[FEATURE]expr_matcher support dual engine(hyperscan & rulescan)
This commit is contained in:
刘文坛
@@ -3,7 +3,9 @@ include_directories(${PROJECT_SOURCE_DIR}/include)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/src/inc_internal)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/deps)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner/adapter_hs)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner/expr_matcher)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner/expr_matcher/adapter_hs)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner/expr_matcher/adapter_rs)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner/ip_matcher)
|
||||
include_directories(${PROJECT_SOURCE_DIR}/scanner/bool_matcher)
|
||||
|
||||
@@ -19,8 +21,8 @@ target_link_libraries(maat_framework_gtest maat_frame_static gtest_static)
|
||||
add_executable(maat_framework_perf_gtest maat_framework_perf_gtest.cpp)
|
||||
target_link_libraries(maat_framework_perf_gtest maat_frame_static gtest_static)
|
||||
|
||||
add_executable(adapter_hs_gtest adapter_hs_gtest.cpp)
|
||||
target_link_libraries(adapter_hs_gtest maat_frame_static gtest_static)
|
||||
add_executable(expr_matcher_gtest expr_matcher_gtest.cpp)
|
||||
target_link_libraries(expr_matcher_gtest maat_frame_static gtest_static)
|
||||
|
||||
add_executable(ip_matcher_gtest ip_matcher_gtest.cpp)
|
||||
target_link_libraries(ip_matcher_gtest maat_frame_static gtest_static)
|
||||
@@ -39,7 +41,6 @@ file(COPY file_test_tableinfo.conf DESTINATION ./)
|
||||
file(COPY literal_expr.conf DESTINATION ./)
|
||||
file(COPY regex_expr.conf DESTINATION ./)
|
||||
file(COPY maat_json.json DESTINATION ./)
|
||||
file(COPY maat_json.json DESTINATION ../tools/)
|
||||
file(COPY ntcrule DESTINATION ./)
|
||||
file(COPY tsgrule DESTINATION ./)
|
||||
file(COPY testdata DESTINATION ./)
|
||||
@@ -48,4 +49,4 @@ file(COPY json_update DESTINATION ./)
|
||||
file(COPY group_exclude DESTINATION ./)
|
||||
|
||||
include(GoogleTest)
|
||||
gtest_discover_tests(maat_framework_gtest)
|
||||
gtest_discover_tests(maat_framework_gtest)
|
||||
|
||||
@@ -1,730 +0,0 @@
|
||||
#include <gtest/gtest.h>
|
||||
|
||||
#include "log/log.h"
|
||||
#include "adapter_hs.h"
|
||||
#include "maat_utils.h"
|
||||
#include "cJSON/cJSON.h"
|
||||
|
||||
struct log_handle *g_logger = NULL;
|
||||
|
||||
enum hs_match_mode match_method_to_match_mode(const char *method)
|
||||
{
|
||||
enum hs_match_mode mode = HS_MATCH_MODE_INVALID;
|
||||
|
||||
if (strcmp(method, "sub") == 0) {
|
||||
mode = HS_MATCH_MODE_SUB;
|
||||
} else if (strcmp(method, "exactly") == 0) {
|
||||
mode = HS_MATCH_MODE_EXACTLY;
|
||||
} else if (strcmp(method, "prefix") == 0) {
|
||||
mode = HS_MATCH_MODE_PREFIX;
|
||||
} else if (strcmp(method, "suffix") == 0) {
|
||||
mode = HS_MATCH_MODE_SUFFIX;
|
||||
} else {
|
||||
assert(0);
|
||||
}
|
||||
|
||||
return mode;
|
||||
}
|
||||
|
||||
enum hs_case_sensitive case_sensitive_str_to_enum(const char *str)
|
||||
{
|
||||
enum hs_case_sensitive case_sensitive = HS_CASE_SENSITIVE;
|
||||
|
||||
if (strcmp(str, "yes") == 0) {
|
||||
case_sensitive = HS_CASE_SENSITIVE;
|
||||
} else if (strcmp(str, "no") == 0) {
|
||||
case_sensitive = HS_CASE_INSENSITIVE;
|
||||
} else {
|
||||
assert(0);
|
||||
}
|
||||
|
||||
return case_sensitive;
|
||||
}
|
||||
|
||||
int is_hexbin_str_to_int(const char *str)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
if (strcmp(str, "yes") == 0) {
|
||||
ret = 1;
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int convertHextoint(char srctmp)
|
||||
{
|
||||
if (isdigit(srctmp)) {
|
||||
return srctmp - '0';
|
||||
} else {
|
||||
char temp = toupper(srctmp);
|
||||
temp = temp - 'A' + 10;
|
||||
return temp;
|
||||
}
|
||||
}
|
||||
|
||||
static size_t hex2bin(char *hex, int hex_len, char *binary, size_t size)
|
||||
{
|
||||
size_t resultlen = 0;
|
||||
int high,low;
|
||||
for (int i = 0; i < hex_len && size > resultlen; i += 2, resultlen++) {
|
||||
high = convertHextoint(hex[i]);
|
||||
low = convertHextoint(hex[i+1]);
|
||||
binary[resultlen] = high * 16 + low;
|
||||
}
|
||||
|
||||
size = resultlen;
|
||||
binary[resultlen] = '\0';
|
||||
|
||||
return resultlen;
|
||||
}
|
||||
|
||||
enum hs_pattern_type pattern_type_str_to_enum(const char *str)
|
||||
{
|
||||
enum hs_pattern_type pattern_type;
|
||||
|
||||
if (strcmp(str, "regex") == 0) {
|
||||
pattern_type = HS_PATTERN_TYPE_REG;
|
||||
} else if (strcmp(str, "literal") == 0) {
|
||||
pattern_type = HS_PATTERN_TYPE_STR;
|
||||
} else {
|
||||
assert(0);
|
||||
}
|
||||
|
||||
return pattern_type;
|
||||
}
|
||||
|
||||
int parse_config_file(const char *filename, struct expr_rule exprs[], size_t *n_expr)
|
||||
{
|
||||
unsigned char *json_buff = NULL;
|
||||
size_t json_buff_size = 0;
|
||||
|
||||
int ret = load_file_to_memory(filename, &json_buff, &json_buff_size);
|
||||
if (ret < 0) {
|
||||
printf("load file:%s to memory failed.\n", filename);
|
||||
return -1;
|
||||
}
|
||||
|
||||
size_t rule_cnt = 0;
|
||||
cJSON *rules_obj = NULL;
|
||||
cJSON *root = cJSON_Parse((const char *)json_buff);
|
||||
if (NULL == root) {
|
||||
printf("Error before: %-200.200s\n", cJSON_GetErrorPtr());
|
||||
ret = -1;
|
||||
goto next;
|
||||
}
|
||||
|
||||
rules_obj = cJSON_GetObjectItem(root, "expr_rules");
|
||||
if (NULL == rules_obj) {
|
||||
printf("Error before: %-200.200s\n", cJSON_GetErrorPtr());
|
||||
ret = -1;
|
||||
goto next;
|
||||
}
|
||||
|
||||
rule_cnt = cJSON_GetArraySize(rules_obj);
|
||||
for (size_t i = 0; i < rule_cnt; i++) {
|
||||
cJSON *expr_obj = cJSON_GetArrayItem(rules_obj, i);
|
||||
cJSON *tmp_item = cJSON_GetObjectItem(expr_obj, "expr_id");
|
||||
if (tmp_item != NULL && tmp_item->type == cJSON_Number) {
|
||||
exprs[i].expr_id = tmp_item->valueint;
|
||||
}
|
||||
|
||||
tmp_item = cJSON_GetObjectItem(expr_obj, "pattern_num");
|
||||
if (tmp_item != NULL && tmp_item->type == cJSON_Number) {
|
||||
exprs[i].n_patterns = tmp_item->valueint;
|
||||
}
|
||||
|
||||
tmp_item = cJSON_GetObjectItem(expr_obj, "patterns");
|
||||
if (NULL == tmp_item || tmp_item->type != cJSON_Array) {
|
||||
printf("json has no patterns array.\n");
|
||||
ret = -1;
|
||||
goto next;
|
||||
}
|
||||
|
||||
size_t pattern_cnt = cJSON_GetArraySize(tmp_item);
|
||||
for (size_t j = 0; j < pattern_cnt; j++) {
|
||||
cJSON *pat_item = cJSON_GetArrayItem(tmp_item, j);
|
||||
|
||||
cJSON *item = cJSON_GetObjectItem(pat_item, "pattern_type");
|
||||
if (item != NULL && item->type == cJSON_String) {
|
||||
exprs[i].patterns[j].pattern_type = pattern_type_str_to_enum(item->valuestring);
|
||||
}
|
||||
|
||||
item = cJSON_GetObjectItem(pat_item, "match_method");
|
||||
if (item != NULL && item->type == cJSON_String) {
|
||||
exprs[i].patterns[j].match_mode = match_method_to_match_mode(item->valuestring);
|
||||
}
|
||||
|
||||
item = cJSON_GetObjectItem(pat_item, "case_sensitive");
|
||||
if (item != NULL && item->type == cJSON_String) {
|
||||
exprs[i].patterns[j].case_sensitive = case_sensitive_str_to_enum(item->valuestring);
|
||||
}
|
||||
|
||||
item = cJSON_GetObjectItem(pat_item, "is_hexbin");
|
||||
if (item != NULL && item->type == cJSON_String) {
|
||||
exprs[i].patterns[j].is_hexbin = is_hexbin_str_to_int(item->valuestring);
|
||||
}
|
||||
|
||||
item = cJSON_GetObjectItem(pat_item, "pattern");
|
||||
if (item != NULL && item->type == cJSON_String) {
|
||||
exprs[i].patterns[j].pat = ALLOC(char, strlen(item->valuestring) + 1);
|
||||
|
||||
if (exprs[i].patterns[j].is_hexbin == 1) {
|
||||
size_t pat_str_len = strlen(item->valuestring) + 1;
|
||||
char *pat_str = ALLOC(char, pat_str_len);
|
||||
pat_str_len = hex2bin(item->valuestring, strlen(item->valuestring),
|
||||
pat_str, pat_str_len);
|
||||
|
||||
memcpy(exprs[i].patterns[j].pat, pat_str, pat_str_len);
|
||||
free(pat_str);
|
||||
exprs[i].patterns[j].pat_len = pat_str_len;
|
||||
} else {
|
||||
memcpy(exprs[i].patterns[j].pat, item->valuestring,
|
||||
strlen(item->valuestring));
|
||||
exprs[i].patterns[j].pat_len = strlen(item->valuestring);
|
||||
}
|
||||
}
|
||||
|
||||
if (exprs[i].patterns->match_mode == HS_MATCH_MODE_SUB) {
|
||||
item = cJSON_GetObjectItem(pat_item, "offset");
|
||||
if (item != NULL && item->type == cJSON_String) {
|
||||
int key_left_offset = -1;
|
||||
int key_right_offset = -1;
|
||||
sscanf(item->valuestring, "%d~%d", &key_left_offset, &key_right_offset);
|
||||
if (key_left_offset < -1 || key_right_offset < -1) {
|
||||
printf("Error: offset should not less than -1, left_offset:%d, right_offset:%d\n",
|
||||
key_left_offset, key_right_offset);
|
||||
}
|
||||
exprs[i].patterns[j].start_offset = key_left_offset;
|
||||
exprs[i].patterns[j].end_offset = key_right_offset;
|
||||
} else {
|
||||
exprs[i].patterns[j].start_offset = -1;
|
||||
exprs[i].patterns[j].end_offset = -1;
|
||||
}
|
||||
}
|
||||
|
||||
if (exprs[i].patterns->match_mode == HS_MATCH_MODE_EXACTLY) {
|
||||
exprs[i].patterns[j].start_offset = 0;
|
||||
exprs[i].patterns[j].end_offset = exprs[i].patterns[j].pat_len - 1;
|
||||
}
|
||||
}
|
||||
exprs[i].n_patterns = pattern_cnt;
|
||||
}
|
||||
|
||||
*n_expr = rule_cnt;
|
||||
next:
|
||||
cJSON_Delete(root);
|
||||
FREE(json_buff);
|
||||
return ret;
|
||||
}
|
||||
|
||||
void expr_array_free(struct expr_rule rules[], size_t n_rule)
|
||||
{
|
||||
for (size_t i = 0; i < n_rule; i++) {
|
||||
for (size_t j = 0; j < rules[i].n_patterns; j++) {
|
||||
if (rules[i].patterns[j].pat != NULL) {
|
||||
free(rules[i].patterns[j].pat);
|
||||
rules[i].patterns[j].pat = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
TEST(adapter_hs_init, invalid_input_parameter)
|
||||
{
|
||||
struct expr_rule rules[64];
|
||||
size_t n_rule = 0;
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(NULL, 0, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance == NULL);
|
||||
|
||||
hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance == NULL);
|
||||
|
||||
n_rule = 1;
|
||||
rules[0].expr_id = 101;
|
||||
rules[0].n_patterns = 10;
|
||||
hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance == NULL);
|
||||
|
||||
memset(rules, 0, sizeof(rules));
|
||||
n_rule = 1;
|
||||
rules[0].expr_id = 101;
|
||||
rules[0].n_patterns = 1;
|
||||
hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance == NULL);
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_sub_has_normal_offset)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello aaa";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data2[64] = "Ahello aaa";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 101);
|
||||
|
||||
char scan_data3[64] = "Aahello aaa";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 101);
|
||||
|
||||
char scan_data4[64] = "Aaahello aaa";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data4, strlen(scan_data4), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_sub_has_left_unlimit_offset)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello bbb";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 102);
|
||||
|
||||
char scan_data2[64] = "Ahello bbb";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 102);
|
||||
|
||||
char scan_data3[64] = "Aahello bbb";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 102);
|
||||
|
||||
char scan_data4[64] = "Aaahello bbb";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data4, strlen(scan_data4), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_sub_has_right_unlimit_offset)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello ccc";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data2[64] = "1234hello ccc";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data3[64] = "12345hello ccc";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 103);
|
||||
|
||||
char scan_data4[64] = "12345hello cccAaBb";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data4, strlen(scan_data4), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 103);
|
||||
|
||||
char scan_data5[64] = "123456hello cccAaBb";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data5, strlen(scan_data5), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 103);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_sub_with_no_offset)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello ddd";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 104);
|
||||
|
||||
char scan_data2[64] = "123hello ddd";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 104);
|
||||
|
||||
char scan_data3[64] = "123hello ddd456";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 104);
|
||||
|
||||
char scan_data4[64] = "helloddd";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data4, strlen(scan_data4), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_exactly)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello eee";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 105);
|
||||
|
||||
char scan_data2[64] = "Ahello eee";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data3[64] = "hello eeeB";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_prefix)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello fff";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 106);
|
||||
|
||||
char scan_data2[64] = "Ahello fff";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data3[64] = "Ahello fffBCD";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data4[64] = "hello fffBCD";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data4, strlen(scan_data4), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 106);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_suffix)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "hello ggg";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 107);
|
||||
|
||||
char scan_data2[64] = "ABChello ggg";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 107);
|
||||
|
||||
char scan_data3[64] = "ABChello gggDEF";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data3, strlen(scan_data3), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
char scan_data4[64] = "hello gggDEF";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data4, strlen(scan_data4), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_sub_with_hexbin)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char scan_data1[64] = "Content-Type: /html";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 108);
|
||||
|
||||
char scan_data2[64] = " html";
|
||||
memset(result, 0, sizeof(result));
|
||||
n_result = 0;
|
||||
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 0);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, literal_with_chinese)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char data0[64] = "#中国 你好";
|
||||
struct hs_scan_result result0[64] = {0};
|
||||
size_t n_result0 = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, data0, strlen(data0), result0, 64, &n_result0);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result0, 1);
|
||||
EXPECT_EQ(result0[0].rule_id, 110);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, same_pattern_different_offset)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
char data[64] = "onetoday,anothertoday";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, data, strlen(data), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 112);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, long_scan_data)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
struct adapter_hs *hs_instance = adapter_hs_new(rules, n_rule, 1, g_logger);
|
||||
EXPECT_TRUE(hs_instance != NULL);
|
||||
expr_array_free(rules, n_rule);
|
||||
|
||||
const char* scan_data = "A directed path in a directed graph is a finite or infinite\
|
||||
sequence of edges which joins a sequence of distinct vertices, but with the added restriction\
|
||||
that the edges be all directed in the same direction.";
|
||||
struct hs_scan_result result[64] = {0};
|
||||
size_t n_result = 0;
|
||||
ret = adapter_hs_scan(hs_instance, 0, scan_data, strlen(scan_data), result, 64, &n_result);
|
||||
EXPECT_EQ(ret, 0);
|
||||
EXPECT_EQ(n_result, 1);
|
||||
EXPECT_EQ(result[0].rule_id, 113);
|
||||
|
||||
adapter_hs_free(hs_instance);
|
||||
hs_instance = NULL;
|
||||
}
|
||||
|
||||
TEST(adapter_hs_scan, regex_expression_check)
|
||||
{
|
||||
struct expr_rule rules[64] = {0};
|
||||
size_t n_rule = 0;
|
||||
|
||||
int ret = parse_config_file("./regex_expr.conf", rules, &n_rule);
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
for (size_t i = 0; i < n_rule; i++) {
|
||||
for (size_t j = 0; j < rules[i].n_patterns; j++) {
|
||||
adapter_hs_verify_regex_expression(rules[i].patterns[j].pat, g_logger);
|
||||
}
|
||||
}
|
||||
|
||||
expr_array_free(rules, n_rule);
|
||||
}
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
int ret = 0;
|
||||
::testing::InitGoogleTest(&argc, argv);
|
||||
g_logger = log_handle_create("./adapter_hs_gtest.log", 0);
|
||||
|
||||
ret = RUN_ALL_TESTS();
|
||||
|
||||
log_handle_destroy(g_logger);
|
||||
|
||||
return ret;
|
||||
}
|
||||
1330
test/expr_matcher_gtest.cpp
Normal file
1330
test/expr_matcher_gtest.cpp
Normal file
File diff suppressed because it is too large
Load Diff
@@ -5,6 +5,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -18,6 +19,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -31,6 +33,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -44,6 +47,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -56,6 +60,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "exactly",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -68,6 +73,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "prefix",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -80,6 +86,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "suffix",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -92,6 +99,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "yes",
|
||||
@@ -105,12 +113,14 @@
|
||||
"pattern_num": 2,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
"pattern": "multi"
|
||||
},
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -123,6 +133,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -135,6 +146,7 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -147,6 +159,7 @@
|
||||
"pattern_num": 2,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -154,6 +167,7 @@
|
||||
"offset": "3~7"
|
||||
},
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
@@ -167,12 +181,26 @@
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "literal",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
"pattern": "a finite or infinite"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"expr_id": 114,
|
||||
"pattern_num": 1,
|
||||
"patterns": [
|
||||
{
|
||||
"pattern_type": "regex",
|
||||
"match_method": "sub",
|
||||
"case_sensitive": "yes",
|
||||
"is_hexbin": "no",
|
||||
"pattern": "query=(.*)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
include_directories(./)
|
||||
|
||||
|
||||
add_library(gtest-static STATIC IMPORTED GLOBAL)
|
||||
add_dependencies(gtest-static gtest)
|
||||
|
||||
set_property(TARGET gtest-static PROPERTY IMPORTED_LOCATION ${PROJECT_SOURCE_DIR}/lib/libgtest.a)
|
||||
set_property(TARGET gtest-static PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${PROJECT_SOURCE_DIR}/include)
|
||||
|
||||
|
||||
add_library(maat-shared SHARED IMPORTED GLOBAL)
|
||||
add_dependencies(maat-shared maat)
|
||||
|
||||
set_property(TARGET maat-shared PROPERTY IMPORTED_LOCATION ${PROJECT_SOURCE_DIR}/lib/libmaat4.so)
|
||||
set_property(TARGET maat-shared PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${PROJECT_SOURCE_DIR}/include)
|
||||
|
||||
add_executable(maat_demo_gtest maat_demo_gtest.cpp)
|
||||
target_link_libraries(maat_demo_gtest maat-shared gtest-static pthread)
|
||||
|
||||
file(COPY demo_table_info.conf DESTINATION ./)
|
||||
file(COPY maat_demo.json DESTINATION ./)
|
||||
file(COPY testdata DESTINATION ./)
|
||||
@@ -1,129 +0,0 @@
|
||||
[
|
||||
{
|
||||
"table_id":0,
|
||||
"table_name":"COMPILE",
|
||||
"table_type":"compile",
|
||||
"valid_column":8,
|
||||
"custom": {
|
||||
"gc_timeout_s": 3,
|
||||
"compile_id":1,
|
||||
"tags":6,
|
||||
"clause_num":9
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":1,
|
||||
"table_name":"GROUP2COMPILE",
|
||||
"table_type":"group2compile",
|
||||
"associated_compile_table_id":0,
|
||||
"valid_column":3,
|
||||
"custom": {
|
||||
"group_id":1,
|
||||
"compile_id":2,
|
||||
"not_flag":4,
|
||||
"virtual_table_name":5,
|
||||
"clause_index":6
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":2,
|
||||
"table_name":"HTTP_URL",
|
||||
"table_type":"expr",
|
||||
"valid_column":7,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"keywords":3,
|
||||
"expr_type":4,
|
||||
"match_method":5,
|
||||
"is_hexbin":6
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":3,
|
||||
"table_name":"KEYWORDS_TABLE",
|
||||
"table_type":"expr",
|
||||
"valid_column":7,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"keywords":3,
|
||||
"expr_type":4,
|
||||
"match_method":5,
|
||||
"is_hexbin":6
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":4,
|
||||
"table_name":"HTTP_SIGNATURE",
|
||||
"table_type":"expr_plus",
|
||||
"valid_column":8,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"district":3,
|
||||
"keywords":4,
|
||||
"expr_type":5,
|
||||
"match_method":6,
|
||||
"is_hexbin":7
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":5,
|
||||
"table_name":"IMAGE_FP",
|
||||
"table_type":"expr",
|
||||
"valid_column":7,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"keywords":3,
|
||||
"expr_type":4,
|
||||
"match_method":5,
|
||||
"is_hexbin":6
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":6,
|
||||
"table_name":"APP_PAYLOAD",
|
||||
"table_type":"expr_plus",
|
||||
"valid_column":8,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"district":3,
|
||||
"keywords":4,
|
||||
"expr_type":5,
|
||||
"match_method":6,
|
||||
"is_hexbin":7
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":7,
|
||||
"table_name":"TROJAN_PAYLOAD",
|
||||
"table_type":"expr",
|
||||
"valid_column":7,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"keywords":3,
|
||||
"expr_type":4,
|
||||
"match_method":5,
|
||||
"is_hexbin":6
|
||||
|
||||
}
|
||||
},
|
||||
{
|
||||
"table_id":8,
|
||||
"table_name":"MAIL_ADDR",
|
||||
"table_type":"expr",
|
||||
"valid_column":7,
|
||||
"custom": {
|
||||
"item_id":1,
|
||||
"group_id":2,
|
||||
"keywords":3,
|
||||
"expr_type":4,
|
||||
"match_method":5,
|
||||
"is_hexbin":6
|
||||
}
|
||||
}
|
||||
]
|
||||
@@ -1,289 +0,0 @@
|
||||
/*
|
||||
**********************************************************************************************
|
||||
* Maat: Deep Packet Inspection Policy Framework
|
||||
|
||||
* Maat is the Goddess of truth and justice in ancient Egyptian concept.
|
||||
* Her feather was the measure that determined whether the souls (considered
|
||||
* to reside in the heart) of the departed would reach the paradise of afterlife
|
||||
* successfully.
|
||||
|
||||
* Authors: Liu WenTan <liuwentan@geedgenetworks.com>
|
||||
* Date: 2022-10-31
|
||||
* Copyright: (c) 2018-2023 Geedge Networks, Inc. All rights reserved.
|
||||
***********************************************************************************************
|
||||
*/
|
||||
|
||||
#ifndef _MAAT_H_
|
||||
#define _MAAT_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C"
|
||||
{
|
||||
#endif
|
||||
|
||||
#include <stdint.h>
|
||||
#include <netinet/in.h>
|
||||
|
||||
/* maat instance handle */
|
||||
struct maat;
|
||||
|
||||
struct maat_hit_path {
|
||||
int Nth_scan;
|
||||
int vtable_id; // 0 is not a virtual table.
|
||||
long long item_id;
|
||||
long long sub_group_id;
|
||||
long long top_group_id;
|
||||
long long compile_id;
|
||||
};
|
||||
|
||||
struct maat_hit_group {
|
||||
long long group_id;
|
||||
int vtable_id;
|
||||
};
|
||||
|
||||
enum maat_scan_status {
|
||||
MAAT_SCAN_ERR = -1, //scan error
|
||||
MAAT_SCAN_OK, //scan but not hit(group or compile)
|
||||
MAAT_SCAN_HALF_HIT, //half hit: hit group, not hit compile
|
||||
MAAT_SCAN_HIT //scan hit compile
|
||||
};
|
||||
|
||||
enum maat_update_type {
|
||||
MAAT_UPDATE_TYPE_INVALID = 0,
|
||||
MAAT_UPDATE_TYPE_FULL,
|
||||
MAAT_UPDATE_TYPE_INC
|
||||
};
|
||||
|
||||
enum maat_list_type {
|
||||
MAAT_LIST_TYPE_FULL = 1,
|
||||
MAAT_LIST_TYPE_INC
|
||||
};
|
||||
|
||||
struct ip_addr {
|
||||
int ip_type; //4: IPv4, 6: IPv6
|
||||
union {
|
||||
unsigned int ipv4; //network order
|
||||
unsigned int ipv6[4];
|
||||
};
|
||||
};
|
||||
|
||||
enum log_level {
|
||||
LOG_LEVEL_TRACE,
|
||||
LOG_LEVEL_DEBUG,
|
||||
LOG_LEVEL_INFO,
|
||||
LOG_LEVEL_WARN,
|
||||
LOG_LEVEL_ERROR,
|
||||
LOG_LEVEL_FATAL
|
||||
};
|
||||
|
||||
/* update_type: MAAT_UPDATE_TYPE_FULL or MAAT_UPDATE_TYPE_INC */
|
||||
typedef void maat_start_callback_t(int update_type, void *u_param);
|
||||
|
||||
typedef void maat_update_callback_t(int table_id, const char *table_line, void *u_para);
|
||||
|
||||
typedef void maat_finish_callback_t(void *u_para);
|
||||
|
||||
typedef void maat_ex_new_func_t(const char *table_name, int table_id, const char *key,
|
||||
const char *table_line, void **ad, long argl, void *argp);
|
||||
|
||||
typedef void maat_ex_free_func_t(int table_id, void **ad, long argl, void *argp);
|
||||
|
||||
typedef void maat_ex_dup_func_t(int table_id, void **to, void **from, long argl, void *argp);
|
||||
|
||||
/* maat_instance options API */
|
||||
struct maat_options;
|
||||
|
||||
struct maat_options *maat_options_new(void);
|
||||
|
||||
void maat_options_free(struct maat_options *opts);
|
||||
|
||||
/**
|
||||
* @brief set maat instance name
|
||||
*
|
||||
* @note The maximum length of instance_name is 15 bytes
|
||||
*/
|
||||
int maat_options_set_instance_name(struct maat_options *opts, const char *instance_name);
|
||||
|
||||
int maat_options_set_caller_thread_number(struct maat_options *opts, size_t n_thread);
|
||||
|
||||
int maat_options_set_accept_tags(struct maat_options *opts, const char *accept_tags);
|
||||
|
||||
int maat_options_set_rule_effect_interval_ms(struct maat_options *opts, int interval_ms);
|
||||
|
||||
int maat_options_set_rule_update_checking_interval_ms(struct maat_options *opts, int interval_ms);
|
||||
|
||||
int maat_options_set_gc_timeout_ms(struct maat_options *opts, int interval_ms);
|
||||
|
||||
int maat_options_set_deferred_load_on(struct maat_options *opts);
|
||||
|
||||
int maat_options_set_stat_on(struct maat_options *opts);
|
||||
|
||||
int maat_options_set_perf_on(struct maat_options *opts);
|
||||
|
||||
int maat_options_set_foreign_cont_dir(struct maat_options *opts, const char *dir);
|
||||
|
||||
int maat_options_set_logger(struct maat_options *opts, const char *log_path,
|
||||
enum log_level level);
|
||||
|
||||
int maat_options_set_iris(struct maat_options *opts, const char *full_directory,
|
||||
const char *increment_directory);
|
||||
|
||||
int maat_options_set_json_file(struct maat_options *opts, const char *json_filename);
|
||||
|
||||
/**
|
||||
* Indicate whether the JSON file is compressed by gzip
|
||||
* flag: 1(compressed) 0(uncompressed)
|
||||
* */
|
||||
int maat_options_set_json_file_gzip_flag(struct maat_options *opts, int flag);
|
||||
|
||||
/* Specify the decryption key for the JSON file to be decrypted */
|
||||
int maat_options_set_json_file_decrypt_key(struct maat_options *opts, const char *decrypt_key);
|
||||
|
||||
int maat_options_set_redis(struct maat_options *opts, const char *redis_ip,
|
||||
uint16_t redis_port, int redis_db);
|
||||
|
||||
int maat_options_set_stat_file(struct maat_options *opts, const char *stat_filename);
|
||||
|
||||
/* maat_instance API */
|
||||
struct maat *maat_new(struct maat_options *opts, const char *table_info_path);
|
||||
void maat_free(struct maat *instance);
|
||||
|
||||
/* maat helper API */
|
||||
int maat_helper_read_column(const char *table_line, int Nth_column,
|
||||
size_t *column_offset, size_t *column_len);
|
||||
/**
|
||||
* verify if regex expression is legal
|
||||
*
|
||||
* @param The NULL-terminated expression to parse.
|
||||
* @retval 1(legal) 0(illegal)
|
||||
**/
|
||||
int maat_helper_verify_regex_expression(const char *expression);
|
||||
|
||||
/* maat table API */
|
||||
int maat_get_table_id(struct maat *instance, const char *table_name);
|
||||
|
||||
/* return 0 if success, otherwise return -1 */
|
||||
int maat_table_callback_register(struct maat *instance, int table_id,
|
||||
maat_start_callback_t *start,
|
||||
maat_update_callback_t *update,
|
||||
maat_finish_callback_t *finish,
|
||||
void *u_para);
|
||||
|
||||
/* maat plugin table API */
|
||||
int maat_plugin_table_ex_schema_register(struct maat *instance, const char *table_name,
|
||||
maat_ex_new_func_t *new_func,
|
||||
maat_ex_free_func_t *free_func,
|
||||
maat_ex_dup_func_t *dup_func,
|
||||
long argl, void *argp);
|
||||
/**
|
||||
* xx_plugin_table_get_ex_data
|
||||
* returned data is duplicated by dup_func of maat_plugin_table_ex_schema_register,
|
||||
* caller is responsible to free the data.
|
||||
*
|
||||
* free_func support gargbage collection(gc), gc timeout(default 0) can be configured
|
||||
* in table_info which means maat will not call free_func until the timeout expires
|
||||
*/
|
||||
|
||||
/**
|
||||
* NOTE: only plugin table support three key type(integer, pointer, ip_addr)
|
||||
* specified in table_info.conf. If use ip_addr key type, then key should be
|
||||
* ip address in network order.
|
||||
*/
|
||||
void *maat_plugin_table_get_ex_data(struct maat *instance, int table_id,
|
||||
const char *key, size_t key_len);
|
||||
|
||||
int maat_ip_plugin_table_get_ex_data(struct maat *instance, int table_id,
|
||||
const struct ip_addr *ip, void **ex_data_array,
|
||||
size_t n_ex_data);
|
||||
|
||||
int maat_fqdn_plugin_table_get_ex_data(struct maat *instance, int table_id,
|
||||
const char *fqdn, void **ex_data_array,
|
||||
size_t n_ex_data);
|
||||
|
||||
int maat_bool_plugin_table_get_ex_data(struct maat *instance, int table_id,
|
||||
unsigned long long *item_ids, size_t n_item,
|
||||
void **ex_data_array, size_t n_ex_data);
|
||||
/* maat scan API */
|
||||
struct maat_state;
|
||||
|
||||
/**
|
||||
* @param instance: maat instance created by maat_new()
|
||||
* @param table_id: the id of table which to be scanned
|
||||
* @param thread_id: thread index
|
||||
* @param results: array to store hit compile id
|
||||
* @param n_result: the array size
|
||||
* @param n_hit_result: the number of hit compile id
|
||||
* @param state: scan mid status
|
||||
*
|
||||
* @retval MAAT_SCAN_ERR
|
||||
* MAAT_SCAN_OK
|
||||
* MAAT_SCAN_HALF_HIT
|
||||
* MAAT_SCAN_HIT
|
||||
*/
|
||||
int maat_scan_flag(struct maat *instance, int table_id,
|
||||
long long flag, long long *results, size_t n_result,
|
||||
size_t *n_hit_result, struct maat_state *state);
|
||||
int maat_scan_integer(struct maat *instance, int table_id,
|
||||
long long integer, long long *results, size_t n_result,
|
||||
size_t *n_hit_result, struct maat_state *state);
|
||||
|
||||
/**
|
||||
* @param ip_addr: network ipv4 address
|
||||
* @param port: network port
|
||||
* @param protocol: -1(ANY protocol) 1(ICMP) 6(TCP) 17(UDP)
|
||||
*/
|
||||
int maat_scan_ipv4(struct maat *instance, int table_id,
|
||||
uint32_t ip_addr, uint16_t port, int protocol,
|
||||
long long *results, size_t n_result,
|
||||
size_t *n_hit_result, struct maat_state *state);
|
||||
|
||||
int maat_scan_ipv6(struct maat *instance, int table_id,
|
||||
uint8_t *ip_addr, uint16_t port, int protocol,
|
||||
long long *results, size_t n_result,
|
||||
size_t *n_hit_result, struct maat_state *state);
|
||||
|
||||
int maat_scan_string(struct maat *instance, int table_id,
|
||||
const char *data, size_t data_len, long long *results,
|
||||
size_t n_result, size_t *n_hit_result,
|
||||
struct maat_state *state);
|
||||
|
||||
struct maat_stream;
|
||||
struct maat_stream *maat_stream_new(struct maat *instance, int table_id,
|
||||
struct maat_state *state);
|
||||
|
||||
int maat_stream_scan(struct maat_stream *stream, const char *data, int data_len,
|
||||
long long *results, size_t n_result, size_t *n_hit_result,
|
||||
struct maat_state *state);
|
||||
|
||||
void maat_stream_free(struct maat_stream *stream);
|
||||
|
||||
/* maat state API */
|
||||
struct maat_state *maat_state_new(struct maat *instance, int thread_id);
|
||||
|
||||
void maat_state_reset(struct maat_state *state);
|
||||
|
||||
void maat_state_free(struct maat_state *state);
|
||||
|
||||
int maat_state_set_scan_district(struct maat_state *state, int table_id,
|
||||
const char *district, size_t district_len);
|
||||
|
||||
int maat_state_set_last_scan(struct maat_state *state);
|
||||
|
||||
int maat_state_set_scan_compile_table(struct maat_state *state, int compile_table_id);
|
||||
|
||||
int maat_state_get_hit_paths(struct maat_state *state, struct maat_hit_path *paths,
|
||||
size_t n_path);
|
||||
|
||||
size_t maat_state_get_scan_count(struct maat_state *state);
|
||||
|
||||
int maat_state_get_hit_groups(struct maat_state *state, enum maat_list_type type,
|
||||
struct maat_hit_group *groups, size_t n_group);
|
||||
|
||||
/* return hit object compile_id */
|
||||
int maat_hit_group_compile_id(struct maat *instance, struct maat_hit_group *group);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
@@ -1,56 +0,0 @@
|
||||
/*
|
||||
**********************************************************************************************
|
||||
* File: maat_command.h
|
||||
* Description:
|
||||
* Authors: Liu WenTan <liuwentan@geedgenetworks.com>
|
||||
* Date: 2022-10-31
|
||||
* Copyright: (c) Since 2022 Geedge Networks, Ltd. All rights reserved.
|
||||
***********************************************************************************************
|
||||
*/
|
||||
|
||||
#ifndef _MAAT_COMMAND_H_
|
||||
#define _MAAT_COMMAND_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C"
|
||||
{
|
||||
#endif
|
||||
|
||||
#include <limits.h>
|
||||
|
||||
#include "maat.h"
|
||||
|
||||
enum maat_operation {
|
||||
MAAT_OP_DEL = 0,
|
||||
MAAT_OP_ADD,
|
||||
MAAT_OP_RENEW_TIMEOUT //Rule expire time is changed to now+cmd->expire_after
|
||||
};
|
||||
|
||||
struct maat_cmd_line {
|
||||
const char *table_name;
|
||||
const char *table_line;
|
||||
long long rule_id; // for MAAT_OP_DEL, only rule_id and table_name are necessary.
|
||||
int expire_after; //expired after $timeout$ seconds, set to 0 for never timeout.
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief write one line to redis
|
||||
*
|
||||
* @retval
|
||||
* success: number of successfully updated rule.
|
||||
* failed: -1
|
||||
*/
|
||||
int maat_cmd_set_line(struct maat *maat_instance, const struct maat_cmd_line *line_rule);
|
||||
|
||||
int maat_cmd_set_file(struct maat *maat_instance, const char *key, const char *value,
|
||||
size_t size, enum maat_operation op);
|
||||
|
||||
long long maat_cmd_incrby(struct maat *maat_instance, const char *key, int increment);
|
||||
|
||||
int maat_cmd_flushDB(struct maat *maat_instance);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
Binary file not shown.
@@ -1 +0,0 @@
|
||||
libmaat4.so.4
|
||||
@@ -1 +0,0 @@
|
||||
libmaat4.so.4.0
|
||||
Binary file not shown.
@@ -1,432 +0,0 @@
|
||||
{
|
||||
"compile_table": "COMPILE",
|
||||
"group2compile_table": "GROUP2COMPILE",
|
||||
"group2group_table": "GROUP2GROUP",
|
||||
"rules": [
|
||||
{
|
||||
"compile_id": 125,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "anything",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
"table_type": "expr",
|
||||
"table_content": {
|
||||
"keywords": "action=search\\&query=(.*)",
|
||||
"expr_type": "regex",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 128,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "StringScan.ExprPlus",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name": "Untitled",
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
"table_type": "expr_plus",
|
||||
"table_content": {
|
||||
"district": "HtTP\\bUrL",
|
||||
"keywords": "abckkk&123",
|
||||
"expr_type": "and",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 132,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "string\\bunescape",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name": "TakeMeHome",
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "KEYWORDS_TABLE",
|
||||
"table_type": "expr",
|
||||
"table_content": {
|
||||
"keywords": "Take\\bme\\bHome&Batman\\",
|
||||
"expr_type": "and",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 136,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "offset_string",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name": "Untitled",
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "IMAGE_FP",
|
||||
"table_type": "expr",
|
||||
"table_content": {
|
||||
"keywords": "4362-4458:323031333A30333A30372032333A35363A313000323031333A30333A30372032333A35363A3130000000FFE20C584943435F50524F46494C4500010100000C484C696E6F021000006D6E74725247422058595A2007CE00020009000600310000",
|
||||
"expr_type": "offset",
|
||||
"match_method": "none",
|
||||
"format": "hexbin"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 146,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "StringScan.Regex",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
"table_type": "expr",
|
||||
"table_content": {
|
||||
"keywords": "Cookie:\\s.*head",
|
||||
"expr_type": "regex",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 148,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"user_region": "StringScan.ExprPlusWithOffset",
|
||||
"effective_rage": 0,
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name": "Untitled",
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "APP_PAYLOAD",
|
||||
"table_type": "expr_plus",
|
||||
"table_content": {
|
||||
"format": "hexbin",
|
||||
"match_method": "sub",
|
||||
"district": "Payload",
|
||||
"keywords": "1-1:03&9-10:2d&14-16:2d34&19-21:2d&24-25:2d",
|
||||
"expr_type": "offset"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 150,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"effective_rage": 0,
|
||||
"user_region": "StringScan.BugReport20190325",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
"table_name": "TROJAN_PAYLOAD",
|
||||
"table_content": {
|
||||
"keywords": "0-4:01000000",
|
||||
"expr_type": "offset",
|
||||
"format": "hexbin",
|
||||
"match_method": "sub"
|
||||
}
|
||||
}
|
||||
],
|
||||
"group_name": "billgates_regist1"
|
||||
},
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
"table_name": "TROJAN_PAYLOAD",
|
||||
"table_content": {
|
||||
"keywords": "1:G2.40",
|
||||
"expr_type": "none",
|
||||
"format": "uncase plain",
|
||||
"match_method": "sub"
|
||||
}
|
||||
}
|
||||
],
|
||||
"group_name": "billgates_regist2"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 151,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"effective_rage": 0,
|
||||
"user_region": "StringScan.PrefixAndSuffix",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
"table_name": "MAIL_ADDR",
|
||||
"table_content": {
|
||||
"keywords": "ceshi3@mailhost.cn",
|
||||
"expr_type": "none",
|
||||
"format": "uncase plain",
|
||||
"match_method": "suffix"
|
||||
}
|
||||
}
|
||||
],
|
||||
"group_name": "Untitled"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 156,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "ExprPlusWithHex",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name": "Untitled",
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
"table_type": "expr_plus",
|
||||
"table_content": {
|
||||
"district": "Content-Type",
|
||||
"keywords": "2f68746d6c",
|
||||
"expr_type": "none",
|
||||
"match_method": "sub",
|
||||
"format": "hexbin"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 157,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"effective_rage": 0,
|
||||
"user_region": "StringScan.StreamScanUTF8",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
"table_name": "TROJAN_PAYLOAD",
|
||||
"table_content": {
|
||||
"keywords": "我的订单",
|
||||
"expr_type": "none",
|
||||
"format": "none",
|
||||
"match_method": "sub"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 182,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "8-expr",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "KEYWORDS_TABLE",
|
||||
"table_type": "expr",
|
||||
"table_content": {
|
||||
"keywords": "string1&string2&string3&string4&string5&string6&string7&string8",
|
||||
"expr_type": "and",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 190,
|
||||
"service": 1,
|
||||
"action": 1,
|
||||
"do_blacklist": 1,
|
||||
"do_log": 1,
|
||||
"user_region": "StringScan.ExprPlus",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"group_name": "Untitled",
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
"table_type": "expr_plus",
|
||||
"table_content": {
|
||||
"district": "我的DistrIct",
|
||||
"keywords": "addis&sapphire",
|
||||
"expr_type": "and",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 191,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"effective_rage": 0,
|
||||
"user_region": "StringScan.HexBinCaseSensitive",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
"table_name": "KEYWORDS_TABLE",
|
||||
"table_content": {
|
||||
"keywords": "54455354",
|
||||
"expr_type": "none",
|
||||
"format": "hexbin",
|
||||
"match_method": "sub"
|
||||
}
|
||||
}
|
||||
],
|
||||
"group_name": "Untitled"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 195,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"user_region": "anything",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_SIGNATURE",
|
||||
"table_type": "expr_plus",
|
||||
"table_content": {
|
||||
"district": "I love China",
|
||||
"keywords": "today&yesterday",
|
||||
"expr_type": "and",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_name": "HTTP_URL",
|
||||
"table_type": "expr",
|
||||
"table_content": {
|
||||
"keywords": "Monday",
|
||||
"expr_type": "none",
|
||||
"match_method": "sub",
|
||||
"format": "uncase plain"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"compile_id": 206,
|
||||
"service": 0,
|
||||
"action": 0,
|
||||
"do_blacklist": 0,
|
||||
"do_log": 0,
|
||||
"effective_rage": 0,
|
||||
"user_region": "duplicateRuleFor191",
|
||||
"is_valid": "yes",
|
||||
"groups": [
|
||||
{
|
||||
"regions": [
|
||||
{
|
||||
"table_type": "expr",
|
||||
"table_name": "KEYWORDS_TABLE",
|
||||
"table_content": {
|
||||
"keywords": "54455354",
|
||||
"expr_type": "none",
|
||||
"format": "hexbin",
|
||||
"match_method": "sub"
|
||||
}
|
||||
}
|
||||
],
|
||||
"group_name": "Untitled"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,718 +0,0 @@
|
||||
#include <gtest/gtest.h>
|
||||
#include <dirent.h>
|
||||
#include <openssl/md5.h>
|
||||
|
||||
#include "include/maat.h"
|
||||
#include "include/maat_command.h"
|
||||
|
||||
#define MODULE_FRAMEWORK_GTEST module_name_str("maat.framework_gtest")
|
||||
|
||||
#define ARRAY_SIZE 10
|
||||
#define HIT_PATH_SIZE 128
|
||||
#define WAIT_FOR_EFFECTIVE_S 2
|
||||
|
||||
#define ALLOC(type, number) ((type *)calloc(sizeof(type), number))
|
||||
|
||||
const char *table_info_path = "./demo_table_info.conf";
|
||||
const char *maat_json_file = "./maat_demo.json";
|
||||
|
||||
int compile_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
enum maat_operation op, long long compile_id,
|
||||
const char *user_region, int clause_num,
|
||||
int expire_after)
|
||||
{
|
||||
char table_line[1024 * 16] = {0};
|
||||
sprintf(table_line, "%lld\t0\t0\t0\t0\t0\t%s\t%d\t%d\t0.0",
|
||||
compile_id, user_region, op, clause_num);
|
||||
|
||||
struct maat_cmd_line line_rule;
|
||||
line_rule.rule_id = compile_id;
|
||||
line_rule.table_line = table_line;
|
||||
line_rule.table_name = table_name;
|
||||
line_rule.expire_after = expire_after;
|
||||
|
||||
return maat_cmd_set_line(maat_inst, &line_rule);
|
||||
}
|
||||
|
||||
#define TO_GROUP2X_KEY(group_id, parent_id, clause_index) (((unsigned long)group_id<<32|parent_id) + clause_index)
|
||||
int group2compile_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
enum maat_operation op, long long group_id,
|
||||
long long compile_id, int not_flag,
|
||||
const char *vtable_name, int clause_index,
|
||||
int expire_after)
|
||||
{
|
||||
char table_line[128] = {0};
|
||||
sprintf(table_line, "%lld\t%lld\t%d\t%d\t%s\t%d",
|
||||
group_id, compile_id, op, not_flag, vtable_name, clause_index);
|
||||
|
||||
struct maat_cmd_line line_rule;
|
||||
line_rule.rule_id = TO_GROUP2X_KEY(group_id, compile_id, clause_index);
|
||||
line_rule.table_line = table_line;
|
||||
line_rule.table_name = table_name;
|
||||
line_rule.expire_after = expire_after;
|
||||
|
||||
return maat_cmd_set_line(maat_inst, &line_rule);
|
||||
}
|
||||
|
||||
int expr_table_set_line(struct maat *maat_inst, const char *table_name,
|
||||
enum maat_operation op, long long item_id,
|
||||
long long group_id, const char *keywords,
|
||||
int expr_type, int match_method, int is_hexbin,
|
||||
int expire_after)
|
||||
{
|
||||
char table_line[1024] = {0};
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
if (table_id < 0) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
sprintf(table_line, "%lld\t%lld\t%s\t%d\t%d\t%d\t%d", item_id, group_id,
|
||||
keywords, expr_type, match_method, is_hexbin, op);
|
||||
|
||||
struct maat_cmd_line line_rule;
|
||||
line_rule.rule_id = item_id;
|
||||
line_rule.table_line = table_line;
|
||||
line_rule.table_name = table_name;
|
||||
line_rule.expire_after = expire_after;
|
||||
|
||||
return maat_cmd_set_line(maat_inst, &line_rule);
|
||||
}
|
||||
|
||||
class JsonMode : public testing::Test
|
||||
{
|
||||
protected:
|
||||
static void SetUpTestCase() {
|
||||
struct maat_options *opts = maat_options_new();
|
||||
maat_options_set_json_file(opts, maat_json_file);
|
||||
maat_options_set_logger(opts, "./maat_sample_gtest.log", LOG_LEVEL_INFO);
|
||||
|
||||
_shared_maat_inst = maat_new(opts, table_info_path);
|
||||
maat_options_free(opts);
|
||||
if (NULL == _shared_maat_inst) {
|
||||
assert(0);
|
||||
}
|
||||
}
|
||||
|
||||
static void TearDownTestCase() {
|
||||
maat_free(_shared_maat_inst);
|
||||
}
|
||||
|
||||
static struct maat *_shared_maat_inst;
|
||||
};
|
||||
|
||||
struct maat *JsonMode::_shared_maat_inst;
|
||||
|
||||
TEST_F(JsonMode, ScanDataOnlyOneByte) {
|
||||
const char *table_name = "HTTP_URL";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char scan_data = 0x20;
|
||||
|
||||
int ret = maat_scan_string(maat_inst, table_id, &scan_data, sizeof(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK);
|
||||
EXPECT_EQ(n_hit_result, 0);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, literal) {
|
||||
const char *table_name = "HTTP_URL";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char *scan_data = "http://www.cyberessays.com/search_results.php?action=search&query=username,abckkk,1234567";
|
||||
|
||||
int ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(n_hit_result, 1);
|
||||
EXPECT_EQ(results[0], 125);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, Regex) {
|
||||
int ret = 0;
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
const char *cookie = "Cookie: Txa123aheadBCAxd";
|
||||
const char *table_name = "HTTP_URL";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ret = maat_scan_string(maat_inst, table_id, cookie, strlen(cookie),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 146);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, ExprPlus) {
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
const char *region_name1 ="HTTP URL";
|
||||
const char *region_name2 ="我的diStricT";
|
||||
const char *scan_data1 = "http://www.cyberessays.com/search_results.php?action=search&query=abckkk,1234567";
|
||||
const char *scan_data2 = "Addis Sapphire Hotel";
|
||||
const char *table_name = "HTTP_SIGNATURE";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
int ret = maat_scan_string(maat_inst, table_id, scan_data1, strlen(scan_data1),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_ERR);//Should return error for district not setting.
|
||||
|
||||
ret = maat_state_set_scan_district(state, table_id, region_name1, strlen(region_name1));
|
||||
ASSERT_EQ(ret, 0);
|
||||
ret = maat_scan_string(maat_inst, table_id, scan_data1, strlen(scan_data1),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 128);
|
||||
maat_state_reset(state);
|
||||
|
||||
ret = maat_state_set_scan_district(state, table_id, region_name2, strlen(region_name2));
|
||||
ASSERT_EQ(ret, 0);
|
||||
ret = maat_scan_string(maat_inst, table_id, scan_data2, strlen(scan_data2),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 190);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, ExprPlusWithOffset)
|
||||
{
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char *region_name = "Payload";
|
||||
unsigned char udp_payload_not_hit[] = { /* Stun packet */
|
||||
0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42,
|
||||
0x4f, 0xc2, 0xc2, 0x70, 0xb3, 0xa8, 0x4e, 0x22,
|
||||
0xf5, 0x22, 0x87, 0x4c, 0x40, 0x00, 0x00, 0x46,
|
||||
0x03, 0x02, 0xab, 0x39, 0xbb, 0x97, 0xe5, 0x01,
|
||||
0x3a, 0x46, 0x1c, 0x28, 0x5b, 0xab, 0xfa, 0x9a,
|
||||
0xab, 0x2e, 0x71, 0x39, 0x66, 0xa0, 0xd7, 0xb9,
|
||||
0xd8, 0x41, 0xa7, 0xa0, 0x84, 0xa9, 0xf3, 0x1b,
|
||||
0x03, 0x7f, 0xa8, 0x28, 0xa2, 0xd3, 0x64, 0xc2,
|
||||
0x3d, 0x20, 0xe0, 0xb1, 0x41, 0x12, 0x6c, 0x2f,
|
||||
0xc5, 0xbb, 0xc3, 0xba, 0x69, 0x73, 0x52, 0x64,
|
||||
0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a,
|
||||
0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a };
|
||||
unsigned char udp_payload_hit[] = { /* Stun packet */ //rule:"1-1:03&9-10:2d&14-16:2d34&19-21:2d&24-25:2d"
|
||||
0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42, //1-1:03
|
||||
0x4f, 0xc2, 0x2d, 0x70, 0xb3, 0xa8, 0x4e, 0x2d, //10-10:2d
|
||||
0x34, 0x22, 0x87, 0x4c, 0x2d, 0x00, 0x00, 0x46, //15-16:2d34
|
||||
0x2d, 0x34, 0xab, 0x39, 0xbb, 0x97, 0xe5, 0x01, //20-20:2d
|
||||
0x03, 0x46, 0x1c, 0x28, 0x5b, 0xab, 0xfa, 0x9a, //24-24:2d
|
||||
0xab, 0x2e, 0x71, 0x39, 0x66, 0xa0, 0xd7, 0xb9,
|
||||
0xd8, 0x41, 0xa7, 0xa0, 0x84, 0xa9, 0xf3, 0x1b,
|
||||
0x03, 0x7f, 0xa8, 0x28, 0xa2, 0xd3, 0x64, 0xc2,
|
||||
0x3d, 0x20, 0xe0, 0xb1, 0x41, 0x12, 0x6c, 0x2f,
|
||||
0xc5, 0xbb, 0xc3, 0xba, 0x69, 0x73, 0x52, 0x64,
|
||||
0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a,
|
||||
0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a };
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, "APP_PAYLOAD");
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
int ret = maat_state_set_scan_district(state, table_id, region_name, strlen(region_name));
|
||||
EXPECT_EQ(ret, 0);
|
||||
|
||||
ret = maat_scan_string(maat_inst, table_id, (char*)udp_payload_not_hit, sizeof(udp_payload_not_hit),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK);
|
||||
|
||||
ret = maat_scan_string(maat_inst, table_id, (char*)udp_payload_hit, sizeof(udp_payload_hit),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 148);
|
||||
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, ExprPlusWithHex) {
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char *scan_data1 = "text/html; charset=UTF-8";
|
||||
const char *scan_data2 = "Batman\\:Take me Home.Superman/:Fine,stay with me.";
|
||||
const char *region_name1 = "Content-Type";
|
||||
const char *region_name2 = "User-Agent";
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, "HTTP_SIGNATURE");
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
int ret = maat_state_set_scan_district(state, table_id, region_name1, strlen(region_name1));
|
||||
ASSERT_EQ(ret, 0);
|
||||
ret = maat_scan_string(maat_inst, table_id, scan_data1, strlen(scan_data1),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 156);
|
||||
|
||||
ret = maat_state_set_scan_district(state, table_id, region_name2, strlen(region_name2));
|
||||
ASSERT_EQ(ret, 0);
|
||||
ret = maat_scan_string(maat_inst, table_id, scan_data1, strlen(scan_data1),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK); //maat-v3 consider as half hit, it's unreasonable
|
||||
|
||||
table_id = maat_get_table_id(maat_inst, "KEYWORDS_TABLE");
|
||||
ret = maat_scan_string(maat_inst, table_id, scan_data2, strlen(scan_data2),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 132);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, ExprAndExprPlus) {
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char *expr_table_name = "HTTP_URL";
|
||||
const char *expr_plus_table_name = "HTTP_SIGNATURE";
|
||||
const char *region_name = "I love China";
|
||||
const char *scan_data = "today is Monday and yesterday is Tuesday";
|
||||
|
||||
int expr_table_id = maat_get_table_id(maat_inst, expr_table_name);
|
||||
int expr_plus_table_id = maat_get_table_id(maat_inst, expr_plus_table_name);
|
||||
|
||||
int ret = maat_scan_string(maat_inst, expr_plus_table_id, scan_data, strlen(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_ERR);
|
||||
|
||||
ret = maat_state_set_scan_district(state, expr_plus_table_id, region_name, strlen(region_name));
|
||||
ASSERT_EQ(ret, 0);
|
||||
ret = maat_scan_string(maat_inst, expr_plus_table_id, scan_data, strlen(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
|
||||
|
||||
ret = maat_scan_string(maat_inst, expr_table_id, scan_data, strlen(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 195);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, ShouldNotHitExprPlus) {
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char *region_name = "tcp.payload";
|
||||
unsigned char udp_payload_not_hit[] = { /* Stun packet */
|
||||
0x00, 0x03, 0x00, 0x4a, 0x21, 0x12, 0xa4, 0x42,
|
||||
0x4f, 0xc2, 0xc2, 0x70, 0xb3, 0xa8, 0x4e, 0x22,
|
||||
0xf5, 0x22, 0x87, 0x4c, 0x40, 0x00, 0x00, 0x46,
|
||||
0x03, 0x02, 0xab, 0x39, 0xbb, 0x97, 0xe5, 0x01,
|
||||
0x3a, 0x46, 0x1c, 0x28, 0x5b, 0xab, 0xfa, 0x9a,
|
||||
0xab, 0x2e, 0x71, 0x39, 0x66, 0xa0, 0xd7, 0xb9,
|
||||
0xd8, 0x41, 0xa7, 0xa0, 0x84, 0xa9, 0xf3, 0x1b,
|
||||
0x03, 0x7f, 0xa8, 0x28, 0xa2, 0xd3, 0x64, 0xc2,
|
||||
0x3d, 0x20, 0xe0, 0xb1, 0x41, 0x12, 0x6c, 0x2f,
|
||||
0xc5, 0xbb, 0xc3, 0xba, 0x69, 0x73, 0x52, 0x64,
|
||||
0xf6, 0x30, 0x81, 0xf4, 0x3f, 0xc2, 0x19, 0x6a,
|
||||
0x68, 0x61, 0x93, 0x08, 0xc0, 0x0a, 0xab, 0x00 };
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, "APP_PAYLOAD");
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
int ret = maat_state_set_scan_district(state, table_id, region_name, strlen(region_name));
|
||||
ASSERT_EQ(ret, 0);
|
||||
|
||||
ret = maat_scan_string(maat_inst, table_id, (char *)udp_payload_not_hit, sizeof(udp_payload_not_hit),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK); //maat-v3 consider as half hit, it's unreasonable
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, Expr8) {
|
||||
const char *table_name = "KEYWORDS_TABLE";
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
char scan_data[128] = "string1, string2, string3, string4, string5, string6, string7, string8";
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
|
||||
int ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(n_hit_result, 1);
|
||||
EXPECT_EQ(results[0], 182);
|
||||
|
||||
struct maat_hit_path hit_path[HIT_PATH_SIZE] = {0};
|
||||
int n_read = 0;
|
||||
n_read = maat_state_get_hit_paths(state, hit_path, HIT_PATH_SIZE);
|
||||
EXPECT_NE(n_read, 0);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, HexBinCaseSensitive) {
|
||||
const char *table_name = "KEYWORDS_TABLE";
|
||||
const char *scan_data1 = "String TeST should not hit.";
|
||||
const char *scan_data2 = "String TEST should hit";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
int thread_id = 0;
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
int ret = maat_scan_string(maat_inst, table_id, scan_data1, strlen(scan_data1),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK);
|
||||
maat_state_reset(state);
|
||||
|
||||
ret = maat_scan_string(maat_inst, table_id, scan_data2, strlen(scan_data2),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(n_hit_result, 2);
|
||||
EXPECT_EQ(results[0], 206);
|
||||
EXPECT_EQ(results[1], 191);
|
||||
maat_state_free(state);
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, BugReport20190325) {
|
||||
unsigned char scan_data[] = {/* Packet 1 */
|
||||
0x01, 0x00, 0x00, 0x00, 0x79, 0x00, 0x00, 0x00,
|
||||
0x00, 0xf4, 0x01, 0x00, 0x00, 0x32, 0x00, 0x00,
|
||||
0x00, 0xe8, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00,
|
||||
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x2d, 0x3d, 0x3d, 0x20, 0x48, 0x3d, 0x48, 0x20,
|
||||
0x3d, 0x3d, 0x2d, 0x3a, 0x00, 0x02, 0x00, 0x00,
|
||||
0x00, 0x07, 0x0e, 0x00, 0x00, 0xe8, 0x03, 0x00,
|
||||
0x00, 0x4c, 0x69, 0x6e, 0x75, 0x78, 0x20, 0x33,
|
||||
0x2e, 0x31, 0x39, 0x2e, 0x30, 0x2d, 0x31, 0x35,
|
||||
0x2d, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x69, 0x63,
|
||||
0x00, 0x31, 0x3a, 0x47, 0x32, 0x2e, 0x34, 0x30,
|
||||
0x00};
|
||||
const char *table_name = "TROJAN_PAYLOAD";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
int thread_id = 0;
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
int ret = maat_scan_string(maat_inst, table_id, (char *)scan_data, sizeof(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(n_hit_result, 1);
|
||||
EXPECT_EQ(results[0], 150);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, MaatUnescape) {
|
||||
const char *scan_data = "Batman\\:Take me Home.Superman/:Fine,stay with me.";
|
||||
const char *table_name = "KEYWORDS_TABLE";
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
int thread_id = 0;
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
int ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(n_hit_result, 1);
|
||||
EXPECT_EQ(results[0], 132);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, OffsetChunk64) {
|
||||
const char *table_name = "IMAGE_FP";
|
||||
const char *file_name = "./testdata/mesa_logo.jpg";
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
|
||||
FILE *fp = fopen(file_name, "r");
|
||||
ASSERT_FALSE(fp==NULL);
|
||||
|
||||
char scan_data[64];
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
struct maat_stream *sp = maat_stream_new(maat_inst, table_id, state);
|
||||
ASSERT_TRUE(sp != NULL);
|
||||
|
||||
int ret = 0;
|
||||
int read_size = 0;
|
||||
int pass_flag = 0;
|
||||
while (0 == feof(fp)) {
|
||||
read_size = fread(scan_data, 1, sizeof(scan_data), fp);
|
||||
ret = maat_stream_scan(sp, scan_data, read_size,
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
if (ret > 0) {
|
||||
pass_flag = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
EXPECT_EQ(pass_flag, 1);
|
||||
EXPECT_EQ(results[0], 136);
|
||||
maat_stream_free(sp);
|
||||
fclose(fp);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, OffsetChunk1460) {
|
||||
const char *table_name = "IMAGE_FP";
|
||||
const char *file_name = "./testdata/mesa_logo.jpg";
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
|
||||
FILE *fp = fopen(file_name, "r");
|
||||
ASSERT_FALSE(fp==NULL);
|
||||
|
||||
char scan_data[1460];
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
struct maat_stream *sp = maat_stream_new(maat_inst, table_id, state);
|
||||
ASSERT_TRUE(sp != NULL);
|
||||
|
||||
int ret = 0;
|
||||
int read_size = 0;
|
||||
int pass_flag = 0;
|
||||
while (0 == feof(fp)) {
|
||||
read_size = fread(scan_data, 1, sizeof(scan_data), fp);
|
||||
ret = maat_stream_scan(sp, scan_data, read_size,
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
if (ret > 0) {
|
||||
pass_flag = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
EXPECT_EQ(pass_flag, 1);
|
||||
EXPECT_EQ(results[0], 136);
|
||||
maat_stream_free(sp);
|
||||
fclose(fp);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, StreamScanUTF8) {
|
||||
const char *table_name = "TROJAN_PAYLOAD";
|
||||
const char* file_name = "./testdata/jd.com.html";
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
char scan_data[2048];
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
|
||||
FILE *fp = fopen(file_name, "r");
|
||||
ASSERT_FALSE(fp == NULL);
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
struct maat_stream *sp = maat_stream_new(maat_inst, table_id, state);
|
||||
ASSERT_FALSE(sp == NULL);
|
||||
|
||||
int pass_flag = 0;
|
||||
while (0 == feof(fp)) {
|
||||
size_t read_size = fread(scan_data, 1, sizeof(scan_data), fp);
|
||||
int ret = maat_stream_scan(sp, scan_data, read_size, results, ARRAY_SIZE,
|
||||
&n_hit_result, state);
|
||||
if (ret == MAAT_SCAN_HIT) {
|
||||
pass_flag = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
EXPECT_EQ(pass_flag, 1);
|
||||
EXPECT_EQ(results[0], 157);
|
||||
maat_stream_free(sp);
|
||||
fclose(fp);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
TEST_F(JsonMode, StreamInput) {
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = JsonMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
const char *scan_data = "http://www.cyberessays.com/search_results.php?action=search&query=yulingjing,abckkk,1234567";
|
||||
const char *table_name = "HTTP_URL";
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
ASSERT_GT(table_id, 0);
|
||||
|
||||
struct maat_stream *sp = maat_stream_new(maat_inst, table_id, state);
|
||||
ASSERT_TRUE(sp != NULL);
|
||||
|
||||
int ret = maat_stream_scan(sp, "www.cyberessays.com", strlen("www.cyberessays.com"),
|
||||
results, ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK);
|
||||
|
||||
ret = maat_stream_scan(sp, scan_data, strlen(scan_data), results, ARRAY_SIZE,
|
||||
&n_hit_result, state);
|
||||
maat_stream_free(sp);
|
||||
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(results[0], 125);
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
class RedisMode : public testing::Test
|
||||
{
|
||||
protected:
|
||||
static void SetUpTestCase() {
|
||||
const char *redis_ip = "127.0.0.1";
|
||||
uint16_t redis_port = 6379;
|
||||
int redis_db = 0;
|
||||
|
||||
struct maat_options *opts = maat_options_new();
|
||||
maat_options_set_redis(opts, redis_ip, redis_port, redis_db);
|
||||
maat_options_set_logger(opts, "./maat_sample_gtest.log", LOG_LEVEL_INFO);
|
||||
|
||||
_shared_maat_inst = maat_new(opts, table_info_path);
|
||||
maat_options_free(opts);
|
||||
if (NULL == _shared_maat_inst) {
|
||||
assert(0);
|
||||
}
|
||||
}
|
||||
|
||||
static void TearDownTestCase() {
|
||||
maat_free(_shared_maat_inst);
|
||||
}
|
||||
|
||||
static struct maat *_shared_maat_inst;
|
||||
};
|
||||
|
||||
struct maat *RedisMode::_shared_maat_inst;
|
||||
|
||||
TEST_F(RedisMode, dynamic_config) {
|
||||
const char *table_name = "HTTP_URL";
|
||||
char data[128] = "welcome to maat version4, it's funny.";
|
||||
long long results[ARRAY_SIZE] = {0};
|
||||
size_t n_hit_result = 0;
|
||||
int thread_id = 0;
|
||||
struct maat *maat_inst = RedisMode::_shared_maat_inst;
|
||||
struct maat_state *state = maat_state_new(maat_inst, thread_id);
|
||||
|
||||
int table_id = maat_get_table_id(maat_inst, table_name);
|
||||
int ret = maat_scan_string(maat_inst, table_id, data, strlen(data), results,
|
||||
ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK);
|
||||
maat_state_reset(state);
|
||||
|
||||
const char *compile_table_name = "COMPILE";
|
||||
const char *g2c_table_name = "GROUP2COMPILE";
|
||||
|
||||
/* compile table add line */
|
||||
long long compile_id = maat_cmd_incrby(maat_inst, "TEST_SEQ", 1);
|
||||
ret = compile_table_set_line(maat_inst, compile_table_name, MAAT_OP_ADD, compile_id, "null", 1, 0);
|
||||
EXPECT_EQ(ret, 1);
|
||||
|
||||
/* group2compile table add line */
|
||||
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
|
||||
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD, group_id,
|
||||
compile_id, 0, "null", 1, 0);
|
||||
EXPECT_EQ(ret, 1);
|
||||
|
||||
/* expr table add line */
|
||||
long long item_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
|
||||
const char *keywords = "welcome to maat";
|
||||
ret = expr_table_set_line(maat_inst, table_name, MAAT_OP_ADD, item_id, group_id,
|
||||
keywords, 1, 0, 0, 0); /* EXPR_TYPE_AND MATCH_METHOD_SUB */
|
||||
EXPECT_EQ(ret, 1);
|
||||
|
||||
sleep(WAIT_FOR_EFFECTIVE_S);
|
||||
|
||||
ret = maat_scan_string(maat_inst, table_id, data, strlen(data), results,
|
||||
ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_HIT);
|
||||
EXPECT_EQ(n_hit_result, 1);
|
||||
EXPECT_EQ(results[0], compile_id);
|
||||
maat_state_reset(state);
|
||||
|
||||
/* expr table del line */
|
||||
ret = expr_table_set_line(maat_inst, table_name, MAAT_OP_DEL, item_id, group_id,
|
||||
keywords, 1, 0, 0, 0); /* EXPR_TYPE_AND MATCH_METHOD_SUB */
|
||||
EXPECT_EQ(ret, 1);
|
||||
|
||||
/* group2compile table del line */
|
||||
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL, group_id,
|
||||
compile_id, 0, "null", 1, 0);
|
||||
EXPECT_EQ(ret, 1);
|
||||
|
||||
/* compile table del line */
|
||||
ret = compile_table_set_line(maat_inst, compile_table_name, MAAT_OP_DEL, compile_id, "null", 1, 0);
|
||||
EXPECT_EQ(ret, 1);
|
||||
|
||||
sleep(WAIT_FOR_EFFECTIVE_S);
|
||||
|
||||
ret = maat_scan_string(maat_inst, table_id, data, strlen(data), results,
|
||||
ARRAY_SIZE, &n_hit_result, state);
|
||||
EXPECT_EQ(ret, MAAT_SCAN_OK);
|
||||
|
||||
maat_state_free(state);
|
||||
state = NULL;
|
||||
}
|
||||
|
||||
int main(int argc, char ** argv)
|
||||
{
|
||||
int ret=0;
|
||||
::testing::InitGoogleTest(&argc, argv);
|
||||
|
||||
ret=RUN_ALL_TESTS();
|
||||
|
||||
return ret;
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
依赖 crypto库，需提前安装
|
||||
安装 redis-server 并按默认配置启动即可，maat_demo_gtest 会用到 redis
|
||||
|
||||
## 编译 & 运行单测
|
||||
1. 当前目录，mkdir build
|
||||
2. cd build
|
||||
3. cmake ..
|
||||
4. make
|
||||
5. ./maat_demo_gtest
|
||||
|
||||
## 文件说明：
|
||||
|
||||
- include 目录存放 maat 库头文件
|
||||
- lib 目录存放 maat 动态库及 gtest 静态库
|
||||
- testdata 为单测所需测试数据
|
||||
- maat_demo.json 为json 格式的匹配规则，运行时会转为 iris 格式，位于maat_demo.json_iris_tmp目录(运行时生成)
|
||||
- demo_table_info.conf用于表示 iris 格式规则每列代表的含义，maat解析对应列的数据
|
||||
- maat_demo_gtest.cpp 为单测文件，字符串匹配相关测试用例可供参考
|
||||
77893
test/maat_demo/testdata/bool-matcher-test-exprs.txt
vendored
77893
test/maat_demo/testdata/bool-matcher-test-exprs.txt
vendored
File diff suppressed because it is too large
Load Diff
48
test/maat_demo/testdata/charsetWindows1251.txt
vendored
48
test/maat_demo/testdata/charsetWindows1251.txt
vendored
@@ -1,48 +0,0 @@
|
||||
<EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!','JS_CORE_WINDOW_AUTH':'<27><><EFBFBD><EFBFBD><EFBFBD>','JS_CORE_IMAGE_FULL':'<27><><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'});</script>
|
||||
<script type="text/javascript">(window.BX||top.BX).message({'LANGUAGE_ID':'ru','FORMAT_DATE':'DD.MM.YYYY','FORMAT_DATETIME':'DD.MM.YYYY HH:MI:SS','COOKIE_PREFIX':'BITRIX_SM','USER_ID':'','SERVER_TIME':'1578340589','SERVER_TZ_OFFSET':'18000','USER_TZ_OFFSET':'0','USER_TZ_AUTO':'Y','bitrix_sessid':'fadf964e9f5bb819f212e5abf5ffb255','SITE_ID':'s1'});</script>
|
||||
|
||||
|
||||
<script type="text/javascript" src="/bitrix/cache/js/s1/web20/kernel_main/kernel_main.js?1402043622360126"></script>
|
||||
<script type="text/javascript" src="/bitrix/js/main/rsasecurity.js?136876011925044"></script>
|
||||
<script type="text/javascript">BX.setCSSList(['/bitrix/js/main/core/css/core.css','/bitrix/js/main/core/css/core_popup.css','/bitrix/js/main/core/css/core_date.css','/bitrix/js/main/core/css/core.css','/bitrix/js/main/core/css/core_popup.css','/bitrix/js/main/core/css/core_date.css']); </script>
|
||||
<script type="text/javascript">BX.setJSList(['/bitrix/js/main/core/core.js','/bitrix/js/main/core/core_ajax.js','/bitrix/js/main/session.js','/bitrix/js/main/json/json2.min.js','/bitrix/js/main/core/core_ls.js','/bitrix/js/main/core/core_window.js','/bitrix/js/main/utils.js','/bitrix/js/main/core/core_popup.js','/bitrix/js/main/core/core_date.js','/bitrix/js/main/dd.js']); </script>
|
||||
|
||||
<script type="text/javascript">
|
||||
bxSession.Expand(1440, 'fadf964e9f5bb819f212e5abf5ffb255', false, '35a74b06af8f9ea55ffbda20075b0894');
|
||||
</script>
|
||||
<script>new Image().src='http://www.sgaice.ru/bitrix/spread.php?s=QklUUklYX1NNX0dVRVNUX0lEATY4MTg5NQExNjA5NDQ0NTg5AS8BAQECQklUUklYX1NNX0xBU1RfVklTSVQBMDcuMDEuMjAyMCAwMDo1NjoyOQExNjA5NDQ0NTg5AS8BAQEC&k=71d3b79b44f9716b27b47feab4a206cf';
|
||||
</script>
|
||||
|
||||
<script type="text/javascript" src="/bitrix/cache/js/s1/web20/template_1e341eb2f86845c7519566374f51d35a/template_1e341eb2f86845c7519566374f51d35a_368c1a68876fd1c32b307a10695f3654.js?14010848191120"></script>
|
||||
<script type="text/javascript" src="/bitrix/js/imgzoom/thumb.js"></script>
|
||||
<meta name="google-site-verification" content="gL_64SaiDgQcX5z-pvPZmBJ-exN-wS6KZNoDMcPtYtM" />
|
||||
<title><3E><><EFBFBD> <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><>ѻ</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
|
||||
|
||||
<div id="maintop">
|
||||
<table align="left1" width="100%" border="0" cellpadding="0" cellspacing="0">
|
||||
<tr><td valign="top">
|
||||
|
||||
<script type="text/javascript">
|
||||
top.BX.defer(top.rsasec_form_bind)({'formid':'system_auth_form6zOUGO','key':{'M':'HazQxsgvQCIFPf30iHR40R22fp7P9YLPXFhQu6uus68RZxf2IpMo9v0KDpxkgg43WXaZaXrTRvjg1e2126IOo66vH5bphkMP/69MSPlEoaXYzWjTokd+Yzy30WR6HEOyB9tJwADGyjysqoE4+jUfHZQv2JMaVZS0U4SHWOUPwNU=','E':'AQAB','chunk':'128'},'rsa_rand':'5e1390ed8a8e19.17355178','params':['USER_PASSWORD']});
|
||||
</script>
|
||||
|
||||
|
||||
|
||||
<div id="login-form-window">
|
||||
|
||||
<a href="" onclick="return CloseLoginForm()" style="float:right;"><3E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD></a>
|
||||
|
||||
<form method="post" target="_top" action="/index.php?login=yes">
|
||||
<input type="hidden" name="backurl" value="/index.php" />
|
||||
<input type="hidden" name="AUTH_FORM" value="Y" />
|
||||
<input type="hidden" name="TYPE" value="AUTH" />
|
||||
|
||||
<table width="95%">
|
||||
<tr>
|
||||
<td colspan="2">
|
||||
<09><><EFBFBD><EFBFBD><EFBFBD>:<br />
|
||||
<input type="text" name="USER_LOGIN" maxlength="50" value="
|
||||
BIN
test/maat_demo/testdata/digest_test.data
vendored
BIN
test/maat_demo/testdata/digest_test.data
vendored
Binary file not shown.
968
test/maat_demo/testdata/jd.com.html
vendored
968
test/maat_demo/testdata/jd.com.html
vendored
File diff suppressed because one or more lines are too long
BIN
test/maat_demo/testdata/mesa_logo.jpg
vendored
BIN
test/maat_demo/testdata/mesa_logo.jpg
vendored
Binary file not shown.
|
Before Width: | Height: | Size: 105 KiB |
File diff suppressed because it is too large
Load Diff
@@ -55,7 +55,6 @@ int make_serial_rule(const char *table_name, const char *line, void *u_para)
|
||||
char *buff = ALLOC(char, strlen(line) + 1);
|
||||
|
||||
memcpy(buff, line, strlen(line) + 1);
|
||||
|
||||
while (buff[strlen(buff) - 1] == '\n' || buff[strlen(buff) - 1] == '\t') {
|
||||
buff[strlen(buff) - 1] = '\0';
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user