gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH]update colm & ragel version

Browse Source
This commit is contained in:
liuwentan
2024-03-20 10:08:39 +08:00
parent d2422fe7e1
commit dd5d65ec80
11 changed files with 180 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
test/CMakeLists.txt
View File

@@ -44,8 +44,7 @@ add_subdirectory(benchmark)
file(COPY table_info.conf DESTINATION ./) file(COPY table_info.conf DESTINATION ./)
file(COPY tsg_table_info.conf DESTINATION ./) file(COPY tsg_table_info.conf DESTINATION ./)
file(COPY file_test_tableinfo.conf DESTINATION ./) file(COPY file_test_tableinfo.conf DESTINATION ./)
file(COPY literal_expr.conf DESTINATION ./) file(COPY expr_matcher.conf DESTINATION ./)
file(COPY regex_expr.conf DESTINATION ./)
file(COPY maat_json.json DESTINATION ./) file(COPY maat_json.json DESTINATION ./)
file(COPY ntcrule DESTINATION ./) file(COPY ntcrule DESTINATION ./)
file(COPY tsgrule DESTINATION ./) file(COPY tsgrule DESTINATION ./)

13
test/literal_expr.conf → test/expr_matcher.conf
View File

@@ -235,6 +235,19 @@
"pattern": "three" "pattern": "three"
} }
] ]
},
{
"expr_id": 116,
"pattern_num": 1,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "no",
"is_hexbin": "no",
"pattern": "\u00C9"
}
]
} }
] ]
} }

109
test/expr_matcher_gtest.cpp
View File

@@ -286,7 +286,7 @@ TEST(hs_expr_matcher_match, literal_sub_has_normal_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, 1, g_logger); struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, 1, g_logger);
@@ -342,7 +342,7 @@ TEST(rs_expr_matcher_match, literal_sub_has_normal_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, 1, g_logger); struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, 1, g_logger);
@@ -398,7 +398,7 @@ TEST(hs_expr_matcher_match, literal_sub_has_left_unlimit_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -456,7 +456,7 @@ TEST(rs_expr_matcher_match, literal_sub_has_left_unlimit_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -514,7 +514,7 @@ TEST(hs_expr_matcher_match, literal_sub_has_right_unlimit_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -581,7 +581,7 @@ TEST(rs_expr_matcher_match, literal_sub_has_right_unlimit_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -648,7 +648,7 @@ TEST(hs_expr_matcher_match, literal_sub_with_no_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -706,7 +706,7 @@ TEST(rs_expr_matcher_match, literal_sub_with_no_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -764,7 +764,7 @@ TEST(hs_expr_matcher_match, literal_exactly)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -812,7 +812,7 @@ TEST(rs_expr_matcher_match, literal_exactly)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -861,7 +861,7 @@ TEST(hs_expr_matcher_match, literal_prefix)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -921,7 +921,7 @@ TEST(rs_expr_matcher_match, literal_prefix)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -981,7 +981,7 @@ TEST(hs_expr_matcher_match, literal_suffix)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -1041,7 +1041,7 @@ TEST(rs_expr_matcher_match, literal_suffix)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -1101,7 +1101,7 @@ TEST(hs_expr_matcher_match, literal_sub_with_hex)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -1140,7 +1140,7 @@ TEST(rs_expr_matcher_match, literal_sub_with_hex)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -1179,7 +1179,7 @@ TEST(hs_expr_matcher_match, literal_with_chinese)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -1208,7 +1208,7 @@ TEST(rs_expr_matcher_match, literal_with_chinese)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -1237,7 +1237,7 @@ TEST(hs_expr_matcher_match, same_pattern_different_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -1266,7 +1266,7 @@ TEST(rs_expr_matcher_match, same_pattern_different_offset)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -1295,7 +1295,7 @@ TEST(hs_expr_matcher_match, long_scan_data)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -1326,7 +1326,7 @@ TEST(rs_expr_matcher_match, long_scan_data)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -1374,7 +1374,7 @@ TEST(hs_expr_matcher_stream, basic)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,
@@ -1416,7 +1416,7 @@ TEST(rs_expr_matcher_stream, basic)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS,
@@ -1458,7 +1458,7 @@ TEST(hs_expr_matcher, regex_basic)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
ret = expr_matcher_verify_regex_expression("[0-9]rain", g_logger); ret = expr_matcher_verify_regex_expression("[0-9]rain", g_logger);
@@ -1489,7 +1489,7 @@ TEST(rs_expr_matcher, regex_basic)
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
ret = expr_matcher_verify_regex_expression("[0-9]rain", g_logger); ret = expr_matcher_verify_regex_expression("[0-9]rain", g_logger);
@@ -1501,7 +1501,6 @@ TEST(rs_expr_matcher, regex_basic)
expr_array_free(rules, n_rule); expr_array_free(rules, n_rule);
const char *scan_data1 = "http://www.cyberessays.com/search_results.php?action=search&query=username,abckkk,1234567"; const char *scan_data1 = "http://www.cyberessays.com/search_results.php?action=search&query=username,abckkk,1234567";
//const char *scan_data2 = "8rain";
struct expr_scan_result result[64] = {0}; struct expr_scan_result result[64] = {0};
size_t n_result = 0; size_t n_result = 0;
@@ -1518,12 +1517,66 @@ TEST(rs_expr_matcher, regex_basic)
matcher = NULL; matcher = NULL;
} }
TEST(hs_expr_matcher, regex_unicode)
{
struct expr_rule rules[64] = {0};
size_t n_rule = 0;
int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, 1, g_logger);
EXPECT_TRUE(matcher != NULL);
expr_array_free(rules, n_rule);
const char *scan_data = "string contains É";
struct expr_scan_result result[64] = {0};
size_t n_result = 0;
size_t n_hit_pattern = 0;
ret = expr_matcher_match(matcher, 0, scan_data, strlen(scan_data), result,
64, &n_result, &n_hit_pattern);
EXPECT_EQ(n_result, 1);
EXPECT_EQ(n_hit_pattern, 1);
EXPECT_EQ(result[0].rule_id, 116);
expr_matcher_free(matcher);
matcher = NULL;
}
TEST(rs_expr_matcher, regex_unicode)
{
struct expr_rule rules[64] = {0};
size_t n_rule = 0;
int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_RS, 1, g_logger);
EXPECT_TRUE(matcher != NULL);
expr_array_free(rules, n_rule);
const char *scan_data = "string contains É";
struct expr_scan_result result[64] = {0};
size_t n_result = 0;
size_t n_hit_pattern = 0;
ret = expr_matcher_match(matcher, 0, scan_data, strlen(scan_data), result,
64, &n_result, &n_hit_pattern);
EXPECT_EQ(n_result, 1);
EXPECT_EQ(n_hit_pattern, 1);
EXPECT_EQ(result[0].rule_id, 116);
expr_matcher_free(matcher);
matcher = NULL;
}
TEST(hs_expr_matcher, hit_pattern_num) TEST(hs_expr_matcher, hit_pattern_num)
{ {
struct expr_rule rules[64] = {0}; struct expr_rule rules[64] = {0};
size_t n_rule = 0; size_t n_rule = 0;
int ret = parse_config_file("./literal_expr.conf", rules, &n_rule); int ret = parse_config_file("./expr_matcher.conf", rules, &n_rule);
EXPECT_EQ(ret, 0); EXPECT_EQ(ret, 0);
struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS, struct expr_matcher *matcher = expr_matcher_new(rules, n_rule, EXPR_ENGINE_TYPE_HS,

52
test/maat_framework_gtest.cpp
View File

@@ -869,13 +869,13 @@ TEST_F(MaatHsStringScan, Regex) {
long long results[ARRAY_SIZE] = {0}; long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0; size_t n_hit_result = 0;
int thread_id = 0; int thread_id = 0;
const char *cookie = "Cookie: Txa123aheadBCAxd"; const char *scan_data = "Cookie: Txa123aheadBCAxd";
const char *table_name = "HTTP_URL"; const char *table_name = "HTTP_URL";
struct maat *maat_inst = MaatHsStringScan::_shared_maat_inst; struct maat *maat_inst = MaatHsStringScan::_shared_maat_inst;
struct maat_state *state = maat_state_new(maat_inst, thread_id); struct maat_state *state = maat_state_new(maat_inst, thread_id);
int table_id = maat_get_table_id(maat_inst, table_name); int table_id = maat_get_table_id(maat_inst, table_name);
ret = maat_scan_string(maat_inst, table_id, cookie, strlen(cookie), ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
results, ARRAY_SIZE, &n_hit_result, state); results, ARRAY_SIZE, &n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(results[0], 148); EXPECT_EQ(results[0], 148);
@@ -888,6 +888,30 @@ TEST_F(MaatHsStringScan, Regex) {
state = NULL; state = NULL;
} }
TEST_F(MaatHsStringScan, RegexUnicode) {
int ret = 0;
long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0;
int thread_id = 0;
const char *scan_data = "String contains É";
const char *table_name = "HTTP_URL";
struct maat *maat_inst = MaatHsStringScan::_shared_maat_inst;
struct maat_state *state = maat_state_new(maat_inst, thread_id);
int table_id = maat_get_table_id(maat_inst, table_name);
ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
results, ARRAY_SIZE, &n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(results[0], 229);
ret = maat_scan_not_logic(maat_inst, table_id, results, ARRAY_SIZE,
&n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_OK);
maat_state_free(state);
state = NULL;
}
TEST_F(MaatHsStringScan, BackslashR_N_Escape) { TEST_F(MaatHsStringScan, BackslashR_N_Escape) {
int ret = 0; int ret = 0;
long long results[ARRAY_SIZE] = {0}; long long results[ARRAY_SIZE] = {0};
@@ -1778,6 +1802,30 @@ TEST_F(MaatRsStringScan, Regex) {
state = NULL; state = NULL;
} }
TEST_F(MaatRsStringScan, RegexUnicode) {
int ret = 0;
long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0;
int thread_id = 0;
const char *scan_data = "String contains É";
const char *table_name = "HTTP_URL";
struct maat *maat_inst = MaatRsStringScan::_shared_maat_inst;
struct maat_state *state = maat_state_new(maat_inst, thread_id);
int table_id = maat_get_table_id(maat_inst, table_name);
ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
results, ARRAY_SIZE, &n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(results[0], 229);
ret = maat_scan_not_logic(maat_inst, table_id, results, ARRAY_SIZE,
&n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_OK);
maat_state_free(state);
state = NULL;
}
TEST_F(MaatRsStringScan, BackslashR_N_Escape) { TEST_F(MaatRsStringScan, BackslashR_N_Escape) {
int ret = 0; int ret = 0;
long long results[ARRAY_SIZE] = {0}; long long results[ARRAY_SIZE] = {0};

28
test/maat_json.json
View File

@@ -3969,6 +3969,34 @@
] ]
} }
] ]
},
{
"compile_id": 229,
"service": 1,
"action": 1,
"do_blacklist": 1,
"do_log": 1,
"user_region": "StringScan.Regex",
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_URL",
"group_name": "229_url_group",
"group_id": 251,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "\u00C9",
"expr_type": "regex",
"match_method": "sub",
"format": "uncase plain"
}
}
]
}
]
} }
], ],
"plugin_table": [ "plugin_table": [

111
test/regex_expr.conf
View File

@@ -1,111 +0,0 @@
{
"expr_rules": [
{
"rule_id": 301,
"pattern_num": 1,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "yes",
"is_hexbin": "no",
"pattern": "[W|w]orld dream"
}
]
},
{
"rule_id": 302,
"pattern_num": 2,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "yes",
"is_hexbin": "no",
"pattern": "[0-9]today"
},
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "yes",
"is_hexbin": "no",
"pattern": "[0-9]Lunch"
}
]
},
{
"rule_id": 303,
"pattern_num": 2,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "yes",
"is_hexbin": "no",
"pattern": "Cookie:\\s"
},
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "yes",
"is_hexbin": "no",
"pattern": "head"
}
]
},
{
"rule_id": 304,
"pattern_num": 2,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "no",
"is_hexbin": "no",
"pattern": "123^abc"
},
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "no",
"is_hexbin": "no",
"pattern": "^123"
}
]
},
{
"rule_id": 305,
"pattern_num": 2,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "no",
"is_hexbin": "no",
"pattern": "^123"
},
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "no",
"is_hexbin": "no",
"pattern": "123^abc"
}
]
},
{
"rule_id": 306,
"pattern_num": 1,
"patterns": [
{
"pattern_type": "regex",
"match_method": "sub",
"case_sensitive": "no",
"is_hexbin": "no",
"pattern": "^[1-9]\\d{5}(18|19|([23]\\d))\\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\\d{3}[0-9Xx]$"
}
]
}
]
}

10
vendor/CMakeLists.txt vendored
View File

@@ -22,18 +22,18 @@ set_property(TARGET gtest_static PROPERTY IMPORTED_LOCATION ${VENDOR_BUILD}/lib/
set_property(TARGET gtest_static PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${VENDOR_BUILD}/include) set_property(TARGET gtest_static PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${VENDOR_BUILD}/include)
set_property(TARGET gtest_static PROPERTY INTERFACE_LINK_LIBRARIES pthread) set_property(TARGET gtest_static PROPERTY INTERFACE_LINK_LIBRARIES pthread)
# colm-0.13.0.5 # colm-0.14.7
ExternalProject_Add(colm PREFIX colm ExternalProject_Add(colm PREFIX colm
URL ${CMAKE_CURRENT_SOURCE_DIR}/colm-0.13.0.5.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/colm-0.14.7.tar.gz
CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD} CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD}
BUILD_COMMAND make BUILD_COMMAND make
INSTALL_COMMAND make install INSTALL_COMMAND make install
BUILD_IN_SOURCE 1) BUILD_IN_SOURCE 1)
# ragel-7.0.0.10 # ragel-7.0.4
ExternalProject_Add(ragel PREFIX ragel ExternalProject_Add(ragel PREFIX ragel
URL ${CMAKE_CURRENT_SOURCE_DIR}/ragel-7.0.0.10.tar.gz URL ${CMAKE_CURRENT_SOURCE_DIR}/ragel-7.0.4.tar.gz
CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD} --with-colm=${VENDOR_BUILD} CONFIGURE_COMMAND ./autogen.sh && ./configure --prefix=${VENDOR_BUILD} --disable-manual --with-colm=${VENDOR_BUILD}
DEPENDS colm DEPENDS colm
BUILD_COMMAND make BUILD_COMMAND make
INSTALL_COMMAND make install INSTALL_COMMAND make install

BIN
vendor/colm-0.13.0.5.tar.gz vendored
View File

Binary file not shown.

BIN
vendor/colm-0.14.7.tar.gz vendored Normal file
View File

Binary file not shown.

BIN
vendor/ragel-7.0.0.10.tar.gz vendored
View File

Binary file not shown.

BIN
vendor/ragel-7.0.4.tar.gz vendored Normal file
View File

Binary file not shown.