Linux: add basic versions of linux.ip.Link and linux.ip.Addr plugins #1029
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…lag_names was set unnecessary
ikelos
reviewed
Nov 5, 2023
| @@ -281,3 +281,39 @@ | |||
| ) | |||
|
|
|||
| ELF_MAX_EXTRACTION_SIZE = 1024 * 1024 * 1024 * 4 - 1 | |||
|
|
|||
| # net_device_flags was not always an enum, so these hard coded values | |||
There was a problem hiding this comment.
Thanks for the comment! This is fine, but much better since it's commented! 5:D
| @@ -46,6 +46,7 @@ def __init__(self, *args, **kwargs) -> None: | |||
| self.set_type_class("sock", extensions.sock) | |||
| self.set_type_class("inet_sock", extensions.inet_sock) | |||
| self.set_type_class("unix_sock", extensions.unix_sock) | |||
| self.set_type_class("net_device", extensions.net_device) | |||
There was a problem hiding this comment.
Will this exist on all kernels, or should this be an optional set_type (as a few lines below)?
There was a problem hiding this comment.
I think it will exist - but it never hurts to double check! I'll look into it.
There was a problem hiding this comment.
I confirm net_device exists at least from 2.6.30, so it should be safe.
| if self.has_member("perm_addr"): | ||
| raw_addr = self.perm_addr[0 : self.addr_len] | ||
| else: # perm_addr is not found in older kernels | ||
| raw_addr = parent_layer.read(self.dev_addr, self.addr_len, pad=True) |
There was a problem hiding this comment.
Liiiiiittle bit ugly, but it's only a line, so I guess that'll be ok. 5:S Can't think of how to improve it, so....
|
Closing in favor of #1079 by @gcmoreira |
gcmoreira
added a commit
to gcmoreira/volatility3
that referenced
this pull request
Jan 27, 2024
volatilityfoundation#1029 * IP address conversion via renderers.coversion.* * Use MAC address internal size instead of hardcoded. * Read NET_DEVICE_FLAGS from enumeration
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello!
This PR brings very basic versions
ip.Linkandip.Addrplugins for linux which I hope to complete with the full suite of ip information, e.g.ip route show,ip neigh show, etc etc.They don't have smear protection yet, I can add that if it looks like this is the correct way of doing things. They are based on the vol2 plugin
ifconfigbut I've tried to include a little bit more information. I don't have a good selection of samples with very old kernels in them so I haven't done the path that using thedev_basesymbol rather thannet_namespace_listyet.I've tested on kernels from v3 to v6 but I'd always welcome more testing! No doubt I've missed something somewhere.
Here is some example output from two different samples.