コード例 #1
0
  def _ParseFileData(self, knowledge_base, file_object):
    """Parses file content (data) for a hostname preprocessing attribute.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      file_object (dfvfs.FileIO): file-like object that contains the artifact
          value data.

    Returns:
      bool: True if all the preprocessing attributes were found and
          the preprocessor plugin is done.

    Raises:
      errors.PreProcessFail: if the preprocessing fails.
    """
    result = False
    text_file_object = dfvfs_text_file.TextFile(file_object)
    hostname = text_file_object.readline()

    try:
      hostname = hostname.decode('utf-8')
    except UnicodeDecodeError:
      # TODO: add and store preprocessing errors.
      hostname = hostname.decode('utf-8', errors='replace')

    hostname = hostname.strip()
    if hostname:
      hostname_artifact = artifacts.HostnameArtifact(name=hostname)
      knowledge_base.SetHostname(hostname_artifact)
      result = True

    return result
コード例 #2
0
ファイル: artifacts.py プロジェクト: vishalbelsare/plaso
  def testGetAttributeNames(self):
    """Tests the GetAttributeNames function."""
    attribute_container = artifacts.HostnameArtifact()

    expected_attribute_names = ['name', 'schema']

    attribute_names = sorted(attribute_container.GetAttributeNames())
    self.assertEqual(attribute_names, expected_attribute_names)
コード例 #3
0
ファイル: mediator.py プロジェクト: william-billaud/plaso
    def setUp(self):
        """Makes preparations before running an individual test."""
        knowledge_base_object = knowledge_base.KnowledgeBase()

        hostname_artifact = artifacts.HostnameArtifact(name='myhost')
        knowledge_base_object.SetHostname(hostname_artifact)

        self._output_mediator = mediator.OutputMediator(
            knowledge_base_object, None)
コード例 #4
0
    def testCopyToDict(self):
        """Tests the CopyToDict function."""
        attribute_container = artifacts.HostnameArtifact(name=u'mydomain.com')

        self.assertEqual(attribute_container.name, u'mydomain.com')

        expected_dict = {u'name': u'mydomain.com', u'schema': u'DNS'}

        test_dict = attribute_container.CopyToDict()

        self.assertEqual(test_dict, expected_dict)
コード例 #5
0
ファイル: artifacts.py プロジェクト: olivierh59500/plaso
    def testCopyToDict(self):
        """Tests the CopyToDict function."""
        hostname = artifacts.HostnameArtifact(name=u'mydomain.com')

        self.assertEquals(hostname.name, u'mydomain.com')

        expected_dict = {u'name': u'mydomain.com', u'schema': u'DNS'}

        hostname_dict = hostname.CopyToDict()

        self.assertEqual(hostname_dict, expected_dict)
コード例 #6
0
ファイル: macos.py プロジェクト: cshanahan/plaso
    def _ParsePlistKeyValue(self, mediator, name, value):
        """Parses a plist key value.

    Args:
      mediator (PreprocessMediator): mediates interactions between preprocess
          plugins and other components, such as storage and knowledge base.
      name (str): name of the plist key.
      value (str): value of the plist key.
    """
        if name in self._PLIST_KEYS:
            hostname_artifact = artifacts.HostnameArtifact(name=value)
            mediator.AddHostname(hostname_artifact)
コード例 #7
0
    def _ParsePlistKeyValue(self, knowledge_base, name, value):
        """Parses a plist key value.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      name (str): name of the plist key.
      value (str): value of the plist key.
    """
        if not knowledge_base.GetHostname():
            if name in self._PLIST_KEYS:
                hostname_artifact = artifacts.HostnameArtifact(name=value)
                knowledge_base.SetHostname(hostname_artifact)
コード例 #8
0
    def _ParseValue(self, knowledge_base, name, value):
        """Parses a plist key value.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      name (str): name of the plist key.
      value (str): value of the plist key.
    """
        if name not in self._PLIST_KEYS:
            return

        hostname_artifact = artifacts.HostnameArtifact(name=value)
        # TODO: refactor the use of store number.
        hostname_artifact.store_number = 0
        knowledge_base.SetHostname(hostname_artifact)
コード例 #9
0
    def _ParsePlistKeyValue(self, knowledge_base, name, value):
        """Parses a plist key value.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      name (str): name of the plist key.
      value (str): value of the plist key.

    Returns:
      bool: True if all the preprocessing attributes were found and
          the preprocessor plugin is done.
    """
        if name in self._PLIST_KEYS:
            hostname_artifact = artifacts.HostnameArtifact(name=value)
            knowledge_base.SetHostname(hostname_artifact)

        return name in self._PLIST_KEYS
コード例 #10
0
ファイル: knowledge_base.py プロジェクト: vishalbelsare/plaso
  def testReadSystemConfigurationArtifact(self):
    """Tests the ReadSystemConfigurationArtifact function."""
    knowledge_base_object = knowledge_base.KnowledgeBase()

    system_configuration = artifacts.SystemConfigurationArtifact()
    system_configuration.hostname = artifacts.HostnameArtifact(
        name='myhost.mydomain')

    user_account = artifacts.UserAccountArtifact(
        identifier='1000', user_directory='/home/testuser',
        username='******')
    system_configuration.user_accounts.append(user_account)

    knowledge_base_object.ReadSystemConfigurationArtifact(system_configuration)

    hostname = knowledge_base_object.GetHostname()
    self.assertEqual(hostname, 'myhost.mydomain')
コード例 #11
0
ファイル: knowledge_base.py プロジェクト: vishalbelsare/plaso
  def testGetSystemConfigurationArtifact(self):
    """Tests the GetSystemConfigurationArtifact function."""
    knowledge_base_object = knowledge_base.KnowledgeBase()

    hostname_artifact = artifacts.HostnameArtifact(name='myhost.mydomain')
    knowledge_base_object.SetHostname(hostname_artifact)

    user_account = artifacts.UserAccountArtifact(
        identifier='1000', user_directory='/home/testuser',
        username='******')
    knowledge_base_object.AddUserAccount(user_account)

    system_configuration = (
        knowledge_base_object.GetSystemConfigurationArtifact())
    self.assertIsNotNone(system_configuration)
    self.assertIsNotNone(system_configuration.hostname)
    self.assertEqual(system_configuration.hostname.name, 'myhost.mydomain')
コード例 #12
0
ファイル: windows.py プロジェクト: marcurdy/plaso
    def _ParseValueData(self, knowledge_base, value_data):
        """Parses Windows Registry value data for a preprocessing attribute.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      value_data (object): Windows Registry value data.

    Raises:
      errors.PreProcessFail: if the value data is not a string type.
    """
        if not isinstance(value_data, py2to3.UNICODE_TYPE):
            raise errors.PreProcessFail(
                u'Unsupported Registry key: {0:s}, value: {1:s} type: {2:s}.'.
                format(self._REGISTRY_KEY_PATH, self._REGISTRY_VALUE_NAME,
                       type(value_data)))

        hostname_artifact = artifacts.HostnameArtifact(name=value_data)
        knowledge_base.SetHostname(hostname_artifact)
コード例 #13
0
  def _ParseFileData(self, knowledge_base, file_object):
    """Parses file content (data) for a hostname preprocessing attribute.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      file_object (dfvfs.FileIO): file-like object that contains the artifact
          value data.

    Raises:
      errors.PreProcessFail: if the preprocessing fails.
    """
    text_file_object = dfvfs_text_file.TextFile(file_object, encoding='utf-8')

    if not knowledge_base.GetHostname():
      hostname = text_file_object.readline()
      hostname = hostname.strip()
      if hostname:
        hostname_artifact = artifacts.HostnameArtifact(name=hostname)
        knowledge_base.SetHostname(hostname_artifact)
コード例 #14
0
    def _ParseValueData(self, knowledge_base, value_data):
        """Parses Windows Registry value data for a preprocessing attribute.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      value_data (object): Windows Registry value data.

    Raises:
      errors.PreProcessFail: if the preprocessing fails.
    """
        if not isinstance(value_data, py2to3.UNICODE_TYPE):
            raise errors.PreProcessFail(
                'Unsupported Windows Registry value type: {0:s} for '
                'artifact: {1:s}.'.format(type(value_data),
                                          self.ARTIFACT_DEFINITION_NAME))

        if not knowledge_base.GetHostname():
            hostname_artifact = artifacts.HostnameArtifact(name=value_data)
            knowledge_base.SetHostname(hostname_artifact)
コード例 #15
0
  def _ParseFileObject(self, knowledge_base, file_object):
    """Parses a hostname file-like object.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      file_object (dfvfs.FileIO): file-like object.
    """
    text_file_object = text_file.TextFile(file_object)
    hostname = text_file_object.readline()

    try:
      hostname = hostname.decode(u'utf-8')
    except UnicodeDecodeError:
      # TODO: add and store preprocessing errors.
      hostname = hostname.decode(u'utf-8', errors=u'replace')

    hostname = hostname.strip()
    if hostname:
      hostname_artifact = artifacts.HostnameArtifact(name=hostname)
      knowledge_base.SetHostname(hostname_artifact)
コード例 #16
0
ファイル: linux.py プロジェクト: cshanahan/plaso
    def _ParseFileData(self, mediator, file_object):
        """Parses file content (data) for a hostname preprocessing attribute.

    Args:
      mediator (PreprocessMediator): mediates interactions between preprocess
          plugins and other components, such as storage and knowledge base.
      file_object (dfvfs.FileIO): file-like object that contains the artifact
          value data.

    Raises:
      errors.PreProcessFail: if the preprocessing fails.
    """
        text_file_object = dfvfs_text_file.TextFile(file_object,
                                                    encoding='utf-8')

        hostname = text_file_object.readline()
        hostname = hostname.strip()
        if hostname:
            hostname_artifact = artifacts.HostnameArtifact(name=hostname)
            mediator.AddHostname(hostname_artifact)
コード例 #17
0
    def _ParseValueData(self, mediator, value_data):
        """Parses Windows Registry value data for a preprocessing attribute.

    Args:
      mediator (PreprocessMediator): mediates interactions between preprocess
          plugins and other components, such as storage and knowledge base.
      value_data (object): Windows Registry value data.

    Raises:
      errors.PreProcessFail: if the preprocessing fails.
    """
        if not isinstance(value_data, str):
            if not hasattr(value_data, '__iter__'):
                raise errors.PreProcessFail(
                    'Unsupported Windows Registry value type: {0!s} for '
                    'artifact: {1:s}.'.format(type(value_data),
                                              self.ARTIFACT_DEFINITION_NAME))

            # If the value data is a multi string only use the first string.
            value_data = value_data[0]

        hostname_artifact = artifacts.HostnameArtifact(name=value_data)
        mediator.AddHostname(hostname_artifact)
コード例 #18
0
ファイル: windows.py プロジェクト: ylwb/plaso
    def _ParseValueData(self, knowledge_base, value_data):
        """Parses Windows Registry value data for a preprocessing attribute.

    Args:
      knowledge_base (KnowledgeBase): to fill with preprocessing information.
      value_data (object): Windows Registry value data.

    Raises:
      errors.PreProcessFail: if the preprocessing fails.
    """
        if not isinstance(value_data, str):
            if not hasattr(value_data, '__iter__'):
                raise errors.PreProcessFail(
                    'Unsupported Windows Registry value type: {0!s} for '
                    'artifact: {1:s}.'.format(type(value_data),
                                              self.ARTIFACT_DEFINITION_NAME))

            # If the value data is a multi string only use the first string.
            value_data = value_data[0]

        if not knowledge_base.GetHostname():
            hostname_artifact = artifacts.HostnameArtifact(name=value_data)
            knowledge_base.SetHostname(hostname_artifact)
コード例 #19
0
  def setUp(self):
    """Makes preparations before running an individual test."""
    self._knowledge_base = knowledge_base.KnowledgeBase()

    hostname_artifact = artifacts.HostnameArtifact(name='myhost')
    self._knowledge_base.SetHostname(hostname_artifact)
コード例 #20
0
    def testSetHostname(self):
        """Tests the SetHostname function."""
        knowledge_base_object = knowledge_base.KnowledgeBase()

        hostname_artifact = artifacts.HostnameArtifact(name='myhost.mydomain')
        knowledge_base_object.SetHostname(hostname_artifact)