$('H6| d Z ddlZddlZddlZddlZddlZddlmZ ddlZ ddl
m Z m Z ddl
mZ ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lm Z ee ee cZ Z G d
de Z G d de Z!dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
Generic Sensor plugin
- Creates listening unix domain socket on config.GenericSensor.SOCKET_PATH
- Expects alert data formatted as
N) getLogger) SimpleRpcGENERIC_SENSOR_SOCKET_PATH) MessageType)Sensor)UnixSocketAuthProtocol)g)getNetworkLogger) RpcServerAV)Scope)
LineBufferc e Zd Zej ej ej ej ej ej ej
ej dZ d Z
fdZd Zd Zd Zd Z xZS )Protocol)NOOP MALWARE_SCANMALWARE_SCAN_TASKMALWARE_SCAN_COMPLETEMALWARE_CLEAN_COMPLETEMALWARE_RESTORE_COMPLETE MALWARE_CHECK_DETACHED_SCANSMALWARE_SEND_FILESc V || _ || _ t | _ d | _ d S N)_loop_sinkr
_line_buffer transport)selfloopsink_s P/opt/imunify360/venv/lib/python3.11/site-packages/imav/plugins/generic_sensor.py__init__zProtocol.__init__G s'
&LL c t | nY# t t t j f$ r:}t d| | Y d }~d S d }~ww xY w| j dk rBt d| j | j
| j | d S || _ t
d d S )Nz@Rejected generic_sensor connection: SO_PEERCRED unavailable (%s)r zJRejected generic_sensor connection from non-root peer uid=%d gid=%d pid=%dzConnection made)superconnection_madeOSErrorAttributeErrorstructerrornetwork_loggerwarningclose_uid_gid_pidr debug)r r exc __class__s r" r' zProtocol.connection_madeM s GG # #I . . . . 6 " "/
OO FFFFF 9>> " "'
OO F" ./////s !% A;/A66A;c | j d S | }| s t d| d S | j | | j D ]s}|rot d | |
| }|r+t j |d< | | td S )NzEmpty message received <%s>zdata_received: {!r} timestamp)
r decodestriploggerr+ r appendr, r2 format
_parse_msgtime _process_msg)r datamsgsmsgtokenss r"
data_receivedzProtocol.data_receivede s > ! F{{}}zz|| LL6 = = = F &&&$ . .C
. $$%:%A%A#%F%FGGG -- .*.)++F;'%%f---
. .r$ c t j | S # t j $ r, t dt | Y d S w xY w)Nz#data_received(%s): unable to decode)jsonloadsJSONDecodeErrorr9 exceptionrepr)r rA s r" r< zProtocol._parse_msgw s^ O:c?? "# O O O BDII N N N N N N Os 7AAc | |d }| j | }nN# t $ rA}t dt | t | Y d }~d S d }~ww xY w|dk rd |d D |d< | j | j || d S )Nmethodz1data_received(%s): Wrong or missing 'method' [%s]r c Z g | ](}t j t j | )S )osfsdecodebase64 b64decode).0fs r"
z)Protocol._process_msg.. s: " " "56 F ,Q / /00" " "r$ filelist) METHOD2MSGTYPEKeyErrorr9 r+ rI r create_taskr process_message)r rB rK msgtypees r" r> zProtocol._process_msg} s H%F)&1GG LLCV Q
FFFFF
( ( (" ":@:L" " "F:
tz 9 9''&// J JKKKKKs
A#6A A#c H d | _ t d d S )N Disconnected)r r, r2 )r r s r" connection_lostzProtocol.connection_lost s# ^,,,,,r$ )__name__
__module__ __qualname__r Noop MalwareScanMalwareScanTaskMalwareScanCompleteMalwareCleanCompleteMalwareRestoreCompleteCheckDetachedScansMalwareSendFilesrV r# r' rC r< r> r^
__classcell__)r4 s @r" r r ; s #/ ( 8!,!@"-"B$/$F(3(F ) : N 0 0 0 0 00. . .$O O O L L L&- - - - - - -r$ r c * e Zd ZeZeZej Z d Z
dS )
GenericSensorc H K t j rG G fddt }| d {V t _ t j S t
j t j j
d t j j
rt
j j
fd j
d {V t _ t
j j
d t j S )Nc , e Zd Z j Z j ZdS )8GenericSensor.create_sensor..GenericSensorSocketN)r_ r` ra SOCKET_PATHPROTOCOL_CLASS)r s r" GenericSensorSocketro s " . !%!4r$ rr T)exist_okc 0 S r )rq )r r r s r" z-GenericSensor.create_sensor.. s ++D$77 r$ i )r SOCKET_ACTIVATIONr creater
sensor_serverrN makedirspathdirnamerp existsunlinkcreate_unix_serverchmod)r r r rr s ``` r"
create_sensorzGenericSensor.create_sensor s: & #
5
5
5
5
5
5
5k
5
5
5 %8$>$>tT$J$J J J J J J JAO? "
K(899D I I I Iw~~d .//
, $*+++$($;$;7777779I% % AO
HT%u - - -? "r$ N) r_ r` ra r rp r rq r AVSCOPEr rM r$ r" rl rl s4 ,K N HE# # # # #r$ rl )"__doc__rP rE rN r* r= loggingr imav.contracts.messagesimav defence360agent.contracts.configr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr 'defence360agent.internals.auth_protocolr &defence360agent.internals.global_scoper defence360agent.internals.loggerr
defence360agent.simple_rpcr defence360agent.utilsr defence360agent.utils.bufferr
r_ r9 r, r rl rM r$ r" r s :
; : : : : : 4 4 4 4 4 4 J J J J J J 4 4 4 4 4 4 = = = = = = 2 2 2 2 2 2 ' ' ' ' ' ' 3 3 3 3 3 3"8,,.>.>x.H.H W- W- W- W- W-% W- W- W-t# # # # #F # # # # #r$