Commit Graph

5635 Commits

Author SHA1 Message Date
Nick Anderson
b60ac312b3
wmi: adding utility function to convert datetime to FILETIME (#5901) 2020-07-07 21:33:17 -07:00
seph
40897bb29c
Change "Symlink loop" message from warning to verbose (#6545)
Change Symlink loop message to verbose from warning
2020-07-07 13:45:26 -04:00
seph
5b959e91ab
Fix logging of GLOG_WARNING (#6547)
Add missing GLOG_WARNING type
2020-07-07 08:47:37 -04:00
Teddy Reed
c250dac2e7
build: Support ASAN for boost coroutine2 using ucontext (#6531) 2020-07-01 15:45:57 -04:00
Stefano Bonicatti
8636dca164
CPack: Update and uniform instructions to build a package (#6529) 2020-06-28 17:15:23 -04:00
Stefano Bonicatti
4a03194ba3
CPack: Use specific RPM variables to set the package name (#6527) 2020-06-27 10:31:29 -04:00
Stefano Bonicatti
e17e3b659b
Azure Pipelines: Update compiler version used to v142 (#6528)
Also update the Windows Server version used from 2016 to 2019,
update Ninja to the latest stable and update the docs.
2020-06-27 10:17:23 -04:00
seph
4734cd44f4
Add additional changelog items (#6523)
Additional changelog items
2020-06-25 15:05:02 -04:00
seph
5cd213c092
Changelog for 4.4.0 (#6492) 2020-06-25 09:12:24 -04:00
Teddy Reed
6710dbd5a6
build: Add Azure tables to specs CMakeLists (#6507) 2020-06-25 09:10:17 -04:00
Stefano Bonicatti
efe9a98290
CMake: Correct macOS framework linking (#6522)
target_link_libraries correctly consider "-framework <library>"
as a library, instead of a flag; lets use that instead of
target_link_options.
2020-06-25 09:08:14 -04:00
Teddy Reed
25eb7b3aae
tables: Only populate table cache with star-like selects (#6513) 2020-06-24 22:00:34 -04:00
Stefano Bonicatti
0654c20501
CMake: Fix and cleanup compile flags (#6521)
Add a description to the function preparing the targets carrying the
main compiler and linker flags.

Convert CMake default flags to the ones we use, instead of overriding
them later via targets.
This can also avoid having us use the wrong CRT on Windows if we forget to link
against osquery_cxx_settings.

Reduce the "overriding <flagX> with <flagY>" messages on Windows by
removing the warning level from the default flags, and adding that
to the specific osquery_<c|cxx>_settings target, so that non internal
targets can choose their own level.

Minor cleanups

Fix osquery/osquery#6509
2020-06-24 21:54:47 -04:00
Teddy Reed
5bc3d806e7
docs: Add note to bump the Homebrew cask (#6519) 2020-06-24 12:03:00 -04:00
Teddy Reed
8310159a7a
tests: Fix atom_packages, processes, rpm_packages flakiness (#6518) 2020-06-24 08:21:23 -04:00
Teddy Reed
0b085c36e9
bug: Do not use system proxy for AWS local authority (#6512) 2020-06-23 13:50:01 -04:00
Nick Anderson
d6e7b25706
packaging: updating docs on cpack usage to include Chocolatey (#6022) 2020-06-23 10:49:55 -07:00
Teddy Reed
e2e9e764e6
bug: Fix typed_row table caching (#6508) 2020-06-23 13:48:36 -04:00
Alessandro Gario
15448199f5
Implement event batching support for Windows tables (#6280)
* Windows events: Complete rewrite, implementing tests

* Windows events: Convert the 'keywords' column to TEXT

Since SQLite does not support unsigned 64-bit integers, this changes
the 'keywords' column type to TEXT.
2020-06-23 19:22:19 +02:00
Teddy Reed
c3bd427f4d
http: Use sync resolve (#6490) 2020-06-12 12:07:19 -04:00
James Jerger
d09ad2b1d7
Add support for basic chassis information (#5282) 2020-06-10 17:28:21 -04:00
Teddy Reed
2c453d7508
Only emit 'denylist' warning once (#6493) 2020-06-08 13:23:24 -04:00
Teddy Reed
429228d75e
docs: Remove references to brew in macOS install (#6494) 2020-06-08 13:22:52 -04:00
analyzeDFIR
c197af9716
Fix for #5890: Event Format Results and the Kafka Logger (#6449) 2020-06-06 21:44:26 -04:00
Nabil Schear
0533399039
make apt_sources table parsing much more resilient (#6482) 2020-06-06 21:28:03 -04:00
Stefano Bonicatti
411556b9a5
Make file and hash container columns hidden (#6486)
This is for consistency with the decisions taken
for PR osquery/osquery#6413 and osquery/osquery#6414.

We also update the integration test helper to accept custom constraints,
in the case the table has required columns.
2020-06-06 21:26:44 -04:00
Teddy Reed
08bcf66ef2
Update documentation to use 'allow list' and 'deny list' diction (#6489)
Update documentation to use 'allow list' and 'deny list' diction
2020-06-06 14:32:29 -04:00
Stefano Bonicatti
2085b175e1
Add validate_container_rows helper for integration tests (#6485)
This simple helper takes a table name and
an already prepared rows map to add the container
columns, which are normally hidden, and call validate_rows on it.

We use this function in deb_packages, rpm_packages, npm_packages,
os_version integration tests.
2020-06-05 21:22:44 -04:00
William Theaker
2ae56d368e
Add Auto Table Construction to docs (#6476) 2020-06-05 21:21:54 -04:00
Stefano Bonicatti
ad6b8fa24f
Change ErrorBase::takeUnderlyingError to non const (#6483)
Fix a build error with newer LLVM/Clang (11), as found on
oss-fuzz.

The member function returns a member variable via std::move,
but the member function is marked as const.
Since that variable to be actually moved would require
the class instance to be non const, a copy is used instead;
the return type has its copy constructor deleted though,
so this is always incorrect and removing the const qualifier
is the solution.
2020-06-05 21:20:56 -04:00
Zachary Wasserman
4e1d31c72a
Use 'denylist' instead of 'blacklist' in query scheduling (#6487) 2020-06-05 21:05:59 -04:00
Zachary Wasserman
86bc8bc8a3
Change compile time 'blacklist' to 'denylist' (#6488) 2020-06-05 21:03:04 -04:00
Teddy Reed
1e50815e7c
docs: Improve the new table tutorial (#6479)
Improve the new table tutorial
2020-06-05 14:24:17 -04:00
Stefano Bonicatti
e2d885b335
Add container access to the os_version table (#6413)
* Add container access to the os_version table

* Change new container columns to hidden
2020-06-05 20:22:34 +02:00
Stefano Bonicatti
dba5f1464e
Add container access to DEB, RPM, NPM packages tables (#6414)
* Add container access to DEB, RPM, NPM packages tables

* Change new container columns to hidden
2020-06-05 20:22:03 +02:00
Stefano Bonicatti
c691ac64cd
Actually use the patched libelfin version (#6480)
This is a followup of PR osquery/osquery#6472,
while the code was patched we were still using the unpatched version.
This should finally fix ossfuzz build failure.
2020-06-04 21:16:28 -04:00
herbmaster
ef65c779b1
Link librdkafka on windows (#6454) 2020-06-01 15:53:01 -04:00
Breakwell
3a63e344f3
Only explode registry key if it can be tokenized (#6474) 2020-06-01 13:58:37 -04:00
Stefano Bonicatti
7f21ccfe67
Drop the facebook and source_migration layers (#6473)
We have ported all platforms to use the source layer.
The facebook layer is not needed anymore since we build everything from source now,
the same is for the transitional source_migration layer.

Minor cleanups about the recently removed python modules.
2020-06-01 09:58:56 -04:00
Stefano Bonicatti
ada1692417
Fix libelfin build on ossfuzz and LLVM/Clang 10 (#6472)
The set_binding function is incorrectly marked as const,
since it actually modifies one of the struct members.
This was somehow not caught by older compilers,
but is failing on LLVM/Clang 10, so we create a patch to fix this.
2020-06-01 09:57:55 -04:00
Teddy Reed
c34bdf6214
codegen: Port Jinja2 to Templite (#6470) 2020-05-31 18:36:47 -04:00
Teddy Reed
34cc6f1411
libraries: Move ssdeep-cpp to source_migration (#6464) 2020-05-30 10:21:51 +02:00
Teddy Reed
9d371124f8
libraries: Move smartmontools to source_migration (#6465) 2020-05-30 10:21:33 +02:00
Stefano Bonicatti
d7c43e61db
Pass the minimum macOS SDK version to openssl only if explicitly set (#6471) 2020-05-29 22:19:18 -04:00
Ted Reed
a8469d63f1 macos: Add locks around auditpipe and event ID accesses 2020-05-28 23:02:09 -04:00
Ted Reed
ca87a35121 macos: Add small optimizations to OpenBSM 2020-05-28 23:02:09 -04:00
Ted Reed
11d8f3e7d1 macos: Switch OpenBSM to block while waiting for data 2020-05-28 23:02:09 -04:00
Ted Reed
ba5c1522fe Do not allow EventPublishers to check for interrupted 2020-05-28 23:02:09 -04:00
Ted Reed
b1940e45c7 macos: Add polling to OpenBSM publisher 2020-05-28 23:02:09 -04:00
Stefano Bonicatti
03cf73367b
Build openssl with the macOS SDK version taken from CMake (#6469) 2020-05-28 12:09:08 -04:00