gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix hyperscan depends ragel bug

Browse Source
This commit is contained in:
liuwentan
2023-03-15 15:11:07 +08:00
parent fb4043f225
commit 71d6cbab2c
5 changed files with 50 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/maat_compile.c
View File

@@ -1630,7 +1630,13 @@ int compile_runtime_commit(void *compile_runtime, const char *table_name)
struct bool_matcher *old_bool_matcher = NULL; struct bool_matcher *old_bool_matcher = NULL;
struct bool_matcher *new_bool_matcher = NULL; struct bool_matcher *new_bool_matcher = NULL;
pthread_rwlock_rdlock(&compile_rt->rwlock);
size_t compile_cnt = HASH_COUNT(compile_rt->compile_hash); size_t compile_cnt = HASH_COUNT(compile_rt->compile_hash);
pthread_rwlock_unlock(&compile_rt->rwlock);
if (0 == compile_cnt) {
return 0;
}
log_info(compile_rt->logger, MODULE_COMPILE, log_info(compile_rt->logger, MODULE_COMPILE,
"table[%s] committing %zu compile rules for rebuilding compile bool_matcher engine", "table[%s] committing %zu compile rules for rebuilding compile bool_matcher engine",
table_name, compile_cnt); table_name, compile_cnt);

33
test/maat_framework_gtest.cpp
View File

@@ -693,9 +693,10 @@ TEST_F(MaatStringScan, StreamInput) {
//TODO: //TODO:
#if 0 #if 0
TEST_F(MaatStringScan, ShouldNotHitExprPlus) { TEST_F(MaatStringScan, ShouldNotHitExprPlus) {
long long results[ARRAY] = {0}; long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0; size_t n_hit_result = 0;
struct maat_state *state = NULL; struct maat_state *state = NULL;
struct maat *maat_instance = MaatStringScan::_shared_maat_instance;
const char *region_name = "tcp.payload"; const char *region_name = "tcp.payload";
unsigned char udp_payload_not_hit[] = { /* Stun packet */ unsigned char udp_payload_not_hit[] = { /* Stun packet */
0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42, 0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42,
@@ -711,13 +712,13 @@ TEST_F(MaatStringScan, ShouldNotHitExprPlus) {
0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a, 0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a,
0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a, 0xab, 0x00 }; 0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a, 0xab, 0x00 };
int table_id = maat_get_table_id(g_maat_instance, "APP_PAYLOAD"); int table_id = maat_get_table_id(maat_instance, "APP_PAYLOAD");
ASSERT_GT(table_id, 0); ASSERT_GT(table_id, 0);
int ret = maat_state_set_scan_district(g_maat_instance, &state, region_name, strlen(region_name)); int ret = maat_state_set_scan_district(maat_instance, &state, region_name, strlen(region_name));
ASSERT_EQ(ret, 0); ASSERT_EQ(ret, 0);
ret = maat_scan_string(g_maat_instance, table_id, 0, (char *)udp_payload_not_hit, sizeof(udp_payload_not_hit), ret = maat_scan_string(maat_instance, table_id, 0, (char *)udp_payload_not_hit, sizeof(udp_payload_not_hit),
results, ARRAY_SIZE, &n_hit_result, &state); results, ARRAY_SIZE, &n_hit_result, &state);
EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
maat_state_free(&state); maat_state_free(&state);
@@ -727,29 +728,30 @@ TEST_F(MaatStringScan, ExprPlusWithHex) {
long long results[ARRAY_SIZE] = {0}; long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0; size_t n_hit_result = 0;
struct maat_state *state = NULL; struct maat_state *state = NULL;
struct maat *maat_instance = MaatStringScan::_shared_maat_instance;
const char *scan_data1 = "text/html; charset=UTF-8"; const char *scan_data1 = "text/html; charset=UTF-8";
const char *scan_data2 = "Batman\\:Take me Home.Superman/:Fine,stay with me."; const char *scan_data2 = "Batman\\:Take me Home.Superman/:Fine,stay with me.";
const char *region_name1 = "Content-Type"; const char *region_name1 = "Content-Type";
const char *region_name2 = "User-Agent"; const char *region_name2 = "User-Agent";
int table_id = maat_get_table_id(g_maat_instance, "HTTP_SIGNATURE"); int table_id = maat_get_table_id(maat_instance, "HTTP_SIGNATURE");
ASSERT_GT(table_id, 0); ASSERT_GT(table_id, 0);
int ret = maat_state_set_scan_district(g_maat_instance, &state, region_name1, strlen(region_name1)); int ret = maat_state_set_scan_district(maat_instance, &state, region_name1, strlen(region_name1));
ASSERT_EQ(ret, 0); ASSERT_EQ(ret, 0);
ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data1, strlen(scan_data1), ret = maat_scan_string(maat_instance, table_id, 0, scan_data1, strlen(scan_data1),
results, ARRAY_SIZE, &n_hit_result, &state); results, ARRAY_SIZE, &n_hit_result, &state);
EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(results[0], 156); EXPECT_EQ(results[0], 156);
ret = maat_state_set_scan_district(g_maat_instance, &state, region_name2, strlen(region_name2)); ret = maat_state_set_scan_district(maat_instance, &state, region_name2, strlen(region_name2));
ASSERT_EQ(ret, 0); ASSERT_EQ(ret, 0);
ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data1, strlen(scan_data1), ret = maat_scan_string(maat_instance, table_id, 0, scan_data1, strlen(scan_data1),
results, ARRAY_SIZE, &n_hit_result, &state); results, ARRAY_SIZE, &n_hit_result, &state);
EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
table_id = maat_get_table_id(g_maat_instance, "KEYWORDS_TABLE"); table_id = maat_get_table_id(maat_instance, "KEYWORDS_TABLE");
ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data2, strlen(scan_data2), ret = maat_scan_string(maat_instance, table_id, 0, scan_data2, strlen(scan_data2),
results, ARRAY_SIZE, &n_hit_result, &state); results, ARRAY_SIZE, &n_hit_result, &state);
EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(results[0], 132); EXPECT_EQ(results[0], 132);
@@ -761,6 +763,7 @@ TEST_F(MaatStringScan, ExprPlusWithOffset)
long long results[ARRAY_SIZE] = {0}; long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0; size_t n_hit_result = 0;
struct maat_state *state = NULL; struct maat_state *state = NULL;
struct maat *maat_instance = MaatStringScan::_shared_maat_instance;
const char *region_name = "Payload"; const char *region_name = "Payload";
unsigned char udp_payload_not_hit[] = { /* Stun packet */ unsigned char udp_payload_not_hit[] = { /* Stun packet */
0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42, 0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42,
@@ -789,17 +792,17 @@ TEST_F(MaatStringScan, ExprPlusWithOffset)
0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a, 0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a,
0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a }; 0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a };
int table_id = maat_get_table_id(g_maat_instance, "APP_PAYLOAD"); int table_id = maat_get_table_id(maat_instance, "APP_PAYLOAD");
ASSERT_GT(table_id, 0); ASSERT_GT(table_id, 0);
int ret = maat_state_set_scan_district(g_maat_instance, &state, region_name, strlen(region_name)); int ret = maat_state_set_scan_district(maat_instance, &state, region_name, strlen(region_name));
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
ret = maat_scan_string(g_maat_instance, table_id, 0, (char*)udp_payload_not_hit, sizeof(udp_payload_not_hit), ret = maat_scan_string(maat_instance, table_id, 0, (char*)udp_payload_not_hit, sizeof(udp_payload_not_hit),
results, ARRAY_SIZE, &n_hit_result, &state); results, ARRAY_SIZE, &n_hit_result, &state);
EXPECT_EQ(ret, MAAT_SCAN_OK); EXPECT_EQ(ret, MAAT_SCAN_OK);
ret = maat_scan_string(g_maat_instance, table_id, 0, (char*)udp_payload_hit, sizeof(udp_payload_hit), ret = maat_scan_string(maat_instance, table_id, 0, (char*)udp_payload_hit, sizeof(udp_payload_hit),
results, ARRAY_SIZE, &n_hit_result, &state); results, ARRAY_SIZE, &n_hit_result, &state);
EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(results[0], 148); EXPECT_EQ(results[0], 148);

2
test/table_info.conf
View File

@@ -233,7 +233,7 @@
"valid_column":8, "valid_column":8,
"custom": { "custom": {
"scan_mode":"block", "scan_mode":"block",
"pattern_type":"literal", "pattern_type":"regex",
"item_id":1, "item_id":1,
"group_id":2, "group_id":2,
"district":3, "district":3,

50
vendor/CMakeLists.txt vendored
View File

@@ -10,9 +10,9 @@ set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC -Wall")
# GoogleTest # GoogleTest
ExternalProject_Add(GoogleTest PREFIX GoogleTest ExternalProject_Add(GoogleTest PREFIX GoogleTest
URL ${CMAKE_CURRENT_SOURCE_DIR}/googletest-release-1.8.0.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/googletest-release-1.8.0.tar.gz
URL_MD5 16877098823401d1bf2ed7891d7dce36 URL_MD5 16877098823401d1bf2ed7891d7dce36
CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${VENDOR_BUILD} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}) CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${VENDOR_BUILD} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE})
ExternalProject_Get_Property(GoogleTest INSTALL_DIR) ExternalProject_Get_Property(GoogleTest INSTALL_DIR)
file(MAKE_DIRECTORY ${VENDOR_BUILD}/include) file(MAKE_DIRECTORY ${VENDOR_BUILD}/include)
@@ -24,26 +24,26 @@ set_property(TARGET gtest_static PROPERTY INTERFACE_LINK_LIBRARIES pthread)
# colm-0.13.0.5 # colm-0.13.0.5
ExternalProject_Add(colm PREFIX colm ExternalProject_Add(colm PREFIX colm
URL ${CMAKE_CURRENT_SOURCE_DIR}/colm-0.13.0.5.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/colm-0.13.0.5.tar.gz
CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD} CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD}
BUILD_COMMAND make BUILD_COMMAND make
INSTALL_COMMAND make install INSTALL_COMMAND make install
BUILD_IN_SOURCE 1) BUILD_IN_SOURCE 1)
# ragel-7.0.0.10 # ragel-7.0.0.10
ExternalProject_Add(ragel PREFIX ragel ExternalProject_Add(ragel PREFIX ragel
URL ${CMAKE_CURRENT_SOURCE_DIR}/ragel-7.0.0.10.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/ragel-7.0.0.10.tar.gz
CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD} CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD} --with-colm=${VENDOR_BUILD}
DEPENDS colm DEPENDS colm
BUILD_COMMAND make BUILD_COMMAND make
INSTALL_COMMAND make install INSTALL_COMMAND make install
BUILD_IN_SOURCE 1) BUILD_IN_SOURCE 1)
# HyperScan 5.4.0 # HyperScan 5.4.0
ExternalProject_Add(hyperscan PREFIX hyperscan ExternalProject_Add(hyperscan PREFIX hyperscan
URL ${CMAKE_CURRENT_SOURCE_DIR}/hyperscan-5.4.0.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/hyperscan-5.4.0.tar.gz
DEPENDS ragel DEPENDS ragel
CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${VENDOR_BUILD} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC") CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${VENDOR_BUILD} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC")
ExternalProject_Get_Property(hyperscan INSTALL_DIR) ExternalProject_Get_Property(hyperscan INSTALL_DIR)
file(MAKE_DIRECTORY ${VENDOR_BUILD}/include) file(MAKE_DIRECTORY ${VENDOR_BUILD}/include)
@@ -60,8 +60,8 @@ set_property(TARGET hyperscan_runtime_static PROPERTY INTERFACE_INCLUDE_DIRECTOR
# hiredis-1.1.0 # hiredis-1.1.0
ExternalProject_Add(hiredis PREFIX hiredis ExternalProject_Add(hiredis PREFIX hiredis
URL ${CMAKE_CURRENT_SOURCE_DIR}/hiredis-1.1.0.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/hiredis-1.1.0.tar.gz
CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${VENDOR_BUILD} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} -DCMAKE_C_FLAGS="-fPIC") CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${VENDOR_BUILD} -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} -DCMAKE_C_FLAGS="-fPIC")
ExternalProject_Get_Property(hiredis INSTALL_DIR) ExternalProject_Get_Property(hiredis INSTALL_DIR)
file(MAKE_DIRECTORY ${VENDOR_BUILD}/include) file(MAKE_DIRECTORY ${VENDOR_BUILD}/include)
@@ -78,12 +78,12 @@ endif()
#igraph-0.7.1 #igraph-0.7.1
ExternalProject_Add(igraph PREFIX igraph ExternalProject_Add(igraph PREFIX igraph
URL ${CMAKE_CURRENT_SOURCE_DIR}/igraph-0.7.1.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/igraph-0.7.1.tar.gz
URL_MD5 4f6e7c16b45fce8ed423516a9786e4e8 URL_MD5 4f6e7c16b45fce8ed423516a9786e4e8
CONFIGURE_COMMAND ./configure --prefix=${VENDOR_BUILD} --disable-shared --with-pic CONFIGURE_COMMAND ./configure --prefix=${VENDOR_BUILD} --disable-shared --with-pic
BUILD_COMMAND make BUILD_COMMAND make
INSTALL_COMMAND make install INSTALL_COMMAND make install
BUILD_IN_SOURCE 1) BUILD_IN_SOURCE 1)
ExternalProject_Get_Property(igraph INSTALL_DIR) ExternalProject_Get_Property(igraph INSTALL_DIR)
file(MAKE_DIRECTORY ${VENDOR_BUILD}/include) file(MAKE_DIRECTORY ${VENDOR_BUILD}/include)

BIN
vendor/hyperscan-5.4.0.tar.gz vendored
View File

Binary file not shown.