"""
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see <https://www.imunify360.com/legal/eula>
Generic Sensor plugin
- Creates listening unix domain socket on config.GenericSensor.SOCKET_PATH
- Expects alert data formatted as
"""
import base64
import json
import os
import struct
import time
from logging import getLogger
# Side-effect import: defining the MalwareScan / MalwareScanTask / ...
# subclasses registers them with MessageType via __init_subclass__, so
# MessageType.MalwareScan resolves to the real class instead of
# UnknownMessage. Without this, METHOD2MSGTYPE entries collapse to
# UnknownMessage at first use.
import imav.contracts.messages # noqa: F401
from defence360agent.contracts.config import (
SimpleRpc,
GENERIC_SENSOR_SOCKET_PATH,
)
from defence360agent.contracts.messages import MessageType
from defence360agent.contracts.plugins import Sensor
from defence360agent.internals.auth_protocol import UnixSocketAuthProtocol
from defence360agent.internals.global_scope import g
from defence360agent.internals.logger import getNetworkLogger
from defence360agent.simple_rpc import (
ConnectionLimiter,
RpcServerAV,
ConnectionGuard,
)
from defence360agent.utils import Scope
from defence360agent.utils.buffer import LineBuffer, LineBufferOverflow
logger, network_logger = getLogger(__name__), getNetworkLogger(__name__)
class Protocol(UnixSocketAuthProtocol):
METHOD2MSGTYPE = {
"NOOP": MessageType.Noop,
"MALWARE_SCAN": MessageType.MalwareScan,
"MALWARE_SCAN_TASK": MessageType.MalwareScanTask,
"MALWARE_SCAN_COMPLETE": MessageType.MalwareScanComplete,
"MALWARE_CLEAN_COMPLETE": MessageType.MalwareCleanComplete,
"MALWARE_RESTORE_COMPLETE": MessageType.MalwareRestoreComplete,
"MALWARE_CHECK_DETACHED_SCANS": MessageType.CheckDetachedScans,
"MALWARE_SEND_FILES": MessageType.MalwareSendFiles,
}
def __init__(self, loop, sink, *_, limiter=None, read_timeout=None):
self._loop = loop
self._sink = sink
self._line_buffer = LineBuffer()
self.transport = None
self._guard = ConnectionGuard(
loop,
limiter=limiter,
read_timeout=read_timeout,
name="generic sensor",
)
def connection_made(self, transport):
try:
super().connection_made(transport)
except (OSError, AttributeError, struct.error) as exc:
network_logger.warning(
"Rejected generic_sensor connection: "
"SO_PEERCRED unavailable (%s)",
exc,
)
transport.close()
return
if self._uid != 0:
network_logger.warning(
"Rejected generic_sensor connection from non-root peer "
"uid=%d gid=%d pid=%d",
self._uid,
self._gid,
self._pid,
)
transport.close()
return
if not self._guard.try_admit(transport):
transport.close()
return
self._guard.note_peer(self._pid, self._uid)
self.transport = transport
network_logger.debug("Connection made")
def data_received(self, data):
if self.transport is None:
return
self._guard.on_data()
msgs = data.decode()
if not msgs.strip():
logger.error("Empty message received <%s>", msgs)
return
try:
self._line_buffer.append(msgs)
except LineBufferOverflow as e:
logger.warning("Closing generic sensor connection: %s", e)
self.transport.close()
self.transport = None
self._guard.on_lost()
return
for msg in self._line_buffer:
if msg:
network_logger.debug("data_received: {!r}".format(msg))
tokens = self._parse_msg(msg)
if tokens:
tokens["timestamp"] = time.time()
self._process_msg(tokens)
def _parse_msg(self, msg):
try:
return json.loads(msg)
except json.JSONDecodeError:
logger.exception("data_received(%s): unable to decode", repr(msg))
def _process_msg(self, tokens):
# map 'method' to appropriate Message type
try:
method = tokens["method"]
msgtype = self.METHOD2MSGTYPE[method]
except KeyError as e:
logger.error(
"data_received(%s): Wrong or missing 'method' [%s]",
repr(tokens),
repr(e),
)
return
if method == "MALWARE_SCAN_TASK":
tokens["filelist"] = [
os.fsdecode(base64.b64decode(f)) for f in tokens["filelist"]
]
self._loop.create_task(self._sink.process_message(msgtype(tokens)))
def connection_lost(self, transport):
self._guard.on_lost()
self.transport = None
network_logger.debug("Disconnected")
class GenericSensor(Sensor):
SOCKET_PATH = GENERIC_SENSOR_SOCKET_PATH
PROTOCOL_CLASS = Protocol
SCOPE = Scope.AV
async def create_sensor(self, loop, sink):
if SimpleRpc.SOCKET_ACTIVATION:
class GenericSensorSocket(RpcServerAV):
SOCKET_PATH = self.SOCKET_PATH
PROTOCOL_CLASS = self.PROTOCOL_CLASS
g.sensor_server = await GenericSensorSocket.create(loop, sink)
return g.sensor_server
else:
# FIXME make sure root can write to
os.makedirs(os.path.dirname(self.SOCKET_PATH), exist_ok=True)
if os.path.exists(self.SOCKET_PATH):
os.unlink(self.SOCKET_PATH)
limiter = ConnectionLimiter(SimpleRpc.MAX_CONCURRENT_CONNECTIONS)
g.sensor_server = await loop.create_unix_server(
lambda: self.PROTOCOL_CLASS(
loop,
sink,
limiter=limiter,
read_timeout=SimpleRpc.READ_TIMEOUT,
),
self.SOCKET_PATH,
)
os.chmod(self.SOCKET_PATH, 0o600)
return g.sensor_server
|