#logging #nop #parse-log #wscale #sack-ok #mss

senpa

A library to parse OPNsense firewall logs

2 releases

0.1.1 Jan 26, 2025
0.1.0 Jan 26, 2025

#1 in #nop

28 downloads per month
Used in firetail

MIT license

32KB
825 lines

Senpa

Senpa is a parser for OPNsense firewall logs(maybe it also work for pfsense).
it's based on this grammar specification.

Features

The serde feature adds Serde Serialize and Deserialize traits to Log.

How to parse a log?

    use senpa::prelude::*;

    let log= "96,,,fae559338f65e11c53669fc3642c93c2,vlan0.20,match,pass,out,\
    4,0x0,,127,61633,0,DF,6,tcp,\
    52,192.168.10.15,192.168.20.14,\
    52461,9100,0,S,3442468761,,64240,,mss;nop;wscale;nop;nop;sackOK";
    
    match parse_log(log){
        Ok(parsed_log) => {
            println!("# LOG #");
            println!("rule number: {} ",parsed_log.packet_filter.rule_info.number);
            assert_eq!(96,parsed_log.packet_filter.rule_info.number);

            println!("rule label: {} ",&parsed_log.packet_filter.rule_info.label);
            assert_eq!("fae559338f65e11c53669fc3642c93c2",&parsed_log.packet_filter.rule_info.label);

            match &parsed_log.packet_filter.action {
                Pass => println!("Action: Pass"),
                Block => println!("Action: Block"),
                Reject => println!("Action: Reject"),
            }
            assert_eq!(Pass,parsed_log.packet_filter.action);

            match &parsed_log.protocol.name {
                Tcp => println!("Proto: tcp"),
                Udp => println!("Proto: udp"),
                Other(other) => println!("Proto: {}",other),
            }
            assert_eq!(Tcp,parsed_log.protocol.name);

            match &parsed_log.proto_info {
                UdpInfo(udp_info) => println!("ProtoInfo:{:#?}",udp_info),
                TcpInfo(tcp_info) => println!("ProtoInfo:{:#?}",tcp_info),
                UnknownInfo(unknown) => println!("ProtoInfo: {}",unknown),
            }
            assert!(matches!(parsed_log.proto_info,TcpInfo(_)));
            
        }
        Err(e) => {
            println!("{}",e);
        }
    }

Todos

  • Add CARP support.

Dependencies

~0.8–1.2MB
~22K SLoC