search for: do_yara_load

...never close either -- my suggestion would be to reuse and expose parts of the "upload" function in daemon/upload.c: int upload_to_fd (int fd) With the above, upload_rules_file could not be needed anymore, and the logic to open a temporary fd could be moved directly at the beginning of do_yara_load. > +/* Compile source code rules and load them. > + * Return ERROR_SUCCESS on success, Yara error code type on error. > + */ > +static int > +compile_rules_file (const char *rules_path) > +{ > + int ret = 0; > + CLEANUP_FCLOSE FILE *rule_file = NULL; > + CLEANUP_DESTR...

...generator/actions_yara.ml | 8 ++++++++ generator/proc_nr.ml | 1 + lib/MAX_PROC_NR | 2 +- 4 files changed, 24 insertions(+), 1 deletion(-) diff --git a/daemon/yara.c b/daemon/yara.c index 0d33d83cd..186a330c1 100644 --- a/daemon/yara.c +++ b/daemon/yara.c @@ -107,6 +107,20 @@ do_yara_load (void) return (ret == ERROR_SUCCESS) ? 0 : -1; } +int +do_yara_destroy (void) +{ + if (rules == NULL) { + reply_with_error ("no yara rules loaded"); + return -1; + } + + yr_rules_destroy (rules); + rules = NULL; + + return 0; +} + /* Compile source code rules and load the...

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

...n would be to reuse and expose > parts of the "upload" function in daemon/upload.c: > > int upload_to_fd (int fd) > > With the above, upload_rules_file could not be needed anymore, and the > logic to open a temporary fd could be moved directly at the beginning > of do_yara_load. Just one question: shall the changes in upload.c be in a separate commit "expose XYZ"? What is the preferred way? This question applies also for the notes in PATCH 5. > >> +/* Compile source code rules and load them. >> + * Return ERROR_SUCCESS on success, Yara error code...

...lback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; + +static int upload_rules_file (char *); +static int compile_rules_file (const char *); +static int write_callback (void *, const void *, size_t); + +/* Has one FileIn parameter. */ +int +do_yara_load (void) +{ + int ret = 0; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + ret = upload_rules_file (tmpfile); + if (ret < 0) + return -1; + + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed initializing yara"); + unlink (tmpfile); +...

..._file (const char *); > +static void compile_error_callback (int, const char *, int, const char *, void *); > +static void cleanup_destroy_yara_compiler (void *ptr); > + > +/* Has one FileIn parameter. > + * Takes optional arguments, consult optargs_bitmask. > + */ > +int > +do_yara_load (void) > +{ > + int r = 0; This should not be initialized. Initializing it means that GCC cannot catch code paths where r is used without being assigned to. There are other instances of this in the same file in later patches so please fix those too. > +/* Compile source code rules and...

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

...+static int compile_rules_file (const char *, const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (const char *namespace) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + fd = mkstemp (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink...

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

...bool initialized = false; + +static int upload_rules_file (char *); +static int compile_rules_file (const char *); +static int write_callback (void *, const void *, size_t); +static void compile_error_callback (int, const char *, int, const char *, void *); + +/* Has one FileIn parameter. */ +int +do_yara_load (void) +{ + int ret = 0; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + ret = upload_rules_file (tmpfile); + if (ret < 0) + return -1; + + /* Initialize yara only once. */ + if (!initialized) { + ret = yr_initialize (); + if (ret != ERROR_SUCCESS) { + reply_with_error (&...

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

...zed = false; + +static int compile_rules_file (const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (void) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + fd = mkstemp (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink (tmpfile); +...

...zed = false; + +static int compile_rules_file (const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (void) +{ + int r = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + fd = mkstemp (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + r = upload_to_fd (fd, tmpfile); + if (r == -1) { + unlink (tmpfile); +...

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

...+static int compile_rules_file (const char *, const char *); +static void compile_error_callback (int, const char *, int, const char *, void *); +static void cleanup_destroy_yara_compiler (void *ptr); + +/* Has one FileIn parameter. + * Takes optional arguments, consult optargs_bitmask. + */ +int +do_yara_load (const char *namespace) +{ + int ret = 0; + CLEANUP_CLOSE int fd = -1; + char tmpfile[] = "/tmp/yaraXXXXXX"; + + fd = mkstemp (tmpfile); + if (fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = upload_to_fd (fd); + if (ret < 0) { + unlink...

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am