flow.record 3.13.dev5__tar.gz → 3.13.dev6__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {flow.record-3.13.dev5/flow.record.egg-info → flow.record-3.13.dev6}/PKG-INFO +1 -1
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/selector.py +7 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/version.py +2 -2
- {flow.record-3.13.dev5 → flow.record-3.13.dev6/flow.record.egg-info}/PKG-INFO +1 -1
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_selector.py +24 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/COPYRIGHT +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/LICENSE +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/MANIFEST.in +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/README.md +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/examples/filesystem.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/examples/passivedns.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/examples/records.json +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/examples/tcpconn.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/__init__.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/__init__.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/archive.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/avro.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/broker.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/csvfile.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/elastic.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/jsonfile.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/line.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/mongo.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/split.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/splunk.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/stream.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/text.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/adapter/xlsx.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/base.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/exceptions.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/__init__.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/credential.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/net/__init__.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/net/ip.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/net/ipv4.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/net/tcp.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/fieldtypes/net/udp.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/jsonpacker.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/packer.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/stream.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/tools/__init__.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/tools/geoip.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/tools/rdump.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/utils.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow/record/whitelist.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow.record.egg-info/SOURCES.txt +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow.record.egg-info/dependency_links.txt +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow.record.egg-info/entry_points.txt +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow.record.egg-info/requires.txt +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/flow.record.egg-info/top_level.txt +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/pyproject.toml +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/setup.cfg +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/__init__.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/_utils.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/docs/Makefile +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/docs/conf.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/docs/index.rst +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/selector_explain_example.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/standalone_test.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_avro.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_avro_adapter.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_compiled_selector.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_deprecations.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_fieldtype_ip.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_fieldtypes.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_json_packer.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_json_record_adapter.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_multi_timestamp.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_packer.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_rdump.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_record.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_record_adapter.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_record_descriptor.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_regression.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/test_splunk_adapter.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tests/utils_inspect.py +0 -0
- {flow.record-3.13.dev5 → flow.record-3.13.dev6}/tox.ini +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: flow.record
|
|
3
|
-
Version: 3.13.
|
|
3
|
+
Version: 3.13.dev6
|
|
4
4
|
Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
|
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
|
6
6
|
License: Affero General Public License v3
|
|
@@ -355,6 +355,12 @@ class WrappedRecord:
|
|
|
355
355
|
def __getattr__(self, k):
|
|
356
356
|
return getattr(self.record, k, NONE_OBJECT)
|
|
357
357
|
|
|
358
|
+
def __str__(self) -> str:
|
|
359
|
+
return str(self.record)
|
|
360
|
+
|
|
361
|
+
def __repr__(self) -> str:
|
|
362
|
+
return repr(self.record)
|
|
363
|
+
|
|
358
364
|
|
|
359
365
|
class CompiledSelector:
|
|
360
366
|
"""CompiledSelector is faster than Selector but unsafe if you don't trust the query."""
|
|
@@ -546,6 +552,7 @@ class RecordContextMatcher:
|
|
|
546
552
|
"True": True,
|
|
547
553
|
"False": False,
|
|
548
554
|
"str": str,
|
|
555
|
+
"repr": repr,
|
|
549
556
|
"fields": rec._desc.getfields,
|
|
550
557
|
"any": any,
|
|
551
558
|
"all": all,
|
|
@@ -12,5 +12,5 @@ __version__: str
|
|
|
12
12
|
__version_tuple__: VERSION_TUPLE
|
|
13
13
|
version_tuple: VERSION_TUPLE
|
|
14
14
|
|
|
15
|
-
__version__ = version = '3.13.
|
|
16
|
-
__version_tuple__ = version_tuple = (3, 13, '
|
|
15
|
+
__version__ = version = '3.13.dev6'
|
|
16
|
+
__version_tuple__ = version_tuple = (3, 13, 'dev6')
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: flow.record
|
|
3
|
-
Version: 3.13.
|
|
3
|
+
Version: 3.13.dev6
|
|
4
4
|
Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
|
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
|
6
6
|
License: Affero General Public License v3
|
|
@@ -53,6 +53,30 @@ def test_selector():
|
|
|
53
53
|
assert TestRecord() in Selector("invalid_func(r.invalid_field, 1337) or r.id == 4")
|
|
54
54
|
|
|
55
55
|
|
|
56
|
+
def test_selector_str_repr():
|
|
57
|
+
TestRecord = RecordDescriptor(
|
|
58
|
+
"test/record",
|
|
59
|
+
[
|
|
60
|
+
("string", "query"),
|
|
61
|
+
("string", "url"),
|
|
62
|
+
],
|
|
63
|
+
)
|
|
64
|
+
|
|
65
|
+
assert TestRecord("foo", "bar") in Selector("'foo' in str(r)")
|
|
66
|
+
assert TestRecord("foo", "bar") in Selector("'test/record' in str(r)")
|
|
67
|
+
assert TestRecord("foo", "bar") in Selector("'foo' in repr(r)")
|
|
68
|
+
assert TestRecord("foo", "bar") in Selector("'test/record' in repr(r)")
|
|
69
|
+
assert TestRecord("foo", "bar") in CompiledSelector("'foo' in str(r)")
|
|
70
|
+
assert TestRecord("foo", "bar") in CompiledSelector("'test/record' in str(r)")
|
|
71
|
+
assert TestRecord("foo", "bar") in CompiledSelector("'foo' in repr(r)")
|
|
72
|
+
assert TestRecord("foo", "bar") in CompiledSelector("'test/record' in repr(r)")
|
|
73
|
+
|
|
74
|
+
assert TestRecord("foo", "bar") not in Selector("'nope' in str(r)")
|
|
75
|
+
assert TestRecord("foo", "bar") not in Selector("'nope' in repr(r)")
|
|
76
|
+
assert TestRecord("foo", "bar") not in CompiledSelector("'nope' in str(r)")
|
|
77
|
+
assert TestRecord("foo", "bar") not in CompiledSelector("'nope' in repr(r)")
|
|
78
|
+
|
|
79
|
+
|
|
56
80
|
def test_selector_meta_query_true():
|
|
57
81
|
source = "internal/flow.record.test"
|
|
58
82
|
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|