Trivial add unit test case

inc/Maat_command.h

@@ -138,21 +138,21 @@ char* Maat_str_escape(char* dst,int size,const char*src);
 
 //Deletion failed due to not complete synchronize with Redis.
 //To make sure the delete command is excecuted, user should try again after MAAT_OPT_SCANDIR_INTERVAL_MS ms.
-//Returns nubmer of successfully updated rule.
+//Returns number of successfully updated rule.
 //The following functions are NOT thread safe.
 int Maat_cmd(Maat_feather_t feather,struct Maat_cmd_t* cmd,enum MAAT_OPERATION op);
 
 //pipeline model
 int Maat_cmd_append(Maat_feather_t feather,struct Maat_cmd_t* cmd,enum MAAT_OPERATION op);
 
-//Return nubmer of successfully updated rule.
+//Return number of successfully updated rule.
 //Return -1 for failed.
 int Maat_cmd_commit(Maat_feather_t feather);
 
 
 int Maat_cmd_set_group(Maat_feather_t feather, int group_id, const struct Maat_region_t* region, enum MAAT_OPERATION op);
 
-//Returns nubmer of successfully updated rule.
+//Returns number of successfully updated rule.
 //Return -1 for failed.
 int Maat_cmd_set_line(Maat_feather_t feather,const struct Maat_line_t* line_rule, enum MAAT_OPERATION op);
 int Maat_cmd_set_lines(Maat_feather_t feather,const struct Maat_line_t** line_rule, int line_num ,enum MAAT_OPERATION op);

test/maat_json.json

@@ -737,8 +737,14 @@
             ]
         },
 				{
+				    "is_valid": "yes",
+				    "do_log": 0,
+				    "effective_rage": 0,
+				    "action": 0,
+				    "compile_id": 148,
 				    "service": 0,
 				    "do_blacklist": 0,
+				    "user_region": "APP_ID=100001;BEHAV_ID=100002",
 				    "groups": [
 				        {
 				            "regions": [
@@ -756,14 +762,75 @@
 				            ],
 				            "group_name": "Untitled"
 				        }
-				    ],
+				    ]
-				    "user_region": "APP_ID=100001;BEHAV_ID=100002",
+				},
-				    "is_valid": "yes",
+        {
-				    "do_log": 0,
+            "compile_id": 149,
-				    "effective_rage": 0,
+            "service": 1,
-				    "action": 0,
+            "action": 1,
-				    "compile_id": 148
+            "do_blacklist": 1,
-				}
+            "do_log": 1,
+            "user_region": "anything",
+            "is_valid": "yes",
+            "groups": [
+                {
+                    "regions": [
+                        {
+                            "table_name": "HTTP_URL",
+                            "table_type": "string",
+                            "table_content": {
+                                "keywords": "^((?!.*\\binstagram\\b)).*\\.fbcdn\\.net$",
+                                "expr_type": "regex",
+                                "match_method": "sub",
+                                "format": "uncase plain"
+                            }
+                        }
+                    ]
+                }
+            ]
+        },
+        {
+            "compile_id": 150,
+            "service": 0,
+            "action": 0,
+            "do_blacklist": 0,
+            "do_log": 0,
+            "effective_rage": 0,
+            "user_region": "0",
+            "is_valid": "yes",
+            "groups": [
+                {
+                    "regions": [
+                        {
+                            "table_type": "expr",
+                            "table_name": "TROJAN_PAYLOAD",
+                            "table_content": {
+                                "keywords": "0-4:01000000",
+                                "expr_type": "offset",
+                                "format": "hexbin",
+                                "match_method": "sub"
+                            }
+                        }
+                    ],
+                    "group_name": "billgates_regist1"
+                },
+                {
+                    "regions": [
+                        {
+                            "table_type": "expr",
+                            "table_name": "TROJAN_PAYLOAD",
+                            "table_content": {
+                                "keywords": "1:G2.40",
+                                "expr_type": "none",
+                                "format": "uncase plain",
+                                "match_method": "sub"
+                            }
+                        }
+                    ],
+                    "group_name": "billgates_regist2"
+                }
+            ]
+        }
     ],
     "plugin_table": [
         {

test/table_info.conf

@@ -32,4 +32,5 @@
 13	COMPILE_ALIAS	compile	escape	--
 14	TEST_PLUGIN_EXDATA_TABLE	plugin {"key":2,"valid":4,"tag":5,"estimate_size":1024}	--
 15	IR_INTERCEPT_IP plugin  {"valid":14,"tag":18}
-16	APP_PAYLOAD	expr_plus	UTF8	UTF8	yes	0	quickoff
+16	APP_PAYLOAD	expr_plus	UTF8	UTF8	yes	0	quickoff
+17	TROJAN_PAYLOAD	expr	UTF8	UTF8	yes	0	quickoff

test/test_maatframe.cpp

@@ -239,16 +239,70 @@ TEST(StringScan, Regex)
 	int found_pos[4];
 	const char* table_name="HTTP_URL";
 	scan_status_t mid=NULL;
-	const char* scan_data="Cookie: Txa123aheadBCAxd";
+	const char* cookie="Cookie: Txa123aheadBCAxd";
+	const char* sni_should_not_hit[]={"instagram.fbcdn.net","a.instagram.fbcdn.net"};
+	const char* sni_should_hit[]={"xx.fbcdn.net","ainstagram.fbcdn.net"};
 	table_id=Maat_table_register(g_feather,table_name);
 	ASSERT_GT(table_id, 0);
 	
-	ret=Maat_full_scan_string(g_feather, table_id,CHARSET_GBK, scan_data, strlen(scan_data), 
+	ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, cookie, strlen(cookie), 
 						result,found_pos, 4, &mid, 0);
 						
 	EXPECT_GE(ret, 1);
 	EXPECT_EQ(result[0].config_id, 146);
 	Maat_clean_status(&mid);
+	
+
+	size_t i=0;
+	for(i=0; i< sizeof(sni_should_not_hit)/sizeof(const char*); i++)
+	{
+		ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, sni_should_not_hit[i], strlen(sni_should_not_hit[i]), 
+							result,found_pos, 4, &mid, 0);
+		EXPECT_EQ(ret, 0);		
+		Maat_clean_status(&mid);
+	}
+	for(i=0; i<sizeof(sni_should_hit)/sizeof(const char*); i++)
+	{
+		ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, sni_should_hit[i], strlen(sni_should_hit[i]), 
+							result,found_pos, 4, &mid, 0);
+		EXPECT_GE(ret, 1);	
+		EXPECT_EQ(result[0].config_id, 149);
+		Maat_clean_status(&mid);
+	}	
+}
+TEST(StringScan, BugReport20190325)
+{
+	struct Maat_rule_t result[4];
+	int found_pos[4];
+
+	unsigned char scan_data[] = { /* Packet 1 */
+	0x01, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00, 
+	0x00, 0xf4, 0x01, 0x00, 0x00, 0x32, 0x00, 0x00, 
+	0x00, 0xe8, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+	0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 
+	0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+	0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 
+	0x2d, 0x3d, 0x3d, 0x20, 0x48, 0x3d, 0x48, 0x20, 
+	0x3d, 0x3d, 0x2d, 0x3a, 0x00, 0x02, 0x00, 0x00, 
+	0x00, 0x07, 0x0e, 0x00, 0x00, 0xe8, 0x03, 0x00, 
+	0x00, 0x4c, 0x69, 0x6e, 0x75, 0x78, 0x20, 0x33, 
+	0x2e, 0x31, 0x39, 0x2e, 0x30, 0x2d, 0x31, 0x35, 
+	0x2d, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63, 
+	0x00, 0x31, 0x3a, 0x47, 0x32, 0x2e, 0x34, 0x30, 
+	0x00 };
+
+	int table_id=Maat_table_register(g_feather, "TROJAN_PAYLOAD");
+	ASSERT_GT(table_id, 0);
+	scan_status_t mid=NULL;
+	int ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, (char*)scan_data, sizeof(scan_data), 
+						result, found_pos, 4,
+						&mid, 0);
+	EXPECT_EQ(ret, 1);
+	EXPECT_EQ(result[0].config_id, 150);
+
 }
 TEST(StringScan,   ExprPlus)
 {