1
1
mirror of https://github.com/wader/fq.git synced 2024-12-22 21:01:37 +03:00
Commit Graph

467 Commits

Author SHA1 Message Date
Mattias Wadman
a6c4db75fd decode: Cleanup old unused help system code 2023-03-28 21:51:04 +02:00
Mattias Wadman
5415bfcaca interp: Make completion work again
Should really add test for this
2023-03-10 21:58:35 +01:00
Mattias Wadman
3dd2c61d3c interp: Fix input completion regression in sub-REPLs
readline Config was used to pass completer function per readline call,
was changed in #612 and caused regression. Now use our own member in
stdOS to pass it instead.

Add a test but test script completer is implemented differently.
2023-03-10 13:57:21 +01:00
Mattias Wadman
980ecdba82 decode: Add float 80 reader
Rename *d.Bits to UintBits as it return a uint
Add *d.Bits that return []byte
2023-03-10 01:15:55 +01:00
Shivaram Lingamneni
ffc66db083 readline: remove direct access to (*Instance).Config 2023-03-09 05:53:29 +00:00
Mattias Wadman
cc52a4419d id3v2: Decode subframes for CTOC and add struct for headers 2023-03-05 19:29:22 +01:00
Mattias Wadman
9852f56b74 tls: Add TLS 1.0, 1.1, 1.2 decode and decryption
What it can do:
- Decodes records and most standard messages and extensions.
- Decryptes records and reassemples application data stream if a keylog is provided
  and the cipher suite is supported.
- Supports most recommended and used ciphers and a bunch of older ones.

What it can't do:
- SSL v3 maybe supported, is similar to TLS 1.0, not tested.
- Decryption and renegotiation/cipher change.
- Record defragmentation not supported, seems rare over TCP.
- TLS 1.3
- SSL v2 but v2 compat header is supported.
- Some key exchange messages not decoded yet

Decryption code is heavly based on golang crypto/tls and zmap/zcrypto.

Will be base for decoding http2 and other TLS based on protocols.

Fixes #587
2023-03-05 13:52:12 +01:00
Mattias Wadman
c75a83c829 help: Show default option value as JSON 2023-03-04 09:53:33 +01:00
Mattias Wadman
dec433fc53 help,markdown: Fix double line breaks when converting to text
Also fix ugly last line break hack
2023-03-02 23:38:11 +01:00
Mattias Wadman
73db6587a0 interp: Exit with error if -o name=@path fails to be read, also document 2023-02-26 21:18:36 +01:00
Mattias Wadman
8e0dde03d0 decode: Support multiple format args and some rename and refactor
This will allow passing both cli options and format options to sub decoder.
Ex: pass keylog option to a tls decoder when decoding a pcap.
Ex: pass decode options to a format inside a http body inside a pcap.

Add ArgAs method to lookup argument based on type. This also makes the format
decode function have same signature as sub decoders in the decode API.

This change decode.Format a bit:
DecodeFn is now just func(d *D) any
DecodeInArg renamed to DefaultInArg
2023-02-18 21:38:51 +01:00
Mattias Wadman
a1bb630a2a doc,fq: Improve cli help and some cleanup 2023-02-15 11:04:39 +01:00
Mattias Wadman
dc79a73b72 interp,json: Move error handling to colorjson
Cancel error from ValueFn etc will be return by Marshal instead
2023-02-07 16:57:54 +01:00
Mattias Wadman
5c8e115106 colorjson: Refactor to option struct 2023-02-07 16:18:32 +01:00
Mattias Wadman
8b49b42fa3 interp: Wrap Binary in decodeValue to fix prompt issue with bits/bytes format 2023-01-04 15:30:05 +01:00
Mattias Wadman
ca27e4266e doc: Add _parent for decode values and clenaup doc a bit 2023-01-03 11:21:09 +01:00
Mattias Wadman
6c229d7382 interp: Don't auto convert to binary for string functions, is just confusing
Instead use tobytes etc if binary matching is what is wanted
2022-12-22 12:13:23 +01:00
Mattias Wadman
e3ae1440c9 interp: Rename to/from<format> functions to to_/from_<format>
Feels less cluttered, easier to read and more consistent.

Still keep tovalue, tobytes etc that are more basic functions this
only renamed format related functions.
Also there is an exceptin for to/fromjson as it comes from jq.

Also fixes lots of spelling errors while reading thru.
2022-12-21 17:48:39 +01:00
Mattias Wadman
9e5a072e50 mp3_frame_tags: Covert to decode group and split to mp3_frame_{xing,vbri} decoders 2022-12-15 12:10:06 +01:00
Mattias Wadman
9b81d4d3ab decode: More type safe API and split scalar into multiple types
Preparation to make decoder use less memory and API more type safe.
Now each scalar type has it's own struct type so it can store different
things and enables to have a scalar interface.
Also own types will enable experimenting with decode DLS designs like
using chained methods that are type aware.
2022-12-14 16:23:58 +01:00
Mattias Wadman
48522e3cb8 mp3_tags,mp3: Add VBRI header support and rename tags to tag as there is only one 2022-12-14 11:34:53 +01:00
Mattias Wadman
578b84d4cf interp,display: Add workaround for go 1.18 when escaping 0x7f 2022-12-10 11:34:21 +01:00
Mattias Wadman
83ccedc506 mp4,decode: Properly decode ilst items (both mdta and mdir)
Refactor mp4 decoder to be simpler and have fallback for unknown box type
Cleanup some old ilst hacks
Add generic string reader to decode API that takes an encoding parameters
2022-12-08 15:56:22 +01:00
Mattias Wadman
6c86945125 gojq: Update rebased fq fork
Fix issue with JQValue:s in assig/update paths.

Rebase on upstream master, commits since last rebase:
c1a3ebd (tag: v0.12.10, origin/main) bump up version to 0.12.10
5294c9e update CHANGELOG.md for v0.12.10
319a797 update dependencies
20ca575 add notes on precedence of unary operators against variable binding
62ffdf7 fix break in try catch syntax
35c123b improve the order of test cases
fe0e20a improve performance of ascii_downcase, ascii_upcase functions
76648c7 improve match/2 to reduce syntax tree nodes just like splits/2
6a683bb improve the install targets in Makefile
6631dd3 escape the null character in csv, tsv, sh formats (close #200)
5253817 fix path value validation on getpath function (fix #198)
2022-12-07 16:45:08 +01:00
Mattias Wadman
423bab9e33 dev,test: Use jqtest code from jqjq for jq tests 2022-12-05 20:52:27 +01:00
Mattias Wadman
6fc84a885c doc,dev: Add more usage and dev tips 2022-12-03 19:00:47 +01:00
Mattias Wadman
e77f776999 decode,interp: Rename unknown gap fields from "unknown#" to "gap#"
Think it makes it clearer and also less likely to collide with a field
name a deocder wants to use.
2022-12-01 20:43:30 +01:00
Mattias Wadman
8d69f1fb23 interp: Change default bits_format=string
I think this is more intuitive but might in some case cause very large JSON output
but maybe that less common or expected. In does cases i think you either want to
use some other bits_format (md5, truncate, etc) or you delete/transform the jq value
before turn it into JSON.

Strings in gojq are binary safe so you can use to hold raw bytes. But note that
convert the binary into JSON is lossy, same as the JSON standard.

Add bits_format option documentation.
2022-12-01 17:49:34 +01:00
Mattias Wadman
ba88a68466 interp: mimic jq: if expr arg is given read stdin even if tty 2022-11-29 18:39:57 +01:00
Mattias Wadman
646f32d563 matroska: Fix path tests and make _tree_path more robust 2022-11-20 20:16:41 +01:00
Mattias Wadman
c93301fc70 raw,bits,bytes: Replace raw format with bits and bytes format that decode to a binary
raw format was a hack to skip decoding to be able to get a binary using tobyte etc.
Now you can do fq -d bytes ... instead of fq -d raw 'tobytes | ...'
2022-11-20 19:51:12 +01:00
Mattias Wadman
c3a0686c9e mp3_frame_tags: Refactor and rename xing format to mp3_frame_tags
Make more sense to use a more general name when there is both info and xing
and possibly vbri in the future. Also both xing and info seems to have extension
fields

Remove some old tests that are not really needed anymore.
2022-11-16 17:32:03 +01:00
Mattias Wadman
41b2d1ad1b cli: Better decode error help 2022-11-02 12:28:53 +01:00
Mattias Wadman
7254b0f9f5 decode,elf,fuzz: TryBytesRange error on negative size 2022-10-20 15:10:35 +02:00
Mattias Wadman
2606916753 yaml,fuzz: gojq.Normalize value to fix type panic 2022-10-11 19:22:49 +02:00
Mattias Wadman
bafd1f564e decode,fuzz: Signed integer (S) read require at least one bit
Otherwise there is no sign bit and it will panic on shifting.

Maybe should require 2? now -0 and +1 hmm
2022-10-11 12:12:28 +02:00
Mattias Wadman
cb3dc80252 decode,tar: Add scalar description and Try* helpers
Rework time helpers to use new functions
Fix panic in tar decoder where sym value might be missing

Still not very happy about the API but it's getting better.
2022-10-04 17:18:51 +02:00
Mattias Wadman
09ea08f3aa
Merge pull request #427 from dgmcdona/bplist
Adds support for Apple Binary Plist, version 00
2022-10-04 14:25:53 +02:00
Mattias Wadman
c4219d69db interp: Fix interrupt panic for cli eval
Rewrite cli query to use display as output query, same as for repl.
Without this "tovalue" values that don't print in the current eval
will end up in the paren eval and be written using an output without
a cancel context.
2022-09-29 18:17:57 +02:00
Mattias Wadman
00ee10a1a1 interp: Make to{actual,sym} behave similar to tovalue
Before if you did toactual it behaved differently and even gave error for
a scalar that only had actual value set. Now both to{actal,sym} works
similar to tovalue but will force if actual or sym value should be used.
2022-09-25 17:53:12 +02:00
Mattias Wadman
0f35fe48fd ranges,decode: Correctly skip empty ranges when adding unknown fields
Before an empty range could cause gaps to be devided instead of continous.
2022-09-25 16:02:15 +02:00
David McDonald
bcccde2358 Fixes and embeds documentation 2022-09-24 12:57:11 -05:00
David McDonald
5f61994087 adds function for decoding fixed sized arrays 2022-09-23 20:50:41 -05:00
David McDonald
a77cec921f Added documentation and tests, fixed bad date parsing 2022-09-23 20:23:23 -05:00
David McDonald
5711f29084 Code fixes from PR, still need to add tests and testdata 2022-09-23 20:21:32 -05:00
David McDonald
d784db69bc Adds support for Apple Binary Plist, version 00 2022-09-23 20:21:32 -05:00
Mattias Wadman
a7a101ca67 doc,help: Nicer format help and move help tests into each format
Also add authors to avro and macho decoders

Generated with:
for i in $(go run . -r -n '_registry | [([([.files[][].name | split(".")[0]] | unique[]), (.formats[].name)] | count[] | select(.[1] == 2)[0]), (.formats[] | select(.decode_in_arg).name)] | unique[]'); do DIR=$(dirname $(find format -name $i.go)); echo "$ fq -h $i" > "$DIR/testdata/help_$i.fqtest" ; done
2022-09-22 23:07:58 +02:00
Mattias Wadman
fe64530e11 csv: Add tsv and header example
Also fix string esacpe in fuzz options parser
2022-09-15 01:16:45 +02:00
Mattias Wadman
abd19ed89b doc: Fix format sections a bit 2022-09-11 09:55:56 +02:00
Mattias Wadman
87b2c6c10c help,doc: Use markdown for format documentation again
Markdown is used as is in online documentation and in cli the markdown decoder
is used to decode and the some jq code massages it into something cli friendly.

Was just too much of a mess to have doc in jq.
2022-09-11 00:53:29 +02:00