gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[UNIT_TEST]add some corner case for NOT logic

Browse Source
This commit is contained in:
liuwentan
2023-10-20 14:25:03 +08:00
parent 613b5b3dcf
commit bf05309f2a
4 changed files with 1251 additions and 667 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/maat_compile.c
View File

@@ -2024,8 +2024,9 @@ int group2compile_runtime_update(void *g2c_runtime, void *g2c_schema,
}
if (1 == g2c_item->not_flag) {
ret = validate_vtable_not_clause(g2c_rt, schema->ref_tbl_mgr, g2c_item->vtable_id,
is_valid, compile_rt->logger);
ret = validate_vtable_not_clause(g2c_rt, schema->ref_tbl_mgr,
g2c_item->vtable_id, is_valid,
compile_rt->logger);
if (ret < 0) {
log_fatal(compile_rt->logger, MODULE_COMPILE,
"[%s:%d]validate NOT clause failed, abandon config:%s",
@@ -2273,7 +2274,7 @@ int maat_compile_state_update(int vtable_id, struct maat_item *hit_items,
}
for (i = 0; i < hit_cnt; i++) {
hit_group_ids[i] = hit_items[i].group_id;
hit_group_ids[i] = hit_items[i].group_id;
}
int g2g_table_id = table_manager_get_group2group_table_id(maat_inst->tbl_mgr);

1728
test/maat_framework_gtest.cpp
View File

File diff suppressed because it is too large Load Diff

177
test/maat_json.json
View File

@@ -796,7 +796,7 @@
"action": 1,
"do_blacklist": 1,
"do_log": 1,
"user_region": "NOTLogic.ScanMultiNotClause",
"user_region": "NOTLogic.NotExprClauseAndNotIPClause",
"is_valid": "yes",
"groups": [
{
@@ -3572,6 +3572,181 @@
]
}
]
},
{
"compile_id": 221,
"service": 0,
"action": 0,
"do_blacklist": 0,
"do_log": 0,
"user_region": "NOTLogic.ScanWithDistrict",
"is_valid": "yes",
"groups": [
{
"group_name": "NOTLogicGroup_221_1",
"virtual_table": "HTTP_REQUEST_HEADER",
"not_flag": 1,
"regions": [
{
"table_name": "HTTP_SIGNATURE",
"table_type": "expr_plus",
"table_content": {
"district": "User-Agent",
"keywords": "Mozilla/5.0",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"group_name": "NOTLogicGroup_221_2",
"not_flag": 0,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "scan_with_district_221",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
}
]
},
{
"compile_id": 222,
"service": 0,
"action": 0,
"do_blacklist": 0,
"do_log": 0,
"user_region": "NOTLogic.SameClauseHasMultiNotGroups",
"is_valid": "yes",
"groups": [
{
"group_name": "NOTLogicGroup_222_1",
"virtual_table": "HTTP_URL_FILTER",
"clause_index": 0,
"not_flag": 1,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "not_logic_compile_222_1",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"group_name": "NOTLogicGroup_222_2",
"virtual_table": "HTTP_URL_FILTER",
"clause_index": 0,
"not_flag": 1,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "not_logic_compile_222_2",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"group_name": "NOTLogicGroup_222_3",
"virtual_table": "HTTP_URL_FILTER",
"clause_index": 1,
"not_flag": 0,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "logic_compile_222_3",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
}
]
},
{
"compile_id": 223,
"service": 0,
"action": 0,
"do_blacklist": 0,
"do_log": 0,
"user_region": "NOTLogic.MultiNotClause",
"is_valid": "yes",
"groups": [
{
"group_name": "NOTLogicGroup_223_1",
"virtual_table": "HTTP_NOT_LOGIC",
"not_flag": 1,
"clause_index": 0,
"regions": [
{
"table_name": "KEYWORDS_TABLE",
"table_type": "expr",
"table_content": {
"keywords": "not_logic_compile_223_1",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"group_name": "NOTLogicGroup_223_2",
"virtual_table": "HTTP_NOT_LOGIC",
"not_flag": 1,
"clause_index": 1,
"regions": [
{
"table_name": "KEYWORDS_TABLE",
"table_type": "expr",
"table_content": {
"keywords": "not_logic_compile_223_2",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"group_name": "NOTLogicGroup_223_1",
"virtual_table": "HTTP_NOT_LOGIC",
"not_flag": 1,
"clause_index": 2,
"regions": [
{
"table_name": "KEYWORDS_TABLE",
"table_type": "expr",
"table_content": {
"keywords": "not_logic_compile_223_3",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
}
]
}
],
"plugin_table": [

6
test/table_info.conf
View File

@@ -638,5 +638,11 @@
"table_name":"HTTP_DUMMY",
"table_type":"virtual",
"physical_table": "KEYWORDS_TABLE"
},
{
"table_id":58,
"table_name":"HTTP_NOT_LOGIC",
"table_type":"virtual",
"physical_table": "KEYWORDS_TABLE"
}
]