On 05/04/16 19:33, Pino Toscano wrote:

On Tuesday 05 April 2016 18:47:28 Matteo Cafasso wrote:

...

The tsk_dirent struct contains the information gathered via TSK APIs.

The struct contains the following fields: * tsk_inode: inode of a file * tsk_type: type of file such as for dirwalk command * tsk_size: file size in bytes * tsk_name: path relative to its disk partition * tsk_allocated: whether the file has been deleted

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- generator/structs.ml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/generator/structs.ml b/generator/structs.ml index 6017ba6..d986fd9 100644 --- a/generator/structs.ml +++ b/generator/structs.ml @@ -442,8 +442,20 @@ let structs = [ "im_device", FString; "im_volume", FString; ]; - s_camel_name = "InternalMountable"; - }; + s_camel_name = "InternalMountable" }; Unneeded change.

...

+ (* The Sleuth Kit directory entry information. *) + { defaults with + s_name = "tsk_dirent"; + s_cols = [ + "tsk_inode", FUInt64; + "tsk_type", FChar; + "tsk_size", FInt64; + "tsk_name", FString; + "tsk_allocated", FUInt32; Once added to the public API, a struct cannot be extended anymore (it would break the ABI). IMHO it would make more sense to have a tsk_flags instead of tsk_allocated, documenting the values of the flags/bits set: this way, adding a new simple boolean flag won't require a new tsk_dirent2 (see e.g. the application2 struct).

The application2 structs shows pretty well the issue but does not have any bitwise flag. Is there an example I could use as a reference? Especially I'd like to see how flags are exposed and documented.

Thanks,

_______________________________________________ Libguestfs mailing list Libguestfs@redhat.com https://www.redhat.com/mailman/listinfo/libguestfs

On Tuesday 05 April 2016 18:47:29 Matteo Cafasso wrote:

Ensure libtsk is available at compile time. If not, daemon routines depending on it won't be available.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> ---

Please also add the optional dependency to the documentation, see docs/guestfs-building.pod.

m4/guestfs_daemon.m4 | 8 ++++++++ 1 file changed, 8 insertions(+)

diff --git a/m4/guestfs_daemon.m4 b/m4/guestfs_daemon.m4 index 88936b2..09cfecd 100644 --- a/m4/guestfs_daemon.m4 +++ b/m4/guestfs_daemon.m4 @@ -118,3 +118,11 @@ PKG_CHECK_MODULES([SD_JOURNAL], [libsystemd],[ AC_MSG_WARN([systemd journal library not found, some features will be disabled]) ]) ]) + +dnl libtsk sleuthkit library (optional) +AC_CHECK_LIB([tsk],[tsk_version_print],[ + AC_CHECK_HEADER([tsk/libtsk.h],[ + AC_SUBST([TSK_LIBS], [-ltsk]) + AC_DEFINE([HAVE_LIBTSK], [1], [Define to 1 if The Sleuth Kit library (libtsk) is available.])

Extra space here ... ^ Thanks, -- Pino Toscano

"daemon: Added internal_filesystem_walk command" -> "New API: internal_filesystem_walk" On Tuesday 05 April 2016 18:47:30 Matteo Cafasso wrote:

The internal_filesystem_walk command walks through the FS structures of a disk partition and returns all the files or directories which could be found.

The command is able to retrieve information regarding deleted or unaccessible files where other commands such as stat or find would fail.

The gathered list of tsk_dirent structs is serialised into XDR format and written to a file by the appliance.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- daemon/Makefile.am | 4 +- daemon/tsk.c | 233 +++++++++++++++++++++++++++++++++++++++++++++++++++ generator/actions.ml | 9 ++ src/MAX_PROC_NR | 2 +- 4 files changed, 246 insertions(+), 2 deletions(-) create mode 100644 daemon/tsk.c

diff --git a/daemon/Makefile.am b/daemon/Makefile.am index beb7962..03bf71f 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -179,6 +179,7 @@ guestfsd_SOURCES = \ sync.c \ syslinux.c \ tar.c \ + tsk.c \ truncate.c \ umask.c \ upload.c \ @@ -209,7 +210,8 @@ guestfsd_LDADD = \ $(LIB_CLOCK_GETTIME) \ $(LIBINTL) \ $(SERVENT_LIB) \ - $(PCRE_LIBS) + $(PCRE_LIBS) \ + $(TSK_LIBS)

guestfsd_CPPFLAGS = \ -I$(top_srcdir)/gnulib/lib \ diff --git a/daemon/tsk.c b/daemon/tsk.c new file mode 100644 index 0000000..cd4879b --- /dev/null +++ b/daemon/tsk.c @@ -0,0 +1,233 @@ +/* libguestfs - the guestfsd daemon + * Copyright (C) 2016 Red Hat Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> +#include <inttypes.h> +#include <string.h> +#include <unistd.h> +#include <rpc/xdr.h> +#include <rpc/types.h> + +#include "guestfs_protocol.h" +#include "daemon.h" +#include "actions.h" +#include "optgroups.h" + +#ifdef HAVE_LIBTSK + +#include <tsk/libtsk.h> + +static int open_filesystem (const char *, TSK_IMG_INFO **, TSK_FS_INFO **); +static TSK_WALK_RET_ENUM fswalk_callback (TSK_FS_FILE *, const char *, void *); +static char file_type (TSK_FS_FILE *); +static int send_dirent_info (guestfs_int_tsk_dirent *); +static void reply_with_tsk_error (const char *); + +int +do_internal_filesystem_walk (const mountable_t *mountable) +{ + int ret = -1; + TSK_FS_INFO *fs = NULL; + TSK_IMG_INFO *img = NULL; /* Used internally by tsk_fs_dir_walk */ + int flags = TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC | + TSK_FS_DIR_WALK_FLAG_RECURSE | TSK_FS_DIR_WALK_FLAG_NOORPHAN; + + ret = open_filesystem (mountable->device, &img, &fs); + if (ret < 0) + return ret; + + reply (NULL, NULL); /* Reply message. */ + + ret = tsk_fs_dir_walk (fs, fs->root_inum, flags, fswalk_callback, NULL); + if (ret == 0) + ret = send_file_end (0); /* File transfer end. */ + else + send_file_end (1); /* Cancel file transfer. */ + + fs->close (fs); + img->close (img); + + return ret; +} + +/* Inspect the device and initialises the img and fs structures. + * Return 0 on success, -1 on error. + */ +static int +open_filesystem (const char *device, TSK_IMG_INFO **img, TSK_FS_INFO **fs) +{ + const char *images[] = { device }; + + *img = tsk_img_open (1, images, TSK_IMG_TYPE_DETECT , 0);

Extra space here ... ^

+ if (*img == NULL) { + reply_with_tsk_error ("tsk_image_open"); + return -1; + } + + *fs = tsk_fs_open_img (*img, 0, TSK_FS_TYPE_DETECT); + if (*fs == NULL) { + reply_with_tsk_error ("tsk_fs_open_img"); + (*img)->close (*img); + return -1; + } + + return 0; +} + +/* Filesystem walk callback, it gets called on every FS node. + * Parse the node, encode it into an XDR structure and send it to the appliance. + * Return TSK_WALK_CONT on success, TSK_WALK_ERROR on error. + */ +static TSK_WALK_RET_ENUM +fswalk_callback (TSK_FS_FILE *fsfile, const char *path, void *data) +{ + int ret = 0; + CLEANUP_FREE char *fname = NULL; + struct guestfs_int_tsk_dirent dirent; + + /* Ignore ./ and ../ */ + ret = TSK_FS_ISDOT (fsfile->name->name); + if (ret != 0) + return TSK_WALK_CONT; + + /* Build the full relative path of the entry */ + ret = asprintf_nowarn (&fname, "%s%s", path, fsfile->name->name);

Since there are no more custom printf formatters, then plain asprintf can be used again, so we get GCC warnings on formats/arguments mismatches.

+ if (ret < 0) { + fprintf (stderr, "asprintf: %m");

perror ("asprintf") does the same, i.e. print a message and the string representation of errno on stderr.

+ return TSK_WALK_ERROR; + } + + dirent.tsk_inode = fsfile->name->meta_addr; + dirent.tsk_type = file_type (fsfile); + dirent.tsk_size = (fsfile->meta != NULL) ? fsfile->meta->size : -1; + dirent.tsk_name = fname; + dirent.tsk_allocated = !(fsfile->name->flags & TSK_FS_NAME_FLAG_UNALLOC); + + ret = send_dirent_info (&dirent); + ret = (ret == 0) ? TSK_WALK_CONT : TSK_WALK_ERROR; + + return ret; +} + +/* Inspect fsfile to identify its type. */ +static char +file_type(TSK_FS_FILE *fsfile)

Missing ^ space.

+{ + if (fsfile->name->type < TSK_FS_NAME_TYPE_STR_MAX) + switch(fsfile->name->type) { + case TSK_FS_NAME_TYPE_UNDEF: return 'u'; + case TSK_FS_NAME_TYPE_FIFO: return 'f'; + case TSK_FS_NAME_TYPE_CHR: return 'c'; + case TSK_FS_NAME_TYPE_DIR: return 'd'; + case TSK_FS_NAME_TYPE_BLK: return 'b'; + case TSK_FS_NAME_TYPE_REG: return 'r'; + case TSK_FS_NAME_TYPE_LNK: return 'l'; + case TSK_FS_NAME_TYPE_SOCK: return 's'; + case TSK_FS_NAME_TYPE_SHAD: return 'h'; + case TSK_FS_NAME_TYPE_WHT: return 'w'; + case TSK_FS_NAME_TYPE_VIRT: return 'u'; /* Temp files created by TSK */ + default: return 'u';

I'd move the fallback outsize the default of the switch, so the switch has only cases for existing enum values.

+ } + else if (fsfile->meta != NULL && + fsfile->meta->type < TSK_FS_META_TYPE_STR_MAX) + switch(fsfile->name->type) { + case TSK_FS_META_TYPE_REG: return 'r'; + case TSK_FS_META_TYPE_DIR: return 'd'; + case TSK_FS_META_TYPE_FIFO: return 'f'; + case TSK_FS_META_TYPE_CHR: return 'c'; + case TSK_FS_META_TYPE_BLK: return 'b'; + case TSK_FS_META_TYPE_LNK: return 'l'; + case TSK_FS_META_TYPE_SHAD: return 'h'; + case TSK_FS_META_TYPE_SOCK: return 's'; + case TSK_FS_META_TYPE_WHT: return 'w'; + case TSK_FS_META_TYPE_VIRT: return 'u'; /* Temp files created by TSK */ + default: return 'u';

Ditto.

+ } + else + return 'u'; +} + +/* Serialise dirent into XDR stream and send it to the appliance. + * Return 0 on success, -1 on error. + */ +static int +send_dirent_info (guestfs_int_tsk_dirent *dirent) +{ + XDR xdr; + size_t len = 0; + bool_t ret = FALSE; + CLEANUP_FREE char *buf;

Make sure to always initialize CLEANUP_* variables: in this case there is nothing between the declaration and the initialization of 'buf', but if something that returns earlier is added between them, then it will cause the handler run by CLEANUP_FREE to try to free an uninitialized pointer.

+ + buf = malloc (GUESTFS_MAX_CHUNK_SIZE); + if (buf == NULL) { + fprintf (stderr, "malloc: %m");

perror

+ return -1; + } + + /* Serialise tsk_dirent struct. */ + xdrmem_create (&xdr, buf, GUESTFS_MAX_CHUNK_SIZE, XDR_ENCODE); + + ret = xdr_guestfs_int_tsk_dirent(&xdr, dirent);

Missing space here ... ^

+ if (ret == FALSE) { + fprintf (stderr, "xdr_guestfs_int_tsk_dirent: %m");

perror

+ return -1; + } + + /* Resize buffer to actual length. */ + len = xdr_getpos (&xdr); + xdr_destroy (&xdr); + buf = realloc (buf, len);

Why do you need to shrink the buffer? After all, send_file_write gets amount of bytes to send back to the library. Thanks, -- Pino Toscano

"appliance: Added filesystem_walk command" -> "New API: filesystem_walk" On Tuesday 05 April 2016 18:47:31 Matteo Cafasso wrote:

The filesystem_walk command is the appliance's counterpart of the daemon's internal_filesystem_walk command.

It is not the counterpart in the appliance, but in the library. The appliance is the small VM used to do all the operations with the disk images, and the guestfsd daemon runs there. This non-daemon API exists only in the library, hence in userspace.

It writes the daemon's command output on a temporary file and parses it, deserialising the XDR formatted tsk_dirent structs.

It returns to the caller the list of tsk_dirent structs generated by the internal_filesystem_walk command.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- generator/actions.ml | 69 +++++++++++++++++++++++++++++ src/Makefile.am | 1 + src/tsk.c | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 193 insertions(+) create mode 100644 src/tsk.c

diff --git a/generator/actions.ml b/generator/actions.ml index 8073370..afff402 100644 --- a/generator/actions.ml +++ b/generator/actions.ml @@ -3546,6 +3546,75 @@ The environment variable C<XDG_RUNTIME_DIR> controls the default value: If C<XDG_RUNTIME_DIR> is set, then that is the default. Else F</tmp> is the default." };

+ { defaults with + name = "filesystem_walk"; added = (1, 33, 18); + style = RStructList ("dirents", "tsk_dirent"), [Mountable "device";], []; + optional = Some "libtsk"; + progress = true; cancellable = true; + shortdesc = "walk through the filesystem content"; + longdesc = "\ +Walk through the internal structures of a disk partition +(eg. F</dev/sda1>) in order to return a list of all the files +and directories stored within. + +It is not necessary to mount the disk partition to run this command. + +All entries in the filesystem are returned, excluding C<.> and +C<..>. This function can list deleted or unaccessible files. +The entries are I<not> sorted. + +If the entry is not allocated (ex: it has been deleted), +its inode, type or size might not be recovered correctly. +In such case, the inode might be 0, the size might be -1 and the type +might be unidentified 'u'.

Use POD C<..> for the special values 0, -1, 'u'.

+This call returns as well basic file type information about each +file. The C<tsk_type> field will contain one of the following characters: + +=over 4 + +=item 'b' + +Block special + +=item 'c' + +Char special + +=item 'd' + +Directory + +=item 'f' + +FIFO (named pipe) + +=item 'l' + +Symbolic link + +=item 'r' + +Regular file + +=item 's' + +Socket + +=item 'h' + +Shadow inode (Solaris) + +=item 'w' + +Whiteout inode (BSD) + +=item 'u' + +Unknown file type + +=back" }; + ]

(* daemon_functions are any functions which cause some action diff --git a/src/Makefile.am b/src/Makefile.am index 3b4cd10..9f8af4c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -130,6 +130,7 @@ libguestfs_la_SOURCES = \ structs-copy.c \ structs-free.c \ tmpdirs.c \ + tsk.c \ whole-file.c \ libguestfs.syms

diff --git a/src/tsk.c b/src/tsk.c new file mode 100644 index 0000000..4d7fd7c --- /dev/null +++ b/src/tsk.c @@ -0,0 +1,123 @@ +/* libguestfs + * Copyright (C) 2016 Red Hat Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> +#include <fcntl.h> +#include <unistd.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <string.h> +#include <rpc/xdr.h> +#include <rpc/types.h> + +#include "full-read.h" + +#include "guestfs.h" +#include "guestfs_protocol.h" +#include "guestfs-internal.h" +#include "guestfs-internal-all.h" +#include "guestfs-internal-actions.h" + +static struct guestfs_tsk_dirent_list *parse_filesystem_walk (guestfs_h *, char *, size_t );

Extra space at the end.

+int deserialise_dirent_list (guestfs_h *, char *, size_t , struct guestfs_tsk_dirent_list *);

deserialise_dirent_list can be static.

+ +struct guestfs_tsk_dirent_list * +guestfs_impl_filesystem_walk (guestfs_h *g, const char *mountable) +{ + int ret = 0; + size_t size = 0; + CLEANUP_FREE char *buf = NULL; + CLEANUP_UNLINK_FREE char *tmpfile = NULL; + + ret = guestfs_int_lazy_make_tmpdir (g); + if (ret < 0) + return NULL; + + tmpfile = safe_asprintf (g, "%s/filesystem_walk%d", g->tmpdir, ++g->unique); + + ret = guestfs_internal_filesystem_walk (g, mountable, tmpfile); + if (ret < 0) + return NULL; + + ret = guestfs_int_read_whole_file (g, tmpfile, &buf, &size);

I think there should be checks for the size of the downloaded file, to avoid reading too much.

+ if (ret < 0) + return NULL; + + return parse_filesystem_walk (g, buf, size); /* caller frees */ +} + +/* Parse buf content and return dirents list. + * Return a list of tsk_dirent on success, NULL on error. + */ +static struct guestfs_tsk_dirent_list * +parse_filesystem_walk (guestfs_h *g, char *buf, size_t bufsize) +{ + int ret = 0; + struct guestfs_tsk_dirent_list *dirents = NULL; + + /* Initialise results array. */ + dirents = safe_malloc (g, sizeof (*dirents)); + dirents->len = 8; + dirents->val = safe_malloc (g, dirents->len * sizeof (*dirents->val)); + + /* Deserialise buffer into dirent list. */ + ret = deserialise_dirent_list (g, buf, bufsize, dirents); + if (ret < 0) { + guestfs_free_tsk_dirent_list (dirents); + return NULL; + } + + return dirents; +} + +/* Deserialise buf content and populate the dirent list. + * Return the number of deserialised dirents, -1 on error. + */ +int +deserialise_dirent_list (guestfs_h *g, char *buf, size_t bufsize, + struct guestfs_tsk_dirent_list *dirents) +{ + XDR xdr; + bool_t ret = 0; + uint32_t index = 0; + + xdrmem_create (&xdr, buf, bufsize, XDR_DECODE); + + for (index = 0; xdr_getpos (&xdr) < bufsize; index++) { + if (index == dirents->len) { + dirents->len = 2 * dirents->len; + dirents->val = safe_realloc (g, dirents->val, + dirents->len * + sizeof (*dirents->val)); + } + + memset(&dirents->val[index], 0, sizeof (*dirents->val));

I think this should not be needed at all, the XDR decoding should set every field in the struct.

+ ret = xdr_guestfs_int_tsk_dirent(&xdr, (guestfs_int_tsk_dirent *)

Why is "(guestfs_int_tsk_dirent *)" needed? (Also, missing space.) Thanks, -- Pino Toscano

On 05/04/16 20:33, Pino Toscano wrote:

On Tuesday 05 April 2016 18:47:32 Matteo Cafasso wrote:

...

The tests check that the filesystem_walk command is able to retrieve information regarding both existing and deleted files.

A NTFS image is used as Ext3+ filesystems deletion is more aggressive in terms of metadata removal.

Signed-off-by: Matteo Cafasso <noxdafox@gmail.com> --- tests/tsk/Makefile.am | 3 +- tests/tsk/test-filesystem-walk.sh | 62 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+), 1 deletion(-) create mode 100755 tests/tsk/test-filesystem-walk.sh

diff --git a/tests/tsk/Makefile.am b/tests/tsk/Makefile.am index 0cd7c03..f9b2fef 100644 --- a/tests/tsk/Makefile.am +++ b/tests/tsk/Makefile.am @@ -18,7 +18,8 @@ include $(top_srcdir)/subdir-rules.mk

TESTS = \ - test-download-inode.sh + test-download-inode.sh \ + test-filesystem-walk.sh

TESTS_ENVIRONMENT = $(top_builddir)/run --test

diff --git a/tests/tsk/test-filesystem-walk.sh b/tests/tsk/test-filesystem-walk.sh new file mode 100755 index 0000000..ab7c1a9 --- /dev/null +++ b/tests/tsk/test-filesystem-walk.sh @@ -0,0 +1,62 @@ +#!/bin/bash - +# libguestfs +# Copyright (C) 2016 Red Hat Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +# Test the filesystem-walk command. + +if [ -n "$SKIP_TEST_FILESYSTEM_WALK_SH" ]; then + echo "$0: test skipped because environment variable is set." + exit 77 +fi + +# Skip if TSK is not supported by the appliance. +if ! guestfish add /dev/null : run : available "libtsk"; then + echo "$0: skipped because TSK is not available in the appliance" + exit 77 +fi + +if [ ! -s ../../test-data/phony-guests/windows.img ]; then + echo "$0: skipped because windows.img is zero-sized" + exit 77 +fi + +# create and delete a file then list the filesystem content +output=$(guestfish --ro -a ../../test-data/phony-guests/windows.img \ + run : \ + mount /dev/sda2 / : \ + write /test.txt "foobar" : \ + rm /test.txt : \ + umount / : \ + filesystem-walk /dev/sda2) This is a bit unreadable, a better approach is to read commands from stdin; see for example fish/test-copy.sh.

...

+ +# test $MFT is in the list +echo $output | grep -q "{ tsk_inode: 0 tsk_type: r tsk_size: .* tsk_name: \$MFT tsk_allocated: 1 }" Hmm are you sure this works when tracing is disabled? The default output in guestfish for structs is each field in a single line.

I tried it without tracing and it works as well. Just to be sure, I'll add the -z flag to grep to ignore newlines.

Unless you compare the whole output like other tests do, a better solution could be write this test using a scripting language like Perl: I think most, if not all, of the non-bash tests are Perl-based, and it would allow to do better checks for the return values.

I'm not familiar with Perl therefore it would require a bit more of time for little value. I could do it in Python but I believe bash for such simple cases is way more readable and effective.

Thanks,

_______________________________________________ Libguestfs mailing list Libguestfs@redhat.com https://www.redhat.com/mailman/listinfo/libguestfs