go * d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z ddl
mZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lm Z ee ee cZ Z G d dej Z G d de Z!dS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
Generic Sensor plugin
- Creates listening unix domain socket on config.GenericSensor.SOCKET_PATH
- Expects alert data formatted as
N) getLogger)MSGS_WITHOUT_IP) SimpleRpcGENERIC_SENSOR_SOCKET_PATH)files) MessageType)Sensor)g)getNetworkLogger) RpcServerAV)Scope)
LineBufferc e Zd Zej ej ej ej ej ej ej
ej dZ d Z
d Zd Zd Zd Zd ZdS ) Protocol)NOOP MALWARE_SCANMALWARE_SCAN_TASKMALWARE_SCAN_COMPLETEMALWARE_CLEAN_COMPLETEMALWARE_RESTORE_COMPLETE MALWARE_CHECK_DETACHED_SCANSMALWARE_SEND_FILESc V || _ || _ t | _ d | _ d S N)_loop_sinkr _line_buffer transport)selfloopsink_s P/opt/imunify360/venv/lib/python3.11/site-packages/imav/plugins/generic_sensor.py__init__zProtocol.__init__B s'
&LL c H || _ t d d S )NzConnection mader network_loggerdebugr r s r# connection_madezProtocol.connection_madeH s$ " ./////r% c | }| s t d| d S | j | | j D ]s}|rot d | | | }|r+t j
|d< | | td S )NzEmpty message received <%s>zdata_received: {!r} timestamp) decodestriploggererrorr appendr( r) format
_parse_msgtime _process_msg)r datamsgsmsgtokenss r#
data_receivedzProtocol.data_receivedL s {{}}zz|| LL6 = = = F &&&$ . .C
. $$%:%A%A#%F%FGGG -- .*.)++F;'%%f---
. .r% c t j | S # t j $ r, t dt | Y d S w xY w)Nz#data_received(%s): unable to decode)jsonloadsJSONDecodeErrorr0 exceptionrepr)r r9 s r# r4 zProtocol._parse_msg[ s^ O:c?? "# O O O BDII N N N N N N Os 7AAc V |d }| j | }nN# t $ rA}t dt | t | Y d }~d S d }~ww xY w|dk rd |d D |d< nk|dk r t d nI|dv r)| j |d < t d
| n |d v r t d
| n|d k r t j |d
}| j
| j ||d
| nE# t j
$ r3}t d|t | Y d }~nd }~ww xY wd S | d s:|t vr1t d| d | d S | j
| j || d S )Nmethodz1data_received(%s): Wrong or missing 'method' [%s]r c Z g | ](}t j t j | )S )osfsdecodebase64 b64decode).0fs r#
z)Protocol._process_msg..o s: " " "56 F ,Q / /00" " "r% filelistSYNCLISTz Received test SynclistResponse)IP_LISTS_UPDATEBLOCKED_PORT_UPDATEBLOCKED_PORT_IP_UPDATEHEALTHr z Received )WHITELIST_CACHE_UPDATE IPSET_UPDATE UPDATE_RULESUPDATE_CUSTOM_LISTS FILES_UPDATE
files_typez Error during processing %s: %s attackers_ipz@Method type is %s but empty or no in message <%s>)METHOD2MSGTYPEKeyErrorr0 r1 rA infor r Indexr create_taskr process_messageIntegrityErrorstrgetr )r r: rC msgtypeeindexr1 s r# r6 zProtocol._process_msga s H%F)&1GG LLCV Q
FFFFF
( ( (" ":@:L" " "F: z
!
! KK8 9 9 9 9
#'.F; KK,F,, - - - -
KK,F,, - - - -
~
%
%
F<$899
&&J.. | 4e<< '
4fc%jj
FN++ o0M0M LL"
8$$
F
tz 9 9''&// J JKKKKKs,
A#6A A#;E F')FFc H d | _ t d d S )N Disconnectedr' r* s r# connection_lostzProtocol.connection_lost s# ^,,,,,r% N)__name__
__module__ __qualname__r Noop MalwareScanMalwareScanTaskMalwareScanCompleteMalwareCleanCompleteMalwareRestoreCompleteCheckDetachedScansMalwareSendFilesrZ r$ r+ r; r4 r6 rh rE r% r# r r 6 s #/ ( 8!,!@"-"B$/$F(3(F ) : N 0 0 0
.
.
. O O O 8L 8L 8Lt- - - - -r% r c * e Zd ZeZeZej Z d Z
dS )
GenericSensorc K t j rG G fddt }| d {V t _ t j S t
j t j j
d t j j
rt
j j
fd j
d {V t _ t j S )Nc , e Zd Z j Z j ZdS )8GenericSensor.create_sensor..GenericSensorSocketN)ri rj rk SOCKET_PATHPROTOCOL_CLASS)r s r# GenericSensorSocketrx s " . !%!4r% r{ T)exist_okc 0 S r )rz )r r r! s r# z-GenericSensor.create_sensor.. s ++D$77 r% )r SOCKET_ACTIVATIONr creater
sensor_serverrF makedirspathdirnamery existsunlinkcreate_unix_server)r r r! r{ s ``` r#
create_sensorzGenericSensor.create_sensor s% & #
5
5
5
5
5
5
5k
5
5
5 %8$>$>tT$J$J J J J J J JAO? "
K(899D I I I Iw~~d .//
, $*+++$($;$;7777779I% % AO ? "r% N) ri rj rk r ry r rz r
AVSCOPEr rE r% r# ru ru s4 ,K N HE# # # # #r% ru )"__doc__asynciorH r= rF r5 loggingr imav.contracts.messagesr defence360agent.contracts.configr r defence360agentr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr &defence360agent.internals.global_scoper
defence360agent.internals.loggerr defence360agent.simple_rpcr defence360agent.utilsr
defence360agent.utils.bufferr ri r0 r( r ru rE r% r# r s :
3 3 3 3 3 3 " ! ! ! ! ! : : : : : : 4 4 4 4 4 4 4 4 4 4 4 4 = = = = = = 2 2 2 2 2 2 ' ' ' ' ' ' 3 3 3 3 3 3"8,,.>.>x.H.H g- g- g- g- g-w g- g- g-T# # # # #F # # # # #r%