Documentation
¶
Overview ¶
Package mbazaar adds an abuse.ch MalwareBazaar attachment-hash lookup to yarad: the SHA256 of each scanned buffer (a MIME attachment, as the rspamd plugin POSTs it) is checked against a locally-cached set of SHA256 hashes of known malware samples. An exact hit is a direct known-bad verdict, independent of the YARA rules.
Design mirrors the URLhaus checker (the same fail-open feed-cache infra):
- The full MalwareBazaar CSV dump is downloaded ONCE per refresh interval (daily by default) into an in-memory set of raw 32-byte digests; lookups are pure local map hits, never a per-message remote API call.
- A failed refresh keeps the previous set (fail-static) and is counted.
- The dump is a ZIP (one CSV inside); a plain-CSV feed (the "recent" export or a custom URL override) is also accepted — the body is magic-sniffed.
- Digests are held as raw [32]byte map keys (not 64-char hex) to keep the full set lean (~40 MB for ~1M samples) on a memory-limited container.
Requires an abuse.ch Auth-Key (free, https://auth.abuse.ch/ — the SAME key as URLhaus). With no key the checker is disabled (New returns nil).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker holds the cached hash set and serves lookups. The zero value is not usable; use New.
func New ¶
func New(key string, refresh time.Duration, feedURL, cacheDir string, logf func(string, ...any)) *Checker
New builds a Checker and starts its background refresher. It returns nil when key is empty (feature disabled), so callers can guard on `c != nil`. refresh is clamped to the fair-use floor; feedURL falls back to the full dump. When cacheDir is non-empty the feed snapshot is persisted there and loaded on startup, so a restart serves from the last-good feed instead of an empty set.
func (*Checker) Check ¶
Check hashes data and reports a Hit when its SHA256 is a known malware sample. It returns a slice (0 or 1 hit) for symmetry with the URLhaus checker, and is safe for concurrent use.
func (*Checker) CheckDigest ¶
CheckDigest is Check for a caller that has already computed the SHA256 of the buffer, so the (up to 8 MiB) body is not hashed a second time per scan.
Source Files