
    Xf                         d dl Z d dlmZmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ  e j        e          Z G d
 dej                  ZdS )    N)IterableCallableTuple)
exceptions	renderers
interfaces)requirements)plugins)utility)format_hints)mac)pslistc                       e Zd ZdZdZed             Zed fdej        j	        de
deegef         deeej        j        ej        j        ej        j        f                  fd	            Zd
 Zd ZdS )Netstatz0Lists all network connections for all processes.)   r   r   c           	          t          j        ddddg          t          j        dt          j        d          t          j        d	t          j        d
          t          j        ddt          d          gS )NkernelzKernel module for the OSIntel32Intel64)namedescriptionarchitecturesr   )   r   r   )r   pluginversionmacutils)   r   r   )r   	componentr   pidzFilter on specific process IDsT)r   r   element_typeoptional)
r	   ModuleRequirementPluginRequirementr   PsListVersionRequirementr   MacUtilitiesListRequirementint)clss    [/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/mac/netstat.pyget_requirementszNetstat.get_requirements   s     *6()4  
 *fmY   +3+;Y   (< 	  
 	
    c                     dS )NF )_s    r*   <lambda>zNetstat.<lambda>3   s    u r,   contextkernel_module_namefilter_funcreturnc              #     K   t           j                            t           j        j        d                   } ||||          D ]!}t	          j        |j                  }|j        }t          j	        
                    ||j        |         j        |          D ]\  }}	}		 |j                                        }
n# t          j        $ r Y 2w xY w|
dk    r=	 |j        j                                                            d          }n# t          j        $ r Y w xY w|j        |j        j                                     |j        j        |j        j                  s|||fV  ͐#dS )aK  
        Returns the open socket descriptors of a process

        Return values:
            A tuple of 3 elements:
                1) The name of the process that opened the socket
                2) The process ID of the processed that opened the socket
                3) The address of the associated socket structure
        r   SOCKETsocketN)r   r$   get_list_taskspslist_methodsr   array_to_stringp_commp_pidr   r&   files_descriptors_for_processmodulessymbol_table_namef_fglobget_fg_typer   InvalidAddressExceptionfg_datadereferencecastlayersvolnative_layer_nameis_validoffsetsize)r)   r1   r2   r3   
list_taskstask	task_namer   filpr/   ftyper7   s               r*   list_socketszNetstat.list_sockets.   s     . ]11&-2Nq2QRR
Jw(:KHH 	- 	-D/<<I*C!.LL);<NPT  - -
a L4466EE!9   H H$$!\1==??DDXNNFF!9   H ~dh&@AJJJ%vz   f,,,,,+-		- 	-s$   B99C
C1DDDc              #   &  K   t           j                            | j                            dd                     }|                     | j        | j        d         |          D ],\  }}}|                                }|dk    r	 |j        	                                
                    d          }t          j        |j        j                  }n# t          j        $ r Y ~w xY wdt#          j        |j        j                  d|dddd| d	|d
ffV  |dv ru|                                }|                                }	|                                }
|
r7|
\  }}}}dt#          j        |j        j                  |	|||||| d	|d
ffV  .d S )Nr   r   )r3   r   unpcbr   UNIX /d)r      )r   r$   create_pid_filterconfiggetrQ   r1   
get_familyso_pcbrD   rE   r   r:   unp_addrsun_pathr   rB   r   HexrG   rJ   	get_stateget_protocol_as_stringget_converted_connection_info)selfr3   rN   r   r7   familyupcbpathstateprotovalsliplportriprports                  r*   
_generatorzNetstat._generatora   s     m55dkooeT6R6RSS&*&7&7L$+h/[ '8 '
 '
 /	 /	"IsF &&((F{{!=4466;;GDDD"24=3IJJDD!9   H $():;;$..s...	     7""((**5577;;== /3,S%e (,VZ->??!!!!(223222	   G/	 /	s   A
CC"!C"c                     t          j        dt          j        fdt          fdt          fdt
          fdt          fdt
          fdt          fdt          fg|                                           S )	NOffsetProtozLocal IPz
Local Portz	Remote IPzRemote PortStateProcess)r   TreeGridr   r`   strr(   ro   )rd   s    r*   runzNetstat.run   sl    !<+,#S!s#c"$#C 	 OO
 
 	
r,   N)__name__
__module____qualname____doc___required_framework_versionclassmethodr+   r   r1   ContextInterfacerv   r   r(   boolr   r   objectsObjectInterfacerQ   ro   rw   r.   r,   r*   r   r      s        ::"+
 
 [
* 
 .=_	0- 0-#40-  0- seTk*	0-
 
...0	

0- 0- 0- [0-d2 2 2h
 
 
 
 
r,   r   )loggingtypingr   r   r   volatility3.frameworkr   r   r   #volatility3.framework.configurationr	    volatility3.framework.interfacesr
   volatility3.framework.objectsr   volatility3.framework.renderersr   volatility3.framework.symbolsr   volatility3.plugins.macr   	getLoggerrx   vollogPluginInterfacer   r.   r,   r*   <module>r      s  
  , , , , , , , , , , C C C C C C C C C C < < < < < < 4 4 4 4 4 4 1 1 1 1 1 1 8 8 8 8 8 8 - - - - - - * * * * * *		8	$	$O
 O
 O
 O
 O
g% O
 O
 O
 O
 O
r,   