/* * Copyright (c) 2014, Facebook, Inc. * All rights reserved. * * This source code is licensed under the BSD-style license found in the * LICENSE file in the root directory of this source tree. An additional grant * of patent rights can be found in the PATENTS file in the same directory. * */ #include #include #include #include #include #include #include #include namespace osquery { namespace tables { QueryData parseEtcHostsContent(const std::string& content) { QueryData results; for (const auto& i : split(content, "\n")) { auto line = split(i); if (line.size() == 0 || boost::starts_with(line[0], "#")) { continue; } Row r; r["address"] = line[0]; if (line.size() > 1) { std::vector hostnames; for (int i = 1; i < line.size(); ++i) { hostnames.push_back(line[i]); } r["hostnames"] = boost::algorithm::join(hostnames, " "); } results.push_back(r); } return results; } QueryData genEtcHosts(QueryContext& context) { std::string content; auto s = osquery::readFile("/etc/hosts", content); if (s.ok()) { return parseEtcHostsContent(content); } else { LOG(ERROR) << "Error reading /etc/hosts: " << s.toString(); return {}; } } } }