osquery-1/osquery/logger/plugins/tls.h

/*
 *  Copyright (c) 2014-present, Facebook, Inc.
 *  All rights reserved.
 *
 *  This source code is licensed under the BSD-style license found in the
 *  LICENSE file in the root directory of this source tree. An additional grant
 *  of patent rights can be found in the PATENTS file in the same directory.
 *
 */

#pragma once

#include <osquery/dispatcher.h>
#include <osquery/logger.h>

#include "osquery/logger/plugins/buffered.h"

namespace osquery {

/**
 * @brief A log forwarder thread flushing database-buffered logs.
 *
 * The TLSLogForwarder flushes buffered result and status logs based
 * on CLI/options settings. If an enrollment key is set (and checked) during
 * startup, this Dispatcher service is started.
 */
class TLSLogForwarder : public BufferedLogForwarder {
 public:
  explicit TLSLogForwarder(const std::string& node_key);

 protected:
  Status send(std::vector<std::string>& log_data,
              const std::string& log_type) override;

  /// Receive an enrollment/node key from the backing store cache.
  std::string node_key_;

  /// Endpoint URI
  std::string uri_;

 private:
  friend class TLSLoggerTests;
};

class TLSLoggerPlugin : public LoggerPlugin {
 public:
  /**
   * @brief The osquery logger initialization method.
   *
   * LoggerPlugin::init is optionally used by logger plugins to receive a
   * buffer of status logs generated between application start and logger
   * initialization. TLSLoggerPlugin will further buffer these logs into the
   * backing store. They will flush to a TLS endpoint under normal conditions
   * in a supporting/asynchronous thread.
   */
  void init(const std::string& name,
            const std::vector<StatusLogLine>& log) override;

  /// Setup node key and worker thread for sending logs.
  Status setUp() override;

  bool usesLogStatus() override { return true; }

 protected:
  /// Log a result string. This is the basic catch-all for snapshots and events.
  Status logString(const std::string& s) override;

  /// Log a status (ERROR/WARNING/INFO) message.
  Status logStatus(const std::vector<StatusLogLine>& log) override;

 private:
  /// Forwarder that buffers/sends logs. Runs in a Dispatcher thread.
  std::shared_ptr<TLSLogForwarder> forwarder_{nullptr};

 private:
  friend class TLSLoggerTests;
};
}