ї Г:├Еъ)HЦСр≈dZddlZddlZddlZddlZddlZddlmZddlm Z ddl mZddlm Z ddlmZddlmZdd lmZmZdd lmZejeі╚ZGd└deі╚ZdS) u This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.б═ See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program.б═ If not, see . Copyrightб═б╘ 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see ИN)зsuppress)зMessageType)з MessageSource)зMalwareScanType)зparse_report_json)з ScanResult)зInotifyзWatcher)зcreate_task_and_log_exceptionscС▌≈eZdZdZdZejdі╚Zd└Zd└Z d└Z d└Zd└Zd e d efd└Zd e fd└Zd efd└Zd└Zd└Zd└ZdS)зAibolitResultsScanzА Plugin to handle generated ai-bolit scan reports. Checks the contents of the *RESULT_SCAN_DIR* for the presence ai-bolit report files that match the *REPORT_FILE_MASK* pattern processes and deletes them. z$/var/imunify360/aibolit/resident/outz!^(?P[0-9a-f-]{36})\.report$cС"≈d|_d|_dS╘N)з_watcherз _init_task╘зselfs З`/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/aibolit_result_scan.pyз__init__zAibolitResultsScan.__init__3s─ь┬▄ ь┬▄┬┬Сc┐СdK≈||_||_t|j|jі╚|_dSr)з_loopз_sinkrз _init_handling_and_setup_watcherr)rзloopзsinks rз create_sourcez AibolitResultsScan.create_source7s3ХХ─ь┬▄ ь┬▄ щ8ь▄J≤т=Я Т ┬▄┬┬rc┐С▄K≈|j│&|j═і╚|j┐d{V≈├|═і╚dSr)rзcancelз_shutdown_watcherrs rзshutdownzAibolitResultsScan.shutdown>sTХХ─ь▄?п&ь▄Oв"р"я$т$п$ь■/п!п!п!п!п!п!п!ьвря т п п п rcСЬ≈tj|jdd╛і╚t|j|j╛і╚|_|j═|j═і╚tj ╛і╚dS)NiюT)зmodeзexist_ok)з coro_callback)зpathзmask)зosзmakedirsзRESULT_SCAN_DIRr rз_handle_incoming_reportrзwatchзencoder зMOVED_TOrs rз_setup_watcherz!AibolitResultsScan._setup_watcherDs~─Е ▄░Dт(╗u╦tпDяDтDпDщь▄J═dт&BП Я Т ┬▄ П ▄ врьт%в,р,я.т.╣Wт5EП Я Т П П П rcСJ≈|j│|j═і╚dSdSr)rзclosers rr z$AibolitResultsScan._shutdown_watcherOs,─ь▄=п$ь▄Mвря!т!п!п!п!П%п$rзreportзreturncСх≈|d}d└t|і╚Dі╚}|═dі╚}t||tj╛і╚}|═dі╚|_|═dgі╚|_|═dі╚}|═dі╚}||z }|═||і╚t|і╚g|_|S) NзsummarycС≈g|] }|d▒▄S)з file_name╘)з.0зhits rЗ zCAibolitResultsScan._get_scan_result_from_report..Us─пFпFпF═S░░Kт пFпFпFrзscan_id)r<з scan_typeзtotal_filesзerrorsзreport_timeз scan_time) rзgetrrзREALTIMEr>r?зset_start_stopзscans) rr2зreport_summaryr&r<зscan_resultзend_timerAз start_times rз_get_scan_result_from_reportz/AibolitResultsScan._get_scan_result_from_reportSsХ─ь═ т*┬ьFпFу,=╦fя,Eт,EпFяFтF┬ь в$р$═Yя/т/┬щ ь≤'ґ_т-EП Я Т ┬П#1в"4р"4╟]я"Cт"C┬ть+в/р/╟╦"я=т=┬тЮ!в%р%═mя4т4┬ь"в&р&═{я3т3┬ ь═ я)┬ ьв"р"═:╗xя8т8п8Е.╗vя6т6п7┬тьпrc┐С√K≈ |═|і╚}|═і╚┐d{V≈├}|j═t jdi|═і╚є▌і╚┐d{V≈├dS#tj$r┌t$r9}t═d═||і╚і╚Yd}~dSd}~wwxYw)Nz:Error '{!r}' occurred while processing ai-bolit report: {}r8) rJrBrзprocess_messagerзMalwareScanзto_dictзasyncioзCancelledErrorз Exceptionзloggerз exceptionзformat)rr2rGзresultзexcs rз_handle_reportz!AibolitResultsScan._handle_reportfs"ХХ─П ьв;р;╦FяCтC┬Kь&÷? ?я,т,п,п,п,п,п,п,┬Fь■*в,р,щт'п;п;╗&╞.╙.я*:т*:п;п;ЯТП П П П П П П П П ЬУт%П П П ьщП П П щврП&ъ&,╒f╗S╟&я&9т&9Я Т П П П П П П П ЬЬЬЬП ЬЬЬs└A0A6а6Cб.CцCr&c┐СфK≈|j═tj═|і╚і╚}|░r"tj═|і╚░r t |і╚5}tj|і╚}dddі╚n#1swxYwY|d═ d|═ dі╚і╚|═|і╚┐d{V≈├n8#tj$r&}t═d||і╚Yd}~nd}~wwxYwtt і╚5tj|і╚dddі╚dS#1swxYwYdSdSdS)Nr5r<зuuidz*Problem with parsing %s aibolit report: %s)зREPORT_FILE_MASKзmatchr(r&зbasenameзisfileзopenзjsonзloadз setdefaultзgrouprWзJSONDecodeErrorrRзwarningrзFileNotFoundErrorзunlink)rr&з match_fileзfr2rVs rзhandle_report_filez%AibolitResultsScan.handle_report_fileusХХ─ьт*в0р0╣Єв1Aр1Aю$я1Gт1GяHтH┬ ьЯ ²"°'÷. .╗я.т.Я П 2щ≤$▒Z■ZП*═1щ!°Y═q≥\°\░FП*П*П*Я*Т*П*П*П*П*П*П*ЬЬЬП*П*П*П*П░yт!в,р,ь≤zв/р/╟я7т7ЯТППв)р)╗&я1т1п1п1п1п1п1п1п1п1ЬУт'П П П щ≈▓ь@ю$хЯТППППППЬЬЬЬП ЬЬЬУу+я,т,П П щ■ ≤$▒■░П П П Я Т П П П П П П П ЬЬЬП П П П П П П П П П sNаC$а-BбC$бBбC$бBбC$ц$Dц3DдDд0EеEеEc┐СK≈t═d|і╚tj═tj|jі╚tj|jі╚і╚}|═|і╚┐d{V≈├dS)NzInotify event: %s)rRзinfor(r&зjoinзfsdecodeзnameri)rзeventзreport_files rr+z*AibolitResultsScan._handle_incoming_report┤s{ХХ─щ▐┼п'╗я/т/п/щ■g≈l▓lщ▄K≤° я#т#╔Rє[╟Єя%<т%<Я Т ┬Пв%р%═kя2т2п2п2п2п2п2п2п2п2п2rc┐СK≈tj═|jі╚rZtj|jі╚5}|D]"}|═|jі╚┐d{V≈├▄# dddі╚dS#1swxYwYdSdSr)r(r&зexistsr*зscandirri)rзitзentrys rз_handle_existing_reportsz+AibolitResultsScan._handle_existing_reports▌sэХХ─щ ▄7▐>┼>≤$т.я/т/П >щ■≤Dт0я1т1П >╟RьП>П>░Eьв1р1╟%Є*я=т=п=п=п=п=п=п=п=п=П>П >П >П >Я >Т >П >П >П >П >П >П >П >ЬЬЬП >П >П >П >П >П >П >П >sа&A4а4A8а;A8c┐СfK≈|═і╚┐d{V≈├|═і╚dSr)rvr/rs rrz3AibolitResultsScan._init_handling_and_setup_watcher■sBХХ─ьв+р+я-т-п-п-п-п-п-п-п-ьврятпппrN)з__name__з __module__з__qualname__з__doc__r*зreзcompilerZrrr!r/r зdictrrJrWзstrrir+rvrr8rrr r (s─────ППП=─Oь!░r■zп"FяGтGпПППП П П П!П!П!П П П П"П"П"П╟4П╦JППППП& ╗4П П П П П ╗SП П П П П$3П3П3П>П>П>ПППППrr )r{rOr_зloggingr(r|з contextlibrз"defence360agent.contracts.messagesrз!defence360agent.contracts.pluginsrзimav.malwarelib.configrз$imav.malwarelib.scan.ai_bolit.reportrз imav.malwarelib.scan.scan_resultrзimav.malwarelib.subsys.ainotifyr r зdefence360agent.utilsrз getLoggerrxrRr r8rrЗr┼s$ПППП*───ь───ь───ь ─ ─ ─ ь ─ ─ ─ ьпппппЮ:п:п:п:п:п:ь;п;п;п;п;п;ь2п2п2п2п2п2ьBпBпBпBпBпBь7п7п7п7п7п7ь<п<п<п<п<п<п<п<ь@п@п@п@п@п@Ю ┬т ≤8я $т $─ПnПnПnПnПn≤ЯnТnПnПnПnr