search for: yr_compiler_destroy

...ret = 0; + FILE *rule_file = NULL; + YR_COMPILER *compiler = NULL; + + ret = yr_compiler_create (&compiler); + if (ret != ERROR_SUCCESS) { + perror ("yr_compiler_create"); + return ret; + } + + rule_file = fopen (rules_path, "r"); + if (rule_file == NULL) { + yr_compiler_destroy (compiler); + perror ("unable to open rules file"); + return ret; + } + + ret = yr_compiler_add_file (compiler, rule_file, NULL, rules_path); + if (ret > 0) { + yr_compiler_destroy (compiler); + fclose (rule_file); + perror ("yr_compiler_add_file"); + ret...

..._stringsbuf (void *ptr) > { > free_stringsbuf ((struct stringsbuf *) ptr); > } > + > +#ifdef HAVE_YARA > + > +void > +cleanup_destroy_yara_compiler (void *ptr) > +{ > + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; > + > + if (compiler != NULL) > + yr_compiler_destroy (compiler); > +} > + This should rather be directly in daemon/yara.c, since libyara would be used there only. > +static int > +upload_rules_file (char *rules_path) > +{ > + int ret = 0; > + CLEANUP_CLOSE int fd = 0; > + struct write_callback_data data = { .written = 0 }...

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

...e (compiler, rule_file, NULL, NULL); + if (ret > 0) + goto err; + + ret = yr_compiler_get_rules (compiler, &rules); + if (ret == ERROR_INSUFICIENT_MEMORY) { + errno = ENOMEM; + reply_with_perror ("yr_compiler_get_rules"); + } + + err: +#ifndef HAVE_ATTRIBUTE_CLEANUP + yr_compiler_destroy (compiler); +#endif + + return ret; +} + +/* Yara compilation error callback. + * Reports back the compilation error message. + * Prints compilation warnings if verbose. + */ +static void +compile_error_callback (int level, const char *name, int line, + const char *message,...

...stringsbuf ((struct stringsbuf *) ptr); >> } >> + >> +#ifdef HAVE_YARA >> + >> +void >> +cleanup_destroy_yara_compiler (void *ptr) >> +{ >> + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; >> + >> + if (compiler != NULL) >> + yr_compiler_destroy (compiler); >> +} >> + > This should rather be directly in daemon/yara.c, since libyara would be > used there only. > >> +static int >> +upload_rules_file (char *rules_path) >> +{ >> + int ret = 0; >> + CLEANUP_CLOSE int fd = 0; >> + struc...

...rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_libyara_available (void) +{ + return 1; +} + +#else /* !HAVE_YARA */ + +OPTGROUP_YARA_NOT_AVAILABLE + +#endif /* !HAVE_YARA */ diff --git a/generator/Makefile.am b/generator/Makefile.am index cb69fe831..0f7fc289b 100644 --- a/generator/Makefile.am +++ b/generator...

...augeas *aug = * (augeas **) ptr; @@ -78,3 +93,16 @@ cleanup_free_stringsbuf (void *ptr) { free_stringsbuf ((struct stringsbuf *) ptr); } + +#ifdef HAVE_YARA + +void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +#endif /* !HAVE_YARA */ diff --git a/daemon/cleanups.h b/daemon/cleanups.h index 6746e27..c61f646 100644 --- a/daemon/cleanups.h +++ b/daemon/cleanups.h @@ -26,8 +26,12 @@ extern void cleanup_free (void *ptr); extern void cleanup_free_string_list (void *ptr); extern void cleanu...

...rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_libyara_available (void) +{ + return 1; +} + +#else /* !HAVE_YARA */ + +OPTGROUP_LIBYARA_NOT_AVAILABLE + +#endif /* !HAVE_YARA */ diff --git a/generator/Makefile.am b/generator/Makefile.am index 31989cd4a..81b49cab1 100644 --- a/generator/Makefile.am +++ b/genera...

...rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_libyara_available (void) +{ + return 1; +} + +#else /* !HAVE_YARA */ + +OPTGROUP_YARA_NOT_AVAILABLE + +#endif /* !HAVE_YARA */ diff --git a/generator/Makefile.am b/generator/Makefile.am index 31989cd4a..81b49cab1 100644 --- a/generator/Makefile.am +++ b/generator...

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple