search for: rules_path

...r) > +{ > + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; > + > + if (compiler != NULL) > + yr_compiler_destroy (compiler); > +} > + This should rather be directly in daemon/yara.c, since libyara would be used there only. > +static int > +upload_rules_file (char *rules_path) > +{ > + int ret = 0; > + CLEANUP_CLOSE int fd = 0; > + struct write_callback_data data = { .written = 0 }; > + > + data.fd = mkstemp (rules_path); > + if (data.fd == -1) { > + reply_with_perror ("mkstemp"); > + return -1; > + } > + > + re...

...= * (YR_COMPILER **) ptr; >> + >> + if (compiler != NULL) >> + yr_compiler_destroy (compiler); >> +} >> + > This should rather be directly in daemon/yara.c, since libyara would be > used there only. > >> +static int >> +upload_rules_file (char *rules_path) >> +{ >> + int ret = 0; >> + CLEANUP_CLOSE int fd = 0; >> + struct write_callback_data data = { .written = 0 }; >> + >> + data.fd = mkstemp (rules_path); >> + if (data.fd == -1) { >> + reply_with_perror ("mkstemp"); >> + re...

...return -1; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed finalizing yara"); + return -1; + } + + return 0; +} + +/* Upload rules file on a temporary file. + * Return 0 on success, -1 on error. + */ +static int +upload_rules_file (char *rules_path) +{ + int ret = 0; + CLEANUP_CLOSE int fd = 0; + struct write_callback_data data = { .written = 0 }; + + data.fd = mkstemp (rules_path); + if (data.fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = receive_file (write_callback, &data.fd); + if (ret...

...load (tmpfile, &rules); + if (ret == ERROR_INVALID_FILE) + ret = compile_rules_file (tmpfile); + + unlink (tmpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Upload rules file on a temporary file. + * Return 0 on success, -1 on error. + */ +static int +upload_rules_file (char *rules_path) +{ + int ret = 0; + CLEANUP_CLOSE int fd = 0; + struct write_callback_data data = { .written = 0 }; + + data.fd = mkstemp (rules_path); + if (data.fd == -1) { + reply_with_perror ("mkstemp"); + return -1; + } + + ret = receive_file (write_callback, &data); + if (ret ==...

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

...ing assigned to. There are other instances of this in the same file in later patches so please fix those too. > +/* Compile source code rules and load them. > + * Return ERROR_SUCCESS on success, Yara error code type on error. > + */ > +static int > +compile_rules_file (const char *rules_path) > +{ > + int ret = 0; > + CLEANUP_FCLOSE FILE *rule_file = NULL; > + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; > + > + ret = yr_compiler_create (&compiler); > + if (ret != ERROR_SUCCESS) { > + reply_with_error ("yr_compiler_create");...

...VALID_FILE) + ret = compile_rules_file (tmpfile, namespace); + + unlink (tmpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path, const char *namespace) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret;...

...== ERROR_INVALID_FILE) + ret = compile_rules_file (tmpfile); + + unlink (tmpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_s...

...(r == ERROR_INVALID_FILE) + r = compile_rules_file (tmpfile); + + unlink (tmpfile); + + return (r == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret; + } + + yr_compiler_s...

...VALID_FILE) + ret = compile_rules_file (tmpfile, namespace); + + unlink (tmpfile); + + return (ret == ERROR_SUCCESS) ? 0 : -1; +} + +/* Compile source code rules and load them. + * Return ERROR_SUCCESS on success, Yara error code type on error. + */ +static int +compile_rules_file (const char *rules_path, const char *namespace) +{ + int ret = 0; + CLEANUP_FCLOSE FILE *rule_file = NULL; + CLEANUP_DESTROY_YARA_COMPILER YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + reply_with_error ("yr_compiler_create"); + return ret;...

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple