dissect.target 3.19.dev37__tar.gz → 3.19.dev39__tar.gz

{dissect_target-3.19.dev37/dissect.target.egg-info → dissect_target-3.19.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev37
+Version: 3.19.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.19.dev39/dissect/target/filesystems/zip.py

@@ -0,0 +1,171 @@
+from __future__ import annotations
+
+import logging
+import stat
+import zipfile
+from datetime import datetime, timezone
+from typing import BinaryIO, Iterator
+
+from dissect.util.stream import BufferedStream
+
+from dissect.target.exceptions import (
+    FileNotFoundError,
+    FilesystemError,
+    IsADirectoryError,
+    NotADirectoryError,
+    NotASymlinkError,
+)
+from dissect.target.filesystem import (
+    Filesystem,
+    FilesystemEntry,
+    VirtualDirectory,
+    VirtualFilesystem,
+)
+from dissect.target.helpers import fsutil
+
+log = logging.getLogger(__name__)
+
+
+class ZipFilesystem(Filesystem):
+    """Filesystem implementation for zip files.
+
+    Python does not have symlink support in the zipfile module, so that's not currently supported.
+    See https://github.com/python/cpython/issues/82102 for more information.
+    """
+
+    __type__ = "zip"
+
+    def __init__(
+        self,
+        fh: BinaryIO,
+        base: str | None = None,
+        *args,
+        **kwargs,
+    ):
+        super().__init__(fh, *args, **kwargs)
+
+        fh.seek(0)
+
+        self.zip = zipfile.ZipFile(fh, mode="r")
+        self.base = base or ""
+
+        self._fs = VirtualFilesystem(alt_separator=self.alt_separator, case_sensitive=self.case_sensitive)
+
+        for member in self.zip.infolist():
+            mname = member.filename.strip("/")
+            if not mname.startswith(self.base) or mname == ".":
+                continue
+
+            rel_name = fsutil.normpath(mname[len(self.base) :], alt_separator=self.alt_separator)
+            self._fs.map_file_entry(rel_name, ZipFilesystemEntry(self, rel_name, member))
+
+    @staticmethod
+    def _detect(fh: BinaryIO) -> bool:
+        """Detect a zip file on a given file-like object."""
+        return zipfile.is_zipfile(fh)
+
+    def get(self, path: str, relentry: FilesystemEntry = None) -> FilesystemEntry:
+        """Returns a ZipFilesystemEntry object corresponding to the given path."""
+        return self._fs.get(path, relentry=relentry)
+
+
+# Note: We subclass from VirtualDirectory because VirtualFilesystem is currently only compatible with VirtualDirectory
+# Subclass from VirtualDirectory so we get that compatibility for free, and override the rest to do our own thing
+class ZipFilesystemEntry(VirtualDirectory):
+    fs: ZipFilesystem
+    entry: zipfile.ZipInfo
+
+    def __init__(self, fs: ZipFilesystem, path: str, entry: zipfile.ZipInfo):
+        super().__init__(fs, path)
+        self.entry = entry
+
+    def open(self) -> BinaryIO:
+        if self.is_dir():
+            raise IsADirectoryError(self.path)
+
+        if self.is_symlink():
+            return self._resolve().open()
+
+        try:
+            return BufferedStream(self.fs.zip.open(self.entry), size=self.entry.file_size)
+        except Exception:
+            raise FileNotFoundError(self.path)
+
+    def iterdir(self) -> Iterator[str]:
+        if not self.is_dir():
+            raise NotADirectoryError(self.path)
+
+        entry = self._resolve()
+        if isinstance(entry, ZipFilesystemEntry):
+            yield from super(ZipFilesystemEntry, entry).iterdir()
+        else:
+            yield from entry.iterdir()
+
+    def scandir(self) -> Iterator[FilesystemEntry]:
+        if not self.is_dir():
+            raise NotADirectoryError(self.path)
+
+        entry = self._resolve()
+        if isinstance(entry, ZipFilesystemEntry):
+            yield from super(ZipFilesystemEntry, entry).scandir()
+        else:
+            yield from entry.scandir()
+
+    def is_dir(self, follow_symlinks: bool = True) -> bool:
+        try:
+            entry = self._resolve(follow_symlinks=follow_symlinks)
+        except FilesystemError:
+            return False
+
+        if isinstance(entry, ZipFilesystemEntry):
+            return entry.entry.is_dir()
+        return isinstance(entry, VirtualDirectory)
+
+    def is_file(self, follow_symlinks: bool = True) -> bool:
+        try:
+            entry = self._resolve(follow_symlinks=follow_symlinks)
+        except FilesystemError:
+            return False
+
+        if isinstance(entry, ZipFilesystemEntry):
+            return not entry.entry.is_dir()
+        return False
+
+    def is_symlink(self) -> bool:
+        return stat.S_ISLNK(self.entry.external_attr >> 16)
+
+    def readlink(self) -> str:
+        if not self.is_symlink():
+            raise NotASymlinkError()
+        return self.fs.zip.open(self.entry).read().decode()
+
+    def readlink_ext(self) -> FilesystemEntry:
+        return FilesystemEntry.readlink_ext(self)
+
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
+        return self._resolve(follow_symlinks=follow_symlinks).lstat()
+
+    def lstat(self) -> fsutil.stat_result:
+        """Return the stat information of the given path, without resolving links."""
+        # ['mode', 'addr', 'dev', 'nlink', 'uid', 'gid', 'size', 'atime', 'mtime', 'ctime']
+        mode = self.entry.external_attr >> 16
+
+        if self.entry.is_dir() and not stat.S_ISDIR(mode):
+            mode = stat.S_IFDIR | mode
+        elif not self.entry.is_dir() and not stat.S_ISREG(mode):
+            mode = stat.S_IFREG | mode
+
+        return fsutil.stat_result(
+            [
+                mode,
+                self.entry.header_offset,
+                id(self.fs),
+                1,
+                0,
+                0,
+                self.entry.file_size,
+                0,
+                datetime(*self.entry.date_time, tzinfo=timezone.utc).timestamp(),
+                0,
+            ]
+        )

{dissect_target-3.19.dev37 → dissect_target-3.19.dev39}/dissect/target/helpers/record.py

@@ -142,3 +142,40 @@ EmptyRecord = RecordDescriptor(
     "empty",
     [],
 )
+
+COMMON_INTERFACE_ELEMENTS = [
+    ("string", "name"),
+    ("string", "type"),
+    ("boolean", "enabled"),
+    ("string", "mac"),
+    ("net.ipaddress[]", "dns"),
+    ("net.ipaddress[]", "ip"),
+    ("net.ipaddress[]", "gateway"),
+    ("string", "source"),
+]
+
+
+UnixInterfaceRecord = TargetRecordDescriptor(
+    "unix/network/interface",
+    COMMON_INTERFACE_ELEMENTS,
+)
+
+WindowsInterfaceRecord = TargetRecordDescriptor(
+    "windows/network/interface",
+    [
+        *COMMON_INTERFACE_ELEMENTS,
+        ("varint", "vlan"),
+        ("string", "metric"),
+        ("datetime", "last_connected"),
+    ],
+)
+
+MacInterfaceRecord = TargetRecordDescriptor(
+    "macos/network/interface",
+    [
+        *COMMON_INTERFACE_ELEMENTS,
+        ("varint", "vlan"),
+        ("string", "proxy"),
+        ("varint", "interface_service_order"),
+    ],
+)

dissect_target-3.19.dev39/dissect/target/plugins/general/network.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from typing import Any, Iterator, Union
+
+from flow.record.fieldtypes.net import IPAddress, IPNetwork
+
+from dissect.target.helpers.record import (
+    MacInterfaceRecord,
+    UnixInterfaceRecord,
+    WindowsInterfaceRecord,
+)
+from dissect.target.plugin import Plugin, export, internal
+from dissect.target.target import Target
+
+InterfaceRecord = Union[UnixInterfaceRecord, WindowsInterfaceRecord, MacInterfaceRecord]
+
+
+class NetworkPlugin(Plugin):
+    __namespace__ = "network"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self._interface_list: list[InterfaceRecord] | None = None
+
+    def check_compatible(self) -> None:
+        pass
+
+    def _interfaces(self) -> Iterator[InterfaceRecord]:
+        yield from ()
+
+    def _get_record_type(self, field_name: str) -> Iterator[Any]:
+        for record in self.interfaces():
+            if (output := getattr(record, field_name, None)) is None:
+                continue
+
+            if isinstance(output, list):
+                yield from output
+            else:
+                yield output
+
+    @export(record=InterfaceRecord)
+    def interfaces(self) -> Iterator[InterfaceRecord]:
+        # Only search for the interfaces once
+        if self._interface_list is None:
+            self._interface_list = list(self._interfaces())
+
+        yield from self._interface_list
+
+    @export
+    def ips(self) -> list[IPAddress]:
+        return list(self._get_record_type("ip"))
+
+    @export
+    def gateways(self) -> list[IPAddress]:
+        return list(self._get_record_type("gateway"))
+
+    @export
+    def macs(self) -> list[str]:
+        return list(self._get_record_type("mac"))
+
+    @export
+    def dns(self) -> list[str]:
+        return list(self._get_record_type("dns"))
+
+    @internal
+    def with_ip(self, ip_addr: str) -> Iterator[InterfaceRecord]:
+        for interface in self.interfaces():
+            if ip_addr in interface.ip:
+                yield interface
+
+    @internal
+    def with_mac(self, mac: str) -> Iterator[InterfaceRecord]:
+        for interface in self.interfaces():
+            if interface.mac == mac:
+                yield interface
+
+    @internal
+    def in_cidr(self, cidr: str) -> Iterator[InterfaceRecord]:
+        cidr = IPNetwork(cidr)
+        for interface in self.interfaces():
+            if any(ip_addr in cidr for ip_addr in interface.ip):
+                yield interface

{dissect_target-3.19.dev37 → dissect_target-3.19.dev39/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev37
+Version: 3.19.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev37 → dissect_target-3.19.dev39}/dissect.target.egg-info/SOURCES.txt

@@ -192,6 +192,7 @@ dissect/target/plugins/general/config.py
 dissect/target/plugins/general/default.py
 dissect/target/plugins/general/example.py
 dissect/target/plugins/general/loaders.py
+dissect/target/plugins/general/network.py
 dissect/target/plugins/general/osinfo.py
 dissect/target/plugins/general/plugins.py
 dissect/target/plugins/general/scrape.py
@@ -489,6 +490,7 @@ tests/plugins/filesystem/unix/test_suid.py
 tests/plugins/general/__init__.py
 tests/plugins/general/test_config.py
 tests/plugins/general/test_default.py
+tests/plugins/general/test_network.py
 tests/plugins/general/test_plugins.py
 tests/plugins/general/test_scrape.py
 tests/plugins/general/test_users.py

{dissect_target-3.19.dev37 → dissect_target-3.19.dev39}/tests/filesystems/test_zip.py

@@ -3,10 +3,15 @@ import zipfile
 
 import pytest
 
+from dissect.target.exceptions import (
+    IsADirectoryError,
+    NotADirectoryError,
+    NotASymlinkError,
+)
 from dissect.target.filesystems.zip import ZipFilesystem, ZipFilesystemEntry
 
 
-def _mkdir(zf, name):
+def _mkdir(zf: zipfile.ZipFile, name: str) -> None:
     # There's no easy way to make a directory with Python zipfile, so copy what zipfile.py does
     zinfo = zipfile.ZipInfo(name)
     zinfo.compress_size = 0
@@ -32,7 +37,7 @@ def _mkdir(zf, name):
         zf.start_dir = zf.fp.tell()
 
 
-def _create_zip(prefix="", zip_dir=True):
+def _create_zip(prefix: str = "", zip_dir: bool = True) -> io.BytesIO:
     buf = io.BytesIO()
     zf = zipfile.ZipFile(buf, "w")
 
@@ -51,34 +56,42 @@ def _create_zip(prefix="", zip_dir=True):
     for i in range(100):
         zf.writestr(f"{prefix}dir/{i}", f"contents {i}")
 
+    symlink = zipfile.ZipInfo(f"{prefix}symlink_dir")
+    symlink.external_attr = 0o120777 << 16
+    zf.writestr(symlink, "dir/")
+
+    symlink = zipfile.ZipInfo(f"{prefix}symlink_file")
+    symlink.external_attr = 0o120777 << 16
+    zf.writestr(symlink, "file_1")
+
     zf.close()
     buf.seek(0)
     return buf
 
 
 @pytest.fixture
-def zip_simple():
-    yield _create_zip()
+def zip_simple() -> io.BytesIO:
+    return _create_zip()
 
 
 @pytest.fixture
-def zip_base():
-    yield _create_zip("base/")
+def zip_base() -> io.BytesIO:
+    return _create_zip("base/")
 
 
 @pytest.fixture
-def zip_relative():
-    yield _create_zip("./", False)
+def zip_relative() -> io.BytesIO:
+    return _create_zip("./", False)
 
 
 @pytest.fixture
-def zip_relative_dir():
-    yield _create_zip("./")
+def zip_relative_dir() -> io.BytesIO:
+    return _create_zip("./")
 
 
 @pytest.fixture
-def zip_virtual_dir():
-    yield _create_zip("", False)
+def zip_virtual_dir() -> io.BytesIO:
+    return _create_zip("", False)
 
 
 @pytest.mark.parametrize(
@@ -91,7 +104,7 @@ def zip_virtual_dir():
         ("zip_virtual_dir", ""),
     ],
 )
-def test_filesystems_zip(obj, base, request):
+def test_filesystems_zip(obj: str, base: str, request: pytest.FixtureRequest) -> None:
     fh = request.getfixturevalue(obj)
 
     assert ZipFilesystem.detect(fh)
@@ -99,22 +112,50 @@ def test_filesystems_zip(obj, base, request):
     fs = ZipFilesystem(fh, base)
     assert isinstance(fs, ZipFilesystem)
 
-    assert len(fs.listdir("/")) == 3
+    assert len(fs.listdir("/")) == 5
 
     assert fs.get("./file_1").open().read() == b"file 1 contents"
     assert fs.get("./file_2").open().read() == b"file 2 contents"
+    assert fs.get("./symlink_file").open().read() == b"file 1 contents"
     assert len(list(fs.glob("./dir/*"))) == 100
+    assert len(list(fs.glob("./symlink_dir/*"))) == 100
 
     zfile = fs.get("./file_1")
     zdir = fs.get("./dir")
+    zsymd = fs.get("./symlink_dir")
+    zsymf = fs.get("./symlink_file")
 
     assert zfile.is_file()
     assert not zfile.is_dir()
     assert not zfile.is_symlink()
 
+    with pytest.raises(NotADirectoryError):
+        list(zfile.iterdir())
+
+    with pytest.raises(NotADirectoryError):
+        next(zfile.scandir())
+
+    with pytest.raises(NotASymlinkError):
+        zfile.readlink()
+
     assert zdir.is_dir()
     assert not zdir.is_file()
     assert not zdir.is_symlink()
+    assert len(list(zdir.iterdir())) == 100
+    assert len(list(zdir.scandir())) == 100
+
+    with pytest.raises(IsADirectoryError):
+        zdir.open()
+
+    assert zsymd.is_dir()
+    assert not zsymd.is_file()
+    assert zsymd.is_symlink()
+    assert zsymd.readlink() == "dir/"
+
+    assert not zsymf.is_dir()
+    assert zsymf.is_file()
+    assert zsymf.is_symlink()
+    assert zsymf.readlink() == "file_1"
 
     file1 = zdir.get("1")
     assert file1.is_file()
@@ -122,7 +163,9 @@ def test_filesystems_zip(obj, base, request):
     assert not file1.is_symlink()
     assert file1.open().read() == b"contents 1"
 
-    assert zfile.stat().st_mode == 0o100777
+    assert file1.stat() == zsymd.get("1").stat()
+
+    assert zfile.stat().st_mode == 0o100600
     assert zfile.stat(follow_symlinks=False) == zfile.lstat()
 
     if isinstance(zdir, ZipFilesystemEntry):

dissect_target-3.19.dev39/tests/plugins/general/test_network.py

@@ -0,0 +1,46 @@
+from unittest.mock import patch
+
+import pytest
+
+from dissect.target.helpers.record import (
+    MacInterfaceRecord,
+    UnixInterfaceRecord,
+    WindowsInterfaceRecord,
+)
+from dissect.target.plugins.general.network import InterfaceRecord, NetworkPlugin
+from dissect.target.target import Target
+
+
+@pytest.fixture(params=[MacInterfaceRecord, WindowsInterfaceRecord, UnixInterfaceRecord])
+def network_record(request: pytest.FixtureRequest) -> InterfaceRecord:
+    return request.param(
+        name="interface_name",
+        type="physical",
+        enabled=True,
+        mac="DE:AD:BE:EF:00:00",
+        ip=["10.42.42.10"],
+        gateway=["10.42.42.1"],
+        dns=["8.8.8.8", "1.1.1.1"],
+        source="some_file",
+    )
+
+
+def test_base_network_plugin(target_bare: Target, network_record: InterfaceRecord) -> None:
+    with patch.object(NetworkPlugin, "_interfaces", return_value=[network_record]):
+        network = NetworkPlugin(target_bare)
+        interfaces = list(network.interfaces())
+        assert len(interfaces) == 1
+
+        assert network.ips() == ["10.42.42.10"]
+        assert network.gateways() == ["10.42.42.1"]
+        assert network.macs() == ["DE:AD:BE:EF:00:00"]
+        assert network.dns() == ["8.8.8.8", "1.1.1.1"]
+
+        assert len(list(network.in_cidr("10.42.42.0/24"))) == 1
+        assert len(list(network.in_cidr("10.43.42.0/24"))) == 0
+
+        assert len(list(network.with_mac("DE:AD:BE:EF:00:00"))) == 1
+        assert len(list(network.with_mac("DE:AD:BE:EF:00:01"))) == 0
+
+        assert len(list(network.with_ip("10.42.42.10"))) == 1
+        assert len(list(network.with_ip("10.42.42.42"))) == 0

{dissect_target-3.19.dev37 → dissect_target-3.19.dev39}/tests/tools/test_query.py

@@ -241,5 +241,6 @@ def test_target_query_dry_run(capsys: pytest.CaptureFixture, monkeypatch: pytest
         assert out == (
             f"Dry run on: <Target {target_file}>\n"
             "  execute: users (general.default.users)\n"
+            "  execute: network.interfaces (general.network.interfaces)\n"
             "  execute: osinfo (general.osinfo.osinfo)\n"
         )

dissect_target-3.19.dev37/dissect/target/filesystems/zip.py

@@ -1,136 +0,0 @@
-from __future__ import annotations
-
-import logging
-import stat
-import zipfile
-from datetime import datetime, timezone
-from typing import BinaryIO, Optional
-
-from dissect.util.stream import BufferedStream
-
-from dissect.target.exceptions import FileNotFoundError
-from dissect.target.filesystem import (
-    Filesystem,
-    FilesystemEntry,
-    VirtualDirectory,
-    VirtualFile,
-    VirtualFilesystem,
-)
-from dissect.target.helpers import fsutil
-
-log = logging.getLogger(__name__)
-
-
-class ZipFilesystem(Filesystem):
-    """Filesystem implementation for zip files.
-
-    Python does not have symlink support in the zipfile module, so that's not currently supported.
-    See https://github.com/python/cpython/issues/82102 for more information.
-    """
-
-    __type__ = "zip"
-
-    def __init__(
-        self,
-        fh: BinaryIO,
-        base: Optional[str] = None,
-        *args,
-        **kwargs,
-    ):
-        super().__init__(fh, *args, **kwargs)
-
-        fh.seek(0)
-
-        self.zip = zipfile.ZipFile(fh, mode="r")
-        self.base = base or ""
-
-        self._fs = VirtualFilesystem(alt_separator=self.alt_separator, case_sensitive=self.case_sensitive)
-
-        for member in self.zip.infolist():
-            mname = member.filename.strip("/")
-            if not mname.startswith(self.base) or mname == ".":
-                continue
-
-            rel_name = fsutil.normpath(mname[len(self.base) :], alt_separator=self.alt_separator)
-
-            # NOTE: Normally we would check here if the member is a symlink or not
-
-            entry_cls = ZipFilesystemDirectoryEntry if member.is_dir() else ZipFilesystemEntry
-            file_entry = entry_cls(self, rel_name, member)
-            self._fs.map_file_entry(rel_name, file_entry)
-
-    @staticmethod
-    def _detect(fh: BinaryIO) -> bool:
-        """Detect a zip file on a given file-like object."""
-        return zipfile.is_zipfile(fh)
-
-    def get(self, path: str, relentry: FilesystemEntry = None) -> FilesystemEntry:
-        """Returns a ZipFilesystemEntry object corresponding to the given path."""
-        return self._fs.get(path, relentry=relentry)
-
-
-class ZipFilesystemEntry(VirtualFile):
-    def open(self) -> BinaryIO:
-        """Returns file handle (file-like object)."""
-        try:
-            return BufferedStream(self.fs.zip.open(self.entry), size=self.entry.file_size)
-        except Exception:
-            raise FileNotFoundError()
-
-    def readlink(self) -> str:
-        """Read the link if this entry is a symlink. Returns a string."""
-        raise NotImplementedError()
-
-    def readlink_ext(self) -> FilesystemEntry:
-        """Read the link if this entry is a symlink. Returns a filesystem entry."""
-        raise NotImplementedError()
-
-    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
-        """Return the stat information of this entry."""
-        return self.lstat()
-
-    def lstat(self) -> fsutil.stat_result:
-        """Return the stat information of the given path, without resolving links."""
-        # ['mode', 'addr', 'dev', 'nlink', 'uid', 'gid', 'size', 'atime', 'mtime', 'ctime']
-        return fsutil.stat_result(
-            [
-                stat.S_IFREG | 0o777,
-                self.entry.header_offset,
-                id(self.fs),
-                1,
-                0,
-                0,
-                self.entry.file_size,
-                0,
-                datetime(*self.entry.date_time, tzinfo=timezone.utc).timestamp(),
-                0,
-            ]
-        )
-
-
-class ZipFilesystemDirectoryEntry(VirtualDirectory):
-    def __init__(self, fs: ZipFilesystem, path: str, entry: zipfile.ZipInfo):
-        super().__init__(fs, path)
-        self.entry = entry
-
-    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
-        """Return the stat information of this entry."""
-        return self.lstat()
-
-    def lstat(self) -> fsutil.stat_result:
-        """Return the stat information of the given path, without resolving links."""
-        # ['mode', 'addr', 'dev', 'nlink', 'uid', 'gid', 'size', 'atime', 'mtime', 'ctime']
-        return fsutil.stat_result(
-            [
-                stat.S_IFDIR | 0o777,
-                self.entry.header_offset,
-                id(self.fs),
-                1,
-                0,
-                0,
-                self.entry.file_size,
-                0,
-                datetime(*self.entry.date_time, tzinfo=timezone.utc).timestamp(),
-                0,
-            ]
-        )