g! d Z ddlZddlZddlZddlZddlmZ ddlmZm Z ddl
m Z m Z ddl
Z
ddlmZ ddlmZmZ ddlmZmZ dd lmZmZ dd
lmZ ej e Z ej ej j! z rd Z"nd Z"ej# $ d
ej% Z&ej# $ dd Z'ej# $ dd Z( e)ej# $ dd Z*dZ+dZ,dZ- G d de. Z/ G d de. Z0d Z1d)d Z2e-fd e3fd Z4e-fd Z5e-d d!Z6e G d" d# Z7e-fd$ee3 d%e e3 fd&Z8d'e
j9 j: d%dfd(Z;dS )*u5
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
Utilities to help upload a malicious file. N) dataclass)IterableList)quote_from_bytesurljoin)utils)CoreMalware)
LicenseCLN LicenseError)IAIDTokenErrorIndependentAgentIDAPI) MalwareTunez /opt/alt/curlssl/usr/bin/curlz /opt/alt/curlssl11/usr/bin/curlI360_MRS_API_BASE_URLI360_MRS_ENDPOINT_UPLOADz
api/v1/uploadI360_MRS_ENDPOINT_CHECKzapi/v1/check-known-hashes IMUNIFY360_POST_FILE_TIMEOUTi false_negativefalse_positiveunknownc e Zd ZdZdS ) ClientErrorzcHTTP client error.
It is used to hide what specific http client is used by upload_file().
N)__name__
__module__ __qualname____doc__ [/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/utils/malware_response.pyr r = s r r c e Zd ZdS )FileTooLargeErrorN)r r r r r r r! r! D s Dr r! c t j } | d | d | d | d | d | d d}d | D }|S ) Nidlimitstatustoken_expire_utctoken_created_utcsign)zI360-Idz
I360-Limitz I360-StatuszI360-Token-Expire-UtczI360-Token-Created-Utcz I360-Signc 4 i | ]\ }}|t | S r )str).0keyvalues r
z%_token_to_headers..R s$ AAA:3sCJJAAAr )r get_tokenitems)tokenheaderss r _token_to_headersr3 H sm " "E;Gn X!&'9!:"'(;"<6]
G BA AAAG Nr c K |i }d | D }t t j | d d }t j t
g|z dt
| d g|duz z ddt j | d d
d d |fz d
dd| d gz }t j | d{V \ }}} |dk rC|dk rt n|dk rt nt }
|
dj
di t |S )a
Post *filename* as multipart/form-data to *url* with given HTTP *headers*.
Return server response as bytes (http body).
Raise TimeoutError on timeout.
Raise ConnectionError if failed to connect to host.
Raise ClientError on error.
Nc n g | ]2\ }}d | d | d fz 3S )s -H%s: %sasciizlatin-1)encode)r+ headerr- s r
z _post_file..b sN FE v}}W--u||I/F/FGG r )safer6 s
--max-times --forms file=@"%s";filename="%s" \s \\ "s \"s --fails --silents --show-errorr zRFailed to post {filename} to {url}: curl: cmd={cmd}, rc={rc}, out={out}, err={err}r )r0 r osfsencoder7 _CURLr* replacer runConnectionError TimeoutErrorr formatvars) filenameurlr2 timeout headers_argsquoted_full_pathcmdrcouterrErrors r
_post_filerS V s $]]__ L ( H(=(=BGGGNN
U
#g,,--g66
77$;N
O P
' H%%((v&&
JJw
, 3 ''''''LBS Qww Qww
O Rxx e
B
vv
Jr filec $ K t j st d t j | }|t j k r.t d | |t j t t t }i t d|i}t | ||t d{V }t! j | }t& d| | |S )z
Upload a file to Malware Response Service.
:param file: path to file
:param upload_reason: one of 'unknown', 'false_positive', 'false_negative'
:return: dict representing json response
:raises LicenseError:
zCFile uploading to Malware Responce Serivce requires a valid licensez@File {} is {} bytes, files larger than {} bytes are not allowed.I360-Upload-ReasonrK Nz@Uploaded file %r to the Malware Response Service with reason: %s)r is_validr r@ pathgetsizeConfigMAX_MRS_UPLOAD_FILEr! rG r
_API_BASE_URL_ENDPOINT_UPLOADr3 rS _POST_FILE_TIMEOUTjsonloadsdecodeloggerinfo)rT
upload_reason file_sizerJ r2
response_bodyresults r upload_fileri s:
'
%%I6---
%vi!;
-!1
2
2C
m G % c7$6 M Z
,,..
/
/F
KKJ
Mr c K g d}t | dz }t |d D ]\ }}t | d| d{V }|s dS t |t r t
d| dS t
d||| || t j | d{V t | d | d{V dS )
zW
:raises LicenseError,
ClientError,
TimeoutError,
ConnectionError,
)g ?g @ ( d )startF) raise_errorsre Nz+File %s is too big. Stop retrying to uploadzKAttempt %d/%d: failed uploading file %s, reason: %s. Retrying in %s secondsT) len enumerate _try_upload
isinstancer! rc warningasynciosleep)rT re delays max_triesipauseerrors r upload_with_retriesr s; -
,
,FF aI fA... P P5! uM
EE e . / / NNH$ O O O EE
mE""""""""""$T OOOOOOOOOOOOr re c K t | | d{V dS # t t t t f$ r}|r||cY d}~S d}~ww xY w)zReturn error instead of raising it unless *raise_errors* is true.
:raises LicenseError:
:raises ClientError,
TimeoutError,
ConnectionError,
FileTooLargeError: if raise_errors is True
r N)ri r rE r! rF )rT rr re es r ru ru s $m<<<<<<<<<< t Gs A
AA
A
c $ e Zd ZU eed< eed< dS )HitInforT hashN)r r r r* __annotations__r r r r r s"
III
IIIIIr r hashesreturnc
, K t | }t j r|S t j d {V }n# t
$ r |cY S w xY wt
t t }||dd}d|i} | d t t j
|t j | |d d {V }n4# t" $ r'}t$ d| |cY d }~S d }~ww xY w|d S )Nzapplication/json)zX-AuthrV z Content-Typer POST)datar2 methodz Failed to check known hashes: %sunknown_hashes)listr NO_CHECK_KNOWN_HASHESr r/ r
r r] _ENDPOINT_CHECKrun_in_executor _do_requesturllibrequestRequestr` dumpsr7 Exceptionrc rw ) loopr re r1 rJ r2 r rh r s r check_known_hashesr so &\\F(
+577777777
-
1
1C +* G
G
++ N " "Z((//11
#
91===
" ##s. ; A
A
2A'C
D $ D D D r c ` t j | t j 5 }|j dk r't
d |j t j |
cd d d S # 1 swxY w Y d S )NrW ro zstatus code is {}) r r urlopenr DEFAULT_SOCKET_TIMEOUTr% r rG r` ra readrb )r responses r r r ! s 4
4 ?c ! ! / 6 6x G GHH Hz(--//002233 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4s A*B##B'*B')NN)r s: . ., ! ! ! ! ! ! ! ! ! ! ! ! ! ! 2 2 2 2 2 2 2 2
! ! ! ! ! ! D D D D D D D D F F F F F F F F . - - - - - 8 $ $ 5#6#== . +EE -E
68IJJ
:>>" $ $C $ $ $ $N 3A !P !P !P !PH $$ $$3-$$ #Y$$ $$ $$ $$N4 / 4D 4 4 4 4 4 4r