go.mondoo.com/cnquery@v0.0.0-20231005093811-59568235f6ea/providers/os/resources/windows.go (about)

     1  // Copyright (c) Mondoo, Inc.
     2  // SPDX-License-Identifier: BUSL-1.1
     3  
     4  package resources
     5  
     6  import (
     7  	"errors"
     8  
     9  	"go.mondoo.com/cnquery/llx"
    10  	"go.mondoo.com/cnquery/providers-sdk/v1/plugin"
    11  	"go.mondoo.com/cnquery/providers/os/connection/shared"
    12  	"go.mondoo.com/cnquery/providers/os/resources/packages"
    13  	"go.mondoo.com/cnquery/providers/os/resources/powershell"
    14  	"go.mondoo.com/cnquery/providers/os/resources/windows"
    15  )
    16  
    17  func (s *mqlWindows) computerInfo() (map[string]interface{}, error) {
    18  	conn := s.MqlRuntime.Connection.(shared.Connection)
    19  
    20  	cmd := windows.PSGetComputerInfo
    21  
    22  	// encode the powershell command
    23  	encodedCmd := powershell.Encode(cmd)
    24  	executedCmd, err := conn.RunCommand(encodedCmd)
    25  	if err != nil {
    26  		return nil, err
    27  	}
    28  
    29  	return windows.ParseComputerInfo(executedCmd.Stdout)
    30  }
    31  
    32  func (wh *mqlWindowsHotfix) id() (string, error) {
    33  	return wh.HotfixId.Data, nil
    34  }
    35  
    36  func initWindowsHotfix(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) {
    37  	if len(args) > 1 {
    38  		return args, nil, nil
    39  	}
    40  
    41  	nameRaw := args["hotfixId"]
    42  	if nameRaw == nil {
    43  		return args, nil, nil
    44  	}
    45  
    46  	name, ok := nameRaw.Value.(string)
    47  	if !ok {
    48  		return args, nil, nil
    49  	}
    50  
    51  	obj, err := NewResource(runtime, "windows", nil)
    52  	if err != nil {
    53  		return nil, nil, err
    54  	}
    55  	winResource := obj.(*mqlWindows)
    56  
    57  	hotfixes := winResource.GetHotfixes()
    58  	if hotfixes.Error != nil {
    59  		return nil, nil, hotfixes.Error
    60  	}
    61  
    62  	for i := range hotfixes.Data {
    63  		hf := hotfixes.Data[i].(*mqlWindowsHotfix)
    64  		if hf.HotfixId.Data == name {
    65  			return nil, hf, nil
    66  		}
    67  	}
    68  
    69  	// if the hotfix cannot be found we return an error
    70  	return nil, nil, errors.New("could not find hotfix " + name)
    71  }
    72  
    73  func (w *mqlWindows) hotfixes() ([]interface{}, error) {
    74  	conn := w.MqlRuntime.Connection.(shared.Connection)
    75  
    76  	// query hotfixes
    77  	encodedCmd := powershell.Encode(packages.WINDOWS_QUERY_HOTFIXES)
    78  	executedCmd, err := conn.RunCommand(encodedCmd)
    79  	if err != nil {
    80  		return nil, err
    81  	}
    82  
    83  	hotfixes, err := packages.ParseWindowsHotfixes(executedCmd.Stdout)
    84  	if err != nil {
    85  		return nil, err
    86  	}
    87  
    88  	// convert hotfixes to MQL resource
    89  	mqlHotFixes := make([]interface{}, len(hotfixes))
    90  	for i, hf := range hotfixes {
    91  		mqlHotfix, err := CreateResource(w.MqlRuntime, "windows.hotfix", map[string]*llx.RawData{
    92  			"hotfixId":    llx.StringData(hf.HotFixId),
    93  			"caption":     llx.StringData(hf.Caption),
    94  			"description": llx.StringData(hf.Description),
    95  			"installedOn": llx.TimeDataPtr(hf.InstalledOnTime()),
    96  			"installedBy": llx.StringData(hf.InstalledBy),
    97  		})
    98  		if err != nil {
    99  			return nil, err
   100  		}
   101  
   102  		mqlHotFixes[i] = mqlHotfix
   103  	}
   104  
   105  	return mqlHotFixes, nil
   106  }
   107  
   108  func (wh *mqlWindowsFeature) id() (string, error) {
   109  	return wh.Path.Data, nil
   110  }
   111  
   112  func initWindowsFeature(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) {
   113  	if len(args) > 1 {
   114  		return args, nil, nil
   115  	}
   116  
   117  	nameRaw := args["name"]
   118  	if nameRaw == nil {
   119  		return args, nil, nil
   120  	}
   121  
   122  	name, ok := nameRaw.Value.(string)
   123  	if !ok {
   124  		return args, nil, nil
   125  	}
   126  
   127  	obj, err := NewResource(runtime, "windows", nil)
   128  	if err != nil {
   129  		return nil, nil, err
   130  	}
   131  	winResource := obj.(*mqlWindows)
   132  
   133  	features := winResource.GetFeatures()
   134  	if features.Error != nil {
   135  		return nil, nil, features.Error
   136  	}
   137  
   138  	for i := range features.Data {
   139  		hf := features.Data[i].(*mqlWindowsFeature)
   140  		if hf.Name.Data == name {
   141  			return nil, hf, nil
   142  		}
   143  	}
   144  
   145  	// if the feature cannot be found we return an error
   146  	return nil, nil, errors.New("could not find feature " + name)
   147  }
   148  
   149  func (w *mqlWindows) features() ([]interface{}, error) {
   150  	conn := w.MqlRuntime.Connection.(shared.Connection)
   151  
   152  	// query features
   153  	encodedCmd := powershell.Encode(windows.QUERY_FEATURES)
   154  	executedCmd, err := conn.RunCommand(encodedCmd)
   155  	if err != nil {
   156  		return nil, err
   157  	}
   158  
   159  	features, err := windows.ParseWindowsFeatures(executedCmd.Stdout)
   160  	if err != nil {
   161  		return nil, err
   162  	}
   163  
   164  	// convert features to MQL resource
   165  	mqlFeatures := make([]interface{}, len(features))
   166  	for i, feature := range features {
   167  
   168  		mqlFeature, err := CreateResource(w.MqlRuntime, "windows.feature", map[string]*llx.RawData{
   169  			"path":         llx.StringData(feature.Path),
   170  			"name":         llx.StringData(feature.Name),
   171  			"displayName":  llx.StringData(feature.DisplayName),
   172  			"description":  llx.StringData(feature.Description),
   173  			"installed":    llx.BoolData(feature.Installed),
   174  			"installState": llx.IntData(feature.InstallState),
   175  		})
   176  		if err != nil {
   177  			return nil, err
   178  		}
   179  
   180  		mqlFeatures[i] = mqlFeature
   181  	}
   182  
   183  	return mqlFeatures, nil
   184  }