관리-도구
편집 파일: malware_response.cpython-311.opt-1.pyc
� ��gE � �� � d Z ddlmZ ddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ddlmZmZmZ dd lmZ dd lmZ dd lmZmZ dd lmZ ee� � Z G d � dee� � Z dS )u This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>. Copyright © 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see <https://www.imunify360.com/legal/eula> � )� defaultdict)� getLogger)�List)�Malware)� LicenseError)� MessageType)� MessageSink� MessageSource�expect)� MalwareHit)�malware_response)� ClientError�FileTooLargeError)� get_results_iterable_expressionc � � e Zd Zd� Zd� Z eej � � d� � � Zde fd�Z e d� � � Z e de de e fd�� � Zd S ) �MalwareResponsePluginc � �& K � || _ || _ d S �N)�_loop�_sink)�self�loop�sinks �]/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/malware_response.py� create_sourcez#MalwareResponsePlugin.create_source. s � � � ��� ��� � � � c � � K � || _ d S r )r )r r s r � create_sinkz!MalwareResponsePlugin.create_sink2 s � � � ��� � � r c � �� K � | � |j � � }|t j j � � � }|r | � |� � � d {V �� d S d S r )�_collect_hashes�filesr �MalwareResponse�UNKNOWN�lower�_process_unknown_hash)r �message�hashes�unknown_hashess r � process_message_malware_responsez6MalwareResponsePlugin.process_message_malware_response5 su � � � ��%�%�g�m�4�4�� � � ;� C� I� I� K� K�L�� � =��,�,�^�<�<� <� <� <� <� <� <� <� <� <� =� =r r' c � �h K � t j s t � d� � dS | � |� � }|D ]�}t � d|� � t j |� � � d{V �� �9# t $ r(}t � d||� � Y d}~ dS d}~wt $ r&}t � d||� � Y d}~��d}~wt $ r t � d|� � Y ��t $ r&}t � d||� � Y d}~��d}~ww xY wdS )z� If there is no such file with given hash in database, Imunify360 Client should upload file using API endpoint /api/v1/upload. z)Sending unknown files to MRS is disabled.Nz"Unknown file %s. Uploading to MRS.z/Cannot upload the following files to MRS %r: %sz File %s uploading failed. %s.z#File %s not found, skipping upload.) �Config� SEND_FILES�logger�info�_get_orig_filesr �upload_with_retriesr �warningr �error�FileNotFoundErrorr )r r' � orig_files� orig_file�es r r% z+MalwareResponsePlugin._process_unknown_hash< s� � � � � � � � �K�K�C� D� D� D� �F��)�)�&�1�1� �#� N� N�I� �K�K�<�i� H� H� H� N�&�:�9�E�E�E�E�E�E�E�E�E�E�� � � � ����E� ��� � � ����������� � L� L� L�� � � <�i��K�K�K�K�K�K�K�K�����$� � � ����9�9�� � � � � %� N� N� N���� >� �1�M�M�M�M�M�M�M�M����� N����# N� Ns6 � A;�; D/� B(�( D/�5 C�(D/� D/� D*�*D/c � � t t � � }| � � � D ]2\ }}||� � � � |� � �3|S r )r �set�itemsr$ �add)r! � type_to_hash� file_hash� hash_types r r z%MalwareResponsePlugin._collect_hashes[ sW � �"�3�'�'� �$)�K�K�M�M� ;� ;� �I�y� �� � �*�*� +� /� /� � :� :� :� :��r �returnc �� � g }d� }t || � � D ]M} |� |j � � � # t $ r# t � d|j � � Y �Jw xY w|S )Nc � � t j � � � t j � | � � � � S r )r �select�where�hash�in_)r' s r � expressionz9MalwareResponsePlugin._get_orig_files.<locals>.expressionf s/ � � �$�&�&�,�,�Z�_�-@�-@��-H�-H�I�I� Ir z File %s not found, skipping.)r �appendr5 r3 r- r1 )r' �resultrE �hits r r/ z%MalwareResponsePlugin._get_orig_filesb s� � ��� J� J� J� 3�:�v�F�F� N� N�C� N�� � �c�m�,�,�,�,��$� N� N� N���� =�s�}�M�M�M�M�M� N����� s �4�*A!� A!N)�__name__� __module__� __qualname__r r r r r" r) r8 r% � staticmethodr r �strr/ � r r r r - s� � � � � � �� � �� � � �V�K� '�(�(�=� =� )�(�=� N�#� N� N� N� N�> � � � �\� � � �� ��S� � � � � �\� � � r r N) �__doc__� collectionsr �loggingr �typingr � defence360agent.contracts.configr r+ �!defence360agent.contracts.licenser �"defence360agent.contracts.messagesr �!defence360agent.contracts.pluginsr r r �imav.malwarelib.modelr �imav.malwarelib.utilsr �&imav.malwarelib.utils.malware_responser r �defence360agent.utilsr rI r- r rN r r �<module>r[ sa ��� �* $� #� #� #� #� #� � � � � � � � � � � � � >� >� >� >� >� >� :� :� :� :� :� :� :� :� :� :� :� :�� � � � � � � � � � -� ,� ,� ,� ,� ,� 2� 2� 2� 2� 2� 2�� � � � � � � � B� A� A� A� A� A� ��8� � ��A� A� A� A� A�K� � A� A� A� A� Ar