How to provide table spec when adding a virtual table from an extension

Question

I'm building an osquery extension using osquery-go which is providing a virtual table into osqueryi. My table requires a WHERE clause on a specific field to generate a result. Where do I put the specifications of my table?

As stated on osquery's documentation, specs are usually provided in the specs source folder. But for an extension, I cannot figure out how to do it.

I used the example provided on osquery-go as a starting point, it works pretty well. I'm also able to filter the input with the constraints but I'd like to get a warning, not the absence of result:

func MyTableGenerate(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
    if cnstList, present := queryContext.Constraints["field1"]; present {
        // If 'field1' is present in queryContext.Contraints's keys
        // translate: if 'field1' is in the WHERE clause

        for _, cnst := range cnstList.Constraints {
            if cnst.Operator == table.OperatorEquals {
                out, err := SomeExternalFn(cnst.Expression)
                return []map[string]string{
                    {
                        "field1": cnst.Expression,
                        "field2": out,
                        "field3": err,
                    },
                }, nil
            }
        }
    }
    return nil, errors.New("Query to table MyTable must have a WHERE clause on 'field1'")
}

In osqueryi:

osquery> select * from MyTable;
osquery> select * from MyTable where field1="foo";
+--------+--------+--------+
| field1 | field2 | field3 |
+--------+--------+--------+
| foo    | foobar | foobaz |
+--------+--------+--------+

What I seek:

osquery> select * from file;
W0618 11:50:58.840874  7252 virtual_table.cpp:991] Table file was queried without a required column in the WHERE clause
W0618 11:50:58.841397  7252 virtual_table.cpp:1002] Please see the table documentation: https://osquery.io/schema/#file

score 0 · Answer 1 · answered Jun 18 '19 at 15:01

0

Return an error instead of nil.

Something like (psuedocode):

    cnstList, present := queryContext.Constraints["field1"]
    if !present {
       return nil, errors.New("Missing required field1")
    }
    ...

For a real example, take a look at some of the custom tables in launcher. For example https://github.com/kolide/launcher/blob/ca2b2a48fb7ee7a13892b3f9940d4e67ccd9d6de/pkg/osquery/table/slack_config.go#L88-L101

answered Jun 18 '19 at 15:01

seph

813
6
16

It feels like it is more or less what I tried, but the error I do return (see last row) does not appear in osquery's shell. – hippwn Jun 18 '19 at 15:13

How to provide table spec when adding a virtual table from an extension

1 Answers1