senpa 0.1.1

A library to parse OPNsense firewall logs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

use std::str::FromStr;

use nom::bytes::complete::take_till;
use nom::character::complete::{u16 as parse_u16, u32 as parse_u32};
use nom::combinator::rest;
use nom::sequence::terminated;
use nom::Parser;
use nom::{
    combinator::{eof, opt},
    IResult,
};

use crate::utils::{csv, parse_utf8_string};

#[cfg(feature = "serde")]
use serde::{Deserialize, Serialize};

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]

pub struct Protocol {
    pub num: u8, //protonum
    pub name: ProtoName,
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]

pub enum ProtoName {
    Tcp,
    Udp,
    Other(String),
}

impl FromStr for ProtoName {
    type Err = ();

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "udp" => Ok(ProtoName::Udp),
            "tcp" => Ok(ProtoName::Tcp),
            other => Ok(ProtoName::Other(other.into())),
        }
    }
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
pub struct Ports {
    pub srcport: u16,
    pub dstport: u16,
}

pub(crate) fn parse_src_dst_ports(input: &str) -> IResult<&str, Ports> {
    let (next, srcport) = csv(parse_u16)(input)?;
    let (next, dstport) = csv(parse_u16)(next)?;

    Ok((next, Ports { srcport, dstport }))
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
pub struct TcpInfo {
    pub ports: Ports,
    pub data_len: u32,
    pub flags: String,
    pub sequence_number: String,
    pub ack_number: Option<u32>,
    pub window: u32,
    pub urg: Option<u32>,
    pub options: String,
}

pub(crate) fn parse_tcp_info(input: &str) -> IResult<&str, ProtoInfo> {
    let (next, ports) = parse_src_dst_ports(input)?;
    let (next, data_len) = csv(parse_u32)(next)?;
    let (next, flags) = csv(parse_utf8_string)(next)?;

    //Todo use a struct to rapresent range
    let (next, sequence_number) = csv(take_till(|c| c == ',')).map(|s| s.into()).parse(next)?;

    let (next, ack_number) = csv(opt(parse_u32))(next)?;
    let (next, window) = csv(parse_u32)(next)?;
    let (next, urg) = csv(opt(parse_u32))(next)?;
    let (next, options) = rest(next).map(|f| (f.0, f.1.into()))?;

    let tcp_info = TcpInfo {
        ports,
        data_len,
        flags,
        sequence_number,
        ack_number,
        window,
        urg,
        options,
    };

    Ok((next, ProtoInfo::TcpInfo(tcp_info)))
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
pub struct UdpInfo {
    pub ports: Ports,
    pub data_len: u32,
}

pub(crate) fn parse_udp_info(input: &str) -> IResult<&str, ProtoInfo> {
    let (next, ports) = parse_src_dst_ports(input)?;
    let (next, data_len) = terminated(parse_u32, eof)(next)?;

    Ok((next, ProtoInfo::UdpInfo(UdpInfo { ports, data_len })))
}

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
pub struct CarpInfo {}

#[derive(Debug, Clone, PartialEq, Eq)]
#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
pub enum ProtoInfo {
    UdpInfo(UdpInfo),
    TcpInfo(TcpInfo),
    //TODO CarpInfo(CarpInfo),
    UnknownInfo(String),
}

pub(crate) fn parse_proto_info<'a>(
    input: &'a str,
    proto: &ProtoName,
) -> IResult<&'a str, ProtoInfo> {
    let (next, proto_info) = match proto {
        ProtoName::Tcp => parse_tcp_info(input)?,
        ProtoName::Udp => parse_udp_info(input)?,
        ProtoName::Other(_) => terminated(parse_utf8_string, eof)
            .map(ProtoInfo::UnknownInfo)
            .parse(input)?,
    };

    Ok((next, proto_info))
}

#[cfg(test)]
mod test {}