Function _read_resolv_conf

network_diagnostics.py:716–741

Parse /etc/resolv.conf for search domains and nameservers. Returns (domains, nameservers, stub) where `stub` is True when the only nameserver is the systemd-resolved stub (127.0.0.53) -- in that case the real upstream servers must come from nmcli/resolvectl instead.

()

    if res['rc'] == 127:
        return {'success': False, 'error': res['err'] or 'arp-scan not found',
                'missing_tool': 'arp-scan', 'hosts': []}
    hosts = []
    for line in res['out'].splitlines():
        m = re.match(r'^(\d+\.\d+\.\d+\.\d+)\s+([0-9a-fA-F:]{17})\s*(.*)$', line)
        if m:
            hosts.append({'ip': m.group(1), 'mac': m.group(2),
                          'vendor': m.group(3).strip() or None})
    return {'success': True, 'hosts': hosts, 'count': len(hosts), 'interface': interface}


# --------------------------------------------------------------------------
# ARP spoofing / poisoning detection: watch the gateway's IP->MAC binding
# against a learned baseline (a MITM inserting itself changes it), and flag a
# single MAC answering for many IPs (one host impersonating the whole subnet).
# The kernel neighbour table is authoritative and needs no capture, so this is
# cheap enough to run on a schedule from the integrity monitor.
# --------------------------------------------------------------------------

_ARP_BASELINE_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)),
                                  'data', 'arp_baseline.json')
_arp_baseline_lock = threading.Lock()
# A MAC bound to at least this many IPs in the neighbour table is treated as a
# possible impersonator. Proxy-ARP routers can legitimately answer for a few, so
# keep the floor above normal noise.
_ARP_IMPERSONATOR_MIN_IPS = 4


def _neigh_entries(iface=None):
    """Parse `ip -4 neigh` into [(ip, mac, state)] for entries with a lladdr.