osquery / osquery-go

Go bindings for osquery
MIT License
388 stars 79 forks source link

Windows Named Pipe transport implementation #44

Closed zwass closed 7 years ago

zwass commented 7 years ago

Note 7015aae seems to work:

PS E:\src\github.com\kolide\osquery-go> .\query.exe \\.\\pipe\\shell.em 'select * from time'
Got results:
osquery.ExtensionPluginResponse{map[string]string{"day":"21", "minutes":"0", "weekday":"Thursday", "timezone":"UTC", "unix_time":"1506016822", "seconds":"22", "year":"2017", "hour":"18", "local_time":"1506016822", "local_timezone":"UTC", "month":"9", "timestamp":"Thu Sep 21 18:00:22 2017 UTC", "datetime":"2017-09-21T18:00:22Z", "iso_8601":"2017-09-21T18:00:22Z"}}

Whereas the attempted refactoring a948e93 does not:

PS E:\src\github.com\kolide\osquery-go> go build .\examples\query
PS E:\src\github.com\kolide\osquery-go> .\query.exe \\.\\pipe\\shell.em 'select * from time'
returning length 0
Error communicating with osqueryd: Invalid data length
zwass commented 7 years ago

The latest commit simplifies things and also gets it working again.

zwass commented 7 years ago

All examples seem to be working now, with the exception of the autoloaded extensions (example_distributed, example_logger). It is not clear to me whether this is due to an issue with extension autoloading on windows (I suspect it is), or some problem with the code here.

Example output:

PS E:\src\github.com\kolide\osquery-go> C:\ProgramData\osquery\osqueryd\osqueryd.exe --pidfile=C:\ProgramData\osquery\osqueryd.pidfile --db_path C:\ProgramData\osquery\osquery.db --config_path=C:\ProgramData\osquery\osquery.conf --logger_path=C:\ProgramData\osquery\logs --verbose --extensions_autoload=.\extensions_windows.load --disable_distributed=false --distributed_plugin=example_distributed --extensions_timeout=3 --extensions_interval=3
I0922 16:58:24.127060  7076 process_ops.cpp:181] Unable to find environment variable (0): OSQUERY_WORKER
I0922 16:58:24.128614  7076 init.cpp:392] osquery initialized [version=2.7.0]
I0922 16:58:24.129511  7076 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_WORKER
I0922 16:58:24.239887  7076 system.cpp:322] Found stale process for osqueryd (1212)
I0922 16:58:24.240885  7076 system.cpp:357] Writing osqueryd pid (5284) to C:\ProgramData\osquery\osqueryd.pidfile
I0922 16:58:24.241822  7076 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_WORKER
I0922 16:58:24.256151  7076 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_EXTENSIONS
I0922 16:58:24.344974  5016 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_EXTENSIONS
I0922 16:58:24.350349  5016 watcher.cpp:513] osqueryd watcher (5284) executing worker (6280)
I0922 16:58:24.372860  7708 init.cpp:389] osquery worker initialized [watcher=5284]
I0922 16:58:24.376664  7708 rocksdb.cpp:214] Opening RocksDB handle: C:\ProgramData\osquery\osquery.db
I0922 16:58:24.440996  6664 interface.cpp:327] Extension manager service starting: \\.\pipe\osquery.em
I0922 16:58:24.486178  7708 process_ops.cpp:181] Unable to find environment variable (203): OSQUERY_EXTENSIONS
E0922 16:58:24.488234  7708 init.cpp:568] Cannot activate example_distributed distributed plugin: Unknown registry plugin: example_distributed
I0922 16:58:24.490846  6664 interface.cpp:89] Thrift message: TPipeServer ConnectNamedPipe GLE=errno = 995
I0922 16:58:24.490846  6664 interface.cpp:89] Thrift message: TServerTransport died: TPipeServer: client connection failed

(It looks like osquery does not wait for the distributed plugin to attempt to register before declaring that it cannot be found)

zwass commented 7 years ago

I'd like to merge this despite the issues with autoloading extensions. I don't think it's worth prioritizing those issues at the moment, but I also don't want to leave this PR hanging any longer.

marpaia commented 7 years ago

I think that's a good idea @zwass. Let's just update the deps to use dep and ship it.