< thor> Has there been any further decisions work on c++ ext osquery #windows

<@U0JT049S4> Has there been any further decisions/...

nobody 162

03/04/2019, 4:50 PM

@thor Has there been any further decisions/work on c++ extensions with buck? The extension I am looking at doing is going to use some c++ libs and it's obviously easier to link them into c++ than Go (or rewrite the functionality in Go)

thor

03/04/2019, 7:39 PM

Not that I know of 😕 I'm hoping to jump back into extensions here sometime soon, but right now I'm much more focused on just getting things back up and running for windows. Sorry that's not a great answer 😕 I think the bigger priority currently will be getting to a state where we have VS support for builds, or just more developer tools, so that we can enable folks to more rapidly iterate on things. I am really not sure of the state of extension building with the new build system

fmanco

03/05/2019, 12:45 AM

@akindyakov is working on this. He just landed a new target

sdk:plugin_sdk

which should allow you to build extensions using Buck. It was just landed and I'm not sure how complete it is so I'll let @akindyakov comment on that here.

akindyakov

03/05/2019, 9:44 AM

Yes, there is a new target

sdk:plugin_sdk

which include hopefully everything you need to build a C++ extension. Although, it is a bit unstable and include to many things from osquery itself (we gonna clean it up soon) it already stable enough and could be used. One important thing you should know - it doesn't include

osquery/extensions:impl_thrift

- it should be added separately. There is unit test for SDK API

sdk/tests:plugin_sdk_tests

, that is a simple example of how to use SDK. Does it make any sense for you?

😍 1

nobody 162

03/05/2019, 4:48 PM

Thanks for the replies. I gave it a go using the libs from those targets (and copying a bunch of headers that were required from all over the source) but I'm getting some unresolved symbols around areas like the RegistryFactory, SQLPlugin and Initializer. I took an extension that I had working before the change over to buck - with some modifications for changes such as TableRows. I'm looking through them now to make sure I've not done something stupid

nobody 162

03/06/2019, 2:21 PM

Ah nevermind I realised that the idea was that I should create a new BUCK file/build in the osquery area to build it. I managed to get it to work after that - as an aside is there a way to include libraries from a completely separate directory in buck? (i.e I either had to put a horrible relative path or copy a microsoft lib to include it)

nobody 162

03/06/2019, 5:39 PM

@akindyakov or @fmanco Is the accepted way to build extensions from within the osquery directories/environment? My first attempt was to try and build it in a separate area/solution to osquery...

akindyakov

03/07/2019, 1:26 PM

@nobody 162, yes there is a way to include other project on BUCK. If I get you right you can use cells for it. https://buckbuild.com/about/overview.html I'd be easier to help you if you have some diff of branch with your changes for me to have a look.

nobody 162

03/07/2019, 1:45 PM

@akindyakov Thanks for your help. I was trying to include libs from the Microsoft SDK (atls.lib) so I'm not sure cell would work in this case since it isn't a buck build...

akindyakov

03/07/2019, 1:46 PM

In this case you can try to do something we did for osquery third-party libraries - just create a target for you external lib. Does it make sense?

nobody 162

03/07/2019, 1:48 PM

Yeah, I wondered if that was going to be the answer. So just create a "dummy" target that just copies everything I need. Thanks

👍 1

Open in Slack

Previous Next