-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Thread-safe setting of variables #350
Comments
You are right, As you said, the most important limitation here is that you can't pass values that depends on the file being scanned, like filename, or whatever. This could be solved by providing a separate structure to each thread to store variable values, but that would break existing code that assumes that once the main thread assigns value to a variable all other threads inherit that value. |
I have hit this issue as well and will likely just be making multiple copies of the rules. Is there any chance the yr_rules_scan_* functions can be extended to include an (optional) variable list? Under the hood it may be possible to keep the calls the same and point this new argument to the rules/compiler structure's external variable list when it isn't present. The thinking being this might avoid breaking existing code while allowing an additional path to be added where variables could be defined per scan call. Yes this means that all variables would need to be defined at all times even if not in use but I see this as a issue for the caller and not an issue for yara to solve. Thoughts? If this sounds like a possible approach I'd be willing to try and code some of this up but not sure how successful I'd be. |
@bmagistro What you describe is pretty much the path I had in mind. |
@hillu I think I have something, I'm just now starting to test things using the new functions and providing the vars to the scan function. Edit: It doesn't work (yet), it seems to work fine when not trying to pass an ext to the scan function, passing it to the scan function doesn't seem to match/apply. This is going to take a bit longer, it isn't as straight forward as I thought. |
If I read
libyara/rules.c
correctly, when there are multiple threadssharing a ruleset for scanning, there is no way to safely define
external variables.
I use variable definition to pass trivial information such as file or
process names that are used within some of my rules. Of course, I
could use one copy of the ruleset per thread, but in my use case that
would mean a much larger memory footprint. (Also, this would defeat
the purpose of YARA's support for multiple threads.)
The
yr_rules_define_*_variable
functions operate on a globalstructure hanging off the
YR_RULES
struct without any locking. Eventhough
yr_rules_scan_mem_blocks
eventually copies everything intocontext.objects_table
before starting the actual scan, I see no wayto ensure that the variables hanging off
rules->externals_list_head
are concsistent -- even if I protect the individual
yr_rules_define_*_variable
calls with a mutex.Am I missing something?
The text was updated successfully, but these errors were encountered: