Feat: Introduce net-localgroup net-user and route-print parsers #602

joehacksalot · 2024-10-01T19:37:29Z

This PR introduces a new parsers for net-localgroup, net-user and route-print[1] windows commands.

Tested on:

Windows XP
Windows 7
Windows 10
Windows 11
Windows Server 2008
Windows Server 2016

Note:
[1] - The 'metric' fields are generally integers, and I was processing them as such but found one instance where the value was the string "Default", which after some research, would require looking up the OS default metric currently set to identify the numerical value. For this reason, I changed the schema type to string and left the original value for the end user to interpret.

This closes #600

kellyjonbrazil · 2024-10-17T22:14:11Z

This PR seems to have other unrelated files in it (e.g. ipconfig.py and associated test files). Could you re-open this PR with a clean set of files?

joehacksalot · 2024-10-21T18:11:41Z

I'll get those removed. I branched off of the wrong branch when I started. It'll be up soon

joehacksalot · 2024-10-21T20:14:03Z

ok. should be ready now

kellyjonbrazil

Thanks for the contributions! Good stuff - just a few changes and suggestions.

kellyjonbrazil · 2024-11-19T19:11:27Z

jc/parsers/net_localgroup.py

+    author = 'joehacksalot'
+    author_email = 'joehacksalot@gmail.com'
+    compatible = ['windows']
+    magic_commands = ['net-localgroup']


I think this should be magic_commands = ['net localgroup']

kellyjonbrazil · 2024-11-19T19:13:50Z

jc/parsers/net_localgroup.py

+    Notes:
+      [0] - 'lease_expires' and 'lease_obtained' are parsed to ISO8601 format date strings. if the value was unable 
+            to be parsed by datetime, the fields will be in their raw form
+      [1] - 'autoconfigured' under 'ipv4_address' is only providing indication if the ipv4 address was labeled as
+            "Autoconfiguration IPv4 Address" vs "IPv4 Address". It does not infer any information from other fields
+      [2] - Windows XP uses 'IP Address' instead of 'IPv4 Address'. Both values are parsed to the 'ipv4_address' 
+            object for consistency


I think this section can be deleted.

I think the information might be helpful to some users. I can delete it if you think that's best.

Ah, I thought this was left over from the ipconfig parser. I didn't see where these footnotes were referenced in the Schema, so it didn't seem to belong here.

kellyjonbrazil · 2024-11-19T19:14:49Z

jc/parsers/net_localgroup.py

+    $ net localgroup Administrators | jc --net-localgroup -p | jq
+    $ net localgroup /domain | jc --net-localgroup -p | jq


Looks like these examples are missing. no need to pipe through jq when using the -p option.

kellyjonbrazil · 2024-11-19T19:16:29Z

jc/parsers/net_localgroup.py

+Usage (module):
+
+    import jc
+    result = jc.parse('net-localgroup', net_localgroup_command_output)


Though 'net-localgroup' will work here, it is best to use 'net_localgroup' for python module examples.

jc/parsers/net_user.py

kellyjonbrazil · 2024-11-19T19:36:04Z

jc/parsers/route_print.py

+    }
+
+    Notes:
+        - The `metric` field is typically an integer but can sometimes be set to "Default"


Wonder if there is another way of handling this? Could a metric of -1 or even null/None be the "Default"? Or another field called metric_is_default set to True or something?

When "Default" is present, the interface is using the value currently set as operating system's default metric value. I believe this value is stored somewhere in the registry.

I'm not opposed to a -1 for default. I think I'd prefer that over using null/None since I usually assume if its null/None that it was not present in the original output.

I started looking into doing this and I found an example where a metric was already set to -1.

{ "interface": 0, "metric": "4294967295", "network_destination": "2001:db8::/64", "gateway": "fe80::1" }

I only googled quickly, but it looks like it may be used for Windows to automatically optimize routing.

Leaving it as a string for now. Open to discuss further.

Just seems a shame to have this be a string field because of that one possible value. I sorta like the idea of having it be null/None if it is default and then set the metric_is_default field to True. A bit more work, but fixes this type override issue.

kellyjonbrazil · 2024-11-19T19:37:14Z

jc/parsers/route_print.py

@@ -0,0 +1,565 @@
+r"""jc - JSON Convert `route-print` command output parser


should be route print

kellyjonbrazil · 2024-11-19T19:37:45Z

jc/parsers/route_print.py

+    author = 'joehacksalot'
+    author_email = 'joehacksalot@gmail.com'
+    compatible = ['windows']
+    magic_commands = ['route-print']


should be 'route print'

kellyjonbrazil · 2024-11-19T19:43:54Z

jc/parsers/route_print.py

+            return raw_output if raw else _process(raw_output)
+        except Exception as e:
+            if not quiet:
+                jc.utils.warning_message(['Could not parse data due to unexpected format.'])


This type of exception handling can make it difficult to troubleshoot. Doing this means the user cannot use jc --route-print -dd to get debug info. Without the exception handling jc should just do the right thing. If you want a custom exception message, it would be better to use jc.exceptions.ParseError:

from jc.exceptions import ParseError raise ParseError('My custom error here.')

You can find examples in the following parsers: cef.py, csv.py, uname.py, etc.

kellyjonbrazil · 2024-11-19T19:45:07Z

jc/parsers/net_user.py

+            return raw_output if raw else _process(raw_output)
+        except Exception as e:
+            if not quiet:
+                jc.utils.warning_message(['Could not parse data due to unexpected format.'])


This type of exception handling can make it difficult to troubleshoot. Doing this means the user cannot use jc --route-print -dd to get debug info. Without the exception handling jc should just do the right thing. If you want a custom exception message, it would be better to use jc.exceptions.ParseError:

from jc.exceptions import ParseError raise ParseError('My custom error here.')

You can find examples in the following parsers: cef.py, csv.py, uname.py, etc.

AvocadoStyle · 2024-11-21T16:34:36Z

tests/fixtures/windows/windows-11/net_user.out

Should it be deleted? why do you need that file?

This is part of the unit test

AvocadoStyle · 2024-11-21T16:37:11Z

tests/fixtures/windows/windows-11/net_localgroup.json

why do you need that file?

This is part of the unit test

joehacksalot changed the base branch from master to dev October 1, 2024 19:48

kellyjonbrazil added the question Further information is requested label Oct 20, 2024

feat(patch): introduce net localgroup, net user, and route print parsers

0f576e8

joehacksalot force-pushed the feat/net-localgroup branch from defa407 to 0f576e8 Compare October 21, 2024 19:29

fix: fix net user parsing error

3c0d75b

Merge branch 'dev' into feat/net-localgroup

8a29890

kellyjonbrazil requested changes Nov 19, 2024

View reviewed changes

kellyjonbrazil added reviewing and removed question Further information is requested labels Nov 19, 2024

AvocadoStyle reviewed Nov 21, 2024

View reviewed changes

fix: address PR findings

c98957e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat: Introduce net-localgroup net-user and route-print parsers #602

Feat: Introduce net-localgroup net-user and route-print parsers #602

joehacksalot commented Oct 1, 2024 •

edited

Loading

kellyjonbrazil commented Oct 17, 2024

joehacksalot commented Oct 21, 2024

joehacksalot commented Oct 21, 2024

kellyjonbrazil left a comment

kellyjonbrazil Nov 19, 2024

kellyjonbrazil Nov 19, 2024

joehacksalot Nov 25, 2024

kellyjonbrazil Nov 25, 2024

kellyjonbrazil Nov 19, 2024

kellyjonbrazil Nov 19, 2024

kellyjonbrazil Nov 19, 2024

joehacksalot Nov 25, 2024

joehacksalot Nov 25, 2024 •

edited

Loading

kellyjonbrazil Nov 25, 2024

kellyjonbrazil Nov 19, 2024

kellyjonbrazil Nov 19, 2024

kellyjonbrazil Nov 19, 2024

kellyjonbrazil Nov 19, 2024

AvocadoStyle Nov 21, 2024

joehacksalot Nov 25, 2024

AvocadoStyle Nov 21, 2024

joehacksalot Nov 25, 2024

		$ net localgroup Administrators \| jc --net-localgroup -p \| jq
		$ net localgroup /domain \| jc --net-localgroup -p \| jq

		@@ -0,0 +1,565 @@
		r"""jc - JSON Convert `route-print` command output parser

Feat: Introduce net-localgroup net-user and route-print parsers #602

Are you sure you want to change the base?

Feat: Introduce net-localgroup net-user and route-print parsers #602

Conversation

joehacksalot commented Oct 1, 2024 • edited Loading

kellyjonbrazil commented Oct 17, 2024

joehacksalot commented Oct 21, 2024

joehacksalot commented Oct 21, 2024

kellyjonbrazil left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joehacksalot Nov 25, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joehacksalot commented Oct 1, 2024 •

edited

Loading

joehacksalot Nov 25, 2024 •

edited

Loading