Convert IF_OPER_STATES to enum

volatility3/framework/constants/linux/__init__.py

@@ -5,6 +5,7 @@
 
 Linux-specific values that aren't found in debug symbols
 """
+from enum import Enum
 
 KERNEL_NAME = "__kernel__"
 
@@ -315,13 +316,15 @@ NET_DEVICE_FLAGS = {
     "IFF_ECHO": 0x40000,
 }
 
-# RFC 2863 operational status. Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h
-IF_OPER_STATES = (
-    "UNKNOWN",
-    "NOTPRESENT",
-    "DOWN",
-    "LOWERLAYERDOWN",
-    "TESTING",
-    "DORMANT",
-    "UP",
-)
+
+# Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h
+class IF_OPER_STATES(Enum):
+    """RFC 2863 - Network interface operational status"""
+
+    UNKNOWN = 0
+    NOTPRESENT = 1
+    DOWN = 2
+    LOWERLAYERDOWN = 3
+    TESTING = 4
+    DORMANT = 5
+    UP = 6

volatility3/framework/symbols/linux/extensions/__init__.py

@@ -16,7 +16,7 @@ from volatility3.framework.constants.linux import BLUETOOTH_PROTOCOLS, SOCKET_ST
 from volatility3.framework.constants.linux import CAPABILITIES, NET_DEVICE_FLAGS
 from volatility3.framework.constants.linux import IFA_HOST, IFA_LINK, IFA_SITE
 from volatility3.framework.constants.linux import IF_OPER_STATES
-from volatility3.framework.renderers import conversion
+from volatility3.framework.renderers import conversion, UnparsableValue
 from volatility3.framework import exceptions, objects, interfaces, symbols
 from volatility3.framework.layers import linear
 from volatility3.framework.objects import utility
@@ -1321,11 +1321,11 @@ class net_device(objects.StructType):
         Returns:
             str: A string with the operational state
         """
-        if self.operstate >= len(IF_OPER_STATES):
+        try:
+            return IF_OPER_STATES(self.operstate).name
+        except ValueError:
             vollog.warning(f"Invalid net_device operational state '{self.operstate}'")
-            return "INVALID"
-
-        return IF_OPER_STATES[self.operstate]
+            return UnparsableValue()
 
 
 class in_device(objects.StructType):