L("!=") |
L("~=") |
L(">") |
L("<")
)
MARKER_OP = VERSION_CMP | L("not in") | L("in")
MARKER_VALUE = QuotedString("'") | QuotedString('"')
MARKER_VALUE.setParseAction(lambda s, l, t: Value(t[0]))
BOOLOP = L("and") | L("or")
MARKER_VAR = VARIABLE | MARKER_VALUE
MARKER_ITEM = Group(MARKER_VAR + MARKER_OP + MARKER_VAR)
MARKER_ITEM.setParseAction(lambda s, l, t: tuple(t[0]))
LPAREN = L("(").suppress()
RPAREN = L(")").suppress()
MARKER_EXPR = Forward()
MARKER_ATOM = MARKER_ITEM | Group(LPAREN + MARKER_EXPR + RPAREN)
MARKER_EXPR << MARKER_ATOM + ZeroOrMore(BOOLOP + MARKER_EXPR)
MARKER = stringStart + MARKER_EXPR + stringEnd
def _coerce_parse_result(results):
if isinstance(results, ParseResults):
return [_coerce_parse_result(i) for i in results]
VARIABLE.setParseAction(lambda s, l, t: Variable(ALIASES.get(t[0], t[0])))
VERSION_CMP = (L("===") | L("==") | L(">=") | L("<=") | L("!=") | L("~=")
| L(">") | L("<"))
MARKER_OP = VERSION_CMP | L("not in") | L("in")
MARKER_OP.setParseAction(lambda s, l, t: Op(t[0]))
MARKER_VALUE = QuotedString("'") | QuotedString('"')
MARKER_VALUE.setParseAction(lambda s, l, t: Value(t[0]))
BOOLOP = L("and") | L("or")
MARKER_VAR = VARIABLE | MARKER_VALUE
MARKER_ITEM = Group(MARKER_VAR + MARKER_OP + MARKER_VAR)
MARKER_ITEM.setParseAction(lambda s, l, t: tuple(t[0]))
LPAREN = L("(").suppress()
RPAREN = L(")").suppress()
MARKER_EXPR = Forward()
MARKER_ATOM = MARKER_ITEM | Group(LPAREN + MARKER_EXPR + RPAREN)
MARKER_EXPR << MARKER_ATOM + ZeroOrMore(BOOLOP + MARKER_EXPR)
MARKER = stringStart + MARKER_EXPR + stringEnd
def _coerce_parse_result(results):
# type: (Union[ParseResults, List[Any]]) -> List[Any]
if isinstance(results, ParseResults):
# print "Flows are ", flows
LBRACE = '('
RBRACE = ')'
COMMA = ','
COLON = ':'
EQUAL = '='
in_port = packets = proto = tos = ttl = src = dst = op = Word(nums)
ipAddress = Combine(Word(nums) + ('.' + Word(nums)) * 3)
twohex = Word(hexnums, exact=2)
macAddress = Combine(twohex + (':' + twohex) * 5)
eth_type = Combine('0x' + Word(hexnums, exact=4))
frag = Word(alphanums)
eth = Group("eth" + LBRACE + "src" + EQUAL + macAddress("src") + COMMA +
"dst" + EQUAL + macAddress("dst") + RBRACE)
arp = Group("arp" + LBRACE + "sip" + EQUAL + ipAddress("sip") + COMMA + "tip" +
EQUAL + ipAddress("tip") + COMMA + "op" + EQUAL + op("op") +
COMMA + "sha" + EQUAL + macAddress("sha") + COMMA + "tha" + EQUAL +
macAddress("tha") + RBRACE)
ipv4 = Group("ipv4" + LBRACE + "src" + EQUAL + ipAddress("src") + COMMA +
"dst" + EQUAL + ipAddress("dst") + COMMA + "proto" + EQUAL +
proto("proto") + COMMA + "tos" + EQUAL + tos("tos") + COMMA +
"ttl" + EQUAL + ttl("ttl") + COMMA + "frag" + EQUAL +
frag("frag") + RBRACE)
# ipv4(src=193.170.192.143,dst=193.170.192.142,proto=6,tos=0,ttl=64,frag=no),tcp(src=45969,dst=5672), packets:1, bytes:87, used:4.040s, flags:P., actions:1
tcp = Group("tcp" + LBRACE + "src" + EQUAL + src("srcPkt") + COMMA + "dst" +
EQUAL + dst("dstPkt") + RBRACE)
flowTcp = (
"in_port" + LBRACE + in_port("in_port") + RBRACE + COMMA + eth("eth") +
COMMA +
