gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复bug：命中未被compile或其它group引用的group时，未将其加入hit path。

Browse Source
This commit is contained in:
zhengchao
2020-04-03 19:44:59 +08:00
parent 737f377511
commit 7f46a386cf
3 changed files with 35 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/entry/Maat_api.cpp
View File

@@ -267,6 +267,20 @@ void scan_hit_status_update_by_group(struct scan_hit_status* hit_status, struct
int ret=0; int ret=0;
struct Maat_hit_path_inner* hit_path=NULL; struct Maat_hit_path_inner* hit_path=NULL;
if(group_rule->top_group_cnt==0)
{
hit_path=ALLOC(struct Maat_hit_path_inner, 1);
hit_path_init(&(hit_path->path));
hit_path->Nth_hit_region=Nth_region_result;
hit_path->path.Nth_scan=Nth_scan;
hit_path->path.region_id=region_id;
hit_path->path.sub_group_id=group_rule->group_id;
hit_path->path.virtual_table_id=virtual_table_id;
TAILQ_INSERT_TAIL(&hit_status->hit_path_qhead, hit_path, entries);
hit_status->hit_path_cnt++;
}
else
{
for(i=0; i<group_rule->top_group_cnt; i++) for(i=0; i<group_rule->top_group_cnt; i++)
{ {
hit_path=ALLOC(struct Maat_hit_path_inner, 1); hit_path=ALLOC(struct Maat_hit_path_inner, 1);
@@ -285,6 +299,7 @@ void scan_hit_status_update_by_group(struct scan_hit_status* hit_status, struct
TO_RELATION_ID(virtual_table_id, group_rule->top_groups[i])); TO_RELATION_ID(virtual_table_id, group_rule->top_groups[i]));
hit_status->all_hit_group_cnt+=ret; hit_status->all_hit_group_cnt+=ret;
} }
}
return; return;
} }
size_t scan_hit_status_update_by_compile(struct scan_hit_status* hit_status, struct Maat_compile_group_relation* compile_rule, int Nth_scan) size_t scan_hit_status_update_by_compile(struct scan_hit_status* hit_status, struct Maat_compile_group_relation* compile_rule, int Nth_scan)

2
src/entry/Maat_rule.cpp
View File

@@ -33,7 +33,7 @@
#include "stream_fuzzy_hash.h" #include "stream_fuzzy_hash.h"
#include "gram_index_engine.h" #include "gram_index_engine.h"
int MAAT_FRAME_VERSION_2_8_20200331=1; int MAAT_FRAME_VERSION_2_8_20200403=1;
int is_valid_table_name(const char* str) int is_valid_table_name(const char* str)
{ {

12
test/test_maatframe.cpp
View File

@@ -745,6 +745,18 @@ TEST(IPScan, IPv4_composition)
EXPECT_EQ(result[0].config_id, 177); EXPECT_EQ(result[0].config_id, 177);
EXPECT_EQ(result[1].config_id, 175); EXPECT_EQ(result[1].config_id, 175);
struct Maat_hit_path_t hit_path[128];
int n_read=0;
n_read=Maat_get_scan_status(g_feather, &mid, MAAT_GET_SCAN_HIT_PATH, hit_path, sizeof(hit_path));
int i=0, c175=0, c177=0;
for(i=0; i<n_read; i++)
{
if(hit_path[i].compile_id==177) c177++;
if(hit_path[i].compile_id==175) c175++;
}
EXPECT_EQ(c177, 1);
EXPECT_EQ(c175, 2);//two paths for source IP hit and destination IP hit
Maat_clean_status(&mid); Maat_clean_status(&mid);
return; return;
} }