in x-pack/filebeat/processors/decode_cef/cef/parser.go [38:1391]
func (e *Event) unpack(data string) error {
cs, p, pe, eof := 0, 0, len(data), len(data)
mark, mark_slash := 0, 0
// state related to CEF values.
var state cefState
// flag for completion of CEF header.
complete := false
// recoveredErrs are problems with the message that the parser was able to
// recover from (though the parsing might not be "correct").
var recoveredErrs []error
e.init(data)
//line parser.go:52
{
cs = cef_start
}
//line parser.go:56
{
if (p) == (pe) {
goto _test_eof
}
if cs == 0 {
goto _out
}
_resume:
switch cs {
case 1:
if data[(p)] == 67 {
goto tr0
}
goto tr1
case 0:
goto _out
case 2:
if data[(p)] == 69 {
goto tr2
}
goto tr1
case 3:
if data[(p)] == 70 {
goto tr3
}
goto tr1
case 4:
if data[(p)] == 58 {
goto tr4
}
goto tr1
case 5:
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr5
}
goto tr1
case 6:
if data[(p)] == 124 {
goto tr7
}
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr6
}
goto tr1
case 7:
switch data[(p)] {
case 92:
goto tr9
case 124:
goto tr10
}
goto tr8
case 8:
switch data[(p)] {
case 92:
goto tr12
case 124:
goto tr13
}
goto tr11
case 9:
switch data[(p)] {
case 92:
goto tr14
case 124:
goto tr14
}
goto tr1
case 10:
switch data[(p)] {
case 92:
goto tr16
case 124:
goto tr17
}
goto tr15
case 11:
switch data[(p)] {
case 92:
goto tr19
case 124:
goto tr20
}
goto tr18
case 12:
switch data[(p)] {
case 92:
goto tr22
case 124:
goto tr23
}
goto tr21
case 13:
switch data[(p)] {
case 92:
goto tr24
case 124:
goto tr24
}
goto tr1
case 14:
switch data[(p)] {
case 92:
goto tr26
case 124:
goto tr27
}
goto tr25
case 15:
switch data[(p)] {
case 92:
goto tr29
case 124:
goto tr30
}
goto tr28
case 16:
switch data[(p)] {
case 92:
goto tr32
case 124:
goto tr33
}
goto tr31
case 17:
switch data[(p)] {
case 92:
goto tr34
case 124:
goto tr34
}
goto tr1
case 18:
switch data[(p)] {
case 92:
goto tr36
case 124:
goto tr37
}
goto tr35
case 19:
switch data[(p)] {
case 92:
goto tr39
case 124:
goto tr40
}
goto tr38
case 20:
switch data[(p)] {
case 92:
goto tr42
case 124:
goto tr43
}
goto tr41
case 21:
switch data[(p)] {
case 92:
goto tr44
case 124:
goto tr44
}
goto tr1
case 22:
switch data[(p)] {
case 92:
goto tr46
case 124:
goto tr47
}
goto tr45
case 23:
switch data[(p)] {
case 92:
goto tr49
case 124:
goto tr50
}
goto tr48
case 24:
switch data[(p)] {
case 92:
goto tr52
case 124:
goto tr53
}
goto tr51
case 25:
switch data[(p)] {
case 92:
goto tr54
case 124:
goto tr54
}
goto tr1
case 26:
switch data[(p)] {
case 92:
goto tr56
case 124:
goto tr57
}
goto tr55
case 27:
switch data[(p)] {
case 45:
goto tr58
case 124:
goto tr59
}
switch {
case data[(p)] < 65:
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr58
}
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr58
}
default:
goto tr58
}
goto tr1
case 28:
switch data[(p)] {
case 45:
goto tr60
case 124:
goto tr61
}
switch {
case data[(p)] < 65:
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr60
}
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr60
}
default:
goto tr60
}
goto tr1
case 36:
switch data[(p)] {
case 32:
goto tr73
case 95:
goto tr74
}
switch {
case data[(p)] < 65:
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr74
}
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr74
}
default:
goto tr74
}
goto tr1
case 29:
switch data[(p)] {
case 32:
goto tr62
case 95:
goto tr63
}
switch {
case data[(p)] < 65:
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr63
}
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr63
}
default:
goto tr63
}
goto tr1
case 30:
switch data[(p)] {
case 61:
goto tr65
case 93:
goto tr64
case 95:
goto tr64
}
switch {
case data[(p)] < 48:
if 44 <= data[(p)] && data[(p)] <= 46 {
goto tr64
}
case data[(p)] > 57:
switch {
case data[(p)] > 91:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr64
}
case data[(p)] >= 65:
goto tr64
}
default:
goto tr64
}
goto tr1
case 37:
switch data[(p)] {
case 32:
goto tr77
case 61:
goto tr66
case 92:
goto tr78
}
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr76
}
goto tr75
case 38:
switch data[(p)] {
case 32:
goto tr81
case 61:
goto tr66
case 92:
goto tr82
}
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr80
}
goto tr79
case 39:
switch data[(p)] {
case 32:
goto tr81
case 61:
goto tr66
case 92:
goto tr82
case 95:
goto tr83
}
switch {
case data[(p)] < 48:
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr80
}
case data[(p)] > 57:
switch {
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr83
}
case data[(p)] >= 65:
goto tr83
}
default:
goto tr83
}
goto tr79
case 40:
switch data[(p)] {
case 32:
goto tr81
case 61:
goto tr85
case 92:
goto tr82
case 95:
goto tr84
}
switch {
case data[(p)] < 48:
switch {
case data[(p)] > 13:
if 44 <= data[(p)] && data[(p)] <= 46 {
goto tr84
}
case data[(p)] >= 9:
goto tr80
}
case data[(p)] > 57:
switch {
case data[(p)] > 93:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr84
}
case data[(p)] >= 65:
goto tr84
}
default:
goto tr84
}
goto tr79
case 41:
switch data[(p)] {
case 32:
goto tr88
case 61:
goto tr66
case 92:
goto tr89
}
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr87
}
goto tr86
case 42:
switch data[(p)] {
case 32:
goto tr92
case 61:
goto tr66
case 92:
goto tr93
}
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr91
}
goto tr90
case 43:
switch data[(p)] {
case 32:
goto tr92
case 61:
goto tr66
case 92:
goto tr93
case 95:
goto tr94
}
switch {
case data[(p)] < 48:
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr91
}
case data[(p)] > 57:
switch {
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr94
}
case data[(p)] >= 65:
goto tr94
}
default:
goto tr94
}
goto tr90
case 44:
switch data[(p)] {
case 32:
goto tr92
case 61:
goto tr85
case 92:
goto tr93
case 95:
goto tr95
}
switch {
case data[(p)] < 48:
switch {
case data[(p)] > 13:
if 44 <= data[(p)] && data[(p)] <= 46 {
goto tr95
}
case data[(p)] >= 9:
goto tr91
}
case data[(p)] > 57:
switch {
case data[(p)] > 93:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr95
}
case data[(p)] >= 65:
goto tr95
}
default:
goto tr95
}
goto tr90
case 31:
switch data[(p)] {
case 61:
goto tr67
case 92:
goto tr67
case 110:
goto tr67
case 114:
goto tr67
}
goto tr66
case 45:
switch data[(p)] {
case 32:
goto tr98
case 61:
goto tr66
case 92:
goto tr99
}
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr97
}
goto tr96
case 32:
switch data[(p)] {
case 61:
goto tr68
case 92:
goto tr68
case 110:
goto tr68
case 114:
goto tr68
}
goto tr66
case 46:
switch data[(p)] {
case 32:
goto tr102
case 61:
goto tr66
case 92:
goto tr103
}
if 9 <= data[(p)] && data[(p)] <= 13 {
goto tr101
}
goto tr100
case 33:
if data[(p)] == 32 {
goto tr70
}
goto tr69
case 34:
switch data[(p)] {
case 32:
goto tr70
case 95:
goto tr71
}
switch {
case data[(p)] < 65:
if 48 <= data[(p)] && data[(p)] <= 57 {
goto tr71
}
case data[(p)] > 90:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr71
}
default:
goto tr71
}
goto tr69
case 35:
switch data[(p)] {
case 32:
goto tr70
case 61:
goto tr72
case 93:
goto tr71
case 95:
goto tr71
}
switch {
case data[(p)] < 48:
if 44 <= data[(p)] && data[(p)] <= 46 {
goto tr71
}
case data[(p)] > 57:
switch {
case data[(p)] > 91:
if 97 <= data[(p)] && data[(p)] <= 122 {
goto tr71
}
case data[(p)] >= 65:
goto tr71
}
default:
goto tr71
}
goto tr69
case 47:
if data[(p)] == 32 {
goto tr70
}
goto tr69
}
tr1:
cs = 0
goto _again
tr66:
cs = 0
goto f24
tr0:
cs = 2
goto _again
tr2:
cs = 3
goto _again
tr3:
cs = 4
goto _again
tr4:
cs = 5
goto _again
tr6:
cs = 6
goto _again
tr5:
cs = 6
goto f0
tr7:
cs = 7
goto f1
tr11:
cs = 8
goto _again
tr8:
cs = 8
goto f0
tr15:
cs = 8
goto f6
tr9:
cs = 9
goto f2
tr12:
cs = 9
goto f4
tr16:
cs = 9
goto f7
tr14:
cs = 10
goto _again
tr10:
cs = 11
goto f3
tr13:
cs = 11
goto f5
tr17:
cs = 11
goto f8
tr21:
cs = 12
goto _again
tr18:
cs = 12
goto f0
tr25:
cs = 12
goto f6
tr19:
cs = 13
goto f2
tr22:
cs = 13
goto f4
tr26:
cs = 13
goto f7
tr24:
cs = 14
goto _again
tr20:
cs = 15
goto f9
tr23:
cs = 15
goto f10
tr27:
cs = 15
goto f11
tr31:
cs = 16
goto _again
tr28:
cs = 16
goto f0
tr35:
cs = 16
goto f6
tr29:
cs = 17
goto f2
tr32:
cs = 17
goto f4
tr36:
cs = 17
goto f7
tr34:
cs = 18
goto _again
tr30:
cs = 19
goto f12
tr33:
cs = 19
goto f13
tr37:
cs = 19
goto f14
tr41:
cs = 20
goto _again
tr38:
cs = 20
goto f0
tr45:
cs = 20
goto f6
tr39:
cs = 21
goto f2
tr42:
cs = 21
goto f4
tr46:
cs = 21
goto f7
tr44:
cs = 22
goto _again
tr40:
cs = 23
goto f15
tr43:
cs = 23
goto f16
tr47:
cs = 23
goto f17
tr51:
cs = 24
goto _again
tr48:
cs = 24
goto f0
tr55:
cs = 24
goto f6
tr49:
cs = 25
goto f2
tr52:
cs = 25
goto f4
tr56:
cs = 25
goto f7
tr54:
cs = 26
goto _again
tr50:
cs = 27
goto f18
tr53:
cs = 27
goto f19
tr57:
cs = 27
goto f20
tr60:
cs = 28
goto _again
tr58:
cs = 28
goto f0
tr62:
cs = 29
goto _again
tr73:
cs = 29
goto f27
tr64:
cs = 30
goto _again
tr63:
cs = 30
goto f0
tr74:
cs = 30
goto f28
tr93:
cs = 31
goto f4
tr99:
cs = 31
goto f7
tr89:
cs = 31
goto f32
tr82:
cs = 32
goto f4
tr103:
cs = 32
goto f7
tr78:
cs = 32
goto f32
tr69:
cs = 33
goto _again
tr70:
cs = 34
goto f0
tr71:
cs = 35
goto _again
tr59:
cs = 36
goto f21
tr61:
cs = 36
goto f22
tr65:
cs = 37
goto f23
tr80:
cs = 38
goto _again
tr101:
cs = 38
goto f6
tr79:
cs = 38
goto f25
tr75:
cs = 38
goto f30
tr76:
cs = 38
goto f31
tr100:
cs = 38
goto f37
tr81:
cs = 39
goto _again
tr102:
cs = 39
goto f6
tr77:
cs = 39
goto f31
tr84:
cs = 40
goto f25
tr83:
cs = 40
goto f34
tr85:
cs = 41
goto f23
tr91:
cs = 42
goto _again
tr97:
cs = 42
goto f6
tr90:
cs = 42
goto f25
tr86:
cs = 42
goto f30
tr87:
cs = 42
goto f31
tr96:
cs = 42
goto f37
tr92:
cs = 43
goto _again
tr98:
cs = 43
goto f6
tr88:
cs = 43
goto f31
tr95:
cs = 44
goto f25
tr94:
cs = 44
goto f35
tr67:
cs = 45
goto f25
tr68:
cs = 46
goto f25
tr72:
cs = 47
goto f26
f0:
//line cef_actions.rl:9
mark = p
goto _again
f4:
//line cef_actions.rl:12
mark_slash = p
goto _again
f6:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
goto _again
f1:
//line cef_actions.rl:18
e.Version, _ = strconv.Atoi(data[mark:p])
goto _again
f5:
//line cef_actions.rl:21
e.DeviceVendor = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f10:
//line cef_actions.rl:25
e.DeviceProduct = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f13:
//line cef_actions.rl:29
e.DeviceVersion = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f16:
//line cef_actions.rl:33
e.DeviceEventClassID = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f19:
//line cef_actions.rl:37
e.Name = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f22:
//line cef_actions.rl:41
e.Severity = data[mark:p]
goto _again
f27:
//line cef_actions.rl:44
complete = true
goto _again
f23:
//line cef_actions.rl:51
// A new extension key marks the end of the last extension value.
if len(state.key) != 0 && state.valueStart < mark {
// We should not be here, but purge the escapes and handle them.
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:mark-1], state.valueStart, state.escapes))
state.reset()
}
state.key = data[mark:p]
goto _again
f31:
//line cef_actions.rl:60
if len(state.escapes) != 0 { // See ragel comment below.
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
state.valueStart = p
state.valueEnd = p
goto _again
f25:
//line cef_actions.rl:68
state.valueEnd = p + 1
goto _again
f24:
//line cef_actions.rl:78
recoveredErrs = append(recoveredErrs, fmt.Errorf("malformed value for %s at pos %d", state.key, p+1))
(p)--
cs = 33
goto _again
f26:
//line cef_actions.rl:82
state.reset()
// Resume processing at p, the start of the next extension key.
p = mark
cs = 29
goto _again
f2:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:12
mark_slash = p
goto _again
f3:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:21
e.DeviceVendor = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f9:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:25
e.DeviceProduct = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f12:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:29
e.DeviceVersion = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f15:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:33
e.DeviceEventClassID = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f18:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:37
e.Name = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f21:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:41
e.Severity = data[mark:p]
goto _again
f35:
//line cef_actions.rl:9
mark = p
//line cef_actions.rl:68
state.valueEnd = p + 1
goto _again
f7:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:12
mark_slash = p
goto _again
f8:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:21
e.DeviceVendor = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f11:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:25
e.DeviceProduct = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f14:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:29
e.DeviceVersion = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f17:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:33
e.DeviceEventClassID = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f20:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:37
e.Name = replaceEscapes(data[mark:p], mark, state.escapes)
state.reset()
goto _again
f37:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:68
state.valueEnd = p + 1
goto _again
f28:
//line cef_actions.rl:44
complete = true
//line cef_actions.rl:9
mark = p
goto _again
f32:
//line cef_actions.rl:60
if len(state.escapes) != 0 { // See ragel comment below.
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
state.valueStart = p
state.valueEnd = p
//line cef_actions.rl:12
mark_slash = p
goto _again
f30:
//line cef_actions.rl:60
if len(state.escapes) != 0 { // See ragel comment below.
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
state.valueStart = p
state.valueEnd = p
//line cef_actions.rl:68
state.valueEnd = p + 1
goto _again
f34:
//line cef_actions.rl:68
state.valueEnd = p + 1
//line cef_actions.rl:9
mark = p
goto _again
_again:
if cs == 0 {
goto _out
}
if (p)++; (p) != (pe) {
goto _resume
}
_test_eof:
{
}
if (p) == eof {
switch _cef_eof_actions[cs] {
case 28:
//line cef_actions.rl:44
complete = true
case 34:
//line cef_actions.rl:71
// Reaching the EOF marks the end of the final extension value.
if len(state.key) != 0 && state.valueStart < state.valueEnd {
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
case 25:
//line cef_actions.rl:78
recoveredErrs = append(recoveredErrs, fmt.Errorf("malformed value for %s at pos %d", state.key, p+1))
(p)--
cs = 33
case 37:
//line cef_actions.rl:15
state.pushEscape(mark_slash, p)
//line cef_actions.rl:71
// Reaching the EOF marks the end of the final extension value.
if len(state.key) != 0 && state.valueStart < state.valueEnd {
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
case 30:
//line cef_actions.rl:60
if len(state.escapes) != 0 { // See ragel comment below.
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
state.valueStart = p
state.valueEnd = p
//line cef_actions.rl:71
// Reaching the EOF marks the end of the final extension value.
if len(state.key) != 0 && state.valueStart < state.valueEnd {
e.pushExtension(state.key, replaceEscapes(data[state.valueStart:state.valueEnd], state.valueStart, state.escapes))
state.reset()
}
//line parser.go:1155
}
}
_out:
{
}
}
//line parser.rl:54
// Check if state machine completed.
if cs < cef_first_final {
// Reached an early end.
if p == pe {
if complete {
return multierr.Append(multierr.Combine(recoveredErrs...), errUnexpectedEndOfEvent)
}
return multierr.Append(multierr.Combine(recoveredErrs...), multierr.Combine(errUnexpectedEndOfEvent, errIncompleteHeader))
}
// Encountered invalid input.
return multierr.Append(multierr.Combine(recoveredErrs...), fmt.Errorf("error in CEF event at pos %d", p+1))
}
return multierr.Combine(recoveredErrs...)
}