]> gitweb.michael.orlitzky.com - djbdns-logparse.git/blob - djbdns/common.py
doc/COPYING: add one for the "or later" bit
[djbdns-logparse.git] / djbdns / common.py
1 r"""
2 Information needed to parse *both* tinydns and dnscache logs.
3 """
4 from struct import pack
5
6 # A pattern to match the timestamp format that the tai64nlocal program
7 # produces. It appears in both dnscache and tinydns lines, after
8 # they've been piped through tai64nlocal, of course.
9 TIMESTAMP_PAT = r'[\d-]+ [\d:\.]+'
10
11 # A dictionary mapping query type identifiers, in decimal, to their
12 # friendly names for tinydns. Reference:
13 #
14 # https://en.wikipedia.org/wiki/List_of_DNS_record_types
15 #
16 # This list *should* be exhaustive, and we hope it is, because the log
17 # parser will now crash if it encounters a type it doesn't know about.
18 QUERY_TYPE_NAME = {
19 1: "a",
20 2: "ns",
21 3: "md",
22 4: "mf",
23 5: "cname",
24 6: "soa",
25 7: "mb",
26 8: "mg",
27 9: "mr",
28 10: "null",
29 11: "wks",
30 12: "ptr",
31 13: "hinfo",
32 14: "minfo",
33 15: "mx",
34 16: "txt",
35 17: "rp",
36 18: "afsdb",
37 19: "x25",
38 20: "isdn",
39 21: "rt",
40 22: "nsap",
41 23: "nsap-ptr",
42 24: "sig",
43 25: "key",
44 26: "px",
45 27: "gpos",
46 28: "aaaa",
47 29: "loc",
48 30: "nxt",
49 31: "eid",
50 32: "nimloc",
51 33: "srv",
52 34: "atma",
53 35: "naptr",
54 36: "kx",
55 37: "cert",
56 38: "a6",
57 39: "dname",
58 40: "sink",
59 41: "opt",
60 42: "apl",
61 43: "ds",
62 44: "sshfp",
63 45: "ipseckey",
64 46: "rrsig",
65 47: "nsec",
66 48: "dnskey",
67 49: "dhcid",
68 50: "nsec3",
69 51: "nsec3param",
70 52: "tlsa",
71 53: "smimea",
72 55: "hip",
73 56: "ninfo",
74 57: "rkey",
75 58: "talink",
76 59: "cds",
77 60: "cdnskey",
78 61: "openpgpkey",
79 62: "csync",
80 63: "zonemd",
81 64: "svcb",
82 65: "https",
83 99: "spf",
84 100: "uinfo",
85 101: "uid",
86 102: "gid",
87 103: "unspec",
88 104: "nid",
89 105: "l32",
90 106: "l64",
91 107: "lp",
92 108: "eui48",
93 109: "euc64",
94 249: "tkey",
95 250: "tsig",
96 251: "ixfr",
97 252: "axfr",
98 253: "mailb",
99 254: "maila",
100 255: "any",
101 256: "uri",
102 257: "caa",
103 259: "doa",
104 32768: "ta",
105 32769: "dlv"
106 }
107
108 def convert_ip(ip : str) -> str:
109 r"""
110 Convert a hex string representing an IP address to
111 human-readable form.
112
113 Parameters
114 ----------
115
116 ip : str
117 The hexadecimal representation of either an IPv4 or an IPv6
118 address.
119
120 Returns
121 -------
122
123 The usual decimal dotted-quad representation is returned for an
124 IPv4 address. IPv6 addresses are returned almost as-is, but with
125 colons inserted in the appropriate places, between every four
126 characters.
127
128 Examples
129 --------
130
131 >>> convert_ip("7f000001")
132 '127.0.0.1'
133 >>> convert_ip("00000000000000000000ffff7f000001")
134 '0000:0000:0000:0000:0000:ffff:7f00:0001'
135 """
136 if len(ip) == 8:
137 # IPv4, eg. "7f000001" -> "7f 00 00 01" -> "127.0.0.1"
138 return ".".join(map(str, pack(">L", int(ip, 16))))
139
140 # IPv6 is actually simpler -- it's just a string-slicing operation.
141 return ":".join([ip[(4*i) : (4*i+4)] for i in range(8)])