diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index fd172fc43..7d4b20da0 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -74,7 +74,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): sock_stat: A tuple with the source, destination and state strings. extended: A dictionary with key/value extended information. """ - family = sock.family + family = sock.get_family() extended = {} sock_handler = self._sock_family_handlers.get(family) if sock_handler: @@ -144,13 +144,13 @@ class SockHandlers(interfaces.configuration.VersionableInterface): sock_stat: A tuple with the source, destination and state strings. """ unix_sock = sock.cast("unix_sock") - state = unix_sock.state - saddr = unix_sock.name - sinode = unix_sock.inode + state = unix_sock.get_state() + saddr = unix_sock.get_name() + sinode = unix_sock.get_inode() if unix_sock.peer != 0: peer = unix_sock.peer.dereference().cast("unix_sock") - daddr = peer.name - dinode = peer.inode + daddr = peer.get_name() + dinode = peer.get_inode() else: daddr = dinode = "" @@ -170,13 +170,13 @@ class SockHandlers(interfaces.configuration.VersionableInterface): sock_stat: A tuple with the source, destination and state strings. """ inet_sock = sock.cast("inet_sock") - saddr = inet_sock.src_addr - sport = inet_sock.src_port - daddr = inet_sock.dst_addr - dport = inet_sock.dst_port - state = inet_sock.state + saddr = inet_sock.get_src_addr() + sport = inet_sock.get_src_port() + daddr = inet_sock.get_dst_addr() + dport = inet_sock.get_dst_port() + state = inet_sock.get_state() - if inet_sock.family == "AF_INET6": + if inet_sock.get_family() == "AF_INET6": saddr = f"[{saddr}]" saddr_tag = f"{saddr}:{sport}" @@ -217,7 +217,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): saddr_tag = ",".join(saddr_list) daddr_tag = ",".join(daddr_list) - state = netlink_sock.state + state = netlink_sock.get_state() sock_stat = saddr_tag, daddr_tag, state return netlink_sock, sock_stat @@ -260,7 +260,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): saddr_tag = f"{dev_name}" daddr_tag = "" - state = packet_sock.state + state = packet_sock.get_state() sock_stat = saddr_tag, daddr_tag, state return packet_sock, sock_stat @@ -318,15 +318,16 @@ class SockHandlers(interfaces.configuration.VersionableInterface): return ":".join(reversed(["%02x" % x for x in addr.b])) saddr_tag = daddr_tag = "" - if bt_sock.protocol == "HCI": + bt_protocol = bt_sock.get_protocol() + if bt_protocol == "HCI": pinfo = bt_sock.cast("hci_pinfo") - elif bt_sock.protocol == "L2CAP": + elif bt_protocol == "L2CAP": pinfo = bt_sock.cast("l2cap_pinfo") src_addr = bt_addr(pinfo.chan.src) dst_addr = bt_addr(pinfo.chan.dst) saddr_tag = f"{src_addr}" daddr_tag = f"{dst_addr}" - elif bt_sock.protocol == "RFCOMM": + elif bt_protocol == "RFCOMM": pinfo = bt_sock.cast("rfcomm_pinfo") src_addr = bt_addr(pinfo.src) dst_addr = bt_addr(pinfo.dst) @@ -334,7 +335,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): saddr_tag = f"[{src_addr}]:{channel}" daddr_tag = f"{dst_addr}" else: - vollog.log(constants.LOGLEVEL_V, "Unsupported bluetooth protocol '%s'", bt_sock.protocol) + vollog.log(constants.LOGLEVEL_V, "Unsupported bluetooth protocol '%s'", bt_protocol) state = bt_sock.state sock_stat = saddr_tag, daddr_tag, state @@ -420,8 +421,8 @@ class Sockstat(plugins.PluginInterface): sock = socket.sk.dereference() - sock_type = sock.type - family = sock.family + sock_type = sock.get_type() + family = sock.get_family() sock_handler = SockHandlers(vmlinux, task) sock_fields = sock_handler.process_sock(sock) @@ -429,7 +430,7 @@ class Sockstat(plugins.PluginInterface): continue child_sock = sock_fields[0] - protocol = child_sock.protocol if hasattr(child_sock, "protocol") else "" + protocol = child_sock.get_protocol() net = task.nsproxy.net_ns netns_id = net.get_inode() diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index fe495f88d..80180ad1b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -617,20 +617,17 @@ class sock(objects.StructType): return module_names[0] - @property - def family(self): + def get_family(self): family_idx = self.__sk_common.skc_family if 0 <= family_idx < len(SOCK_FAMILY): return SOCK_FAMILY[family_idx] else: return "UNKNOWN" - @property - def type(self): + def get_type(self): return SOCK_TYPES.get(self.sk_type, "") - @property - def inode(self): + def get_inode(self): if not self.sk_socket: return 0 @@ -646,8 +643,7 @@ class sock(objects.StructType): return vfs_inode.i_ino class unix_sock(objects.StructType): - @property - def name(self): + def get_name(self): if self.addr: sockaddr_un = self.addr.name.cast("sockaddr_un") saddr = str(utility.array_to_string(sockaddr_un.sun_path)) @@ -655,16 +651,14 @@ class unix_sock(objects.StructType): saddr = "" return saddr - @property - def protocol(self): + def get_protocol(self): return "" - @property - def state(self): + def get_state(self): """Return a string representing the sock state.""" # Unix socket states reuse (a subset) of the inet_sock states contants - if self.sk.type == "STREAM": + if self.sk.get_type() == "STREAM": state_idx = self.sk.__sk_common.skc_state if 0 <= state_idx < len(TCP_STATES): state = TCP_STATES[state_idx] @@ -675,33 +669,29 @@ class unix_sock(objects.StructType): return state - @property - def inode(self): - return self.sk.inode + def get_inode(self): + return self.sk.get_inode() class inet_sock(objects.StructType): - @property - def family(self): + def get_family(self): family_idx = self.sk.__sk_common.skc_family if 0 <= family_idx < len(SOCK_FAMILY): return SOCK_FAMILY[family_idx] else: return "UNKNOWN" - @property - def protocol(self): + def get_protocol(self): # If INET6 family and a proto is defined, we use that specific IPv6 protocol. # Otherwise, we use the standard IP protocol. protocol = IP_PROTOCOLS.get(self.sk.sk_protocol, "UNKNOWN") - if self.family == "AF_INET6": + if self.get_family() == "AF_INET6": protocol = IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol) return protocol - @property - def state(self): + def get_state(self): """Return a string representing the sock state.""" - if self.sk.type == "STREAM": + if self.sk.get_type() == "STREAM": state_idx = self.sk.__sk_common.skc_state if 0 <= state_idx < len(TCP_STATES): state = TCP_STATES[state_idx] @@ -712,14 +702,12 @@ class inet_sock(objects.StructType): return state - @property - def src_port(self): + def get_src_port(self): sport_le = getattr(self, "sport", getattr(self, "inet_sport", None)) if sport_le is not None: return socket.htons(sport_le) - @property - def dst_port(self): + def get_dst_port(self): sk_common = self.sk.__sk_common if hasattr(sk_common, "skc_portpair"): dport_le = sk_common.skc_portpair & 0xffff @@ -734,8 +722,7 @@ class inet_sock(objects.StructType): return socket.htons(dport_le) - @property - def src_addr(self): + def get_src_addr(self): sk_common = self.sk.__sk_common family = sk_common.skc_family if family == socket.AF_INET: @@ -756,8 +743,7 @@ class inet_sock(objects.StructType): addr_bytes = parent_layer.read(saddr.vol.offset, addr_size) return socket.inet_ntop(family, addr_bytes) - @property - def dst_addr(self): + def get_dst_addr(self): sk_common = self.sk.__sk_common family = sk_common.skc_family if family == socket.AF_INET: @@ -782,16 +768,14 @@ class inet_sock(objects.StructType): return socket.inet_ntop(family, addr_bytes) class netlink_sock(objects.StructType): - @property - def protocol(self): + def get_protocol(self): protocol_idx = self.sk.sk_protocol if 0 <= protocol_idx < len(NETLINK_PROTOCOLS): return NETLINK_PROTOCOLS[protocol_idx] else: return "UNKNOWN" - @property - def state(self): + def get_state(self): # Netlink is a datagram-oriented service. We can only have # SOCK_RAW or SOCK_DGRAM socket types. # NOTE: We are overriding the netlink_sock.state member here @@ -800,8 +784,7 @@ class netlink_sock(objects.StructType): class packet_sock(objects.StructType): - @property - def protocol(self): + def get_protocol(self): eth_proto = socket.htons(self.num) if eth_proto == 0: return "" @@ -810,15 +793,13 @@ class packet_sock(objects.StructType): else: return f"0x{eth_proto:x}" - @property - def state(self): + def get_state(self): # Packet socket types are either SOCK_RAW or SOCK_DGRAM. return "UNCONNECTED" class bt_sock(objects.StructType): - @property - def protocol(self): + def get_protocol(self): type_idx = self.sk.sk_protocol if 0 <= type_idx < len(BLUETOOTH_PROTOCOLS): state = BLUETOOTH_PROTOCOLS[type_idx] @@ -827,8 +808,7 @@ class bt_sock(objects.StructType): return state - @property - def state(self): + def get_state(self): state_idx = self.sk.__sk_common.skc_state if 0 <= state_idx < len(BLUETOOTH_STATES): state = BLUETOOTH_STATES[state_idx]