rename terminology "not flag" to "negate option"
This commit is contained in:
@@ -572,7 +572,7 @@
|
||||
"custom": {
|
||||
"group_id":1,
|
||||
"rule_id":2,
|
||||
"not_flag":3,
|
||||
"negate_option":3,
|
||||
"attribute_name":4,
|
||||
"condition_index":5
|
||||
}
|
||||
|
||||
@@ -15,9 +15,9 @@ TEST(bool_matcher_match, MultiExprWithSameID) {
|
||||
bool_expr_array->expr_id = 100;
|
||||
bool_expr_array->item_num = 2;
|
||||
bool_expr_array->items[0].item_id = 1;
|
||||
bool_expr_array->items[0].not_flag = 0;
|
||||
bool_expr_array->items[0].negate_option = 0;
|
||||
bool_expr_array->items[1].item_id = 1;
|
||||
bool_expr_array->items[1].not_flag = 0;
|
||||
bool_expr_array->items[1].negate_option = 0;
|
||||
|
||||
size_t mem_size = 0;
|
||||
struct bool_matcher *bm = bool_matcher_new(bool_expr_array, 1, &mem_size);
|
||||
|
||||
@@ -54,7 +54,7 @@
|
||||
"custom": {
|
||||
"group_id":1,
|
||||
"rule_id":2,
|
||||
"not_flag":4,
|
||||
"negate_option":4,
|
||||
"attribute_name":5,
|
||||
"condition_index":6
|
||||
}
|
||||
|
||||
@@ -6845,7 +6845,7 @@ TEST_F(Policy, NotConditionHitPath) {
|
||||
|
||||
EXPECT_EQ(hit_path[0].Nth_scan, 1);
|
||||
EXPECT_EQ(hit_path[0].attribute_id, url_table_id);
|
||||
EXPECT_EQ(hit_path[0].NOT_flag, 0);
|
||||
EXPECT_EQ(hit_path[0].negate_option, 0);
|
||||
EXPECT_EQ(hit_path[0].condition_index, 1);
|
||||
EXPECT_EQ(hit_path[0].sub_group_id, 249);
|
||||
EXPECT_EQ(hit_path[0].top_group_id, 249);
|
||||
@@ -6853,7 +6853,7 @@ TEST_F(Policy, NotConditionHitPath) {
|
||||
|
||||
EXPECT_EQ(hit_path[1].Nth_scan, 2);
|
||||
EXPECT_EQ(hit_path[1].attribute_id, ip_table_id);
|
||||
EXPECT_EQ(hit_path[1].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[1].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[1].condition_index, -1);
|
||||
EXPECT_EQ(hit_path[1].sub_group_id, 100);
|
||||
EXPECT_EQ(hit_path[1].top_group_id, 144);
|
||||
@@ -6861,7 +6861,7 @@ TEST_F(Policy, NotConditionHitPath) {
|
||||
|
||||
EXPECT_EQ(hit_path[2].Nth_scan, 2);
|
||||
EXPECT_EQ(hit_path[2].attribute_id, ip_table_id);
|
||||
EXPECT_EQ(hit_path[2].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[2].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[2].condition_index, -1);
|
||||
EXPECT_EQ(hit_path[2].sub_group_id, 100);
|
||||
EXPECT_EQ(hit_path[2].top_group_id, -1);
|
||||
@@ -6869,7 +6869,7 @@ TEST_F(Policy, NotConditionHitPath) {
|
||||
|
||||
EXPECT_EQ(hit_path[3].Nth_scan, 2);
|
||||
EXPECT_EQ(hit_path[3].attribute_id, ip_table_id);
|
||||
EXPECT_EQ(hit_path[3].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[3].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[3].condition_index, 2);
|
||||
EXPECT_EQ(hit_path[3].sub_group_id, 250);
|
||||
EXPECT_EQ(hit_path[3].top_group_id, 250);
|
||||
@@ -10122,7 +10122,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group1_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, group11_id);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, http_req_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
path_idx++;
|
||||
@@ -10131,7 +10131,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group1_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, http_req_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
int http_res_table_id = maat_get_table_id(maat_inst, "HTTP_RESPONSE_HEADER");
|
||||
@@ -10164,7 +10164,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].item_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group1_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, group11_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
path_idx++;
|
||||
@@ -10173,7 +10173,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].item_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group1_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, group1_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 1);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, rule1_id);
|
||||
|
||||
path_idx++;
|
||||
@@ -10183,7 +10183,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group2_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, group21_id);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, http_res_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, rule1_id);
|
||||
|
||||
path_idx++;
|
||||
@@ -10193,7 +10193,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group2_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, http_res_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
const char *keywords1 = "In math theory, a finite and infinite come up all the time.";
|
||||
@@ -10225,7 +10225,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group4_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, keywords_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
int ip_table_id = maat_get_table_id(maat_inst, ip_table_name);
|
||||
@@ -10255,7 +10255,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group3_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, ip_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
Nth_scan++;
|
||||
@@ -10280,7 +10280,7 @@ TEST_F(MaatCmd, HitPathHasNotGroup) {
|
||||
EXPECT_EQ(hit_path[path_idx].sub_group_id, group4_id);
|
||||
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
|
||||
EXPECT_EQ(hit_path[path_idx].attribute_id, keywords_table_id);
|
||||
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].negate_option, 0);
|
||||
EXPECT_EQ(hit_path[path_idx].rule_id, -1);
|
||||
|
||||
maat_stream_free(stream);
|
||||
|
||||
@@ -735,7 +735,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "143_url_group1",
|
||||
"group_id": 121,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -751,7 +751,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "143_url_group2",
|
||||
"group_id": 122,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -778,7 +778,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "144_url_group",
|
||||
"group_id": 123,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -794,7 +794,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS",
|
||||
"group_name": "144_keywords_group",
|
||||
"group_id": 124,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "KEYWORDS_TABLE",
|
||||
@@ -821,7 +821,7 @@
|
||||
"attribute": "HTTP_URL",
|
||||
"group_name": "145_url_group",
|
||||
"group_id": 125,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -836,7 +836,7 @@
|
||||
{
|
||||
"attribute": "ATTRIBUTE_IP_CONFIG",
|
||||
"group_name": "123_IP_group",
|
||||
"not_flag": 1
|
||||
"negate_option": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -853,7 +853,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "146_url_group",
|
||||
"group_id": 126,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -870,7 +870,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS",
|
||||
"group_name": "146_keywords_group",
|
||||
"group_id": 127,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -886,7 +886,7 @@
|
||||
{
|
||||
"attribute": "ATTRIBUTE_IP_CONFIG",
|
||||
"group_name": "123_IP_group",
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 2
|
||||
}
|
||||
]
|
||||
@@ -904,7 +904,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_1",
|
||||
"group_name": "147_keywords_group1",
|
||||
"group_id": 128,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -921,7 +921,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_2",
|
||||
"group_name": "147_keywords_group2",
|
||||
"group_id": 129,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -938,7 +938,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_3",
|
||||
"group_name": "147_keywords_group3",
|
||||
"group_id": 130,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 2,
|
||||
"regions": [
|
||||
{
|
||||
@@ -955,7 +955,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_4",
|
||||
"group_name": "147_keywords_group4",
|
||||
"group_id": 131,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 3,
|
||||
"regions": [
|
||||
{
|
||||
@@ -972,7 +972,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_5",
|
||||
"group_name": "147_keywords_group5",
|
||||
"group_id": 132,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 4,
|
||||
"regions": [
|
||||
{
|
||||
@@ -989,7 +989,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_6",
|
||||
"group_name": "147_keywords_group6",
|
||||
"group_id": 133,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 5,
|
||||
"regions": [
|
||||
{
|
||||
@@ -1006,7 +1006,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_7",
|
||||
"group_name": "147_keywords_group7",
|
||||
"group_id": 134,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 6,
|
||||
"regions": [
|
||||
{
|
||||
@@ -1023,7 +1023,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS_8",
|
||||
"group_name": "147_keywords_group8",
|
||||
"group_id": 135,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 7,
|
||||
"regions": [
|
||||
{
|
||||
@@ -1215,7 +1215,7 @@
|
||||
"attribute": "MAIL_ADDR",
|
||||
"group_name": "153_expr_group",
|
||||
"group_id": 143,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
@@ -1258,7 +1258,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "154_IP_group",
|
||||
"group_id": 145,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -1284,7 +1284,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "155_IP_group",
|
||||
"group_id": 146,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -1412,13 +1412,13 @@
|
||||
{
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS",
|
||||
"group_name": "TakeMeHome",
|
||||
"not_flag": 0
|
||||
"negate_option": 0
|
||||
},
|
||||
{
|
||||
"attribute": "HTTP_URL",
|
||||
"group_name": "160_url_group",
|
||||
"group_id": 151,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -1445,7 +1445,7 @@
|
||||
"attribute": "HTTP_SIGNATURE",
|
||||
"group_name": "vt_grp_http_sig1",
|
||||
"group_id": 152,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
@@ -1462,7 +1462,7 @@
|
||||
"attribute": "HTTP_SIGNATURE",
|
||||
"group_name": "vt_grp_http_sig2",
|
||||
"group_id": 153,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
@@ -1498,12 +1498,12 @@
|
||||
{
|
||||
"attribute": "HTTP_REQUEST_HEADER",
|
||||
"group_name": "vt_grp_http_sig1",
|
||||
"not_flag": 0
|
||||
"negate_option": 0
|
||||
},
|
||||
{
|
||||
"attribute": "HTTP_RESPONSE_HEADER",
|
||||
"group_name": "vt_grp_http_sig2",
|
||||
"not_flag": 0
|
||||
"negate_option": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -1519,12 +1519,12 @@
|
||||
{
|
||||
"attribute": "HTTP_REQUEST_HEADER",
|
||||
"group_name": "vt_grp_http_sig2",
|
||||
"not_flag": 0
|
||||
"negate_option": 0
|
||||
},
|
||||
{
|
||||
"attribute": "HTTP_RESPONSE_HEADER",
|
||||
"group_name": "vt_grp_http_sig2",
|
||||
"not_flag": 0
|
||||
"negate_option": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -1583,7 +1583,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "165_IP_group",
|
||||
"group_id": 156,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -1695,7 +1695,7 @@
|
||||
"group_name": "169_IP_group",
|
||||
"group_id": 160,
|
||||
"condition_index": 0,
|
||||
"not_flag" : 0,
|
||||
"negate_option" : 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -1721,7 +1721,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "ipv4_attribute.source",
|
||||
"group_id": 161,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -1747,7 +1747,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "ipv4_attribute.destination",
|
||||
"group_id": 162,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -1772,13 +1772,13 @@
|
||||
{
|
||||
"attribute": "ASN_NOT_LOGIC",
|
||||
"group_name": ["ASN1234", "ASN6789", "ASN9001"],
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "DESTINATION_IP_ASN",
|
||||
"group_name": "ASN2345",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1
|
||||
}
|
||||
]
|
||||
@@ -1795,13 +1795,13 @@
|
||||
{
|
||||
"attribute": "SOURCE_IP_ASN",
|
||||
"group_name": ["ASN1234", "ASN6789", "ASN9001"],
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "DESTINATION_IP_ASN",
|
||||
"group_name": "ASN2345",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1
|
||||
}
|
||||
]
|
||||
@@ -1844,19 +1844,19 @@
|
||||
{
|
||||
"attribute": "SOURCE_IP_ASN",
|
||||
"group_name": ["ASN1234", "ASN6789", "ASN9001"],
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "SOURCE_IP_GEO",
|
||||
"group_name": "Country-Sparta-IP",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "IP_CONFIG",
|
||||
"group_name": "financial-department-ip",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1
|
||||
}
|
||||
]
|
||||
@@ -1873,19 +1873,19 @@
|
||||
{
|
||||
"attribute": "SOURCE_IP_ASN",
|
||||
"group_name": ["ASN1234", "ASN6789", "ASN9001"],
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "develop-department-ip",
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "SOURCE_IP_GEO",
|
||||
"group_name": "Country-Sparta-IP",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1
|
||||
}
|
||||
]
|
||||
@@ -1954,31 +1954,31 @@
|
||||
{
|
||||
"attribute": "DESTINATION_IP_ASN",
|
||||
"group_name": ["ASN1234", "ASN6789", "ASN9001"],
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "SOURCE_IP_GEO",
|
||||
"group_name": "Country-Sparta-IP",
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "DESTINATION_IP_ASN",
|
||||
"group_name": "ASN9002",
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1
|
||||
},
|
||||
{
|
||||
"attribute": "DESTINATION_IP_ASN",
|
||||
"group_name": "ASN9003",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 2
|
||||
},
|
||||
{
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "security-department-ip",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 3
|
||||
}
|
||||
]
|
||||
@@ -1996,7 +1996,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "186_expr_group",
|
||||
"group_id": 170,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -2012,7 +2012,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "186_IP_group",
|
||||
"group_id": 171,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -2038,7 +2038,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "187_url_group",
|
||||
"group_id": 172,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -2054,7 +2054,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "187_IP_group",
|
||||
"group_id": 173,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -2080,7 +2080,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "188_url_group",
|
||||
"group_id": 174,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -2096,7 +2096,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "188_IP_group",
|
||||
"group_id": 175,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -2841,7 +2841,7 @@
|
||||
"attribute": "IP_PLUS_CONFIG",
|
||||
"group_name": "208_IP_group",
|
||||
"group_id": 213,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -2918,7 +2918,7 @@
|
||||
"attribute": "IP_PERF_CONFIG",
|
||||
"group_name": "211_IP_group",
|
||||
"group_id": 216,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_type":"ip",
|
||||
@@ -3046,14 +3046,14 @@
|
||||
{
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "ExcludeLogicGroup200",
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0
|
||||
},
|
||||
{
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS",
|
||||
"group_name": "NOTConditionAndExcludeGroup216",
|
||||
"group_id": 221,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3081,7 +3081,7 @@
|
||||
"attribute": "HTTP_URL_FILTER",
|
||||
"group_name": "NOTConditionAndExcludeGroup217_1",
|
||||
"group_id": 222,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0,
|
||||
"sub_groups": [
|
||||
{
|
||||
@@ -3120,7 +3120,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS",
|
||||
"group_name": "NOTConditionAndExcludeGroup217_2",
|
||||
"group_id": 225,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3173,7 +3173,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_1",
|
||||
"group_id": 227,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3190,7 +3190,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_2",
|
||||
"group_id": 228,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3207,7 +3207,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_3",
|
||||
"group_id": 229,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 2,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3224,7 +3224,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_4",
|
||||
"group_id": 230,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 3,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3241,7 +3241,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_5",
|
||||
"group_id": 231,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 4,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3258,7 +3258,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_6",
|
||||
"group_id": 232,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 5,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3275,7 +3275,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_7",
|
||||
"group_id": 233,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 6,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3292,7 +3292,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup219_8",
|
||||
"group_id": 234,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 7,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3320,7 +3320,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup220_1",
|
||||
"group_id": 235,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3337,7 +3337,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup220_2",
|
||||
"group_id": 236,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3354,7 +3354,7 @@
|
||||
"attribute": "HTTP_DUMMY",
|
||||
"group_name": "NOTConditionAndExcludeGroup220_3",
|
||||
"group_id": 237,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 2,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3382,7 +3382,7 @@
|
||||
"attribute": "HTTP_REQUEST_HEADER",
|
||||
"group_name": "NOTLogicGroup_221_1",
|
||||
"group_id": 238,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
@@ -3399,7 +3399,7 @@
|
||||
"attribute": "HTTP_URL",
|
||||
"group_name": "NOTLogicGroup_221_2",
|
||||
"group_id": 239,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
@@ -3426,7 +3426,7 @@
|
||||
"attribute": "HTTP_NOT_LOGIC_1",
|
||||
"group_name": "NOTLogicGroup_222",
|
||||
"group_id": 240,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3454,7 +3454,7 @@
|
||||
"attribute": "HTTP_NOT_LOGIC",
|
||||
"group_name": "NOTLogicGroup_223_1",
|
||||
"group_id": 241,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3471,7 +3471,7 @@
|
||||
"attribute": "HTTP_NOT_LOGIC",
|
||||
"group_name": "NOTLogicGroup_223_2",
|
||||
"group_id": 242,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3488,7 +3488,7 @@
|
||||
"attribute": "HTTP_NOT_LOGIC",
|
||||
"group_name": "NOTLogicGroup_223_1",
|
||||
"group_id": 243,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 2,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3516,7 +3516,7 @@
|
||||
"attribute": "KEYWORDS_TABLE",
|
||||
"group_name": "NOTLogicGroup_224_1",
|
||||
"group_id": 244,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3533,7 +3533,7 @@
|
||||
"attribute": "HTTP_RESPONSE_KEYWORDS",
|
||||
"group_name": "NOTLogicGroup_224_2",
|
||||
"group_id": 245,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3561,7 +3561,7 @@
|
||||
"attribute": "KEYWORDS_TABLE",
|
||||
"group_name": "EscapeGroup_225_1",
|
||||
"group_id": 246,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3623,7 +3623,7 @@
|
||||
"attribute": "HTTP_URL",
|
||||
"group_name": "228_url_group",
|
||||
"group_id": 249,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 1,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3640,7 +3640,7 @@
|
||||
"attribute": "ATTRIBUTE_IP_CONFIG",
|
||||
"group_name": "228_IP_group",
|
||||
"group_id": 250,
|
||||
"not_flag": 1,
|
||||
"negate_option": 1,
|
||||
"condition_index": 2,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3787,7 +3787,7 @@
|
||||
"attribute": "KEYWORDS_TABLE",
|
||||
"group_name": "EscapeGroup_234_1",
|
||||
"group_id": 260,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
@@ -3815,7 +3815,7 @@
|
||||
"attribute": "KEYWORDS_TABLE",
|
||||
"group_name": "EscapeGroup_235_1",
|
||||
"group_id": 261,
|
||||
"not_flag": 0,
|
||||
"negate_option": 0,
|
||||
"condition_index": 0,
|
||||
"regions": [
|
||||
{
|
||||
|
||||
@@ -47,7 +47,7 @@
|
||||
"custom": {
|
||||
"group_id":1,
|
||||
"rule_id":2,
|
||||
"not_flag":3,
|
||||
"negate_option":3,
|
||||
"attribute_name":4,
|
||||
"condition_index":5
|
||||
}
|
||||
@@ -84,7 +84,7 @@
|
||||
"custom": {
|
||||
"group_id":1,
|
||||
"rule_id":2,
|
||||
"not_flag":3,
|
||||
"negate_option":3,
|
||||
"attribute_name":4,
|
||||
"condition_index":5
|
||||
}
|
||||
|
||||
@@ -170,13 +170,13 @@ int rule_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
|
||||
int group2rule_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
enum maat_operation op, long long group_id,
|
||||
long long rule_id, int not_flag,
|
||||
long long rule_id, int negate_option,
|
||||
const char *attribute_name, int condition_index,
|
||||
int expire_after)
|
||||
{
|
||||
char table_line[128] = {0};
|
||||
sprintf(table_line, "%lld\t%lld\t%d\t%s\t%d\t%d",
|
||||
group_id, rule_id, not_flag, attribute_name, condition_index, op);
|
||||
group_id, rule_id, negate_option, attribute_name, condition_index, op);
|
||||
|
||||
struct maat_cmd_line line_rule;
|
||||
line_rule.rule_id = TO_GROUP2X_KEY(group_id, rule_id, condition_index);
|
||||
|
||||
@@ -20,7 +20,7 @@ int rule_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
|
||||
int group2rule_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
enum maat_operation op, long long group_id,
|
||||
long long rule_id, int not_flag,
|
||||
long long rule_id, int negate_option,
|
||||
const char *attribute_name, int condition_index,
|
||||
int expire_after);
|
||||
|
||||
|
||||
Reference in New Issue
Block a user