dot1x: add macOS and Windows 802.1X supplicant state table

.testcoverage.yml

@@ -60,6 +60,10 @@ exclude:
     - tables/puppet/puppet_logs.go
     - tables/puppet/puppet_state.go
     - tables/puppet/yaml.go
+    # darwin/windows backends are build-tagged out of the Linux coverage run;
+    # the active !darwin && !windows path (dot1x_other.go) stays covered.
+    - tables/dot1x/dot1x_darwin.go
+    - tables/dot1x/dot1x_windows.go
     # - \.pb\.go$ # excludes all protobuf generated files
     # - ^pkg/bar # exclude package `pkg/bar`
 

BUILD.bazel

@@ -41,6 +41,7 @@ go_library(
         "//tables/authdb",
         "//tables/chromeuserprofiles",
         "//tables/crowdstrike_falcon",
+        "//tables/dot1x",
         "//tables/energyimpact",
         "//tables/fileline",
         "//tables/filevaultusers",
@@ -62,19 +63,40 @@ go_library(
     ],
 )
 
+# The dot1x table (and any future cgo tables) need cgo + Apple CC
+# toolchain on darwin. These are darwin-only binaries (goos = "darwin"),
+# so cgo=True does not affect Linux/Windows builds. The apple_support
+# toolchain in WORKSPACE satisfies the CC requirement on macOS.
+#
+# These targets require a darwin C++ toolchain (only available on macOS
+# hosts), so they are tagged "manual" to keep them out of `//...` / `:all`
+# wildcard expansion. That way `bazel build //...` / `bazel test //...` on a
+# Linux/Windows host won't try to analyze them and fail; they still build when
+# named explicitly (the Makefile and tools/bazel_to_builddir.sh do so, gated on
+# the host OS via `ifeq ($(UNAME_S),Darwin)` and `[ "$host_os" = "Darwin" ]`).
+#
+# target_compatible_with is not used here: the goos="darwin" platform
+# transition makes the resolved target platform macOS, so a macos constraint
+# would always be satisfied and would never skip the target on a Linux host.
 go_binary(
     name = "osquery-extension-mac-arm",
+    cgo = True,
     embed = [":osquery-extension_lib"],
     goarch = "arm64",
     goos = "darwin",
+    pure = "off",
+    tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 
 go_binary(
     name = "osquery-extension-mac-amd",
+    cgo = True,
     embed = [":osquery-extension_lib"],
     goarch = "amd64",
     goos = "darwin",
+    pure = "off",
+    tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 

Makefile

@@ -4,6 +4,10 @@ current_dir = $(shell pwd)
 
 SHELL = /bin/sh
 
+# Computed once, with a safe empty default if `uname` is unavailable (some
+# Windows shells / CI images). Used to gate the darwin-only binary builds.
+UNAME_S := $(shell uname -s 2>/dev/null)
+
 BAZEL_OUTPUT_PATH := $(shell bazel info output_path)
 
 APP_NAME = macadmins_extension
@@ -50,11 +54,25 @@ update-repos:
 	bazel run //:gazelle-update-repos -- -from_file=go.mod
 
 test:
-	bazel test --test_output=errors //...
+	# Query only test targets (any *_test kind) rather than `bazel test //...`,
+	# which would also analyze the darwin go_binary targets (pure="off",
+	# cgo=True in root BUILD.bazel) and fail on Linux CI where no darwin
+	# C++ toolchain exists.
+	# Matching all *_test kinds (not just go_test) keeps non-Go tests
+	# (sh_test, py_test, etc.) in scope if any are added later. The target
+	# list is passed via --target_pattern_file rather than expanded onto the
+	# command line, so a growing test set can't hit argv length limits.
+	@set -e; \
+	targets="$$(mktemp "$${TMPDIR:-/tmp}/dot1x-test-targets.XXXXXX")"; \
+	trap 'rm -f "$$targets"' EXIT; \
+	bazel query 'kind(".*_test", //...)' > "$$targets"; \
+	bazel test --test_output=errors --target_pattern_file="$$targets"
 
 build: .pre-build
+ifeq ($(UNAME_S),Darwin)
 	bazel build --verbose_failures //:osquery-extension-mac-amd
 	bazel build --verbose_failures //:osquery-extension-mac-arm
+endif
 	bazel build --verbose_failures //:osquery-extension-linux-amd
 	bazel build --verbose_failures //:osquery-extension-linux-arm
 	bazel build --verbose_failures //:osquery-extension-win-amd

README.md

@@ -19,6 +19,7 @@ For production deployment, you should refer to the [osquery documentation](https
 | `alt_system_info`            | Alternative system_info table | macOS                   | This table is an alternative to the built-in system_info table in osquery, which triggers an `Allow "osquery" to find devices on local networks?` prompt on macOS 15.0. On versions other than 15.0, this table falls back to the built-in system_info table. Note: this table returns an empty `cpu_subtype` field. See [#58](https://github.com/macadmins/osquery-extension/pull/58) for more details. |
 | `authdb`                     | macOS Authorization database | macOS                   | Use the constraint `name` to specify a right name to query, otherwise all rights will be returned. |
 | `crowdstrike_falcon`         | Provides basic information about the currently installed Falcon sensor. | Linux / macOS           | Requires Falcon to be installed. |
+| `dot1x`                      | Per-interface 802.1X / EAPOL supplicant state and authentication status                       | macOS / Windows         | Exposes state, supplicant state, EAP method, authenticator MAC, auth mode, and unique identifier. macOS additionally provides TLS certificate chain, trust status, cipher, protocol version, and timestamp via EAP8021X.framework. Windows queries wlanapi.dll and parses WLAN profile XML. Use `WHERE interface = 'en0'` (macOS) or `WHERE interface = 'Adapter Name'` (Windows). No root required.                                                                                                                                                                                                                  |
 | `energy_impact`              | Process energy impact data from `powermetrics`                                                | macOS                   | Use the `interval` constraint to specify sampling duration in milliseconds (default: 1000). |
 | `file_lines`                 | Read an arbitrary file                                                                        | Linux / macOS / Windows | Use the constraint `path` and `last` to specify the file to read lines from                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `filevault_users`            | Information on the users able to unlock the current boot volume when encrypted with Filevault | macOS                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

WORKSPACE

@@ -1,5 +1,57 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+# --- Apple C/C++ toolchain for cgo on macOS -------------------------------
+# The dot1x table calls EAP8021X.framework (CoreFoundation) via cgo,
+# so the macOS go_binary targets are built with cgo enabled (see
+# root BUILD.bazel go_binary targets: cgo = True, pure = "off"). That requires an Apple CC toolchain,
+# which apple_support provides. This block must precede rules_go so its CC
+# toolchain is registered for the Apple cc actions cgo uses.
+#
+# NOTE: In WORKSPACE mode (no bzlmod), these http_archive + load calls are
+# unconditional — they are fetched on every platform even though only darwin
+# builds consume them. The alternative (platform-gating with a load/condition)
+# adds complexity without meaningful savings, since Bazel lazy-fetches archives
+# and the WORKSPACE is already ~200 lines of unconditional deps. On bzlmod the
+# toolchain is registered via MODULE.bazel, not this file.
+#
+# Pinned to 1.24.5: the last apple_support release that supports WORKSPACE mode
+# (2.0.0 dropped it), and >= 1.19.0 so wrapped_clang is built WITHOUT the
+# -Wl,-no_uuid workaround that recent macOS / dyld versions reject with
+# "missing LC_UUID load command" (apple_support PR #373; bazelbuild/bazel#27026).
+http_archive(
+    name = "build_bazel_apple_support",
+    sha256 = "1ae6fcf983cff3edab717636f91ad0efff2e5ba75607fdddddfd6ad0dbdfaf10",
+    url = "https://github.com/bazelbuild/apple_support/releases/download/1.24.5/apple_support.1.24.5.tar.gz",
+)
+
+load(
+    "@build_bazel_apple_support//lib:repositories.bzl",
+    "apple_support_dependencies",
+)
+
+apple_support_dependencies()
+
+# bazel_features (pulled in by apple_support_dependencies) deps.
+load("@bazel_features//:deps.bzl", "bazel_features_deps")
+
+bazel_features_deps()
+
+# rules_cc (pulled in by apple_support_dependencies) deps + toolchains, plus the
+# WORKSPACE-mode compatibility proxy repo (cc_compatibility_proxy) that the
+# rules_cc 0.2.x APIs resolve through. In bzlmod this repo is created by a module
+# extension; in WORKSPACE mode it must be created explicitly here.
+load("@rules_cc//cc:repositories.bzl", "rules_cc_dependencies", "rules_cc_toolchains")
+
+rules_cc_dependencies()
+
+rules_cc_toolchains()
+
+load("@rules_cc//cc:extensions.bzl", "compatibility_proxy_repo")
+
+compatibility_proxy_repo()
+
+# --------------------------------------------------------------------------
+
 http_archive(
     name = "io_bazel_rules_go",
     sha256 = "68af54cb97fbdee5e5e8fe8d210d15a518f9d62abfd71620c3eaff3b26a5ff86",

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/sync v0.17.0
+	golang.org/x/sys v0.36.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -24,5 +25,4 @@ require (
 	go.opentelemetry.io/otel v1.41.0 // indirect
 	go.opentelemetry.io/otel/metric v1.41.0 // indirect
 	go.opentelemetry.io/otel/trace v1.41.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
 )

main.go

@@ -10,6 +10,7 @@ import (
 	"github.com/macadmins/osquery-extension/tables/alt_system_info"
 	"github.com/macadmins/osquery-extension/tables/chromeuserprofiles"
 	"github.com/macadmins/osquery-extension/tables/crowdstrike_falcon"
+	"github.com/macadmins/osquery-extension/tables/dot1x"
 	"github.com/macadmins/osquery-extension/tables/energyimpact"
 	"github.com/macadmins/osquery-extension/tables/fileline"
 	"github.com/macadmins/osquery-extension/tables/filevaultusers"
@@ -77,9 +78,12 @@ func main() {
 	}
 
 	// Platform specific tables
-	// if runtime.GOOS == "windows" {
-	// If there were windows only tables, they would go here
-	// }
+	if runtime.GOOS == "darwin" || runtime.GOOS == "windows" {
+		dot1xPlugins := []osquery.OsqueryPlugin{
+			table.NewPlugin("dot1x", dot1x.Dot1XStatusColumns(), dot1x.Dot1XStatusGenerate),
+		}
+		plugins = append(plugins, dot1xPlugins...)
+	}
 
 	if runtime.GOOS == "linux" || runtime.GOOS == "darwin" {
 		linuxPlugins := []osquery.OsqueryPlugin{

tables/dot1x/BUILD.bazel

@@ -0,0 +1,55 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "dot1x",
+    srcs = [
+        "dot1x.go",
+        "dot1x_darwin.go",
+        "dot1x_other.go",
+        "dot1x_wlanprofile.go",
+        "dot1x_windows.go",
+    ],
+    # cgo is only needed on darwin: dot1x_darwin.go (//go:build darwin) calls
+    # EAP8021X.framework (via dlopen/dlsym) + CoreFoundation via cgo.
+    # The darwin build constraint does NOT include ios, so only darwin gets
+    # the cgo + framework links; linux/windows stay pure Go.
+    cgo = select({
+        "@io_bazel_rules_go//go/platform:darwin": True,
+        "//conditions:default": False,
+    }),
+    clinkopts = select({
+        "@io_bazel_rules_go//go/platform:darwin": [
+            "-framework",
+            "CoreFoundation",
+        ],
+        "//conditions:default": [],
+    }),
+    importpath = "github.com/macadmins/osquery-extension/tables/dot1x",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@com_github_osquery_osquery_go//plugin/table",
+    ] + select({
+        "@io_bazel_rules_go//go/platform:windows": [
+            "@org_golang_x_sys//windows",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
+go_test(
+    name = "dot1x_test",
+    srcs = [
+        "dot1x_test.go",
+        "dot1x_darwin_test.go",
+        "dot1x_helpers_test.go",
+        "dot1x_other_test.go",
+        "dot1x_wlanprofile_test.go",
+        "dot1x_windows_test.go",
+    ],
+    embed = [":dot1x"],
+    deps = [
+        "@com_github_osquery_osquery_go//plugin/table",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)