dissect.target 3.22.dev54__tar.gz → 3.22.dev57__tar.gz

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev54
+Version: 3.22.dev57
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/dissect/target/plugins/apps/container/docker.py

@@ -336,6 +336,14 @@ def find_installs(target: Target) -> Iterator[Path]:
         - https://docs.docker.com/config/daemon/
     """
 
+    default_data_paths = [
+        # Linux
+        "/var/lib/docker",
+        "/var/snap/docker/common/var-lib-docker",
+        # Windows
+        "sysvol/ProgramData/docker",
+    ]
+
     default_config_paths = [
         # Linux
         "/etc/docker/daemon.json",
@@ -349,21 +357,26 @@ def find_installs(target: Target) -> Iterator[Path]:
         ".docker/daemon.json",
     ]
 
-    if (default_root := target.fs.path("/var/lib/docker")).exists():
-        yield default_root
+    for path in default_data_paths:
+        if (path := target.fs.path(path)).exists():
+            yield path
 
     for path in default_config_paths:
-        if (config_file := target.fs.path(path)).exists() and (
-            data_root_path := target.fs.path(get_data_path(config_file))
-        ).exists():
-            yield data_root_path
+        if (config_file := target.fs.path(path)).exists():
+            if not (data_path := get_data_path(config_file)):
+                target.log.info("Unable to get data-root from docker daemon file %s", config_file)
+                continue
+            if (data_root_path := target.fs.path(data_path)).exists():
+                yield data_root_path
 
     for path in user_config_paths:
         for user_details in target.user_details.all_with_home():
-            if (config_file := user_details.home_path.joinpath(path)).exists() and (
-                data_root_path := target.fs.path(get_data_path(config_file))
-            ).exists():
-                yield data_root_path
+            if (config_file := user_details.home_path.joinpath(path)).exists():
+                if not (data_path := get_data_path(config_file)):
+                    target.log.info("Unable to get data-root from docker daemon file %s", config_file)
+                    continue
+                if (data_root_path := target.fs.path(data_path)).exists():
+                    yield data_root_path
 
 
 def convert_timestamp(timestamp: str | None) -> str | None:

dissect_target-3.22.dev57/dissect/target/plugins/child/colima.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import ChildTargetRecord
+from dissect.target.plugin import ChildTargetPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from dissect.target import Target
+
+
+def find_containers(paths: list[Path]) -> Iterator[Path]:
+    for path in paths:
+        for config_path in path.iterdir():
+            if (config_file := config_path.joinpath("colima.yaml")).exists():
+                name = f"-{config_file.parts[-2]}" if config_file.parts[-2] != "default" else ""
+                if (disk_path := path.joinpath("_lima", f"colima{name}", "diffdisk")).exists():
+                    yield disk_path
+
+
+class ColimaChildTargetPlugin(ChildTargetPlugin):
+    """Child target plugin that yields Colima containers.
+
+    Colima is a container runtime for macOS and Linux.
+
+    Resources:
+        - https://github.com/abiosoft/colima/blob/5d2e91c4a491d4ae35d69fb2583f4f959401bc37
+    """
+
+    __type__ = "colima"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.paths = [
+            path
+            for user in self.target.user_details.all_with_home()
+            if (path := user.home_path.joinpath(".colima")).exists()
+        ]
+
+    def check_compatible(self) -> None:
+        if not self.paths:
+            raise UnsupportedPluginError("No Colima configurations found")
+
+    def list_children(self) -> Iterator[ChildTargetRecord]:
+        for container in find_containers(self.paths):
+            yield ChildTargetRecord(
+                type=self.__type__,
+                path=container,
+                _target=self.target,
+            )

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev54
+Version: 3.22.dev57
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/dissect.target.egg-info/SOURCES.txt

@@ -204,6 +204,7 @@ dissect/target/plugins/apps/webserver/iis.py
 dissect/target/plugins/apps/webserver/nginx.py
 dissect/target/plugins/apps/webserver/webserver.py
 dissect/target/plugins/child/__init__.py
+dissect/target/plugins/child/colima.py
 dissect/target/plugins/child/docker.py
 dissect/target/plugins/child/esxi.py
 dissect/target/plugins/child/hyperv.py
@@ -580,6 +581,7 @@ tests/plugins/apps/webserver/test_iis.py
 tests/plugins/apps/webserver/test_nginx.py
 tests/plugins/apps/webserver/test_webserver.py
 tests/plugins/child/__init__.py
+tests/plugins/child/test_colima.py
 tests/plugins/child/test_docker.py
 tests/plugins/child/test_hyperv.py
 tests/plugins/child/test_parallels.py

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/tests/conftest.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import importlib.util
 import pathlib
 import tempfile
 import textwrap
@@ -36,6 +37,16 @@ if TYPE_CHECKING:
     from dissect.target.plugin import OSPlugin
 
 
+HAS_BENCHMARK = importlib.util.find_spec("pytest_benchmark") is not None
+
+
+def pytest_configure(config: pytest.Config) -> None:
+    if not HAS_BENCHMARK:
+        # If we don't have pytest-benchmark (or pytest-codspeed) installed, register the benchmark marker ourselves
+        # to avoid pytest warnings
+        config.addinivalue_line("markers", "benchmark: mark test for benchmarking (requires pytest-benchmark)")
+
+
 def pytest_sessionstart(session: pytest.Session) -> None:
     # Test if the _data/ directory is present and if not, as is the case in Python
     # source distributions of dissect.target, we give an error
@@ -67,6 +78,11 @@ def pytest_sessionstart(session: pytest.Session) -> None:
             break
 
 
+def pytest_runtest_setup(item: pytest.Item) -> None:
+    if not HAS_BENCHMARK and item.get_closest_marker("benchmark") is not None:
+        pytest.skip("pytest-benchmark is not installed")
+
+
 @pytest.fixture(autouse=True)
 def clear_caches() -> None:
     _generate_long_paths.cache_clear()

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/tests/helpers/test_scrape.py

@@ -13,6 +13,8 @@ from dissect.target.helpers import scrape
 if TYPE_CHECKING:
     from collections.abc import Iterator
 
+    from pytest_benchmark.fixture import BenchmarkFixture
+
 
 def test_one_needle() -> None:
     needle = b"ABCD"
@@ -246,7 +248,7 @@ def test_find_needle() -> None:
     mock_progress.assert_called_once_with(0)
 
     buf = io.BytesIO(b"A" * 100 + b"needle" + b"B" * 100 + b"needle" + b"C" * 100 + b"needle" + b"D" * 100)
-    for i, (_needle, offset) in enumerate(scrape.find_needles(buf, [b"needle"], lock_seek=False, block_size=100)):
+    for i, (_, offset) in enumerate(scrape.find_needles(buf, [b"needle"], lock_seek=False, block_size=100)):
         if i == 0:
             assert offset == 100
             buf.seek(300)
@@ -271,3 +273,10 @@ def test_find_needle() -> None:
 )
 def test_recover_string(buf: bytes, encoding: str, reverse: bool, ascii: bool, expected: str) -> None:
     assert scrape.recover_string(buf, encoding, reverse=reverse, ascii=ascii) == expected
+
+
+@pytest.mark.benchmark
+def test_benchmark_find_needles(benchmark: BenchmarkFixture) -> None:
+    buf = b"A" * 100 + b"needle" + b"B" * 100
+    needles = [b"needle"]
+    benchmark(lambda: list(scrape.find_needles(io.BytesIO(buf), needles)))

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/tests/plugins/apps/container/test_docker.py

@@ -44,6 +44,15 @@ def test_docker_plugin_data_roots(target_unix_users: Target, fs_unix: VirtualFil
     ]
 
 
+def test_docker_plugin_data_roots_empty(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+    fs_unix.makedirs("/var/lib/docker")
+    fs_unix.map_file_fh("/etc/docker/daemon.json", BytesIO(b"{}"))
+
+    assert [str(p) for p in find_installs(target_unix_users)] == [
+        "/var/lib/docker",
+    ]
+
+
 def test_docker_plugin_images(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
     fs_unix.map_file(
         "/var/lib/docker/image/overlay2/repositories.json",

dissect_target-3.22.dev57/tests/plugins/child/test_colima.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from io import BytesIO
+from typing import TYPE_CHECKING
+
+from dissect.target.plugins.child.colima import ColimaChildTargetPlugin
+
+if TYPE_CHECKING:
+    from dissect.target.filesystem import VirtualFilesystem
+    from dissect.target.target import Target
+
+
+def test_child_colima(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+    fs_unix.map_file_fh("/root/.colima/default/colima.yaml", BytesIO())
+    fs_unix.map_file_fh("/root/.colima/_lima/colima/diffdisk", BytesIO())
+    fs_unix.map_file_fh("/root/.colima/test/colima.yaml", BytesIO())
+    fs_unix.map_file_fh("/root/.colima/_lima/colima-test/diffdisk", BytesIO())
+    fs_unix.map_file_fh("/home/user/.colima/default/colima.yaml", BytesIO())
+    fs_unix.map_file_fh("/home/user/.colima/_lima/colima/diffdisk", BytesIO())
+
+    target_unix_users.add_plugin(ColimaChildTargetPlugin)
+
+    children = list(target_unix_users.list_children())
+
+    assert len(children) == 3
+    assert children[0].type == "colima"
+    assert children[0].path == "/root/.colima/_lima/colima/diffdisk"
+    assert children[1].path == "/root/.colima/_lima/colima-test/diffdisk"
+    assert children[2].path == "/home/user/.colima/_lima/colima/diffdisk"

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/tests/plugins/filesystem/test_walkfs.py

@@ -1,11 +1,18 @@
 from __future__ import annotations
 
+from pathlib import Path
 from typing import TYPE_CHECKING
 
+import pytest
+
 from dissect.target.filesystem import VirtualFile, VirtualFilesystem
+from dissect.target.loaders.tar import TarLoader
 from dissect.target.plugins.filesystem.walkfs import WalkFSPlugin
+from tests._utils import absolute_path
 
 if TYPE_CHECKING:
+    from pytest_benchmark.fixture import BenchmarkFixture
+
     from dissect.target.target import Target
 
 
@@ -37,3 +44,16 @@ def test_walkfs_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
         "/root_file",
         "/var",
     ]
+
+
+@pytest.mark.benchmark
+def test_benchmark_walkfs(target_bare: Target, benchmark: BenchmarkFixture) -> None:
+    """Benchmark walkfs performance on a small tar archive with ~500 files."""
+
+    loader = TarLoader(Path(absolute_path("_data/loaders/containerimage/alpine.tar")))
+    loader.map(target_bare)
+    target_bare.apply()
+
+    result = benchmark(lambda: next(WalkFSPlugin(target_bare).walkfs()))
+
+    assert result.path == "/"

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/tests/plugins/os/unix/log/test_journal.py

@@ -1,15 +1,17 @@
 from __future__ import annotations
 
 import logging
+from datetime import datetime, timezone
 from typing import TYPE_CHECKING
 
+import pytest
 from flow.record.fieldtypes import datetime as dt
 
 from dissect.target.plugins.os.unix.log.journal import JournalPlugin
 from tests._utils import absolute_path
 
 if TYPE_CHECKING:
-    import pytest
+    from pytest_benchmark.fixture import BenchmarkFixture
 
     from dissect.target.filesystem import VirtualFilesystem
     from dissect.target.target import Target
@@ -39,18 +41,20 @@ def test_journal_plugin(target_unix: Target, fs_unix: VirtualFilesystem) -> None
     assert record.source == "/var/log/journal/1337/user-1000.journal"
 
 
-def test_journal_plugin_benchmark(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+@pytest.mark.benchmark
+def test_benchmark_journal(target_unix: Target, fs_unix: VirtualFilesystem, benchmark: BenchmarkFixture) -> None:
     """Test if we can parse some large journal files. this demonstrates how slow the journal plugin is."""
 
     system_journal = absolute_path("_data/plugins/os/unix/log/journal/system.journal")
     user_journal = absolute_path("_data/plugins/os/unix/log/journal/user-1000.journal")
 
-    fs_unix.map_file("/var/log/journal/deadbeef/system.journal", system_journal)
-    fs_unix.map_file("/var/log/journal/deadbeef/user-1000.journal", user_journal)
-    target_unix.add_plugin(JournalPlugin)
+    fs_unix.map_file("/var/log/journal/deadbeef/system.journal", system_journal)  # contains 252 entries
+    fs_unix.map_file("/var/log/journal/deadbeef/user-1000.journal", user_journal)  # contains 17986 entries
 
-    results = list(target_unix.journal())
-    assert len(results) == 252 + 17986
+    result = benchmark(lambda: next(JournalPlugin(target_unix).journal()))
+
+    assert result.ts == datetime(2025, 1, 15, 14, 25, 1, 607354, tzinfo=timezone.utc)
+    assert result.message == "pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)"
 
 
 def test_journal_plugin_unused_object(

{dissect_target-3.22.dev54 → dissect_target-3.22.dev57}/tox.ini

@@ -19,12 +19,21 @@ deps =
     pytest-xdist
     pytest-randomly
     coverage
-    docutils
 commands =
     pytest --basetemp="{envtmpdir}" {posargs:--color=yes --cov=dissect --cov-report=term-missing -n auto -v tests}
     coverage report
     coverage xml
 
+[testenv:benchmark]
+deps =
+    pytest
+    pytest-benchmark
+    pytest-codspeed
+passenv =
+    CODSPEED_ENV
+commands =
+    pytest --basetemp="{envtmpdir}" -m benchmark {posargs:--color=yes -v tests}
+
 [testenv:build]
 package = skip
 deps =