dissect.target 3.21.dev1__py3-none-any.whl → 3.21.dev3__py3-none-any.whl

dissect/target/helpers/configutil.py

@@ -891,7 +891,7 @@ KNOWN_FILES: dict[str, type[ConfigurationParser]] = {
 }
 
 
-def parse(path: Union[FilesystemEntry, TargetPath], hint: Optional[str] = None, *args, **kwargs) -> ConfigParser:
+def parse(path: Union[FilesystemEntry, TargetPath], hint: Optional[str] = None, *args, **kwargs) -> ConfigurationParser:
     """Parses the content of an ``path`` or ``entry`` to a dictionary.
 
     Args:
@@ -922,7 +922,7 @@ def parse_config(
     entry: FilesystemEntry,
     hint: Optional[str] = None,
     options: Optional[ParserOptions] = None,
-) -> ConfigParser:
+) -> ConfigurationParser:
     parser_type = _select_parser(entry, hint)
 
     parser = parser_type.create_parser(options)

dissect/target/helpers/record.py

@@ -145,33 +145,40 @@ EmptyRecord = RecordDescriptor(
 
 COMMON_INTERFACE_ELEMENTS = [
     ("string", "name"),
+    ("string[]", "mac"),
     ("string", "type"),
     ("boolean", "enabled"),
-    ("string", "mac"),
     ("net.ipaddress[]", "dns"),
     ("net.ipaddress[]", "ip"),
     ("net.ipaddress[]", "gateway"),
+    ("net.ipnetwork[]", "network"),
     ("string", "source"),
 ]
 
 
 UnixInterfaceRecord = TargetRecordDescriptor(
     "unix/network/interface",
-    COMMON_INTERFACE_ELEMENTS,
+    [
+        *COMMON_INTERFACE_ELEMENTS,
+        ("boolean", "dhcp_ipv4"),  # NetworkManager allows for dual-stack configurations.
+        ("boolean", "dhcp_ipv6"),
+        ("datetime", "last_connected"),
+        ("varint[]", "vlan"),
+        ("string", "configurator"),
+    ],
 )
 
 WindowsInterfaceRecord = TargetRecordDescriptor(
     "windows/network/interface",
     [
         *COMMON_INTERFACE_ELEMENTS,
-        ("varint", "vlan"),
-        ("net.ipnetwork[]", "network"),
         ("varint", "metric"),
         ("stringlist", "search_domain"),
         ("datetime", "first_connected"),
         ("datetime", "last_connected"),
         ("net.ipaddress[]", "subnetmask"),
         ("boolean", "dhcp"),
+        ("varint", "vlan"),
     ],
 )
 
@@ -179,10 +186,9 @@ MacInterfaceRecord = TargetRecordDescriptor(
     "macos/network/interface",
     [
         *COMMON_INTERFACE_ELEMENTS,
-        ("varint", "vlan"),
-        ("net.ipnetwork[]", "network"),
         ("varint", "interface_service_order"),
         ("boolean", "dhcp"),
+        ("varint", "vlan"),
     ],
 )
 

dissect/target/helpers/utils.py

@@ -1,10 +1,12 @@
+from __future__ import annotations
+
 import logging
 import re
 import urllib.parse
 from datetime import datetime, timezone, tzinfo
 from enum import Enum
 from pathlib import Path
-from typing import BinaryIO, Callable, Iterator, Optional, Union
+from typing import BinaryIO, Callable, Iterator, Optional, TypeVar, Union
 
 from dissect.util.ts import from_unix
 
@@ -24,6 +26,23 @@ def findall(buf: bytes, needle: bytes) -> Iterator[int]:
         offset += 1
 
 
+T = TypeVar("T")
+
+
+def to_list(value: T | list[T]) -> list[T]:
+    """Convert a single value or a list of values to a list.
+
+    Args:
+        value: The value to convert.
+
+    Returns:
+        A list of values.
+    """
+    if not isinstance(value, list):
+        return [value]
+    return value
+
+
 class StrEnum(str, Enum):
     """Sortable and serializible string-based enum"""
 

dissect/target/plugins/general/network.py

@@ -79,7 +79,7 @@ class NetworkPlugin(Plugin):
     @internal
     def with_mac(self, mac: str) -> Iterator[InterfaceRecord]:
         for interface in self.interfaces():
-            if interface.mac == mac:
+            if mac in interface.mac:
                 yield interface
 
     @internal

dissect/target/plugins/os/unix/bsd/osx/network.py

@@ -84,9 +84,10 @@ class MacNetworkPlugin(NetworkPlugin):
                     network=network,
                     interface_service_order=interface_service_order,
                     dhcp=dhcp,
+                    mac=[],
                     _target=self.target,
                 )
 
             except Exception as e:
-                self.target.log.warning("Error reading configuration for network device %s: %s", name, e)
+                self.target.log.warning("Error reading configuration for network device %s", name, exc_info=e)
                 continue

dissect/target/plugins/os/unix/etc/etc.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import fnmatch
 import re
 from pathlib import Path
@@ -30,9 +32,10 @@ class EtcTree(ConfigurationTreePlugin):
     def __init__(self, target: Target):
         super().__init__(target, "/etc")
 
-    def _sub(self, items: ConfigurationEntry, entry: Path, pattern: str) -> Iterator[UnixConfigTreeRecord]:
+    def _sub(
+        self, items: ConfigurationEntry | dict, entry: Path, orig_path: Path, pattern: str
+    ) -> Iterator[UnixConfigTreeRecord]:
         index = 0
-        config_entry = items
         if not isinstance(items, dict):
             items = items.as_dict()
 
@@ -41,7 +44,7 @@ class EtcTree(ConfigurationTreePlugin):
             path = Path(entry) / Path(key)
 
             if isinstance(value, dict):
-                yield from self._sub(value, path, pattern)
+                yield from self._sub(value, path, orig_path, pattern)
                 continue
 
             if not isinstance(value, list):
@@ -50,7 +53,7 @@ class EtcTree(ConfigurationTreePlugin):
             if fnmatch.fnmatch(path, pattern):
                 data = {
                     "_target": self.target,
-                    "source": self.target.fs.path(config_entry.entry.path),
+                    "source": self.target.fs.path(orig_path),
                     "path": path,
                     "key": key,
                     "value": value,
@@ -71,8 +74,11 @@ class EtcTree(ConfigurationTreePlugin):
         for entry, subs, items in self.config_fs.walk(root):
             for item in items:
                 try:
-                    config_object = self.get(str(Path(entry) / Path(item)))
-                    yield from self._sub(config_object, Path(entry) / Path(item), pattern)
+                    path = Path(entry) / item
+                    config_object = self.get(str(path))
+
+                    if isinstance(config_object, ConfigurationEntry):
+                        yield from self._sub(config_object, path, orig_path=path, pattern=pattern)
                 except Exception:
                     self.target.log.warning("Could not open configuration item: %s", item)
                     pass

dissect/target/plugins/os/unix/linux/network.py

@@ -0,0 +1,338 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from ipaddress import ip_address, ip_interface
+from typing import TYPE_CHECKING, Any, Iterator, Literal, NamedTuple
+
+from dissect.target.helpers import configutil
+from dissect.target.helpers.record import UnixInterfaceRecord
+from dissect.target.helpers.utils import to_list
+from dissect.target.plugins.general.network import NetworkPlugin
+
+if TYPE_CHECKING:
+    from ipaddress import IPv4Address, IPv4Interface, IPv6Address, IPv6Interface
+
+    from dissect.target import Target
+    from dissect.target.target import TargetPath
+
+    NetAddress = IPv4Address | IPv6Address
+    NetInterface = IPv4Interface | IPv6Interface
+
+
+class LinuxNetworkPlugin(NetworkPlugin):
+    """Linux network interface plugin."""
+
+    def _interfaces(self) -> Iterator[UnixInterfaceRecord]:
+        """Try all available network configuration managers and aggregate the results."""
+        for manager_cls in MANAGERS:
+            manager: LinuxNetworkConfigParser = manager_cls(self.target)
+            yield from manager.interfaces()
+
+
+VlanIdByInterface = dict[str, set[int]]
+
+
+class LinuxNetworkConfigParser:
+    def __init__(self, target: Target):
+        self._target = target
+
+    def _config_files(self, config_paths: list[str], glob: str) -> list[TargetPath]:
+        """Returns all configuration files in config_paths matching the given extension."""
+        all_files = []
+        for config_path in config_paths:
+            paths = self._target.fs.path(config_path).glob(glob)
+            all_files.extend(config_file for config_file in paths if config_file.is_file())
+
+        return sorted(all_files, key=lambda p: p.stem)
+
+    def interfaces(self) -> Iterator[UnixInterfaceRecord]:
+        """Parse network interfaces from configuration files."""
+        yield from ()
+
+
+class NetworkManagerConfigParser(LinuxNetworkConfigParser):
+    """NetworkManager configuration parser.
+
+    NetworkManager configuration files are generally in an INI-like format.
+    Note that Red Hat and Fedora deprecated ifcfg files.
+    Documentation: https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html
+    """
+
+    config_paths: list[str] = [
+        "/etc/NetworkManager/system-connections/",
+        "/usr/lib/NetworkManager/system-connections/",
+        "/run/NetworkManager/system-connections/",
+    ]
+
+    @dataclass
+    class ParserContext:
+        source: str
+        uuid: str | None = None
+        last_connected: datetime | None = None
+        name: str | None = None
+        mac_address: str | None = None
+        type: str = ""
+        dns: set[NetAddress] = field(default_factory=set)
+        ip_interfaces: set[NetInterface] = field(default_factory=set)
+        gateways: set[NetAddress] = field(default_factory=set)
+        dhcp_ipv4: bool = False
+        dhcp_ipv6: bool = False
+        vlan: set[int] = field(default_factory=set)
+
+        def to_record(self) -> UnixInterfaceRecord:
+            return UnixInterfaceRecord(
+                source=self.source,
+                last_connected=self.last_connected,
+                name=self.name,
+                mac=[self.mac_address] if self.mac_address else [],
+                type=self.type,
+                dhcp_ipv4=self.dhcp_ipv4,
+                dhcp_ipv6=self.dhcp_ipv6,
+                dns=list(self.dns),
+                ip=[interface.ip for interface in self.ip_interfaces],
+                network=[interface.network for interface in self.ip_interfaces],
+                gateway=list(self.gateways),
+                vlan=list(self.vlan),
+                configurator="NetworkManager",
+            )
+
+    def interfaces(self) -> Iterator[UnixInterfaceRecord]:
+        connections: list[NetworkManagerConfigParser.ParserContext] = []
+        vlan_id_by_interface: VlanIdByInterface = {}
+
+        for connection_file_path in self._config_files(self.config_paths, "*"):
+            try:
+                config = configutil.parse(connection_file_path, hint="ini")
+                context = self.ParserContext(source=connection_file_path)
+                common_section: dict[str, str] = config.get("connection", {})
+                context.type = common_section.get("type", "")
+                sub_type: dict[str, str] = config.get(context.type, {})
+
+                if context.type == "vlan":
+                    self._parse_vlan(sub_type, vlan_id_by_interface)
+                    continue
+
+                for ip_version in ["ipv4", "ipv6"]:
+                    ip_section: dict[str, str] = config.get(ip_version, {})
+                    for key, value in ip_section.items():
+                        self._parse_ip_section_key(key, value, context, ip_version)
+
+                context.name = common_section.get("interface-name")
+                context.mac_address = sub_type.get("mac-address")
+                context.uuid = common_section.get("uuid")
+                context.source = str(connection_file_path)
+                context.last_connected = self._parse_lastconnected(common_section.get("timestamp", ""))
+
+                connections.append(context)
+
+            except Exception as e:
+                self._target.log.warning("Error parsing network config file %s", connection_file_path)
+                self._target.log.debug("", exc_info=e)
+
+        for connection in connections:
+            vlan_ids_from_interface = vlan_id_by_interface.get(connection.name, set())
+            connection.vlan.update(vlan_ids_from_interface)
+
+            vlan_ids_from_uuid = vlan_id_by_interface.get(connection.uuid, set())
+            connection.vlan.update(vlan_ids_from_uuid)
+
+            yield connection.to_record()
+
+    def _parse_route(self, route: str) -> NetAddress | None:
+        """Parse a route and return gateway IP address."""
+        if (elements := route.split(",")) and len(elements) > 1:
+            return ip_address(elements[1])
+
+        return None
+
+    def _parse_lastconnected(self, last_connected: str) -> datetime | None:
+        """Parse last connected timestamp."""
+        if not last_connected:
+            return None
+
+        return datetime.fromtimestamp(int(last_connected), timezone.utc)
+
+    def _parse_ip_section_key(
+        self, key: str, value: str, context: ParserContext, ip_version: Literal["ipv4", "ipv6"]
+    ) -> None:
+        if not (trimmed := value.strip()):
+            return
+
+        if key == "dns":
+            context.dns.update(ip_address(addr) for addr in trimmed.split(";") if addr)
+        elif key.startswith("address"):
+            # Undocumented: single gateway on address line. Observed when running:
+            # nmcli connection add type ethernet ... ip4 192.168.2.138/24 gw4 192.168.2.1
+            ip, *gateway = trimmed.split(",", 1)
+            context.ip_interfaces.add(ip_interface(ip))
+            if gateway:
+                context.gateways.add(ip_address(gateway[0]))
+        elif key.startswith("gateway"):
+            context.gateways.add(ip_address(trimmed))
+        elif key == "method":
+            if ip_version == "ipv4":
+                context.dhcp_ipv4 = trimmed == "auto"
+            elif ip_version == "ipv6":
+                context.dhcp_ipv6 = trimmed == "auto"
+        elif key.startswith("route"):
+            if gateway := self._parse_route(value):
+                context.gateways.add(gateway)
+
+    def _parse_vlan(self, sub_type: dict[str, Any], vlan_id_by_interface: VlanIdByInterface) -> None:
+        parent_interface = sub_type.get("parent")
+        vlan_id = sub_type.get("id")
+        if not parent_interface or not vlan_id:
+            return
+
+        ids = vlan_id_by_interface.setdefault(parent_interface, set())
+        ids.add(int(vlan_id))
+
+
+class SystemdNetworkConfigParser(LinuxNetworkConfigParser):
+    """Systemd network configuration parser.
+
+    Systemd network configuration files are generally in an INI-like format with some quirks.
+    Note that drop-in directories are not yet supported.
+
+    Documentation: https://www.freedesktop.org/software/systemd/man/latest/systemd.network.html
+    """
+
+    config_paths: list[str] = [
+        "/etc/systemd/network/",
+        "/run/systemd/network/",
+        "/usr/lib/systemd/network/",
+        "/usr/local/lib/systemd/network/",
+    ]
+
+    class DhcpConfig(NamedTuple):
+        ipv4: bool
+        ipv6: bool
+
+    # Can be enclosed in brackets for IPv6. Can also have port, iface name, and SNI, which we ignore.
+    # Example: [1111:2222::3333]:9953%ifname#example.com
+    dns_ip_patttern = re.compile(
+        r"(?P<withoutBrackets>(?:\d{1,3}\.){3}\d{1,3})|\[(?P<withBrackets>\[?[0-9a-fA-F:]+\]?)\]"
+    )
+
+    def interfaces(self) -> Iterator:
+        virtual_networks = self._parse_virtual_networks()
+        yield from self._parse_networks(virtual_networks)
+
+    def _parse_virtual_networks(self) -> VlanIdByInterface:
+        """Parse virtual network configurations from systemd network configuration files."""
+
+        virtual_networks: VlanIdByInterface = {}
+        for config_file in self._config_files(self.config_paths, "*.netdev"):
+            try:
+                virtual_network_config = configutil.parse(config_file, hint="systemd")
+                net_dev_section: dict[str, str] = virtual_network_config.get("NetDev", {})
+                if net_dev_section.get("Kind") != "vlan":
+                    continue
+
+                vlan_id = virtual_network_config.get("VLAN", {}).get("Id")
+                if (name := net_dev_section.get("Name")) and vlan_id:
+                    vlan_ids = virtual_networks.setdefault(name, set())
+                    vlan_ids.add(int(vlan_id))
+            except Exception as e:
+                self._target.log.warning("Error parsing virtual network config file %s", config_file)
+                self._target.log.debug("", exc_info=e)
+
+        return virtual_networks
+
+    def _parse_networks(self, virtual_networks: VlanIdByInterface) -> Iterator[UnixInterfaceRecord]:
+        """Parse network configurations from systemd network configuration files."""
+        for config_file in self._config_files(self.config_paths, "*.network"):
+            try:
+                config = configutil.parse(config_file, hint="systemd")
+
+                match_section: dict[str, str] = config.get("Match", {})
+                network_section: dict[str, str] = config.get("Network", {})
+                link_section: dict[str, str] = config.get("Link", {})
+
+                ip_interfaces: set[NetInterface] = set()
+                gateways: set[NetAddress] = set()
+                dns: set[NetAddress] = set()
+                mac_addresses: set[str] = set()
+
+                if link_mac := link_section.get("MACAddress"):
+                    mac_addresses.add(link_mac)
+                mac_addresses.update(match_section.get("MACAddress", "").split())
+                mac_addresses.update(match_section.get("PermanentMACAddress", "").split())
+
+                dns_value = to_list(network_section.get("DNS", []))
+                dns.update(self._parse_dns_ip(dns_ip) for dns_ip in dns_value)
+
+                address_value = to_list(network_section.get("Address", []))
+                ip_interfaces.update(ip_interface(addr) for addr in address_value)
+
+                gateway_value = to_list(network_section.get("Gateway", []))
+                gateways.update(ip_address(gateway) for gateway in gateway_value)
+
+                vlan_ids: set[int] = set()
+                vlan_names = to_list(network_section.get("VLAN", []))
+                for vlan_name in vlan_names:
+                    if ids := virtual_networks.get(vlan_name):
+                        vlan_ids.update(ids)
+
+                # There are possibly multiple route sections, but they are collapsed into one by the parser.
+                route_section: dict[str, Any] = config.get("Route", {})
+                gateway_values = to_list(route_section.get("Gateway", []))
+                gateways.update(filter(None, map(self._parse_gateway, gateway_values)))
+
+                dhcp_ipv4, dhcp_ipv6 = self._parse_dhcp(network_section.get("DHCP"))
+
+                yield UnixInterfaceRecord(
+                    source=str(config_file),
+                    type=match_section.get("Type"),
+                    enabled=None,  # Unknown, dependent on run-time state
+                    dhcp_ipv4=dhcp_ipv4,
+                    dhcp_ipv6=dhcp_ipv6,
+                    name=match_section.get("Name"),
+                    dns=list(dns),
+                    mac=list(mac_addresses),
+                    ip=[interface.ip for interface in ip_interfaces],
+                    network=[interface.network for interface in ip_interfaces],
+                    gateway=list(gateways),
+                    vlan=list(vlan_ids),
+                    configurator="systemd-networkd",
+                )
+            except Exception as e:
+                self._target.log.warning("Error parsing network config file %s", config_file)
+                self._target.log.debug("", exc_info=e)
+
+    def _parse_dns_ip(self, address: str) -> NetAddress:
+        """Parse DNS address from systemd network configuration file.
+
+        The optional brackets and port number make this hard to parse.
+        See https://www.freedesktop.org/software/systemd/man/latest/systemd.network.html and search for DNS.
+        """
+
+        if match := self.dns_ip_patttern.search(address):
+            return ip_address(match.group("withoutBrackets") or match.group("withBrackets"))
+
+        raise ValueError(f"Invalid DNS address format: {address}")
+
+    def _parse_dhcp(self, value: str | None) -> DhcpConfig:
+        """Parse DHCP value from systemd network configuration file to a named tuple (ipv4, ipv6)."""
+
+        if value is None or value == "no":
+            return self.DhcpConfig(ipv4=False, ipv6=False)
+        elif value == "yes":
+            return self.DhcpConfig(ipv4=True, ipv6=True)
+        elif value == "ipv4":
+            return self.DhcpConfig(ipv4=True, ipv6=False)
+        elif value == "ipv6":
+            return self.DhcpConfig(ipv4=False, ipv6=True)
+
+        raise ValueError(f"Invalid DHCP value: {value}")
+
+    def _parse_gateway(self, value: str | None) -> NetAddress | None:
+        if (not value) or (value in {"_dhcp4", "_ipv6ra"}):
+            return None
+
+        return ip_address(value)
+
+
+MANAGERS = [NetworkManagerConfigParser, SystemdNetworkConfigParser]

dissect/target/plugins/os/windows/network.py

@@ -281,7 +281,8 @@ class WindowsNetworkPlugin(NetworkPlugin):
                     pass
 
                 # Extract the rest of the device information
-                device_info["mac"] = _try_value(subkey, "NetworkAddress")
+                if mac_address := _try_value(subkey, "NetworkAddress"):
+                    device_info["mac"] = [mac_address]
                 device_info["vlan"] = _try_value(subkey, "VlanID")
 
                 if timestamp := _try_value(subkey, "NetworkInterfaceInstallTimestamp"):

{dissect.target-3.21.dev1.dist-info → dissect.target-3.21.dev3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.21.dev1
+Version: 3.21.dev3
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -23,81 +23,81 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
-Requires-Dist: dissect.cstruct <5,>=4
-Requires-Dist: dissect.eventlog <4,>=3
-Requires-Dist: dissect.evidence <4,>=3
-Requires-Dist: dissect.hypervisor <4,>=3
-Requires-Dist: dissect.ntfs <4,>=3.4
-Requires-Dist: dissect.regf <4,>=3.3
-Requires-Dist: dissect.util <4,>=3
-Requires-Dist: dissect.volume <4,>=2
-Requires-Dist: flow.record ~=3.18.0
+Requires-Dist: dissect.cstruct<5,>=4
+Requires-Dist: dissect.eventlog<4,>=3
+Requires-Dist: dissect.evidence<4,>=3
+Requires-Dist: dissect.hypervisor<4,>=3
+Requires-Dist: dissect.ntfs<4,>=3.4
+Requires-Dist: dissect.regf<4,>=3.3
+Requires-Dist: dissect.util<4,>=3
+Requires-Dist: dissect.volume<4,>=2
+Requires-Dist: flow.record~=3.18.0
 Requires-Dist: structlog
-Provides-Extra: cb
-Requires-Dist: dissect.target[full] ; extra == 'cb'
-Requires-Dist: carbon-black-cloud-sdk ~=1.4.3 ; extra == 'cb'
-Provides-Extra: dev
-Requires-Dist: dissect.target[full,mqtt,yara] ; extra == 'dev'
-Requires-Dist: dissect.archive[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.btrfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.cim[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.clfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.cstruct <5.0.dev,>=4.0.dev ; extra == 'dev'
-Requires-Dist: dissect.esedb[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.etl[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.eventlog[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.evidence[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.extfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.fat[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.ffs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.hypervisor[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.jffs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.ntfs[dev] <4.0.dev,>=3.4.dev ; extra == 'dev'
-Requires-Dist: dissect.regf[dev] <4.0.dev,>=3.3.dev ; extra == 'dev'
-Requires-Dist: dissect.shellitem[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.sql[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.squashfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.thumbcache[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.util <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.vmfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.volume[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.xfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.fve[dev] <5.0.dev,>=4.0.dev ; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == 'dev'
 Provides-Extra: full
-Requires-Dist: asn1crypto ; extra == 'full'
-Requires-Dist: dissect.archive <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.btrfs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.cim <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.clfs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.esedb <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.etl <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.extfs <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.fat <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.ffs <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.jffs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.ole <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.shellitem <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.squashfs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.sql <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.thumbcache <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.vmfs <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.xfs <4,>=3 ; extra == 'full'
-Requires-Dist: ipython ; extra == 'full'
-Requires-Dist: fusepy ; extra == 'full'
-Requires-Dist: pycryptodome ; extra == 'full'
-Requires-Dist: ruamel.yaml ; extra == 'full'
-Requires-Dist: zstandard ; extra == 'full'
-Requires-Dist: dissect.fve <5,>=4 ; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == 'full'
-Requires-Dist: tomli ; (python_version < "3.11") and extra == 'full'
-Provides-Extra: mqtt
-Requires-Dist: dissect.target[full] ; extra == 'mqtt'
-Requires-Dist: paho-mqtt ==1.6.1 ; extra == 'mqtt'
-Provides-Extra: smb
-Requires-Dist: dissect.target[full] ; extra == 'smb'
-Requires-Dist: impacket ==0.10.0 ; extra == 'smb'
+Requires-Dist: asn1crypto; extra == "full"
+Requires-Dist: dissect.archive<2,>=1; extra == "full"
+Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
+Requires-Dist: dissect.cim<4,>=3; extra == "full"
+Requires-Dist: dissect.clfs<2,>=1; extra == "full"
+Requires-Dist: dissect.esedb<4,>=3; extra == "full"
+Requires-Dist: dissect.etl<4,>=3; extra == "full"
+Requires-Dist: dissect.extfs<4,>=3; extra == "full"
+Requires-Dist: dissect.fat<4,>=3; extra == "full"
+Requires-Dist: dissect.ffs<4,>=3; extra == "full"
+Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
+Requires-Dist: dissect.jffs<2,>=1; extra == "full"
+Requires-Dist: dissect.ole<4,>=3; extra == "full"
+Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
+Requires-Dist: dissect.squashfs<2,>=1; extra == "full"
+Requires-Dist: dissect.sql<4,>=3; extra == "full"
+Requires-Dist: dissect.thumbcache<2,>=1; extra == "full"
+Requires-Dist: dissect.vmfs<4,>=3; extra == "full"
+Requires-Dist: dissect.xfs<4,>=3; extra == "full"
+Requires-Dist: ipython; extra == "full"
+Requires-Dist: fusepy; extra == "full"
+Requires-Dist: pycryptodome; extra == "full"
+Requires-Dist: ruamel.yaml; extra == "full"
+Requires-Dist: tomli; python_version < "3.11" and extra == "full"
+Requires-Dist: zstandard; extra == "full"
+Provides-Extra: dev
+Requires-Dist: dissect.target[full,mqtt,yara]; extra == "dev"
+Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
+Requires-Dist: dissect.esedb[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
+Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"
+Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.3.dev; extra == "dev"
+Requires-Dist: dissect.shellitem[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.sql[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.squashfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.thumbcache[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.util<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.vmfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.volume[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.xfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Provides-Extra: yara
-Requires-Dist: dissect.target[full] ; extra == 'yara'
-Requires-Dist: yara-python ; extra == 'yara'
+Requires-Dist: dissect.target[full]; extra == "yara"
+Requires-Dist: yara-python; extra == "yara"
+Provides-Extra: smb
+Requires-Dist: dissect.target[full]; extra == "smb"
+Requires-Dist: impacket==0.10.0; extra == "smb"
+Provides-Extra: cb
+Requires-Dist: dissect.target[full]; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
+Provides-Extra: mqtt
+Requires-Dist: dissect.target[full]; extra == "mqtt"
+Requires-Dist: paho-mqtt==1.6.1; extra == "mqtt"
 
 # dissect.target
 

{dissect.target-3.21.dev1.dist-info → dissect.target-3.21.dev3.dist-info}/RECORD

@@ -46,7 +46,7 @@ dissect/target/filesystems/zip.py,sha256=BeNj23DOYfWuTm5V1V419ViJiMfBrO1VA5gP6rl
 dissect/target/helpers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/helpers/cache.py,sha256=TXlJBdFRz6V9zKs903am4Yawr0maYw5kZY0RqklDQJM,8568
 dissect/target/helpers/config.py,sha256=RMHnIuKJHINHiLrvKN3EyA0jFA1o6-pbeaycG8Pgrp8,2596
-dissect/target/helpers/configutil.py,sha256=KuuQoJZMr69247-yDKylLUSfSsoE4sGXy3a145CwDa8,31414
+dissect/target/helpers/configutil.py,sha256=xXCmQA939iacd6cHr1SwNv6dyUo2bKMWsAI0TxwL24I,31428
 dissect/target/helpers/cyber.py,sha256=2kAA2YjWnPfKn_aTmRSse4uB64lq6AnNX19TD8Alylc,16830
 dissect/target/helpers/descriptor_extensions.py,sha256=uT8GwznfDAiIgMM7JKKOY0PXKMv2c0GCqJTCkWFgops,2605
 dissect/target/helpers/docs.py,sha256=G5Ll1cX2kYUfNcFFI-qjeUQ5Di60RAVpVnlB72F4Vqk,5153
@@ -60,12 +60,12 @@ dissect/target/helpers/mount.py,sha256=7Y4B0uY2c00p23hmuMKSgwAwxkKcY4spyAMO1kdcV
 dissect/target/helpers/mui.py,sha256=i-7XoHbu4WO2fYapK9yGAMW04rFlgRispknc1KQIS5Q,22258
 dissect/target/helpers/polypath.py,sha256=h8p7m_OCNiQljGwoZh5Aflr9H2ot6CZr6WKq1OSw58o,2175
 dissect/target/helpers/protobuf.py,sha256=b4DsnqrRLrefcDjx7rQno-_LBcwtJXxuKf5RdOegzfE,1537
-dissect/target/helpers/record.py,sha256=TxG1lwW5N0V-7kuq4s2vnQh-hAbT7rVwwZLf4sIDNjM,6334
+dissect/target/helpers/record.py,sha256=VRwPE8OIotWzfxw-_ep_eXG-Iml6xzhodwPlbQYYaoY,6540
 dissect/target/helpers/record_modifier.py,sha256=cRNDhUYMmx4iEKyEr5Pqy9xiFgxr_GBNJPp_omkQsEU,4094
 dissect/target/helpers/regutil.py,sha256=hnJRTOQs4IqN4EroBoSNC4HDvuA8w6U1dqNBvu-ILn0,28376
 dissect/target/helpers/shell_application_ids.py,sha256=hYxrP-YtHK7ZM0ectJFHfoMB8QUXLbYNKmKXMWLZRlA,38132
 dissect/target/helpers/shell_folder_ids.py,sha256=Behhb8oh0kMxrEk6YYKYigCDZe8Hw5QS6iK_d2hTs2Y,24978
-dissect/target/helpers/utils.py,sha256=K3xVq9D0FwIhTBAuiWN8ph7Pq2GABgG3hOz-3AmKuEA,4244
+dissect/target/helpers/utils.py,sha256=1UZNTUVBmtS2clbyIsi6mHOVw0jqPktM8OwCxCbOiY0,4587
 dissect/target/helpers/compat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/helpers/compat/path_310.py,sha256=PsLDIodlp3Hv5u-w7GDl6_LnTtchBYcRjz2MicX1egg,16982
 dissect/target/helpers/compat/path_311.py,sha256=2aydxCMWu1pN8PTBCo8HUbHRMC1xO-hj013j4QxaogE,18182
@@ -190,7 +190,7 @@ dissect/target/plugins/general/config.py,sha256=Mdy9uhWn4OJ96zfXpLgjVifV5SrViqHn
 dissect/target/plugins/general/default.py,sha256=8W_9JV3jKEeETlyTrB25sACoIIFmmO8wlVU5Zoi51W0,1425
 dissect/target/plugins/general/example.py,sha256=mYAbhtfQmUBj2L2C1DFt9bWpI7rQLJwCIYUsNLcA_pc,6053
 dissect/target/plugins/general/loaders.py,sha256=z_t55Q1XNjmTOxq0E4tCwpZ-utFyxiLKyAJIFgJMlJs,1508
-dissect/target/plugins/general/network.py,sha256=TWfSdI5fTgwe1_nV7u_ldtvvRwgmkVFLd4XFzy4cEZU,3257
+dissect/target/plugins/general/network.py,sha256=I9wdFbBkDik1S9zvTi7sN20MdjJ2c_5tT8X8bgxWx5U,3257
 dissect/target/plugins/general/osinfo.py,sha256=oU-vmMiA-oaSEQWTSyn6-yQiH2sLQT6aTQHRd0677wo,1415
 dissect/target/plugins/general/plugins.py,sha256=9KJ70YvYwBfxt19C9yISv8YE4mOdHNvP16fTCTHC68U,6033
 dissect/target/plugins/general/scrape.py,sha256=Fz7BNXflvuxlnVulyyDhLpyU8D_hJdH6vWVtER9vjTg,6651
@@ -220,12 +220,12 @@ dissect/target/plugins/os/unix/bsd/openbsd/__init__.py,sha256=47DEQpj8HBSa-_TImW
 dissect/target/plugins/os/unix/bsd/openbsd/_os.py,sha256=9npz-osM-wHmjOACUqof5N5HJeps7J8KuyenUS5MZDs,923
 dissect/target/plugins/os/unix/bsd/osx/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/bsd/osx/_os.py,sha256=hNFB1rwahLwgZD1kc3T4xalFusT88EoxM2Mh-8jOW_w,3440
-dissect/target/plugins/os/unix/bsd/osx/network.py,sha256=0Qf1jsCDNPmc_L-AmrvHjXaN_x-AtT1Ow3tdQOvFRsk,3734
+dissect/target/plugins/os/unix/bsd/osx/network.py,sha256=3m71T-T-DnZFVidrokuHpr89lZOe_4drt-Xwam1ebfw,3767
 dissect/target/plugins/os/unix/bsd/osx/user.py,sha256=5rsGhsntBW9IXYIOrLpfYpSsJcBDL61QJkuZ456lXlE,2411
 dissect/target/plugins/os/unix/esxi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/esxi/_os.py,sha256=s6pAgUyfHh3QcY6sgvk5uVMmLvqK1tIHWR7MSbrFn8w,17789
 dissect/target/plugins/os/unix/etc/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/unix/etc/etc.py,sha256=QngR0nA1azvbNTau4U9-jKOjSoGdyduDpyEna_6yxWY,2636
+dissect/target/plugins/os/unix/etc/etc.py,sha256=YSCRZZfQvmzaR5VWhTJhB8pIGliL6Nw5ruhdfvYKYaM,2783
 dissect/target/plugins/os/unix/linux/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/linux/_os.py,sha256=k1aHhWqocSHMVbF54VDw9wqwa0QSToOa69TMKAyQcxw,2979
 dissect/target/plugins/os/unix/linux/cmdline.py,sha256=n_Uetoplx33XpIY27oPtMaw1E2AbAEeGLCSkxHshWgY,1673
@@ -233,6 +233,7 @@ dissect/target/plugins/os/unix/linux/environ.py,sha256=n7KttVzUtBHTIXQuS1DI5Azv6
 dissect/target/plugins/os/unix/linux/iptables.py,sha256=qTzY5PHHXA33WnPYb5NESgoSwI7ECZ8YPoEe_Fmln-8,6045
 dissect/target/plugins/os/unix/linux/modules.py,sha256=-LThb5mcKtngVfIICpdOGLtgJPc99WQ8Qufwddt8YgQ,2500
 dissect/target/plugins/os/unix/linux/netstat.py,sha256=EBpbK4BD3pZ0fKCR3ZMmVip4eQ0f6x_9yumA8vsUKPw,1691
+dissect/target/plugins/os/unix/linux/network.py,sha256=KfGfYhtrzpHHefaHjTpdbGSLu6IN4anweYt3V02D9zU,14392
 dissect/target/plugins/os/unix/linux/network_managers.py,sha256=nr0gA3hBqsvP9k6xAYmRYwGRB1kMtXB1k0pe78jWdFI,25768
 dissect/target/plugins/os/unix/linux/proc.py,sha256=jm35fAasnNbObN2tpflwQuCfVYLDkTP2EDrzYG42ZSk,23354
 dissect/target/plugins/os/unix/linux/processes.py,sha256=xAJswf06HZsY8JhQ11xfJw1OLTZ1q9XZbu7_a7k2UpY,2019
@@ -289,7 +290,7 @@ dissect/target/plugins/os/windows/generic.py,sha256=RJ1znzsIa4CFxmdMh91SjMY_pnjw
 dissect/target/plugins/os/windows/jumplist.py,sha256=3gZk6O1B3lKK2Jxe0B-HapOCEehk94CYNvCVDpQC9nQ,11773
 dissect/target/plugins/os/windows/lnk.py,sha256=KTqhw0JMW-KjAxe4xlRDNSRSx-th-_nPVgTGyBaKmW0,7891
 dissect/target/plugins/os/windows/locale.py,sha256=QiLWGgWrGBGHiXgep5iSOo6VNim4YC-xd4MdW0BUJPA,2486
-dissect/target/plugins/os/windows/network.py,sha256=ni-qK1PyA3UJD3lRJZGEBLAXcwDVKXPa3rIor9G5OSw,11283
+dissect/target/plugins/os/windows/network.py,sha256=lziv_oqmRaVKLW-Ep8CZqfd160eVmL1RswTlPgoVapg,11336
 dissect/target/plugins/os/windows/notifications.py,sha256=xxfMEY_noDxMVqvT3QS1a3j-X3qAYikOtT6v2owxuCY,17480
 dissect/target/plugins/os/windows/prefetch.py,sha256=wbbYoy05gWbJfRsM2ci4wPG7kM58OocVwXD3hkQlbRw,10647
 dissect/target/plugins/os/windows/recyclebin.py,sha256=zx58hDCvcrD_eJl9nJmr_i80krSN03ya8nQzWFr2Tw0,4917
@@ -380,10 +381,10 @@ dissect/target/volumes/luks.py,sha256=OmCMsw6rCUXG1_plnLVLTpsvE1n_6WtoRUGQbpmu1z
 dissect/target/volumes/lvm.py,sha256=wwQVR9I3G9YzmY6UxFsH2Y4MXGBcKL9aayWGCDTiWMU,2269
 dissect/target/volumes/md.py,sha256=7ShPtusuLGaIv27SvEETtgsuoQyAa4iAAeOR1NEaajI,1689
 dissect/target/volumes/vmfs.py,sha256=-LoUbn9WNwTtLi_4K34uV_-wDw2W5hgaqxZNj4UmqAQ,1730
-dissect.target-3.21.dev1.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
-dissect.target-3.21.dev1.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-dissect.target-3.21.dev1.dist-info/METADATA,sha256=U1ZlYrqE3MK3Bz0cfFnkwamJFHYozo9JiH2cXiAlt2c,13302
-dissect.target-3.21.dev1.dist-info/WHEEL,sha256=R06PA3UVYHThwHvxuRWMqaGcr-PuniXahwjmQRFMEkY,91
-dissect.target-3.21.dev1.dist-info/entry_points.txt,sha256=BWuxAb_6AvUAQpIQOQU0IMTlaF6TDht2AIZK8bHd-zE,492
-dissect.target-3.21.dev1.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect.target-3.21.dev1.dist-info/RECORD,,
+dissect.target-3.21.dev3.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
+dissect.target-3.21.dev3.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+dissect.target-3.21.dev3.dist-info/METADATA,sha256=krLCWFNjd5yyUqcYsAEFm-PSOsLJLMLhTOyG54hXbvg,13186
+dissect.target-3.21.dev3.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
+dissect.target-3.21.dev3.dist-info/entry_points.txt,sha256=BWuxAb_6AvUAQpIQOQU0IMTlaF6TDht2AIZK8bHd-zE,492
+dissect.target-3.21.dev3.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect.target-3.21.dev3.dist-info/RECORD,,

{dissect.target-3.21.dev1.dist-info → dissect.target-3.21.dev3.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (75.5.0)
+Generator: setuptools (75.6.0)
 Root-Is-Purelib: true
 Tag: py3-none-any