gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

如果扫描无规则数值类型的table时直接返回，导致未进行非表达式的运算。

Browse Source
This commit is contained in:
liuxueli
2021-08-20 14:44:09 +08:00
parent d86d220f33
commit c84fb97aae
4 changed files with 257 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

160
test/maat_json.json
View File

@@ -2085,28 +2085,28 @@
}
]
},
{
"compile_id": 185,
"service": 0,
"action": 0,
"do_blacklist": 0,
"do_log": 0,
"effective_rage": 0,
"user_region": "ipv4_composition.NOT_match",
"is_valid": "yes",
"groups": [
{
"group_name":"IPv4-composition-NOT-client-ip",
"virtual_table":"COMPOSITION_IP_SOURCE",
"not_flag":0
},
{
"group_name":"IPv4-composition-NOT-server-ip",
"virtual_table":"COMPOSITION_IP_DESTINATION",
"not_flag":1
}
]
},
{
"compile_id": 185,
"service": 0,
"action": 0,
"do_blacklist": 0,
"do_log": 0,
"effective_rage": 0,
"user_region": "ipv4_composition.NOT_match",
"is_valid": "yes",
"groups": [
{
"group_name":"IPv4-composition-NOT-client-ip",
"virtual_table":"COMPOSITION_IP_SOURCE",
"not_flag":0
},
{
"group_name":"IPv4-composition-NOT-server-ip",
"virtual_table":"COMPOSITION_IP_DESTINATION",
"not_flag":1
}
]
},
{
"compile_id": 186,
"service": 1,
@@ -2117,7 +2117,7 @@
"is_valid": "yes",
"groups": [
{
"not_flag":1,
"not_flag": 1,
"regions": [
{
"table_name": "HTTP_URL",
@@ -2138,9 +2138,9 @@
"table_name": "IP_PLUS_CONFIG",
"table_content": {
"addr_type": "ipv4",
"saddr_format": "CIDR",
"src_ip1": "10.0.8.18",
"src_ip2": "10.0.8.18",
"saddr_format": "range",
"src_ip1": "10.0.8.186",
"src_ip2": "10.0.8.186",
"sport_format": "range",
"src_port1": "18611",
"src_port2": "18611",
@@ -2153,9 +2153,113 @@
"protocol": 6,
"direction": "single"
}
}
}
],
"not_flag" : 0
"not_flag": 0
}
]
},
{
"compile_id": 187,
"service": 1,
"action": 1,
"do_blacklist": 1,
"do_log": 1,
"user_region": "NOTLogic.ScanHitAtLast",
"is_valid": "yes",
"groups": [
{
"not_flag": 1,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "string",
"table_content": {
"keywords": "must-not-contained-string-of-rule-187",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"regions": [
{
"table_type": "ip_plus",
"table_name": "IP_PLUS_CONFIG",
"table_content": {
"addr_type": "ipv4",
"saddr_format": "range",
"src_ip1": "10.0.8.187",
"src_ip2": "10.0.8.187",
"sport_format": "range",
"src_port1": "18611",
"src_port2": "18611",
"daddr_format": "range",
"dst_ip1": "10.0.8.20",
"dst_ip2": "10.0.8.20",
"dport_format": "range",
"dst_port1": "80",
"dst_port2": "80",
"protocol": 6,
"direction": "single"
}
}
],
"not_flag": 0
}
]
},
{
"compile_id": 188,
"service": 1,
"action": 1,
"do_blacklist": 1,
"do_log": 1,
"user_region": "NOTLogic.ScanHitAtLast",
"is_valid": "yes",
"groups": [
{
"not_flag": 1,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "string",
"table_content": {
"keywords": "must-not-contained-string-of-rule-188",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"regions": [
{
"table_type": "ip_plus",
"table_name": "IP_PLUS_CONFIG",
"table_content": {
"addr_type": "ipv4",
"saddr_format": "range",
"src_ip1": "10.0.8.188",
"src_ip2": "10.0.8.188",
"sport_format": "range",
"src_port1": "18611",
"src_port2": "18611",
"daddr_format": "range",
"dst_ip1": "10.0.8.20",
"dst_ip2": "10.0.8.20",
"dport_format": "range",
"dst_port1": "80",
"dst_port2": "80",
"protocol": 6,
"direction": "single"
}
}
],
"not_flag": 0
}
]
}