forked from Velocidex/velociraptor
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathprotobuf.go
112 lines (92 loc) · 3.04 KB
/
protobuf.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
package json
import (
"github.com/Velocidex/json"
"github.com/Velocidex/ordereddict"
"google.golang.org/protobuf/encoding/protojson"
"google.golang.org/protobuf/proto"
"google.golang.org/protobuf/reflect/protoreflect"
)
func MarshalProtobuf(v interface{}, opts *json.EncOpts) ([]byte, error) {
self, ok := v.(proto.Message)
if !ok {
return nil, json.EncoderCallbackSkip
}
return protojson.MarshalOptions{
Multiline: true, Indent: " ", UseProtoNames: true,
}.Marshal(self)
}
// Convert a protobuf to an ordered dict. Ordered Dicts have more
// predictable json serializations and are therefore more desirable
// for VQL export:
//
// 1) The serialized fields are exactly the same casing as the accessed fields.
// 2) Enums are encoded in the same way as they are accessed.
//
// This function is usually used to convert a protobuf in a VQL
// plugin/function before emitting the message into the VQL subsystem.
func ConvertProtoToOrderedDict(m proto.Message) *ordereddict.Dict {
return descriptorToDict(m.ProtoReflect())
}
func descriptorToDict(message protoreflect.Message) *ordereddict.Dict {
descriptor := message.Descriptor()
result := ordereddict.NewDict()
fields := descriptor.Fields()
for i := 0; i < fields.Len(); i++ {
field := fields.Get(i)
value := message.Get(field)
if field.Cardinality() == protoreflect.Repeated {
setRepeatedValue(result, value, field)
} else {
setOneValue(result, value, field)
}
}
return result
}
func setRepeatedValue(result *ordereddict.Dict, value protoreflect.Value,
field protoreflect.FieldDescriptor) {
field_name := string(field.Name())
switch field.Kind() {
case protoreflect.MessageKind:
value_list := value.List()
list := make([]*ordereddict.Dict, 0, value_list.Len())
for i := 0; i < value_list.Len(); i++ {
new_value := descriptorToDict(value_list.Get(i).Message())
list = append(list, new_value)
}
result.Set(field_name, list)
case protoreflect.EnumKind:
value_list := value.List()
list := make([]string, 0, value_list.Len())
enum_desc := field.Enum().Values()
for i := 0; i < value_list.Len(); i++ {
value := value_list.Get(i)
value_descriptor := enum_desc.ByNumber(value.Enum())
list = append(list, string(value_descriptor.Name()))
}
result.Set(field_name, list)
default:
value_list := value.List()
list := make([]interface{}, 0, value_list.Len())
for i := 0; i < value_list.Len(); i++ {
list = append(list, value_list.Get(i).Interface())
}
result.Set(field_name, list)
}
}
func setOneValue(result *ordereddict.Dict, value protoreflect.Value,
field protoreflect.FieldDescriptor) {
field_name := string(field.Name())
switch field.Kind() {
// Store the enums as strings so we can match them properly in
// VQL.
case protoreflect.EnumKind:
value_descriptor := field.Enum().Values().ByNumber(value.Enum())
result.Set(field_name, string(value_descriptor.Name()))
case protoreflect.MessageKind:
result.Set(field_name, descriptorToDict(value.Message()))
default:
// Skip empty values
v := value.Interface()
result.Set(field_name, v)
}
}