search for: yr_finalize

...n exit. */ > +void yara_finalize (void) __attribute__((destructor)); > +void > +yara_finalize (void) > +{ > + int ret = 0; if (!initialized) return; > + > + if (rules != NULL) { > + yr_rules_destroy (rules); > + rules = NULL; > + } > + > + ret = yr_finalize (); > + if (ret != ERROR_SUCCESS) > + perror ("yr_finalize"); > + > + initialized = false; > +} Thanks, -- Pino Toscano

...f (rules == NULL) { > + reply_with_error ("no yara rules loaded"); > + return -1; > + } > + > + CHROOT_IN; > + fd = open (path, O_RDONLY|O_CLOEXEC); > + CHROOT_OUT; > + > + if (fd < 0) { > + reply_with_perror ("%s", path); > + yr_finalize (); I don't think that's the right place for yr_finalize. > + return -1; > + } > + > + reply (NULL, NULL); /* Reply message. */ > + > + ret = yr_rules_scan_fd (rules, fd, 0, yara_rules_callback, (void *) path, 0); > + if (ret == ERROR_SUCCESS) > + ret =...

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

...estructor)); >> +void >> +yara_finalize (void) >> +{ >> + int ret = 0; > if (!initialized) > return; > >> + >> + if (rules != NULL) { >> + yr_rules_destroy (rules); >> + rules = NULL; >> + } >> + >> + ret = yr_finalize (); >> + if (ret != ERROR_SUCCESS) >> + perror ("yr_finalize"); >> + >> + initialized = false; >> +} > Thanks, > > > _______________________________________________ > Libguestfs mailing list > Libguestfs@redhat.com > https://www.redh...

..._error ("no yara rules loaded"); >> + return -1; >> + } >> + >> + CHROOT_IN; >> + fd = open (path, O_RDONLY|O_CLOEXEC); >> + CHROOT_OUT; >> + >> + if (fd < 0) { >> + reply_with_perror ("%s", path); >> + yr_finalize (); > I don't think that's the right place for yr_finalize. > >> + return -1; >> + } >> + >> + reply (NULL, NULL); /* Reply message. */ >> + >> + ret = yr_rules_scan_fd (rules, fd, 0, yara_rules_callback, (void *) path, 0); >> + if (re...

...r are in source code format, compile them first. + */ + ret = yr_rules_load (tmpfile, &rules); + if (ret == ERROR_INVALID_FILE) + ret = compile_rules_file (tmpfile); + + unlink (tmpfile); + + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed loading the rules"); + yr_finalize (); + return -1; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) { + reply_with_error ("failed finalizing yara"); + return -1; + } + + return 0; +} + +/* Upload rules file on a temporary file. + * Return 0 on success, -1 on error. + */ +static int +upload_rules_fil...

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

..., line, message); +} + +/* Clean up yara handle on daemon exit. */ +void yara_finalize (void) __attribute__((destructor)); + +void +yara_finalize (void) +{ + int ret = 0; + + if (!initialized) + return; + + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_li...

..., "(%d): Yara warning: %s\n", line, message); +} + +/* Clean up yara handle on daemon exit. */ +void yara_finalize (void) __attribute__((destructor)); +void +yara_finalize (void) +{ + int ret = 0; + + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +int +optgroup_libyara_available (void) +{ + return 1; +} + +#else /* !HAVE_YARA */ + +OPTGROUP_YARA_NOT_AVAILABLE + +#endif /* !HAVE_YARA */ diff --git a/generator/actions.ml b/generator/acti...

..., line, message); +} + +/* Clean up yara handle on daemon exit. */ +void yara_finalize (void) __attribute__((destructor)); + +void +yara_finalize (void) +{ + int ret = 0; + + if (!initialized) + return; + + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_li...

...uot;, line, message); +} + +/* Clean up yara handle on daemon exit. */ +void yara_finalize (void) __attribute__((destructor)); + +void +yara_finalize (void) +{ + int r = 0; + + if (!initialized) + return; + + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + r = yr_finalize (); + if (r != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_liby...

..., line, message); +} + +/* Clean up yara handle on daemon exit. */ +void yara_finalize (void) __attribute__((destructor)); + +void +yara_finalize (void) +{ + int ret = 0; + + if (!initialized) + return; + + if (rules != NULL) { + yr_rules_destroy (rules); + rules = NULL; + } + + ret = yr_finalize (); + if (ret != ERROR_SUCCESS) + perror ("yr_finalize"); + + initialized = false; +} + +static void +cleanup_destroy_yara_compiler (void *ptr) +{ + YR_COMPILER *compiler = * (YR_COMPILER **) ptr; + + if (compiler != NULL) + yr_compiler_destroy (compiler); +} + +int +optgroup_li...

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

...+{ + int ret = 0; + CLEANUP_CLOSE int fd = 0; + + if (rules == NULL) { + reply_with_error ("no yara rules loaded"); + return -1; + } + + CHROOT_IN; + fd = open (path, O_RDONLY|O_CLOEXEC); + CHROOT_OUT; + + if (fd < 0) { + reply_with_perror ("%s", path); + yr_finalize (); + return -1; + } + + reply (NULL, NULL); /* Reply message. */ + + ret = yr_rules_scan_fd (rules, fd, 0, yara_rules_callback, (void *) path, 0); + if (ret == ERROR_SUCCESS) + ret = send_file_end (0); /* File transfer end. */ + else + send_file_end (1); /* Cancel file transfer. *...

v3: - allow to load multiple rule files - added optional namespace parameter to yara_load - move destructor logic in yara module - use generic file upload logic - use generic temporary path function Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am