static void
test_linux_audit_scanner_audit_style_hex_dump_is_decoded(void)
{
/* not decoded as no characters to be escaped, kernel only escapes stuff below 0x21, above 0x7e and the quote character */
kv_scanner_input(kv_scanner, "proctitle=41607E");
assert_next_kv_is("proctitle", "41607E");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "proctitle=412042");
assert_next_kv_is("proctitle", "A B");
assert_no_more_tokens();
/* odd number of chars, not decoded */
kv_scanner_input(kv_scanner, "proctitle=41204");
assert_next_kv_is("proctitle", "41204");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "proctitle=C3A17276C3AD7A74C5B172C59174C3BC6BC3B67266C3BA72C3B367C3A970");
assert_next_kv_is("proctitle", "árvíztűrőtükörfúrógép");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "proctitle=2F62696E2F7368002D65002F6574632F696E69742E642F706F737466697800737461747573");
assert_next_kv_is("proctitle", "/bin/sh\t-e\t/etc/init.d/postfix\tstatus");
assert_no_more_tokens();
}
static void
test_kv_scanner_stray_words_are_ignored(void)
{
kv_scanner_input(kv_scanner, "lorem ipsum foo=bar");
assert_next_kv_is("foo", "bar");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "foo=bar lorem ipsum key=value some more values");
assert_next_kv_is("foo", "bar");
assert_next_kv_is("key", "value");
assert_no_more_tokens();
}
static void
test_kv_scanner_incomplete_string_returns_no_pairs(void)
{
kv_scanner_input(kv_scanner, "");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "f");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "fo");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "foo");
assert_no_more_tokens();
}
static void
test_kv_scanner_quotation_is_stored_in_the_was_quoted_value_member(void)
{
kv_scanner_input(kv_scanner, "foo=\"bar\"");
assert_next_kv_is("foo", "bar");
assert_true(kv_scanner->value_was_quoted, "expected value_was_quoted to be TRUE");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "foo=bar");
assert_next_kv_is("foo", "bar");
assert_false(kv_scanner->value_was_quoted, "expected value_was_quoted to be FALSE");
assert_no_more_tokens();
}
static void
test_kv_scanner_transforms_values_if_parse_value_is_set(void)
{
kv_scanner->parse_value = _parse_value_by_incrementing_all_bytes;
kv_scanner_input(kv_scanner, "foo=\"bar\"");
assert_next_kv_is("foo", "cbs");
assert_no_more_tokens();
}
static void
test_kv_scanner_with_comma_separated_values(void)
{
kv_scanner_input(kv_scanner, "key1=value1, key2=value2, key3=value3");
assert_next_kv_is("key1", "value1");
assert_next_kv_is("key2", "value2");
assert_next_kv_is("key3", "value3");
assert_no_more_tokens();
}
static void
test_kv_scanner_spaces_between_values_are_ignored(void)
{
kv_scanner_input(kv_scanner, "key1=value1 key2=value2 key3=value3 ");
assert_next_kv_is("key1", "value1");
assert_next_kv_is("key2", "value2");
assert_next_kv_is("key3", "value3");
assert_no_more_tokens();
}
static void
test_kv_scanner_with_multiple_key_values_return_multiple_pairs(void)
{
kv_scanner_input(kv_scanner, "key1=value1 key2=value2 key3=value3 ");
assert_next_kv_is("key1", "value1");
assert_next_kv_is("key2", "value2");
assert_next_kv_is("key3", "value3");
assert_no_more_tokens();
}
static void
test_kv_scanner_name_equals_value_returns_a_pair(void)
{
kv_scanner_input(kv_scanner, "foo=");
assert_next_kv_is("foo", "");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "foo=b");
assert_next_kv_is("foo", "b");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "foo=bar");
assert_next_kv_is("foo", "bar");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "foo=barbar ");
assert_next_kv_is("foo", "barbar");
assert_no_more_tokens();
}
static void
test_kv_scanner_quoted_values_are_unquoted_like_c_strings(void)
{
kv_scanner_input(kv_scanner, "foo=\"bar\"");
assert_next_kv_is("foo", "bar");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "key1=\"value1\", key2=\"value2\"");
assert_next_kv_is("key1", "value1");
assert_next_kv_is("key2", "value2");
assert_no_more_tokens();
/* embedded quote */
kv_scanner_input(kv_scanner, "key1=\"\\\"value1\"");
assert_next_kv_is("key1", "\"value1");
assert_no_more_tokens();
/* control sequences */
kv_scanner_input(kv_scanner, "key1=\"\\b \\f \\n \\r \\t \\\\\"");
assert_next_kv_is("key1", "\b \f \n \r \t \\");
assert_no_more_tokens();
/* unknown backslash escape is left as is */
kv_scanner_input(kv_scanner, "key1=\"\\p\"");
assert_next_kv_is("key1", "\\p");
assert_no_more_tokens();
kv_scanner_input(kv_scanner, "key1='value1', key2='value2'");
assert_next_kv_is("key1", "value1");
assert_next_kv_is("key2", "value2");
assert_no_more_tokens();
/* embedded quote */
kv_scanner_input(kv_scanner, "key1='\\'value1'");
assert_next_kv_is("key1", "'value1");
assert_no_more_tokens();
/* control sequences */
kv_scanner_input(kv_scanner, "key1='\\b \\f \\n \\r \\t \\\\'");
assert_next_kv_is("key1", "\b \f \n \r \t \\");
assert_no_more_tokens();
/* unknown backslash escape is left as is */
kv_scanner_input(kv_scanner, "key1='\\p'");
assert_next_kv_is("key1", "\\p");
assert_no_more_tokens();
}
static void
_scan_kv_pairs_scanner(KVScanner *scanner, const gchar *input, VAElement args[])
{
g_assert(input);
kv_scanner_input(scanner, input);
gboolean expect_more = TRUE;
const gchar *key = *(args++);
while (key)
{
const gchar *value = *(args++);
if (!value || !_compare_key_value(scanner, key, value, &expect_more))
break;
key = *(args++);
}
if (expect_more)
_assert_no_more_tokens(scanner);
}
static gboolean
kv_parser_process(LogParser *s, LogMessage **pmsg, const LogPathOptions *path_options, const gchar *input, gsize input_len)
{
KVParser *self = (KVParser *) s;
log_msg_make_writable(pmsg, path_options);
/* FIXME: input length */
kv_scanner_input(self->kv_scanner, input);
while (kv_scanner_scan_next(self->kv_scanner))
{
/* FIXME: value length */
log_msg_set_value_by_name(*pmsg,
_get_formatted_key(self, kv_scanner_get_current_key(self->kv_scanner)),
kv_scanner_get_current_value(self->kv_scanner), -1);
}
return TRUE;
}
static void
_scan_kv_pairs_quoted(const gchar *input, KVQContainer args)
{
KVScanner *scanner = kv_scanner_new();
g_assert(input);
kv_scanner_input(scanner, input);
gboolean expect_more = TRUE;
for (gsize i = 0; i < args.n; i++)
{
if (!_compare_key_value(scanner, args.arg[i].key, args.arg[i].value, &expect_more))
break;
expect_gboolean(scanner->value_was_quoted, args.arg[i].quoted,
"mismatch in value_was_quoted for [%s/%s]",
args.arg[i].key, args.arg[i].value);
}
if (expect_more)
_assert_no_more_tokens(scanner);
kv_scanner_free(scanner);
}
