Commit Graph

406 Commits

Author SHA1 Message Date
Mike Arpaia
2b9bbb6bd4 Merge pull request #1223 from marpaia/yara-3.4.0
updating yara to 3.4.0
2015-06-22 09:33:25 -07:00
Teddy Reed
37188f788b Fixups in tables, add DOUBLE, shell extensions 2015-06-22 04:17:23 -04:00
Mike Arpaia
6f85f2f617 updating yara to 3.4.0 2015-06-21 11:40:51 -04:00
Teddy Reed
46ceb7aa6d Merge pull request #1213 from theopolis/certs2
Update testing x509 certs
2015-06-13 02:24:29 -07:00
Teddy Reed
2fb774218a Update testing x509 certs 2015-06-13 02:13:31 -07:00
Teddy Reed
e7ab2fc47b Limit scope of git/tag version defines.
Harden plist parsing against internal fuzzing tests.
Improve file/stream read speeds.
2015-06-12 10:10:20 -07:00
Teddy Reed
727f5b091f Various table perf improvements and TLS docs 2015-06-05 22:03:15 -07:00
Teddy Reed
4e59bcf4c1 Merge pull request #1191 from theopolis/feature-backoffs
[#1190] Schedule queries without logging removed results
2015-06-04 14:58:19 -07:00
Teddy Reed
a678f8f46a Merge pull request #1192 from theopolis/rocksdb-from-homebrew
[Fix #1185, #1183] Use RocksDB from Homebrew on OS X
2015-06-04 14:34:52 -07:00
Teddy Reed
650a43d053 [Fix #1185, #1183] Use RocksDB from Homebrew on OS X 2015-06-04 13:56:58 -07:00
Teddy Reed
e244883ea4 [#1190] Schedule queries without logging removed results 2015-06-04 13:53:55 -07:00
Teddy Reed
a70828c2a4 Merge pull request #1187 from sharvilshah/xattr_update
Extended Attributes: Use LaunchServices API for quarantine data
2015-06-03 22:38:17 -07:00
Sharvil Shah
065fe6412d Use LaunchServices (part of CoreServices) to grab quarantine properties instead of manually parsing the colon separated attribute data.
Fall back to deprecated LaunchService API for OS X 10.9 Mavericks.

Added tests for extended_attributes

Better error handling and cleanup
2015-06-03 22:18:45 -07:00
Teddy Reed
c934ad0df3 Update tooling/profiling paths 2015-06-03 21:22:12 -07:00
Teddy Reed
8aacaca7eb Query pack platform binds should match any/all 2015-06-03 13:56:39 -07:00
Teddy Reed
a105924804 Move specs to a top-level path, add query examples
1. Example queries will run with an (optional) integration test.
2. Fix bad accesses with OS X package BOMs
3. Move spec files from ./osquery/tables/specs to ./specs
4. Remove server parsers (netlib) from client builds.
2015-06-03 10:39:05 -07:00
Teddy Reed
5899bbb8f5 Merge pull request #1182 from theopolis/osx_rocksdb_portable
Build RocksDB from source on Darwin
2015-06-02 15:50:15 -07:00
Teddy Reed
eeab588d8f Build RocksDB from source on Darwin 2015-06-02 15:25:16 -07:00
Teddy Reed
f41fb6b107 Remove package-manager installed autoconf tools for older distros 2015-06-02 03:05:47 -07:00
Teddy Reed
0669d8205e Merge pull request #1174 from theopolis/remote_logger
TLS/HTTPS-based logger plugin
2015-06-02 02:59:34 -07:00
Teddy Reed
33f53809ad Fix DBHandle checking with concurrent processes.
`make tests` fails with another osquery process running.
The backing-store check happens after a config plugin is setUp and
the initial load occures. This may involve calls to cached keys, the
check should occur pre-config initialize.
2015-06-02 02:50:04 -07:00
Teddy Reed
da9bd5801b Migrate HTTP remote logger to TLS logger 2015-06-01 10:12:31 -07:00
Teddy Reed
4064fa6eb5 Pack and testing fixups 2015-05-28 12:17:27 -07:00
Blake Frantz
28d9237b50 Amazon EC2-based vagrant targets for RHEL/Amazon Linux
1. added docs for vagrant-aws support in Vagrantfile
2. removed aws target that have local vagrant support. inline-string'd aws.user_data
3. support building rhel6/7 in aws
4. correct aws-rhel6.6 name. it should be rhel6.5
2015-05-26 21:03:10 -07:00
Teddy Reed
8b3686a58a TLS plugin workflow tests 2015-05-26 19:55:00 -07:00
Teddy Reed
b90b21bc2d [Fix #1154] Clean up CMake messages and check TP 2015-05-23 17:15:28 -07:00
Teddy Reed
5969ae4fbf Clean up TLS-version from OpenSSL detection 2015-05-23 13:04:36 -07:00
Javier Marcos
9a4f611baf Merge pull request #1155 from javuto/osquery_packs_table
Osquery packs table
2015-05-21 20:32:45 -07:00
Javier Marcos
c6855fab43 Table for osquery packs 2015-05-19 18:44:28 -07:00
Teddy Reed
b3338dc5d2 Merge pull request #1146 from theopolis/tls
Towards TLS config/logging
2015-05-19 17:17:04 -07:00
Teddy Reed
2a1f496cc5 Towards TLS config/logging 2015-05-19 17:05:55 -07:00
Javier Marcos
65e6e38e0f Merge pull request #1143 from javuto/pack_config_changes
Support to load query packs as scheduled queries
2015-05-16 15:37:27 -07:00
Javier Marcos
47e680e825 Adding tests and implementing version checker 2015-05-15 22:25:19 -07:00
Teddy Reed
f5945f98b4 Oracle 5.11 2015-05-14 22:44:01 -07:00
Teddy Reed
525c584a0b Merge pull request #1141 from theopolis/static_cryptsetup
Build libcryptsetup statically
2015-05-14 22:33:56 -07:00
Teddy Reed
9ee839b265 Build libcryptsetup statically 2015-05-14 19:36:00 -07:00
Blake Frantz
4262dd502d add install_iptables_dev 2015-05-13 11:52:49 -07:00
Blake Frantz
3a49fc46c8 Merge remote-tracking branch 'upstream/master' 2015-05-13 07:38:41 -07:00
Blake Frantz
410dec3a9c update provision/lib.sh to support amazon linux 2015-05-13 07:37:59 -07:00
Mike Arpaia
fff36af0af Removing trailing whitespace 2015-05-11 23:31:13 -07:00
Blake Frantz
805db480c5 Merge remote-tracking branch 'upstream/master' 2015-05-11 16:08:59 -07:00
Teddy Reed
5b43067c98 Merge pull request #1130 from theopolis/patch-134
[Fix #1125 #1126] Flag padding checks, config_check tests
2015-05-11 13:43:36 -07:00
Teddy Reed
fed0474bce Merge pull request #1129 from brandt/fix-command-not-found
Fix missing command: force_provision
2015-05-11 11:45:38 -07:00
Teddy Reed
7815f49020 Merge pull request #1128 from brandt/fix-dep-libtool-url
Fix URL for libtool
2015-05-11 11:45:29 -07:00
Teddy Reed
88b93b853c Add example newsyslog conf for OS X 2015-05-11 10:42:41 -07:00
Teddy Reed
771ed4da2f [Fix #1125 #1126] Flag padding checks, config_check tests 2015-05-11 10:37:16 -07:00
J. Brandt Buckley
3c6916a01b Fix missing command: force_provision
Prior to this commit, you'd get this error when running `make deps` with a version of autoconf that belongs in a museum (e.g. the one that's in CentOS 6 Base):

```
[+] autoconf is already installed. skipping provision.
/home/brandt/osquery/tools/provision/lib.sh: line 163: force_provision: command not found
make: *** [deps] Error 127
```

I couldn't find a `force_provision` in the codebase. Plain old `provision` should do the job.
2015-05-11 00:50:55 -06:00
J. Brandt Buckley
a0a09eb588 Fix URL for libtool
Looks like a simple typo: `automake` for `libtool`

Before this commit, this is the error you'd get when you ran `make deps`:

```
[+] libtool is not installed/provisioned. installing...
[+] libtool has not been downloaded. downloading...
--2015-05-11 06:01:38--  https://osquery-packages.s3.amazonaws.com/deps/automake-2.4.5.tar.gz
Resolving osquery-packages.s3.amazonaws.com... failed: Temporary failure in name resolution.
wget: unable to resolve host address “osquery-packages.s3.amazonaws.com”
[+] libtool has not been extracted. extracting...
tar (child): libtool-2.4.5.tar.gz: Cannot open: No such file or directory
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
/vagrant/tools/provision/lib.sh: line 196: pushd: libtool-2.4.5: No such file or directory
make: *** [deps] Error 1
```
2015-05-11 00:14:15 -06:00
Blake Frantz
bbc21a545a remove unnecessary conditionals from amazon.sh 2015-05-10 17:33:12 -07:00
Blake Frantz
5c00016e30 base rhel/amazon/centos detection on system-release and ubuntu on lsb-release 2015-05-10 17:10:30 -07:00