diff --git a/src/parser.c b/src/parser.c index 7343d844..2c55f1e5 100644 --- a/src/parser.c +++ b/src/parser.c @@ -2936,19 +2936,39 @@ PARSER_Parse(CheckpointLEA) if(i+1 >= npb->strLen || npb->str[i] != ':') { FAIL(LN_WRONGPARSER); } + /* Sometimes there is multiple colons */ + while( i < npb->strLen && npb->str[i+1] == ':' ) { + i++; + } lenName = i - iName; ++i; /* skip ':' */ while(i < npb->strLen && npb->str[i] == ' ') /* skip leading SP */ ++i; - iValue = i; - while(i < npb->strLen && npb->str[i] != ';') { + /* Improvement by KGuillemot & M4jr0 to support quoted values */ + if( npb->str[i] == '"' ) { + iValue = i+1; + i++; + while( i < npb->strLen && ( npb->str[i] != '"' || npb->str[i-1] == '\\' ) ) { + ++i; + } + // Do not take the " in value + lenValue = i - iValue; + // Skip " ++i; + } else { + iValue = i; + while (i < npb->strLen && npb->str[i] != ';' && npb->str[i] != data->terminator) { + ++i; + } + lenValue = i - iValue; } - if(i+1 > npb->strLen || npb->str[i] != ';') + + if(i+1 > npb->strLen || (npb->str[i] != ';' && npb->str[i] != data->terminator)) FAIL(LN_WRONGPARSER); - lenValue = i - iValue; - ++i; /* skip ';' */ + + if(npb->str[i] == ';') + ++i; /* skip ';' */ if(value != NULL) { CHKN(name = malloc(sizeof(char) * (lenName + 1))); diff --git a/tests/field_checkpoint-lea-terminator.sh b/tests/field_checkpoint-lea-terminator.sh index 0d7469bd..1daaba99 100755 --- a/tests/field_checkpoint-lea-terminator.sh +++ b/tests/field_checkpoint-lea-terminator.sh @@ -10,6 +10,9 @@ add_rule 'rule=:[ %{"name":"f", "type":"checkpoint-lea", "terminator": "]"}%]' execute '[ tcp_flags: RST-ACK; src: 192.168.0.1; ]' assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }' +# Newest Checkpoint format +execute '[ tcp_flags:"RST-ACK"; src:"192.168.0.1"; ]' +assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }' cleanup_tmp_files diff --git a/tests/field_checkpoint-lea_jsoncnf.sh b/tests/field_checkpoint-lea_jsoncnf.sh index 2d1581ff..ecdaa269 100755 --- a/tests/field_checkpoint-lea_jsoncnf.sh +++ b/tests/field_checkpoint-lea_jsoncnf.sh @@ -10,6 +10,9 @@ add_rule 'rule=:%{"name":"f", "type":"checkpoint-lea"}%' execute 'tcp_flags: RST-ACK; src: 192.168.0.1;' assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }' +# Newest Checkpoint format +execute 'tcp_flags:"RST-ACK"; src:"192.168.0.1";' +assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }' cleanup_tmp_files diff --git a/tests/field_checkpoint-lea_v1.sh b/tests/field_checkpoint-lea_v1.sh index 3d38ff05..95aa5ceb 100755 --- a/tests/field_checkpoint-lea_v1.sh +++ b/tests/field_checkpoint-lea_v1.sh @@ -9,6 +9,9 @@ add_rule 'rule=:%f:checkpoint-lea%' execute 'tcp_flags: RST-ACK; src: 192.168.0.1;' assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }' +# Newest Checkpoint format +execute 'tcp_flags:"RST-ACK"; src:"192.168.0.1";' +assert_output_json_eq '{ "f": { "tcp_flags": "RST-ACK", "src": "192.168.0.1" } }' cleanup_tmp_files