Changes to findFilesInPool to support LVM

sleuthkit · Mar 25, 2023 · 4ce75ba · 4ce75ba
1 parent 1a6f4c0
commit 4ce75ba
Show file tree

Hide file tree

Showing 3 changed files with 100 additions and 2 deletions.
diff --git a/tsk/auto/auto.cpp b/tsk/auto/auto.cpp
@@ -467,7 +467,6 @@ TskAuto::findFilesInPool(TSK_OFF_T start, TSK_POOL_TYPE_ENUM ptype)
     else if (retval1 == TSK_FILTER_STOP)
         return TSK_STOP;
 
-    /* Only APFS pools are currently supported */
     if (pool->ctype == TSK_POOL_TYPE_APFS) {
 
         TSK_POOL_VOLUME_INFO *vol_info = pool->vol_list;
@@ -487,6 +486,7 @@ TskAuto::findFilesInPool(TSK_OFF_T start, TSK_POOL_TYPE_ENUM ptype)
                         TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, fs_info->root_inum);
                         tsk_fs_close(fs_info);
 
+                        // TODO: what if retval != TSK_STOP, shouldn't pool_img be closed?
                         if (retval == TSK_STOP) {
                             tsk_img_close(pool_img);
                             tsk_pool_close(pool);
@@ -527,6 +527,51 @@ TskAuto::findFilesInPool(TSK_OFF_T start, TSK_POOL_TYPE_ENUM ptype)
             vol_info = vol_info->next;
         }
     }
+#ifdef HAVE_LIBVSLVM
+    if (pool->ctype == TSK_POOL_TYPE_LVM) {
+        TSK_POOL_VOLUME_INFO *vol_info = pool->vol_list;
+        while (vol_info != NULL) {
+
+            // The call to filterPoolVol is needed to ensure the object state is
+            // correctly set for filling the database.
+            TSK_FILTER_ENUM filterRetval = filterPoolVol(vol_info);
+            if ((filterRetval == TSK_FILTER_STOP) || (m_stopAllProcessing)) {
+                tsk_pool_close(pool);
+                return TSK_STOP;
+            }
+
+            TSK_IMG_INFO *pool_img = pool->get_img_info(pool, vol_info->block);
+            if (pool_img == NULL) {
+                tsk_pool_close(pool);
+                tsk_error_set_errstr2(
+                    "findFilesInPool: Error opening LVM logical volume: %" PRIdOFF "",
+                    vol_info->block);
+                registerError();
+                return TSK_ERR;
+            }
+            TSK_FS_INFO *fs_info = tsk_fs_open_img(pool_img, 0, TSK_FS_TYPE_DETECT);
+            if (fs_info == NULL) {
+                tsk_img_close(pool_img);
+                tsk_pool_close(pool);
+                tsk_error_set_errstr2(
+                    "findFilesInPool: Unable to open file system in LVM logical volume: %" PRIdOFF "",
+                    vol_info->block);
+                registerError();
+                return TSK_ERR;
+            }
+            TSK_RETVAL_ENUM retval = findFilesInFsInt(fs_info, fs_info->root_inum);
+
+            tsk_fs_close(fs_info);
+            tsk_img_close(pool_img);
+
+            if (retval == TSK_STOP) {
+                tsk_pool_close(pool);
+                return TSK_STOP;
+            }
+            vol_info = vol_info->next;
+        }
+    }
+#endif /* HAVE_LIBVSLVM */
     else {
         tsk_pool_close(pool);
         tsk_error_reset();

diff --git a/tsk/pool/lvm_pool_compat.cpp b/tsk/pool/lvm_pool_compat.cpp
@@ -28,6 +28,53 @@ static uint8_t getError(libvslvm_error_t *vslvm_error, char error_string[512])
     return retval <= 0;
 }
 
+LVMPoolCompat::~LVMPoolCompat() {
+  // Clean up the dynamic allocations
+  if (_info.vol_list != nullptr) {
+    auto vol = _info.vol_list;
+    while (vol != nullptr) {
+      if (vol->desc != nullptr) delete[] vol->desc;
+      vol = vol->next;
+    }
+    delete[] _info.vol_list;
+    _info.vol_list = nullptr;
+  }
+}
+
+// Note that vol_list is used by findFilesInPool
+void LVMPoolCompat::init_volumes() {
+    int number_of_logical_volumes = 0;
+    if (libvslvm_volume_group_get_number_of_logical_volumes(_lvm_volume_group, &number_of_logical_volumes, NULL) != 1 ) {
+        return;
+    }
+    _info.num_vols = number_of_logical_volumes;
+    _info.vol_list = new TSK_POOL_VOLUME_INFO[number_of_logical_volumes]();
+
+    libvslvm_logical_volume_t *lvm_logical_volume = NULL;
+    TSK_POOL_VOLUME_INFO *last = nullptr;
+
+    for (int volume_index = 0; volume_index < number_of_logical_volumes; volume_index++ ) {
+        if (libvslvm_volume_group_get_logical_volume(_lvm_volume_group, volume_index, &lvm_logical_volume, NULL) != 1 ) {
+            return;
+        }
+        auto &vinfo = _info.vol_list[volume_index];
+
+        vinfo.tag = TSK_POOL_VOL_INFO_TAG;
+        vinfo.index = volume_index;
+        vinfo.block = volume_index + 1;
+        vinfo.prev = last;
+        if (vinfo.prev != nullptr) {
+            vinfo.prev->next = &vinfo;
+        }
+        vinfo.desc = new char[64];
+        libvslvm_logical_volume_get_name(lvm_logical_volume, vinfo.desc, 64, NULL);
+
+        libvslvm_logical_volume_free(&lvm_logical_volume, NULL);
+
+        last = &vinfo;
+    }
+}
+
 uint8_t LVMPoolCompat::poolstat(FILE *hFile) const noexcept try {
 
     tsk_fprintf(hFile, "POOL CONTAINER INFORMATION\n");

diff --git a/tsk/pool/lvm_pool_compat.hpp b/tsk/pool/lvm_pool_compat.hpp
@@ -17,10 +17,16 @@
 #include "tsk_lvm.hpp"
 
 class LVMPoolCompat : public TSKPoolCompat<LVMPool> {
+  void init_volumes();
+
  public:
   template <typename... Args>
   LVMPoolCompat(Args&&... args)
-      : TSKPoolCompat<LVMPool>(TSK_POOL_TYPE_LVM, std::forward<Args>(args)...) { }
+      : TSKPoolCompat<LVMPool>(TSK_POOL_TYPE_LVM, std::forward<Args>(args)...) {
+    init_volumes();
+  }
+
+  ~LVMPoolCompat();
 
   uint8_t poolstat(FILE* hFile) const noexcept;
   TSK_IMG_INFO * getImageInfo(const TSK_POOL_INFO *pool_info, TSK_DADDR_T pvol_block) noexcept;