gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

继续修复带偏移量字符串扫描的bug。

Browse Source
This commit is contained in:
zhengchao
2017-10-11 20:32:26 +08:00
parent 853e934ff6
commit 0f5f87ef69
3 changed files with 45 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/entry/Maat_api.cpp
View File

@@ -420,7 +420,7 @@ int detain_last_data(char* buff,int buff_size,int detained_len,const char* data,
{
memcpy(buff,data+data_len-buff_size,buff_size);
ret_len=buff_size;
*cache_offset+=(data_len-buff_size);
*cache_offset+=(data_len-buff_size+detained_len);
}
return ret_len;
}

27
test/maat_json.json
View File

@@ -429,6 +429,33 @@
]
}
]
},
{
"compile_id": 137,
"service": 1,
"action": 1,
"do_blacklist": 1,
"do_log": 1,
"effective_range": 0,
"user_region": "offset_string",
"is_valid": "yes",
"groups": [
{
"group_name": "Untitled",
"regions": [
{
"table_name": "IMAGE_FP",
"table_type": "string",
"table_content": {
"keywords": "19339-19467:6CB2CB2F2028474C994991CCFC65CCA5E3B6FF001673985D157358610CACC674EE64CC27B5721CCDABD9CCA7C8E9F7BB1F54A930A6034D50F92711F5B2DACCB0715D2E6873CE5CE431DC701A194C260E9DB78CC89F2C84745869AB88349A3AE0412AB59D9ABA84EDEFFF0057FA4DA66D333698B5AD6F844DA2226D1CADAD5E44",
"expr_type": "offset",
"match_method": "none",
"format": "hexbin"
}
}
]
}
]
}
],
"plugin_table": [

24
test/maat_test.cpp
View File

@@ -466,19 +466,22 @@ int test_string_similar_scan(Maat_feather_t feather,const char* table_name,scan_
printf("Similar String Scan:%s\n",print_maat_result(result,ret));
return ret;
}
int test_offset_str_scan(Maat_feather_t feather,const char* table_name,scan_status_t* mid)
int test_offset_str_scan_with_chunk(Maat_feather_t feather,const char* table_name,int chunk_size)
{
int table_id=0,ret=0;
int read_size=0,pass_flag=0;
struct Maat_rule_t result[4];
const char* fn="./testdata/mesa_logo.jpg";
scan_status_t mid=NULL;
//const char* fn="./testdata/mesa_logo.jpg";
const char* fn="./testdata/100719.jpg";
FILE*fp=fopen(fn,"r");
if(fp==NULL)
{
printf("%s open %s failed.\n",__FUNCTION__, fn);
return -1;
}
char scan_data[64];
char scan_data[chunk_size];
table_id=Maat_table_register(feather,table_name);
if(table_id==-1)
{
@@ -498,10 +501,10 @@ int test_offset_str_scan(Maat_feather_t feather,const char* table_name,scan_stat
read_size=fread(scan_data,1,sizeof(scan_data),fp);
ret=Maat_stream_scan_string_detail(&sp,CHARSET_NONE,scan_data,read_size
,result,4,hit_detail,10
,&detail_ret,mid);
,&detail_ret,&mid);
if(ret>0)
{
printf("Test offset string Scan Success. String Scan:%s\n",print_maat_result(result,ret));
printf("Test offset string Scan chunk=%d Success. String Scan:%s\n",chunk_size,print_maat_result(result,ret));
pass_flag=1;
break;
}
@@ -513,9 +516,17 @@ int test_offset_str_scan(Maat_feather_t feather,const char* table_name,scan_stat
{
printf("Test offset string Scan Failed.\n");
}
Maat_clean_status(&mid);
return ret;
}
void test_offset_str_scan(Maat_feather_t feather,const char* table_name)
{
test_offset_str_scan_with_chunk(feather,table_name,64);
test_offset_str_scan_with_chunk(feather,table_name,1460);
return;
}
int test_table_conjunction(Maat_feather_t feather,const char* table_name,const char* conj_table_name,scan_status_t* mid)
{
int ret=0;
@@ -926,8 +937,7 @@ int main(int argc,char* argv[])
test_table_conjunction(feather, "HTTP_URL", "HTTP_HOST", &mid);
Maat_clean_status(&mid);
test_offset_str_scan(feather,"IMAGE_FP",&mid);
Maat_clean_status(&mid);
test_offset_str_scan(feather,"IMAGE_FP");
if(1==using_redis)
{