Code review: 308370043: Fixed syslog:ssh parser.

config/dpkg/changelog

@@ -2,4 +2,4 @@ plaso (1.4.1-1) unstable; urgency=low
 
   * Auto-generated
 
- -- Log2Timeline <[email protected]>  Sat, 17 Sep 2016 19:49:02 +0200
+ -- Log2Timeline <[email protected]>  Sat, 17 Sep 2016 19:59:24 +0200

plaso/parsers/syslog_plugins/ssh.py

@@ -55,7 +55,8 @@ class SSHPlugin(interface.SyslogPlugin):
       pyparsing.Literal(u'from') + _PYPARSING_COMPONENTS[u'address'] +
       pyparsing.Literal(u'port') + _PYPARSING_COMPONENTS[u'port'] +
       _PYPARSING_COMPONENTS[u'protocol'] +
-      pyparsing.Literal(u':') + _PYPARSING_COMPONENTS[u'fingerprint'] +
+      pyparsing.Optional(
+          pyparsing.Literal(u':') + _PYPARSING_COMPONENTS[u'fingerprint']) +
       pyparsing.StringEnd()
   )
 

tests/parsers/syslog_plugins/ssh.py

@@ -65,6 +65,15 @@ def testParse(self):
     expected_address = u'188.124.3.41'
     self.assertEqual(expected_address, event.address)
 
+    event = storage_writer.events[7]
+    expected_address = u'192.0.2.60'
+    self.assertEqual(expected_address, event.address)
+
+    expected_port = u'20042'
+    self.assertEqual(expected_port, event.port)
+
+    expected_username = u'fred'
+    self.assertEqual(expected_username, event.username)
 
 if __name__ == '__main__':
   unittest.main()

tools/log2timeline_test.py

@@ -102,7 +102,6 @@ def testListOutputModules(self):
     test_tool.ListOutputModules()
 
     output = output_writer.ReadOutput()
-
     number_of_tables = 0
     lines = []
     for line in output.split(b'\n'):
@@ -114,9 +113,18 @@ def testListOutputModules(self):
 
     self.assertIn(u'Output Modules', lines[1])
 
+    # pylint: disable=protected-access
     lines = frozenset(lines)
+    disabled_outputs = list(test_tool._front_end.GetDisabledOutputClasses())
+    enabled_outputs = list(test_tool._front_end.GetOutputClasses())
+
+    expected_number_of_tables = 0
+    if disabled_outputs:
+      expected_number_of_tables += 1
+    if enabled_outputs:
+      expected_number_of_tables += 1
 
-    self.assertEqual(number_of_tables, 2)
+    self.assertEqual(number_of_tables, expected_number_of_tables)
 
     expected_line = b'rawpy : "raw" (or native) Python output.'
     self.assertIn(expected_line, lines)

tools/psort_test.py

@@ -376,10 +376,18 @@ def testListOutputModules(self):
 
     self.assertIn(u'Output Modules', lines[1])
 
+    # pylint: disable=protected-access
     lines = frozenset(lines)
+    disabled_outputs = list(test_tool._front_end.GetDisabledOutputClasses())
+    enabled_outputs = list(test_tool._front_end.GetOutputClasses())
 
-    self.assertEqual(number_of_tables, 2)
+    expected_number_of_tables = 0
+    if disabled_outputs:
+      expected_number_of_tables += 1
+    if enabled_outputs:
+      expected_number_of_tables += 1
 
+    self.assertEqual(number_of_tables, expected_number_of_tables)
     expected_line = b'rawpy : "raw" (or native) Python output.'
     self.assertIn(expected_line, lines)