Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix last_connected column in wifi_networks on Catalina #6669

Merged
merged 8 commits into from
Oct 21, 2020

Conversation

mike-myers-tob
Copy link
Member

I've added a macOS version check, and if the version is 10.15 or above, it references a changed key name for the field in the plist that fills the last_connected column, restoring the functionality of that column.

Related to #6235

@mike-myers-tob mike-myers-tob added macOS Big Sur For things pertaining to macOS 11.0 macOS Catalina For things pertaining to macOS 10.15 networking virtual tables labels Sep 24, 2020
@mike-myers-tob mike-myers-tob marked this pull request as ready for review October 21, 2020 06:48
@mike-myers-tob
Copy link
Member Author

mike-myers-tob commented Oct 21, 2020

For a reason I don't understand, the code to get the OS version behaves differently in the test, even though it works when running osquery directly. Is there a "registry" of resources in osquery that is not set up properly by the test logic, to allow the wifi_networks table to call another table?

auto qd = SQL::selectAllFrom("os_version");
     if (qd.size() != 1) {
       return Status(-1, "Couldn't determine macOS version");
     }

When running the test, qd is empty and the output includes

E1021 01:54:26.953287 19328448 registry_factory.cpp:179] table registry os_version plugin caused exception: Unknown registry requested: table

@mike-myers-tob
Copy link
Member Author

I figured it out, there is some undocumented setup that needs to be done in the test files.

We gotta document this stuff. 😤


// Adjust the keys to read, based on the version of macOS
Status getKnownWifiNetworkKeys(std::map<std::string, std::string>& keys) {
auto qd = SQL::selectAllFrom("os_version");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like this approach but I see it used in several other places so we can follow up and fix this later.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a table with one row in this case, but I can see it has been a performance problem in other cases in the past?

@theopolis theopolis merged commit 22d614c into osquery:master Oct 21, 2020
@mike-myers-tob mike-myers-tob deleted the fix-macos-wifi-columns branch October 21, 2020 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
macOS Big Sur For things pertaining to macOS 11.0 macOS Catalina For things pertaining to macOS 10.15 networking virtual tables
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants