+^T~F d Z ddlmZ ddlZddlmZ ddlmZ ddlm Z ddl
m Z m Z ddl
mZ dd lmZ dd
lmZ dd lmZ dd lmZmZmZ dd
lmZm Z ddl m Z e rddl m Z ee!e"e f Z# e e$ Z% G d dee Z&dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
) annotationsN)Queue) ExitStack) getLogger)
TYPE_CHECKINGList)
inactivity)Malware) LicenseError) MessageType) MessageSink
MessageSourceexpect)recurring_checksafe_cancel_task)malware_response)MalwareMRSUploadc e Zd ZdZ ej d Zd Zd Zd Z d Z
dd Z e e
j d
Z ed d ZddZ e e
j dd ZdS ) MRSUploaderzFailed to submit a filez-(?:suspicious\..+|[CS]MW-SUS-.+|SMW-HEUR-ELF)c , t | _ d S N)r
_upload_queueselfs Y/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/mrs_uploader.py__init__zMRSUploader.__init__6 s ,1GG c ~ K || _ || _ | | | _ d S r )_sink_loop create_taskupload _upload_task)r loopsinks r
create_sourcezMRSUploader.create_source9 s8
, ,T[[]] ; ;r c
K d S r )r r$ s r create_sinkzMRSUploader.create_sink> s r c > K t | j d {V d S r )r r# r s r shutdownzMRSUploader.shutdownA s/ t 011111111111r returntuplec g }g }g }| D ]\ }}d}d}d} |d D ]_}
||
dd z }|t |
d o | j |
d z }| |
d z } `t j ||d } |r| | |r| | | r| | |||fS )NFhitsextended_suspicious
suspiciousmatcheshash)itemsgetbool SUSP_PATTERNmatchr HitInfoappend) r results maliciousr1 r0 filedatais_extended_suspicious
is_suspicious is_malicioushithit_infos r _separate_hits_by_typez"MRSUploader._separate_hits_by_typeD s;
!--// + +JD$%* " !M LF|
6
6&#''2G*O*OO& % @ )//I??" "
C $5 55 '/d6lCCH%
+#**84444
+!!(++++
+ ****&999r c K |d }|d S t j s t d d S | | \ }}}|r4| j t j |d d {V |r4| j t j |d d {V |r4| j t j |d d {V |d d }|rBd |D }| j t j |d
d {V d S d S ) Nr; z"Uploading files to MRS is disabledr< )r/
upload_reasonr1 zextended-suspicioussummaryerrorsc P g | ]#}t j |d |d $S )r= r3 )r r9 .0rB s r
z,MRSUploader.process_scan.. s= !(Vc&kBB r
scan_error)
Config
SEND_FILESloggerinforD r process_messager r r5 )r messager; malicious_hitssuspicious_hitsextended_suspicious_hitsrH
error_hitss r process_scanzMRSUploader.process_scan\ s )$ ? F KK< = = = F
' ' 0 0
$ *,,,'{
*,,,(
$ *,,,1"7
#''11 ! J *,,,#<
r r c \ K | j d {V \ }}|d }t j | j d |D | }d}t 5 }| | j j |2 3 d {V fd|D }|rXd} | ||| d {V 8# t j $ r%}t d| Y d }~gd }~ww xY wp6 d d d n # 1 swxY w Y |r t d d S d S )Nr/ c 3 $ K | ] }|j V d S r )r3 rJ s r z%MRSUploader.upload.. s$ 22c222222r Tc 0 g | ]}|j v |j S r( )r3 r= )rK rB unknown_hashess r rL z&MRSUploader.upload.. s. !$N0J0JCH0J0J0Jr FzFailed to upload files: %sz1All files are known to MRS. Skipping uploading...)
r r5 r check_known_hashesr r callback task_done
_upload_files
UploadFailurerP errorrQ )
r rF rS r/ hashes_generator
no_new_hashesstackfileser] s
@r r" zMRSUploader.upload s
$((** * * * * * *
07v+> J22T222M
[[ FE NN4-7 8 8 8(8
F
F
F
F
F
F
Fn (, F$)MF " 0 0
w O OOOOOOOOO+9 F F F %A1EEEEEEEEF F )9(8 F F F F F F F F F F F F F F F M KKK L L L L L M MsH #"DC5 D B=<D=C1 C,'D,C11DD
Drg list[str]rF strrS r c K t j d 5 |D ]} t j || d {V # t
$ r'}t d|| Y d }~ n[d }~wt $ rK}d | j
|j }t d||j Y d }~d }~ww xY wd d d d S # 1 swxY w Y d S )N
mrs_upload)rF z Cannot process message %s: %sz{}. {}z%s: %s)
r tracktaskr upload_with_retriesr rP warningFileNotFoundErrorformatERR_MSGstrerrorfilename)r rg rF rS r= rh errs r ra zMRSUploader._upload_files sr
"
"<
0
0 > >
>
> >*> M $ NN#BGQOOOEEEEE( > > >"//$,
CCCNN8S!*========> > > > > > > > > > > > > > > > > > >sM C AC
C A1+C1
C >AC?CC CC C c n K | dd }| j ||f d S )NrF r1 )r5 r
put_nowait)r rS rF s r process_hitszMRSUploader.process_hits s; O\BB
%%}g&>?????r N)r, r- )rg ri rF rj rS r )rS r )__name__
__module__ __qualname__rs recompiler7 r r& r) r+ rD r r MalwareScanrX r r" ra r ry r( r r r r 2 s 'G 2: NOOL4 4 4< < <
2 2 2: : : :0 VK #$$+ + %$+Z _QM M M8> > > > VK ())@ @ @ *)@ @ @r r )'__doc__
__future__r r} asyncior
contextlibr loggingr typingr r defence360agent.apir defence360agent.contracts.configr
rN !defence360agent.contracts.licenser "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr
r r defence360agent.utilsr r imav.malwarelib.utilsr imav.contracts.messagesr r- rj
UploaderQueuerz rP r r( r r r s * # " " " " " & & & & & & & & * * * * * * > > > > > > : : : : : : : : : : : :
D C C C C C C C 2 2 2 2 2 2 8888888%%5 567M 8 H@ H@ H@ H@ H@+} H@ H@ H@ H@ H@r