gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

support flag_plus table

Browse Source
This commit is contained in:
liuwentan
2023-03-01 17:44:07 +08:00
parent 2c6cca6f56
commit d429a6346d
16 changed files with 546 additions and 425 deletions
Download Patch File Download Diff File Expand all files Collapse all files

432
test/table_info.conf
View File

@@ -27,170 +27,6 @@
},
{
"table_id":2,
"table_name":"GROUP2GROUP",
"table_type":"group2group",
"valid_column":3,
"custom": {
"group_id":1,
"super_group_id":2
}
},
{
"table_id":3,
"table_name":"HTTP_URL_LITERAL",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":4,
"table_name":"HTTP_URL_REGEX",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"regex",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":5,
"table_name":"HTTP_HOST",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":6,
"table_name":"KEYWORDS_TABLE",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":7,
"table_name":"IP_CONFIG",
"table_type":"ip_plus",
"valid_column":18,
"custom": {
"item_id":1,
"group_id":2,
"addr_type":3,
"saddr_format":4,
"sip1":5,
"sip2":6
}
},
{
"table_id":8,
"table_name":"CONTENT_SIZE",
"table_type":"intval",
"valid_column":5,
"custom": {
"item_id":1,
"group_id":2,
"low_bound":3,
"up_bound":4
}
},
{
"table_id":9,
"table_name":"QD_ENTRY_INFO",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":1,
"tag":3
}
},
{
"table_id":10,
"table_name":"HTTP_SIGNATURE",
"table_type":"expr_plus",
"valid_column":8,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"district":3,
"keywords":4,
"expr_type":5,
"match_method":6,
"is_hexbin":7
}
},
{
"table_id":11,
"table_name":"IMAGE_FP",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":12,
"table_name":"TEST_EFFECTIVE_RANGE_TABLE",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":1,
"tag":5
}
},
{
"table_id":13,
"table_name":"TEST_FOREIGN_KEY",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":2,
"tag":3,
"foreign": [6,8]
}
},
{
"table_id":14,
"table_name":"COMPILE_ALIAS",
"table_type":"compile",
"user_region_encoded":"escape",
@@ -207,8 +43,186 @@
"evaluation_order":10
}
},
{
"table_id":3,
"table_name":"GROUP2COMPILE_ALIAS",
"table_type":"group2compile",
"associated_compile_table_id":0,
"valid_column":3,
"custom": {
"group_id":1,
"compile_id":2,
"not_flag":4,
"virtual_table_name":5,
"clause_index":6
}
},
{
"table_id":4,
"table_name":"GROUP2GROUP",
"table_type":"group2group",
"valid_column":3,
"custom": {
"group_id":1,
"super_group_id":2
}
},
{
"table_id":5,
"table_name":"HTTP_URL_LITERAL",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":6,
"table_name":"HTTP_URL_REGEX",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"regex",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":7,
"table_name":"HTTP_HOST",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":8,
"table_name":"KEYWORDS_TABLE",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":9,
"table_name":"IP_CONFIG",
"table_type":"ip_plus",
"valid_column":18,
"custom": {
"item_id":1,
"group_id":2,
"addr_type":3,
"saddr_format":4,
"sip1":5,
"sip2":6
}
},
{
"table_id":10,
"table_name":"CONTENT_SIZE",
"table_type":"intval",
"valid_column":5,
"custom": {
"item_id":1,
"group_id":2,
"low_bound":3,
"up_bound":4
}
},
{
"table_id":11,
"table_name":"QD_ENTRY_INFO",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":1,
"tag":3
}
},
{
"table_id":12,
"table_name":"HTTP_SIGNATURE",
"table_type":"expr_plus",
"valid_column":8,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"district":3,
"keywords":4,
"expr_type":5,
"match_method":6,
"is_hexbin":7
}
},
{
"table_id":13,
"table_name":"IMAGE_FP",
"table_type":"expr",
"valid_column":7,
"custom": {
"scan_mode":"block",
"pattern_type":"literal",
"item_id":1,
"group_id":2,
"keywords":3,
"expr_type":4,
"match_method":5,
"is_hexbin":6
}
},
{
"table_id":14,
"table_name":"TEST_EFFECTIVE_RANGE_TABLE",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":1,
"tag":5
}
},
{
"table_id":15,
"table_name":"TEST_FOREIGN_KEY",
"table_type":"plugin",
"valid_column":4,
"custom": {
"key":2,
"tag":3,
"foreign": [6,8]
}
},
{
"table_id":16,
"table_name":"TEST_PLUGIN_EXDATA_TABLE",
"table_type":"plugin",
"valid_column":4,
@@ -219,7 +233,7 @@
}
},
{
"table_id":16,
"table_id":17,
"table_name":"IR_INTERCEPT_IP",
"table_type":"plugin",
"valid_column":14,
@@ -229,7 +243,7 @@
}
},
{
"table_id":17,
"table_id":18,
"table_name":"APP_PAYLOAD",
"table_type":"expr_plus",
"valid_column":8,
@@ -246,7 +260,7 @@
}
},
{
"table_id":18,
"table_id":19,
"table_name":"TROJAN_PAYLOAD",
"table_type":"expr",
"valid_column":7,
@@ -263,7 +277,7 @@
}
},
{
"table_id":19,
"table_id":20,
"table_name":"MAIL_ADDR",
"table_type":"expr",
"valid_column":7,
@@ -279,7 +293,7 @@
}
},
{
"table_id":20,
"table_id":21,
"table_name":"IP_PLUS_CONFIG",
"table_type":"ip_plus",
"valid_column":18,
@@ -293,43 +307,43 @@
}
},
{
"table_id":21,
"table_id":22,
"table_name":"HTTP_RESPONSE_KEYWORDS",
"table_type":"virtual",
"physical_table": ["KEYWORDS_TABLE"]
},
{
"table_id":22,
"table_id":23,
"table_name":"HTTP_REQUEST_HEADER",
"table_type":"virtual",
"physical_table": ["HTTP_SIGNATURE"]
},
{
"table_id":23,
"table_id":24,
"table_name":"HTTP_RESPONSE_HEADER",
"table_type":"virtual",
"physical_table": ["HTTP_SIGNATURE"]
},
{
"table_id":24,
"table_id":25,
"table_name":"VIRTUAL_IP_PLUS_TABLE",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
},
{
"table_id":24,
"table_id":26,
"table_name":"VIRTUAL_IP_PLUS_SOURCE",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
},
{
"table_id":24,
"table_id":27,
"table_name":"VIRTUAL_IP_PLUS_DESTINATION",
"table_type":"virtual",
"physical_table": ["IP_PLUS_CONFIG"]
},
{
"table_id":29,
"table_id":28,
"table_name":"TEST_IP_PLUGIN_WITH_EXDATA",
"table_type":"ip_plugin",
"valid_column":6,
@@ -342,7 +356,7 @@
}
},
{
"table_id":30,
"table_id":29,
"table_name":"AS_NUMBER",
"table_type":"expr",
"valid_column":7,
@@ -358,19 +372,19 @@
}
},
{
"table_id":31,
"table_id":30,
"table_name":"SOURCE_IP_ASN",
"table_type":"virtual",
"physical_table":["AS_NUMBER"]
},
{
"table_id":32,
"table_id":31,
"table_name":"DESTINATION_IP_ASN",
"table_type":"virtual",
"physical_table":["AS_NUMBER"]
},
{
"table_id":33,
"table_id":32,
"table_name":"GeoLocation",
"table_type":"expr",
"valid_column":7,
@@ -386,13 +400,13 @@
}
},
{
"table_id":34,
"table_id":33,
"table_name":"SOURCE_IP_GEO",
"table_type":"virtual",
"physical_table":["GeoLocation"]
},
{
"table_id":35,
"table_id":34,
"table_name":"INTERGER_PLUS",
"table_type":"intval_plus",
"valid_column":6,
@@ -405,7 +419,7 @@
}
},
{
"table_id":36,
"table_id":35,
"table_name":"TEST_FQDN_PLUGIN_WITH_EXDATA",
"table_type":"fqdn_plugin",
"valid_column":5,
@@ -416,7 +430,7 @@
}
},
{
"table_id":38,
"table_id":36,
"table_name":"APP_ID",
"table_type":"intval",
"valid_column":5,
@@ -428,7 +442,7 @@
}
},
{
"table_id":39,
"table_id":37,
"table_name":"EMPTY_KEYWORD",
"table_type":"expr",
"valid_column":7,
@@ -444,7 +458,7 @@
}
},
{
"table_id":40,
"table_id":38,
"table_name":"EMPTY_INTERGER",
"table_type":"intval",
"valid_column":5,
@@ -456,7 +470,7 @@
}
},
{
"table_id":41,
"table_id":39,
"table_name":"TEST_BOOL_PLUGIN_WITH_EXDATA",
"table_type":"bool_plugin",
"valid_column":4,
@@ -466,7 +480,7 @@
}
},
{
"table_id":42,
"table_id":40,
"table_name":"FLAG_CONFIG",
"table_type":"flag",
"valid_column":5,
@@ -478,9 +492,22 @@
}
},
{
"table_id":43,
"table_name":"PORT_PROTO_CONFIG",
"table_type":"port_proto",
"table_id":41,
"table_name":"FLAG_PLUS_CONFIG",
"table_type":"flag_plus",
"valid_column":6,
"custom": {
"item_id":1,
"group_id":2,
"district":3,
"flag":4,
"flag_mask":5
}
},
{
"table_id":42,
"table_name":"PORT_CONFIG",
"table_type":"port",
"valid_column":7,
"custom": {
"item_id":1,
@@ -490,5 +517,28 @@
"port2":5,
"proto":6
}
},
{
"table_id":43,
"table_name":"VIRTUAL_PORT_SOURCE",
"table_type":"virtual",
"physical_table": ["PORT_CONFIG"]
},
{
"table_id":44,
"table_name":"VIRTUAL_PORT_DESTINATION",
"table_type":"virtual",
"physical_table": ["PORT_CONFIG"]
},
{
"table_id":45,
"table_name":"COMPOSITION_CONFIG",
"table_type":"composition",
"custom": {
"source_ip":"VIRTUAL_IP_PLUS_SOURCE",
"dest_ip":"VIRTUAL_IP_PLUS_DESTINATION",
"source_port":"VIRTUAL_PORT_SOURCE",
"dest_port":"VIRTUAL_PORT_DESTINATION"
}
}
]