dissect.target 3.23.dev69__tar.gz → 3.23.dev71__tar.gz

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev69
+Version: 3.23.dev71
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/dissect/target/helpers/configutil.py

@@ -828,6 +828,77 @@ class SystemD(Indentation):
         return [], None
 
 
+class Leases(Default):
+    """A :class:`ConfigurationParser` that specifically parses dhclient ``.leases`` files.
+
+    Examples:
+
+        .. code-block::
+
+            >>> Leases = textwrap.dedent(
+                    '''
+                    lease {
+                        interface "eth0"; # A comment that gets ignored
+                        fixed-address 1.2.3.4;
+                        option dhcp-lease-time 13337;
+                        option routers 0.0.0.0;
+                        option host-name "hostname";
+                        renew 1 2023/12/31 13:37:00;
+                        rebind 2 2023/01/01 01:00:00;
+                        expire 3 2024/01/01 13:37:00;
+                        # Another comment that gets ignored
+                    }
+                    '''
+                )
+            >>> parser = Leases(io.StringIO(lease))
+            >>> parser.parsed_data
+            {
+                "lease-0": {
+                    "interface": "eth0",
+                    "fixed-address": "1.2.3.4"
+                    "option": {
+                        "dhcp-lease-time": "13337",
+                        "routers": "0.0.0.0",
+                        "host-name": "hostname"
+                    },
+                    "renew": "1 2023/12/31 13:37:00",
+                    "rebind": "2 2023/01/01 01:00:00",
+                    "expire": "3 2024/01/01 13:37:00",
+            }
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs, separator=(r"\s",))
+
+    def _parse_line(self, line: str) -> tuple[str, str]:
+        key, *value = self.SEPARATOR.split(line.strip(), 1)
+        value = value[0].strip() if value else ""
+        return key, value
+
+    def parse_file(self, fh: TextIO) -> None:
+        root = None
+
+        for line in self.line_reader(fh):
+            key, value = self._parse_line(line)
+
+            if key.startswith("}"):
+                continue
+
+            if key.startswith("lease"):
+                idx = len([key for key in self.parsed_data if "lease" in key])
+                root = f"{key}-{idx}"
+                self.parsed_data[root] = {}
+                continue
+
+            if root:
+                if key == "option":
+                    value = dict([value.split(maxsplit=1)])
+
+                _update_dictionary(self.parsed_data[root], key, value)
+            else:
+                _update_dictionary(self.parsed_data, key, value)
+
+
 @dataclass(frozen=True)
 class ParserOptions:
     collapse: bool | set | None = None
@@ -884,6 +955,7 @@ CONFIG_MAP: dict[tuple[str, ...], ParserConfig] = {
     "systemd": ParserConfig(SystemD),
     "template": ParserConfig(Txt),
     "toml": ParserConfig(Toml),
+    "leases": ParserConfig(Leases),
 }
 
 

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/dissect/target/plugins/os/default/network.py

@@ -16,6 +16,7 @@ if TYPE_CHECKING:
     from collections.abc import Iterator
 
     from dissect.target.target import Target
+
 InterfaceRecord = Union[UnixInterfaceRecord, WindowsInterfaceRecord, MacOSInterfaceRecord]
 
 

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/dissect/target/plugins/os/unix/linux/network.py

@@ -3,18 +3,19 @@ from __future__ import annotations
 import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
-from ipaddress import ip_address, ip_interface
+from ipaddress import IPv4Interface, IPv6Interface, ip_address, ip_interface
 from itertools import chain
 from typing import TYPE_CHECKING, Any, Literal, NamedTuple
 
 from dissect.target.helpers import configutil
 from dissect.target.helpers.record import UnixInterfaceRecord
 from dissect.target.helpers.utils import to_list
+from dissect.target.plugin import export
 from dissect.target.plugins.os.default.network import NetworkPlugin
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
-    from ipaddress import IPv4Address, IPv4Interface, IPv6Address, IPv6Interface
+    from ipaddress import IPv4Address, IPv6Address
 
     from dissect.target.target import Target, TargetPath
 
@@ -27,10 +28,17 @@ class LinuxNetworkPlugin(NetworkPlugin):
 
     def _interfaces(self) -> Iterator[UnixInterfaceRecord]:
         """Try all available network configuration managers and aggregate the results."""
-        for manager_cls in MANAGERS:
+        for manager_cls in MANAGERS + LEASERS:
             manager: LinuxNetworkConfigParser = manager_cls(self.target)
             yield from manager.interfaces()
 
+    @export(record=UnixInterfaceRecord)
+    def dhcp(self) -> Iterator[UnixInterfaceRecord]:
+        """Return interfaces obtained via DHCP."""
+        for interface in self.interfaces():
+            if interface.type == "dhcp":
+                yield interface
+
 
 VlanIdByInterface = dict[str, set[int]]
 
@@ -337,6 +345,77 @@ class SystemdNetworkConfigParser(LinuxNetworkConfigParser):
         return ip_address(value)
 
 
+class DhclientLeaseParser(LinuxNetworkConfigParser):
+    """Parse network interfaces from dhclient DHCP ``.leases`` files.
+
+    Resources:
+        - https://linux.die.net/man/5/dhclient.conf
+    """
+
+    def interfaces(self) -> Iterator[UnixInterfaceRecord]:
+        """Parse network interfaces from dhclient DHCP ``.leases`` files."""
+
+        # TODO: Add support for renew, rebind, expire events.
+        for file in self._config_files(["/var/lib/dhclient/", "/var/lib/dhcp/"], "*.leases"):
+            try:
+                leases = configutil.parse(file, hint="leases")
+                for label, data in leases.parsed_data.items():
+                    if "lease" in label:
+                        if (fixed_address := data.get("fixed-address")) is not None:
+                            if (subnet_mask := data.get("option", {}).get("subnet-mask")) is not None:
+                                fixed_address = ip_interface((fixed_address, subnet_mask))
+                            else:
+                                fixed_address = ip_interface(fixed_address)
+
+                        if (router := data.get("option", {}).get("routers")) is not None:
+                            router = ip_address(router)
+
+                        yield UnixInterfaceRecord(
+                            name=data.get("interface").strip('"'),
+                            type="dhcp",
+                            cidr={fixed_address},
+                            gateway={router},
+                            source=file,
+                            dhcp_ipv4=isinstance(fixed_address, IPv4Interface),
+                            dhcp_ipv6=isinstance(fixed_address, IPv6Interface),
+                            configurator="dhclient",
+                            _target=self._target,
+                        )
+            except Exception as e:  # noqa: PERF203
+                self._target.log.warning("Error parsing dhclient leases file %s", file)
+                self._target.log.debug("", exc_info=e)
+                continue
+
+
+class NetworkManagerLeaseParser(LinuxNetworkConfigParser):
+    """Parse network interfaces from NetworkManager DHCP ``.lease`` files."""
+
+    def interfaces(self) -> Iterator[UnixInterfaceRecord]:
+        """Parse network interfaces from NetworkManager DHCP ``.lease`` files."""
+        for file in self._config_files(["/var/lib/NetworkManager/"], "*.lease"):
+            try:
+                lease = configutil.parse(file, hint="env")
+
+                interface = file.stem.split("-")[-1]  # Extract interface name from file stem
+                if ip_address := lease.get("ADDRESS"):
+                    ip_address = ip_interface(ip_address)
+
+                yield UnixInterfaceRecord(
+                    name=interface,
+                    type="dhcp",
+                    cidr={ip_address},
+                    source=file,
+                    configurator="NetworkManager",
+                    dhcp_ipv4=isinstance(ip_address, IPv4Interface),
+                    dhcp_ipv6=isinstance(ip_address, IPv6Interface),
+                    _target=self._target,
+                )
+            except Exception as e:  # noqa: PERF203
+                self._target.log.warning("Error parsing NetworkManager lease file %s", file)
+                self._target.log.debug("", exc_info=e)
+                continue
+
+
 class ProcConfigParser(LinuxNetworkConfigParser):
     """Parser for dynamic network configuration data from /proc/net.
 
@@ -517,3 +596,4 @@ def be_hex_to_int(be_hex: str) -> int:
 
 
 MANAGERS = [NetworkManagerConfigParser, SystemdNetworkConfigParser, ProcConfigParser]
+LEASERS = [DhclientLeaseParser, NetworkManagerLeaseParser]

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev69
+Version: 3.23.dev71
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/tests/filesystems/test_extfs.py

@@ -28,9 +28,7 @@ def test_stat_information() -> None:
         b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
     )
 
-    inode = c_ext.ext4_inode(BytesIO(inode_bytes))
-
-    entry._inode = inode
+    entry.inode = c_ext.ext4_inode(BytesIO(inode_bytes))
 
     fs_entry = ExtFilesystemEntry(Mock(), "some/path", entry)
 

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/tests/helpers/test_configutil.py

@@ -16,6 +16,7 @@ from dissect.target.helpers.configutil import (
     Env,
     Indentation,
     Json,
+    Leases,
     ScopeManager,
     SystemD,
     parse,
@@ -375,3 +376,28 @@ def test_env_parser(input: str | Path, expected_output: dict) -> None:
         parser.parse_file(input.open("r"))
 
     assert parser.parsed_data == expected_output
+
+
+@pytest.mark.parametrize(
+    ("string_data", "expected_output"),
+    [
+        (
+            'default-duid "\\000\\001\\000\\001\\037\\305\\371\\341\\001\\002\\003\\004\\005\\006"\nlease {\ninterface "eth0"; # some comment\nfixed-address "1.2.3.4";\noption subnet-mask 255.255.255.0;\nrenew 2 2023/10/04 13:37:04;\n# some other comment}',  # noqa: E501
+            {
+                "default-duid": '"\\000\\001\\000\\001\\037\\305\\371\\341\\001\\002\\003\\004\\005\\006"',
+                "lease-0": {
+                    "interface": '"eth0"',
+                    "fixed-address": '"1.2.3.4"',
+                    "option": {"subnet-mask": "255.255.255.0"},
+                    "renew": "2 2023/10/04 13:37:04",
+                },
+            },
+        ),
+    ],
+)
+def test_leases_parser(string_data: str, expected_output: dict) -> None:
+    """Test the leases parser."""
+    parser = Leases()
+    parser.parse_file(StringIO(string_data))
+
+    assert parser.parsed_data == expected_output

{dissect_target-3.23.dev69 → dissect_target-3.23.dev71}/tests/plugins/os/unix/linux/test_network.py

@@ -1,15 +1,19 @@
 from __future__ import annotations
 
+import textwrap
 from datetime import datetime
+from io import BytesIO
 from ipaddress import ip_address, ip_interface
 from typing import TYPE_CHECKING
 from unittest.mock import MagicMock, patch
 
 from dissect.target.plugins.os.default.network import UnixInterfaceRecord
 from dissect.target.plugins.os.unix.linux.network import (
+    DhclientLeaseParser,
     LinuxNetworkConfigParser,
     LinuxNetworkPlugin,
     NetworkManagerConfigParser,
+    NetworkManagerLeaseParser,
     ProcConfigParser,
     SystemdNetworkConfigParser,
 )
@@ -221,6 +225,81 @@ def test_linux_network_plugin_interfaces(target_linux: Target) -> None:
         MockLinuxConfigParser2.return_value.interfaces.assert_called_once()
 
 
+def test_linux_network_dhclient_leases_file(target_linux: Target, fs_linux: VirtualFilesystem) -> None:
+    lease_dhcp_dhclient = r"""
+    default-duid "\000\001\000\001\037\305\371\341\001\002\003\004\005\006"
+    lease {
+        interface "eth0";  # some comment
+        fixed-address 1.2.3.4;
+        option dhcp-lease-time 13337;
+        option routers 0.0.0.0;
+        option host-name "hostname";
+        option subnet-mask 255.255.255.0;
+        renew 1 2023/12/31 13:37:00;
+        rebind 2 2023/01/01 01:00:00;
+        expire 3 2024/01/01 13:37:00;
+    }
+    lease {
+        interface "eth0";
+        fixed-address 2001:db8::2:1;
+        option dhcp-lease-time 13338;
+        option routers 1.1.1.1;
+        option host-name "hostname";
+        renew 4 2024/12/31 14:37:00;
+        rebind 5 2024/01/01 02:00:00;
+        expire 6 2025/01/01 15:37:00;
+        # some more comments
+    }
+    """
+
+    fs_linux.map_file_fh("/var/lib/dhcp/dhclient.leases", BytesIO(textwrap.dedent(lease_dhcp_dhclient).encode()))
+    fs_linux.map_file_fh(
+        "/var/lib/dhclient/dhclient.eth0.leases", BytesIO(textwrap.dedent(lease_dhcp_dhclient).encode())
+    )
+
+    dhclient = DhclientLeaseParser(target_linux)
+
+    leases = list(dhclient.interfaces())
+
+    assert len(leases) == 4
+    assert leases[0].name == "eth0"
+    assert leases[0].type == "dhcp"
+    assert leases[0].cidr == [ip_interface("1.2.3.4/24")]
+    assert leases[0].gateway == [ip_address("0.0.0.0")]
+    assert leases[0].dhcp_ipv4
+    assert not leases[0].dhcp_ipv6
+    assert leases[0].configurator == "dhclient"
+
+    assert leases[3].name == "eth0"
+    assert leases[3].type == "dhcp"
+    assert leases[3].cidr == [ip_interface("2001:db8::2:1/128")]
+    assert leases[3].gateway == [ip_address("1.1.1.1")]
+    assert not leases[3].dhcp_ipv4
+    assert leases[3].dhcp_ipv6
+    assert leases[0].configurator == "dhclient"
+
+
+def test_linux_network_networkmanager_leases_file(target_linux: Target, fs_linux: VirtualFilesystem) -> None:
+    lease_networkmanager = """
+    # This is private data. Do not parse.
+    ADDRESS=1.3.3.7
+    """
+
+    fs_linux.map_file_fh(
+        "/var/lib/NetworkManager/internal-d6b936ad-d73f-4898-a826-edbb61d6155a-eth0.lease",
+        BytesIO(textwrap.dedent(lease_networkmanager).encode()),
+    )
+
+    networkmanager = NetworkManagerLeaseParser(target_linux)
+    leases = list(networkmanager.interfaces())
+
+    assert len(leases) == 1
+    assert leases[0].name == "eth0"
+    assert leases[0].type == "dhcp"
+    assert leases[0].configurator == "NetworkManager"
+    assert leases[0].cidr == [ip_interface("1.3.3.7/32")]
+
+
 def test_proc_config_parser(target_linux: Target, fs_linux: VirtualFilesystem) -> None:
     fixture_dir = absolute_path("_data/plugins/os/unix/linux/proc")
     fs_linux.map_file("/proc/net/route", fixture_dir.joinpath("route"))