{"action":"created","comment":{"url":"https://api.github.com/repos/osquery/osquery-python/pulls/comments/168837376","pull_request_review_id":97018030,"id":168837376,"diff_hunk":"@@ -0,0 +1,222 @@\n+\"\"\"This source code is licensed under the BSD-style license found in the\n+LICENSE file in the root directory of this source tree. An additional grant\n+of patent rights can be found in the PATENTS file in the same directory.\n+\"\"\"\n+\n+from __future__ import absolute_import\n+from __future__ import division\n+from __future__ import print_function\n+from __future__ import unicode_literals\n+\n+import win32event\n+import win32pipe\n+import win32file\n+import win32api\n+import winerror\n+import pywintypes\n+\n+from thrift.transport.TTransport import TTransportBase\n+from thrift.transport.TTransport import TTransportException\n+from thrift.transport.TTransport import TServerTransportBase\n+\n+\n+class TPipeBase(TTransportBase):\n+    \"\"\"Base class for Windows TPipe transport\"\"\"\n+\n+    def __init__(self):\n+        self._handle = None\n+\n+    def close(self):\n+        \"\"\"\n+        Generic close method, as both server and client rely on closing pipes\n+        in the same way\n+        \"\"\"\n+        if self._handle is not None:\n+            win32pipe.DisconnectNamedPipe(self._handle)\n+            self._handle = None\n+\n+\n+class TPipe(TPipeBase):\n+    \"\"\"Client for communicating over Named Pipes\"\"\"\n+\n+    def __init__(self, pipeName, timeout=5, maxAttempts=5):\n+        \"\"\"\n+        Initialize a TPipe client\n+\n+        @param pipeName(string)  The path of the pipe to connect to.\n+        @param timeout(int)  The time to wait for a named pipe connection.\n+        @param maxAttempts(int)  Maximum number of connection attempts.\n+        \"\"\"\n+        self._handle = None\n+        self._pipeName = pipeName\n+        self._timeout = timeout\n+        self._maxConnAttempts = maxAttempts\n+\n+    def setHandle(self, h):\n+        self._handle = h\n+\n+    def isOpen(self):\n+        return self._handle is not None\n+\n+    def open(self):\n+        if self.isOpen():\n+            raise TTransportException(TTransportException.ALREADY_OPEN)\n+\n+        h = None\n+        conns = 0\n+        while conns < self._maxConnAttempts:\n+            try:\n+                h = win32file.CreateFile(\n+                    self._pipeName,\n+                    win32file.GENERIC_READ | win32file.GENERIC_WRITE, 0, None,","path":"osquery/TPipe.py","position":71,"original_position":71,"commit_id":"05f2c88f16fce1ed7dbb0a18f80363bf61fcedda","original_commit_id":"05f2c88f16fce1ed7dbb0a18f80363bf61fcedda","user":{"login":"friedbutter","id":6203418,"avatar_url":"https://avatars1.githubusercontent.com/u/6203418?v=4","gravatar_id":"","url":"https://api.github.com/users/friedbutter","html_url":"https://github.com/friedbutter","followers_url":"https://api.github.com/users/friedbutter/followers","following_url":"https://api.github.com/users/friedbutter/following{/other_user}","gists_url":"https://api.github.com/users/friedbutter/gists{/gist_id}","starred_url":"https://api.github.com/users/friedbutter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/friedbutter/subscriptions","organizations_url":"https://api.github.com/users/friedbutter/orgs","repos_url":"https://api.github.com/users/friedbutter/repos","events_url":"https://api.github.com/users/friedbutter/events{/privacy}","received_events_url":"https://api.github.com/users/friedbutter/received_events","type":"User","site_admin":false},"body":"Ideally each param is a new line.","created_at":"2018-02-16T18:40:01Z","updated_at":"2018-02-16T18:52:26Z","html_url":"https://github.com/osquery/osquery-python/pull/48#discussion_r168837376","pull_request_url":"https://api.github.com/repos/osquery/osquery-python/pulls/48","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/comments/168837376"},"html":{"href":"https://github.com/osquery/osquery-python/pull/48#discussion_r168837376"},"pull_request":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48"}}},"pull_request":{"url":"https://api.github.com/repos/osquery/osquery-python/pulls/48","id":166411415,"html_url":"https://github.com/osquery/osquery-python/pull/48","diff_url":"https://github.com/osquery/osquery-python/pull/48.diff","patch_url":"https://github.com/osquery/osquery-python/pull/48.patch","issue_url":"https://api.github.com/repos/osquery/osquery-python/issues/48","number":48,"state":"open","locked":false,"title":"Adding Python extensions support for Windows","user":{"login":"muffins","id":1328916,"avatar_url":"https://avatars1.githubusercontent.com/u/1328916?v=4","gravatar_id":"","url":"https://api.github.com/users/muffins","html_url":"https://github.com/muffins","followers_url":"https://api.github.com/users/muffins/followers","following_url":"https://api.github.com/users/muffins/following{/other_user}","gists_url":"https://api.github.com/users/muffins/gists{/gist_id}","starred_url":"https://api.github.com/users/muffins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffins/subscriptions","organizations_url":"https://api.github.com/users/muffins/orgs","repos_url":"https://api.github.com/users/muffins/repos","events_url":"https://api.github.com/users/muffins/events{/privacy}","received_events_url":"https://api.github.com/users/muffins/received_events","type":"User","site_admin":false},"body":"This adds in an implementation of TPipe for windows, which allows us to make use of Python extensions on the Windows platform.\r\n\r\nSome samples of the extensions in action. First we startup osquery:\r\n```\r\n:\\Users\\Nick\\work\\repos\\osquery [win-python-auto-ext]\r\nλ  .\\build\\windows10\\osquery\\RelWithDebInfo\\osqueryd.exe -S --flagfile=C:\\Users\\Nick\\work\\configs\\osquery_extensions\\osquery.flags --verbose\r\n```\r\nThen we start up our extension:\r\n```\r\nC:\\Users\\Nick\\work\\repos\\osquery-python [osquery-python-windows-port +1 ~0 -0 !]\r\nλ  python .\\foobar_table.ext --socket \\\\.\\pipe\\shell.em --verbose\r\n```\r\nWe see the extension connect to our shell:\r\n```\r\nI0131 16:07:10.660527  4272 init.cpp:380] osquery initialized [version=3.0.0-17-g10c0c60b]\r\nI0131 16:07:10.663009  4272 rocksdb.cpp:132] Opening RocksDB handle: C:\\Users\\Nick\\work\\configs\\osquery_extensions\\osquery.db\r\nI0131 16:07:10.725503 22132 interface.cpp:338] Extension manager service starting: \\\\.\\pipe\\shell.em\r\nI0131 16:07:10.741130 21252 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109\r\nI0131 16:07:10.741130 21252 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed\r\nI0131 16:07:10.741130  5972 interface.cpp:89] Thrift message: TPipe ::GetOverlappedResult errored GLE=errno = 109\r\nI0131 16:07:10.741130  5972 interface.cpp:89] Thrift message: TConnectedClient died: TPipe: GetOverlappedResult failed\r\nUsing a I0131 16:07:11.811651 25176 events.cpp:746] Starting event publisher run loop: windows_event_log\r\nvirtual database. Need help, type '.help'\r\nosquery> I0131 16:07:12.191326  8460 interface.cpp:141] Registering extension (foobar_table, 29953, version=1.0.0, sdk=1.8.0)\r\nI0131 16:07:12.191326  8460 registry.cpp:351] Extension 29953 registered table plugin foobar\r\n```\r\nWe then query the extension:\r\n```\r\nosquery> select * from foobar;\r\n+-----+-----+\r\n| foo | baz |\r\n+-----+-----+\r\n| bar | baz |\r\n| bar | baz |\r\n+-----+-----+\r\n```\r\n\r\nSo far I have tested extensions being autloaded with osquery, which currently works from both command line and running as a system service. I tested having a python extension that both provides data to, and queries data from osquery, and this didn't seem to work. I'm still digging into what's happening to prevent bidirectional communication, but throwing this up to get the review process started.","created_at":"2018-02-01T00:10:01Z","updated_at":"2018-02-16T18:52:26Z","closed_at":null,"merged_at":null,"merge_commit_sha":"06ef81298dd6730fd3f35c45e3dbb1b397256a25","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":561622722,"url":"https://api.github.com/repos/osquery/osquery-python/labels/Windows","name":"Windows","color":"0052cc","default":false},{"id":828341706,"url":"https://api.github.com/repos/osquery/osquery-python/labels/ready%20for%20review","name":"ready for review","color":"f98b66","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/osquery/osquery-python/pulls/48/commits","review_comments_url":"https://api.github.com/repos/osquery/osquery-python/pulls/48/comments","review_comment_url":"https://api.github.com/repos/osquery/osquery-python/pulls/comments{/number}","comments_url":"https://api.github.com/repos/osquery/osquery-python/issues/48/comments","statuses_url":"https://api.github.com/repos/osquery/osquery-python/statuses/05f2c88f16fce1ed7dbb0a18f80363bf61fcedda","head":{"label":"muffins:osquery-python-windows-port","ref":"osquery-python-windows-port","sha":"05f2c88f16fce1ed7dbb0a18f80363bf61fcedda","user":{"login":"muffins","id":1328916,"avatar_url":"https://avatars1.githubusercontent.com/u/1328916?v=4","gravatar_id":"","url":"https://api.github.com/users/muffins","html_url":"https://github.com/muffins","followers_url":"https://api.github.com/users/muffins/followers","following_url":"https://api.github.com/users/muffins/following{/other_user}","gists_url":"https://api.github.com/users/muffins/gists{/gist_id}","starred_url":"https://api.github.com/users/muffins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffins/subscriptions","organizations_url":"https://api.github.com/users/muffins/orgs","repos_url":"https://api.github.com/users/muffins/repos","events_url":"https://api.github.com/users/muffins/events{/privacy}","received_events_url":"https://api.github.com/users/muffins/received_events","type":"User","site_admin":false},"repo":{"id":66449989,"name":"osquery-python","full_name":"muffins/osquery-python","owner":{"login":"muffins","id":1328916,"avatar_url":"https://avatars1.githubusercontent.com/u/1328916?v=4","gravatar_id":"","url":"https://api.github.com/users/muffins","html_url":"https://github.com/muffins","followers_url":"https://api.github.com/users/muffins/followers","following_url":"https://api.github.com/users/muffins/following{/other_user}","gists_url":"https://api.github.com/users/muffins/gists{/gist_id}","starred_url":"https://api.github.com/users/muffins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/muffins/subscriptions","organizations_url":"https://api.github.com/users/muffins/orgs","repos_url":"https://api.github.com/users/muffins/repos","events_url":"https://api.github.com/users/muffins/events{/privacy}","received_events_url":"https://api.github.com/users/muffins/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/muffins/osquery-python","description":"python bindings for osquery","fork":true,"url":"https://api.github.com/repos/muffins/osquery-python","forks_url":"https://api.github.com/repos/muffins/osquery-python/forks","keys_url":"https://api.github.com/repos/muffins/osquery-python/keys{/key_id}","collaborators_url":"https://api.github.com/repos/muffins/osquery-python/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/muffins/osquery-python/teams","hooks_url":"https://api.github.com/repos/muffins/osquery-python/hooks","issue_events_url":"https://api.github.com/repos/muffins/osquery-python/issues/events{/number}","events_url":"https://api.github.com/repos/muffins/osquery-python/events","assignees_url":"https://api.github.com/repos/muffins/osquery-python/assignees{/user}","branches_url":"https://api.github.com/repos/muffins/osquery-python/branches{/branch}","tags_url":"https://api.github.com/repos/muffins/osquery-python/tags","blobs_url":"https://api.github.com/repos/muffins/osquery-python/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/muffins/osquery-python/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/muffins/osquery-python/git/refs{/sha}","trees_url":"https://api.github.com/repos/muffins/osquery-python/git/trees{/sha}","statuses_url":"https://api.github.com/repos/muffins/osquery-python/statuses/{sha}","languages_url":"https://api.github.com/repos/muffins/osquery-python/languages","stargazers_url":"https://api.github.com/repos/muffins/osquery-python/stargazers","contributors_url":"https://api.github.com/repos/muffins/osquery-python/contributors","subscribers_url":"https://api.github.com/repos/muffins/osquery-python/subscribers","subscription_url":"https://api.github.com/repos/muffins/osquery-python/subscription","commits_url":"https://api.github.com/repos/muffins/osquery-python/commits{/sha}","git_commits_url":"https://api.github.com/repos/muffins/osquery-python/git/commits{/sha}","comments_url":"https://api.github.com/repos/muffins/osquery-python/comments{/number}","issue_comment_url":"https://api.github.com/repos/muffins/osquery-python/issues/comments{/number}","contents_url":"https://api.github.com/repos/muffins/osquery-python/contents/{+path}","compare_url":"https://api.github.com/repos/muffins/osquery-python/compare/{base}...{head}","merges_url":"https://api.github.com/repos/muffins/osquery-python/merges","archive_url":"https://api.github.com/repos/muffins/osquery-python/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/muffins/osquery-python/downloads","issues_url":"https://api.github.com/repos/muffins/osquery-python/issues{/number}","pulls_url":"https://api.github.com/repos/muffins/osquery-python/pulls{/number}","milestones_url":"https://api.github.com/repos/muffins/osquery-python/milestones{/number}","notifications_url":"https://api.github.com/repos/muffins/osquery-python/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/muffins/osquery-python/labels{/name}","releases_url":"https://api.github.com/repos/muffins/osquery-python/releases{/id}","deployments_url":"https://api.github.com/repos/muffins/osquery-python/deployments","created_at":"2016-08-24T09:18:21Z","updated_at":"2016-08-24T09:18:22Z","pushed_at":"2018-02-06T06:23:04Z","git_url":"git://github.com/muffins/osquery-python.git","ssh_url":"git@github.com:muffins/osquery-python.git","clone_url":"https://github.com/muffins/osquery-python.git","svn_url":"https://github.com/muffins/osquery-python","homepage":null,"size":132,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"osquery:master","ref":"master","sha":"e40c092df126790e640253944b39cbc77aa3055b","user":{"login":"osquery","id":8315868,"avatar_url":"https://avatars1.githubusercontent.com/u/8315868?v=4","gravatar_id":"","url":"https://api.github.com/users/osquery","html_url":"https://github.com/osquery","followers_url":"https://api.github.com/users/osquery/followers","following_url":"https://api.github.com/users/osquery/following{/other_user}","gists_url":"https://api.github.com/users/osquery/gists{/gist_id}","starred_url":"https://api.github.com/users/osquery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/osquery/subscriptions","organizations_url":"https://api.github.com/users/osquery/orgs","repos_url":"https://api.github.com/users/osquery/repos","events_url":"https://api.github.com/users/osquery/events{/privacy}","received_events_url":"https://api.github.com/users/osquery/received_events","type":"Organization","site_admin":false},"repo":{"id":34819313,"name":"osquery-python","full_name":"osquery/osquery-python","owner":{"login":"osquery","id":8315868,"avatar_url":"https://avatars1.githubusercontent.com/u/8315868?v=4","gravatar_id":"","url":"https://api.github.com/users/osquery","html_url":"https://github.com/osquery","followers_url":"https://api.github.com/users/osquery/followers","following_url":"https://api.github.com/users/osquery/following{/other_user}","gists_url":"https://api.github.com/users/osquery/gists{/gist_id}","starred_url":"https://api.github.com/users/osquery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/osquery/subscriptions","organizations_url":"https://api.github.com/users/osquery/orgs","repos_url":"https://api.github.com/users/osquery/repos","events_url":"https://api.github.com/users/osquery/events{/privacy}","received_events_url":"https://api.github.com/users/osquery/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/osquery/osquery-python","description":"python bindings for osquery","fork":false,"url":"https://api.github.com/repos/osquery/osquery-python","forks_url":"https://api.github.com/repos/osquery/osquery-python/forks","keys_url":"https://api.github.com/repos/osquery/osquery-python/keys{/key_id}","collaborators_url":"https://api.github.com/repos/osquery/osquery-python/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/osquery/osquery-python/teams","hooks_url":"https://api.github.com/repos/osquery/osquery-python/hooks","issue_events_url":"https://api.github.com/repos/osquery/osquery-python/issues/events{/number}","events_url":"https://api.github.com/repos/osquery/osquery-python/events","assignees_url":"https://api.github.com/repos/osquery/osquery-python/assignees{/user}","branches_url":"https://api.github.com/repos/osquery/osquery-python/branches{/branch}","tags_url":"https://api.github.com/repos/osquery/osquery-python/tags","blobs_url":"https://api.github.com/repos/osquery/osquery-python/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/osquery/osquery-python/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/osquery/osquery-python/git/refs{/sha}","trees_url":"https://api.github.com/repos/osquery/osquery-python/git/trees{/sha}","statuses_url":"https://api.github.com/repos/osquery/osquery-python/statuses/{sha}","languages_url":"https://api.github.com/repos/osquery/osquery-python/languages","stargazers_url":"https://api.github.com/repos/osquery/osquery-python/stargazers","contributors_url":"https://api.github.com/repos/osquery/osquery-python/contributors","subscribers_url":"https://api.github.com/repos/osquery/osquery-python/subscribers","subscription_url":"https://api.github.com/repos/osquery/osquery-python/subscription","commits_url":"https://api.github.com/repos/osquery/osquery-python/commits{/sha}","git_commits_url":"https://api.github.com/repos/osquery/osquery-python/git/commits{/sha}","comments_url":"https://api.github.com/repos/osquery/osquery-python/comments{/number}","issue_comment_url":"https://api.github.com/repos/osquery/osquery-python/issues/comments{/number}","contents_url":"https://api.github.com/repos/osquery/osquery-python/contents/{+path}","compare_url":"https://api.github.com/repos/osquery/osquery-python/compare/{base}...{head}","merges_url":"https://api.github.com/repos/osquery/osquery-python/merges","archive_url":"https://api.github.com/repos/osquery/osquery-python/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/osquery/osquery-python/downloads","issues_url":"https://api.github.com/repos/osquery/osquery-python/issues{/number}","pulls_url":"https://api.github.com/repos/osquery/osquery-python/pulls{/number}","milestones_url":"https://api.github.com/repos/osquery/osquery-python/milestones{/number}","notifications_url":"https://api.github.com/repos/osquery/osquery-python/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/osquery/osquery-python/labels{/name}","releases_url":"https://api.github.com/repos/osquery/osquery-python/releases{/id}","deployments_url":"https://api.github.com/repos/osquery/osquery-python/deployments","created_at":"2015-04-29T21:29:00Z","updated_at":"2018-02-11T21:05:37Z","pushed_at":"2018-02-06T06:23:05Z","git_url":"git://github.com/osquery/osquery-python.git","ssh_url":"git@github.com:osquery/osquery-python.git","clone_url":"https://github.com/osquery/osquery-python.git","svn_url":"https://github.com/osquery/osquery-python","homepage":null,"size":113,"stargazers_count":87,"watchers_count":87,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":19,"mirror_url":null,"archived":false,"open_issues_count":9,"license":{"key":"bsd-3-clause","name":"BSD 3-Clause \"New\" or \"Revised\" License","spdx_id":"BSD-3-Clause","url":"https://api.github.com/licenses/bsd-3-clause"},"forks":19,"open_issues":9,"watchers":87,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48"},"html":{"href":"https://github.com/osquery/osquery-python/pull/48"},"issue":{"href":"https://api.github.com/repos/osquery/osquery-python/issues/48"},"comments":{"href":"https://api.github.com/repos/osquery/osquery-python/issues/48/comments"},"review_comments":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48/comments"},"review_comment":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/osquery/osquery-python/pulls/48/commits"},"statuses":{"href":"https://api.github.com/repos/osquery/osquery-python/statuses/05f2c88f16fce1ed7dbb0a18f80363bf61fcedda"}},"author_association":"NONE"}}
{"actor":{"display_login":"friedbutter"}}