diff --git a/Dockerfile b/Dockerfile index 999ecea..1bd216d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,11 @@ -FROM golang:1.19-alpine3.16 AS builder +FROM golang:1.22-alpine3.20 AS builder RUN apk update upgrade; -ENV YARA 4.2.3 +ENV YARA 4.5.1 # Install Yara -RUN apk --update add --no-cache openssl file bison jansson ca-certificates +RUN apk --update add --no-cache openssl file bison jansson ca-certificates zlib RUN apk --update add --no-cache \ pkgconfig \ openssl-dev \ @@ -19,15 +19,19 @@ RUN apk --update add --no-cache \ flex \ git \ gcc \ - && echo "===> Install Yara from source..." \ - && cd /tmp \ + libcrypto3 \ + libmagic-static \ + linux-headers \ + && echo "===> Install Yara from source..." + +RUN cd /tmp \ && git clone --recursive --branch v${YARA} https://github.com/VirusTotal/yara.git \ && cd /tmp/yara \ && ./bootstrap.sh \ && sync \ && ./configure --enable-magic \ + --enable-crypto \ --enable-cuckoo \ - --enable-dotnet \ && make \ && make install \ && rm -rf /tmp/* @@ -45,7 +49,7 @@ RUN go build -o /go/bin/hawk RUN git clone https://github.com/Yara-Rules/rules.git /rules -FROM alpine:3.16 +FROM alpine:3.20 # Update RUN apk update upgrade diff --git a/README.md b/README.md index 0721818..33feac8 100644 --- a/README.md +++ b/README.md @@ -51,24 +51,30 @@ The following image tags are available: Run hawk docker image: ```bash docker run -p 9000:9999 -itd --name hawk cloudina/hawk +docker run -p 9000:9999 -v $HOME/.aws/credentials:/go/src/app/.aws/credentials:ro -itd --name hawk cloudina/hawk ``` Test that service detects common test virus signature: -**HTTP** +**EXAMPLES** ```bash -$ curl --data "@./testsamples/request/s3filescan" http://0.0.0.0:9000/s3/scanfile -H 'Content-Type: application/json' +# Request - Scanning a file from S3 , ./testsamples/request/s3filescan has config for s3 +curl --data "@./testsamples/request/s3filescan" http://0.0.0.0:9000/s3/scanfile -H 'Content-Type: application/json' -{"filename":"stream","matches":[{"Rule":"Win.Test.EICAR_HDB-1","namespace":"","tags":null}],"status":"INFECTED"}% +# Response +{"filename":"stream","matches":[{"Rule":"Win.Test.EICAR_HDB-1","namespace":"","tags":null}],"status":"INFECTED"}% -$ curl --data "@./testsamples/scanfiles/eicar" http://0.0.0.0:9000/scanstream -H 'Content-Type: application/json' +# Request - Uploading sample virus file to API +curl --data "@./testsamples/scanfiles/eicar" http://0.0.0.0:9000/scanstream -H 'Content-Type: application/json' +# Response {"filename":"stream","matches":[{"Rule":"Win.Test.EICAR_HDB-1","namespace":"","tags":null}],"status":"INFECTED"} -$ curl --data "@./testsamples/scanfiles/hello.txt" http://0.0.0.0:9000/scanstream -H 'Content-Type: application/json' +# Request - Uploading sample clean file to API +curl --data "@./testsamples/scanfiles/hello.txt" http://0.0.0.0:9000/scanstream -H 'Content-Type: application/json' +# Response {"filename":"stream","matches":[],"status":"CLEAN"} - ``` ## Networking diff --git a/s3.go b/s3.go index 4e8c317..98b2d4e 100644 --- a/s3.go +++ b/s3.go @@ -29,7 +29,7 @@ func getPartSize() int64 { } else { sizeInMb, err := strconv.Atoi(strSizeInMb) if err != nil { - elog.Println(time.Now().Format(time.RFC3339) + "DOWNLOAD_PART_SIZE conversion issue..using DefaultDownloadPartSize ") + elog.Println(time.Now().Format(time.RFC3339) + " DOWNLOAD_PART_SIZE conversion issue..using DefaultDownloadPartSize ") partSize = manager.DefaultDownloadPartSize } else { partSize = int64(sizeInMb) * 1024 * 1204 @@ -41,7 +41,7 @@ func getPartSize() int64 { func getRegion() string { region, err := os.LookupEnv("AWS_REGION") if !err { - elog.Println(time.Now().Format(time.RFC3339) + "AWS_REGION is not present..using us-east-1") + elog.Println(time.Now().Format(time.RFC3339) + " AWS_REGION is not present..using us-east-1") region = "us-east-1" } return region @@ -211,7 +211,7 @@ func readFile(bucket string, item string) ([] byte, error) { return nil, errors.New("Filed to read file") } // pre-allocate in memory buffer, where headObject type is *s3.HeadObjectOutput - buff := make([]byte, int(headObject.ContentLength)) + buff := make([]byte, int(*headObject.ContentLength)) // wrap with aws.WriteAtBuffer w := manager.NewWriteAtBuffer(buff) // download file into the memory