It ) d Z ddlZddlZddlZddlmZ ddlmZmZ ddl m
Z
m Z m Z ddl
mZmZmZmZmZ ddlmZmZ G d d
e Ze G d d Ze G d
d Ze G d d Z G d dej Z G d de Z G d de Z G d d Z dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict) dataclassfield)List
NamedTupleOptional )DBPatchDependencyMatch VersionMatch HashStateDefinitionType)HashCalculator get_base_dirc X e Zd ZU eed< eed< dZee ed< dZee ed< dS )FileIdentifierrel_pathhashNvuln_id vuln_type) __name__
__module__ __qualname__str__annotations__r r intr U/opt/imunify360/venv/lib/python3.11/site-packages/imav/patchman/fs_scanner/matcher.pyr r ' sL MMM
III !GXc]!!! #Ix}#####r r c \ e Zd ZU eed< eed< ee ed< ee Z
e ed< dS )VersionIdentifieridr file_identifiers)default_factorymatched_base_dirsN) r r r r r r listr r setr% r r r r! r! . sS GGG
III>**** "U3 7 7 7s77777r r! c & e Zd ZU ee ed< dS )PatchDependencyfilesN)r r r r& r r r r r r) r) 7 s# r r) c 8 e Zd ZU eed< eed< eed< eed< dS )HashDefinitiontyper" r stateN)r r r r r r r r
r r r r, r, < s<
GGG
III r r, c ` e Zd ZdefdZej dedeeee f fd Z
dS )Matcher
input_filec : | | | _ d S N) _parse_inputdict_of_identifiers)selfr1 s r __init__zMatcher.__init__E s #'#4#4Z#@#@ r file_pathreturnc d S r3 r )r6 r8 s r r4 zMatcher._parse_inputH s r N) r r r r r7 abcabstractmethoddictr& tupler4 r r r r0 r0 D st A3 A A A A
c
d3U 3C.D
r r0 c e Zd Zededee fd Zdedee fdZ
dede eee f fdZ de d ed
e
defd Zd ed
eded
e
fdZdS )VersionsMatcher file_hashesr9 c | d }d t |dd d |d d d D S )N|c 4 g | ]\ }}t || S r r ).0r hash_s r
z:VersionsMatcher._parse_path_hash_pairs..S s6
%
8U + +
r r )stripsplitzip)rA partss r _parse_path_hash_pairsz&VersionsMatcher._parse_path_hash_pairsN sb !!##))#..
#&uQTT{E##A#J#?#?
r linec | d \ }}}}|dk rd S t ||| | S )N:+)rJ rK r! rN )r6 rO r. id_rG rA s r _parse_linezVersionsMatcher._parse_lineX s] *. ););C)@)@&sE; C<<4 33K@@
r r8 c t t }t |d 5 }|D ]D}| | x}r+||j d j | E d d d n # 1 swxY w Y |S )Nrr )r r& openrT r# r append)r6 r8 plugins_identifiers_by_pathfilerO new_identifiers r r4 z VersionsMatcher._parse_inputb s
$ )S
!
! -T
-
-%)%5%5d%;%;;> -/&7:C f^,,,
- - - - - - - - - - - - - - - - +*s AA::A>A>plugin_identifierbase_dirhash_calculatorc D |j D ]G}t j t j ||j s dS H|j D ]H}| t j ||j d |j k r dS IdS )NFT)apply_normalization)r# ospathisfilejoinr calc_hashr )r6 r\ r] r^ file_identifiers r has_full_matchz VersionsMatcher.has_full_matchr s 1 A O7>> X'?@@
uu
1 A O ))GLL?+CDD(, * #' ( ( uu
( tr full_path
relative_pathdbc F d}| j |g D ]}t || }||j vrg| ||| rP|j | |j t |j ||j
d}|S )NF)r" rb r T) r5 getr r% rg addversions_matchesbuffered_insertr r" r )r6 rh ri rj r^
is_matchedr\ r] s r match_and_savez VersionsMatcher.match_and_save s
!%!9!=!= 2"
"
" " $I}==H 1 CCC''%x D
"377AAA#33 ,/ % . 3 "
r N)r r r staticmethodr r& r rN r r! rT r= r4 r boolrg r
rq r r r r@ r@ M s
C
D 4H
\
1B(C
+ +
c4)** ++ + + + , (
0
( r r@ c R e Zd Zdedeeee f fdZdededede fdZ
d S )
PatchDependenciesMatcherr8 r9 c h t t }t |d 5 }|D ]q}|d |dd }}|dk rt d t j | D }|j D ]"}||j | #r d d d n # 1 swxY w Y |S )NrV r r rR c d g | ]-}t |d |d |d |d .S )filenamer vulnerability_idvulnerability_type)r r r r rE )rF _s r rH z9PatchDependenciesMatcher._parse_input.. sY
'%&z]!"6$%&8$9&'(<&= r )r* ) r r& rW r) jsonloadsr* r rX ) r6 r8
patch_depsrZ rO r. datapatch_dependencyrf s r r4 z%PatchDependenciesMatcher._parse_input s/ 8C47H7H
)S
!
! T
"1gtABBxtC<< #2 "&D!1!1
$
$
$ (8'= O 78??(
( s A5B''B+.B+rh ri rj r^ c d}| j |g D ]Ԋ t || }g j D ]}|j |k r| t j ||j |j k rM
t j ||j |j |j |j f d} fdD fdD |S )NFTc
n g | ]1}t |d t t j k i2S )dependencies_met)r lenr* )rF rowmatches_to_insertr s r rH z;PatchDependenciesMatcher.match_and_save.. s\ ! ! !
% -..#6F6L2M2MM ! ! !r c D g | ] }j | S r )patch_dependenciesro )rF matchrj s r rH z;PatchDependenciesMatcher.match_and_save.. s:
%55e<<
r )
r5 rl r r* r re ra rb rd r rX r r )
r6 rh ri rj r^ rp r] rf r r s
` @@r rq z'PatchDependenciesMatcher.match_and_save s_
$ 8 < < 2!
!
' ' $I}==H !# #3#9
&
&#,
=='11 X/GHH '+, , &,, GLL?3K L L + 0 + 3 + 5 "&J! ! ! ! ! -! ! !
.
r N) r r r r r= r& r) r4 r
r rq r r r ru ru s c d3_8M3M.N >00 0
0
( 0 0 0 0 0 0r ru c L e Zd ZdefdZededee fd Zd Z dS )
HashesMatcher hashes_filec ` | | | _ t | _ d S r3 )r4 hash_recordsr' _seen)r6 r s r r7 zHashesMatcher.__init__ s. 262C2C 3
3
UU
r hashes_pathr9 c X t j j t j j t j j h}g }t | d 5 }|D ]}| d }t | dk r=|\ }}}} t | }
t | } |
|v s| t j j k r|| t t |
t | |t | ddd n # 1 swxY w Y |S )a
Parses the hashes file and returns a list of HashDefinition,
filtering out malware-related types and state==2.
The lines look like :::
Example: 2:675:ab43f2f7ad32404e1b923a8387f1a167:2
Where :code:`type` can be one of the following:
* DEFINITION_TYPE_MALWARE = 1
* DEFINITION_TYPE_VULNERABILITY = 2
* DEFINITION_TYPE_APPLICATION = 3
* DEFINITION_TYPE_DRYRUN = 4
* DEFINITION_TYPE_MALWARE_RULE = 7
* DEFINITION_TYPE_MALWARE_RULE_DRYRUN = 8
* DEFINITION_TYPE_VULNERABILITY_ECOMMERCE = 9
* DEFINITION_TYPE_VULNERABILITY_PLUGIN = 10
rV rQ )r- r" r r. N)r MALWAREvalue MALWARE_RULEMALWARE_RULE_DRYRUNrW rJ rK r r r
SUPERSEDEDrX r, ) r
MALWARE_TYPESresultfrO rM typrS rG r. typ_int state_ints r r4 zHashesMatcher._parse_input si $
" ( ' - . 4
+s
#
# q
**3//u::?? ).&S% c(( JJ },, I$8$>>>
" +G 4 4 s88 " ' 2 2
*
s C
D D#&D#c | | }| j D ]m}|||j j |j |j j f}||j k r@|| j vr7|j | | j
| dS ndS )NTF) re r r- r r" r. r r hashes_matchesro rm )r6 r8 ri rj r^ file_hashrecordkeys r rq z HashesMatcher.match_and_save2 s #--i88 ' F ! " C FK''Ctz,A,A!11#666
s###ttur N)
r r r r r7 rr r r, r4 rq r r r r r sr C +# +$~*> + + + \+Z r r ) __doc__r; r| ra collectionsr dataclassesr r typingr r r rj r
r r r
r utilsr r r r! r) r, ABCr0 r@ ru r r r r r sh *
# # # # # # ( ( ( ( ( ( ( ( - - - - - - - - - - 0 / / / / / / /$ $ $ $ $Z $ $ $ 8 8 8 8 8 8 8 8
cg
Z Z Z Z Zg Z Z ZzP P P P Pw P P PfC C C C C C C C C Cr