diff --git a/src/inc_internal/maat_rule.h b/src/inc_internal/maat_rule.h index c77db0f..edd80ee 100644 --- a/src/inc_internal/maat_rule.h +++ b/src/inc_internal/maat_rule.h @@ -22,6 +22,7 @@ extern "C" #include #include #include +#include #include #include "hiredis/hiredis.h" @@ -247,6 +248,10 @@ struct maat_state { struct maat_compile_state *compile_state; }; +int my_scandir(const char *dir, struct dirent ***namelist, + int(*filter)(const struct dirent *), + int(*compar)(const void *, const void *)); + enum scan_type maat_table_get_scan_type(enum table_type table_type); size_t parse_accept_tag(const char *value, struct rule_tag **result, struct log_handle *logger); diff --git a/src/maat_api.c b/src/maat_api.c index d59f613..0bbc31c 100644 --- a/src/maat_api.c +++ b/src/maat_api.c @@ -194,12 +194,12 @@ int maat_options_set_deferred_load_on(struct maat_options *opts) int maat_options_set_stat_on(struct maat_options *opts) { - + return 0; } int maat_options_set_perf_on(struct maat_options *opts) { - + return 0; } int maat_options_set_foreign_cont_dir(struct maat_options *opts, const char *dir) @@ -353,6 +353,18 @@ struct maat *maat_new(struct maat_options *opts, const char *table_info_path) maat_instance->logger = log_handle_create(log_path, opts->log_level); } + if (0 == strlen(opts->foreign_cont_dir)) { + snprintf(maat_instance->foreign_cont_dir, sizeof(maat_instance->foreign_cont_dir), + "%s_files", table_info_path); + } else { + memcpy(maat_instance->foreign_cont_dir, opts->foreign_cont_dir, strlen(opts->foreign_cont_dir)); + size_t len = strlen(maat_instance->foreign_cont_dir); + if (maat_instance->foreign_cont_dir[len - 1] == '/') { + maat_instance->foreign_cont_dir[len - 1] = '\0'; + } + } + system_cmd_mkdir(maat_instance->foreign_cont_dir); + maat_instance->input_mode = opts->input_mode; switch (maat_instance->input_mode) { @@ -1203,9 +1215,6 @@ int maat_scan_flag(struct maat *maat_instance, int table_id, state->scan_cnt++; if (NULL == maat_instance->maat_rt) { - log_error(maat_instance->logger, MODULE_MAAT_API, - "[%s:%d] table(table_id:%d) thread_id:%d maat_scan_flag error because of maat_runtime is NULL", - __FUNCTION__, __LINE__, table_id, state->thread_id); return MAAT_SCAN_OK; } @@ -1276,9 +1285,6 @@ int maat_scan_integer(struct maat *maat_instance, int table_id, state->scan_cnt++; if (NULL == maat_instance->maat_rt) { - log_error(maat_instance->logger, MODULE_MAAT_API, - "[%s:%d] table(table_id:%d) thread_id:%d maat_scan_integer error because of maat_runtime is NULL", - __FUNCTION__, __LINE__, table_id, state->thread_id); return MAAT_SCAN_OK; } @@ -1350,9 +1356,6 @@ int maat_scan_ipv4(struct maat *maat_instance, int table_id, state->scan_cnt++; if (NULL == maat_instance->maat_rt) { - log_error(maat_instance->logger, MODULE_MAAT_API, - "[%s:%d] table(table_id:%d) thread_id:%d maat_scan_ipv4 error because of maat_runtime is NULL", - __FUNCTION__, __LINE__, table_id, state->thread_id); return MAAT_SCAN_OK; } @@ -1432,9 +1435,6 @@ int maat_scan_ipv6(struct maat *maat_instance, int table_id, state->scan_cnt++; if (NULL == maat_instance->maat_rt) { - log_error(maat_instance->logger, MODULE_MAAT_API, - "[%s:%d] table(table_id:%d) thread_id:%d maat_scan_ipv6 error because of maat_runtime is NULL", - __FUNCTION__, __LINE__, table_id, state->thread_id); return MAAT_SCAN_OK; } @@ -1513,9 +1513,6 @@ int maat_scan_string(struct maat *maat_instance, int table_id, const char *data, state->scan_cnt++; if (NULL == maat_instance->maat_rt) { - log_error(maat_instance->logger, MODULE_MAAT_API, - "[%s:%d] table(table_id:%d) thread_id:%d maat_scan_string error because of maat_runtime is NULL", - __FUNCTION__, __LINE__, table_id, state->thread_id); return MAAT_SCAN_OK; } diff --git a/src/maat_compile.c b/src/maat_compile.c index c456da4..203785f 100644 --- a/src/maat_compile.c +++ b/src/maat_compile.c @@ -121,6 +121,7 @@ struct maat_compile { char table_name[NAME_MAX]; int actual_clause_num; int declared_clause_num; + double evaluation_order; int not_clause_cnt; void *user_data; void (*user_data_free)(void *); @@ -289,6 +290,15 @@ void *compile_schema_new(cJSON *json, struct table_manager *tbl_mgr, goto error; } + custom_item = cJSON_GetObjectItem(item, "evaluation_order"); + if (custom_item != NULL && custom_item->type == cJSON_Number) { + compile_schema->evaluation_order_column = custom_item->valueint; + } else { + log_error(logger, MODULE_COMPILE, + "[%s:%d] table %s has no evaluation_order column", table_name); + goto error; + } + compile_schema->ref_tbl_mgr = tbl_mgr; return compile_schema; error: @@ -478,6 +488,16 @@ compile_item_new(const char *line, struct compile_schema *compile_schema, } compile_item->declared_clause_num = atoi(line + column_offset); + ret = get_column_pos(line, compile_schema->evaluation_order_column, + &column_offset, &column_len); + if (ret < 0) { + log_error(logger, MODULE_COMPILE, + "[%s:%d] compile table(table_id:%d) line:%s has no evaluation_order", + __FUNCTION__, __LINE__, compile_schema->table_id, line); + goto error; + } + compile_item->evaluation_order = atof(line + column_offset); + return compile_item; error: FREE(compile_item); @@ -755,8 +775,8 @@ struct maat_compile *maat_compile_new(long long compile_id) } int maat_compile_set(struct maat_compile *compile, const char *table_name, - int declared_clause_num, void *user_data, - void (*user_data_free)(void *)) + double evaluation_order, int declared_clause_num, + void *user_data, void (*user_data_free)(void *)) { if (user_data != NULL && NULL == user_data_free) { return -1; @@ -764,6 +784,7 @@ int maat_compile_set(struct maat_compile *compile, const char *table_name, memset(compile->table_name, 0, sizeof(compile->table_name)); memcpy(compile->table_name, table_name, sizeof(compile->table_name)); + compile->evaluation_order = evaluation_order; compile->declared_clause_num = declared_clause_num; compile->user_data = user_data; compile->user_data_free = user_data_free; @@ -808,8 +829,9 @@ void maat_compile_hash_set(struct maat_compile **compile_hash, long long compile assert(tmp_compile != NULL); assert(tmp_compile->user_data == NULL); - maat_compile_set(tmp_compile, table_name, compile->declared_clause_num, - compile->user_data, compile->user_data_free); + maat_compile_set(tmp_compile, table_name, compile->evaluation_order, + compile->declared_clause_num, compile->user_data, + compile->user_data_free); } @@ -1465,13 +1487,13 @@ void compile_item_to_compile_rule(struct compile_item *compile_item, const char *table_line) { compile_rule->magic_num = COMPILE_RULE_MAGIC; + compile_rule->evaluation_order = compile_item->evaluation_order; compile_rule->declared_clause_num = compile_item->declared_clause_num; compile_rule->ref_table = compile_schema; compile_rule->ex_data = ALLOC(void *, 1); compile_rule->table_line_len = strlen(table_line) + 1; compile_rule->table_line = ALLOC(char, compile_rule->table_line_len); memcpy(compile_rule->table_line, table_line, compile_rule->table_line_len); - compile_rule->evaluation_order = compile_item->evaluation_order; if (compile_schema->ex_schema != NULL) { *(compile_rule->ex_data) = rule_ex_data_new(table_name, compile_schema->table_id, @@ -1600,7 +1622,8 @@ int compile_runtime_update(void *compile_runtime, void *compile_schema, return -1; } - maat_compile_set(compile, table_name, compile_rule->declared_clause_num, compile_rule, + maat_compile_set(compile, table_name, compile_rule->evaluation_order, + compile_rule->declared_clause_num, compile_rule, (void (*)(void *))destroy_compile_rule); struct maat_compile *tmp_compile = maat_compile_hash_find(&(compile_rt->compile_hash), compile_id); if (tmp_compile != NULL) { diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt index 1c565ce..5748ed2 100644 --- a/test/CMakeLists.txt +++ b/test/CMakeLists.txt @@ -29,4 +29,5 @@ file(COPY literal_expr.conf DESTINATION ./) file(COPY regex_expr.conf DESTINATION ./) file(COPY maat_json.json DESTINATION ./) file(COPY ntcrule DESTINATION ./) -file(COPY testdata DESTINATION ./) \ No newline at end of file +file(COPY testdata DESTINATION ./) +file(COPY test_streamfiles DESTINATION ./) \ No newline at end of file diff --git a/test/file_test_tableinfo.conf b/test/file_test_tableinfo.conf index c633e7b..de233a4 100644 --- a/test/file_test_tableinfo.conf +++ b/test/file_test_tableinfo.conf @@ -1,7 +1,8 @@ [ { "table_id":0, - "table_name":["NTC_COMPILE", "WHITE_LIST_COMPILE"], + "table_name": "FILE_COMPILE", + "db_tables": ["NTC_COMPILE", "WHITE_LIST_COMPILE"], "table_type":"compile", "valid_column":8, "custom": { @@ -39,14 +40,18 @@ "table_id":3, "table_name":"NTC_UNIVERSAL_IP", "table_type":"ip_plus", - "valid_column":18, + "valid_column":11, "custom": { "item_id":1, "group_id":2, "addr_type":3, - "saddr_format":4, - "sip1":5, - "sip2":6 + "addr_format":4, + "ip1":5, + "ip2":6, + "port_format":7, + "port1":8, + "port2":9, + "protocol":10 } }, { @@ -65,23 +70,27 @@ "table_id":5, "table_name":"WHITE_LIST_IP", "table_type":"ip_plus", - "valid_column":18, + "valid_column":11, "custom": { "item_id":1, "group_id":2, "addr_type":3, - "saddr_format":4, - "sip1":5, - "sip2":6 + "addr_format":4, + "ip1":5, + "ip2":6, + "port_format":7, + "port1":8, + "port2":9, + "protocol":10 } }, { "table_id":7, - "table_name":["NTC_HTTP_URL", "WHITE_LIST_DOMAIN"], + "table_name":"FILE_HTTP_URL", + "db_tables": ["NTC_HTTP_URL", "WHITE_LIST_DOMAIN"], "table_type":"expr", "valid_column":7, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "keywords":3, @@ -92,11 +101,11 @@ }, { "table_id":8, - "table_name":["NTC_HTTP_REQ_HDR", "NTC_HTTP_RES_HDR"], + "table_name":"FILE_HTTP_HDR_REGION", + "db_tables":["NTC_HTTP_REQ_HDR", "NTC_HTTP_RES_HDR"], "table_type":"expr_plus", "valid_column":8, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "district":3, @@ -108,11 +117,11 @@ }, { "table_id":9, - "table_name":["NTC_HTTP_REQ_BODY", "NTC_HTTP_RES_BODY"], + "table_name":"FILE_HTTP_BODY_REGION", + "db_tables":["NTC_HTTP_REQ_BODY", "NTC_HTTP_RES_BODY"], "table_type":"expr", "valid_column":7, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "keywords":3, @@ -127,7 +136,6 @@ "table_type":"expr_plus", "valid_column":8, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "district":3, @@ -143,7 +151,6 @@ "table_type":"expr_plus", "valid_column":8, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "district":3, @@ -159,7 +166,6 @@ "table_type":"expr", "valid_column":7, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "keywords":3, @@ -174,7 +180,6 @@ "table_type":"expr", "valid_column":7, "custom": { - "pattern_type":"literal", "item_id":1, "group_id":2, "keywords":3, diff --git a/test/maat_framework_gtest.cpp b/test/maat_framework_gtest.cpp index 490f57e..ac232e3 100644 --- a/test/maat_framework_gtest.cpp +++ b/test/maat_framework_gtest.cpp @@ -1,4 +1,6 @@ #include +#include +#include #include "maat.h" #include "maat_rule.h" @@ -2782,31 +2784,69 @@ TEST_F(Policy, CompileEXData) { TEST_F(Policy, SubGroup) { long long results[ARRAY_SIZE] = {0}; size_t n_hit_result = 0; - struct maat_state *state = NULL; + int thread_id = 0; + struct maat *maat_instance = Policy::_shared_maat_instance; + struct maat_state *state = maat_state_new(maat_instance, thread_id); const char *scan_data = "ceshi6@mailhost.cn"; - uint32_t sip; - inet_pton(AF_INET,"10.0.6.205", &sip); + uint32_t ip_addr; + inet_pton(AF_INET,"10.0.6.205", &ip_addr); + uint16_t port = htons(50001); - int table_id = maat_get_table_id(g_maat_instance, "MAIL_ADDR"); + int table_id = maat_get_table_id(maat_instance, "MAIL_ADDR"); ASSERT_GT(table_id, 0); - int ret = maat_scan_string(g_maat_instance, table_id, scan_data, strlen(scan_data), - results, ARRAY_SIZE, &n_hit_result, &state); + int ret = maat_scan_string(maat_instance, table_id, scan_data, strlen(scan_data), + results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); - table_id = maat_get_table_id(g_maat_instance, "IP_CONFIG"); + table_id = maat_get_table_id(maat_instance, "IP_CONFIG"); ASSERT_GT(table_id, 0); - ret = maat_scan_ipv4(g_maat_instance, table_id, sip, results, ARRAY_SIZE, - &n_hit_result, &state); + ret = maat_scan_ipv4(maat_instance, table_id, ip_addr, port, 6, + results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(results[0], 153); - maat_state_free(&state); + maat_state_free(state); } #endif +TEST_F(Policy, EvaluationOrder) { + const char *url = "cavemancircus.com/2019/12/27/pretty-girls-6/"; + long long results[ARRAY_SIZE] = {0}; + size_t n_hit_result = 0; + int thread_id = 0; + struct maat *maat_instance = Policy::_shared_maat_instance; + struct maat_state *state = maat_state_new(maat_instance, thread_id); + + int table_id = maat_get_table_id(maat_instance, "HTTP_URL"); + ASSERT_GT(table_id, 0); + + int ret = maat_scan_string(maat_instance, table_id, url, strlen(url), + results, ARRAY_SIZE, &n_hit_result, state); + EXPECT_EQ(ret, MAAT_SCAN_HIT); + EXPECT_EQ(n_hit_result, 3); + EXPECT_EQ(results[0], 166); + EXPECT_EQ(results[1], 167); + EXPECT_EQ(results[2], 168); + + uint32_t ip_addr; + inet_pton(AF_INET, "192.168.23.23", &ip_addr); + uint16_t port = htons(65530); + + table_id = maat_get_table_id(maat_instance, "IP_PLUS_CONFIG"); + ASSERT_GT(table_id, 0); + + memset(results, 0, sizeof(results)); + ret = maat_scan_ipv4(maat_instance, table_id, ip_addr, port, 6, + results, ARRAY_SIZE, &n_hit_result, state); + EXPECT_EQ(ret, MAAT_SCAN_HIT); + EXPECT_EQ(n_hit_result, 1); + EXPECT_EQ(results[0], 165); + maat_state_free(state); +} + TEST_F(Policy, ReadColumn) { const char *ip = "192.168.0.1"; const char *tmp = "something"; @@ -2897,10 +2937,16 @@ protected: static void SetUpTestCase() { const char *rule_folder = "./ntcrule/full/index"; const char *table_info = "./file_test_tableinfo.conf"; + int scan_interval_ms = 500; + int effective_interval_ms = 0; struct maat_options *opts = maat_options_new(); + maat_options_set_caller_thread_number(opts, g_thread_num); + maat_options_set_instance_name(opts, "files"); maat_options_set_iris(opts, rule_folder, rule_folder); - maat_options_set_logger(opts, "./maat_input_mode_gtest.log", LOG_LEVEL_INFO); + maat_options_set_rule_update_checking_interval_ms(opts, scan_interval_ms); + maat_options_set_rule_effect_interval_ms(opts, effective_interval_ms); + maat_options_set_logger(opts, "./maat_framework_gtest.log", LOG_LEVEL_INFO); _shared_maat_instance = maat_new(opts, table_info); EXPECT_TRUE(_shared_maat_instance != NULL); @@ -2912,6 +2958,73 @@ protected: static struct maat *_shared_maat_instance; }; +struct maat *MaatFileTest::_shared_maat_instance; + +TEST_F(MaatFileTest, StreamFiles) { + const char test_data_dir[64] = "./test_streamfiles"; + const char *table_name = "NTC_HTTP_REQ_BODY"; + int thread_id = 0; + struct maat *maat_instance = MaatFileTest::_shared_maat_instance; + struct maat_state *state = maat_state_new(maat_instance, thread_id); + + int table_id = maat_get_table_id(maat_instance, table_name); + ASSERT_GT(table_id, 0); + + struct dirent **name_list; + int n = my_scandir(test_data_dir, &name_list, NULL, + (int (*)(const void*, const void*))alphasort); + ASSERT_GT(n, 0); + struct maat_stream *stream = maat_stream_new(maat_instance, table_id, state); + ASSERT_FALSE(stream == NULL); + + struct stat file_info; + size_t file_size = 0; + char file_path[PATH_MAX] = {0}; + long long results[ARRAY_SIZE] = {0}; + size_t n_hit_result = 0; + int hit_cnt = 0; + + for (int i = 0; i < n; i++) { + if ((strcmp(name_list[i]->d_name, ".") == 0) || + (strcmp(name_list[i]->d_name, "..") == 0)) { + continue; + } + + snprintf(file_path, sizeof(file_path), "%s/%s", test_data_dir, + name_list[i]->d_name); + int ret = stat(file_path, &file_info); + ASSERT_TRUE(ret == 0); + + file_size = file_info.st_size; + char *buff = ALLOC(char, file_size); + FILE *fp = fopen(file_path, "rb"); + if (fp == NULL) { + printf("fopen %s error.\n", file_path); + continue; + } + + int read_len = fread(buff, 1, file_size, fp); + ret = maat_stream_scan(stream, buff, read_len, results, ARRAY_SIZE, + &n_hit_result, state); + read_len = fread(buff, 1, sizeof(buff), fp); + if (ret > 0) { + hit_cnt++; + } + fclose(fp); + free(buff); + buff = NULL; + } + maat_state_free(state); + state = NULL; + maat_stream_free(stream); + EXPECT_GT(hit_cnt, 0); + + for (int i = 0; i < n; i++) { + free(name_list[i]); + } + + free(name_list); +} class MaatCmdTest : public testing::Test { @@ -2931,6 +3044,7 @@ protected: maat_cmd_flushDB(_shared_maat_instance); maat_free(_shared_maat_instance); + maat_options_set_foreign_cont_dir(opts, "./foreign_files/"); _shared_maat_instance = maat_new(opts, table_info_path); maat_options_free(opts); } @@ -3696,6 +3810,7 @@ int is_same_file(const char *filename1, const char *filename2) return 0; } } + int g_test_foregin_read_OK = 0, g_test_foreign_del_OK = 0; char file1_to_del[256], file2_to_del[256]; const char* empty_file_name = "An_empty_file"; @@ -3730,7 +3845,6 @@ void foreign_key_test_entry_cb(int table_id, const char *table_line, void *u_par } } -#if 0 TEST_F(MaatCmdTest, SetFile) { struct maat *maat_instance = MaatCmdTest::_shared_maat_instance; const char* table_name = "TEST_FOREIGN_KEY"; @@ -3741,7 +3855,7 @@ TEST_F(MaatCmdTest, SetFile) { int ret = maat_table_callback_register(maat_instance, table_id, NULL, foreign_key_test_entry_cb, NULL, NULL); - ASSERT_GT(ret, 1); + EXPECT_EQ(ret, 0); const char *file1_name = "./testdata/digest_test.data"; const char *file2_name = "./testdata/mesa_logo.jpg"; @@ -3817,7 +3931,7 @@ TEST_F(MaatCmdTest, SetFile) { sleep(WAIT_FOR_EFFECTIVE_S);//wait for callback triggered. EXPECT_EQ(g_test_foregin_read_OK, 1); } -#endif + struct user_info { char name[256]; char ip_addr[32]; @@ -4761,8 +4875,7 @@ TEST_F(MaatCmdTest, CompileDelete_TSG6548) { EXPECT_LE(hit_cnt, miss_cnt); maat_state_free(state); } - -#if 1 +#if 0 TEST_F(MaatCmdTest, UpdateDeadLockDetection) { const char* g2c_table_name = "GROUP2COMPILE"; const char* compile_table_name = "COMPILE"; diff --git a/test/ntcrule/full/2018-10-09/NTC_UNIVERSAL_IP.0000050997 b/test/ntcrule/full/2018-10-09/NTC_UNIVERSAL_IP.0000050997 index d270663..c5263eb 100644 --- a/test/ntcrule/full/2018-10-09/NTC_UNIVERSAL_IP.0000050997 +++ b/test/ntcrule/full/2018-10-09/NTC_UNIVERSAL_IP.0000050997 @@ -1,24 +1,24 @@ 0000000023 -977 962 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -1000 985 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -967 950 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -852 835 6 :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 fc00::1:1f FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 0 0 1 -992 977 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -863 846 4 0.0.0.0 255.255.255.255 0 65535 192.168.17.3 255.255.255.255 0 65535 0 0 1 -849 832 4 0.0.0.0 255.255.255.255 0 65535 192.168.17.3 255.255.255.255 0 65535 0 0 1 -995 980 4 10.11.36.59 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -931 914 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -739 723 4 10.11.36.26 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -619 603 4 10.11.36.26 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -742 726 4 10.3.57.1 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -938 921 4 10.11.36.5 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -997 982 4 10.11.36.59 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -625 609 4 10.3.57.1 255.255.255.255 2345 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -847 830 6 :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 fc00::1:1f FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 0 0 1 -865 848 4 0.0.0.0 255.255.255.255 0 65535 192.168.17.3 255.255.255.255 0 65535 0 0 1 -986 971 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -628 612 4 10.3.57.1 255.255.255.255 56345 65535 10.3.57.2 255.255.255.255 179 65535 0 0 1 -974 959 4 10.11.36.21 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -622 606 4 10.3.57.1 255.255.255.255 0 65535 0.0.0.0 255.255.255.255 0 65535 0 0 1 -867 850 6 :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 fc00::1:1f FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 0 0 1 -860 843 6 :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 fc00::1:1f FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF 0 65535 0 0 1 +977 962 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +1000 985 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +967 950 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +852 835 6 mask :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF range 0 65535 6 1 +992 977 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +863 846 4 mask 0.0.0.0 255.255.255.255 range 0 65535 6 1 +849 832 4 mask 0.0.0.0 255.255.255.255 range 0 65535 6 1 +995 980 4 mask 10.11.36.59 255.255.255.255 range 0 65535 6 1 +931 914 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +739 723 4 mask 10.11.36.26 255.255.255.255 range 0 65535 6 1 +619 603 4 mask 10.11.36.26 255.255.255.255 range 0 65535 6 1 +742 726 4 mask 10.3.57.1 255.255.255.255 range 0 65535 6 1 +938 921 4 mask 10.11.36.5 255.255.255.255 range 0 65535 6 1 +997 982 4 mask 10.11.36.59 255.255.255.255 range 0 65535 6 1 +625 609 4 mask 10.3.57.1 255.255.255.255 range 2345 65535 6 1 +847 830 6 mask :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF range 0 65535 6 1 +865 848 4 mask 0.0.0.0 255.255.255.255 range 0 65535 6 1 +986 971 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +628 612 4 mask 10.3.57.1 255.255.255.255 range 56345 65535 6 1 +974 959 4 mask 10.11.36.21 255.255.255.255 range 0 65535 6 1 +622 606 4 mask 10.3.57.1 255.255.255.255 range 0 65535 6 1 +867 850 6 mask :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF range 0 65535 6 1 +860 843 6 mask :: FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF range 0 65535 6 1 \ No newline at end of file diff --git a/test/ntcrule/full/2018-10-09/WHITE_LIST_IP.0000050997 b/test/ntcrule/full/2018-10-09/WHITE_LIST_IP.0000050997 index 22dd219..2e792b9 100644 --- a/test/ntcrule/full/2018-10-09/WHITE_LIST_IP.0000050997 +++ b/test/ntcrule/full/2018-10-09/WHITE_LIST_IP.0000050997 @@ -1,2 +1,2 @@ 0000000001 -81 81 4 10.11.36.7 255.255.255.255 22222 65535 192.168.17.4 255.255.255.255 80 65535 0 0 1 +81 81 4 mask 10.11.36.7 255.255.255.255 range 22222 65535 6 1 diff --git a/test/table_info.conf b/test/table_info.conf index 9b6764f..44eeae2 100644 --- a/test/table_info.conf +++ b/test/table_info.conf @@ -8,7 +8,8 @@ "custom": { "compile_id":1, "tags":6, - "clause_num":9 + "clause_num":9, + "evaluation_order":10 } }, { @@ -34,7 +35,8 @@ "custom": { "compile_id":1, "tags":6, - "clause_num":9 + "clause_num":9, + "evaluation_order":10 } }, { diff --git a/test/test_streamfiles/stream_dump.1 b/test/test_streamfiles/stream_dump.1 new file mode 100644 index 0000000..fc48737 --- /dev/null +++ b/test/test_streamfiles/stream_dump.1 @@ -0,0 +1,55 @@ + + + + + + + + + + + + + + + + +全国中小学教师继续教育网 + + + +
+ + +
+
+ +
+     返回旧版 + +
+
+
+ + +
    +
  •  400- \ No newline at end of file diff --git a/test/test_streamfiles/stream_dump.3 b/test/test_streamfiles/stream_dump.3 new file mode 100644 index 0000000..75718d3 --- /dev/null +++ b/test/test_streamfiles/stream_dump.3 @@ -0,0 +1,95 @@ +812-1228
    • +
  •  在线咨询
    • +
  •  zx@teacher.com.cn
    • +
+
+
+
+
+ +
+ +
+ + + + +
+
+ +
+
+
+ + + + +
+
+
+
+ +
+
+
    +
    • +
    • +
    • +
    • +
    • +
+
+
+ +
+ +
+
+
+
+
+
+ +
+ +
+ +
+
+ +
+
+ +
+
+ +
+
+ +
+ +
+
+ 国培示范项目 +
+
+ “国培计划（2018）”——示范性紧缺领域体育美育小学音乐骨干教师培训项目（沈阳师范大学） +
+
+ “国培计划（2018）”——示范性培训团队高级研修项目（清华大学） +
+
+ “国培计划”——示范性综合改革项目 优秀心理健康青年教师助力研修项目（黑龙江省教育学院） +
+
+ “国培计划”——示范性综合改革项目 初中语文骨干教师培训项目（黑龙江省教育学院） +
+
+ “国培计划（2017）”——示范性名师高端研修 四川省小学特级教师高端研修项目（成都师范学院） +
+
+ + + +
+
+ 各类培训项目 +
+
+ +