bin/djbdns-logparse

   1 #!/usr/bin/python3
   2 """
   3 Convert tinydns and dnscache logs to human-readable form
   4 """
   5
   6 #
   7 # Reads log files from tinydns and/or dnscache and prints them out in
   8 # human-readable form. Logs can be supplied on stdin, or listed on the
   9 # command line:
  10 #
  11 #   $ cat @*.s | djbdns-logparse
  12 #   $ djbdns-logparse @*.s
  13 #   $ tail -f current | djbdns-logparse
  14 #
  15 # Pipes each log file through tai64nlocal, which must be on your path.
  16 #
  17 # Acknowledgments:
  18 #
  19 # * The log format descriptions by Rob Mayoff were invaluable:
  20 #   ** http://dqd.com/~mayoff/notes/djbdns/tinydns-log.html
  21 #   ** http://dqd.com/~mayoff/notes/djbdns/dnscache-log.html
  22 #
  23 # * Faried Nawaz's dnscache log parser was the original inspiration:
  24 #   ** http://www.hungry.com/~fn/dnscache-log.pl.txt
  25 #
  26
  27 import sys, re
  28 from struct import pack
  29 from time import strftime, gmtime
  30 from subprocess import Popen, PIPE
  31
  32
  33 # common components of line-matching regexes
  34 timestamp_pat = r'[\d-]+ [\d:\.]+'      # output of tai64nlocal
  35 hex4_pat = r'[0-9a-f]{4}'
  36 ip_pat = r'[0-9a-f]{8,32}'              # IPv4 or IPv6 addresses in hex
  37
  38 # discriminate between dnscache and tinydns log lines
  39 tinydns_log_re = re.compile(
  40     r'(%s) (%s):(%s):(%s) ([\+\-IC/]) (%s) (.*)'
  41     % (timestamp_pat, ip_pat, hex4_pat, hex4_pat, hex4_pat))
  42 dnscache_log_re = re.compile(r'(%s) (\w+)(.*)' % timestamp_pat)
  43
  44 query_type = {
  45       1: "a",
  46       2: "ns",
  47       5: "cname",
  48       6: "soa",
  49      12: "ptr",
  50      13: "hinfo",
  51      15: "mx",
  52      16: "txt",
  53      17: "rp",
  54      24: "sig",
  55      25: "key",
  56      28: "aaaa",
  57      38: "a6",
  58     252: "axfr",
  59     255: "any",
  60 }
  61
  62 # for tinydns only
  63 query_drop_reason = {
  64     "-": "no authority",
  65     "I": "invalid query",
  66     "C": "invalid class",
  67     }
  68
  69
  70 def convert_ip(ip):
  71     """Convert a hex string representing an IP address to conventional
  72     human-readable form, ie. dotted-quad decimal for IPv4, and
  73     8 colon-separated hex shorts for IPv6.
  74     """
  75     if len(ip) == 8:
  76         # IPv4, eg. "7f000001" -> "127.0.0.1"
  77         return "%d.%d.%d.%d" % tuple(pack(">L", int(ip, 16)))
  78     elif len(ip) == 32:
  79         # IPv6 is actually simpler -- it's just a string-slicing operation,
  80         # eg. "00000000000000000000ffff7f000001" ->
  81         # "0000:0000:0000:0000:0000:ffff:7f00:0001"
  82         return ":".join([ip[(4*i) : (4*i+4)] for i in range(8)])
  83
  84
  85 def _cvt_ip(match):
  86     return convert_ip(match.group(1))
  87
  88 def _cvt_port(match):
  89     return ":" + str(int(match.group(1), 16))
  90
  91 def decode_client(words, i):
  92     chunks = words[i].split(":")
  93     if len(chunks) == 2:                # ip:port
  94         words[i] = "%s:%d" % (convert_ip(chunks[0]), int(chunks[1], 16))
  95     elif len(chunks) == 3:
  96         words[i] = "%s:%d (id %d)" % (convert_ip(chunks[0]),
  97                                       int(chunks[1], 16),
  98                                       int(chunks[2], 16))
  99
 100 def decode_ip(words, i):
 101     words[i] = convert_ip(words[i])
 102
 103 def decode_ttl(words, i):
 104     words[i] = "TTL=%s" % words[i]
 105
 106 def decode_serial(words, i):
 107     serial = int(words[i])
 108     words[i] = "#%d" % serial
 109
 110 def decode_type(words, i):
 111     qt = words[i]
 112     words[i] = query_type.get(int(qt), qt)
 113
 114 def handle_dnscache_log(line, match):
 115     (timestamp, event, data) = match.groups()
 116
 117     words = data.split()
 118     if event == "cached":
 119         if words[0] not in ("cname", "ns", "nxdomain"):
 120             decode_type(words, 0)
 121
 122     elif event == "drop":
 123         decode_serial(words, 0)
 124
 125     elif event == "lame":
 126         decode_ip(words, 0)
 127
 128     elif event == "nodata":
 129         decode_ip(words, 0)
 130         decode_ttl(words, 1)
 131         decode_type(words, 2)
 132
 133     elif event == "nxdomain":
 134         decode_ip(words, 0)
 135         decode_ttl(words, 1)
 136
 137     elif event == "query":
 138         decode_serial(words, 0)
 139         decode_client(words, 1)
 140         decode_type(words, 2)
 141
 142     elif event == "rr":
 143         decode_ip(words, 0)
 144         decode_ttl(words, 1)
 145         if words[2] not in ("cname", "mx", "ns", "ptr", "soa"):
 146             decode_type(words, 2)
 147             if words[2] == "a":         # decode answer to an A query
 148                 decode_ip(words, 4)
 149             if words[2] == "txt":       # text record
 150                 response = words[4]
 151                 if response.endswith("..."):
 152                     ellipsis = "..."
 153                     response = response[0:-3]
 154                 else:
 155                     ellipsis = ""
 156                 length = int(response[0:2], 16)
 157                 chars = []
 158                 for i in range(1, len(response)/2):
 159                     chars.append(chr(int(response[2*i : (2*i)+2], 16)))
 160                 words[4] = "%d:\"%s%s\"" % (length, "".join(chars), ellipsis)
 161
 162     elif event == "sent":
 163         decode_serial(words, 0)
 164
 165     elif event == "stats":
 166         words[0] = "count=%s" % words[0]
 167         words[1] = "motion=%s" % words[1]
 168         words[2] = "udp-active=%s" % words[2]
 169         words[3] = "tcp-active=%s" % words[3]
 170
 171     elif event == "tx":
 172         words[0] = "g=%s" % words[0]
 173         decode_type(words, 1)
 174         # words[2] = name
 175         # words[3] = control (domain for which these servers are believed
 176         #            to be authoritative)
 177         for i in range(4, len(words)):
 178             decode_ip(words, i)
 179
 180     elif event in ("tcpopen", "tcpclose"):
 181         decode_client(words, 0)
 182
 183     print(timestamp, event, " ".join(words))
 184
 185
 186 def handle_tinydns_log(line, match):
 187     (timestamp, ip, port, id, code, type, name) = match.groups()
 188     ip = convert_ip(ip)
 189     port = int(port, 16)
 190     id = int(id, 16)
 191     type = int(type, 16)                # "001c" -> 28
 192     type = query_type.get(type, type)   # 28 -> "aaaa"
 193
 194     print(timestamp, end=' ')
 195
 196     if code == "+":
 197         print ("sent response to %s:%s (id %s): %s %s"
 198                % (ip, port, id, type, name))
 199     elif code in ("-", "I", "C"):
 200         reason = query_drop_reason[code]
 201         print ("dropped query (%s) from %s:%s (id %s): %s %s"
 202                % (reason, ip, port, id, type, name))
 203     elif code == "/":
 204         print ("dropped query (couldn't parse) from %s:%s"
 205                % (ip, port))
 206     else:
 207         print ("%s from %s:%s (id %s): %s %s"
 208                % (code, ip, port, id, type, name))
 209
 210
 211 def parse_logfile(file):
 212     # Open pipe to tai64nlocal: we will write lines of our input (the
 213     # raw log file) to it, and read log lines with readable timestamps
 214     # from it.
 215     tai = Popen(["tai64nlocal"], stdin=PIPE, stdout=PIPE, text=True, bufsize=0)
 216
 217     for line in file:
 218         tai.stdin.write(line)
 219         line = tai.stdout.readline()
 220
 221         match = tinydns_log_re.match(line)
 222         if match:
 223             handle_tinydns_log(line, match)
 224             continue
 225
 226         match = dnscache_log_re.match(line)
 227         if match:
 228             handle_dnscache_log(line, match)
 229             continue
 230
 231         print(line)
 232
 233 def main():
 234     # Create an argument parser using the file's docsctring as its
 235     # description.
 236     from argparse import ArgumentParser, FileType
 237     parser = ArgumentParser(description = __doc__)
 238
 239     # Parse zero or more positional arguments into a list of
 240     # "logfiles". If none are given, read from stdin instead.
 241     parser.add_argument("logfiles",
 242                         metavar="LOGFILE",
 243                         type=FileType("r"),
 244                         nargs="*",
 245                         default=[sys.stdin],
 246                         help="djbdns logfile to process (default: stdin)")
 247
 248     args = parser.parse_args()
 249     for f in args.logfiles:
 250         parse_logfile(f)
 251
 252
 253
 254
 255 if __name__ == "__main__":
 256     main()