File: hdb_base.c

package info (click to toggle)
sleuthkit 4.11.1%2Bdfsg-1
  • links: PTS, VCS
  • area: main
  • in suites: bookworm
  • size: 18,388 kB
  • sloc: ansic: 143,074; cpp: 33,286; java: 32,933; sh: 4,342; xml: 2,197; makefile: 436; python: 270
file content (283 lines) | stat: -rwxr-xr-x 9,605 bytes parent folder | download | duplicates (5)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
/*
* The Sleuth Kit
*
* Brian Carrier [carrier <at> sleuthkit [dot] org]
* Copyright (c) 2014 Brian Carrier.  All rights reserved
*
*
* This software is distributed under the Common Public License 1.0
*/

#include "tsk_hashdb_i.h"

/**
* \file hdb_base.c
* "Base" functions for hash databases. Many are no-ops / stubs
*/

/**
* \ingroup hashdblib
* Sets hash database name in hdb_info based on database file path. 
* @param hdb_info Struct representation of an open hash database.
*/
void 
    hdb_base_db_name_from_path(TSK_HDB_INFO *hdb_info)
{
#ifdef TSK_WIN32
    const char PATH_CHAR = '\\';
#else
    const char PATH_CHAR = '/';
#endif
    TSK_TCHAR * begin;
    TSK_TCHAR * end;
    int i;
    hdb_info->db_name[0] = '\0';

    begin = TSTRRCHR(hdb_info->db_fname, PATH_CHAR);
#ifdef TSK_WIN32
    // cygwin can have forward slashes, so try that too on Windows
    if (!begin) {
        begin = TSTRRCHR(hdb_info->db_fname, '/');
    }
#endif

    if (!begin) {
        begin = hdb_info->db_fname;
    }
    else {
        // unlikely since this means that the dbname is "/"
        if (TSTRLEN(begin) == 1)
            return;
        else
            begin++;
    }

    // end points to the byte after the last one we want to use
    if ((TSTRLEN(hdb_info->db_fname) > 4) && (TSTRICMP(&hdb_info->db_fname[TSTRLEN(hdb_info->db_fname)-4], _TSK_T(".idx")) == 0)) 
        end = &hdb_info->db_fname[TSTRLEN(hdb_info->db_fname)-4];
    else
        end = begin + TSTRLEN(begin);   

    // @@@ This only works for file names with Latin characters. It may need
    // to be fixed some day. Leave it be for now. 
    for(i = 0; i < (end-begin); i++)
    {
        hdb_info->db_name[i] = (char) begin[i];
    }

    hdb_info->db_name[i] = '\0';
}

/**
* \ingroup hashdblib
* \internal
* Initializes TSK_HDB_INFO struct with "base class" method pointers and basic
* setup of values.  
* @param hdb_info Allocated struct to initialize.
* @param db_path 
* @return 0 on success, 1 on failure.
*/
uint8_t 
    hdb_info_base_open(TSK_HDB_INFO *hdb_info, const TSK_TCHAR *db_path)
{
    // copy the database path into the struct
    size_t path_len = TSTRLEN(db_path); 
    hdb_info->db_fname = (TSK_TCHAR*)tsk_malloc((path_len + 1) * sizeof(TSK_TCHAR));
    if (!hdb_info->db_fname) {
        return 1;
    }
    TSTRNCPY(hdb_info->db_fname, db_path, path_len);

    // set the name based on path
    hdb_base_db_name_from_path(hdb_info);

    hdb_info->db_type = TSK_HDB_DBTYPE_INVALID_ID;
    tsk_init_lock(&hdb_info->lock);

    hdb_info->transaction_in_progress = 0;

    hdb_info->get_db_path = hdb_base_get_db_path;
    hdb_info->get_display_name = hdb_base_get_display_name;
    hdb_info->uses_external_indexes = hdb_base_uses_external_indexes;
    hdb_info->get_index_path = hdb_base_get_index_path;
    hdb_info->has_index = hdb_base_has_index; 
    hdb_info->make_index = hdb_base_make_index;
    hdb_info->open_index = hdb_base_open_index;
    hdb_info->lookup_str = hdb_base_lookup_str;
    hdb_info->lookup_raw = hdb_base_lookup_bin;
    hdb_info->lookup_verbose_str = hdb_base_lookup_verbose_str;
    hdb_info->accepts_updates = hdb_base_accepts_updates;
    hdb_info->add_entry = hdb_base_add_entry;
    hdb_info->begin_transaction = hdb_base_begin_transaction;
    hdb_info->commit_transaction = hdb_base_commit_transaction;
    hdb_info->rollback_transaction = hdb_base_rollback_transaction;
    hdb_info->close_db = hdb_info_base_close;

    return 0;
}

const TSK_TCHAR *
    hdb_base_get_db_path(TSK_HDB_INFO *hdb_info)
{
    // The "base class" assumption is that the hash database is implemented
    // as a user-accessible file (e.g., it is a SQLite database or a text-
    // format database). In the future, it may become necessary to accomodate
    // connection strings.
    return hdb_info->db_fname;
}

const char *
    hdb_base_get_display_name(TSK_HDB_INFO *hdb_info)
{
    return hdb_info->db_name;
}

uint8_t
    hdb_base_uses_external_indexes()
{
    // The "base class" assumption is that the hash database does not use
    // user-accessible external index files (e.g., it is a relational
    // database).
    return 0;
}

const TSK_TCHAR*
    hdb_base_get_index_path(TSK_HDB_INFO *hdb_info, TSK_HDB_HTYPE_ENUM htype)
{
    // The "base class" assumption is that the hash database does not have
    // user-accessible external index files (e.g., it is a relational
    // database). It follows that the hash database path and index path are 
    // the same, assuming that the hash database is implemented
    // as a user-accessible file (e.g., it is a SQLite database). 
    return hdb_info->db_fname;
}

uint8_t
    hdb_base_has_index(TSK_HDB_INFO *hdb_info, TSK_HDB_HTYPE_ENUM htype)
{
    // The "base class" assumption is that the hash database does not have
    // user-accessible external index files (e.g., it is a relational database). 
    // It follows that the hash database has an index as soon as it is created. 
    // This implementation of this function also says that look ups for all hash 
    // algorithm types are supported.
    return 1;
}

uint8_t 
    hdb_base_make_index(TSK_HDB_INFO *hdb_info, TSK_TCHAR *htype)
{
    // The "base class" assumption is that the hash database does not have
    // user-accessible external index files (e.g., it is a relational
    // database). It follows that the hash database has an index upon creation.
    // Make this a no-op by simply returning the success code.
    return 0;
}

uint8_t
    hdb_base_open_index(TSK_HDB_INFO *hdb_info, TSK_HDB_HTYPE_ENUM htype)
{
    // The "base class" assumption is that the hash database does not use
    // user-accessible external index files (e.g., it is a relational
    // database). It follows that the hash database has an index when it is
    // created and it is already "open". Make this a no-op by simply returning
    // the success code.
    return 0;
}

int8_t
    hdb_base_lookup_str(TSK_HDB_INFO *hdb_info, const char *hash, TSK_HDB_FLAG_ENUM flag, TSK_HDB_LOOKUP_FN callback, void *data)
{
    // This function always needs an "override" by "derived classes."
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_lookup_str: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return -1;
}

int8_t
    hdb_base_lookup_bin(TSK_HDB_INFO *hdb_info, uint8_t *hash, uint8_t hash_len, TSK_HDB_FLAG_ENUM flag, TSK_HDB_LOOKUP_FN callback, void *data)
{
    // This function always needs an "override" by "derived classes."
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_lookup_bin: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return -1;
}

int8_t
    hdb_base_lookup_verbose_str(TSK_HDB_INFO *hdb_info, const char *hash, void *result)
{
    // This function always needs an "override" by "derived classes."
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_lookup_verbose_str: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return -1;
}

uint8_t
    hdb_base_accepts_updates()
{
    // The "base class" assumption is that the database accepts updates (e.g.,
    // it is a relational database and there is a "derived class override" of 
    // add_entry() function that does INSERTs).
    return 1;
}

uint8_t
    hdb_base_add_entry(TSK_HDB_INFO *hdb_info, const char *file_name, const char *md5, const char *sha1, const char *sha2_256, const char *comment)
{
    // This function needs an "override" by "derived classes" unless there is an 
    // "override" of the accepts_updates function that returns 0 (false).
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_add_entry: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return 1;
}

uint8_t hdb_base_begin_transaction(TSK_HDB_INFO *hdb_info)
{
    // This function needs an "override" by "derived classes" unless there is an 
    // "override" of the accepts_updates function that returns 0 (false).
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_begin_transaction: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return 1;
}

uint8_t hdb_base_commit_transaction(TSK_HDB_INFO *hdb_info)
{
    // This function needs an "override" by "derived classes" unless there is an 
    // "override" of the accepts_updates function that returns 0 (false).
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_commit_transaction: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return 1;
}

uint8_t hdb_base_rollback_transaction(TSK_HDB_INFO *hdb_info)
{
    // This function needs an "override" by "derived classes" unless there is an 
    // "override" of the accepts_updates function that returns 0 (false).
    tsk_error_reset();
    tsk_error_set_errno(TSK_ERR_HDB_UNSUPFUNC);
    tsk_error_set_errstr("hdb_base_rollback_transaction: operation not supported for hdb_info->db_type=%u", hdb_info->db_type);
    return 1;
}

/**
* \ingroup hashdblib
* De-initializes struct representation of a hash database.
* @param hdb_info Struct representation of a hash database.
* @return 0 on success, 1 on failure.
*/
void hdb_info_base_close(TSK_HDB_INFO *hdb_info)
{
    if (NULL == hdb_info) {
        return;
    }

    free(hdb_info->db_fname);
    hdb_info->db_fname = NULL;

    tsk_deinit_lock(&hdb_info->lock);
}