Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

some more decoders can now expose the underlying errors #50

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

some more decoders can now expose the underlying errors #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/decoders/darwin.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ pub(crate) fn permission(permissions: &str) -> String {

#[cfg(test)]
mod tests {
use crate::decoders::darwin::{errno_codes, permission};
use super::*;

#[test]
fn test_errno_codes() {
Expand Down
18 changes: 9 additions & 9 deletions src/decoders/decoder.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ pub(crate) fn check_objects(
} else if format_string.contains("bool") {
Ok(lowercase_bool(&message_values[index].message_strings))
} else if format_string.contains("uuid_t") {
Ok(parse_uuid(&message_values[index].message_strings))
parse_uuid(&message_values[index].message_strings)
} else if format_string.contains("darwin.errno") {
Ok(errno_codes(&message_values[index].message_strings))
} else if format_string.contains("darwin.mode") {
Expand Down Expand Up @@ -92,13 +92,13 @@ pub(crate) fn check_objects(
} else if format_string.contains("network:sockaddr") {
sockaddr(&message_values[index].message_strings)
} else if format_string.contains("time_t") {
Ok(parse_time(&message_values[index].message_strings))
parse_time(&message_values[index].message_strings)
} else if format_string.contains("mdns:dnshdr") {
parse_dns_header(&message_values[index].message_strings)
} else if format_string.contains("mdns:rd.svcb") {
get_service_binding(&message_values[index].message_strings)
} else if format_string.contains("location:IOMessage") {
Ok(io_message(&message_values[index].message_strings))
io_message(&message_values[index].message_strings).map(ToString::to_string)
} else if format_string.contains("mdnsresponder:domain_name") {
get_domain_name(&message_values[index].message_strings)
} else if format_string.contains("mdnsresponder:mac_addr") {
Expand All @@ -108,21 +108,21 @@ pub(crate) fn check_objects(
} else if format_string.contains("mdns:addrmv") {
Ok(dns_addrmv(&message_values[index].message_strings))
} else if format_string.contains("mdns:rrtype") {
Ok(dns_records(&message_values[index].message_strings))
dns_records(&message_values[index].message_strings).map(ToString::to_string)
} else if format_string.contains("mdns:nreason") {
Ok(dns_reason(&message_values[index].message_strings))
dns_reason(&message_values[index].message_strings).map(ToString::to_string)
} else if format_string.contains("mdns:protocol") {
Ok(dns_protocol(&message_values[index].message_strings))
dns_protocol(&message_values[index].message_strings).map(ToString::to_string)
} else if format_string.contains("mdns:dns.idflags") {
Ok(dns_idflags(&message_values[index].message_strings))
dns_idflags(&message_values[index].message_strings)
} else if format_string.contains("mdns:dns.counts") {
Ok(dns_counts(&message_values[index].message_strings))
dns_counts(&message_values[index].message_strings).map(|x| x.to_string())
} else if format_string.contains("mdns:yesno") {
Ok(dns_yes_no(&message_values[index].message_strings))
} else if format_string.contains("mdns:acceptable") {
Ok(dns_acceptable(&message_values[index].message_strings))
} else if format_string.contains("mdns:gaiopts") {
Ok(dns_getaddrinfo_opts(&message_values[index].message_strings))
dns_getaddrinfo_opts(&message_values[index].message_strings).map(ToString::to_string)
} else {
Ok(String::new())
};
Expand Down
179 changes: 86 additions & 93 deletions src/decoders/dns.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ use super::{
};
use crate::util::{decode_standard, extract_string, extract_string_size};
use byteorder::{BigEndian, WriteBytesExt};
use log::{error, warn};
use log::error;
use nom::{
bytes::complete::take,
combinator::{fail, iterator, map, map_parser, verify},
Expand Down Expand Up @@ -341,7 +341,7 @@ pub(crate) fn dns_addrmv(data: &str) -> String {
}

/// Translate DNS records to string
pub(crate) fn dns_records(data: &str) -> String {
pub(crate) fn dns_records(data: &str) -> Result<&'static str, DecoderError<'_>> {
// Found at https://en.wikipedia.org/wiki/List_of_DNS_record_types
let message = match data {
"1" => "A",
Expand Down Expand Up @@ -393,82 +393,78 @@ pub(crate) fn dns_records(data: &str) -> String {
"32768" => "TA",
"32769" => "DLV",
_ => {
warn!(
"[macos-unifiedlogs] Unknown DNS Resource Record Type: {}",
data
);
data
return Err(DecoderError::Parse {
input: data.as_bytes(),
parser_name: "dns records",
message: "Unknown DNS Resource Record Type",
});
}
};
message.to_string()
Ok(message)
}

/// Translate DNS response/reason? to string
pub(crate) fn dns_reason(data: &str) -> String {
pub(crate) fn dns_reason(data: &str) -> Result<&'static str, DecoderError<'_>> {
let message = match data {
"1" => "no-data",
"4" => "query-suppressed",
"3" => "no-dns-service",
"2" => "nxdomain",
"5" => "server error",
_ => {
warn!("[macos-unifiedlogs] Unknown DNS Reason: {}", data);
data
return Err(DecoderError::Parse {
input: data.as_bytes(),
parser_name: "dns reason",
message: "Unknown DNS Reason",
});
}
};
message.to_string()
Ok(message)
}

/// Translate the DNS protocol used
pub(crate) fn dns_protocol(data: &str) -> String {
pub(crate) fn dns_protocol(data: &str) -> Result<&'static str, DecoderError<'_>> {
let message = match data {
"1" => "UDP",
"2" => "TCP",
//"3" => "HTTP",??
"4" => "HTTPS",
_ => {
warn!("[macos-unifiedlogs] Unknown DNS Protocol: {}", data);
data
return Err(DecoderError::Parse {
input: data.as_bytes(),
parser_name: "dns protocol",
message: "Unknown DNS Protocol",
});
}
};
message.to_string()
Ok(message)
}

/// Get just the DNS flags associated with the DNS header
pub(crate) fn dns_idflags(data: &str) -> String {
let flags_results = data.parse::<u32>();
let flags: u32 = match flags_results {
Ok(results) => results,
Err(err) => {
error!(
"[macos-unifiedlogs] Failed to convert ID Flags to int: {:?}",
err
);
return data.to_string();
}
};
pub(crate) fn dns_idflags(input: &str) -> Result<String, DecoderError<'_>> {
let flags = input.parse::<u32>().map_err(|_| DecoderError::Parse {
input: input.as_bytes(),
parser_name: "dns id flags",
message: "Failed to convert ID Flags to int",
})?;

let mut bytes = [0u8; size_of::<u32>()];
let result = bytes.as_mut().write_u32::<BigEndian>(flags);
match result {
Ok(_) => {}
Err(err) => {
error!(
"[macos-unifiedlogs] Failed to convert ID Flags to bytes: {:?}",
err
);
return data.to_string();
}
}
bytes
.as_mut()
.write_u32::<BigEndian>(flags)
.map_err(|_| DecoderError::Parse {
input: input.as_bytes(),
parser_name: "dns id flags",
message: "Failed to convert ID Flags to bytes",
})?;

let (_, result) = parse_idflags(&bytes).map_err(|_| DecoderError::Parse {
input: input.as_bytes(),
parser_name: "dns id flags",
message: "Failed to get ID Flags",
})?;

let message_result = parse_idflags(&bytes);
match message_result {
Ok((_, result)) => result,
Err(err) => {
error!("[macos-unifiedlogs] Failed to get ID Flags: {:?}", err);
data.to_string()
}
}
Ok(result)
}

/// Parse just the DNS flags associated with the DNS header
Expand All @@ -494,47 +490,34 @@ fn parse_idflags(data: &[u8]) -> nom::IResult<&[u8], String> {
}

/// Get just the DNS count data associated with the DNS header
pub(crate) fn dns_counts(data: &str) -> String {
// todo: not sure error handling should be handled as strings
// todo: this function

let flags_results = data.parse::<u64>();
let flags: u64 = match flags_results {
Ok(results) => results,
Err(err) => {
error!(
"[macos-unifiedlogs] Failed to convert counts to int: {:?}",
err
);
return data.to_string();
}
};
pub(crate) fn dns_counts(input: &str) -> Result<DnsCounts, DecoderError<'_>> {
let flags = input.parse::<u64>().map_err(|_| DecoderError::Parse {
input: input.as_bytes(),
parser_name: "dns counts",
message: "Failed to convert counts to int",
})?;

let mut bytes = [0u8; size_of::<u64>()];
let result = bytes.as_mut().write_u64::<BigEndian>(flags);
match result {
Ok(_) => {}
Err(err) => {
error!(
"[macos-unifiedlogs] Failed to convert counts to bytes: {:?}",
err
);
return data.to_string();
}
}
bytes
.as_mut()
.write_u64::<BigEndian>(flags)
.map_err(|_| DecoderError::Parse {
input: input.as_bytes(),
parser_name: "dns counts",
message: "Failed to convert counts to bytes",
})?;

let (_, counts) = parse_counts(&bytes).map_err(|_| DecoderError::Parse {
input: input.as_bytes(),
parser_name: "dns counts",
message: "Failed to get counts",
})?;

let message_result = parse_counts(&bytes);
match message_result {
Ok((_, result)) => result.to_string(),
Err(err) => {
error!("[macos-unifiedlogs] Failed to get counts: {:?}", err);
data.to_string()
}
}
Ok(counts)
}

#[derive(Debug, PartialEq)]
struct DnsCounts {
pub(crate) struct DnsCounts {
question: u16,
answer: u16,
authority: u16,
Expand Down Expand Up @@ -584,18 +567,21 @@ pub(crate) fn dns_acceptable(data: &str) -> String {
}

/// Translate DNS getaddrinfo log values
pub(crate) fn dns_getaddrinfo_opts(data: &str) -> String {
pub(crate) fn dns_getaddrinfo_opts(data: &str) -> Result<&'static str, DecoderError<'_>> {
let message = match data {
"0" => "0x0 {}",
"8" => "0x8 {use-failover}",
"12" => "0xC {in-app-browser, use-failover}",
"24" => "0x18 {use-failover, prohibit-encrypted-dns}",
_ => {
warn!("[macos-unifiedlogs] Unknown getaddrinfo options: {}", data);
data
return Err(DecoderError::Parse {
input: data.as_bytes(),
parser_name: "dns getaddrinfo opts",
message: "Unknown DNS getaddrinfo options",
});
}
};
message.to_string()
Ok(message)
}

#[cfg(test)]
Expand Down Expand Up @@ -734,31 +720,31 @@ mod tests {
fn test_dns_records() {
let test_data = "65";

let result = dns_records(test_data);
let result = dns_records(test_data).unwrap();
assert_eq!(result, "HTTPS");
}

#[test]
fn test_dns_reason() {
let test_data = "1";

let result = dns_reason(test_data);
let result = dns_reason(test_data).unwrap();
assert_eq!(result, "no-data");
}

#[test]
fn test_dns_protocol() {
let test_data = "1";

let result = dns_protocol(test_data);
let result = dns_protocol(test_data).unwrap();
assert_eq!(result, "UDP");
}

#[test]
fn test_dns_idflags() {
let test_data = "2126119168";

let result = dns_idflags(test_data);
let result = dns_idflags(test_data).unwrap();
assert_eq!(result, "id: 0x7EBA, flags: 0x100 Opcode: QUERY, \n Query Type: 0,\n Authoritative Answer Flag: 0, \n Truncation Flag: 0, \n Recursion Desired: 1, \n Recursion Available: 0, \n Response Code: No Error");
}

Expand All @@ -774,8 +760,15 @@ mod tests {
fn test_dns_counts() {
let test_data = "281474976710656";

let result = dns_counts(test_data);
assert_eq!(result, "Question Count: 1, Answer Record Count: 0, Authority Record Count: 0, Additional Record Count: 0");
let result = dns_counts(test_data).unwrap();
let expected = DnsCounts {
question: 1,
answer: 0,
authority: 0,
additional: 0,
};

assert_eq!(result, expected);
}

#[test]
Expand Down Expand Up @@ -814,7 +807,7 @@ mod tests {
fn test_dns_getaddrinfo_opts() {
let test_data = "8";

let result = dns_getaddrinfo_opts(test_data);
let result = dns_getaddrinfo_opts(test_data).unwrap();
assert_eq!(result, "0x8 {use-failover}");
}
}
14 changes: 8 additions & 6 deletions src/decoders/location.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -419,7 +419,7 @@ fn location_tracker_object(tracker: &LocationTrackerState) -> String {
}

/// Parse location tracker state data
pub(crate) fn io_message(data: &str) -> String {
pub(crate) fn io_message(data: &str) -> Result<&'static str, DecoderError<'_>> {
// Found in dyldcache
let message = match data {
"3758097008" => "CanSystemSleep",
Expand Down Expand Up @@ -447,11 +447,14 @@ pub(crate) fn io_message(data: &str) -> String {
"3758096976" => "SystemWillPowerOff",
"3758096981" => "SystemPagingOff",
_ => {
warn!("[macos-unifiedlogs] Unknown IO Message: {}", data);
data
return Err(DecoderError::Parse {
input: data.as_bytes(),
parser_name: "io message",
message: "Unknown IO Message",
});
}
};
message.to_string()
Ok(message)
}

/// Parse and get the location Daemon tracker
Expand Down Expand Up @@ -640,8 +643,7 @@ mod tests {
#[test]
fn test_io_message() {
let test_data = "3758096981";
let result = io_message(test_data);

let result = io_message(test_data).unwrap();
assert_eq!(result, "SystemPagingOff")
}

Expand Down
Loading