diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 8c2f1a1..867187f 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -14,7 +14,7 @@ add_definitions(-fPIC) set(MAAT_SRC alignment.c maat_api.c rcu_hash.c maat_garbage_collection.c maat_config_monitor.c maat_core.c maat_kv.c maat_ex_data.c maat_utils.c maat_command.c maat_redis_monitor.c maat_table.c maat_rule.c maat_object.c maat_ip.c maat_flag.c maat_interval.c maat_expr.c maat_plugin.c - maat_ip_plugin.c maat_ipport_plugin.c maat_bool_plugin.c maat_fqdn_plugin.c maat_attribute.c maat_stat.c) + maat_ip_plugin.c maat_ipport_plugin.c maat_bool_plugin.c maat_fqdn_plugin.c maat_stat.c) set(LIB_SOURCE_FILES ${PROJECT_SOURCE_DIR}/deps/cJSON/cJSON.c ${PROJECT_SOURCE_DIR}/deps/log/log.c) diff --git a/src/inc_internal/maat_attribute.h b/src/inc_internal/maat_attribute.h deleted file mode 100644 index c437555..0000000 --- a/src/inc_internal/maat_attribute.h +++ /dev/null @@ -1,62 +0,0 @@ -/* -********************************************************************************************** -* File: maat_attribute.h -* Description: -* Authors: Liu WenTan -* Date: 2022-10-31 -* Copyright: (c) Since 2022 Geedge Networks, Ltd. All rights reserved. -*********************************************************************************************** -*/ - -#ifndef _MAAT_ATTRIBUTE_H_ -#define _MAAT_ATTRIBUTE_H_ - -#ifdef __cplusplus -extern "C" -{ -#endif - -#include "cJSON/cJSON.h" -#include "maat_table.h" - -struct attribute_runtime; - -void *attribute_schema_new(cJSON *json, struct table_manager *tbl_mgr, - const char *table_name, struct log_handle *logger); - -void attribute_schema_free(void *attribute_schema); - -void *attribute_runtime_new(void *attribute_schema, size_t max_thread_num, - struct maat_garbage_bin *garbage_bin, - struct log_handle *logger); - -void attribute_runtime_free(void *attribute_runtime); - -void attribute_runtime_scan_times_inc(struct attribute_runtime *virt_rt, - int thread_id); - -void attribute_runtime_scan_bytes_add(struct attribute_runtime *virt_rt, - int thread_id, long long val); - -long long attribute_runtime_scan_bytes(void *virt_rt); - -long long attribute_runtime_scan_times(void *attribute_runtime); - -long long attribute_runtime_scan_cpu_time(void *attribute_runtime); - -void attribute_runtime_hit_times_inc(struct attribute_runtime *virt_rt, - int thread_id); - -long long attribute_runtime_hit_times(void *attribute_runtime); - -void attribute_runtime_hit_item_num_add(struct attribute_runtime *virt_rt, - int thread_id, long long val); - -long long attribute_runtime_hit_item_num(void *attribute_runtime); - - -#ifdef __cplusplus -} -#endif - -#endif \ No newline at end of file diff --git a/src/inc_internal/maat_config_monitor.h b/src/inc_internal/maat_config_monitor.h index 7ff3a97..15fb7b2 100644 --- a/src/inc_internal/maat_config_monitor.h +++ b/src/inc_internal/maat_config_monitor.h @@ -28,8 +28,8 @@ void config_monitor_traverse(long long version, const cJSON *json_root, const char *dec_key, struct log_handle *logger); int load_maat_json_rule_file(struct maat *maat_inst, const char *json_filename, - cJSON *json_root, char *err_str, size_t err_str_sz); -void convert_maat_json_rule(cJSON *json_root, unsigned char *json_buff); + cJSON **json_root, char *err_str, size_t err_str_sz); +void convert_maat_json_rule(cJSON **json_root, unsigned char *json_buff); #ifdef __cplusplus } diff --git a/src/inc_internal/maat_core.h b/src/inc_internal/maat_core.h index bb94829..f861ee6 100644 --- a/src/inc_internal/maat_core.h +++ b/src/inc_internal/maat_core.h @@ -31,7 +31,6 @@ extern "C" #include "maat.h" #include "maat_kv.h" #include "maat_table.h" -#include "maat_attribute.h" #include "maat_stat.h" #include "hiredis/hiredis.h" diff --git a/src/maat_api.c b/src/maat_api.c index 4c6507e..04f5be5 100644 --- a/src/maat_api.c +++ b/src/maat_api.c @@ -38,7 +38,6 @@ #include "maat_ipport_plugin.h" #include "maat_fqdn_plugin.h" #include "maat_bool_plugin.h" -#include "maat_attribute.h" #include "maat_stat.h" #include "uthash/utarray.h" diff --git a/src/maat_attribute.c b/src/maat_attribute.c deleted file mode 100644 index fcd033f..0000000 --- a/src/maat_attribute.c +++ /dev/null @@ -1,248 +0,0 @@ -/* -********************************************************************************************** -* File: maat_attribute.c -* Description: -* Authors: Liu WenTan -* Date: 2022-10-31 -* Copyright: (c) Since 2022 Geedge Networks, Ltd. All rights reserved. -*********************************************************************************************** -*/ - -#include - -#include "maat_kv.h" -#include "maat_utils.h" -#include "log/log.h" -#include "alignment.h" -#include "maat_core.h" -#include "maat_table.h" - -#define MODULE_ATTRIBUTE module_name_str("maat.attribute") - -struct attribute_schema { - int attribute_id; - int physical_table_id; - struct table_manager *ref_tbl_mgr; -}; - -struct attribute_runtime { - size_t n_worker_thread; - long long *scan_times; - long long *scan_bytes; - long long *scan_cpu_time; - long long *hit_times; - long long *hit_item_num; -}; - -void *attribute_schema_new(cJSON *json, struct table_manager *tbl_mgr, - const char *table_name, struct log_handle *logger) -{ - struct attribute_schema *schema = ALLOC(struct attribute_schema, 1); - schema->ref_tbl_mgr = tbl_mgr; - - cJSON *item = cJSON_GetObjectItem(json, "table_id"); - if (NULL == item || item->type != cJSON_Number) { - log_fatal(logger, MODULE_ATTRIBUTE, - "[%s:%d] attribute:<%s> schema has no table_id column", - __FUNCTION__, __LINE__, table_name); - goto error; - } - schema->attribute_id = item->valueint; - - item = cJSON_GetObjectItem(json, "physical_table"); - if (NULL == item || item->type != cJSON_String) { - log_fatal(logger, MODULE_ATTRIBUTE, - "[%s:%d] attribute:<%s> schema has no physical_table column", - __FUNCTION__, __LINE__, table_name); - goto error; - } - - schema->physical_table_id = table_manager_get_table_id(tbl_mgr, item->valuestring); - if (schema->physical_table_id < 0) { - log_fatal(logger, MODULE_ATTRIBUTE, - "[%s:%d] attribute:<%s>'s physical table:<%s> unregistered.", - __FUNCTION__, __LINE__, table_name, item->valuestring); - goto error; - } - - return schema; -error: - FREE(schema); - return NULL; -} - -void attribute_schema_free(void *attribute_schema) -{ - FREE(attribute_schema); -} - -void *attribute_runtime_new(void *attribute_schema, size_t max_thread_num, - struct maat_garbage_bin *garbage_bin, - struct log_handle *logger) -{ - if (NULL == attribute_schema) { - return NULL; - } - - struct attribute_runtime *virt_rt = ALLOC(struct attribute_runtime, 1); - - virt_rt->n_worker_thread = max_thread_num; - virt_rt->scan_times = alignment_int64_array_alloc(max_thread_num); - virt_rt->scan_bytes = alignment_int64_array_alloc(max_thread_num); - virt_rt->scan_cpu_time = alignment_int64_array_alloc(max_thread_num); - virt_rt->hit_times = alignment_int64_array_alloc(max_thread_num); - virt_rt->hit_item_num = alignment_int64_array_alloc(max_thread_num); - - return virt_rt; -} - -void attribute_runtime_free(void *attribute_runtime) -{ - if (NULL == attribute_runtime) { - return; - } - - struct attribute_runtime *virt_rt = (struct attribute_runtime *)attribute_runtime; - - if (virt_rt->scan_times != NULL) { - alignment_int64_array_free(virt_rt->scan_times); - virt_rt->scan_times = NULL; - } - - if (virt_rt->scan_bytes != NULL) { - alignment_int64_array_free(virt_rt->scan_bytes); - virt_rt->scan_bytes = NULL; - } - - if (virt_rt->scan_cpu_time != NULL) { - alignment_int64_array_free(virt_rt->scan_cpu_time); - virt_rt->scan_cpu_time = NULL; - } - - if (virt_rt->hit_times != NULL) { - alignment_int64_array_free(virt_rt->hit_times); - virt_rt->hit_times = NULL; - } - - if (virt_rt->hit_item_num != NULL) { - alignment_int64_array_free(virt_rt->hit_item_num); - virt_rt->hit_item_num = NULL; - } - - FREE(virt_rt); -} - -void attribute_runtime_scan_bytes_add(struct attribute_runtime *virt_rt, - int thread_id, long long val) -{ - if (NULL == virt_rt || thread_id < 0) { - return; - } - - alignment_int64_array_add(virt_rt->scan_bytes, thread_id, val); -} - -long long attribute_runtime_scan_bytes(void *attribute_runtime) -{ - if (NULL == attribute_runtime) { - return 0; - } - - struct attribute_runtime *virt_rt = (struct attribute_runtime *)attribute_runtime; - long long sum = alignment_int64_array_sum(virt_rt->scan_bytes, - virt_rt->n_worker_thread); - alignment_int64_array_reset(virt_rt->scan_bytes, - virt_rt->n_worker_thread); - - return sum; -} - -void attribute_runtime_scan_times_inc(struct attribute_runtime *virt_rt, - int thread_id) -{ - if (NULL == virt_rt || thread_id < 0) { - return; - } - - alignment_int64_array_add(virt_rt->scan_times, thread_id, 1); -} - -long long attribute_runtime_scan_times(void *attribute_runtime) -{ - if (NULL == attribute_runtime) { - return 0; - } - - struct attribute_runtime *virt_rt = (struct attribute_runtime *)attribute_runtime; - long long sum = alignment_int64_array_sum(virt_rt->scan_times, - virt_rt->n_worker_thread); - alignment_int64_array_reset(virt_rt->scan_times, - virt_rt->n_worker_thread); - - return sum; -} - -long long attribute_runtime_scan_cpu_time(void *attribute_runtime) -{ - if (NULL == attribute_runtime) { - return 0; - } - - struct attribute_runtime *virt_rt = (struct attribute_runtime *)attribute_runtime; - long long sum = alignment_int64_array_sum(virt_rt->scan_cpu_time, - virt_rt->n_worker_thread); - alignment_int64_array_reset(virt_rt->scan_cpu_time, - virt_rt->n_worker_thread); - - return sum; -} - -void attribute_runtime_hit_times_inc(struct attribute_runtime *virt_rt, - int thread_id) -{ - if (NULL == virt_rt || thread_id < 0) { - return; - } - - alignment_int64_array_add(virt_rt->hit_times, thread_id, 1); -} - -long long attribute_runtime_hit_times(void *attribute_runtime) -{ - if (NULL == attribute_runtime) { - return 0; - } - - struct attribute_runtime *virt_rt = (struct attribute_runtime *)attribute_runtime; - long long sum = alignment_int64_array_sum(virt_rt->hit_times, - virt_rt->n_worker_thread); - alignment_int64_array_reset(virt_rt->hit_times, - virt_rt->n_worker_thread); - - return sum; -} - -void attribute_runtime_hit_item_num_add(struct attribute_runtime *virt_rt, - int thread_id, long long val) -{ - if (NULL == virt_rt || thread_id < 0) { - return; - } - - alignment_int64_array_add(virt_rt->hit_item_num, thread_id, val); -} - -long long attribute_runtime_hit_item_num(void *attribute_runtime) -{ - if (NULL == attribute_runtime) { - return 0; - } - - struct attribute_runtime *virt_rt = (struct attribute_runtime *)attribute_runtime; - long long sum = alignment_int64_array_sum(virt_rt->hit_item_num, - virt_rt->n_worker_thread); - alignment_int64_array_reset(virt_rt->hit_item_num, - virt_rt->n_worker_thread); - - return sum; -} diff --git a/src/maat_config_monitor.c b/src/maat_config_monitor.c index 55aad62..6e091a7 100644 --- a/src/maat_config_monitor.c +++ b/src/maat_config_monitor.c @@ -88,15 +88,13 @@ int my_scandir(const char *dir, struct dirent ***namelist, static void config_load_json_content(const cJSON *json_root, const char *table_name, const char *key, void *u_param, int (*update_fn)(const char *, const char *, void *, enum maat_operation)) { - cJSON *tmp_item = NULL; cJSON *array_item = NULL; int i; - tmp_item = cJSON_GetObjectItem(json_root, table_name); array_item = cJSON_GetObjectItem(json_root, key); if (array_item != NULL) { - for (i = 0; i < cJSON_GetArraySize(tmp_item); i++) { - cJSON *rule = cJSON_GetArrayItem(tmp_item, i); + for (i = 0; i < cJSON_GetArraySize(array_item); i++) { + cJSON *rule = cJSON_GetArrayItem(array_item, i); if (rule == NULL) { continue; } @@ -106,7 +104,7 @@ static void config_load_json_content(const cJSON *json_root, const char *table_n continue; } - update_fn(tmp_item->valuestring, rule_str, u_param, MAAT_OP_ADD); + update_fn(table_name, rule_str, u_param, MAAT_OP_ADD); FREE(rule_str); } } @@ -127,8 +125,10 @@ void config_monitor_traverse(long long current_version, const cJSON *json_root, } cJSON *tmp_obj = NULL; + cJSON *rule_table = cJSON_GetObjectItem(json_root, "rule_table"); + cJSON *object2object_table = cJSON_GetObjectItem(json_root, "object2object_table"); - tmp_obj = cJSON_GetObjectItem(json_root, "objects"); + tmp_obj = cJSON_GetObjectItem(json_root, "items"); if (tmp_obj != NULL) { for (i = 0; i < cJSON_GetArraySize(tmp_obj); i++) { cJSON *object = cJSON_GetArrayItem(tmp_obj, i); @@ -136,11 +136,6 @@ void config_monitor_traverse(long long current_version, const cJSON *json_root, continue; } - cJSON *regions = cJSON_GetObjectItem(object, "regions"); - if (regions == NULL) { - continue; - } - cJSON *table_name = cJSON_GetObjectItem(object, "table_name"); if (table_name == NULL) { continue; @@ -158,25 +153,107 @@ void config_monitor_traverse(long long current_version, const cJSON *json_root, } } - config_load_json_content(json_root, "object2object_table", "object_groups", u_param, update_fn); - config_load_json_content(json_root, "rule_table", "rules", u_param, update_fn); + config_load_json_content(json_root, object2object_table->valuestring, "object_groups", u_param, update_fn); + config_load_json_content(json_root, rule_table->valuestring, "rules", u_param, update_fn); if (finish_fn != NULL) { finish_fn(u_param); } } -void convert_maat_json_rule(cJSON *json_root, unsigned char *json_buff) +void convert_maat_json_rule(cJSON **json_root, unsigned char *json_buff) { - json_root = cJSON_Parse((const char *)json_buff); - cJSON *top_objects = cJSON_GetObjectItem(json_root, "objects"); - //cJSON *object_groups = cJSON_GetObjectItem(json_root, "object_groups");//TODO: object include object in rules - cJSON *rules = cJSON_GetObjectItem(json_root, "rules"); - cJSON *tmp_rule = NULL; + *json_root = cJSON_Parse((const char *)json_buff); + cJSON *top_items = cJSON_GetObjectItem(*json_root, "items"); + cJSON *top_objects = cJSON_GetObjectItem(*json_root, "objects"); + cJSON *rules = cJSON_GetObjectItem(*json_root, "rules"); long long item_id = 1; long long object_id = 1; char str[10]; + if (top_items == NULL) { + top_items = cJSON_CreateArray(); + cJSON_AddItemToObject(*json_root, "items", top_items); + } + + /* + "objects": [ "items": [ + { { + "object_name": "ASN1234", "table_name": "AS_NUMBER", + "object_id": 1, "table_content": { + "items": [ "item_id": "1", + { "object_id": "1", + "table_name": "AS_NUMBER", --------------------> "keywords": "^AS1234$", + "table_type": "expr", "expr_type": "and" + "table_content": { } + "keywords": "^AS1234$", } + "expr_type": "and" ] + } + } + ] + } + ] + */ + cJSON *tmp_node = NULL; + cJSON_ArrayForEach(tmp_node, top_objects) { + cJSON *object_id_obj = cJSON_GetObjectItem(tmp_node, "object_id"); + cJSON *items = cJSON_GetObjectItem(tmp_node, "items"); + cJSON *tmp_item = NULL; + cJSON_ArrayForEach(tmp_item, items) { + cJSON *table_name = cJSON_GetObjectItem(tmp_item, "table_name"); + cJSON *table_content = cJSON_GetObjectItem(tmp_item, "table_content"); + cJSON *new_item = cJSON_CreateObject(); + cJSON *new_table_content = cJSON_Duplicate(table_content, 0); + + if (object_id_obj == NULL) { + memset(str, 0, sizeof(str)); + snprintf(str, sizeof(str), "%lld", object_id); + cJSON_AddStringToObject(new_table_content, "object_id", str); + object_id++; + } else { + cJSON_AddStringToObject(new_table_content, "object_id", object_id_obj->valuestring); + } + + if (cJSON_GetObjectItem(table_content, "item_id") == NULL) { + memset(str, 0, sizeof(str)); + snprintf(str, sizeof(str), "%lld", item_id); + cJSON_AddStringToObject(new_table_content, "item_id", str); + item_id++; + } + + cJSON_AddStringToObject(new_item, "table_name", table_name->valuestring); + cJSON_AddItemToObject(new_item, "table_content", new_table_content); + cJSON_AddItemToArray(top_items, new_item); + } + } + + /* + "rules": [ "items":[ + { { + "rule_id": "201", "table_name": "ATTR_APP_ID", + "conditions": [ "table_content": { + { "item_id": "1", + "attribute_name": "ATTR_APP_ID", "object_id": "1", + "objects": [ "interval": "4001" + { + "items":[ --------------> } + "table_name": "APP_ID_DICT", } + "table_type": "interval", ] + "interval": "4001" + ] + } "rules": [{ + ] "rule_id": "201", + } "conditions": [ + ], { + "misc": "blah, blah" "attribute_name": "ATTR_APP_ID", + } "object_ids": [1] + ] } + ] + "misc": "blah, blah" + } + ] + */ + cJSON *tmp_rule = NULL; cJSON_ArrayForEach(tmp_rule, rules) { cJSON *tmp_condition = NULL; cJSON *condition_array = cJSON_GetObjectItem(tmp_rule, "conditions"); @@ -184,26 +261,42 @@ void convert_maat_json_rule(cJSON *json_root, unsigned char *json_buff) cJSON *tmp_object = NULL; cJSON *object_id_array = cJSON_CreateArray(); cJSON *object_array = cJSON_GetObjectItem(tmp_condition, "objects"); + + if (object_array == NULL) { + continue; + } + cJSON_ArrayForEach(tmp_object, object_array) { //find items, generate item_id and object_id - cJSON *table_name = cJSON_GetObjectItem(tmp_object, "table_name"); - cJSON *tmp_item = cJSON_CreateObject(); - cJSON_AddItemToObject(tmp_item, "table_name", cJSON_CreateString(table_name->valuestring)); - cJSON *dup = cJSON_Duplicate(tmp_object, 0); - if (cJSON_GetObjectItem(dup, "item_id") == NULL) { - memset(str, 0, sizeof(str)); - snprintf(str, sizeof(str), "%lld", item_id); - cJSON_AddItemToObject(dup, "item_id", cJSON_CreateString(str)); - item_id++; - } - if (cJSON_GetObjectItem(dup, "object_id") == NULL) { - memset(str, 0, sizeof(str)); + cJSON *object_id_obj = cJSON_GetObjectItem(tmp_object, "object_id"); + cJSON *items = cJSON_GetObjectItem(tmp_object, "items"); + cJSON *item = NULL; + + memset(str, 0, sizeof(str)); + if (object_id_obj != NULL) { + snprintf(str, sizeof(str), "%s", object_id_obj->valuestring); + } else { snprintf(str, sizeof(str), "%lld", object_id); - cJSON_AddItemToObject(dup, "object_id", cJSON_CreateString(str)); object_id++; } - cJSON_AddItemToObject(tmp_item, "table_content", dup); - cJSON_AddItemToArray(top_objects, tmp_item); + cJSON_ArrayForEach(item, items) { + cJSON *table_name = cJSON_GetObjectItem(item, "table_name"); + cJSON *tmp_item = cJSON_CreateObject(); + cJSON_AddItemToObject(tmp_item, "table_name", cJSON_CreateString(table_name->valuestring)); + + cJSON *dup = cJSON_Duplicate(cJSON_GetObjectItem(item, "table_content"), 1); + + if (cJSON_GetObjectItem(dup, "item_id") == NULL) { + memset(str, 0, sizeof(str)); + snprintf(str, sizeof(str), "%lld", item_id); + cJSON_AddStringToObject(dup, "item_id", str); + item_id++; + } + cJSON_AddStringToObject(dup, "object_id", str); + + cJSON_AddItemToObject(tmp_item, "table_content", dup); + cJSON_AddItemToArray(top_items, tmp_item); + } cJSON_AddItemToArray(object_id_array, cJSON_CreateString(str)); } @@ -216,7 +309,7 @@ void convert_maat_json_rule(cJSON *json_root, unsigned char *json_buff) } int load_maat_json_rule_file(struct maat *maat_inst, const char *json_filename, - cJSON *json_root, char *err_str, size_t err_str_sz) + cJSON **json_root, char *err_str, size_t err_str_sz) { int ret = 0; unsigned char *json_buff = NULL; diff --git a/src/maat_core.c b/src/maat_core.c index fbec874..d6f0288 100644 --- a/src/maat_core.c +++ b/src/maat_core.c @@ -336,7 +336,7 @@ void maat_read_full_config(struct maat *maat_inst) break; case DATA_SOURCE_JSON_FILE: ret = load_maat_json_rule_file(maat_inst, maat_inst->opts.json_ctx.json_file, - json_root, err_str, sizeof(err_str)); + &json_root, err_str, sizeof(err_str)); if (ret < 0) { log_fatal(maat_inst->logger, MODULE_MAAT_RULE, "[%s:%d] Maat re-initiate with JSON file %s failed: %s", @@ -460,7 +460,7 @@ void *rule_monitor_loop(void *arg) md5_file(maat_inst->opts.json_ctx.json_file, md5_tmp); if (0 != strcmp(md5_tmp, maat_inst->opts.json_ctx.effective_json_md5)) { ret = load_maat_json_rule_file(maat_inst, maat_inst->opts.json_ctx.json_file, - json_root, err_str, sizeof(err_str)); + &json_root, err_str, sizeof(err_str)); if (ret < 0) { log_fatal(maat_inst->logger, MODULE_MAAT_RULE, "[%s:%d] Maat re-initiate with JSON file %s (md5=%s)failed: %s\n", diff --git a/src/maat_redis_monitor.c b/src/maat_redis_monitor.c index bc3f2f6..4d29dbe 100644 --- a/src/maat_redis_monitor.c +++ b/src/maat_redis_monitor.c @@ -22,7 +22,6 @@ #include "maat_config_monitor.h" #include "maat_redis_monitor.h" #include "maat_plugin.h" -#include "maat_attribute.h" #define MODULE_REDIS_MONITOR module_name_str("maat.redis_monitor") diff --git a/src/maat_rule.c b/src/maat_rule.c index d28d7df..4409148 100644 --- a/src/maat_rule.c +++ b/src/maat_rule.c @@ -279,23 +279,25 @@ static struct maat_rule *maat_rule_new(struct rule_runtime *rule_rt, struct rule } tmp_obj = cJSON_GetObjectItem(condition_obj, "negate_option"); - if (tmp_obj == NULL || tmp_obj->type != cJSON_String) { - log_fatal(logger, MODULE_RULE, - "[%s:%d] table: <%s> has no negate_option or not string format", - __FUNCTION__, __LINE__, table_name); - goto error; - } + if (tmp_obj) { + if (tmp_obj->type != cJSON_String) { + log_fatal(logger, MODULE_RULE, + "[%s:%d] table: <%s> has no negate_option or not string format", + __FUNCTION__, __LINE__, table_name); + goto error; + } - if (strncmp(tmp_obj->valuestring, "true", 4) == 0) { - condition->negate_option = CONDITION_NEGATE_OPTION_SET; - } else if (strncmp(tmp_obj->valuestring, "false", 5) == 0) { - condition->negate_option = CONDITION_NEGATE_OPTION_UNSET; - } else { - log_fatal(logger, MODULE_RULE, - "[%s:%d] table: <%s> negate_option:%s is illegal", - __FUNCTION__, __LINE__, table_name, tmp_obj->valuestring); - goto error; - } + if (strncmp(tmp_obj->valuestring, "true", 4) == 0) { + condition->negate_option = CONDITION_NEGATE_OPTION_SET; + } else if (strncmp(tmp_obj->valuestring, "false", 5) == 0) { + condition->negate_option = CONDITION_NEGATE_OPTION_UNSET; + } else { + log_fatal(logger, MODULE_RULE, + "[%s:%d] table: <%s> negate_option:%s is illegal", + __FUNCTION__, __LINE__, table_name, tmp_obj->valuestring); + goto error; + } + } if (condition->negate_option == CONDITION_NEGATE_OPTION_SET) { int ret = validate_table_not_condition(rule_rt, schema->ref_tbl_mgr, condition->attribute_id, MAAT_OP_ADD, logger); @@ -315,8 +317,8 @@ static struct maat_rule *maat_rule_new(struct rule_runtime *rule_rt, struct rule for (int j = 0; j < n_object_ids; j++) { cJSON *object_id_obj = cJSON_GetArrayItem(tmp_obj, j); - if (object_id_obj && object_id_obj->type == cJSON_Number) { - long long object_id = object_id_obj->valueint; + if (object_id_obj && object_id_obj->type == cJSON_String) { + long long object_id = atoll(object_id_obj->valuestring); condition->object_ids[j] = object_id; } } diff --git a/src/maat_table.c b/src/maat_table.c index b52d824..2ecc143 100644 --- a/src/maat_table.c +++ b/src/maat_table.c @@ -27,7 +27,6 @@ #include "maat_bool_plugin.h" #include "maat_fqdn_plugin.h" #include "maat_interval.h" -#include "maat_attribute.h" #include "expr_matcher/expr_matcher.h" #define MODULE_TABLE module_name_str("maat.table") @@ -272,22 +271,6 @@ struct table_operations table_ops[TABLE_TYPE_MAX] = { .rule_count = bool_plugin_runtime_rule_count, .update_err_count = bool_plugin_runtime_update_err_count }, -#if 0 - { - .type = TABLE_TYPE_ATTRIBUTE, - .new_schema = attribute_schema_new, - .free_schema = attribute_schema_free, - .new_runtime = attribute_runtime_new, - .free_runtime = attribute_runtime_free, - .update_runtime = NULL, - .commit_runtime = NULL, - .scan_times = attribute_runtime_scan_times, - .scan_bytes = attribute_runtime_scan_bytes, - .scan_cpu_time = attribute_runtime_scan_cpu_time, - .hit_times = attribute_runtime_hit_times, - .hit_item_num = attribute_runtime_hit_item_num - }, -#endif { .type = TABLE_TYPE_RULE, .new_schema = rule_schema_new, diff --git a/test/json_update/corrupted.json b/test/json_update/corrupted.json index fdc6c7d..623e6b3 100644 --- a/test/json_update/corrupted.json +++ b/test/json_update/corrupted.json @@ -10,23 +10,25 @@ "do_log": 1, "user_region": "anything", "is_valid": "yes", - "objects": [ + "conditions": [ { "object_name": "Untitled", - "regions": [ + "objects": [ { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "hello&world", - "expr_type": "none", - "match_method": "sub", - "format": "uncase plain" - } + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "hello&world", + "expr_type": "none" + } + } + ] } ] } ] } ] -} +} \ No newline at end of file diff --git a/test/json_update/new.json b/test/json_update/new.json index ba07f69..650bb33 100644 --- a/test/json_update/new.json +++ b/test/json_update/new.json @@ -1,6 +1,5 @@ { "rule_table": "RULE_DEFAULT", - "object2rule_table": "OBJECT2RULE_DEFAULT", "object2object_table": "OBJECT2OBJECT", "rules": [ { @@ -11,23 +10,25 @@ "do_log": 1, "user_region": "anything", "is_valid": "yes", - "objects": [ + "conditions": [ { "attribute": "HTTP_URL", - "regions": [ + "objects": [ { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "MESA&Maat", - "expr_type": "and", - "match_method": "sub", - "format": "uncase plain" - } + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "MESA&Maat", + "expr_type": "and" + } + } + ] } ] } ] } ] -} +} \ No newline at end of file diff --git a/test/json_update/old.json b/test/json_update/old.json index c395d6f..e382fa9 100644 --- a/test/json_update/old.json +++ b/test/json_update/old.json @@ -1,34 +1,35 @@ { "rule_table": "RULE_DEFAULT", - "object2rule_table": "OBJECT2RULE_DEFAULT", "object2object_table": "OBJECT2OBJECT", "rules": [ { - "rule_id": 1, + "rule_id": "1", "service": 1, "action": 1, "do_blacklist": 1, "do_log": 1, "user_region": "anything", "is_valid": "yes", - "objects": [ + "conditions": [ { "object_name": "Untitled", - "attribute": "HTTP_URL", - "regions": [ + "attribute_name": "HTTP_URL", + "objects": [ { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "hello&world", - "expr_type": "and", - "match_method": "sub", - "format": "uncase plain" - } + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "hello&world", + "expr_type": "and" + } + } + ] } ] } ] } ] -} +} \ No newline at end of file diff --git a/test/maat_framework_gtest.cpp b/test/maat_framework_gtest.cpp index c18c19e..0d6ff23 100644 --- a/test/maat_framework_gtest.cpp +++ b/test/maat_framework_gtest.cpp @@ -108,16 +108,16 @@ void scan_with_old_or_new_cfg(struct maat *maat_inst, int is_old) { const char *hit_old_data = "Hello world! I'm eve."; const char *hit_new_data = "Maat was borned in MESA."; - const char *table_name = "HTTP_URL"; + const char *attribute_name = "HTTP_URL"; long long results[ARRAY_SIZE] = {0}; size_t n_hit_result = 0; int thread_id = 0; struct maat_state *state = maat_state_new(maat_inst, thread_id); - int table_id = maat_get_table_id(maat_inst, table_name); - ASSERT_GT(table_id, 0); + int attribute_id = maat_get_attribute_id(maat_inst, attribute_name); + ASSERT_GT(attribute_id, 0); - int ret = maat_scan_string(maat_inst, table_id, hit_old_data, + int ret = maat_scan_string(maat_inst, attribute_id, hit_old_data, strlen(hit_old_data), results, ARRAY_SIZE, &n_hit_result, state); if (is_old) { @@ -127,12 +127,12 @@ void scan_with_old_or_new_cfg(struct maat *maat_inst, int is_old) EXPECT_EQ(ret, MAAT_SCAN_OK); } - ret = maat_scan_not_logic(maat_inst, table_id, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, attribute_id, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); maat_state_reset(state); - ret = maat_scan_string(maat_inst, table_id, hit_new_data, + ret = maat_scan_string(maat_inst, attribute_id, hit_new_data, strlen(hit_new_data), results, ARRAY_SIZE, &n_hit_result, state); if (!is_old) { @@ -142,7 +142,7 @@ void scan_with_old_or_new_cfg(struct maat *maat_inst, int is_old) EXPECT_EQ(ret, MAAT_SCAN_OK); } - ret = maat_scan_not_logic(maat_inst, table_id, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, attribute_id, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); diff --git a/test/maat_json.json b/test/maat_json.json index adc147a..936a651 100644 --- a/test/maat_json.json +++ b/test/maat_json.json @@ -1,3974 +1,4610 @@ { - "rule_table": "RULE_DEFAULT", - "object2rule_table": "OBJECT2RULE_DEFAULT", - "object2object_table": "OBJECT2OBJECT", - "objects": [ + "rule_table": "RULE_DEFAULT", + "object2object_table": "OBJECT2OBJECT", + "objects": [ + { + "object_name": "ASN1234", + "object_id": "1", + "items": [ + { + "table_name": "AS_NUMBER", + "table_type": "expr", + "table_content": { + "keywords": "^AS1234$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ASN2345", + "object_id": "2", + "items": [ + { + "table_name": "AS_NUMBER", + "table_type": "expr", + "table_content": { + "keywords": "^AS2345$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ASN6789", + "object_id": "3", + "items": [ + { + "table_name": "AS_NUMBER", + "table_type": "expr", + "table_content": { + "keywords": "^AS6789$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ASN9001", + "object_id": "4", + "items": [ + { + "table_name": "AS_NUMBER", + "table_type": "expr", + "table_content": { + "keywords": "^AS9001$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ASN9002", + "object_id": "5", + "items": [ + { + "table_name": "AS_NUMBER", + "table_type": "expr", + "table_content": { + "keywords": "^AS9002$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ASN9003", + "object_id": "6", + "items": [ + { + "table_name": "AS_NUMBER", + "table_type": "expr", + "table_content": { + "keywords": "^AS9003$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "IPv4-composition-source-only", + "object_id": "7", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.50.24" + } + } + ] + }, + { + "object_name": "FQDN_OBJ1", + "object_id": "8", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "^sports.example.com$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "FQDN_CAT1", + "object_id": "9", + "items": [ + { + "table_name": "INTERGER_PLUS", + "table_type": "interval_plus", + "table_content": { + "district": "fqdn_cat_id", + "interval": "1724" + } + } + ] + }, + { + "object_name": "IPv4-composition-NOT-client-ip", + "object_id": "10", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.58.19" + } + } + ] + }, + { + "object_name": "IPv4-composition-NOT-server-ip", + "object_id": "11", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "10.0.1.20-10.0.1.25" + } + } + ] + }, + { + "object_name": "financial-department-ip", + "object_id": "12", + "items": [ + { + "table_name": "IP_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "192.168.40.88/32" + } + } + ] + }, + { + "object_name": "security-department-ip", + "object_id": "13", + "items": [ + { + "table_name": "IP_PLUS_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "192.168.40.88/32" + } + } + ] + }, + { + "object_name": "develop-department-ip", + "object_id": "14", + "items": [ + { + "table_name": "IP_PLUS_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "192.168.40.88/32" + } + } + ] + }, + { + "object_name": "Country-Sparta-IP", + "object_id": "15", + "items": [ + { + "table_name": "GeoLocation", + "table_type": "expr", + "table_content": { + "keywords": "^Greece.Sparta$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "123_IP_object", + "object_id": "100", + "items": [ + { + "table_name": "IP_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "10.0.6.201/32" + } + }, + { + "table_name": "IP_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "2001:da8:205:1::101/112" + } + } + ] + }, { - "object_name": "ASN1234", - "object_id": 1, - "regions": [ + "object_name": "126_interval_object", + "object_id": "106", + "items": [ { - "table_name": "AS_NUMBER", - "table_type": "expr", + "table_name": "CONTENT_SIZE", + "table_type": "interval", "table_content": { - "keywords": "^AS1234$", + "interval": "2014-2016" + } + } + ] + }, + { + "object_name": "TakeMeHome", + "object_id": "111", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "Take me Home&Batman\\", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "152_mail_addr", + "object_id": "141", + "items": [ + { + "table_type": "expr", + "table_name": "MAIL_ADDR", + "table_content": { + "keywords": "^ceshi3@mailhost.cn", + "expr_type": "and" + } + }, + { + "table_type": "expr", + "table_name": "MAIL_ADDR", + "table_content": { + "keywords": "^ceshi6@mailhost.cn", "expr_type": "and" } } ] }, { - "object_name": "ASN2345", - "object_id": 2, - "regions": [ + "object_name": "153_expr_object", + "object_id": "143", + "items": [ { - "table_name": "AS_NUMBER", "table_type": "expr", + "table_name": "MAIL_ADDR", "table_content": { - "keywords": "^AS2345$", + "keywords": "^ceshi4@mailhost.cn", "expr_type": "and" } } ] }, { - "object_name": "ASN6789", - "object_id": 3, - "regions": [ + "object_name": "vt_grp_http_sig1", + "object_id": "152", + "items": [ { - "table_name": "AS_NUMBER", - "table_type": "expr", + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", "table_content": { - "keywords": "^AS6789$", + "district": "User-Agent", + "keywords": "Chrome/78.0.3904.108", "expr_type": "and" } } ] }, { - "object_name": "ASN9001", - "object_id": 4, - "regions": [ + "object_name": "vt_grp_http_sig2", + "object_id": "153", + "items": [ { - "table_name": "AS_NUMBER", - "table_type": "expr", + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", "table_content": { - "keywords": "^AS9001$", + "district": "Cookie", + "keywords": "uid=12345678", + "expr_type": "and" + } + }, + { + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", + "table_content": { + "district": "Cookie", + "keywords": "sessionid=888888", "expr_type": "and" } } ] }, { - "object_name": "ASN9002", - "object_id": 5, - "regions": [ + "object_name": "167_url_object", + "object_id": "158", + "items": [ { - "table_name": "AS_NUMBER", + "table_name": "HTTP_URL", "table_type": "expr", "table_content": { - "keywords": "^AS9002$", + "keywords": "2019/12/27", "expr_type": "and" } } ] }, { - "object_name": "ASN9003", - "object_id": 6, - "regions": [ + "object_name": "ExcludeLogicObject199_1", + "object_id": 189, + "is_exclude": 0, + "items": [ { - "table_name": "AS_NUMBER", + "table_name": "HTTP_URL", "table_type": "expr", "table_content": { - "keywords": "^AS9003$", + "keywords": "must-contained-string-of-rule-199", "expr_type": "and" } } ] }, { - "object_name": "IPv4-composition-source-only", - "object_id": 7, - "regions": [ + "object_name": "ExcludeLogicObject199_2", + "object_id": 190, + "is_exclude": 1, + "items": [ { - "table_type":"ip", + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-199", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ExcludeLogicObject200_1", + "object_id": 192, + "is_exclude": 0, + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-contained-string-of-rule-200", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ExcludeLogicObject200_2", + "object_id": 193, + "is_exclude": 1, + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-200", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ExcludeLogicObject202_1", + "object_id": 195, + "is_exclude": 0, + "items": [ + { + "table_type": "ip", "table_name": "IP_PLUS_CONFIG", "table_content": { - "ip": "192.168.50.24" + "ip": "100.64.1.0-100.64.1.20" } } ] }, { - "object_name": "FQDN_OBJ1", - "object_id": 8, - "regions": [ + "object_name": "ExcludeLogicObject202_2", + "object_id": 196, + "is_exclude": 1, + "items": [ { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "100.64.1.6-100.64.1.10" + } + } + ] + }, + { + "object_name": "ExcludeLogicObject202_3", + "object_id": 197, + "is_exclude": 1, + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "100.64.1.11-100.64.1.20" + } + } + ] + }, + { + "object_name": "ExcludeLogicObject203_3_1", + "object_id": 201, + "is_exclude": 0, + "items": [ + { + "table_type": "expr", "table_name": "KEYWORDS_TABLE", - "table_type": "expr", "table_content": { - "keywords": "^sports.example.com$", + "keywords": "jianshu.com$", "expr_type": "and" } } ] }, { - "object_name": "FQDN_CAT1", - "object_id": 9, - "regions": [ + "object_name": "ExcludeLogicObject203_3_2", + "object_id": 202, + "is_exclude": 1, + "items": [ { - "table_name": "INTERGER_PLUS", - "table_type": "interval_plus", - "table_content": { - "district": "fqdn_cat_id", - "interval": "1724" - } - } - ] - }, - { - "object_name": "IPv4-composition-NOT-client-ip", - "object_id": 10, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "192.168.58.19" - } - } - ] - }, - { - "object_name": "IPv4-composition-NOT-server-ip", - "object_id": 11, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "10.0.1.20-10.0.1.25" - } - } - ] - }, - { - "object_name": "financial-department-ip", - "object_id": 12, - "regions": [ - { - "table_name": "IP_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "192.168.40.88/32" - } - } - ] - }, - { - "object_name": "security-department-ip", - "object_id": 13, - "regions": [ - { - "table_name": "IP_PLUS_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "192.168.40.88/32" - } - } - ] - }, - { - "object_name": "develop-department-ip", - "object_id": 14, - "regions": [ - { - "table_name": "IP_PLUS_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "192.168.40.88/32" - } - } - ] - }, - { - "object_name": "Country-Sparta-IP", - "object_id": 15, - "regions": [ - { - "table_name": "GeoLocation", "table_type": "expr", + "table_name": "KEYWORDS_TABLE", "table_content": { - "keywords": "^Greece.Sparta$", + "keywords": "^www.jianshu.com$", "expr_type": "and" } } ] - } - ], - "rules": [ + }, { - "rule_id": 123, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.", - "is_valid": "yes", - "objects": [ + "object_name": "ExcludeLogicObject204_3_1_1", + "object_id": 207, + "is_exclude": 0, + "items": [ { - "attribute": "IP_CONFIG", - "object_name": "123_IP_object", - "object_id": 100, - "regions": [ - { - "table_name": "IP_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "10.0.6.201/32" - } - }, - { - "table_name": "IP_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "2001:da8:205:1::101/112" - } - } - ] - }, - { - "attribute": "HTTP_URL", - "object_name": "123_url_object", - "object_id": 101, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "abckkk&123", - "expr_type": "and" - } - } - ] + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "baidu.com$", + "expr_type": "and" + } } ] }, { - "rule_id": 124, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ + "object_name": "ExcludeLogicObject204_3_1_2", + "object_id": 208, + "is_exclude": 1, + "items": [ { - "attribute":"IP_CONFIG", - "object_name": "123_IP_object" - }, - { - "attribute": "CONTENT_SIZE", - "object_name": "124_interval_object", - "object_id": 102, - "regions": [ - { - "table_name": "CONTENT_SIZE", - "table_type": "interval", - "table_content": { - "interval": "100-500" - } - } - ] + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "^www.baidu.com$", + "expr_type": "and" + } } ] }, { - "rule_id": 125, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ + "object_name": "ExcludeLogicObject204_3_2", + "object_id": 209, + "is_exclude": 1, + "items": [ { - "attribute":"HTTP_URL", - "object_name": "125_url_object", - "object_id": 103, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "action=search\\&query=(.*)", - "expr_type": "regex" - } - } - ] + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "^mail.baidu.com$", + "expr_type": "and" + } } ] }, + { + "object_name": "ExcludeLogicObject217_1_1", + "object_id": 223, + "is_exclude": 0, + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "string-of-rule-217.com$", + "expr_type": "and" + } + } + ] + }, + { + "object_name": "ExcludeLogicObject217_1_2", + "object_id": 224, + "is_exclude": 1, + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "www.string-of-rule-217.com", + "expr_type": "and" + } + } + ] + } + ], + "object_groups": [ { - "rule_id": 126, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "126_url_object", - "object_id": 105, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "should_not_hit_any_rule", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "CONTENT_SIZE", - "object_name": "126_interval_object", - "object_id": 106, - "regions": [ - { - "table_name": "CONTENT_SIZE", - "table_type": "interval", - "table_content": { - "interval": "2014-2016" - } - } - ] - } + "object_id": "500", + "include_object_ids": [ + "106" ] }, { - "rule_id": 128, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "StringScan.ExprPlus", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_SIGNATURE", - "object_name": "128_expr_plus_object", - "object_id": 107, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "HtTP UrL", - "keywords": "abckkk&123", - "expr_type": "and" - } - } - ] - } + "object_id": "501", + "include_object_ids": [ + "141" ] }, { - "rule_id": 129, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "utf8_中文", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "129_url_object", - "object_id": 108, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "C#中国", - "expr_type": "and" - } - } - ] - } + "object_id": "502", + "include_object_ids": [ + "100" ] }, { - "rule_id": 130, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "utf8_维语", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "130_keywords_object", - "object_id": 109, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "2010&يىلىدىكى", - "expr_type": "and" - } - } - ] - } + "object_id": "503", + "include_object_ids": [ + "189" + ], + "exclude_object_ids": [ + "190" ] }, { - "rule_id": 131, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "utf8_维语2", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "131_keywords_object", - "object_id": 110, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "سىياسىي", - "expr_type": "and" - } - } - ] - } + "object_id": "504", + "include_object_ids": [ + "192" + ], + "exclude_object_ids": [ + "193" ] }, { - "rule_id": 132, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "string\\bunescape", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "TakeMeHome", - "object_id": 111, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "Take me Home&Batman\\", - "expr_type": "and" - } - } - ] - } + "object_id": "505", + "include_object_ids": [ + "195" + ], + "exclude_object_ids": [ + "196", + "197" ] }, { - "rule_id": 133, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_HOST", - "object_name": "133_host_object", - "object_id": 112, - "regions": [ - { - "table_name": "HTTP_HOST", - "table_type": "expr", - "table_content": { - "keywords": "www.3300av.com", - "expr_type": "and" - } - } - ] - } + "object_id": "506", + "include_object_ids": [ + "201" + ], + "exclude_object_ids": [ + "202" ] }, { - "rule_id": 134, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "table_conjunction_test_part2", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "134_url_object", - "object_id": 113, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "novel&27122.txt", - "expr_type": "and" - } - } - ] - } + "object_id": "507", + "object_name": "ExcludeLogicObject204_3_1", + "include_object_ids": [ + "207" + ], + "exclude_object_ids": [ + "208" ] }, { - "rule_id": 136, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "offset_string", - "is_valid": "yes", - "objects": [ - { - "attribute": "IMAGE_FP", - "object_name": "136_expr_object", - "object_id": 114, - "regions": [ - { - "table_name": "IMAGE_FP", - "table_type": "expr", - "table_content": { - "keywords": "(offset=4362,depth=4458)|323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000|", - "expr_type": "and" - } - } - ] - } + "object_id": "508", + "object_name": "ExcludeLogicObject204_3", + "include_object_ids": [ + "507" + ], + "exclude_object_ids": [ + "209" ] }, - { - "rule_id": 137, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "offset_string", - "is_valid": "yes", - "objects": [ - { - "attribute": "IMAGE_FP", - "object_name": "137_expr_object", - "object_id": 115, - "regions": [ - { - "table_name": "IMAGE_FP", - "table_type": "expr", - "table_content": { - "keywords": "(offset=19339,depth=19467)|6CB2CB2F2028474C994991CCFC65CCA5E3B6FF001673985D157358610CACC674EE64CC27B5721CCDABD9CCA7C8E9F7BB1F54A930A6034D50F92711F5B2DACCB0715D2E6873CE5CE431DC701A194C260E9DB78CC89F2C84745869AB88349A3AE0412AB59D9ABA84EDEFFF0057FA4DA66D333698B5AD6F844DA2226D1CADAD5E44|", - "expr_type": "and" - } - } + { + "object_id": "509", + "include_object_ids": [ + "223" + ], + "exclude_object_ids": [ + "224" + ] + } + ], + "rules": [ + { + "rule_id": "123", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_CONFIG", + "object_ids": [ + "100" + ] + }, + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "123_url_object", + "object_id": "101", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "abckkk&123", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "124", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_CONFIG", + "object_ids": [ + "100" + ] + }, + { + "attribute": "CONTENT_SIZE", + "objects": [ + { + "object_name": "124_interval_object", + "object_id": "102", + "items": [ + { + "table_name": "CONTENT_SIZE", + "table_type": "interval", + "table_content": { + "interval": "100-500" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "125", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "125_url_object", + "object_id": "103", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "action=search\\&query=(.*)", + "expr_type": "regex" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "126", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "126_url_object", + "object_id": "105", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "should_not_hit_any_rule", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "CONTENT_SIZE", + "object_ids": [ + "106" + ] + } + ] + }, + { + "rule_id": "128", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "StringScan.ExprPlus", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_SIGNATURE", + "objects": [ + { + "object_name": "128_expr_plus_object", + "object_id": "107", + "items": [ + { + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", + "table_content": { + "district": "HtTP UrL", + "keywords": "abckkk&123", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "129", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "utf8_中文", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "129_url_object", + "object_id": "108", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "C#中国", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "130", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "utf8_维语", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "130_keywords_object", + "object_id": "109", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "2010&يىلىدىكى", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "131", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "utf8_维语2", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "131_keywords_object", + "object_id": "110", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "سىياسىي", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "132", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "string\\bunescape", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "object_ids":[ + "111" + ] + } + ] + }, + { + "rule_id": "133", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_HOST", + "objects": [ + { + "object_name": "133_host_object", + "object_id": "112", + "items": [ + { + "table_name": "HTTP_HOST", + "table_type": "expr", + "table_content": { + "keywords": "www.3300av.com", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "134", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "table_conjunction_test_part2", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "134_url_object", + "object_id": "113", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "novel&27122.txt", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "136", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "offset_string", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IMAGE_FP", + "objects": [ + { + "object_name": "136_expr_object", + "object_id": "114", + "items": [ + { + "table_name": "IMAGE_FP", + "table_type": "expr", + "table_content": { + "keywords": "(offset=4362,depth=4458)|323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "137", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "offset_string", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IMAGE_FP", + "objects": [ + { + "object_name": "137_expr_object", + "object_id": "115", + "items": [ + { + "table_name": "IMAGE_FP", + "table_type": "expr", + "table_content": { + "keywords": "(offset=19339,depth=19467)|6CB2CB2F2028474C994991CCFC65CCA5E3B6FF001673985D157358610CACC674EE64CC27B5721CCDABD9CCA7C8E9F7BB1F54A930A6034D50F92711F5B2DACCB0715D2E6873CE5CE431DC701A194C260E9DB78CC89F2C84745869AB88349A3AE0412AB59D9ABA84EDEFFF0057FA4DA66D333698B5AD6F844DA2226D1CADAD5E44|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "138", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "effective_range": 0, + "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}", + "user_region": "Not\\baccepted\\btags", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "138_url_object", + "object_id": "116", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "should&hit&aaa", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "139", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "effective_range": 0, + "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}", + "user_region": "Accepted\\btags", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "139_url_object", + "object_id": "117", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "should&hit&bbb", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "140", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "file_streams", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "140_keywords_object", + "object_id": "118", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "2018-10-05", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "141", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "Something:I\\bhave\\ba\\bname,7799", + "rule_table_name": "RULE_ALIAS", + "is_valid": "yes", + "conditions": [ + { + "g2c_table_name": "OBJECT2RULE_ALIAS", + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "141_url_object", + "object_id": "119", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "i.ytimg.com", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "142", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "StringScan.UTF8EncodedURL", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "142_url_object", + "object_id": "120", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": ",IgpwcjA0LnN2bzAzKgkxMjcuMC4wLjE", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "143", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.OneRegion", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 0, + "objects": [ + { + "object_name": "143_url_object1", + "object_id": "121", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-contained-string-of-rule-143", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 1, + "objects": [ + { + "object_name": "143_url_object2", + "object_id": "122", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-143", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "144", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.ScanNotAtLast", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 0, + "objects": [ + { + "object_name": "144_url_object", + "object_id": "123", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-contained-string-of-rule-144", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "negate_option": 1, + "objects": [ + { + "object_name": "144_keywords_object", + "object_id": "124", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-144", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "145", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.ScanNotIP", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "negate_option": 0, + "objects": [ + { + "object_name": "145_url_object", + "object_id": "125", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-contained-string-of-rule-145", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "ATTRIBUTE_IP_CONFIG", + "negate_option": 1, + "object_ids": [ + "100" + ] + } + ] + }, + { + "rule_id": "146", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.NotExprConditionAndNotIPCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 0, + "condition_index": 0, + "objects": [ + { + "object_name": "146_url_object", + "object_id": "126", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-contained-string-of-rule-146", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "negate_option": 1, + "condition_index": 1, + "objects": [ + { + "object_name": "146_keywords_object", + "object_id": "127", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "must-contained-not-string-of-rule-146", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "ATTRIBUTE_IP_CONFIG", + "negate_option": 1, + "condition_index": 2, + "object_ids": [ + "100" + ] + } + ] + }, + { + "rule_id": "147", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.8NotCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_RESPONSE_KEYWORDS_1", + "negate_option": 1, + "condition_index": 0, + "objects": [ + { + "object_name": "147_keywords_object1", + "object_id": "128", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition0-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_2", + "negate_option": 1, + "condition_index": 1, + "objects": [ + { + "object_name": "147_keywords_object2", + "object_id": "129", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition1-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_3", + "negate_option": 1, + "condition_index": 2, + "objects": [ + { + "object_name": "147_keywords_object3", + "object_id": "130", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition2-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_4", + "negate_option": 1, + "condition_index": 3, + "objects": [ + { + "object_name": "147_keywords_object4", + "object_id": "131", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition3-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_5", + "negate_option": 1, + "condition_index": 4, + "objects": [ + { + "object_name": "147_keywords_object5", + "object_id": "132", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition4-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_6", + "negate_option": 1, + "condition_index": 5, + "objects": [ + { + "object_name": "147_keywords_object6", + "object_id": "133", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition5-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_7", + "negate_option": 1, + "condition_index": 6, + "objects": [ + { + "object_name": "147_keywords_object7", + "object_id": "134", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition6-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS_8", + "negate_option": 1, + "condition_index": 7, + "objects": [ + { + "object_name": "147_keywords_object8", + "object_id": "135", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "condition7-in-rule-147", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "148", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "StringScan.Regex", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "148_url_object", + "object_id": "136", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "Cookie:\\s.*head", + "expr_type": "regex" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "149", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.ExprPlusWithOffset", + "is_valid": "yes", + "conditions": [ + { + "attribute": "APP_PAYLOAD", + "objects": [ + { + "object_name": "149_app_object", + "object_id": "137", + "items": [ + { + "table_name": "APP_PAYLOAD", + "table_type": "expr_plus", + "table_content": { + "district": "Payload", + "keywords": "(offset=1,depth=1)|03|&(offset=9,depth=10)|2d|&(offset=14,depth=16)|2d34|&(offset=19,depth=21)|2d|&(offset=24,depth=25)|2d|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "150", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.BugReport20190325", + "is_valid": "yes", + "conditions": [ + { + "attribute": "TROJAN_PAYLOAD", + "objects": [ + { + "object_name": "billgates_regist1", + "object_id": "138", + "items": [ + { + "table_type": "expr", + "table_name": "TROJAN_PAYLOAD", + "table_content": { + "keywords": "(offset=0,depth=4)|01000000|", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "TROJAN_PAYLOAD", + "objects": [ + { + "object_name": "billgates_regist2", + "object_id": "139", + "items": [ + { + "table_type": "expr", + "table_name": "TROJAN_PAYLOAD", + "table_content": { + "keywords": "1:G2.40", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "151", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.PrefixAndSuffix", + "is_valid": "yes", + "conditions": [ + { + "attribute": "MAIL_ADDR", + "objects": [ + { + "object_name": "151_expr_object", + "object_id": "140", + "items": [ + { + "table_type": "expr", + "table_name": "MAIL_ADDR", + "table_content": { + "keywords": "ceshi3@mailhost.cn$", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "152", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.PrefixAndSuffix", + "is_valid": "yes", + "conditions": [ + { + "attribute": "MAIL_ADDR", + "object_ids": [ + "141" + ] + }, + { + "attribute": "CONTENT_SIZE", + "object_ids": [ + "500" + ] + } + ] + }, + { + "rule_id": "153", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "Policy.SubObject", + "is_valid": "yes", + "conditions": [ + { + "attribute": "MAIL_ADDR", + "negate_option": 0, + "object_ids": [ + "143", + "501" + ] + }, + { + "attribute": "IP_CONFIG", + "object_ids": [ + "502" ] - } - ] - }, - { - "rule_id": 138, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}", - "user_region": "Not\\baccepted\\btags", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "138_url_object", - "object_id": 116, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "should&hit&aaa", - "expr_type": "and" - } - } + } + ] + }, + { + "rule_id": "154", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "ipv4_plus", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "154_IP_object", + "object_id": "145", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "10.0.7.100-10.0.7.101" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "155", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "ipv6_plus", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "155_IP_object", + "object_id": "146", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "1001:da8:205:1::101-1001:da8:205:1::102" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "156", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "ExprPlusWithHex", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_SIGNATURE", + "objects": [ + { + "object_name": "156_expr_object", + "object_id": "147", + "items": [ + { + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", + "table_content": { + "district": "Content-Type", + "keywords": "|2f68746d6c|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "157", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.StreamScanUTF8", + "is_valid": "yes", + "conditions": [ + { + "attribute": "TROJAN_PAYLOAD", + "objects": [ + { + "object_name": "157_expr_object", + "object_id": "148", + "items": [ + { + "table_type": "expr", + "table_name": "TROJAN_PAYLOAD", + "table_content": { + "keywords": "我的订单", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "158", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "IPScan.IPv4_CIDR", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "objects": [ + { + "object_name": "158_IP_object", + "object_id": "149", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.0.1/32" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "159", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "IPScan.IPv6_CIDR", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "objects": [ + { + "object_name": "159_IP_object", + "object_id": "150", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "2001:db8::/120" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "160", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "AttributeWithOnePhysical", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "negate_option": 0, + "object_ids":[ + "111" + ] + }, + { + "attribute": "HTTP_URL", + "negate_option": 0, + "objects": [ + { + "object_name": "160_url_object", + "object_id": "151", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "https://blog.csdn.net/littlefang/article/details/8213058", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "161", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "attribute_test_temp", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_SIGNATURE", + "negate_option": 0, + "object_ids": [ + "152" + ] + }, + { + "attribute": "HTTP_SIGNATURE", + "negate_option": 0, + "object_ids": [ + "153" + ] + } + ] + }, + { + "rule_id": "162", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "AttributeWithAttribute", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_REQUEST_HEADER", + "negate_option": 0, + "object_ids": [ + "152" ] - } - ] - }, - { - "rule_id": 139, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "effective_range": 0, - "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}", - "user_region": "Accepted\\btags", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "139_url_object", - "object_id": 117, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "should&hit&bbb", - "expr_type": "and" - } - } + }, + { + "attribute": "HTTP_RESPONSE_HEADER", + "negate_option": 0, + "object_ids": [ + "153" ] - } - ] - }, - { - "rule_id": 140, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "file_streams", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "140_keywords_object", - "object_id": 118, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "2018-10-05", - "expr_type": "and" - } - } + } + ] + }, + { + "rule_id": "163", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "OneObjectInTwoAttribute", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_REQUEST_HEADER", + "negate_option": 0, + "object_ids": [ + "153" ] - } - ] - }, - { - "rule_id": 141, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "Something:I\\bhave\\ba\\bname,7799", - "rule_table_name": "RULE_ALIAS", - "is_valid": "yes", - "objects": [ - { - "g2c_table_name": "OBJECT2RULE_ALIAS", - "attribute": "HTTP_URL", - "object_name": "141_url_object", - "object_id": 119, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "i.ytimg.com", - "expr_type": "and" - } - } + }, + { + "attribute": "HTTP_RESPONSE_HEADER", + "negate_option": 0, + "object_ids": [ + "153" ] - } - ] - }, - { - "rule_id": 142, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "StringScan.UTF8EncodedURL", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "142_url_object", - "object_id": 120, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": ",IgpwcjA0LnN2bzAzKgkxMjcuMC4wLjE", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 143, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.OneRegion", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "143_url_object1", - "object_id": 121, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-string-of-rule-143", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_URL_FILTER", - "object_name": "143_url_object2", - "object_id": 122, - "negate_option": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-143", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 144, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.ScanNotAtLast", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "144_url_object", - "object_id": 123, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-string-of-rule-144", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "144_keywords_object", - "object_id": 124, - "negate_option": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-144", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 145, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.ScanNotIP", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "145_url_object", - "object_id": 125, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-string-of-rule-145", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "ATTRIBUTE_IP_CONFIG", - "object_name": "123_IP_object", - "negate_option": 1 - } - ] - }, - { - "rule_id": 146, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.NotExprConditionAndNotIPCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "146_url_object", - "object_id": 126, - "negate_option": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-string-of-rule-146", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "146_keywords_object", - "object_id": 127, - "negate_option": 1, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-not-string-of-rule-146", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "ATTRIBUTE_IP_CONFIG", - "object_name": "123_IP_object", - "negate_option": 1, - "condition_index": 2 - } - ] - }, - { - "rule_id": 147, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.8NotCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_RESPONSE_KEYWORDS_1", - "object_name": "147_keywords_object1", - "object_id": 128, - "negate_option": 1, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition0-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_2", - "object_name": "147_keywords_object2", - "object_id": 129, - "negate_option": 1, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition1-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_3", - "object_name": "147_keywords_object3", - "object_id": 130, - "negate_option": 1, - "condition_index": 2, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition2-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_4", - "object_name": "147_keywords_object4", - "object_id": 131, - "negate_option": 1, - "condition_index": 3, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition3-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_5", - "object_name": "147_keywords_object5", - "object_id": 132, - "negate_option": 1, - "condition_index": 4, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition4-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_6", - "object_name": "147_keywords_object6", - "object_id": 133, - "negate_option": 1, - "condition_index": 5, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition5-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_7", - "object_name": "147_keywords_object7", - "object_id": 134, - "negate_option": 1, - "condition_index": 6, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition6-in-rule-147", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS_8", - "object_name": "147_keywords_object8", - "object_id": 135, - "negate_option": 1, - "condition_index": 7, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "condition7-in-rule-147", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 148, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "StringScan.Regex", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "148_url_object", - "object_id": 136, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "Cookie:\\s.*head", - "expr_type": "regex" - } - } - ] - } - ] - }, - { - "rule_id": 149, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.ExprPlusWithOffset", - "is_valid": "yes", - "objects": [ - { - "attribute": "APP_PAYLOAD", - "object_name": "149_app_object", - "object_id": 137, - "regions": [ - { - "table_name": "APP_PAYLOAD", - "table_type": "expr_plus", - "table_content": { - "district": "Payload", - "keywords": "(offset=1,depth=1)|03|&(offset=9,depth=10)|2d|&(offset=14,depth=16)|2d34|&(offset=19,depth=21)|2d|&(offset=24,depth=25)|2d|", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 150, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.BugReport20190325", - "is_valid": "yes", - "objects": [ - { - "attribute": "TROJAN_PAYLOAD", - "object_name": "billgates_regist1", - "object_id": 138, - "regions": [ - { - "table_type": "expr", - "table_name": "TROJAN_PAYLOAD", - "table_content": { - "keywords": "(offset=0,depth=4)|01000000|", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "TROJAN_PAYLOAD", - "object_name": "billgates_regist2", - "object_id": 139, - "regions": [ - { - "table_type": "expr", - "table_name": "TROJAN_PAYLOAD", - "table_content": { - "keywords": "1:G2.40", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 151, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.PrefixAndSuffix", - "is_valid": "yes", - "objects": [ - { - "attribute": "MAIL_ADDR", - "object_name": "151_expr_object", - "object_id": 140, - "regions": [ - { - "table_type": "expr", - "table_name": "MAIL_ADDR", - "table_content": { - "keywords": "ceshi3@mailhost.cn$", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 152, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.PrefixAndSuffix", - "is_valid": "yes", - "objects": [ - { - "attribute": "MAIL_ADDR", - "object_name": "152_mail_addr", - "object_id": 141, - "regions": [ - { - "table_type": "expr", - "table_name": "MAIL_ADDR", - "table_content": { - "keywords": "^ceshi3@mailhost.cn", - "expr_type": "and" - } - }, - { - "table_type": "expr", - "table_name": "MAIL_ADDR", - "table_content": { - "keywords": "^ceshi6@mailhost.cn", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "CONTENT_SIZE", - "object_name": "interval_object_refered", - "object_id": 142, - "sub_objects": [ - { - "object_name": "126_interval_object" - } - ] - } - ] - }, - { - "rule_id": 153, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "Policy.SubObject", - "is_valid": "yes", - "objects": [ - { - "attribute": "MAIL_ADDR", - "object_name": "153_expr_object", - "object_id": 143, - "negate_option": 0, - "regions": [ - { - "table_type": "expr", - "table_name": "MAIL_ADDR", - "table_content": { - "keywords": "^ceshi4@mailhost.cn", - "expr_type": "and" - } - } + } + ] + }, + { + "rule_id": "164", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "CharsetWindows1251", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "164_keywords_object", + "object_id": "154", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": ">ЗАО «Севергазвтоматика АйС»<", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "165", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "EvaluationOrder", + "is_valid": "yes", + "evaluation_order": "2.111", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "165_url_object", + "object_id": "155", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "cavemancircus.com/", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "165_IP_object", + "object_id": "156", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.23.1/24" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "166", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "EvaluationOrder", + "is_valid": "yes", + "evaluation_order": "100.233", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "166_url_object", + "object_id": "157", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "2019/12/27/pretty-girls-6", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "167", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "EvaluationOrder", + "is_valid": "yes", + "evaluation_order": "300.999", + "conditions": [ + { + "attribute": "HTTP_URL", + "condition_index": 1, + "object_ids": [ + "158" + ] + }, + { + "attribute": "HTTP_URL", + "object_ids": [ + "158" ], - "sub_objects": [ - { - "attribute": "MAIL_ADDR", - "object_name": "152_mail_addr" - } - ] - }, - { - "attribute": "IP_CONFIG", - "object_name": "IP_object_refered", - "object_id": 144, - "sub_objects": [ - { - "object_name": "123_IP_object" - } - ] - } - ] - }, - { - "rule_id": 154, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "ipv4_plus", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "154_IP_object", - "object_id": 145, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "10.0.7.100-10.0.7.101" - } - } - ] - } - ] - }, - { - "rule_id": 155, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "ipv6_plus", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "155_IP_object", - "object_id": 146, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "1001:da8:205:1::101-1001:da8:205:1::102" - } - } - ] - } - ] - }, - { - "rule_id": 156, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "ExprPlusWithHex", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_SIGNATURE", - "object_name": "156_expr_object", - "object_id": 147, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "Content-Type", - "keywords": "|2f68746d6c|", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 157, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.StreamScanUTF8", - "is_valid": "yes", - "objects": [ - { - "attribute": "TROJAN_PAYLOAD", - "object_name": "157_expr_object", - "object_id": 148, - "regions": [ - { - "table_type": "expr", - "table_name": "TROJAN_PAYLOAD", - "table_content": { - "keywords": "我的订单", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 158, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "IPScan.IPv4_CIDR", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "158_IP_object", - "object_id": 149, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "192.168.0.1/32" - } - } - ] - } - ] - }, - { - "rule_id": 159, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "IPScan.IPv6_CIDR", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "159_IP_object", - "object_id": 150, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "2001:db8::/120" - } - } - ] - } - ] - }, - { - "rule_id": 160, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "AttributeWithOnePhysical", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "TakeMeHome", - "negate_option": 0 - }, - { - "attribute": "HTTP_URL", - "object_name": "160_url_object", - "object_id": 151, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "https://blog.csdn.net/littlefang/article/details/8213058", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 161, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "attribute_test_temp", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_SIGNATURE", - "object_name": "vt_grp_http_sig1", - "object_id": 152, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "User-Agent", - "keywords": "Chrome/78.0.3904.108", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_SIGNATURE", - "object_name": "vt_grp_http_sig2", - "object_id": 153, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "Cookie", - "keywords": "uid=12345678", - "expr_type": "and" - } - }, - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "Cookie", - "keywords": "sessionid=888888", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 162, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "AttributeWithAttribute", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_REQUEST_HEADER", - "object_name": "vt_grp_http_sig1", - "negate_option": 0 - }, - { - "attribute": "HTTP_RESPONSE_HEADER", - "object_name": "vt_grp_http_sig2", - "negate_option": 0 - } - ] - }, - { - "rule_id": 163, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "OneObjectInTwoAttribute", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_REQUEST_HEADER", - "object_name": "vt_grp_http_sig2", - "negate_option": 0 - }, - { - "attribute": "HTTP_RESPONSE_HEADER", - "object_name": "vt_grp_http_sig2", - "negate_option": 0 - } - ] - }, - { - "rule_id": 164, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "CharsetWindows1251", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "164_keywords_object", - "object_id": 154, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": ">ЗАО «Севергазвтоматика АйС»<", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 165, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "EvaluationOrder", - "is_valid": "yes", - "evaluation_order": "2.111", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "165_url_object", - "object_id": 155, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "cavemancircus.com/", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "165_IP_object", - "object_id": 156, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "192.168.23.1/24" - } - } - ] - } - ] - }, - { - "rule_id": 166, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "EvaluationOrder", - "is_valid": "yes", - "evaluation_order": "100.233", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "166_url_object", - "object_id": 157, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "2019/12/27/pretty-girls-6", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 167, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "EvaluationOrder", - "is_valid": "yes", - "evaluation_order": "300.999", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "167_url_object", - "object_id": 158, - "condition_index": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "2019/12/27", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_URL", - "object_name": "167_url_object", - "object_id": 158, - "condition_index": 3 - } - ] - }, - { - "rule_id": 168, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "EvaluationOrder", - "is_valid": "yes", - "evaluation_order": "0", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "167_url_object", - "object_id": 158, - "condition_index": 2 - }, - { - "attribute": "HTTP_URL", - "object_name": "167_url_object", - "object_id": 158, - "condition_index": 6 - } - ] - }, - { - "rule_id": 169, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "IPScan.IPv4_Any", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "169_IP_object", - "object_id": 160, - "condition_index": 0, - "negate_option" : 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "100.64.3.1/32" - } - } - ] - } - ] - }, - { - "rule_id": 170, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "IPScan.IPv4_attribute.source", - "is_valid": "no", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "ipv4_attribute.source", - "object_id": 161, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "192.168.40.10/32" - } - } - ] - } - ] - }, - { - "rule_id": 171, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "IPScan.IPv4_attribute.destination", - "is_valid": "no", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "ipv4_attribute.destination", - "object_id": 162, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "192.168.231.46/32" - } - } - ] - } - ] - }, - { - "rule_id": 177, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.MultiObjectsInOneNotCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "ASN_NOT_LOGIC", - "object_name": ["ASN1234", "ASN6789", "ASN9001"], + "condition_index": 3 + } + ] + }, + { + "rule_id": "168", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "EvaluationOrder", + "is_valid": "yes", + "evaluation_order": "0", + "conditions": [ + { + "attribute": "HTTP_URL", + "object_ids": [ + "158" + ], + "condition_index": 2 + }, + { + "attribute": "HTTP_URL", + "object_ids": [ + "158" + ], + "condition_index": 6 + } + ] + }, + { + "rule_id": "169", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "IPScan.IPv4_Any", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "condition_index": 0, + "negate_option": 0, + "objects": [ + { + "object_name": "169_IP_object", + "object_id": "160", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "100.64.3.1/32" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "170", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "IPScan.IPv4_attribute.source", + "is_valid": "no", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "ipv4_attribute.source", + "object_id": "161", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.40.10/32" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "171", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "IPScan.IPv4_attribute.destination", + "is_valid": "no", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "ipv4_attribute.destination", + "object_id": "162", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.231.46/32" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "177", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.MulticonditionsInOneNotCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "ASN_NOT_LOGIC", "negate_option": 1, - "condition_index": 0 - }, - { - "attribute": "DESTINATION_IP_ASN", - "object_name": "ASN2345", + "object_ids": [ + "1", + "3", + "4" + ], + "condition_index": 0 + }, + { + "attribute": "DESTINATION_IP_ASN", "negate_option": 0, - "condition_index": 1 - } - ] - }, - { - "rule_id": 178, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "Hierarchy.MultiObjectInOneCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "SOURCE_IP_ASN", - "object_name": ["ASN1234", "ASN6789", "ASN9001"], + "object_ids": [ + "2" + ], + "condition_index": 1 + } + ] + }, + { + "rule_id": "178", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "Hierarchy.MultiObjectInOneCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "SOURCE_IP_ASN", + "object_ids": [ + "1", + "3", + "4" + ], + "negate_option": 0, + "condition_index": 0 + }, + { + "attribute": "DESTINATION_IP_ASN", "negate_option": 0, - "condition_index": 0 - }, - { - "attribute": "DESTINATION_IP_ASN", - "object_name": "ASN2345", + "object_ids": [ + "2" + ], + "condition_index": 1 + } + ] + }, + { + "rule_id": "179", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "INTERGER_PLUS", + "objects": [ + { + "object_name": "179_interval_object", + "object_id": "166", + "items": [ + { + "table_name": "INTERGER_PLUS", + "table_type": "interval_plus", + "table_content": { + "district": "interval.plus", + "interval": "2020" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "180", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "Hierarchy.MultiObjectInOneCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "SOURCE_IP_ASN", "negate_option": 0, - "condition_index": 1 - } - ] - }, - { - "rule_id": 179, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "INTERGER_PLUS", - "object_name": "179_interval_object", - "object_id": 166, - "regions": [ - { - "table_name": "INTERGER_PLUS", - "table_type": "interval_plus", - "table_content": { - "district": "interval.plus", - "interval": "2020" - } - } - ] - } - ] - }, - { - "rule_id": 180, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "Hierarchy.MultiObjectInOneCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "SOURCE_IP_ASN", - "object_name": ["ASN1234", "ASN6789", "ASN9001"], + "object_ids": [ + "1", + "3", + "4" + ], + "condition_index": 0 + }, + { + "attribute": "SOURCE_IP_GEO", "negate_option": 0, - "condition_index": 0 - }, - { - "attribute": "SOURCE_IP_GEO", - "object_name": "Country-Sparta-IP", + "object_ids": [ + "15" + ], + "condition_index": 0 + }, + { + "attribute": "IP_CONFIG", "negate_option": 0, - "condition_index": 0 - }, - { - "attribute": "IP_CONFIG", - "object_name": "financial-department-ip", + "object_ids": [ + "12" + ], + "condition_index": 1 + } + ] + }, + { + "rule_id": "181", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.MultiLiteralsInOneNotCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "SOURCE_IP_ASN", + "negate_option": 1, + "object_ids": [ + "1", + "3", + "4" + ], + "condition_index": 0 + }, + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 1, + "object_ids": [ + "14" + ], + "condition_index": 0 + }, + { + "attribute": "SOURCE_IP_GEO", "negate_option": 0, - "condition_index": 1 - } - ] - }, - { - "rule_id": 181, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.MultiLiteralsInOneNotCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "SOURCE_IP_ASN", - "object_name": ["ASN1234", "ASN6789", "ASN9001"], + "object_ids": [ + "15" + ], + "condition_index": 1 + } + ] + }, + { + "rule_id": "182", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "8-expr", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "182_keywords_object", + "object_id": "167", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "string1&string2&string3&string4&string5&string6&string7&string8", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "184", + "user_region": "APP_ID=6006740;Liumengyan-Bugreport-20210515", + "description": "Hulu", + "is_valid": "yes", + "do_blacklist": 0, + "do_log": 0, + "action": 0, + "service": 0, + "conditions": [ + { + "attribute": "IP_CONFIG", + "objects": [ + { + "object_name": "184_IP_object", + "object_id": "169", + "items": [ + { + "table_name": "IP_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "::/128" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "185", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.SameAttributeInMultiCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "DESTINATION_IP_ASN", "negate_option": 1, - "condition_index": 0 - }, - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "develop-department-ip", + "object_ids": [ + "1", + "3", + "4" + ], + "condition_index": 0 + }, + { + "attribute": "SOURCE_IP_GEO", "negate_option": 1, - "condition_index": 0 - }, - { - "attribute": "SOURCE_IP_GEO", - "object_name": "Country-Sparta-IP", + "object_ids": [ + "15" + ], + "condition_index": 0 + }, + { + "attribute": "DESTINATION_IP_ASN", + "negate_option": 1, + "object_ids": [ + "5" + ], + "condition_index": 1 + }, + { + "attribute": "DESTINATION_IP_ASN", "negate_option": 0, - "condition_index": 1 - } - ] - }, - { - "rule_id": 182, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "8-expr", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "182_keywords_object", - "object_id": 167, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "string1&string2&string3&string4&string5&string6&string7&string8", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 184, - "user_region": "APP_ID=6006740;Liumengyan-Bugreport-20210515", - "description": "Hulu", - "is_valid": "yes", - "do_blacklist": 0, - "do_log": 0, - "action": 0, - "service": 0, - "objects": [ - { - "attribute": "IP_CONFIG", - "object_name": "184_IP_object", - "object_id": 169, - "regions": [ - { - "table_name": "IP_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "::/128" - } - } - ] - } - ] - }, - { - "rule_id": 185, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.SameAttributeInMultiCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "DESTINATION_IP_ASN", - "object_name": ["ASN1234", "ASN6789", "ASN9001"], - "negate_option": 1, - "condition_index": 0 - }, - { - "attribute": "SOURCE_IP_GEO", - "object_name": "Country-Sparta-IP", - "negate_option": 1, - "condition_index": 0 - }, - { - "attribute": "DESTINATION_IP_ASN", - "object_name": "ASN9002", - "negate_option": 1, - "condition_index": 1 - }, - { - "attribute": "DESTINATION_IP_ASN", - "object_name": "ASN9003", + "object_ids": [ + "6" + ], + "condition_index": 2 + }, + { + "attribute": "IP_PLUS_CONFIG", "negate_option": 0, - "condition_index": 2 - }, - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "security-department-ip", + "object_ids": [ + "13" + ], + "condition_index": 3 + } + ] + }, + { + "rule_id": "186", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.ScanHitAtLast", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 1, + "objects": [ + { + "object_name": "186_expr_object", + "object_id": "170", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-186", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "186_IP_object", + "object_id": "171", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "10.0.8.186" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "187", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.ScanHitAtLast", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 1, + "objects": [ + { + "object_name": "187_url_object", + "object_id": "172", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-187", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "187_IP_object", + "object_id": "173", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "10.0.8.187" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "188", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NOTLogic.ScanHitAtLast", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 1, + "objects": [ + { + "object_name": "188_url_object", + "object_id": "174", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "must-not-contained-string-of-rule-188", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "188_IP_object", + "object_id": "175", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "10.0.8.188" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "189", + "is_valid": "yes", + "do_log": 0, + "action": 0, + "service": 0, + "do_blacklist": 0, + "user_region": "StringScan.ShouldNotHitExprPlus", + "conditions": [ + { + "attribute": "APP_PAYLOAD", + "objects": [ + { + "object_name": "189_app_object", + "object_id": "176", + "items": [ + { + "table_name": "APP_PAYLOAD", + "table_type": "expr_plus", + "table_content": { + "district": "tcp.payload.c2s_first_data", + "keywords": "|ab00|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "190", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "StringScan.ExprPlus", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_SIGNATURE", + "objects": [ + { + "object_name": "190_expr_object", + "object_id": "177", + "items": [ + { + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", + "table_content": { + "district": "我的DistrIct", + "keywords": "addis&sapphire", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "191", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.HexBinCaseSensitive", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "191_keywords_object", + "object_id": "178", + "items": [ + { + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "|54455354|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "192", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "FLAG_CONFIG", + "objects": [ + { + "object_name": "192_flag_object", + "object_id": "179", + "items": [ + { + "table_type": "flag", + "table_name": "FLAG_CONFIG", + "table_content": { + "flag": 1, + "flag_mask": 3 + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "193", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "FLAG_CONFIG", + "objects": [ + { + "object_name": "193_flag_object", + "object_id": "180", + "items": [ + { + "table_type": "flag", + "table_name": "FLAG_CONFIG", + "table_content": { + "flag": 2, + "flag_mask": 3 + } + } + ] + } + ] + }, + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "193_url_object", + "object_id": "181", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "hello", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "194", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "FLAG_CONFIG", + "objects": [ + { + "object_name": "194_flag_object", + "object_id": "182", + "items": [ + { + "table_type": "flag", + "table_name": "FLAG_CONFIG", + "table_content": { + "flag": 21, + "flag_mask": 31 + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "195", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_SIGNATURE", + "objects": [ + { + "object_name": "195_signature_object", + "object_id": "183", + "items": [ + { + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", + "table_content": { + "district": "I love China", + "keywords": "today&yesterday", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "195_url_object", + "object_id": "184", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "Monday", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "196", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "FLAG_PLUS_CONFIG", + "objects": [ + { + "object_name": "196_flag_object", + "object_id": "185", + "items": [ + { + "table_type": "flag_plus", + "table_name": "FLAG_PLUS_CONFIG", + "table_content": { + "district": "I love China", + "flag": 30, + "flag_mask": 14 + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "197", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "Something:I\\bhave\\ba\\bname,8866", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "197_url_object", + "object_id": "186", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "hqdefault.jpg", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "198", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "Something:I have a name,7799", + "rule_table_name": "RULE_FIREWALL_DEFAULT", + "is_valid": "yes", + "conditions": [ + { + "g2c_table_name": "OBJECT2RULE_FIREWALL", + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "198_url_object", + "object_id": "187", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "firewall", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "199", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "ExcludeLogic.ScanNotAtLast", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "object_name": "ExcludeLogicObject199", + "object_ids": [ + "503" + ] + } + ] + }, + { + "rule_id": "200", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "ExcludeLogic.OneRegion", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "object_ids": [ + "504" + ] + } + ] + }, + { + "rule_id": "202", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "null", + "is_valid": "yes", + "conditions": [ + { + "attribute": "ATTRIBUTE_IP_PLUS_TABLE", + "object_name": "ExcludeLogicObject202", + "object_ids": [ + "505" + ], + "condition_index": 0 + } + ] + }, + { + "rule_id": "203", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "null", + "is_valid": "yes", + "conditions": [ + { + "attribute": "ATTRIBUTE_IP_PLUS_SOURCE", + "condition_index": 0, + "objects": [ + { + "object_name": "ExcludeLogicObject203_1", + "object_id": "198", + "items": [ + { + "table_name": "IP_PLUS_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "192.168.50.43-192.168.50.43" + } + } + ] + } + ] + }, + { + "attribute": "ATTRIBUTE_IP_PLUS_DESTINATION", + "condition_index": 1, + "objects": [ + { + "object_name": "ExcludeLogicObject203_2", + "object_id": "199", + "items": [ + { + "table_name": "IP_PLUS_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "47.92.108.93-47.92.108.93" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "object_name": "ExcludeLogicObject203_3", + "object_ids": [ + "506" + ], + "condition_index": 2 + } + ] + }, + { + "rule_id": "204", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "null", + "is_valid": "yes", + "conditions": [ + { + "attribute": "ATTRIBUTE_IP_PLUS_SOURCE", + "condition_index": 0, + "objects": [ + { + "object_name": "ExcludeLogicObject204_1", + "object_id": "203", + "items": [ + { + "table_name": "IP_PLUS_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "100.64.2.0-100.64.2.5" + } + } + ] + } + ] + }, + { + "attribute": "ATTRIBUTE_IP_PLUS_DESTINATION", + "condition_index": 1, + "objects": [ + { + "object_name": "ExcludeLogicObject204_2", + "object_id": "204", + "items": [ + { + "table_name": "IP_PLUS_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "100.64.2.6-100.64.2.10" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "object_ids": [ + "508" + ], + "condition_index": 2 + } + ] + }, + { + "rule_id": "205", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.RegexExpressionIllegal", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "205_keywords_object", + "object_id": "210", + "items": [ + { + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "123^456", + "expr_type": "regex" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "206", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "duplicateRuleFor191", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "206_keywords_object", + "object_id": "211", + "items": [ + { + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "|54455354|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "207", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "duplicateRuleFor192", + "is_valid": "yes", + "conditions": [ + { + "attribute": "FLAG_CONFIG", + "objects": [ + { + "object_name": "207_flag_object", + "object_id": "212", + "items": [ + { + "table_type": "flag", + "table_name": "FLAG_CONFIG", + "table_content": { + "flag": 1, + "flag_mask": 3 + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "208", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "duplicateRuleFor154", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "208_IP_object", + "object_id": "213", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "10.0.7.100-10.0.7.106" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "209", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "duplicateRuleFor179", + "is_valid": "yes", + "conditions": [ + { + "attribute": "INTERGER_PLUS", + "objects": [ + { + "object_name": "209_interval_object", + "object_id": "214", + "items": [ + { + "table_name": "INTERGER_PLUS", + "table_type": "interval_plus", + "table_content": { + "district": "interval.plus", + "interval": "2020" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "210", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "ipv6_::", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "objects": [ + { + "object_name": "210_IP_object", + "object_id": "215", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "::/0" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "211", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "ip_perf_test", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PERF_CONFIG", + "negate_option": 0, + "objects": [ + { + "object_name": "211_IP_object", + "object_id": "216", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PERF_CONFIG", + "table_content": { + "ip": "10.0.0.1-10.0.0.6" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "212", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "integer_perf_test", + "is_valid": "yes", + "conditions": [ + { + "attribute": "INTEGER_PERF_CONFIG", + "objects": [ + { + "object_name": "212_interval_object", + "object_id": "217", + "items": [ + { + "table_name": "INTEGER_PERF_CONFIG", + "table_type": "interval", + "table_content": { + "interval": "3000" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "213", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "expr_perf_test", + "is_valid": "yes", + "conditions": [ + { + "attribute": "EXPR_LITERAL_PERF_CONFIG", + "objects": [ + { + "object_name": "213_expr_object", + "object_id": "218", + "items": [ + { + "table_name": "EXPR_LITERAL_PERF_CONFIG", + "table_type": "expr", + "table_content": { + "keywords": "today&yesterday", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "214", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "flag_perf_test", + "is_valid": "yes", + "conditions": [ + { + "attribute": "FLAG_PERF_CONFIG", + "objects": [ + { + "object_name": "214_flag_object", + "object_id": "219", + "items": [ + { + "table_type": "flag", + "table_name": "FLAG_PERF_CONFIG", + "table_content": { + "flag": 15, + "flag_mask": 15 + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "215", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "expr_perf_test", + "is_valid": "yes", + "conditions": [ + { + "attribute": "EXPR_REGEX_PERF_CONFIG", + "objects": [ + { + "object_name": "215_expr_object", + "object_id": "220", + "items": [ + { + "table_name": "EXPR_REGEX_PERF_CONFIG", + "table_type": "expr", + "table_content": { + "keywords": "action=search\\&query=(.*)", + "expr_type": "regex" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "216", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "NOTCondition&ExcludeObject", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", "negate_option": 0, - "condition_index": 3 - } - ] - }, - { - "rule_id": 186, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.ScanHitAtLast", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "186_expr_object", - "object_id": 170, - "negate_option": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-186", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "186_IP_object", - "object_id": 171, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "10.0.8.186" - } - } - ] - } - ] - }, - { - "rule_id": 187, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.ScanHitAtLast", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "187_url_object", - "object_id": 172, - "negate_option": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-187", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "187_IP_object", - "object_id": 173, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "10.0.8.187" - } - } - ] - } - ] - }, - { - "rule_id": 188, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NOTLogic.ScanHitAtLast", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "188_url_object", - "object_id": 174, - "negate_option": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-188", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "188_IP_object", - "object_id": 175, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "10.0.8.188" - } - } - ] - } - ] - }, - { - "rule_id": 189, - "is_valid": "yes", - "do_log": 0, - "action": 0, - "service": 0, - "do_blacklist": 0, - "user_region": "StringScan.ShouldNotHitExprPlus", - "objects": [ - { - "attribute": "APP_PAYLOAD", - "object_name": "189_app_object", - "object_id": 176, - "regions": [ - { - "table_name": "APP_PAYLOAD", - "table_type": "expr_plus", - "table_content": { - "district": "tcp.payload.c2s_first_data", - "keywords": "|ab00|", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 190, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "StringScan.ExprPlus", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_SIGNATURE", - "object_name": "190_expr_object", - "object_id": 177, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "我的DistrIct", - "keywords": "addis&sapphire", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 191, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.HexBinCaseSensitive", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "191_keywords_object", - "object_id": 178, - "regions": [ - { - "table_type": "expr", - "table_name": "KEYWORDS_TABLE", - "table_content": { - "keywords": "|54455354|", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 192, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "FLAG_CONFIG", - "object_name": "192_flag_object", - "object_id": 179, - "regions": [ - { - "table_type": "flag", - "table_name": "FLAG_CONFIG", - "table_content": { - "flag": 1, - "flag_mask": 3 - } - } - ] - } - ] - }, - { - "rule_id": 193, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "FLAG_CONFIG", - "object_name": "193_flag_object", - "object_id": 180, - "regions": [ - { - "table_type": "flag", - "table_name": "FLAG_CONFIG", - "table_content": { - "flag": 2, - "flag_mask": 3 - } - } - ] - }, - { - "attribute": "HTTP_URL", - "object_name": "193_url_object", - "object_id": 181, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "hello", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 194, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "FLAG_CONFIG", - "object_name": "194_flag_object", - "object_id": 182, - "regions": [ - { - "table_type": "flag", - "table_name": "FLAG_CONFIG", - "table_content": { - "flag": 21, - "flag_mask": 31 - } - } - ] - } - ] - }, - { - "rule_id": 195, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_SIGNATURE", - "object_name": "195_signature_object", - "object_id": 183, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "I love China", - "keywords": "today&yesterday", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_URL", - "object_name": "195_url_object", - "object_id": 184, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "Monday", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 196, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "FLAG_PLUS_CONFIG", - "object_name": "196_flag_object", - "object_id": 185, - "regions": [ - { - "table_type": "flag_plus", - "table_name": "FLAG_PLUS_CONFIG", - "table_content": { - "district": "I love China", - "flag": 30, - "flag_mask": 14 - } - } - ] - } - ] - }, - { - "rule_id": 197, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "Something:I\\bhave\\ba\\bname,8866", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "197_url_object", - "object_id": 186, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "hqdefault.jpg", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 198, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "Something:I have a name,7799", - "rule_table_name": "RULE_FIREWALL_DEFAULT", - "is_valid": "yes", - "objects": [ - { - "g2c_table_name": "OBJECT2RULE_FIREWALL", - "attribute": "HTTP_URL", - "object_name": "198_url_object", - "object_id": 187, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "firewall", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 199, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "ExcludeLogic.ScanNotAtLast", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "ExcludeLogicObject199", - "object_id": 188, - "sub_objects":[ - { - "object_name": "ExcludeLogicObject199_1", - "object_id": 189, - "is_exclude": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-string-of-rule-199", - "expr_type": "and" - } - } - ] - }, - { - "object_name": "ExcludeLogicObject199_2", - "object_id": 190, - "is_exclude": 1, - "condition_index": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-199", - "expr_type": "and" - } - } - ] - } - ] - } - ] - }, - { - "rule_id": 200, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "ExcludeLogic.OneRegion", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "ExcludeLogicObject200", - "object_id": 191, - "sub_objects":[ - { - "attribute": "HTTP_URL", - "object_name": "ExcludeLogicObject200_1", - "object_id": 192, - "is_exclude": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-contained-string-of-rule-200", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_URL", - "object_name": "ExcludeLogicObject200_2", - "object_id": 193, - "is_exclude": 1, - "condition_index": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "must-not-contained-string-of-rule-200", - "expr_type": "and" - } - } - ] - } - ] - } - ] - }, - { - "rule_id": 202, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "null", - "is_valid": "yes", - "objects": [ - { - "attribute": "ATTRIBUTE_IP_PLUS_TABLE", - "object_name": "ExcludeLogicObject202", - "object_id": 194, - "condition_index": 0, - "sub_objects":[ - { - "object_name": "ExcludeLogicObject202_1", - "object_id": 195, - "is_exclude": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "100.64.1.0-100.64.1.20" - } - } - ] - }, - { - "object_name": "ExcludeLogicObject202_2", - "object_id": 196, - "is_exclude": 1, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "100.64.1.6-100.64.1.10" - } - } - ] - }, - { - "object_name": "ExcludeLogicObject202_3", - "object_id": 197, - "is_exclude": 1, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "100.64.1.11-100.64.1.20" - } - } - ] - } - ] - } - ] - }, - { - "rule_id": 203, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "null", - "is_valid": "yes", - "objects": [ - { - "attribute": "ATTRIBUTE_IP_PLUS_SOURCE", - "object_name": "ExcludeLogicObject203_1", - "object_id": 198, - "condition_index": 0, - "regions": [ - { - "table_name": "IP_PLUS_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "192.168.50.43-192.168.50.43" - } - - } - ] - }, - { - "attribute": "ATTRIBUTE_IP_PLUS_DESTINATION", - "object_name": "ExcludeLogicObject203_2", - "object_id": 199, - "condition_index": 1, - "regions": [ - { - "table_name": "IP_PLUS_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "47.92.108.93-47.92.108.93" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "ExcludeLogicObject203_3", - "object_id": 200, - "condition_index": 2, - "sub_objects": [ - { - "object_name": "ExcludeLogicObject203_3_1", - "object_id": 201, - "is_exclude": 0, - "regions": [ - { - "table_type":"expr", - "table_name":"KEYWORDS_TABLE", - "table_content":{ - "keywords":"jianshu.com$", - "expr_type":"and" - } - } - ] - }, - { - "object_name": "ExcludeLogicObject203_3_2", - "object_id": 202, - "is_exclude": 1, - "regions": [ - { - "table_type":"expr", - "table_name":"KEYWORDS_TABLE", - "table_content":{ - "keywords":"^www.jianshu.com$", - "expr_type":"and" - } - } - ] - } - ] - } - ] - }, - { - "rule_id": 204, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "null", - "is_valid": "yes", - "objects": [ - { - "attribute": "ATTRIBUTE_IP_PLUS_SOURCE", - "object_name": "ExcludeLogicObject204_1", - "object_id": 203, - "condition_index": 0, - "regions": [ - { - "table_name": "IP_PLUS_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "100.64.2.0-100.64.2.5" - } - - } - ] - }, - { - "attribute": "ATTRIBUTE_IP_PLUS_DESTINATION", - "object_name": "ExcludeLogicObject204_2", - "object_id":204, - "condition_index": 1, - "regions": [ - { - "table_name": "IP_PLUS_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "100.64.2.6-100.64.2.10" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "ExcludeLogicObject204_3", - "object_id": 205, - "condition_index": 2, - "sub_objects": [ - { - "object_name": "ExcludeLogicObject204_3_1", - "object_id": 206, - "is_exclude": 0, - "sub_objects" : [ - { - "object_name": "ExcludeLogicObject204_3_1_1", - "object_id": 207, - "is_exclude": 0, - "regions": [ - { - "table_type":"expr", - "table_name":"KEYWORDS_TABLE", - "table_content":{ - "keywords":"baidu.com$", - "expr_type":"and" - } - } - ] - }, - { - "object_name": "ExcludeLogicObject204_3_1_2", - "object_id": 208, - "is_exclude": 1, - "regions": [ - { - "table_type":"expr", - "table_name":"KEYWORDS_TABLE", - "table_content":{ - "keywords":"^www.baidu.com$", - "expr_type":"and" - } - } - ] - } - ] - }, - { - "object_name": "ExcludeLogicObject204_3_2", - "object_id": 209, - "is_exclude": 1, - "regions": [ - { - "table_type":"expr", - "table_name":"KEYWORDS_TABLE", - "table_content":{ - "keywords":"^mail.baidu.com$", - "expr_type":"and" - } - } - ] - } - ] - } - ] - }, - { - "rule_id": 205, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.RegexExpressionIllegal", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "205_keywords_object", - "object_id": 210, - "regions": [ - { - "table_type": "expr", - "table_name": "KEYWORDS_TABLE", - "table_content": { - "keywords": "123^456", - "expr_type": "regex" - } - } - ] - } - ] - }, - { - "rule_id": 206, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "duplicateRuleFor191", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "206_keywords_object", - "object_id": 211, - "regions": [ - { - "table_type": "expr", - "table_name": "KEYWORDS_TABLE", - "table_content": { - "keywords": "|54455354|", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 207, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "duplicateRuleFor192", - "is_valid": "yes", - "objects": [ - { - "attribute": "FLAG_CONFIG", - "object_name": "207_flag_object", - "object_id": 212, - "regions": [ - { - "table_type": "flag", - "table_name": "FLAG_CONFIG", - "table_content": { - "flag": 1, - "flag_mask": 3 - } - } - ] - } - ] - }, - { - "rule_id": 208, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "duplicateRuleFor154", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "208_IP_object", - "object_id": 213, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "10.0.7.100-10.0.7.106" - } - } - ] - } - ] - }, - { - "rule_id": 209, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "duplicateRuleFor179", - "is_valid": "yes", - "objects": [ - { - "attribute": "INTERGER_PLUS", - "object_name": "209_interval_object", - "object_id": 214, - "regions": [ - { - "table_name": "INTERGER_PLUS", - "table_type": "interval_plus", - "table_content": { - "district": "interval.plus", - "interval": "2020" - } - } - ] - } - ] - }, - { - "rule_id": 210, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "ipv6_::", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "210_IP_object", - "object_id": 215, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "::/0" - } - } - ] - } - ] - }, - { - "rule_id": 211, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "ip_perf_test", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PERF_CONFIG", - "object_name": "211_IP_object", - "object_id": 216, - "negate_option": 0, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PERF_CONFIG", - "table_content": { - "ip": "10.0.0.1-10.0.0.6" - } - } - ] - } - ] - }, - { - "rule_id": 212, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "integer_perf_test", - "is_valid": "yes", - "objects": [ - { - "attribute": "INTEGER_PERF_CONFIG", - "object_name": "212_interval_object", - "object_id": 217, - "regions": [ - { - "table_name": "INTEGER_PERF_CONFIG", - "table_type": "interval", - "table_content": { - "interval": "3000" - } - } - ] - } - ] - }, - { - "rule_id": 213, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "expr_perf_test", - "is_valid": "yes", - "objects": [ - { - "attribute": "EXPR_LITERAL_PERF_CONFIG", - "object_name": "213_expr_object", - "object_id": 218, - "regions": [ - { - "table_name": "EXPR_LITERAL_PERF_CONFIG", - "table_type": "expr", - "table_content": { - "keywords": "today&yesterday", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 214, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "flag_perf_test", - "is_valid": "yes", - "objects": [ - { - "attribute": "FLAG_PERF_CONFIG", - "object_name": "214_flag_object", - "object_id": 219, - "regions": [ - { - "table_type": "flag", - "table_name": "FLAG_PERF_CONFIG", - "table_content": { - "flag": 15, - "flag_mask": 15 - } - } - ] - } - ] - }, - { - "rule_id": 215, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "expr_perf_test", - "is_valid": "yes", - "objects": [ - { - "attribute": "EXPR_REGEX_PERF_CONFIG", - "object_name": "215_expr_object", - "object_id": 220, - "regions": [ - { - "table_name": "EXPR_REGEX_PERF_CONFIG", - "table_type": "expr", - "table_content": { - "keywords": "action=search\\&query=(.*)", - "expr_type": "regex" - } - } - ] - } - ] - }, - { - "rule_id": 216, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "NOTCondition&ExcludeObject", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "ExcludeLogicObject200", - "negate_option": 0, - "condition_index": 0 - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "NOTConditionAndExcludeObject216", - "object_id": 221, - "negate_option": 1, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-for-rule-211", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 217, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "NOTCondition&ExcludeObject", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL_FILTER", - "object_name": "NOTConditionAndExcludeObject217_1", - "object_id": 222, - "negate_option": 1, - "condition_index": 0, - "sub_objects": [ - { - "object_name": "ExcludeLogicObject217_1_1", - "object_id": 223, - "is_exclude": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "string-of-rule-217.com$", - "expr_type": "and" - } - } - ] - }, - { - "object_name": "ExcludeLogicObject217_1_2", - "object_id": 224, - "is_exclude": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "www.string-of-rule-217.com", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "NOTConditionAndExcludeObject217_2", - "object_id": 225, - "negate_option": 0, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-for-rule-217", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 218, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "CONTENT_SIZE", - "object_name": "218_interval_object", - "object_id": 226, - "regions": [ - { - "table_name": "CONTENT_SIZE", - "table_type": "interval", - "table_content": { - "interval": "3000" - } - } - ] - } - ] - }, - { - "rule_id": 219, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_1", - "object_id": 227, - "negate_option": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-1", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_2", - "object_id": 228, - "negate_option": 1, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-2", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_3", - "object_id": 229, - "negate_option": 1, - "condition_index": 2, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-3", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_4", - "object_id": 230, - "negate_option": 1, - "condition_index": 3, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-4", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_5", - "object_id": 231, - "negate_option": 1, - "condition_index": 4, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-5", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_6", - "object_id": 232, - "negate_option": 1, - "condition_index": 5, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-6", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_7", - "object_id": 233, - "negate_option": 1, - "condition_index": 6, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-7", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject219_8", - "object_id": 234, - "negate_option": 1, - "condition_index": 7, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-219-8", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 220, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "anything", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject220_1", - "object_id": 235, - "negate_option": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-220-1", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject220_2", - "object_id": 236, - "negate_option": 1, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-220-2", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_DUMMY", - "object_name": "NOTConditionAndExcludeObject220_3", - "object_id": 237, - "negate_option": 1, - "condition_index": 2, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "keywords-dummy-220-3", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 221, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "NOTLogic.ScanWithDistrict", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_REQUEST_HEADER", - "object_name": "NOTLogicObject_221_1", - "object_id": 238, - "negate_option": 1, - "regions": [ - { - "table_name": "HTTP_SIGNATURE", - "table_type": "expr_plus", - "table_content": { - "district": "User-Agent", - "keywords": "Mozilla/5.0", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_URL", - "object_name": "NOTLogicObject_221_2", - "object_id": 239, - "negate_option": 0, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "scan_with_district_221", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 222, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "NOTLogic.SingleNotCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_NOT_LOGIC_1", - "object_name": "NOTLogicObject_222", - "object_id": 240, - "negate_option": 1, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "not_logic_keywords_222", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 223, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "NOTLogic.MultiNotCondition", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_NOT_LOGIC", - "object_name": "NOTLogicObject_223_1", - "object_id": 241, - "negate_option": 1, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "not_logic_rule_223_1", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_NOT_LOGIC", - "object_name": "NOTLogicObject_223_2", - "object_id": 242, - "negate_option": 1, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "not_logic_rule_223_2", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_NOT_LOGIC", - "object_name": "NOTLogicObject_223_1", - "object_id": 243, - "negate_option": 1, - "condition_index": 2, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "not_logic_rule_223_3", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 224, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "NOTLogic.NotPhysicalTable", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "NOTLogicObject_224_1", - "object_id": 244, - "negate_option": 1, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "not_logic_rule_224_1", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "NOTLogicObject_224_2", - "object_id": 245, - "negate_option": 0, - "condition_index": 1, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "not_logic_rule_224_2", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 225, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "Payload escape", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "EscapeObject_225_1", - "object_id": 246, - "negate_option": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "GET / HTTP/1.1\\r\\nHost: www.baidu.com\\r\\n\\r\\n", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 226, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "maat_scan_object", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "226_url_object", - "object_id":247 - } - ] - }, - { - "rule_id": 227, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "maat_scan_object", - "rule_table_name": "RULE_FIREWALL_DEFAULT", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "227_url_object", - "object_id": 248, - "g2c_table_name": "OBJECT2RULE_FIREWALL" - } - ] - }, - { - "rule_id": 228, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "NotConditionHitPath", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "228_url_object", - "object_id": 249, - "negate_option": 0, - "condition_index": 1, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "youtube.com", - "expr_type": "and" - } - } - ] - }, - { - "attribute": "ATTRIBUTE_IP_CONFIG", - "object_name": "228_IP_object", - "object_id": 250, - "negate_option": 1, - "condition_index": 2, - "regions": [ - { - "table_name": "IP_CONFIG", - "table_type":"ip", - "table_content": { - "ip": "192.168.101.102/32" - } - } - ] - } - ] - }, - { - "rule_id": 229, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "StringScan.Regex", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_URL", - "object_name": "229_url_object", - "object_id": 251, - "regions": [ - { - "table_name": "HTTP_URL", - "table_type": "expr", - "table_content": { - "keywords": "\u00C9", - "expr_type": "regex" - } - } - ] - } - ] - }, - { - "rule_id": 230, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "ipv6_::", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "230_IP_object", - "object_id": 256, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "2607:5d00:2:2::32:28/128", - "port":"80-443" - } - } - ] - } - ] - }, - { - "rule_id": 231, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "should_not_hit", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "231_IP_object", - "object_id": 257, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "2607:5d00:2:2::32:28/128", - "port":"80" - } - } - ] - } - ] - }, - { - "rule_id": 232, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "should_not_hit", - "is_valid": "yes", - "objects": [ - { - "attribute": "IP_PLUS_CONFIG", - "object_name": "232_IP_object", - "object_id": 258, - "regions": [ - { - "table_type":"ip", - "table_name": "IP_PLUS_CONFIG", - "table_content": { - "ip": "192.168.30.44/32", - "port": "80" - } - } - ] - } - ] - }, - { - "rule_id": 233, - "service": 1, - "action": 1, - "do_blacklist": 1, - "do_log": 1, - "user_region": "maat_scan_object", - "is_valid": "yes", - "objects": [ - { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "object_name": "233_url_object", - "object_id": 259 - } - ] - }, - { - "rule_id": 234, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "Payload escape", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "EscapeObject_234_1", - "object_id": 260, - "negate_option": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "html>\\\\r\\\\n", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 235, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "Payload escape", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "EscapeObject_235_1", - "object_id": 261, - "negate_option": 0, - "condition_index": 0, - "regions": [ - { - "table_name": "KEYWORDS_TABLE", - "table_type": "expr", - "table_content": { - "keywords": "\\(\\)abc\\^\\$def\\|", - "expr_type": "and" - } - } - ] - } - ] - }, - { - "rule_id": 236, - "service": 0, - "action": 0, - "do_blacklist": 0, - "do_log": 0, - "user_region": "StringScan.HexBinCombineString", - "is_valid": "yes", - "objects": [ - { - "attribute": "KEYWORDS_TABLE", - "object_name": "236_keywords_object", - "object_id": 262, - "regions": [ - { - "table_type": "expr", - "table_name": "KEYWORDS_TABLE", - "table_content": { - "keywords": "cd |6162|", - "expr_type": "and" - } - } - ] - } - ] - } - ], - "plugin_table": [ - { - "table_name": "QD_ENTRY_INFO", - "table_content": [ - "1\t192.168.0.1\t101\t1", - "2\t192.168.0.2\t102\t1", - "3\t192.168.1.1\t103\t1" - ] - }, - { - "table_name": "TEST_PLUGIN_TABLE", - "table_content": [ - "1\t3388\t99\t1", - "2\t3355\t66\t1", - "3\tcccc\t11\t1" - ] - }, - { - "table_name": "TEST_PLUGIN_EXDATA_TABLE", - "table_content": [ - "1\tHeBei\tShijiazhuang\t1\t0", - "2\tHeNan\tZhengzhou\t1\t0", - "3\tShanDong\tJinan\t1\t0", - "4\tShanXi\tTaiyuan\t1\t0" - ] - }, - { - "table_name": "TEST_EFFECTIVE_RANGE_TABLE", - "table_content": [ - "1\tSUCCESS\t99\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}\t1111", - "2\tSUCCESS\t66\t1\t0\t222", - "3\tFAILED\t11\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}\t333", - "4\tSUCCESS\t66\t1\t{}\t444", - "5\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京\"]}]]}\t444", - "6\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"weather\",\"value\":[\"hot\"]}]]}\t444" - ] - }, - { - "table_name": "IR_INTERCEPT_IP", - "table_content": [ - "1000000130\t1000000130\t4\t192.168.10.99\t255.255.255.255\t0\t65535\t0.0.0.0\t255.255.255.255\t0\t65535\t0\t1\t1\t96\t1\tuser_region\t{}\t2019/1/24/18:0:34", - "161\t161\t4\t0.0.0.0\t255.255.255.255\t0\t65535\t61.135.169.121\t255.255.255.255\t0\t65535\t0\t0\t1\t96\t832\t0\t0\t2019/1/24/18:48:42" - ] - }, - { - "table_name": "TEST_IP_PLUGIN_WITH_EXDATA", - "table_content": [ - "101\t4\t192.168.30.99-192.168.30.101\tSomething-like-json\t1", - "102\t4\t192.168.30.90-192.168.30.128\tBigger-range-should-in-the-back\t1", - "103\t6\t2001:db8:1234::-2001:db8:1235::\tBigger-range-should-in-the-back\t1", - "104\t6\t2001:db8:1234::1-2001:db8:1234::5210\tSomething-like-json\t1", - "105\t6\t2620:100:3000::-2620:0100:30ff:ffff:ffff:ffff:ffff:ffff\tBugreport-liumengyan-20210517\t1" - ] - }, - { - "table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA", - "table_content": [ - "101\t4\t192.168.100.1\t0\t255\t1", - "102\t4\t192.168.100.2\t100\t200\t1", - "103\t4\t192.168.100.1\t255\t300\t1", - "104\t6\t2001:db8:1234::5210\t255\t512\t1" - ] - }, - { - "table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA", - "table_content": [ - "201\twww.example1.com\tcatid=1\t1", - "202\t*.example1.com\tcatid=1\t1", - "203\tnews.example1.com\tcatid=2\t1", - "204\tr3---sn-i3belne6.example2.com\tcatid=3\t1", - "205\tr3---sn-i3belne6.example2.com\tcatid=3\t1" - ] - }, - { - "table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA", - "table_content": [ - "301\t1&2&1000\ttunnel1\t1", - "302\t101&102\ttunnel2\t1", - "303\t102\ttunnel3\t1", - "304\t101\ttunnel4\t1", - "305\t0&1&2&3&4&5&6&7\ttunnel5\t1", - "306\t101&101\tinvalid\t1" - ] - }, - { - "table_name": "TEST_PLUGIN_LONG_KEY_TYPE_TABLE", - "table_content": [ - "1\t11111111\tShijiazhuang\t1\t0", - "2\t22222222\tZhengzhou\t1\t0", - "3\t33333333\tJinan\t1\t0", - "4\t44444444\tTaiyuan\t1\t0" - ] - }, - { - "table_name": "TEST_PLUGIN_INT_KEY_TYPE_TABLE", - "table_content": [ - "1\t101\tChina\t1\t0", - "2\t102\tAmerica\t1\t0", - "3\t103\tRussia\t1\t0", - "4\t104\tJapan\t1\t0" - ] - }, - { - "table_name": "TEST_PLUGIN_IP_KEY_TYPE_TABLE", - "table_content": [ - "4\t100.64.1.1\tXiZang\t1\t0", - "4\t100.64.1.2\tXinJiang\t1\t0", - "6\t2001:da8:205:1::101\tGuiZhou\t1\t0", - "6\t1001:da8:205:1::101\tSiChuan\t1\t0", - "7\t100.64.1.3\tQingHai\t1\t0", - "6\t100.64.1.4\tGanSu\t1\t0" - ] - } - ] + "object_ids": [ + "504" + ], + "condition_index": 0 + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "negate_option": 1, + "condition_index": 1, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject216", + "object_id": "221", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-for-rule-211", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "217", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "NOTCondition&ExcludeObject", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL_FILTER", + "negate_option": 1, + "object_ids": [ + "509" + ], + "condition_index": 0 + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "negate_option": 0, + "condition_index": 1, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject217_2", + "object_id": "225", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-for-rule-217", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "218", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "CONTENT_SIZE", + "objects": [ + { + "object_name": "218_interval_object", + "object_id": "226", + "items": [ + { + "table_name": "CONTENT_SIZE", + "table_type": "interval", + "table_content": { + "interval": "3000" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "219", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_DUMMY", + "negate_option": 0, + "condition_index": 0, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_1", + "object_id": "227", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-1", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 1, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_2", + "object_id": "228", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-2", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 2, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_3", + "object_id": "229", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-3", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 3, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_4", + "object_id": "230", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-4", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 4, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_5", + "object_id": "231", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-5", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 5, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_6", + "object_id": "232", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-6", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 6, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_7", + "object_id": "233", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-7", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 7, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject219_8", + "object_id": "234", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-219-8", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "220", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_DUMMY", + "negate_option": 0, + "condition_index": 0, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject220_1", + "object_id": "235", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-220-1", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 1, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject220_2", + "object_id": "236", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-220-2", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_DUMMY", + "negate_option": 1, + "condition_index": 2, + "objects": [ + { + "object_name": "NOTConditionAndExcludeObject220_3", + "object_id": "237", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "keywords-dummy-220-3", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "221", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "NOTLogic.ScanWithDistrict", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_REQUEST_HEADER", + "negate_option": 1, + "objects": [ + { + "object_name": "NOTLogicObject_221_1", + "object_id": "238", + "items": [ + { + "table_name": "HTTP_SIGNATURE", + "table_type": "expr_plus", + "table_content": { + "district": "User-Agent", + "keywords": "Mozilla/5.0", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_URL", + "negate_option": 0, + "objects": [ + { + "object_name": "NOTLogicObject_221_2", + "object_id": "239", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "scan_with_district_221", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "222", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "NOTLogic.SingleNotCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_NOT_LOGIC_1", + "negate_option": 1, + "condition_index": 0, + "objects": [ + { + "object_name": "NOTLogicObject_222", + "object_id": "240", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "not_logic_keywords_222", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "223", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "NOTLogic.MultiNotCondition", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_NOT_LOGIC", + "negate_option": 1, + "condition_index": 0, + "objects": [ + { + "object_name": "NOTLogicObject_223_1", + "object_id": "241", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "not_logic_rule_223_1", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_NOT_LOGIC", + "negate_option": 1, + "condition_index": 1, + "objects": [ + { + "object_name": "NOTLogicObject_223_2", + "object_id": "242", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "not_logic_rule_223_2", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_NOT_LOGIC", + "negate_option": 1, + "condition_index": 2, + "objects": [ + { + "object_name": "NOTLogicObject_223_1", + "object_id": "243", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "not_logic_rule_223_3", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "224", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "NOTLogic.NotPhysicalTable", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "negate_option": 1, + "condition_index": 0, + "objects": [ + { + "object_name": "NOTLogicObject_224_1", + "object_id": "244", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "not_logic_rule_224_1", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "negate_option": 0, + "condition_index": 1, + "objects": [ + { + "object_name": "NOTLogicObject_224_2", + "object_id": "245", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "not_logic_rule_224_2", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "225", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "Payload escape", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "negate_option": 0, + "condition_index": 0, + "objects": [ + { + "object_name": "EscapeObject_225_1", + "object_id": "246", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "GET / HTTP/1.1\\r\\nHost: www.baidu.com\\r\\n\\r\\n", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "226", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "maat_scan_object", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "object_name": "226_url_object", + "object_ids": [ + "247" + ] + } + ] + }, + { + "rule_id": "227", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "maat_scan_object", + "rule_table_name": "RULE_FIREWALL_DEFAULT", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "object_name": "227_url_object", + "object_ids": [ + "248" + ] + } + ] + }, + { + "rule_id": "228", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "NotConditionHitPath", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "negate_option": 0, + "condition_index": 1, + "objects": [ + { + "object_name": "228_url_object", + "object_id": "249", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "youtube.com", + "expr_type": "and" + } + } + ] + } + ] + }, + { + "attribute": "ATTRIBUTE_IP_CONFIG", + "negate_option": 1, + "condition_index": 2, + "objects": [ + { + "object_name": "228_IP_object", + "object_id": "250", + "items": [ + { + "table_name": "IP_CONFIG", + "table_type": "ip", + "table_content": { + "ip": "192.168.101.102/32" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "229", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "StringScan.Regex", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_URL", + "objects": [ + { + "object_name": "229_url_object", + "object_id": "251", + "items": [ + { + "table_name": "HTTP_URL", + "table_type": "expr", + "table_content": { + "keywords": "É", + "expr_type": "regex" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "230", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "ipv6_::", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "objects": [ + { + "object_name": "230_IP_object", + "object_id": "256", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "2607:5d00:2:2::32:28/128", + "port": "80-443" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "231", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "should_not_hit", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "objects": [ + { + "object_name": "231_IP_object", + "object_id": "257", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "2607:5d00:2:2::32:28/128", + "port": "80" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "232", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "should_not_hit", + "is_valid": "yes", + "conditions": [ + { + "attribute": "IP_PLUS_CONFIG", + "objects": [ + { + "object_name": "232_IP_object", + "object_id": "258", + "items": [ + { + "table_type": "ip", + "table_name": "IP_PLUS_CONFIG", + "table_content": { + "ip": "192.168.30.44/32", + "port": "80" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "233", + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "maat_scan_object", + "is_valid": "yes", + "conditions": [ + { + "attribute": "HTTP_RESPONSE_KEYWORDS", + "object_name": "233_url_object", + "object_id": [ + "259" + ] + } + ] + }, + { + "rule_id": "234", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "Payload escape", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "negate_option": 0, + "condition_index": 0, + "objects": [ + { + "object_name": "EscapeObject_234_1", + "object_id": "260", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "html>\\\\r\\\\n", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "235", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "Payload escape", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "negate_option": 0, + "condition_index": 0, + "objects": [ + { + "object_name": "EscapeObject_235_1", + "object_id": "261", + "items": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "expr", + "table_content": { + "keywords": "\\(\\)abc\\^\\$def\\|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + }, + { + "rule_id": "236", + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "user_region": "StringScan.HexBinCombineString", + "is_valid": "yes", + "conditions": [ + { + "attribute": "KEYWORDS_TABLE", + "objects": [ + { + "object_name": "236_keywords_object", + "object_id": "262", + "items": [ + { + "table_type": "expr", + "table_name": "KEYWORDS_TABLE", + "table_content": { + "keywords": "cd |6162|", + "expr_type": "and" + } + } + ] + } + ] + } + ] + } + ], + "plugin_table": [ + { + "table_name": "QD_ENTRY_INFO", + "table_content": [ + "1\t192.168.0.1\t101\t1", + "2\t192.168.0.2\t102\t1", + "3\t192.168.1.1\t103\t1" + ] + }, + { + "table_name": "TEST_PLUGIN_TABLE", + "table_content": [ + "1\t3388\t99\t1", + "2\t3355\t66\t1", + "3\tcccc\t11\t1" + ] + }, + { + "table_name": "TEST_PLUGIN_EXDATA_TABLE", + "table_content": [ + "1\tHeBei\tShijiazhuang\t1\t0", + "2\tHeNan\tZhengzhou\t1\t0", + "3\tShanDong\tJinan\t1\t0", + "4\tShanXi\tTaiyuan\t1\t0" + ] + }, + { + "table_name": "TEST_EFFECTIVE_RANGE_TABLE", + "table_content": [ + "1\tSUCCESS\t99\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}\t1111", + "2\tSUCCESS\t66\t1\t0\t222", + "3\tFAILED\t11\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}\t333", + "4\tSUCCESS\t66\t1\t{}\t444", + "5\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京\"]}]]}\t444", + "6\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"weather\",\"value\":[\"hot\"]}]]}\t444" + ] + }, + { + "table_name": "IR_INTERCEPT_IP", + "table_content": [ + "1000000130\t1000000130\t4\t192.168.10.99\t255.255.255.255\t0\t65535\t0.0.0.0\t255.255.255.255\t0\t65535\t0\t1\t1\t96\t1\tuser_region\t{}\t2019/1/24/18:0:34", + "161\t161\t4\t0.0.0.0\t255.255.255.255\t0\t65535\t61.135.169.121\t255.255.255.255\t0\t65535\t0\t0\t1\t96\t832\t0\t0\t2019/1/24/18:48:42" + ] + }, + { + "table_name": "TEST_IP_PLUGIN_WITH_EXDATA", + "table_content": [ + "101\t4\t192.168.30.99-192.168.30.101\tSomething-like-json\t1", + "102\t4\t192.168.30.90-192.168.30.128\tBigger-range-should-in-the-back\t1", + "103\t6\t2001:db8:1234::-2001:db8:1235::\tBigger-range-should-in-the-back\t1", + "104\t6\t2001:db8:1234::1-2001:db8:1234::5210\tSomething-like-json\t1", + "105\t6\t2620:100:3000::-2620:0100:30ff:ffff:ffff:ffff:ffff:ffff\tBugreport-liumengyan-20210517\t1" + ] + }, + { + "table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA", + "table_content": [ + "101\t4\t192.168.100.1\t0\t255\t1", + "102\t4\t192.168.100.2\t100\t200\t1", + "103\t4\t192.168.100.1\t255\t300\t1", + "104\t6\t2001:db8:1234::5210\t255\t512\t1" + ] + }, + { + "table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA", + "table_content": [ + "201\twww.example1.com\tcatid=1\t1", + "202\t*.example1.com\tcatid=1\t1", + "203\tnews.example1.com\tcatid=2\t1", + "204\tr3---sn-i3belne6.example2.com\tcatid=3\t1", + "205\tr3---sn-i3belne6.example2.com\tcatid=3\t1" + ] + }, + { + "table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA", + "table_content": [ + "301\t1&2&1000\ttunnel1\t1", + "302\t101&102\ttunnel2\t1", + "303\t102\ttunnel3\t1", + "304\t101\ttunnel4\t1", + "305\t0&1&2&3&4&5&6&7\ttunnel5\t1", + "306\t101&101\tinvalid\t1" + ] + }, + { + "table_name": "TEST_PLUGIN_LONG_KEY_TYPE_TABLE", + "table_content": [ + "1\t11111111\tShijiazhuang\t1\t0", + "2\t22222222\tZhengzhou\t1\t0", + "3\t33333333\tJinan\t1\t0", + "4\t44444444\tTaiyuan\t1\t0" + ] + }, + { + "table_name": "TEST_PLUGIN_INT_KEY_TYPE_TABLE", + "table_content": [ + "1\t101\tChina\t1\t0", + "2\t102\tAmerica\t1\t0", + "3\t103\tRussia\t1\t0", + "4\t104\tJapan\t1\t0" + ] + }, + { + "table_name": "TEST_PLUGIN_IP_KEY_TYPE_TABLE", + "table_content": [ + "4\t100.64.1.1\tXiZang\t1\t0", + "4\t100.64.1.2\tXinJiang\t1\t0", + "6\t2001:da8:205:1::101\tGuiZhou\t1\t0", + "6\t1001:da8:205:1::101\tSiChuan\t1\t0", + "7\t100.64.1.3\tQingHai\t1\t0", + "6\t100.64.1.4\tGanSu\t1\t0" + ] + } + ] } \ No newline at end of file diff --git a/test/table_info.json b/test/table_info.json index 5a6ad84..0c6d15b 100644 --- a/test/table_info.json +++ b/test/table_info.json @@ -2,25 +2,13 @@ { "table_id":0, "table_name":"RULE_DEFAULT", - "table_type":"rule", - "valid_column":9, - "custom": { - "rule_id":1, - "tags":6, - "condition_num":8 - } + "table_type":"rule" }, { "table_id":1, "table_name":"RULE_ALIAS", "table_type":"rule", - "valid_column":9, - "schema_tag": "{\"rule_alias\": \"rule\"}", - "custom": { - "rule_id":1, - "tags":6, - "condition_num":8 - } + "schema_tag": "{\"rule_alias\": \"rule\"}" }, { "table_id":2, @@ -28,90 +16,35 @@ "db_tables":["RULE_DEFAULT", "RULE_ALIAS"], "default_rule_table":2, "table_type":"rule", - "valid_column":9, - "schema_tag": "{\"rule_conjunction\": \"rule\"}", - "custom": { - "rule_id":1, - "tags":6, - "condition_num":8 - } - }, - { - "table_id":3, - "table_name":"OBJECT2RULE", - "db_tables":["OBJECT2RULE_DEFAULT", "OBJECT2RULE_ALIAS"], - "table_type":"object2rule", - "associated_rule_table_id":2, - "valid_column":6, - "schema_tag": "{\"object2rule\": \"object2rule\"}", - "custom": { - "object_id":1, - "rule_id":2, - "negate_option":3, - "attribute_name":4, - "condition_index":5 - } + "schema_tag": "{\"rule_conjunction\": \"rule\"}" }, { "table_id":4, "table_name":"RULE_FIREWALL_DEFAULT", - "table_type":"rule", - "valid_column":9, - "custom": { - "rule_id":1, - "tags":6, - "condition_num":8 - } + "table_type":"rule" }, { "table_id":5, "table_name":"RULE_FIREWALL_CONJUNCTION", "db_tables":["RULE_FIREWALL_DEFAULT"], - "table_type":"rule", - "valid_column":9, - "custom": { - "rule_id":1, - "tags":6, - "condition_num":8 - } - }, - { - "table_id":6, - "table_name":"OBJECT2RULE_FIREWALL", - "table_type":"object2rule", - "associated_rule_table_id":5, - "valid_column":6, - "custom": { - "object_id":1, - "rule_id":2, - "negate_option":3, - "attribute_name":4, - "condition_index":5 - } + "table_type":"rule" }, { "table_id":7, "table_name":"OBJECT2OBJECT", - "table_type":"object2object", - "valid_column":4, - "custom": { - "object_id":1, - "included_sub_object_ids":2, - "excluded_sub_object_ids":3 - } + "table_type":"object2object" }, { "table_id":8, "table_name":"RULE_PLUGIN", "db_tables":["RULE_DEFAULT", "RULE_ALIAS"], "table_type":"plugin", - "valid_column":8, "schema_tag": "{\"rule_plugin\": \"plugin\"}", "custom": { "gc_timeout_s":3, "key_type":"integer", "key_len":8, - "key":1 + "key_name": "rule_id" } }, { @@ -119,12 +52,11 @@ "table_name":"RULE_FIREWALL_PLUGIN", "db_tables":["RULE_FIREWALL_DEFAULT"], "table_type":"plugin", - "valid_column":8, "custom": { "gc_timeout_s":3, "key_type":"integer", "key_len":8, - "key":1 + "key_name":"TODO" } }, { @@ -133,555 +65,260 @@ "db_tables":["HTTP_URL", "HTTP_HOST"], "table_type":"expr", "expr_engine":"rulescan", - "valid_column":5, - "schema_tag": "{\"http_region\": \"expr\"}", - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "supported_attributes":["HTTP_URL", "HTTP_URL_FILTER"], + "schema_tag": "{\"http_region\": \"expr\"}" }, { "table_id":11, "table_name":"KEYWORDS_TABLE", "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "supported_attributes":[ + "HTTP_RESPONSE_KEYWORDS", + "HTTP_RESPONSE_KEYWORDS_1", + "HTTP_RESPONSE_KEYWORDS_2", + "HTTP_RESPONSE_KEYWORDS_3", + "HTTP_RESPONSE_KEYWORDS_4", + "HTTP_RESPONSE_KEYWORDS_5", + "HTTP_RESPONSE_KEYWORDS_6", + "HTTP_RESPONSE_KEYWORDS_7", + "HTTP_RESPONSE_KEYWORDS_8", + "HTTP_DUMMY", + "HTTP_NOT_LOGIC", + "HTTP_NOT_LOGIC_1"], + "schema_tag": "{\"http_response_keywords\": \"attribute\"}" }, { "table_id":12, "table_name":"IP_CONFIG", "table_type":"ip", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "ip":3, - "port":4 - } + "supported_attributes": ["ATTRIBUTE_IP_CONFIG"] }, { "table_id":13, "table_name":"CONTENT_SIZE", - "table_type":"interval", - "valid_column":4, - "custom": { - "item_id":1, - "object_id":2, - "interval":3 - } + "table_type":"interval" }, { "table_id":14, "table_name":"QD_ENTRY_INFO", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"integer", "key_len":8, - "key":1 + "key_name":"TODO" } }, { "table_id":15, "table_name":"HTTP_SIGNATURE", "table_type":"expr_plus", - "valid_column":6, - "custom": { - "item_id":1, - "object_id":2, - "district":3, - "expr_type":4, - "keywords":5 - } + "supported_attributes":["HTTP_REQUEST_HEADER", "HTTP_RESPONSE_HEADER"] }, { "table_id":16, "table_name":"IMAGE_FP", - "table_type":"expr", - "valid_column":5, - "supported_attributes":["HTTP_URL", "HTTP_REQ_BODY"], - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "table_type":"expr" }, { "table_id":17, "table_name":"TEST_EFFECTIVE_RANGE_TABLE", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"integer", "key_len":8, - "key":1, - "tag":5 + "key_name":"TODO" } }, { "table_id":18, "table_name":"TEST_FOREIGN_KEY", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"pointer", - "key":2, - "tag":3, - "foreign": [6,8] + "key_name":"TODO", + "foreign_names": ["TODO", "TODO"] } }, { "table_id":19, "table_name":"TEST_PLUGIN_EXDATA_TABLE", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"pointer", - "key":2, - "tag":5 + "key_name":"TODO" } }, { "table_id":20, "table_name":"IR_INTERCEPT_IP", "table_type":"plugin", - "valid_column":14, "custom": { "gc_timeout_s":3, "key_type":"pointer", - "key":2, - "tag":18 + "key_name":"TODO" } }, { "table_id":21, "table_name":"APP_PAYLOAD", - "table_type":"expr_plus", - "valid_column":6, - "custom": { - "item_id":1, - "object_id":2, - "district":3, - "expr_type":4, - "keywords":5 - } + "table_type":"expr_plus" }, { "table_id":22, "table_name":"TROJAN_PAYLOAD", - "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "table_type":"expr" }, { "table_id":23, "table_name":"MAIL_ADDR", - "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "table_type":"expr" }, { "table_id":24, "table_name":"IP_PLUS_CONFIG", "table_type":"ip", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "ip":3, - "port":4 - } - }, - { - "table_id":25, - "table_name":"HTTP_RESPONSE_KEYWORDS", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE", - "schema_tag": "{\"http_response_keywords\": \"attribute\"}" - }, - { - "table_id":26, - "table_name":"HTTP_REQUEST_HEADER", - "table_type":"attribute", - "physical_table": "HTTP_SIGNATURE" - }, - { - "table_id":27, - "table_name":"HTTP_RESPONSE_HEADER", - "table_type":"attribute", - "physical_table": "HTTP_SIGNATURE" - }, - { - "table_id":28, - "table_name":"ATTRIBUTE_IP_PLUS_TABLE", - "db_tables":["ATTRIBUTE_IP_PLUS_SOURCE", "ATTRIBUTE_IP_PLUS_DESTINATION"], - "table_type":"attribute", - "physical_table": "IP_PLUS_CONFIG", + "supported_attributes":["ATTRIBUTE_IP_PLUS_TABLE", "ATTRIBUTE_IP_PLUS_SOURCE", "ATTRIBUTE_IP_PLUS_DESTINATION"], "schema_tag": "{\"attribute_ip_plus_table\": \"attribute\"}" }, { "table_id":29, "table_name":"TEST_IP_PLUGIN_WITH_EXDATA", "table_type":"ip_plugin", - "valid_column":5, "custom": { "gc_timeout_s": 3, - "item_id":1, - "ip":3 + "key_name":"TODO" } }, { "table_id":30, "table_name":"AS_NUMBER", "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } - }, - { - "table_id":31, - "table_name":"SOURCE_IP_ASN", - "table_type":"attribute", - "physical_table":"AS_NUMBER" - }, - { - "table_id":32, - "table_name":"DESTINATION_IP_ASN", - "table_type":"attribute", - "physical_table":"AS_NUMBER" + "supported_attributes":["SOURCE_IP_ASN", "DESTINATION_IP_ASN", "ASN_NOT_LOGIC"] }, { "table_id":33, "table_name":"GeoLocation", "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } - }, - { - "table_id":34, - "table_name":"SOURCE_IP_GEO", - "table_type":"attribute", - "physical_table":"GeoLocation" + "supported_attributes":["SOURCE_IP_GEO"] }, { "table_id":35, "table_name":"INTERGER_PLUS", - "table_type":"interval_plus", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "district":3, - "interval":4 - } + "table_type":"interval_plus" }, { "table_id":36, "table_name":"TEST_FQDN_PLUGIN_WITH_EXDATA", "table_type":"fqdn_plugin", - "valid_column":4, "custom": { "gc_timeout_s": 3, - "item_id":1, - "fqdn":2 + "key_name":"TODO" } }, { "table_id":37, "table_name":"APP_ID", - "table_type":"interval", - "valid_column":4, - "custom": { - "item_id":1, - "object_id":2, - "interval":3 - } + "table_type":"interval" }, { "table_id":38, "table_name":"EMPTY_KEYWORD", - "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "table_type":"expr" }, { "table_id":39, "table_name":"EMPTY_INTERGER", - "table_type":"interval", - "valid_column":4, - "custom": { - "item_id":1, - "object_id":2, - "interval":3 - } + "table_type":"interval" }, { "table_id":40, "table_name":"TEST_BOOL_PLUGIN_WITH_EXDATA", "table_type":"bool_plugin", - "valid_column":4, "custom": { "gc_timeout_s": 3, - "item_id":1, - "bool_expr":2 + "key_name":"TODO" } }, { "table_id":41, "table_name":"FLAG_CONFIG", - "table_type":"flag", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "flag":3, - "flag_mask":4 - } + "table_type":"flag" }, { "table_id":42, "table_name":"FLAG_PLUS_CONFIG", - "table_type":"flag_plus", - "valid_column":6, - "custom": { - "item_id":1, - "object_id":2, - "district":3, - "flag":4, - "flag_mask":5 - } + "table_type":"flag_plus" }, { "table_id":43, "table_name":"TEST_PLUGIN_LONG_KEY_TYPE_TABLE", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"integer", "key_len":8, - "key":2, - "tag":5 + "key_name":"TODO" } }, { "table_id":44, "table_name":"TEST_PLUGIN_INT_KEY_TYPE_TABLE", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"integer", "key_len":4, - "key":2, - "tag":5 + "key_name":"TODO" } }, { "table_id":45, "table_name":"TEST_PLUGIN_IP_KEY_TYPE_TABLE", "table_type":"plugin", - "valid_column":4, "custom": { "gc_timeout_s":3, "key_type":"ip_addr", - "addr_type":1, - "key":2 + "key_name":"TODO" } }, - { - "table_id":46, - "table_name":"HTTP_URL_FILTER", - "table_type":"attribute", - "physical_table": "HTTP_URL" - }, { "table_id":47, "table_name":"IP_PERF_CONFIG", - "table_type":"ip", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "ip":3, - "port":4 - } + "table_type":"ip" }, { "table_id":48, "table_name":"INTEGER_PERF_CONFIG", - "table_type":"interval", - "valid_column":4, - "custom": { - "item_id":1, - "object_id":2, - "interval":3 - } + "table_type":"interval" }, { "table_id":49, "table_name":"EXPR_LITERAL_PERF_CONFIG", - "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "table_type":"expr" }, { "table_id":50, "table_name":"EXPR_REGEX_PERF_CONFIG", - "table_type":"expr", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "expr_type":3, - "keywords":4 - } + "table_type":"expr" }, { "table_id":51, "table_name":"FLAG_PERF_CONFIG", - "table_type":"flag", - "valid_column":5, - "custom": { - "item_id":1, - "object_id":2, - "flag":3, - "flag_mask":4 - } + "table_type":"flag" }, { "table_id":52, "table_name":"TEST_IPPORT_PLUGIN_WITH_EXDATA", "table_type":"ipport_plugin", - "valid_column":6, "custom": { "gc_timeout_s": 3, - "item_id":1, - "ip_type":2, - "ip_addr":3, - "port1":4, - "port2":5 + "key_name":"TODO" } }, - { - "table_id":53, - "table_name":"ATTRIBUTE_IP_CONFIG", - "table_type":"attribute", - "physical_table": "IP_CONFIG" - }, - { - "table_id":54, - "table_name":"HTTP_RESPONSE_KEYWORDS_1", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":55, - "table_name":"HTTP_RESPONSE_KEYWORDS_2", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":56, - "table_name":"HTTP_RESPONSE_KEYWORDS_3", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":57, - "table_name":"HTTP_RESPONSE_KEYWORDS_4", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":58, - "table_name":"HTTP_RESPONSE_KEYWORDS_5", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":59, - "table_name":"HTTP_RESPONSE_KEYWORDS_6", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":60, - "table_name":"HTTP_RESPONSE_KEYWORDS_7", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":61, - "table_name":"HTTP_RESPONSE_KEYWORDS_8", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":62, - "table_name":"HTTP_DUMMY", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":63, - "table_name":"HTTP_NOT_LOGIC", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":64, - "table_name":"HTTP_NOT_LOGIC_1", - "table_type":"attribute", - "physical_table": "KEYWORDS_TABLE" - }, - { - "table_id":65, - "table_name":"ASN_NOT_LOGIC", - "table_type":"attribute", - "physical_table":"AS_NUMBER" - }, { "table_id":66, "table_name":"TEST_IP_PLUGIN_WITH_ADDR_FORMAT", @@ -689,8 +326,7 @@ "valid_column":5, "custom": { "gc_timeout_s": 3, - "item_id":1, - "ip":3 + "key_name":"TODO" } } ] \ No newline at end of file diff --git a/test/test_utils.cpp b/test/test_utils.cpp index 1cfbfd7..4ba704c 100644 --- a/test/test_utils.cpp +++ b/test/test_utils.cpp @@ -68,7 +68,7 @@ int write_json_to_redis(const char *json_filename, char *redis_ip, int redis_por return -1; } - convert_maat_json_rule(json_root, (unsigned char *)json_buff); + convert_maat_json_rule(&json_root, (unsigned char *)json_buff); redisContext *c = maat_connect_redis(redis_ip, redis_port, redis_db, logger); if (NULL == c) {