diff --git a/test/maat_json.json b/test/maat_json.json index 036947a..c6b24c3 100644 --- a/test/maat_json.json +++ b/test/maat_json.json @@ -2156,6 +2156,21 @@ } ], "not_flag" : 0 + }, + { + "regions": [ + { + "table_name": "KEYWORDS_TABLE", + "table_type": "string", + "table_content": { + "keywords": "contains-keywords-MUST-hit-by-rule-186", + "expr_type": "and", + "match_method": "expr", + "format": "uncase plain" + } + } + ], + "not_flag" : 0 } ] } diff --git a/test/test_maatframe.cpp b/test/test_maatframe.cpp index da3449d..d1173eb 100644 --- a/test/test_maatframe.cpp +++ b/test/test_maatframe.cpp @@ -1117,11 +1117,12 @@ TEST(NOTLogic, ScanIrrelavantAtLast) TEST(NOTLogic, ScanHitAtLast) { const char* string_should_not_hit="This string should not hit."; + const char* string_should_hit="This string contains-keywords-MUST-hit-by-rule-186."; int ret=0; int table_id=0; struct Maat_rule_t result[4]; int found_pos[4]; - const char* not_hit_table_name="HTTP_URL", *hit_table_name="IP_PLUS_CONFIG"; + const char* not_hit_table_name="HTTP_URL", *hit_table_name1="IP_PLUS_CONFIG", *hit_table_name2="KEYWORDS_TABLE"; scan_status_t mid=NULL; table_id=Maat_table_register(g_feather, not_hit_table_name); ASSERT_GT(table_id, 0); @@ -1139,14 +1140,22 @@ TEST(NOTLogic, ScanHitAtLast) v4_addr.dest=htons(80); ipv4_addr.v4=&v4_addr; - table_id=Maat_table_register(g_feather, hit_table_name); + table_id=Maat_table_register(g_feather, hit_table_name1); ASSERT_GT(table_id, 0); - Maat_set_scan_status(g_feather, &mid, MAAT_SET_SCAN_LAST_REGION, NULL, 0); ret=Maat_scan_proto_addr(g_feather, table_id, &ipv4_addr, 6, result, 4, &mid,0); - EXPECT_EQ(ret, 1); + EXPECT_EQ(ret, -2); + + table_id=Maat_table_register(g_feather, hit_table_name2); + ASSERT_GT(table_id, 0); + + Maat_set_scan_status(g_feather, &mid, MAAT_SET_SCAN_LAST_REGION, NULL, 0); + + ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, string_should_hit, strlen(string_should_hit), + result, found_pos, 4, &mid, 0); + EXPECT_EQ(result[0].config_id, 186); Maat_clean_status(&mid);