dissect.target 3.20.dev41__tar.gz → 3.20.dev44__tar.gz

{dissect_target-3.20.dev41/dissect.target.egg-info → dissect_target-3.20.dev44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev41
+Version: 3.20.dev44
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/dissect/target/loader.py

@@ -205,4 +205,5 @@ register("velociraptor", "VelociraptorLoader")
 register("smb", "SmbLoader")
 register("cb", "CbLoader")
 register("cyber", "CyberLoader")
+register("proxmox", "ProxmoxLoader")
 register("multiraw", "MultiRawLoader")  # Should be last

dissect_target-3.20.dev44/dissect/target/loaders/proxmox.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from dissect.target import container
+from dissect.target.loader import Loader
+from dissect.target.target import Target
+
+RE_VOLUME_ID = re.compile(r"(?:file=)?([^:]+):([^,]+)")
+
+
+class ProxmoxLoader(Loader):
+    """Loader for Proxmox VM configuration files.
+
+    Proxmox uses volume identifiers in the format of ``storage_id:volume_id``. The ``storage_id`` maps to a
+    storage configuration in ``/etc/pve/storage.cfg``. The ``volume_id`` is the name of the volume within
+    that configuration.
+
+    This loader currently does not support parsing the storage configuration, so it will attempt to open the
+    volume directly from the same directory as the configuration file, or from ``/dev/pve/`` (default LVM config).
+    If the volume is not found, it will log a warning.
+    """
+
+    def __init__(self, path: Path, **kwargs):
+        path = path.resolve()
+        super().__init__(path)
+        self.base_dir = path.parent
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        if path.suffix.lower() != ".conf":
+            return False
+
+        with path.open("rb") as fh:
+            lines = fh.read(512).split(b"\n")
+            needles = [b"cpu:", b"memory:", b"name:"]
+            return all(any(needle in line for line in lines) for needle in needles)
+
+    def map(self, target: Target) -> None:
+        with self.path.open("rt") as fh:
+            for line in fh:
+                if not (line := line.strip()):
+                    continue
+
+                key, value = line.split(":", 1)
+                value = value.strip()
+
+                if key.startswith(("scsi", "sata", "ide", "virtio")) and key[-1].isdigit():
+                    # https://pve.proxmox.com/wiki/Storage
+                    if match := RE_VOLUME_ID.match(value):
+                        storage_id, volume_id = match.groups()
+
+                        # TODO: parse the storage information from /etc/pve/storage.cfg
+                        # For now, let's try a few assumptions
+                        disk_path = None
+                        if (path := self.base_dir.joinpath(volume_id)).exists():
+                            disk_path = path
+                        elif (path := self.base_dir.joinpath("/dev/pve/").joinpath(volume_id)).exists():
+                            disk_path = path
+
+                        if disk_path:
+                            try:
+                                target.disks.add(container.open(disk_path))
+                            except Exception:
+                                target.log.exception("Failed to open disk: %s", disk_path)
+                        else:
+                            target.log.warning("Unable to find disk: %s:%s", storage_id, volume_id)

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/dissect/target/plugin.py

@@ -57,17 +57,18 @@ log = logging.getLogger(__name__)
 
 
 class OperatingSystem(StrEnum):
-    LINUX = "linux"
-    WINDOWS = "windows"
-    ESXI = "esxi"
+    ANDROID = "android"
     BSD = "bsd"
+    CITRIX = "citrix-netscaler"
+    ESXI = "esxi"
+    FORTIOS = "fortios"
+    IOS = "ios"
+    LINUX = "linux"
     OSX = "osx"
+    PROXMOX = "proxmox"
     UNIX = "unix"
-    ANDROID = "android"
     VYOS = "vyos"
-    IOS = "ios"
-    FORTIOS = "fortios"
-    CITRIX = "citrix-netscaler"
+    WINDOWS = "windows"
 
 
 def export(*args, **kwargs) -> Callable:

dissect_target-3.20.dev44/dissect/target/plugins/child/proxmox.py

@@ -0,0 +1,23 @@
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import ChildTargetRecord
+from dissect.target.plugin import ChildTargetPlugin
+
+
+class ProxmoxChildTargetPlugin(ChildTargetPlugin):
+    """Child target plugin that yields from the VM listing."""
+
+    __type__ = "proxmox"
+
+    def check_compatible(self) -> None:
+        if self.target.os != "proxmox":
+            raise UnsupportedPluginError("Not a Proxmox operating system")
+
+    def list_children(self) -> Iterator[ChildTargetRecord]:
+        for vm in self.target.vmlist():
+            yield ChildTargetRecord(
+                type=self.__type__,
+                path=vm.path,
+                _target=self.target,
+            )

dissect_target-3.20.dev44/dissect/target/plugins/general/loaders.py

@@ -0,0 +1,39 @@
+import json
+
+from dissect.target.helpers.docs import INDENT_STEP, get_docstring
+from dissect.target.loader import LOADERS_BY_SCHEME
+from dissect.target.plugin import Plugin, arg, export
+
+
+class LoaderListPlugin(Plugin):
+    """Plugin to list the available loaders."""
+
+    def check_compatible(self) -> None:
+        pass
+
+    @export(output="none")
+    # NOTE: We would prefer to re-use arguments across plugins from argparse in query.py, but that is not possible yet.
+    # For now we use --as-json, but in the future this should be changed to inherit --json from target-query.
+    # https://github.com/fox-it/dissect.target/pull/841
+    # https://github.com/fox-it/dissect.target/issues/889
+    @arg("--as-json", dest="as_json", action="store_true")
+    def loaders(self, as_json: bool = False) -> None:
+        """List the available loaders."""
+
+        loaders_info = {}
+        for key, loader in LOADERS_BY_SCHEME.items():
+            try:
+                docstring = get_docstring(loader, "No documentation.").splitlines()[0].strip()
+                loaders_info[key] = docstring
+            except ImportError:
+                continue
+
+        loaders = sorted(loaders_info.items())
+
+        if as_json:
+            print(json.dumps([{"name": name, "description": desc} for name, desc in loaders]), end="")
+
+        else:
+            print("Available loaders:")
+            for loader_name, loader_description in loaders:
+                print(f"{INDENT_STEP}{loader_name} - {loader_description}")

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/dissect/target/plugins/general/plugins.py

@@ -1,5 +1,8 @@
+from __future__ import annotations
+
+import json
 import textwrap
-from typing import Dict, List, Type, Union
+from typing import Iterator, Type
 
 from dissect.target import plugin
 from dissect.target.helpers.docs import INDENT_STEP, get_plugin_overview
@@ -23,7 +26,8 @@ def categorize_plugins(plugins_selection: list[dict] = None) -> dict:
     return output_dict
 
 
-def get_exported_plugins():
+def get_exported_plugins() -> list:
+    """Returns list of exported plugins."""
     return [p for p in plugin.plugins() if len(p["exports"])]
 
 
@@ -50,10 +54,10 @@ def update_dict_recursive(source_dict: dict, updated_dict: dict) -> dict:
 
 
 def output_plugin_description_recursive(
-    structure_dict: Union[Dict, Plugin],
+    structure_dict: dict | Plugin,
     print_docs: bool,
-    indentation_step=0,
-) -> List[str]:
+    indentation_step: int = 0,
+) -> list[str]:
     """Create plugin overview with identations."""
 
     if isinstance(structure_dict, type) and issubclass(structure_dict, Plugin):
@@ -78,10 +82,10 @@ def get_plugin_description(
 
 
 def get_description_dict(
-    structure_dict: Dict,
+    structure_dict: dict,
     print_docs: bool,
     indentation_step: int,
-) -> List[str]:
+) -> list[str]:
     """Returns a list of indented descriptions."""
 
     output_descriptions = []
@@ -105,10 +109,17 @@ class PluginListPlugin(Plugin):
 
     @export(output="none", cache=False)
     @arg("--docs", dest="print_docs", action="store_true")
-    def plugins(self, plugins: list[dict] = None, print_docs: bool = False) -> None:
-        """Print all registered plugins to stdout."""
+    # NOTE: We would prefer to re-use arguments across plugins from argparse in query.py, but that is not possible yet.
+    # For now we use --as-json, but in the future this should be changed to inherit --json from target-query.
+    # https://github.com/fox-it/dissect.target/pull/841
+    # https://github.com/fox-it/dissect.target/issues/889
+    @arg("--as-json", dest="as_json", action="store_true")
+    def plugins(self, plugins: list[Plugin] = None, print_docs: bool = False, as_json: bool = False) -> None:
+        """Print all available plugins."""
+
+        dict_plugins = list({p.path: p.plugin_desc for p in plugins}.values())
+        categorized_plugins = dict(sorted(categorize_plugins(dict_plugins).items()))
 
-        categorized_plugins = dict(sorted(categorize_plugins(plugins).items()))
         plugin_descriptions = output_plugin_description_recursive(categorized_plugins, print_docs)
 
         plugins_list = textwrap.indent(
@@ -142,4 +153,32 @@ class PluginListPlugin(Plugin):
             "Failed to load:",
             failed_list,
         ]
-        print("\n".join(output_lines))
+
+        if as_json:
+            out = {"loaded": list(generate_plugins_json(plugins))}
+
+            if failed_plugins := plugin.failed():
+                out["failed"] = [
+                    {"module": p["module"], "stacktrace": "".join(p["stacktrace"])} for p in failed_plugins
+                ]
+
+            print(json.dumps(out), end="")
+
+        else:
+            print("\n".join(output_lines))
+
+
+def generate_plugins_json(plugins: list[Plugin]) -> Iterator[dict]:
+    """Generates JSON output of a list of :class:`Plugin`s."""
+
+    for p in plugins:
+        func = getattr(p.class_object, p.method_name)
+        description = getattr(func, "__doc__", None)
+        summary = description.split("\n\n", 1)[0].strip() if description else None
+
+        yield {
+            "name": p.name,
+            "output": p.output_type,
+            "description": summary,
+            "path": p.path,
+        }

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/dissect/target/plugins/os/unix/_os.py

@@ -23,6 +23,7 @@ class UnixPlugin(OSPlugin):
     def __init__(self, target: Target):
         super().__init__(target)
         self._add_mounts()
+        self._add_devices()
         self._hostname_dict = self._parse_hostname_string()
         self._hosts_dict = self._parse_hosts_string()
         self._os_release = self._parse_os_release()
@@ -247,6 +248,17 @@ class UnixPlugin(OSPlugin):
                     self.target.log.debug("Mounting %s (%s) at %s", fs, fs.volume, mount_point)
                     self.target.fs.mount(mount_point, fs)
 
+    def _add_devices(self) -> None:
+        """Add some virtual block devices to the target.
+
+        Currently only adds LVM devices.
+        """
+        vfs = self.target.fs.append_layer()
+
+        for volume in self.target.volumes:
+            if volume.vs and volume.vs.__type__ == "lvm":
+                vfs.map_file_fh(f"/dev/{volume.raw.vg.name}/{volume.raw.name}", volume)
+
     def _parse_os_release(self, glob: str | None = None) -> dict[str, str]:
         """Parse files containing Unix version information.
 

dissect_target-3.20.dev44/dissect/target/plugins/os/unix/linux/debian/proxmox/_os.py

@@ -0,0 +1,141 @@
+from __future__ import annotations
+
+import stat
+from io import BytesIO
+from typing import BinaryIO
+
+from dissect.sql import sqlite3
+from dissect.util.stream import BufferedStream
+
+from dissect.target.filesystem import (
+    Filesystem,
+    VirtualDirectory,
+    VirtualFile,
+    VirtualFilesystem,
+)
+from dissect.target.helpers import fsutil
+from dissect.target.plugins.os.unix._os import OperatingSystem, export
+from dissect.target.plugins.os.unix.linux.debian._os import DebianPlugin
+from dissect.target.target import Target
+
+
+class ProxmoxPlugin(DebianPlugin):
+    @classmethod
+    def detect(cls, target: Target) -> Filesystem | None:
+        for fs in target.filesystems:
+            if fs.exists("/etc/pve") or fs.exists("/var/lib/pve"):
+                return fs
+
+        return None
+
+    @classmethod
+    def create(cls, target: Target, sysvol: Filesystem) -> ProxmoxPlugin:
+        obj = super().create(target, sysvol)
+
+        if (config_db := target.fs.path("/var/lib/pve-cluster/config.db")).exists():
+            with config_db.open("rb") as fh:
+                vfs = _create_pmxcfs(fh, obj.hostname)
+
+            target.fs.mount("/etc/pve", vfs)
+
+        return obj
+
+    @export(property=True)
+    def version(self) -> str:
+        """Returns Proxmox VE version with underlying OS release."""
+
+        for pkg in self.target.dpkg.status():
+            if pkg.name == "proxmox-ve":
+                distro_name = self._os_release.get("PRETTY_NAME", "")
+                return f"{pkg.name} {pkg.version} ({distro_name})"
+
+    @export(property=True)
+    def os(self) -> str:
+        return OperatingSystem.PROXMOX.value
+
+
+DT_DIR = 4
+DT_REG = 8
+
+
+def _create_pmxcfs(fh: BinaryIO, hostname: str | None = None) -> VirtualFilesystem:
+    # https://pve.proxmox.com/wiki/Proxmox_Cluster_File_System_(pmxcfs)
+    db = sqlite3.SQLite3(fh)
+
+    entries = {row.inode: row for row in db.table("tree")}
+
+    vfs = VirtualFilesystem()
+    for entry in entries.values():
+        if entry.type == DT_DIR:
+            cls = ProxmoxConfigDirectoryEntry
+        elif entry.type == DT_REG:
+            cls = ProxmoxConfigFileEntry
+        else:
+            raise ValueError(f"Unknown pmxcfs file type: {entry.type}")
+
+        parts = []
+        current = entry
+        while current.parent != 0:
+            parts.append(current.name)
+            current = entries[current.parent]
+        parts.append(current.name)
+
+        path = "/".join(parts[::-1])
+        vfs.map_file_entry(path, cls(vfs, path, entry))
+
+    if hostname:
+        node_root = vfs.path(f"nodes/{hostname}")
+        vfs.symlink(str(node_root), "local")
+        vfs.symlink(str(node_root / "lxc"), "lxc")
+        vfs.symlink(str(node_root / "openvz"), "openvz")
+        vfs.symlink(str(node_root / "qemu-server"), "qemu-server")
+
+    # TODO: .version, .members, .vmlist, maybe .clusterlog and .rrd?
+
+    return vfs
+
+
+class ProxmoxConfigFileEntry(VirtualFile):
+    def open(self) -> BinaryIO:
+        return BufferedStream(BytesIO(self.entry.data or b""))
+
+    def lstat(self) -> fsutil.stat_result:
+        # ['mode', 'addr', 'dev', 'nlink', 'uid', 'gid', 'size', 'atime', 'mtime', 'ctime']
+        return fsutil.stat_result(
+            [
+                stat.S_IFREG | 0o640,
+                self.entry.inode,
+                id(self.fs),
+                1,
+                0,
+                0,
+                len(self.entry.data) if self.entry.data else 0,
+                0,
+                self.entry.mtime,
+                0,
+            ]
+        )
+
+
+class ProxmoxConfigDirectoryEntry(VirtualDirectory):
+    def __init__(self, fs: VirtualFilesystem, path: str, entry: sqlite3.Row):
+        super().__init__(fs, path)
+        self.entry = entry
+
+    def lstat(self) -> fsutil.stat_result:
+        """Return the stat information of the given path, without resolving links."""
+        # ['mode', 'addr', 'dev', 'nlink', 'uid', 'gid', 'size', 'atime', 'mtime', 'ctime']
+        return fsutil.stat_result(
+            [
+                stat.S_IFDIR | 0o755,
+                self.entry.inode,
+                id(self.fs),
+                1,
+                0,
+                0,
+                0,
+                0,
+                self.entry.mtime,
+                0,
+            ]
+        )

dissect_target-3.20.dev44/dissect/target/plugins/os/unix/linux/debian/proxmox/vm.py

@@ -0,0 +1,29 @@
+from typing import Iterator
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+VirtualMachineRecord = TargetRecordDescriptor(
+    "proxmox/vm",
+    [
+        ("string", "path"),
+    ],
+)
+
+
+class VirtualMachinePlugin(Plugin):
+    """Plugin to list Proxmox virtual machines."""
+
+    def check_compatible(self) -> None:
+        if self.target.os != "proxmox":
+            raise UnsupportedPluginError("Not a Proxmox operating system")
+
+    @export(record=VirtualMachineRecord)
+    def vmlist(self) -> Iterator[VirtualMachineRecord]:
+        """List Proxmox virtual machines on this node."""
+        for config in self.target.fs.path("/etc/pve/qemu-server").iterdir():
+            yield VirtualMachineRecord(
+                path=config,
+                _target=self.target,
+            )

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/dissect/target/tools/query.py

@@ -169,31 +169,40 @@ def main():
     # Show the list of available plugins for the given optional target and optional
     # search pattern, only display plugins that can be applied to ANY targets
     if args.list:
-        collected_plugins = {}
+        collected_plugins = []
 
         if targets:
             for plugin_target in Target.open_all(targets, args.children):
                 funcs, _ = find_plugin_functions(plugin_target, args.list, compatibility=True, show_hidden=True)
                 for func in funcs:
-                    collected_plugins[func.path] = func.plugin_desc
+                    collected_plugins.append(func)
         else:
             funcs, _ = find_plugin_functions(Target(), args.list, compatibility=False, show_hidden=True)
             for func in funcs:
-                collected_plugins[func.path] = func.plugin_desc
+                collected_plugins.append(func)
 
-        # Display in a user friendly manner
         target = Target()
         fparser = generate_argparse_for_bound_method(target.plugins, usage_tmpl=USAGE_FORMAT_TMPL)
         fargs, rest = fparser.parse_known_args(rest)
 
+        # Display in a user friendly manner
         if collected_plugins:
-            target.plugins(list(collected_plugins.values()))
+            if args.json:
+                print('{"plugins": ', end="")
+            target.plugins(collected_plugins, as_json=args.json)
 
         # No real targets specified, show the available loaders
         if not targets:
             fparser = generate_argparse_for_bound_method(target.loaders, usage_tmpl=USAGE_FORMAT_TMPL)
             fargs, rest = fparser.parse_known_args(rest)
-            target.loaders(**vars(fargs))
+            del fargs.as_json
+            if args.json:
+                print(', "loaders": ', end="")
+            target.loaders(**vars(fargs), as_json=args.json)
+
+        if args.json:
+            print("}")
+
         parser.exit()
 
     if not targets:

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev41
+Version: 3.20.dev44
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/dissect.target.egg-info/SOURCES.txt

@@ -105,6 +105,7 @@ dissect/target/loaders/overlay.py
 dissect/target/loaders/ovf.py
 dissect/target/loaders/phobos.py
 dissect/target/loaders/profile.py
+dissect/target/loaders/proxmox.py
 dissect/target/loaders/pvm.py
 dissect/target/loaders/pvs.py
 dissect/target/loaders/raw.py
@@ -175,6 +176,7 @@ dissect/target/plugins/child/docker.py
 dissect/target/plugins/child/esxi.py
 dissect/target/plugins/child/hyperv.py
 dissect/target/plugins/child/parallels.py
+dissect/target/plugins/child/proxmox.py
 dissect/target/plugins/child/qemu.py
 dissect/target/plugins/child/virtuozzo.py
 dissect/target/plugins/child/vmware_workstation.py
@@ -254,6 +256,9 @@ dissect/target/plugins/os/unix/linux/debian/_os.py
 dissect/target/plugins/os/unix/linux/debian/apt.py
 dissect/target/plugins/os/unix/linux/debian/dpkg.py
 dissect/target/plugins/os/unix/linux/debian/snap.py
+dissect/target/plugins/os/unix/linux/debian/proxmox/__init__.py
+dissect/target/plugins/os/unix/linux/debian/proxmox/_os.py
+dissect/target/plugins/os/unix/linux/debian/proxmox/vm.py
 dissect/target/plugins/os/unix/linux/debian/vyos/__init__.py
 dissect/target/plugins/os/unix/linux/debian/vyos/_os.py
 dissect/target/plugins/os/unix/linux/fortios/__init__.py
@@ -572,6 +577,8 @@ tests/plugins/os/unix/linux/debian/__init__.py
 tests/plugins/os/unix/linux/debian/test_apt.py
 tests/plugins/os/unix/linux/debian/test_dpkg.py
 tests/plugins/os/unix/linux/debian/test_snap.py
+tests/plugins/os/unix/linux/debian/proxmox/__init__.py
+tests/plugins/os/unix/linux/debian/proxmox/test__os.py
 tests/plugins/os/unix/linux/fortios/test_keys.py
 tests/plugins/os/unix/linux/redhat/__init__.py
 tests/plugins/os/unix/linux/redhat/test_yum.py

{dissect_target-3.20.dev41 → dissect_target-3.20.dev44}/tests/plugins/general/test_plugins.py

@@ -29,7 +29,7 @@ def test_update_dict():
 
 def test_plugin_description():
     description = [x for x in output_plugin_description_recursive(PluginListPlugin, False)]
-    assert description == ["plugins - Print all registered plugins to stdout. (output: no output)"]
+    assert description == ["plugins - Print all available plugins. (output: no output)"]
 
 
 def test_plugin_description_compacting():
@@ -39,7 +39,7 @@ def test_plugin_description_compacting():
     assert description == [
         "hello:",
         "  world:",
-        "    plugins - Print all registered plugins to stdout. (output: no output)",
+        "    plugins - Print all available plugins. (output: no output)",
     ]
 
 
@@ -54,9 +54,9 @@ def test_plugin_description_in_dict_multiple():
         "hello:",
         "  world:",
         "    data:",
-        "      plugins - Print all registered plugins to stdout. (output: no output)",
+        "      plugins - Print all available plugins. (output: no output)",
         "    data2:",
-        "      plugins - Print all registered plugins to stdout. (output: no output)",
+        "      plugins - Print all available plugins. (output: no output)",
     ]