-
Notifications
You must be signed in to change notification settings - Fork 83
Open
Labels
Description
Context
osquery 4.2
Windows 10 Pro 64bit
Test extension
package main
import (
"context"
"flag"
"log"
"github.com/kolide/osquery-go"
"github.com/kolide/osquery-go/plugin/table"
)
func main() {
flSocket := flag.String("socket", "", "")
flag.Int("timeout", 0, "")
flag.Int("interval", 0, "")
flag.Bool("verbose", false, "")
flag.Parse()
if *flSocket == "" {
log.Fatalln("--socket flag cannot be empty")
}
server, err := osquery.NewExtensionManagerServer("dev_extension", *flSocket)
if err != nil {
log.Fatalf("Error creating osquery extension server: %s\n", err)
}
server.RegisterPlugin(
table.NewPlugin(
"test_table",
[]table.ColumnDefinition{
table.TextColumn("foo"),
},
func(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
return []map[string]string{
map[string]string{
"foo": "bar",
},
}, nil
},
),
)
if err := server.Run(); err != nil {
log.Fatal(err)
}
}
Running the above test extension with .\osqueryi.exe --allow_unsafe --extension=.\extension.exe will throw an error registering extension: i/o timeout. Then about a minute later the extension will connect successfully.
Adding a time.Sleep(1 * time.Second) to the beginning of the extension will make it connect on the first try instead.
Similar behavior happens when the extension is run via the extensions.load file.