gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1、修复bug：virtual table扫描时，未能正确识别上一次命中的compile的bug，导致compile多次返回。2、修复bug：在进行virtual table+ Expr plus的扫描时，由于笔误，错误的认为table id不合法

Browse Source
This commit is contained in:
zhengchao
2019-11-21 18:48:22 +08:00
parent fb9f5587ef
commit 2f10504d64
5 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/entry/Maat_api.cpp
View File

@@ -103,7 +103,7 @@ size_t pickup_hit_region_from_compile(struct bool_expr *compile_hit,
group_id=(unsigned long long)dynamic_array_read(hitted_id, i); group_id=(unsigned long long)dynamic_array_read(hitted_id, i);
for(j=0; j<compile_hit->item_num; j++) for(j=0; j<compile_hit->item_num; j++)
{ {
if(group_id==(compile_hit->items[j].item_id&0x00000000ffffffff)) if(group_id==compile_hit->items[j].item_id)
{ {
region_pos[k]=i; region_pos[k]=i;
k++; k++;
@@ -198,13 +198,13 @@ int region_compile(_Maat_feather_t*feather, struct _INNER_scan_status_t *_mid, c
{ {
if(_mid->cur_hit_group_cnt<MAX_SCANNER_HIT_NUM) if(_mid->cur_hit_group_cnt<MAX_SCANNER_HIT_NUM)
{ {
dynamic_array_write(_mid->cur_hit_groups, _mid->cur_hit_group_cnt, (void*)group_rule->top_groups[j]); dynamic_array_write(_mid->cur_hit_groups, _mid->cur_hit_group_cnt, (void*)TO_RELATION_ID(region_hit_wraper->virtual_table_id,group_rule->top_groups[j]));
_mid->cur_hit_group_cnt++; _mid->cur_hit_group_cnt++;
} }
ret=insert_set_id(&(_mid->all_hit_group_array), ret=insert_set_id(&(_mid->all_hit_group_array),
&(_mid->all_hit_group_array_sz), &(_mid->all_hit_group_array_sz),
_mid->all_hit_group_cnt, _mid->all_hit_group_cnt,
(unsigned long long)region_hit_wraper->virtual_table_id<<32|group_rule->top_groups[j]); TO_RELATION_ID(region_hit_wraper->virtual_table_id, group_rule->top_groups[j]));
_mid->all_hit_group_cnt+=ret; _mid->all_hit_group_cnt+=ret;
} }
} }

2
src/entry/Maat_rule.cpp
View File

@@ -33,7 +33,7 @@
#include "stream_fuzzy_hash.h" #include "stream_fuzzy_hash.h"
#include "gram_index_engine.h" #include "gram_index_engine.h"
int MAAT_FRAME_VERSION_2_8_20190919=1; int MAAT_FRAME_VERSION_2_8_20191121=1;
int is_valid_table_name(const char* str) int is_valid_table_name(const char* str)
{ {

4
src/entry/Maat_table.cpp
View File

@@ -551,8 +551,8 @@ struct Maat_table_desc * Maat_table_get_by_id(struct Maat_table_manager* table_m
} }
if(p_real_table->table_type!=expect_type) if(p_real_table->table_type!=expect_type)
{ {
if((expect_type==TABLE_TYPE_EXPR && p_table->table_type!=TABLE_TYPE_EXPR_PLUS)|| if((expect_type==TABLE_TYPE_EXPR && p_real_table->table_type!=TABLE_TYPE_EXPR_PLUS)||
(expect_type==TABLE_TYPE_IP && p_table->table_type!=TABLE_TYPE_IP_PLUS)) (expect_type==TABLE_TYPE_IP && p_real_table->table_type!=TABLE_TYPE_IP_PLUS))
{ {
return NULL; return NULL;
} }

2
src/inc_internal/Maat_utils.h
View File

@@ -46,7 +46,7 @@
#define UNUSED __attribute__((unused)) #define UNUSED __attribute__((unused))
const char* module_name_str(const char*name); const char* module_name_str(const char*name);
#define maat_module (module_name_str("MAAT_Frame")) #define maat_module (module_name_str("MAAT_Frame"))
#define TO_RELATION_ID(vid, gid) ((unsigned long long)vid<<32|gid)
char* _maat_strdup(const char* s); char* _maat_strdup(const char* s);
char* str_unescape(char* s); char* str_unescape(char* s);
inline void ipv6_ntoh(unsigned int *v6_addr) inline void ipv6_ntoh(unsigned int *v6_addr)

2
test/test_maatframe.cpp
View File

@@ -1491,7 +1491,7 @@ TEST(VirtualTable, Test1)
EXPECT_EQ(ret, 1); EXPECT_EQ(ret, 1);
EXPECT_EQ(result[0].config_id, 160); EXPECT_EQ(result[0].config_id, 160);
Maat_clean_status(&mid);
const char* should_not_hit="2018-10-05 is a keywords of table KEYWORDS_TABLE. Should not hit."; const char* should_not_hit="2018-10-05 is a keywords of table KEYWORDS_TABLE. Should not hit.";
mid=NULL; mid=NULL;