Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support dnsinfo and nwi custom objects #10

Open
puffyCid opened this issue Jun 17, 2023 · 1 comment
Open

Support dnsinfo and nwi custom objects #10

puffyCid opened this issue Jun 17, 2023 · 1 comment

Comments

@puffyCid
Copy link
Collaborator

Describe the issue
While reviewing statedump events, two new custom objects were identified:

  • dnsinfo
  • nwi

These events show up when the statedump event type is 3 (which is custom object)
Both seem to be part of macOS configd daemon.

dnsinfo seems to be a structure containing dns_config_t information
https://opensource.apple.com/source/configd/configd-596.12/dnsinfo/dnsinfo.h.auto.html

Brief snippet

== StateDump ===========================================================
chunk 393:          tag:0x6003, subtag:0x0000, length:1748
proc_id:            105@248
cur_aid:            80000000000405d0
timestamp:          317922751662556
ttl:                14
sender:             26CB0BA5-A028-3160-8AA9-2925793D202E
State Data:         
    title:          DNS Configuration
    size:           1500
    type:           3 / custom
    decoder library:SystemConfiguration, decoder type dnsinfo

DNS configuration

resolver #1
  search domain[0] : lan
  nameserver[0] : 192.168.1.1
  if_index : 6 (en0)
  flags    : 0x00000002 (Request A records)
  reach    : 0x00020002 (Reachable,Directly Reachable Address)
  config id: Default: 0

resolver #2
  domain   : local
  options  : mdns
  timeout  : 5
  flags    : 0x00000002 (Request A records)
  reach    : 0x00000000 (Not Reachable)
  order    : 300000
  config id: Multicast DNS: 0
....

nwi I have not looked into much but appears to contain info about the network interface
Further info about this structure might found under:
https://opensource.apple.com/source/configd/configd-1109.60.2/nwi/

Brief snippet:

== StateDump ===========================================================
chunk 22390:        tag:0x6003, subtag:0x0000, length:1200
proc_id:            105@248
cur_aid:            80000000000405d0
timestamp:          317922751664855
ttl:                14
sender:             26CB0BA5-A028-3160-8AA9-2925793D202E
State Data:         
    title:          Network information
    size:           952
    type:           3 / custom
    decoder library:SystemConfiguration, decoder type nwi

Network information (generation 32469211037191 size=952)
IPv4 network interface information
     en0 : flags      : 0x5 (IPv4,DNS)
           address    : 192.168.1.231
           reach      : 0x00000002 (Reachable)
           rank       : 0x01000001 (Default, 1)
           signature  : {length = 20, bytes = 0x4fbc10c583230625d1e54cf00f8d51a12b9f20a3}
           generation : 32469211037191
   REACH : flags 0x00000002 (Reachable)
...

Steps to quickly reproduce:

  1. Collect logs on system sudo log collect. This should output system_logs.logarchive
  2. Examine the contents of system_logs.logarchive and delete all logs in Persist and Signpost directories. This will make parsing even faster
  3. Run latest version of unifiedlog_parser example
  4. Review output.csv for any results with: Unsupported Statedump object: DNS Configuration-AAAA.... or Unsupported Statedump object: Network information-AQYXIAQAAA...

The log command can be used to further examine the collected logarchive

Expected behavior
macos-unifiedlogs parses the custom objects correctly

Actual behavior
Currently we just base64 encode the data

@puffyCid
Copy link
Collaborator Author

For parsing these objects it will likely require another decoder under src/decoders/
Since these objects are part of the configd daemon, probably best to put them in a separate file like decoders/configs.rs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant