gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

如果扫描无规则table时直接返回，导致未进行非表达式的运算。

Browse Source
This commit is contained in:
zhengchao
2021-08-19 21:46:38 +08:00
parent 293ad8e21c
commit 465ad3ca6a
4 changed files with 19 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/entry/Maat_api.cpp
View File

@@ -1419,10 +1419,11 @@ int Maat_full_scan_string_detail(Maat_feather_t feather,int table_id
scan_data.text_data.toffset=0;
struct Maat_table_runtime* table_rt=Maat_table_runtime_get(my_scanner->table_rt_mgr, p_table->table_id);
if(table_rt->origin_rule_num==0)
{
return 0;
}
// Even no rule in table, we still need to search for NOT compile.
// if(table_rt->origin_rule_num==0)
// {
// return 0;
// }
assert(thread_num<_feather->scan_thread_num);
region_result=my_scanner->region_rslt_buff+MAX_SCANNER_HIT_NUM*thread_num;
@@ -1543,10 +1544,12 @@ int Maat_scan_intval(Maat_feather_t feather,int table_id
return 0;
}
struct Maat_table_runtime* table_rt=Maat_table_runtime_get(my_scanner->table_rt_mgr, p_table->table_id);
if(table_rt->origin_rule_num==0)
{
return 0;
}
// Even no rule in table, we still need to search for NOT compile.
// if(table_rt->origin_rule_num==0)
// {
// return 0;
// }
if(p_table->table_type==TABLE_TYPE_INTERVAL_PLUS&&(_mid==NULL||_mid->is_set_district!=1))
{
_feather->scan_err_cnt++;
@@ -1651,10 +1654,6 @@ int Maat_similar_scan_string(Maat_feather_t feather,int table_id
GIE_result_t* region_result=my_scanner->gie_rslt_buff+MAX_SCANNER_HIT_NUM*thread_num;
struct Maat_table_runtime* table_rt=Maat_table_runtime_get(my_scanner->table_rt_mgr, p_table->table_id);
if(table_rt->origin_rule_num==0)
{
return 0;
}
GIE_handle_t* gie_handle=table_rt->similar.gie_handle;
INC_SCANNER_REF(my_scanner,thread_num);
@@ -2038,7 +2037,7 @@ int Maat_stream_scan_string_detail(stream_para_t* stream_para
{
return 0;
}
//table rule num is already in Maat_stream_scan_string_start
//table rule num is already tested in Maat_stream_scan_string_start
if(sp->p_real_table->table_type==TABLE_TYPE_EXPR_PLUS&&(_mid==NULL||_mid->is_set_district!=1))

15
test/maat_json.json
View File

@@ -2156,21 +2156,6 @@
}
],
"not_flag" : 0
},
{
"regions": [
{
"table_name": "KEYWORDS_TABLE",
"table_type": "string",
"table_content": {
"keywords": "contains-keywords-MUST-hit-by-rule-186",
"expr_type": "and",
"match_method": "expr",
"format": "uncase plain"
}
}
],
"not_flag" : 0
}
]
}

1
test/table_info.conf
View File

@@ -59,3 +59,4 @@
36 TEST_FQDN_PLUGIN_WITH_EXDATA fqdn_plugin {"row_id":1,"is_suffix_match":2,"fqdn":3,"valid":5} --
37 VIRTUAL_SSL_SNI virtual ["KEYWORDS_TABLE","INTERGER_PLUS"] --
38 APP_ID intval --
39 EMPTY_KEYWORD expr UTF8 UTF8 yes 0

10
test/test_maatframe.cpp
View File

@@ -1117,12 +1117,12 @@ TEST(NOTLogic, ScanIrrelavantAtLast)
TEST(NOTLogic, ScanHitAtLast)
{
const char* string_should_not_hit="This string should not hit.";
const char* string_should_hit="This string contains-keywords-MUST-hit-by-rule-186.";
const char* string_match_no_region="This string is matched against a empty table.";
int ret=0;
int table_id=0;
struct Maat_rule_t result[4];
int found_pos[4];
const char* not_hit_table_name="HTTP_URL", *hit_table_name1="IP_PLUS_CONFIG", *hit_table_name2="KEYWORDS_TABLE";
const char* not_hit_table_name="HTTP_URL", *hit_table_name1="IP_PLUS_CONFIG", *empty_table_name="EMPTY_KEYWORD";
scan_status_t mid=NULL;
table_id=Maat_table_register(g_feather, not_hit_table_name);
ASSERT_GT(table_id, 0);
@@ -1148,14 +1148,14 @@ TEST(NOTLogic, ScanHitAtLast)
EXPECT_EQ(ret, -2);
table_id=Maat_table_register(g_feather, hit_table_name2);
table_id=Maat_table_register(g_feather, empty_table_name);
ASSERT_GT(table_id, 0);
Maat_set_scan_status(g_feather, &mid, MAAT_SET_SCAN_LAST_REGION, NULL, 0);
ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, string_should_hit, strlen(string_should_hit),
ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, string_match_no_region, strlen(string_match_no_region),
result, found_pos, 4, &mid, 0);
EXPECT_EQ(ret, 1);
EXPECT_EQ(result[0].config_id, 186);
Maat_clean_status(&mid);