infidel/iptables-parser
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Parse success, python ctypes struct to library connected

Browse Source
This commit is contained in:
infidel 2023-10-25 23:51:08 +07:00
parent e420442b3d
commit cfa5264b16
8 changed files with 1836 additions and 1530 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Makefile
View File

@ -1,10 +1,14 @@
CC=gcc
CFLAGS=
SFLAGS=-shared -fPIC
DEBUG=-g
TARGET_DIR=lib
parser_lib.so: $(TARGET_DIR)
$(CC) $(SFLAGS) iptables_parser_lib.c -o $(TARGET_DIR)/$@
$(CC) $(SFLAGS) src/iptables_parser.c -o $(TARGET_DIR)/$@
parser: $(TARGET_DIR)
$(CC) iptables_parser.c -o $(TARGET_DIR)/$@
$(CC) src/iptables_parser.c -o $(TARGET_DIR)/$@
parser_dbg: $(TARGET_DIR)
$(CC) $(DEBUG) src/iptables_parser.c -o $(TARGET_DIR)/$@

36
Readme.md
View File

@ -1,11 +1,39 @@
# Infidel's iptables log parser
# Iptables Log parser
## Codes
## How To
### Build
```c=
mkdir lib
#Compile the library
make parse_lib.so
```
### Execute
```bash=
./wrapper.py
```
## Structure
### wrapper.py
Reads, iptables.log and calls the c `parser_lib.so`. Feed the parser library with lines from iptables log.
Reads, iptables.log and calls the `lib/parser_lib.so`. Feed the parser library with lines from iptables log.
### parser_lib.so
### lib/parser_lib.so
Process the sed like operation on the line by line feeded by `wrapper.py`.
Current parsed values are :
- Source IP
- Destination IP
- Packet Length
- Interface IN
- Interface OUT
- Protocol

2438
example/iptables.log
View File

File diff suppressed because it is too large Load Diff

157
iptables_parser.c
View File

@ -1,157 +0,0 @@
#include <stdio.h>
#include <string.h>
int main()
{
int h,i,j,k,l,v,w,x,y,ctr,dtr;
char str_in[200];
char newString[200][200];
char newParam[100][100];
char str_final[50];
char *filename = "example/iptables.log";
FILE *fp = fopen(filename, "r");
if (fp == NULL)
{
printf("Error: could not open file %s", filename);
return 1;
}
// reading line by line, max 256 bytes
const unsigned MAX_LENGTH = 256;
char buffer[MAX_LENGTH];
h = 0;
while (fgets(buffer, MAX_LENGTH, fp)) {
h = h + 1;
}
//printf(" %d\n ", h);
i = 0;
fclose(fp);
fp = fopen(filename, "r");
while (fgets(buffer, MAX_LENGTH, fp)) {
// printf("- %d -", i);
if ( i > h-10 ) {
j=0; ctr=0;
printf("\n%d -> %s \n", i, buffer);
//printf("[%d]\t[ Param ]\t\t[ Value ] \n", i);
for (x=0; x <= (strlen(buffer)); x++)
{
if(buffer[x]==' '|| buffer[x]=='\0' || buffer[x]=='\n'){
newString[ctr][j]='\0';
ctr++;
j=0;
}
else {
newString[ctr][j]=buffer[x];
j++;
}
}
for (v=0; v <= ctr ; v++) {
// printf("[ %d ]----> %s \n", v, newString[v]);
strcpy(str_in, newString[v]);
// printf("\n[%d]----> %s \n", i, str_in);
k=0; dtr=0;
memset(newParam, 0, sizeof newParam);
for (w=0; w <= (strlen(str_in)) ; w++) {
if(str_in[w]=='='){
newParam[dtr][k]='\0';
dtr++;
k=0;
}
// else if(str_in[w]!='\n' && str_in[w]!=' ') {
else {
newParam[dtr][k]=str_in[w];
k++;
}
}
strcpy(str_final, newParam[0]);
// if ( newParam[0] && newParam[0][0] != "\n" ) {
if ( *str_final == EOF ) {
// if strcmp(&str_final, '\n') {
continue;
}
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
// printf("*******************\n");
// printf("-< %s >-\n", str_final);
// printf("-< %s >-\n", newParam[1]);
// if (str_final=="SRC"){
// printf("[ Value %d]----> %s \n", i, newParam[1]);
// for (l=0; l <= dtr ; l++) {
// printf("[ + %d]----> %s \n", w, newParam[l]);
// }
if (strcmp(str_final,"SRC") == 0){
printf("[.]----------------------------------------n");
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"DST") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"SPT") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"DPT") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
}
// j=0; ctr=0;
// for (v=0; v <= (strlen(newString)); v++) {
// if(newString[v]=='='){
// newParam[ctr][j]='\0';
// ctr++;
// j=0;
// }
// else {
// newParam[ctr][j]=newString[v];
// j++;
// }
// }
}
i = i +1 ;
// printf("\n==================================================================================\n");
}
// close the file
fclose(fp);
return 0;
}

346
src/iptables_parser.c Normal file
View File

@ -0,0 +1,346 @@
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include "struct.h"
#define KNRM "\x1B[0m"
#define KRED "\x1B[31m"
#define KGRN "\x1B[32m"
#define KYEL "\x1B[33m"
#define KBLU "\x1B[34m"
#define KMAG "\x1B[35m"
#define KCYN "\x1B[36m"
#define KWHT "\x1B[37m"
#define RESET "\033[0m"
struct log_data *line_parse(char * line_dump){
//Struct
struct log_data *data = malloc(sizeof(struct log_data));
//
int h,i,j,k,l,v,w,x,y,ctr,dtr;
char str_in[200];
char newString[200][200];
char newParam[100][100];
char str_final[50];
//data->dst_ip = strdup(line_dump);
//printf("-< %s >-\n", data->dst_ip);
j=0; ctr=0;
//printf("\n%d -> %s \n", i, line_dump);
//printf("[%d]\t[ Param ]\t\t[ Value ] \n", i);
if ( *line_dump == EOF ) {
// if strcmp(&str_final, '\n') {
return 0;
}
for (x=0; x <= (strlen(line_dump)); x++)
{
if(line_dump[x]==' '|| line_dump[x]=='\0' || line_dump[x]=='\n'){
newString[ctr][j]='\0';
ctr++;
j=0;
}
else {
newString[ctr][j]=line_dump[x];
j++;
}
//printf("-< %s >-\n", newString[ctr]);
}
for (v=0; v <= ctr ; v++) {
strcpy(str_in, newString[v]);
//printf("\n[%d]----> %s \n", i, str_in);
k=0; dtr=0;
//memset(newParam, 0, sizeof newParam);
for (w=0; w <= (strlen(str_in)) ; w++) {
//printf("-< %c >-\n", str_in[w]);
if(str_in[w]=='='){
//printf("-< %c >-\n", str_in[w]);
newParam[dtr][k]='\0';
dtr++;
k=0;
}
// else if(str_in[w]!='\n' && str_in[w]!=' ') {
else {
//printf("-[ %c ]-\n", str_in[w]);
newParam[dtr][k]=str_in[w];
k++;
}
//printf("-[ %s ]-\n", newParam[dtr]);
}
if ( *str_final == EOF ) {
// if strcmp(&str_final, '\n') {
continue;
}
//printf("-<->-< %s >-\n", newParam[1]);
// if ( newParam[0] && newParam[0][0] != "\n" ) {
strcpy(str_final, newParam[0]);
if (strcmp(str_final,"SRC") == 0){
//printf("[.]----------------------------------------\n");
//printf("-< %s >-\n", str_final);
//printf("-< %s >-\n", newParam[1]);
//data->src_ip = "AAAA";
//printf("%s-< Arrayy Size >-< %d >-%s\n", KGRN, sizeof(data->src_ip), RESET);
//memcpy(data->src_ip, newParam[1], sizeof(data->src_ip));
data->src_ip = strdup(newParam[1]);
//data->src_ip = "AAAA";
//printf("%s-< STRUCT >-< %s >-%s\n", KGRN, data->src_ip, RESET);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"DST") == 0){
data->dst_ip = strdup(newParam[1]);
}
if (strcmp(str_final,"SPT") == 0){
data->src_port = strdup(newParam[1]);
}
if (strcmp(str_final,"DPT") == 0){
data->dst_port = strdup(newParam[1]);
}
if (strcmp(str_final,"MAC") == 0){
data->mac = strdup(newParam[1]);
}
if (strcmp(str_final,"LEN") == 0){
data->len = strdup(newParam[1]);
}
if (strcmp(str_final,"IN") == 0){
data->iface_in = strdup(newParam[1]);
}
if (strcmp(str_final,"OUT") == 0){
data->iface_out = strdup(newParam[1]);
}
if (strcmp(str_final,"PROTO") == 0){
data->proto = strdup(newParam[1]);
}
}
//printf("==================================\n");
//free(data);
return data;
}
//int main()
struct log_data *main()
{
// Strcut
struct log_data *data = malloc(sizeof(struct log_data));
//
int h,i,j,k,l,v,w,x,y,ctr,dtr;
char str_in[200];
char newString[200][200];
char newParam[100][100];
char str_final[50];
char *filename = "example/iptables.log";
FILE *fp = fopen(filename, "r");
if (fp == NULL)
{
printf("Error: could not open file %s", filename);
return 0;
}
// reading line by line, max 256 bytes
const unsigned MAX_LENGTH = 256;
char buffer[MAX_LENGTH];
h = 0;
while (fgets(buffer, MAX_LENGTH, fp)) {
h = h + 1;
}
//printf(" %d\n ", h);
i = 0;
fclose(fp);
fp = fopen(filename, "r");
while (fgets(buffer, MAX_LENGTH, fp)) {
// printf("- %d -", i);
if ( i > h-10 ) {
j=0; ctr=0;
printf("\n%d -> %s \n", i, buffer);
//printf("[%d]\t[ Param ]\t\t[ Value ] \n", i);
for (x=0; x <= (strlen(buffer)); x++)
{
if(buffer[x]==' '|| buffer[x]=='\0' || buffer[x]=='\n'){
newString[ctr][j]='\0';
ctr++;
j=0;
}
else {
newString[ctr][j]=buffer[x];
j++;
}
}
for (v=0; v <= ctr ; v++) {
// printf("[ %d ]----> %s \n", v, newString[v]);
strcpy(str_in, newString[v]);
// printf("\n[%d]----> %s \n", i, str_in);
k=0; dtr=0;
memset(newParam, 0, sizeof newParam);
for (w=0; w <= (strlen(str_in)) ; w++) {
if(str_in[w]=='='){
newParam[dtr][k]='\0';
dtr++;
k=0;
}
// else if(str_in[w]!='\n' && str_in[w]!=' ') {
else {
newParam[dtr][k]=str_in[w];
k++;
}
}
strcpy(str_final, newParam[0]);
// if ( newParam[0] && newParam[0][0] != "\n" ) {
if ( *str_final == EOF ) {
// if strcmp(&str_final, '\n') {
continue;
}
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
// printf("*******************\n");
// printf("-< %s >-\n", str_final);
// printf("-< %s >-\n", newParam[1]);
// if (str_final=="SRC"){
// printf("[ Value %d]----> %s \n", i, newParam[1]);
// for (l=0; l <= dtr ; l++) {
// printf("[ + %d]----> %s \n", w, newParam[l]);
// }
if (strcmp(str_final,"SRC") == 0){
printf("[.]----------------------------------------\n");
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//data->src_ip = "AAAA";
printf("%s-< Arrayy Size >-< %d >-%s\n", KGRN, sizeof(data->src_ip), RESET);
//memcpy(data->src_ip, newParam[1], sizeof(data->src_ip));
data->src_ip = strdup(newParam[1]);
//data->src_ip = "AAAA";
printf("%s-< STRUCT >-< %s >-%s\n", KGRN, data->src_ip, RESET);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"IN") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//memcpy(data->dst_ip, newParam[1], sizeof(data->dst_ip));
data->iface_in = strdup(newParam[1]);
//data->src_ip = "AAAA";
printf("%s-< STRUCT >-< %s >-%s\n", KGRN, data->iface_in, RESET);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"OUT") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//memcpy(data->dst_ip, newParam[1], sizeof(data->dst_ip));
data->iface_out = strdup(newParam[1]);
//data->src_ip = "AAAA";
printf("%s-< STRUCT >-< %s >-%s\n", KGRN, data->iface_out, RESET);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"DST") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
//memcpy(data->dst_ip, newParam[1], sizeof(data->dst_ip));
data->dst_ip = strdup(newParam[1]);
//data->src_ip = "AAAA";
printf("%s-< STRUCT >-< %s >-%s\n", KGRN, data->dst_ip, RESET);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"SPT") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
data->src_port = strdup(newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"PROTO") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
data->proto = strdup(newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
if (strcmp(str_final,"DPT") == 0){
printf("-< %s >-\n", str_final);
printf("-< %s >-\n", newParam[1]);
data->dst_port = strdup(newParam[1]);
//printf("[%d]\t[ %s ]\t\t[ %s ] \n", v, str_final, newParam[1]);
}
}
// j=0; ctr=0;
// for (v=0; v <= (strlen(newString)); v++) {
// if(newString[v]=='='){
// newParam[ctr][j]='\0';
// ctr++;
// j=0;
// }
// else {
// newParam[ctr][j]=newString[v];
// j++;
// }
// }
}
i = i +1 ;
//free(data->src_ip);
//free(data->dst_ip);
}
// close the file
//free(data->src_ip);
//free(data);
data->len = 12;
//data->src_ip = strdup("CUNT");
fclose(fp);
//free(data);
printf("\n==================================================================================\n");
return data;
}

0
iptables_parser_lib.c → src/iptables_parser_lib.c
View File

15
src/struct.h Normal file
View File

@ -0,0 +1,15 @@
typedef struct log_data {
char *tag;
char *iface_in;
char *iface_out;
char *mac;
char *dst_ip;
char *src_ip;
char *dst_port;
char *src_port;
char *proto;
char *len;
}log_data;

76
wrapper.py
View File

@ -1,13 +1,28 @@
#!/usr/bin/env python3
from ctypes import *
#from ctypes import *
import ctypes
import _ctypes
import os
class LogData(ctypes.Structure):
_fields_ = [
("tag", ctypes.c_char_p),
("iface_in", ctypes.c_char_p),
("iface_out", ctypes.c_char_p),
("mac", ctypes.c_char_p),
("dst_ip", ctypes.c_char_p),
("src_ip", ctypes.c_char_p),
("dst_port", ctypes.c_char_p),
("src_port", ctypes.c_char_p),
("proto", ctypes.c_char_p),
("len", ctypes.c_char_p)
]
def c_parser(log_line):
so_file = "lib/parser_lib.so"
iptablesParser = CDLL(so_file)
iptablesParser.iptablesParser.argtype = c_char_p
iptablesParser.iptablesParser.restype = c_char_p
iptablesParser.lineParser.argtype = c_char_p
iptablesParser.lineParser.restype = c_char_p
@ -39,6 +54,61 @@ def file_pointer():
break
i = i + 1
file_pointer()
def struct_process():
path = os.getcwd()
clibrary = ctypes.CDLL(os.path.join(path, 'lib/parser_lib.so'))
#param_1=("ABC", "CDE")
clibrary.main.restype = ctypes.POINTER(LogData)
call_lib = clibrary.main()
print(call_lib.contents.src_ip.decode('utf-8'))
print(call_lib.contents.dst_ip.decode('utf-8'))
print(call_lib.contents.src_port.decode('utf-8'))
print(call_lib.contents.dst_port.decode('utf-8'))
print(call_lib.contents.proto.decode('utf-8'))
print(call_lib.contents.iface_in.decode('utf-8'))
print(call_lib.contents.iface_out.decode('utf-8'))
print(call_lib.contents.len)
def line_process():
path = os.getcwd()
log_file = "example/iptables.log"
p_file = open(os.path.join(path, log_file))
p_lines = p_file.readlines()
clibrary = ctypes.CDLL(os.path.join(path, 'lib/parser_lib.so'))
clibrary.main.restype = ctypes.POINTER(LogData)
clibrary.line_parse.restype = ctypes.POINTER(LogData)
clibrary.line_parse.argtype = ctypes.c_char_p
test_val = "HERRROOOO"
for line in p_lines:
#print(line)
parser_arg = line.encode('utf-8')
call_lib = clibrary.line_parse(parser_arg)
print("-"*30)
print("SRC ",call_lib.contents.src_ip.decode('utf-8'))
print("DST ",call_lib.contents.dst_ip.decode('utf-8'))
print("LEN ",call_lib.contents.len.decode('utf-8'))
print("IFACE_IN ",call_lib.contents.iface_in.decode('utf-8'))
print("IFACE_OUT ",call_lib.contents.iface_out.decode('utf-8'))
#print("Source ",call_lib.contents.src_port.decode('utf-8'))
#print("Source ",call_lib.contents.dst_port.decode('utf-8'))
print("PROTO ",call_lib.contents.proto.decode('utf-8'))
print()
#_ctypes.dlclose(call_lib._handle)
##clibrary.main(param_1)
#print(clibrary.main().contents.src_ip)
#print(clibrary.main().contents.dst_ip)
#file_pointer()
#struct_process()
line_process()