search for: optgroup_libtsk_available

...t and is not Root. */ +static int +entry_is_dot(TSK_FS_FILE *fsfile) +{ + if (TSK_FS_ISDOT (fsfile->name->name)) + if (fsfile->fs_info->root_inum != fsfile->name->meta_addr || + strcmp (fsfile->name->name, ".")) + return 1; + + return 0; +} + int optgroup_libtsk_available (void) { -- 2.9.3

...;name)) { + if (fsfile->fs_info->root_inum == fsfile->name->meta_addr && /* Root */ + STREQ(fsfile->name->name, ".")) /* Avoid '..' 'bin/..' 'etc/..' */ + return 0; + else + return 1; + } + + return 0; +} + int optgroup_libtsk_available (void) { diff --git a/generator/actions.ml b/generator/actions.ml index eccef00..0698b4f 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -3566,9 +3566,8 @@ and directories stored within. It is not necessary to mount the disk partition to run this command. -All entries in the f...

...oid reply_with_tsk_error(void); + +#else + +OPTGROUP_LIBTSK_NOT_AVAILABLE + +#endif + static int file_out (const char *cmd); static guestfs_int_tsk_node* parse_ffind (const char *out, int64_t inode); @@ -226,3 +246,169 @@ file_out (const char *cmd) return 0; } + +#ifdef HAVE_LIBTSK + + +int optgroup_libtsk_available(void) +{ + return 1; +} + +int do_filesystem_walk0(const mountable_t *mountable) +{ + int ret = 0; + TSK_FS_INFO *fs = NULL; + TSK_IMG_INFO *img = NULL; + int flags = TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC | + TSK_FS_DIR_WALK_FLAG_RECURSE | TSK_FS_DIR_WALK_FLAG_NOORPHAN;...

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp

...(const char *funcname) +{ + int ret = 0; + const char *buf = NULL; + + ret = tsk_error_get_errno (); + if (ret != 0) { + buf = tsk_error_get (); + reply_with_error ("%s: %s", funcname, buf); + } + else + reply_with_error ("%s: unknown error", funcname); +} + +int +optgroup_libtsk_available (void) +{ + return 1; +} + +#else /* !HAVE_LIBTSK */ + +OPTGROUP_LIBTSK_NOT_AVAILABLE + +#endif /* !HAVE_LIBTSK */ diff --git a/generator/actions.ml b/generator/actions.ml index e5cb939..8073370 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -12958,6 +12958,15 @@ and save it as...

...ret = 0; + const char *buf = NULL; + + ret = tsk_error_get_errno (); + if (ret != 0) { + buf = tsk_error_get (); + reply_with_error ("TSK function %s error: %s", funcname, buf); + } + else + reply_with_error ("TSK function %s: unknown error", funcname); +} + +int +optgroup_libtsk_available (void) +{ + return 1; +} + +#else /* !HAVE_LIBTSK */ + +OPTGROUP_LIBTSK_NOT_AVAILABLE + +#endif /* !HAVE_LIBTSK */ diff --git a/generator/actions.ml b/generator/actions.ml index e5cb939..449ffa0 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -12958,6 +12958,31 @@ and save it as...

...); > + if (ret != 0) { > + buf = tsk_error_get (); > + reply_with_error ("TSK function %s error: %s", funcname, buf); > + } > + else > + reply_with_error ("TSK function %s: unknown error", funcname); > +} s/TSK function// > + > +int > +optgroup_libtsk_available (void) > +{ > + return 1; > +} > + > +#else /* !HAVE_LIBTSK */ > + > +OPTGROUP_LIBTSK_NOT_AVAILABLE > + > +#endif /* !HAVE_LIBTSK */ > diff --git a/generator/actions.ml b/generator/actions.ml > index e5cb939..449ffa0 100644 > --- a/generator/actions.ml > +...

...(const char *funcname) +{ + int ret = 0; + const char *buf = NULL; + + ret = tsk_error_get_errno (); + if (ret != 0) { + buf = tsk_error_get (); + reply_with_error ("%s: %s", funcname, buf); + } + else + reply_with_error ("%s: unknown error", funcname); +} + +int +optgroup_libtsk_available (void) +{ + return 1; +} + +#else /* !HAVE_LIBTSK */ + +OPTGROUP_LIBTSK_NOT_AVAILABLE + +#endif /* !HAVE_LIBTSK */ diff --git a/docs/guestfs-building.pod b/docs/guestfs-building.pod index 28256c4..3fe1d41 100644 --- a/docs/guestfs-building.pod +++ b/docs/guestfs-building.pod @@ -395,6 +395,10 @...

...get (); > > + reply_with_error ("TSK function %s error: %s", funcname, buf); > > + } > > + else > > + reply_with_error ("TSK function %s: unknown error", funcname); > > +} > > s/TSK function// > > > + > > +int > > +optgroup_libtsk_available (void) > > +{ > > + return 1; > > +} > > + > > +#else /* !HAVE_LIBTSK */ > > + > > +OPTGROUP_LIBTSK_NOT_AVAILABLE > > + > > +#endif /* !HAVE_LIBTSK */ > > diff --git a/generator/actions.ml b/generator/actions.ml > > index e5cb939...

v3: - coding style fixes - comment entry_is_dot logic Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 157 ++++++++++++++++++++++++++++++------------- generator/actions.ml | 21 ++++++

v2: - Increased the amount of collected information from the FS content. - Moved filesystem_walk0 as internal command. - Code improvement based on comments. - Adhere to project's coding style. - Better command documentation. - More robust tests. Patch ready for review, code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso (5): generator:

v4: - refactor entry_is_dot My apologies for the duplicated submission but I did not read the next e-mail. The tsk_fs_dir_walk API will list all the entries including '.' and '..' in a similar manner as for 'ls -a'. This means our callback will be called for the following entries: . <-- the Root entry etc/. etc/.. <-- again the Root entry etc/systemd/.

This series should be ready for merge v6: - rebase on master - changes according to last comments Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 155 ++++++++++++++++++++++++++++++-------------

v2: - refactor logic to reduce code duplication - better functions naming Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c | 156 ++++++++++++++++++++++++++++++------------- generator/actions.ml

v5: - small doc fix: filesystem_walk claimed '.' and '..' entries were not reported but Root is now reported as '.' - bump to 1.35.6 Matteo Cafasso (6): filesystem_walk: fixed root inode listing daemon: refactor tsk code lib: rename tsk internal function New API: internal_find_inode New API: find_inode find_inode: added API tests daemon/tsk.c

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the information gathered from the metadata structure (file

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am