ruby - 您如何使用 ruby​​ 正确使用 'match' 为文件中的每一行构建哈希？

Question

我正在查看 show conn protocol tcp 的 Cisco ASA 上的输出.

每一行都有这样的格式:

TCP OUTSIDE 4.2.2.2:443 INSIDE 10.17.21.44:63314, idle 0:00:44, bytes 11365, flags UIO

我希望我的哈希看起来像这样:

h = {:dst => 4.2.2.2:443,
     :src => 10.17.21.44:63314,
     :bytes => 11356,
     :flags => UIO,
    }

这是我尝试执行此操作的尝试，但我得到“nil:NilClass 的未定义方法‘捕获’”。

我认为这是在说该行不匹配，但我很确定我的正则表达式是正确的。我知道我会遇到的一个问题是 src和 dst在此设置中将匹配两个地址。我不确定如何制作 dst匹配第一个地址，src匹配第一个地址。

h = {}
fp = File.open('conns.txt','r+')
fp.each_with_index do |line, i|
    dst = line.match(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}:\d+/).captures
    src = line.match(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}:\d+/).captures
    bytes = line.match(/(?<=bytes\s)(\d+)/).captures
    flags = line.match(/(?<=flags\s)(\w+)/).captures
    h[i+1] = {dst: dst, src: src, bytes: bytes, flags: flags}
end

这是 irb session :

irb(main):001:0> h = {}
=> {}
irb(main):002:0> fp = File.open('conns.txt','r+')
=> #<File:conns.txt>
irb(main):003:0> #TCP OUTSIDE  4.2.2.2:443 INSIDE  10.17.21.44:63314, idle 0:00:44, bytes 11365, flags UIO
irb(main):004:0* fp.each_with_index do |line, i|
irb(main):005:1*     dst = line.match(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}:\d+/).captures
irb(main):006:1>     src = line.match(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}:\d+/).captures
irb(main):007:1>     bytes = line.match(/(?<=bytes\s)(\d+)/).captures
irb(main):008:1>     flags = line.match(/(?<=flags\s)(\w+)/).captures
irb(main):009:1>     h[i+1] = {dst: dst, src: src, bytes: bytes, flags: flags}
irb(main):010:1> end
NoMethodError: undefined method `captures' for nil:NilClass
    from (irb):5:in `block in irb_binding'
    from (irb):4:in `each'
    from (irb):4:in `each_with_index'
    from (irb):4
    from /usr/bin/irb:12:in `<main>'
irb(main):011:0> 

---

如果我删除 captures它不再失败，但我得到 #<MatchData前置到每个字段。哈希看起来像这样:

 {1=>{:dst=>#<MatchData "4.2.2.2:443">, :src=>#<MatchData "4.2.2.2:443">, :bytes=>#<MatchData "11365" 1:"11365">, :flags=>#<MatchData "UIO" 1:"UIO">}}

---

使用 scan有效，我想出了 dst对比src也有问题:

h = {}
fp = File.open('conns.txt','r+')
#TCP OUTSIDE  4.2.2.2:443 INSIDE  10.17.21.44:63314, idle 0:00:44, bytes 11365, flags UIO
fp.each_with_index do |line, i|
    ip = line.scan(/(?:[0-9]{1,3}\.){3}[0-9]{1,3}:\d+/)
    dst = ip[0]
    src = ip[1]
    bytes = line.scan(/(?<=bytes\s)(\d+)/)
    flags = line.scan(/(?<=flags\s)(\w+)/)
    h[i+1] = {dst: dst, src: src, bytes: bytes, flags: flags}
end

Answer 1

需要考虑的事项:

IP_REGEX = '(?:\d{1,3}\.){3}\d{1,3}(?::\d+)?'
input = 'TCP OUTSIDE 4.2.2.2:443 INSIDE 10.17.21.44:63314, idle 0:00:44, bytes 11365, flags UIO'
input.scan(/(\w+)\s(#{ IP_REGEX })/) 
# => [["OUTSIDE", "4.2.2.2:443"], ["INSIDE", "10.17.21.44:63314"]]

scan 查找给定的模式并返回所有匹配命中的数组。因为我使用的是捕获，所以它们作为子数组返回。

如果你希望结果是一个散列，你可以这样做:

input.scan(/(\w+)\s(#{ IP_REGEX })/).to_h # => {"OUTSIDE"=>"4.2.2.2:443", "INSIDE"=>"10.17.21.44:63314"}

或者，如果您使用的是不支持 to_h 的旧版 Ruby:

Hash[input.scan(/(\w+)\s(#{ IP_REGEX })/)] # => {"OUTSIDE"=>"4.2.2.2:443", "INSIDE"=>"10.17.21.44:63314"}

您可以使用更简单的 scan 模式并允许并行分配帮助您按顺序获取 IP:

src, dst = input.scan(/#{ IP_REGEX }/)

然后根据需要获取其他两个字段并将它们全部分配给您的散列:

foo = {
  src: src,
  dst: dst,
  ...
}

但是，实际上，我会利用命名捕获:

matches = input.match(/(?<src>#{ IP_REGEX }) \w+ (?<dst>#{ IP_REGEX }), idle (?<idle>\S+), bytes (?<bytes>\d+), flags (?<flags>\S+)/)
# => #<MatchData
#     "4.2.2.2:443 INSIDE 10.17.21.44:63314, idle 0:00:44, bytes 11365, flags UIO"
#     src:"4.2.2.2:443"
#     dst:"10.17.21.44:63314"
#     idle:"0:00:44"
#     bytes:"11365"
#     flags:"UIO">
matches['src'] # => "4.2.2.2:443"
matches['dst'] # => "10.17.21.44:63314"
matches['idle'] # => "0:00:44"
matches['bytes'] # => "11365"
matches['flags'] # => "UIO"

此时 matches 就允许访问单个元素而言就像哈希一样。

如果您不喜欢，这是获得真正哈希的简单步骤:

matches.names.zip(matches.captures).to_h
# => {"src"=>"4.2.2.2:443",
#     "dst"=>"10.17.21.44:63314",
#     "idle"=>"0:00:44",
#     "bytes"=>"11365",
#     "flags"=>"UIO"}