0M7E d Z ddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
m Z ddl m
Z
mZmZmZ ddlmZmZmZ ddlmZ dd lmZmZ dd
lmZ dd l m Z dd l m Z m Z dd
l!m"Z"m#Z#m$Z$m%Z% ddl&m'Z' ddl(m)Z) ej* e+ Z,dZ- e. ej/ d 0 Z1e2e3e
f Z4 e
d G d d Z5 G d dee Z6 G d dee Z7dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)AbstractEventLoop) defaultdict) dataclassfield)Any
AsyncIteratorIterablecast)Message
Reportable ReportTarget)get_myimunify_users) MessageSink
MessageSource)
AbstractPanel) HostingPanel)
load_state
save_state)Scoperecurring_checksafe_cancel_tasksplit_for_chunk)MalwareHitStatus)
MalwareHiti, )daysT)slotsc n e Zd ZU dZ ee Zeeee f e
d< dZ e e
d< dZ
e e
d< dS )
ProcessedHitsz"Result of processing malware hits.)default_factoryfilesr infected_count
cleaned_countN)__name__
__module__ __qualname____doc__r listr! dictstrr __annotations__r" intr# ^/opt/imunify360/venv/lib/python3.11/site-packages/imav/plugins/send_malware_infection_state.pyr r < sb ,,"'%"="="=E4S#X ===NCM3r. r c e Zd ZdZej ZdS )MalwareInfectionStateMALWARE_STATE_SNAPSHOTSN)r$ r% r& DEFAULT_METHODr
APITARGETr- r. r/ r1 r1 E s .N
FFFr. r1 c ^ e Zd Zej ZdZd Zd Zde fdZ
de fdZ d Z e
dedefd Zd(d eez d
z fd Zdefd
Zd Zd Ze
dedefd Zdedeeef fdZde e de fdZ d)dededede eeef ded ed ed e e d
z de fd Z d)de e dededed ed e e d
z de!e fd Z"e
d!ed"e#e defd# Z$de!e fd$Z%de e dededede!e f
d%Z&de e dededed&e'de!e f d'Z(d
S )*SendMalwareInfectionStatei c " d | _ d| _ d S )Nr )_task_last_send_timestampselfs r/ __init__z"SendMalwareInfectionState.__init__O s
$%!!!r. loopc
K d S Nr- )r< r> s r/ create_sinkz%SendMalwareInfectionState.create_sinkS s r. c K || _ | | _ | t t
| j | _ d S r@ )_sink_load_last_send_timestampr: create_taskr RECURRING_CHECK_INTERVAL_check_and_sendr9 )r< r> sinks r/
create_sourcez'SendMalwareInfectionState.create_sourceV s^
$($B$B$D$D!%% K 5O 4 5 5d6J K K M M
r. c d K | j &d | j c| _ }t | d {V d S d S r@ )r9 r )r< ts r/ shutdownz"SendMalwareInfectionState.shutdown] sK : ! $*MDJ"1%% % % % % % % % % % " !r. timestampreturnc F t | t t f o| dk S )z.Check if timestamp is a valid positive number.r )
isinstancer, float)rM s r/ _is_valid_timestampz-SendMalwareInfectionState._is_valid_timestampb s! )c5\22EyA~Er. Ntsc || j n|}| | s t d| dS t | j d|i dS )z1Save the last send timestamp to persistent state.Nz'Invalid timestamp to save: %s, skippinglast_send_timestamp)r: rR loggerwarningr STATE_KEY)r< rS rM s r/ _save_last_send_timestampz3SendMalwareInfectionState._save_last_send_timestampg si 13D-- '' 22 NN99
F4>$99#EFFFFFr. c t | j d }| | s t d dS t
t | S )z3Load the last send timestamp from persistent state.rU z>>GAt
18<<<!%!=!=c8S" "
g
"
"&!@!@c8S"" "
g
" "7 s* $B %C#' C#0)C C#4EE(c \ K | ||||dg 2 3 d{V }|W V
6 dS )z+Generate messages aggregated at user level.rs r| r r r r r N)r )r< r| r r r rf s r/ r z1SendMalwareInfectionState._generate_user_messages su " < < !#
=
' MMMMM
s +r c N K | | d{V }t t }|D ]'}||j |j (t t } |D ][}
|
dd } | | | } | | |
\| D ]B\ }
}|
|||||
| |
g 2 3 d{V }|W V
6 CdS )z4Generate messages aggregated at document root level.Nrr rs r ) get_user_domains_detailsr r( r r~ domainr[ r keysitemsr )r< r| r r r r domain_detailsdocroot_to_domains domain_datadocroot_to_hitsrp r r r docroot_hitsrf s r/ r z4SendMalwareInfectionState._generate_docroot_messages, s " : :8 D DDDDDDD ;Fd:K:K) O OK { 2 3 : :;;M N N N N CN C
C
9 9C++I " 9 9-2244 O
O , 3 3C 8 8 8 8 &5%:%:%<%< !G\!%!@!@!!%, / 3 3GR @ @
"A " "
g
" " s D#r@ )rs N))r$ r% r& r AV_IM360SCOPEr rX r= r rA rI rL staticmethodr boolrR r, rQ rY rD rG r` r* ro MalwareHitDictr) r{ r( r r r1 r r r r r rd r r r r- r. r/ r7 r7 J s NEJ+I& & &
&7
(9
& & &
Fs Ft F F F \FG GC%K$,> G G G G&5 & & & & - - - 6 6 6 C C \
^
S#X
$~"6 = 2 %')-
$sCx.)
" 3i$&
: %')- >"
"
3i$&
, - 4 # # 3 \ ( -8M*N ( ( ( ( T ( /4 @C JM , - & >"& & &
&
&
, -& & & & & & r. r7 )8r' datetimeloggingr r^ asyncior collectionsr dataclassesr r typingr r r r
"defence360agent.contracts.messagesr r r
&defence360agent.contracts.myimunify_idr !defence360agent.contracts.pluginsr r "defence360agent.subsys.panels.baser +defence360agent.subsys.panels.hosting_panelr 'defence360agent.subsys.persistent_stater r defence360agent.utilsr r r r imav.malwarelib.configr imav.malwarelib.modelr getLoggerr$ rV rF r, timedelta
total_secondsr_ r) r* r r r1 r7 r- r. r/ r s *
% % % % % % # # # # # # ( ( ( ( ( ( ( ( 5 5 5 5 5 5 5 5 5 5 5 5
G F F F F F H H H H H H H H < < < < < < D D D D D D J J J J J J J J 4 3 3 3 3 3 , , , , , , 8 $ $ " &H&A...<<>>??
c3h GZ
H H H H H ] H H H H H r.