diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 8b42ccdbf..76f7253fe 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -15,7 +15,7 @@ class Addr(plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -47,7 +47,7 @@ class Addr(plugins.PluginInterface): prefix_len = in_ifaddr.get_prefix_len() scope_type = in_ifaddr.get_scope_type() ip_addr = in_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state + yield net_ns_id or renderers.NotAvailableValue(), iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state # Interface IPv6 Addresses inet6_dev = net_dev.ip6_ptr.dereference().cast("inet6_dev") @@ -55,7 +55,7 @@ class Addr(plugins.PluginInterface): prefix_len = inet6_ifaddr.get_prefix_len() scope_type = inet6_ifaddr.get_scope_type() ip6_addr = inet6_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state + yield net_ns_id or renderers.NotAvailableValue(), iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] @@ -127,7 +127,7 @@ class Link(plugins.PluginInterface): ] flags_str = ",".join(flags_list) - yield net_ns_id, iface_name, mac_addr, operational_state, mtu, qdisc_name, qlen, flags_str + yield net_ns_id or renderers.NotAvailableValue(), iface_name, mac_addr, operational_state, mtu, qdisc_name or renderers.NotAvailableValue(), qlen, flags_str def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] diff --git a/volatility3/framework/symbols/linux/extensions/network.py b/volatility3/framework/symbols/linux/extensions/network.py index ed739894d..30094d1b1 100644 --- a/volatility3/framework/symbols/linux/extensions/network.py +++ b/volatility3/framework/symbols/linux/extensions/network.py @@ -199,7 +199,7 @@ class net_device(objects.StructType): """ return self.flags & self._get_net_device_flag_value("IFF_PROMISC") != 0 - def get_net_namespace_id(self) -> int: + def _do_get_net_namespace_id(self) -> int: """Return the network namespace id for this network interface. Returns: @@ -216,6 +216,20 @@ class net_device(objects.StructType): return net_ns_id + def get_net_namespace_id(self) -> Optional[int]: + """Return the network namespace id for this network interface. + + Returns: + int: the network namespace id for this network interface + """ + try: + return self._do_get_net_namespace_id() + except exceptions.InvalidAddressException: + vollog.debug( + f"Encountered an invalid address exception when getting the namespace for {self.vol.offset:#x}" + ) + return None + def get_operational_state(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Return the netwok device oprational state (RFC 2863) string @@ -228,13 +242,17 @@ class net_device(objects.StructType): vollog.warning(f"Invalid net_device operational state '{self.operstate}'") return renderers.UnparsableValue() - def get_qdisc_name(self) -> str: + def get_qdisc_name(self) -> Optional[str]: """Return the network device queuing discipline (qdisc) name Returns: str: A string with the queuing discipline (qdisc) name """ - return utility.array_to_string(self.qdisc.ops.id) + try: + return utility.array_to_string(self.qdisc.ops.id) + except exceptions.InvalidAddressException: + vollog.debug(f"Unable to get qdisc name for {self.vol.offset:#x}") + return None def get_queue_length(self) -> int: """Return the netwrok device transmision qeueue length (qlen) @@ -247,17 +265,34 @@ class net_device(objects.StructType): class in_device(objects.StructType): def get_addresses( - self, + self, max_devices=128 ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yield the IPv4 ifaddr addresses Yields: in_ifaddr: An IPv4 ifaddr address """ - cur = self.ifa_list + seen = set() + + try: + cur = self.ifa_list + except exceptions.InvalidAddressException: + return + while cur and cur.vol.offset: + if len(seen) > max_devices: + break + + if cur.vol.offset in seen: + break + seen.add(cur.vol.offset) + yield cur - cur = cur.ifa_next + + try: + cur = cur.ifa_next + except exceptions.InvalidAddressException: + break class inet6_dev(objects.StructType):