Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Linux systemd network interface plugin #776

Open
DissectBot opened this issue Jul 31, 2024 · 0 comments · May be fixed by #932
Open

Linux systemd network interface plugin #776

DissectBot opened this issue Jul 31, 2024 · 0 comments · May be fixed by #932

Comments

@DissectBot
Copy link

DissectBot commented Jul 31, 2024

Task 5/5 for network interface plugin

  • Create linux OS-specific class - systemd
  • separate DHCP and static IP
  • calculate network subnet (using method in base class)
  • Borrow paths and fields form the current network manager but update to use the config parser (don’t use any logic)
  • Add a field to the UnixInterfaceRecord to indicate the networking system the record data was retrieved from
  • Below is the design scheme with notes for linux:
windows/
    _os.py
    network.py

_os.py:
    Still has the ips export for backwards compatibility
    
network.py
    Can take inspiration from datetime namespace plugin.
    
    Define a NetworkPlugin based on a base class with some defined exports.
    It should be defined in plugins/general/network.py, so that the Default OS plugin can also make use of it. 
    The exported functions can just return empty iterators.
    
    Should also have some @internal functions for interface lookup (similar to user_details)
    
    - interfaces
      - InterfaceRecord
        - Base record for common stuff, OS specialized fields where applicable
          - Can take inspiration from UserRecord/Browser*Record
        - Fields (in no particular order):
          - Type (TUN/TAP/Physical)
          - Name
          - Enabled/disabled
          - MAC (optional)
          - IP / subnet
          - VLAN? (macOS/windows)
          - Gateway
          - DNS server / Search domain (Windows/macOS specific?)
          - Proxy (at least macOS specific)
          - Metric (Windows specific)
          - Interface service order (macOS)
          - Last connected (maybe only Windows?)
          - Config source (similar to how we use the source field in other records)
    - ips -> shorthand for getting all ips
    - gateways/mac/dns/other common fields -> idem as ^

Linux notes:
  - Need to parse information from static configuration files on disk
  - Maybe not initially, but should also support parsing information from log files (e.g. messages/sysvol/journalctl) for similar information
    - ips in LinuxPlugin already does this
    - This is best effort information, but very valuable if dissect can do this for the analyst
  - Could also be nice to extend with /proc information down the line
  - Maybe each network manager can be its own "NetworkPlugin", and there's a "parent" network plugin that loads as many compatible sub-network plugins and just iterates over all of them.
    - Like the browser/other similar namespace plugins
    - Log based can be a separate one of these as well
  - Can utilize unix config parser
@DissectBot DissectBot changed the title Create class for Linux network interface plugin Linux NetworkManager network interface plugin Oct 15, 2024
@DissectBot DissectBot changed the title Linux NetworkManager network interface plugin Linux systemd network interface plugin Oct 15, 2024
@DissectBot DissectBot changed the title Linux systemd network interface plugin Linux NetworkManager network interface plugin Oct 15, 2024
@DissectBot DissectBot changed the title Linux NetworkManager network interface plugin Linux systemd network interface plugin Oct 15, 2024
@DissectBot DissectBot changed the title Linux systemd network interface plugin Linux NetworkManager network interface plugin Oct 24, 2024
@DissectBot DissectBot changed the title Linux NetworkManager network interface plugin Linux systemd network interface plugin Oct 30, 2024
@DissectBot DissectBot changed the title Linux systemd network interface plugin Linux NetworkManager network interface plugin Nov 5, 2024
@DissectBot DissectBot changed the title Linux NetworkManager network interface plugin Linux systemd network interface plugin Nov 5, 2024
@DissectBot DissectBot changed the title Linux systemd network interface plugin Linux NetworkManager network interface plugin Nov 7, 2024
@DissectBot DissectBot changed the title Linux NetworkManager network interface plugin Linux systemd network interface plugin Nov 7, 2024
@DissectBot DissectBot changed the title Linux systemd network interface plugin Linux NetworkManager network interface plugin Nov 7, 2024
@DissectBot DissectBot changed the title Linux NetworkManager network interface plugin Linux systemd network interface plugin Nov 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant