flow.record 3.16.dev6__tar.gz → 3.16.dev8__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {flow_record-3.16.dev6/flow.record.egg-info → flow_record-3.16.dev8}/PKG-INFO +1 -1
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/__init__.py +2 -1
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/jsonpacker.py +6 -1
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/version.py +2 -2
- {flow_record-3.16.dev6 → flow_record-3.16.dev8/flow.record.egg-info}/PKG-INFO +1 -1
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_fieldtypes.py +9 -2
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_json_packer.py +21 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/COPYRIGHT +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/LICENSE +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/MANIFEST.in +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/README.md +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/filesystem.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/passivedns.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/records.json +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/tcpconn.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/__init__.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/__init__.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/archive.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/avro.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/broker.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/csvfile.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/duckdb.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/elastic.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/jsonfile.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/line.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/mongo.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/split.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/splunk.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/sqlite.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/stream.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/text.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/xlsx.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/base.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/exceptions.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/credential.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/__init__.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/ip.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/ipv4.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/tcp.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/udp.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/packer.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/selector.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/stream.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/tools/__init__.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/tools/geoip.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/tools/rdump.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/utils.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/whitelist.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/SOURCES.txt +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/dependency_links.txt +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/entry_points.txt +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/requires.txt +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/top_level.txt +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/pyproject.toml +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/setup.cfg +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/__init__.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/_utils.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/docs/Makefile +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/docs/conf.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/docs/index.rst +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/selector_explain_example.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/standalone_test.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_avro.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_avro_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_compiled_selector.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_csv_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_deprecations.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_elastic_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_fieldtype_ip.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_json_record_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_multi_timestamp.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_packer.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_rdump.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_record.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_record_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_record_descriptor.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_regression.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_selector.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_splunk_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_sqlite_duckdb_adapter.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/utils_inspect.py +0 -0
- {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tox.ini +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: flow.record
|
|
3
|
-
Version: 3.16.
|
|
3
|
+
Version: 3.16.dev8
|
|
4
4
|
Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
|
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
|
6
6
|
License: Affero General Public License v3
|
|
@@ -767,7 +767,8 @@ class command(FieldType):
|
|
|
767
767
|
# an '%' for an environment variable
|
|
768
768
|
# r'\\' for a UNC path
|
|
769
769
|
# the strip and check for ":" on the second line is for `<drive_letter>:`
|
|
770
|
-
|
|
770
|
+
stripped_value = value.lstrip("\"'")
|
|
771
|
+
windows = value.startswith((r"\\", "%")) or (len(stripped_value) >= 2 and stripped_value[1] == ":")
|
|
771
772
|
|
|
772
773
|
if windows:
|
|
773
774
|
cls = windows_command
|
|
@@ -41,15 +41,20 @@ class JsonRecordPacker:
|
|
|
41
41
|
if obj._desc.identifier not in self.descriptors:
|
|
42
42
|
self.register(obj._desc, True)
|
|
43
43
|
serial = obj._asdict()
|
|
44
|
+
|
|
44
45
|
if self.pack_descriptors:
|
|
45
46
|
serial["_type"] = "record"
|
|
46
47
|
serial["_recorddescriptor"] = obj._desc.identifier
|
|
47
48
|
|
|
48
|
-
# PYTHON2: Because "bytes" are also "str" we have to handle this here
|
|
49
49
|
for field_type, field_name in obj._desc.get_field_tuples():
|
|
50
|
+
# PYTHON2: Because "bytes" are also "str" we have to handle this here
|
|
50
51
|
if field_type == "bytes" and isinstance(serial[field_name], str):
|
|
51
52
|
serial[field_name] = base64.b64encode(serial[field_name]).decode()
|
|
52
53
|
|
|
54
|
+
# Boolean field types should be cast to a bool instead of staying ints
|
|
55
|
+
elif field_type == "boolean" and isinstance(serial[field_name], int):
|
|
56
|
+
serial[field_name] = bool(serial[field_name])
|
|
57
|
+
|
|
53
58
|
return serial
|
|
54
59
|
if isinstance(obj, RecordDescriptor):
|
|
55
60
|
serial = {
|
|
@@ -12,5 +12,5 @@ __version__: str
|
|
|
12
12
|
__version_tuple__: VERSION_TUPLE
|
|
13
13
|
version_tuple: VERSION_TUPLE
|
|
14
14
|
|
|
15
|
-
__version__ = version = '3.16.
|
|
16
|
-
__version_tuple__ = version_tuple = (3, 16, '
|
|
15
|
+
__version__ = version = '3.16.dev8'
|
|
16
|
+
__version_tuple__ = version_tuple = (3, 16, 'dev8')
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: flow.record
|
|
3
|
-
Version: 3.16.
|
|
3
|
+
Version: 3.16.dev8
|
|
4
4
|
Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
|
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
|
6
6
|
License: Affero General Public License v3
|
|
@@ -1075,9 +1075,16 @@ def test_command_integration_none(tmp_path: pathlib.Path) -> None:
|
|
|
1075
1075
|
# Test a quoted path
|
|
1076
1076
|
(r"'c:\path to some exe' /d /a", r"c:\path to some exe", [r"/d /a"]),
|
|
1077
1077
|
# Test a unquoted path
|
|
1078
|
-
(r"
|
|
1078
|
+
(r"\Users\test\hello.exe", r"\Users\test\hello.exe", []),
|
|
1079
1079
|
# Test an unquoted path with a path as argument
|
|
1080
|
-
(r"
|
|
1080
|
+
(r"\Users\test\hello.exe c:\startmepls.exe", r"\Users\test\hello.exe", [r"c:\startmepls.exe"]),
|
|
1081
|
+
# Test a quoted UNC path
|
|
1082
|
+
(r"'\\192.168.1.2\Program Files\hello.exe'", r"\\192.168.1.2\Program Files\hello.exe", []),
|
|
1083
|
+
# Test an unquoted UNC path
|
|
1084
|
+
(r"\\192.168.1.2\Users\test\hello.exe /d /a", r"\\192.168.1.2\Users\test\hello.exe", [r"/d /a"]),
|
|
1085
|
+
# Test an empty command string
|
|
1086
|
+
(r"''", r"", []),
|
|
1087
|
+
# Test None
|
|
1081
1088
|
(None, None, None),
|
|
1082
1089
|
],
|
|
1083
1090
|
)
|
|
@@ -69,3 +69,24 @@ def test_record_descriptor_not_found():
|
|
|
69
69
|
packer = JsonRecordPacker()
|
|
70
70
|
with pytest.raises(RecordDescriptorNotFound, match="No RecordDescriptor found for: .*test/descriptor_not_found"):
|
|
71
71
|
packer.unpack(data)
|
|
72
|
+
|
|
73
|
+
|
|
74
|
+
def test_record_pack_bool_regression() -> None:
|
|
75
|
+
TestRecord = RecordDescriptor(
|
|
76
|
+
"test/record_pack_bool",
|
|
77
|
+
[
|
|
78
|
+
("varint", "some_varint"),
|
|
79
|
+
("uint16", "some_uint"),
|
|
80
|
+
("boolean", "some_boolean"),
|
|
81
|
+
],
|
|
82
|
+
)
|
|
83
|
+
|
|
84
|
+
record = TestRecord(some_varint=1, some_uint=0, some_boolean=False)
|
|
85
|
+
packer = JsonRecordPacker()
|
|
86
|
+
|
|
87
|
+
# pack to json string and check if some_boolean is false instead of 0
|
|
88
|
+
data = packer.pack(record)
|
|
89
|
+
assert data.startswith('{"some_varint": 1, "some_uint": 0, "some_boolean": false, ')
|
|
90
|
+
|
|
91
|
+
# pack the json string back to a record and make sure it is the same as before
|
|
92
|
+
assert packer.unpack(data) == record
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|