Fix the empty host column from logged_in_users table

[sm0k]

Fixes empty "host" column from logged_in_users table

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: sm0k (199dc8b)

[directionless]

Did you run into trouble with the CLA signing?

[sm0k]

Did you run into trouble with the CLA signing?

Didn't think this was mandatory, will do tomorrow

[Smjert]

Are we sure that the empty case it's not an error caused by this?

osquery/osquery/tables/system/windows/logged_in_users.cpp

Lines 118 to 119 in fa48b83

	auto addr = reinterpret_cast<const char*>(wtsClient->ClientAddress);
	r["host"] = std::string(addr, CLIENTADDRESS_LENGTH);

Because as I far as I can understand we are reinterpreting the IPv6 bytes as characters, not converting those bytes to digits that can be printed as with IPv4 case.
So maybe one of the initial bytes could be 0 and that gets printed/serialized as an empty string.

How were you able to reproduce this issue?

[sm0k]

Are we sure that the empty case it's not an error caused by this?

osquery/osquery/tables/system/windows/logged_in_users.cpp

Lines 118 to 119 in fa48b83

	auto addr = reinterpret_cast<const char*>(wtsClient->ClientAddress);
	r["host"] = std::string(addr, CLIENTADDRESS_LENGTH);

Because as I far as I can understand we are reinterpreting the IPv6 bytes as characters, not converting those bytes to digits that can be printed as with IPv4 case. So maybe one of the initial bytes could be 0 and that gets printed/serialized as an empty string.

How were you able to reproduce this issue?

Here is my debug session, with a RDP connected user:

Looks like WTSQuerySessionInformationW using the WTSClientInfo _WTS_INFO_CLASS is not following the expected behavior described in MSDN, reason why I chose to use WTSClientName in case of an empty host. Maybe its a Microsoft related bug?

[sm0k]

Did you run into trouble with the CLA signing?

I signed the CLA yesterday, is there anything more to do?

[Smjert]

/easycla

[Smjert]

The committers listed above are authorized under a signed CLA.

• ✅ login: sm0k (199dc8b, 1207514, 82e8cff, be56e34, 6984530)

[sm0k]

Did you run into trouble with the CLA signing?

I signed the CLA yesterday, is there anything more to do?

@sm0k There seems to be a problem with the commit itself which is missing the User ID. As far as I recall this means that you have created and/or pushed that commit with a user and mail that's not the one you have here on Github, so EasyCLA is unable to connect the commit with your Github account

Hm that's strange, the original commit was done using my ssh pub key, linked to this account... How can I fix this? Sorry, not really familiar with easyCLA here.

[Smjert]

Hm that's strange, the original commit was done using my ssh pub key, linked to this account... How can I fix this? Sorry, not really familiar with easyCLA here.

It's more a problem of the author/email in the commit itself. Is the email in the commit associated with the Github account?
The email you have there has to be one of the primary or secondary emails you have in the account.

[sm0k]

Hm that's strange, the original commit was done using my ssh pub key, linked to this account... How can I fix this? Sorry, not really familiar with easyCLA here.

It's more a problem of the author/email in the commit itself. Is the email in the commit associated with the Github account? The email you have there has to be one of the primary or secondary emails you have in the account.

Ok, got it, the commit was done using my professional email. Do you want me to close this PR and open a clean one?

[Smjert]

Ok, got it, the commit was done using my professional email. Do you want me to close this PR and open a clean one?

It's not necessary, either modify the commit author with git commit --amend --author="..." --no-edit or set for the osquery repository your user and email with git config user.name <youruser> and git config user.email <your email>, then git commit --amend --reset-author --no-edit.
The second method would be permanent for that folder/repository, so that if you want to contribute again you don't have to do this anymore.

Finally push force the branch, and the PR will update.

One unrelated thing for the future: I would suggest to use a dedicated branch in your repository for the PR to be pointed at instead of master.

[sm0k]

Thank you, should be good now

[Smjert]

I'm not sure what happened but I had to restore a couple of our comments because the EasyCLA bot decided to edit them and put there the update on its status.

[sm0k]

Ok thank you, are you waiting fro an action from me to close the change request?

[Smjert]

Hello @sm0k, sorry for waiting.
The code works, but I'd like to have a final small change.

[mike-myers-tob]

Hello @sm0k, sorry for waiting. The code works, but I'd like to have a final small change.

Did the final small change address all the feedback? Can this PR be approved?