Commit Graph

3186 Commits

Author SHA1 Message Date
William Woodruff
e79e76eb8e (Windows) New table: ntfs_journal_events (#5371)
Co-authored-by: Garret Reece <GarretReece@users.noreply.github.com>
Co-authored-by: Alessandro Gario <5714290+alessandrogario@users.noreply.github.com>
2019-12-31 19:22:44 -05:00
mark m
826d1f3b44 core/windows/wmi: Add ability to exec methods on WMI results (#5504) 2019-12-31 19:09:47 -05:00
Rachel Cipkins
b5bddbef87 Add optional_permissions column to chrome_extensions table (#6115) 2019-12-22 22:21:55 -05:00
Teddy Reed
1d58bf8de5
bug: Fix race in Dispatcher adding and stopping (#6145) 2019-12-22 22:21:01 -05:00
Teddy Reed
6944de9529 tables: Fix ntfs_acl_permissions (#6128) 2019-12-15 13:25:53 -08:00
Stefano Bonicatti
532435d15e Restore test_osqueryd.py test (#6116)
Co-Authored-By: SS <sahil.suneja@trailofbits.com>
2019-12-12 21:06:18 -05:00
seph
a73ffad3bf tables: Add constraints and testing (#6105)
Co-Authored-By: Teddy Reed <teddy@casualhacking.io>
2019-12-12 20:45:15 -05:00
Rachel Cipkins
df20cb120a Added Brave/Chromium support for chrome_extensions (#6088) 2019-12-12 20:39:31 -05:00
Alessandro Gario
ec2593e143 rpm_packages: Add the install_time column 2019-12-10 22:41:45 +01:00
Teddy Reed
2933614301
tables: Remove INDEX requirement for ADDITIONAL option (#6104)
We do not need an explicit INDEX column for ADDITIONAL to work.
If the ADDITIONAL option is set the constraint should be passed
into the virtual table context.
2019-12-10 15:43:35 -05:00
Stefano Bonicatti
515704954c Move the test config files in their own directory
This is to have better separation between them and the python tests.
BUCK files have been updated accordingly.

Changes to the internal generateCopyFileTarget function were needed.
The function now supports a base folder to be set so that the regex or file path
is appended to that base path, without having it included in the destination.
It will also not use a library target anymore, but a custom one so
that's possible to set properties with custom names.

Use only one copy target to copy test config files instead of having
multiple that overlaps.
It may give issues when copying and tests in the end will need all of
them.
2019-12-07 20:51:09 -05:00
Garret Reece
5c3a4636ec macOS: Add a bsd_flags column to the file table (#5981) 2019-12-03 18:40:42 -08:00
Teddy Reed
00f43e9915 config: Add more checks for pack JSON (#6071) 2019-12-03 18:22:54 -08:00
Nick Anderson
80cbefbae7 tests: adding platform conversion strings tests (#5908)
* Summary:

This adds tests for the windows and darwin conversions strings helper
classes. Darwin currently has tests, but they are not hooked up and
being run. Windows does not have tests, this adds two simple unit tests
against the logic for our string conversions.

Test Plan:
Ran the tests.
2019-12-02 14:32:05 -05:00
mark m
706874c3d3 Implement azure metadata and tags tables (#5434) 2019-11-26 21:12:27 -05:00
thehellajeff
e3b809b4de Added return code to requestShutdown call (#6018) 2019-11-21 10:27:00 -08:00
Teddy Reed
b170a517b5
tables: Fix apt_sources and refactor tests (#6047) 2019-11-19 08:56:18 -05:00
Teddy Reed
66700b9251
fuzzing: Minify logic required for new harnesses (#5942) 2019-11-19 00:25:29 -05:00
Teddy Reed
d3959d578d
tables: Re-enable required-column warning message (#6038) 2019-11-19 00:24:53 -05:00
Teddy Reed
19d4e3fc78
docs: Remove references to old osquery kernel extension (#6051) 2019-11-19 00:23:47 -05:00
Teddy Reed
d52786d08c
parsers: Always apply the options parser first (#6050) 2019-11-19 00:23:15 -05:00
Teddy Reed
fa8ac48a87
http_client: Handle relative redirects (#6049) 2019-11-19 00:22:41 -05:00
packetzero
0f9b15b05b new windows_optional_features table (#5991) 2019-11-18 20:48:11 -08:00
Teddy Reed
2d4308b284 tables: Improve integration test debugging and fix deb_packages (#6045) 2019-11-18 20:43:18 -08:00
Teddy Reed
07afc4e2a7 tables: Change atom_packages to use user constraints (#6052) 2019-11-18 20:40:45 -08:00
Teddy Reed
3e437d555d tables: Improve nvram to use input variable names (#6053) 2019-11-18 20:39:37 -08:00
Stefano Bonicatti
8bab38e30d Fix use after move in YARAEventSubscriber::configure (#6054) 2019-11-17 17:04:36 -05:00
Teddy Reed
e9b224b53b
extensions: Skip shell socket when extensions are disabled (#6046) 2019-11-17 16:04:35 -05:00
packetzero
b2e48695ec yara: avoid scanning special files that could hang (#5971) 2019-11-12 18:51:55 -05:00
packetzero
de54b643e5 extensions compatibility : default columns to INDEX (#6006)
Recent changes in INDEX enforcement broke extensions.

This fix adds a compatibility flag that defaults to the old behavior of INDEX on all columns.
This only affects extension virtual tables, all built in tables have index constraints enforced.
2019-11-12 13:40:48 -05:00
Stefano Bonicatti
e571f1aa5a Don't always link to all AWS libraries (#6032)
While in the end the osqueryd binary will require almost all libraries
built and linked, having each intermediate library depend on the whole
set of AWS libraries might result in higher compiling time.
Especially since on some platforms not all libraries are used.

This should speed up the compilation speed on Windows.
2019-11-11 09:52:21 -05:00
packetzero
af9fc86cb9 yara memory management (#5972) 2019-11-09 13:31:58 -05:00
Teddy Reed
c964db2a49
logging: Change logNumericsAsNumbers to numerics and add docs (#6002)
This is an API change for the format of logged events.
The top-level log field "logNumericsAsNumbers" was introduced to help
migrate from string-encoded numerics to JSON numbers.

This change updates the field to be "numerics", updates the flag to
conform to flag naming conventions, and documents the expectation.
2019-11-09 13:29:14 -05:00
Zachary Wasserman
3ece9e9ef7 Migrate glog and gflags to source build on macOS and Windows (#5902)
Note that glog and gflags must be migrated at the same time, otherwise
linker errors are generated on macOS.
2019-11-08 23:06:09 -05:00
Stefano Bonicatti
e80af8953e Do not use dllimport in glog on Windows (#6008)
Use osquery/logger.h instead of including glog headers.
Reduce warnings about locally defined and imported symbols.
2019-11-08 07:33:51 -05:00
Teddy Reed
11ae5a21b0
docs: Move the schedule_max_drift description into docs (#6003) 2019-11-06 23:34:55 -05:00
Teddy Reed
d3f0d6dfa5 database: Remove INFO logs for migration successes (#5948) 2019-11-04 22:40:42 -08:00
uptycs-nishant
91b7a5ba47 Prevent Audit from stalling Linux system services (#5959) 2019-11-01 21:26:00 -04:00
Chris Broome
4cbb4ad6c8 process_open_sockets/windows: add state column (#5927) 2019-11-01 01:17:24 +01:00
Zachary Wasserman
7e18771f16 Migrate glibc from "facebook" dependencies (#5900) 2019-10-31 19:08:09 -04:00
Teddy Reed
629ca7b65e
http: Move away from deprecated async_resolve overload (#5947)
When testing on IPv6-only hosts, with an IPv4 lo stack, the resolver may
not return an IPv4 address. This seems to be an issue with the
deprecated overload of async_resolve. Upon inspection, the previous
overload would only return 1 result_type.

Migrating to the recommended overload works as expected.
2019-10-31 12:05:36 -04:00
Teddy Reed
0a68a695e5
audit: Allow configuring audit_backlog_wait_time (#5953)
Read the analysis within #5952.

There are multiple sources suggesting an optimal value is 0. Our
implementation previously hardcoded the value to 1. It is now 0 and can
be configured to a different value using the audit_backlog_wait_time
option or command line flag.
2019-10-31 12:05:00 -04:00
Teddy Reed
b0bf653745
powershell/config: Add checks for character_frequencies (#5945)
Co-Authored-By: Stefano Bonicatti <smjert@gmail.com>
2019-10-31 12:03:53 -04:00
Stefano Bonicatti
dee0212433 Fix a race condition between Thrift server stop() and listen() (#5937)
If a Thrift server is requested to stop before everything is
properly initialized a race condition could happen.
Specifically if stopping during a listen() a race condition will happen
accessing childInterruptSockWriter_, which is a socket initialized by listen(),
in a non thread-safe way, and used by stop() to notify other threads
that they should shutdown.
2019-10-31 08:38:46 -04:00
packetzero
ceb70dee9e new: aws_session_token support (#5944) 2019-10-30 15:23:53 -04:00
Teddy Reed
04896c85cd
killswitch: Remove killswitch code (#5949)
This was determined to be the wrong approach to adding simple
killswitches. The intent was to quickly flip on/off features. It was
not widely adopted due to the dependencies killswitching has.

A different approach is to implement the same functions with something
simple like filesystem flags.
2019-10-29 19:14:35 -04:00
Teddy Reed
5180dfaa70 tests: Add test for JSON exponent parsing (#5941)
There is a bug in RapidJSON 1.1.0 that results in wild pointer reads
when parsing exponents. We want to prevent regressing.

This requires updating the Buck/pre-built libraries.
2019-10-29 02:16:15 +01:00
Teddy Reed
8b54ba9b16 http: Minor fixups to Client (#5946) 2019-10-28 10:10:08 +01:00
Teddy Reed
6978d31277 buck: Detect git version (#5950) 2019-10-27 20:51:16 -07:00
Stefano Bonicatti
62336ee8bb Fix a race condition during the shutdown of the worker process (#5943)
When a thread different from the main requests a shutdown
through Initializer::requestShutdown, it should not call
waitForShutdown; there's no reason to wait, moreover the function
doesn't only wait, but also actually stops other components and then
finally calls exit().

Since the main thread is already inside the waitForShutdown call
waiting on Dispatcher::joinServices or inside the shutdown() callable
on Windows, having a secondary thread do
the same work potentially at the same time is wrong.
Moreover calling exit() from a secondary thread is most of the time
incorrect.

The waitForShutdown function has been renamed to waitThenShutdown
to better represent what it's actually doing.
2019-10-27 17:09:50 -04:00