hI d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl
m Z ddl m
Z
ddlmZmZmZ dd lmZ dd
lmZ dd lmZ dd lmZmZ ee Z G d
dee Z dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
) defaultdict) getLogger)List)Malware) LicenseError) MessageType) MessageSink
MessageSourceexpect) get_results_iterable_expression)
MalwareHit)malware_response)FileTooLargeError
UploadFailurec e Zd Zd Zd Z eej d Zde fdZ
e d Z e de de
e fd Zd S )
MalwareResponsePluginc & K || _ || _ d S N)_loop_sink)selfloopsinks ]/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/malware_response.py
create_sourcez#MalwareResponsePlugin.create_source. s
c K || _ d S r )r )r r s r create_sinkz!MalwareResponsePlugin.create_sink2 s
r c K | |j }|t j j }|r | | d {V d S d S r )_collect_hashesfilesr MalwareResponseUNKNOWNlower_process_unknown_hash)r messagehashesunknown_hashess r process_message_malware_responsez6MalwareResponsePlugin.process_message_malware_response5 su %%gm44 ; C I I K KL =,,^<< < < < < < < < < < = =r r' c h K t j s t d dS | | }|D ]}t d| t j | d{V 9# t $ r(}t d|| Y d}~ dS d}~wt $ r&}t
d|| Y d}~d}~wt $ r t d| Y t $ r&}t d|| Y d}~d}~ww xY wdS )z
If there is no such file with given hash in database, Imunify360 Client
should upload file using API endpoint /api/v1/upload.
z)Sending unknown files to MRS is disabled.Nz"Unknown file %s. Uploading to MRS.z/Cannot upload the following files to MRS %r: %sz File %s uploading failed. %s.z#File %s not found, skipping upload.)
Config
SEND_FILESloggerinfo_get_orig_filesr upload_with_retriesr warningr errorFileNotFoundErrorr )r r'
orig_files orig_filees r r% z+MalwareResponsePlugin._process_unknown_hash< s KKC D D D F))&11
# N NI KK 1MMMMMMMM
N# N Ns6 A;;
D/ B((
D/5 C(D/ D/ D**D/c t t }| D ]2\ }}|| | 3|S r )r setitemsr$ add)r! type_to_hash file_hash hash_types r r z%MalwareResponsePlugin._collect_hashes[ sW "3'' $)KKMM ; ; Iy ** + / / : : : :r returnc g }d }t || D ]M} | |j # t $ r# t d|j Y Jw xY w|S )Nc t j t j | S r )r
selectwherehashin_)r' s r
expressionz9MalwareResponsePlugin._get_orig_files..expressionf s/ $&&,,Z_-@-@-H-HII Ir z File %s not found, skipping.)r appendr5 r3 r- r1 )r' resultrE hits r r/ z%MalwareResponsePlugin._get_orig_filesb s J J J 3:vFF N NC
N
cm,,,,$
N
N
N =s}MMMMM
N
s 4*A! A!N)__name__
__module__ __qualname__r r r r r" r) r8 r% staticmethodr r strr/ r r r r - s VK '((= = )(= N# N N N N> \ S \ r r N) __doc__ collectionsr loggingr typingr defence360agent.contracts.configr r+ !defence360agent.contracts.licenser "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r
r defence360agent.utilsr imav.malwarelib.modelr
imav.malwarelib.utilsr &imav.malwarelib.utils.malware_responser r rI r- r rN r r r[ sa * $ # # # # # > > > > > > : : : : : : : : : : : :
B A A A A A , , , , , , 2 2 2 2 2 2
8 A A A A AK A A A A Ar