dissect.target 3.20.dev7__tar.gz → 3.20.dev9__tar.gz

{dissect_target-3.20.dev7/dissect.target.egg-info → dissect_target-3.20.dev9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev7
+Version: 3.20.dev9
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev7 → dissect_target-3.20.dev9}/dissect/target/filesystems/overlay.py

@@ -89,15 +89,25 @@ class Overlay2Filesystem(LayerFilesystem):
 
         # append and mount every layer
         for dest, layer in layers:
-            if layer.is_file() and dest in ["/etc/hosts", "/etc/hostname", "/etc/resolv.conf"]:
+            # we could have collected a layer reference that actually does not exist on the host
+            if not layer.exists():
+                log.warning(
+                    "Can not mount layer %s for container %s as it does not exist on the host", layer, path.name
+                )
+                continue
+
+            # mount points can be files
+            if layer.is_file():
                 layer_fs = VirtualFilesystem()
-                layer_fs.map_file_fh("/etc/" + layer.name, layer.open("rb"))
-                dest = dest.split("/")[0]
+                layer_fs.map_file_fh(dest, layer.open("rb"))
 
+            # regular overlay2 layers are directories
+            # mount points can be directories too
             else:
                 layer_fs = DirectoryFilesystem(layer)
 
-            self.append_layer().mount(dest, layer_fs)
+            log.info("Adding layer %s to destination %s", layer, dest)
+            self.append_layer().mount("/" if layer.is_file() else dest, layer_fs)
 
     def __repr__(self) -> str:
         return f"<{self.__class__.__name__} {self.base_path}>"

{dissect_target-3.20.dev7 → dissect_target-3.20.dev9}/dissect/target/plugins/apps/container/docker.py

@@ -4,7 +4,7 @@ import json
 import logging
 import re
 from pathlib import Path
-from typing import Iterator, Optional
+from typing import Iterator
 
 from dissect.cstruct import cstruct
 from dissect.util import ts
@@ -128,12 +128,17 @@ class DockerPlugin(Plugin):
         for data_root in self.installs:
             images_path = data_root.joinpath("image/overlay2/repositories.json")
 
-            if images_path.exists():
-                repositories = json.loads(images_path.read_text()).get("Repositories")
-            else:
+            if not images_path.exists():
                 self.target.log.debug("No docker images found, file %s does not exist.", images_path)
                 continue
 
+            try:
+                repositories = json.loads(images_path.read_text()).get("Repositories", {})
+            except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                self.target.log.warning("Unable to parse JSON in: %s", images_path)
+                self.target.log.debug("", exc_info=e)
+                continue
+
             for name, tags in repositories.items():
                 for tag, hash in tags.items():
                     image_metadata_path = data_root.joinpath(
@@ -142,8 +147,12 @@ class DockerPlugin(Plugin):
                     created = None
 
                     if image_metadata_path.exists():
-                        image_metadata = json.loads(image_metadata_path.read_text())
-                        created = convert_timestamp(image_metadata.get("created"))
+                        try:
+                            image_metadata = json.loads(image_metadata_path.read_text())
+                            created = convert_timestamp(image_metadata.get("created"))
+                        except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                            self.target.log.warning("Unable to parse JSON in: %s", image_metadata_path)
+                            self.target.log.debug("", exc_info=e)
 
                     yield DockerImageRecord(
                         name=name,
@@ -160,47 +169,51 @@ class DockerPlugin(Plugin):
 
         for data_root in self.installs:
             for config_path in data_root.joinpath("containers").glob("**/config.v2.json"):
-                config = json.loads(config_path.read_text())
+                try:
+                    config = json.loads(config_path.read_text())
+                except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                    self.target.log.warning("Unable to parse JSON in file: %s", config_path)
+                    self.target.log.debug("", exc_info=e)
+                    continue
+
                 container_id = config.get("ID")
 
                 # determine state
-                running = config.get("State").get("Running")
+                running = config.get("State", {}).get("Running")
                 if running:
-                    ports = config.get("NetworkSettings").get("Ports", {})
-                    pid = config.get("Pid")
-                else:
-                    ports = config.get("Config").get("ExposedPorts", {})
-                    pid = None
+                    ports = config.get("NetworkSettings", {}).get("Ports", {})
+
+                if not running or not ports:
+                    ports = config.get("Config", {}).get("ExposedPorts", {})
 
                 # parse volumes
                 volumes = []
-                if mount_points := config.get("MountPoints"):
-                    for mp in mount_points:
-                        mount_point = mount_points[mp]
+                if mount_points := config.get("MountPoints", {}):
+                    for mount_point in mount_points.values():
                         volumes.append(f"{mount_point.get('Source')}:{mount_point.get('Destination')}")
 
                 # determine mount point
                 mount_path = None
-                if config.get("Driver") == "overlay2":
+                if container_id and config.get("Driver") == "overlay2":
                     mount_path = data_root.joinpath("image/overlay2/layerdb/mounts", container_id)
                     if not mount_path.exists():
-                        self.target.log.warning("Overlay2 mount path for container %s does not exist!", container_id)
+                        self.target.log.warning("Overlay2 mount path does not exist for container: %s", container_id)
 
                 else:
-                    self.target.log.warning("Encountered unsupported container filesystem %s", config.get("Driver"))
+                    self.target.log.warning("Encountered unsupported container filesystem: %s", config.get("Driver"))
 
                 yield DockerContainerRecord(
                     container_id=container_id,
-                    image=config.get("Config").get("Image"),
-                    image_id=config.get("Image").split(":")[-1],
-                    command=config.get("Config").get("Cmd"),
+                    image=config.get("Config", {}).get("Image"),
+                    image_id=config.get("Image", "").split(":")[-1],
+                    command=f"{config.get('Path', '')} {' '.join(config.get('Args', []))}".strip(),
                     created=convert_timestamp(config.get("Created")),
                     running=running,
-                    pid=pid,
-                    started=convert_timestamp(config.get("State").get("StartedAt")),
-                    finished=convert_timestamp(config.get("State").get("FinishedAt")),
+                    pid=config.get("State", {}).get("Pid"),
+                    started=convert_timestamp(config.get("State", {}).get("StartedAt")),
+                    finished=convert_timestamp(config.get("State", {}).get("FinishedAt")),
                     ports=convert_ports(ports),
-                    names=config.get("Name").replace("/", "", 1),
+                    names=config.get("Name", "").replace("/", "", 1),
                     volumes=volumes,
                     mount_path=mount_path,
                     config_path=config_path,
@@ -288,19 +301,19 @@ class DockerPlugin(Plugin):
         for line in open_decompress(path, "rt"):
             try:
                 entry = json.loads(line)
-            except json.JSONDecodeError as e:
-                self.target.log.warning("Could not decode JSON line in file %s", path)
+            except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                self.target.log.warning("Could not decode JSON line in file: %s", path)
                 self.target.log.debug("", exc_info=e)
                 continue
             yield entry
 
 
-def get_data_path(path: Path) -> Optional[str]:
+def get_data_path(path: Path) -> str | None:
     """Returns the configured Docker daemon data-root path."""
     try:
         config = json.loads(path.open("rt").read())
-    except json.JSONDecodeError as e:
-        log.warning("Could not read JSON file '%s'", path)
+    except (json.JSONDecodeError, UnicodeDecodeError) as e:
+        log.warning("Could not read JSON file: %s", path)
         log.debug(exc_info=e)
 
     return config.get("data-root")
@@ -341,7 +354,7 @@ def find_installs(target: Target) -> Iterator[Path]:
                     yield data_root_path
 
 
-def convert_timestamp(timestamp: str) -> str:
+def convert_timestamp(timestamp: str | None) -> str:
     """Docker sometimes uses (unpadded) 9 digit nanosecond precision
     in their timestamp logs, eg. "2022-12-19T13:37:00.123456789Z".
 
@@ -350,6 +363,9 @@ def convert_timestamp(timestamp: str) -> str:
     compatbility with the 6 digit %f microsecond directive.
     """
 
+    if not timestamp:
+        return
+
     timestamp_nanoseconds_plus_postfix = timestamp[19:]
     match = RE_DOCKER_NS.match(timestamp_nanoseconds_plus_postfix)
 

{dissect_target-3.20.dev7 → dissect_target-3.20.dev9/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev7
+Version: 3.20.dev9
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev7 → dissect_target-3.20.dev9}/tests/filesystems/test_overlay.py

@@ -3,11 +3,13 @@ from dissect.target.filesystems.overlay import Overlay2Filesystem
 
 
 def test_overlay_filesystem_docker_container(target_linux_docker: Target) -> None:
-    mount_path = list(target_linux_docker.fs.path("/var/lib/docker/image/overlay2/layerdb/mounts/").iterdir())[0]
+    mount_path = target_linux_docker.fs.path(
+        "/var/lib/docker/image/overlay2/layerdb/mounts/f988f88e221d97930a665712cf16ab520f7e2c5af395660c145df93aebedf071"  # noqa: E501
+    )
     fs = Overlay2Filesystem(mount_path)
 
     assert fs.__type__ == "overlay2"
-    assert len(fs.layers) == 4
+    assert len(fs.layers) == 9
 
     assert sorted([str(p) for p in fs.path("/").iterdir()]) == sorted(
         [
@@ -29,13 +31,14 @@ def test_overlay_filesystem_docker_container(target_linux_docker: Target) -> Non
             "/usr",
             "/srv",
             "/.dockerenv",
+            "/container",
         ]
     )
 
-    assert [str(p) for p in fs.path("/root").iterdir()] == [
-        "/root/secret.txt",
-        "/root/file.txt",
+    assert sorted([str(p) for p in fs.path("/root").iterdir()]) == [
         "/root/.ash_history",
+        "/root/file.txt",
+        "/root/secret.txt",
     ]
 
     assert fs.path("/root/secret.txt").open().read() == b"this is a secret!\n"
@@ -47,3 +50,19 @@ def test_overlay_filesystem_docker_container(target_linux_docker: Target) -> Non
     assert fs.path("/bin/sh").readlink() == fs.path("/bin/busybox")
     assert fs.path("/etc/ssl/cert.pem").resolve() == fs.path("/etc/ssl/certs/ca-certificates.crt")
     assert fs.path("/usr/lib/libcrypto.so.3").resolve() == fs.path("/lib/libcrypto.so.3")
+
+    # test if standard mounts were correctly added
+    assert fs.path("/etc/hostname").exists()
+    assert fs.path("/etc/hostname").is_file()
+    assert fs.path("/etc/hostname").read_text() == "f988f88e221d\n"
+    assert fs.path("/etc/hosts").exists()
+    assert fs.path("/etc/resolv.conf").exists()
+
+    # test if custom mounts were correctly added
+    assert fs.path("/container/file.txt").exists()
+    assert fs.path("/container/file.txt").is_file()
+    assert fs.path("/container/file.txt").read_text() == "this is a mounted file!\n"
+    assert fs.path("/container/folder").exists()
+    assert fs.path("/container/folder").is_dir()
+    assert fs.path("/container/folder/some-file.txt").exists()
+    assert fs.path("/container/folder/some-file.txt").is_file()

{dissect_target-3.20.dev7 → dissect_target-3.20.dev9}/tests/plugins/apps/container/test_docker.py

@@ -1,4 +1,5 @@
 import datetime
+import json
 import operator
 from io import BytesIO
 from typing import Iterator
@@ -14,6 +15,7 @@ from dissect.target.plugins.apps.container.docker import (
     find_installs,
     strip_log,
 )
+from dissect.target.plugins.os.unix._os import UnixPlugin
 from tests._utils import absolute_path
 
 
@@ -134,3 +136,67 @@ def test_backspace_interpretation() -> None:
         '~ # \x1b[6necho \'\x08\x1b[J"ths \x08\x1b[J\x08\x1b[Js \x08\x1b[J\x08\x1b[Jis is a secret!" > secret.txt\r\n'
     )
     assert strip_log(input, exc_backspace=True) == '~ # echo "this is a secret!" > secret.txt'
+
+
+def test_regression_running_container_parsing(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if we correctly discover and reconstruct exposed container ports and commands on a running container"""
+
+    id = "deadbeef"
+    config = {
+        "ID": id,
+        "Image": "sha256:blabla",
+        "Name": "/foo",
+        "Path": "/bin/some-binary",
+        "Driver": "overlay2",
+        "Args": [
+            "--some-argument 1",
+            "--another-argument 2",
+        ],
+        "State": {
+            "Running": True,
+            "Pid": 1337,
+            "StartedAt": "2024-12-31T13:37:00.123456789Z",
+        },
+        "Config": {
+            "Hostname": "foo",
+            "ExposedPorts": {
+                "1337/tcp": {},
+                "1337/udp": {},
+            },
+            "Image": "docker.io/debian",
+        },
+        "NetworkSettings": {
+            "Ports": {},
+        },
+        "MountPoints": {
+            "/dest/file.txt": {
+                "Source": "/somewhere/on/host/file.txt",
+                "Destination": "/dest/file.txt",
+            },
+        },
+    }
+
+    fs_unix.map_file_fh(f"/var/lib/docker/containers/{id}/config.v2.json", BytesIO(json.dumps(config).encode()))
+    fs_unix.map_file_fh("/etc/hostname", BytesIO(b"hostname"))
+
+    target_unix.add_plugin(UnixPlugin)
+    target_unix.add_plugin(DockerPlugin)
+
+    results = list(target_unix.docker.containers())
+    assert len(results) == 1
+
+    assert results[0].hostname == "hostname"
+    assert results[0].container_id == id
+    assert results[0].image == "docker.io/debian"
+    assert results[0].image_id == "blabla"
+    assert results[0].command == "/bin/some-binary --some-argument 1 --another-argument 2"
+    assert results[0].created is None
+    assert results[0].running
+    assert results[0].pid == 1337
+    assert results[0].started == datetime.datetime(2024, 12, 31, 13, 37, 0, 123456, tzinfo=datetime.timezone.utc)
+    assert results[0].finished is None
+    assert results[0].ports == str({"1337/tcp": "0.0.0.0:1337", "1337/udp": "0.0.0.0:1337"})
+    assert results[0].names == "foo"
+    assert results[0].volumes == ["/somewhere/on/host/file.txt:/dest/file.txt"]
+    assert results[0].mount_path == "/var/lib/docker/image/overlay2/layerdb/mounts/deadbeef"
+    assert results[0].config_path == "/var/lib/docker/containers/deadbeef/config.v2.json"

dissect_target-3.20.dev9/tests/plugins/child/test_docker.py

@@ -0,0 +1,16 @@
+from dissect.target import Target
+from dissect.target.plugins.child.docker import DockerChildTargetPlugin
+
+
+def test_plugins_child_docker(target_linux_docker: Target) -> None:
+    target_linux_docker.add_plugin(DockerChildTargetPlugin)
+    children = sorted(list(target_linux_docker.list_children()), key=lambda r: r.path)
+
+    assert len(children) == 3
+    assert children[0].type == "docker"
+
+    assert [c.path for c in children] == [
+        "/var/lib/docker/image/overlay2/layerdb/mounts/01b646bc043eb4ad72f3a64b4ffd9be2cbeb399e0a07497d749d724460ccad3a",  # noqa: E501
+        "/var/lib/docker/image/overlay2/layerdb/mounts/589135d12011921ac6ce69753569da5f206f4bc792a9133727ddae860997ee66",  # noqa: E501
+        "/var/lib/docker/image/overlay2/layerdb/mounts/f988f88e221d97930a665712cf16ab520f7e2c5af395660c145df93aebedf071",  # noqa: E501
+    ]

dissect_target-3.20.dev7/tests/plugins/child/test_docker.py

@@ -1,14 +0,0 @@
-from dissect.target import Target
-from dissect.target.plugins.child.docker import DockerChildTargetPlugin
-
-
-def test_plugins_child_docker(target_linux_docker: Target) -> None:
-    target_linux_docker.add_plugin(DockerChildTargetPlugin)
-    children = list(target_linux_docker.list_children())
-
-    assert len(children) == 3
-    assert children[0].type == "docker"
-    assert (
-        children[0].path
-        == "/var/lib/docker/image/overlay2/layerdb/mounts/f988f88e221d97930a665712cf16ab520f7e2c5af395660c145df93aebedf071"  # noqa: E501
-    )