class SqliteTestStruct(rdf_structs.RDFProtoStruct): """Custom struct for testing schema generation.""" type_description = type_info.TypeDescriptorSet( rdf_structs.ProtoString(name="string_field", field_number=1), rdf_structs.ProtoBinary(name="bytes_field", field_number=2), rdf_structs.ProtoUnsignedInteger(name="uint_field", field_number=3), rdf_structs.ProtoSignedInteger(name="int_field", field_number=4), rdf_structs.ProtoFloat(name="float_field", field_number=5), rdf_structs.ProtoDouble(name="double_field", field_number=6), rdf_structs.ProtoEnum(name="enum_field", field_number=7, enum_name="EnumField", enum={ "FIRST": 1, "SECOND": 2 }), rdf_structs.ProtoBoolean(name="bool_field", field_number=8), rdf_structs.ProtoRDFValue(name="urn_field", field_number=9, rdf_type="RDFURN"), rdf_structs.ProtoRDFValue(name="time_field", field_number=10, rdf_type="RDFDatetime"), rdf_structs.ProtoRDFValue(name="time_field_seconds", field_number=11, rdf_type="RDFDatetimeSeconds"), rdf_structs.ProtoRDFValue(name="duration_field", field_number=12, rdf_type="Duration"), rdf_structs.ProtoEmbedded(name="embedded_field", field_number=13, nested=TestEmbeddedStruct))
class FastGrrMessageList(rdf_structs.RDFProtoStruct): """A Faster implementation of GrrMessageList.""" type_description = type_info.TypeDescriptorSet( rdf_structs.ProtoList( rdf_structs.ProtoEmbedded( name="job", field_number=1, nested=StructGrrMessage)))
def MakeFlatRDFClass(self, value): """Generates flattened RDFValue class definition for the given value.""" def Flatten(self, metadata, value_to_flatten): if metadata: self.metadata = metadata for desc in value_to_flatten.type_infos: if desc.name == "metadata": continue if hasattr(self, desc.name) and value_to_flatten.HasField( desc.name): setattr(self, desc.name, getattr(value_to_flatten, desc.name)) descriptors = [] enums = {} # Metadata is always the first field of exported data. descriptors.append( rdf_structs.ProtoEmbedded(name="metadata", field_number=1, nested=base.ExportedMetadata)) for number, desc in sorted(value.type_infos_by_field_number.items()): # Name 'metadata' is reserved to store ExportedMetadata value. if desc.name == "metadata": logging.debug("Ignoring 'metadata' field in %s.", value.__class__.__name__) continue # Copy descriptors for primivie values as-is, just make sure their # field number is correct. if isinstance(desc, (rdf_structs.ProtoBinary, rdf_structs.ProtoString, rdf_structs.ProtoUnsignedInteger, rdf_structs.ProtoRDFValue, rdf_structs.ProtoEnum)): # Incrementing field number by 1, as 1 is always occuppied by metadata. descriptors.append(desc.Copy(field_number=number + 1)) if (isinstance(desc, rdf_structs.ProtoEnum) and not isinstance(desc, rdf_structs.ProtoBoolean)): # Attach the enum container to the class for easy reference: enums[desc.enum_name] = desc.enum_container # Create the class as late as possible. This will modify a # metaclass registry, we need to make sure there are no problems. output_class = compatibility.MakeType( self.ExportedClassNameForValue(value), (AutoExportedProtoStruct, ), dict(Flatten=Flatten)) for descriptor in descriptors: output_class.AddDescriptor(descriptor) for name, container in enums.items(): setattr(output_class, name, container) return output_class
class DynamicTypeTest(rdf_structs.RDFProtoStruct): """A protobuf with dynamic types.""" type_description = type_info.TypeDescriptorSet( rdf_structs.ProtoString( name="type", field_number=1, # By default return the TestStruct proto. default="TestStruct", description="A string value"), rdf_structs.ProtoDynamicEmbedded( name="dynamic", # The callback here returns the type specified by the type member. dynamic_cb=lambda x: rdf_structs.RDFProtoStruct.classes.get(x.type), field_number=2, description="A dynamic value based on another field."), rdf_structs.ProtoEmbedded( name="nested", field_number=3, nested=rdf_client.User))
class LateBindingTest(rdf_structs.RDFProtoStruct): type_description = type_info.TypeDescriptorSet( # A nested protobuf referring to an undefined type. rdf_structs.ProtoEmbedded( name="nested", field_number=1, nested="UndefinedYet"), rdf_structs.ProtoRDFValue( name="rdfvalue", field_number=6, rdf_type="UndefinedRDFValue", description="An undefined RDFValue field."), # A repeated late bound field. rdf_structs.ProtoList( rdf_structs.ProtoRDFValue( name="repeated", field_number=7, rdf_type="UndefinedRDFValue2", description="An undefined RDFValue field.")), )
def _RDFClass(cls, table: rdf_osquery.OsqueryTable) -> Type[Any]: """Creates a dynamic RDF proto struct class for given osquery table. The fields of the proto will correspond to the columns of the table. Args: table: An osquery table for which the class is about to be generated. Returns: A class object corresponding to the given table. """ rdf_cls_name = "OsqueryTable{}".format(hash(table.query)) try: return cls._rdf_cls_cache[rdf_cls_name] except KeyError: pass rdf_cls = compatibility.MakeType(rdf_cls_name, (rdf_structs.RDFProtoStruct, ), {}) rdf_cls.AddDescriptor( rdf_structs.ProtoEmbedded(name="metadata", field_number=1, nested=base.ExportedMetadata)) rdf_cls.AddDescriptor( rdf_structs.ProtoString(name="__query__", field_number=2)) for idx, column in enumerate(table.header.columns): # It is possible that RDF column is named "metadata". To avoid name clash # we must rename it to `__metadata__`. if column.name == "metadata": name = "__metadata__" else: name = column.name descriptor = rdf_structs.ProtoString(name=name, field_number=idx + 3) rdf_cls.AddDescriptor(descriptor) cls._rdf_cls_cache[rdf_cls_name] = rdf_cls return rdf_cls
"THIRD": 3 }, default=3, description="An enum field"), rdf_structs.ProtoFloat( name="float", field_number=8, description="A float number", default=1.1), ) # In order to define a recursive structure we must add it manually after the # class definition. TestStruct.AddDescriptor( rdf_structs.ProtoEmbedded(name="nested", field_number=4, nested=TestStruct),) TestStruct.AddDescriptor( rdf_structs.ProtoList( rdf_structs.ProtoEmbedded( name="repeat_nested", field_number=5, nested=TestStruct)),) class TestStructWithBool(rdf_structs.RDFProtoStruct): """A test struct object.""" type_description = type_info.TypeDescriptorSet( rdf_structs.ProtoBoolean( name="foo", field_number=1, default=False,