dissect.target 3.22.dev2__tar.gz → 3.22.dev4__tar.gz

{dissect_target-3.22.dev2/dissect.target.egg-info → dissect_target-3.22.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev2
+Version: 3.22.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -45,7 +45,7 @@ Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"
 Requires-Dist: dissect.ffs<4,>=3; extra == "full"
 Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
-Requires-Dist: dissect.jffs<2,>=1; extra == "full"
+Requires-Dist: dissect.jffs<2,>=1.5.dev; extra == "full"
 Requires-Dist: dissect.ole<4,>=3; extra == "full"
 Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
 Requires-Dist: dissect.squashfs<2,>=1; extra == "full"
@@ -75,7 +75,7 @@ Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
 Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"
 Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.3.dev; extra == "dev"
 Requires-Dist: dissect.shellitem[dev]<4.0.dev,>=3.0.dev; extra == "dev"

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/dissect/target/filesystems/jffs.py

@@ -109,7 +109,7 @@ class JFFSFilesystemEntry(FilesystemEntry):
                 self.entry.mode,
                 self.entry.inum,
                 id(self.fs),
-                1,  # TODO: properly calculate nlink in dissect.jffs
+                self.entry.nlink,
                 node.uid,
                 node.gid,
                 node.isize,

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/dissect/target/plugins/apps/webserver/apache.py

@@ -13,6 +13,7 @@ from dissect.target.plugin import OperatingSystem, export
 from dissect.target.plugins.apps.webserver.webserver import (
     WebserverAccessLogRecord,
     WebserverErrorLogRecord,
+    WebserverHostRecord,
     WebserverPlugin,
 )
 from dissect.target.target import Target
@@ -32,7 +33,7 @@ RE_CONFIG_ROOT = re.compile(
         "?(?P<location>[^"\s]+)"
         $
     """,
-    re.VERBOSE,
+    re.VERBOSE | re.IGNORECASE,
 )
 
 # e.g. Include conf.modules.d/*.conf and IncludeOptional conf.d/*.conf
@@ -44,7 +45,7 @@ RE_CONFIG_INCLUDE = re.compile(
         ?(?P<location>[^"\s]+)
         $
     """,
-    re.VERBOSE,
+    re.VERBOSE | re.IGNORECASE,
 )
 
 
@@ -59,7 +60,7 @@ RE_CONFIG_CUSTOM_LOG_DIRECTIVE = re.compile(
         (?P<logformat>[^$]+)            # Format to use (can be either a format string or a nickname).
         $
     """,
-    re.VERBOSE,
+    re.VERBOSE | re.IGNORECASE,
 )
 
 # e.g ErrorLog "/var/log/httpd/error_log"
@@ -71,7 +72,7 @@ RE_CONFIG_ERRORLOG_DIRECTIVE = re.compile(
         "?(?P<location>[^"\s]+)"?       # Location to log to, optionally wrapped in double quotes.
         $
     """,
-    re.VERBOSE,
+    re.VERBOSE | re.IGNORECASE,
 )
 
 RE_REMOTE_PATTERN = r"""
@@ -142,6 +143,8 @@ RE_ERROR_COMMON_PATTERN = r"""
 
 RE_ENV_VAR_IN_STRING = re.compile(r"\$\{(?P<env_var>[^\"\s$]+)\}", re.VERBOSE)
 
+RE_VIRTUALHOST = re.compile(r"^\<VirtualHost (?P<addr>[^\s:]+)(?:\:(?P<port>\d+))?", re.IGNORECASE)
+
 LOG_FORMAT_ACCESS_COMMON = LogFormat(
     "common",
     re.compile(
@@ -214,28 +217,31 @@ class ApachePlugin(WebserverPlugin):
     DEFAULT_CONFIG_PATHS = [
         "/etc/apache2/apache2.conf",
         "/usr/local/etc/apache22/httpd.conf",
+        "/usr/local/apache2/httpd.conf",
         "/etc/httpd/conf/httpd.conf",
         "/etc/httpd.conf",
     ]
     DEFAULT_ENVVAR_PATHS = ["/etc/apache2/envvars", "/etc/sysconfig/httpd", "/etc/rc.conf"]
+    DEFAULT_SERVER_ROOTS = ["/etc/apache2", "/usr/local/apache2", "/etc/httpd", "/home/httpd", "/home/apache2"]
 
     def __init__(self, target: Target):
         super().__init__(target)
         self.server_root = None
         self.access_paths = set()
         self.error_paths = set()
+        self.virtual_hosts = set()
         self.find_logs()
 
     def check_compatible(self) -> None:
-        if not self.access_paths and not self.error_paths:
-            raise UnsupportedPluginError("No Apache log files found")
+        if not self.access_paths and not self.error_paths and not self.virtual_hosts:
+            raise UnsupportedPluginError("No Apache log files or virtual hosts found")
 
         if self.target.os == OperatingSystem.CITRIX:
             raise UnsupportedPluginError("Use the 'apps.webserver.citrix' apache plugin instead")
 
     def find_logs(self) -> None:
         """Discover any present Apache log paths on the target system.
-        Populates ``self.access_paths`` and ``self.error_paths``.
+        Populates ``self.access_paths``, ``self.error_paths`` and ``self.virtual_hosts``.
 
         References:
             - https://httpd.apache.org/docs/2.4/logs.html
@@ -267,6 +273,11 @@ class ApachePlugin(WebserverPlugin):
     def _process_conf_file(self, path: Path, seen: set[Path] | None = None) -> None:
         """Process an Apache ``.conf`` file for ``ServerRoot``, ``CustomLog``, ``Include``
         and ``OptionalInclude`` directives. Populates ``self.access_paths`` and ``self.error_paths``.
+
+        Apache / Httpd directives are case-insensitive which is why we convert lines to lowercase for pattern matching.
+
+        Resources:
+            - https://httpd.apache.org/docs/2.4/en/configuring.html#syntax
         """
         seen = set() if seen is None else seen
 
@@ -280,17 +291,19 @@ class ApachePlugin(WebserverPlugin):
             if not (line := line.strip()):
                 continue
 
-            if "ServerRoot" in line:
+            line_lower = line.lower()
+
+            if "serverroot" in line_lower:
                 if not (match := RE_CONFIG_ROOT.match(line)):
                     self.target.log.warning("Unable to parse Apache 'ServerRoot' configuration in %s: %r", path, line)
                     continue
                 location = match.groupdict().get("location")
                 self.server_root = self.target.fs.path(location)
 
-            elif "CustomLog" in line or "ErrorLog" in line:
+            elif "customlog" in line_lower or "errorlog" in line_lower:
                 self._process_conf_line(path, line)
 
-            elif "Include" in line:
+            elif "include" in line_lower:
                 if not (match := RE_CONFIG_INCLUDE.match(line)):
                     self.target.log.warning("Unable to parse Apache 'Include' configuration in %s: %r", path, line)
                     continue
@@ -319,9 +332,13 @@ class ApachePlugin(WebserverPlugin):
                 else:
                     self.target.log.warning("Unable to resolve Apache Include in %s: %r", path, line)
 
+            # While we're at it, see if we can find any VirtualHosts
+            elif "<virtualhost" in line_lower:
+                self.virtual_hosts.add(path)
+
     def _process_conf_line(self, path: Path, line: str) -> None:
         """Parse and resolve the given ``CustomLog`` or ``ErrorLog`` directive found in a Apache ``.conf`` file."""
-        if "ErrorLog" in line:
+        if "errorlog" in line.lower():
             pattern = RE_CONFIG_ERRORLOG_DIRECTIVE
             set_to_update = self.error_paths
         else:
@@ -443,6 +460,42 @@ class ApachePlugin(WebserverPlugin):
                 self.target.log.warning("An error occured parsing Apache log file %s: %s", path, str(e))
                 self.target.log.debug("", exc_info=e)
 
+    def hosts(self) -> Iterator[WebserverHostRecord]:
+        """Return found ``VirtualHost`` directives in the Apache configuration.
+
+        Resources:
+            - https://httpd.apache.org/docs/2.4/mod/core.html#virtualhost
+        """
+
+        for path in self.virtual_hosts:
+            # A configuration file can contain multiple VirtualHost directives.
+            current_vhost = {}
+            for line in path.open("rt"):
+                line_lower = line.lower()
+                if "<virtualhost" in line_lower:
+                    # Currently only supports a single addr:port combination.
+                    if match := RE_VIRTUALHOST.match(line.lstrip()):
+                        current_vhost = match.groupdict()
+                    else:
+                        self.target.log.warning("Unable to parse VirtualHost directive %r in %s", line, path)
+                        current_vhost = {}
+
+                elif "</virtualhost" in line_lower:
+                    yield WebserverHostRecord(
+                        ts=path.lstat().st_mtime,
+                        server_name=current_vhost.get("servername") or current_vhost.get("addr"),
+                        server_port=current_vhost.get("port"),
+                        root_path=current_vhost.get("documentroot"),
+                        access_log_config=current_vhost.get("customlog", "").rpartition(" ")[0],
+                        error_log_config=current_vhost.get("errorlog"),
+                        source=path,
+                        _target=self.target,
+                    )
+
+                else:
+                    key, _, value = line.strip().partition(" ")
+                    current_vhost[key.lower()] = value
+
     def _iterate_log_lines(self, paths: list[Path]) -> Iterator[tuple[str, Path]]:
         """Iterate through a list of paths and yield tuples of loglines and the path of the file where they're from."""
         for path in paths:

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/dissect/target/plugins/apps/webserver/webserver.py

@@ -38,6 +38,19 @@ WebserverErrorLogRecord = TargetRecordDescriptor(
     ],
 )
 
+WebserverHostRecord = TargetRecordDescriptor(
+    "application/log/webserver/host",
+    [
+        ("datetime", "ts"),
+        ("string", "server_name"),
+        ("varint", "server_port"),
+        ("path", "root_path"),
+        ("path", "access_log_config"),
+        ("path", "error_log_config"),
+        ("path", "source"),
+    ],
+)
+
 
 class WebserverPlugin(NamespacePlugin):
     __namespace__ = "webserver"

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev2
+Version: 3.22.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -45,7 +45,7 @@ Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"
 Requires-Dist: dissect.ffs<4,>=3; extra == "full"
 Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
-Requires-Dist: dissect.jffs<2,>=1; extra == "full"
+Requires-Dist: dissect.jffs<2,>=1.5.dev; extra == "full"
 Requires-Dist: dissect.ole<4,>=3; extra == "full"
 Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
 Requires-Dist: dissect.squashfs<2,>=1; extra == "full"
@@ -75,7 +75,7 @@ Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
 Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"
 Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.3.dev; extra == "dev"
 Requires-Dist: dissect.shellitem[dev]<4.0.dev,>=3.0.dev; extra == "dev"

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/dissect.target.egg-info/requires.txt

@@ -29,7 +29,7 @@ dissect.extfs[dev]<4.0.dev,>=3.0.dev
 dissect.fat[dev]<4.0.dev,>=3.0.dev
 dissect.ffs[dev]<4.0.dev,>=3.0.dev
 dissect.hypervisor[dev]<4.0.dev,>=3.0.dev
-dissect.jffs[dev]<2.0.dev,>=1.0.dev
+dissect.jffs[dev]<2.0.dev,>=1.5.dev
 dissect.ntfs[dev]<4.0.dev,>=3.4.dev
 dissect.regf[dev]<4.0.dev,>=3.3.dev
 dissect.shellitem[dev]<4.0.dev,>=3.0.dev
@@ -56,7 +56,7 @@ dissect.etl<4,>=3
 dissect.extfs<4,>=3
 dissect.fat<4,>=3
 dissect.ffs<4,>=3
-dissect.jffs<2,>=1
+dissect.jffs<2,>=1.5.dev
 dissect.ole<4,>=3
 dissect.shellitem<4,>=3
 dissect.squashfs<2,>=1

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/pyproject.toml

@@ -57,7 +57,7 @@ full = [
     "dissect.fat>=3,<4",
     "dissect.ffs>=3,<4",
     "dissect.fve>=4,<5; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",
-    "dissect.jffs>=1,<2",
+    "dissect.jffs>=1.5.dev,<2",     # TODO: update on release 
     "dissect.ole>=3,<4",
     "dissect.shellitem>=3,<4",
     "dissect.squashfs>=1,<2",
@@ -95,7 +95,7 @@ dev = [
     "dissect.ffs[dev]>=3.0.dev,<4.0.dev",
     "dissect.fve[dev]>=4.0.dev,<5.0.dev; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",
     "dissect.hypervisor[dev]>=3.0.dev,<4.0.dev",
-    "dissect.jffs[dev]>=1.0.dev,<2.0.dev",
+    "dissect.jffs[dev]>=1.5.dev,<2.0.dev",
     "dissect.ntfs[dev]>=3.4.dev,<4.0.dev",
     "dissect.regf[dev]>=3.3.dev,<4.0.dev",
     "dissect.shellitem[dev]>=3.0.dev,<4.0.dev",

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/tests/filesystems/test_jffs2.py

@@ -20,6 +20,7 @@ def jffs_fs_file_entry(jffs_fs: JFFSFilesystem) -> Iterator[JFFSFilesystemEntry]
     inode = Mock(
         mode=0o100664,
         inum=4,
+        nlink=1,
         inode=raw_inode,
         atime=datetime(2024, 10, 1, 12, 0, 0),
         mtime=datetime(2024, 10, 2, 12, 0, 0),
@@ -39,6 +40,7 @@ def jffs_fs_directory_entry(jffs_fs: JFFSFilesystem) -> Iterator[JFFSFilesystemE
     inode = Mock(
         mode=0o40775,
         inum=2,
+        nlink=2,
         inode=raw_inode,
         atime=datetime(2024, 10, 1, 12, 0, 0),
         mtime=datetime(2024, 10, 2, 12, 0, 0),
@@ -63,7 +65,7 @@ def test_jffs2_stat(entry_fixture: str, expected_blocks: int, request: pytest.Fi
     assert stat.st_mode == entry.mode
     assert stat.st_ino == entry.inum
     assert stat.st_dev == id(jffs_entry.fs)
-    assert stat.st_nlink == 1
+    assert stat.st_nlink == entry.nlink
     assert stat.st_uid == entry.inode.uid
     assert stat.st_gid == entry.inode.gid
     assert stat.st_size == entry.inode.isize

{dissect_target-3.22.dev2 → dissect_target-3.22.dev4}/tests/plugins/apps/webserver/test_apache.py

@@ -274,8 +274,8 @@ def test_config_vhosts_apache2(target_unix: Target, fs_unix: VirtualFilesystem)
     <VirtualHost *:80>
         ServerName example.com
         DocumentRoot /var/www/html
-        ErrorLog /path/to/virtualhost/log/error.log
-        CustomLog /path/to/virtualhost/log/access.log custom
+        errorlog /path/to/virtualhost/log/error.log
+        customlog /path/to/virtualhost/log/access.log custom
     </VirtualHost>
     """
     fs_unix.map_file_fh("/etc/apache2/sites-enabled/example.conf", BytesIO(textwrap.dedent(site_conf).encode()))
@@ -359,3 +359,41 @@ def test_all_error_log_formats(target_unix: Target, fs_unix: VirtualFilesystem)
     assert log_with_source.pid == 7
     assert log_with_source.message == "authorization result of <RequireAny>: granted"
     assert log_with_source.error_source == "mod_authz_core.c(820)"
+
+
+def test_apache_virtual_hosts(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if we can find and parse virtual host configurations correctly."""
+
+    fs_unix.map_file_fh("/etc/apache2/apache2.conf", BytesIO(b'ServerRoot "/etc/apache2"\n'))
+
+    site = r"""
+    <VirtualHost *:443>
+        ServerName example.com
+        DocumentRoot /var/www/html
+        ErrorLog ${APACHE_LOG_DIR}/error.log
+        CustomLog ${APACHE_LOG_DIR}/access.log combined
+    </VirtualHost>
+    <Virtualhost 127.0.0.1:80>
+        documentroot /path/to/other/html
+    </Virtualhost>
+    """
+    fs_unix.map_file_fh("/etc/apache2/sites-available/example.conf", BytesIO(textwrap.dedent(site).encode()))
+
+    target_unix.add_plugin(ApachePlugin)
+
+    records = list(target_unix.apache.hosts())
+    assert len(records) == 2
+
+    assert records[0].ts
+    assert records[0].server_name == "example.com"
+    assert records[0].server_port == 443
+    assert records[0].root_path == "/var/www/html"
+    assert records[0].access_log_config == r"${APACHE_LOG_DIR}/access.log"
+    assert records[0].error_log_config == r"${APACHE_LOG_DIR}/error.log"
+    assert records[0].source == "/etc/apache2/sites-available/example.conf"
+
+    assert records[1].ts
+    assert records[1].server_name == "127.0.0.1"
+    assert records[1].server_port == 80
+    assert records[1].root_path == "/path/to/other/html"
+    assert records[1].source == "/etc/apache2/sites-available/example.conf"