hd d Z ddlmZ ddlZddlmZmZ ddlmZm Z ddl
m Z ddl m
Z
mZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZmZmZ dd
l m Z ddl m Z e
rddl m!Z! ee"e#e!f Z$ e e% Z& G d dee Z'dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
) annotationsN)CancelledErrorQueue) ExitStacksuppress) getLogger)
TYPE_CHECKINGList)
inactivity)Malware) LicenseError) MessageType) MessageSink
MessageSourceexpect)recurring_check)malware_response)MalwareMRSUploadc e Zd ZdZ ej d Zd Zd Zd Z d Z
dd Z e e
j d
Z ed d ZddZ e e
j dd ZdS ) MRSUploaderzFailed to submit a filez-(?:suspicious\..+|[CS]MW-SUS-.+|SMW-HEUR-ELF)c , t | _ d S N)r
_upload_queueselfs Y/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/mrs_uploader.py__init__zMRSUploader.__init__6 s ,1GG c ~ K || _ || _ | | | _ d S r )_sink_loop create_taskupload _upload_task)r loopsinks r
create_sourcezMRSUploader.create_source9 s8
, ,T[[]] ; ;r c
K d S r )r r% s r create_sinkzMRSUploader.create_sink> s r c K | j t t 5 | j d {V d d d d S # 1 swxY w Y d S r )r$ cancelr r r s r shutdownzMRSUploader.shutdownA s """
n
%
% $ $# # # # # # # # $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s A AAreturntuplec g }g }g }| D ]\ }}d}d}d} |d D ]_}
||
dd z }|t |
d o | j |
d z }| |
d z } `t j ||d } |r| | |r| | | r| | |||fS )NFhitsextended_suspicious
suspiciousmatcheshash)itemsgetbool SUSP_PATTERNmatchr HitInfoappend) r results maliciousr3 r2 filedatais_extended_suspicious
is_suspicious is_malicioushithit_infos r _separate_hits_by_typez"MRSUploader._separate_hits_by_typeF s;
!--// + +JD$%* " !M LF|
6
6&#''2G*O*OO& % @ )//I??" "
C $5 55 '/d6lCCH%
+#**84444
+!!(++++
+ ****&999r c K |d }|d S t j s t d d S | | \ }}}|r4| j t j |d d {V |r4| j t j |d d {V |r4| j t j |d d {V |d d }|rBd |D }| j t j |d
d {V d S d S ) Nr= z"Uploading files to MRS is disabledr> )r1
upload_reasonr3 zextended-suspicioussummaryerrorsc P g | ]#}t j |d |d $S )r? r5 )r r; .0rD s r
z,MRSUploader.process_scan.. s= !(Vc&kBB r
scan_error)
Config
SEND_FILESloggerinforF r process_messager r r7 )r messager= malicious_hitssuspicious_hitsextended_suspicious_hitsrJ
error_hitss r process_scanzMRSUploader.process_scan^ s )$ ? F KK< = = = F
' ' 0 0
$ *,,,'{
*,,,(
$ *,,,1"7
#''11 ! J *,,,#<
r r c \ K | j d {V \ }}|d }t j | j d |D | }d}t 5 }| | j j |2 3 d {V fd|D }|rXd} | ||| d {V 8# t j $ r%}t d| Y d }~gd }~ww xY wp6 d d d n # 1 swxY w Y |r t d d S d S )Nr1 c 3 $ K | ] }|j V d S r )r5 rL s r z%MRSUploader.upload.. s$ 22c222222r Tc 0 g | ]}|j v |j S r) )r5 r? )rM rD unknown_hashess r rN z&MRSUploader.upload.. s. !$N0J0JCH0J0J0Jr FzFailed to upload files: %sz1All files are known to MRS. Skipping uploading...)
r r7 r check_known_hashesr! r callback task_done
_upload_files
UploadFailurerR errorrS )
r rH rU r1 hashes_generator
no_new_hashesstackfileser_ s
@r r# zMRSUploader.upload s
$((** * * * * * *
07v+> J22T222M
[[ FE NN4-7 8 8 8(8
F
F
F
F
F
F
Fn (, F$)MF " 0 0
w O OOOOOOOOO+9 F F F %A1EEEEEEEEF F )9(8 F F F F F F F F F F F F F F F M KKK L L L L L M MsH #"DC5 D B=<D=C1 C,'D,C11DD
Dri list[str]rH strrU r c K t j d 5 |D ]} t j || d {V # t
$ r'}t d|| Y d }~ n[d }~wt $ rK}d | j
|j }t d||j Y d }~d }~ww xY wd d d d S # 1 swxY w Y d S )N
mrs_upload)rH z Cannot process message %s: %sz{}. {}z%s: %s)
r tracktaskr upload_with_retriesr
rR warningFileNotFoundErrorformatERR_MSGstrerrorfilename)r ri rH rU r? rj errs r rc zMRSUploader._upload_files sr
"
"<
0
0 > >
>
> >*> M $ NN#BGQOOOEEEEE( > > >"//$,
CCCNN8S!*========> > > > > > > > > > > > > > > > > > >sM C AC
C A1+C1
C >AC?CC CC C c n K | dd }| j ||f d S )NrH r3 )r7 r
put_nowait)r rU rH s r process_hitszMRSUploader.process_hits s; O\BB
%%}g&>?????r N)r. r/ )ri rk rH rl rU r )rU r )__name__
__module__ __qualname__ru recompiler9 r r' r* r- rF r r MalwareScanrZ r r# rc r r{ r) r r r r 2 s 'G 2: NOOL4 4 4< < <
$ $ $
: : : :0 VK #$$+ + %$+Z _QM M M8> > > > VK ())@ @ @ *)@ @ @r r )(__doc__
__future__r r asyncior r
contextlibr r loggingr typingr r
defence360agent.apir defence360agent.contracts.configr rP !defence360agent.contracts.licenser
"defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r r defence360agent.utilsr imav.malwarelib.utilsr imav.contracts.messagesr r/ rl
UploaderQueuer| rR r r) r r r s * # " " " " " ) ) ) ) ) ) ) ) * * * * * * * * & & & & & & & & * * * * * * > > > > > > : : : : : : : : : : : :
2 1 1 1 1 1 2 2 2 2 2 2 8888888%%5 567M 8 J@ J@ J@ J@ J@+} J@ J@ J@ J@ J@r