Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{ID}\\DhcpNameServer may contain multiple ips, separated by a space #951

Open
wbi-ocd opened this issue Nov 19, 2024 · 1 comment
Labels
bug Something isn't working core Related to a core component of dissect.target good first issue Good for newcomers

Comments

@wbi-ocd
Copy link

wbi-ocd commented Nov 19, 2024

DhcpNameServer may contain a list of server, separated by a space, causing the following error (crash) when the ips plugins is used :

ValueError: '172.16.0.3 172.16.0.4 does not appear to be an IPv4 or IPv6 address

Debug trace shows than these two IPS are considered as one element and not two element of the set

│ in __init__:38                                                                                   │
│ ╭─────────────────────────────────────────── locals ───────────────────────────────────────────╮ │
│ │                  _classification = None                                                      │ │
│ │                       _generated = None                                                      │ │
│ │                          _source = PosixPath('CENSORED')       │ │
│ │                         _version = None                                                      │ │
│ │ _windows_network_interface__self = <repr-error "'windows_network_interface' object has no    │ │
│ │                                    attribute 'dns'">                                         │ │
│ │                             dhcp = True                                                      │ │
│ │                              dns = {'172.16.0.3 172.16.0.4'}   

A simple fix would be to split on space when the value contains space :

dhcp_config["dns"].update(_get_config_value(key, "DhcpNameServer"))

@Horofic Horofic added bug Something isn't working core Related to a core component of dissect.target good first issue Good for newcomers labels Nov 19, 2024
@wbi-ocd
Copy link
Author

wbi-ocd commented Nov 20, 2024

I have made some test and the following line key may also cause bugs :

This look like a regression related to 90cbaac#diff-a8cdba395abca9f908bbf562e9a7f94c37e2bed16994171b11e08e45e17333eaL311 , as a split was done before.

I will make a PR

wbi-ocd added a commit to wbi-ocd/dissect.target that referenced this issue Nov 20, 2024
add optional params to _get_config_value to split value according to a list of character
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working core Related to a core component of dissect.target good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

2 participants