From df4fad9e8b0ce6329dc191eb1fcdb0561c373244 Mon Sep 17 00:00:00 2001 From: zhengchao Date: Mon, 24 May 2021 23:11:54 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E6=B5=8B=E8=AF=95=E7=94=A8?= =?UTF-8?q?=E4=BE=8B=EF=BC=9A=20=E4=BD=BF=E7=94=A8=E5=90=8C=E4=B8=80?= =?UTF-8?q?=E4=B8=AAmid=E6=89=AB=E6=8F=8F=E6=97=B6=EF=BC=8C=20=E6=9B=B4?= =?UTF-8?q?=E6=96=B0boolmatcher=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- inc/Maat_command.h | 29 +++++- src/entry/Maat_command.cpp | 22 ++++- test/test_maatframe.cpp | 198 ++++++++++++++++++++++++++++++++++++- 3 files changed, 242 insertions(+), 7 deletions(-) diff --git a/inc/Maat_command.h b/inc/Maat_command.h index ca28270..72c728a 100644 --- a/inc/Maat_command.h +++ b/inc/Maat_command.h @@ -19,6 +19,7 @@ enum MAAT_REGION_TYPE { REGION_EXPR, REGION_IP, + REGION_IP_PLUS, REGION_INTERVAL, REGION_DIGEST, REGION_SIMILARITY @@ -62,7 +63,7 @@ struct Maat_rgn_str_t enum MAAT_MATCH_METHOD match_method; enum MAAT_CASE_TYPE hex_bin; }; -struct Maat_rgn_addr_t +struct Maat_rgn_ip_t { enum MAAT_ADDR_TYPE addr_type; const char* src_ip; @@ -76,6 +77,27 @@ struct Maat_rgn_addr_t unsigned short protocol; enum MAAT_ADDR_DIRECTION direction; }; +struct Maat_rgn_ip_plus_t +{ + enum MAAT_ADDR_TYPE addr_type; + + const char* saddr_format;//mask, range or CIDR + const char* src_ip1; + const char* src_ip2; + const char* sport_format;//mask or range + unsigned short src_port1; + unsigned short src_port2; + + const char* daddr_format;//mask, range or CIDR + const char* dst_ip1; + const char* dst_ip2; + const char* dport_format;//mask or range + unsigned short dst_port1; + unsigned short dst_port2; + + unsigned short protocol; + enum MAAT_ADDR_DIRECTION direction; +}; struct Maat_rgn_intv_t { const char *district;// optional for expr_plus, otherwise set to NULL. @@ -101,7 +123,7 @@ struct Maat_region_t union { struct Maat_rgn_str_t expr_rule; - struct Maat_rgn_addr_t ip_rule; + struct Maat_rgn_ip_t ip_rule; struct Maat_rgn_intv_t interval_rule; struct Maat_rgn_digest_t digest_rule; struct Maat_rgn_sim_t similarity_rule; @@ -115,7 +137,8 @@ struct Maat_cmd_region union { struct Maat_rgn_str_t expr_rule; - struct Maat_rgn_addr_t ip_rule; + struct Maat_rgn_ip_t ip_rule; + struct Maat_rgn_ip_plus_t ip_plus_rule; struct Maat_rgn_intv_t interval_rule; struct Maat_rgn_digest_t digest_rule; struct Maat_rgn_sim_t similarity_rule; diff --git a/src/entry/Maat_command.cpp b/src/entry/Maat_command.cpp index df16fcd..01a0ce8 100644 --- a/src/entry/Maat_command.cpp +++ b/src/entry/Maat_command.cpp @@ -291,7 +291,7 @@ void serialize_region(const struct Maat_cmd_region* p, int group_id, char* buff, switch(p->region_type) { case REGION_IP: - ret=snprintf(buff,sz,"%d\t%d\t%d\t%s\t%s\t%hu\t%hu\t%s\t%s\t%hu\t%hu\t%d\t%d\t1", + ret=snprintf(buff, sz, "%d\t%d\t%d\t%s\t%s\t%hu\t%hu\t%s\t%s\t%hu\t%hu\t%d\t%d\t1", p->region_id, group_id, p->ip_rule.addr_type, @@ -306,6 +306,26 @@ void serialize_region(const struct Maat_cmd_region* p, int group_id, char* buff, p->ip_rule.protocol, p->ip_rule.direction); break; + case REGION_IP_PLUS: + ret=snprintf(buff, sz, "%d\t%d\t%d\t%s\t%s\t%s\t%s\t%hu\t%hu\t%s\t%s\t%s\t%s\t%hu\t%hu\t%d\t%d\t1", + p->region_id, + group_id, + p->ip_plus_rule.addr_type, + p->ip_plus_rule.saddr_format, + p->ip_plus_rule.src_ip1, + p->ip_plus_rule.src_ip2, + p->ip_plus_rule.sport_format, + p->ip_plus_rule.src_port1, + p->ip_plus_rule.src_port2, + p->ip_plus_rule.daddr_format, + p->ip_plus_rule.dst_ip1, + p->ip_plus_rule.dst_ip2, + p->ip_plus_rule.dport_format, + p->ip_plus_rule.dst_port1, + p->ip_plus_rule.dst_port2, + p->ip_plus_rule.protocol, + p->ip_plus_rule.direction); + break; case REGION_EXPR: if(p->expr_rule.district==NULL) { diff --git a/test/test_maatframe.cpp b/test/test_maatframe.cpp index 4755d6f..1764f91 100644 --- a/test/test_maatframe.cpp +++ b/test/test_maatframe.cpp @@ -3621,7 +3621,7 @@ TEST_F(MaatCmdTest, GroupInMassCompiles) //region_url2->group2 - memset(®ion_url1, 0, sizeof(region_url1)); + memset(®ion_url2, 0, sizeof(region_url2)); region_url2.region_id=Maat_command_get_new_region_id(feather); region_url2.region_type=REGION_EXPR; region_url2.table_name=table_url; @@ -3648,7 +3648,7 @@ TEST_F(MaatCmdTest, GroupInMassCompiles) for(i=0; icompile1 + // / + //group2--/ + + memset(&group1, 0, sizeof(group1)); + group1.group_id=Maat_command_get_new_group_id(feather); + group1.table_name=g2c_tn; + group1.compile_id=compile1.config_id; + group1.clause_index=0; + Maat_command_raw_set_group2compile(feather, MAAT_OP_ADD, &group1); + + memset(&group2, 0, sizeof(group2)); + group2.group_id=Maat_command_get_new_group_id(feather); + group2.table_name=g2c_tn; + group2.compile_id=compile1.config_id; + group2.clause_index=1; + Maat_command_raw_set_group2compile(feather, MAAT_OP_ADD, &group2); + + //region1->group1->compile1 + // / + // group2--/ + + memset(®ion1, 0, sizeof(region1)); + region1.region_id=Maat_command_get_new_region_id(feather); + region1.region_type=REGION_IP_PLUS; + region1.table_name=ip_table_name; + region1.ip_plus_rule.addr_type=ADDR_TYPE_IPv4; + region1.ip_plus_rule.saddr_format="range"; + region1.ip_plus_rule.src_ip1="192.168.2.1"; + region1.ip_plus_rule.src_ip2="192.168.2.4"; + region1.ip_plus_rule.sport_format="range"; + region1.ip_plus_rule.src_port1=region1.ip_plus_rule.src_port2=0; + + region1.ip_plus_rule.daddr_format="mask"; + region1.ip_plus_rule.dst_ip1="0.0.0.0"; + region1.ip_plus_rule.dst_ip2="255.255.255.255"; + region1.ip_plus_rule.dport_format="range"; + region1.ip_plus_rule.dst_port1=region1.ip_plus_rule.dst_port2=0; + + Maat_command_raw_set_region(feather, MAAT_OP_ADD, ®ion1, group1.group_id); + + + //region1->group1->compile1 + // / + //region2->group2--/ + + region2.region_id=Maat_command_get_new_region_id(feather); + region2.region_type=REGION_INTERVAL; + region2.table_name=app_id_table_name; + region2.interval_rule.up_boundary=region2.interval_rule.low_boundary=31; + Maat_command_raw_set_region(feather, MAAT_OP_ADD, ®ion2, group2.group_id); + + //---------------End Compile1 Initialization---------------------------- + + + //---------------Start Compile2 Initialization---------------------------- + + memset(&compile2, 0, sizeof(compile2)); + compile2.config_id=(int)Maat_cmd_incrby(feather, "TEST_SEQ", 1); + Maat_command_raw_set_compile(feather, MAAT_OP_ADD, &compile2, compile_table_name, NULL, 2, 0, 0); + + + //group3->compile2 + // / + //group4--/ + + memset(&group3, 0, sizeof(group1)); + group3.group_id=Maat_command_get_new_group_id(feather); + group3.table_name=g2c_tn; + group3.compile_id=compile2.config_id; + group3.clause_index=0; + Maat_command_raw_set_group2compile(feather, MAAT_OP_ADD, &group3); + + memset(&group4, 0, sizeof(group4)); + group4.group_id=Maat_command_get_new_group_id(feather); + group4.table_name=g2c_tn; + group4.compile_id=compile2.config_id; + group4.clause_index=1; + Maat_command_raw_set_group2compile(feather, MAAT_OP_ADD, &group4); + + //region4->group3->compile2 + // / + // group4--/ + + memset(®ion4, 0, sizeof(region1)); + region4.region_id=Maat_command_get_new_region_id(feather); + region4.region_type=REGION_IP_PLUS; + region4.table_name=ip_table_name; + region4.ip_plus_rule.addr_type=ADDR_TYPE_IPv4; + region4.ip_plus_rule.saddr_format="range"; + region4.ip_plus_rule.src_ip1="10.100.2.1"; + region4.ip_plus_rule.src_ip2="10.100.2.254"; + region4.ip_plus_rule.sport_format="range"; + region4.ip_plus_rule.src_port1=region1.ip_plus_rule.src_port2=0; + + region4.ip_plus_rule.daddr_format="mask"; + region4.ip_plus_rule.dst_ip1="0.0.0.0"; + region4.ip_plus_rule.dst_ip2="255.255.255.255"; + region4.ip_plus_rule.dport_format="range"; + region4.ip_plus_rule.dst_port1=region4.ip_plus_rule.dst_port2=0; + + Maat_command_raw_set_region(feather, MAAT_OP_ADD, ®ion4, group3.group_id); + + + //region4->group3->compile2 + // / + //region5->group4--/ + // / + //region6---/ + region5.region_id=Maat_command_get_new_region_id(feather); + region5.region_type=REGION_INTERVAL; + region5.table_name=app_id_table_name; + region5.interval_rule.up_boundary=region5.interval_rule.low_boundary=31; + Maat_command_raw_set_region(feather, MAAT_OP_ADD, ®ion5, group4.group_id); + + region6.region_id=Maat_command_get_new_region_id(feather); + region6.region_type=REGION_INTERVAL; + region6.table_name=app_id_table_name; + region6.interval_rule.up_boundary=region6.interval_rule.low_boundary=32; + Maat_command_raw_set_region(feather, MAAT_OP_ADD, ®ion6, group4.group_id); + + + sleep(1); + + int table_id=0, ret=0; + struct Maat_rule_t result[4]; + scan_status_t mid=NULL; + struct ipaddr ipv4_addr; + struct stream_tuple4_v4 v4_addr; + ipv4_addr_set(&ipv4_addr, &v4_addr, "192.168.2.5", 50001, "10.0.6.201", 80); + + int scan_app_id=31; + + table_id=Maat_table_register(feather, ip_table_name); + ret=Maat_scan_proto_addr(feather,table_id, &ipv4_addr, 6, result, 4, &mid,0); + EXPECT_EQ(ret, 0); + + table_id=Maat_table_register(feather, app_id_table_name); + ret=Maat_scan_intval(feather, table_id, scan_app_id, result, 4, &mid, 0); + EXPECT_EQ(ret, -2); + + + // region1->group1->compile1 + // / + // region2->group2--/ + // / + //region3(new)--/ + + region3.region_id=Maat_command_get_new_region_id(feather); + region3.region_type=REGION_INTERVAL; + region3.table_name=app_id_table_name; + region3.interval_rule.up_boundary=region3.interval_rule.low_boundary=32; + Maat_command_raw_set_region(feather, MAAT_OP_ADD, ®ion3, group2.group_id); + + sleep(1); + + table_id=Maat_table_register(feather, ip_table_name); + ret=Maat_scan_proto_addr(feather, table_id, &ipv4_addr, 6, result, 4, &mid,0); + EXPECT_EQ(ret, 0); + + table_id=Maat_table_register(feather, app_id_table_name); + ret=Maat_scan_intval(feather, table_id, scan_app_id, result, 4, &mid, 0); + EXPECT_EQ(ret, -2); + + Maat_clean_status(&mid); + +} + #define Update_DeadLock_Detection TEST_F(MaatCmdTest, UpdateDeadLockDetection) { @@ -4059,12 +4248,13 @@ TEST_F(MaatCmdTest, UpdateDeadLockDetection) EXPECT_EQ(result[0].config_id, compile2.config_id); Maat_clean_status(&mid); + Maat_cmd_incrby(feather, "MAAT_VERSION", 100); return; } #define VersionRollBack_SegFault -TEST_F(MaatCmdTest, StreamScanSegfaultWhenVersionRollBack_TSG_6324) +TEST_F(MaatCmdTest, StreamScanSegfaultWhenVersionRollBack_TSG6324) { Maat_feather_t feather=MaatCmdTest::_shared_feather; @@ -4133,9 +4323,11 @@ TEST_F(MaatCmdTest, StreamScanSegfaultWhenVersionRollBack_TSG_6324) Maat_stream_scan_string_end(&sp); Maat_clean_status(&mid); + Maat_cmd_incrby(feather, "MAAT_VERSION", 100); } + int main(int argc, char ** argv) {