Linux ip.Addr and ip.Link plugins #1079

gcmoreira · 2024-01-09T19:28:36Z

This PR adds the linux.ip.Addr and linux.ip.Link plugins.

linux.ip.Addr:

It displays information about all network interfaces including network namespace, interface index, interface name, mac address, promiscuous status, IPv4/IPv6 address, prefix, scope type and state.

Example output:

$ python3 ./vol.py -r pretty \
  -f ram-6.2.0-26 \
  linux.ip.Addr
Volatility 3 Framework 2.5.2
Formatting...0.00               Stacking attempts finished                 
  |      NetNS | Index | Interface |               MAC | Promiscuous |                       IP | Prefix | Scope Type |   State
* | 4026531840 |     1 |        lo | 00:00:00:00:00:00 |       False |                127.0.0.1 |      8 |       host | UNKNOWN
* | 4026531840 |     1 |        lo | 00:00:00:00:00:00 |       False |                      ::1 |    128 |       host | UNKNOWN
* | 4026531840 |     2 |     ens32 | 00:0c:29:7f:8b:ab |       False |           172.16.141.130 |     24 |     global |      UP
* | 4026531840 |     2 |     ens32 | 00:0c:29:7f:8b:ab |       False | fe80::20c:29ff:fe7f:8bab |     64 |       link |      UP
* | 4026531840 |     3 |     ens33 | 00:0c:29:7f:8b:b5 |       False |          192.168.249.129 |     24 |     global |      UP
* | 4026531840 |     3 |     ens33 | 00:0c:29:7f:8b:b5 |       False | fe80::20c:29ff:fe7f:8bb5 |     64 |       link |      UP

linux.ip.Link (by @eve-mem )

It displays information about all network devices configuration including network namespace, interface name, mac address, state, MTU, Qdisc, Qlen and flags.

$ python3 ./vol.py -r pretty \
  -f ram-6.2.0-26 \
  linux.ip.Link
Volatility 3 Framework 2.5.2
Formatting...0.00               Stacking attempts finished                 
  |         NS | Interface |               MAC |   State |   MTU |    Qdisc | Qlen |                           Flags
* | 4026531840 |        lo | 00:00:00:00:00:00 | UNKNOWN | 65536 |  noqueue | 1000 |            LOOPBACK,LOWER_UP,UP
* | 4026531840 |     ens32 | 00:0c:29:7f:8b:ab |      UP |  1500 | fq_codel | 1000 | BROADCAST,LOWER_UP,MULTICAST,UP
* | 4026531840 |     ens33 | 00:0c:29:7f:8b:b5 |      UP |  1500 | fq_codel | 1000 | BROADCAST,LOWER_UP,MULTICAST,UP

Both plugins were tested with the following linux kernel versions:

2.6.32-74.142
3.10.0-862_el7
3.11.0-26
4.4.0-210
4.13.0-46
4.15.0-45
4.18.0-10
5.3.0-76
5.8.0-53
5.19.0-50
6.2.0-26

See the full test case suite output:
vol3_linux_ip_addr_output.txt

vol3_linux_ip_link_output.txt

…xplicitily use the exception instance

volatility3/framework/symbols/linux/extensions/__init__.py

gcmoreira · 2024-01-09T19:49:23Z

Hey @ikelos I'm aware of this #1029 excellent contribution from @eve. We've already discussed this, and we agreed to collaborate, combining our efforts into one.
I will borrow some part of his code, for instance, to display the interface state and use the address conversion from the vol3 helpers instead from the python socket module.
Regarding the plugin name, I like the @eve-mem idea of named it as the new linux commands ip address. That also allows to continue developing other plugins like 'ip link' (@eve-mem already have done that) and other future commands.
My only concern is that probably for users coming from vol2 they would like to see this as ifconfig. Any preference?

eve-mem · 2024-01-15T06:57:41Z

@gcmoreira - looks really cool, I need to look over it properly. I certainly like pulling out the prefix into it's own column compared with #1029 - that makes it easier to work with programmatically later.

+1 vote to renaming the plugins to linux.ip.addr etc to match the new linux commands. There are already a bunch of commands that were effectively renamed between vol2 and vol3 already.

volatilityfoundation#1029 * IP address conversion via renderers.coversion.* * Use MAC address internal size instead of hardcoded. * Read NET_DEVICE_FLAGS from enumeration

volatility3/framework/symbols/linux/extensions/__init__.py

ikelos

Generally looks good, just a couple of minor points to check please. 5:)

ikelos · 2024-01-28T23:42:18Z

volatility3/framework/symbols/linux/extensions/__init__.py

+
+    def _get_net_device_flag_value(self, name):
+        """Return the net_deivce flag value based on the flag name"""
+        return self._get_flag_choices()[name]


I'd be happier if this were a get with a default value? Having said that, it's such a short function, perhaps it's not worth having at all (given it's private so can't be used by anyone else?)

Default value and error managed.
I prefer to keep it as a function, even though it's short and private. This way, it serves the purpose of documenting what it does and increases the code's readability. I would let the language to implement the bytecode inline if needed.
Anyway, if you still think it should be inline, let me know, and I will change it.

ikelos · 2024-01-28T23:44:24Z

volatility3/framework/constants/linux/__init__.py

+}
+
+# RFC 2863 operational status. Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h
+IF_OPER_STATES = (


Should these be Enums rather than just a list of strings? If may potentially lead to typos?

Done. This is used by value, so I don't think at the moment being an Enum offers any usability advantage. Although I reckon it may look better to Pythonic eyes ;)

ikelos · 2024-01-28T23:44:41Z

volatility3/framework/constants/linux/__init__.py

-IFF_PROMISC = 0x100
+# Only for kernels < 3.15 when the net_device_flags enum didn't exist
+# ref include/uapi/linux/if.h
+NET_DEVICE_FLAGS = {


This also looks like it could be a python Enum?

hm here changing this to an Enum makes the code a bit complicated... have a look at how it's used in _get_flag_choices() and _get_net_device_flag_value() to support both kernels <3.15 and >=3.15.

gcmoreira · 2024-01-29T00:54:57Z

Thanks @ikelos. I will have a look at this soon. I also plan to include the ip.link plugin from @eve-mem in this PR, that's why I marked it as a draft.

In the meantime, could you have a look at the black formatter checks? I'm confused, as far as I understand it's failing on files which are not from this PR

eve-mem · 2024-01-29T06:17:32Z

@gcmoreira - it looks nice to me. I'll run it against my collection of samples when I can. Can I help adding in ip.Link at all?

volatility3/framework/symbols/linux/extensions/__init__.py

ikelos · 2024-01-29T10:06:37Z

It is, or was, github updated to black 24.1.0, so I went over the while codebase, but it doesn't seem to get that the merge *target* updated, so returning the task still results in the same output. 5:S. Basically if you add a new commit, it should do a proper refresh and either pass or show you how the new black failed it. Hard to tell if there's still something that needs doing, but just a trivial commit will help and I figured since it was in draft it would get added to... 5:)

…

On Mon, 29 Jan 2024, 00:55 gcmoreira, ***@***.***> wrote: Thanks @ikelos <https://github.com/ikelos>. I will have a look at this soon. I also plan to include the ip.link plugin from @eve-mem <https://github.com/eve-mem> in this PR, that's why I marked it as a draft. In the meantime, could you have a look at the black formatter checks? I'm confused, as far as I understand it's failing on files which are not from this PR — Reply to this email directly, view it on GitHub <#1079 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIZVIJNUJJARGODCOUILTYQ3XOXAVCNFSM6AAAAABBTT6DKKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMJTG44TEMRTG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

gcmoreira · 2024-01-30T16:27:42Z

It is, or was, github updated to black 24.1.0, so I went over the while codebase, but it doesn't seem to get that the merge target updated, so returning the task still results in the same output. 5:S. Basically if you add a new commit, it should do a proper refresh and either pass or show you how the new black failed it.

Yep, that did the trick, thanks

gcmoreira · 2024-01-30T16:29:13Z

@gcmoreira - it looks nice to me. I'll run it against my collection of samples when I can. Can I help adding in ip.Link at all?

@eve-mem sure, go ahead with that ;)

…tform and, based on it, utilizes either the posixpath or ntpath modules

@eve-mem

- On top of the @eve-mem, I've added the queue length field to mimic the ip link command. - Furthermore, I've included some functions to export the network device flags exactly as they are presented to userland

gcmoreira · 2024-02-02T10:44:42Z

@ikelos This is now ready for review. Added testcases for both plugins

gcmoreira · 2024-03-13T07:16:58Z

Hi @ikelos, this is still awaiting a review. Maybe @atcuno can have a look? 🙏

gcmoreira added 2 commits January 9, 2024 16:12

Linux - Added linux.ifconfig.Ifconfig plugin

82668af

Fix exception. Although it will be auto-instantiated it's better to e…

6b3bbad

…xplicitily use the exception instance

github-advanced-security bot found potential problems Jan 9, 2024

View reviewed changes

volatility3/framework/symbols/linux/extensions/__init__.py Fixed Show fixed Hide fixed

volatility3/framework/symbols/linux/extensions/__init__.py Fixed Show fixed Hide fixed

eve-mem mentioned this pull request Jan 15, 2024

Linux: add basic versions of linux.ip.Link and linux.ip.Addr plugins #1029

Closed

Plugin renamed. Added net iface status and other improvements from @eve

6e0ffc9

volatilityfoundation#1029 * IP address conversion via renderers.coversion.* * Use MAC address internal size instead of hardcoded. * Read NET_DEVICE_FLAGS from enumeration

gcmoreira changed the title ~~Linux ifconfig plugin~~ Linux ip.addr plugin Jan 27, 2024

gcmoreira changed the title ~~Linux ip.addr plugin~~ Linux ip.Addr plugin Jan 27, 2024

github-advanced-security bot found potential problems Jan 27, 2024

View reviewed changes

volatility3/framework/symbols/linux/extensions/__init__.py Fixed Show fixed Hide fixed

Minor fixes

97007e8

gcmoreira changed the title ~~Linux ip.Addr plugin~~ Draft: Linux ip.Addr plugin Jan 27, 2024

gcmoreira and others added 2 commits January 27, 2024 17:52

Fix: Explicit returns mixed with implicit (fall through) returns

620b9b4

Merge branch 'volatilityfoundation:develop' into linux_ifconfig_plugin

cd867bf

ikelos reviewed Jan 28, 2024

View reviewed changes

eve-mem reviewed Jan 29, 2024

View reviewed changes

volatility3/framework/symbols/linux/extensions/__init__.py Outdated Show resolved Hide resolved

gcmoreira added 3 commits January 30, 2024 12:53

Fix docstring typos

5a8a0de

Convert IF_OPER_STATES to enum

c72fa75

Manage net_device flag default value & error

1b153cc

gcmoreira added 6 commits February 2, 2024 16:43

Add test for linux.ip.Addr and linux-sample-1.bin

6f1e7c2

Python os.path module precisely does that by checking the current pla…

260fbd8

…tform and, based on it, utilizes either the posixpath or ntpath modules

Linux: Add the linux.ip.Link plugin by @eve-mem

7b1c75c

- On top of the @eve-mem, I've added the queue length field to mimic the ip link command. - Furthermore, I've included some functions to export the network device flags exactly as they are presented to userland

Add linux.ip.Link test using linux-sample-1.bin image

8b6bd0f

Remove lowercase matching from linux.ip.Addr test

5219e8a

Fix issue with net namespace id and improve code

828b688

gcmoreira changed the title ~~Draft: Linux ip.Addr plugin~~ Linux ip.Addr and ip.Link plugins Feb 2, 2024

ikelos assigned atcuno Mar 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Linux ip.Addr and ip.Link plugins #1079

Linux ip.Addr and ip.Link plugins #1079

gcmoreira commented Jan 9, 2024 •

edited

gcmoreira commented Jan 9, 2024 •

edited

eve-mem commented Jan 15, 2024

ikelos left a comment

ikelos Jan 28, 2024

gcmoreira Jan 30, 2024 •

edited

ikelos Jan 28, 2024

gcmoreira Jan 30, 2024

ikelos Jan 28, 2024

gcmoreira Jan 30, 2024

gcmoreira commented Jan 29, 2024

eve-mem commented Jan 29, 2024

ikelos commented Jan 29, 2024 via email

gcmoreira commented Jan 30, 2024

gcmoreira commented Jan 30, 2024

gcmoreira commented Feb 2, 2024

gcmoreira commented Mar 13, 2024 •

edited

Linux ip.Addr and ip.Link plugins #1079

Are you sure you want to change the base?

Linux ip.Addr and ip.Link plugins #1079

Conversation

gcmoreira commented Jan 9, 2024 • edited

linux.ip.Addr:

linux.ip.Link (by @eve-mem )

gcmoreira commented Jan 9, 2024 • edited

eve-mem commented Jan 15, 2024

ikelos left a comment

Choose a reason for hiding this comment

ikelos Jan 28, 2024

Choose a reason for hiding this comment

gcmoreira Jan 30, 2024 • edited

Choose a reason for hiding this comment

ikelos Jan 28, 2024

Choose a reason for hiding this comment

gcmoreira Jan 30, 2024

Choose a reason for hiding this comment

ikelos Jan 28, 2024

Choose a reason for hiding this comment

gcmoreira Jan 30, 2024

Choose a reason for hiding this comment

gcmoreira commented Jan 29, 2024

eve-mem commented Jan 29, 2024

ikelos commented Jan 29, 2024 via email

gcmoreira commented Jan 30, 2024

gcmoreira commented Jan 30, 2024

gcmoreira commented Feb 2, 2024

gcmoreira commented Mar 13, 2024 • edited

gcmoreira commented Jan 9, 2024 •

edited

gcmoreira commented Jan 9, 2024 •

edited

gcmoreira Jan 30, 2024 •

edited

gcmoreira commented Mar 13, 2024 •

edited