search for: tsk_version_print

...fecd 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -118,3 +118,11 @@ PKG_CHECK_MODULES([SD_JOURNAL], [libsystemd],[ AC_MSG_WARN([systemd journal library not found, some features will be disabled]) ]) ]) + +dnl libtsk sleuthkit library (optional) +AC_CHECK_LIB([tsk],[tsk_version_print],[ + AC_CHECK_HEADER([tsk/libtsk.h],[ + AC_SUBST([TSK_LIBS], [-ltsk]) + AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) + ], []) +],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) -- 2.8.0.rc3

...$(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 12123df..9dc7c6c 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,11 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +AC_CHECK_LIB([yara],[yr_initialize],[ + AC_CHECK_HEADER([yara.h],[ + AC_SUBS...

...$(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 12123df..0018930 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA...

...$(PCRE_LIBS) \ - $(TSK_LIBS) + $(TSK_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 12123df..0018930 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA...

...$(TSK_LIBS) \ - $(RPC_LIBS) + $(RPC_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index eb5a6d5cf..522cd5f0e 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA...

...$(TSK_LIBS) \ - $(RPC_LIBS) + $(RPC_LIBS) \ + $(YARA_LIBS) guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index eb5a6d5cf..522cd5f0e 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -126,3 +126,17 @@ AC_CHECK_LIB([tsk],[tsk_version_print],[ AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) ], []) ],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) + +dnl yara library (optional) +PKG_CHECK_MODULES([YARA], [libyara],[ + AC_SUBST([YARA_CFLAGS]) + AC_SUBST([YARA...

...fecd 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -118,3 +118,11 @@ PKG_CHECK_MODULES([SD_JOURNAL], [libsystemd],[ AC_MSG_WARN([systemd journal library not found, some features will be disabled]) ]) ]) + +dnl libtsk sleuthkit library (optional) +AC_CHECK_LIB([tsk],[tsk_version_print],[ + AC_CHECK_HEADER([tsk/libtsk.h],[ + AC_SUBST([TSK_LIBS], [-ltsk]) + AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) + ], []) +],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) diff --git a/src/MAX_PROC_NR b/src/MAX_P...

...583b 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -118,3 +118,11 @@ PKG_CHECK_MODULES([SD_JOURNAL], [libsystemd],[ AC_MSG_WARN([systemd journal library not found, some features will be disabled]) ]) ]) + +dnl libtsk sleuthkit library (optional) +AC_CHECK_LIB([tsk],[tsk_version_print],[ + AC_CHECK_HEADER([tsk/libtsk.h],[ + AC_SUBST([TSK_LIBS], [-ltsk]) + AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.]) + ], []) +],[AC_MSG_WARN([The Sleuth Kit library (libtsk) not found])]) diff --git a/src/MAX_PROC_NR b/src/MAX_PR...

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

v3: - File size will be reported as - 1 if it cannot be retrieved. - Code improvements based on comments. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check daemon: Added internal_filesystem_walk command appliance: Added filesystem_walk command appliance: Added filesystem_walk command tests daemon/Makefile.am | 4 +-

v5: - fixed compile-time warning - removed unused flag enumeration - new version 1.33.19 Patch ready for review. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c

v4: - Changed tsk_allocated struct field into tsk_flags. - Added optional dependency in documentation. - Use asprintf and perror instead of asprintf_nowarn and fprintf. - Ensure CLEANUP_FREE vars are initialised. - Reworked the function documentation. - Improved tests robustness. Matteo Cafasso (5): generator: Added tsk_dirent struct configure: Added libtsk compile-time check

The filesystem_walk0 API parses the FS internals of a partition and returns a list of all the files and directories contained within. It list deleted files and directories as well. For each node, it reports its relative path, its inode and its allocation status. The output is serialised in XDR format and written to the given file. The command is similar to The Sleuth Kit "fls -rp

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

v6: - added metadata reallocation flag in tsk_flags Certain filesystems separate file name structures and metadata ones. Therefore, deleted entries with file name structures in an unallocated state might point to metadata structures which have been reallocated to new files. A flag set to 1 is generally an indication that the information gathered from the metadata structure (file

v7: - iterate over output file instead of reading it into memory Instead of reading the whole output file in memory and iterating over the resulting buffer, use XDR primitives to directly iterate over the file itself. This should reduce the API memory consumption. Patch ready for review. Code available at: https://github.com/noxdafox/libguestfs/tree/filesystem_walk Matteo Cafasso

v9: - add missing files: java/Makefile.inc, java/com/redhat/et/libguestfs/.gitignore, gobject/Makefile.inc - reserve space in tsk_dirent struct for future usage - use int instead of bool_t type - improve API documentation Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

v8: - rebase on master - bump version to 1.33.37 - squash commits 1, 2, 3 Kept original commits messages when squashing them. Matteo Cafasso (3): New API: internal_filesystem_walk New API: filesystem_walk lib: Added filesystem_walk command tests daemon/Makefile.am | 4 +- daemon/tsk.c | 249 ++++++++++++++++++++++++++++++++++++++

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am