2014-09-19 08:54:33 +00:00
|
|
|
// Copyright 2004-present Facebook. All Rights Reserved.
|
|
|
|
|
2014-09-25 17:17:32 +00:00
|
|
|
#include <boost/algorithm/string.hpp>
|
|
|
|
#include <boost/algorithm/string/classification.hpp>
|
2014-09-19 08:54:33 +00:00
|
|
|
#include <boost/lexical_cast.hpp>
|
|
|
|
|
2014-12-03 23:14:02 +00:00
|
|
|
#include <osquery/core.h>
|
|
|
|
#include <osquery/dispatcher.h>
|
|
|
|
#include <osquery/events.h>
|
|
|
|
#include <osquery/flags.h>
|
2014-12-08 10:22:59 +00:00
|
|
|
#include <osquery/logger.h>
|
2014-12-03 23:14:02 +00:00
|
|
|
|
2014-09-19 08:54:33 +00:00
|
|
|
#include "osquery/core/conversions.h"
|
|
|
|
|
|
|
|
namespace osquery {
|
|
|
|
|
2014-11-09 21:31:56 +00:00
|
|
|
DEFINE_osquery_flag(bool,
|
|
|
|
event_pubsub,
|
|
|
|
true,
|
2014-11-24 16:47:11 +00:00
|
|
|
"Use (enable) the osquery eventing pub/sub.");
|
2014-11-09 21:31:56 +00:00
|
|
|
|
2014-12-04 18:56:31 +00:00
|
|
|
DEFINE_osquery_flag(int32,
|
|
|
|
event_pubsub_expiry,
|
|
|
|
86000,
|
|
|
|
"Expire (remove) recorded events after a timeout.");
|
|
|
|
|
2014-11-24 16:47:11 +00:00
|
|
|
const std::vector<size_t> kEventTimeLists = {
|
|
|
|
1 * 60 * 60, // 1 hour
|
2014-12-04 18:56:31 +00:00
|
|
|
1 * 60, // 1 minute
|
|
|
|
10, // 10 seconds
|
2014-09-19 08:54:33 +00:00
|
|
|
};
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
void EventPublisherCore::fire(const EventContextRef& ec, EventTime time) {
|
2014-09-23 01:35:12 +00:00
|
|
|
EventContextID ec_id;
|
|
|
|
|
|
|
|
{
|
|
|
|
boost::lock_guard<boost::mutex> lock(ec_id_lock_);
|
|
|
|
ec_id = next_ec_id_++;
|
|
|
|
}
|
|
|
|
|
2014-09-25 17:17:32 +00:00
|
|
|
// Fill in EventContext ID and time if needed.
|
|
|
|
if (ec != nullptr) {
|
|
|
|
ec->id = ec_id;
|
|
|
|
if (ec->time == 0) {
|
|
|
|
if (time == 0) {
|
|
|
|
time = getUnixTime();
|
|
|
|
}
|
2014-12-08 10:22:59 +00:00
|
|
|
// Todo: add a check to assure normalized (seconds) time.
|
2014-09-25 17:17:32 +00:00
|
|
|
ec->time = time;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Set the optional string-verion of the time for DB columns.
|
|
|
|
ec->time_string = boost::lexical_cast<std::string>(ec->time);
|
|
|
|
}
|
|
|
|
|
2014-10-03 15:26:41 +00:00
|
|
|
for (const auto& subscription : subscriptions_) {
|
2014-12-15 05:20:20 +00:00
|
|
|
fireCallback(subscription, ec);
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-12-15 00:05:07 +00:00
|
|
|
std::vector<std::string> EventSubscriberCore::getIndexes(EventTime start,
|
2014-12-04 18:56:31 +00:00
|
|
|
EventTime stop,
|
|
|
|
int list_key) {
|
|
|
|
auto db = DBHandle::getInstance();
|
|
|
|
auto index_key = "indexes." + dbNamespace();
|
|
|
|
std::vector<std::string> indexes;
|
|
|
|
|
|
|
|
// Keep track of the tail/head of account time while bin searching.
|
|
|
|
EventTime start_max = stop, stop_min = stop, local_start, local_stop;
|
|
|
|
auto types = kEventTimeLists.size();
|
|
|
|
// List types are sized bins of time containing records for this namespace.
|
|
|
|
for (size_t i = 0; i < types; ++i) {
|
|
|
|
auto size = kEventTimeLists[i];
|
|
|
|
if (list_key > 0 && i != list_key) {
|
|
|
|
// A specific list_type was requested, only return bins of this key.
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
std::string time_list;
|
|
|
|
auto list_type = boost::lexical_cast<std::string>(size);
|
|
|
|
auto status = db->Get(kEvents, index_key + "." + list_type, time_list);
|
|
|
|
if (time_list.length() == 0) {
|
|
|
|
// No events in this binning size.
|
|
|
|
return indexes;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (list_key == 0 && i == (types - 1) && types > 1) {
|
|
|
|
// Relax the requested start/stop bounds.
|
|
|
|
if (start != start_max) {
|
|
|
|
start = (start / size) * size;
|
|
|
|
start_max = ((start / size) + 1) * size;
|
|
|
|
if (start_max < stop) {
|
|
|
|
start_max = start + kEventTimeLists[types - 2];
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (stop != stop_min) {
|
|
|
|
stop = ((stop / size) + 1) * size;
|
|
|
|
stop_min = (stop / size) * size;
|
|
|
|
if (stop_min > start) {
|
|
|
|
stop_min = stop_min - kEventTimeLists[types - 1];
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else if (list_key > 0 || types == 1) {
|
|
|
|
// Relax the requested bounds to fit the requested/only index.
|
|
|
|
start = (start / size) * size;
|
|
|
|
start_max = ((start_max / size) + 1) * size;
|
|
|
|
}
|
|
|
|
|
|
|
|
// (1) The first iteration will have 1 range (start to start_max=stop).
|
|
|
|
// (2) Itermediate iterations will have 2 (start-start_max, stop-stop_min).
|
|
|
|
// For each iteration the range collapses based on the coverage using
|
|
|
|
// the first bin's start time and the last bin's stop time.
|
|
|
|
// (3) The last iteration's range includes relaxed bounds outside the
|
|
|
|
// requested start to stop range.
|
2014-12-06 09:18:29 +00:00
|
|
|
std::vector<std::string> all_bins, bins, expirations;
|
2014-12-04 18:56:31 +00:00
|
|
|
boost::split(all_bins, time_list, boost::is_any_of(","));
|
|
|
|
for (const auto& bin : all_bins) {
|
|
|
|
// Bins are identified by the binning size step.
|
2014-12-06 09:18:29 +00:00
|
|
|
auto step = boost::lexical_cast<EventTime>(bin);
|
2014-12-04 18:56:31 +00:00
|
|
|
// Check if size * step -> size * (step + 1) is within a range.
|
|
|
|
int bin_start = size * step, bin_stop = size * (step + 1);
|
2014-12-06 09:18:29 +00:00
|
|
|
if (expire_events_ && step * size < expire_time_) {
|
|
|
|
expirations.push_back(list_type + "." + bin);
|
|
|
|
} else if (bin_start >= start && bin_stop <= start_max) {
|
2014-12-04 18:56:31 +00:00
|
|
|
bins.push_back(bin);
|
|
|
|
} else if ((bin_start >= stop_min && bin_stop <= stop) || stop == 0) {
|
|
|
|
bins.push_back(bin);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-12-06 09:18:29 +00:00
|
|
|
expireIndexes(list_type, all_bins, expirations);
|
2014-12-04 18:56:31 +00:00
|
|
|
if (bins.size() != 0) {
|
|
|
|
// If more percision was acheived though this list's binning.
|
|
|
|
local_start = boost::lexical_cast<EventTime>(bins.front()) * size;
|
|
|
|
start_max = (local_start < start_max) ? local_start : start_max;
|
|
|
|
local_stop = (boost::lexical_cast<EventTime>(bins.back()) + 1) * size;
|
|
|
|
stop_min = (local_stop < stop_min) ? local_stop : stop_min;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (const auto& bin : bins) {
|
|
|
|
indexes.push_back(list_type + "." + bin);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (start == start_max && stop == stop_min) {
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-12-08 10:22:59 +00:00
|
|
|
// Update the new time that events expire to now - expiry.
|
2014-12-04 18:56:31 +00:00
|
|
|
return indexes;
|
|
|
|
}
|
|
|
|
|
2014-12-15 00:05:07 +00:00
|
|
|
Status EventSubscriberCore::expireIndexes(
|
2014-12-06 09:18:29 +00:00
|
|
|
const std::string& list_type,
|
|
|
|
const std::vector<std::string>& indexes,
|
|
|
|
const std::vector<std::string>& expirations) {
|
2014-09-25 17:17:32 +00:00
|
|
|
auto db = DBHandle::getInstance();
|
2014-12-06 09:18:29 +00:00
|
|
|
auto index_key = "indexes." + dbNamespace();
|
2014-12-04 18:56:31 +00:00
|
|
|
auto record_key = "records." + dbNamespace();
|
2014-12-06 09:18:29 +00:00
|
|
|
auto data_key = "data." + dbNamespace();
|
2014-09-25 17:17:32 +00:00
|
|
|
|
2014-12-06 09:18:29 +00:00
|
|
|
// Get the records list for the soon-to-be expired records.
|
|
|
|
std::vector<std::string> record_indexes;
|
|
|
|
for (const auto& bin : expirations) {
|
|
|
|
record_indexes.push_back(list_type + "." + bin);
|
|
|
|
}
|
|
|
|
auto expired_records = getRecords(record_indexes);
|
|
|
|
|
|
|
|
// Remove the records using the list of expired indexes.
|
|
|
|
std::vector<std::string> persisting_indexes = indexes;
|
|
|
|
for (const auto& bin : expirations) {
|
|
|
|
db->Delete(kEvents, record_key + "." + list_type + "." + bin);
|
|
|
|
persisting_indexes.erase(
|
|
|
|
std::remove(persisting_indexes.begin(), persisting_indexes.end(), bin),
|
|
|
|
persisting_indexes.end());
|
|
|
|
}
|
|
|
|
|
|
|
|
// Update the list of indexes with the non-expired indexes.
|
|
|
|
auto new_indexes = boost::algorithm::join(persisting_indexes, ",");
|
|
|
|
db->Put(kEvents, index_key + "." + list_type, new_indexes);
|
|
|
|
|
|
|
|
// Delete record events.
|
|
|
|
for (const auto& record : expired_records) {
|
|
|
|
db->Delete(kEvents, data_key + "." + record.first);
|
|
|
|
}
|
|
|
|
|
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
|
2014-12-15 00:05:07 +00:00
|
|
|
std::vector<EventRecord> EventSubscriberCore::getRecords(
|
2014-12-06 09:18:29 +00:00
|
|
|
const std::vector<std::string>& indexes) {
|
|
|
|
auto db = DBHandle::getInstance();
|
|
|
|
auto record_key = "records." + dbNamespace();
|
|
|
|
std::vector<EventRecord> records;
|
2014-09-25 17:17:32 +00:00
|
|
|
|
2014-12-04 18:56:31 +00:00
|
|
|
for (const auto& index : indexes) {
|
|
|
|
std::string record_value;
|
|
|
|
if (!db->Get(kEvents, record_key + "." + index, record_value).ok()) {
|
|
|
|
return records;
|
|
|
|
}
|
2014-09-25 17:17:32 +00:00
|
|
|
|
|
|
|
if (record_value.length() == 0) {
|
|
|
|
// There are actually no events in this bin, interesting error case.
|
|
|
|
continue;
|
|
|
|
}
|
2014-12-04 18:56:31 +00:00
|
|
|
|
|
|
|
// Each list is tokenized into a record=event_id:time.
|
2014-09-25 17:17:32 +00:00
|
|
|
std::vector<std::string> bin_records;
|
|
|
|
boost::split(bin_records, record_value, boost::is_any_of(",:"));
|
|
|
|
auto bin_it = bin_records.begin();
|
|
|
|
for (; bin_it != bin_records.end(); bin_it++) {
|
|
|
|
std::string eid = *bin_it;
|
|
|
|
EventTime time = boost::lexical_cast<EventTime>(*(++bin_it));
|
|
|
|
records.push_back(std::make_pair(eid, time));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-12-06 09:18:29 +00:00
|
|
|
return records;
|
2014-09-25 17:17:32 +00:00
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventSubscriberCore::recordEvent(EventID& eid, EventTime time) {
|
2014-09-19 08:54:33 +00:00
|
|
|
Status status;
|
|
|
|
auto db = DBHandle::getInstance();
|
2014-09-25 17:17:32 +00:00
|
|
|
std::string time_value = boost::lexical_cast<std::string>(time);
|
2014-09-19 08:54:33 +00:00
|
|
|
|
|
|
|
// The record is identified by the event type then module name.
|
2014-09-25 17:17:32 +00:00
|
|
|
std::string index_key = "indexes." + dbNamespace();
|
|
|
|
std::string record_key = "records." + dbNamespace();
|
2014-09-19 08:54:33 +00:00
|
|
|
// The list key includes the list type (bin size) and the list ID (bin).
|
|
|
|
std::string list_key;
|
|
|
|
std::string list_id;
|
|
|
|
|
|
|
|
for (auto time_list : kEventTimeLists) {
|
|
|
|
// The list_id is the MOST-Specific key ID, the bin for this list.
|
|
|
|
// If the event time was 13 and the time_list is 5 seconds, lid = 2.
|
2014-09-25 17:17:32 +00:00
|
|
|
list_id = boost::lexical_cast<std::string>(time / time_list);
|
2014-09-19 08:54:33 +00:00
|
|
|
// The list name identifies the 'type' of list.
|
|
|
|
list_key = boost::lexical_cast<std::string>(time_list);
|
2014-09-25 17:17:32 +00:00
|
|
|
// list_key = list_key + "." + list_id;
|
2014-09-19 08:54:33 +00:00
|
|
|
|
|
|
|
{
|
|
|
|
boost::lock_guard<boost::mutex> lock(event_record_lock_);
|
|
|
|
// Append the record (eid, unix_time) to the list bin.
|
2014-09-25 17:17:32 +00:00
|
|
|
std::string record_value;
|
|
|
|
status = db->Get(
|
|
|
|
kEvents, record_key + "." + list_key + "." + list_id, record_value);
|
2014-09-19 08:54:33 +00:00
|
|
|
|
|
|
|
if (record_value.length() == 0) {
|
2014-09-25 17:17:32 +00:00
|
|
|
// This is a new list_id for list_key, append the ID to the indirect
|
|
|
|
// lookup for this list_key.
|
|
|
|
std::string index_value;
|
|
|
|
status = db->Get(kEvents, index_key + "." + list_key, index_value);
|
|
|
|
if (index_value.length() == 0) {
|
|
|
|
// A new index.
|
|
|
|
index_value = list_id;
|
|
|
|
} else {
|
|
|
|
index_value += "," + list_id;
|
|
|
|
}
|
|
|
|
status = db->Put(kEvents, index_key + "." + list_key, index_value);
|
2014-09-19 08:54:33 +00:00
|
|
|
record_value = eid + ":" + time_value;
|
|
|
|
} else {
|
|
|
|
// Tokenize a record using ',' and the EID/time using ':'.
|
|
|
|
record_value += "," + eid + ":" + time_value;
|
|
|
|
}
|
2014-09-25 17:17:32 +00:00
|
|
|
status = db->Put(
|
|
|
|
kEvents, record_key + "." + list_key + "." + list_id, record_value);
|
2014-09-19 08:54:33 +00:00
|
|
|
if (!status.ok()) {
|
2014-09-25 17:17:32 +00:00
|
|
|
LOG(ERROR) << "Could not put Event Record key: " << record_key << "."
|
|
|
|
<< list_key << "." << list_id;
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
|
2014-12-15 00:05:07 +00:00
|
|
|
EventID EventSubscriberCore::getEventID() {
|
2014-09-19 08:54:33 +00:00
|
|
|
Status status;
|
|
|
|
auto db = DBHandle::getInstance();
|
|
|
|
// First get an event ID from the meta key.
|
2014-09-25 17:17:32 +00:00
|
|
|
std::string eid_key = "eid." + dbNamespace();
|
2014-09-19 08:54:33 +00:00
|
|
|
std::string last_eid_value;
|
|
|
|
std::string eid_value;
|
|
|
|
|
|
|
|
{
|
|
|
|
boost::lock_guard<boost::mutex> lock(event_id_lock_);
|
|
|
|
status = db->Get(kEvents, eid_key, last_eid_value);
|
|
|
|
if (!status.ok()) {
|
|
|
|
last_eid_value = "0";
|
|
|
|
}
|
|
|
|
|
|
|
|
size_t eid = boost::lexical_cast<size_t>(last_eid_value) + 1;
|
|
|
|
eid_value = boost::lexical_cast<std::string>(eid);
|
|
|
|
status = db->Put(kEvents, eid_key, eid_value);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!status.ok()) {
|
|
|
|
return "0";
|
|
|
|
}
|
|
|
|
|
|
|
|
return eid_value;
|
|
|
|
}
|
|
|
|
|
2014-12-15 00:05:07 +00:00
|
|
|
QueryData EventSubscriberCore::get(EventTime start, EventTime stop) {
|
2014-09-25 17:17:32 +00:00
|
|
|
QueryData results;
|
|
|
|
Status status;
|
|
|
|
auto db = DBHandle::getInstance();
|
|
|
|
|
|
|
|
// Get the records for this time range.
|
2014-12-06 09:18:29 +00:00
|
|
|
auto indexes = getIndexes(start, stop);
|
|
|
|
auto records = getRecords(indexes);
|
|
|
|
|
|
|
|
std::vector<EventRecord> mapped_records;
|
|
|
|
for (const auto& record : records) {
|
|
|
|
if (record.second >= start && (record.second <= stop || stop == 0)) {
|
|
|
|
mapped_records.push_back(record);
|
|
|
|
}
|
|
|
|
}
|
2014-09-25 17:17:32 +00:00
|
|
|
|
|
|
|
std::string events_key = "data." + dbNamespace();
|
|
|
|
|
2014-12-06 09:18:29 +00:00
|
|
|
// Select mapped_records using event_ids as keys.
|
2014-09-25 17:17:32 +00:00
|
|
|
std::string data_value;
|
2014-12-06 09:18:29 +00:00
|
|
|
for (const auto& record : mapped_records) {
|
2014-09-25 17:17:32 +00:00
|
|
|
Row r;
|
|
|
|
status = db->Get(kEvents, events_key + "." + record.first, data_value);
|
|
|
|
if (data_value.length() == 0) {
|
|
|
|
// THere is no record here, interesting error case.
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
status = deserializeRowJSON(data_value, r);
|
|
|
|
if (status.ok()) {
|
|
|
|
results.push_back(r);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return results;
|
|
|
|
}
|
|
|
|
|
2014-12-15 00:05:07 +00:00
|
|
|
Status EventSubscriberCore::add(const Row& r, EventTime time) {
|
2014-09-19 08:54:33 +00:00
|
|
|
Status status;
|
|
|
|
auto db = DBHandle::getInstance();
|
|
|
|
|
|
|
|
// Get and increment the EID for this module.
|
|
|
|
EventID eid = getEventID();
|
|
|
|
|
2014-09-25 17:17:32 +00:00
|
|
|
std::string event_key = "data." + dbNamespace() + "." + eid;
|
2014-09-19 08:54:33 +00:00
|
|
|
std::string data;
|
|
|
|
|
2014-09-24 18:25:05 +00:00
|
|
|
status = serializeRowJSON(r, data);
|
2014-09-19 08:54:33 +00:00
|
|
|
if (!status.ok()) {
|
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Store the event data.
|
|
|
|
status = db->Put(kEvents, event_key, data);
|
|
|
|
// Record the event in the indexing bins.
|
2014-09-25 17:17:32 +00:00
|
|
|
recordEvent(eid, time);
|
2014-09-19 08:54:33 +00:00
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
2014-09-23 01:35:12 +00:00
|
|
|
void EventFactory::delay() {
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
2014-10-03 15:14:36 +00:00
|
|
|
for (const auto& eventtype : EventFactory::getInstance().event_pubs_) {
|
2014-09-24 17:20:58 +00:00
|
|
|
auto thread_ = std::make_shared<boost::thread>(
|
|
|
|
boost::bind(&EventFactory::run, eventtype.first));
|
2014-09-30 02:06:33 +00:00
|
|
|
ef.threads_.push_back(thread_);
|
2014-09-23 01:35:12 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventFactory::run(EventPublisherID& type_id) {
|
2014-09-19 08:54:33 +00:00
|
|
|
// An interesting take on an event dispatched entrypoint.
|
2014-09-22 21:35:07 +00:00
|
|
|
// There is little introspection into the event type.
|
2014-09-19 08:54:33 +00:00
|
|
|
// Assume it can either make use of an entrypoint poller/selector or
|
|
|
|
// take care of async callback registrations in setUp/configure/run
|
|
|
|
// only once and handle event queueing/firing in callbacks.
|
2014-10-03 15:14:36 +00:00
|
|
|
auto event_pub = EventFactory::getInstance().getEventPublisher(type_id);
|
|
|
|
if (event_pub == nullptr) {
|
2014-09-19 08:54:33 +00:00
|
|
|
return Status(1, "No Event Type");
|
|
|
|
}
|
|
|
|
|
2014-12-08 10:22:59 +00:00
|
|
|
auto status = Status(0, "OK");
|
2014-09-30 02:06:33 +00:00
|
|
|
while (!EventFactory::getInstance().ending_ && status.ok()) {
|
2014-09-23 01:35:12 +00:00
|
|
|
// Can optionally implement a global cooloff latency here.
|
2014-10-03 15:14:36 +00:00
|
|
|
status = event_pub->run();
|
2014-12-08 10:22:59 +00:00
|
|
|
::usleep(20);
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// The runloop status is not reflective of the event type's.
|
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
|
2014-09-23 03:33:58 +00:00
|
|
|
void EventFactory::end(bool should_end) {
|
2014-09-30 02:06:33 +00:00
|
|
|
EventFactory::getInstance().ending_ = should_end;
|
2014-09-23 01:35:12 +00:00
|
|
|
// Join on the thread group.
|
2014-09-25 17:17:32 +00:00
|
|
|
::usleep(400);
|
2014-09-23 01:35:12 +00:00
|
|
|
}
|
|
|
|
|
2014-09-19 08:54:33 +00:00
|
|
|
// There's no reason for the event factory to keep multiple instances.
|
2014-09-30 02:06:33 +00:00
|
|
|
EventFactory& EventFactory::getInstance() {
|
|
|
|
static EventFactory ef;
|
|
|
|
return ef;
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventFactory::registerEventPublisher(const EventPublisherRef& pub) {
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
2014-12-14 11:43:31 +00:00
|
|
|
auto type_id = pub->type();
|
2014-09-19 08:54:33 +00:00
|
|
|
|
2014-10-03 15:14:36 +00:00
|
|
|
if (ef.getEventPublisher(type_id) != nullptr) {
|
2014-09-19 08:54:33 +00:00
|
|
|
// This is a duplicate type id?
|
|
|
|
return Status(1, "Duplicate Event Type");
|
|
|
|
}
|
|
|
|
|
2014-12-14 11:43:31 +00:00
|
|
|
if (!pub->setUp().ok()) {
|
2014-12-08 10:22:59 +00:00
|
|
|
// Only add the publisher if setUp was successful.
|
|
|
|
return Status(1, "SetUp failed.");
|
|
|
|
}
|
|
|
|
|
2014-12-14 11:43:31 +00:00
|
|
|
ef.event_pubs_[type_id] = pub;
|
2014-09-19 08:54:33 +00:00
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
|
2014-10-04 00:50:25 +00:00
|
|
|
Status EventFactory::registerEventSubscriber(
|
2014-12-15 18:17:56 +00:00
|
|
|
const EventSubscriberRef& event_module) {
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
2014-10-03 15:26:41 +00:00
|
|
|
// Let the module initialize any Subscriptions.
|
2014-09-24 15:03:16 +00:00
|
|
|
event_module->init();
|
2014-12-15 08:25:28 +00:00
|
|
|
ef.event_subs_[event_module->name()] = event_module;
|
2014-09-24 15:03:16 +00:00
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventFactory::addSubscription(EventPublisherID& type_id,
|
|
|
|
const SubscriptionContextRef& mc,
|
2014-12-15 05:20:20 +00:00
|
|
|
EventCallback cb) {
|
|
|
|
auto subscription = Subscription::create(mc, cb);
|
|
|
|
return EventFactory::addSubscription(type_id, subscription);
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventFactory::addSubscription(EventPublisherID& type_id,
|
|
|
|
const SubscriptionRef& subscription) {
|
2014-10-03 15:14:36 +00:00
|
|
|
auto event_pub = EventFactory::getInstance().getEventPublisher(type_id);
|
|
|
|
if (event_pub == nullptr) {
|
2014-10-03 15:26:41 +00:00
|
|
|
// Cannot create a Subscription for a missing type_id.
|
2014-09-19 08:54:33 +00:00
|
|
|
return Status(1, "No Event Type");
|
|
|
|
}
|
|
|
|
|
|
|
|
// The event factory is responsible for configuring the event types.
|
2014-10-03 15:26:41 +00:00
|
|
|
auto status = event_pub->addSubscription(subscription);
|
2014-10-03 15:14:36 +00:00
|
|
|
event_pub->configure();
|
2014-09-19 08:54:33 +00:00
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
size_t EventFactory::numSubscriptions(EventPublisherID& type_id) {
|
2014-10-04 00:50:25 +00:00
|
|
|
const auto& event_pub =
|
|
|
|
EventFactory::getInstance().getEventPublisher(type_id);
|
2014-10-03 15:14:36 +00:00
|
|
|
if (event_pub != nullptr) {
|
2014-10-03 15:26:41 +00:00
|
|
|
return event_pub->numSubscriptions();
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
EventPublisherRef EventFactory::getEventPublisher(EventPublisherID& type_id) {
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
2014-10-03 15:14:36 +00:00
|
|
|
const auto& it = ef.event_pubs_.find(type_id);
|
|
|
|
if (it != ef.event_pubs_.end()) {
|
|
|
|
return ef.event_pubs_[type_id];
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
EventSubscriberRef EventFactory::getEventSubscriber(
|
|
|
|
EventSubscriberID& name_id) {
|
2014-12-15 08:25:28 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
|
|
|
const auto& it = ef.event_subs_.find(name_id);
|
|
|
|
if (it != ef.event_subs_.end()) {
|
|
|
|
return ef.event_subs_[name_id];
|
|
|
|
}
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventFactory::deregisterEventPublisher(const EventPublisherRef& pub) {
|
|
|
|
return EventFactory::deregisterEventPublisher(pub->type());
|
2014-09-19 08:54:33 +00:00
|
|
|
}
|
|
|
|
|
2014-12-15 18:17:56 +00:00
|
|
|
Status EventFactory::deregisterEventPublisher(EventPublisherID& type_id) {
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
2014-10-03 15:14:36 +00:00
|
|
|
const auto& it = ef.event_pubs_.find(type_id);
|
|
|
|
if (it == ef.event_pubs_.end()) {
|
2014-09-19 08:54:33 +00:00
|
|
|
return Status(1, "No Event Type registered");
|
|
|
|
}
|
|
|
|
|
2014-10-03 15:14:36 +00:00
|
|
|
ef.event_pubs_[type_id]->tearDown();
|
|
|
|
ef.event_pubs_.erase(it);
|
2014-09-19 08:54:33 +00:00
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
|
2014-10-03 15:14:36 +00:00
|
|
|
Status EventFactory::deregisterEventPublishers() {
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = EventFactory::getInstance();
|
2014-10-03 15:14:36 +00:00
|
|
|
auto it = ef.event_pubs_.begin();
|
|
|
|
for (; it != ef.event_pubs_.end(); it++) {
|
2014-09-19 08:54:33 +00:00
|
|
|
it->second->tearDown();
|
|
|
|
}
|
|
|
|
|
2014-10-03 15:14:36 +00:00
|
|
|
ef.event_pubs_.erase(ef.event_pubs_.begin(), ef.event_pubs_.end());
|
2014-09-19 08:54:33 +00:00
|
|
|
return Status(0, "OK");
|
|
|
|
}
|
|
|
|
}
|
2014-09-24 18:25:05 +00:00
|
|
|
|
|
|
|
namespace osquery {
|
|
|
|
namespace registries {
|
2014-10-03 15:14:36 +00:00
|
|
|
void faucet(EventPublishers ets, EventSubscribers ems) {
|
2014-11-09 21:31:56 +00:00
|
|
|
if (!FLAGS_event_pubsub) {
|
|
|
|
// Invocation disabled eventing.
|
|
|
|
return;
|
|
|
|
}
|
2014-09-30 02:06:33 +00:00
|
|
|
auto& ef = osquery::EventFactory::getInstance();
|
2014-10-03 15:14:36 +00:00
|
|
|
for (const auto& event_pub : ets) {
|
|
|
|
ef.registerEventPublisher(event_pub.second);
|
2014-09-24 18:25:05 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for (const auto& event_module : ems) {
|
2014-10-03 15:08:06 +00:00
|
|
|
ef.registerEventSubscriber(event_module.second);
|
2014-09-24 18:25:05 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|