-
Notifications
You must be signed in to change notification settings - Fork 0
/
add_header.py
154 lines (136 loc) · 7.17 KB
/
add_header.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# -*- coding: utf-8 -*-
import logging
from fuglu.shared import ScannerPlugin, DUNNO,string_to_actioncode,apply_template
class URIExtractAddHeader(ScannerPlugin):
def __init__(self, config, section=None):
ScannerPlugin.__init__(self, config, section)
self.logger = logging.getLogger('fuglu.plugin.DomainAction')
self.requiredvars = {
'addheaderlinks': {
'default': 0,
'description': 'Add header with blacklisted uris',
},
'addheadercount': {
'default': 0,
'description': 'Add header with count of blacklisted uris',
},
'action': {
'default': 'DUNNO',
'description': 'action on hit (reject, delete, etc)',
},
'message': {
'default': '5.7.1 black listed URL ${domain} by ${blacklist}',
'description': 'message template for rejects/ok messages',
}
}
def examine(self, suspect):
urls = suspect.get_tag('black.uris', defaultvalue=[])
add_header_links = self.config.getboolean(self.section, 'addheaderlinks')
add_header_count = self.config.getboolean(self.section, 'addheadercount')
if len(urls) == 0:
return DUNNO
elif add_header_count is True and add_header_links is False:
suspect.add_header('X-Black-Host-Count', str(len(urls)), immediate=True)
elif add_header_count is True and add_header_links is True:
suspect.add_header('X-Black-Host', "\t" + "\r\n\t\t\t ".join(urls), immediate=True)
suspect.add_header('X-Black-Host-Count', str(len(urls)), immediate=True)
elif add_header_count is False and add_header_links is True:
suspect.add_header('X-Black-Host', "\t" + "\r\n\t\t\t ".join(urls), immediate=True)
return string_to_actioncode(self.config.get('URIExtractPlugin', 'action'), self.config), apply_template(
self.config.get('URIExtractPlugin', 'message'), suspect, dict(domain=urls[0], blacklist='tbd'))
class AttachmentAddHeader(ScannerPlugin):
def __init__(self, config, section=None):
ScannerPlugin.__init__(self, config, section)
self.logger = logging.getLogger('fuglu.plugin.DomainAction')
self.requiredvars = {
'blockedaddheader': {
'default': '0',
'description': 'if set to non zero value a header will be added for blocked files and the message will be accepted\n1:\tonly filename appended as header\n2:\tfilename and details will be added as header\nany other string value will be added as-it-is to header',
}
}
def examine(self, suspect):
filename = suspect.get_tag('block.file', defaultvalue=[])
add_header = self.config.get('FiletypePlugin', 'blockedaddheader')
if len(filename) == 0 or add_header == '0':
return DUNNO
elif add_header == '1':
suspect.add_header('X-Fuglu-Blocked', str(filename['ascii']), immediate=True)
elif add_header == '2':
suspect.add_header('X-Fuglu-Blocked', str(filename['info']), immediate=True)
else:
suspect.add_header('X-Fuglu-Blocked', str(add_header), immediate=True)
return DUNNO
# return string_to_actioncode(self.config.get('URIExtractPlugin', 'action'), self.config), apply_template(
# self.config.get('URIExtractPlugin', 'message'), suspect, dict(domain=urls[0], blacklist='tbd'))
class ClamAddHeader(ScannerPlugin):
def __init__(self, config, section=None):
ScannerPlugin.__init__(self, config, section)
self.logger = logging.getLogger('fuglu.plugin.DomainAction')
self.requiredvars = {
'addheaderinfected': {
'default': '0',
'description': 'if set to non zero value a header will be added for infected files\n1:\tonly virusname appended as header\n2:\tvirusname and details will be added as header\nany other string value will be added as-it-is to header',
},
'addheaderclean': {
'default': '0',
'description': 'add header if message is clean\nany string value will be used as-it-is',
}
}
def examine(self, suspect):
virusname = suspect.get_tag('clam.virus', defaultvalue=[])
add_header = self.config.get('ClamavPlugin', 'addheaderinfected')
if len(virusname) == 0 or add_header == '0':
return DUNNO
elif add_header == '1' or add_header == '2':
suspect.add_header('X-Fuglu-ClamAV', str(virusname), immediate=True)
else:
suspect.add_header('X-Fuglu-ClamAV', str(add_header), immediate=True)
return DUNNO
class FprotAddHeader(ScannerPlugin):
def __init__(self, config, section=None):
ScannerPlugin.__init__(self, config, section)
self.logger = logging.getLogger('fuglu.plugin.DomainAction')
self.requiredvars = {
'addheaderinfected': {
'default': '0',
'description': 'if set to non zero value a header will be added for infected files\n1:\tonly virusname appended as header\n2:\tvirusname and details will be added as header\nany other string value will be added as-it-is to header',
},
'addheaderclean': {
'default': '0',
'description': 'add header if message is clean\nany string value will be used as-it-is',
}
}
def examine(self, suspect):
virusname = suspect.get_tag('fprot.virus', defaultvalue=[])
add_header = self.config.get('FprotPlugin', 'addheaderinfected')
if len(virusname) == 0 or add_header == '0':
return DUNNO
elif add_header == '1' or add_header == '2':
suspect.add_header('X-Fuglu-Fprot', str(virusname), immediate=True)
else:
suspect.add_header('X-Fuglu-Fprot', str(add_header), immediate=True)
return DUNNO
class SsspAddHeader(ScannerPlugin):
def __init__(self, config, section=None):
ScannerPlugin.__init__(self, config, section)
self.logger = logging.getLogger('fuglu.plugin.DomainAction')
self.requiredvars = {
'addheaderinfected': {
'default': '0',
'description': 'if set to non zero value a header will be added for infected files\n1:\tonly virusname appended as header\n2:\tvirusname and details will be added as header\nany other string value will be added as-it-is to header',
},
'addheaderclean': {
'default': '0',
'description': 'add header if message is clean\nany string value will be used as-it-is',
}
}
def examine(self, suspect):
virusname = suspect.get_tag('sssp.virus', defaultvalue=[])
add_header = self.config.get('SSSPPlugin', 'addheaderinfected')
if len(virusname) == 0 or add_header == '0':
return DUNNO
elif add_header == '1' or add_header == '2':
suspect.add_header('X-Fuglu-Sophos', str(virusname), immediate=True)
else:
suspect.add_header('X-Fuglu-Sophos', str(add_header), immediate=True)
return DUNNO