fix prolem parsing argus header

Author: AlyaGomaa

slips_files/core/input_profilers/argus.py

@@ -33,6 +33,10 @@ def process_line(self, new_line: dict) -> Tuple[bool, str]:
         line = new_line["data"]
         nline = line.strip().split(self.separator)
 
+        if self.is_header_line(nline):
+            self.define_columns(new_line)
+            return False, "Done defining columns"
+
         def get_value_of(field_name, default_=False):
             """field_name is used to get the index of
             the field from the column_idx dict"""
@@ -42,6 +46,13 @@ def get_value_of(field_name, default_=False):
             except (IndexError, KeyError):
                 return default_
 
+        def get_int_value_of(field_name) -> int:
+            value = get_value_of(field_name, 0)
+            try:
+                return int(value)
+            except (TypeError, ValueError):
+                return 0
+
         self.flow: ArgusConn = ArgusConn(
             starttime=utils.convert_to_datetime(get_value_of("starttime")),
             endtime=get_value_of("endtime"),
@@ -54,12 +65,12 @@ def get_value_of(field_name, default_=False):
             daddr=get_value_of("daddr"),
             dport=get_value_of("dport"),
             state=get_value_of("state"),
-            pkts=int(get_value_of("pkts")),
-            spkts=int(get_value_of("spkts")),
-            dpkts=int(get_value_of("dpkts")),
-            bytes=int(get_value_of("bytes")),
-            sbytes=int(get_value_of("sbytes")),
-            dbytes=int(get_value_of("dbytes")),
+            pkts=get_int_value_of("pkts"),
+            spkts=get_int_value_of("spkts"),
+            dpkts=get_int_value_of("dpkts"),
+            bytes=get_int_value_of("bytes"),
+            sbytes=get_int_value_of("sbytes"),
+            dbytes=get_int_value_of("dbytes"),
             interface="default",
         )
 
@@ -137,3 +148,9 @@ def define_columns(self, new_line: dict) -> dict:
             )
             self.print(traceback.format_exc(), 0, 1)
             sys.exit(1)
+
+    def is_header_line(self, nline) -> bool:
+        """Return True when the current line looks like an Argus header."""
+        header_tokens = {"starttime", "time", "srcaddr", "dstaddr", "totpkts"}
+        normalized_fields = {field.strip().lower() for field in nline}
+        return bool(header_tokens.intersection(normalized_fields))

tests/unit/slips_files/core/input/test_argus_input_profiler.py

@@ -0,0 +1,39 @@
+# SPDX-FileCopyrightText: 2021 Sebastian Garcia <sebastian.garcia@agents.fel.cvut.cz>
+# SPDX-License-Identifier: GPL-2.0-only
+
+from unittest.mock import Mock
+
+from slips_files.core.input_profilers.argus import Argus
+
+
+def test_argus_parser_skips_repeated_headers_and_parses_short_binetflow():
+    parser = Argus(Mock())
+    header = {
+        "data": (
+            "StartTime,Dur,Proto,SrcAddr,Sport,Dir,DstAddr,Dport,"
+            "State,sTos,dTos,TotPkts,TotBytes,SrcBytes,Label"
+        )
+    }
+    flow_line = {
+        "data": (
+            "2018/09/27 22:40:52.362768,193.831726,tcp,192.168.2.1,52893,"
+            "  <?>,192.168.2.12,22,CON,16,16,35,3766,1224,"
+        )
+    }
+
+    flow, err = parser.process_line(header)
+    assert flow is False
+    assert err == "Defined Columns"
+
+    flow, err = parser.process_line(header)
+    assert flow is False
+    assert err == "Defined Columns"
+
+    flow, err = parser.process_line(flow_line)
+    assert err == ""
+    assert flow.pkts == 35
+    assert flow.bytes == 3766
+    assert flow.sbytes == 1224
+    assert flow.dbytes == 0
+    assert flow.spkts == 0
+    assert flow.dpkts == 0