# added 2015-04-30 by Rainer Gerhards
# This file is part of the liblognorm project, released under ASL 2.0
. $srcdir/exec.sh

test_def $0 "v2-iptables field"
add_rule 'version=2'
add_rule 'rule=:iptables output denied: %field:v2-iptables%'

# first, a real-world case
execute 'iptables output denied: IN= OUT=eth0 SRC=176.9.56.141 DST=168.192.14.3 LEN=32 TOS=0x00 PREC=0x00 TTL=64 ID=39110 DF PROTO=UDP SPT=49564 DPT=2010 LEN=12'
assert_output_json_eq '{ "field": { "IN": "", "OUT": "eth0", "SRC": "176.9.56.141", "DST": "168.192.14.3", "LEN": "12", "TOS": "0x00", "PREC": "0x00", "TTL": "64", "ID": "39110", "DF": null, "PROTO": "UDP", "SPT": "49564", "DPT": "2010" } }'

# now some more "fabricated" cases for better readable test
reset_rules
add_rule 'rule=:iptables: %field:v2-iptables%'

execute 'iptables: IN=value SECOND=test'
assert_output_json_eq '{ "field": { "IN": "value", "SECOND": "test" }} }'

execute 'iptables: IN= SECOND=test'
assert_output_json_eq '{ "field": { "IN": ""} }'

execute 'iptables: IN SECOND=test'
assert_output_json_eq '{ "field": { "IN": null} }'

execute 'iptables: IN=invalue OUT=outvalue'
assert_output_json_eq '{ "field": { "IN": "invalue", "OUT": "outvalue" } }'

execute 'iptables: IN= OUT=outvalue'
assert_output_json_eq '{ "field": { "IN": "", "OUT": "outvalue" } }'

execute 'iptables: IN OUT=outvalue'
assert_output_json_eq '{ "field": { "IN": null, "OUT": "outvalue" } }'

#
#check cases where parsing failure must occur
#
echo verify failure cases

# lower case is not permitted
execute 'iptables: in=value'
assert_output_json_eq '{ "originalmsg": "iptables: in=value", "unparsed-data": "in=value" }'

execute 'iptables: in='
assert_output_json_eq '{ "originalmsg": "iptables: in=", "unparsed-data": "in=" }'

execute 'iptables: in'
assert_output_json_eq '{ "originalmsg": "iptables: in", "unparsed-data": "in" }'

execute 'iptables: IN' # single field is NOT permitted!
assert_output_json_eq '{ "originalmsg": "iptables: IN", "unparsed-data": "IN" }'

# multiple spaces between n=v pairs are not permitted
execute 'iptables: IN=invalue  OUT=outvalue'
assert_output_json_eq '{ "originalmsg": "iptables: IN=invalue  OUT=outvalue", "unparsed-data": "IN=invalue  OUT=outvalue" }'

execute 'iptables: IN=  OUT=outvalue'
assert_output_json_eq '{ "originalmsg": "iptables: IN=  OUT=outvalue", "unparsed-data": "IN=  OUT=outvalue" }'

execute 'iptables: IN  OUT=outvalue'
assert_output_json_eq '{ "originalmsg": "iptables: IN  OUT=outvalue", "unparsed-data": "IN  OUT=outvalue" }'


cleanup_tmp_files