Skip to content

Commit

Permalink
feat: removed serde derive
Browse files Browse the repository at this point in the history
  • Loading branch information
Samuel Garcés Marín committed Nov 21, 2023
1 parent d118817 commit fa47482
Show file tree
Hide file tree
Showing 6 changed files with 241 additions and 77 deletions.
4 changes: 2 additions & 2 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "forensic-rs"
version = "0.7.1"
version = "0.7.2"
authors = ["Samuel Garcés Marín <samuel.garces@protonmail.com>"]
keywords = ["forensic", "windows", "parser", "registry", "cybersecurity"]
categories = ["parsing"]
Expand All @@ -14,7 +14,7 @@ default = ["serde"]
serde = ["dep:serde"]

[dependencies]
serde = {version = "1", optional = true, features = ["derive"]}
serde = {version = "1", optional = true}

[dev-dependencies]
sqlite = "0.28.1"
Expand Down
37 changes: 25 additions & 12 deletions src/artifact.rs
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
use serde::{de::Visitor, Deserializer};
#[cfg(feature = "serde")]
use serde::{Deserialize, Serialize};
use serde::{Deserialize, Serialize,de::Visitor, Deserializer};

use crate::field::Text;

Expand Down Expand Up @@ -218,6 +217,7 @@ impl std::fmt::Display for OtherOS {
write!(f, "{}::{}", self.os, self.artifact)
}
}
#[cfg(feature = "serde")]
impl Serialize for Artifact {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -226,7 +226,7 @@ impl Serialize for Artifact {
serializer.collect_str(&self)
}
}

#[cfg(feature = "serde")]
impl Serialize for OtherOS {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -235,6 +235,7 @@ impl Serialize for OtherOS {
serializer.collect_str(&self)
}
}
#[cfg(feature = "serde")]
impl Serialize for WindowsArtifacts {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -243,7 +244,7 @@ impl Serialize for WindowsArtifacts {
serializer.collect_str(&self)
}
}

#[cfg(feature = "serde")]
impl Serialize for WindowsEvents {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -252,6 +253,7 @@ impl Serialize for WindowsEvents {
serializer.collect_str(&self)
}
}
#[cfg(feature = "serde")]
impl Serialize for RegistryArtifacts {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -260,6 +262,7 @@ impl Serialize for RegistryArtifacts {
serializer.collect_str(&self)
}
}
#[cfg(feature = "serde")]
impl Serialize for LinuxService {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -268,6 +271,7 @@ impl Serialize for LinuxService {
serializer.collect_str(&self)
}
}
#[cfg(feature = "serde")]
impl Serialize for MacArtifacts {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -276,7 +280,7 @@ impl Serialize for MacArtifacts {
serializer.collect_str(&self)
}
}

#[cfg(feature = "serde")]
impl<'de> Deserialize<'de> for Artifact {
fn deserialize<D>(deserializer: D) -> Result<Artifact, D::Error>
where
Expand All @@ -285,8 +289,9 @@ impl<'de> Deserialize<'de> for Artifact {
deserializer.deserialize_str(ArtifactVisitor)
}
}

#[cfg(feature = "serde")]
struct LinuxServiceVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for LinuxServiceVisitor {
type Value = LinuxService;

Expand All @@ -313,8 +318,9 @@ impl<'de> Visitor<'de> for LinuxServiceVisitor {
self.visit_str(&v[..])
}
}

#[cfg(feature = "serde")]
pub struct ArtifactVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for ArtifactVisitor {
type Value = Artifact;

Expand Down Expand Up @@ -342,7 +348,9 @@ impl<'de> Visitor<'de> for ArtifactVisitor {
}
}

#[cfg(feature = "serde")]
struct WindowsArtifactVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for WindowsArtifactVisitor {
type Value = WindowsArtifacts;

Expand All @@ -369,8 +377,9 @@ impl<'de> Visitor<'de> for WindowsArtifactVisitor {
self.visit_str(&v[..])
}
}

#[cfg(feature = "serde")]
struct WinEvtVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for WinEvtVisitor {
type Value = WindowsEvents;

Expand All @@ -397,8 +406,9 @@ impl<'de> Visitor<'de> for WinEvtVisitor {
self.visit_str(&v[..])
}
}

#[cfg(feature = "serde")]
struct RegistryArtifactsVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for RegistryArtifactsVisitor {
type Value = RegistryArtifacts;

Expand All @@ -425,8 +435,9 @@ impl<'de> Visitor<'de> for RegistryArtifactsVisitor {
self.visit_str(&v[..])
}
}

#[cfg(feature = "serde")]
struct OtherOsVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for OtherOsVisitor {
type Value = OtherOS;

Expand Down Expand Up @@ -454,8 +465,9 @@ impl<'de> Visitor<'de> for OtherOsVisitor {
}
}


#[cfg(feature = "serde")]
struct LinuxArtifactVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for LinuxArtifactVisitor {
type Value = LinuxArtifacts;

Expand All @@ -482,8 +494,9 @@ impl<'de> Visitor<'de> for LinuxArtifactVisitor {
self.visit_str(&v[..])
}
}

#[cfg(feature = "serde")]
struct MacOsArtifactVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for MacOsArtifactVisitor {
type Value = MacArtifacts;

Expand Down
13 changes: 7 additions & 6 deletions src/data.rs
Original file line number Diff line number Diff line change
@@ -1,8 +1,7 @@
use std::{borrow::Cow, collections::BTreeMap};

use serde::{Deserializer, de::Visitor, ser::SerializeMap};
#[cfg(feature="serde")]
use serde::{Serialize, Deserialize};
use serde::{Deserialize, Serialize, de::Visitor, Deserializer, ser::SerializeMap};

use crate::{prelude::{Artifact, *}, field::{internal::{InternalField, PreStoredField}, Text, Field, Ip}, context::context};

Expand Down Expand Up @@ -294,7 +293,7 @@ impl<'a> Iterator for EventFieldIter<'a> {
Some((field, &value.original))
}
}

#[cfg(feature = "serde")]
impl<'de> Deserialize<'de> for ForensicData {
fn deserialize<D>(deserializer: D) -> Result<ForensicData, D::Error>
where
Expand All @@ -303,7 +302,7 @@ impl<'de> Deserialize<'de> for ForensicData {
deserializer.deserialize_any(DataVisitor)
}
}

#[cfg(feature = "serde")]
impl Serialize for ForensicData {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand All @@ -315,8 +314,9 @@ impl Serialize for ForensicData {
map.end()
}
}

#[cfg(feature = "serde")]
struct DataVisitor;
#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for DataVisitor {
type Value = ForensicData;

Expand Down Expand Up @@ -367,8 +367,9 @@ mod data_tests {
data.insert("field001".into(), "value001".into());
data.insert("field002".into(), "value002".into());
data.insert("field003".into(), "value003".into());
data.insert("field004".into(), crate::field::Field::Array(vec!["aaa".into(), "bbb".into()]));
let deserialized = serde_json::to_string(&data).unwrap();
assert_eq!(r#"{"artifact.host":"host007","artifact.name":"Windows::Registry::ShellBags","field001":"value001","field002":"value002","field003":"value003"}"#, deserialized);
assert_eq!(r#"{"artifact.host":"host007","artifact.name":"Windows::Registry::ShellBags","field001":"value001","field002":"value002","field003":"value003","field004":["aaa","bbb"]}"#, deserialized);
let serialized : ForensicData = serde_json::from_str(&deserialized).unwrap();
assert_eq!(Artifact::Windows(WindowsArtifacts::Registry(RegistryArtifacts::ShellBags)), serialized.artifact);
let deserialized2 = serde_json::to_string(&serialized).unwrap();
Expand Down
27 changes: 2 additions & 25 deletions src/field/internal.rs
Original file line number Diff line number Diff line change
@@ -1,17 +1,15 @@
use serde::{Serialize, Deserialize};

use super::{Field, Text, Ip};


#[derive(Serialize, Deserialize, Debug, Clone, Default)]
#[derive(Debug, Clone, Default)]
pub enum PreStoredField<T> {
Invalid,
#[default]
None,
Some(T)
}

#[derive(Deserialize, Debug, Clone, Default)]
#[derive(Debug, Clone, Default)]
pub struct InternalField {
pub original : Field,
pub array : Box<PreStoredField<Vec<Text>>>,
Expand Down Expand Up @@ -54,25 +52,4 @@ impl Into<InternalField> for Field{
}
ifield
}
}

impl Serialize for InternalField {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
S: serde::Serializer {
match &self.original {
Field::Null => serializer.serialize_none(),
Field::Text(v) => serializer.serialize_str(&v[..]),
Field::Ip(v) => v.serialize(serializer),
Field::Domain(v) => serializer.serialize_str(&v[..]),
Field::User(v) => serializer.serialize_str(&v[..]),
Field::AssetID(v) => serializer.serialize_str(&v[..]),
Field::U64(v) => serializer.serialize_u64(*v),
Field::I64(v) => serializer.serialize_i64(*v),
Field::F64(v) => serializer.serialize_f64(*v),
Field::Date(v) => serializer.serialize_i64(*v),
Field::Array(v) => v.serialize(serializer),
Field::Path(v) => serializer.serialize_str(&v.to_string_lossy()[..]),
}
}
}
34 changes: 32 additions & 2 deletions src/field/ip.rs
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
use std::fmt::Display;

use serde::{Deserialize, Serialize, Serializer};
#[cfg(feature = "serde")]
use serde::{Deserialize, Serialize, Serializer, Deserializer, de::Visitor};

use super::utils::{ipv4_to_str, ipv6_to_str, is_local_ipv4, is_local_ipv6, ipv4_from_str, ipv6_from_str};
use super::Field;


#[derive(Deserialize, Debug, Clone, Copy)]
#[derive(Debug, Clone, Copy)]
pub enum Ip {
V4(u32),
V6(u128),
Expand Down Expand Up @@ -51,6 +52,8 @@ impl Ip {
}
}
}

#[cfg(feature = "serde")]
impl Serialize for Ip {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
Expand Down Expand Up @@ -150,6 +153,33 @@ impl std::hash::Hash for Ip {
}
}

#[cfg(feature = "serde")]
impl<'de> Deserialize<'de> for Ip {
fn deserialize<D>(deserializer: D) -> Result<Ip, D::Error>
where
D: Deserializer<'de>,
{
deserializer.deserialize_any(IpVisitor)
}
}
#[cfg(feature = "serde")]
struct IpVisitor;

#[cfg(feature = "serde")]
impl<'de> Visitor<'de> for IpVisitor {
type Value = Ip;

fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
formatter.write_str("a valid forensic data")
}

fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
where
E: serde::de::Error, {
Ip::from_ip_str(v).map_err(|e| E::custom(e))
}
}

#[cfg(test)]
mod tst {
use super::*;
Expand Down
Loading

0 comments on commit fa47482

Please sign in to comment.