finished unit tests and docstrings

This commit is contained in:
Volodymyr Smirnov
2020-10-29 16:09:56 +02:00
parent b2902c128a
commit b68c285ce5
48 changed files with 910 additions and 194 deletions

View File

@@ -1,77 +1,64 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Text.RegularExpressions;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Abstracts
{
/// <inheritdoc />
public abstract class AbstractLocalProcessScanBackend : AbstractScanBackend
{
private readonly ILogger _logger;
private readonly IProcessRunner _processRunner;
protected AbstractLocalProcessScanBackend(ILogger logger)
/// <inheritdoc />
protected AbstractLocalProcessScanBackend(IProcessRunner processRunner)
{
_logger = logger;
_processRunner = processRunner;
}
/// <summary>
/// Regex to extract names of threats.
/// </summary>
protected abstract Regex MatchRegex { get; }
/// <summary>
/// Path to the backend.
/// </summary>
protected abstract string BackendPath { get; }
/// <summary>
/// Parse StdErr instead of StdOut.
/// </summary>
protected virtual bool ParseStdErr { get; } = false;
/// <summary>
/// Throw on non-zero exit code.
/// </summary>
protected virtual bool ThrowOnNonZeroExitCode { get; } = true;
/// <summary>
/// Get backend process parameters.
/// </summary>
/// <param name="path">Path to the temporary file.</param>
/// <returns>Formatted string with parameters and path.</returns>
protected abstract string GetBackendArguments(string path);
public override async Task<string[]> ScanAsync(string path, CancellationToken cancellationToken)
/// <inheritdoc />
public override Task<string[]> ScanAsync(string path, CancellationToken cancellationToken)
{
var process = new Process
{
StartInfo = new ProcessStartInfo(BackendPath, GetBackendArguments(path))
{
RedirectStandardError = true,
RedirectStandardOutput = true,
WorkingDirectory = Path.GetDirectoryName(BackendPath) ?? Directory.GetCurrentDirectory()
}
};
var exitCode = _processRunner.RunTillCompletion(BackendPath, GetBackendArguments(path), cancellationToken,
out var standardOutput, out var standardError);
_logger.LogInformation(
$"Starting process {process.StartInfo.FileName} " +
$"with arguments {process.StartInfo.Arguments} " +
$"in working directory {process.StartInfo.WorkingDirectory}");
if (ThrowOnNonZeroExitCode && exitCode != 0)
throw new ApplicationException($"Process has terminated with an exit code {exitCode}");
process.Start();
cancellationToken.Register(() =>
{
if (process.HasExited)
return;
process.Kill(true);
throw new TimeoutException("Scanning failed to complete within the timeout");
});
process.WaitForExit();
_logger.LogInformation($"Process has exited with code {process.ExitCode}");
var standardOutput = await process.StandardOutput.ReadToEndAsync();
var standardError = await process.StandardError.ReadToEndAsync();
_logger.LogDebug($"Process standard output: {standardOutput}");
_logger.LogDebug($"Process standard error: {standardError}");
if (ThrowOnNonZeroExitCode && process.ExitCode != 0)
throw new ApplicationException($"Process has terminated with an exit code {process.ExitCode}");
return MatchRegex
return Task.FromResult(MatchRegex
.Matches(ParseStdErr ? standardError : standardOutput)
.Where(x => x.Success)
.Select(x => x.Groups["threat"].Value)
.ToArray();
.ToArray());
}
}
}

View File

@@ -1,4 +1,5 @@
using System;
using System.Diagnostics.CodeAnalysis;
using System.IO;
using System.Net.Http;
using System.Threading;
@@ -7,12 +8,17 @@ using MalwareMultiScan.Backends.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Abstracts
{
/// <inheritdoc />
[ExcludeFromCodeCoverage]
public abstract class AbstractScanBackend : IScanBackend
{
/// <inheritdoc />
public abstract string Id { get; }
/// <inheritdoc />
public abstract Task<string[]> ScanAsync(string path, CancellationToken cancellationToken);
/// <inheritdoc />
public async Task<string[]> ScanAsync(Uri uri, CancellationToken cancellationToken)
{
using var httpClient = new HttpClient();
@@ -22,6 +28,7 @@ namespace MalwareMultiScan.Backends.Backends.Abstracts
return await ScanAsync(uriStream, cancellationToken);
}
/// <inheritdoc />
public async Task<string[]> ScanAsync(Stream stream, CancellationToken cancellationToken)
{
var tempFile = Path.GetTempFileName();

View File

@@ -1,24 +1,31 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class ClamavScanBackend : AbstractLocalProcessScanBackend
{
public ClamavScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public ClamavScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "clamav";
/// <inheritdoc />
protected override string BackendPath { get; } = "/usr/bin/clamdscan";
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@"(\S+): (?<threat>[\S]+) FOUND", RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override bool ThrowOnNonZeroExitCode { get; } = false;
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return $"-m --fdpass --no-summary {path}";

View File

@@ -1,23 +1,29 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class ComodoScanBackend : AbstractLocalProcessScanBackend
{
public ComodoScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public ComodoScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "comodo";
/// <inheritdoc />
protected override string BackendPath { get; } = "/opt/COMODO/cmdscan";
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@".* ---> Found Virus, Malware Name is (?<threat>.*)",
RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return $"-v -s {path}";

View File

@@ -1,22 +1,28 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class DrWebScanBackend : AbstractLocalProcessScanBackend
{
public DrWebScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public DrWebScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "drweb";
/// <inheritdoc />
protected override string BackendPath { get; } = "/usr/bin/drweb-ctl";
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@".* - infected with (?<threat>[\S ]+)", RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return $"scan {path}";

View File

@@ -6,20 +6,25 @@ using MalwareMultiScan.Backends.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class DummyScanBackend : IScanBackend
{
/// <inheritdoc />
public string Id { get; } = "dummy";
/// <inheritdoc />
public Task<string[]> ScanAsync(string path, CancellationToken cancellationToken)
{
return Scan();
}
/// <inheritdoc />
public Task<string[]> ScanAsync(Uri uri, CancellationToken cancellationToken)
{
return Scan();
}
/// <inheritdoc />
public Task<string[]> ScanAsync(Stream stream, CancellationToken cancellationToken)
{
return Scan();
@@ -29,7 +34,7 @@ namespace MalwareMultiScan.Backends.Backends.Implementations
{
await Task.Delay(
TimeSpan.FromSeconds(5));
return new[] {"Malware.Dummy.Result"};
}
}

View File

@@ -1,22 +1,28 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class KesScanBackend : AbstractLocalProcessScanBackend
{
public KesScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public KesScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "kes";
/// <inheritdoc />
protected override string BackendPath { get; } = "/bin/bash";
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@"[ +]DetectName.*: (?<threat>.*)", RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return $"/usr/bin/kesl-scan {path}";

View File

@@ -1,24 +1,31 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class McAfeeScanBackend : AbstractLocalProcessScanBackend
{
public McAfeeScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public McAfeeScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "mcafee";
/// <inheritdoc />
protected override string BackendPath { get; } = "/usr/local/uvscan/uvscan";
/// <inheritdoc />
protected override bool ThrowOnNonZeroExitCode { get; } = false;
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@".* ... Found: (?<threat>.*).", RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return $"--SECURE {path}";

View File

@@ -1,24 +1,31 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class SophosScanBackend : AbstractLocalProcessScanBackend
{
public SophosScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public SophosScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "sophos";
/// <inheritdoc />
protected override string BackendPath { get; } = "/opt/sophos-av/bin/savscan";
/// <inheritdoc />
protected override bool ThrowOnNonZeroExitCode { get; } = false;
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@">>> Virus '(?<threat>.*)' found in file .*", RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return $"-f -archive -ss {path}";

View File

@@ -1,25 +1,32 @@
using System.Text.RegularExpressions;
using MalwareMultiScan.Backends.Backends.Abstracts;
using Microsoft.Extensions.Logging;
using MalwareMultiScan.Backends.Services.Interfaces;
namespace MalwareMultiScan.Backends.Backends.Implementations
{
/// <inheritdoc />
public class WindowsDefenderScanBackend : AbstractLocalProcessScanBackend
{
public WindowsDefenderScanBackend(ILogger logger) : base(logger)
/// <inheritdoc />
public WindowsDefenderScanBackend(IProcessRunner processRunner) : base(processRunner)
{
}
/// <inheritdoc />
public override string Id { get; } = "windows-defender";
/// <inheritdoc />
protected override string BackendPath { get; } = "/opt/mpclient";
/// <inheritdoc />
protected override Regex MatchRegex { get; } =
new Regex(@"EngineScanCallback\(\): Threat (?<threat>[\S]+) identified",
RegexOptions.Compiled | RegexOptions.Multiline);
/// <inheritdoc />
protected override bool ParseStdErr { get; } = true;
/// <inheritdoc />
protected override string GetBackendArguments(string path)
{
return path;

View File

@@ -1,14 +1,48 @@
namespace MalwareMultiScan.Backends.Enums
{
/// <summary>
/// Backend type.
/// </summary>
public enum BackendType
{
/// <summary>
/// Dummy
/// </summary>
Dummy,
/// <summary>
/// Windows Defender.
/// </summary>
Defender,
/// <summary>
/// ClamAV.
/// </summary>
Clamav,
/// <summary>
/// DrWeb.
/// </summary>
DrWeb,
/// <summary>
/// KES.
/// </summary>
Kes,
/// <summary>
/// Comodo.
/// </summary>
Comodo,
/// <summary>
/// Sophos.
/// </summary>
Sophos,
/// <summary>
/// McAfee.
/// </summary>
McAfee
}
}

View File

@@ -1,32 +1,72 @@
using System;
using System.Diagnostics.CodeAnalysis;
using EasyNetQ;
using MalwareMultiScan.Backends.Backends.Implementations;
using MalwareMultiScan.Backends.Enums;
using MalwareMultiScan.Backends.Interfaces;
using MalwareMultiScan.Backends.Services.Implementations;
using MalwareMultiScan.Backends.Services.Interfaces;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
namespace MalwareMultiScan.Backends.Extensions
{
/// <summary>
/// Extensions for IServiceCollection.
/// </summary>
[ExcludeFromCodeCoverage]
public static class ServiceCollectionExtensions
{
public static void AddScanningBackend(this IServiceCollection services, BackendType type)
/// <summary>
/// Add RabbitMQ service.
/// </summary>
/// <param name="services">Service collection.</param>
/// <param name="configuration">Configuration.</param>
public static void AddRabbitMq(this IServiceCollection services, IConfiguration configuration)
{
using var provider = services.BuildServiceProvider();
services.AddSingleton(x =>
RabbitHutch.CreateBus(configuration.GetConnectionString("RabbitMQ")));
}
var logger = provider.GetService<ILogger<IScanBackend>>();
/// <summary>
/// Add scanning backend.
/// </summary>
/// <param name="services">Service collection.</param>
/// <param name="configuration">Configuration.</param>
/// <exception cref="ArgumentOutOfRangeException">Unknown backend.</exception>
public static void AddScanningBackend(this IServiceCollection services, IConfiguration configuration)
{
services.AddSingleton<IProcessRunner, ProcessRunner>();
services.AddSingleton<IScanBackend>(type switch
switch (configuration.GetValue<BackendType>("BackendType"))
{
BackendType.Dummy => new DummyScanBackend(),
BackendType.Defender => new WindowsDefenderScanBackend(logger),
BackendType.Clamav => new ClamavScanBackend(logger),
BackendType.DrWeb => new DrWebScanBackend(logger),
BackendType.Kes => new KesScanBackend(logger),
BackendType.Comodo => new ComodoScanBackend(logger),
BackendType.Sophos => new SophosScanBackend(logger),
BackendType.McAfee => new McAfeeScanBackend(logger),
_ => throw new NotImplementedException()
});
case BackendType.Dummy:
services.AddSingleton<IScanBackend, DummyScanBackend>();
break;
case BackendType.Defender:
services.AddSingleton<IScanBackend, WindowsDefenderScanBackend>();
break;
case BackendType.Clamav:
services.AddSingleton<IScanBackend, ClamavScanBackend>();
break;
case BackendType.DrWeb:
services.AddSingleton<IScanBackend, DrWebScanBackend>();
break;
case BackendType.Kes:
services.AddSingleton<IScanBackend, KesScanBackend>();
break;
case BackendType.Comodo:
services.AddSingleton<IScanBackend, ComodoScanBackend>();
break;
case BackendType.Sophos:
services.AddSingleton<IScanBackend, SophosScanBackend>();
break;
case BackendType.McAfee:
services.AddSingleton<IScanBackend, McAfeeScanBackend>();
break;
default:
throw new ArgumentOutOfRangeException();
}
}
}
}

View File

@@ -5,11 +5,38 @@ using System.Threading.Tasks;
namespace MalwareMultiScan.Backends.Interfaces
{
/// <summary>
/// Scan backend.
/// </summary>
public interface IScanBackend
{
/// <summary>
/// Unique backend id.
/// </summary>
public string Id { get; }
/// <summary>
/// Scan file.
/// </summary>
/// <param name="path">File path.</param>
/// <param name="cancellationToken">Cancellation token.</param>
/// <returns>List of detected threats.</returns>
public Task<string[]> ScanAsync(string path, CancellationToken cancellationToken);
/// <summary>
/// Scan URL.
/// </summary>
/// <param name="uri">URL.</param>
/// <param name="cancellationToken">Cancellation token.</param>
/// <returns>List of detected threats.</returns>
public Task<string[]> ScanAsync(Uri uri, CancellationToken cancellationToken);
/// <summary>
/// Scan stream.
/// </summary>
/// <param name="stream">Stream.</param>
/// <param name="cancellationToken">Cancellation token.</param>
/// <returns>List of detected threats.</returns>
public Task<string[]> ScanAsync(Stream stream, CancellationToken cancellationToken);
}
}

View File

@@ -2,11 +2,19 @@
<PropertyGroup>
<TargetFramework>netcoreapp3.1</TargetFramework>
<Company>Volodymyr Smirnov</Company>
<Product>MalwareMultiScan Backends</Product>
<AssemblyVersion>1.0.0</AssemblyVersion>
<FileVersion>1.0.0</FileVersion>
<GenerateDocumentationFile>true</GenerateDocumentationFile>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="EasyNetQ" Version="5.6.0" />
<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="3.1.9" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="3.1.9" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="3.1.9" />
<PackageReference Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="3.1.9" />
</ItemGroup>
</Project>

View File

@@ -2,10 +2,19 @@ using System;
namespace MalwareMultiScan.Backends.Messages
{
/// <summary>
/// Scan request message.
/// </summary>
public class ScanRequestMessage
{
/// <summary>
/// Result id.
/// </summary>
public string Id { get; set; }
/// <summary>
/// Remote URL.
/// </summary>
public Uri Uri { get; set; }
}
}

View File

@@ -1,15 +1,33 @@
using System;
namespace MalwareMultiScan.Backends.Messages
{
/// <summary>
/// Scan result message.
/// </summary>
public class ScanResultMessage
{
/// <summary>
/// Result id.
/// </summary>
public string Id { get; set; }
/// <summary>
/// Backend.
/// </summary>
public string Backend { get; set; }
/// <summary>
/// Status.
/// </summary>
public bool Succeeded { get; set; }
public string[] Threats { get; set; }
/// <summary>
/// List of detected threats.
/// </summary>
public string[] Threats { get; set; }
/// <summary>
/// Duration.
/// </summary>
public long Duration { get; set; }
}
}

View File

@@ -0,0 +1,81 @@
using System;
using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.IO;
using System.Threading;
using MalwareMultiScan.Backends.Services.Interfaces;
using Microsoft.Extensions.Logging;
namespace MalwareMultiScan.Backends.Services.Implementations
{
/// <summary>
///
/// </summary>
[ExcludeFromCodeCoverage]
public class ProcessRunner : IProcessRunner
{
private readonly ILogger<ProcessRunner> _logger;
/// <summary>
/// Initialize process runner.
/// </summary>
/// <param name="logger">Logger.</param>
public ProcessRunner(ILogger<ProcessRunner> logger)
{
_logger = logger;
}
/// <summary>
///
/// </summary>
/// <param name="path"></param>
/// <param name="arguments"></param>
/// <param name="cancellationToken"></param>
/// <param name="standardOutput"></param>
/// <param name="standardError"></param>
/// <returns></returns>
/// <exception cref="TimeoutException"></exception>
public int RunTillCompletion(string path, string arguments, CancellationToken cancellationToken,
out string standardOutput, out string standardError)
{
var process = new Process
{
StartInfo = new ProcessStartInfo(path, arguments)
{
RedirectStandardError = true,
RedirectStandardOutput = true,
WorkingDirectory = Path.GetDirectoryName(path) ?? Directory.GetCurrentDirectory()
}
};
_logger.LogInformation(
$"Starting process {process.StartInfo.FileName} " +
$"with arguments {process.StartInfo.Arguments} " +
$"in working directory {process.StartInfo.WorkingDirectory}");
process.Start();
cancellationToken.Register(() =>
{
if (process.HasExited)
return;
process.Kill(true);
throw new TimeoutException("Scanning failed to complete within the timeout");
});
process.WaitForExit();
_logger.LogInformation($"Process has exited with code {process.ExitCode}");
standardOutput = process.StandardOutput.ReadToEnd();
standardError = process.StandardError.ReadToEnd();
_logger.LogDebug($"Process standard output: {standardOutput}");
_logger.LogDebug($"Process standard error: {standardError}");
return process.ExitCode;
}
}
}

View File

@@ -0,0 +1,22 @@
using System.Threading;
namespace MalwareMultiScan.Backends.Services.Interfaces
{
/// <summary>
/// Process runner.
/// </summary>
public interface IProcessRunner
{
/// <summary>
/// Run process till completion.
/// </summary>
/// <param name="path">Path to binary.</param>
/// <param name="arguments">Arguments.</param>
/// <param name="token">Cancellation token.</param>
/// <param name="standardOutput">Standard output of a process.</param>
/// <param name="standardError">Standard error of a process.</param>
/// <returns>Exit code.</returns>
int RunTillCompletion(string path, string arguments, CancellationToken token,
out string standardOutput, out string standardError);
}
}