#!/bin/bash
# added 2018-10-31 by Rainer Gerhards
# This file is part of the liblognorm project, released under ASL 2.0
. $srcdir/exec.sh

test_def $0 "Checkpoint LEA parser"
add_rule 'version=2'
add_rule 'rule=:[ %{"name":"f", "type":"checkpoint-lea", "terminator": "]"}%]'

execute '[ tcp_flags: RST-ACK; src: 192.168.0.1; ]'
assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }'

execute '[ tcp_flags: RST-ACK; src: 192.168.0.1 ]'
assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }'

# Newest Checkpoint format
execute '[ tcp_flags:"RST-ACK"; src:"192.168.0.1"; ]'
assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }'

execute '[ tcp_flags:"RST-ACK"; src:"192.168.0.1" ]'
assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }'

execute '[ key:"value with \"escaped quote\""; path:"C:\\Windows\\System32" ]'
assert_output_json_eq '{ "f": { "key": "value with \\\"escaped quote\\\"", "path": "C:\\\\Windows\\\\System32" } }'

cleanup_tmp_files
