search for: rule_fil

Displaying 20 results from an estimated 22 matches for "rule_fil".

Did you mean: rule_file
2016 Nov 21
2
Re: [PATCH v2 2/6] New API: yara_load
...rectly at the beginning of do_yara_load. > +/* Compile source code rules and load them. > + * Return ERROR_SUCCESS on success, Yara error code type on error. > + */ > +static int > +compile_rules_file (const char *rules_path) > +{ > + int ret = 0; > + CLEANUP_FCLOSE FILE *rule_file = NULL; > + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; > + > + ret = yr_compiler_create (&compiler); > + if (ret != ERROR_SUCCESS) { > + reply_with_error ("yr_compiler_create"); > + return ret; > + } > + > + yr_compiler_set_callb...
2016 Nov 02
0
[PATCH 2/6] New API: yara_load
...reply_with_error ("file upload cancelled"); + return -1; + } + + return 0; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path) +{ + int ret = 0; + FILE *rule_file = NULL; + YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + perror ("yr_compiler_create"); + return ret; + } + + rule_file = fopen (rules_path, "r"); + if (rule_file == NULL) { + yr_compiler_destroy (compi...
2016 Nov 22
0
Re: [PATCH v2 2/6] New API: yara_load
...H 5. > >> +/* Compile source code rules and load them. >> + * Return ERROR_SUCCESS on success, Yara error code type on error. >> + */ >> +static int >> +compile_rules_file (const char *rules_path) >> +{ >> + int ret = 0; >> + CLEANUP_FCLOSE FILE *rule_file = NULL; >> + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; >> + >> + ret = yr_compiler_create (&compiler); >> + if (ret != ERROR_SUCCESS) { >> + reply_with_error ("yr_compiler_create"); >> + return ret; >> + } >>...
2016 Nov 02
8
[PATCH 0/6] Feature: Yara file scanning
Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:
2017 Mar 12
0
[PATCH v4 3/7] New API: yara_load
...mpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path, const char *namespace) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_set_callback (compiler, compile_error_callback, NULL);...
2016 Nov 09
0
[PATCH v2 2/6] New API: yara_load
...ror ("file upload cancelled"); + return -1; + } + + return 0; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_set_callback (compiler, compile_error_callback, NULL);...
2017 Apr 06
0
[PATCH v6 3/7] New API: yara_load
...mpfile); + + unlink (tmpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_set_callback (compiler, compile_error_callback, NULL);...
2017 Apr 24
0
[PATCH v8 4/8] New API: yara_load
...(tmpfile); + + unlink (tmpfile); + + return (r == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_set_callback (compiler, compile_error_callback, NULL);...
2017 Apr 25
1
Re: [PATCH v8 4/8] New API: yara_load
...n later patches so please fix those too. > +/* Compile source code rules and load them. > + * Return ERROR_SUCCESS on success, Yara error code type on error. > + */ > +static int > +compile_rules_file (const char *rules_path) > +{ > + int ret = 0; > + CLEANUP_FCLOSE FILE *rule_file = NULL; > + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; > + > + ret = yr_compiler_create (&compiler); > + if (ret != ERROR_SUCCESS) { > + reply_with_error ("yr_compiler_create"); > + return ret; > + } > + > + yr_compiler_set_callb...
2017 Apr 04
0
[PATCH v5 3/7] New API: yara_load
...mpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path, const char *namespace) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_set_callback (compiler, compile_error_callback, NULL);...
2016 Nov 09
9
[PATCH v2 0/6] Feature: Yara file scanning
v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:
2017 Mar 12
8
[PATCH v4 0/7] Feature: Yara file scanning
Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am
2017 Apr 24
10
[PATCH v8 0/8] Feature: Yara file scanning
v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in
2019 Jul 10
6
[Bug 1351] New: Segfault in v0.9.1
...OS: other Status: NEW Severity: major Priority: P5 Component: nft Assignee: pablo at netfilter.org Reporter: 4bzilla at mailbox.org OS: Arch Linux After updating to v0.9.1 I am getting a segfault when loading my rules using nft -f $rule_file. This also happens when I build from the current master branch. Cant post my rules because they are made of multiple include files and I currently dont have the time to strip them down to a minimum. But I think the following trace might help: (gdb) bt #0 0x00007ffff7d78162 in __strcmp_avx2 () fr...
2016 Dec 18
6
[PATCH v3 0/6] Feature: Yara file scanning
v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests
2010 Nov 19
3
what are the constraints on the contents of 'imported ' files
...e,mysql,pop2,pop3,bad- traffic,dos,exploit,misc,smtp,web-misc,emerging-exploit,emerging-scan, emerging-web,emerging-web_sql_injection,emerging- web_server,emerging-web_specific_apps, emerging-attack_response,emerging- virus,emerging,emerging-trojan] } $rule_files = $sensor_rule_categories[$master] if I have the definition $sensor_rule_categories in the file ./ masters.pp then I get the error: err: Could not retrieve catalog from remote server: Error 400 on SERVER: undefined local variable or method `accesskey'' for #<Puppet::Parser::AST::Hash...
2017 Feb 19
9
[PATCH v3 0/7] Feature: Yara file scanning
Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am
2017 Apr 25
8
[PATCH v9 0/7] Feature: Yara file scanning
v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-
2017 Apr 04
13
[PATCH v5 0/7] Feature: Yara file scanning
v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am
2017 Apr 23
11
[PATCH v7 0/7] Feature: Yara file scanning
v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am