Fix typo in passwd subscriber, merge vtable tests

include/osquery/tables.h

@@ -266,6 +266,7 @@ class TablePlugin : public Plugin {
  protected:
   /// Helper method to generate the virtual table CREATE statement.
   virtual std::string statement();
+  virtual std::string columnDefinition();
   virtual TableColumns columns() {
     TableColumns columns;
     return columns;
@@ -288,6 +289,10 @@ class TablePlugin : public Plugin {
                                        PluginResponse& response);
   static void setContextFromRequest(const PluginRequest& request,
                                     QueryContext& context);
+
+ private:
+  FRIEND_TEST(VirtualTableTests, test_tableplugin_columndefinition);
+  FRIEND_TEST(VirtualTableTests, test_tableplugin_statement);
 };
 }
 

osquery/core/flags.cpp

@@ -8,6 +8,8 @@
  *
  */
 
+#include <tuple>
+
 #include <osquery/flags.h>
 
 namespace osquery {

osquery/core/tables.cpp

@@ -174,6 +174,8 @@ Status TablePlugin::call(const PluginRequest& request,
     for (const auto& column : column_list) {
       response.push_back({{"name", column.first}, {"type", column.second}});
     }
+  } else if (request.at("action") == "columns_definition") {
+    response.push_back({{"definition", columnDefinition()}});
   } else {
     return Status(1, "Unknown table plugin action: " + request.at("action"));
   }
@@ -181,11 +183,11 @@ Status TablePlugin::call(const PluginRequest& request,
   return Status(0, "OK");
 }
 
-std::string TablePlugin::statement() {
-  auto column_list = columns();
-  std::string statement = "CREATE TABLE " + name_ + "(";
+std::string TablePlugin::columnDefinition() {
+  const auto& column_list = columns();
+  std::string statement = "(";
   for (size_t i = 0; i < column_list.size(); ++i) {
-    statement += column_list[i].first + " " + column_list[i].second;
+    statement += column_list[i].first + " " + column_list.at(i).second;
     if (i < column_list.size() - 1) {
       statement += ", ";
     }
@@ -193,5 +195,9 @@ std::string TablePlugin::statement() {
   statement += ")";
   return statement;
 }
+
+std::string TablePlugin::statement() {
+  return "CREATE TABLE " + name_ + columnDefinition();
+}
 }
 }

osquery/core/virtual_table.cpp

@@ -79,16 +79,24 @@ int xCreate(sqlite3 *db,
 
   PluginResponse response;
   pVtab->content->name = std::string(argv[0]);
-  NewRegistry::call(
+  auto status = NewRegistry::call(
       "table", pVtab->content->name, {{"action", "statement"}}, response);
+  if (!status.ok() || response.size() == 0) {
+    return SQLITE_ERROR;
+  }
+
   int rc = sqlite3_declare_vtab(db, response[0].at("statement").c_str());
   if (rc != SQLITE_OK) {
     return rc;
   }
 
   // Also set the table column information.
-  NewRegistry::call(
+  status = NewRegistry::call(
       "table", pVtab->content->name, {{"action", "columns"}}, response);
+  if (!status.ok() || response.size() == 0) {
+    return SQLITE_ERROR;
+  }
+
   for (const auto &column : response) {
     pVtab->content->columns.push_back(
         std::make_pair(column.at("name"), column.at("type")));
@@ -235,18 +243,23 @@ int attachTable(sqlite3 *db, const std::string &name) {
       0,
   };
 
+  // Column information is nice for virtual table create call.
+  PluginResponse response;
+  auto status = NewRegistry::call(
+      "table", name, {{"action", "columns_definition"}}, response);
+  if (!status.ok() || response.size() == 0) {
+    return SQLITE_ERROR;
+  }
+
   rc = sqlite3_create_module(db, name.c_str(), &module, 0);
   if (rc == SQLITE_OK) {
-    auto format = "CREATE VIRTUAL TABLE temp." + name + " USING " + name;
+    auto format = "CREATE VIRTUAL TABLE temp." + name + " USING " + name +
+                  response[0].at("definition");
     rc = sqlite3_exec(db, format.c_str(), 0, 0, 0);
   }
   return rc;
 }
 
-std::string TablePlugin::statement(TableName name, TableColumns columns) {
-  return "CREATE TABLE " + name + columnDefinition(columns);
-}
-
 void attachVirtualTables(sqlite3 *db) {
   for (const auto &name : NewRegistry::names("table")) {
     int status = attachTable(db, name);

osquery/core/virtual_table.h

@@ -48,6 +48,7 @@ struct VirtualTable {
   VirtualTableContent *content;
 };
 
+int attachTable(sqlite3 *db, const std::string &name);
 void attachVirtualTables(sqlite3 *db);
 }
 }

osquery/core/virtual_table_tests.cpp

@@ -11,6 +11,8 @@
 #include <gtest/gtest.h>
 
 #include <osquery/core.h>
+#include <osquery/registry.h>
+
 #include "osquery/core/virtual_table.h"
 
 namespace osquery {
@@ -20,42 +22,40 @@ class VirtualTableTests : public testing::Test {};
 
 // sample plugin used on tests
 class sampleTablePlugin : public TablePlugin {
- public:
-  TableName name = "sample";
-  TableColumns columns = {std::make_pair("foo", "INTEGER"),
-                          std::make_pair("bar", "TEXT")};
-
-  QueryData generate(QueryContext& request) {
-    // do nothing (not used), just to fullfil interface
-    QueryData results;
-    return results;
+ private:
+  TableColumns columns() {
+    return {
+        {"foo", "INTEGER"}, {"bar", "TEXT"},
+    };
   }
-
- public:
-  sampleTablePlugin() {}
-  int attachVtable(sqlite3* db) {
-    return sqlite3_attach_vtable<sampleTablePlugin>(db, name, columns);
-  }
-  virtual ~sampleTablePlugin() {}
 };
 
 TEST_F(VirtualTableTests, test_tableplugin_columndefinition) {
   auto table = sampleTablePlugin();
-  EXPECT_EQ("(foo INTEGER, bar TEXT)",
-            TablePlugin::columnDefinition(table.columns));
+  EXPECT_EQ("(foo INTEGER, bar TEXT)", table.columnDefinition());
 }
 
 TEST_F(VirtualTableTests, test_tableplugin_statement) {
   auto table = sampleTablePlugin();
-  EXPECT_EQ("CREATE TABLE sample(foo INTEGER, bar TEXT)",
-            table.statement(table.name, table.columns));
+  table.setName("sample");
+  EXPECT_EQ("CREATE TABLE sample(foo INTEGER, bar TEXT)", table.statement());
 }
 
 TEST_F(VirtualTableTests, test_sqlite3_attach_vtable) {
   auto table = sampleTablePlugin();
+  table.setName("sample");
   sqlite3* db = nullptr;
   sqlite3_open(":memory:", &db);
-  table.attachVtable(db);
+
+  // Virtual tables require the registry/plugin API to query tables.
+  int rc = osquery::tables::attachTable(db, "failed_sample");
+  EXPECT_EQ(rc, SQLITE_ERROR);
+
+  // The table attach will complete only when the table name is registered.
+  NewRegistry::add<sampleTablePlugin>("table", "sample");
+  rc = osquery::tables::attachTable(db, "sample");
+  EXPECT_EQ(rc, SQLITE_OK);
+
   std::string q = "SELECT sql FROM sqlite_temp_master WHERE tbl_name='sample';";
   int error_return;
   QueryData results = query(q, error_return, db);

osquery/filesystem/filesystem_tests.cpp

@@ -65,6 +65,7 @@ TEST_F(FilesystemTests, test_list_files_in_directory_not_found) {
   EXPECT_FALSE(not_found.ok());
   EXPECT_EQ(not_found.toString(), "Directory not found: /foo/bar");
 }
+
 // Recursive Tests
 TEST_F(FilesystemTests, test_wildcard_single_folder_list) {
   std::vector<std::string> files;

osquery/tables/events/linux/passwd_changes.cpp

@@ -51,8 +51,8 @@ class PasswdChangesEventSubscriber
  * pseudo-plugin registry.
  */
 auto PasswdChangesEventSubscriberRegistryItem =
-    NewRegistry::add<PasswdChangesEventSubscriberSubscriber>("event_subscriber",
-                                                             "passwd_changes");
+    NewRegistry::add<PasswdChangesEventSubscriber>("event_subscriber",
+                                                   "passwd_changes");
 
 void PasswdChangesEventSubscriber::init() {
   auto mc = createSubscriptionContext();