log2timeline / l2tscaffolder

Scaffolders for bootstrapping development of open source forensics tools.
http://l2tscaffolder.readthedocs.io/
Apache License 2.0
6 stars 9 forks source link

Timesketch crashes with current "ts_sketch_analyzer.jinja2" template #82

Closed jkppr closed 2 years ago

jkppr commented 2 years ago

Describe the bug

When using l2t_scaffolder.py to create a new timesketch sketch analyzer the template ts_sketch_analyzer.jinja2 is used. However, the argument for the class in line 9 interface.BaseSketchAnalyzer seems to be deprecated and renamed to interface.BaseAnalyzer. Trying to run timesketch with the analyzer file generated by the l2t_scaffolder.py tool does crash with AttributeError: module 'timesketch.lib.analyzers.interface' has no attribute 'BaseSketchAnalyzer'.

To Reproduce

Steps to reproduce the behavior:

$ l2t_scaffolder.py 
   == Starting the scaffolder ==
Gathering required information.

Available definitions: 
  [0] plaso
  [1] timesketch
  [2] turbinia
Definition choice: 1
timesketch chosen.

Path to the project root: .
Path [.] set as the project path.

Name of the module to be generated. This can be something like "foobar sqlite" or "event analytics".

This will be used for class name generation and file name prefixes.
Module Name: screenshot
About to create a new feature branch to store newly generated code.
ERROR:root:Running: "git show-ref --verify --quiet refs/heads/"screenshot"" failed with error: .
Creating feature branch: screenshot inside .
Switching to feature branch screenshot

Available scaffolders for timesketch:
  [0] index_analyzer
  [1] sketch_analyzer
Scaffolder choice: 1
Ready to generate files? [Y/n]: 
File: ./timesketch/lib/analyzers/screenshot.py written to disk.
File: ./timesketch/lib/analyzers/screenshot_test.py written to disk.
File: ./timesketch/lib/analyzers/__init__.py written to disk.

Error As soon as I try to run timesketch after creating the new analyzer template the timesketch container throws the following error:

[2022-06-07 15:26:01 +0000] [156] [ERROR] Exception in worker process
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/arbiter.py", line 586, in spawn_worker
    worker.init_process()
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/workers/base.py", line 135, in init_process
    self.load_wsgi()
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/workers/base.py", line 144, in load_wsgi
    self.wsgi = self.app.wsgi()
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/app/base.py", line 67, in wsgi
    self.callable = self.load()
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/app/wsgiapp.py", line 52, in load
    return self.load_wsgiapp()
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/app/wsgiapp.py", line 41, in load_wsgiapp
    return util.import_app(self.app_uri)
  File "/usr/local/lib/python3.8/dist-packages/gunicorn/util.py", line 350, in import_app
    __import__(module)
  File "/usr/local/src/timesketch/timesketch/wsgi.py", line 39, in <module>
    from timesketch.app import configure_logger
  File "/usr/local/src/timesketch/timesketch/app.py", line 32, in <module>
    from timesketch.api.v1.routes import API_ROUTES as V1_API_ROUTES
  File "/usr/local/src/timesketch/timesketch/api/v1/routes.py", line 18, in <module>
    from .resources.aggregation import AggregationGroupResource
  File "/usr/local/src/timesketch/timesketch/api/v1/resources/aggregation.py", line 30, in <module>
    from timesketch.api.v1 import utils
  File "/usr/local/src/timesketch/timesketch/api/v1/utils.py", line 29, in <module>
    from timesketch.lib import ontology
  File "/usr/local/src/timesketch/timesketch/lib/ontology.py", line 17, in <module>
    from timesketch.lib.analyzers import interface
  File "/usr/local/src/timesketch/timesketch/lib/analyzers/__init__.py", line 29, in <module>
    from timesketch.lib.analyzers import screenshot
  File "/usr/local/src/timesketch/timesketch/lib/analyzers/screenshot.py", line 9, in <module>
    class ScreenshotSketchPlugin(interface.BaseSketchAnalyzer):
AttributeError: module 'timesketch.lib.analyzers.interface' has no attribute 'BaseSketchAnalyzer'
[2022-06-07 15:26:01 +0000] [156] [INFO] Worker exiting (pid: 156)
[2022-06-07 15:26:02 +0000] [115] [INFO] Shutting down: Master
[2022-06-07 15:26:02 +0000] [115] [INFO] Reason: Worker failed to boot.

Expected behavior

When using the l2t_scaffolder.py tool to create a new analyzer template I would expect it not to crash the timesketch server.

Possible solution Change ts_sketch_analyzer.jinja2 line 9 to class {{ class_name }}SketchPlugin(interface.BaseAnalyzer):

Desktop (please complete the following information):

**l2tscaffolder Version``

$ pip3 list | grep l2tscaffolder
l2tscaffolder               20200511