scVENUS / PeekabooAV

Peekaboo Extended Email Attachment Behavior Observation Owl
https://peekabooav.de
GNU General Public License v3.0
66 stars 20 forks source link

Traceback if Cuckoo API sends invalid response #159

Closed michaelweiser closed 4 years ago

michaelweiser commented 4 years ago

If the Cuckoo API sends an invalid response we run into an exception and log it (non-fatally):

urllib3.connectionpool - (Worker-1) - DEBUG - http://127.0.0.1:8090 "POST /tasks/create/file HTTP/1.1" 200 22
peekaboo.ruleset.engine - (Worker-1) - WARNING - Unexpected error in 'cuckoo_evil_sig' for <Sample(filename='p002', job_id='-1', result='Result.unknown', sha256sum='3b0e...')>
peekaboo.ruleset.engine - (Worker-1) - ERROR - '>' not supported between instances of 'NoneType' and 'int'
Traceback (most recent call last):
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/engine.py", line 119, in run
    result = rule.evaluate(sample)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/rules.py", line 337, in evaluate
    report = self.get_cuckoo_report(sample)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/rules.py", line 128, in get_cuckoo_report
    job_id = sample.submit_to_cuckoo()
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/sample.py", line 466, in submit_to_cuckoo
    self.__cuckoo_job_id = self.__cuckoo.submit(self)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/toolbox/cuckoo.py", line 421, in submit
    if task_id > 0:
TypeError: '>' not supported between instances of 'NoneType' and 'int'
peekaboo.sample - (Worker-1) - DEBUG - Adding rule result Result "failed" of rule RulesetEngine - Rule aborted with error, analysis continues: No.
peekaboo.sample - (Worker-1) - DEBUG - Current overall result: Result.unknown, new rule result: Result.failed

So it is rather an annoyance than a bug.

As the backtrace says, we're expecting task_id to have an integer value but it is None. We should fix that to avoid the annoying backtrace.