
    Xf$                        d dl Z d dlZd dlmZmZmZmZ d dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZ  e j        e          Zdedeee         ef         d	efd
ZdZdZ eej        d gdz            Z eej        d gdz            Z G d de	j                  Z G d de          Z G d de          Z G d de	j                  Z G d de	j                  ZeeeeedZeeeedZ dS )    N)DictTupleListUnion)
exceptions)objects
interfaces)Array)
conversionaddress_family	packed_ipreturnc                     | t           j        t           j        fv r@	 t          j        | t	          |                    S # t
          $ r t          d          w xY wt          j        d          )NzEThis version of python does not have socket.inet_ntop, please upgradez3[Errno 97] Address family not supported by protocol)socketAF_INET6AF_INET	inet_ntopbytesAttributeErrorRuntimeErrorerror)r   r   s     j/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/network.pyr   r      sy    &/6>:::	#NE)4D4DEEE 	 	 	W  	 ,L
M
MMs	   !> A            c                        e Zd ZdZdZdZdej        j        de	dej
        j        dedee	eeej
        j        f         f         d	d
f fdZd Zd Zd Zd Zd Zd Zd Zd Z xZS )_TCP_LISTENERa  Class for objects found in TcpL pools.

    This class serves as a base class for all pooled network objects.

    It exposes some functions which return sanity-checked members. Substructures referred to by a
    pointer may appear valid at first glance but will throw an InvalidAddressException on access.

    This is not a problem when objects are validated via their `is_valid()` method, but when
    scanning for semi-corrupted data this check will not be performed.

    Be mindful that most of those methods return `None` when they would access invalid data.
    If you want to process the raw data access the attributes directly, e.g.
    via `network_object.InetAF` instead of `network_object.get_address_family()`.

    i  i  context	type_nameobject_infosizemembersr   Nc                 T    t                                          |||||           d S )N)r   r    r!   r"   r#   )super__init__)selfr   r    r!   r"   r#   	__class__s         r   r&   z_TCP_LISTENER.__init__;   s?     	# 	 	
 	
 	
 	
 	
    c                 l    	 | j                                         j        S # t          j        $ r Y d S w xY wN)InetAFdereferenceAddressFamilyr   InvalidAddressExceptionr'   s    r   get_address_familyz _TCP_LISTENER.get_address_familyK   sC    	;**,,::1 	 	 	44	s     33c                 ~    	 |                      d                                          S # t          j        $ r Y d S w xY w)NOwner)memberr-   r   r/   r0   s    r   	get_ownerz_TCP_LISTENER.get_ownerR   sJ    	;;w''335551 	 	 	44	s   &) <<c                     |                                                                  r@|                                                      d          r|                                  j        S d S )NUniqueProcessId)r5   is_validhas_valid_memberr7   r0   s    r   get_owner_pidz_TCP_LISTENER.get_owner_pidY   sY    >>$$&& 	8~~001BCC 8~~''77tr)   c                 @   |                                                                  rw|                                                      d          rP|                                  j                            d|                                  j        j        j        d          S d S )NImageFileNamestringreplace)
max_lengtherrors)r5   r8   r9   r<   castvolcountr0   s    r   get_owner_procnamez _TCP_LISTENER.get_owner_procname`   s    >>$$&& 	~~00AA ~~''5::#~~//=AG$ ;    tr)   c                     t          j        | j        j                  }t	          |t
          j        j                  r|S | j        |j	        cxk     r| j
        k     sn d S |S r+   )r   wintime_to_datetime
CreateTimeQuadPart
isinstancer	   	renderersBaseAbsentValueMIN_CREATETIME_YEARyearMAX_CREATETIME_YEAR)r'   dt_objs     r   get_create_timez_TCP_LISTENER.get_create_timek   sg    /0HIIfj2BCC 	M (6;QQQQ9QQQQQ4Mr)   c                     	 | j                                         }|j                                        j        d         }|j                                        r	|j        }|S d S # t
          j        $ r Y d S w xY w)Nr   )	LocalAddrr-   pDataaddr4inaddrr   r/   )r'   
local_addr_rU   s       r   get_in_addrz_TCP_LISTENER.get_in_addrw   s    	3355J  ,,..4Q7A++-- #*t1 	 	 	44	s   AA# #A65A6c              #     K   |                                  }|r|                                 t          k    r+dt          t          j        |j                  t          fV  dS |                                 t          k    r+dt          t          j        |j                  t          fV  dS dS dt          t          fV  |                                 t          k    rdt          t          fV  dS dS )z!Handle Windows dual-stack socketsv4v6N)
rX   r1   r   r   r   rT   
inaddr_anyr   addr6inaddr6_anyr'   rU   s     r   dual_stack_socketsz _TCP_LISTENER.dual_stack_sockets   s       !!## 	5&&((G33IfnflCCZOOOOOO((**h66Ifov|DDkQQQQQQ 76 
J....&&((H44K444444 54r)   c                 d   	 |                                  t          t          fvrLt                              d                    | j        j        |                                                       dS n?# t          j	        $ r- t                              d| j        j        dd           Y dS w xY wdS )Nz8netw obj 0x{:x} invalid due to invalid address_family {}Fznetw obj 0xx& invalid due to invalid address accessT)
r1   r   r   vollogdebugformatrB   offsetr   r/   r0   s    r   r8   z_TCP_LISTENER.is_valid   s    	**,,(0CCCNUU)@)@)B)B   
 u D 1 	 	 	LLWdhoWWWW   55		
 ts   A,A1 18B-,B-)__name__
__module____qualname____doc__rL   rN   r	   r   ContextInterfacestrr   ObjectInformationintr   r   Templater&   r1   r5   r:   rD   rP   rX   r`   r8   __classcell__)r(   s   @r   r   r   '   s-          
#4
 
  '9	

 
 c5j&8&A!ABBC
 

 
 
 
 
 
       	 	 	
 
 
  25 5 50      r)   r   c                   *    e Zd ZdZd Zd Zd Zd ZdS )_TCP_ENDPOINTz%Class for objects found in TcpE poolsc                     |                                  t          k    rt          t          j        |j                  S t          t          j        |j                  S r+   )r1   r   r   r   rT   r   r]   r_   s     r   _ipv4_or_ipv6z_TCP_ENDPOINT._ipv4_or_ipv6   sA    ""$$//V^V\:::V_fl;;;r)   c                     	 | j                                         j        j                                                                        }|                     |          S # t
          j        $ r Y d S w xY wr+   )AddrInfor-   LocalrS   ru   r   r/   r_   s     r   get_local_addressz_TCP_ENDPOINT.get_local_address   sq    	]..006<HHJJVVXXF%%f---1 	 	 	44	s   AA A10A1c                     	 | j                                         j                                        }|                     |          S # t          j        $ r Y d S w xY wr+   )rw   r-   Remoteru   r   r/   r_   s     r   get_remote_addressz _TCP_ENDPOINT.get_remote_address   sb    	]..007CCEEF%%f---1 	 	 	44	s   AA AAc                    | j         | j         j                                        vrAt                              t          |            d| j        j        dd| j                     dS 	 |                                 t          t          fvrNt                              t          |            d| j        j        dd|                                             dS |                                 s|                                 r:|                                 j        dk    s|                                 j        dk    r:t                              t          |            d| j        j        dd           dS nN# t          j        $ r< t                              t          |            d| j        j        dd	           Y dS w xY wd
S )Nz 0xrb   z" invalid due to invalid tcp state Fz' invalid due to invalid address_family r   i  z" invalid due to invalid owner datarc   T)Statechoicesvaluesrd   re   typerB   rg   r1   r   r   ry   r5   r7   r   r/   r0   s    r   r8   z_TCP_ENDPOINT.is_valid   s   :TZ/668888LL::cc$(/cccW[Wacc   5	&&(((0CCCDzz{{dho{{{`d`w`w`y`y{{   u))++ NN$$>>##3q88>>##3e;;Dzz[[dho[[[[   u1 	 	 	LL::[[$(/[[[[   55		 ts   (A.E5 BE5 5AG ?G N)rh   ri   rj   rk   ru   ry   r|   r8    r)   r   rs   rs      sV        //< < <        r)   rs   c                       e Zd ZdZdS )_UDP_ENDPOINTz%Class for objects found in UdpA poolsN)rh   ri   rj   rk   r   r)   r   r   r      s        ////r)   r   c                   $    e Zd Zed             ZdS )_LOCAL_ADDRESSc                 X    | j                                                                         S r+   rS   r-   r0   s    r   rU   z_LOCAL_ADDRESS.inaddr   s"    z%%''33555r)   Nrh   ri   rj   propertyrU   r   r)   r   r   r      s-        6 6 X6 6 6r)   r   c                   $    e Zd Zed             ZdS )_LOCAL_ADDRESS_WIN10_UDPc                 4    | j                                         S r+   r   r0   s    r   rU   z_LOCAL_ADDRESS_WIN10_UDP.inaddr  s    z%%'''r)   Nr   r   r)   r   r   r      s-        ( ( X( ( (r)   r   )rs   r   r   r   r   )rs   r   r   r   )!loggingr   typingr   r   r   r   volatility3.frameworkr   r   r	   volatility3.framework.objectsr
   volatility3.framework.renderersr   	getLoggerrh   rd   ro   rm   r   r   r   r\   r^   
StructTyper   rs   r   r   r   win10_x64_class_typesclass_typesr   r)   r   <module>r      s<  
   + + + + + + + + + + + + , , , , , , 5 5 5 5 5 5 5 5 / / / / / / 6 6 6 6 6 6		8	$	$Nc NeDIu4D.E N# N N N N  Yv~sQw//
i!r22P P P P PG& P P Pf9 9 9 9 9M 9 9 9x0 0 0 0 0M 0 0 06 6 6 6 6W' 6 6 6( ( ( ( (w1 ( ( ( #""$ 8   #""$	 r)   