gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add flagMatcher and IntevalMatcher

Browse Source
This commit is contained in:
liuwentan
2023-02-06 08:14:25 +08:00
parent 57f0a0581a
commit 4d2f783874
17 changed files with 761 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files

431
test/table_info.conf
View File

@@ -1,6 +1,6 @@
[
{
"table_id":1,
"table_id":0,
"table_name":"COMPILE",
"table_type":"compile",
"valid_column":8,
@@ -17,7 +17,7 @@
}
},
{
"table_id":2,
"table_id":1,
"table_name":"GROUP2COMPILE",
"table_type":"group2compile",
"associated_compile_table_id":1,
@@ -31,38 +31,7 @@
}
},
{
"table_id":3,
"table_name":"COMPILE_2",
"table_type":"compile",
"valid_column":8,
"custom": {
"compile_id":1,
"service_id":2,
"action":3,
"do_blacklist":4,
"do_log":5,
"tags":6,
"user_region":7,
"clause_num":9,
"evaluation_order":10
}
},
{
"table_id":4,
"table_name":"GROUP2COMPILE_2",
"table_type":"group2compile",
"associated_compile_table_id":3,
"valid_column":3,
"custom": {
"group_id":1,
"compile_id":2,
"not_flag":4,
"virtual_table_name":5,
"clause_index":6
}
},
{
"table_id":5,
"table_id":2,
"table_name":"GROUP2GROUP",
"table_type":"group2group",
"valid_column":3,
@@ -72,7 +41,7 @@
}
},
{
"table_id":6,
"table_id":3,
"table_name":"HTTP_URL",
"table_type":"expr",
"valid_column":7,
@@ -87,10 +56,248 @@
}
},
{
"table_id":7,
"table_name":"IP_PLUGIN_TABLE",
"table_type":"ip_plugin",
"table_id":3,
"table_name":"HTTP_HOST",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":4,
"table_name":"KEYWORDS_TABLE",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":6,
"table_name":"CONTENT_SIZE",
"table_type":"intval",
"valid_column":5,
"custom": {
"item_id":1,
"group_id":2,
"low_bound":3,
"up_bound":4
}
},
{
"table_id":7,
"table_name":"QD_ENTRY_INFO",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":1,
"tag":3
}
},
{
"table_id":9,
"table_name":"HTTP_SIGNATURE",
"table_type":"expr_plus",
"valid_column":8,
"custom": {
"item_id":1,
"group_id":2,
"district":3,
"keywords":4,
"expr_type":5,
"match_method":6,
"db_hexbin":7
}
},
{
"table_id":11,
"table_name":"IMAGE_FP",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":12,
"table_name":"TEST_EFFECTIVE_RANGE_TABLE",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":1,
"tag":5
}
},
{
"table_id":13,
"table_name":"TEST_FOREIGN_KEY",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":2,
"tag":3,
"foreign": [6,8]
}
},
{
"table_id":14,
"table_name":"COMPILE_ALIAS",
"table_type":"compile",
"valid_column":4,
"custom": {
"compile_id":1,
"service_id":2,
"action":3,
"do_blacklist":4,
"do_log":5,
"tags":6,
"user_region":7,
"clause_num":9,
"evaluation_order":10
}
},
{
"table_id":15,
"table_name":"TEST_PLUGIN_EXDATA_TABLE",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":2,
"tag":5,
"estimate_size": 1024
}
},
{
"table_id":16,
"table_name":"IR_INTERCEPT_IP",
"table_type":"plugin",
"valid_column":14,
"custom": {
"key":2,
"tag":18
}
},
{
"table_id":17,
"table_name":"APP_PAYLOAD",
"table_type":"expr_plus",
"valid_column":8,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"district":3,
"keywords":4,
"expr_type":5,
"match_method":6,
"is_hexbin":7
}
},
{
"table_id":18,
"table_name":"TROJAN_PAYLOAD",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":19,
"table_name":"MAIL_ADDR",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":20,
"table_name":"IP_PLUS_CONFIG",
"table_type":"ip_plus",
"valid_column":7,
"custom": {
"item_id":1,
"group_id":2,
"addr_type":3,
"saddr_format":4,
"sip1":5,
"sip2":6
}
},
{
"table_id":21,
"table_name":"HTTP_RESPONSE_KEYWORDS",
"table_type":"virtual",
"physical_table": ["KEYWORDS_TABLE"]
},
{
"table_id":22,
"table_name":"HTTP_REQUEST_HEADER",
"table_type":"virtual",
"physical_table": ["HTTP_SIGNATURE"]
},
{
"table_id":23,
"table_name":"HTTP_RESPONSE_HEADER",
"table_type":"virtual",
"physical_table": ["HTTP_SIGNATURE"]
},
{
"table_id":24,
"table_name":"VIRTUAL_IP_PLUS_TABLE",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
},
{
"table_id":24,
"table_name":"VIRTUAL_IP_PLUS_SOURCE",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
},
{
"table_id":24,
"table_name":"VIRTUAL_IP_PLUS_DESTINATION",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
},
{
"table_id":29,
"table_name":"TEST_IP_PLUGIN_WITH_EXDATA",
"table_type":"ip_plugin",
"custom": {
"item_id":1,
"ip_type":2,
@@ -99,40 +306,142 @@
}
},
{
"table_id":8,
"table_name":"PLUGIN_TABLE",
"table_type":"plugin",
"valid_column":4,
"table_id":30,
"table_name":"AS_NUMBER",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"key":2,
"tag":3,
"foreign":[6,8,10]
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":9,
"table_name":"IP_PLUS_CONFIG",
"table_type":"ip_plus",
"valid_column":18,
"table_id":31,
"table_name":"SOURCE_IP_ASN",
"table_type":"virtual",
"physical_table":["AS_NUMBER"]
},
{
"table_id":32,
"table_name":"DESTINATION_IP_ASN",
"table_type":"virtual",
"physical_table":["AS_NUMBER"]
},
{
"table_id":33,
"table_name":"GeoLocation",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":34,
"table_name":"SOURCE_IP_GEO",
"table_type":"virtual",
"physical_table":["GeoLocation"]
},
{
"table_id":35,
"table_name":"INTERGER_PLUS",
"table_type":"intval_plus",
"valid_column":6,
"custom": {
"item_id":1,
"group_id":2,
"addr_type":3,
"saddr_format":4,
"sip1":5,
"sip2":6,
"sport_format":7,
"sport1":8,
"sport2":9,
"proto":16,
"direction":17
"district":3,
"low_bound":4,
"up_bound":5
}
},
{
"table_id":10,
"table_name":"VIRTUAL_IP_PLUS_TABLE",
"table_id":36,
"table_name":"TEST_FQDN_PLUGIN_WITH_EXDATA",
"table_type":"fqdn_plugin",
"valid_column":5,
"custom": {
"row_id":1,
"is_suffix_match":2,
"fqdn":3
}
},
{
"table_id":37,
"table_name":"VIRTUAL_SSL_SNI",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
"physical_table": ["KEYWORDS_TABLE", "INTERGER_PLUS"]
},
{
"table_id":38,
"table_name":"APP_ID",
"table_type":"intval",
"valid_column":5,
"custom": {
"item_id":1,
"group_id":2,
"low_bound":3,
"up_bound":4
}
},
{
"table_id":39,
"table_name":"EMPTY_KEYWORD",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":40,
"table_name":"EMPTY_INTERGER",
"table_type":"intval",
"valid_column":5,
"custom": {
"item_id":1,
"group_id":2,
"low_bound":3,
"up_bound":4
}
},
{
"table_id":41,
"table_name":"TEST_BOOL_PLUGIN_WITH_EXDATA",
"table_type":"bool_plugin",
"valid_column":4,
"custom": {
"item_id":1,
"bool_expr":2
}
},
{
"table_id":42,
"table_name":"FLAG_CONFIG",
"table_type":"flag",
"valid_column":5,
"custom": {
"item_id":1,
"group_id":2,
"flag":3,
"flag_mask":4
}
}
]