コード例 #1
0
ファイル: interface_ip.cpp プロジェクト: FritzX6/osquery
QueryData genInterfaceIpv6(QueryContext& context) {
  QueryData results;
  for (const auto& iface : genInterfaceDetails(context)) {
    genIpv6FromIntf(iface.at("interface"), results);
  }
  return results;
}
コード例 #2
0
ファイル: arp_cache.cpp プロジェクト: PoppySeedPlehzr/osquery
QueryData genIPv4ArpCache(QueryContext& context) {
  QueryData results;
  QueryData interfaces = genInterfaceDetails(context);
  WmiRequest wmiSystemReq("select * from MSFT_NetNeighbor",
                          (BSTR)L"ROOT\\StandardCimv2");
  std::vector<WmiResultItem>& wmiResults = wmiSystemReq.results();
  std::map<long, std::string> mapOfInterfaces = {
      {1, ""}, // loopback
  };
  unsigned short usiPlaceHolder;
  unsigned char cPlaceHolder;
  unsigned int uiPlaceHolder;
  std::string strPlaceHolder;

  for (const auto& iface : interfaces) {
    long interfaceIndex;
    if (iface.count("interface") > 0) {
      safeStrtol(iface.at("interface"), 10, interfaceIndex);
      std::string macAddress = iface.at("mac");

      mapOfInterfaces.insert(std::make_pair(interfaceIndex, macAddress));
    }
  }
  for (const auto& item : wmiResults) {
    Row r;
    item.GetUnsignedShort("AddressFamily", usiPlaceHolder);
    r["address_family"] = SQL_TEXT(kMapOfAddressFamily.at(usiPlaceHolder));
    item.GetUChar("Store", cPlaceHolder);
    r["store"] = SQL_TEXT(kMapOfStore.at(cPlaceHolder));
    item.GetUChar("State", cPlaceHolder);
    r["state"] = SQL_TEXT(kMapOfState.at(cPlaceHolder));
    item.GetUnsignedInt32("InterfaceIndex", uiPlaceHolder);
    r["interface"] = SQL_TEXT(mapOfInterfaces.at(uiPlaceHolder));
    item.GetString("IPAddress", r["ip_address"]);
    item.GetString("InterfaceAlias", r["interface_alias"]);
    item.GetString("LinkLayerAddress", strPlaceHolder);
    r["link_layer_address"] =
        SQL_TEXT(boost::replace_all_copy(strPlaceHolder, "-", ":"));

    results.push_back(r);
  }

  return results;
}