osquery_rust/plugin/table/
mod.rs

1pub(crate) mod column_def;
2pub use column_def::ColumnDef;
3pub use column_def::ColumnType;
4
5pub(crate) mod query_constraint;
6#[allow(unused_imports)]
7pub use query_constraint::QueryConstraints;
8
9use std::collections::BTreeMap;
10
11use crate::_osquery as osquery;
12use crate::_osquery::{ExtensionPluginRequest, ExtensionPluginResponse, ExtensionResponse, ExtensionStatus};
13use crate::plugin::{OsqueryPlugin, Registry};
14
15type TableFn = fn(ExtensionPluginRequest) -> osquery::ExtensionResponse;
16
17#[derive(Clone, Debug)]
18pub struct Table {
19    name: String,
20    columns: Vec<ColumnDef>,
21    func: TableFn,
22}
23
24impl Table {
25    pub fn new(name: &str, columns: Vec<ColumnDef>, func: TableFn) -> Self {
26        // todo: error handling, not all names are allowed, e.g. when using - in name, we get:
27        //W0214 01:20:44.925724  9935 interface.cpp:143] Could not add extension foobar: SQLITE_ERROR
28        // Status 1 registering extension foobar (0): Failed adding registry: SQLITE_ERROR
29        //routes.insert("foobartable".to_string(), resp);
30        Table {
31            name: name.to_string(),
32            columns,
33            func,
34        }
35    }
36}
37
38impl OsqueryPlugin for Table {
39    fn name(&self) -> String {
40        self.name.clone()
41    }
42
43    fn registry(&self) -> Registry {
44        todo!()
45    }
46
47    fn routes(&self) -> osquery::ExtensionPluginResponse {
48        let mut resp = ExtensionPluginResponse::new();
49
50        for column in &self.columns {
51            let mut r: BTreeMap<String, String> = BTreeMap::new();
52
53            r.insert("id".to_string(), "column".to_string());
54            r.insert("name".to_string(), column.name());
55            r.insert("type".to_string(), column.t());
56            r.insert("op".to_string(), "0".to_string());
57
58            resp.push(r);
59        }
60
61        resp
62    }
63
64    fn ping(&self) -> ExtensionStatus {
65        todo!()
66    }
67
68    fn call(&self, req: ExtensionPluginRequest) -> ExtensionResponse {
69        (self.func)(req)
70    }
71
72    fn shutdown(&self) {
73        todo!()
74    }
75}
osquery_rust/plugin/table/mod.rs

osquery_rust/plugin/table/
mod.rs
