Implement wifi-ish table for linux

pkg/dataflatten/string_delimited.go

@@ -0,0 +1,84 @@
+package dataflatten
+
+import (
+	"bufio"
+	"bytes"
+	"strings"
+)
+
+type dataFunc func(data []byte, opts ...FlattenOpts) ([]Row, error)
+
+type recordSplittingStrategy int
+
+const (
+	None recordSplittingStrategy = iota
+	DuplicateKeys
+)
+
+func StringDelimitedFunc(kVDelimiter string, splittingStrategy recordSplittingStrategy) dataFunc {
+	switch splittingStrategy {
+	case None:
+		return singleRecordFunc(kVDelimiter)
+	case DuplicateKeys:
+		return duplicateKeyFunc(kVDelimiter)
+	default:
+		panic("Unknown record splitting strategy")
+	}
+
+}
+
+// duplicateKeyFunc returns a function that conforms to the interface expected
+// by dataflattentable.Table's execDataFunc property. properties are grouped
+// into a single record based on 'duplicate key' strategy: If a key/value pair
+// is encountered, and the record being built already has a value for that key,
+// then that record is considered 'complete'. The record is stored in the
+// collection, and a new record is started. This strategy is only suitable if
+// properties for a single record are grouped together, and there is at least
+// one field that appears for every record before any sparse data.
+func duplicateKeyFunc(kVDelimiter string) dataFunc {
+	return func(rawdata []byte, opts ...FlattenOpts) ([]Row, error) {
+		results := []interface{}{}
+		scanner := bufio.NewScanner(bytes.NewReader(rawdata))
+		row := map[string]interface{}{}
+		for scanner.Scan() {
+			line := scanner.Text()
+			parts := strings.SplitN(line, kVDelimiter, 2)
+			if len(parts) < 2 {
+				continue
+			}
+			key := strings.TrimSpace(parts[0])
+			value := strings.TrimSpace(parts[1])
+			if _, ok := row[key]; ok { // this key already exists, so we want to start a new record.
+				results = append(results, row) // store the 'finished' record in the collection
+				row = map[string]interface{}{} // reset the record
+			}
+			row[key] = value
+		}
+		results = append(results, row) // store the final record
+
+		return Flatten(results, opts...)
+	}
+}
+
+// singleRecordFunc returns an execData function that assumes 'rawdata'
+// only holds key-value pairs for a single record. Additionally, each k/v pair
+// must be on its own line. Useful for output that can be easily separated into
+// separate records before 'flattening'
+func singleRecordFunc(kVDelimiter string) dataFunc {
+	return func(rawdata []byte, opts ...FlattenOpts) ([]Row, error) {
+		results := []interface{}{}
+		scanner := bufio.NewScanner(bytes.NewReader(rawdata))
+		for scanner.Scan() {
+			line := scanner.Text()
+			parts := strings.SplitN(line, kVDelimiter, 2)
+			if len(parts) < 2 {
+				continue
+			}
+			key := strings.TrimSpace(parts[0])
+			value := strings.TrimSpace(parts[1])
+			results = append(results, map[string]interface{}{key: value})
+		}
+
+		return Flatten(results, opts...)
+	}
+}

pkg/osquery/table/platform_tables_linux.go

@@ -4,6 +4,7 @@ package table
 
 import (
 	"github.com/go-kit/kit/log"
+	"github.com/kolide/launcher/pkg/osquery/tables/dataflattentable"
 	"github.com/kolide/launcher/pkg/osquery/tables/gsettings"
 	osquery "github.com/kolide/osquery-go"
 	"github.com/kolide/osquery-go/plugin/table"
@@ -13,5 +14,8 @@ func platformTables(client *osquery.ExtensionManagerClient, logger log.Logger, c
 	return []*table.Plugin{
 		gsettings.Settings(client, logger),
 		gsettings.Metadata(client, logger),
+		dataflattentable.TablePluginExec(client, logger,
+			"kolide_nmcli_wifi", dataflattentable.KeyValueType, []string{"/usr/bin/nmcli", "--mode=multiline", "--fields=all", "device", "wifi", "list"},
+			dataflattentable.WithKVSeparator(":")),
 	}
 }

pkg/osquery/tables/dataflattentable/exec.go

@@ -15,21 +15,40 @@ import (
 	"github.com/pkg/errors"
 )
 
-func TablePluginExec(client *osquery.ExtensionManagerClient, logger log.Logger, tableName string, dataSourceType DataSourceType, execArgs []string) *table.Plugin {
+type ExecTableOpt func(*Table)
+
+// WithKVSeparator sets the delimiter between key and value. It replaces the
+// default ":" in dataflattentable.Table
+func WithKVSeparator(separator string) ExecTableOpt {
+	return func(t *Table) {
+		t.keyValueSeparator = separator
+	}
+}
+
+func TablePluginExec(client *osquery.ExtensionManagerClient, logger log.Logger, tableName string, dataSourceType DataSourceType, execArgs []string, opts ...ExecTableOpt) *table.Plugin {
 	columns := Columns()
 
 	t := &Table{
-		client:    client,
-		logger:    level.NewFilter(logger, level.AllowInfo()),
-		tableName: tableName,
-		execArgs:  execArgs,
+		client:            client,
+		logger:            level.NewFilter(logger, level.AllowInfo()),
+		tableName:         tableName,
+		execArgs:          execArgs,
+		keyValueSeparator: ":",
+	}
+
+	for _, opt := range opts {
+		opt(t)
 	}
 
 	switch dataSourceType {
 	case PlistType:
 		t.execDataFunc = dataflatten.Plist
 	case JsonType:
 		t.execDataFunc = dataflatten.Json
+	case KeyValueType:
+		// TODO: allow callers of TablePluginExec to specify the record
+		// splitting strategy
+		t.execDataFunc = dataflatten.StringDelimitedFunc(t.keyValueSeparator, dataflatten.DuplicateKeys)
 	default:
 		panic("Unknown data source type")
 	}

pkg/osquery/tables/dataflattentable/tables.go

@@ -22,6 +22,7 @@ const (
 	ExecType
 	XmlType
 	IniType
+	KeyValueType
 )
 
 type Table struct {
@@ -33,6 +34,8 @@ type Table struct {
 
 	execDataFunc func([]byte, ...dataflatten.FlattenOpts) ([]dataflatten.Row, error)
 	execArgs     []string
+
+	keyValueSeparator string
 }
 
 func TablePlugin(client *osquery.ExtensionManagerClient, logger log.Logger, dataSourceType DataSourceType) *table.Plugin {