search for: have_yara

....am @@ -200,6 +200,7 @@ guestfsd_SOURCES = \ wc.c \ xattr.c \ xfs.c \ + yara.c \ zero.c \ zerofree.c diff --git a/daemon/cleanups.c b/daemon/cleanups.c index 092e493..a02e521 100644 --- a/daemon/cleanups.c +++ b/daemon/cleanups.c @@ -24,6 +24,12 @@ #include <augeas.h> +#ifdef HAVE_YARA + +#include <yara.h> + +#endif /* !HAVE_YARA */ + #include "cleanups.h" /* Use by the CLEANUP_* macros. Do not call these directly. */ @@ -62,6 +68,15 @@ cleanup_close (void *ptr) } void +cleanup_fclose (void *ptr) +{ + FILE *f = * (FILE **) ptr; + + if (f) + fclose (...

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

...page for > > If we check the manual, in guestfs appears guestfs_yara_load function so > libyara is installed. I installed and compiled it from tarballs. This function: https://github.com/libguestfs/libguestfs/blob/4aa4edf972bc8df8869cdcaa4ab4f40b63a626cf/daemon/yara.c#L308 returns 1 if HAVE_YARA is defined. This is defined by this ./configure test: https://github.com/libguestfs/libguestfs/blob/4aa4edf972bc8df8869cdcaa4ab4f40b63a626cf/m4/guestfs-daemon.m4#L128 In other words it depends how libguestfs was configured. Where did you get libguestfs from? How was it compiled? Rich. -- Ri...

...HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA_LIBS]) + AC_DEFINE([HAVE_YARA],[1],[yara library found at compile time.]) +],[ + AC_CHECK_LIB([yara],[yr_initialize],[ + AC_CHECK_HEADER([yara.h],[ + AC_SUBST([YARA_LIBS], [-lyara]) + AC_DEFINE([HAVE_YARA], [1], [Define to 1 if Yara library is available.]) + ], []) + ],[AC_MSG_WARN([Yar...

...HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA_LIBS]) + AC_DEFINE([HAVE_YARA],[1],[yara library found at compile time.]) +],[ + AC_CHECK_LIB([yara],[yr_initialize],[ + AC_CHECK_HEADER([yara.h],[ + AC_SUBST([YARA_LIBS], [-lyara]) + AC_DEFINE([HAVE_YARA], [1], [Define to 1 if Yara library is available.]) + ], []) + ],[AC_MSG_WARN([Yar...

...HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA_LIBS]) + AC_DEFINE([HAVE_YARA],[1],[yara library found at compile time.]) +],[ + AC_CHECK_LIB([yara],[yr_initialize],[ + AC_CHECK_HEADER([yara.h],[ + AC_SUBST([YARA_LIBS], [-lyara]) + AC_DEFINE([HAVE_YARA], [1], [Define to 1 if Yara library is available.]) + ], []) + ],[AC_MSG_WARN([Yar...

...HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA_LIBS]) + AC_DEFINE([HAVE_YARA],[1],[yara library found at compile time.]) +],[ + AC_CHECK_LIB([yara],[yr_initialize],[ + AC_CHECK_HEADER([yara.h],[ + AC_SUBST([YARA_LIBS], [-lyara]) + AC_DEFINE([HAVE_YARA], [1], [Define to 1 if Yara library is available.]) + ], []) + ],[AC_MSG_WARN([Yar...

...> +#include <stdbool.h> +#include <rpc/xdr.h> +#include <rpc/types.h> +#include <sys/types.h> +#include <sys/stat.h> + +#include "daemon.h" +#include "actions.h" +#include "optgroups.h" +#include "guestfs_protocol.h" + +#ifdef HAVE_YARA + +#include <yara.h> + +#define CLEANUP_DESTROY_YARA_COMPILER \ + __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool i...

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

...> +#include <stdbool.h> +#include <rpc/xdr.h> +#include <rpc/types.h> +#include <sys/types.h> +#include <sys/stat.h> + +#include "daemon.h" +#include "actions.h" +#include "optgroups.h" +#include "guestfs_protocol.h" + +#ifdef HAVE_YARA + +#include <yara.h> + +#define CLEANUP_DESTROY_YARA_COMPILER \ + __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool i...

...> +#include <stdbool.h> +#include <rpc/xdr.h> +#include <rpc/types.h> +#include <sys/types.h> +#include <sys/stat.h> + +#include "daemon.h" +#include "actions.h" +#include "optgroups.h" +#include "guestfs_protocol.h" + +#ifdef HAVE_YARA + +#include <yara.h> + +#ifdef HAVE_ATTRIBUTE_CLEANUP +#define CLEANUP_DESTROY_YARA_COMPILER \ + __attribute__((cleanup(cleanup_destroy_yara_compiler))) +#else +#define CLEANUP_DESTROY_YARA_COMPILER +#endif + +struct write_callback_data { + int fd; + uint64_t writ...

...> +#include <stdbool.h> +#include <rpc/xdr.h> +#include <rpc/types.h> +#include <sys/types.h> +#include <sys/stat.h> + +#include "daemon.h" +#include "actions.h" +#include "optgroups.h" +#include "guestfs_protocol.h" + +#ifdef HAVE_YARA + +#include <yara.h> + +#define CLEANUP_DESTROY_YARA_COMPILER \ + __attribute__((cleanup(cleanup_destroy_yara_compiler))) + +struct write_callback_data { + int fd; + uint64_t written; +}; + +/* Yara compiled rules. */ +static YR_RULES *rules = NULL; +static bool i...

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

...] > diff --git a/daemon/cleanups.c b/daemon/cleanups.c > index 092e493..a02e521 100644 > --- a/daemon/cleanups.c > +++ b/daemon/cleanups.c > @@ -78,3 +93,16 @@ cleanup_free_stringsbuf (void *ptr) > { > free_stringsbuf ((struct stringsbuf *) ptr); > } > + > +#ifdef HAVE_YARA > + > +void > +cleanup_destroy_yara_compiler (void *ptr) > +{ > + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; > + > + if (compiler != NULL) > + yr_compiler_destroy (compiler); > +} > + This should rather be directly in daemon/yara.c, since libyara would be us...

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

...stfs appears guestfs_yara_load function so >>> libyara is installed. I installed and compiled it from tarballs. >> This function: >> >> https://github.com/libguestfs/libguestfs/blob/4aa4edf972bc8df8869cdcaa4ab4f40b63a626cf/daemon/yara.c#L308 >> >> returns 1 if HAVE_YARA is defined. This is defined by this >> ./configure test: >> >> https://github.com/libguestfs/libguestfs/blob/4aa4edf972bc8df8869cdcaa4ab4f40b63a626cf/m4/guestfs-daemon.m4#L128 >> >> In other words it depends how libguestfs was configured. Where >> did you get l...