huginn_net_db/

db_parse.rs

use std::str::FromStr;

use crate::db::{Database, FingerprintCollection, Label, Type};
use crate::error::DatabaseError;
use crate::{
    http::{Header as HttpHeader, Signature as HttpSignature, Version as HttpVersion},
    tcp::{IpVersion, PayloadSize, Quirk, Signature as TcpSignature, TcpOption, Ttl, WindowSize},
};
use nom::branch::alt;
use nom::bytes::complete::{take_until, take_while};
use nom::character::complete::{alpha1, char, digit1};
use nom::combinator::{map, map_res, opt};
use nom::multi::{separated_list0, separated_list1};
use nom::sequence::{pair, separated_pair, terminated};
use nom::*;
use nom::{
    bytes::complete::tag,
    character::complete::{alphanumeric1, space0},
    combinator::rest,
    sequence::preceded,
    IResult,
};
use tracing::{trace, warn};

impl FromStr for Database {
    type Err = DatabaseError;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        let mut classes = vec![];
        let mut mtu_entries = vec![];
        let mut ua_os_entries = vec![];

        let mut temp_tcp_request_entries: Vec<(Label, Vec<TcpSignature>)> = vec![];
        let mut temp_tcp_response_entries: Vec<(Label, Vec<TcpSignature>)> = vec![];
        let mut temp_http_request_entries: Vec<(Label, Vec<HttpSignature>)> = vec![];
        let mut temp_http_response_entries: Vec<(Label, Vec<HttpSignature>)> = vec![];

        let mut cur_mod = None;

        for line in s.lines() {
            let line = line.trim();

            if line.is_empty() || line.starts_with(';') {
                continue;
            }

            if line.starts_with("classes") {
                classes.append(
                    &mut parse_classes(line)
                        .map_err(|err| {
                            DatabaseError::Parse(format!("fail to parse `classes`: {line}, {err}"))
                        })?
                        .1,
                );
            } else if line.starts_with("ua_os") {
                ua_os_entries.append(
                    &mut parse_ua_os(line)
                        .map_err(|err| {
                            DatabaseError::Parse(format!("fail to parse `ua_os`: {line}, {err}"))
                        })?
                        .1,
                );
            } else if line.starts_with('[') && line.ends_with(']') {
                cur_mod = Some(
                    parse_module(line)
                        .map_err(|err| {
                            DatabaseError::Parse(format!("fail to parse `module`: {line}, {err}"))
                        })?
                        .1,
                );
            } else if let Some((module, direction)) = cur_mod.as_ref() {
                let (_, (name, value)) = parse_named_value(line).map_err(|err| {
                    DatabaseError::Parse(format!("fail to parse named value: {line}, {err}"))
                })?;

                match name {
                    "label" if module == "mtu" => {
                        mtu_entries.push((value.to_string(), vec![]));
                    }
                    "sig" if module == "mtu" => {
                        if let Some((_label, values)) = mtu_entries.last_mut() {
                            let sig = value.parse::<u16>().map_err(|err| {
                                DatabaseError::Parse(format!(
                                    "fail to parse `mtu` value: {value}, {err}"
                                ))
                            })?;
                            values.push(sig);
                        } else {
                            return Err(DatabaseError::Parse(format!(
                                "`mtu` value without `label`: {value}"
                            )));
                        }
                    }
                    "label" => {
                        let (_, label) = parse_label(value).map_err(|err| {
                            DatabaseError::Parse(format!("fail to parse `label`: {value}, {err}"))
                        })?;

                        match (module.as_str(), direction.as_ref().map(|s| s.as_ref())) {
                            ("tcp", Some("request")) => {
                                temp_tcp_request_entries.push((label, vec![]))
                            }
                            ("tcp", Some("response")) => {
                                temp_tcp_response_entries.push((label, vec![]))
                            }
                            ("http", Some("request")) => {
                                temp_http_request_entries.push((label, vec![]))
                            }
                            ("http", Some("response")) => {
                                temp_http_response_entries.push((label, vec![]))
                            }
                            _ => {
                                warn!("skip `label` in unknown module `{}`: {}", module, value);
                            }
                        }
                    }
                    "sig" => match (module.as_str(), direction.as_ref().map(|s| s.as_ref())) {
                        ("tcp", Some("request")) => {
                            if let Some((label, values)) = temp_tcp_request_entries.last_mut() {
                                let sig = value.parse()?;
                                trace!("sig for `{}` tcp request: {}", label, sig);
                                values.push(sig);
                            } else {
                                return Err(DatabaseError::Parse(format!(
                                    "tcp signature without `label`: {value}"
                                )));
                            }
                        }
                        ("tcp", Some("response")) => {
                            if let Some((label, values)) = temp_tcp_response_entries.last_mut() {
                                let sig = value.parse()?;
                                trace!("sig for `{}` tcp response: {}", label, sig);
                                values.push(sig);
                            } else {
                                return Err(DatabaseError::Parse(format!(
                                    "tcp signature without `label`: {value}"
                                )));
                            }
                        }
                        ("http", Some("request")) => {
                            if let Some((label, values)) = temp_http_request_entries.last_mut() {
                                let sig = value.parse()?;
                                trace!("sig for `{}` http request: {}", label, sig);
                                values.push(sig);
                            } else {
                                return Err(DatabaseError::Parse(format!(
                                    "http signature without `label`: {value}"
                                )));
                            }
                        }
                        ("http", Some("response")) => {
                            if let Some((label, values)) = temp_http_response_entries.last_mut() {
                                let sig = value.parse()?;
                                trace!("sig for `{}` http response: {}", label, sig);
                                values.push(sig);
                            } else {
                                return Err(DatabaseError::Parse(format!(
                                    "http signature without `label`: {value}"
                                )));
                            }
                        }
                        _ => {
                            warn!("skip `sig` in unknown module `{}`: {}", module, value);
                        }
                    },
                    "sys" if module != "mtu" => {}
                    _ => {
                        warn!("skip unknown named value: {} = {}", name, value);
                    }
                }
            } else {
                return Err(DatabaseError::Parse(format!(
                    "unexpected line outside the module: {line}"
                )));
            }
        }

        Ok(Database {
            classes,
            mtu: mtu_entries,
            ua_os: ua_os_entries,
            tcp_request: FingerprintCollection::new(temp_tcp_request_entries),
            tcp_response: FingerprintCollection::new(temp_tcp_response_entries),
            http_request: FingerprintCollection::new(temp_http_request_entries),
            http_response: FingerprintCollection::new(temp_http_response_entries),
        })
    }
}

macro_rules! impl_from_str {
    ($ty:ty, $parse:ident) => {
        impl FromStr for $ty {
            type Err = DatabaseError;

            fn from_str(s: &str) -> Result<Self, Self::Err> {
                let (remaining, res) = $parse(s).map_err(|err| {
                    DatabaseError::Parse(format!(
                        "parse {} failed: {}, {}",
                        stringify!($ty),
                        s,
                        err
                    ))
                })?;

                if !remaining.is_empty() {
                    Err(DatabaseError::Parse(format!(
                        "parse {} failed, remaining: {}",
                        stringify!($ty),
                        remaining
                    )))
                } else {
                    Ok(res)
                }
            }
        }
    };
}

impl_from_str!(Label, parse_label);
impl_from_str!(Type, parse_type);
impl_from_str!(TcpSignature, parse_tcp_signature);
impl_from_str!(IpVersion, parse_ip_version);
impl_from_str!(Ttl, parse_ttl);
impl_from_str!(WindowSize, parse_window_size);
impl_from_str!(TcpOption, parse_tcp_option);
impl_from_str!(Quirk, parse_quirk);
impl_from_str!(PayloadSize, parse_payload_size);
impl_from_str!(HttpSignature, parse_http_signature);
impl_from_str!(HttpHeader, parse_http_header);

fn parse_named_value(input: &str) -> IResult<&str, (&str, &str)> {
    let (input, (name, _, _, _, value)) =
        (alphanumeric1, space0, tag("="), space0, rest).parse(input)?;
    Ok((input, (name, value)))
}

fn parse_classes(input: &str) -> IResult<&str, Vec<String>> {
    let (input, (_, _, _, _, classes)) = (
        tag("classes"),
        space0,
        tag("="),
        space0,
        separated_list0(tag(","), alphanumeric1),
    )
        .parse(input)?;

    let class_vec = classes.into_iter().map(|s| s.to_string()).collect();
    Ok((input, class_vec))
}

fn parse_module(input: &str) -> IResult<&str, (String, Option<String>)> {
    let (input, (_, module, direction, _)) =
        (tag("["), alpha1, opt(preceded(tag(":"), alpha1)), tag("]")).parse(input)?;
    let module_str = module.to_string();
    let direction_str = direction.map(|s| s.to_string());

    Ok((input, (module_str, direction_str)))
}

fn parse_ua_os(input: &str) -> IResult<&str, Vec<(String, Option<String>)>> {
    let (input, (_, _, _, _, values)) = (
        tag("ua_os"),
        space0,
        tag("="),
        space0,
        separated_list0(tag(","), parse_key_value),
    )
        .parse(input)?;

    let result = values
        .into_iter()
        .map(|(name, value)| (name.to_string(), value.map(|s| s.to_string())))
        .collect();

    Ok((input, result))
}

fn parse_key_value(input: &str) -> IResult<&str, (&str, Option<&str>)> {
    let (input, (name, _, value)) =
        (alphanumeric1, space0, opt(preceded((space0, tag("="), space0), alphanumeric1)))
            .parse(input)?;

    Ok((input, (name, value)))
}

fn parse_label(input: &str) -> IResult<&str, Label> {
    let (input, (ty, _, class, _, name, flavor)) = (
        parse_type,
        tag(":"),
        alt((map(tag("!"), |_| None), map(take_until(":"), |s: &str| Some(s.to_string())))),
        tag(":"),
        take_until(":"),
        opt(preceded(tag(":"), rest)),
    )
        .parse(input)?;

    Ok((
        input,
        Label {
            ty,
            class,
            name: name.to_string(),
            flavor: flavor.filter(|f| !f.is_empty()).map(String::from),
        },
    ))
}

fn parse_type(input: &str) -> IResult<&str, Type> {
    alt((tag("s").map(|_| Type::Specified), tag("g").map(|_| Type::Generic))).parse(input)
}

fn parse_tcp_signature(input: &str) -> IResult<&str, TcpSignature> {
    let (
        input,
        (version, _, ittl, _, olen, _, mss, _, wsize, _, wscale, _, olayout, _, quirks, _, pclass),
    ) = (
        parse_ip_version,
        tag(":"),
        parse_ttl,
        tag(":"),
        map_res(digit1, |s: &str| s.parse::<u8>()), // olen
        tag(":"),
        alt((tag("*").map(|_| None), map_res(digit1, |s: &str| s.parse::<u16>().map(Some)))), // mss
        tag(":"),
        parse_window_size,
        tag(","),
        alt((tag("*").map(|_| None), map_res(digit1, |s: &str| s.parse::<u8>().map(Some)))), // wscale
        tag(":"),
        separated_list1(tag(","), parse_tcp_option),
        tag(":"),
        separated_list0(tag(","), parse_quirk),
        tag(":"),
        parse_payload_size,
    )
        .parse(input)?;

    Ok((
        input,
        TcpSignature { version, ittl, olen, mss, wsize, wscale, olayout, quirks, pclass },
    ))
}

fn parse_ip_version(input: &str) -> IResult<&str, IpVersion> {
    alt((
        map(tag("4"), |_| IpVersion::V4),
        map(tag("6"), |_| IpVersion::V6),
        map(tag("*"), |_| IpVersion::Any),
    ))
    .parse(input)
}

fn parse_ttl(input: &str) -> IResult<&str, Ttl> {
    alt((
        map_res(terminated(digit1, tag("-")), |s: &str| s.parse::<u8>().map(Ttl::Bad)),
        map_res(terminated(digit1, tag("+?")), |s: &str| s.parse::<u8>().map(Ttl::Guess)),
        map_res(
            separated_pair(digit1, tag("+"), digit1),
            |(ttl_str, distance_str): (&str, &str)| match (
                ttl_str.parse::<u8>(),
                distance_str.parse::<u8>(),
            ) {
                (Ok(ttl), Ok(distance)) => Ok(Ttl::Distance(ttl, distance)),
                (Err(_), _) => Err("Failed to parse ttl"),
                (_, Err(_)) => Err("Failed to parse distance"),
            },
        ),
        map_res(digit1, |s: &str| s.parse::<u8>().map(Ttl::Value)),
    ))
    .parse(input)
}

fn parse_window_size(input: &str) -> IResult<&str, WindowSize> {
    alt((
        map(tag("*"), |_| WindowSize::Any),
        map_res(preceded(tag("mss*"), digit1), |s: &str| s.parse::<u8>().map(WindowSize::Mss)),
        map_res(preceded(tag("mtu*"), digit1), |s: &str| s.parse::<u8>().map(WindowSize::Mtu)),
        map_res(preceded(tag("%"), digit1), |s: &str| s.parse::<u16>().map(WindowSize::Mod)),
        map_res(digit1, |s: &str| s.parse::<u16>().map(WindowSize::Value)),
    ))
    .parse(input)
}

fn parse_tcp_option(input: &str) -> IResult<&str, TcpOption> {
    alt((
        map_res(preceded(tag("eol+"), digit1), |s: &str| s.parse::<u8>().map(TcpOption::Eol)),
        tag("nop").map(|_| TcpOption::Nop),
        tag("mss").map(|_| TcpOption::Mss),
        tag("ws").map(|_| TcpOption::Ws),
        tag("sok").map(|_| TcpOption::Sok),
        tag("sack").map(|_| TcpOption::Sack),
        tag("ts").map(|_| TcpOption::TS),
        preceded(tag("?"), map(digit1, |s: &str| s.parse::<u8>().unwrap_or(0)))
            .map(TcpOption::Unknown),
    ))
    .parse(input)
}

fn parse_quirk(input: &str) -> IResult<&str, Quirk> {
    alt((
        map(tag("df"), |_| Quirk::Df),
        map(tag("id+"), |_| Quirk::NonZeroID),
        map(tag("id-"), |_| Quirk::ZeroID),
        map(tag("ecn"), |_| Quirk::Ecn),
        map(tag("0+"), |_| Quirk::MustBeZero),
        map(tag("flow"), |_| Quirk::FlowID),
        map(tag("seq-"), |_| Quirk::SeqNumZero),
        map(tag("ack+"), |_| Quirk::AckNumNonZero),
        map(tag("ack-"), |_| Quirk::AckNumZero),
        map(tag("uptr+"), |_| Quirk::NonZeroURG),
        map(tag("urgf+"), |_| Quirk::Urg),
        map(tag("pushf+"), |_| Quirk::Push),
        map(tag("ts1-"), |_| Quirk::OwnTimestampZero),
        map(tag("ts2+"), |_| Quirk::PeerTimestampNonZero),
        map(tag("opt+"), |_| Quirk::TrailinigNonZero),
        map(tag("exws"), |_| Quirk::ExcessiveWindowScaling),
        map(tag("bad"), |_| Quirk::OptBad),
    ))
    .parse(input)
}

fn parse_payload_size(input: &str) -> IResult<&str, PayloadSize> {
    alt((
        map(tag("0"), |_| PayloadSize::Zero),
        map(tag("+"), |_| PayloadSize::NonZero),
        map(tag("*"), |_| PayloadSize::Any),
    ))
    .parse(input)
}

fn parse_http_signature(input: &str) -> IResult<&str, HttpSignature> {
    let (input, (version, _, horder, _, habsent, _, expsw)) = (
        parse_http_version,
        tag(":"),
        separated_list1(tag(","), parse_http_header),
        tag(":"),
        opt(separated_list0(tag(","), parse_http_header)),
        tag(":"),
        rest,
    )
        .parse(input)?;

    let habsent = habsent
        .unwrap_or_default()
        .into_iter()
        .filter(|h| !h.name.is_empty())
        .collect();

    Ok((input, HttpSignature { version, horder, habsent, expsw: expsw.to_string() }))
}

fn parse_http_version(input: &str) -> IResult<&str, HttpVersion> {
    alt((
        map(tag("0"), |_| HttpVersion::V10),
        map(tag("1"), |_| HttpVersion::V11),
        map(tag("*"), |_| HttpVersion::Any),
    ))
    .parse(input)
}

fn parse_header_key_value(input: &str) -> IResult<&str, (&str, Option<&str>)> {
    pair(
        take_while(|c: char| (c.is_ascii_alphanumeric() || c == '-') && c != ':' && c != '='),
        opt(preceded(tag("=["), terminated(take_until("]"), char(']')))),
    )
    .parse(input)
}

fn parse_http_header(input: &str) -> IResult<&str, HttpHeader> {
    let (input, optional) = opt(char('?')).parse(input)?;
    let (input, (name, value)) = parse_header_key_value(input)?;

    Ok((
        input,
        HttpHeader {
            optional: optional.is_some(),
            name: name.to_string(),
            value: value.map(|s| s.to_string()),
        },
    ))
}