增加带偏移量字符串扫描的测试用例。

src/entry/Maat_rule.cpp

@@ -30,7 +30,7 @@
 #include "stream_fuzzy_hash.h"
 #include "gram_index_engine.h"
 
-int MAAT_FRAME_VERSION_2_1_20171010=1;
+int MAAT_FRAME_VERSION_2_1_20171011=1;
 
 const char* CHARSET_STRING[]={"NONE","gbk","big5","unicode","utf8","bin",
 							"unicode_ascii_esc","unicode_ascii_aligned","unicode_ncr_dec","unicode_ncr_hex","url_encode_gb2312","url_encode_utf8",""};

test/maat_json.json

@@ -402,6 +402,33 @@
                     ]
                 }
             ]
+        },
+        {
+            "compile_id": 136,
+            "service": 1,
+            "action": 1,
+            "do_blacklist": 1,
+            "do_log": 1,
+            "effective_range": 0,
+            "user_region": "offset_string",
+            "is_valid": "yes",
+            "groups": [
+                {
+                    "group_name": "Untitled",
+                    "regions": [
+                        {
+                            "table_name": "IMAGE_FP",
+                            "table_type": "string",
+                            "table_content": {
+                                "keywords": "4362-4458:323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000",
+                                "expr_type": "offset",
+                                "match_method": "none",
+                                "format": "hexbin"
+                            }
+                        }
+                    ]
+                }
+            ]
         }
     ],
     "plugin_table": [

test/maat_test.cpp

@@ -466,6 +466,56 @@ int test_string_similar_scan(Maat_feather_t feather,const char* table_name,scan_
 	printf("Similar String Scan:%s\n",print_maat_result(result,ret));
 	return ret;
 }
+int test_offset_str_scan(Maat_feather_t feather,const char* table_name,scan_status_t* mid)
+{
+	int table_id=0,ret=0;
+	int read_size=0,pass_flag=0;
+	struct Maat_rule_t result[4];
+	const char* fn="./testdata/mesa_logo.jpg";
+	FILE*fp=fopen(fn,"r");
+	if(fp==NULL)
+	{
+		printf("%s open %s failed.\n",__FUNCTION__, fn);
+		return -1;
+	}
+	char scan_data[64];
+	table_id=Maat_table_register(feather,table_name);
+	if(table_id==-1)
+	{
+		printf("Database table %s register failed.\n",table_name);
+		return -1;
+	}
+	struct Maat_hit_detail_t *hit_detail=(struct Maat_hit_detail_t *)malloc(sizeof(struct Maat_hit_detail_t)*10);
+	stream_para_t sp=Maat_stream_scan_string_start(feather,table_id,0);
+	int detail_ret=0;
+	if(sp==NULL)
+	{
+		printf("stream scan start failed.\n");
+		return -1;
+	}
+	while(0==feof(fp))
+	{
+		read_size=fread(scan_data,1,sizeof(scan_data),fp);
+		ret=Maat_stream_scan_string_detail(&sp,CHARSET_NONE,scan_data,read_size
+							,result,4,hit_detail,10
+							,&detail_ret,mid);
+		if(ret>0)
+		{
+			printf("Test offset string Scan Success. String Scan:%s\n",print_maat_result(result,ret));
+			pass_flag=1;
+			break;
+		}
+	}
+	Maat_stream_scan_string_end(&sp);
+	free(hit_detail);
+	fclose(fp);
+	if(!pass_flag)
+	{
+		printf("Test offset string Scan Failed.\n");
+	}
+	return ret;
+}
+
 int test_table_conjunction(Maat_feather_t feather,const char* table_name,const char* conj_table_name,scan_status_t* mid)
 {
 	int ret=0;
@@ -875,6 +925,10 @@ int main(int argc,char* argv[])
 
 	test_table_conjunction(feather, "HTTP_URL", "HTTP_HOST", &mid);
 	Maat_clean_status(&mid);
+	
+	test_offset_str_scan(feather,"IMAGE_FP",&mid);
+	Maat_clean_status(&mid);
+	
 	if(1==using_redis)
 	{
 		test_command(feather);

test/table_info.conf

@@ -4,8 +4,17 @@
 #type one of ip,expr,expr_plus,digest,intval,compile or plugin
 #src_charset one of GBK,BIG5,UNICODE,UTF8
 #dst_charset combined by GBK,BIG5,UNICODE,UTF8,seperate with '/'
-#do_merege yes or no
+#do_merege [yes/no]
-#id	name	type	src_charset	dst_charset	do_merge
+#cross cache [number]
+#quick mode [quickon/quickoff], default [quickoff]
+#For ip/intval/digest/compile/group
+#id	name	type
+#
+#For plugin table
+#id	name	type	valid_column
+#
+#For expr/expr_plus Table
+#id	name	type	src_charset	dst_charset	do_merge cross_cache quick_mode
 0	COMPILE	compile	--
 1	GROUP	group	--
 2	HTTP_URL	expr	UTF8	GBK/BIG5/UNICODE/UTF8/url_encode_gb2312/url_encode_utf8	yes	128	quickoff
@@ -17,3 +26,4 @@
 7	FILE_DIGEST	digest	--
 8	HTTP_REGION	expr_plus	GBK	GBK	no	0
 9	SIM_URL	similar	--
+10	IMAGE_FP	expr	UTF8	UTF8	yes	128	quickoff