i think you can also use Beast as it has been imported into

Question

i think you can also use Beast as it has been imported into the third party folder

Rich5 · Answer

I started working on the curl extension and as a test I tried to just include the existing http client into the example extension code Adding include osquery remote http client h to the file was the only change I then compiled it with make external and I get an linker error like this usr local osquery bin ld lld error undefined symbol SSL library init gt gt gt referenced by openssl init ipp 40 usr local osquery include boost asio ssl detail impl openssl init ipp 40 gt gt gt home zaphod osquery build bionic cache Thin 37287b tmp o boost asio ssl detail openssl init base instance usr local osquery bin ld lld error undefined symbol SSL load error strings gt gt gt referenced by openssl init ipp 41 usr local osquery include boost asio ssl detail impl openssl init ipp 41 gt gt gt home zaphod osquery build bionic cache Thin 37287b tmp o boost asio ssl detail openssl init base instance usr local osquery bin ld lld error undefined symbol SSL COMP free compression methods gt gt gt referenced by openssl init ipp 84 usr local osquery include boost asio ssl detail impl openssl init ipp 84 gt gt gt home zaphod osquery build bionic cache Thin 37287b tmp o boost asio ssl detail openssl init base do init ~do init clang 6 0 error linker command failed with exit code 1 use v to see invocation

Rich5 · Answer

have you ever seen this happen when making extensions

alessandrogario · Answer

boost is not being linked

alessandrogario · Answer

err sorry openssl

alessandrogario · Answer

extensions don t inherit all the libs that osquery uses

Rich5 · Answer

any ideas why

alessandrogario · Answer

but you can link to them as they are inside usr local osquery lib

Rich5 · Answer

seems like make should link those I thought

alessandrogario · Answer

yeah it s normal the CMake project is not importing those libs

alessandrogario · Answer

well extensions are new executables so CMake doesn t have to export osquery libs to extensions

Rich5 · Answer

so do I just include that in my own CMake file for the extension

alessandrogario · Answer

i m not even sure they have been marked PUBLIC

alessandrogario · Answer

yeah

alessandrogario · Answer

if you are using our new CMake code bundling

Rich5 · Answer

I see I m not the best with make files so I ll have to figure that out

alessandrogario · Answer

you can use new style target link libraries target PRIVATE usr local osquery lib ssl

alessandrogario · Answer

you can just look at the CMake files

alessandrogario · Answer

the Makefile stuff is just a wrapper

alessandrogario · Answer

around CMake

Rich5 · Answer

something like this <https github com trailofbits osquery extensions blob master efigy CMakeLists txt L33>

alessandrogario · Answer

alessandrogario · Answer

search for the ssl lib in usr local osquery lib and use that name

alessandrogario · Answer

you can use the full path to really make sure to reference the osquery one rather than the system one if present

Rich5 · Answer

ok cool I ll give that a shot Thanks

Rich5 · Answer

cmake minimum required VERSION 3 10 project web request function main set project source files web request cpp add library $ PROJECT NAME STATIC $ project source files target link libraries $ PROJECT NAME PRIVATE usr local osquery lib libssl a endfunction main

Rich5 · Answer

added that and it seems to compile and link Does that seem right

Rich5 · Answer

nevermind something s not right

alessandrogario · Answer

extensions are executable so you can t use add library and you also have to use the osquery wrappers

alessandrogario · Answer

have a look at the cmake in our repo

Rich5 · Answer

looking through it now

alessandrogario · Answer

that is for extension bundling

alessandrogario · Answer

let me find you and example for a standalone extension

alessandrogario · Answer

alessandrogario · Answer

line 36

Rich5 · Answer

ok that s a little more clear to me

Rich5 · Answer

do I then add target link libraries $ PROJECT NAME usr local osquery lib libssl a

Rich5 · Answer

or do I need the add subdirectory etc

Rich5 · Answer

what s not clear is how much the osquery wrapper takes care of

alessandrogario · Answer

I m back

alessandrogario · Answer

so you can just create a subfolder named extension yourname and symlink it inside osquery external

alessandrogario · Answer

then just use the add osquery extension call i linked

alessandrogario · Answer

the last one at line 36

alessandrogario · Answer

after that call you can just add additional libraries

alessandrogario · Answer

sorry but I only have a phone with me

Rich5 · Answer

no problem I really appreciate the help

Rich5 · Answer

Where I m at now is a different linker error So I assume I m missing a lib somewhere usr local osquery bin ld lld error undefined symbol osquery Uri Uri std 1 basic string lt char std 1 char traits lt char gt std 1 allocator lt char gt gt const amp gt gt gt referenced by http client h 313 home zaphod osquery osquery remote http client h 313 gt gt gt home zaphod osquery build bionic cache Thin 59c554 tmp o WebRequestTablePlugin generate osquery QueryContext amp usr local osquery bin ld lld error undefined symbol osquery http Client closeSocket gt gt gt referenced by http client h 237 home zaphod osquery osquery remote http client h 237 gt gt gt home zaphod osquery build bionic cache Thin 59c554 tmp o osquery http Client ~Client clang 6 0 error linker command failed with exit code 1 use v to see invocation

Rich5 · Answer

since I m trying to copy the curl cpp code I included the http client h and then tried to use the same methods as the curl cpp table

Rich5 · Answer

osquery http Client client osquery http Response response osquery http Request request <http www google com>

Rich5 · Answer

but the linker error is from inside the http client code

alessandrogario · Answer

if it is using the boost beast stuff both the h and cpp needs to be included

alessandrogario · Answer

from third party folder

Rich5 · Answer

I thought the http client h did that though

Rich5 · Answer

or do I need to add and includes directory in the makefile

alessandrogario · Answer

yeah you have to add them to the cmake file

alessandrogario · Answer

uhm if curl is enough maybe just use that

alessandrogario · Answer

i thought it was easier to call the osquery http helpers from the extensions

Rich5 · Answer

I thought so too I may end up just using curl if this doesn t work tomorrow neutral face

Rich5 · Answer

Honestly it s probably just my inexperience will osquery I m still learning the ends and outs of how it all pieces together