paste-ee/yarascanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use Yara 4.0.5, update api

Browse Source
This commit is contained in:
Tyler
2021-02-24 22:00:39 -05:00
parent ed71b46945
commit 75e9a42a51
4 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
main.go
View File

@ -5,7 +5,7 @@ import (
"encoding/json"
"errors"
"github.com/beanstalkd/go-beanstalk"
"github.com/hillu/go-yara"
"github.com/hillu/go-yara/v4"
log "github.com/sirupsen/logrus"
"github.com/spf13/afero"
"github.com/spf13/afero/zipfs"
@ -25,7 +25,7 @@ import (
type Job struct {
PasteID string
Data []byte
Data []byte
}
var (
@ -80,7 +80,7 @@ func main() {
signal.Notify(ch, syscall.SIGKILL, syscall.SIGTERM, syscall.SIGINT)
<- ch
<-ch
}
func loadRules(c *yara.Compiler) {
@ -180,7 +180,7 @@ func watchQueue(c *beanstalk.Conn, jobChan chan Job) {
}
log.WithFields(log.Fields{
"id": id,
"id": id,
"body": body,
}).Debug("Handling job")
@ -202,25 +202,27 @@ func worker(rules *yara.Rules, jobs chan Job) {
}
for {
job := <- jobs
job := <-jobs
processJob(s, job)
}
}
func processJob(s *yara.Scanner, job Job) {
matched, err := s.ScanMem(job.Data)
var m yara.MatchRules
err := s.SetCallback(&m).ScanMem(job.Data)
if err != nil {
return
}
// Respond with job
if len(matched) < 1 {
if len(m) < 1 {
return
}
quarantine(job.PasteID, matched[0].Rule)
quarantine(job.PasteID, m[0].Rule)
}
func quarantine(pasteId, reason string) {
@ -228,7 +230,7 @@ func quarantine(pasteId, reason string) {
v.Set("reason", reason)
req, err := http.NewRequest(http.MethodPost, viper.GetString("pasteUrl") + "/admin/quarantine/" + pasteId, nil)
req, err := http.NewRequest(http.MethodPost, viper.GetString("pasteUrl")+"/admin/quarantine/"+pasteId, nil)
if err != nil {
return
@ -241,4 +243,4 @@ func quarantine(pasteId, reason string) {
}
defer res.Body.Close()
}
}