diff --git a/inc/Maat_command.h b/inc/Maat_command.h index eb61899..f0c8ce9 100644 --- a/inc/Maat_command.h +++ b/inc/Maat_command.h @@ -138,21 +138,21 @@ char* Maat_str_escape(char* dst,int size,const char*src); //Deletion failed due to not complete synchronize with Redis. //To make sure the delete command is excecuted, user should try again after MAAT_OPT_SCANDIR_INTERVAL_MS ms. -//Returns nubmer of successfully updated rule. +//Returns number of successfully updated rule. //The following functions are NOT thread safe. int Maat_cmd(Maat_feather_t feather,struct Maat_cmd_t* cmd,enum MAAT_OPERATION op); //pipeline model int Maat_cmd_append(Maat_feather_t feather,struct Maat_cmd_t* cmd,enum MAAT_OPERATION op); -//Return nubmer of successfully updated rule. +//Return number of successfully updated rule. //Return -1 for failed. int Maat_cmd_commit(Maat_feather_t feather); int Maat_cmd_set_group(Maat_feather_t feather, int group_id, const struct Maat_region_t* region, enum MAAT_OPERATION op); -//Returns nubmer of successfully updated rule. +//Returns number of successfully updated rule. //Return -1 for failed. int Maat_cmd_set_line(Maat_feather_t feather,const struct Maat_line_t* line_rule, enum MAAT_OPERATION op); int Maat_cmd_set_lines(Maat_feather_t feather,const struct Maat_line_t** line_rule, int line_num ,enum MAAT_OPERATION op); diff --git a/test/maat_json.json b/test/maat_json.json index 85d470d..4bd2f4b 100644 --- a/test/maat_json.json +++ b/test/maat_json.json @@ -737,8 +737,14 @@ ] }, { + "is_valid": "yes", + "do_log": 0, + "effective_rage": 0, + "action": 0, + "compile_id": 148, "service": 0, "do_blacklist": 0, + "user_region": "APP_ID=100001;BEHAV_ID=100002", "groups": [ { "regions": [ @@ -756,14 +762,75 @@ ], "group_name": "Untitled" } - ], - "user_region": "APP_ID=100001;BEHAV_ID=100002", - "is_valid": "yes", - "do_log": 0, - "effective_rage": 0, - "action": 0, - "compile_id": 148 - } + ] + }, + { + "compile_id": 149, + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "groups": [ + { + "regions": [ + { + "table_name": "HTTP_URL", + "table_type": "string", + "table_content": { + "keywords": "^((?!.*\\binstagram\\b)).*\\.fbcdn\\.net$", + "expr_type": "regex", + "match_method": "sub", + "format": "uncase plain" + } + } + ] + } + ] + }, + { + "compile_id": 150, + "service": 0, + "action": 0, + "do_blacklist": 0, + "do_log": 0, + "effective_rage": 0, + "user_region": "0", + "is_valid": "yes", + "groups": [ + { + "regions": [ + { + "table_type": "expr", + "table_name": "TROJAN_PAYLOAD", + "table_content": { + "keywords": "0-4:01000000", + "expr_type": "offset", + "format": "hexbin", + "match_method": "sub" + } + } + ], + "group_name": "billgates_regist1" + }, + { + "regions": [ + { + "table_type": "expr", + "table_name": "TROJAN_PAYLOAD", + "table_content": { + "keywords": "1:G2.40", + "expr_type": "none", + "format": "uncase plain", + "match_method": "sub" + } + } + ], + "group_name": "billgates_regist2" + } + ] + } ], "plugin_table": [ { diff --git a/test/table_info.conf b/test/table_info.conf index 68a98eb..570b681 100644 --- a/test/table_info.conf +++ b/test/table_info.conf @@ -32,4 +32,5 @@ 13 COMPILE_ALIAS compile escape -- 14 TEST_PLUGIN_EXDATA_TABLE plugin {"key":2,"valid":4,"tag":5,"estimate_size":1024} -- 15 IR_INTERCEPT_IP plugin {"valid":14,"tag":18} -16 APP_PAYLOAD expr_plus UTF8 UTF8 yes 0 quickoff \ No newline at end of file +16 APP_PAYLOAD expr_plus UTF8 UTF8 yes 0 quickoff +17 TROJAN_PAYLOAD expr UTF8 UTF8 yes 0 quickoff \ No newline at end of file diff --git a/test/test_maatframe.cpp b/test/test_maatframe.cpp index 48f6b8e..abffb3d 100644 --- a/test/test_maatframe.cpp +++ b/test/test_maatframe.cpp @@ -239,16 +239,70 @@ TEST(StringScan, Regex) int found_pos[4]; const char* table_name="HTTP_URL"; scan_status_t mid=NULL; - const char* scan_data="Cookie: Txa123aheadBCAxd"; + const char* cookie="Cookie: Txa123aheadBCAxd"; + const char* sni_should_not_hit[]={"instagram.fbcdn.net","a.instagram.fbcdn.net"}; + const char* sni_should_hit[]={"xx.fbcdn.net","ainstagram.fbcdn.net"}; table_id=Maat_table_register(g_feather,table_name); ASSERT_GT(table_id, 0); - ret=Maat_full_scan_string(g_feather, table_id,CHARSET_GBK, scan_data, strlen(scan_data), + ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, cookie, strlen(cookie), result,found_pos, 4, &mid, 0); EXPECT_GE(ret, 1); EXPECT_EQ(result[0].config_id, 146); Maat_clean_status(&mid); + + + size_t i=0; + for(i=0; i< sizeof(sni_should_not_hit)/sizeof(const char*); i++) + { + ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, sni_should_not_hit[i], strlen(sni_should_not_hit[i]), + result,found_pos, 4, &mid, 0); + EXPECT_EQ(ret, 0); + Maat_clean_status(&mid); + } + for(i=0; i