cpp->c and expr support configurable generation of literal_db or regex_db

src/CMakeLists.txt

@@ -7,12 +7,13 @@ set(MAAT_FRAME_VERSION ${MAAT_FRAME_MAJOR_VERSION}.${MAAT_FRAME_MINOR_VERSION}.$
 
 message(STATUS "Maat Frame, Version: ${MAAT_FRAME_VERSION}")
 
+add_definitions(-D_GNU_SOURCE) 
 add_definitions(-fPIC)
-set(MAAT_SRC json2iris.cpp maat_api.cpp rcu_hash.cpp maat_garbage_collection.cpp maat_config_monitor.cpp 
-    maat_rule.cpp maat_kv.cpp maat_ex_data.cpp maat_utils.cpp maat_command.cpp maat_redis_monitor.cpp 
-    maat_table.cpp maat_compile.cpp maat_group.cpp maat_ip.cpp maat_flag.cpp maat_interval.cpp
-    maat_expr.cpp maat_plugin.cpp maat_ip_plugin.cpp maat_bool_plugin.cpp maat_fqdn_plugin.cpp 
-    maat_virtual.cpp)
+set(MAAT_SRC alignment.c json2iris.c maat_api.c rcu_hash.c maat_garbage_collection.c maat_config_monitor.c 
+    maat_rule.c maat_kv.c maat_ex_data.c maat_utils.c maat_command.c maat_redis_monitor.c 
+    maat_table.c maat_compile.c maat_group.c maat_ip.c maat_flag.c maat_interval.c
+    maat_expr.c maat_fqdn.c maat_port_proto.c maat_plugin.c maat_ip_plugin.c maat_bool_plugin.c 
+    maat_fqdn_plugin.c maat_virtual.c)
 
 set(LIB_SOURCE_FILES
 	${PROJECT_SOURCE_DIR}/deps/cJSON/cJSON.c ${PROJECT_SOURCE_DIR}/deps/log/log.c)
@@ -28,18 +29,31 @@ set_target_properties(maat_frame_static PROPERTIES LINKER_LANGUAGE CXX)
 set_target_properties(maat_frame_static PROPERTIES OUTPUT_NAME maatframe)
 set_target_properties(maat_frame_static PROPERTIES CLEAN_DIRECT_OUTPUT 1)
 
-target_link_libraries(maat_frame_static adapter-static hiredis-static igraph-static flagmatcher-static intervalmatcher-static pthread crypto z)
+target_link_libraries(maat_frame_static hiredis-static ${MAAT_DEPEND_DYN_LIB})
+target_link_libraries(maat_frame_static igraph-static)
+target_link_libraries(maat_frame_static ipmatcher-static)
+target_link_libraries(maat_frame_static adapter-static)
+target_link_libraries(maat_frame_static flagmatcher-static)
+target_link_libraries(maat_frame_static intervalmatcher-static)
 
 # Shared Library Output
-#add_library(maat_frame_shared SHARED ${MAAT_SRC} ${LIB_SOURCE_FILES})
-#set_target_properties(maat_frame_shared PROPERTIES LINKER_LANGUAGE CXX)
-#set_target_properties(maat_frame_shared PROPERTIES OUTPUT_NAME maatframe)
-#set_target_properties(maat_frame_shared PROPERTIES CLEAN_DIRECT_OUTPUT 1)
-#set_target_properties(maat_frame_shared PROPERTIES VERSION ${MAAT_FRAME_MAJOR_VERSION}.${MAAT_FRAME_MINOR_VERSION})
-#set_target_properties(maat_frame_shared PROPERTIES SOVERSION ${MAAT_FRAME_MAJOR_VERSION})
+add_library(maat_frame_shared SHARED ${MAAT_SRC} ${LIB_SOURCE_FILES})
+set_target_properties(maat_frame_shared PROPERTIES LINKER_LANGUAGE CXX)
+set_target_properties(maat_frame_shared PROPERTIES OUTPUT_NAME maatframe)
+set_target_properties(maat_frame_shared PROPERTIES CLEAN_DIRECT_OUTPUT 1)
+set_target_properties(maat_frame_shared PROPERTIES VERSION ${MAAT_FRAME_MAJOR_VERSION}.${MAAT_FRAME_MINOR_VERSION})
+set_target_properties(maat_frame_shared PROPERTIES SOVERSION ${MAAT_FRAME_MAJOR_VERSION})
+set_target_properties(maat_frame_shared PROPERTIES LINK_FLAGS "-Wl,--version-script=${CMAKE_CURRENT_LIST_DIR}/version.map")
 
-#target_link_libraries(maat_frame_shared hyperscan_static)
+target_link_libraries(maat_frame_shared hiredis-static ${MAAT_DEPEND_DYN_LIB})
+target_link_libraries(maat_frame_shared igraph-static ${MAAT_DEPEND_DYN_LIB})
+target_link_libraries(maat_frame_shared ipmatcher-static)
+target_link_libraries(maat_frame_shared adapter-static)
+target_link_libraries(maat_frame_shared flagmatcher-static)
+target_link_libraries(maat_frame_shared intervalmatcher-static)
 
 # install
 set(CMAKE_INSTALL_PREFIX /opt/MESA/)
-#install(FILES ${PROJECT_SOURCE_DIR}/include/maat DESTINATION ${CMAKE_INSTALL_PREFIX}/include/MESA/ COMPONENT HEADER)
+install(FILES ${PROJECT_SOURCE_DIR}/include/maat.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/MESA/ COMPONENT HEADER)
+install(FILES ${PROJECT_SOURCE_DIR}/include/bool_matcher.h DESTINATION ${CMAKE_INSTALL_PREFIX}/include/MESA/ COMPONENT HEADER)
+install(TARGETS maat_frame_shared LIBRARY DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/ COMPONENT LIBRARIES)

src/alignment.c

@@ -0,0 +1,67 @@
+/*
+**********************************************************************************************
+*	File: alignment.c
+*   Description:
+*	Authors: Zheng Chao <zhengchao@geedgenetworks.com>
+*	Date:    2022-10-31
+*   Copyright: (c) 2018-2022 Geedge Networks, Inc. All rights reserved.
+***********************************************************************************************
+*/
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "alignment.h"
+
+#define	CPU_CACHE_ALIGMENT	64
+
+inline long long *alignment_int64_array_alloc(int size)
+{
+	return (long long *)calloc(CPU_CACHE_ALIGMENT, size);
+}
+
+inline long long alignment_int64_array_sum(long long *array, int size)
+{	
+    int offset = 0;
+	long long sum = 0;
+	
+	for (int i = 0; i < size; i++) {
+		offset = (CPU_CACHE_ALIGMENT / sizeof(long long)) * i;
+		sum += array[offset];
+	}
+
+	return sum;
+}
+
+inline long long alignment_int64_array_add(long long *array, int offset, long long op_val)
+{
+	int idx = (CPU_CACHE_ALIGMENT / sizeof(long long)) * offset;
+	array[idx] += op_val;
+
+	return array[idx];
+}
+
+inline long long alignment_int64_array_cnt(long long *array, int size)
+{
+	int offset = 0;
+	int cnt = 0;
+
+	for (int i = 0; i < size; i++) {
+		offset = (CPU_CACHE_ALIGMENT / sizeof(long long)) * i;
+		if (array[offset] > 0) {
+			cnt++;
+		}
+	}
+
+	return cnt;
+}
+
+inline void alignment_int64_array_reset(long long *array, int size)
+{
+	memset(array, 0, CPU_CACHE_ALIGMENT * size);
+}
+
+inline void alignment_int64_array_free(long long *array)
+{
+	free(array);
+}

src/inc_internal/alignment.h

@@ -11,68 +11,24 @@
 #ifndef _ALIGNMENT_H_
 #define _ALIGNMENT_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include <stdlib.h>
-#include <string.h>
+long long *alignment_int64_array_alloc(int size);
 
-#define	CPU_CACHE_ALIGMENT	64
+long long alignment_int64_array_sum(long long *array, int size);
 
-inline long long *alignment_int64_array_alloc(int size)
-{
-	return (long long *)calloc(CPU_CACHE_ALIGMENT, size);
-}
+long long alignment_int64_array_add(long long *array, int offset, long long op_val);
 
-inline long long alignment_int64_array_sum(long long *array, int size)
-{	
-    int offset = 0;
-	long long sum = 0;
-	
-	for (int i = 0; i < size; i++) {
-		offset = (CPU_CACHE_ALIGMENT / sizeof(long long)) * i;
-		sum += array[offset];
-	}
+long long alignment_int64_array_cnt(long long *array, int size);
 
-	return sum;
-}
+void alignment_int64_array_reset(long long *array, int size);
 
-inline long long alignment_int64_array_add(long long *array, int offset, long long op_val)
-{
-	int idx = (CPU_CACHE_ALIGMENT / sizeof(long long)) * offset;
-	array[idx] += op_val;
+void alignment_int64_array_free(long long *array);
 
-	return array[idx];
-}
-
-inline long long alignment_int64_array_cnt(long long *array, int size)
-{
-	int offset = 0;
-	int cnt = 0;
-
-	for (int i = 0; i < size; i++) {
-		offset = (CPU_CACHE_ALIGMENT / sizeof(long long)) * i;
-		if (array[offset] > 0) {
-			cnt++;
-		}
-	}
-
-	return cnt;
-}
-
-inline void alignment_int64_array_reset(long long *array, int size)
-{
-	memset(array, 0, CPU_CACHE_ALIGMENT * size);
-}
-
-inline void alignment_int64_array_free(long long *array)
-{
-	free(array);
-}
-
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/json2iris.h

@@ -11,19 +11,20 @@
 #ifndef _JSON2IRIS_H_
 #define _JSON2IRIS_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
 #include "hiredis/hiredis.h"
+#include "log/log.h"
 
 int json2iris(const char *json_buff, const char *json_filename,
               redisContext *redis_write_ctx, char *iris_dir_buf, 
               int buf_len, char *encrypt_key, char *encrypt_algo,
               struct log_handle *logger);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_bool_plugin.h

@@ -11,16 +11,18 @@
 #ifndef _MAAT_BOOL_PLUGIN_H_
 #define _MAAT_BOOL_PLUGIN_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "log/log.h"
-#include "maat/maat.h"
+#include "maat.h"
 #include "cJSON/cJSON.h"
 
 struct bool_plugin_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 /* bool plugin schema API */
 void *bool_plugin_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
@@ -49,7 +51,7 @@ int bool_plugin_runtime_commit(void *bool_plugin_runtime, const char *table_name
 
 struct ex_data_runtime *bool_plugin_runtime_get_ex_data_rt(void *bool_plugin_runtime);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_command.h

@@ -11,11 +11,13 @@
 #ifndef _MAAT_COMMAND_H_
 #define _MAAT_COMMAND_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
+#include "maat.h"
+
 enum maat_operation {
 	MAAT_OP_DEL = 0,
 	MAAT_OP_ADD,
@@ -39,7 +41,7 @@ struct maat_cmd_line
 */
 int maat_cmd_set_line(struct maat *maat_instance, const struct maat_cmd_line *line_rule);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_common.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_COMMON_H_
 #define _MAAT_COMMON_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -41,7 +41,7 @@ struct maat_options {
     };
 };
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_compile.h

@@ -11,14 +11,13 @@
 #ifndef _MAAT_COMPILE_H_
 #define _MAAT_COMPILE_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "log/log.h"
 #include "cJSON/cJSON.h"
-#include "maat/maat.h"
+#include "maat.h"
 #include "maat_kv.h"
 #include "maat_rule.h"
 
@@ -32,6 +31,11 @@ struct compile_ex_data_schema {
 	int table_id;
 };
 
+struct compile_schema;
+struct compile_runtime;
+struct maat_compile_state;
+struct group2group_runtime;
+
 /* compile schema API */
 void *compile_schema_new(cJSON *json, struct table_manager *tbl_mgr,
                          const char *table_name, struct log_handle *logger);
@@ -93,7 +97,7 @@ int maat_compile_state_update(struct maat_item *item_hash, int vtable_id,
                               
 int maat_compile_state_has_NOT_clause(struct maat_compile_state *compile_state);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_config_monitor.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_CONFIG_MONITOR_H_
 #define _MAAT_CONFIG_MONITOR_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -27,7 +27,7 @@ void config_monitor_traverse(long long version, const char *idx_dir,
 int load_maat_json_file(struct maat *maat_instance, const char *json_filename, 
                         char *err_str, size_t err_str_sz);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_ex_data.h

@@ -11,12 +11,12 @@
 #ifndef _MAAT_EX_DATA_H_
 #define _MAAT_EX_DATA_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "maat/maat.h"
+#include "maat.h"
 #include "rcu_hash.h"
 
 struct ex_data_container {
@@ -90,7 +90,7 @@ void *ex_data_runtime_get_custom_data(struct ex_data_runtime *ex_data_rt,
 
 size_t ex_data_runtime_ex_container_count(struct ex_data_runtime *ex_data_rt);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_expr.h

@@ -11,15 +11,18 @@
 #ifndef _MAAT_EXPR_H_
 #define _MAAT_EXPR_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "log/log.h"
+#include "maat_rule.h"
 #include "cJSON/cJSON.h"
 
 struct expr_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                       const char *table_name, struct log_handle *logger);
@@ -41,13 +44,13 @@ int expr_runtime_commit(void *expr_runtime, const char *table_name);
  * 
  * @retval the num of hit group_id
 */
-int expr_runtime_scan_string(struct expr_runtime *expr_rt, int thread_id, 
-                             const char *data, size_t data_len,
-                             int *group_ids, size_t group_ids_size, 
-                             int vtable_ids, struct maat_state *state);
+int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id, 
+                      const char *data, size_t data_len,
+                      int *group_ids, size_t group_ids_size, 
+                      int vtable_ids, struct maat_state *state);
 
 void expr_runtime_stream_open(struct expr_runtime *expr_rt, int thread_id);
-int expr_runtime_scan_stream(struct expr_runtime *expr_rt, const char *data,
+int expr_runtime_stream_scan(struct expr_runtime *expr_rt, const char *data,
                              size_t data_len, int *group_ids, size_t group_ids_size, 
                              int vtable_id, struct maat_state *state);
 void expr_runtime_stream_close(struct expr_runtime *expr_rt);
@@ -55,7 +58,7 @@ void expr_runtime_stream_close(struct expr_runtime *expr_rt);
 void expr_runtime_scan_hit_inc(struct expr_runtime *expr_rt, int thread_id);
 long long expr_runtime_scan_hit_sum(struct expr_runtime *expr_rt, int n_thread);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_flag.h

@@ -11,17 +11,20 @@
 #ifndef _MAAT_FLAG_H_
 #define _MAAT_FLAG_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
 #include <stdint.h>
 
-#include "log/log.h"
+#include "maat_rule.h"
 #include "cJSON/cJSON.h"
 
 struct flag_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 void *flag_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                       const char *table_name, struct log_handle *logger);
@@ -43,14 +46,14 @@ int flag_runtime_commit(void *flag_runtime, const char *table_name);
  * 
  * @retval the num of hit group_id
 */
-int flag_runtime_scan_flag(struct flag_runtime *flag_rt, int thread_id, 
-                           uint64_t flag, int *group_ids, size_t group_ids_size, 
-                           int vtable_id, struct maat_state *state);
+int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id, 
+                      uint64_t flag, int *group_ids, size_t group_ids_size, 
+                      int vtable_id, struct maat_state *state);
 
 void flag_runtime_scan_hit_inc(struct flag_runtime *flag_rt, int thread_id);
 long long flag_runtime_scan_hit_sum(struct flag_runtime *flag_rt, int n_thread);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_fqdn.h

@@ -0,0 +1,55 @@
+/*
+**********************************************************************************************
+*	File: maat_fqdn.h
+*   Description: 
+*	Authors: Liu WenTan <liuwentan@geedgenetworks.com>
+*	Date:    2022-10-31
+*   Copyright: (c) 2018-2022 Geedge Networks, Inc. All rights reserved.
+***********************************************************************************************
+*/
+
+#ifndef _MAAT_FQDN_H_
+#define _MAAT_FQDN_H_
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include "maat_rule.h"
+#include "cJSON/cJSON.h"
+
+struct fqdn_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
+
+void *fqdn_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
+                      const char *table_name, struct log_handle *logger);
+void fqdn_schema_free(void *fqdn_schema);
+
+/* fqdn runtime API */
+void *fqdn_runtime_new(void *fqdn_schema, int max_thread_num, 
+                     struct maat_garbage_bin *garbage_bin,
+                     struct log_handle *logger);
+void fqdn_runtime_free(void *fqdn_runtime);
+
+int fqdn_runtime_update(void *fqdn_runtime, void *fqdn_schema, 
+                      const char *line, int valid_column);
+int fqdn_runtime_commit(void *fqdn_runtime, const char *table_name);
+
+struct ex_data_runtime *fqdn_runtime_get_ex_data_rt(struct fqdn_runtime *fqdn_rt);
+
+/* fqdn runtime scan API */
+int fqdn_runtime_scan(struct fqdn_runtime *fqdn_rt, int thread_id, int port, 
+                    int proto, int *group_ids, size_t group_id_size, 
+                    int vtable_id, struct maat_state *state);
+
+void fqdn_runtime_scan_hit_inc(struct fqdn_runtime *fqdn_rt, int thread_id);
+long long fqdn_runtime_scan_hit_sum(struct fqdn_runtime *fqdn_rt, int n_thread);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/inc_internal/maat_fqdn_plugin.h

@@ -11,16 +11,18 @@
 #ifndef _MAAT_FQDN_PLUGIN_H_
 #define _MAAT_FQDN_PLUGIN_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "log/log.h"
-#include "maat/maat.h"
+#include "maat.h"
 #include "cJSON/cJSON.h"
 
 struct fqdn_plugin_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 /* fqdn plugin schema API */
 void *fqdn_plugin_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
@@ -49,7 +51,7 @@ int fqdn_plugin_runtime_commit(void *fqdn_plugin_runtime, const char *table_name
 
 struct ex_data_runtime *fqdn_plugin_runtime_get_ex_data_rt(void *fqdn_plugin_runtime);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_garbage_collection.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_GARBAGE_COLLECTION_H_
 #define _MAAT_GARBAGE_COLLECTION_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -33,7 +33,7 @@ size_t maat_garbage_bin_get_size(struct maat_garbage_bin *bin);
 
 void maat_garbage_collect_by_force(struct maat_garbage_bin *bin);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_group.h

@@ -11,17 +11,18 @@
 #ifndef _MAAT_GROUP_H_
 #define _MAAT_GROUP_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
 #include "cJSON/cJSON.h"
-#include "uthash/uthash.h"
-#include "igraph/igraph.h"
 #include "maat_kv.h"
 
 struct maat_group;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 /* group2group schema API */
 void *group2group_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
@@ -49,7 +50,7 @@ int group2group_runtime_update(void *g2g_runtime, void *g2g_schema,
                                const char *line, int valid_column);			   
 int group2group_runtime_commit(void *g2g_runtime, const char *table_name);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_interval.h

@@ -11,17 +11,20 @@
 #ifndef _MAAT_INTERVAL_H_
 #define _MAAT_INTERVAL_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
 #include <stdint.h>
 
-#include "log/log.h"
+#include "maat_rule.h"
 #include "cJSON/cJSON.h"
 
 struct interval_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 void *interval_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                           const char *table_name, struct log_handle *logger);
@@ -43,14 +46,14 @@ int interval_runtime_commit(void *interval_runtime, const char *table_name);
  * 
  * @retval the num of hit group_id
 */
-int interval_runtime_scan_intval(struct interval_runtime *interval_rt, int thread_id, 
-                                 uint64_t integer, int *group_ids, size_t group_ids_size, 
-                                 int vtable_id, struct maat_state *state);
+int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id, 
+                          uint64_t integer, int *group_ids, size_t group_ids_size, 
+                          int vtable_id, struct maat_state *state);
 
 void interval_runtime_scan_hit_inc(struct interval_runtime *interval_rt, int thread_id);
 long long interval_runtime_scan_hit_sum(struct interval_runtime *interval_rt, int n_thread);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_ip.h

@@ -11,12 +11,17 @@
 #ifndef _MAAT_IP_H_
 #define _MAAT_IP_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
+#include "cJSON/cJSON.h"
+
 struct ip_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 void *ip_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                     const char *table_name, struct log_handle *logger);
@@ -35,14 +40,14 @@ int ip_runtime_commit(void *ip_runtime, const char *table_name);
 struct ex_data_runtime *ip_runtime_get_ex_data_rt(struct ip_runtime *ip_rt);
 
 /* ip runtime scan API */
-int ip_runtime_scan_ip(struct ip_runtime *ip_rt, int thread_id, int ip_type, 
+int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type, 
                     uint8_t *ip_addr, int *group_ids, size_t group_id_size, 
                     int vtable_id, struct maat_state *state);
 
 void ip_runtime_scan_hit_inc(struct ip_runtime *ip_rt, int thread_id);
 long long ip_runtime_scan_hit_sum(struct ip_runtime *ip_rt, int n_thread);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_ip_plugin.h

@@ -11,16 +11,18 @@
 #ifndef _MAAT_IP_PLUGIN_H_
 #define _MAAT_IP_PLUGIN_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "log/log.h"
-#include "maat/maat.h"
+#include "maat.h"
 #include "cJSON/cJSON.h"
 
 struct ip_plugin_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
 
 /* ip plugin schema API */
 void *ip_plugin_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
@@ -49,7 +51,7 @@ int ip_plugin_runtime_commit(void *ip_plugin_runtime, const char *table_name);
 
 struct ex_data_runtime *ip_plugin_runtime_get_ex_data_rt(void *ip_plugin_runtime);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_kv.h

@@ -11,11 +11,13 @@
 #ifndef _MAAT_KV_H_
 #define _MAAT_KV_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
+#include <stddef.h>
+
 struct maat_kv_store;
 
 struct maat_kv_store *maat_kv_store_new(void);
@@ -30,7 +32,7 @@ int maat_kv_read_unNull(struct maat_kv_store *store, const char *key, size_t key
 
 struct maat_kv_store *maat_kv_store_duplicate(struct maat_kv_store *store);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_limits.h

@@ -11,14 +11,14 @@
 #ifndef _MAAT_LIMITS_H_
 #define _MAAT_LIMITS_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
 #define MAX_KEYWORDS_STR     1024
                               
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_plugin.h

@@ -11,12 +11,13 @@
 #ifndef _MAAT_PLUGIN_H_
 #define _MAAT_PLUGIN_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
-#include "maat/maat.h"
+#include "cJSON/cJSON.h"
+#include "maat.h"
 
 #define	MAX_FOREIGN_CLMN_NUM 8
 
@@ -59,7 +60,7 @@ int plugin_runtime_commit(void *plugin_runtime, const char *table_name);
 
 struct ex_data_runtime *plugin_runtime_get_ex_data_rt(void *plugin_runtime);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_port_proto.h

@@ -0,0 +1,56 @@
+/*
+**********************************************************************************************
+*	File: maat_port_proto.h
+*   Description: 
+*	Authors: Liu WenTan <liuwentan@geedgenetworks.com>
+*	Date:    2022-10-31
+*   Copyright: (c) 2018-2022 Geedge Networks, Inc. All rights reserved.
+***********************************************************************************************
+*/
+
+#ifndef _MAAT_PORT_PROTO_H_
+#define _MAAT_PORT_PROTO_H_
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include "maat_rule.h"
+#include "cJSON/cJSON.h"
+
+/* pp is short for port proto */
+struct pp_runtime;
+struct table_manager;
+struct log_handle;
+struct maat_garbage_bin;
+
+void *pp_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
+                    const char *table_name, struct log_handle *logger);
+void pp_schema_free(void *pp_schema);
+
+/* ip runtime API */
+void *pp_runtime_new(void *pp_schema, int max_thread_num, 
+                     struct maat_garbage_bin *garbage_bin,
+                     struct log_handle *logger);
+void pp_runtime_free(void *pp_runtime);
+
+int pp_runtime_update(void *pp_runtime, void *pp_schema, 
+                      const char *line, int valid_column);
+int pp_runtime_commit(void *pp_runtime, const char *table_name);
+
+struct ex_data_runtime *pp_runtime_get_ex_data_rt(struct pp_runtime *pp_rt);
+
+/* ip runtime scan API */
+int pp_runtime_scan(struct pp_runtime *pp_rt, int thread_id, int port, 
+                    int proto, int *group_ids, size_t group_id_size, 
+                    int vtable_id, struct maat_state *state);
+
+void pp_runtime_scan_hit_inc(struct pp_runtime *pp_rt, int thread_id);
+long long pp_runtime_scan_hit_sum(struct pp_runtime *pp_rt, int n_thread);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/inc_internal/maat_redis_monitor.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_REDIS_MONITOR_H_
 #define _MAAT_REDIS_MONITOR_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -25,7 +25,7 @@ void redis_monitor_traverse(long long version, struct source_redis_ctx *mr_ctx,
 							int (*update_fn)(const char *, const char *, void *),
 							void (*finish_fn)(void *), void *u_param);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_rule.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_RULE_H_
 #define _MAAT_RULE_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -29,8 +29,10 @@ extern "C"
 #include "uthash/uthash.h"
 #include "maat_command.h"
 #include "IPMatcher.h"
+#include "maat.h"
 #include "maat_kv.h"
 #include "maat_table.h"
+#include "maat_rule.h"
 #include "maat_virtual.h"
 
 #define MAX_TABLE_NUM	256
@@ -66,18 +68,6 @@ struct maat_rule_head {
 	int	serv_def_len;
 };
 
-#define	MAX_SERVICE_DEFINE_LEN 128
-struct maat_rule {
-	int	config_id;
-	int	service_id;
-	uint8_t	do_log;
-	uint8_t do_blacklist;
-	uint8_t	action;
-	uint8_t	reserved;
-	int	serv_def_len;
-	char service_defined[MAX_SERVICE_DEFINE_LEN];
-};
-
 #define	ITEM_RULE_MAGIC 0x4d3c2b1a
 struct maat_item_inner {
 	long long magic_num;
@@ -329,7 +319,7 @@ void maat_cmd_set_serial_rule(struct serial_rule *rule, enum maat_operation op,
 void fill_maat_rule(struct maat_rule *rule, const struct maat_rule_head *rule_head,
                     const char *srv_def, int srv_def_len);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_table.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_TABLE_H_
 #define _MAAT_TABLE_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -19,6 +19,8 @@ extern "C"
 #include <stddef.h>
 #include <cJSON/cJSON.h>
 
+#include "maat_garbage_collection.h"
+
 enum table_type {
     TABLE_TYPE_INVALID = -1,
     TABLE_TYPE_FLAG = 0,
@@ -74,7 +76,7 @@ void *table_manager_get_runtime(struct table_manager *tbl_mgr, int table_id);
 int table_manager_update_runtime(struct table_manager *tbl_mgr, int table_id, const char *line);
 void table_manager_commit_runtime(struct table_manager *tbl_mgr, int table_id);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_utils.h

@@ -11,7 +11,7 @@
 #ifndef _MAAT_UTILS_H_
 #define _MAAT_UTILS_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -67,12 +67,7 @@ enum maat_ip_format ip_format_str2int(const char *format);
 int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, const char *ip2, 
                     uint32_t range_begin[], uint32_t range_end[]);
 
-inline void ipv6_ntoh(unsigned int *v6_addr)
-{
-	for (unsigned int i = 0; i < 4; i++) {
-		v6_addr[i] = ntohl(v6_addr[i]);
-	}
-}
+
 
 #define UNUSED	__attribute__((unused))
 
@@ -80,6 +75,8 @@ const char *module_name_str(const char *name);
 
 char *maat_strdup(const char *s);
 
+void ipv6_ntoh(unsigned int *v6_addr);
+
 int get_column_pos(const char *line, int column_seq, size_t *offset, size_t *len);
 
 /* the column value must be integer */
@@ -111,7 +108,7 @@ int system_cmd_mkdir(const char* path);
 
 int system_cmd_rmdir(const char *dir);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/maat_virtual.h

@@ -11,11 +11,13 @@
 #ifndef _MAAT_VIRTUAL_H_
 #define _MAAT_VIRTUAL_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
 
+#include "cJSON/cJSON.h"
+
 enum scan_type {
     SCAN_TYPE_INVALID = -1,
 	SCAN_TYPE_NONE = 0,
@@ -30,6 +32,9 @@ enum scan_type {
 	SCAN_TYPE_MAX
 };
 
+struct table_manager;
+struct log_handle;
+
 void *virtual_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                          const char *table_name, struct log_handle *logger);
 
@@ -37,7 +42,7 @@ void virtual_schema_free(void *virtual_schema);
 
 int virtual_table_get_physical_table_id(void *virtual_schema, enum scan_type type);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/inc_internal/rcu_hash.h

@@ -11,7 +11,7 @@
 #ifndef _RCU_HASH_H_
 #define _RCU_HASH_H_
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 extern "C"
 {
 #endif
@@ -62,7 +62,7 @@ size_t rcu_hash_garbage_queue_len(struct rcu_hash_table *htable);
 
 size_t rcu_hash_list_updating_data(struct rcu_hash_table *htable, void ***data_array);
 
-#ifdef __cpluscplus
+#ifdef __cplusplus
 }
 #endif
 

src/maat_api.c

@@ -14,7 +14,7 @@
 
 #include "maat_utils.h"
 #include "json2iris.h"
-#include "maat/maat.h"
+#include "maat.h"
 #include "maat_rule.h"
 #include "maat_common.h"
 #include "maat_kv.h"
@@ -29,6 +29,7 @@
 #include "maat_group.h"
 #include "maat_expr.h"
 #include "maat_flag.h"
+#include "maat_interval.h"
 #include "maat_ip.h"
 #include "maat_plugin.h"
 #include "maat_ip_plugin.h"
@@ -41,6 +42,12 @@ enum district_set_flag {
     DISTRICT_FLAG_SET
 };
 
+struct maat_stream {
+    struct maat *maat_instance;
+    struct maat_runtime *ref_maat_rt;
+    int vtable_id;
+};
+
 enum scan_type maat_table_get_scan_type(enum table_type table_type)
 {
 	enum scan_type ret = SCAN_TYPE_INVALID;
@@ -381,12 +388,12 @@ int maat_table_get_id(struct maat *maat_instance, const char *table_name)
     return table_id;
 }
 
-inline void maat_runtime_ref_inc(struct maat_runtime *maat_rt, int thread_id)
+static inline void maat_runtime_ref_inc(struct maat_runtime *maat_rt, int thread_id)
 {
 	alignment_int64_array_add(maat_rt->ref_cnt, thread_id, 1);
 }
 
-inline void maat_runtime_ref_dec(struct maat_runtime *maat_rt, int thread_id)
+static inline void maat_runtime_ref_dec(struct maat_runtime *maat_rt, int thread_id)
 {
 	alignment_int64_array_add(maat_rt->ref_cnt, thread_id, -1);
 }
@@ -701,7 +708,7 @@ struct maat_state *grab_state(struct maat_state **state, struct maat *maat_insta
     return mid;
 }
 
-inline int scan_status_should_compile_NOT(struct maat_state *state)
+static inline int scan_status_should_compile_NOT(struct maat_state *state)
 {
 	if (state && (LAST_SCAN_SET == state->is_last_scan) && state->compile_state 
         && maat_compile_state_has_NOT_clause(state->compile_state)) {
@@ -723,7 +730,7 @@ int maat_scan_flag(struct maat *maat_instance, int table_id, int thread_id,
                    uint64_t flag, int *results, size_t n_result,
                    size_t *n_hit_result, struct maat_state **state)
 {
-     if ((NULL == maat_instance) || (table_id < 0) || (table_id >= MAX_TABLE_NUM) 
+    if ((NULL == maat_instance) || (table_id < 0) || (table_id >= MAX_TABLE_NUM) 
         || (thread_id < 0) || (NULL == results) || (0 == n_result) || (NULL == state)) {
         return MAAT_SCAN_ERR;
     }
@@ -762,7 +769,7 @@ int maat_scan_flag(struct maat *maat_instance, int table_id, int thread_id,
         return MAAT_SCAN_ERR;
     }
 
-    int group_hit_cnt = flag_runtime_scan_flag((struct flag_runtime *)flag_rt, 
+    int group_hit_cnt = flag_runtime_scan((struct flag_runtime *)flag_rt, 
                                                  thread_id,
                                                  flag, group_ids, 
                                                  MAX_SCANNER_HIT_GROUP_NUM,
@@ -814,11 +821,99 @@ int maat_scan_flag(struct maat *maat_instance, int table_id, int thread_id,
     return MAAT_SCAN_OK;
 }
 
-int maat_scan_integer(struct maat *instance, int table_id, int thread_id,
+int maat_scan_integer(struct maat *maat_instance, int table_id, int thread_id,
                       unsigned int intval, int *results, size_t n_result,
                       size_t *n_hit_result, struct maat_state **state)
 {
-    return 0;
+    if ((NULL == maat_instance) || (table_id < 0) || (table_id >= MAX_TABLE_NUM) 
+        || (thread_id < 0) || (NULL == results) || (0 == n_result) || (NULL == state)) {
+        return MAAT_SCAN_ERR;
+    }
+    
+    struct maat_state *mid = NULL;
+    mid = grab_state(state, maat_instance, thread_id);
+    mid->scan_cnt++;
+
+    int physical_table_id = 0;
+    int vtable_id = 0;
+    
+    enum table_type table_type = table_manager_get_table_type(maat_instance->tbl_mgr, table_id);
+    if (table_type == TABLE_TYPE_VIRTUAL) {
+        //find physical table id
+        void *virtual_schema = table_manager_get_schema(maat_instance->tbl_mgr, table_id);
+        physical_table_id = virtual_table_get_physical_table_id(virtual_schema, SCAN_TYPE_FLAG);
+        if (physical_table_id < 0) {
+            return MAAT_SCAN_ERR;
+        }
+    } else {
+        physical_table_id = table_id;
+    }
+
+    if (NULL == maat_instance->maat_rt) {
+        log_error(maat_instance->logger, MODULE_MAAT_API, 
+                 "maat_scan_string error because of maat_runtime is NULL");
+        return MAAT_SCAN_OK;
+    }
+
+    maat_runtime_ref_inc(maat_instance->maat_rt, thread_id);
+    alignment_int64_array_add(maat_instance->thread_call_cnt, thread_id, 1);
+
+    int group_ids[MAX_SCANNER_HIT_GROUP_NUM] = {-1};
+    void *interval_rt = table_manager_get_runtime(maat_instance->tbl_mgr, table_id);
+    if (NULL == interval_rt) {
+        return MAAT_SCAN_ERR;
+    }
+
+    int group_hit_cnt = interval_runtime_scan((struct interval_runtime *)interval_rt, 
+                                                      thread_id,
+                                                      intval, group_ids, 
+                                                      MAX_SCANNER_HIT_GROUP_NUM,
+                                                      vtable_id, mid);
+    if (group_hit_cnt < 0) {
+        return MAAT_SCAN_ERR;
+    } 
+    
+    size_t n_hit_compile = 0;
+    if (group_hit_cnt > 0 || scan_status_should_compile_NOT(mid)) {
+        // come here means group_hit_cnt > 0, at least MAAT_SCAN_HALF_HIT, or MAAT_SCAN_HIT
+        if (group_hit_cnt > 0) {
+            interval_runtime_scan_hit_inc((struct interval_runtime *)interval_rt, thread_id);
+        }
+
+        int compile_table_id = -1;
+        if (mid->compile_table_id == -1) {
+            compile_table_id = maat_instance->default_compile_table_id;
+        } else {
+            compile_table_id = mid->compile_table_id;
+        }
+
+        void *compile_rt = table_manager_get_runtime(maat_instance->tbl_mgr, compile_table_id);
+        n_hit_compile = hit_group_to_compile(compile_rt, results, n_result, mid);
+        *n_hit_result = n_hit_compile;
+
+        assert(mid->is_last_scan < LAST_SCAN_FINISHED);
+        if (LAST_SCAN_SET == mid->is_last_scan) {
+            mid->is_last_scan = LAST_SCAN_FINISHED;
+        }
+    }
+
+    if (n_hit_compile > 0) {
+        alignment_int64_array_add(maat_instance->hit_cnt, thread_id, 1);
+        if (0 == group_hit_cnt) {
+            //hit NOT group
+             alignment_int64_array_add(maat_instance->not_grp_hit_cnt, thread_id, 1);
+        }
+        return MAAT_SCAN_HIT;
+    } else {
+        // n_hit_compile == 0
+        if (group_hit_cnt > 0) {
+            return MAAT_SCAN_HALF_HIT;
+        }
+    }
+
+    maat_runtime_ref_dec(maat_instance->maat_rt, thread_id);
+
+    return MAAT_SCAN_OK;
 }
 
 int maat_scan_ipv4(struct maat *maat_instance, int table_id, int thread_id, 
@@ -857,7 +952,7 @@ int maat_scan_ipv4(struct maat *maat_instance, int table_id, int thread_id,
     //     return 0;
     // }
 
-    int group_hit_cnt = ip_runtime_scan_ip((struct ip_runtime *)ip_rt, thread_id, IPv4,
+    int group_hit_cnt = ip_runtime_scan((struct ip_runtime *)ip_rt, thread_id, IPv4,
                                         (uint8_t *)&ip_addr, group_ids, sizeof(group_ids),
                                          vtable_id, mid);
     if (group_hit_cnt < 0) {
@@ -944,7 +1039,7 @@ int maat_scan_ipv6(struct maat *maat_instance, int table_id, int thread_id,
     //     return 0;
     // }
 
-    int group_hit_cnt = ip_runtime_scan_ip((struct ip_runtime *)ip_rt, thread_id, IPv6, ip_addr, 
+    int group_hit_cnt = ip_runtime_scan((struct ip_runtime *)ip_rt, thread_id, IPv6, ip_addr, 
                                          group_ids, sizeof(group_ids), vtable_id, mid);
     if (group_hit_cnt < 0) {
         return MAAT_SCAN_ERR;
@@ -1045,7 +1140,7 @@ int maat_scan_string(struct maat *maat_instance, int table_id, int thread_id,
         return MAAT_SCAN_ERR;
     }
 
-    int group_hit_cnt = expr_runtime_scan_string((struct expr_runtime *)expr_rt, 
+    int group_hit_cnt = expr_runtime_scan((struct expr_runtime *)expr_rt, 
                                                  thread_id,
                                                  data, data_len, group_ids, 
                                                  MAX_SCANNER_HIT_GROUP_NUM,

src/maat_compile.c

@@ -20,7 +20,6 @@
 #include "maat_compile.h"
 #include "maat_garbage_collection.h"
 #include "maat_group.h"
-#include "maat/maat.h"
 #include "rcu_hash.h"
 #include "maat_table.h"
 

src/maat_ex_data.c

@@ -14,7 +14,6 @@
 #include "uthash/uthash.h"
 #include "uthash/utarray.h"
 #include "log/log.h"
-#include "rcu_hash.h"
 #include "maat_utils.h"
 #include "maat_ex_data.h"
 
@@ -69,8 +68,8 @@ void ex_data_runtime_free(struct ex_data_runtime *ex_data_rt)
 
     if (ex_data_rt->cache_rows != NULL) {
 		utarray_free(ex_data_rt->cache_rows);
-		ex_data_rt->cache_rows=NULL;
-		ex_data_rt->cache_row_num=0;
+		ex_data_rt->cache_rows = NULL;
+		ex_data_rt->cache_row_num = 0;
 	}
 
     if (ex_data_rt->htable != NULL) {

src/maat_expr.c

@@ -35,6 +35,7 @@ struct expr_schema {
     int match_method_column;
     int is_hexbin_column;
     enum hs_scan_mode scan_mode; /* adapter_hs scan mode */
+    enum hs_pattern_type pattern_type; /* literal or regex */
     int table_id; //ugly
     struct table_manager *ref_tbl_mgr;
 };
@@ -61,13 +62,14 @@ struct expr_item {
     int district_id;
     char keywords[MAX_KEYWORDS_STR];
     enum expr_type expr_type;
-    enum match_method match_method;
+    enum hs_match_mode match_mode;
     int is_hexbin;
     int is_case_sensitive;
 };
 
 struct expr_runtime {
     enum hs_scan_mode scan_mode;
+    enum hs_pattern_type pattern_type;
     struct adapter_hs *hs;
     struct adapter_hs_stream *hs_stream;
     struct rcu_hash_table *htable;
@@ -111,28 +113,28 @@ enum expr_type int_to_expr_type(int expr_type)
     return type;
 }
 
-enum match_method int_to_match_method_type(int match_method_type)
+enum hs_match_mode int_to_match_mode(int match_method)
 {
-    enum match_method type = MATCH_METHOD_MAX;
+    enum hs_match_mode mode = HS_MATCH_MODE_MAX;
 
-    switch (match_method_type) {
+    switch (match_method) {
     case 0:
-        type = MATCH_METHOD_SUB;
+        mode = HS_MATCH_MODE_SUB;
         break;
     case 1:
-        type = MATCH_METHOD_RIGHT;
+        mode = HS_MATCH_MODE_SUFFIX;
         break;
     case 2:
-        type = MATCH_METHOD_LEFT;
+        mode = HS_MATCH_MODE_PREFIX;
         break;
     case 3:
-        type = MATCH_METHOD_COMPLETE;
+        mode = HS_MATCH_MODE_EXACTLY;
         break;
     default:
         break;
     }
 
-    return type;
+    return mode;
 }
 
 struct expr_item *expr_item_new(const char *line, struct expr_schema *expr_schema,
@@ -205,7 +207,7 @@ struct expr_item *expr_item_new(const char *line, struct expr_schema *expr_schem
     }
     
     match_method_type = atoi(line + column_offset);
-    expr_item->match_method = int_to_match_method_type(match_method_type);
+    expr_item->match_mode = int_to_match_mode(match_method_type);
 
     ret = get_column_pos(line, expr_schema->is_hexbin_column, &column_offset, &column_len);
     if (ret < 0) {
@@ -252,7 +254,6 @@ struct expr_item *expr_item_new(const char *line, struct expr_schema *expr_schem
     }
     memcpy(expr_item->keywords, (line + column_offset), column_len);
 
-   
     return expr_item;
 error:
     FREE(expr_item);
@@ -264,17 +265,42 @@ void expr_item_free(struct expr_item *expr_item)
     FREE(expr_item);
 }
 
+enum hs_scan_mode scan_mode_str_to_enum(const char *mode_str)
+{
+    enum hs_scan_mode scan_mode = HS_SCAN_MODE_MAX;
+
+    if (strcmp(mode_str, "block") == 0) {
+        scan_mode = HS_SCAN_MODE_BLOCK;
+    } else if (strcmp(mode_str, "stream") == 0) {
+        scan_mode = HS_SCAN_MODE_STREAM;
+    } else {
+        assert(0);
+    }
+
+    return scan_mode;
+}
+
+enum hs_pattern_type pattern_type_str_to_enum(const char *type_str)
+{
+    enum hs_pattern_type pattern_type = HS_PATTERN_TYPE_MAX;
+
+    if (strcmp(type_str, "literal") == 0) {
+        pattern_type = HS_PATTERN_TYPE_STR;
+    } else if (strcmp(type_str, "regex") == 0) {
+        pattern_type = HS_PATTERN_TYPE_REG;
+    } else {
+        assert(0);
+    }
+
+    return pattern_type;
+}
+
 void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
                       const char *table_name, struct log_handle *logger)
 {
     int read_cnt = 0;
 	struct expr_schema *expr_schema = ALLOC(struct expr_schema, 1);
-	struct maat_kv_store *scan_mode_map = maat_kv_store_new();
 
-    maat_kv_register(scan_mode_map, "block", HS_SCAN_MODE_BLOCK);
-    maat_kv_register(scan_mode_map, "stream", HS_SCAN_MODE_STREAM);
-
-    int ret = -1;
     cJSON *custom_item = NULL;
     cJSON *item = cJSON_GetObjectItem(json, "table_id");
     if (item != NULL && item->type == cJSON_Number) {
@@ -291,13 +317,13 @@ void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr,
 
 	custom_item = cJSON_GetObjectItem(item, "scan_mode");
 	if (custom_item != NULL && custom_item->type == cJSON_String) {
-		ret = maat_kv_read(scan_mode_map, custom_item->valuestring, 
-                          (int*)&(expr_schema->scan_mode));
-        if (ret < 0) {
-            log_error(logger, MODULE_EXPR, "scan_mode %s illegal", 
-                      custom_item->valuestring);
-            goto error;
-        }
+        expr_schema->scan_mode = scan_mode_str_to_enum(custom_item->valuestring);
+        read_cnt++;
+	}
+
+    custom_item = cJSON_GetObjectItem(item, "pattern_type");
+	if (custom_item != NULL && custom_item->type == cJSON_String) {
+        expr_schema->pattern_type = pattern_type_str_to_enum(custom_item->valuestring);
         read_cnt++;
 	}
 
@@ -319,10 +345,10 @@ void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr,
         read_cnt++;
     }
 
+    /* expr_plus has district */
 	custom_item = cJSON_GetObjectItem(item, "district");
 	if (custom_item != NULL && custom_item->type == cJSON_Number) {
 		expr_schema->district_column = custom_item->valueint;
-		read_cnt++;
 	}
 
 	custom_item = cJSON_GetObjectItem(item, "expr_type");
@@ -345,14 +371,12 @@ void *expr_schema_new(cJSON *json, struct table_manager *tbl_mgr,
 
     expr_schema->ref_tbl_mgr = tbl_mgr;
 
-    if (read_cnt < 8) {
+    if (read_cnt < 9) {
 		goto error;
     }
 	
-    maat_kv_store_free(scan_mode_map);
     return expr_schema;
 error:
-    maat_kv_store_free(scan_mode_map);
     FREE(expr_schema);
     return NULL;
 }
@@ -394,6 +418,7 @@ void *expr_runtime_new(void *expr_schema, int max_thread_num,
 
     expr_rt->htable = rcu_hash_new(expr_ex_data_free);
     expr_rt->scan_mode = schema->scan_mode;
+    expr_rt->pattern_type = schema->pattern_type;
     expr_rt->item_user_data_free = maat_item_inner_free;
     expr_rt->n_worker_thread = max_thread_num;
     expr_rt->ref_garbage_bin = garbage_bin;
@@ -477,17 +502,18 @@ int expr_runtime_update_row(struct expr_runtime *expr_rt, char *key,
     return 0;
 }
 
-enum pattern_type expr_type2pattern_type(enum expr_type expr_type)
+enum hs_pattern_type expr_type2pattern_type(enum expr_type expr_type)
 {
-    enum pattern_type pattern_type = PATTERN_TYPE_STR;
+    enum hs_pattern_type pattern_type = HS_PATTERN_TYPE_MAX;
 
     switch (expr_type) {
         case EXPR_TYPE_STRING:
         case EXPR_TYPE_AND:
         case EXPR_TYPE_OFFSET:
+            pattern_type = HS_PATTERN_TYPE_STR;
             break;
         case EXPR_TYPE_REGEX:
-            pattern_type = PATTERN_TYPE_REG;
+            pattern_type = HS_PATTERN_TYPE_REG;
             break;
         default:
             break;
@@ -496,7 +522,7 @@ enum pattern_type expr_type2pattern_type(enum expr_type expr_type)
     return pattern_type;
 }
 
-int converHextoint(char srctmp)
+int convertHextoint(char srctmp)
 {
 	if (isdigit(srctmp)) {
 		return srctmp - '0';
@@ -512,8 +538,8 @@ size_t hex2bin(char *hex, int hex_len, char *binary, size_t size)
 	size_t resultlen = 0;
 	int high,low;
 	for (int i = 0; i < hex_len && size > resultlen; i += 2, resultlen++) {
-		high = converHextoint(hex[i]);
-		low = converHextoint(hex[i+1]);
+		high = convertHextoint(hex[i]);
+		low = convertHextoint(hex[i+1]);
 		binary[resultlen] = high * 16 + low;
 	}
 
@@ -612,15 +638,15 @@ and_expr_t *expr_item_to_expr_rule(struct expr_item *expr_item, void *user_data,
     size_t sub_key_len = 0;
 
     for (i = 0; i < sub_expr_cnt; i++) {
-        expr_rule->expr_id = expr_item->item_id;
+       
         if (FALSE == expr_item->is_case_sensitive) {
             // insensitive
-            expr_rule->patterns[i].case_sensitive = 1;
+            expr_rule->patterns[i].case_sensitive = HS_CASE_INSESITIVE;
         }
         
-        expr_rule->patterns[i].type = expr_type2pattern_type(expr_item->expr_type);
+        enum hs_pattern_type pattern_type = expr_type2pattern_type(expr_item->expr_type);
 
-        if (TRUE == expr_item->is_hexbin && expr_rule->patterns[i].type != EXPR_TYPE_REGEX) {
+        if (TRUE == expr_item->is_hexbin && pattern_type != HS_PATTERN_TYPE_REG) {
             region_str_len = strlen(sub_key_array[i]) + 1;
 			region_string = ALLOC(char, region_str_len);
 			region_str_len = hex2bin(sub_key_array[i], strlen(sub_key_array[i]), region_string, region_str_len);
@@ -637,11 +663,26 @@ and_expr_t *expr_item_to_expr_rule(struct expr_item *expr_item, void *user_data,
             memcpy(expr_rule->patterns[i].pat, sub_key_array[i], sub_key_len);
             expr_rule->patterns[i].pat_len = sub_key_len;
         }
+
+        expr_rule->patterns[i].match_mode = expr_item->match_mode;
+        if (expr_rule->patterns[i].match_mode == HS_MATCH_MODE_SUB) {
+            expr_rule->patterns[i].l_offset = key_left_offset[i];
+            expr_rule->patterns[i].r_offset = key_right_offset[i];
+        }
     }
-   
+    expr_rule->expr_id = expr_item->item_id;
     expr_rule->user_tag = user_data;
     expr_rule->n_patterns = sub_expr_cnt;
     
+    //mytest
+    // printf("expr_rule->expr_id:%u\n", expr_rule->expr_id);
+    // printf("expr_rule->n_patterns:%zu\n", expr_rule->n_patterns);
+    // for (size_t i = 0; i < expr_rule->n_patterns; i++) {
+    //     printf("expr_rule->patterns[%zu].pat:%s\n", i, expr_rule->patterns[i].pat);
+    //     printf("expr_rule->patterns[%zu].pat_len:%zu\n", i, expr_rule->patterns[i].pat_len);
+    //     printf("expr_rule->patterns[%zu].l_offset:%d\n", i, expr_rule->patterns[i].l_offset);
+    //     printf("expr_rule->patterns[%zu].r_offset:%d\n", i, expr_rule->patterns[i].r_offset);
+    // }
     return expr_rule;
 }
 
@@ -755,7 +796,7 @@ int expr_runtime_commit(void *expr_runtime, const char *table_name)
     log_info(expr_rt->logger, MODULE_EXPR,
              "table[%s] committing %zu expr rules for rebuilding adapter_hs engine", 
              table_name, rule_cnt);
-    new_adapter_hs = adapter_hs_initialize(expr_rt->scan_mode, 
+    new_adapter_hs = adapter_hs_initialize(expr_rt->scan_mode, expr_rt->pattern_type,
                                            expr_rt->n_worker_thread, 
                                            rules, rule_cnt, 
                                            expr_rt->logger);
@@ -781,7 +822,7 @@ int expr_runtime_commit(void *expr_runtime, const char *table_name)
     return ret;
 }
 
-int expr_runtime_scan_string(struct expr_runtime *expr_rt, int thread_id, 
+int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id, 
                              const char *data, size_t data_len,
                              int *group_ids, size_t group_ids_size, 
                              int vtable_id, struct maat_state *state)
@@ -839,7 +880,7 @@ void expr_runtime_stream_open(struct expr_runtime *expr_rt, int thread_id)
     expr_rt->hs_stream = hs_stream;
 }
 
-int expr_runtime_scan_stream(struct expr_runtime *expr_rt, const char *data, 
+int expr_runtime_stream_scan(struct expr_runtime *expr_rt, const char *data, 
                              size_t data_len, int *group_ids, size_t group_ids_size, 
                              int vtable_id, struct maat_state *state)
 {

src/maat_flag.c

@@ -410,7 +410,7 @@ int flag_runtime_commit(void *flag_runtime, const char *table_name)
     return ret;
 }
 
-int flag_runtime_scan_flag(struct flag_runtime *flag_rt, int thread_id, 
+int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id, 
                            uint64_t flag, int *group_ids, size_t group_ids_size, 
                            int vtable_id, struct maat_state *state)
 {

src/maat_fqdn.c

@@ -0,0 +1,72 @@
+/*
+**********************************************************************************************
+*	File: maat_fqdn.cpp
+*   Description: 
+*	Authors: Liu WenTan <liuwentan@geedgenetworks.com>
+*	Date:    2022-10-31
+*   Copyright: (c) 2018-2022 Geedge Networks, Inc. All rights reserved.
+***********************************************************************************************
+*/
+
+#include "maat_fqdn.h"
+#include "log/log.h"
+
+struct fqdn_runtime {
+
+};
+
+void *fqdn_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
+                    const char *table_name, struct log_handle *logger)
+{
+    return NULL;
+}
+
+void fqdn_schema_free(void *fqdn_schema)
+{
+
+}
+
+void *fqdn_runtime_new(void *fqdn_schema, int max_thread_num, 
+                     struct maat_garbage_bin *garbage_bin,
+                     struct log_handle *logger)
+{
+    return NULL;
+}
+
+void fqdn_runtime_free(void *fqdn_runtime)
+{
+
+}
+
+int fqdn_runtime_update(void *fqdn_runtime, void *fqdn_schema, 
+                      const char *line, int valid_column)
+{
+    return 0;
+}
+
+int fqdn_runtime_commit(void *fqdn_runtime, const char *table_name)
+{
+    return 0;
+}
+
+struct ex_data_runtime *fqdn_runtime_get_ex_data_rt(struct fqdn_runtime *fqdn_rt)
+{
+    return NULL;
+}
+
+int fqdn_runtime_scan(struct fqdn_runtime *fqdn_rt, int thread_id, int port, 
+                    int proto, int *group_ids, size_t group_id_size, 
+                    int vtable_id, struct maat_state *state)
+{
+    return 0;
+}
+
+void fqdn_runtime_scan_hit_inc(struct fqdn_runtime *fqdn_rt, int thread_id)
+{
+
+}
+
+long long fqdn_runtime_scan_hit_sum(struct fqdn_runtime *fqdn_rt, int n_thread)
+{
+    return 0;
+}

src/maat_group.c

@@ -11,11 +11,12 @@
 #include <assert.h>
 #include <pthread.h>
 
+#include "log/log.h"
 #include "maat_group.h"
 #include "maat_utils.h"
 #include "uthash/uthash.h"
 #include "igraph/igraph.h"
-#include "log/log.h"
+#include "maat_kv.h"
 
 #define MODULE_GROUP	 module_name_str("maat.group")
 

src/maat_interval.c

@@ -439,7 +439,7 @@ int interval_runtime_commit(void *interval_runtime, const char *table_name)
     return ret;
 }
 
-int interval_runtime_scan_intval(struct interval_runtime *interval_rt, int thread_id, 
+int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id, 
                                  uint64_t integer, 
                                  int *group_ids, size_t group_ids_size, 
                                  int vtable_id, struct maat_state *state)

src/maat_ip.c

@@ -12,7 +12,6 @@
 #include <assert.h>
 
 #include "log/log.h"
-#include "cJSON/cJSON.h"
 #include "maat_utils.h"
 #include "maat_ex_data.h"
 #include "IPMatcher.h"
@@ -479,7 +478,7 @@ int ip_runtime_commit(void *ip_runtime, const char *table_name)
     return ret;
 }
 
-int ip_runtime_scan_ip(struct ip_runtime *ip_rt, int thread_id, int ip_type, 
+int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type, 
                     uint8_t *ip_addr, int *group_ids, size_t group_id_size, 
                     int vtable_id, struct maat_state *state)
 {

src/maat_ip_plugin.c

@@ -10,6 +10,7 @@
 
 #include <assert.h>
 
+#include "log/log.h"
 #include "maat_utils.h"
 #include "maat_ip_plugin.h"
 #include "maat_ex_data.h"

src/maat_kv.c

@@ -8,7 +8,6 @@
 ***********************************************************************************************
 */
 
-#include <stddef.h>
 #include <ctype.h>
 
 #include "uthash/uthash.h"

src/maat_plugin.c

@@ -11,7 +11,6 @@
 #include <assert.h>
 
 #include "log/log.h"
-#include "cJSON/cJSON.h"
 #include "maat_utils.h"
 #include "maat_rule.h"
 #include "maat_plugin.h"

src/maat_port_proto.c

@@ -0,0 +1,69 @@
+/*
+**********************************************************************************************
+*	File: maat_ip.cpp
+*   Description: 
+*	Authors: Liu WenTan <liuwentan@geedgenetworks.com>
+*	Date:    2022-10-31
+*   Copyright: (c) 2018-2022 Geedge Networks, Inc. All rights reserved.
+***********************************************************************************************
+*/
+
+#include "maat_port_proto.h"
+#include "log/log.h"
+
+void *pp_schema_new(cJSON *json, struct table_manager *tbl_mgr, 
+                    const char *table_name, struct log_handle *logger)
+{
+
+}
+
+void pp_schema_free(void *pp_schema)
+{
+
+}
+
+/* ip runtime API */
+void *pp_runtime_new(void *pp_schema, int max_thread_num, 
+                     struct maat_garbage_bin *garbage_bin,
+                     struct log_handle *logger)
+{
+
+}
+
+void pp_runtime_free(void *pp_runtime)
+{
+
+}
+
+int pp_runtime_update(void *pp_runtime, void *pp_schema, 
+                      const char *line, int valid_column)
+{
+
+}
+
+int pp_runtime_commit(void *pp_runtime, const char *table_name)
+{
+
+}
+
+struct ex_data_runtime *pp_runtime_get_ex_data_rt(struct pp_runtime *pp_rt)
+{
+
+}
+
+int pp_runtime_scan(struct pp_runtime *pp_rt, int thread_id, int port, 
+                    int proto, int *group_ids, size_t group_id_size, 
+                    int vtable_id, struct maat_state *state)
+{
+
+}
+
+void pp_runtime_scan_hit_inc(struct pp_runtime *pp_rt, int thread_id)
+{
+
+}
+
+long long pp_runtime_scan_hit_sum(struct pp_runtime *pp_rt, int n_thread)
+{
+
+}

src/maat_redis_monitor.c

@@ -13,7 +13,7 @@
 #include <sys/stat.h>
 #include <stdio.h>
 
-#include "maat/maat.h"
+#include "maat.h"
 #include "maat_utils.h"
 #include "maat_command.h"
 #include "maat_config_monitor.h"

src/maat_table.c

@@ -15,7 +15,6 @@
 #include "maat_utils.h"
 #include "maat_table.h"
 #include "maat_rule.h"
-#include "maat_garbage_collection.h"
 #include "maat_kv.h"
 #include "maat_expr.h"
 #include "maat_ip.h"

src/maat_utils.c

@@ -32,6 +32,13 @@ const char *module_name_str(const char *name)
 	return module;
 }
 
+inline void ipv6_ntoh(unsigned int *v6_addr)
+{
+	for (unsigned int i = 0; i < 4; i++) {
+		v6_addr[i] = ntohl(v6_addr[i]);
+	}
+}
+
 char *maat_strdup(const char *s)
 {
 	if (NULL == s) {
@@ -440,7 +447,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 			return -1;
 		}
 
-		ipv4_addr = ntohl(ipv4_addr);
+		//ipv4_addr = ntohl(ipv4_addr);
         uint32_t ipv4_range_end = 0;
         uint32_t ipv4_mask = 0;
 		switch (format) {
@@ -450,7 +457,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}				
-				ipv4_range_end = ntohl(ipv4_range_end);
+				//ipv4_range_end = ntohl(ipv4_range_end);
 				range_end[0] = ipv4_range_end;
 				break;
 			case IP_FORMAT_MASK:
@@ -458,7 +465,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}
-				ipv4_mask = ntohl(ipv4_mask);
+				//ipv4_mask = ntohl(ipv4_mask);
 				range_begin[0] = ipv4_addr & ipv4_mask;
 				range_end[0] = ipv4_addr | ~ipv4_mask;
 				break;
@@ -485,7 +492,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 		if (ret <= 0) {
 			return -1;
 		}
-		ipv6_ntoh(ipv6_addr);
+		//ipv6_ntoh(ipv6_addr);
 
 		switch (format) {
 			case IP_FORMAT_RANGE:
@@ -493,7 +500,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}
-				ipv6_ntoh(ipv6_range_end);
+				//ipv6_ntoh(ipv6_range_end);
 
 				memcpy(range_begin, ipv6_addr, sizeof(ipv6_addr));				
 				memcpy(range_end, ipv6_range_end, sizeof(ipv6_range_end));
@@ -503,7 +510,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}
-				ipv6_ntoh(ipv6_mask);
+				//ipv6_ntoh(ipv6_mask);
                 
 				for (i = 0; i < 4; i++) {
 					range_begin[i]=ipv6_addr[i] & ipv6_mask[i];	

src/maat_virtual.c

@@ -10,7 +10,6 @@
 
 #include <assert.h>
 
-#include "cJSON/cJSON.h"
 #include "maat_kv.h"
 #include "maat_utils.h"
 #include "log/log.h"

src/version.map

@@ -0,0 +1,9 @@
+VERS_3.0{
+global:
+	extern "C" {
+		*MAAT_FRAME_VERSION_*;
+		*maat_*;
+		*bool_matcher_*;
+	};
+local: *;
+};