# tinydns can drop a query for one of three reasons; this dictionary
# maps the symbol that gets logged in each case to a human-readable
-# reason.
+# reason. We include the "+" case here, indicating that the query was
+# NOT dropped, to avoid a special case later on when we're formatting
+# the human-readable output.
query_drop_reason = {
+ "+": None,
"-": "no authority",
"I": "invalid query",
"C": "invalid class",
+ "/": "couldn't parse"
}
qt = words[i]
words[i] = query_type.get(int(qt), qt)
-def handle_dnscache_log(line, match):
+def handle_dnscache_log(line) -> bool:
+ """
+ Handle a single log line if it matches the ``dnscache_log_re`` regex.
+
+ Parameters
+ ----------
+
+ line : string
+ The log line that might match ``dnscache_log_re``.
+
+ Returns
+ -------
+
+ ``True`` if the log line was handled (that is, if it was really a
+ dnscache log line), and ``False`` otherwise.
+
+ Examples
+ --------
+
+ >>> line = "2022-09-15 18:37:33.863805500 query 1 7f000001:a3db:4fb9 1 www.example.com."
+ >>> handle_dnscache_log(line)
+ 2022-09-15 18:37:33.863805500 query #1 127.0.0.1:41947 (id 20409) a www.example.com.
+ True
+
+ >>> line = "2022-09-15 18:37:33.863874500 tx 0 1 www.example.com. . c0a80101"
+ >>> handle_dnscache_log(line)
+ 2022-09-15 18:37:33.863874500 tx g=0 a www.example.com. . 192.168.1.1
+ True
+
+ >>> line = "2022-09-15 18:37:33.878529500 rr c0a80101 20865 1 www.example.com. 5db8d822"
+ >>> handle_dnscache_log(line)
+ 2022-09-15 18:37:33.878529500 rr 192.168.1.1 TTL=20865 a www.example.com. 93.184.216.34
+ True
+
+ >>> line = "2022-09-15 18:37:33.878532500 stats 1 43 1 0"
+ >>> handle_dnscache_log(line)
+ 2022-09-15 18:37:33.878532500 stats count=1 motion=43 udp-active=1 tcp-active=0
+ True
+
+ >>> line = "2022-09-15 18:37:33.878602500 sent 1 49"
+ >>> handle_dnscache_log(line)
+ 2022-09-15 18:37:33.878602500 sent #1 49
+ True
+
+ >>> line = "this line is nonsense"
+ >>> handle_dnscache_log(line)
+ False
+
+ """
+ match = dnscache_log_re.match(line)
+ if not match:
+ return False
+
(timestamp, event, data) = match.groups()
words = data.split()
decode_client(words, 0)
print(timestamp, event, " ".join(words))
+ return True
-def handle_tinydns_log(line : str, match: re.Match):
+def handle_tinydns_log(line : str) -> bool:
"""
- Handle a line that matched the ``tinydns_log_re`` regex.
+ Handle a single log line if it matches the ``tinydns_log_re`` regex.
Parameters
----------
line : string
- The tinydns log line that matched ``tinydns_log_re``.
+ The log line that might match ``tinydns_log_re``.
- match : re.Match
- The match object that was returned when ``line`` was
- tested against ``tinydns_log_re``.
+ Returns
+ -------
+
+ ``True`` if the log line was handled (that is, if it was really a
+ tinydns log line), and ``False`` otherwise.
Examples
--------
>>> line = "2022-09-14 21:04:40.206516500 7f000001:9d61:be69 - 0001 www.example.com"
- >>> match = tinydns_log_re.match(line)
- >>> handle_tinydns_log(line, match)
+ >>> handle_tinydns_log(line)
2022-09-14 21:04:40.206516500 dropped query (no authority) from 127.0.0.1:40289 (id 48745): a www.example.com
+ True
+
+ >>> line = "this line is nonsense"
+ >>> handle_tinydns_log(line)
+ False
"""
+ match = tinydns_log_re.match(line)
+ if not match:
+ return False
+
(timestamp, ip, port, id, code, type, name) = match.groups()
ip = convert_ip(ip)
port = int(port, 16)
print(timestamp, end=' ')
+ reason = query_drop_reason[code]
if code == "+":
- print ("sent response to %s:%s (id %s): %s %s"
- % (ip, port, id, type, name))
- elif code in ("-", "I", "C"):
- reason = query_drop_reason[code]
- print ("dropped query (%s) from %s:%s (id %s): %s %s"
- % (reason, ip, port, id, type, name))
- elif code == "/":
- print ("dropped query (couldn't parse) from %s:%s"
- % (ip, port))
+ line_tpl = "sent response to {ip}:{port} (id {id}): {type} {name}"
else:
- print ("%s from %s:%s (id %s): %s %s"
- % (code, ip, port, id, type, name))
+ line_tpl = "dropped query ({reason}) from {ip}:{port}"
+ if code != "/":
+ # If the query can actually be parsed, the log line is a
+ # bit more informative than it would have been otherwise.
+ line_tpl += " (id {id}): {type} {name}"
+
+ print(line_tpl.format(reason=reason,
+ ip=ip,
+ port=port,
+ id=id,
+ type=type,
+ name=name))
+ return True
def parse_logfile(file : typing.TextIO):
- """
+ r"""
Process a single log ``file``.
Parameters
file : typing.TextIO
An open log file, or stdin.
+ Examples
+ --------
+
+ >>> line = "@4000000063227a320c4f3114 7f000001:9d61:be69 - 0001 www.example.com\n"
+ >>> from tempfile import NamedTemporaryFile
+ >>> with NamedTemporaryFile(mode="w", delete=False) as f:
+ ... _ = f.write(line)
+ >>> f = open(f.name, 'r')
+ >>> parse_logfile(f)
+ 2022-09-14 21:04:40.206516500 dropped query (no authority) from 127.0.0.1:40289 (id 48745): a www.example.com
+ >>> f.close()
+ >>> from os import remove
+ >>> remove(f.name)
+
"""
# Open pipe to tai64nlocal: we will write lines of our input (the
# raw log file) to it, and read log lines with readable timestamps
tai.stdin.write(line)
line = tai.stdout.readline()
- match = tinydns_log_re.match(line)
- if match:
- handle_tinydns_log(line, match)
- continue
-
- match = dnscache_log_re.match(line)
- if match:
- handle_dnscache_log(line, match)
- continue
-
- print(line)
+ if not handle_tinydns_log(line):
+ if not handle_dnscache_log(line):
+ print(line, end='')
def main():
+ r"""
+ The entry point to the program.
+
+ This function is responsible only for parsing any command-line
+ arguments, and then calling :func`parse_logfile` on them.
+ """
# Create an argument parser using the file's docsctring as its
# description.
from argparse import ArgumentParser, FileType
projects / djbdns-logparse.git / blobdiff