1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
use std::collections::BTreeMap;

use crate::_osquery as osquery;
use crate::_osquery::{ExtensionPluginRequest, ExtensionPluginResponse, ExtensionResponse, ExtensionStatus};
use crate::plugin::table::ColumnDef;
use crate::plugin::{OsqueryPlugin, Registry};

type TableFn = fn(ExtensionPluginRequest) -> osquery::ExtensionResponse;

#[derive(Clone, Debug)]
pub struct Table {
    name: String,
    columns: Vec<ColumnDef>,
    func: TableFn,
}

impl Table {
    pub fn new(name: &str, columns: Vec<ColumnDef>, func: TableFn) -> Self {
        // todo: error handling, not all names are allowed, e.g. when using - in name, we get:
        //W0214 01:20:44.925724  9935 interface.cpp:143] Could not add extension foobar: SQLITE_ERROR
        // Status 1 registering extension foobar (0): Failed adding registry: SQLITE_ERROR
        //routes.insert("foobartable".to_string(), resp);
        Table {
            name: name.to_string(),
            columns,
            func,
        }
    }
}

impl OsqueryPlugin for Table {
    fn name(&self) -> String {
        self.name.clone()
    }

    fn registry(&self) -> Registry {
        todo!()
    }

    fn routes(&self) -> osquery::ExtensionPluginResponse {
        let mut resp = ExtensionPluginResponse::new();

        for column in &self.columns {
            let mut r: BTreeMap<String, String> = BTreeMap::new();

            r.insert("id".to_string(), "column".to_string());
            r.insert("name".to_string(), column.name());
            r.insert("type".to_string(), column.t());
            r.insert("op".to_string(), "0".to_string());

            resp.push(r);
        }

        resp
    }

    fn ping(&self) -> ExtensionStatus {
        todo!()
    }

    fn call(&self, req: ExtensionPluginRequest) -> ExtensionResponse {
        (self.func)(req)
    }

    fn shutdown(&self) {
        todo!()
    }
}