Commit Graph

80 Commits

Author SHA1 Message Date
Mike Myers
b803743bf7
Fix typos across source code (#6901) 2021-01-14 23:49:06 -08:00
Teddy Reed
5b8f20bfce
refactor: Move ephemeral database plugin into core and simplify tests (#6648) 2020-09-21 18:25:08 -04:00
Teddy Reed
b36678d707
refactor: Rename database APIs to not use DatabasePlugin class (#6620) 2020-08-31 22:45:43 -04:00
Teddy Reed
160ac6c906
refactor: Change the include path for osquery/core/plugins (#6619) 2020-08-29 20:24:39 -04:00
seph
29f4694df2
Update copyright notices (#6589)
Bulk update copyright notices from Facebook to "The osquery authors"
2020-08-11 16:46:54 -04:00
Teddy Reed
8ee7e3a3b0
refactor: Move osquery/include files to appropriate places (#6557) 2020-08-11 11:54:54 -04:00
Ted Reed
5cd2d6cbd3 detangle: Move platform setup and teardown out of Initializer 2020-07-09 10:38:53 -04:00
Chris Broome
26d94ce037
Add messages to distributed query results (#6352) 2020-05-03 21:51:59 -04:00
Stefano Bonicatti
52f310a5a8
First steps to remove the Buck build system (#6361)
* First steps to remove the Buck build system

* Azure Pipelines: Rename jobs for consistency
2020-04-09 01:56:21 +02:00
Stefano Bonicatti
d0b42a98e2
Fix all TLS tests and framework (#6170) 2020-02-03 07:50:25 -08:00
Stefano Bonicatti
515704954c Move the test config files in their own directory
This is to have better separation between them and the python tests.
BUCK files have been updated accordingly.

Changes to the internal generateCopyFileTarget function were needed.
The function now supports a base folder to be set so that the regex or file path
is appended to that base path, without having it included in the destination.
It will also not use a library target anymore, but a custom one so
that's possible to set properties with custom names.

Use only one copy target to copy test config files instead of having
multiple that overlaps.
It may give issues when copying and tests in the end will need all of
them.
2019-12-07 20:51:09 -05:00
Alessandro Gario
6481b34e23
Refactor third-party libraries to build from source on Linux (#5706)
Add a way to compile third-party libraries from source instead of downloading prebuilt ones.
Each library source code is downloaded with git into a submodule at configure time,
in response to the find_package(library_name) CMake call,
except for OpenSSL where the official source archive is used.
Each submodule is attached to a release tag on its own upstream repository.
All the libraries are built using CMake directly, except for OpenSSL which uses a formula system,
which permits to build libraries with a separate build system
when there's no easy way to integrate it directly with CMake.

This new dependency system determines which library is fetched from where using the concept of "layers".
Currently we have three of them: source, formula, facebook,
where the last layer represents the pre-built libraries.
The provided order will be used when looking for libraries.

A system to patch submodule source code has been added and it's currently used with googletest, libudev and util-linux.
Patches should be put under libraries/cmake/source/<library name>/patches/<submodule>,
where <submodule> is often one and is "src", but in other cases, like AWS,
there are multiple with a more specific name.
If for whatever reason the submodule cloning or the patching fails,
the submodule has to be unregistered and its folder should be cleared.
This should be achievable with "git submodule deinit -f <submodule path>"

Following some other changes on existing functionality:

- Changed the CMake variable BUILD_TESTING to OSQUERY_BUILD_TESTS
  to avoid enabling tests on third party libraries.
  Due to an issue with glog the BUILD_TESTING variable
  will be always forced to OFF.
- Moved compiler and linker flags to their own file cmake/flags.cmake
- Moved all the third-party CMakeLists.txt used for pre-built libraries under libraries/cmake/facebook
- Added the --exclude-folders option to tools/format-check.py and tools/git-clang-format.py,
  so that it's possible to ignore any third party library source code.
- The format and format_check target use the new --exclude-folders option
  to exclude libraries/cmake/source from formatting.
- The test and osquery binaries are properly compiled with PIE (osquery/osquery#5611)

Co-authored-by: Stefano Bonicatti <stefano.bonicatti@gmail.com>
Co-authored-by: Teddy Reed <teddy@casualhacking.io>
2019-08-30 16:25:19 +02:00
Stefano Bonicatti
942878854b Add CMake support
Taken from osql-experimental.

- Change CMake code license to the one present in osquery right now

- Package metadata doesn't mention Trail of Bits or osql anymore

- Set specific ACLs for the osqueryd on Windows when packaging

- Remove LLVM_INSTALL_PATH support on macOS, since we are using AppleClang

- Remove OSQUERY_SOURCE_DIR variable need and source in a submodule support

- Add targets format_check and format to check code formatting and
  format it with clang-format

- Do not warn about not using Clang on macOS when using AppleClang
2019-06-26 21:49:06 -04:00
Alessandro Gario
33fbbecb5f Initial commit
Taken from osql-experimental.

Initial support for Linux and macOS.
2019-06-26 21:49:06 -04:00
Jesse Kornblum
9f58f0cc0a Use Status::success throughout osquery (#5542)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5542

We replace deprecated calls to the Status class with newer ones. This will stop Lint from nagging me every time I open these files. There should be no change to functionality.

Specifically, we use a codemod on `.cpp` files to replace any instance of `return Status();` with `return Status::success();`.

Reviewed By: guliashvili

Differential Revision: D14652922

fbshipit-source-id: 243576195ed201d6b82fc942a785742c6b01cf83
2019-03-29 04:28:39 -07:00
Filipe Manco
d14fd5d538 Move plugins to a separate directory [5/?] (#5483)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5483

Initial steps to separate plugins from the rest of osquery. On the long run separating plugins will provide more build flexibility such that we can have configurable builds that include only the bits and pieces we actually need per deployment. Reducing the attack surface, possibility of supply chain attacks, binary size, etc.

Move killswitch

Reviewed By: guliashvili

Differential Revision: D14259760

fbshipit-source-id: deaaa148fac25b3f534a8881a1ea9eda0ec6bdc9
2019-03-02 04:23:06 -08:00
Jesse Kornblum
ecbc65cf39 Replace Status(0) calls with Status::success() to appease Lint (#5487)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5487

I got tired of Lint telling me to update the calls to the Status class, so I wrote some codemods to update the vast majority of them:

  $ cd ~/fbsource
  $ codemod -d xplat/osquery/oss/osquery --extensions cpp,h "return Status\(0\, \".*\"\);" "return Status::success();"

**Blindly accepted all changes**.

FWIW, I tried to do something similar with the failure return values, but the unit tests were failing afterward.

Reviewed By: guliashvili

Differential Revision: D14278739

fbshipit-source-id: b023f6e969be697eeb67d66ea3ad10d16c69ff0c
2019-03-01 04:29:33 -08:00
Alexander Kindyakov
b7d635ec2b remove thrift_impl from osquery plugin_sdk
Summary: To be able to build with different `thrift_impl` modules in extensions (like facebook does with fbthrift) I removed implementation from `extensions` lib and explicitly used for `osqueryd` and for all tests. This allows us to remove `thrift_impl` from sdk dependencies list. If you need it - please use explicitly as I did for `osqueryd`. If you want to use your own implementation of `thrift_impl` - build it and link against it and sdk simultaneously.

Reviewed By: marekcirkos

Differential Revision: D14224206

fbshipit-source-id: 218dc05d87e1ffaca37783185fc672a20684d757
2019-02-26 11:20:08 -08:00
Jesse Kornblum
c7355b19aa Update osquery licensing wording (#5452)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5452

As suggested in another diff, this diff updates the language we use to describe the osquery licensing terms. We are changing all instances of

//This source code is licensed as defined on the LICENSE file found in the root directory of this source tree.//

to

//This source code is licensed in accordance with the terms specified in the LICENSE file found in the root directory of this source tree.//

We accomplish this with a codemod:

  $ codemod -md xplat/osquery/oss --extensions cpp,h,in,py,sh,mm,ps1 "(.\s+)This source code is licensed as defined on the LICENSE file found in the(.*)root directory of this source tree\." "\1This source code is licensed in accordance with the terms specified in\2the LICENSE file found in the root directory of this source tree."

Reviewed By: fmanco

Differential Revision: D14131290

fbshipit-source-id: 52c90da342263e2a80f5a678ecd760c19cf7513e
2019-02-19 10:59:48 -08:00
Filipe Manco
2d5572d51e Move plugins to a separate directory [2/?]
Summary:
Initial steps to separate plugins from the rest of osquery. On the long run separating plugins will provide more build flexibility such that we can have configurable builds that include only the bits and pieces we actually need per deployment. Reducing the attack surface, possibility of supply chain attacks, binary size, etc.

Move distributed

Reviewed By: marekcirkos

Differential Revision: D14121619

fbshipit-source-id: 9ad8a837450874e79a819ab4f11258ae24ec8014
2019-02-19 00:55:27 -08:00
Filipe Manco
be07c2938a Move plugins to a separate directory [1/?]
Summary:
Initial steps to separate plugins from the rest of osquery. On the long run separating plugins will provide more build flexibility such that we can have configurable builds that include only the bits and pieces we actually need per deployment. Reducing the attack surface, possibility of supply chain attacks, binary size, etc.

Move config and config_parser plugins

Reviewed By: marekcirkos

Differential Revision: D14119102

fbshipit-source-id: 0bc956398b3829c6f1013b38ebba2f0fc1071a93
2019-02-19 00:55:27 -08:00
Filipe Manco
a67525fae1 Fix LICENSE information on file headers (#5375)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5375

LICENSE is now defined in a single file on the root of the project, update the
header to contain that information.

**Project LICENSE did not change.**

Reviewed By: akindyakov

Differential Revision: D13750575

fbshipit-source-id: 1e608a81b260b8395f9d008fc67f463160c1fc2b
2019-01-21 11:51:54 -08:00
George Guliashvili
d498bcbd65 unique target names for xcode (#5328)
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5328

xcode needs unique target names to properly parse buck generated project

Reviewed By: marekcirkos

Differential Revision: D13487400

fbshipit-source-id: cf0c76145344d0873a0973e226d007597a06d17d
2019-01-16 12:28:04 -08:00
Max Kareta
8c0c403796 fixed headers_namespace to match file path
Summary: Some tools does not support virtual headers namespaces and expect header path to match actual file path from project root. This diff will fix few namespaces in utils library

Reviewed By: guliashvili

Differential Revision: D13552878

fbshipit-source-id: 2a06f73550c69777bf73be73abdde297fe580583
2019-01-14 03:33:32 -08:00
George Guliashvili
971bee4441 Move build system to BUCK
fbshipit-source-id: 8ffef5e6a393ac67ce56dcb74845402e43d964a0
2018-12-07 16:12:35 +00:00
Giorgi Guliashvili
94397d3c04
get rid of unnecessary ptree includes (#4727) 2018-07-19 10:45:40 +01:00
Max Kareta
6ab2a83a61
Refactor/cmake 5 (#4642) 2018-06-26 16:54:08 +01:00
Max Kareta
2084c74238
updated another set of cmake files (#4622) 2018-06-21 18:43:22 +01:00
Max Kareta
5aca61375f
reorganized includes to improve compile time (#4445) 2018-05-30 00:17:40 +01:00
Mitchell Grenier
21cae039eb bug: Fix acceleration code to use RapidJSON properly (#4236) 2018-04-02 10:21:22 -07:00
Mitchell Grenier
873fc4124c
Add status back instead of query data again (#4182) 2018-03-09 12:02:53 -08:00
Filipe Manco
1bbdff8c7a
Replace ptree with JSON on serialization code (#4128) 2018-03-01 00:36:24 +00:00
Teddy Reed
90a737ead7
Replace most of boost::property_tree with rapidjson (#3910) 2018-01-20 20:58:01 -05:00
Teddy Reed
f6d077cbf7
license: Change license to Apache 2.0 and GPLv2 (#4007) 2017-12-18 16:04:06 -08:00
Teddy Reed
f29de27649 Combine osqueryi and osqueryd into single binary (#2742) 2017-08-27 11:09:25 -07:00
Teddy Reed
cf170c4278 cleanup: Move query out of database header (#3576) 2017-08-20 02:44:38 -07:00
Mitchell Grenier
8a963e8d40 [Distributed] Moving to RapidJSON (#3265) 2017-08-07 16:34:44 -07:00
Teddy Reed
fb287745c6 linux: Use lld and ThinLTO on Linux (#3284) 2017-05-14 14:23:50 -07:00
Nick Anderson
8fdb0a6945 Adding distributed workid to carver (#3252) 2017-05-05 15:14:21 -07:00
Mitchell Grenier
9715fdbd84 Adding discovery query support to distributed queries (#3049) 2017-03-17 22:00:45 -07:00
lambda-conjecture
721dd1ed62 Fix column order and repeated columns in distributed query (#2926) 2017-01-20 22:52:47 -08:00
Teddy Reed
0e9733f94c Simplify Registry and plugin concepts (#2887) 2017-01-07 12:21:35 -08:00
Teddy Reed
530f2933e3 [Fix #2704] Various distributed code cleanups (#2719) 2016-11-03 23:54:55 -07:00
Teddy Reed
a3acf2a3e5 Fix Config TLS plugin default verb (#2708) 2016-11-02 17:08:44 -07:00
Teddy Reed
b00118a293 Fix regression in Requests/TLS APIs related to verb detection (#2660) 2016-10-21 12:58:40 -07:00
Zachary Wasserman
42fb80f40b Fix TLS logger plugin handling of re-enrollment scenarios (#2627) 2016-10-14 16:31:51 -07:00
yying
a7af70d021 Adding remote config/logging capabilities to Windows build (#2469) 2016-09-20 14:18:58 -07:00
Mitchell Grenier
072a93ccac Accelerated checkins (#2454) 2016-09-12 16:53:42 -07:00
yying
a27d6567e4 Core and Additional Tests (#2441) 2016-09-12 09:46:52 -07:00
Mitchell Grenier
61c9da1c42 Buffer the distributed queries to RocksDB for greater reliability (#2452) 2016-09-08 15:40:14 -07:00