1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
use bodyfile::Bodyfile3Line;
use chrono::{DateTime, Utc};
use flow_record_common::types::Filesize;
use flow_record_derive::FlowRecord;

use super::{FileMode, FileType};

#[derive(Debug, FlowRecord)]
#[flow_record(version = 1, source = "Posix", classification = "file")]
pub struct FileRecord {
    file_name: String,
    user_id: i64,
    group_id: i64,
    file_type: FileType,
    mode: FileMode,
    size: Filesize,

    modified: Option<DateTime<Utc>>,
    accessed: Option<DateTime<Utc>>,
    changed: Option<DateTime<Utc>>,
    birth: Option<DateTime<Utc>>,
}

struct UnixTimestamp(i64);

impl From<i64> for UnixTimestamp {
    fn from(value: i64) -> Self {
        Self(value)
    }
}

impl From<UnixTimestamp> for Option<DateTime<Utc>> {
    fn from(value: UnixTimestamp) -> Self {
        if value.0 != -1 {
            DateTime::from_timestamp(value.0, 0)
        } else {
            None
        }
    }
}

impl TryFrom<&Bodyfile3Line> for FileRecord {
    type Error = flow_record_common::Error;
    fn try_from(line: &Bodyfile3Line) -> Result<Self, Self::Error> {
        Ok(Self {
            file_name: line.get_name().to_string(),
            user_id: i64::try_from(line.get_uid())?,
            group_id: i64::try_from(line.get_gid())?,
            mode: line.get_mode().try_into()?,
            file_type: line.get_mode().try_into()?,
            size: line.get_size().into(),
            modified: UnixTimestamp::from(line.get_mtime()).into(),
            accessed: UnixTimestamp::from(line.get_atime()).into(),
            changed: UnixTimestamp::from(line.get_ctime()).into(),
            birth: UnixTimestamp::from(line.get_crtime()).into(),
        })
    }
}