Client summary react call should be ignored if call was cancelled. (V…

…elocidex#2483)

README.md

@@ -52,10 +52,10 @@ Velociraptor is also useful as a local triage tool. You can create a self contai
 ## Building from source
 
 To build from source, make sure you have a recent Golang installed
-from https://golang.org/dl/ (Currently Go 1.17) and the go binary is
-on your path. In addition make sure the GOBIN directory is also on
-your path (Defaults are: on linux and mac `~/go/bin`, on Windows
-`c:\\Users\\<username>\\go\\bin`):
+from https://golang.org/dl/ (Currently at least Go 1.17) and the go
+binary is on your path. In addition make sure the GOBIN directory is
+also on your path (Defaults are: on linux and mac `~/go/bin`, on
+Windows `c:\\Users\\<username>\\go\\bin`):
 
 ```bash
     $ git clone https://github.com/Velocidex/velociraptor.git

docs/references/vql.yaml

@@ -33,7 +33,7 @@
   - name: items
     type: Any
     description: The items to consider. Can be an array, subquery or stored query.
-      Will only be lazily evaluted!
+      Will only be lazily evaluated!
     required: true
   - name: filter
     type: vfilter.Lambda
@@ -61,7 +61,7 @@
   - name: items
     type: Any
     description: The items to consider. Can be an array, subquery or stored query.
-      Will only be lazily evaluted!
+      Will only be lazily evaluated!
     required: true
   - name: filter
     type: vfilter.Lambda
@@ -821,10 +821,10 @@
     description: If set we wait for the download to complete before returning.
   - name: type
     type: string
-    description: Type of download to create (deperated Ignored).
+    description: Type of download to create (deprecated Ignored).
   - name: template
     type: string
-    description: Report template to use (deperated Ignored).
+    description: Report template to use (deprecated Ignored).
   - name: password
     type: string
     description: An optional password to encrypt the collection zip.
@@ -1959,8 +1959,8 @@
   args:
   - name: all_orgs
     type: bool
-    description: If set we enumberate permission for all orgs, otherwise just for
-      this org.
+    description: If set we enumerate permission for all orgs, otherwise just for this
+      org.
   category: server
 - name: gunzip
   description: Apply Gunzip to the data.
@@ -2687,8 +2687,48 @@
     required: true
   category: basic
 - name: log
-  description: Log the message.
+  description: |
+    Log the message and return TRUE.
+
+    The message will be logged into the query log stream (Viewable in
+    the Logs tab). The `message` parameter represents a format string
+    that will be expanded using the `args` parameter list if needed.
+
+    Since `log()` always returns TRUE it is easy to use in a WHERE
+    clause as a form of debugging (It is basically equivalent to the
+    print statement of other languages).
+
+    ```sql
+    SELECT * FROM glob(...)
+    WHERE log(message="Value of OSPath is %v", args=OSPath)
+    ```
+
+    ## Deduplication
+
+    Log messages will be deduped according to the `dedup`
+    parameter - each distinct format string will not be emitted more
+    frequently than the `dedup` parameter (by default 60 seconds).
+
+    This makes it safe to use `log()` frequently without overflowing
+    the logs stream.
+
+    ```vql
+    SELECT * FROM range(end=_value)
+    WHERE log(message="Value is %v", args=_value)
+    ```
+
+    Will only emit a single message due to the format string being
+    deduped.
+
+    This property makes it useful to add progress logging to long
+    running artifacts. The logs will be emitted every minute.
+
+    ```vql
+    SELECT * FROM glob(...)
+    WHERE log(message="Processing file %v", args=OSPath)
+    ```
   type: Function
+  version: 2
   args:
   - name: message
     type: string
@@ -3561,6 +3601,9 @@
   - name: prefix
     type: accessors.OSPath
     description: If specified we prefix all paths with this path.
+  - name: start
+    type: int64
+    description: The first entry to scan.
   category: parsers
 - name: parse_ntfs
   description: |
@@ -4955,7 +4998,7 @@
     description: Field to use as event timestamp.
   - name: hostname_field
     type: string
-    description: Field to use as event hostname. Overrides hostname param.
+    description: Field to use as event hostname. Overrides hostname parameter.
   category: server
 - name: sql
   description: Run queries against sqlite, mysql, and postgres databases
@@ -6087,7 +6130,7 @@
     `wide ascii`, `wide nocase`, `wide nocase ascii`.
 
     This shorthand notation is less useful because recent Velociraptor
-    versions offer a context sensivite Yara rule editor in the GUI
+    versions offer a context sensitive Yara rule editor in the GUI
     (simply press ? to bring up a rule template).
 
     {{% notice note %}}

go.mod

@@ -99,11 +99,11 @@ require (
 	www.velocidex.com/golang/evtx v0.2.1-0.20220404133451-1fdf8be7325e
 	www.velocidex.com/golang/go-ese v0.1.1-0.20220107095505-c38622559671
 	www.velocidex.com/golang/go-ntfs v0.1.2-0.20230221030709-f91b68ac3222
-	www.velocidex.com/golang/go-pe v0.1.1-0.20230221012148-9abf830a16b4
+	www.velocidex.com/golang/go-pe v0.1.1-0.20230228112150-ef2eadf34bc3
 	www.velocidex.com/golang/go-prefetch v0.0.0-20220801101854-338dbe61982a
 	www.velocidex.com/golang/oleparse v0.0.0-20230217092320-383a0121aafe
 	www.velocidex.com/golang/regparser v0.0.0-20221020153526-bbc758cbd18b
-	www.velocidex.com/golang/vfilter v0.0.0-20230205055939-24cd6452d8bd
+	www.velocidex.com/golang/vfilter v0.0.0-20230228090108-bafcf1fc297f
 )
 
 require (

go.sum

@@ -118,7 +118,6 @@ github.com/Velocidex/json v0.0.0-20220224052537-92f3c0326e5a/go.mod h1:ukJBuruT9
 github.com/Velocidex/ordereddict v0.0.0-20200723153557-9460a6764ab8/go.mod h1:pxJpvN5ISMtDwrdIdqnJ3ZrjIngCw+WT6gfNil6Zjvo=
 github.com/Velocidex/ordereddict v0.0.0-20211223082514-572009c595d0/go.mod h1:USioSRAHYrnbOEZvFUX5Puw3BBWl42kVg8D9xuZOEwA=
 github.com/Velocidex/ordereddict v0.0.0-20220107075049-3dbe58412844/go.mod h1:Y5Tfx5SKGOzkulpqfonrdILSPIuNg+GqKE/DhVJgnpg=
-github.com/Velocidex/ordereddict v0.0.0-20220428153415-da46091cd216/go.mod h1:XJDUbaGh2U9e0z78L5O2OXf1hE1wSxnJ7nSlQmA+bIs=
 github.com/Velocidex/ordereddict v0.0.0-20221110130714-6a7cb85851cd h1:GA/Aogkc2wf0RCvjiSXIILg2WqGoSb5OsozwX3gvZFY=
 github.com/Velocidex/ordereddict v0.0.0-20221110130714-6a7cb85851cd/go.mod h1:+MqO5UMBemyFSm+yRXslbpFTwPUDhFHUf7HPV92twg4=
 github.com/Velocidex/pkcs7 v0.0.0-20210524015001-8d1eee94a157/go.mod h1:/fy/Eg4TQz9KkJduvZfGCnbWTQ/LKaknS2wYB52cU6c=
@@ -660,6 +659,7 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
@@ -686,6 +686,7 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220128200615-198e4374d7ed/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20221012134737-56aed061732a h1:NmSIgad6KjE6VvHciPZuNRTKxGhlPfD6OA87W/PLkqg=
 golang.org/x/crypto v0.0.0-20221012134737-56aed061732a/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -775,6 +776,7 @@ golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
@@ -816,6 +818,7 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -898,6 +901,7 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -980,6 +984,7 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1230,16 +1235,16 @@ www.velocidex.com/golang/go-ese v0.1.1-0.20220107095505-c38622559671/go.mod h1:q
 www.velocidex.com/golang/go-ntfs v0.1.2-0.20230221030709-f91b68ac3222 h1:HcMVGo7mIEfms1XMruzsqJSAOPdQRGHz6ip+cXjIeXg=
 www.velocidex.com/golang/go-ntfs v0.1.2-0.20230221030709-f91b68ac3222/go.mod h1:itvbHQcnLdTVIDY6fI3lR0zeBwXwBYBdUFtswE0x1vc=
 www.velocidex.com/golang/go-pe v0.1.1-0.20220107093716-e91743c801de/go.mod h1:j9Xy8Z9wxzY2SCB8CqDkkoSzy+eUwevnOrRm/XM2q/A=
-www.velocidex.com/golang/go-pe v0.1.1-0.20230221012148-9abf830a16b4 h1:Ev2mJ922a3R+ym2sZRca7ANb/t4KCLoIUsNgSsAPjl4=
-www.velocidex.com/golang/go-pe v0.1.1-0.20230221012148-9abf830a16b4/go.mod h1:2vFZELMrzs1ZcgR8yEtqJ4q12QR/xtFgB0bEw3J2xvM=
+www.velocidex.com/golang/go-pe v0.1.1-0.20230228112150-ef2eadf34bc3 h1:W394TEIFuHFxHY8mzTJPHI5v+M+NLKEHmHn7KY/VpEM=
+www.velocidex.com/golang/go-pe v0.1.1-0.20230228112150-ef2eadf34bc3/go.mod h1:agYwYzeeytVtdwkRrvxZAjgIA8SCeM/Tg7Ym2/jBwmA=
 www.velocidex.com/golang/go-prefetch v0.0.0-20220801101854-338dbe61982a h1:iXYitl3w8pDTH8ltwra5Za9weXN5p8UAi87JoGf8SvU=
 www.velocidex.com/golang/go-prefetch v0.0.0-20220801101854-338dbe61982a/go.mod h1:UNIUmQhflpSTt7TH4o/6O/GiMCjSzIALXe9/zzTKFCw=
 www.velocidex.com/golang/oleparse v0.0.0-20230217092320-383a0121aafe h1:o9jQWSwKTLhBeavfOk054/HK5yNi6Ni9VHQ6rxYZEi4=
 www.velocidex.com/golang/oleparse v0.0.0-20230217092320-383a0121aafe/go.mod h1:R7IisRzDO7q5LVRJsCQf1xA50LrIavsPWzAjVE4THyY=
 www.velocidex.com/golang/regparser v0.0.0-20221020153526-bbc758cbd18b h1:NrnjFXwjUi7vdLEDKgSxu6cs304UJLZE/H7pSXXakVA=
 www.velocidex.com/golang/regparser v0.0.0-20221020153526-bbc758cbd18b/go.mod h1:pxSECT5mWM3goJ4sxB4HCJNKnKqiAlpyT8XnvBwkLGU=
 www.velocidex.com/golang/vfilter v0.0.0-20220103082604-85bb38175cb7/go.mod h1:eEFMhAmoFHWGCKF39j+iOhTH8REpqBndc3OsdPsxqo8=
-www.velocidex.com/golang/vfilter v0.0.0-20230205055939-24cd6452d8bd h1:p01h12DjfV8BVmN0GWezKqReIt/H6tghqChl4jDT0Lw=
-www.velocidex.com/golang/vfilter v0.0.0-20230205055939-24cd6452d8bd/go.mod h1:R3nLf1iHcc7eezqqc68KF+SUOXaAJeFz3TV+j8xorfY=
+www.velocidex.com/golang/vfilter v0.0.0-20230228090108-bafcf1fc297f h1:OUEiW8pcP3IOGDorDKIa6Gc8r1TBnzJJdFDoMWu4IcE=
+www.velocidex.com/golang/vfilter v0.0.0-20230228090108-bafcf1fc297f/go.mod h1:Cn+7YodmnN3IuglLh7p6JF2ahMCDXhGANZnsL8GKXR4=
 www.velocidex.com/golang/vtypes v0.0.0-20220816192452-6a27ae078f12 h1:8azOLd/l6sPy1/ug03ueA7jLfsVwE1sI3oHg9q/nkqQ=
 www.velocidex.com/golang/vtypes v0.0.0-20220816192452-6a27ae078f12/go.mod h1:gpuRaiyhcuPmZYvI/zw+rjlDXklR2ORaLQBuzCXe84o=

gui/velociraptor/src/components/clients/client-summary.jsx

@@ -29,6 +29,16 @@ export default class VeloClientSummary extends Component {
         clearInterval(this.interval);
     }
 
+    componentDidUpdate = (prevProps, prevState, rootNode) => {
+        let old_client_id = prevProps.client && prevProps.client.client_id;
+        let new_client_id = this.props.client && this.props.client.client_id;
+        if (old_client_id !== new_client_id) {
+            clearInterval(this.interval);
+            this.interval = setInterval(this.getClientInfo, POLL_TIME);
+            this.getClientInfo();
+        }
+    }
+
     getClientInfo = () => {
         this.source.cancel();
         this.source = axios.CancelToken.source();

gui/velociraptor/src/components/clients/host-info.jsx

@@ -235,6 +235,9 @@ class VeloHostInfo extends Component {
         if (client_id) {
             api.get("v1/GetClient/" + client_id, params, this.source.token).then(
                 response=>{
+                    if (!response.data || response.data.client_id !== client_id) {
+                        return false;
+                    }
                     this.setState({loading: false});
                     return this.props.setClient(response.data);
                 }, this.source);

vql/aggregates/all.go

@@ -17,7 +17,7 @@ type allState struct {
 }
 
 type _AllFunctionArgs struct {
-	Items  vfilter.Any     `vfilter:"required,field=items,doc=The items to consider. Can be an array, subquery or stored query. Will only be lazily evaluted!"`
+	Items  vfilter.Any     `vfilter:"required,field=items,doc=The items to consider. Can be an array, subquery or stored query. Will only be lazily evaluated!"`
 	Filter *vfilter.Lambda `vfilter:"optional,field=filter,doc=A callback to consider each item"`
 	Regex  []string        `vfilter:"optional,field=regex,doc=Optionally one or more regex can be provided for convenience"`
 }

vql/server/downloads/downloads.go

@@ -41,8 +41,8 @@ type CreateFlowDownloadArgs struct {
 	ClientId     string `vfilter:"required,field=client_id,doc=Client ID to export."`
 	FlowId       string `vfilter:"required,field=flow_id,doc=The flow id to export."`
 	Wait         bool   `vfilter:"optional,field=wait,doc=If set we wait for the download to complete before returning."`
-	Type         string `vfilter:"optional,field=type,doc=Type of download to create (deperated Ignored)."`
-	Template     string `vfilter:"optional,field=template,doc=Report template to use (deperated Ignored)."`
+	Type         string `vfilter:"optional,field=type,doc=Type of download to create (deprecated Ignored)."`
+	Template     string `vfilter:"optional,field=template,doc=Report template to use (deprecated Ignored)."`
 	Password     string `vfilter:"optional,field=password,doc=An optional password to encrypt the collection zip."`
 	Format       string `vfilter:"optional,field=format,doc=Format to export (csv,json,csv_only) defaults to both."`
 	ExpandSparse bool   `vfilter:"optional,field=expand_sparse,doc=If set we expand sparse files in the archive."`

vql/server/splunk.go

@@ -57,7 +57,7 @@ type _SplunkPluginArgs struct {
 	WaitTime       int64               `vfilter:"optional,field=wait_time,doc=Batch splunk upload this long (2 sec)."`
 	Hostname       string              `vfilter:"optional,field=hostname,doc=Hostname for Splunk Events. Defaults to server hostname."`
 	TimestampField string              `vfilter:"optional,field=timestamp_field,doc=Field to use as event timestamp."`
-	HostnameField  string              `vfilter:"optional,field=hostname_field,doc=Field to use as event hostname. Overrides hostname param."`
+	HostnameField  string              `vfilter:"optional,field=hostname_field,doc=Field to use as event hostname. Overrides hostname parameter."`
 }
 
 type _SplunkPlugin struct{}

vql/server/users/users.go

@@ -16,7 +16,7 @@ import (
 )
 
 type UsersPluginArgs struct {
-	AllOrgs bool `vfilter:"optional,field=all_orgs,doc=If set we enumberate permission for all orgs, otherwise just for this org."`
+	AllOrgs bool `vfilter:"optional,field=all_orgs,doc=If set we enumerate permission for all orgs, otherwise just for this org."`
 }
 
 type UsersPlugin struct{}