HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{ID}\\DhcpNameServer may contain multiple ips, separated by a space

[wbi-ocd]

DhcpNameServer may contain a list of server, separated by a space, causing the following error (crash) when the ips plugins is used :

ValueError: '172.16.0.3 172.16.0.4 does not appear to be an IPv4 or IPv6 address

Debug trace shows than these two IPS are considered as one element and not two element of the set

│ in __init__:38                                                                                   │
│ ╭─────────────────────────────────────────── locals ───────────────────────────────────────────╮ │
│ │                  _classification = None                                                      │ │
│ │                       _generated = None                                                      │ │
│ │                          _source = PosixPath('CENSORED')       │ │
│ │                         _version = None                                                      │ │
│ │ _windows_network_interface__self = <repr-error "'windows_network_interface' object has no    │ │
│ │                                    attribute 'dns'">                                         │ │
│ │                             dhcp = True                                                      │ │
│ │                              dns = {'172.16.0.3 172.16.0.4'}   

A simple fix would be to split on space when the value contains space :

dissect.target/dissect/target/plugins/os/windows/network.py

Line 357 in d6eb12e

dhcp_config["dns"].update(_get_config_value(key, "DhcpNameServer"))

[wbi-ocd]

I have made some test and the following line key may also cause bugs :

• static_config["dns"].update(_get_config_value(key, "NameServer")) :> could contains comma separated values (eg after running the following commands : Set-DnsClientServerAddress -InterfaceIndex 13 -ServerAddresses('8.8.8.8','4.4.4.4') the NameServer key will contains : 8.8.8.8,4.4.4.4

This look like a regression related to 90cbaac#diff-a8cdba395abca9f908bbf562e9a7f94c37e2bed16994171b11e08e45e17333eaL311 , as a split was done before.

I will make a PR

[JSCU-CNI]

The PR in #955 was merged, I think this issue can be closed now. Perhaps this fix warrants for a 3.20.1 release of dissect.target and a release for dissect?

[Horofic]

This issue can indeed be closed. Ill raise comment about the release with the team!