|
...
|
...
|
@@ -1460,7 +1460,7 @@ cl_error_t cli_virus_found_cb(cli_ctx *ctx, const char *virname, bool is_potenti
|
|
1460
|
1460
|
is_potentially_unwanted ? IndicatorType_PotentiallyUnwanted : IndicatorType_Strong,
|
|
1461
|
1461
|
&remove_indicator_error);
|
|
1462
|
1462
|
if (!remove_successful) {
|
|
1463
|
|
- cli_errmsg("Failed to remove indicator from scan evidence: %s\n", ffierror_fmt(remove_indicator_error));
|
|
|
1463
|
+ cli_errmsg("cli_virus_found_cb: Failed to remove indicator from scan evidence: %s\n", ffierror_fmt(remove_indicator_error));
|
|
1464
|
1464
|
status = CL_ERROR;
|
|
1465
|
1465
|
goto done;
|
|
1466
|
1466
|
}
|
|
...
|
...
|
@@ -1474,7 +1474,7 @@ cl_error_t cli_virus_found_cb(cli_ctx *ctx, const char *virname, bool is_potenti
|
|
1474
|
1474
|
// Get the index of the last alert.
|
|
1475
|
1475
|
size_t num_alerts = json_object_array_length(alerts);
|
|
1476
|
1476
|
if (0 == num_alerts) {
|
|
1477
|
|
- cli_errmsg("Attempting to ignore an alerts, but alert not found in metadata Alerts array.\n");
|
|
|
1477
|
+ cli_errmsg("cli_virus_found_cb: Attempting to ignore an alert, but alert not found in metadata Alerts array.\n");
|
|
1478
|
1478
|
status = CL_ERROR;
|
|
1479
|
1479
|
goto done;
|
|
1480
|
1480
|
}
|
|
...
|
...
|
@@ -1482,7 +1482,7 @@ cl_error_t cli_virus_found_cb(cli_ctx *ctx, const char *virname, bool is_potenti
|
|
1482
|
1482
|
// Remove the alert from the Alerts array.
|
|
1483
|
1483
|
json_ret = json_object_array_del_idx(alerts, num_alerts - 1, 1);
|
|
1484
|
1484
|
if (0 != json_ret) {
|
|
1485
|
|
- cli_errmsg("Failed to remove alert from metadata JSON.\n");
|
|
|
1485
|
+ cli_errmsg("cli_virus_found_cb: Failed to remove alert from metadata JSON.\n");
|
|
1486
|
1486
|
status = CL_ERROR;
|
|
1487
|
1487
|
goto done;
|
|
1488
|
1488
|
}
|
|
...
|
...
|
@@ -1501,7 +1501,7 @@ cl_error_t cli_virus_found_cb(cli_ctx *ctx, const char *virname, bool is_potenti
|
|
1501
|
1501
|
// Get the index of the last indicator.
|
|
1502
|
1502
|
size_t num_indicators = json_object_array_length(indicators);
|
|
1503
|
1503
|
if (0 == num_indicators) {
|
|
1504
|
|
- cli_errmsg("Attempting to ignore an alerts, but alert not found in metadata Alerts array.\n");
|
|
|
1504
|
+ cli_errmsg("cli_virus_found_cb: Attempting to ignore an alert, but alert not found in metadata Alerts array.\n");
|
|
1505
|
1505
|
status = CL_ERROR;
|
|
1506
|
1506
|
goto done;
|
|
1507
|
1507
|
}
|
|
...
|
...
|
@@ -1517,13 +1517,13 @@ cl_error_t cli_virus_found_cb(cli_ctx *ctx, const char *virname, bool is_potenti
|
|
1517
|
1517
|
// Add an "Ignored" string to the indicator object.
|
|
1518
|
1518
|
json_object *ignored = json_object_new_string("Signature ignored by alert application callback");
|
|
1519
|
1519
|
if (!ignored) {
|
|
1520
|
|
- cli_errmsg("metadata_json_trust_this_layer: no memory for json ignored indicator object\n");
|
|
|
1520
|
+ cli_errmsg("cli_virus_found_cb: no memory for json ignored indicator object\n");
|
|
1521
|
1521
|
status = CL_EMEM;
|
|
1522
|
1522
|
goto done;
|
|
1523
|
1523
|
}
|
|
1524
|
1524
|
json_ret = json_object_object_add(indicator_obj, "Ignored", ignored);
|
|
1525
|
1525
|
if (0 != json_ret) {
|
|
1526
|
|
- cli_errmsg("metadata_json_trust_this_layer: Failed to add Ignored boolean to indicator object\n");
|
|
|
1526
|
+ cli_errmsg("cli_virus_found_cb: Failed to add Ignored boolean to indicator object\n");
|
|
1527
|
1527
|
status = CL_ERROR;
|
|
1528
|
1528
|
goto done;
|
|
1529
|
1529
|
}
|
|
...
|
...
|
@@ -1670,11 +1670,13 @@ static cl_error_t append_virus(cli_ctx *ctx, const char *virname, IndicatorType
|
|
1670
|
1670
|
|
|
1671
|
1671
|
// Set the verdict
|
|
1672
|
1672
|
ctx->recursion_stack[ctx->recursion_level].verdict = CL_VERDICT_STRONG_INDICATOR;
|
|
|
1673
|
+ cli_dbgmsg("append_virus: Strong indicator '%s' added to evidence\n", virname);
|
|
1673
|
1674
|
} else if (type == IndicatorType_PotentiallyUnwanted) {
|
|
1674
|
1675
|
// Set the verdict, but don't override a strong indicator verdict.
|
|
1675
|
1676
|
if (CL_VERDICT_STRONG_INDICATOR != ctx->recursion_stack[ctx->recursion_level].verdict) {
|
|
1676
|
1677
|
ctx->recursion_stack[ctx->recursion_level].verdict = CL_VERDICT_POTENTIALLY_UNWANTED;
|
|
1677
|
1678
|
}
|
|
|
1679
|
+ cli_dbgmsg("append_virus: Potentially Unwanted indicator '%s' added to evidence\n", virname);
|
|
1678
|
1680
|
} else if (type == IndicatorType_Weak) {
|
|
1679
|
1681
|
cli_dbgmsg("append_virus: Weak indicator '%s' added to evidence\n", virname);
|
|
1680
|
1682
|
}
|