dissect.target 3.19.dev36__tar.gz → 3.19.dev38__tar.gz

{dissect_target-3.19.dev36/dissect.target.egg-info → dissect_target-3.19.dev38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev36
+Version: 3.19.dev38
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev36 → dissect_target-3.19.dev38}/dissect/target/helpers/record.py

@@ -142,3 +142,40 @@ EmptyRecord = RecordDescriptor(
     "empty",
     [],
 )
+
+COMMON_INTERFACE_ELEMENTS = [
+    ("string", "name"),
+    ("string", "type"),
+    ("boolean", "enabled"),
+    ("string", "mac"),
+    ("net.ipaddress[]", "dns"),
+    ("net.ipaddress[]", "ip"),
+    ("net.ipaddress[]", "gateway"),
+    ("string", "source"),
+]
+
+
+UnixInterfaceRecord = TargetRecordDescriptor(
+    "unix/network/interface",
+    COMMON_INTERFACE_ELEMENTS,
+)
+
+WindowsInterfaceRecord = TargetRecordDescriptor(
+    "windows/network/interface",
+    [
+        *COMMON_INTERFACE_ELEMENTS,
+        ("varint", "vlan"),
+        ("string", "metric"),
+        ("datetime", "last_connected"),
+    ],
+)
+
+MacInterfaceRecord = TargetRecordDescriptor(
+    "macos/network/interface",
+    [
+        *COMMON_INTERFACE_ELEMENTS,
+        ("varint", "vlan"),
+        ("string", "proxy"),
+        ("varint", "interface_service_order"),
+    ],
+)

dissect_target-3.19.dev38/dissect/target/loaders/libvirt.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+
+from defusedxml import ElementTree
+
+from dissect.target import container
+from dissect.target.helpers import fsutil
+from dissect.target.loader import Loader
+from dissect.target.target import Target
+
+
+class LibvirtLoader(Loader):
+    """Load libvirt xml configuration files."""
+
+    def __init__(self, path: Path, **kwargs):
+        path = path.resolve()
+        self.base_dir = path.parent
+        super().__init__(path)
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        if path.suffix.lower() != ".xml":
+            return False
+
+        with path.open("rb") as fh:
+            lines = fh.read(512).split(b"\n")
+            # From what I've seen, these are are always at the start of the file
+            # If its generated using virt-install
+            needles = [b"<domain", b"<name>", b"<uuid>"]
+            return all(any(needle in line for line in lines) for needle in needles)
+
+    def map(self, target: Target) -> None:
+        xml_data = ElementTree.fromstring(self.path.read_text())
+        for disk in xml_data.findall("devices/disk/source"):
+            if not (file := disk.get("file")):
+                continue
+
+            for part in [fsutil.basename(file), file]:
+                if (path := self.base_dir.joinpath(part)).exists():
+                    target.disks.add(container.open(path))
+                    break

dissect_target-3.19.dev38/dissect/target/plugins/child/qemu.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import ChildTargetRecord
+from dissect.target.plugin import ChildTargetPlugin
+
+
+class QemuChildTargetPlugin(ChildTargetPlugin):
+    """Child target plugin that yields all QEMU domains from a KVM libvirt deamon."""
+
+    __type__ = "qemu"
+
+    def check_compatible(self) -> None:
+        if not self.target.fs.path("/etc/libvirt/qemu").exists():
+            raise UnsupportedPluginError("No libvirt QEMU installation found")
+
+    def list_children(self) -> Iterator[ChildTargetRecord]:
+        for domain in self.target.fs.path("/etc/libvirt/qemu").glob("*.xml"):
+            yield ChildTargetRecord(type=self.__type__, path=domain)

dissect_target-3.19.dev38/dissect/target/plugins/general/network.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from typing import Any, Iterator, Union
+
+from flow.record.fieldtypes.net import IPAddress, IPNetwork
+
+from dissect.target.helpers.record import (
+    MacInterfaceRecord,
+    UnixInterfaceRecord,
+    WindowsInterfaceRecord,
+)
+from dissect.target.plugin import Plugin, export, internal
+from dissect.target.target import Target
+
+InterfaceRecord = Union[UnixInterfaceRecord, WindowsInterfaceRecord, MacInterfaceRecord]
+
+
+class NetworkPlugin(Plugin):
+    __namespace__ = "network"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self._interface_list: list[InterfaceRecord] | None = None
+
+    def check_compatible(self) -> None:
+        pass
+
+    def _interfaces(self) -> Iterator[InterfaceRecord]:
+        yield from ()
+
+    def _get_record_type(self, field_name: str) -> Iterator[Any]:
+        for record in self.interfaces():
+            if (output := getattr(record, field_name, None)) is None:
+                continue
+
+            if isinstance(output, list):
+                yield from output
+            else:
+                yield output
+
+    @export(record=InterfaceRecord)
+    def interfaces(self) -> Iterator[InterfaceRecord]:
+        # Only search for the interfaces once
+        if self._interface_list is None:
+            self._interface_list = list(self._interfaces())
+
+        yield from self._interface_list
+
+    @export
+    def ips(self) -> list[IPAddress]:
+        return list(self._get_record_type("ip"))
+
+    @export
+    def gateways(self) -> list[IPAddress]:
+        return list(self._get_record_type("gateway"))
+
+    @export
+    def macs(self) -> list[str]:
+        return list(self._get_record_type("mac"))
+
+    @export
+    def dns(self) -> list[str]:
+        return list(self._get_record_type("dns"))
+
+    @internal
+    def with_ip(self, ip_addr: str) -> Iterator[InterfaceRecord]:
+        for interface in self.interfaces():
+            if ip_addr in interface.ip:
+                yield interface
+
+    @internal
+    def with_mac(self, mac: str) -> Iterator[InterfaceRecord]:
+        for interface in self.interfaces():
+            if interface.mac == mac:
+                yield interface
+
+    @internal
+    def in_cidr(self, cidr: str) -> Iterator[InterfaceRecord]:
+        cidr = IPNetwork(cidr)
+        for interface in self.interfaces():
+            if any(ip_addr in cidr for ip_addr in interface.ip):
+                yield interface

{dissect_target-3.19.dev36 → dissect_target-3.19.dev38/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev36
+Version: 3.19.dev38
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev36 → dissect_target-3.19.dev38}/dissect.target.egg-info/SOURCES.txt

@@ -96,6 +96,7 @@ dissect/target/loaders/dir.py
 dissect/target/loaders/hyperv.py
 dissect/target/loaders/itunes.py
 dissect/target/loaders/kape.py
+dissect/target/loaders/libvirt.py
 dissect/target/loaders/local.py
 dissect/target/loaders/log.py
 dissect/target/loaders/mqtt.py
@@ -167,6 +168,7 @@ dissect/target/plugins/child/__init__.py
 dissect/target/plugins/child/docker.py
 dissect/target/plugins/child/esxi.py
 dissect/target/plugins/child/hyperv.py
+dissect/target/plugins/child/qemu.py
 dissect/target/plugins/child/virtuozzo.py
 dissect/target/plugins/child/vmware_workstation.py
 dissect/target/plugins/child/wsl.py
@@ -190,6 +192,7 @@ dissect/target/plugins/general/config.py
 dissect/target/plugins/general/default.py
 dissect/target/plugins/general/example.py
 dissect/target/plugins/general/loaders.py
+dissect/target/plugins/general/network.py
 dissect/target/plugins/general/osinfo.py
 dissect/target/plugins/general/plugins.py
 dissect/target/plugins/general/scrape.py
@@ -409,6 +412,7 @@ tests/loaders/test_cb.py
 tests/loaders/test_dir.py
 tests/loaders/test_hyperv.py
 tests/loaders/test_kape.py
+tests/loaders/test_libvirt.py
 tests/loaders/test_local.py
 tests/loaders/test_log.py
 tests/loaders/test_mqtt.py
@@ -467,6 +471,7 @@ tests/plugins/apps/webserver/test_webserver.py
 tests/plugins/child/__init__.py
 tests/plugins/child/test_docker.py
 tests/plugins/child/test_hyperv.py
+tests/plugins/child/test_qemu.py
 tests/plugins/child/test_virtuozzo.py
 tests/plugins/child/test_wsl.py
 tests/plugins/filesystem/__init__.py
@@ -485,6 +490,7 @@ tests/plugins/filesystem/unix/test_suid.py
 tests/plugins/general/__init__.py
 tests/plugins/general/test_config.py
 tests/plugins/general/test_default.py
+tests/plugins/general/test_network.py
 tests/plugins/general/test_plugins.py
 tests/plugins/general/test_scrape.py
 tests/plugins/general/test_users.py

dissect_target-3.19.dev38/tests/loaders/test_libvirt.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.loaders.libvirt import LibvirtLoader
+from tests.conftest import absolute_path
+
+
+def test_libvirt_detection(target_bare: Target, tmp_path: Path) -> None:
+    xml_file = tmp_path.joinpath("base")
+    xml_file.write_text("not a libvirt file")
+
+    assert LibvirtLoader.detect(xml_file) is False
+
+    xml_file = tmp_path.joinpath("base.xml")
+    xml_file.write_text("<domain>")
+    assert LibvirtLoader.detect(xml_file) is False
+
+    xml_file = tmp_path.joinpath("base.xml")
+    xml_file.write_text("not a libvirt file")
+
+    assert LibvirtLoader.detect(xml_file) is False
+
+    qemu_xml = Path(absolute_path("_data/loaders/libvirt/qemu.xml"))
+
+    assert LibvirtLoader.detect(qemu_xml)
+
+
+@patch(f"{LibvirtLoader.__module__}.container.open")
+def test_libvirt_map(mocked_container_open: Mock, target_bare: Target, fs_linux: VirtualFilesystem) -> None:
+    fs_linux.map_file("/test.xml", absolute_path("_data/loaders/libvirt/qemu.xml"))
+    fs_linux.map_file_fh("/var/lib/libvirt/images/linux2022.qcow2", None)
+    fs_linux.map_file_fh("/second-disk.qcow2", None)
+    target_bare.fs.mount("/", fs_linux)
+
+    loader = LibvirtLoader(target_bare.fs.path("/test.xml"))
+    loader.map(target_bare)
+
+    assert mocked_container_open.call_count == 2

dissect_target-3.19.dev38/tests/plugins/child/test_qemu.py

@@ -0,0 +1,32 @@
+import pytest
+
+from dissect.target import Target
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.child.qemu import QemuChildTargetPlugin
+from tests.conftest import absolute_path
+
+
+def test_compatible(target_linux: Target, fs_linux: VirtualFilesystem) -> None:
+    with pytest.raises(UnsupportedPluginError):
+        QemuChildTargetPlugin(target_linux).check_compatible()
+
+    qemu_xml = absolute_path("_data/loaders/libvirt/qemu.xml")
+    fs_linux.map_file("/etc/libvirt/qemu/qemu.xml", qemu_xml)
+    QemuChildTargetPlugin(target_linux).check_compatible()
+
+
+def test_list_children(target_linux: Target, fs_linux: VirtualFilesystem) -> None:
+    qemu_xml = absolute_path("_data/loaders/libvirt/qemu.xml")
+    fs_linux.map_file("/etc/libvirt/qemu/linux2022.xml", qemu_xml)
+    fs_linux.map_file("/etc/libvirt/qemu/linux2024.xml", qemu_xml)
+
+    child_plugin = QemuChildTargetPlugin(target_linux)
+
+    children = list(child_plugin.list_children())
+
+    assert len(children) == 2
+
+    child = children[0]
+    assert child.type == "qemu"
+    assert child.path == "/etc/libvirt/qemu/linux2022.xml"

dissect_target-3.19.dev38/tests/plugins/general/test_network.py

@@ -0,0 +1,46 @@
+from unittest.mock import patch
+
+import pytest
+
+from dissect.target.helpers.record import (
+    MacInterfaceRecord,
+    UnixInterfaceRecord,
+    WindowsInterfaceRecord,
+)
+from dissect.target.plugins.general.network import InterfaceRecord, NetworkPlugin
+from dissect.target.target import Target
+
+
+@pytest.fixture(params=[MacInterfaceRecord, WindowsInterfaceRecord, UnixInterfaceRecord])
+def network_record(request: pytest.FixtureRequest) -> InterfaceRecord:
+    return request.param(
+        name="interface_name",
+        type="physical",
+        enabled=True,
+        mac="DE:AD:BE:EF:00:00",
+        ip=["10.42.42.10"],
+        gateway=["10.42.42.1"],
+        dns=["8.8.8.8", "1.1.1.1"],
+        source="some_file",
+    )
+
+
+def test_base_network_plugin(target_bare: Target, network_record: InterfaceRecord) -> None:
+    with patch.object(NetworkPlugin, "_interfaces", return_value=[network_record]):
+        network = NetworkPlugin(target_bare)
+        interfaces = list(network.interfaces())
+        assert len(interfaces) == 1
+
+        assert network.ips() == ["10.42.42.10"]
+        assert network.gateways() == ["10.42.42.1"]
+        assert network.macs() == ["DE:AD:BE:EF:00:00"]
+        assert network.dns() == ["8.8.8.8", "1.1.1.1"]
+
+        assert len(list(network.in_cidr("10.42.42.0/24"))) == 1
+        assert len(list(network.in_cidr("10.43.42.0/24"))) == 0
+
+        assert len(list(network.with_mac("DE:AD:BE:EF:00:00"))) == 1
+        assert len(list(network.with_mac("DE:AD:BE:EF:00:01"))) == 0
+
+        assert len(list(network.with_ip("10.42.42.10"))) == 1
+        assert len(list(network.with_ip("10.42.42.42"))) == 0

{dissect_target-3.19.dev36 → dissect_target-3.19.dev38}/tests/tools/test_query.py

@@ -241,5 +241,6 @@ def test_target_query_dry_run(capsys: pytest.CaptureFixture, monkeypatch: pytest
         assert out == (
             f"Dry run on: <Target {target_file}>\n"
             "  execute: users (general.default.users)\n"
+            "  execute: network.interfaces (general.network.interfaces)\n"
             "  execute: osinfo (general.osinfo.osinfo)\n"
         )