Server IP : 66.29.132.122 / Your IP : 18.118.27.199 Web Server : LiteSpeed System : Linux business142.web-hosting.com 4.18.0-553.lve.el8.x86_64 #1 SMP Mon May 27 15:27:34 UTC 2024 x86_64 User : admazpex ( 531) PHP Version : 7.2.34 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : OFF | Pkexec : OFF Directory : /proc/self/root/proc/self/root/proc/thread-self/root/proc/thread-self/root/proc/self/root/proc/thread-self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/opt/imunify360/venv/lib64/python3.11/site-packages/imav/malwarelib/plugins/ |
Upload File : |
""" This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>. Copyright © 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see <https://www.imunify360.com/legal/eula> """ from collections import defaultdict from logging import getLogger from typing import List from defence360agent.contracts.config import Malware as Config from defence360agent.contracts.license import LicenseError from defence360agent.contracts.messages import MessageType from defence360agent.contracts.plugins import ( MessageSink, MessageSource, expect, ) from imav.malwarelib.model import MalwareHit from imav.malwarelib.utils import malware_response from imav.malwarelib.utils.malware_response import ( ClientError, FileTooLargeError, ) from defence360agent.utils import get_results_iterable_expression logger = getLogger(__name__) class MalwareResponsePlugin(MessageSink, MessageSource): async def create_source(self, loop, sink): self._loop = loop self._sink = sink async def create_sink(self, loop): self._loop = loop @expect(MessageType.MalwareResponse) async def process_message_malware_response(self, message): hashes = self._collect_hashes(message.files) unknown_hashes = hashes[MessageType.MalwareResponse.UNKNOWN.lower()] if unknown_hashes: await self._process_unknown_hash(unknown_hashes) async def _process_unknown_hash(self, hashes: set): """ If there is no such file with given hash in database, Imunify360 Client should upload file using API endpoint /api/v1/upload. """ if not Config.SEND_FILES: logger.info("Sending unknown files to MRS is disabled.") return orig_files = self._get_orig_files(hashes) for orig_file in orig_files: logger.info("Unknown file %s. Uploading to MRS.", orig_file) try: await malware_response.upload_with_retries(orig_file) except LicenseError as e: logger.warning( "Cannot upload the following files to MRS %r: %s", orig_files, e, ) break except ClientError as e: logger.error("File %s uploading failed. %s.", orig_file, e) except FileNotFoundError: logger.warning( "File %s not found, skipping upload.", orig_file ) except FileTooLargeError as e: logger.warning("File %s uploading failed. %s.", orig_file, e) @staticmethod def _collect_hashes(files): type_to_hash = defaultdict(set) for file_hash, hash_type in files.items(): type_to_hash[hash_type.lower()].add(file_hash) return type_to_hash @staticmethod def _get_orig_files(hashes: set) -> List[str]: result = [] def expression(hashes): return MalwareHit.select().where(MalwareHit.hash.in_(hashes)) for hit in get_results_iterable_expression(expression, hashes): try: result.append(hit.orig_file) except FileNotFoundError: logger.warning("File %s not found, skipping.", hit.orig_file) return result