Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve DHCP IP address parsing speed for journal #687

Merged

Conversation

JSCU-CNI
Copy link
Contributor

This PR aims to improve DHCP parsing logic introduced in #550. Unfortunately the previous approach makes interactive commands such as target-info slow. We have opted to only parse the first 10000 journal log messages for DHCP IP address leases by default. This can be extended with the flag --dhcp-all.

@Horofic Horofic self-requested a review April 19, 2024 14:22
@JSCU-CNI
Copy link
Contributor Author

Hi @Horofic could you take a look at this PR? This fix makes sure target-info does not take up to two hours to complete :)

Copy link
Contributor

@Horofic Horofic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apologies for the (significantly) delayed review. This slipped through, as I somehow forgot to press the submit review button

@@ -33,15 +33,16 @@ def detect(cls, target: Target) -> Optional[Filesystem]:
return None

@export(property=True)
def ips(self) -> list[str]:
@arg("--dhcp-all", action="store_true", help="parse all syslog, messages and journal files for DHCP IP addresses")
def ips(self, dhcp_all: bool = False) -> list[str]:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a test to test this new behaviour?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added test in ab47074. It seems that there is a bug in the @arg decorator. The documentation states This decorator adds the ``__args__`` private attribute to a method or property., however it does not seem to add __args__ for this exported property.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is inherit to properties, so no arguments can be passed to it. This might be incorrectly be reflected in the documentation.

Also, I remembered a similar discussion in #133 where we talked about a similar change where we decided to move it to ips_dhcp in the meantime. It might be a good idea to move towards this again, to avoid the t.ip vs t.ips() inconsistency across OSes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps if the parsed argparse args are available somewhere in the self.target instance we could still check for provided arguments at runtime.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll raise this discussion in the team and get back to you!

Copy link
Member

@Schamper Schamper Jul 31, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had a brief discussion and decided that's not an ideal solution. You can execute multiple functions, and each function can have it's own argument parser. There's no "one big" set of parsed arguments available at runtime, each plugin only gets to see its own set of parsed argument that matched its defined arguments.

For something like properties I think it'd be better to use dependency injection, but that's non-trivial to add and we rarely use properties anyway, so I fear it may be a bit of a waste to add support for that.

For this specific case we expect this to be resolved by the network interface rework that's been in the planning for a while, described in #774 ( epic:network interfaces plugin ).

An alternative to ips_dhcp to work around this issue in the meantime is to (ab)use the target configuration system. At the moment, this can be used by placing a file called .targetcfg.py in the same directory (or parents) of a target, and storing a variable like UNIX_IPS_DHCP = True in there. You can access this through target._config.UNIX_IPS_DHCP in the code. Note that this behaves like a module type so you may need to getattr. We're open to improvements to this config system by the way, e.g. adding support for environment variables (#771, #772).

Or revert back to ips_dhcp 😄 but both of these will be temporary workarounds.

Copy link
Contributor Author

@JSCU-CNI JSCU-CNI Jul 31, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Those are some good options, will look into that. For now we're fine with leaving dhcp_all out of ips, as changed in a862b2e.

@Horofic
Copy link
Contributor

Horofic commented Jul 19, 2024

It also seems like to the test_ips_dhcp now fails.

@Horofic Horofic self-assigned this Jul 19, 2024
@JSCU-CNI JSCU-CNI requested a review from Horofic July 24, 2024 10:06
@JSCU-CNI
Copy link
Contributor Author

It also seems like to the test_ips_dhcp now fails.

Those should now be fixed!

@JSCU-CNI JSCU-CNI requested a review from Horofic August 1, 2024 08:30
Copy link

codecov bot commented Aug 1, 2024

Codecov Report

Attention: Patch coverage is 82.35294% with 3 lines in your changes missing coverage. Please review.

Project coverage is 75.24%. Comparing base (11afdf0) to head (8851f13).

Files Patch % Lines
dissect/target/helpers/network_managers.py 81.25% 3 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #687      +/-   ##
==========================================
+ Coverage   75.21%   75.24%   +0.03%     
==========================================
  Files         296      296              
  Lines       25422    25434      +12     
==========================================
+ Hits        19121    19139      +18     
+ Misses       6301     6295       -6     
Flag Coverage Δ
unittests 75.24% <82.35%> (+0.03%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@Horofic Horofic merged commit 793cfc6 into fox-it:main Aug 1, 2024
18 checks passed
@JSCU-CNI JSCU-CNI deleted the improvement/dhcp-ip-parsing-journal-speed branch August 1, 2024 11:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants