diff --git a/test/maat_json.json b/test/maat_json.json index 892ebed..29495f8 100644 --- a/test/maat_json.json +++ b/test/maat_json.json @@ -1971,6 +1971,32 @@ ] } ] + }, + { + "compile_id": 183, + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "StringScan.RegexWithNotContains", + "is_valid": "yes", + "groups": [ + { + "group_name": "Untitled", + "regions": [ + { + "table_name": "HTTP_URL", + "table_type": "string", + "table_content": { + "keywords": "^(?=.*/rain/a/TWF2021042600418000)(?!new.qq.com).*", + "expr_type": "regex", + "match_method": "sub", + "format": "uncase plain" + } + } + ] + } + ] } ], "plugin_table": [ diff --git a/test/test_maatframe.cpp b/test/test_maatframe.cpp index 98a933c..0412e7a 100644 --- a/test/test_maatframe.cpp +++ b/test/test_maatframe.cpp @@ -1326,6 +1326,35 @@ TEST(StringScan, Expr8) return; } +TEST(StringScan, RegexWithNotContains) +{ + int ret=0; + int table_id=0; + struct Maat_rule_t result[4]; + //The rule is contains + const char* should_NOT_hit_scan_data="new.qq.com/rain/a/TWF2021042600418000"; + const char* should_hit_scan_data="fakesina.com/rain/a/TWF2021042600418000"; + const char* table_name="HTTP_URL"; + scan_status_t mid=NULL; + + table_id=Maat_table_register(g_feather,table_name); + ASSERT_GT(table_id, 0); + + ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, should_NOT_hit_scan_data, strlen(should_NOT_hit_scan_data), + result, NULL, 4, + &mid, 0); + EXPECT_EQ(ret, 0); + Maat_clean_status(&mid); + + ret=Maat_full_scan_string(g_feather, table_id, CHARSET_GBK, should_hit_scan_data, strlen(should_hit_scan_data), + result, NULL, 4, + &mid, 0); + EXPECT_EQ(ret, 1); + EXPECT_EQ(result[0].config_id, 183); + Maat_clean_status(&mid); + + return; +} TEST(StringScan, StreamInput) { @@ -3985,7 +4014,7 @@ TEST_F(MaatCmdTest, UpdateDeadLockDetection) Maat_cmd_incrby(feather, "MAAT_VERSION", -100); //Wating for scanner garbage collect expiration. - sleep(20); + sleep(10); ret=Maat_full_scan_string(feather, table_id, CHARSET_GBK, scan_data2, strlen(scan_data2), result, NULL, 4, &mid, 0); @@ -4021,6 +4050,11 @@ int main(int argc, char ** argv) //Set a short intevral for testing. Maat_set_feather_opt(g_feather, MAAT_OPT_EFFECT_INVERVAL_MS, &effective_interval_ms, sizeof(effective_interval_ms)); + //Set a short intevral for testing. + int tmp=0; + Maat_set_feather_opt(g_feather, MAAT_OPT_GARBAGE_COLLECTION_TIMEOUT_MS, &tmp, sizeof(tmp)); + + Maat_set_feather_opt(g_feather, MAAT_OPT_STAT_FILE_PATH, stat_file, strlen(stat_file)+1); Maat_set_feather_opt(g_feather, MAAT_OPT_STAT_ON, NULL, 0); Maat_set_feather_opt(g_feather, MAAT_OPT_PERF_ON, NULL, 0);