search for: compile_error_callback

...+ CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; > + > + ret = yr_compiler_create (&compiler); > + if (ret != ERROR_SUCCESS) { > + reply_with_error ("yr_compiler_create"); > + return ret; > + } > + > + yr_compiler_set_callback (compiler, compile_error_callback, NULL); > + > + rule_file = fopen (rules_path, "r"); > + if (rule_file == NULL) { > + reply_with_error ("unable to open rules file"); > + return ret; > + } > + > + ret = yr_compiler_add_file (compiler, rule_file, NULL, rules_path); Considering...

...> +#endif > + > +struct write_callback_data { > + int fd; > + uint64_t written; > +}; > + > +/* Yara compiled rules. */ > +static YR_RULES *rules = NULL; > +static bool initialized = false; > + > +static int compile_rules_file (const char *); > +static void compile_error_callback (int, const char *, int, const char *, void *); > +static void cleanup_destroy_yara_compiler (void *ptr); > + > +/* Has one FileIn parameter. > + * Takes optional arguments, consult optargs_bitmask. > + */ > +int > +do_yara_load (void) > +{ > + int r = 0; This should no...

....c b/daemon/yara.c > index fe1f69a..8e7d328 100644 > --- a/daemon/yara.c > +++ b/daemon/yara.c > @@ -52,6 +52,8 @@ static int upload_rules_file (char *); > static int compile_rules_file (const char *); > static int write_callback (void *, const void *, size_t); > static void compile_error_callback (int, const char *, int, const char *, void *); > +static int yara_rules_callback (int , void *, void *); > +static int send_detection_info (const char *, YR_RULE *); > > /* Has one FileIn parameter. */ > int > @@ -107,6 +109,39 @@ do_yara_destroy (void) > return 0; >...

...+ __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool initialized = false; + +static int compile_rules_file (const char *, const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (const char *namespace) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmp...

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

...data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool initialized = false; + +static int upload_rules_file (char *); +static int compile_rules_file (const char *); +static int write_callback (void *, const void *, size_t); +static void compile_error_callback (int, const char *, int, const char *, void *); + +/* Has one FileIn parameter. */ +int +do_yara_load (void) +{ + int ret = 0; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + ret = upload_rules_file (tmpfile); + if (ret < 0) + return -1; + + /* Initialize yara only once. */ + if (!i...

...YR_COMPILER *compiler = NULL; >> + >> + ret = yr_compiler_create (&compiler); >> + if (ret != ERROR_SUCCESS) { >> + reply_with_error ("yr_compiler_create"); >> + return ret; >> + } >> + >> + yr_compiler_set_callback (compiler, compile_error_callback, NULL); >> + >> + rule_file = fopen (rules_path, "r"); >> + if (rule_file == NULL) { >> + reply_with_error ("unable to open rules file"); >> + return ret; >> + } >> + >> + ret = yr_compiler_add_file (compiler, rule_file,...

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

...\ + __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool initialized = false; + +static int compile_rules_file (const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (void) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/t...

...oy_yara_compiler))) +#else +#define CLEANUP_DESTROY_YARA_COMPILER +#endif + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool initialized = false; + +static int compile_rules_file (const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (void) +{ + int r = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/tmp...

...+ __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool initialized = false; + +static int compile_rules_file (const char *, const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (const char *namespace) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmp...

...ex fe1f69a..8e7d328 100644 >> --- a/daemon/yara.c >> +++ b/daemon/yara.c >> @@ -52,6 +52,8 @@ static int upload_rules_file (char *); >> static int compile_rules_file (const char *); >> static int write_callback (void *, const void *, size_t); >> static void compile_error_callback (int, const char *, int, const char *, void *); >> +static int yara_rules_callback (int , void *, void *); >> +static int send_detection_info (const char *, YR_RULE *); >> >> /* Has one FileIn parameter. */ >> int >> @@ -107,6 +109,39 @@ do_yara_destroy (v...

...letion(-) diff --git a/daemon/yara.c b/daemon/yara.c index fe1f69a..8e7d328 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -52,6 +52,8 @@ static int upload_rules_file (char *); static int compile_rules_file (const char *); static int write_callback (void *, const void *, size_t); static void compile_error_callback (int, const char *, int, const char *, void *); +static int yara_rules_callback (int , void *, void *); +static int send_detection_info (const char *, YR_RULE *); /* Has one FileIn parameter. */ int @@ -107,6 +109,39 @@ do_yara_destroy (void) return 0; } +/* Has one FileOut parameter. */...

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

...| 2 +- 8 files changed, 109 insertions(+), 1 deletion(-) diff --git a/daemon/yara.c b/daemon/yara.c index 78e367f23..cab008a03 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -58,6 +58,8 @@ static bool initialized = false; static int compile_rules_file (const char *); static void compile_error_callback (int, const char *, int, const char *, void *); static void cleanup_destroy_yara_compiler (void *ptr); +static int yara_rules_callback (int , void *, void *); +static int send_detection_info (const char *, YR_RULE *); /* Has one FileIn parameter. * Takes optional arguments, consult optargs_bit...

...| 2 +- 8 files changed, 109 insertions(+), 1 deletion(-) diff --git a/daemon/yara.c b/daemon/yara.c index 186a330c1..80e3f692b 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -54,6 +54,8 @@ static bool initialized = false; static int compile_rules_file (const char *); static void compile_error_callback (int, const char *, int, const char *, void *); static void cleanup_destroy_yara_compiler (void *ptr); +static int yara_rules_callback (int , void *, void *); +static int send_detection_info (const char *, YR_RULE *); /* Has one FileIn parameter. * Takes optional arguments, consult optargs_bit...

...2 +- 8 files changed, 109 insertions(+), 1 deletion(-) diff --git a/daemon/yara.c b/daemon/yara.c index cb49593c7..471547341 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -54,6 +54,8 @@ static bool initialized = false; static int compile_rules_file (const char *, const char *); static void compile_error_callback (int, const char *, int, const char *, void *); static void cleanup_destroy_yara_compiler (void *ptr); +static int yara_rules_callback (int , void *, void *); +static int send_detection_info (const char *, YR_RULE *); /* Has one FileIn parameter. * Takes optional arguments, consult optargs_bit...

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-