Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Paraglob prevents use of OpaqueVal in plugins #602

Closed
J-Gras opened this issue Sep 26, 2019 · 1 comment · Fixed by #603
Closed

Paraglob prevents use of OpaqueVal in plugins #602

J-Gras opened this issue Sep 26, 2019 · 1 comment · Fixed by #603
Assignees
Labels
Milestone

Comments

@J-Gras
Copy link
Contributor

J-Gras commented Sep 26, 2019

The introduction of paraglob seems to have introduced some dependencies that cannot be resolved properly when the OpaqueVal class is used in external plugins like bro-fuzzy-hashing or bro-lognorm. See J-Gras/bro-fuzzy-hashing#3.

@jsiwek jsiwek added this to the 3.0.1 milestone Sep 26, 2019
@jsiwek jsiwek added this to Unassigned / Todo in Release 3.0.1 via automation Sep 26, 2019
@jsiwek jsiwek self-assigned this Sep 26, 2019
jsiwek added a commit to zeek/paraglob that referenced this issue Sep 27, 2019
Moves all paraglob headers into include/paraglob and installs them.
Also shortened some filenames since they'll be included via paraglob
subdirectory now, like "paraglob/paraglob.h".

Moves ahocorasick headers into src/ since they're not part of the
public API.

Related to zeek/zeek#602
@jsiwek jsiwek moved this from Unassigned / Todo to Needs Review / Merge in Release 3.0.1 Sep 27, 2019
@jsiwek
Copy link
Contributor

jsiwek commented Sep 27, 2019

Fix for this is pending in #603 (and will need to include it in a 3.0.1 patch release).

There's also just some changes in 3.0.x to the OpaqueVal API that you may need to update your plugin(s) for regardless. In case it helps, here's rough idea of what's needed to make bro-fuzzy-hashing compile:

diff --git a/src/FuzzyHashVal.cc b/src/FuzzyHashVal.cc
index 1beec16..7cdf6b0 100644
--- a/src/FuzzyHashVal.cc
+++ b/src/FuzzyHashVal.cc
@@ -4,6 +4,8 @@
 
 #include "FuzzyHashVal.h"
 
+#include <broker/error.hh>
+
 using namespace plugin::JGras_FuzzyHashing;
 
 FuzzyHashVal::FuzzyHashVal(OpaqueType* t) : HashVal(t)
@@ -150,3 +152,27 @@ StringVal* TLSHVal::DoGet()
 	const char* hash = tlsh->getHash();
 	return new StringVal(hash);
 	}
+
+broker::expected<broker::data> SSDeepVal::DoSerialize() const
+	{
+	// TODO: implement this
+	return broker::ec::invalid_data;
+	}
+
+bool SSDeepVal::DoUnserialize(const broker::data& data)
+	{
+	// TODO: implement this
+	return false;
+	}
+
+broker::expected<broker::data> TLSHVal::DoSerialize() const
+	{
+	// TODO: implement this
+	return broker::ec::invalid_data;
+	}
+
+bool TLSHVal::DoUnserialize(const broker::data& data)
+	{
+	// TODO: implement this
+	return false;
+	}
diff --git a/src/FuzzyHashVal.h b/src/FuzzyHashVal.h
index f7adca7..e638222 100644
--- a/src/FuzzyHashVal.h
+++ b/src/FuzzyHashVal.h
@@ -34,6 +34,7 @@ protected:
 	virtual StringVal* DoGet() override;
 
 	//DECLARE_SERIAL(SSDeepVal);
+    DECLARE_OPAQUE_VALUE(SSDeepVal);
 
 private:
 	fuzzy_state* state;
@@ -55,6 +56,7 @@ protected:
 
 	//DECLARE_SERIAL(TLSHVal);
 
+    DECLARE_OPAQUE_VALUE(TLSHVal);
 private:
 	Tlsh* tlsh;
 };

And implement the indicated functions if you want these values to be serializable/cloneable.

@jsiwek jsiwek mentioned this issue Sep 27, 2019
18 tasks
0xxon added a commit that referenced this issue Oct 1, 2019
* origin/topic/jsiwek/paraglob-headers:
  GH-602: fix paraglob header inclusion, installation, and search paths
@0xxon 0xxon closed this as completed in #603 Oct 1, 2019
Release 3.0.1 automation moved this from Needs Review / Merge to Done Oct 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
No open projects
Release 3.0.1
  
Done
Development

Successfully merging a pull request may close this issue.

2 participants