Extractor Plugins

BDBA scanner container functionality can be extended with additional extractors. This is useful, for example, when you have a proprietary file format, but you want to have the BDBA scanner processing files in that format. Requirements for the plugins are:

Extractor code that handles the file format.
- Program must be executable in x86-64 Linux.
- BDBA provides CPython, so Python 3 -based extractors work as well.
Yaml configuration file that describes the file extensions and command line arguments for extraction.
Dockerfile which interits from BDBA the container and adds necessary tools.
Registry used by the BDBA Kubernetes deployment.

Configuration file

The configuration file for the plugins should be placed in /plugins/plugins.yaml.

plugins:
- name: decryptor
  cmd: "/plugins/bin/decryptor {infile} {outdir}"
  files:
    - path: "*.asc"
    - path: "*.crypt"
    - path: "archive.zip//sub-archive.zip//opt/payload/encrypted"
- name: b64
  cmd: "/plugins/bin/b64extractor {infile} {outdir}/{target}"
  files:
    - path: "*.b64"

The top-level key is plugins.

Each extractor requires three keywords, name, cmd and files. cmd contains the command line to template for executing the extractor. files contains the matching pattern for files. Currently the supported selector is path, which uses a globbing pattern to match the file. Additional globbing rules are:

*.foo will match any file ending with .foo.
foobar/*.foo will match any file ending with .foo if it is in foobar/directory.
quux.zip//*.foo will match any file ending with *.foo if it is archive named quux.zip.

Template

The template supports the following keywords:

{infile} is the path to the input file.
{outdir} is the path to the output directory. This is a temporary directory managed by BDBA.
{target} is the basename of target file with file extension removed. For example if the file passed is foo.b64, {target} is foo. It is needed if extraction tool requires filename instead of directory as target.
{python} is the path to the Python binary. It is also available in the PYTHON environment variable.

Example

For the above example, b64extractor is a shell script that contains the following:

#!/bin/bash

base64 -d -i $1 > $2

It will invoke the base64 program which removes the base64 encoding from a file. Generally extractor programs should be added to the plugins/bin directory. If the program needs an additional library, they should be added to /plugins/lib and the invocation script should set the LD_LIBRARY_PATH accordingly, for example export LD_LIBRARY_PATH=/plugins/lib.

Dockerfile

An example Dockerfile that builds with additional tools:

FROM blackducksoftware/bdba-worker:FROM blackducksoftware/bdba-worker:2023.6.0
USER root
RUN mkdir -p /plugins
COPY plugins.yaml /plugins/
COPY bin/b64extractor /plugins/bin/
USER appcheck

To publish an image with this Dockerfile, run the following:

$ docker build -t my-registry/bdba-worker-plugins:2023.6.0
$ docker push my-registry/bdba-worker-plugins:2023.6.0

This pushes the BDBA worker with plugins to my-registry. To use this custom container with a BDBA Kubernetes installation, just change the worker image to be my-registry/bdba-worker-plugins with --set worker.repository="my-registry/bdba-worker-plugins" for Helm.