h* @ d Z ddlZddlZddlmZ ddlmZmZ ddlm Z ddl
m Z ddl m
Z
mZmZ ddlmZ dd lmZmZ dd
lmZ dd lmZmZ dd lm Z dd
l m Z ddl m Z ddl!m"Z" ddl#m$Z$ ee% Z& G d de
e Z' G d d Z( G d de' Z)dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) getLogger)OptionalUnion) HookEvent) MessageType) MessageSink
MessageSourceexpect)Scope)MalwareScanResourceTypeMalwareScanType) MalwareScan)ScanAlreadyCompleteError
ScanInfoErrorAiBolitDetachedScan)MDSDetachedScan)QueueSupervisorSync)aggregate_result)fill_results_ownerc : e Zd Zej j Zej Z d\ Z
Z i Z d Z
d Z eej d d Zd Zd Zed efd
Zdd Zed
eeee f fd Z eej d Z e d Z!d Z"d S )DetachedScanPlugin)NNc & K || _ || _ d S N)loopsink)selfr r s Z/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/detached_scan.py
create_sourcez DetachedScanPlugin.create_source= s c
K d S r )r r s r create_sinkz DetachedScanPlugin.create_sinkA s r T)
async_lockc K t | }|j s(| | d {V }||d d< |S |j r| | d {V S | | d {V S )Nsummarytotal_malicious)MalwareScanMessageInfo is_detached_count_total_malicious
is_summary_handle_summary_handle_results)r message message_typer' s r
complete_scanz DetachedScanPlugin.complete_scanD s -g66 ' 7$($?$?$H$H H H H H H HO4CGI 0 1N
$ 7 --g66666666 6 ))'222222222r c K |d d }|| j v rt j |d d< | j | |d< | | d {V }||d d< t j |d d }|r t j | | |d |r|j ni d {V |S )Nr& scanid completedresultsr' r2 )
results_cachetimepopr* r queuefindremove_call_scan_finished_hookargs)r r. scan_idr' queued_scans r r, z"DetachedScanPlugin._handle_summaryR s' )$X. d( ( (.2ikkGI { +!%!3!7!7!@!@GI $($?$?$H$H H H H H H HO4CGI 0 1-388 y)(3 9 K
>#)00===// " $KK$4$4
r c K | | d {V }t | }|d }t d t j |d }|j |r?|j d |d< |j d |d< t j | |
d s|
d r$d |d
< | |i d {V |S |d d }|d | j |< t | j }|d
k rt d| d S |j }|j |d< |j |d< |j |d< t% j |d< |
d
|j |d< |j |d< |
dd |d< ||d< | | d {V }||d d
< |r?|j d |d< |j d |d< t j | | ||r|j ni d {V |S )Nr& z Scan stoppedr2 r5
file_patternsexclude_patternspatherrorr r' ) scan_argsr4 z MalwareScan cache size is %dstartedr3 total_filestype)r r( loggerinfor r9 r: summary_from_dbr= r; getr< r6 lenrD r2 rC rG r7 total_resourcesrI r* ) r r. r/ r& r? r>
cache_sizescanr' s r r- z"DetachedScanPlugin._handle_resultsd s --g66666666-g66 )$ N###)/44GH+6+;O+L(.9.>&/*+ $)00==={{6""
gkk'&:&:
-.)*33Gr3JJJJJJJJJ i(2G*1)*z=DetachedScanPlugin._count_total_malicious.. s>
AqV9Q< -66 666r r4 )rN itemsr. s r r* z)DetachedScanPlugin._count_total_malicious sE
#I . 4 4 6 6
r Nc K t j |d |d |d |d |d |d | d | d rdnd |i d
| D d|d i
}| j | d {V | d {V d S ) Nr2 rI rC rG rH r' rD failedokc " i | ] \ }}|d v ||
S )) scan_time scan_time_hsscan_time_preg
smart_time_hssmart_time_preg finder_timecas_timedeobfuscate_timemem_peakr" )rW keyvalues r
z?DetachedScanPlugin._call_scan_finished_hook.. s@ "U
r )
r> scan_typerC rG rH r' rD status scan_paramsstats)r MalwareScanningFinishedrM r[ r process_message_recheck_scan_queue)r r& rE
scan_finisheds r r< z+DetachedScanPlugin._call_scan_finished_hook s !9H% fo I&
. #$5 6++g&& &{{7 3 3=88! &-mmoo " !'-"89#
< i''
666666666&&(((((((((((r
resource_typec t | S r r ru r> s r _get_detached_scanz%DetachedScanPlugin._get_detached_scan s #7+++r c , K | d }| d }| || } | d {V }n# t $ rO}t d|| Y d }~t
j t |j d d S d }~wt $ rZ}t d|j j
|| Y d }~t
j t |j d d S d }~ww xY w t
j t |j d n-# t
j t |j d w xY w| j | d {V d S )Nr> ru z ru
detached_scan scan_messageerrs r complete_detached_scanz)DetachedScanPlugin.complete_detached_scan s ++i(( O44
//
wGG
O!.!7!7!9!9999999LL' NN
FFF
M#m 899 N N N N N N LLN +1
FFF M#m 899 N N N N N N
&
M#m 899 N N N N NFM#m 899 N N N N Ni'' 55555555555sB A E
D) B3E 3
D 'D'E DE *E1c p K t |d |d< t |d d {V |S Nr4 )r r )clsr. s r r z#DetachedScanPlugin.aggregate_result sG -gi.@ A A !3444444444r c l K | j t j d {V d S r )r rr r MalwareScanQueueRecheckr s r rs z&DetachedScanPlugin._recheck_scan_queue s= i'' (K(M(MNNNNNNNNNNNr )rR N)#__name__
__module__ __qualname__r ProcessingOrderPRE_PROCESS_MESSAGEPROCESSING_ORDERr AVSCOPEr r r6 r r# r
r r r0 r, r- staticmethodintr* r< r r r r rx MalwareScanCompleter classmethodr rs r" r r r r 7 sl "2F HEJD$M
VK #555 3 3 65 3 $2 2 2h
\
) ) ) )D , c+B&B CD, , , \,
VK +,,6 6 -,6: [
O O O O Or r c Z e Zd ZdZd Zed Zed Zed ZdS )r( z_A helper class that allows to receive information about scan
from MalwareScan message.
c R || _ d | _ | j d d | _ d S )Nr& r2 )r. _summary_from_dbr> )r r. s r __init__z MalwareScanMessageInfo.__init__ s( $ |I.x8 r c | j d }| d t j t j t j d fv S )Nr& rI )r. rM r
ON_DEMAND
BACKGROUNDUSER)r r& s r r) z"MalwareScanMessageInfo.is_detached sA ,y){{6"" % & '
r c | j d d u S r r\ r s r r+ z!MalwareScanMessageInfo.is_summary s |I&$..r c | j s[t j t j | j k d }|r
|d | _ | j S )NrF r )r MalwareScanModelselectwherer2 r> limit)r rL s r rL z&MalwareScanMessageInfo.summary_from_db
sa $ ; '))'.$,>??q
;(7(:%$$r N) r r r __doc__r propertyr) r+ rL r" r r r( r( s~ 9 9 9
X
/ / X/ % % X % % %r r( c e Zd Zej Zedeee e
f fd Z e e
j d ZdS )DetachedScanPluginIm360ru c x | *t | t j u rt | S t | S r )r DBr r rw s r rx z*DetachedScanPluginIm360._get_detached_scan sC $ #M 2 2&)
*
* #7++ +"7+++r c b K t j |d }|rt j | t j |d |d |d }| j | d {V | d {V d S d S )Nr> r5 rI rC )r> rm rC ) r r9 r: r; r rq r rr rs )r r. r? scan_finished_events r complete_scan_dbz(DetachedScanPluginIm360.complete_scan_db% s )/44GIr s. *
" " " " " " " " ; ; ; ; ; ; : : : : : :
( ' ' ' ' ' B A A A A A > = = = = = J J J J J J = = = = = = > > > > > > 8 xO xO xO xO xOm xO xO xOv"% "% "% "% "% "% "% "%J- - - - - 0 - - - - -r