Extension cannot connect on first try when loaded automatically
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 433
- Forks
- 89
- PR merge metrics
- No merged PRs in 30d
Description
Context
osquery 4.2
Windows 10 Pro 64bit
Test extension
package main
import (
"context"
"flag"
"log"
"github.com/kolide/osquery-go"
"github.com/kolide/osquery-go/plugin/table"
)
func main() {
flSocket := flag.String("socket", "", "")
flag.Int("timeout", 0, "")
flag.Int("interval", 0, "")
flag.Bool("verbose", false, "")
flag.Parse()
if *flSocket == "" {
log.Fatalln("--socket flag cannot be empty")
}
server, err := osquery.NewExtensionManagerServer("dev_extension", *flSocket)
if err != nil {
log.Fatalf("Error creating osquery extension server: %s\n", err)
}
server.RegisterPlugin(
table.NewPlugin(
"test_table",
[]table.ColumnDefinition{
table.TextColumn("foo"),
},
func(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
return []map[string]string{
map[string]string{
"foo": "bar",
},
}, nil
},
),
)
if err := server.Run(); err != nil {
log.Fatal(err)
}
}
Running the above test extension with .\osqueryi.exe --allow_unsafe --extension=.\extension.exe will throw an error registering extension: i/o timeout. Then about a minute later the extension will connect successfully.
Adding a time.Sleep(1 * time.Second) to the beginning of the extension will make it connect on the first try instead.
Similar behavior happens when the extension is run via the extensions.load file.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with osqueryi.exe --allow_unsafe --extension=.\extension.exe and the provided Go test extension, then compare startup with and without the one-second sleep. Check the extension manager setup and server.Run entry point, and also test loading through the extensions.load file; done means the extension connects successfully on the first attempt in both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100