log_clean.py

import base64
import re
import sys

# a script to take an xmpppeek log of a Ecovacs app session with a Deebot N79 and strip out some of the nonsense,
# including any private identifiers

source_ip = None
userid = None
resourceid = None
robotid = None
auth_glob = None

for line in sys.stdin:
    # remove the garbage
    line = line.rstrip()
    line = re.sub("\[\\d{4}-\\d{2}-\\d{2} ", "", line)
    line = re.sub("\.\\d{6}-\\d{2}:\\d{2}\] \[", " ", line)
    line = re.sub("]$", " ", line)
    line = re.sub("\(([SC])2[SC]\) [.0-9]+:\\d+ -> [.0-9]+:\d+\]", "\\1", line)
    line = re.sub("\}\}\}", "", line)
    line = re.sub("\{\{\{", "", line)

    # find the private bits and remove them
    if not source_ip:
        match = re.search("Client connect from ([.0-9]+)", line)
        if match:
            source_ip = match.group(1)
    if not userid:
        match = re.search("(20\d{6}[0-9a-f]{13})@ecouser.net/([0-9a-f]{8})", line)
        if match:
            userid = match.group(1)
            resourceid = match.group(2)
    if not robotid:
        match = re.search("(E\d{8,})@126.ecorobot.net/atom", line)
        if match:
            robotid = match.group(1)
    if not auth_glob:
        match = re.search(
            '<auth mechanism="PLAIN" xmlns="urn:ietf:params:xml:ns:xmpp-sasl">([-A-Za-z0-9+/=]+)</auth>',
            line,
        )
        if match:
            auth_glob = match.group(1)
    if source_ip:
        line = re.sub(source_ip, "SOURCEIP", line)
    if userid:
        line = re.sub(userid, "USERID", line)
    if resourceid:
        line = re.sub(resourceid, "RESOURCEID", line)
    if robotid:
        line = re.sub(robotid, "ROBOTID", line)
    if auth_glob:
        line = re.sub(auth_glob, "AUTHGLOB", line)

    # translate client commmands

    line = re.sub(
        '<iq id="(\d+)" to="ROBOTID@126.ecorobot.net/atom" from="USERID@ecouser.net/RESOURCEID" type="set"><query xmlns="com:ctl">(<ctl .*>)</query></iq>',
        "id=\\1 command=\\2",
        line,
    )

    # translate server responses

    line = re.sub(
        '<iq to="USERID@ecouser.net/RESOURCEID" type="result" id="(\d+)" from="ROBOTID@126.ecorobot.net/atom"/>',
        "id=\\1 result =empty",
        line,
    )
    line = re.sub(
        '<iq to="USERID@ecouser.net/RESOURCEID" type="set" id="(\d+)" from="ROBOTID@126.ecorobot.net/atom"><query xmlns="com:ctl"><ctl id="(\d+)" ret="([^"]+)"/></query></iq>',
        "id=\\1 id=\\2 result=\\3",
        line,
    )
    line = re.sub(
        '<iq to="USERID@ecouser.net/RESOURCEID" type="set" id="(\d+)" from="ROBOTID@126.ecorobot.net/atom"><query xmlns="com:ctl">(<ctl .*)</query></iq>',
        "id=\\1 response=\\2",
        line,
    )

    print(line)

# per SASL plain auth: https://tools.ietf.org/html/rfc4616
(authentication_id, authorization_id, password) = (
    base64.b64decode(auth_glob).decode().split(sep="\0")
)

# no idea what the leading field is, and the resource appears to be the same
(mystery, resource, secret) = password.split("/")

print("------------------")
print("sample config:")
print("user=" + userid)
print("domain=ecouser.net")
print("resource=" + resourceid)
print("secret=" + secret)
print("vacuum=" + robotid + "@126.ecorobot.net")