search

Hugal31 / yara-rust

Rust bindings for VirusTotal/Yara
Apache License 2.0
77 stars 28 forks source link

Any thoughts about concurrency and mutability? #3

Closed jondot closed 4 years ago

jondot commented 5 years ago

Hi, I'm trying to use this crate (thanks! :heart:) in a concurrent scenario, however Rules being mutable and borrowing means I can't really cache compiled rules or do any kind of sharing between threads.

Right now i'm compiling, creating rules and scanning every time I want to match text, which has a considerable overhead as a workaround.

Any thoughts you already had about this?

Hugal31 commented 5 years ago

Not really, but I know Yara is thread-safe in most cases. But I didn't use it for a long time, so I can't say for sure if you can use a rule in multiple thread. I'll give it a look when I have some time. Feel free to investigate by yourself.

For now, consider saving a rule in a file if it is really long to compile. I may also add a feature to save and load a rule from/to a Read<u8> Write<u8>.

Thanks for your feedback!

Hugal31 commented 4 years ago

Scanning on multiple thread is now possible on version 0.4.0, as Rules is Sync and Rules::scan_* take non-mut &self.