CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
249 stars 15 forks source link

Task pre-empted in Extract service due to TypeError #241

Closed kam193 closed 4 months ago

kam193 commented 4 months ago

Describe the bug Since one of the Extract service versions in last weeks, the service cannot extract some files. I see the following errors in logs:

Exiting:
Traceback (most recent call last):
  File \"/var/lib/assemblyline/.local/lib/python3.11/site-packages/assemblyline_core/server_base.py\", line 100, in run
    self.try_run()
  File \"/var/lib/assemblyline/.local/lib/python3.11/site-packages/assemblyline_v4_service/run_privileged_service.py\", line 162, in try_run
    task, _ = self.tasking_client.get_task(self.client_id, self.service_name, self.service_config['version'],
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File \"/var/lib/assemblyline/.local/lib/python3.11/site-packages/elasticapm/traces.py\", line 1080, in decorated
    return func(*args, **kwds)
           ^^^^^^^^^^^^^^^^^^^
  File \"/var/lib/assemblyline/.local/lib/python3.11/site-packages/assemblyline_core/tasking_client.py\", line 267, in get_task
    result.expiry_ts = max(result.expiry_ts, now_as_iso(task.ttl * 24 * 60 * 60))
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: '>' not supported between instances of 'str' and 'datetime.datetime'

To Reproduce I'm not sure how to provide steps to reproduce. It happens with some files, but based on the stack trace, it is probably related to existing old results.

What I suspect, based on the following UI information, where the Count value is higher than the number of submissions in the submission details, is that maybe the file was uploaded in the past, then submission expired, and now it came again. Although I don't really believe in such an explanation (and perhaps misunderstand the Count value), and I don't have any way to confirm it.

obraz

Expected behavior File is extracted.

Screenshots

Environment (please complete the following information if pertinent):

Additional context

cccs-rs commented 4 months ago

Should be resolved in the latest stable of the service following release 4.5.0.38 of Assemblyline.

kam193 commented 4 months ago

Thank you!