similar to: [PATCH] upload: improve file write callback

Exposing file upload logic as suggested in previous patch: https://www.redhat.com/archives/libguestfs/2016-November/msg00109.html Matteo Cafasso (1): daemon: expose upload logic daemon/daemon.h | 3 +++ daemon/upload.c | 70 ++++++++++++++++++++++++++++++++------------------------- 2 files changed, 42 insertions(+), 31 deletions(-) -- 2.10.2

Allows other modules to use the same logic for uploading files. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/daemon.h | 3 +++ daemon/upload.c | 70 ++++++++++++++++++++++++++++++++------------------------- 2 files changed, 42 insertions(+), 31 deletions(-) diff --git a/daemon/daemon.h b/daemon/daemon.h index 2379e31..1723b68 100644 --- a/daemon/daemon.h +++

Allows other modules to use the same logic for uploading files. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/daemon.h | 3 +++ daemon/upload.c | 70 ++++++++++++++++++++++++++++++++------------------------- 2 files changed, 42 insertions(+), 31 deletions(-) diff --git a/daemon/daemon.h b/daemon/daemon.h index 793074dea..bc89f78dd 100644 --- a/daemon/daemon.h +++

Allows other modules to use the same logic for uploading files. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/daemon.h | 3 +++ daemon/upload.c | 70 ++++++++++++++++++++++++++++++++------------------------- 2 files changed, 42 insertions(+), 31 deletions(-) diff --git a/daemon/daemon.h b/daemon/daemon.h index abec087cd..797ec2dd9 100644 --- a/daemon/daemon.h +++

Allows other modules to use the same logic for uploading files. Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/daemon.h | 3 +++ daemon/upload.c | 66 ++++++++++++++++++++++++++++++++------------------------- 2 files changed, 40 insertions(+), 29 deletions(-) diff --git a/daemon/daemon.h b/daemon/daemon.h index 5137e2c2a..75af5246e 100644 --- a/daemon/daemon.h +++

v6: - use new test functions - fix yara_detection struct field names - revert yara_load function to initial version With Pino we were exploring the idea of allowing Users to load multiple rule files with subsequent calls to yara_load API. https://www.redhat.com/archives/libguestfs/2016-November/msg00119.html It turns out impractical due to YARA API limitations. It is possible to load multiple

v8: - Ignore returned value in daemon/upload.c - Report serialization errors in lib/yara.c Matteo Cafasso (8): daemon: ignore unused return value in upload function daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in

On Wednesday, 9 November 2016 22:38:53 CET Matteo Cafasso wrote: > The yara_load API allows to load a set of Yara rules contained within a > file on the host. > > Rules can be in binary format, as when compiled with yarac command, or > in source code format. In the latter case, the rules will be first > compiled and then loaded. > > Subsequent calls of the yara_load API

Rebase patches on top of 1.35.25. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

Rebase patches on top of 1.37.1. No changes since last series. Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v5: - rebase on top of 1.37.9 - add missing actions_yara.* files Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

v9: - fixes according to comments Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am | 4 +-

v7: - Fixes according to comments - Rebase on top of 1.37.12 Matteo Cafasso (7): daemon: expose file upload logic appliance: add yara dependency New API: yara_load New API: yara_destroy New API: internal_yara_scan New API: yara_scan yara_scan: added API tests appliance/packagelist.in | 4 + configure.ac | 1 + daemon/Makefile.am

Yara is a rule based scanning engine aimed to help malware analysts in finding and classifying interesting samples. https://github.com/VirusTotal/yara This series adds Yara support to Libguestfs allowing to upload sets of rules and scanning files against them. Currently provided APIs: - yara_load: loads a set of rules - yara_destroy: free resources allocated by loaded rules - yara_scan:

v2: - Fix yara dependency in packagelist - Use pkg-config where available - Improve longdesc of yara_load API - Fix libyara initialization and finalization - Import CLEANUP_FCLOSE - Add custom CLEANUP_DESTROY_YARA_COMPILER - Add rules compilation error callback - Other small fixes according to comments Matteo Cafasso (6): appliance: add yara dependency New API: yara_load New API:

On 21/11/16 18:27, Pino Toscano wrote: > On Wednesday, 9 November 2016 22:38:53 CET Matteo Cafasso wrote: >> The yara_load API allows to load a set of Yara rules contained within a >> file on the host. >> >> Rules can be in binary format, as when compiled with yarac command, or >> in source code format. In the latter case, the rules will be first >> compiled

The yara_load API allows to load a set of Yara rules contained within a file on the host. Rules can be in binary format, as when compiled with yarac command, or in source code format. In the latter case, the rules will be first compiled and then loaded. Subsequent calls of the yara_load API will result in the discard of the previously loaded rules. Signed-off-by: Matteo Cafasso

On Sun, Apr 23, 2017 at 07:49:56PM +0300, Matteo Cafasso wrote: > + if (r == -1) { /* write error */ > + err = errno; > + r = cancel_receive (); You need to use ignore_value here, and it needs to be in a separate commit, as discussed previously. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog:

The yara_load API allows to load a set of Yara rules contained within a file on the host. Rules can be in binary format, as when compiled with yarac command, or in source code format. In the latter case, the rules will be first compiled and then loaded. Subsequent calls of the yara_load API will result in the discard of the previously loaded rules. Signed-off-by: Matteo Cafasso

I have been able to get a litle further with converting a windows VM. After getting the updated virt-v2v code and rhsrvany, I now get this error: libguestfs: trace: hivex_node_set_value = 0 libguestfs: trace: upload "/usr/share/virtio-win/drivers/amd64/Win2012R2/netkvm.cat" "/Windows/Drivers/VirtIO" guestfsd: main_loop: proc 365 (hivex_node_set_value) took 0.01 seconds