{"action":"opened","number":48,"pull_request":{"url":"https://api.github.com/repos/osquery/osquery-python/pulls/48","id":166411415,"html_url":"https://github.com/osquery/osquery-python/pull/48","diff_url":"https://github.com/osquery/osquery-python/pull/48.diff","patch_url":"https://github.com/osquery/osquery-python/pull/48.patch","issue_url":"https://api.github.com/repos/osquery/osquery-python/issues/48","number":48,"state":"open","locked":false,"title":"Adding Python extensions support for Windows","user":{"login":"muffins","id":1328916,"avatar_url":"https://avatars1.githubusercontent.com/u/1328916?v=4","gravatar_id":"","url":"https://api.github.com/users/muffins","html_url":"https://github.com/muffins","followers_url":"https://api.github.com/users/muffins/followers","following_url":"https://api.github.com/users/muffins/following{/other_user}","gists_url":"https://api.github.com/users/muffins/gists{/gist_id}","starred_url":"https://api.github.com/users/muffins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffins/subscriptions","organizations_url":"https://api.github.com/users/muffins/orgs","repos_url":"https://api.github.com/users/muffins/repos","events_url":"https://api.github.com/users/muffins/events{/privacy}","received_events_url":"https://api.github.com/users/muffins/received_events","type":"User","site_admin":false},"body":"This adds in an implementation of TPipe for windows, which allows us to make use of Python extensions on the Windows platform.\r\n\r\nSome samples of the extensions in action. First we startup osquery:\r\n```\r\n:\\Users\\Nick\\work\\repos\\osquery [win-python-auto-ext]\r\nλ  .\\build\\windows10\\osquery\\RelWithDebInfo\\osqueryd.exe -S --flagfile=C:\\Users\\Nick\\work\\configs\\osquery_extensions\\osquery.flags --verbose\r\n```\r\nThen we start up our extension:\r\n```\r\nC:\\Users\\Nick\\work\\repos\\osquery-python [osquery-python-windows-port +1 ~0 -0 !]\r\nλ  python .\\foobar_table.ext --socket \\\\.\\pipe\\shell.em --verbose\r\n```\r\nWe see the extension connect to our shell:\r\n```\r\nI0131 16:07:10.660527  4272 init.cpp:380] osquery initialized [version=3.0.0-17-g10c0c60b]\r\nI0131 16:07:10.663009  4272 rocksdb.cpp:132] Opening RocksDB handle: C:\\Users\\Nick\\work\\configs\\osquery_extensions\\osquery.db\r\nI0131 16:07:10.725503 22132 interface.cpp:338] Extension manager service starting: \\\\.\\pipe\\shell.em\r\nI0131 16:07:10.741130 21252 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109\r\nI0131 16:07:10.741130 21252 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed\r\nI0131 16:07:10.741130  5972 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109\r\nI0131 16:07:10.741130  5972 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed\r\nUsing a I0131 16:07:11.811651 25176 events.cpp:746] Starting event publisher run loop: windows_event_log\r\nvirtual database. Need help, type '.help'\r\nosquery> I0131 16:07:12.191326  8460 interface.cpp:141] Registering extension (foobar_table, 29953, version=1.0.0, sdk=1.8.0)\r\nI0131 16:07:12.191326  8460 registry.cpp:351] Extension 29953 registered table plugin foobar\r\n```\r\nWe then query the extension:\r\n```\r\nosquery> select * from foobar;\r\n+-----+-----+\r\n| foo | baz |\r\n+-----+-----+\r\n| bar | baz |\r\n| bar | baz |\r\n+-----+-----+\r\n```\r\n\r\nSo far I have tested extensions being autloaded with osquery, which currently works from both command line and running as a system service. I tested having a python extension that both provides data to, and queries data from osquery, and this didn't seem to work. I'm still digging into what's happening to prevent bidirectional communication, but throwing this up to get the review process started.","created_at":"2018-02-01T00:10:01Z","updated_at":"2018-02-01T00:10:01Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"milestone":null,"commits_url":"https://api.github.com/repos/osquery/osquery-python/pulls/48/commits","review_comments_url":"https://api.github.com/repos/osquery/osquery-python/pulls/48/comments","review_comment_url":"https://api.github.com/repos/osquery/osquery-python/pulls/comments{/number}","comments_url":"https://api.github.com/repos/osquery/osquery-python/issues/48/comments","statuses_url":"https://api.github.com/repos/osquery/osquery-python/statuses/a48d937b079c38197d5ee0e9ff8152caa1b71128","head":{"label":"muffins:osquery-python-windows-port","ref":"osquery-python-windows-port","sha":"a48d937b079c38197d5ee0e9ff8152caa1b71128","user":{"login":"muffins","id":1328916,"avatar_url":"https://avatars1.githubusercontent.com/u/1328916?v=4","gravatar_id":"","url":"https://api.github.com/users/muffins","html_url":"https://github.com/muffins","followers_url":"https://api.github.com/users/muffins/followers","following_url":"https://api.github.com/users/muffins/following{/other_user}","gists_url":"https://api.github.com/users/muffins/gists{/gist_id}","starred_url":"https://api.github.com/users/muffins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffins/subscriptions","organizations_url":"https://api.github.com/users/muffins/orgs","repos_url":"https://api.github.com/users/muffins/repos","events_url":"https://api.github.com/users/muffins/events{/privacy}","received_events_url":"https://api.github.com/users/muffins/received_events","type":"User","site_admin":false},"repo":{"id":66449989,"name":"osquery-python","full_name":"muffins/osquery-python","owner":{"login":"muffins","id":1328916,"avatar_url":"https://avatars1.githubusercontent.com/u/1328916?v=4","gravatar_id":"","url":"https://api.github.com/users/muffins","html_url":"https://github.com/muffins","followers_url":"https://api.github.com/users/muffins/followers","following_url":"https://api.github.com/users/muffins/following{/other_user}","gists_url":"https://api.github.com/users/muffins/gists{/gist_id}","starred_url":"https://api.github.com/users/muffins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffins/subscriptions","organizations_url":"https://api.github.com/users/muffins/orgs","repos_url":"https://api.github.com/users/muffins/repos","events_url":"https://api.github.com/users/muffins/events{/privacy}","received_events_url":"https://api.github.com/users/muffins/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/muffins/osquery-python","description":"python bindings for osquery","fork":true,"url":"https://api.github.com/repos/muffins/osquery-python","forks_url":"https://api.github.com/repos/muffins/osquery-python/forks","keys_url":"https://api.github.com/repos/muffins/osquery-python/keys{/key_id}","collaborators_url":"https://api.github.com/repos/muffins/osquery-python/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/muffins/osquery-python/teams","hooks_url":"https://api.github.com/repos/muffins/osquery-python/hooks","issue_events_url":"https://api.github.com/repos/muffins/osquery-python/issues/events{/number}","events_url":"https://api.github.com/repos/muffins/osquery-python/events","assignees_url":"https://api.github.com/repos/muffins/osquery-python/assignees{/user}","branches_url":"https://api.github.com/repos/muffins/osquery-python/branches{/branch}","tags_url":"https://api.github.com/repos/muffins/osquery-python/tags","blobs_url":"https://api.github.com/repos/muffins/osquery-python/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/muffins/osquery-python/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/muffins/osquery-python/git/refs{/sha}","trees_url":"https://api.github.com/repos/muffins/osquery-python/git/trees{/sha}","statuses_url":"https://api.github.com/repos/muffins/osquery-python/statuses/{sha}","languages_url":"https://api.github.com/repos/muffins/osquery-python/languages","stargazers_url":"https://api.github.com/repos/muffins/osquery-python/stargazers","contributors_url":"https://api.github.com/repos/muffins/osquery-python/contributors","subscribers_url":"https://api.github.com/repos/muffins/osquery-python/subscribers","subscription_url":"https://api.github.com/repos/muffins/osquery-python/subscription","commits_url":"https://api.github.com/repos/muffins/osquery-python/commits{/sha}","git_commits_url":"https://api.github.com/repos/muffins/osquery-python/git/commits{/sha}","comments_url":"https://api.github.com/repos/muffins/osquery-python/comments{/number}","issue_comment_url":"https://api.github.com/repos/muffins/osquery-python/issues/comments{/number}","contents_url":"https://api.github.com/repos/muffins/osquery-python/contents/{+path}","compare_url":"https://api.github.com/repos/muffins/osquery-python/compare/{base}...{head}","merges_url":"https://api.github.com/repos/muffins/osquery-python/merges","archive_url":"https://api.github.com/repos/muffins/osquery-python/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/muffins/osquery-python/downloads","issues_url":"https://api.github.com/repos/muffins/osquery-python/issues{/number}","pulls_url":"https://api.github.com/repos/muffins/osquery-python/pulls{/number}","milestones_url":"https://api.github.com/repos/muffins/osquery-python/milestones{/number}","notifications_url":"https://api.github.com/repos/muffins/osquery-python/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/muffins/osquery-python/labels{/name}","releases_url":"https://api.github.com/repos/muffins/osquery-python/releases{/id}","deployments_url":"https://api.github.com/repos/muffins/osquery-python/deployments","created_at":"2016-08-24T09:18:21Z","updated_at":"2016-08-24T09:18:22Z","pushed_at":"2018-02-01T00:06:27Z","git_url":"git://github.com/muffins/osquery-python.git","ssh_url":"git@github.com:muffins/osquery-python.git","clone_url":"https://github.com/muffins/osquery-python.git","svn_url":"https://github.com/muffins/osquery-python","homepage":null,"size":119,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"osquery:master","ref":"master","sha":"e40c092df126790e640253944b39cbc77aa3055b","user":{"login":"osquery","id":8315868,"avatar_url":"https://avatars1.githubusercontent.com/u/8315868?v=4","gravatar_id":"","url":"https://api.github.com/users/osquery","html_url":"https://github.com/osquery","followers_url":"https://api.github.com/users/osquery/followers","following_url":"https://api.github.com/users/osquery/following{/other_user}","gists_url":"https://api.github.com/users/osquery/gists{/gist_id}","starred_url":"https://api.github.com/users/osquery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/osquery/subscriptions","organizations_url":"https://api.github.com/users/osquery/orgs","repos_url":"https://api.github.com/users/osquery/repos","events_url":"https://api.github.com/users/osquery/events{/privacy}","received_events_url":"https://api.github.com/users/osquery/received_events","type":"Organization","site_admin":false},"repo":{"id":34819313,"name":"osquery-python","full_name":"osquery/osquery-python","owner":{"login":"osquery","id":8315868,"avatar_url":"https://avatars1.githubusercontent.com/u/8315868?v=4","gravatar_id":"","url":"https://api.github.com/users/osquery","html_url":"https://github.com/osquery","followers_url":"https://api.github.com/users/osquery/followers","following_url":"https://api.github.com/users/osquery/following{/other_user}","gists_url":"https://api.github.com/users/osquery/gists{/gist_id}","starred_url":"https://api.github.com/users/osquery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/osquery/subscriptions","organizations_url":"https://api.github.com/users/osquery/orgs","repos_url":"https://api.github.com/users/osquery/repos","events_url":"https://api.github.com/users/osquery/events{/privacy}","received_events_url":"https://api.github.com/users/osquery/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/osquery/osquery-python","description":"python bindings for osquery","fork":false,"url":"https://api.github.com/repos/osquery/osquery-python","forks_url":"https://api.github.com/repos/osquery/osquery-python/forks","keys_url":"https://api.github.com/repos/osquery/osquery-python/keys{/key_id}","collaborators_url":"https://api.github.com/repos/osquery/osquery-python/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/osquery/osquery-python/teams","hooks_url":"https://api.github.com/repos/osquery/osquery-python/hooks","issue_events_url":"https://api.github.com/repos/osquery/osquery-python/issues/events{/number}","events_url":"https://api.github.com/repos/osquery/osquery-python/events","assignees_url":"https://api.github.com/repos/osquery/osquery-python/assignees{/user}","branches_url":"https://api.github.com/repos/osquery/osquery-python/branches{/branch}","tags_url":"https://api.github.com/repos/osquery/osquery-python/tags","blobs_url":"https://api.github.com/repos/osquery/osquery-python/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/osquery/osquery-python/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/osquery/osquery-python/git/refs{/sha}","trees_url":"https://api.github.com/repos/osquery/osquery-python/git/trees{/sha}","statuses_url":"https://api.github.com/repos/osquery/osquery-python/statuses/{sha}","languages_url":"https://api.github.com/repos/osquery/osquery-python/languages","stargazers_url":"https://api.github.com/repos/osquery/osquery-python/stargazers","contributors_url":"https://api.github.com/repos/osquery/osquery-python/contributors","subscribers_url":"https://api.github.com/repos/osquery/osquery-python/subscribers","subscription_url":"https://api.github.com/repos/osquery/osquery-python/subscription","commits_url":"https://api.github.com/repos/osquery/osquery-python/commits{/sha}","git_commits_url":"https://api.github.com/repos/osquery/osquery-python/git/commits{/sha}","comments_url":"https://api.github.com/repos/osquery/osquery-python/comments{/number}","issue_comment_url":"https://api.github.com/repos/osquery/osquery-python/issues/comments{/number}","contents_url":"https://api.github.com/repos/osquery/osquery-python/contents/{+path}","compare_url":"https://api.github.com/repos/osquery/osquery-python/compare/{base}...{head}","merges_url":"https://api.github.com/repos/osquery/osquery-python/merges","archive_url":"https://api.github.com/repos/osquery/osquery-python/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/osquery/osquery-python/downloads","issues_url":"https://api.github.com/repos/osquery/osquery-python/issues{/number}","pulls_url":"https://api.github.com/repos/osquery/osquery-python/pulls{/number}","milestones_url":"https://api.github.com/repos/osquery/osquery-python/milestones{/number}","notifications_url":"https://api.github.com/repos/osquery/osquery-python/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/osquery/osquery-python/labels{/name}","releases_url":"https://api.github.com/repos/osquery/osquery-python/releases{/id}","deployments_url":"https://api.github.com/repos/osquery/osquery-python/deployments","created_at":"2015-04-29T21:29:00Z","updated_at":"2018-01-26T08:52:42Z","pushed_at":"2017-10-22T20:53:07Z","git_url":"git://github.com/osquery/osquery-python.git","ssh_url":"git@github.com:osquery/osquery-python.git","clone_url":"https://github.com/osquery/osquery-python.git","svn_url":"https://github.com/osquery/osquery-python","homepage":null,"size":113,"stargazers_count":78,"watchers_count":78,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":18,"mirror_url":null,"archived":false,"open_issues_count":8,"license":{"key":"bsd-3-clause","name":"BSD 3-Clause \"New\" or \"Revised\" License","spdx_id":"BSD-3-Clause","url":"https://api.github.com/licenses/bsd-3-clause"},"forks":18,"open_issues":8,"watchers":78,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48"},"html":{"href":"https://github.com/osquery/osquery-python/pull/48"},"issue":{"href":"https://api.github.com/repos/osquery/osquery-python/issues/48"},"comments":{"href":"https://api.github.com/repos/osquery/osquery-python/issues/48/comments"},"review_comments":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48/comments"},"review_comment":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48/commits"},"statuses":{"href":"https://api.github.com/repos/osquery/osquery-python/statuses/a48d937b079c38197d5ee0e9ff8152caa1b71128"}},"author_association":"NONE","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":18,"additions":281,"deletions":15,"changed_files":4}}
{"actor":{"display_login":"muffins"}}