dissect.target
dissect.target copied to clipboard
Create class for Linux network interface plugin
Task 4/4 for network interface plugin
- Create linux OS-specific class
- separate DHCP and static IP
- calculate network subnet (using method in base class)
- Below is the design scheme with notes for linux:
windows/
_os.py
network.py
_os.py:
Still has the ips export for backwards compatibility
network.py
Can take inspiration from datetime namespace plugin.
Define a NetworkPlugin based on a base class with some defined exports.
It should be defined in plugins/general/network.py, so that the Default OS plugin can also make use of it.
The exported functions can just return empty iterators.
Should also have some @internal functions for interface lookup (similar to user_details)
- interfaces
- InterfaceRecord
- Base record for common stuff, OS specialized fields where applicable
- Can take inspiration from UserRecord/Browser*Record
- Fields (in no particular order):
- Type (TUN/TAP/Physical)
- Name
- Enabled/disabled
- MAC (optional)
- IP / subnet
- VLAN? (macOS/windows)
- Gateway
- DNS server / Search domain (Windows/macOS specific?)
- Proxy (at least macOS specific)
- Metric (Windows specific)
- Interface service order (macOS)
- Last connected (maybe only Windows?)
- Config source (similar to how we use the source field in other records)
- ips -> shorthand for getting all ips
- gateways/mac/dns/other common fields -> idem as ^
Linux notes:
- Need to parse information from static configuration files on disk
- Maybe not initially, but should also support parsing information from log files (e.g. messages/sysvol/journalctl) for similar information
- ips in LinuxPlugin already does this
- This is best effort information, but very valuable if dissect can do this for the analyst
- Could also be nice to extend with /proc information down the line
- Maybe each network manager can be its own "NetworkPlugin", and there's a "parent" network plugin that loads as many compatible sub-network plugins and just iterates over all of them.
- Like the browser/other similar namespace plugins
- Log based can be a separate one of these as well
- Can utilize unix config parser