bin/djbdns-logparse.py: add docstring for decode_ip().

[djbdns-logparse.git] / bin / djbdns-logparse.py

diff --git a/bin/djbdns-logparse.py b/bin/djbdns-logparse.py
index 2a7f6cab5bb4a1f4411d8de82c9ac88db46c0be4..f2a69b5a333a6b4fb3c421661bd158972d988144 100755 (executable)
--- a/bin/djbdns-logparse.py
+++ b/bin/djbdns-logparse.py
@@ -5,8 +5,6 @@ Convert tinydns and dnscache logs to human-readable form
 
 import re, typing
 from struct import pack
-from time import strftime, gmtime
-
 
 ## Regular expressions for matching tinydns/dnscache log lines. We
 ## compile these once here rather than within the corresponding
@@ -169,6 +167,43 @@ def decode_client(words : list, i : int):
         words[i] += f" (id {id})"
 
 def decode_ip(words, i):
+    r"""
+    Helper function to decode the ip field in a dnscache log
+    entry.
+
+    A single "serverip" field is present in the lame, nodata,
+    nxdomain, and rr entry types.
+
+    Parameters
+    ----------
+
+    words : list
+        The ``words`` list (a list of fields) from
+        :func:`handle_dnscache_log`.
+
+    i : int
+        The index of the ip field within ``words``
+
+    Returns
+    -------
+
+    Nothing; the ``i``th entry in the ``words`` list is modified
+    in-place.
+
+    Examples
+    --------
+
+        >>> words = ["foo", "bar", "7f000001", "quux"]
+        >>> decode_ip(words, 2)
+        >>> words
+        ['foo', 'bar', '127.0.0.1', 'quux']
+
+        >>> words = ["foo", "00000000000000000000ffff7f000001", "bar", "quux"]
+        >>> decode_ip(words, 1)
+        >>> words
+        ['foo', '0000:0000:0000:0000:0000:ffff:7f00:0001', 'bar', 'quux']
+
+    """
     words[i] = convert_ip(words[i])
 
 def decode_ttl(words, i):
@@ -299,7 +334,11 @@ def handle_dnscache_log(line) -> typing.Optional[str]:
     elif event in ("tcpopen", "tcpclose"):
         decode_client(words, 0)
 
-    return f"{timestamp} {event} " + " ".join(words)
+    # Reconstitute "data" (i.e. everything after the timestamp and the
+    # event) from "words", which was originally obtained by splitting
+    # "data".
+    data = " ".join(words)
+    return f"{timestamp} {event} {data}"