dissect.target 3.17.dev4__tar.gz → 3.17.dev5__tar.gz

{dissect.target-3.17.dev4/dissect.target.egg-info → dissect.target-3.17.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.17.dev4
+Version: 3.17.dev5
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect.target-3.17.dev5/dissect/target/plugins/apps/vpn/openvpn.py

@@ -0,0 +1,215 @@
+from __future__ import annotations
+
+import io
+import itertools
+from itertools import product
+from typing import Iterable, Iterator, Optional, Union
+
+from dissect.target.exceptions import ConfigurationParsingError, UnsupportedPluginError
+from dissect.target.helpers import fsutil
+from dissect.target.helpers.configutil import Default, ListUnwrapper, _update_dictionary
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import OperatingSystem, Plugin, arg, export
+
+COMMON_ELEMENTS = [
+    ("string", "name"),  # basename of .conf file
+    ("string", "proto"),
+    ("string", "dev"),
+    ("string", "ca"),
+    ("string", "cert"),
+    ("string", "key"),
+    ("boolean", "redacted_key"),
+    ("string", "tls_auth"),
+    ("string", "status"),
+    ("string", "log"),
+    ("string", "source"),
+]
+
+OpenVPNServer = TargetRecordDescriptor(
+    "application/vpn/openvpn/server",
+    [
+        ("net.ipaddress", "local"),
+        ("uint16", "port"),
+        ("string", "dh"),
+        ("string", "topology"),
+        ("string", "server"),
+        ("string", "ifconfig_pool_persist"),
+        ("string[]", "pushed_options"),
+        ("boolean", "client_to_client"),
+        ("boolean", "duplicate_cn"),
+        *COMMON_ELEMENTS,
+    ],
+)
+
+OpenVPNClient = TargetRecordDescriptor(
+    "application/vpn/openvpn/client",
+    [
+        ("string[]", "remote"),
+        *COMMON_ELEMENTS,
+    ],
+)
+
+
+class OpenVPNParser(Default):
+    def __init__(self, *args, **kwargs):
+        boolean_fields = OpenVPNServer.getfields("boolean") + OpenVPNClient.getfields("boolean")
+        self.boolean_field_names = set(field.name.replace("_", "-") for field in boolean_fields)
+
+        super().__init__(*args, separator=(r"\s",), collapse=["key", "ca", "cert"], **kwargs)
+
+    def parse_file(self, fh: io.TextIOBase) -> None:
+        root = {}
+        iterator = self.line_reader(fh)
+        for line in iterator:
+            if line.startswith("<"):
+                key = line.strip().strip("<>")
+                value = self._read_blob(iterator)
+                _update_dictionary(root, key, value)
+                continue
+
+            self._parse_line(root, line)
+
+        self.parsed_data = ListUnwrapper.unwrap(root)
+
+    def _read_blob(self, lines: Iterable[str]) -> str | list[dict]:
+        """Read the whole section between <data></data> sections"""
+        output = ""
+        with io.StringIO() as buffer:
+            for line in lines:
+                if "</" in line:
+                    break
+
+                buffer.write(line)
+            output = buffer.getvalue()
+
+        # Check for connection profile blocks
+        if not output.startswith("-----"):
+            profile_dict = dict()
+            for line in output.splitlines():
+                self._parse_line(profile_dict, line)
+
+            # We put it as a list as _update_dictionary appends data in a list.
+            output = [profile_dict]
+
+        return output
+
+    def _parse_line(self, root: dict, line: str) -> None:
+        key, *value = self.SEPARATOR.split(line, 1)
+        # Unquote data
+        value = value[0].strip() if value else ""
+
+        value = value.strip("'\"")
+
+        if key in self.boolean_field_names:
+            value = True
+
+        _update_dictionary(root, key, value)
+
+
+class OpenVPNPlugin(Plugin):
+    """OpenVPN configuration parser.
+
+    References:
+        - man (8) openvpn
+    """
+
+    __namespace__ = "openvpn"
+
+    config_globs = [
+        # This catches openvpn@, openvpn-client@, and openvpn-server@ systemd configurations
+        # Linux
+        "/etc/openvpn/",
+        # Windows
+        "sysvol/Program Files/OpenVPN/config/",
+    ]
+
+    user_config_paths = {
+        OperatingSystem.WINDOWS.value: ["OpenVPN/config/"],
+        OperatingSystem.OSX.value: ["Library/Application Support/OpenVPN Connect/profiles/"],
+    }
+
+    def __init__(self, target) -> None:
+        super().__init__(target)
+        self.configs: list[fsutil.TargetPath] = []
+        for base, glob in product(self.config_globs, ["*.conf", "*.ovpn"]):
+            self.configs.extend(self.target.fs.path(base).rglob(glob))
+
+        user_paths = self.user_config_paths.get(target.os, [])
+        for path, glob, user_details in itertools.product(
+            user_paths, ["*.conf", "*.ovpn"], self.target.user_details.all_with_home()
+        ):
+            self.configs.extend(user_details.home_path.joinpath(path).rglob(glob))
+
+    def check_compatible(self) -> None:
+        if not self.configs:
+            raise UnsupportedPluginError("No OpenVPN configuration files found")
+
+    def _load_config(self, parser: OpenVPNParser, config_path: fsutil.TargetPath) -> Optional[dict]:
+        with config_path.open("rt") as file:
+            try:
+                parser.parse_file(file)
+            except ConfigurationParsingError as e:
+                # Couldn't parse file, continue
+                self.target.log.info("An issue occurred during parsing of %s, continuing", config_path)
+                self.target.log.debug("", exc_info=e)
+                return None
+
+        return parser.parsed_data
+
+    @export(record=[OpenVPNServer, OpenVPNClient])
+    @arg("--export-key", action="store_true")
+    def config(self, export_key: bool = False) -> Iterator[Union[OpenVPNServer, OpenVPNClient]]:
+        """Parses config files from openvpn interfaces."""
+        # We define the parser here so we can reuse it
+        parser = OpenVPNParser()
+
+        for config_path in self.configs:
+            config = self._load_config(parser, config_path)
+
+            common_elements = {
+                "name": config_path.stem,
+                "proto": config.get("proto", "udp"),  # Default is UDP
+                "dev": config.get("dev"),
+                "ca": config.get("ca"),
+                "cert": config.get("cert"),
+                "key": config.get("key"),
+                "status": config.get("status"),
+                "log": config.get("log"),
+                "source": config_path,
+                "_target": self.target,
+            }
+
+            if not export_key and "PRIVATE KEY" in common_elements.get("key"):
+                common_elements.update({"key": None})
+                common_elements.update({"redacted_key": True})
+
+            tls_auth = config.get("tls-auth", "")
+            # The format of tls-auth is 'tls-auth ta.key <NUM>'.
+            # NUM is either 0 or 1 depending on whether the configuration
+            # is for the client or server, and that does not interest us
+            # This gets rid of the number at the end, while still supporting spaces
+            tls_auth = " ".join(tls_auth.split(" ")[:-1]).strip("'\"")
+
+            common_elements.update({"tls_auth": tls_auth})
+
+            if "client" in config:
+                remote = config.get("remote", [])
+
+                yield OpenVPNClient(
+                    **common_elements,
+                    remote=remote,
+                )
+            else:
+                # Defaults here are taken from `man (8) openvpn`
+                yield OpenVPNServer(
+                    **common_elements,
+                    local=config.get("local", "0.0.0.0"),
+                    port=int(config.get("port", "1194")),
+                    dh=config.get("dh"),
+                    topology=config.get("topology"),
+                    server=config.get("server"),
+                    ifconfig_pool_persist=config.get("ifconfig-pool-persist"),
+                    pushed_options=config.get("push", []),
+                    client_to_client=config.get("client-to-client", False),
+                    duplicate_cn=config.get("duplicate-cn", False),
+                )

{dissect.target-3.17.dev4 → dissect.target-3.17.dev5/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.17.dev4
+Version: 3.17.dev5
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.17.dev4 → dissect.target-3.17.dev5}/tests/plugins/apps/vpn/test_openvpn.py

@@ -1,3 +1,4 @@
+import io
 from pathlib import Path
 from typing import Union
 
@@ -6,6 +7,7 @@ import pytest
 from dissect.target.filesystem import Filesystem
 from dissect.target.plugins.apps.vpn.openvpn import (
     OpenVPNClient,
+    OpenVPNParser,
     OpenVPNPlugin,
     OpenVPNServer,
 )
@@ -17,7 +19,9 @@ def map_openvpn_configs(filesystem: Filesystem, target_dir: Path):
     client_config = absolute_path("_data/plugins/apps/vpn/openvpn/client.conf")
     server_config = absolute_path("_data/plugins/apps/vpn/openvpn/server.conf")
     filesystem.map_file(str(target_dir.joinpath("server.conf")), server_config)
+    filesystem.map_file(str(target_dir.joinpath("server.ovpn")), server_config)
     filesystem.map_file(str(target_dir.joinpath("client.conf")), client_config)
+    filesystem.map_file(str(target_dir.joinpath("client.ovpn")), client_config)
 
 
 @pytest.mark.parametrize(
@@ -26,12 +30,12 @@ def map_openvpn_configs(filesystem: Filesystem, target_dir: Path):
         (
             "target_win_users",
             "fs_win",
-            "Program Files/OpenVPN/config",
+            "Program Files/OpenVPN/config/helper",
         ),
         (
             "target_win_users",
             "fs_win",
-            "Users/John/OpenVPN/config",
+            "Users/John/OpenVPN/config/helper",
         ),
         (
             "target_unix_users",
@@ -50,7 +54,7 @@ def test_openvpn_plugin(target: str, fs: str, map_path: str, request: pytest.Fix
 
 
 def _verify_records(records: list[Union[OpenVPNClient, OpenVPNServer]]):
-    assert len(records) == 2
+    assert len(records) == 4
 
     for record in records:
         if record.name == "server":
@@ -69,9 +73,10 @@ def _verify_records(records: list[Union[OpenVPNClient, OpenVPNServer]]):
             assert record.duplicate_cn.value is False
             assert record.proto == "udp"
             assert record.dev == "tun"
-            assert record.ca == "ca.crt"
-            assert record.cert == "server.crt"
-            assert record.key == "server.key"
+            assert "BEGIN CERTIFICATE" in record.ca
+            assert "BEGIN CERTIFICATE" in record.cert
+            assert record.key is None
+            assert record.redacted_key
             assert record.tls_auth == "/etc/a ta.key"
             assert record.status == "/var/log/openvpn/openvpn-status.log"
             assert record.log is None
@@ -89,6 +94,29 @@ def _verify_records(records: list[Union[OpenVPNClient, OpenVPNServer]]):
             assert record.ca == "ca.crt"
             assert record.cert == "client.crt"
             assert record.key == "client.key"
+            assert not record.redacted_key
             assert record.tls_auth == "ta.key"
             assert record.status is None
             assert record.log is None
+
+
+@pytest.mark.parametrize(
+    "data_string, expected_data",
+    [
+        (
+            "<connection>\nroute data\n</connection>\n",
+            {"connection": {"list_item0": {"route": "data"}}},
+        ),
+        (
+            "<ca>\n----- BEGIN PRIVATE DATA -----\n</ca>",
+            {
+                "ca": "----- BEGIN PRIVATE DATA -----\n",
+            },
+        ),
+    ],
+)
+def test_openvpn_config(data_string: str, expected_data: Union[dict, list]) -> None:
+    parser = OpenVPNParser()
+    parser.parse_file(io.StringIO(data_string))
+
+    assert parser.parsed_data == expected_data

dissect.target-3.17.dev4/dissect/target/plugins/apps/vpn/openvpn.py

@@ -1,193 +0,0 @@
-import itertools
-import re
-from os.path import basename
-from typing import Iterator, Union
-
-from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers import fsutil
-from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import OperatingSystem, Plugin, export
-
-COMMON_ELEMENTS = [
-    ("string", "name"),  # basename of .conf file
-    ("string", "proto"),
-    ("string", "dev"),
-    ("string", "ca"),
-    ("string", "cert"),
-    ("string", "key"),
-    ("string", "tls_auth"),
-    ("string", "status"),
-    ("string", "log"),
-    ("string", "source"),
-]
-
-OpenVPNServer = TargetRecordDescriptor(
-    "application/vpn/openvpn/server",
-    [
-        ("net.ipaddress", "local"),
-        ("uint16", "port"),
-        ("string", "dh"),
-        ("string", "topology"),
-        ("string", "server"),
-        ("string", "ifconfig_pool_persist"),
-        ("string[]", "pushed_options"),
-        ("boolean", "client_to_client"),
-        ("boolean", "duplicate_cn"),
-        *COMMON_ELEMENTS,
-    ],
-)
-
-OpenVPNClient = TargetRecordDescriptor(
-    "application/vpn/openvpn/client",
-    [
-        ("string[]", "remote"),
-        *COMMON_ELEMENTS,
-    ],
-)
-
-
-CONFIG_COMMENT_SPLIT_REGEX = re.compile("(#|;)")
-
-
-class OpenVPNPlugin(Plugin):
-    """OpenVPN configuration parser.
-
-    References:
-        - man (8) openvpn
-    """
-
-    __namespace__ = "openvpn"
-
-    config_globs = [
-        # This catches openvpn@, openvpn-client@, and openvpn-server@ systemd configurations
-        # Linux
-        "/etc/openvpn/*.conf",
-        "/etc/openvpn/server/*.conf",
-        "/etc/openvpn/client/*.conf",
-        # Windows
-        "sysvol/Program Files/OpenVPN/config/*.conf",
-    ]
-
-    user_config_paths = {
-        OperatingSystem.WINDOWS.value: ["OpenVPN/config/*.conf"],
-        OperatingSystem.OSX.value: ["Library/Application Support/OpenVPN Connect/profiles/*.conf"],
-    }
-
-    def __init__(self, target) -> None:
-        super().__init__(target)
-        self.configs: list[fsutil.TargetPath] = []
-        for path in self.config_globs:
-            self.configs.extend(self.target.fs.path().glob(path.lstrip("/")))
-
-        user_paths = self.user_config_paths.get(target.os, [])
-        for path, user_details in itertools.product(user_paths, self.target.user_details.all_with_home()):
-            self.configs.extend(user_details.home_path.glob(path))
-
-    def check_compatible(self) -> None:
-        if not self.configs:
-            raise UnsupportedPluginError("No OpenVPN configuration files found")
-
-    @export(record=[OpenVPNServer, OpenVPNClient])
-    def config(self) -> Iterator[Union[OpenVPNServer, OpenVPNClient]]:
-        """Parses config files from openvpn interfaces."""
-
-        for config_path in self.configs:
-            config = _parse_config(config_path.read_text())
-
-            name = basename(config_path).replace(".conf", "")
-            proto = config.get("proto", "udp")  # Default is UDP
-            dev = config.get("dev")
-            ca = _unquote(config.get("ca"))
-            cert = _unquote(config.get("cert"))
-            key = _unquote(config.get("key"))
-            tls_auth = config.get("tls-auth", "")
-            # The format of tls-auth is 'tls-auth ta.key <NUM>'.
-            # NUM is either 0 or 1 depending on whether the configuration
-            # is for the client or server, and that does not interest us
-            # This gets rid of the number at the end, while still supporting spaces
-            tls_auth = _unquote(" ".join(tls_auth.split(" ")[:-1]))
-            status = config.get("status")
-            log = config.get("log")
-
-            if "client" in config:
-                remote = config.get("remote", [])
-                # In cases when there is only a single remote,
-                # we want to return it as its own list
-                if isinstance(remote, str):
-                    remote = [remote]
-
-                yield OpenVPNClient(
-                    name=name,
-                    proto=proto,
-                    dev=dev,
-                    ca=ca,
-                    cert=cert,
-                    key=key,
-                    tls_auth=tls_auth,
-                    status=status,
-                    log=log,
-                    remote=remote,
-                    source=config_path,
-                    _target=self.target,
-                )
-            else:
-                pushed_options = config.get("push", [])
-                # In cases when there is only a single push,
-                # we want to return it as its own list
-                if isinstance(pushed_options, str):
-                    pushed_options = [pushed_options]
-                pushed_options = [_unquote(opt) for opt in pushed_options]
-                # Defaults here are taken from `man (8) openvpn`
-                yield OpenVPNServer(
-                    name=name,
-                    proto=proto,
-                    dev=dev,
-                    ca=ca,
-                    cert=cert,
-                    key=key,
-                    tls_auth=tls_auth,
-                    status=status,
-                    log=log,
-                    local=config.get("local", "0.0.0.0"),
-                    port=int(config.get("port", "1194")),
-                    dh=_unquote(config.get("dh")),
-                    topology=config.get("topology"),
-                    server=config.get("server"),
-                    ifconfig_pool_persist=config.get("ifconfig-pool-persist"),
-                    pushed_options=pushed_options,
-                    client_to_client=config.get("client-to-client", False),
-                    duplicate_cn=config.get("duplicate-cn", False),
-                    source=config_path,
-                    _target=self.target,
-                )
-
-
-def _parse_config(content: str) -> dict[str, Union[str, list[str]]]:
-    """Parses Openvpn config  files"""
-    lines = content.splitlines()
-    res = {}
-    boolean_fields = OpenVPNServer.getfields("boolean") + OpenVPNClient.getfields("boolean")
-    boolean_field_names = set(field.name for field in boolean_fields)
-
-    for line in lines:
-        # As per man (8) openvpn, lines starting with ; or # are comments
-        if line and not line.startswith((";", "#")):
-            key, *value = line.split(" ", 1)
-            value = value[0] if value else ""
-            # This removes all text after the first comment
-            value = CONFIG_COMMENT_SPLIT_REGEX.split(value, 1)[0].strip()
-
-            if key in boolean_field_names and value == "":
-                value = True
-
-            if old_value := res.get(key):
-                if not isinstance(old_value, list):
-                    old_value = [old_value]
-                res[key] = old_value + [value]
-            else:
-                res[key] = value
-    return res
-
-
-def _unquote(content: str) -> str:
-    return content.strip("\"'")