1

"""

     2

    Parse ISC dhcpd messages in syslog.

     3

"""

     4

     5

import re

     6

    11

    """

    12

        Parse SyslogMessages from SyslogParser for ISC dhcp semantics.

    13

    """

    14

    15

    ## various message types sent/recieved by dhcpd

    16

    # from server/dhcp.c

    17

    TYPE_NAMES = (

    18

        "DHCPDISCOVER",

    19

        "DHCPOFFER",

    20

        "DHCPREQUEST",

    21

        "DHCPDECLINE",

    22

        "DHCPACK",

    23

        "DHCPNAK",

    24

        "DHCPRELEASE",

    25

        "DHCPINFORM",

    26

        "type 9",

    27

        "DHCPLEASEQUERY",

    28

        "DHCPLEASEUNASSIGNED",

    29

        "DHCPLEASEUNKNOWN",

    30

        "DHCPLEASEACTIVE"

    31

    )

    32

    33

    # message-parsing regexp..

    34

    RECV_MESSAGE_RE = (

    35

        # dhcpdiscover/ack_lease: info/error

    36

        #   hwaddr:     <no identifier>

    37

        #   hostname:   Hostname Unsuitable for Printing

    38

        #   error:

    39

        #               peer holds all free leases

    40

        #               network %s: no free leases

    41

        re.compile(r'(?P<type>DHCPDISCOVER) from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?)(: (?P<error>.+?))?$'),

    42

    43

        # dhcprequest

    44

        #   error:

    45

        #               wrong network.

    46

        #               ignored (not authoritative).

    47

        #               ignored (unknown subnet).

    48

        #               lease %s unavailable.

    49

        #               unknown lease %s.

    50

        re.compile(r'(?P<type>DHCPREQUEST) for (?P<lease>.+?)( \((?P<server>.+?)\))? from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?)(: (?P<error>.+?))?$'),

    51

    52

        # dhcprelease

    53

        re.compile(r'(?P<type>DHCPRELEASE) of (?P<lease>.+?) from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?) \((?P<found>.+?)\)$'),

    54

    55

        # dhcpdecline

    56

        #   status:

    57

        #       abandoned

    58

        #       not found

    59

        #       ignored

    60

        re.compile(r'(?P<type>DHCPDECLINE) of (?P<lease>.+?) from (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?): (?P<status>.+?)$'),

    61

    62

        # dhcpinform

    63

        #   error:

    64

        #       ignored (null source address).

    65

        #       unknown subnet for relay address %s

    66

        #       unknown subnet for %s address %s

    67

        #       not authoritative for subnet %s

    68

        re.compile(r'(?P<type>DHCPINFORM) from (?P<lease>.+?) via (?P<gateway>.+?)(: (?P<error>.+?))?$'),

    69

    70

        # dhcpleasequery

    71

        re.compile(r'(?P<type>DHCPLEASEQUERY) from (?P<server>.+?)( for (?P<key_type>IP|client-id|MAC address) (?P<key>.+?))?(: (?P<error>.+?))?$'),

    72

    73

        # dhcp: generic/unknown packet

    74

        re.compile(r'(?P<type>\w+) from (?P<hwaddr>.+?) via (?P<gateway>.+?): (?P<error>.+?)$'),

    75

    )

    76

    77

    SEND_MESSAGE_RE = (

    78

        # dhcp_reply

    79

        re.compile(r'(?P<type>DHCPACK|DHCPOFFER|BOOTREPLY) on (?P<lease>.+?) to (?P<hwaddr>.+?)( \((?P<hostname>.+?)\))? via (?P<gateway>.+?)$'),

    80

    81

        # dhcpinform

    82

        #   hwaddr:     <no client hardware address>

    83

        re.compile(r'(?P<type>DHCPACK) to (?P<lease>.+?) \((?P<hwaddr>.+?)\) via (?P<gateway>.+?)$'),

    84

    85

        # nak_lease

    86

        re.compile(r'(?P<type>DHCPNAK) on (?P<lease>.+?) to (?P<hwaddr>.+?) via (?P<gateway>.+?)$'),

    87

    88

        # dhcpleasequery

    89

        re.compile(r'(?P<type>DHCPLEASEUNKNOWN|DHCPLEASEACTIVE|DHCPLEASEUNASSIGNED) to (?P<lease>.+?) for (?P<key_type>IP|client-id|MAC address) (?P<key>.+?) \((?P<count>\d+) associated IPs\)$'),

    90

    )

    91

    92

    MESSAGE_ERROR_RE = (

    93

        ('peer-all-free-leases',    re.compile('peer holds all free leases')),

    94

        ('no-free-leases',          re.compile(r'network (?P<network>.+?): no free leases')),

    95

        ('wrong-network',           re.compile(r'wrong network')),

    96

        ('ignored-not-auth',        re.compile(r'ignored \(not authoritative\)')),

    97

        ('ignored-unknown-subnet',  re.compile(r'ignored \(unknown subnet\)')),

    98

        ('lease-unavailable',       re.compile(r'lease (?P<lease>.+?) unavailable')),

    99

        ('lease-unknown',           re.compile(r'unknown lease (?P<lease>.+?).$')),

   100

    )

   101

   102

    ERROR_RE = (

   103

        # find_lease

   104

        ('duplicate-uid-lease', 

   105

            re.compile(r'uid lease (?P<client>.+?) for client (?P<hwaddr>.+?) is duplicate on (?P<shared_network>.+?)$')),

   106

   107

        # dhcprelease

   108

        ('dhcprelease-requested-address', 

   109

            re.compile(r'DHCPRELEASE from (?P<hwaddr>.+?) specified requested-address.')),

   110

   111

        # ???

   112

        ('unexpected-icmp-echo-reply',

   113

            re.compile(r'unexpected ICMP Echo Reply from (?P<client>.+?)$')),

   114

   115

        ('host-unknown',

   116

            re.compile(r'(?P<host>.+?): host unknown.')),

   117

    )

   118

   119

    IGNORE_RE = (

   120

        re.compile(r'Wrote (?P<count>\d+) (?P<what>.+?) to leases file.'),

   121

    )

   122

   123

    def parse (self, line) :

   124

        """

   125

            Match line against our regexps, returning a

   126

   127

                {

   128

                    tag:        send/recv/error,

   129

                    type:       ...,

   130

                    [error]:    ...,

   131

                    ...

   132

                }

   133

   134

            dict if matched

   135

   136

            Returns False if the message is ignored, or None if the no regexp matched.

   137

        """

   138

   139

        for tag, re_list in (

   140

            ('recv',    self.RECV_MESSAGE_RE),

   141

            ('send',    self.SEND_MESSAGE_RE),

   142

        ) :

   143

            for re in re_list :

   144

                # test

   145

                match = re.match(line)

   146

   147

                if match :

   148

                    data = match.groupdict()

   149

                    data['tag'] = tag

   150

   151

                    return data

   152

   153

        # error?

   154

        for type, re in self.ERROR_RE:

   155

            match = re.match(line)

   156

   157

            if match : 

   158

                data = match.groupdict()

   159

                data['tag'] = 'error'

   160

                data['type'] = type

   161

   162

                return data

   163

   164

        # ignore

   165

        for re in self.IGNORE_RE :

   166

            if re.match(line) :

   167

                # ignore

   168

                return False

   169

   170

        # unknown

   171

        return None

   172

   173

    def parse_error (self, error) :

   174

        """

   175

            Match given error status from send/recv against known types, returning a type name or None.

   176

        """

   177

   178

        for type, re in self.MESSAGE_ERROR_RE :

   179

            match = re.match(error)

   180

   181

            if match :

   182

                return type

   183

   184

        # nope

   185

        return None

   186

   187

if __name__ == '__main__' :

   188

    import logging

   189

   190

    logging.basicConfig()

   191

   192

    import doctest

   193

    doctest.testmod()

   194