
r c K | j &| j | j d {V | d S r )r cancel_shutdown_watcherr s r shutdownzAibolitResultsScan.shutdown> sT ? & O " " $ $ $/ ! ! ! ! ! ! ! r c t j | j dd t | j | j | _ | j | j t j
d S )Ni T)modeexist_ok)
coro_callback)pathmask) osmakedirsRESULT_SCAN_DIRr
r _handle_incoming_reportr watchencoder MOVED_TOr s r _setup_watcherz!AibolitResultsScan._setup_watcherD s~
D(utDDDD Jd&B
%,,..W5E
r c J | j | j d S d S r )r closer s r r z$AibolitResultsScan._shutdown_watcherO s, = $ M ! ! ! ! ! % $r reportreturnc |d }d t | D }| d }t ||t j }| d |_ | dg |_ | d }| d }||z
}| || t | g|_ |S ) Nsummaryc g | ]
}|d S ) file_name ).0hits r
zCAibolitResultsScan._get_scan_result_from_report..U s FFFSK FFFr scan_id)r< scan_type total_fileserrors report_time scan_time) r getr r REALTIMEr> r? set_start_stopscans) r r2 report_summaryr& r< scan_resultend_timerA
start_times r _get_scan_result_from_reportz/AibolitResultsScan._get_scan_result_from_reportS s *FF,=f,E,EFFF $$Y// '_-E
#1"4"4]"C"C + / /" = = !%%m44"&&{33 )
"":x888 .v 6 6 7 r c K | | }| d {V }| j t j di | d {V d S # t j $ r t $ r9}t d || Y d }~d S d }~ww xY w)Nz:Error '{!r}' occurred while processing ai-bolit report: {}r8 )
rJ rB r process_messager MalwareScanto_dictasyncioCancelledError Exceptionlogger exceptionformat)r r2 rG resultexcs r _handle_reportz!AibolitResultsScan._handle_reportf s" ;;FCCK&??,,,,,,,,F*,,';;&..*:*:;;
% &&,fS&&9&9
s A0A6 6C.CCr& c K | j t j | }|r"t j | r t
| 5 }t j | }d d d n # 1 swxY w Y |d d|
d | | d {V n8# t j $ r&}t d|| Y d }~nd }~ww xY wt t 5 t j | d d d d S # 1 swxY w Y d S d S d S )Nr5 r< uuidz*Problem with parsing %s aibolit report: %s)REPORT_FILE_MASKmatchr( r& basenameisfileopenjsonload
setdefaultgrouprW JSONDecodeErrorrR warningr FileNotFoundErrorunlink)r r&
match_filefr2 rV s r handle_report_filez%AibolitResultsScan.handle_report_fileu s *001A1A$1G1GHH
"'....
2$ZZ *1 !Yq\\F* * * * * * * * * * * * * * * y!,, z / / 7 7 ))&1111111111 '
@$
+,,
$
sN C$ -B C$ BC$ BC$ $D3 DD0EEEc K t d| t j t j |j t j |j }| | d {V d S )NzInotify event: %s)rR infor( r& joinfsdecodenameri )r event report_files r r+ z*AibolitResultsScan._handle_incoming_report s{ '///gll K
# #R[%<%<
%%k22222222222r c K t j | j rZt j | j 5 }|D ]"}| |j d {V # d d d d S # 1 swxY w Y d S d S r )r( r& existsr* scandirri )r itentrys r _handle_existing_reportsz+AibolitResultsScan._handle_existing_reports s
7>>$. / / >D 011
>R > >E 11%*==========>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> > >s &A44A8;A8c f K | d {V | d S r )rv r/ r s r r z3AibolitResultsScan._init_handling_and_setup_watcher sB ++--------- r N)__name__
__module__ __qualname____doc__r* recompilerZ r r r! r/ r dictr rJ rW strri r+ rv r r8 r r r
r
( s =O!rz"FGG
! ! !
" " "4 J &
4
S $3 3 3> > > r r
)r{ rO r_ loggingr( r|
contextlibr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr imav.malwarelib.configr $imav.malwarelib.scan.ai_bolit.reportr imav.malwarelib.scan.scan_resultr imav.malwarelib.subsys.ainotifyr r
defence360agent.utilsr getLoggerrx rR r
r8 r r r s$ * : : : : : : ; ; ; ; ; ; 2 2 2 2 2 2 B B B B B B 7 7 7 7 7 7 < < < < < < < < @ @ @ @ @ @ 8 $ $n n n n n n n n n n r