class SqliteTestStruct(rdf_structs.RDFProtoStruct):
"""Custom struct for testing schema generation."""
type_description = type_info.TypeDescriptorSet(
rdf_structs.ProtoString(name="string_field", field_number=1),
rdf_structs.ProtoBinary(name="bytes_field", field_number=2),
rdf_structs.ProtoUnsignedInteger(name="uint_field", field_number=3),
rdf_structs.ProtoSignedInteger(name="int_field", field_number=4),
rdf_structs.ProtoFloat(name="float_field", field_number=5),
rdf_structs.ProtoDouble(name="double_field", field_number=6),
rdf_structs.ProtoEnum(name="enum_field",
field_number=7,
enum_name="EnumField",
enum={
"FIRST": 1,
"SECOND": 2
}),
rdf_structs.ProtoBoolean(name="bool_field", field_number=8),
rdf_structs.ProtoRDFValue(name="urn_field",
field_number=9,
rdf_type="RDFURN"),
rdf_structs.ProtoRDFValue(name="time_field",
field_number=10,
rdf_type="RDFDatetime"),
rdf_structs.ProtoRDFValue(name="time_field_seconds",
field_number=11,
rdf_type="RDFDatetimeSeconds"),
rdf_structs.ProtoRDFValue(name="duration_field",
field_number=12,
rdf_type="Duration"),
rdf_structs.ProtoEmbedded(name="embedded_field",
field_number=13,
nested=TestEmbeddedStruct))
class FastGrrMessageList(rdf_structs.RDFProtoStruct):
"""A Faster implementation of GrrMessageList."""
type_description = type_info.TypeDescriptorSet(
rdf_structs.ProtoList(
rdf_structs.ProtoEmbedded(
name="job", field_number=1, nested=StructGrrMessage)))
def MakeFlatRDFClass(self, value):
"""Generates flattened RDFValue class definition for the given value."""
def Flatten(self, metadata, value_to_flatten):
if metadata:
self.metadata = metadata
for desc in value_to_flatten.type_infos:
if desc.name == "metadata":
continue
if hasattr(self, desc.name) and value_to_flatten.HasField(
desc.name):
setattr(self, desc.name,
getattr(value_to_flatten, desc.name))
descriptors = []
enums = {}
# Metadata is always the first field of exported data.
descriptors.append(
rdf_structs.ProtoEmbedded(name="metadata",
field_number=1,
nested=base.ExportedMetadata))
for number, desc in sorted(value.type_infos_by_field_number.items()):
# Name 'metadata' is reserved to store ExportedMetadata value.
if desc.name == "metadata":
logging.debug("Ignoring 'metadata' field in %s.",
value.__class__.__name__)
continue
# Copy descriptors for primivie values as-is, just make sure their
# field number is correct.
if isinstance(desc,
(rdf_structs.ProtoBinary, rdf_structs.ProtoString,
rdf_structs.ProtoUnsignedInteger,
rdf_structs.ProtoRDFValue, rdf_structs.ProtoEnum)):
# Incrementing field number by 1, as 1 is always occuppied by metadata.
descriptors.append(desc.Copy(field_number=number + 1))
if (isinstance(desc, rdf_structs.ProtoEnum)
and not isinstance(desc, rdf_structs.ProtoBoolean)):
# Attach the enum container to the class for easy reference:
enums[desc.enum_name] = desc.enum_container
# Create the class as late as possible. This will modify a
# metaclass registry, we need to make sure there are no problems.
output_class = compatibility.MakeType(
self.ExportedClassNameForValue(value), (AutoExportedProtoStruct, ),
dict(Flatten=Flatten))
for descriptor in descriptors:
output_class.AddDescriptor(descriptor)
for name, container in enums.items():
setattr(output_class, name, container)
return output_class
class DynamicTypeTest(rdf_structs.RDFProtoStruct):
"""A protobuf with dynamic types."""
type_description = type_info.TypeDescriptorSet(
rdf_structs.ProtoString(
name="type",
field_number=1,
# By default return the TestStruct proto.
default="TestStruct",
description="A string value"),
rdf_structs.ProtoDynamicEmbedded(
name="dynamic",
# The callback here returns the type specified by the type member.
dynamic_cb=lambda x: rdf_structs.RDFProtoStruct.classes.get(x.type),
field_number=2,
description="A dynamic value based on another field."),
rdf_structs.ProtoEmbedded(
name="nested", field_number=3, nested=rdf_client.User))
class LateBindingTest(rdf_structs.RDFProtoStruct):
type_description = type_info.TypeDescriptorSet(
# A nested protobuf referring to an undefined type.
rdf_structs.ProtoEmbedded(
name="nested", field_number=1, nested="UndefinedYet"),
rdf_structs.ProtoRDFValue(
name="rdfvalue",
field_number=6,
rdf_type="UndefinedRDFValue",
description="An undefined RDFValue field."),
# A repeated late bound field.
rdf_structs.ProtoList(
rdf_structs.ProtoRDFValue(
name="repeated",
field_number=7,
rdf_type="UndefinedRDFValue2",
description="An undefined RDFValue field.")),
)
def _RDFClass(cls, table: rdf_osquery.OsqueryTable) -> Type[Any]:
"""Creates a dynamic RDF proto struct class for given osquery table.
The fields of the proto will correspond to the columns of the table.
Args:
table: An osquery table for which the class is about to be generated.
Returns:
A class object corresponding to the given table.
"""
rdf_cls_name = "OsqueryTable{}".format(hash(table.query))
try:
return cls._rdf_cls_cache[rdf_cls_name]
except KeyError:
pass
rdf_cls = compatibility.MakeType(rdf_cls_name,
(rdf_structs.RDFProtoStruct, ), {})
rdf_cls.AddDescriptor(
rdf_structs.ProtoEmbedded(name="metadata",
field_number=1,
nested=base.ExportedMetadata))
rdf_cls.AddDescriptor(
rdf_structs.ProtoString(name="__query__", field_number=2))
for idx, column in enumerate(table.header.columns):
# It is possible that RDF column is named "metadata". To avoid name clash
# we must rename it to `__metadata__`.
if column.name == "metadata":
name = "__metadata__"
else:
name = column.name
descriptor = rdf_structs.ProtoString(name=name,
field_number=idx + 3)
rdf_cls.AddDescriptor(descriptor)
cls._rdf_cls_cache[rdf_cls_name] = rdf_cls
return rdf_cls
"THIRD": 3
},
default=3,
description="An enum field"),
rdf_structs.ProtoFloat(
name="float",
field_number=8,
description="A float number",
default=1.1),
)
# In order to define a recursive structure we must add it manually after the
# class definition.
TestStruct.AddDescriptor(
rdf_structs.ProtoEmbedded(name="nested", field_number=4,
nested=TestStruct),)
TestStruct.AddDescriptor(
rdf_structs.ProtoList(
rdf_structs.ProtoEmbedded(
name="repeat_nested", field_number=5, nested=TestStruct)),)
class TestStructWithBool(rdf_structs.RDFProtoStruct):
"""A test struct object."""
type_description = type_info.TypeDescriptorSet(
rdf_structs.ProtoBoolean(
name="foo",
field_number=1,
default=False,
