* ETW name and options functionality
Added functionality to set the event (task) name and options (such as
event or associated event ID) for ETW events created by the hook based
on the logrus.Entry fields.
Signed-off-by: Hamza El-Saawy <hamzaelsaawy@microsoft.com>
* PR: export and comment
Signed-off-by: Hamza El-Saawy <hamzaelsaawy@microsoft.com>
pkg/guid is not windows specific, as it can run on Linux.
Build constraints on guid_windows and guid_nonwindows are redundant with
file names, but added for consistency.
Added missing build constraints.
Added Ubuntu to test matrix, along with windows 2022.
Signed-off-by: Hamza El-Saawy <hamzaelsaawy@microsoft.com>
Since Go version 1.13, the standard library has built-in support for
wrapping and unwrapping of error values. This commit bumps the minimum
version required by the module from 1.12 to 1.13, replaces all calls to
errors.Wrap/f with fmt.Errorf and removes the now unneeded dependency on
github.com/pkg/errors.
Signed-off-by: Michael Hofmann <michael.hofmann@bitgestalt.com>
These packages had incorrect error handling for their generated syscall
bindings. The functions they were calling returned errors directly, but
the binding was written such that the generated code was calling
GetLastError instead.
Thankfully, this did not affect the detection of whether or not an error
had occurred, it only caused the value returned in the case of an error
to be not the right error code.
Signed-off-by: Kevin Parsons <kevpar@microsoft.com>
We don't support actually using ETW on windows/arm, but to make things
easier for downstream dependencies, we want to still allow the package
to compile and just no-op on this architecture. We do this by returning
a nil Provider, and implementing its methods to no-op when the receiver
is nil.
Previously this was implemented by putting NewProviderWithID in
provider_unsupported.go, but when we refactored the code so that the
actual work was done in NewProviderWithOptions instead, we didn't fix up
provider_unsupported. This change fixes this by putting only
NewProviderWithOptions in provider_unsupported.go, since the other
provider creation functions call into this one.
Signed-off-by: Kevin Parsons <kevpar@microsoft.com>
At this point points of difference between the three local
mksyscall_windows.go implementations and
golang.org/x/sys/windows/mkwinsyscall v0.0.0-20210104204734-6f8348627aad
are:
- pkg/etw: Deduplicates imported functions due to multiple calling APIs
- pkg/security and vhd: Forced UTF-16 mode, not checking A/W suffix. I
also removed cosmetic differences between these two implementations.
`go generate` reports no changes with these updates.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
This moves all the current users of
$GOROOT/src/syscall/mksyscall_windows.go to instead use
golang.org/x/sys/windows/mkwinsyscall, as directed by the version of the
former in Go 1.15.
It also syncs the local forks of mksyscall_windows.go with the latest
version of golang.org/x/sys/windows/mkwinsyscall/mkwinsyscall.go, so
that the local patches can be easily seen in a side-by-side comparison.
Significant changes compared to the in-tree forked versions:
* *bool parameters are read back through a temp-var, not directly like
other pointer parameters.
* ?-suffixed function names support testing for function presence before
calling. This replaces a local implementation of this in
pkg/security, which was not actually used anyway. The upstream version
correctly supports functions that don't already have an error return.
* `errnoErr(0)` is now useful, so each call of `errnoErr` doesn't need
to be protected with a check for 0 first.
* The generated functions are now sorted. This of course produced a
*lot* of churn in the generated files.
vhd\vhd.go was changed to generate syscalls into zvhd_windows.go, since
regeneration removes the build tag added by hand in
9d8277341f.
After all that, I also ran
```
go generate . .\pkg\etw\ .\pkg\process\ .\pkg\security\ .\vhd\
```
to update all the existing generated code.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
On Windows, the os/exec.{Command,CommandContext,LookPath} functions resolve command
names that have neither path separators nor file extension (e.g., "git") by first
looking in the current working directory before looking in the PATH environment
variable.
Go maintainers intended to match cmd.exe's historical behavior.
However, this is pretty much never the intended behavior and as an abundance of
precaution this patch prevents that when executing commands.
This patch was prompted by the [Go 1.15.7 security fixes](https://blog.golang.org/path-security).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The _docs_ say it returns 0 for failure, non-zero for success.
This implementation is looking for <0 as HRESULT failure, and deriving
an Errno from that.
The new tests fail with GetFileSystemType as it was defined, e.g.,
```
--- FAIL: TestGetFSTypeOfValidButAbsentDrive (0.00s)
fs_windows_test.go:41: GetFileSystemType a:\ unexpectedly succeeded
```
when I definitely do not have an A:\ drive.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
`golang.org/x/sys/windows.GUID` is currently only available to builds
targeting `GOOS=windows` (see golang/go#36485). This change makes it
so `windows` builds continue to use `golang.org/x/sys/windows.GUID`,
while non-`windows` builds get a different structure that has all
the same fields and methods.
This change updates the logrus hook to sort the incoming logrus data
before passing it to the tracelogging code. This is useful because it
ensures that two instances of the same event have the fields in the same
order, which is necessary to get WPA to line the fields up.
This change adds support for encoding time.Time values as FILETIME
values in tracelogging events. FILETIME has slightly less precision than
time.Time (100ns vs 1ns), but it is the closest availble match.
The ETW registration handle is defined to be 64-bits on all platforms. The Go
type previously used a uintptr which created problems on 32-bit systems. This
change adds a new wrapper file which receives a 64-bit handle for the functions
defined in it, and correctly passes it to the native ETW functions either as-is
(on 64-bit) or as two 32-bit values (on 32-bit).
This required a minor change in mksyscall_windows.go, to allow multiple syscalls
that map to the same underlying function without causing a duplicate definition
error in the generated file.
Hamza El-Saawy