def test_storm_syntax_gele(self): insts = s_syntax.parse('foo:bar>=10') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', 10, by='ge')) insts = s_syntax.parse('foo:bar<=10') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', 10, by='le'))
def test_storm_syntax_by(self): insts = s_syntax.parse('woot/foo:bar*baz="hehe"') opts = {'from': 'woot', 'by': 'baz'} self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', 'hehe', **opts)) insts = s_syntax.parse('woot/foo:bar*baz') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', None, **opts))
def test_storm_syntax_macro_eq(self): ########################################################### insts = s_syntax.parse('foo:bar') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', None, by='has')) ########################################################### insts = s_syntax.parse('foo:bar=10') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', 10, by='eq')) ########################################################### insts = s_syntax.parse('foo:bar="woot"') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', 'woot', by='eq'))
def test_storm_syntax_lifteq(self): insts = s_syntax.parse('foo:bar join("foo:bar","baz:quux")') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', None, by='has')) self.eq(insts[1], ('join', { 'args': ['foo:bar', 'baz:quux'], 'kwlist': [] }))
def test_storm_syntax_liftlift(self): insts = s_syntax.parse('foo:bar baz:faz') self.eq(insts[0], s_syntax.oper('lift', 'foo:bar', None, by='has')) self.eq(insts[1], s_syntax.oper('lift', 'baz:faz', None, by='has'))
def test_storm_syntax_whites(self): insts = s_syntax.parse('inet:fqdn = "1.2.3.4"') self.eq(insts[0], s_syntax.oper('lift', 'inet:fqdn', '1.2.3.4', by='eq'))