Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[vbox-clean-snapshots.py] Fix several bugs & improve code #645

Merged
merged 8 commits into from
Jan 27, 2025

Conversation

Ana06
Copy link
Member

@Ana06 Ana06 commented Jan 23, 2025

The following PR fixes the following bugs:

  • A snapshot outside root may be deleted if it has the same name as one inside root.Use the snapshot ID instead of the name to fix the issue.
  • The root snapshot argument should be optional and case sensitive. Make clear that this is the case and use all snapshots if no root snapshot is provided instead of raising an exception.
  • Duplicated current snapshot. The current code may include the current snapshot twice, which causes that
    a confusing output is rendered and that the snapshot is being removed twice (failing the second time).
  • Root snapshot is not deleted if a child is protected, but it is possible to delete a root snapshot with a single protected child. It is not possible to delete the root snapshot if it has more than one protected child. But this issue happens at every level, not only at the root snapshot. The inconsistent behavior is confusing and complicates the code unnecessarily. Instead, try to always delete non protected snapshots (including the root snapshot) and improve the rendered error output.
  • Protected root snapshot is not supported. The root snapshot can be protected, so that its children get deleted but not the root snapshot.

In addition, the PR includes other improvements, such as better exception handling and using more specific VBoxManage commands. See the detailed commit messages for more details on every of the changes.

Ana06 added 8 commits January 23, 2025 19:44
Remove print just before exception as the same information is already
printed by the exception.
The root snapshot can be protected, so that its children get deleted but
not the root snapshot.

Example (remove `EMPTY` children: `Snapshot 1` and `Snapshot 2`):
```
Fresh
  ├─ EMPTY
  │   ├─ Snapshot 1
  │   └─ Snapshot 2
  └─ Snapshot 3

vbox-clean-snapshots.py FLARE-VM --protected EMPTY --root_snapshot "EMPTY"
```
Use `snapshot` command (with the `list` option) instead of `showvminfo`
as it returns only the snapshot information in `showinfo` and that is
the only information we use.
The current code includes the current snapshot twice, which causes that
a confusing output is rendered and that the snapshot is being removed
twice (failing the second time).

Example of `VBoxManage snapshot VM_NAME list --machinereadable` output:
```
SnapshotName="ROOT"
SnapshotUUID="86b38fc9-9d68-4e4b-a033-4075002ab570"
SnapshotName-1="Snapshot 1"
SnapshotUUID-1="e383e702-fee3-4e0b-b1e0-f3b869dbcaea"
CurrentSnapshotName="Snapshot 1"
CurrentSnapshotUUID="e383e702-fee3-4e0b-b1e0-f3b869dbcaea"
CurrentSnapshotNode="SnapshotName-1"
SnapshotName-1-1="Snapshot 2"
SnapshotUUID-1-1="8cc12787-99df-466e-8a51-80e373d3447a"
SnapshotName-2="Snapshot 3"
SnapshotUUID-2="f42533a8-7c14-4855-aa66-7169fe8187fe"

ROOT
  ├─ Snapshot 1
  │   └─ Snapshot 2
  └─ Snapshot 3
```
The current code excludes the root snapshot from deletion if a child is
protected. But it is possible to delete a root snapshot with a single
protected child.

It is not possible to delete the root snapshot if it has more than one
protected child. But this issue happens at every level, not only at the
root snapshot. For example (fail to delete 'Snapshot 1'):
```
ROOT
  ├─ Snapshot 1
  │   ├─ PROTECTED 1
  │   └─ PROTECTED 2
  └─ Snapshot 2

vbox-clean-snapshots.py FLARE-VM --protected "ROOT,PROTECTED" --root_snapshot ROOT
```

This inconsistent behavior is confusing and complicates the code
unnecessarily. Instead, try to always delete non protected snapshots
(including the root snapshot) and improve the rendered error output.

In the error output, include the command as a string (instead of a list)
as this allows to copy-paste the command to manually execute it.
Simplify also the long stderr from VBoxManage, by using only the first
`VBoxManage: error:` line to prevent using the long VBoxManage help
message or noisy information like the details and context.

Remove the use of `check` in `subprocess.run` (triggering an exception
on error) as it can be handle without exceptions.
Use the snapshot ID instead of the name to avoid removing an snapshot
outside of the root snapshot.

Example (wrong `IMPORTANT` is deleted):
```
ROOT
  ├─ IMPORTANT
  └─ Snapshot 1
      └─ IMPORTANT

vbox-clean-snapshots.py FLARE-VM --root_snapshot
```
The current code breaks if no root snapshot is provided. The root
snapshot argument should be optional and case sensitive.  Make clear
that this is the case and use all snapshots if no root snapshot is
provided.
Do not catch unexpected exceptions so that the original exception
reaches to the user.
@Ana06 Ana06 added 🐛 bug Something isn't working 🖥️ virtualbox labels Jan 23, 2025
@Ana06 Ana06 self-assigned this Jan 23, 2025
Copy link
Contributor

@williballenthin williballenthin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

beautiful sequence of commits and messages. thank you!

@stevemk14ebr
Copy link
Contributor

+1 the commit messages are :chefs_kiss: I can do a quick once over tomorrow

@Ana06 Ana06 merged commit 9b511ad into mandiant:main Jan 27, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐛 bug Something isn't working 🖥️ virtualbox
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants