dissect.target 3.15.dev29__tar.gz → 3.15.dev31__tar.gz

{dissect.target-3.15.dev29/dissect.target.egg-info → dissect.target-3.15.dev31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.15.dev29
+Version: 3.15.dev31
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31}/dissect/target/plugin.py

@@ -495,7 +495,7 @@ def register(plugincls: Type[Plugin]) -> None:
     root["exports"] = plugincls.__exports__
     root["namespace"] = plugincls.__namespace__
     root["fullname"] = ".".join((plugincls.__module__, plugincls.__qualname__))
-    root["cls"] = plugincls
+    root["is_osplugin"] = issubclass(plugincls, OSPlugin)
 
 
 def internal(*args, **kwargs) -> Callable:
@@ -1117,7 +1117,7 @@ def plugin_function_index(target: Optional[Target]) -> tuple[dict[str, PluginDes
             available["exports"].remove("get_all_records")
 
         for exported in available["exports"]:
-            if issubclass(available["cls"], OSPlugin) and os_type == general.default.DefaultPlugin:
+            if available["is_osplugin"] and os_type == general.default.DefaultPlugin:
                 # This makes the os plugin exports listed under the special
                 # "OS plugins" header by the 'plugins' plugin.
                 available["module"] = ""

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31}/dissect/target/plugins/os/unix/bsd/citrix/_os.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import re
 from typing import Iterator, Optional
 
-from dissect.target.filesystem import Filesystem, VirtualFilesystem
+from dissect.target.filesystem import Filesystem
 from dissect.target.helpers.record import UnixUserRecord
 from dissect.target.plugin import OperatingSystem, export
 from dissect.target.plugins.os.unix.bsd._os import BsdPlugin
@@ -18,12 +18,12 @@ RE_CONFIG_USER = re.compile(r"bind system user (?P<user>[^ ]+) ")
 RE_LOADER_CONFIG_KERNEL_VERSION = re.compile(r'kernel="/(?P<version>.*)"')
 
 
-class CitrixBsdPlugin(BsdPlugin):
+class CitrixPlugin(BsdPlugin):
     def __init__(self, target: Target):
         super().__init__(target)
         self._ips = []
         self._hostname = None
-        self.config_usernames = []
+        self._config_usernames = []
         self._parse_netscaler_configs()
 
     def _parse_netscaler_configs(self) -> None:
@@ -49,26 +49,46 @@ class CitrixBsdPlugin(BsdPlugin):
 
     @classmethod
     def detect(cls, target: Target) -> Optional[Filesystem]:
-        newfilesystem = VirtualFilesystem()
-        is_citrix = False
+        ramdisk = None
+        for fs in target.filesystems:
+            # /netscaler can be present on both the ramdisk and the harddisk. Therefore we also check for the /log
+            # folder, which is not present on the ramdisk. We regard the harddisk as the system volume, as it is
+            # possible to only have a disk image of a Netscaler. However, in the case where we only have the ramdisk,
+            # we want to fall back on that as the system volume. Thus we store that filesystem in a fallback variable.
+            if fs.exists("/netscaler"):
+                if fs.exists("/log"):
+                    return fs
+                ramdisk = fs
+
+        # At this point, we could not find the filesystem for '/var'. Thus, we fall back to the ramdisk variable, which
+        # is either 'None' (in which case this isn't a Citrix netscaler), or points to the filesystem of the ramdisk.
+        return ramdisk
+
+    @classmethod
+    def create(cls, target: Target, sysvol: Filesystem) -> CitrixPlugin:
+        # A disk image of a Citrix Netscaler contains two partitions, that after boot are mounted to /var and /flash.
+        # The rest of the filesystem is recreated at runtime into a 'ramdisk'. Currently, this plugin does not
+        # yet support recreating the ramdisk from a 'clean' state. This might be possible in a future iteration but
+        # requires further research.
+
+        # When the ramdisk is present within the target's filesystems, mount it accordingly,
         for fs in target.filesystems:
             if fs.exists("/bin/freebsd-version"):
-                newfilesystem.map_fs("/", fs)
-                break
+                # If available, mount the ramdisk first.
+                target.fs.mount("/", fs)
+        # The 'disk' filesystem is mounted at '/var'.
+        target.fs.mount("/var", sysvol)
+
+        # Enumerate filesystems for flash partition
         for fs in target.filesystems:
             if fs.exists("/nsconfig") and fs.exists("/boot"):
-                newfilesystem.map_fs("/flash", fs)
-                is_citrix = True
-            elif fs.exists("/netscaler"):
-                newfilesystem.map_fs("/var", fs)
-                is_citrix = True
-        if is_citrix:
-            return newfilesystem
-        return None
+                target.fs.mount("/flash", fs)
+
+        return cls(target)
 
     @export(property=True)
     def hostname(self) -> Optional[str]:
-        return self._hostname
+        return self._hostname or super().hostname
 
     @export(property=True)
     def version(self) -> Optional[str]:
@@ -96,16 +116,21 @@ class CitrixBsdPlugin(BsdPlugin):
     @export(record=UnixUserRecord)
     def users(self) -> Iterator[UnixUserRecord]:
         nstmp_users = set()
-        nstmp_path = "/var/nstmp/"
-
-        nstmp_user_path = nstmp_path + "{username}"
-
-        for entry in self.target.fs.scandir(nstmp_path):
-            if entry.is_dir() and entry.name != "#nsinternal#":
-                nstmp_users.add(entry.name)
+        seen = set()
+        nstmp_path = self.target.fs.path("/var/nstmp/")
+
+        # Build a set of nstmp users
+        if nstmp_path.exists():
+            for entry in nstmp_path.iterdir():
+                if entry.is_dir() and entry.name != "#nsinternal#":
+                    # The nsmonitor user has a home directory of /var/nstmp/monitors rather than /var/nstmp/nsmonitor
+                    username = "nsmonitor" if entry.name == "monitors" else entry.name
+                    nstmp_users.add(username)
+
+        # Yield users from the config, matching them to their 'home' in /var/nstmp if it exists.
         for username in self._config_usernames:
-            nstmp_home = nstmp_user_path.format(username=username)
-            user_home = nstmp_home if self.target.fs.exists(nstmp_home) else None
+            nstmp_home = nstmp_path.joinpath(username)
+            user_home = nstmp_home if nstmp_home.exists() else None
 
             if user_home:
                 # After this loop we will yield all users who are not in the config, but are listed in /var/nstmp/
@@ -114,13 +139,28 @@ class CitrixBsdPlugin(BsdPlugin):
 
             if username == "root" and self.target.fs.exists("/root"):
                 # If we got here, 'root' is present both in /var/nstmp and in /root. In such cases, we yield
-                # the 'root' user as having '/root' as a home, not in /var/nstmp.
-                user_home = "/root"
+                # the 'root' user as having '/root' as a home, not in /var/nstmp, as there is no 'nscli_history'
+                # for the root user in /var/nstmp.
+                user_home = self.target.fs.path("/root")
 
+            seen.add((username, user_home.as_posix() if user_home else None, None))
             yield UnixUserRecord(name=username, home=user_home)
 
+        # Yield all users in nstmp that were not observed in the config
         for username in nstmp_users:
-            yield UnixUserRecord(name=username, home=nstmp_user_path.format(username=username))
+            # The nsmonitor user has a home directory of /var/nstmp/monitors rather than /var/nstmp/nsmonitor
+            home = nstmp_path.joinpath(username) if username != "nsmonitor" else nstmp_path.joinpath("monitors")
+            seen.add((username, home.as_posix(), None))
+            yield UnixUserRecord(name=username, home=home)
+
+        # Yield users from /etc/passwd if we have not seem them in previous loops
+        for user in super().users():
+            if (user.name, user.home.as_posix(), user.shell) in seen:
+                continue
+            # To prevent bogus command history for all users without a home whenever a history is located at the root
+            # of the filesystem, we set the user home to None if their home is equivalent to '/'
+            user.home = user.home if user.home != "/" else None
+            yield user
 
     @export(property=True)
     def os(self) -> str:

dissect.target-3.15.dev31/dissect/target/plugins/os/unix/bsd/citrix/history.py

@@ -0,0 +1,130 @@
+import re
+from typing import Iterator, Optional
+
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import UnixUserRecord
+from dissect.target.helpers.utils import year_rollover_helper
+from dissect.target.plugin import export
+from dissect.target.plugins.os.unix.history import (
+    CommandHistoryPlugin,
+    CommandHistoryRecord,
+)
+
+RE_CITRIX_NETSCALER_BASH_HISTORY_DATE = re.compile(r"(?P<date>[^<]+)\s")
+
+CITRIX_NETSCALER_BASH_HISTORY_RE = re.compile(
+    r"""
+        (?P<date>[^<]+)
+        \s
+        <
+            (?P<syslog_facility>[^\.]+)
+            \.
+            (?P<syslog_loglevel>[^>]+)
+        >
+        \s
+        (?P<hostname>[^\s]+)
+        \s
+        (?P<process_name>[^\[]+)
+            \[
+                (?P<process_id>\d+)
+            \]
+        :
+        \s
+        (?P<username>.*)\s
+        on\s
+            (?P<destination>[^\s]+)\s
+        shell_command=
+        \"
+            (?P<command>.*)
+        \"
+    $
+    """,
+    re.VERBOSE,
+)
+
+
+class CitrixCommandHistoryPlugin(CommandHistoryPlugin):
+    COMMAND_HISTORY_ABSOLUTE_PATHS = (("citrix-netscaler-bash", "/var/log/bash.log*"),)
+    COMMAND_HISTORY_RELATIVE_PATHS = CommandHistoryPlugin.COMMAND_HISTORY_RELATIVE_PATHS + (
+        ("citrix-netscaler-cli", ".nscli_history"),
+    )
+
+    def _find_history_files(self) -> list[tuple[str, TargetPath, Optional[UnixUserRecord]]]:
+        """Find history files on the target that this plugin can parse."""
+        history_files = []
+        for shell, history_absolute_path_glob in self.COMMAND_HISTORY_ABSOLUTE_PATHS:
+            for path in self.target.fs.path("/").glob(history_absolute_path_glob.lstrip("/")):
+                history_files.append((shell, path, None))
+
+        # Also utilize the _find_history_files function of the parent class
+        history_files.extend(super()._find_history_files())
+        return history_files
+
+    def _find_user_by_name(self, username: str) -> Optional[UnixUserRecord]:
+        """Cached function to return the matching UnixUserRecord for a given username."""
+        if username is None:
+            return None
+
+        user_details = self.target.user_details.find(username=username)
+        return user_details.user if user_details else None
+
+    @export(record=CommandHistoryRecord)
+    def commandhistory(self) -> Iterator[CommandHistoryRecord]:
+        """Return shell history for all users.
+
+        When using a shell, history of the used commands is kept on the system.
+        """
+
+        for shell, history_path, user in self._history_files:
+            if shell == "citrix-netscaler-cli":
+                yield from self.parse_netscaler_cli_history(history_path, user)
+            elif shell == "citrix-netscaler-bash":
+                yield from self.parse_netscaler_bash_history(history_path)
+
+    def parse_netscaler_bash_history(self, path: TargetPath) -> Iterator[CommandHistoryRecord]:
+        """Parse bash.log* contents."""
+        for ts, line in year_rollover_helper(path, RE_CITRIX_NETSCALER_BASH_HISTORY_DATE, "%b %d %H:%M:%S "):
+            line = line.strip()
+            if not line:
+                continue
+
+            match = CITRIX_NETSCALER_BASH_HISTORY_RE.match(line)
+            if not match:
+                continue
+
+            group = match.groupdict()
+            command = group.get("command")
+            user = self._find_user_by_name(group.get("username"))
+
+            yield CommandHistoryRecord(
+                ts=ts,
+                command=command,
+                shell="citrix-netscaler-bash",
+                source=path,
+                _target=self.target,
+                _user=user,
+            )
+
+    def parse_netscaler_cli_history(
+        self, history_file: TargetPath, user: UnixUserRecord
+    ) -> Iterator[CommandHistoryRecord]:
+        """Parses the history file of the Citrix Netscaler CLI.
+
+        The only difference compared to generic bash history files is that the first line will start with
+        ``_HiStOrY_V2_``, which we will skip.
+        """
+        for idx, line in enumerate(history_file.open("rt")):
+            if not (line := line.strip()):
+                continue
+
+            if idx == 0 and line == "_HiStOrY_V2_":
+                continue
+
+            yield CommandHistoryRecord(
+                ts=None,
+                command=line,
+                shell="citrix-netscaler-cli",
+                source=history_file,
+                _target=self.target,
+                _user=user,
+            )

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.15.dev29
+Version: 3.15.dev31
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31}/dissect.target.egg-info/SOURCES.txt

@@ -198,6 +198,7 @@ dissect/target/plugins/os/unix/shadow.py
 dissect/target/plugins/os/unix/bsd/_os.py
 dissect/target/plugins/os/unix/bsd/citrix/__init__.py
 dissect/target/plugins/os/unix/bsd/citrix/_os.py
+dissect/target/plugins/os/unix/bsd/citrix/history.py
 dissect/target/plugins/os/unix/bsd/freebsd/__init__.py
 dissect/target/plugins/os/unix/bsd/freebsd/_os.py
 dissect/target/plugins/os/unix/bsd/ios/__init__.py
@@ -461,6 +462,7 @@ tests/plugins/os/unix/test_version.py
 tests/plugins/os/unix/bsd/__init__.py
 tests/plugins/os/unix/bsd/citrix/__init__.py
 tests/plugins/os/unix/bsd/citrix/test__os.py
+tests/plugins/os/unix/bsd/citrix/test_history.py
 tests/plugins/os/unix/bsd/osx/__init__.py
 tests/plugins/os/unix/bsd/osx/test__os.py
 tests/plugins/os/unix/bsd/osx/test_user.py

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31}/tests/conftest.py

@@ -12,7 +12,7 @@ from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
 from dissect.target.plugin import OSPlugin
 from dissect.target.plugins.general import default
 from dissect.target.plugins.os.unix._os import UnixPlugin
-from dissect.target.plugins.os.unix.bsd.citrix._os import CitrixBsdPlugin
+from dissect.target.plugins.os.unix.bsd.citrix._os import CitrixPlugin
 from dissect.target.plugins.os.unix.bsd.osx._os import MacPlugin
 from dissect.target.plugins.os.unix.linux._os import LinuxPlugin
 from dissect.target.plugins.os.unix.linux.android._os import AndroidPlugin
@@ -301,11 +301,15 @@ def target_osx(tmp_path: pathlib.Path, fs_osx: Filesystem) -> Iterator[Target]:
 
 
 @pytest.fixture
-def target_citrix(tmp_path: pathlib.Path, fs_bsd: Filesystem) -> Iterator[Target]:
-    mock_target = make_os_target(tmp_path, CitrixBsdPlugin, root_fs=fs_bsd, apply_target=False)
+def target_citrix(tmp_path: pathlib.Path, fs_bsd: VirtualFilesystem) -> Target:
+    mock_target = next(make_mock_target(tmp_path))
+    mock_target._os_plugin = CitrixPlugin
+
+    mock_target.filesystems.add(fs_bsd)
 
     var_filesystem = VirtualFilesystem()
     var_filesystem.makedirs("/netscaler")
+    var_filesystem.makedirs("/log")
     mock_target.filesystems.add(var_filesystem)
 
     flash_filesystem = VirtualFilesystem()

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31}/tests/plugins/apps/webserver/test_citrix.py

@@ -1,6 +1,8 @@
 from datetime import datetime, timedelta, timezone
 from io import BytesIO
 
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.apps.webserver.apache import ApachePlugin
 from dissect.target.plugins.apps.webserver.citrix import (
     LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME,
     LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME_WITH_HEADERS,
@@ -30,10 +32,10 @@ def test_infer_access_log_citrix_netscaler_combined_response_time_with_headers()
     assert logformat == LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME_WITH_HEADERS
 
 
-def test_access_logs(target_citrix: Target) -> None:
+def test_access_logs(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
     tz = timezone(timedelta(hours=1))
     data_file = absolute_path("_data/plugins/apps/webserver/citrix/httpaccess.log")
-    target_citrix.fs.mounts["/"].map_file("var/log/httpaccess.log", data_file)
+    fs_bsd.map_file("var/log/httpaccess.log", data_file)
 
     target_citrix.add_plugin(CitrixWebserverPlugin)
 
@@ -69,9 +71,9 @@ def test_access_logs(target_citrix: Target) -> None:
     assert citrix_netscaler_headers_combined_response_log.pid == 82775
 
 
-def test_error_logs(target_citrix: Target) -> None:
-    target_citrix.fs.mounts["/"].map_file("var/log/httperror-vpn.log", BytesIO(b"Foo"))
-    target_citrix.fs.mounts["/"].map_file("var/log/httperror.log", BytesIO(b"Bar"))
+def test_error_logs(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
+    fs_bsd.map_file("var/log/httperror-vpn.log", BytesIO(b"Foo"))
+    fs_bsd.map_file("var/log/httperror.log", BytesIO(b"Bar"))
 
     target_citrix.add_plugin(CitrixWebserverPlugin)
     access_log_paths, error_log_paths = target_citrix.citrix.get_log_paths()
@@ -79,10 +81,11 @@ def test_error_logs(target_citrix: Target) -> None:
     assert len(error_log_paths) == 2
 
 
-def test_access_logs_webserver_namespace(target_citrix: Target) -> None:
+def test_access_logs_webserver_namespace(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
     data_file = absolute_path("_data/plugins/apps/webserver/citrix/httpaccess.log")
-    target_citrix.fs.mounts["/"].map_file("var/log/httpaccess.log", data_file)
+    fs_bsd.map_file("var/log/httpaccess.log", data_file)
 
+    target_citrix.add_plugin(ApachePlugin, check_compatible=False)
     target_citrix.add_plugin(CitrixWebserverPlugin)
     target_citrix.add_plugin(WebserverPlugin)
 

dissect.target-3.15.dev31/tests/plugins/os/unix/bsd/citrix/test__os.py

@@ -0,0 +1,65 @@
+import textwrap
+from io import BytesIO
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.bsd.citrix._os import CitrixPlugin
+from dissect.target.target import Target
+
+
+def test_citrix_os(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
+    example_etc_passwd = """
+    # $FreeBSD: releng/11.4/etc/master.passwd 359448 2020-03-30 17:11:21Z brooks $
+    #
+    root:*:0:0:Charlie &:/root:/usr/bin/bash
+    bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin
+    nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin
+    """
+
+    fs_bsd.map_file_fh("/root/.cli_history", BytesIO(b'echo "hello world"'))
+    fs_bsd.map_file_fh("/var/nstmp/robin/.cli_history", BytesIO(b'echo "hello world"'))
+    fs_bsd.map_file_fh("/var/nstmp/alfred/.cli_history", BytesIO(b'echo "bye world"'))
+    fs_bsd.map_file_fh("/etc/passwd", BytesIO(textwrap.dedent(example_etc_passwd).encode()))
+
+    target_citrix.add_plugin(CitrixPlugin)
+
+    assert target_citrix.os == "citrix-netscaler"
+    hostname = target_citrix.hostname
+    version = target_citrix.version
+    users = sorted(list(target_citrix.users()), key=lambda user: (user.name, str(user.home) if user.home else ""))
+    ips = target_citrix.ips
+    ips.sort()
+
+    assert hostname == "mynetscaler"
+    assert version == "NetScaler 13.1 build 30 (ns-13.1-30.52)"
+
+    assert ips == ["10.0.0.68", "10.0.0.69"]
+
+    assert target_citrix.timezone == "Europe/Amsterdam"
+
+    assert len(users) == 8
+
+    assert users[0].name == "alfred"  # Only listed in /var/nstmp
+    assert users[0].home == "/var/nstmp/alfred"
+
+    assert users[1].name == "batman"  # Only listed in config
+    assert users[1].home is None
+
+    assert users[2].name == "bind"  # User entry from /etc/passwd, home overwritten from '/' to None
+    assert users[2].home is None
+
+    assert users[3].name == "jasontodd"  # Only listed in config backup
+    assert users[3].home is None
+
+    assert users[4].name == "nobody"  # User entry for the nobody user from /etc/passwd
+    assert users[4].home == "/nonexistent"
+
+    assert users[5].name == "robin"  # Listed in config and /var/nstmp
+    assert users[5].home == "/var/nstmp/robin"
+
+    assert users[6].name == "root"  # User entry for /root, from the config
+    assert users[6].home == "/root"
+    assert users[6].shell is None
+
+    assert users[7].name == "root"  # User entry for /root, from /etc/passwd
+    assert users[7].home == "/root"
+    assert users[7].shell == "/usr/bin/bash"

dissect.target-3.15.dev31/tests/plugins/os/unix/bsd/citrix/test_history.py

@@ -0,0 +1,88 @@
+import datetime
+import gzip
+import textwrap
+from io import BytesIO
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.unix.bsd.citrix.history import CitrixCommandHistoryPlugin
+from dissect.target.target import Target
+
+
+def test_netscaler_bash_history_absolute_path_glob(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
+    commandhistory_data = """\
+    Aug  9 12:56:00 <local7.notice> ns bash[23841]: root on /dev/pts/0 shell_command="find . -name '*ci.php*'"
+    Aug 10 11:57:39 <local7.notice> ns bash[56440]: (null) on /dev/pts/1 shell_command="debug "hello world""
+    """
+
+    fs_bsd.map_file_fh(
+        "/var/log/bash.log",
+        BytesIO(textwrap.dedent(commandhistory_data).encode()),
+    )
+
+    target_citrix.add_plugin(CitrixCommandHistoryPlugin)
+
+    results = list(target_citrix.commandhistory())
+    assert len(results) == 2
+    # Due to the usage of year_rollover_helper, the results are returned back-to-front. Moreover, it takes the
+    # year from the file's mtime, which in this mocked version is epoch 0 (thus the year 1970)
+    assert results[1].ts == datetime.datetime(1970, 8, 9, 12, 56, 0, tzinfo=datetime.timezone.utc)
+    assert results[1].command == "find . -name '*ci.php*'"
+    assert results[1].shell == "citrix-netscaler-bash"
+    assert results[1].source.as_posix() == "/var/log/bash.log"
+
+    assert results[0].ts == datetime.datetime(1970, 8, 10, 11, 57, 39, tzinfo=datetime.timezone.utc)
+    assert results[0].command == 'debug "hello world"'
+    assert results[0].shell == "citrix-netscaler-bash"
+    assert results[0].source.as_posix() == "/var/log/bash.log"
+
+
+def test_netscaler_commandhistory_decompress(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
+    commandhistory_data = """\
+    Aug  9 12:56:00 <local7.notice> ns bash[23841]: root on /dev/pts/0 shell_command="find . -name '*ci.php*'"
+    Aug 10 11:57:39 <local7.notice> ns bash[56440]: (null) on /dev/pts/1 shell_command="debug "hello world""
+    """
+
+    fs_bsd.map_file_fh(
+        "/var/log/bash.log.0.gz",
+        BytesIO(gzip.compress(textwrap.dedent(commandhistory_data).encode())),
+    )
+
+    target_citrix.add_plugin(CitrixCommandHistoryPlugin)
+
+    results = list(target_citrix.commandhistory())
+    assert len(results) == 2
+    # Due to the usage of year_rollover_history, the results are returned back-to-front
+    assert results[1].ts == datetime.datetime(1970, 8, 9, 12, 56, 0, tzinfo=datetime.timezone.utc)
+    assert results[1].command == "find . -name '*ci.php*'"
+    assert results[1].shell == "citrix-netscaler-bash"
+    assert results[1].source.as_posix() == "/var/log/bash.log.0.gz"
+
+    assert results[0].ts == datetime.datetime(1970, 8, 10, 11, 57, 39, tzinfo=datetime.timezone.utc)
+    assert results[0].command == 'debug "hello world"'
+    assert results[0].shell == "citrix-netscaler-bash"
+    assert results[0].source.as_posix() == "/var/log/bash.log.0.gz"
+
+
+def test_netscaler_cli_history(target_citrix: Target, fs_bsd: VirtualFilesystem) -> None:
+    commandhistory_data = """\
+    _HiStOrY_V2_
+    help
+    shell
+    """
+
+    fs_bsd.map_file_fh("/var/nstmp/user/.nscli_history", BytesIO(textwrap.dedent(commandhistory_data).encode()))
+
+    target_citrix.add_plugin(CitrixCommandHistoryPlugin)
+
+    results = list(target_citrix.commandhistory())
+    assert len(results) == 2
+
+    assert not results[0].ts
+    assert results[0].command == "help"
+    assert results[0].shell == "citrix-netscaler-cli"
+    assert results[0].source.as_posix() == "/var/nstmp/user/.nscli_history"
+
+    assert not results[1].ts
+    assert results[1].command == "shell"
+    assert results[1].shell == "citrix-netscaler-cli"
+    assert results[1].source.as_posix() == "/var/nstmp/user/.nscli_history"

{dissect.target-3.15.dev29 → dissect.target-3.15.dev31}/tests/test_plugin.py

@@ -2,7 +2,7 @@ import os
 from functools import reduce
 from pathlib import Path
 from typing import Optional
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import Mock, patch
 
 import pytest
 from flow.record import Record
@@ -82,9 +82,9 @@ class MockOSWarpPlugin(OSPlugin):
 @patch(
     "dissect.target.plugin.plugins",
     return_value=[
-        {"module": "test.x13", "exports": ["f3"], "namespace": "Warp", "class": "x13", "cls": MagicMock},
-        {"module": "os", "exports": ["f3"], "namespace": None, "class": "f3", "cls": MagicMock},
-        {"module": "os.warp._os", "exports": ["f6"], "namespace": None, "class": "warp", "cls": MockOSWarpPlugin},
+        {"module": "test.x13", "exports": ["f3"], "namespace": "Warp", "class": "x13", "is_osplugin": False},
+        {"module": "os", "exports": ["f3"], "namespace": None, "class": "f3", "is_osplugin": False},
+        {"module": "os.warp._os", "exports": ["f6"], "namespace": None, "class": "warp", "is_osplugin": True},
     ],
 )
 @patch("dissect.target.Target", create=True)

dissect.target-3.15.dev29/tests/plugins/os/unix/bsd/citrix/test__os.py

@@ -1,43 +0,0 @@
-from io import BytesIO
-
-from dissect.target.plugins.os.unix.bsd.citrix._os import CitrixBsdPlugin
-
-
-def test_unix_bsd_citrix_os(target_citrix):
-    target_citrix.add_plugin(CitrixBsdPlugin)
-
-    assert target_citrix.os == "citrix-netscaler"
-
-    target_citrix.fs.mounts["/"].map_file_fh("/root/.cli_history", BytesIO(b'echo "hello world"'))
-    target_citrix.fs.mounts["/"].map_file_fh("/var/nstmp/robin/.cli_history", BytesIO(b'echo "hello world"'))
-    target_citrix.fs.mounts["/"].map_file_fh("/var/nstmp/alfred/.cli_history", BytesIO(b'echo "bye world"'))
-
-    hostname = target_citrix.hostname
-    version = target_citrix.version
-    users = sorted(list(target_citrix.users()), key=lambda user: (user.name, user.home if user.home else ""))
-    ips = target_citrix.ips
-    ips.sort()
-
-    assert hostname == "mynetscaler"
-    assert version == "NetScaler 13.1 build 30 (ns-13.1-30.52)"
-
-    assert ips == ["10.0.0.68", "10.0.0.69"]
-
-    assert target_citrix.timezone == "Europe/Amsterdam"
-
-    assert len(users) == 5
-
-    assert users[0].name == "alfred"  # Only listed in /var/nstmp
-    assert users[0].home == "/var/nstmp/alfred"
-
-    assert users[1].name == "batman"  # Only listed in config
-    assert users[1].home is None
-
-    assert users[2].name == "jasontodd"  # Only listed in config backup
-    assert users[2].home is None
-
-    assert users[3].name == "robin"  # Listed in config and /var/nstmp
-    assert users[3].home == "/var/nstmp/robin"
-
-    assert users[4].name == "root"  # User entry for /root
-    assert users[4].home == "/root"