Add XFS metadata: number of blocks per file. (#874)

- Add the number of blocks to the stat output.
- Add the birthtime in nanoseconds to the stat output

dissect/target/filesystems/xfs.py

@@ -130,8 +130,15 @@ def lstat(self) -> fsutil.stat_result:
  st_info.st_mtime_ns = self.entry.mtime_ns
  st_info.st_ctime_ns = self.entry.ctime_ns
 
- # XFS has a birth time, called crtime
+ st_info.st_blksize = self.fs.xfs.block_size
+ # Convert number of filesystem blocks to basic blocks
+ # Reference: https://github.com/torvalds/linux/blob/e32cde8d2bd7d251a8f9b434143977ddf13dcec6/fs/xfs/xfs_iops.c#L602 # noqa: E501
+ # Note that block size in XFS is always a multiple of 512, so the division below is safe
+ st_info.st_blocks = self.entry.nblocks * (self.fs.xfs.block_size // 512)
+
+ # XFS has a birth time, since inode version 3 (version 5 of filesystem)
  st_info.st_birthtime = self.entry.crtime.timestamp()
+ st_info.st_birthtime_ns = self.entry.crtime_ns
 
  return st_info
 

dissect/target/tools/fsutils.py

@@ -207,7 +207,7 @@ def filetype(path: TargetPath) -> str:
  filetype=filetype(path),
  device="?",
  inode=s.st_ino,
- blocks=s.st_blocks or "?",
+ blocks=s.st_blocks if s.st_blocks is not None else "?",
  blksize=s.st_blksize or "?",
  nlink=s.st_nlink,
  modeord=oct(stat.S_IMODE(s.st_mode)),

tests/filesystems/test_xfs.py

@@ -0,0 +1,67 @@
+from datetime import datetime
+from typing import Iterator
+from unittest.mock import Mock, patch
+
+import pytest
+
+from dissect.target.filesystems.xfs import XfsFilesystem, XfsFilesystemEntry
+
+NANOSECONDS_IN_SECOND = 1_000_000_000
+
+
+@pytest.fixture
+def xfs_fs() -> Iterator[XfsFilesystem]:
+ with patch("dissect.xfs.xfs.XFS"):
+ xfs_fs = XfsFilesystem(Mock())
+ xfs_fs.xfs.block_size = 4096
+
+ yield xfs_fs
+
+
+@pytest.fixture
+def xfs_fs_entry(xfs_fs: XfsFilesystem) -> Iterator[XfsFilesystemEntry]:
+ atime = datetime(2024, 10, 1, 12, 0, 0)
+ mtime = datetime(2024, 10, 2, 12, 0, 0)
+ ctime = datetime(2024, 10, 3, 12, 0, 0)
+ crtime = datetime(2024, 10, 4, 12, 0, 0)
+
+ dinode = Mock(di_mode=33272, di_nlink=1, di_uid=1000, di_gid=999)
+ inode = Mock(
+ nblocks=10,
+ inode=dinode,
+ inum=4,
+ size=4594,
+ atime=atime,
+ atime_ns=atime.timestamp() * NANOSECONDS_IN_SECOND,
+ mtime=mtime,
+ mtime_ns=mtime.timestamp() * NANOSECONDS_IN_SECOND,
+ ctime=ctime,
+ ctime_ns=ctime.timestamp() * NANOSECONDS_IN_SECOND,
+ crtime=crtime,
+ crtime_ns=crtime.timestamp() * NANOSECONDS_IN_SECOND,
+ )
+ entry = XfsFilesystemEntry(xfs_fs, "/some_file", inode)
+ yield entry
+
+
+def test_xfs_stat(xfs_fs: XfsFilesystem, xfs_fs_entry: XfsFilesystemEntry) -> None:
+ stat = xfs_fs_entry.stat()
+
+ entry = xfs_fs_entry.entry
+ assert stat.st_mode == entry.inode.di_mode
+ assert stat.st_ino == entry.inum
+ assert stat.st_dev == id(xfs_fs)
+ assert stat.st_nlink == entry.inode.di_nlink
+ assert stat.st_uid == entry.inode.di_uid
+ assert stat.st_gid == entry.inode.di_gid
+ assert stat.st_size == entry.size
+ assert stat.st_atime == entry.atime.timestamp()
+ assert stat.st_atime_ns == entry.atime_ns
+ assert stat.st_mtime == entry.mtime.timestamp()
+ assert stat.st_mtime_ns == entry.mtime_ns
+ assert stat.st_ctime == entry.ctime.timestamp()
+ assert stat.st_ctime_ns == entry.ctime_ns
+ assert stat.st_birthtime == entry.crtime.timestamp()
+ assert stat.st_birthtime_ns == entry.crtime_ns
+ assert stat.st_blksize == 4096
+ assert stat.st_blocks == 10 * 4096 // 512