1

"""

     2

    Parse ISC dhcpd messages from pvl.syslog.

     3

"""

     4

     5

from pvl.invoke import merge # XXX

     6

     7

import re

     8

     9

import logging; log = logging.getLogger('pvl.dhcp.syslog')

    10

    11

# TODO: use pvl.syslog.rule.SyslogRule?

    12

class DHCPSyslogParser (object) :

    13

    """

    14

        Parse SyslogMessages from SyslogParser for ISC dhcp semantics.

    15

    16

        TODO: BOOTREQUEST from <hwaddr> via <gateway>

    17

    """

    18

    19

    ## various message types sent/recieved by dhcpd

    20

    # from server/dhcp.c

    21

    TYPE_NAMES = (

    22

        "DHCPDISCOVER",

    23

        "DHCPOFFER",

    24

        "DHCPREQUEST",

    25

        "DHCPDECLINE",

    26

        "DHCPACK",

    27

        "DHCPNAK",

    28

        "DHCPRELEASE",

    29

        "DHCPINFORM",

    30

        "type 9",

    31

        "DHCPLEASEQUERY",

    32

        "DHCPLEASEUNASSIGNED",

    33

        "DHCPLEASEUNKNOWN",

    34

        "DHCPLEASEACTIVE"

    35

    )

    36

    37

    # message-parsing regexp..

    38

    RECV_MESSAGE_RE = (

    39

        # dhcpdiscover/ack_lease: info/error

    40

        #   hwaddr:     <no identifier>

    41

        #   hostname:   Hostname Unsuitable for Printing

    42

        #   error:

    43

        #               peer holds all free leases

    44

        #               network %s: no free leases

    45

        re.compile(r'(?P<type>DHCPDISCOVER) from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?)(: (?P<error>.+?))?$'),

    46

    47

        # dhcprequest

    48

        #   error:

    49

        #               wrong network.

    50

        #               ignored (not authoritative).

    51

        #               ignored (unknown subnet).

    52

        #               lease %s unavailable.

    53

        #               unknown lease %s.

    54

        re.compile(r'(?P<type>DHCPREQUEST) for (?P<lease>.+?)( \((?P<server>.+?)\))? from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?)(: (?P<error>.+?))?$'),

    55

    56

        # dhcprelease

    57

        re.compile(r'(?P<type>DHCPRELEASE) of (?P<lease>.+?) from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?) \((?P<found>.+?)\)$'),

    58

    59

        # dhcpdecline

    60

        #   status:

    61

        #       abandoned

    62

        #       not found

    63

        #       ignored

    64

        re.compile(r'(?P<type>DHCPDECLINE) of (?P<lease>.+?) from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?): (?P<status>.+?)$'),

    65

    66

        # dhcpinform

    67

        #   error:

    68

        #       ignored (null source address).

    69

        #       unknown subnet for relay address %s

    70

        #       unknown subnet for %s address %s

    71

        #       not authoritative for subnet %s

    72

        #

    73

        # TODO: DHCPINFORM with error indicates rogue dhcp

    74

        re.compile(r'(?P<type>DHCPINFORM) from (?P<lease>.+?) via (?P<gateway>.+?)(: (?P<error>.+?))?$'),

    75

    76

        # dhcpleasequery

    77

        re.compile(r'(?P<type>DHCPLEASEQUERY) from (?P<server>.+?)( for (?P<key_type>IP|client-id|MAC address) (?P<key>.+?))?(: (?P<error>.+?))?$'),

    78

    79

        # dhcp: generic/unknown packet

    80

        re.compile(r'(?P<type>\w+) from (?P<hwaddr>.+?) via (?P<gateway>.+?): (?P<error>.+?)$'),

    81

    )

    82

    83

    SEND_MESSAGE_RE = (

    84

        # dhcp_reply

    85

        re.compile(r'(?P<type>DHCPACK|DHCPOFFER|BOOTREPLY) on (?P<lease>.+?) to (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?)$'),

    86

    87

        # dhcpinform

    88

        #   hwaddr:     <no client hardware address>

    89

        re.compile(r'(?P<type>DHCPACK) to (?P<lease>.+?) \((?P<hwaddr>.+?)\) via (?P<gateway>.+?)$'),

    90

    91

        # nak_lease

    92

        re.compile(r'(?P<type>DHCPNAK) on (?P<lease>.+?) to (?P<hwaddr>.+?) via (?P<gateway>.+?)$'),

    93

    94

        # dhcpleasequery

    95

        re.compile(r'(?P<type>DHCPLEASEUNKNOWN|DHCPLEASEACTIVE|DHCPLEASEUNASSIGNED) to (?P<lease>.+?) for (?P<key_type>IP|client-id|MAC address) (?P<key>.+?) \((?P<count>\d+) associated IPs\)$'),

    96

    )

    97

    98

    MESSAGE_ERROR_RE = (

    99

        ('peer-all-free-leases',    re.compile('peer holds all free leases')),

   100

        ('no-free-leases',          re.compile(r'network (?P<network>.+?): no free leases')),

   101

        ('wrong-network',           re.compile(r'wrong network')),

   102

        ('ignored-not-auth',        re.compile(r'ignored \(not authoritative\)')),

   103

        ('ignored-unknown-subnet',  re.compile(r'ignored \(unknown subnet\)')),

   104

        ('lease-unavailable',       re.compile(r'lease (?P<lease>.+?) unavailable')),

   105

        ('lease-unknown',           re.compile(r'unknown lease (?P<lease>.+?).$')),

   106

    )

   107

   108

    ERROR_RE = (

   109

        # find_lease

   110

        ('duplicate-uid-lease', 

   111

            re.compile(r'uid lease (?P<client>.+?) for client (?P<hwaddr>.+?) is duplicate on (?P<shared_network>.+?)$')),

   112

   113

        # dhcprelease

   114

        ('dhcprelease-requested-address', 

   115

            re.compile(r'DHCPRELEASE from (?P<hwaddr>.+?) specified requested-address.')),

   116

   117

        # ???

   118

        ('unexpected-icmp-echo-reply',

   119

            re.compile(r'unexpected ICMP Echo Reply from (?P<client>.+?)$')),

   120

   121

        ('host-unknown',

   122

            re.compile(r'(?P<host>.+?): host unknown.')),

   123

    )

   124

   125

    IGNORE_RE = (

   126

        re.compile(r'Wrote (?P<count>\d+) (?P<what>.+?) to leases file.'),

   127

    )

   128

   129

    def parse (self, line) :

   130

        """

   131

            Match line against our regexps, returning a

   132

   133

                {

   134

                    tag:        send/recv/error,

   135

                    type:       ...,

   136

                    [error]:    ...,

   137

                    ...

   138

                }

   139

   140

            dict if matched

   141

   142

            Returns False if the message is ignored, or None if the no regexp matched.

   143

        """

   144

   145

        for tag, re_list in (

   146

            ('recv',    self.RECV_MESSAGE_RE),

   147

            ('send',    self.SEND_MESSAGE_RE),

   148

        ) :

   149

            for re in re_list :

   150

                # test

   151

                match = re.match(line)

   152

   153

                if match :

   154

                    data = match.groupdict()

   155

                    data['tag'] = tag

   156

   157

                    return data

   158

   159

        # error?

   160

        for type, re in self.ERROR_RE:

   161

            match = re.match(line)

   162

   163

            if match : 

   164

                data = match.groupdict()

   165

                data['tag'] = 'error'

   166

                data['type'] = type

   167

   168

                return data

   169

   170

        # ignore

   171

        for re in self.IGNORE_RE :

   172

            if re.match(line) :

   173

                # ignore

   174

                return False

   175

   176

        # unknown

   177

        return None

   178

   179

    def parse_error (self, error) :

   180

        """

   181

            Match given error status from send/recv against known types, returning a type name or None.

   182

        """

   183

   184

        for type, re in self.MESSAGE_ERROR_RE :

   185

            match = re.match(error)

   186

   187

            if match :

   188

                return type

   189

   190

        # nope

   191

        return None

   192

   193

    def process (self, source) :

   194

        """

   195

            Process syslog items from given source, yielding parsed DHCP items.

   196

        """

   197

   198

        for item in source :

   199

            dhcp_item = self.parse(item['msg'])

   200

   201

            log.debug("%s: %s", item, dhcp_item)

   202

   203

            if not dhcp_item :

   204

                # ignore

   205

                continue

   206

   207

            item = merge(item, dhcp_item)

   208

   209

            if item.get('error') :

   210

                item['error-type'] = self.parse_error(item['error'])

   211

   212

            yield item

   213

   214

    __call__ = process

   215

   216

   217

if __name__ == '__main__' :

   218

    import logging

   219

   220

    logging.basicConfig()

   221

   222

    import doctest

   223

    doctest.testmod()

   224