Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Table for Win32_Tpm class #7107

Merged
merged 8 commits into from
Jul 24, 2021
Merged

Conversation

skepth
Copy link
Contributor

@skepth skepth commented May 14, 2021

This PR adds support for Win32_Tpm WMI class that would help identify TPM related information on windows machines.

Win32_Tpm class is available on all versions of Windows after Vista on clients and Server 2008 on servers, so we should get good coverage here.

Sample output:
win32_tpm

Reference: Microsoft's doc

Note: I've noticed that the integration tests for all wmi tables are commented out for the most part and I stuck to the same pattern. Please let me know if its sufficient or not.

Fixes: #7187

@skepth skepth requested review from a team as code owners May 14, 2021 18:22
@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented May 14, 2021

CLA Signed

The committers are authorized under a signed CLA.

@Smjert
Copy link
Member

Smjert commented May 14, 2021

Note: I've noticed that the integration tests for all wmi tables are commented out for the most part and I stuck to the same pattern. Please let me know if its sufficient or not.

Welcome!
And thank you for the contribution; the tests have mostly commented out code only because they are not implemented yet (but we would definitely want to have them!).

The comment is showing an idea of what it can be tested. Normally these kind of tests aim to verify that the table is able to retrieve some data, that the format of the columns and the general type/category of data is the one expected.

When possible we always welcome tests that validate the actual data; though I believe in this specific case it might be a bit difficult to verify if every column reports a very specific information, given that it might vary depending on where it's run.

@skepth
Copy link
Contributor Author

skepth commented May 17, 2021

When possible we always welcome tests that validate the actual data; though I believe in this specific case it might be a bit difficult to verify if every column reports a very specific information, given that it might vary depending on where it's run.

Oh cool. Thanks for clarifying that for me :)

Copy link
Member

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be named tpm_info? Is this information we can (eventually) gather for other platforms? Is there a non-WMI mechanism for windows?

specs/windows/wmi_tpm_info.table Outdated Show resolved Hide resolved
specs/windows/wmi_tpm_info.table Outdated Show resolved Hide resolved
specs/windows/wmi_tpm_info.table Outdated Show resolved Hide resolved
tests/integration/tables/wmi_tpm_info.cpp Outdated Show resolved Hide resolved
osquery/tables/system/windows/wmi_tpm_info.cpp Outdated Show resolved Hide resolved
@Smjert
Copy link
Member

Smjert commented Jun 30, 2021

@skepth There was a simple merge conflict against master which I fixed, though there's more work to do (currently, formatting the code).
Are you still working on this?

@skepth
Copy link
Contributor Author

skepth commented Jun 30, 2021

@skepth There was a simple merge conflict against master which I fixed, though there's more work to do (currently, formatting the code).
Are you still working on this?

Thanks for fixing the merge conflict. I re-formatted the code & it should pass the code style check.

@csmarin
Copy link

csmarin commented Jul 8, 2021

Powershell Get-Tpm is another way to pull TPM information status from an endpoint, but it depends on whether TPM Module is available or not. WMI is and remains the best way to query TPM details, so please add them in a new "tpm_info" table in the schema.

@directionless
Copy link
Member

Powershell Get-Tpm is another way to pull TPM information status from an endpoint, but it depends on whether TPM Module is available or not. WMI is and remains the best way to query TPM details, so please add them in a new "tpm_info" table in the schema.

I'm not sure what to make of this request? This PR seems reasonable to me. The underlying WMI is a good API. osquery is not going to exec out to powershell.

@csmarin
Copy link

csmarin commented Jul 8, 2021

Powershell Get-Tpm is another way to pull TPM information status from an endpoint, but it depends on whether TPM Module is available or not. WMI is and remains the best way to query TPM details, so please add them in a new "tpm_info" table in the schema.

I'm not sure what to make of this request? This PR seems reasonable to me. The underlying WMI is a good API. osquery is not going to exec out to powershell.

I was not suggesting to use PS. It was just to suggest another alternative to query the same information, I actually believe even PS wraps around WMI eventually. I am not requesting anything, but to have this tpm_info. I don't really care eventually how TPM is pulled into it, but it's needed.

Copy link
Member

@directionless directionless left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks okay to me. A couple of nits. I'll let some the c folks comment


QueryData genTpmInfo(QueryContext& context) {
QueryData resultsdata;
std::string wmiclass{"SELECT * FROM Win32_Tpm"};
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can/should this be a constant?

QueryData resultsdata;
std::string wmiclass{"SELECT * FROM Win32_Tpm"};

BSTR wminamespace = ::SysAllocString(L"root\\cimv2\\Security\\MicrosoftTpm");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ca/should the namespace string be a constant?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BSTRs are a special system type, unfortunately although they're typedef'd to wchar_t *. They should always be allocated with SysAllocString and freed with SysFreeString. BSTRs use a different memory allocator, even (https://docs.microsoft.com/en-us/previous-versions/windows/desktop/automat/bstr).

@directionless directionless added this to the 5.0.0 milestone Jul 11, 2021
Copy link
Contributor

@farfella farfella left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@theopolis theopolis merged commit 672b9df into osquery:master Jul 24, 2021
sharvilshah pushed a commit to sharvilshah/osquery that referenced this pull request Aug 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

TPM Information in a new Table in Schema
6 participants