SET(CMAKE_BUILD_TYPE "DEBUG")
ENDIF(NOT CMAKE_BUILD_TYPE)
-message("CMAKE_BUILD_TYPE = ${CMAKE_BUILD_TYPE}")
-message("CMAKE_BUILD_TYPE = ${CMAKE_BUILD_TYPE}")
-message("CMAKE_BUILD_TYPE = ${CMAKE_BUILD_TYPE}")
-message("CMAKE_BUILD_TYPE = ${CMAKE_BUILD_TYPE}")
-
SET(CMAKE_CXX_FLAGS_DEBUG "-g -std=c++1z -O0 -ggdb -Wp,-U_FORTIFY_SOURCE")
SET(CMAKE_CXX_FLAGS_RELEASE "-g -std=c++1z -O2 -DNDEBUG")
dl
boost_regex
boost_system
- boost_thread
boost_filesystem
sqlite3)
plugins/plugin.cpp
plugins/sql.cpp
sql/column.cpp
- sql/diff_results.cpp
- sql/scheduled_query.cpp)
+ sql/diff_results.cpp)
FILE(GLOB OSQUERY_CORE_TESTS "tests/*.cpp")
ADD_OSQUERY_TEST(${OSQUERY_SQL_TESTS})
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include "scheduled_query.h"
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-#include <map>
-
-#include <osquery/utils/only_movable.h>
-
-namespace osquery {
-
-/**
- * @brief Represents the relevant parameters of a scheduled query.
- *
- * Within the context of osqueryd, a scheduled query may have many relevant
- * attributes. Those attributes are represented in this data structure.
- */
-struct ScheduledQuery : private only_movable {
- /// Name of the pack containing query
- std::string pack_name;
-
- /// Name of the query
- std::string name;
-
- /// The SQL query.
- std::string query;
-
- /// Owner of the query
- std::string oncall;
-
- /// How often the query should be executed, in second.
- size_t interval{0};
-
- /// A temporary splayed internal.
- size_t splayed_interval{0};
-
- /**
- * @brief Queries are blacklisted based on logic in the configuration.
- *
- * Most calls to inspect scheduled queries will abstract away the blacklisting
- * concept and only return non-blacklisted queries. The config may be asked
- * to return all queries, thus it is important to capture this optional data.
- */
- bool blacklisted{false};
-
- /// Set of query options.
- std::map<std::string, bool> options;
-
- ScheduledQuery(const std::string& pack_name,
- const std::string& name,
- const std::string& query)
- : pack_name(pack_name), name(name), query(query) {}
- ScheduledQuery() = default;
- ScheduledQuery(ScheduledQuery&&) = default;
- ScheduledQuery& operator=(ScheduledQuery&&) = default;
-
- /// equals operator
- bool operator==(const ScheduledQuery& comp) const
- {
- return (comp.query == query) && (comp.interval == interval);
- }
-
- /// not equals operator
- bool operator!=(const ScheduledQuery& comp) const
- {
- return !(*this == comp);
- }
-};
-
-} // namespace osquery
#include <string>
-#include <osquery/utils/macros/macros.h>
-
/// A configuration error is catastrophic and should exit the watcher.
#define EXIT_CATASTROPHIC 78
#include <osquery/core.h>
#include <osquery/core/sql/diff_results.h>
-#include <osquery/core/sql/scheduled_query.h>
namespace osquery {
*/
class Query {
public:
- /**
- * @brief Constructor which sets up necessary parameters of a Query object.
- *
- * Given a query, this constructor calculates the value of columnFamily_,
- * which can be accessed via the getColumnFamilyName getter method.
- *
- * @param name The query name.
- * @param q a SheduledQuery struct.
- */
- explicit Query(std::string name, const ScheduledQuery& q)
- : query_(q.query), name_(std::move(name)) {}
-
/**
* @brief Serialize the data in RocksDB into a useful data structure
*
# See the License for the specific language governing permissions and
# limitations under the License
-ADD_OSQUERY_LIBRARY(osquery_utils base64.cpp
- chars.cpp
- only_movable.cpp
+ADD_OSQUERY_LIBRARY(osquery_utils only_movable.cpp
status/status.cpp
- system/time.cpp
- system/posix/env.cpp
- system/posix/errno.cpp
- system/posix/filepath.cpp
- system/posix/time.cpp
conversions/tryto.cpp
conversions/split.cpp)
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#if __cplusplus >= 201703L
-#define OSQUERY_NODISCARD [[nodiscard]]
-#else
-#if defined(POSIX)
-#define OSQUERY_NODISCARD __attribute__((warn_unused_result))
-#elif defined(WIDOWS) && defined(_MSC_VER) && _MSC_VER >= 1700
-#define OSQUERY_NODISCARD _Check_return_
-#else
-#define OSQUERY_NODISCARD
-#endif
-#endif
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include "base64.h"
-
-#include <boost/algorithm/string.hpp>
-#include <boost/archive/iterators/base64_from_binary.hpp>
-#include <boost/archive/iterators/binary_from_base64.hpp>
-#include <boost/archive/iterators/transform_width.hpp>
-
-#include <vist/logger.hpp>
-
-namespace bai = boost::archive::iterators;
-
-namespace osquery {
-
-namespace base64 {
-
-namespace {
-
-typedef bai::binary_from_base64<const char*> base64_str;
-typedef bai::transform_width<base64_str, 8, 6> base64_dec;
-typedef bai::transform_width<std::string::const_iterator, 6, 8> base64_enc;
-typedef bai::base64_from_binary<base64_enc> it_base64;
-
-} // namespace
-
-std::string decode(std::string encoded)
-{
- boost::erase_all(encoded, "\r\n");
- boost::erase_all(encoded, "\n");
- boost::trim_right_if(encoded, boost::is_any_of("="));
-
- if (encoded.empty()) {
- return encoded;
- }
-
- try {
- return std::string(base64_dec(encoded.data()),
- base64_dec(encoded.data() + encoded.size()));
- } catch (const boost::archive::iterators::dataflow_exception& e) {
- INFO(OSQUERY) << "Could not base64 decode string: " << e.what();
- return "";
- }
-}
-
-std::string encode(const std::string& unencoded)
-{
- if (unencoded.empty()) {
- return unencoded;
- }
-
- size_t writePaddChars = (3U - unencoded.length() % 3U) % 3U;
- try {
- auto encoded =
- std::string(it_base64(unencoded.begin()), it_base64(unencoded.end()));
- encoded.append(std::string(writePaddChars, '='));
- return encoded;
- } catch (const boost::archive::iterators::dataflow_exception& e) {
- INFO(OSQUERY) << "Could not base64 decode string: " << e.what();
- return "";
- }
-}
-
-} // namespace base64
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-
-namespace osquery {
-
-namespace base64 {
-
-/**
- * @brief Decode a base64 encoded string.
- *
- * @param encoded The encode base64 string.
- * @return Decoded string.
- */
-std::string decode(std::string encoded);
-
-/**
- * @brief Encode a string.
- *
- * @param A string to encode.
- * @return Encoded string.
- */
-std::string encode(const std::string& unencoded);
-
-} // namespace base64
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <string>
-#include <cstddef>
-
-#include <vist/logger.hpp>
-
-#include <osquery/utils/chars.h>
-#include <osquery/utils/conversions/tryto.h>
-
-namespace osquery {
-
-bool isPrintable(const std::string& check)
-{
- for (const unsigned char ch : check) {
- if (ch >= 0x7F || ch <= 0x1F) {
- return false;
- }
- }
- return true;
-}
-
-size_t utf8StringSize(const std::string& str)
-{
- size_t res = 0;
- std::string::const_iterator it = str.begin();
- for (; it != str.end(); incUtf8StringIterator(it, str.end())) {
- res++;
- }
-
- return res;
-}
-
-std::string unescapeUnicode(const std::string& escaped)
-{
- if (escaped.size() < 6) {
- return escaped;
- }
-
- std::string unescaped;
- unescaped.reserve(escaped.size());
- for (size_t i = 0; i < escaped.size(); ++i) {
- if (i < escaped.size() - 5 && '\\' == escaped[i] && 'u' == escaped[i + 1]) {
- // Assume 2-byte wide unicode.
- auto const exp = tryTo<long>(escaped.substr(i + 2, 4), 16);
- if (exp.isError()) {
- WARN(OSQUERY) << "Unescaping a string with length: " << escaped.size()
- << " failed at: " << i;
- return "";
- }
- long const value = exp.get();
- if (value < 255) {
- unescaped += static_cast<char>(value);
- i += 5;
- continue;
- }
- } else if (i < escaped.size() - 1 && '\\' == escaped[i] &&
- '\\' == escaped[i + 1]) {
- // In the case of \\users 'sers' is not a unicode character
- // If we see \\ we should skip them and we do this by adding
- // an extra jump forward.
- unescaped += escaped[i];
- ++i;
- }
- unescaped += escaped[i];
- }
- return unescaped;
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-
-namespace osquery {
-
-/**
- * @brief Check if a string is ASCII printable
- *
- * @param A string to check.
- * @return If the string is printable.
- */
-bool isPrintable(const std::string& check);
-
-/**
- * @brief In-line helper function for use with utf8StringSize
- */
-template <typename _Iterator1, typename _Iterator2>
-size_t incUtf8StringIterator(_Iterator1& it, const _Iterator2& last)
-{
- if (it == last) {
- return 0;
- }
-
- size_t res = 1;
- for (++it; last != it; ++it, ++res) {
- unsigned char c = *it;
- if (!(c & 0x80) || ((c & 0xC0) == 0xC0)) {
- break;
- }
- }
-
- return res;
-}
-
-/**
- * @brief Get the length of a UTF-8 string
- *
- * @param str The UTF-8 string
- *
- * @return the length of the string
- */
-size_t utf8StringSize(const std::string& str);
-
-/// Safely convert unicode escaped ASCII.
-std::string unescapeUnicode(const std::string& escaped);
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-
-#include <boost/algorithm/string.hpp>
-
-namespace osquery {
-
-/**
- * @brief Join a vector of strings inserting a token string between elements
- *
- * @param s the vector of strings to be joined.
- * @param tok a token glue string to be inserted between elements.
- *
- * @return the joined string.
- */
-template <typename SequenceType>
-inline std::string join(const SequenceType& s, const std::string& tok)
-{
- return boost::algorithm::join(s, tok);
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <string>
-
-#include <gtest/gtest.h>
-
-#include <osquery/utils/conversions/join.h>
-
-namespace osquery {
-
-class ConversionsTests : public testing::Test {};
-
-TEST_F(ConversionsTests, test_join)
-{
- std::vector<std::string> content = {
- "one", "two", "three",
- };
- EXPECT_EQ(join(content, ", "), "one, two, three");
-}
-
-}
#pragma once
-#include <osquery/utils/attribute.h>
#include <osquery/utils/conversions/to.h>
#include <memory>
}
template <typename ErrorCodeEnumType, typename OtherErrorCodeEnumType>
-OSQUERY_NODISCARD Error<ErrorCodeEnumType> createError(
+[[nodiscard]] Error<ErrorCodeEnumType> createError(
ErrorCodeEnumType error_code,
Error<OtherErrorCodeEnumType> underlying_error)
{
}
template <typename ErrorCodeEnumType>
-OSQUERY_NODISCARD Error<ErrorCodeEnumType> createError(
+[[nodiscard]] Error<ErrorCodeEnumType> createError(
ErrorCodeEnumType error_code)
{
return Error<ErrorCodeEnumType>(error_code);
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-// clang-format off
-#ifndef STR
-#define STR_OF(x) #x
-#define STR(x) STR_OF(x)
-#endif
-
-#ifdef WIN32
-#define STR_EX(...) __VA_ARGS__
-#else
-#define STR_EX(x) x
-#endif
-#define CONCAT(x, y) STR(STR_EX(x)STR_EX(y))
-
-#ifdef WIN32
-#define USED_SYMBOL
-#define EXPORT_FUNCTION __declspec(dllexport)
-#else
-#define USED_SYMBOL __attribute__((used))
-#define EXPORT_FUNCTION
-#endif
-// clang-format on
#include <mutex>
#include <shared_mutex>
-#include <boost/thread/recursive_mutex.hpp>
namespace osquery {
/// Helper alias for write locking a recursive mutex.
using RecursiveLock = std::unique_lock<std::recursive_mutex>;
-/// Helper alias for upgrade locking a mutex.
-using UpgradeLock = boost::upgrade_lock<Mutex>;
-
-/// Helper alias for write locking an upgrade lock.
-using WriteUpgradeLock = boost::upgrade_to_unique_lock<Mutex>;
-
} // namespace osquery
#pragma once
#include <osquery/utils/error/error.h>
-#include <osquery/utils/expected/expected.h>
#include <sstream>
#include <string>
::std::ostream& operator<<(::std::ostream& os, const Status& s);
-template <typename ToType, typename ValueType, typename ErrorCodeEnumType>
-inline
-typename std::enable_if<std::is_same<ToType, Status>::value, Status>::type
-to(const Expected<ValueType, ErrorCodeEnumType>& expected)
-{
- return expected ? Status::success()
- : Status::failure(expected.getError().getMessage());
-}
-
} // namespace osquery
#endif
}
-namespace {
-
-enum class TestError {
- Semantic = 1,
-};
-
-bool stringContains(const std::string& where, const std::string& what)
-{
- return boost::contains(where, what);
-};
-
-} // namespace
-
-TEST_F(StatusTests, test_expected_to_status_failure)
-{
- const auto expected = Expected<std::string, TestError>(
- TestError::Semantic, "The ultimate failure reason");
- auto s = to<Status>(expected);
- EXPECT_FALSE(s.ok());
- EXPECT_PRED2(stringContains, s.toString(), "The ultimate failure reason");
-}
-
-TEST_F(StatusTests, test_expected_to_status_success)
-{
- const auto expected =
- Expected<std::string, TestError>("This is not a failure");
- auto s = to<Status>(expected);
- EXPECT_TRUE(s.ok());
- EXPECT_EQ(s, Status::success());
-}
}
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-#include <boost/optional.hpp>
-
-
-namespace osquery {
-
-/// Set the environment variable name with value value.
-bool setEnvVar(const std::string& name, const std::string& value);
-
-/// Unsets the environment variable specified by name.
-bool unsetEnvVar(const std::string& name);
-
-/**
- * @brief Returns the value of the specified environment variable name.
- *
- * If the environment variable does not exist, boost::none is returned.
- */
-boost::optional<std::string> getEnvVar(const std::string& name);
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-
-namespace osquery {
-
-/// Returns a C++ string explaining the errnum
-std::string platformStrerr(int errnum);
-
-}
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <string>
-
-namespace osquery {
-
-/// Safer way to do realpath
-const std::string canonicalize_file_name(const char* name);
-
-}
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <osquery/utils/system/env.h>
-
-#include <string>
-#include <boost/optional.hpp>
-
-#include <stdlib.h>
-
-
-namespace osquery {
-
-bool setEnvVar(const std::string& name, const std::string& value)
-{
- auto ret = ::setenv(name.c_str(), value.c_str(), 1);
- return (ret == 0);
-}
-
-bool unsetEnvVar(const std::string& name)
-{
- auto ret = ::unsetenv(name.c_str());
- return (ret == 0);
-}
-
-boost::optional<std::string> getEnvVar(const std::string& name)
-{
- char* value = ::getenv(name.c_str());
- if (value) {
- return std::string(value);
- }
- return boost::none;
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <osquery/utils/system/errno.h>
-#include <osquery/utils/system/posix/errno.h>
-
-#include <string.h>
-
-#include <unordered_map>
-
-namespace osquery {
-
-std::string platformStrerr(int errnum)
-{
- return ::strerror(errnum);
-}
-
-namespace impl {
-
-PosixError toPosixSystemError(int from_errno)
-{
- static auto const table = std::unordered_map<int, PosixError> {
- {EPERM, PosixError::PERM}, {ENOENT, PosixError::NOENT},
- {ESRCH, PosixError::SRCH}, {EINTR, PosixError::INTR},
- {EIO, PosixError::IO}, {ENXIO, PosixError::NXIO},
- {E2BIG, PosixError::T_BIG}, {ENOEXEC, PosixError::NOEXEC},
- {EBADF, PosixError::BADF}, {ECHILD, PosixError::CHILD},
- {EAGAIN, PosixError::AGAIN}, {ENOMEM, PosixError::NOMEM},
- {EACCES, PosixError::ACCES}, {EFAULT, PosixError::FAULT},
- {ENOTBLK, PosixError::NOTBLK}, {EBUSY, PosixError::BUSY},
- {EEXIST, PosixError::EXIST}, {EXDEV, PosixError::XDEV},
- {ENODEV, PosixError::NODEV}, {ENOTDIR, PosixError::NOTDIR},
- {EISDIR, PosixError::ISDIR}, {EINVAL, PosixError::INVAL},
- {ENFILE, PosixError::NFILE}, {EMFILE, PosixError::MFILE},
- {ENOTTY, PosixError::NOTTY}, {ETXTBSY, PosixError::TXTBSY},
- {EFBIG, PosixError::FBIG}, {ENOSPC, PosixError::NOSPC},
- {ESPIPE, PosixError::SPIPE}, {EROFS, PosixError::ROFS},
- {EMLINK, PosixError::MLINK}, {EPIPE, PosixError::PIPE},
- {EDOM, PosixError::DOM}, {ERANGE, PosixError::RANGE},
- };
- auto const it = table.find(from_errno);
- if (it == table.end()) {
- return PosixError::Unknown;
- }
- return it->second;
-}
-
-} // namespace impl
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2018-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <errno.h>
-
-#include <type_traits>
-
-namespace osquery {
-
-enum class PosixError {
- Unknown = 0,
- PERM = EPERM,
- NOENT = ENOENT,
- SRCH = ESRCH,
- INTR = EINTR,
- IO = EIO,
- NXIO = ENXIO,
- T_BIG = E2BIG,
- NOEXEC = ENOEXEC,
- BADF = EBADF,
- CHILD = ECHILD,
- AGAIN = EAGAIN,
- NOMEM = ENOMEM,
- ACCES = EACCES,
- FAULT = EFAULT,
- NOTBLK = ENOTBLK,
- BUSY = EBUSY,
- EXIST = EEXIST,
- XDEV = EXDEV,
- NODEV = ENODEV,
- NOTDIR = ENOTDIR,
- ISDIR = EISDIR,
- INVAL = EINVAL,
- NFILE = ENFILE,
- MFILE = EMFILE,
- NOTTY = ENOTTY,
- TXTBSY = ETXTBSY,
- FBIG = EFBIG,
- NOSPC = ENOSPC,
- SPIPE = ESPIPE,
- ROFS = EROFS,
- MLINK = EMLINK,
- PIPE = EPIPE,
- DOM = EDOM,
- RANGE = ERANGE,
-};
-
-namespace impl {
-
-PosixError toPosixSystemError(int from_errno);
-
-}
-
-template <typename ToType>
-inline typename std::enable_if<std::is_same<ToType, PosixError>::value,
- PosixError>::type
- to(int from_errno)
-{
- return impl::toPosixSystemError(from_errno);
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <osquery/utils/system/filepath.h>
-
-#include <climits>
-#include <cstdlib>
-#include <cstring>
-#include <string>
-
-namespace osquery {
-
-const std::string canonicalize_file_name(const char* name)
-{
-#ifdef PATH_MAX
- // On supported platforms where PATH_MAX is defined we can pass null
- // as buffer, and allow libc to alloced space
- // On centos/ubuntu libc will use realloc so we will be able to resolve
- // any path
- // On darwin libc will allocate PATH_MAX buffer for us
- char* resolved = realpath(name, nullptr);
- std::string result = (resolved == nullptr) ? name : resolved;
- free(resolved);
-#else
-#warning PATH_MAX is undefined, please read comment below
- // PATH_MAX is not defined, very likely it's not officially supported
- // os, our best guess is _PC_PATH_MAX if available
- // In case of failure fallback to "safe" buffer of 8K
-
- long int path_max = pathconf(name, _PC_PATH_MAX);
- if (path_max <= 0) {
- path_max = 8 * 1024;
- }
- char* buffer = static_cast<char*>(malloc(path_max));
- char* resolved = realpath(name, buffer);
- std::string result = (resolved == nullptr) ? name : resolved;
- free(buffer);
-#endif
- return result;
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2018-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <string>
-
-#include <gtest/gtest.h>
-
-#include <osquery/utils/system/posix/errno.h>
-
-namespace osquery {
-namespace {
-
-class PosixErrnoTests : public testing::Test {};
-
-TEST_F(PosixErrnoTests, to)
-{
- EXPECT_EQ(PosixError::Unknown, to<PosixError>(0));
- EXPECT_EQ(PosixError::Unknown, to<PosixError>(-1));
- EXPECT_EQ(PosixError::Unknown, to<PosixError>(98765));
- EXPECT_EQ(PosixError::Unknown, to<PosixError>(987654));
-
- EXPECT_EQ(PosixError::PIPE, to<PosixError>(EPIPE));
- EXPECT_EQ(PosixError::DOM, to<PosixError>(EDOM));
- EXPECT_EQ(PosixError::RANGE, to<PosixError>(ERANGE));
- EXPECT_EQ(PosixError::T_BIG, to<PosixError>(E2BIG));
-}
-
-} // namespace
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <osquery/utils/system/time.h>
-
-#include <string.h>
-
-namespace osquery {
-
-std::string platformAsctime(const struct tm* timeptr)
-{
- if (timeptr == nullptr) {
- return "";
- }
-
- // Manual says at least 26 characters.
- char buffer[32] = {0};
- return ::asctime_r(timeptr, buffer);
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
+++ /dev/null
-/**
- * Copyright (c) 2018-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <gtest/gtest.h>
-
-#include <osquery/utils/system/time.h>
-
-namespace osquery {
-
-class TimeTests : public testing::Test {};
-
-TEST_F(TimeTests, test_asciitime)
-{
- const std::time_t epoch = 1491518994;
- const std::string expected = "Thu Apr 6 22:49:54 2017 UTC";
-
- auto const result = std::gmtime(&epoch);
-
- EXPECT_EQ(expected, toAsciiTime(result));
-}
-
-TEST_F(TimeTests, test_asciitimeutc)
-{
- const std::time_t epoch = 1491518994;
- const std::string expected = "Thu Apr 6 22:49:54 2017 UTC";
-
- auto const result = std::localtime(&epoch);
-
- EXPECT_EQ(expected, toAsciiTimeUTC(result));
-}
-}
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#include <osquery/utils/system/time.h>
-
-#include <boost/algorithm/string/trim.hpp>
-
-#include <cstring>
-#include <ctime>
-
-namespace osquery {
-
-std::string toAsciiTime(const struct tm* tm_time)
-{
- if (tm_time == nullptr) {
- return "";
- }
-
- auto time_str = platformAsctime(tm_time);
- boost::algorithm::trim(time_str);
- return time_str + " UTC";
-}
-
-std::string toAsciiTimeUTC(const struct tm* tm_time)
-{
- size_t epoch = toUnixTime(tm_time);
- struct tm tptr;
-
- std::memset(&tptr, 0, sizeof(tptr));
-
- if (epoch == (size_t) -1) {
- return "";
- }
-
-#ifdef OSQUERY_WINDOWS
- _gmtime64_s(&tptr, (time_t*)&epoch);
-#else
- gmtime_r((time_t*)&epoch, &tptr);
-#endif
- return toAsciiTime(&tptr);
-}
-
-std::string getAsciiTime()
-{
- auto result = std::time(nullptr);
-
- struct tm now;
-#ifdef OSQUERY_WINDOWS
- _gmtime64_s(&now, &result);
-#else
- gmtime_r(&result, &now);
-#endif
-
- return toAsciiTime(&now);
-}
-
-size_t toUnixTime(const struct tm* tm_time)
-{
- struct tm result;
- std::memset(&result, 0, sizeof(result));
-
- std::memcpy(&result, tm_time, sizeof(result));
- return mktime(&result);
-}
-
-size_t getUnixTime()
-{
- std::time_t ut = std::time(nullptr);
- return ut < 0 ? 0 : ut;
-}
-
-} // namespace osquery
+++ /dev/null
-/**
- * Copyright (c) 2014-present, Facebook, Inc.
- * All rights reserved.
- *
- * This source code is licensed in accordance with the terms specified in
- * the LICENSE file found in the root directory of this source tree.
- */
-
-#pragma once
-
-#include <ctime>
-#include <string>
-
-namespace osquery {
-
-/// Returns the ASCII version of the timeptr as a C++ string
-std::string platformAsctime(const struct tm* timeptr);
-
-/**
- * @brief Converts struct tm to a size_t
- *
- * @param tm_time the time/date to convert to UNIX epoch time
- *
- * @return an int representing the UNIX epoch time of the struct tm
- */
-size_t toUnixTime(const struct tm* tm_time);
-
-/**
- * @brief Getter for the current UNIX time.
- *
- * @return an int representing the amount of seconds since the UNIX epoch
- */
-size_t getUnixTime();
-
-/**
- * @brief Converts a struct tm into a human-readable format. This expected the
- * struct tm to be already in UTC time/
- *
- * @param tm_time the time/date to convert to ASCII
- *
- * @return the data/time of tm_time in the format: "Wed Sep 21 10:27:52 2011"
- */
-std::string toAsciiTime(const struct tm* tm_time);
-
-/**
- * @brief Converts a struct tm to ASCII time UTC by converting the tm_time to
- * epoch and then running gmtime() on the new epoch
- *
- * @param tm_time the local time/date to covert to UTC ASCII time
- *
- * @return the data/time of tm_time in the format: "Wed Sep 21 10:27:52 2011"
- */
-std::string toAsciiTimeUTC(const struct tm* tm_time);
-
-/**
- * @brief Getter for the current time, in a human-readable format.
- *
- * @return the current date/time in the format: "Wed Sep 21 10:27:52 2011"
- */
-std::string getAsciiTime();
-
-}
projects / platform / core / security / vist.git / commitdiff