
    #gD!                         d dl Z d dlmZmZmZ d dlmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j,                  e      Z G d
 dej2                        Zy)    N)IterableCallableTuple)
exceptions	renderers
interfaces	constants)requirements)plugins)utility)format_hints)linux)pslistc                      e Zd ZdZdZed        Zed fdej                  j                  de
deegef   deeee
ej                   j"                  eeej                   j"                  f   f      fd	       Zed
 fdej                  j                  de
deegef   deee
eej                   j"                  f      fd       Zd Zd Zy)Netstatz0Lists all network connections for all processes.   r   r   c           	         t        j                  ddg d      t        j                  dt        j                  d      t        j
                  dt        j                  d	
      t        j                  ddt        d      gS )NkernelzLinux kernel module)Intel32Intel64AArch64AMD64)namedescriptionarchitecturesr   r   )r   pluginversion
linuxutils)r      r   )r   	componentr   pidzFilter on specific process IDsT)r   r   element_typeoptional)
r
   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   LinuxUtilitiesListRequirementint)clss    ]/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/linux/netstat.pyget_requirementszNetstat.get_requirements   sy     **1H
 **fmmY ++!U-A-A9 ((< 	
 	
    c                      yNF _s    r-   <lambda>zNetstat.<lambda>2       ur/   contextvmlinux_namefilter_funcreturnc              #     K   t         j                  j                  |||      D ]  }t        |j                        } ||      r!t        j                  |j                        }|j                  }|sO	 |j                         }|sc|j                         D ]  \  }	}
|
s	||||	|
ff   y# t        j                  $ r Y w xY ww)a  
        Lists file descriptors for all processes without retrieving the file path.

        Yields:
            A tuple containing:
                - PID
                - Process command name
                - Task object
                - Tuple of (fd number, file object)
        N)r   r'   
list_tasksr+   r"   r   array_to_stringcommfilesget_fdsr   InvalidAddressExceptionitems)r,   r7   r8   r9   taskr"   	task_commr?   fd_tablefd_numfilps              r-   list_fds_no_pathzNetstat.list_fds_no_path-   s     " MM,,WlKPDdhh-C3//		:IJJE ==?  ( 09dVTN::	 !1' Q 55 s*   A1C4B/+C/CCCCc                      yr1   r2   r3   s    r-   r5   zNetstat.<lambda>\   r6   r/   kernel_module_namec              #     K   |j                   |   }	 |j                  d      }| j                  ||j                  |      }|D ]  \  }}}	}
|
\  }}	 |r|j                  |k(  rn!	 	 |j                  j                         j                  d      }|j                  |	j                  j                     j!                  |j                  j"                  |j                  j$                        st'        j(                  |	j*                        }|||f  y # t        j                  $ r t        j                  d       d }Y w xY w# t        j                  $ r Y w xY w# t        j                  $ r Y 2w xY ww)Nsocket_file_opszFSymbol 'socket_file_ops' not found. The plugin may not work correctly.socket)modulesobject_from_symbolr   SymbolErrorvollogwarningrH   r   f_oprA   private_datadereferencecastlayersvolnative_layer_nameis_validoffsetsizer   r=   r>   )r,   r7   rJ   r9   vmlinuxrL   fd_generatorr"   rD   rC   fd_inforF   rG   rM   	task_names                  r-   list_socketszNetstat.list_socketsW   s_     //"45	#%889JKO ++GW\\;O-9)CD'"LFD"tyyO'C **668==hG
 >>$(("<"<=FF

!!6::?? //		:IS&((5 .: %% 	#NNcd"O	#" 55  55 sp   E9D ,E9E#E9&)EBE9*E>E9EE9EE9EE9E62E95E66E9c              #     K   t         j                  j                  | j                  j	                  dd             }| j                  | j                  | j                  d   |      D ]|  \  }}}	 |j                  j                  }||j                  j                  j                  k(  r	 |j                  j                         j!                  d      }|so|j"                  }|r"t%        j&                  |j(                  d      }nd}dt+        j,                  |j                  j.                        d	|dddd| d
| ff ||j                  j                  j0                  |j                  j                  j2                  fv s 	 |j                  j4                  j6                  }	|	|j                  j                  j8                  k(  rd}
n+|	|j                  j                  j:                  k(  rd}
nd|	 }
|j                  j4                  j<                  }||j                  j                  j0                  k(  rkt%        j>                  |j                  j4                  j@                  d      }t%        j>                  |j                  j4                  jB                  d      }nt%        j>                  |j                  j4                  jD                  jF                  jH                  d      }t%        j>                  |j                  j4                  jJ                  jF                  jH                  d      }|j                  j4                  jL                  }|j                  j4                  jN                  }tP        jS                  |jU                  dd      d      }dt+        j,                  |j                  j.                        |
||||t[        |      | d
| ff  y # t        j                  $ r Y w xY w# t        j                  $ r Y w xY w# t        j                  tV        tX        f$ r Y w xY ww)Nr"   r   )r9   	unix_sockzutf-8)encoding r   UNIX/TCPUDPIPPROTO_ipv4)familyipv6r   little)	byteorderbig).r   r'   create_pid_filterconfiggetra   r7   opsrl   r   rA   rX   constsAF_UNIXskrU   rV   addrr   r=   r   r   Hexr[   AF_INETAF_INET6_Netstat__sk_commonskc_protocolIPPROTO_TCPIPPROTO_UDP	skc_statearray_to_ipskc_rcv_saddr	skc_daddrskc_v6_rcv_saddrin6_uu6_addr8skc_v6_daddrskc_num	skc_dportr+   
from_bytesto_bytesAttributeError
ValueErrorstr)selfr9   r`   r"   rM   rl   rc   rx   pathprotocolprotostatelipriplportrports                   r-   
_generatorzNetstat._generator   s{    mm55dkkooeT6RS&*&7&7LL$++h/[ '8 '
"IsF**
 **222 &		 5 5 7 < <[ II$ $>>D&66tyy7S!
 $(():):;$+Qse,	  FJJ--55vzz7H7H7Q7QRR%yy44AAH6::#4#4#@#@@ %!VZZ%6%6%B%BB %"*8* 5 #II11;;E !2!2!:!::%11&))2G2G2U2U^de%11&))2G2G2Q2QZ`a%11&))2G2G2X2X2^2^2g2gpvw%11&))2G2G2T2T2Z2Z2c2clrs"II1199E"II11;;E  NN5>>!x>+P\aNbE $(():):;E
$+Qse,	 M'
 55  "99 \ #::NJW s   A-Q0O(#Q*+PQ2PA=QHP!AQ(O?;Q>O??QPQPQP>:Q=P>>Qc                     t        j                  dt        j                  fdt        fdt        fdt
        fdt        fdt
        fdt        fdt        fg| j                               S )	NOffsetProtozLocal IPz
Local Portz	Remote IPzRemote PortStateProcess)r   TreeGridr   ry   r   r+   r   )r   s    r-   runzNetstat.run   sj    !!<++,#S!s#c"$#C 	 OO
 	
r/   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr.   r   r7   ContextInterfacer   r   r+   boolr   r   objectsObjectInterfacerH   ra   r   r   r2   r/   r-   r   r      s*   :"+
 
* 
 .=	';##44'; '; seTk*	';
 
%S*"4"4"D"DeCQ[QcQcQsQsLsFttu	v'; ';R 
 .=	,)##44,)  ,) seTk*	,)
 
%S*"4"4"D"DDE	F,) ,)\Un
r/   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   r	   #volatility3.framework.configurationr
    volatility3.framework.interfacesr   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.linuxr   	getLoggerr   rQ   PluginInterfacer   r2   r/   r-   <module>r      sN     , , N N < 4 1 8 / ,			8	$X
g%% X
r/   