From e180ce18e08a944ab2b629785a3f154586756df8 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 10 Oct 2024 06:28:40 +0000 Subject: [PATCH] fix test case using rule from json file --- scanner/flag_matcher/flag_matcher.cpp | 1 + src/maat_bool_plugin.c | 14 +- src/maat_config_monitor.c | 2 +- src/maat_expr.c | 34 +- src/maat_fqdn_plugin.c | 40 +- src/maat_ip_plugin.c | 13 +- src/maat_ipport_plugin.c | 12 +- src/maat_object.c | 92 +-- src/maat_plugin.c | 43 +- src/maat_rule.c | 12 +- test/json_update/corrupted.json | 2 +- test/maat_framework_gtest.cpp | 318 +++++---- test/maat_json.json | 886 +++++++++++++------------- test/table_info.json | 41 +- test/test_utils.cpp | 5 + 15 files changed, 776 insertions(+), 739 deletions(-) diff --git a/scanner/flag_matcher/flag_matcher.cpp b/scanner/flag_matcher/flag_matcher.cpp index 61a74b0..4413b84 100644 --- a/scanner/flag_matcher/flag_matcher.cpp +++ b/scanner/flag_matcher/flag_matcher.cpp @@ -72,6 +72,7 @@ int flag_matcher_match(struct flag_matcher *flag_matcher, uint64_t flag, struct if (!((flag ^ flag_matcher->rule_table[i].flag) & flag_matcher->rule_table[i].mask)) { uuid_copy(result[result_number].rule_uuid, flag_matcher->rule_table[i].rule_uuid); + result_number++; if (result_number >= n_result) { diff --git a/src/maat_bool_plugin.c b/src/maat_bool_plugin.c index f72a4cd..e88f49d 100644 --- a/src/maat_bool_plugin.c +++ b/src/maat_bool_plugin.c @@ -260,17 +260,13 @@ bool_plugin_accept_tag_match(struct bool_plugin_schema *schema, size_t n_tag = table_manager_accept_tags_count(schema->ref_tbl_mgr); cJSON *tmp_obj = NULL; - tmp_obj = cJSON_GetObjectItem(json, "tag"); + tmp_obj = cJSON_GetObjectItem(json, "effective_range"); if (tmp_obj && n_tag > 0) { - if (tmp_obj->type != cJSON_String) { - log_fatal(logger, MODULE_BOOL_PLUGIN, - "[%s:%d] bool_plugin table:<%s> has invalid tag format" - " in line:%s", __FUNCTION__, __LINE__, table_name, - cJSON_Print(json)); - return TAG_MATCH_ERR; - } + char *tag_str = cJSON_Print(tmp_obj); - int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tmp_obj->valuestring); + int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag_str); + FREE(tag_str); + if (TAG_MATCH_ERR == ret) { log_fatal(logger, MODULE_BOOL_PLUGIN, "[%s:%d] bool_plugin table:<%s> has invalid tag" diff --git a/src/maat_config_monitor.c b/src/maat_config_monitor.c index c45c639..7dd8a6c 100644 --- a/src/maat_config_monitor.c +++ b/src/maat_config_monitor.c @@ -219,7 +219,7 @@ void convert_maat_json_rule(cJSON **json_root, unsigned char *json_buff) cJSON *table_name = cJSON_GetObjectItem(tmp_item, "table_name"); cJSON *table_content = cJSON_GetObjectItem(tmp_item, "table_content"); cJSON *new_item = cJSON_CreateObject(); - cJSON *new_table_content = cJSON_Duplicate(table_content, 0); + cJSON *new_table_content = cJSON_Duplicate(table_content, 1); if (object_id_obj == NULL) { char uuid_str[UUID_STR_LEN]; diff --git a/src/maat_expr.c b/src/maat_expr.c index 202befc..ae21af4 100644 --- a/src/maat_expr.c +++ b/src/maat_expr.c @@ -41,10 +41,8 @@ struct expr_schema { enum expr_type { EXPR_TYPE_INVALID = -1, - EXPR_TYPE_STRING = 0, - EXPR_TYPE_AND, + EXPR_TYPE_AND = 0, EXPR_TYPE_REGEX, - EXPR_TYPE_OFFSET, EXPR_TYPE_MAX }; @@ -93,30 +91,10 @@ struct expr_runtime_stream { struct expr_matcher_stream *handle; }; -static enum expr_type int_to_expr_type(int expr_type) { - enum expr_type type = EXPR_TYPE_INVALID; - - switch (expr_type) { - case 0: - case 1: - case 3: - type = EXPR_TYPE_AND; - break; - case 2: - type = EXPR_TYPE_REGEX; - break; - default: - break; - } - - return type; -} - static struct expr_item * expr_item_new(struct expr_schema *expr_schema, const char *table_name, const cJSON *json, struct expr_runtime *expr_rt, uuid_t item_uuid) { - int expr_type = -1; struct expr_item *expr_item = ALLOC(struct expr_item, 1); cJSON *tmp_obj = NULL; size_t len = 0; @@ -158,8 +136,14 @@ expr_item_new(struct expr_schema *expr_schema, const char *table_name, goto error; } - expr_type = atoi(tmp_obj->valuestring); - expr_item->expr_type = int_to_expr_type(expr_type); + if (strncmp(tmp_obj->valuestring, "and", 3) == 0) { + expr_item->expr_type = EXPR_TYPE_AND; + } else if (strncmp(tmp_obj->valuestring, "regex", 5) == 0) { + expr_item->expr_type = EXPR_TYPE_REGEX; + } else { + expr_item->expr_type = EXPR_TYPE_INVALID; + } + if (expr_item->expr_type == EXPR_TYPE_INVALID) { log_fatal(expr_rt->logger, MODULE_EXPR, "[%s:%d] expr table:<%s> has invalid expr_type in line:%s", diff --git a/src/maat_fqdn_plugin.c b/src/maat_fqdn_plugin.c index 3b7b659..205eef7 100644 --- a/src/maat_fqdn_plugin.c +++ b/src/maat_fqdn_plugin.c @@ -211,34 +211,28 @@ fqdn_plugin_accept_tag_match(struct fqdn_plugin_schema *schema, size_t n_tag = table_manager_accept_tags_count(schema->ref_tbl_mgr); cJSON *tmp_obj = NULL; - tmp_obj = cJSON_GetObjectItem(json, "tag"); + tmp_obj = cJSON_GetObjectItem(json, "effective_range"); if (tmp_obj != NULL && n_tag > 0) { - if (tmp_obj->type != cJSON_String) { + + char *tag_str = cJSON_Print(tmp_obj); + + int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag_str); + FREE(tag_str); + + if (TAG_MATCH_ERR == ret) { log_fatal(logger, MODULE_FQDN_PLUGIN, - "[%s:%d] fqdn_plugin table:<%s> has invalid tag format" - " in line:%s", __FUNCTION__, __LINE__, table_name, - cJSON_Print(json)); + "[%s:%d] fqdn_plugin table:<%s> has invalid tag" + " format in line:%s", __FUNCTION__, __LINE__, + table_name, cJSON_Print(json)); return TAG_MATCH_ERR; } - const char *tag = tmp_obj->valuestring; - if (strlen(tag) > 2) { - int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag); - if (TAG_MATCH_ERR == ret) { - log_fatal(logger, MODULE_FQDN_PLUGIN, - "[%s:%d] fqdn_plugin table:<%s> has invalid tag" - " format in line:%s", __FUNCTION__, __LINE__, - table_name, cJSON_Print(json)); - return TAG_MATCH_ERR; - } - - if (TAG_MATCH_UNMATCHED == ret) { - log_fatal(logger, MODULE_FQDN_PLUGIN, - "[%s:%d] fqdn_plugin table:<%s> has unmatched tag" - " in line:%s", __FUNCTION__, __LINE__, table_name, - cJSON_Print(json)); - return TAG_MATCH_UNMATCHED; - } + if (TAG_MATCH_UNMATCHED == ret) { + log_fatal(logger, MODULE_FQDN_PLUGIN, + "[%s:%d] fqdn_plugin table:<%s> has unmatched tag" + " in line:%s", __FUNCTION__, __LINE__, table_name, + cJSON_Print(json)); + return TAG_MATCH_UNMATCHED; } } diff --git a/src/maat_ip_plugin.c b/src/maat_ip_plugin.c index d75af36..eb18391 100644 --- a/src/maat_ip_plugin.c +++ b/src/maat_ip_plugin.c @@ -110,16 +110,13 @@ ip_plugin_accept_tag_match(struct ip_plugin_schema *schema, cJSON *tmp_obj = NULL; size_t n_tag = table_manager_accept_tags_count(schema->ref_tbl_mgr); - tmp_obj = cJSON_GetObjectItem(json, "tag"); + tmp_obj = cJSON_GetObjectItem(json, "effective_range"); if (tmp_obj && n_tag > 0) { - if (tmp_obj->type != cJSON_String) { - log_fatal(logger, MODULE_IP_PLUGIN, - "[%s:%d] ip_plugin table:<%s> has invalid tag format" - " in line:%s", __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); - return TAG_MATCH_ERR; - } + char *tag_str = cJSON_Print(tmp_obj); - int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tmp_obj->valuestring); + int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag_str); + FREE(tag_str); + if (TAG_MATCH_ERR == ret) { log_fatal(logger, MODULE_IP_PLUGIN, "[%s:%d] ip_plugin table:<%s> has invalid tag format" diff --git a/src/maat_ipport_plugin.c b/src/maat_ipport_plugin.c index 3cf434d..35b12bd 100644 --- a/src/maat_ipport_plugin.c +++ b/src/maat_ipport_plugin.c @@ -602,7 +602,17 @@ int ipport_plugin_runtime_get_ex_data(void *ipport_plugin_runtime, } struct ipport_result results[n_ex_data]; - int n_hit_item = ipport_matcher_match(ipport_plugin_rt->matcher, ip_addr, + struct ip_addr ip_data; + if (ip_addr->ip_type == IPV4) { + ip_data.ip_type = IPV4; + ip_data.ipv4 = ntohl(ip_addr->ipv4); + } else { + ip_data.ip_type = IPV6; + memcpy(ip_data.ipv6, ip_addr->ipv6, sizeof(ip_data.ipv6)); + ipv6_ntoh(ip_data.ipv6); + } + + int n_hit_item = ipport_matcher_match(ipport_plugin_rt->matcher, &ip_data, port, results, n_ex_data); if (n_hit_item <= 0) { return n_hit_item; diff --git a/src/maat_object.c b/src/maat_object.c index 5961be2..62e6aeb 100644 --- a/src/maat_object.c +++ b/src/maat_object.c @@ -290,67 +290,71 @@ object2object_item_new(const char *line, struct object2object_schema *o2o_schema tmp_obj = cJSON_GetObjectItem(json, "object_uuid"); if (tmp_obj == NULL || tmp_obj->type != cJSON_String) { log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2o table:<%s> has no object_id or format is not string in line:%s", + "[%s:%d] o2o table:<%s> has no object_uuid or format is not string in line:%s", __FUNCTION__, __LINE__, table_name, line); goto error; } uuid_parse(tmp_obj->valuestring, o2o_item->object_uuid); tmp_obj = cJSON_GetObjectItem(json, "included_sub_object_uuids"); - if (tmp_obj == NULL || tmp_obj->type != cJSON_Array) { - log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2o table:<%s> has no included_sub_object_ids or format is not array in line:%s", - __FUNCTION__, __LINE__, table_name, line); - goto error; - } - - for (int i = 0; i < cJSON_GetArraySize(tmp_obj); i++) { - cJSON *item = cJSON_GetArrayItem(tmp_obj, i); - if (item == NULL || item->type != cJSON_String) { + if (tmp_obj) { + if (tmp_obj->type != cJSON_Array) { log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2o table:<%s> included_sub_object_ids format error in line:%s", - __FUNCTION__, __LINE__, table_name, line); + "[%s:%d] o2o table:<%s> included_sub_object_ids format is not array in line:%s", + __FUNCTION__, __LINE__, table_name, line); goto error; } - uuid_t object_uuid; - uuid_parse(item->valuestring, object_uuid); - utarray_push_back(o2o_item->incl_sub_object_uuids, &object_uuid); - } - if (utarray_len(o2o_item->incl_sub_object_uuids) > MAX_OBJECT_CNT) { - log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2r table:<%s> included_sub_object_ids exceed maximum:%d in line:%s", - __FUNCTION__, __LINE__, table_name, MAX_OBJECT_CNT, line); - goto error; + for (int i = 0; i < cJSON_GetArraySize(tmp_obj); i++) { + cJSON *item = cJSON_GetArrayItem(tmp_obj, i); + if (item == NULL || item->type != cJSON_String) { + log_fatal(logger, MODULE_OBJECT, + "[%s:%d] o2o table:<%s> included_sub_object_ids format error in line:%s", + __FUNCTION__, __LINE__, table_name, line); + goto error; + } + uuid_t object_uuid; + uuid_parse(item->valuestring, object_uuid); + utarray_push_back(o2o_item->incl_sub_object_uuids, &object_uuid); + } + + if (utarray_len(o2o_item->incl_sub_object_uuids) > MAX_OBJECT_CNT) { + log_fatal(logger, MODULE_OBJECT, + "[%s:%d] o2r table:<%s> included_sub_object_ids exceed maximum:%d in line:%s", + __FUNCTION__, __LINE__, table_name, MAX_OBJECT_CNT, line); + goto error; + } } tmp_obj = cJSON_GetObjectItem(json, "excluded_sub_object_uuids"); - if (tmp_obj == NULL || tmp_obj->type != cJSON_Array) { - log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2o table:<%s> has no excluded_sub_object_ids or format is not array in line:%s", - __FUNCTION__, __LINE__, table_name, line); - goto error; - } - - for (int i = 0; i < cJSON_GetArraySize(tmp_obj); i++) { - cJSON *item = cJSON_GetArrayItem(tmp_obj, i); - if (item == NULL || item->type != cJSON_String) { + if (tmp_obj) { + if (tmp_obj->type != cJSON_Array) { log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2o table:<%s> excluded_sub_object_ids format error in line:%s", - __FUNCTION__, __LINE__, table_name, line); + "[%s:%d] o2o table:<%s> excluded_sub_object_ids format is not array in line:%s", + __FUNCTION__, __LINE__, table_name, line); goto error; } - uuid_t object_uuid; - uuid_parse(item->valuestring, object_uuid); - utarray_push_back(o2o_item->excl_sub_object_uuids, &object_uuid); - } - if (utarray_len(o2o_item->excl_sub_object_uuids) > MAX_OBJECT_CNT) { - log_fatal(logger, MODULE_OBJECT, - "[%s:%d] o2r table:<%s> excluded_sub_object_ids exceed maximum:%d in line:%s", - __FUNCTION__, __LINE__, table_name, MAX_OBJECT_CNT, line); - goto error; - } + for (int i = 0; i < cJSON_GetArraySize(tmp_obj); i++) { + cJSON *item = cJSON_GetArrayItem(tmp_obj, i); + if (item == NULL || item->type != cJSON_String) { + log_fatal(logger, MODULE_OBJECT, + "[%s:%d] o2o table:<%s> excluded_sub_object_ids format error in line:%s", + __FUNCTION__, __LINE__, table_name, line); + goto error; + } + uuid_t object_uuid; + uuid_parse(item->valuestring, object_uuid); + utarray_push_back(o2o_item->excl_sub_object_uuids, &object_uuid); + } + + if (utarray_len(o2o_item->excl_sub_object_uuids) > MAX_OBJECT_CNT) { + log_fatal(logger, MODULE_OBJECT, + "[%s:%d] o2r table:<%s> excluded_sub_object_ids exceed maximum:%d in line:%s", + __FUNCTION__, __LINE__, table_name, MAX_OBJECT_CNT, line); + goto error; + } + } cJSON_Delete(json); diff --git a/src/maat_plugin.c b/src/maat_plugin.c index 1ff9635..b42454d 100644 --- a/src/maat_plugin.c +++ b/src/maat_plugin.c @@ -376,42 +376,29 @@ static int plugin_accept_tag_match(struct plugin_schema *schema, const char *table_name, const char *line, struct log_handle *logger) { - size_t tag_len = 0; size_t n_tag = table_manager_accept_tags_count(schema->ref_tbl_mgr); cJSON *tmp_obj = NULL; int ret = 0; cJSON *json = cJSON_Parse(line); - tmp_obj = cJSON_GetObjectItem(json, "tag"); + tmp_obj = cJSON_GetObjectItem(json, "effective_range"); if (tmp_obj != NULL && n_tag > 0) { - if (tmp_obj->type != cJSON_String) { + char *tag_str = cJSON_Print(tmp_obj); + ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag_str); + FREE(tag_str); + if (TAG_MATCH_ERR == ret) { log_fatal(logger, MODULE_PLUGIN, - "[%s:%d] table: <%s> has invalid tag format in json, line %s", - __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); + "[%s:%d] table: <%s> has invalid tag format in table_line:%s", + __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); return TAG_MATCH_ERR; } - tag_len = strlen(tmp_obj->valuestring); - - if (tag_len > 2) { - char *tag_str = ALLOC(char, tag_len + 1); - memcpy(tag_str, tmp_obj->valuestring, tag_len); - ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag_str); - FREE(tag_str); - if (TAG_MATCH_ERR == ret) { - log_fatal(logger, MODULE_PLUGIN, - "[%s:%d] table: <%s> has invalid tag format in table_line:%s", - __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); - return TAG_MATCH_ERR; - } - - if (TAG_MATCH_UNMATCHED == ret) { - log_fatal(logger, MODULE_PLUGIN, - "[%s:%d] table: <%s> has unmatched tag in table_line:%s", - __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); - return TAG_MATCH_UNMATCHED; - } + if (TAG_MATCH_UNMATCHED == ret) { + log_fatal(logger, MODULE_PLUGIN, + "[%s:%d] table: <%s> has unmatched tag in table_line:%s", + __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); + return TAG_MATCH_UNMATCHED; } } @@ -440,9 +427,9 @@ static int plugin_table_line_get_ip_key(struct plugin_schema *schema, int ret = 0; tmp_obj = cJSON_GetObjectItem(json, "addr_type"); - if (tmp_obj == NULL || tmp_obj->type != cJSON_String) { + if (tmp_obj == NULL || tmp_obj->type != cJSON_Number) { log_fatal(logger, MODULE_PLUGIN, - "[%s:%d] plugin table:<%s> has no addr_type or not string format in table_line:%s", + "[%s:%d] plugin table:<%s> has no addr_type or not number format in table_line:%s", __FUNCTION__, __LINE__, table_name, cJSON_Print(json)); goto ERROR; } @@ -451,7 +438,7 @@ static int plugin_table_line_get_ip_key(struct plugin_schema *schema, // snprintf() write at most (key_len+1) bytes (including the terminating null{'\0}) to ip_key. snprintf(ip_key, src_key_len + 1, "%s", src_key); - int addr_type = atoi(tmp_obj->valuestring); + int addr_type = tmp_obj->valueint; if (IPV4 == addr_type) { uint32_t ipv4_addr; ret = inet_pton(AF_INET, ip_key, &ipv4_addr); diff --git a/src/maat_rule.c b/src/maat_rule.c index fae3561..954e1ff 100644 --- a/src/maat_rule.c +++ b/src/maat_rule.c @@ -348,11 +348,12 @@ static int rule_accept_tag_match(struct rule_schema *schema, const char *line, cJSON *tmp_obj = NULL; cJSON *table_json = cJSON_Parse(line); - tmp_obj = cJSON_GetObjectItem(table_json, "tag"); + tmp_obj = cJSON_GetObjectItem(table_json, "effective_range"); if (tmp_obj && n_tag > 0) { - char *tag_str = tmp_obj->valuestring; + char *tag_str = cJSON_Print(tmp_obj); int ret = table_manager_accept_tags_match(schema->ref_tbl_mgr, tag_str); + FREE(tag_str); if (TAG_MATCH_ERR == ret) { log_fatal(logger, MODULE_RULE, "[%s:%d] table: <%s> has invalid tag format in line:%s", @@ -1627,7 +1628,7 @@ static int rule_sort_para_compare(const struct rule_sort_para *a, if (a->condition_num != b->condition_num) { return (a->condition_num - b->condition_num); } else { - return uuid_compare(a->rule_uuid, b->rule_uuid); + return uuid_compare(b->rule_uuid, a->rule_uuid); } } @@ -1779,8 +1780,11 @@ void rule_compile_state_not_logic_update(struct rule_compile_state *rule_compile struct condition_id_kv *condition_id_kv = NULL; for (size_t i = 0; i < utarray_len(tbl_object->object_uuids); i++) { - uuid_t *object_uuid = utarray_eltptr(tbl_object->object_uuids, i); struct condition_query_key key; + + uuid_t *object_uuid = utarray_eltptr(tbl_object->object_uuids, i); + memset(&key, 0, sizeof(key)); + snprintf(key.attribute_name, sizeof(key.attribute_name), "%s", attribute_name); key.negate_option = 1; uuid_copy(key.object_uuid, *object_uuid); diff --git a/test/json_update/corrupted.json b/test/json_update/corrupted.json index 81c9e9f..42c7966 100644 --- a/test/json_update/corrupted.json +++ b/test/json_update/corrupted.json @@ -22,7 +22,7 @@ "table_type": "expr", "table_content": { "expression": "hello&world", - "expr_type": "none" + "expr_type": "and" } } ] diff --git a/test/maat_framework_gtest.cpp b/test/maat_framework_gtest.cpp index bcc7696..2f9a97c 100644 --- a/test/maat_framework_gtest.cpp +++ b/test/maat_framework_gtest.cpp @@ -239,12 +239,12 @@ TEST_F(FlagScan, basic) { ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(n_hit_result, 2); - char uuid_str1[UUID_STR_LEN] = {0}; - char uuid_str2[UUID_STR_LEN] = {0}; - uuid_unparse(results[0], uuid_str1); - uuid_unparse(results[1], uuid_str2); - EXPECT_TRUE(strcmp(uuid_str1, "00000000-0000-0000-0000-000000000207") == 0); - EXPECT_TRUE(strcmp(uuid_str2, "00000000-0000-0000-0000-000000000192") == 0); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(results[0], uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000207"); + + uuid_unparse(results[1], uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000192"); ret = maat_scan_not_logic(maat_inst, flag_table_name, attribute_name, results, ARRAY_SIZE, &n_hit_result, state); @@ -264,10 +264,11 @@ TEST_F(FlagScan, basic) { ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HIT); EXPECT_EQ(n_hit_result, 2); - uuid_unparse(results[0], uuid_str1); - uuid_unparse(results[1], uuid_str2); - EXPECT_TRUE(strcmp(uuid_str1, "00000000-0000-0000-0000-000000000207") == 0); - EXPECT_TRUE(strcmp(uuid_str2, "00000000-0000-0000-0000-000000000192") == 0); + uuid_unparse(results[0], uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000207"); + + uuid_unparse(results[1], uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000192"); ret = maat_scan_not_logic(maat_inst, flag_table_name, attribute_name, results, ARRAY_SIZE, &n_hit_result, state); @@ -3508,12 +3509,12 @@ TEST_F(NOTLogic, NotPhysicalTable) { struct maat_state *state = maat_state_new(maat_inst, thread_id); // scan hit string1(KEYWORDS_TABLE) & hit string2(HTTP_RESPONSE_KEYWORDS) => not hit rule - int ret = maat_scan_string(maat_inst, table_name, attribute_name, string1, + int ret = maat_scan_string(maat_inst, table_name, table_name, string1, strlen(string1), results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); - ret = maat_scan_not_logic(maat_inst, table_name, attribute_name, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, table_name, table_name, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); @@ -3524,11 +3525,11 @@ TEST_F(NOTLogic, NotPhysicalTable) { maat_state_reset(state); //scan not hit string1(KEYWORDS_TABLE) & hit string2(HTTP_RESPONSE_KEYWORDS) => hit rule224 - ret = maat_scan_string(maat_inst, table_name, attribute_name, string3, strlen(string3), + ret = maat_scan_string(maat_inst, table_name, table_name, string3, strlen(string3), results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); - ret = maat_scan_not_logic(maat_inst, table_name, attribute_name, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, table_name, table_name, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); @@ -4430,7 +4431,8 @@ TEST_F(ExcludeLogic, ScanWithMultiCondition) { int thread_id = 0; struct maat *maat_inst = ExcludeLogic::_shared_maat_inst; struct maat_state *state = maat_state_new(maat_inst, thread_id); - const char *ip_attribute_name = "ATTRIBUTE_IP_PLUS_TABLE"; + const char *src_ip_attribute_name = "ATTRIBUTE_IP_PLUS_SOURCE"; + const char *dst_ip_attribute_name = "ATTRIBUTE_IP_PLUS_DESTINATION"; const char *ip_table_name = "IP_PLUS_CONFIG"; int ip_table_id = maat_get_table_id(maat_inst, ip_table_name); @@ -4439,20 +4441,20 @@ TEST_F(ExcludeLogic, ScanWithMultiCondition) { uint32_t ip_addr; inet_pton(AF_INET, "192.168.50.43", &ip_addr); - int ret = maat_scan_ipv4(maat_inst, ip_table_name, ip_attribute_name, ip_addr, results, + int ret = maat_scan_ipv4(maat_inst, ip_table_name, src_ip_attribute_name, ip_addr, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); - ret = maat_scan_not_logic(maat_inst, ip_table_name, ip_attribute_name, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, ip_table_name, src_ip_attribute_name, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); inet_pton(AF_INET, "47.92.108.93", &ip_addr); - ret = maat_scan_ipv4(maat_inst, ip_table_name, ip_attribute_name, ip_addr, results, ARRAY_SIZE, + ret = maat_scan_ipv4(maat_inst, ip_table_name, dst_ip_attribute_name, ip_addr, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); - ret = maat_scan_not_logic(maat_inst, ip_table_name, ip_attribute_name, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, ip_table_name, dst_ip_attribute_name, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); @@ -4493,27 +4495,28 @@ TEST_F(ExcludeLogic, ExcludeInDifferentLevel) { int thread_id = 0; struct maat *maat_inst = ExcludeLogic::_shared_maat_inst; struct maat_state *state = maat_state_new(maat_inst, thread_id); - const char *ip_attribute_name = "ATTRIBUTE_IP_PLUS_TABLE"; + const char *src_ip_attribute_name = "ATTRIBUTE_IP_PLUS_SOURCE"; + const char *dst_ip_attribute_name = "ATTRIBUTE_IP_PLUS_DESTINATION"; const char *ip_table_name = "IP_PLUS_CONFIG"; uint32_t ip_addr; inet_pton(AF_INET, "100.64.2.1", &ip_addr); - int ret = maat_scan_ipv4(maat_inst, ip_table_name, ip_attribute_name, ip_addr, results, + int ret = maat_scan_ipv4(maat_inst, ip_table_name, src_ip_attribute_name, ip_addr, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); - ret = maat_scan_not_logic(maat_inst, ip_table_name, ip_attribute_name, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, ip_table_name, src_ip_attribute_name, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); inet_pton(AF_INET, "100.64.2.6", &ip_addr); - ret = maat_scan_ipv4(maat_inst, ip_table_name, ip_attribute_name, ip_addr, results, + ret = maat_scan_ipv4(maat_inst, ip_table_name, dst_ip_attribute_name, ip_addr, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT); - ret = maat_scan_not_logic(maat_inst, ip_table_name, ip_attribute_name, results, ARRAY_SIZE, + ret = maat_scan_not_logic(maat_inst, ip_table_name, dst_ip_attribute_name, results, ARRAY_SIZE, &n_hit_result, state); EXPECT_EQ(ret, MAAT_SCAN_OK); @@ -4564,17 +4567,30 @@ void maat_read_entry_start_cb(int update_type, void *u_para) void maat_read_entry_cb(const char *table_name, const char *table_line, enum maat_operation op, void *u_para) { char ip_str[16] = {0}; - int entry_id = -1, seq = -1; + int entry_id = -1; unsigned int ip_uint = 0; int is_valid = 0; unsigned int local_ip_nr = 16820416;//192.168.0.1 + cJSON *json = cJSON_Parse(table_line); - sscanf(table_line, "%d\t%s\t%d\t%d", &seq,ip_str, &entry_id, &is_valid); - inet_pton(AF_INET, ip_str, &ip_uint); - if (local_ip_nr == ip_uint) { + EXPECT_TRUE(json != NULL); + + cJSON *tmp_obj = cJSON_GetObjectItem(json, "ip"); + EXPECT_TRUE(tmp_obj != NULL); + strcpy(ip_str, tmp_obj->valuestring); + inet_pton(AF_INET, ip_str, &ip_uint); + if (local_ip_nr == ip_uint) { + tmp_obj = cJSON_GetObjectItem(json, "is_valid"); + EXPECT_TRUE(tmp_obj != NULL); + is_valid = tmp_obj->valueint; + tmp_obj = cJSON_GetObjectItem(json, "entry_id"); + EXPECT_TRUE(tmp_obj != NULL); + entry_id = tmp_obj->valueint; EXPECT_EQ(is_valid, 1); EXPECT_EQ(entry_id, 101); - } + } + + cJSON_Delete(json); } void maat_read_entry_finish_cb(void *u_para) @@ -4643,19 +4659,35 @@ TEST_F(PluginTable, Callback) { struct plugin_ud { char key[32]; char value[32]; - int id; + uuid_t uuid; }; void plugin_EX_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp) { int *counter = (int *)argp; - int valid = 0, tag = 0; struct plugin_ud *ud = ALLOC(struct plugin_ud, 1); - - int ret = sscanf(table_line, "%d\t%s\t%s\t%d\t%d", - &(ud->id), ud->key, ud->value, &valid, &tag); - EXPECT_EQ(ret, 5); + + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); + + cJSON *tmp_obj = cJSON_GetObjectItem(json, "uuid"); + EXPECT_TRUE(tmp_obj != NULL); + uuid_parse(tmp_obj->valuestring, ud->uuid); + + tmp_obj = cJSON_GetObjectItem(json, "key"); + EXPECT_TRUE(tmp_obj != NULL); + if (tmp_obj->type == cJSON_Number) { + snprintf(ud->key, sizeof(ud->key), "%d", tmp_obj->valueint); + } else { + strncpy(ud->key, tmp_obj->valuestring, sizeof(ud->key)); + } + + tmp_obj = cJSON_GetObjectItem(json, "city"); + EXPECT_TRUE(tmp_obj != NULL); + strncpy(ud->value, tmp_obj->valuestring, sizeof(ud->value)); + + cJSON_Delete(json); *ad = ud; (*counter)++; @@ -4696,14 +4728,17 @@ TEST_F(PluginTable, EX_DATA) { key1, strlen(key1)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "Shijiazhuang"); - EXPECT_EQ(ud->id, 1); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000001"); const char *key2 = "ShanDong"; ud = (struct plugin_ud *)maat_plugin_table_get_ex_data(maat_inst, table_name, key2, strlen(key2)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "Jinan"); - EXPECT_EQ(ud->id, 3); + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000003"); } TEST_F(PluginTable, LONG_KEY_TYPE) { @@ -4725,14 +4760,17 @@ TEST_F(PluginTable, LONG_KEY_TYPE) { (char *)&key1, sizeof(long long)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "Shijiazhuang"); - EXPECT_EQ(ud->id, 1); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000001"); long long key2 = 33333333; ud = (struct plugin_ud *)maat_plugin_table_get_ex_data(maat_inst, table_name, (char *)&key2, sizeof(long long)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "Jinan"); - EXPECT_EQ(ud->id, 3); + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000003"); int key3 = 22222222; ud = (struct plugin_ud *)maat_plugin_table_get_ex_data(maat_inst, table_name, @@ -4759,14 +4797,17 @@ TEST_F(PluginTable, INT_KEY_TYPE) { (char *)&key1, sizeof(key1)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "China"); - EXPECT_EQ(ud->id, 1); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000001"); int key2 = 102; ud = (struct plugin_ud *)maat_plugin_table_get_ex_data(maat_inst, table_name, (char *)&key2, sizeof(key2)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "America"); - EXPECT_EQ(ud->id, 2); + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000002"); long long key3 = 103; ud = (struct plugin_ud *)maat_plugin_table_get_ex_data(maat_inst, table_name, @@ -4797,7 +4838,9 @@ TEST_F(PluginTable, IP_KEY_TYPE) { sizeof(ipv4_addr1)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "XiZang"); - EXPECT_EQ(ud->id, 4); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000001"); uint32_t ipv4_addr2; ret = inet_pton(AF_INET, "100.64.1.2", &ipv4_addr2); @@ -4808,7 +4851,8 @@ TEST_F(PluginTable, IP_KEY_TYPE) { sizeof(ipv4_addr2)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "XinJiang"); - EXPECT_EQ(ud->id, 4); + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000002"); uint8_t ipv6_addr1[16]; ret = inet_pton(AF_INET6, "2001:da8:205:1::101", ipv6_addr1); @@ -4819,7 +4863,8 @@ TEST_F(PluginTable, IP_KEY_TYPE) { sizeof(ipv6_addr1)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "GuiZhou"); - EXPECT_EQ(ud->id, 6); + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000003"); uint8_t ipv6_addr2[16]; ret = inet_pton(AF_INET6, "1001:da8:205:1::101", ipv6_addr2); @@ -4830,7 +4875,8 @@ TEST_F(PluginTable, IP_KEY_TYPE) { sizeof(ipv6_addr2)); ASSERT_TRUE(ud != NULL); EXPECT_STREQ(ud->value, "SiChuan"); - EXPECT_EQ(ud->id, 6); + uuid_unparse(ud->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000004"); } class IPPluginTable : public testing::Test @@ -4880,7 +4926,7 @@ struct maat *IPPluginTable::_shared_maat_inst; struct log_handle *IPPluginTable::logger; struct ip_plugin_ud { - long long rule_id; + uuid_t rule_uuid; char *buffer; size_t buf_len; }; @@ -4888,21 +4934,23 @@ void ip_plugin_ex_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp) { int *counter = (int *)argp; - size_t column_offset=0, column_len=0; struct ip_plugin_ud *ud = ALLOC(struct ip_plugin_ud, 1); - int ret = get_column_pos(table_line, 1, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); - ud->rule_id = atoll(table_line + column_offset); + cJSON *tmp_obj = cJSON_GetObjectItem(json, "uuid"); + EXPECT_TRUE(tmp_obj != NULL); + uuid_parse(tmp_obj->valuestring, ud->rule_uuid); - ret = get_column_pos(table_line, 4, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + tmp_obj = cJSON_GetObjectItem(json, "buffer"); + EXPECT_TRUE(tmp_obj != NULL); + ud->buf_len = strlen(tmp_obj->valuestring); + ud->buffer = ALLOC(char, ud->buf_len + 1); + strncpy(ud->buffer, tmp_obj->valuestring, ud->buf_len); - ud->buffer = ALLOC(char, column_len + 1); - strncpy(ud->buffer, table_line + column_offset, column_len); + cJSON_Delete(json); - ud->buf_len = column_len + 1; *ad = ud; (*counter)++; } @@ -4911,7 +4959,7 @@ void ip_plugin_ex_free_cb(const char *table_name, void **ad, long argl, void *ar { struct ip_plugin_ud *ud = (struct ip_plugin_ud *)(*ad); - ud->rule_id = 0; + uuid_clear(ud->rule_uuid); memset(ud->buffer, 0, ud->buf_len); ud->buf_len = 0; @@ -4949,8 +4997,12 @@ TEST_F(IPPluginTable, EX_DATA) { ret = maat_ip_plugin_table_get_ex_data(maat_inst, table_name, &ipv4, (void **)results, ARRAY_SIZE); EXPECT_EQ(ret, 2); - EXPECT_EQ(results[0]->rule_id, 101); - EXPECT_EQ(results[1]->rule_id, 102); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(results[0]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000101"); + + uuid_unparse(results[1]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000102"); struct ip_addr ipv6; ipv6.ip_type = IPv6; @@ -4960,8 +5012,11 @@ TEST_F(IPPluginTable, EX_DATA) { ret = maat_ip_plugin_table_get_ex_data(maat_inst, table_name, &ipv6, (void**)results, ARRAY_SIZE); EXPECT_EQ(ret, 2); - EXPECT_EQ(results[0]->rule_id, 104); - EXPECT_EQ(results[1]->rule_id, 103); + uuid_unparse(results[0]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000104"); + + uuid_unparse(results[1]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000103"); //Reproduce BugReport-Liumengyan-20210515 inet_pton(AF_INET6, "240e:97c:4010:104::17", &(ipv6.ipv6)); @@ -5017,7 +5072,7 @@ struct maat *IPPortPluginTable::_shared_maat_inst; struct log_handle *IPPortPluginTable::logger; struct ipport_plugin_ud { - long long rule_id; + uuid_t rule_uuid; char *buffer; size_t buf_len; }; @@ -5026,21 +5081,17 @@ void ipport_plugin_ex_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp) { int *counter = (int *)argp; - size_t column_offset=0, column_len=0; struct ipport_plugin_ud *ud = ALLOC(struct ipport_plugin_ud, 1); - int ret = get_column_pos(table_line, 1, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); - ud->rule_id = atoll(table_line + column_offset); + cJSON *tmp_obj = cJSON_GetObjectItem(json, "uuid"); + EXPECT_TRUE(tmp_obj != NULL); + uuid_parse(tmp_obj->valuestring, ud->rule_uuid); - ret = get_column_pos(table_line, 5, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + cJSON_Delete(json); - ud->buffer = ALLOC(char, column_len + 1); - strncpy(ud->buffer, table_line + column_offset, column_len); - - ud->buf_len = column_len + 1; *ad = ud; (*counter)++; } @@ -5049,11 +5100,13 @@ void ipport_plugin_ex_free_cb(const char *table_name, void **ad, long argl, void { struct ipport_plugin_ud *ud = (struct ipport_plugin_ud *)(*ad); - ud->rule_id = 0; - memset(ud->buffer, 0, ud->buf_len); - ud->buf_len = 0; - - free(ud->buffer); + uuid_clear(ud->rule_uuid); + if (ud->buffer) { + memset(ud->buffer, 0, ud->buf_len); + ud->buf_len = 0; + free(ud->buffer); + } + free(ud); *ad = NULL; } @@ -5089,7 +5142,9 @@ TEST_F(IPPortPluginTable, EX_DATA) { ret = maat_ipport_plugin_table_get_ex_data(maat_inst, table_name, &ipv4, port, (void **)results, ARRAY_SIZE); EXPECT_EQ(ret, 1); - EXPECT_EQ(results[0]->rule_id, 103); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(results[0]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000103"); struct ip_addr ipv6; ipv6.ip_type = IPv6; @@ -5099,7 +5154,8 @@ TEST_F(IPPortPluginTable, EX_DATA) { ret = maat_ipport_plugin_table_get_ex_data(maat_inst, table_name, &ipv6, port, (void**)results, ARRAY_SIZE); EXPECT_EQ(ret, 1); - EXPECT_EQ(results[0]->rule_id, 104); + uuid_unparse(results[0]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000104"); inet_pton(AF_INET6, "240e:97c:4010:104::17", ipv6.ipv6); ret = maat_ipport_plugin_table_get_ex_data(maat_inst, table_name, &ipv6, port, @@ -5156,7 +5212,7 @@ struct log_handle *FQDNPluginTable::logger; #define FQDN_PLUGIN_EX_DATA struct fqdn_plugin_ud { - int rule_id; + uuid_t rule_uuid; int catid; }; @@ -5164,17 +5220,20 @@ void fqdn_plugin_ex_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp) { int *counter = (int *)argp; - size_t column_offset = 0, column_len = 0; struct fqdn_plugin_ud *ud = ALLOC(struct fqdn_plugin_ud, 1); - int ret = get_column_pos(table_line, 1, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); - ud->rule_id = atoi(table_line + column_offset); - ret = get_column_pos(table_line, 3, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + cJSON *tmp_obj = cJSON_GetObjectItem(json, "uuid"); + EXPECT_TRUE(tmp_obj != NULL); + uuid_parse(tmp_obj->valuestring, ud->rule_uuid); - sscanf(table_line + column_offset, "catid=%d", &ud->catid); + tmp_obj = cJSON_GetObjectItem(json, "buffer"); + EXPECT_TRUE(tmp_obj != NULL); + sscanf(tmp_obj->valuestring, "catid=%d", &ud->catid); + + cJSON_Delete(json); *ad = ud; (*counter)++; @@ -5184,7 +5243,7 @@ void fqdn_plugin_ex_free_cb(const char *table_name, void **ad, long argl, void * { struct fqdn_plugin_ud *u = (struct fqdn_plugin_ud *)(*ad); - u->rule_id = 0; + uuid_clear(u->rule_uuid); u->catid = 0; free(u); @@ -5216,8 +5275,12 @@ TEST_F(FQDNPluginTable, EX_DATA) { ret = maat_fqdn_plugin_table_get_ex_data(maat_inst, table_name, "www.example1.com", (void**)result, 4); ASSERT_EQ(ret, 2); - EXPECT_EQ(result[0]->rule_id, 201); - EXPECT_EQ(result[1]->rule_id, 202); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(result[0]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000201"); + + uuid_unparse(result[1]->rule_uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000202"); ret = maat_fqdn_plugin_table_get_ex_data(maat_inst, table_name, "www.example3.com", (void**)result, 4); @@ -5226,11 +5289,13 @@ TEST_F(FQDNPluginTable, EX_DATA) { ret = maat_fqdn_plugin_table_get_ex_data(maat_inst, table_name, "r3---sn-i3belne6.example2.com", (void**)result, 4); ASSERT_EQ(ret, 2); - EXPECT_TRUE(result[0]->rule_id == 205 || result[0]->rule_id == 204); + uuid_unparse(result[0]->rule_uuid, uuid_str); + EXPECT_TRUE(strcmp(uuid_str, "00000000-0000-0000-0000-000000000204") == 0 || + strcmp(uuid_str, "00000000-0000-0000-0000-000000000205") == 0); } struct bool_plugin_ud { - int id; + uuid_t uuid; char *name; size_t name_len; }; @@ -5238,19 +5303,22 @@ void bool_plugin_ex_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp) { int *counter=(int *)argp; - size_t column_offset=0, column_len=0; struct bool_plugin_ud *ud = ALLOC(struct bool_plugin_ud, 1); - - int ret = get_column_pos(table_line, 1, &column_offset, &column_len); - EXPECT_EQ(ret, 0); - ud->id = atoi(table_line + column_offset); - ret = get_column_pos(table_line, 3, &column_offset, &column_len); - EXPECT_EQ(ret, 0); + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); - ud->name = ALLOC(char, column_len + 1); - memcpy(ud->name, table_line+column_offset, column_len); - ud->name_len = column_len + 1; + cJSON *tmp_obj = cJSON_GetObjectItem(json, "uuid"); + EXPECT_TRUE(tmp_obj != NULL); + uuid_parse(tmp_obj->valuestring, ud->uuid); + + tmp_obj = cJSON_GetObjectItem(json, "buffer"); + EXPECT_TRUE(tmp_obj != NULL); + ud->name_len = strlen(tmp_obj->valuestring); + ud->name = ALLOC(char, ud->name_len + 1); + strncpy(ud->name, tmp_obj->valuestring, ud->name_len); + + cJSON_Delete(json); *ad = ud; (*counter)++; @@ -5259,7 +5327,7 @@ void bool_plugin_ex_free_cb(const char *table_name, void **ad, long argl, void * { struct bool_plugin_ud *u = (struct bool_plugin_ud *)(*ad); - u->id = 0; + uuid_clear(u->uuid); memset(u->name, 0, u->name_len); u->name_len = 0; @@ -5344,7 +5412,9 @@ TEST_F(BoolPluginTable, EX_DATA) { ret = maat_bool_plugin_table_get_ex_data(maat_inst, table_name, items_2, 3, (void**)result, 6); EXPECT_EQ(ret, 1); - EXPECT_EQ(result[0]->id, 301); + char uuid_str[UUID_STR_LEN] = {0}; + uuid_unparse(result[0]->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000301"); unsigned long long items_3[]={101, 102, 1000}; ret = maat_bool_plugin_table_get_ex_data(maat_inst, table_name, items_3, @@ -5355,8 +5425,9 @@ TEST_F(BoolPluginTable, EX_DATA) { ret = maat_bool_plugin_table_get_ex_data(maat_inst, table_name, items_4, sizeof(items_4)/sizeof(unsigned long long), (void**)result, 6); - EXPECT_EQ(ret, 1); - EXPECT_EQ(result[0]->id, 305); + EXPECT_EQ(ret, 1); + uuid_unparse(result[0]->uuid, uuid_str); + EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000305"); } class Attribute : public testing::Test @@ -5573,18 +5644,15 @@ void rule_ex_param_new(const char *table_name, const char *key, int *counter = (int *)argp; *ad = NULL; - struct rule_ex_param *param = ALLOC(struct rule_ex_param, 1); - - int rule_id = 0; - int service_id = 0; - int action = 0; - int do_blacklist = 0; - int do_log = 0; - char tags[1024] = {0}; + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); - sscanf(table_line, "%d\t%d\t%d\t%d\t%d\t%s\t%*[^:]:%[^,],%d", - &rule_id, &service_id, &action, &do_blacklist, &do_log, - tags, param->name, &(param->id)); + cJSON *tmp_obj = cJSON_GetObjectItem(json, "action_parameter"); + EXPECT_TRUE(tmp_obj != NULL); + + struct rule_ex_param *param = ALLOC(struct rule_ex_param, 1); + + sscanf(tmp_obj->valuestring, "%*[^:]:%[^,],%d", param->name, &(param->id)); (*counter)++; *ad = param; @@ -5751,12 +5819,14 @@ struct log_handle *Policy::logger; void accept_tags_entry_cb(const char *table_name, const char *table_line, enum maat_operation op, void *u_para) { int* callback_times = (int *)u_para; - char status[32] = {0}; - int entry_id = -1, seq = -1; - int is_valid = 0; - sscanf(table_line, "%d\t%s\t%d\t%d", &seq,status, &entry_id, &is_valid); - EXPECT_STREQ(status, "SUCCESS"); + cJSON *json = cJSON_Parse(table_line); + EXPECT_TRUE(json != NULL); + + cJSON *tmp_obj = cJSON_GetObjectItem(json, "status"); + EXPECT_TRUE(tmp_obj != NULL); + EXPECT_STREQ(tmp_obj->valuestring, "SUCCESS"); + (*callback_times)++; } @@ -5867,7 +5937,7 @@ TEST_F(Policy, RuleEXData) { EXPECT_EQ(ret, MAAT_SCAN_OK); void *ex_data = maat_plugin_table_get_ex_data(maat_inst, plugin_table_name, - (char *)&results[0], sizeof(long long)); + uuid_str, strlen(uuid_str)); ASSERT_TRUE(ex_data!=NULL); struct rule_ex_param *param = (struct rule_ex_param *)ex_data; EXPECT_EQ(param->id, 7799); @@ -6129,7 +6199,7 @@ TEST_F(TableInfo, Conjunction) { const char *scan_data = "soq is using table conjunction function." "http://www.3300av.com/novel/27122.txt"; const char *conj_table_name = "HTTP_HOST"; - const char *attribute_name = "HTTP_HOST"; + const char *attribute_name = "HTTP_URL"; struct maat *maat_inst = TableInfo::_shared_maat_inst; struct maat_state *state = maat_state_new(maat_inst, thread_id); @@ -6142,7 +6212,7 @@ TEST_F(TableInfo, Conjunction) { uuid_unparse(results[0], uuid_str); EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000134"); - uuid_unparse(results[0], uuid_str); + uuid_unparse(results[1], uuid_str); EXPECT_STREQ(uuid_str, "00000000-0000-0000-0000-000000000133"); ret = maat_scan_not_logic(maat_inst, conj_table_name, attribute_name, results, ARRAY_SIZE, diff --git a/test/maat_json.json b/test/maat_json.json index 1e8adba..ac14ab1 100644 --- a/test/maat_json.json +++ b/test/maat_json.json @@ -552,86 +552,86 @@ ], "object_groups": [ { - "uuid": "00000000-0000-0000-0000-000000000500", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000500", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000106" ] }, { - "uuid": "00000000-0000-0000-0000-000000000501", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000501", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000141" ] }, { - "uuid": "00000000-0000-0000-0000-000000000502", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000502", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000100" ] }, { - "uuid": "00000000-0000-0000-0000-000000000503", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000503", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000189" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000190" ] }, { - "uuid": "00000000-0000-0000-0000-000000000504", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000504", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000192" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000193" ] }, { - "uuid": "00000000-0000-0000-0000-000000000505", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000505", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000195" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000196", "00000000-0000-0000-0000-000000000197" ] }, { - "uuid": "00000000-0000-0000-0000-000000000506", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000506", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000201" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000202" ] }, { - "uuid": "00000000-0000-0000-0000-000000000507", + "object_uuid": "00000000-0000-0000-0000-000000000507", "object_name": "ExcludeLogicObject204_3_1", - "include_object_uuids": [ + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000207" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000208" ] }, { - "uuid": "00000000-0000-0000-0000-000000000508", + "object_uuid": "00000000-0000-0000-0000-000000000508", "object_name": "ExcludeLogicObject204_3", - "include_object_uuids": [ + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000507" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000209" ] }, { - "uuid": "00000000-0000-0000-0000-000000000509", - "include_object_uuids": [ + "object_uuid": "00000000-0000-0000-0000-000000000509", + "included_sub_object_uuids": [ "00000000-0000-0000-0000-000000000223" ], - "exclude_object_uuids": [ + "excluded_sub_object_uuids": [ "00000000-0000-0000-0000-000000000224" ] } @@ -643,17 +643,17 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.", + "action_parameter": "escaped\\bdata:have\\ba\\bspace\\band\\ba\\b\\&\\bsymbol.", "is_valid": "yes", "conditions": [ { - "attribute": "IP_CONFIG", + "attribute_name": "IP_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] }, { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "123_url_object", @@ -679,17 +679,17 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "IP_CONFIG", + "attribute_name": "IP_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] }, { - "attribute": "CONTENT_SIZE", + "attribute_name": "CONTENT_SIZE", "objects": [ { "object_name": "124_interval_object", @@ -714,11 +714,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "125_url_object", @@ -744,11 +744,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "126_url_object", @@ -767,7 +767,7 @@ ] }, { - "attribute": "CONTENT_SIZE", + "attribute_name": "CONTENT_SIZE", "object_uuids": [ "00000000-0000-0000-0000-000000000106" ] @@ -780,11 +780,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "StringScan.ExprPlus", + "action_parameter": "StringScan.ExprPlus", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_SIGNATURE", + "attribute_name": "HTTP_SIGNATURE", "objects": [ { "object_name": "128_expr_object", @@ -811,11 +811,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "utf8_中文", + "action_parameter": "utf8_中文", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "129_url_object", @@ -841,11 +841,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "utf8_维语", + "action_parameter": "utf8_维语", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "130_keywords_object", @@ -871,11 +871,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "utf8_维语2", + "action_parameter": "utf8_维语2", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "131_keywords_object", @@ -901,11 +901,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "string\\bunescape", + "action_parameter": "string\\bunescape", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "object_uuids":[ "00000000-0000-0000-0000-000000000111" ] @@ -918,11 +918,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz", + "action_parameter": "13018_table_conjunction_test_part1\bnow_its_very_very_long0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz0123456789abcdefghijklmnopkrstuvwxyz", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_HOST", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "133_host_object", @@ -948,11 +948,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "table_conjunction_test_part2", + "action_parameter": "table_conjunction_test_part2", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "134_url_object", @@ -978,11 +978,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "offset_string", + "action_parameter": "offset_string", "is_valid": "yes", "conditions": [ { - "attribute": "IMAGE_FP", + "attribute_name": "IMAGE_FP", "objects": [ { "object_name": "136_expr_object", @@ -1008,11 +1008,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "offset_string", + "action_parameter": "offset_string", "is_valid": "yes", "conditions": [ { - "attribute": "IMAGE_FP", + "attribute_name": "IMAGE_FP", "objects": [ { "object_name": "137_expr_object", @@ -1038,13 +1038,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "effective_range": 0, - "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}", - "user_region": "Not\\baccepted\\btags", + "effective_range": {"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里","上海/浦东/陆家嘴"]},{"tag":"isp","value":["电信","联通"]}],[{"tag":"location","value":["北京"]},{"tag":"isp","value":["联通"]}]]}, + "action_parameter": "Not\\baccepted\\btags", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "138_url_object", @@ -1070,13 +1069,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "effective_range": 0, - "tags": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}", - "user_region": "Accepted\\btags", + "effective_range": "{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}", + "action_parameter": "Accepted\\btags", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "139_url_object", @@ -1102,11 +1100,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "file_streams", + "action_parameter": "file_streams", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "140_keywords_object", @@ -1132,13 +1130,13 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "Something:I\\bhave\\ba\\bname,7799", + "action_parameter": "Something:I\\bhave\\ba\\bname,7799", "rule_table_name": "RULE_ALIAS", "is_valid": "yes", "conditions": [ { "o2r_table_name": "OBJECT2RULE_ALIAS", - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "141_url_object", @@ -1164,11 +1162,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "StringScan.UTF8EncodedURL", + "action_parameter": "StringScan.UTF8EncodedURL", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "142_url_object", @@ -1194,12 +1192,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.OneRegion", + "action_parameter": "NOTLogic.OneRegion", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 0, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": false, "objects": [ { "object_name": "143_url_object1", @@ -1218,8 +1216,8 @@ ] }, { - "attribute": "HTTP_URL_FILTER", - "negate_option": 1, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": true, "objects": [ { "object_name": "143_url_object2", @@ -1245,12 +1243,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.ScanNotAtLast", + "action_parameter": "NOTLogic.ScanNotAtLast", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 0, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": false, "objects": [ { "object_name": "144_url_object", @@ -1269,8 +1267,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS", + "negate_option": true, "objects": [ { "object_name": "144_keywords_object", @@ -1296,12 +1294,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.ScanNotIP", + "action_parameter": "NOTLogic.ScanNotIP", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", - "negate_option": 0, + "attribute_name": "HTTP_URL", + "negate_option": false, "objects": [ { "object_name": "145_url_object", @@ -1320,8 +1318,8 @@ ] }, { - "attribute": "ATTRIBUTE_IP_CONFIG", - "negate_option": 1, + "attribute_name": "ATTRIBUTE_IP_CONFIG", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000100" ] @@ -1334,12 +1332,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.NotExprConditionAndNotIPCondition", + "action_parameter": "NOTLogic.NotExprConditionAndNotIPCondition", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 0, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": false, "condition_index": 0, "objects": [ { @@ -1359,8 +1357,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS", + "negate_option": true, "condition_index": 1, "objects": [ { @@ -1380,8 +1378,8 @@ ] }, { - "attribute": "ATTRIBUTE_IP_CONFIG", - "negate_option": 1, + "attribute_name": "ATTRIBUTE_IP_CONFIG", + "negate_option": true, "condition_index": 2, "object_uuids": [ "00000000-0000-0000-0000-000000000100" @@ -1395,12 +1393,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.8NotCondition", + "action_parameter": "NOTLogic.8NotCondition", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_RESPONSE_KEYWORDS_1", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_1", + "negate_option": true, "condition_index": 0, "objects": [ { @@ -1420,8 +1418,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_2", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_2", + "negate_option": true, "condition_index": 1, "objects": [ { @@ -1441,8 +1439,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_3", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_3", + "negate_option": true, "condition_index": 2, "objects": [ { @@ -1462,8 +1460,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_4", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_4", + "negate_option": true, "condition_index": 3, "objects": [ { @@ -1483,8 +1481,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_5", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_5", + "negate_option": true, "condition_index": 4, "objects": [ { @@ -1504,8 +1502,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_6", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_6", + "negate_option": true, "condition_index": 5, "objects": [ { @@ -1525,8 +1523,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_7", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_7", + "negate_option": true, "condition_index": 6, "objects": [ { @@ -1546,8 +1544,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS_8", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS_8", + "negate_option": true, "condition_index": 7, "objects": [ { @@ -1574,11 +1572,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "StringScan.Regex", + "action_parameter": "StringScan.Regex", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "148_url_object", @@ -1604,11 +1602,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.BugReport20190325", + "action_parameter": "StringScan.BugReport20190325", "is_valid": "yes", "conditions": [ { - "attribute": "TROJAN_PAYLOAD", + "attribute_name": "TROJAN_PAYLOAD", "objects": [ { "object_name": "billgates_regist1", @@ -1627,7 +1625,7 @@ ] }, { - "attribute": "TROJAN_PAYLOAD", + "attribute_name": "TROJAN_PAYLOAD", "objects": [ { "object_name": "billgates_regist2", @@ -1653,11 +1651,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.PrefixAndSuffix", + "action_parameter": "StringScan.PrefixAndSuffix", "is_valid": "yes", "conditions": [ { - "attribute": "MAIL_ADDR", + "attribute_name": "MAIL_ADDR", "objects": [ { "object_name": "151_expr_object", @@ -1683,17 +1681,17 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.PrefixAndSuffix", + "action_parameter": "StringScan.PrefixAndSuffix", "is_valid": "yes", "conditions": [ { - "attribute": "MAIL_ADDR", + "attribute_name": "MAIL_ADDR", "object_uuids": [ "00000000-0000-0000-0000-000000000141" ] }, { - "attribute": "CONTENT_SIZE", + "attribute_name": "CONTENT_SIZE", "object_uuids": [ "00000000-0000-0000-0000-000000000500" ] @@ -1706,19 +1704,19 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "Policy.SubObject", + "action_parameter": "Policy.SubObject", "is_valid": "yes", "conditions": [ { - "attribute": "MAIL_ADDR", - "negate_option": 0, + "attribute_name": "MAIL_ADDR", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000143", "00000000-0000-0000-0000-000000000501" ] }, { - "attribute": "IP_CONFIG", + "attribute_name": "IP_CONFIG", "object_uuids": [ "00000000-0000-0000-0000-000000000502" ] @@ -1731,12 +1729,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "ipv4_plus", + "action_parameter": "ipv4_plus", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "154_IP_object", @@ -1761,12 +1759,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "ipv6_plus", + "action_parameter": "ipv6_plus", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "155_IP_object", @@ -1791,11 +1789,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.StreamScanUTF8", + "action_parameter": "StringScan.StreamScanUTF8", "is_valid": "yes", "conditions": [ { - "attribute": "TROJAN_PAYLOAD", + "attribute_name": "TROJAN_PAYLOAD", "objects": [ { "object_name": "157_expr_object", @@ -1821,11 +1819,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "IPScan.IPv4_CIDR", + "action_parameter": "IPScan.IPv4_CIDR", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "158_IP_object", @@ -1850,11 +1848,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "IPScan.IPv6_CIDR", + "action_parameter": "IPScan.IPv6_CIDR", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "159_IP_object", @@ -1879,19 +1877,19 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "AttributeWithOnePhysical", + "action_parameter": "AttributeWithOnePhysical", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "negate_option": 0, + "attribute_name": "HTTP_RESPONSE_KEYWORDS", + "negate_option": false, "object_uuids":[ "00000000-0000-0000-0000-000000000111" ] }, { - "attribute": "HTTP_URL", - "negate_option": 0, + "attribute_name": "HTTP_URL", + "negate_option": false, "objects": [ { "object_name": "160_url_object", @@ -1917,19 +1915,19 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "OneObjectInTwoAttribute", + "action_parameter": "OneObjectInTwoAttribute", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_REQUEST_HEADER", - "negate_option": 0, + "attribute_name": "HTTP_REQUEST_HEADER", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000153" ] }, { - "attribute": "HTTP_RESPONSE_HEADER", - "negate_option": 0, + "attribute_name": "HTTP_RESPONSE_HEADER", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000153" ] @@ -1942,11 +1940,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "CharsetWindows1251", + "action_parameter": "CharsetWindows1251", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "164_keywords_object", @@ -1972,12 +1970,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "EvaluationOrder", + "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "2.111", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "165_url_object", @@ -1996,8 +1994,8 @@ ] }, { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "165_IP_object", @@ -2022,12 +2020,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "EvaluationOrder", + "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "100.233", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "166_url_object", @@ -2053,19 +2051,19 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "EvaluationOrder", + "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "300.999", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "condition_index": 1, "object_uuids": [ "00000000-0000-0000-0000-000000000158" ] }, { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000158" ], @@ -2079,19 +2077,19 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "EvaluationOrder", + "action_parameter": "EvaluationOrder", "is_valid": "yes", "evaluation_order": "0", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000158" ], "condition_index": 2 }, { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000158" ], @@ -2105,13 +2103,13 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "IPScan.IPv4_Any", + "action_parameter": "IPScan.IPv4_Any", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "condition_index": 0, - "negate_option": 0, + "negate_option": false, "objects": [ { "object_name": "169_IP_object", @@ -2136,15 +2134,15 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "IPScan.IPv4_attribute.source", + "action_parameter": "IPScan.IPv4_attribute_name.source", "is_valid": "no", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { - "object_name": "ipv4_attribute.source", + "object_name": "ipv4_attribute_name.source", "uuid": "00000000-0000-0000-0000-000000000161", "items": [ { @@ -2166,15 +2164,15 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "IPScan.IPv4_attribute.destination", + "action_parameter": "IPScan.IPv4_attribute_name.destination", "is_valid": "no", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { - "object_name": "ipv4_attribute.destination", + "object_name": "ipv4_attribute_name.destination", "uuid": "00000000-0000-0000-0000-000000000162", "items": [ { @@ -2196,12 +2194,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.MulticonditionsInOneNotCondition", + "action_parameter": "NOTLogic.MulticonditionsInOneNotCondition", "is_valid": "yes", "conditions": [ { - "attribute": "ASN_NOT_LOGIC", - "negate_option": 1, + "attribute_name": "ASN_NOT_LOGIC", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", @@ -2210,8 +2208,8 @@ "condition_index": 0 }, { - "attribute": "DESTINATION_IP_ASN", - "negate_option": 0, + "attribute_name": "DESTINATION_IP_ASN", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000002" ], @@ -2225,22 +2223,22 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "Hierarchy.MultiObjectInOneCondition", + "action_parameter": "Hierarchy.MultiObjectInOneCondition", "is_valid": "yes", "conditions": [ { - "attribute": "SOURCE_IP_ASN", + "attribute_name": "SOURCE_IP_ASN", "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", "00000000-0000-0000-0000-000000000004" ], - "negate_option": 0, + "negate_option": false, "condition_index": 0 }, { - "attribute": "DESTINATION_IP_ASN", - "negate_option": 0, + "attribute_name": "DESTINATION_IP_ASN", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000002" ], @@ -2254,12 +2252,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "Hierarchy.MultiObjectInOneCondition", + "action_parameter": "Hierarchy.MultiObjectInOneCondition", "is_valid": "yes", "conditions": [ { - "attribute": "SOURCE_IP_ASN", - "negate_option": 0, + "attribute_name": "SOURCE_IP_ASN", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", @@ -2268,16 +2266,16 @@ "condition_index": 0 }, { - "attribute": "SOURCE_IP_GEO", - "negate_option": 0, + "attribute_name": "SOURCE_IP_GEO", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000015" ], "condition_index": 0 }, { - "attribute": "IP_CONFIG", - "negate_option": 0, + "attribute_name": "IP_CONFIG", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000012" ], @@ -2291,12 +2289,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.MultiLiteralsInOneNotCondition", + "action_parameter": "NOTLogic.MultiLiteralsInOneNotCondition", "is_valid": "yes", "conditions": [ { - "attribute": "SOURCE_IP_ASN", - "negate_option": 1, + "attribute_name": "SOURCE_IP_ASN", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", @@ -2305,16 +2303,16 @@ "condition_index": 0 }, { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 1, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000014" ], "condition_index": 0 }, { - "attribute": "SOURCE_IP_GEO", - "negate_option": 0, + "attribute_name": "SOURCE_IP_GEO", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000015" ], @@ -2328,11 +2326,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "8-expr", + "action_parameter": "8-expr", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "182_keywords_object", @@ -2354,7 +2352,7 @@ }, { "uuid": "00000000-0000-0000-0000-000000000184", - "user_region": "APP_ID=6006740;Liumengyan-Bugreport-20210515", + "action_parameter": "APP_ID=6006740;Liumengyan-Bugreport-20210515", "description": "Hulu", "is_valid": "yes", "do_blacklist": 0, @@ -2363,7 +2361,7 @@ "service": 0, "conditions": [ { - "attribute": "IP_CONFIG", + "attribute_name": "IP_CONFIG", "objects": [ { "object_name": "184_IP_object", @@ -2388,12 +2386,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.SameAttributeInMultiCondition", + "action_parameter": "NOTLogic.SameAttributeInMultiCondition", "is_valid": "yes", "conditions": [ { - "attribute": "DESTINATION_IP_ASN", - "negate_option": 1, + "attribute_name": "DESTINATION_IP_ASN", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000001", "00000000-0000-0000-0000-000000000003", @@ -2402,32 +2400,32 @@ "condition_index": 0 }, { - "attribute": "SOURCE_IP_GEO", - "negate_option": 1, + "attribute_name": "SOURCE_IP_GEO", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000015" ], "condition_index": 0 }, { - "attribute": "DESTINATION_IP_ASN", - "negate_option": 1, + "attribute_name": "DESTINATION_IP_ASN", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000005" ], "condition_index": 1 }, { - "attribute": "DESTINATION_IP_ASN", - "negate_option": 0, + "attribute_name": "DESTINATION_IP_ASN", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000006" ], "condition_index": 2 }, { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000013" ], @@ -2441,12 +2439,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.ScanHitAtLast", + "action_parameter": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 1, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": true, "objects": [ { "object_name": "186_expr_object", @@ -2465,8 +2463,8 @@ ] }, { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "186_IP_object", @@ -2491,12 +2489,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.ScanHitAtLast", + "action_parameter": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 1, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": true, "objects": [ { "object_name": "187_url_object", @@ -2515,8 +2513,8 @@ ] }, { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "187_IP_object", @@ -2541,12 +2539,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NOTLogic.ScanHitAtLast", + "action_parameter": "NOTLogic.ScanHitAtLast", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 1, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": true, "objects": [ { "object_name": "188_url_object", @@ -2565,8 +2563,8 @@ ] }, { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "188_IP_object", @@ -2592,10 +2590,10 @@ "action": 0, "service": 0, "do_blacklist": 0, - "user_region": "StringScan.ShouldNotHitExprPlus", + "action_parameter": "StringScan.ShouldNotHitExprPlus", "conditions": [ { - "attribute": "APP_PAYLOAD", + "attribute_name": "APP_PAYLOAD", "objects": [ { "object_name": "189_app_object", @@ -2622,11 +2620,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.HexBinCaseSensitive", + "action_parameter": "StringScan.HexBinCaseSensitive", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "191_keywords_object", @@ -2652,11 +2650,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "FLAG_CONFIG", + "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "192_flag_object", @@ -2682,11 +2680,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "FLAG_CONFIG", + "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "193_flag_object", @@ -2705,7 +2703,7 @@ ] }, { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "193_url_object", @@ -2731,11 +2729,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "FLAG_CONFIG", + "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "194_flag_object", @@ -2761,11 +2759,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "Something:I\\bhave\\ba\\bname,8866", + "action_parameter": "Something:I\\bhave\\ba\\bname,8866", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "197_url_object", @@ -2791,13 +2789,13 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "Something:I have a name,7799", + "action_parameter": "Something:I have a name,7799", "rule_table_name": "RULE_FIREWALL_DEFAULT", "is_valid": "yes", "conditions": [ { "o2r_table_name": "OBJECT2RULE_FIREWALL", - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "198_url_object", @@ -2823,11 +2821,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "ExcludeLogic.ScanNotAtLast", + "action_parameter": "ExcludeLogic.ScanNotAtLast", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "object_name": "ExcludeLogicObject199", "object_uuids": [ "00000000-0000-0000-0000-000000000503" @@ -2841,11 +2839,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "ExcludeLogic.OneRegion", + "action_parameter": "ExcludeLogic.OneRegion", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "object_uuids": [ "00000000-0000-0000-0000-000000000504" ] @@ -2858,11 +2856,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "null", + "action_parameter": "null", "is_valid": "yes", "conditions": [ { - "attribute": "ATTRIBUTE_IP_PLUS_TABLE", + "attribute_name": "ATTRIBUTE_IP_PLUS_TABLE", "object_name": "ExcludeLogicObject202", "object_uuids": [ "00000000-0000-0000-0000-000000000505" @@ -2877,12 +2875,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "null", + "action_parameter": "null", "is_valid": "yes", "conditions": [ { - "attribute": "ATTRIBUTE_IP_PLUS_SOURCE", - "condition_index": 0, + "attribute_name": "ATTRIBUTE_IP_PLUS_SOURCE", "objects": [ { "object_name": "ExcludeLogicObject203_1", @@ -2900,8 +2897,7 @@ ] }, { - "attribute": "ATTRIBUTE_IP_PLUS_DESTINATION", - "condition_index": 1, + "attribute_name": "ATTRIBUTE_IP_PLUS_DESTINATION", "objects": [ { "object_name": "ExcludeLogicObject203_2", @@ -2919,12 +2915,11 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", + "attribute_name": "HTTP_RESPONSE_KEYWORDS", "object_name": "ExcludeLogicObject203_3", "object_uuids": [ "00000000-0000-0000-0000-000000000506" - ], - "condition_index": 2 + ] } ] }, @@ -2934,12 +2929,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "null", + "action_parameter": "null", "is_valid": "yes", "conditions": [ { - "attribute": "ATTRIBUTE_IP_PLUS_SOURCE", - "condition_index": 0, + "attribute_name": "ATTRIBUTE_IP_PLUS_SOURCE", "objects": [ { "object_name": "ExcludeLogicObject204_1", @@ -2957,8 +2951,7 @@ ] }, { - "attribute": "ATTRIBUTE_IP_PLUS_DESTINATION", - "condition_index": 1, + "attribute_name": "ATTRIBUTE_IP_PLUS_DESTINATION", "objects": [ { "object_name": "ExcludeLogicObject204_2", @@ -2976,11 +2969,10 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", + "attribute_name": "HTTP_RESPONSE_KEYWORDS", "object_uuids": [ "00000000-0000-0000-0000-000000000508" - ], - "condition_index": 2 + ] } ] }, @@ -2990,11 +2982,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.RegexExpressionIllegal", + "action_parameter": "StringScan.RegexExpressionIllegal", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "205_keywords_object", @@ -3020,11 +3012,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "duplicateRuleFor191", + "action_parameter": "duplicateRuleFor191", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "206_keywords_object", @@ -3050,11 +3042,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "duplicateRuleFor192", + "action_parameter": "duplicateRuleFor192", "is_valid": "yes", "conditions": [ { - "attribute": "FLAG_CONFIG", + "attribute_name": "FLAG_CONFIG", "objects": [ { "object_name": "207_flag_object", @@ -3080,12 +3072,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "duplicateRuleFor154", + "action_parameter": "duplicateRuleFor154", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PLUS_CONFIG", + "negate_option": false, "objects": [ { "object_name": "208_IP_object", @@ -3110,11 +3102,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "ipv6_::", + "action_parameter": "ipv6_::", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "210_IP_object", @@ -3139,12 +3131,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "ip_perf_test", + "action_parameter": "ip_perf_test", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PERF_CONFIG", - "negate_option": 0, + "attribute_name": "IP_PERF_CONFIG", + "negate_option": false, "objects": [ { "object_name": "211_IP_object", @@ -3169,11 +3161,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "integer_perf_test", + "action_parameter": "integer_perf_test", "is_valid": "yes", "conditions": [ { - "attribute": "INTEGER_PERF_CONFIG", + "attribute_name": "INTEGER_PERF_CONFIG", "objects": [ { "object_name": "212_interval_object", @@ -3198,11 +3190,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "expr_perf_test", + "action_parameter": "expr_perf_test", "is_valid": "yes", "conditions": [ { - "attribute": "EXPR_LITERAL_PERF_CONFIG", + "attribute_name": "EXPR_LITERAL_PERF_CONFIG", "objects": [ { "object_name": "213_expr_object", @@ -3228,11 +3220,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "flag_perf_test", + "action_parameter": "flag_perf_test", "is_valid": "yes", "conditions": [ { - "attribute": "FLAG_PERF_CONFIG", + "attribute_name": "FLAG_PERF_CONFIG", "objects": [ { "object_name": "214_flag_object", @@ -3258,11 +3250,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "expr_perf_test", + "action_parameter": "expr_perf_test", "is_valid": "yes", "conditions": [ { - "attribute": "EXPR_REGEX_PERF_CONFIG", + "attribute_name": "EXPR_REGEX_PERF_CONFIG", "objects": [ { "object_name": "215_expr_object", @@ -3288,20 +3280,20 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "NOTCondition&ExcludeObject", + "action_parameter": "NOTCondition&ExcludeObject", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 0, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": false, "object_uuids": [ "00000000-0000-0000-0000-000000000504" ], "condition_index": 0 }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "negate_option": 1, + "attribute_name": "HTTP_RESPONSE_KEYWORDS", + "negate_option": true, "condition_index": 1, "objects": [ { @@ -3328,20 +3320,20 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "NOTCondition&ExcludeObject", + "action_parameter": "NOTCondition&ExcludeObject", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL_FILTER", - "negate_option": 1, + "attribute_name": "HTTP_URL_FILTER", + "negate_option": true, "object_uuids": [ "00000000-0000-0000-0000-000000000509" ], "condition_index": 0 }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "negate_option": 0, + "attribute_name": "HTTP_RESPONSE_KEYWORDS", + "negate_option": false, "condition_index": 1, "objects": [ { @@ -3368,11 +3360,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "CONTENT_SIZE", + "attribute_name": "CONTENT_SIZE", "objects": [ { "object_name": "218_interval_object", @@ -3397,12 +3389,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_DUMMY", - "negate_option": 0, + "attribute_name": "HTTP_DUMMY", + "negate_option": false, "condition_index": 0, "objects": [ { @@ -3422,8 +3414,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 1, "objects": [ { @@ -3443,8 +3435,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 2, "objects": [ { @@ -3464,8 +3456,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 3, "objects": [ { @@ -3485,8 +3477,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 4, "objects": [ { @@ -3506,8 +3498,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 5, "objects": [ { @@ -3527,8 +3519,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 6, "objects": [ { @@ -3548,8 +3540,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 7, "objects": [ { @@ -3576,12 +3568,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "anything", + "action_parameter": "anything", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_DUMMY", - "negate_option": 0, + "attribute_name": "HTTP_DUMMY", + "negate_option": false, "condition_index": 0, "objects": [ { @@ -3601,8 +3593,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 1, "objects": [ { @@ -3622,8 +3614,8 @@ ] }, { - "attribute": "HTTP_DUMMY", - "negate_option": 1, + "attribute_name": "HTTP_DUMMY", + "negate_option": true, "condition_index": 2, "objects": [ { @@ -3650,12 +3642,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "NOTLogic.SingleNotCondition", + "action_parameter": "NOTLogic.SingleNotCondition", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_NOT_LOGIC_1", - "negate_option": 1, + "attribute_name": "HTTP_NOT_LOGIC_1", + "negate_option": true, "condition_index": 0, "objects": [ { @@ -3682,12 +3674,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "NOTLogic.MultiNotCondition", + "action_parameter": "NOTLogic.MultiNotCondition", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_NOT_LOGIC", - "negate_option": 1, + "attribute_name": "HTTP_NOT_LOGIC", + "negate_option": true, "condition_index": 0, "objects": [ { @@ -3707,8 +3699,8 @@ ] }, { - "attribute": "HTTP_NOT_LOGIC", - "negate_option": 1, + "attribute_name": "HTTP_NOT_LOGIC", + "negate_option": true, "condition_index": 1, "objects": [ { @@ -3728,8 +3720,8 @@ ] }, { - "attribute": "HTTP_NOT_LOGIC", - "negate_option": 1, + "attribute_name": "HTTP_NOT_LOGIC", + "negate_option": true, "condition_index": 2, "objects": [ { @@ -3756,12 +3748,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "NOTLogic.NotPhysicalTable", + "action_parameter": "NOTLogic.NotPhysicalTable", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", - "negate_option": 1, + "attribute_name": "KEYWORDS_TABLE", + "negate_option": true, "condition_index": 0, "objects": [ { @@ -3781,8 +3773,8 @@ ] }, { - "attribute": "HTTP_RESPONSE_KEYWORDS", - "negate_option": 0, + "attribute_name": "HTTP_RESPONSE_KEYWORDS", + "negate_option": false, "condition_index": 1, "objects": [ { @@ -3809,12 +3801,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "Payload escape", + "action_parameter": "Payload escape", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", - "negate_option": 0, + "attribute_name": "KEYWORDS_TABLE", + "negate_option": false, "condition_index": 0, "objects": [ { @@ -3841,11 +3833,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "maat_scan_object", + "action_parameter": "maat_scan_object", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "object_name": "226_url_object", "object_uuids": [ "00000000-0000-0000-0000-000000000247" @@ -3859,12 +3851,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "maat_scan_object", + "action_parameter": "maat_scan_object", "rule_table_name": "RULE_FIREWALL_DEFAULT", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "object_name": "227_url_object", "object_uuids": [ "00000000-0000-0000-0000-000000000248" @@ -3878,12 +3870,12 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "NotConditionHitPath", + "action_parameter": "NotConditionHitPath", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", - "negate_option": 0, + "attribute_name": "HTTP_URL", + "negate_option": false, "condition_index": 1, "objects": [ { @@ -3903,8 +3895,8 @@ ] }, { - "attribute": "ATTRIBUTE_IP_CONFIG", - "negate_option": 1, + "attribute_name": "ATTRIBUTE_IP_CONFIG", + "negate_option": true, "condition_index": 2, "objects": [ { @@ -3930,11 +3922,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "StringScan.Regex", + "action_parameter": "StringScan.Regex", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_URL", + "attribute_name": "HTTP_URL", "objects": [ { "object_name": "229_url_object", @@ -3960,11 +3952,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "ipv6_::", + "action_parameter": "ipv6_::", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "230_IP_object", @@ -3990,11 +3982,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "should_not_hit", + "action_parameter": "should_not_hit", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "231_IP_object", @@ -4020,11 +4012,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "should_not_hit", + "action_parameter": "should_not_hit", "is_valid": "yes", "conditions": [ { - "attribute": "IP_PLUS_CONFIG", + "attribute_name": "IP_PLUS_CONFIG", "objects": [ { "object_name": "232_IP_object", @@ -4050,11 +4042,11 @@ "action": 1, "do_blacklist": 1, "do_log": 1, - "user_region": "maat_scan_object", + "action_parameter": "maat_scan_object", "is_valid": "yes", "conditions": [ { - "attribute": "HTTP_RESPONSE_KEYWORDS", + "attribute_name": "HTTP_RESPONSE_KEYWORDS", "object_name": "233_url_object", "object_uuids": [ "00000000-0000-0000-0000-000000000259" @@ -4068,12 +4060,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "Payload escape", + "action_parameter": "Payload escape", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", - "negate_option": 0, + "attribute_name": "KEYWORDS_TABLE", + "negate_option": false, "condition_index": 0, "objects": [ { @@ -4100,12 +4092,12 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "Payload escape", + "action_parameter": "Payload escape", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", - "negate_option": 0, + "attribute_name": "KEYWORDS_TABLE", + "negate_option": false, "condition_index": 0, "objects": [ { @@ -4132,11 +4124,11 @@ "action": 0, "do_blacklist": 0, "do_log": 0, - "user_region": "StringScan.HexBinCombineString", + "action_parameter": "StringScan.HexBinCombineString", "is_valid": "yes", "conditions": [ { - "attribute": "KEYWORDS_TABLE", + "attribute_name": "KEYWORDS_TABLE", "objects": [ { "object_name": "236_keywords_object", @@ -4161,113 +4153,105 @@ { "table_name": "QD_ENTRY_INFO", "table_content": [ - "1\t192.168.0.1\t101\t1", - "2\t192.168.0.2\t102\t1", - "3\t192.168.1.1\t103\t1" - ] - }, - { - "table_name": "TEST_PLUGIN_TABLE", - "table_content": [ - "1\t3388\t99\t1", - "2\t3355\t66\t1", - "3\tcccc\t11\t1" + {"uuid":"00000000-0000-0000-0000-000000000001", "ip":"192.168.0.1", "entry_id":101, "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000002", "ip":"192.168.0.2", "entry_id":102, "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000003", "ip":"192.168.1.1", "entry_id":103, "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_EXDATA_TABLE", "table_content": [ - "1\tHeBei\tShijiazhuang\t1\t0", - "2\tHeNan\tZhengzhou\t1\t0", - "3\tShanDong\tJinan\t1\t0", - "4\tShanXi\tTaiyuan\t1\t0" - ] - }, - { - "table_name": "TEST_EFFECTIVE_RANGE_TABLE", - "table_content": [ - "1\tSUCCESS\t99\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"移动\"]}]]}\t1111", - "2\tSUCCESS\t66\t1\t0\t222", - "3\tFAILED\t11\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京/朝阳/华严北里\",\"上海/浦东/陆家嘴\"]},{\"tag\":\"isp\",\"value\":[\"电信\",\"联通\"]}],[{\"tag\":\"location\",\"value\":[\"北京\"]},{\"tag\":\"isp\",\"value\":[\"联通\"]}]]}\t333", - "4\tSUCCESS\t66\t1\t{}\t444", - "5\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"location\",\"value\":[\"北京\"]}]]}\t444", - "6\tSUCCESS\t66\t1\t{\"tag_sets\":[[{\"tag\":\"weather\",\"value\":[\"hot\"]}]]}\t444" - ] - }, - { - "table_name": "IR_INTERCEPT_IP", - "table_content": [ - "1000000130\t1000000130\t4\t192.168.10.99\t255.255.255.255\t0\t65535\t0.0.0.0\t255.255.255.255\t0\t65535\t0\t1\t1\t96\t1\tuser_region\t{}\t2019/1/24/18:0:34", - "161\t161\t4\t0.0.0.0\t255.255.255.255\t0\t65535\t61.135.169.121\t255.255.255.255\t0\t65535\t0\t0\t1\t96\t832\t0\t0\t2019/1/24/18:48:42" - ] - }, - { - "table_name": "TEST_IP_PLUGIN_WITH_EXDATA", - "table_content": [ - "101\t4\t192.168.30.99-192.168.30.101\tSomething-like-json\t1", - "102\t4\t192.168.30.90-192.168.30.128\tBigger-range-should-in-the-back\t1", - "103\t6\t2001:db8:1234::-2001:db8:1235::\tBigger-range-should-in-the-back\t1", - "104\t6\t2001:db8:1234::1-2001:db8:1234::5210\tSomething-like-json\t1", - "105\t6\t2620:100:3000::-2620:0100:30ff:ffff:ffff:ffff:ffff:ffff\tBugreport-liumengyan-20210517\t1" - ] - }, - { - "table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA", - "table_content": [ - "101\t4\t192.168.100.1\t0\t255\t1", - "102\t4\t192.168.100.2\t100\t200\t1", - "103\t4\t192.168.100.1\t255\t300\t1", - "104\t6\t2001:db8:1234::5210\t255\t512\t1" - ] - }, - { - "table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA", - "table_content": [ - "201\twww.example1.com\tcatid=1\t1", - "202\t*.example1.com\tcatid=1\t1", - "203\tnews.example1.com\tcatid=2\t1", - "204\tr3---sn-i3belne6.example2.com\tcatid=3\t1", - "205\tr3---sn-i3belne6.example2.com\tcatid=3\t1" - ] - }, - { - "table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA", - "table_content": [ - "301\t1&2&1000\ttunnel1\t1", - "302\t101&102\ttunnel2\t1", - "303\t102\ttunnel3\t1", - "304\t101\ttunnel4\t1", - "305\t0&1&2&3&4&5&6&7\ttunnel5\t1", - "306\t101&101\tinvalid\t1" + {"uuid":"00000000-0000-0000-0000-000000000001", "key":"HeBei", "city":"Shijiazhuang", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000002", "key":"HeNan", "city":"Zhengzhou", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000003", "key":"ShanDong", "city":"Jinan", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000004", "key":"ShanXi", "city":"Taiyuan", "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_LONG_KEY_TYPE_TABLE", "table_content": [ - "1\t11111111\tShijiazhuang\t1\t0", - "2\t22222222\tZhengzhou\t1\t0", - "3\t33333333\tJinan\t1\t0", - "4\t44444444\tTaiyuan\t1\t0" + {"uuid":"00000000-0000-0000-0000-000000000001", "key":11111111, "city":"Shijiazhuang", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000002", "key":22222222, "city":"Zhengzhou", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000003", "key":33333333, "city":"Jinan", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000004", "key":44444444, "city":"Taiyuan", "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_INT_KEY_TYPE_TABLE", "table_content": [ - "1\t101\tChina\t1\t0", - "2\t102\tAmerica\t1\t0", - "3\t103\tRussia\t1\t0", - "4\t104\tJapan\t1\t0" + { "uuid":"00000000-0000-0000-0000-000000000001", "key":101, "city":"China", "is_valid":1}, + { "uuid":"00000000-0000-0000-0000-000000000002", "key":102, "city":"America", "is_valid":1}, + { "uuid":"00000000-0000-0000-0000-000000000003", "key":103, "city":"Russia", "is_valid":1}, + { "uuid":"00000000-0000-0000-0000-000000000004", "key":104, "city":"Japan", "is_valid":1} ] }, { "table_name": "TEST_PLUGIN_IP_KEY_TYPE_TABLE", "table_content": [ - "4\t100.64.1.1\tXiZang\t1\t0", - "4\t100.64.1.2\tXinJiang\t1\t0", - "6\t2001:da8:205:1::101\tGuiZhou\t1\t0", - "6\t1001:da8:205:1::101\tSiChuan\t1\t0", - "7\t100.64.1.3\tQingHai\t1\t0", - "6\t100.64.1.4\tGanSu\t1\t0" + {"uuid":"00000000-0000-0000-0000-000000000001", "key":"100.64.1.1", "addr_type":4, "city":"XiZang", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000002", "key":"100.64.1.2", "addr_type":4, "city":"XinJiang", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000003", "key":"2001:da8:205:1::101", "addr_type":6, "city":"GuiZhou", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000004", "key":"1001:da8:205:1::101", "addr_type":6, "city":"SiChuan", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000005", "key":"100.64.1.3", "addr_type":7, "city":"QingHai", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000006", "key":"100.64.1.4", "addr_type":6, "city":"GanSu", "is_valid":1} + ] + }, + { + "table_name": "TEST_IP_PLUGIN_WITH_EXDATA", + "table_content": [ + {"uuid":"00000000-0000-0000-0000-000000000101", "ip":"192.168.30.99-192.168.30.101", "buffer":"Something-like-json", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000102", "ip":"192.168.30.90-192.168.30.128", "buffer":"Bigger-range-should-in-the-back", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000103", "ip":"2001:db8:1234::-2001:db8:1235::", "buffer":"Bigger-range-should-in-the-back", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000104", "ip":"2001:db8:1234::1-2001:db8:1234::5210", "buffer":"Something-like-json", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000105", "ip":"2620:100:3000::-2620:0100:30ff:ffff:ffff:ffff:ffff:ffff", "buffer":"Bugreport-liumengyan-20210517", "is_valid":1} + ] + }, + { + "table_name": "TEST_IPPORT_PLUGIN_WITH_EXDATA", + "table_content": [ + {"uuid":"00000000-0000-0000-0000-000000000101", "ip":"192.168.100.1", "port":"0-255", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000102", "ip":"192.168.100.2", "port":"100-200", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000103", "ip":"192.168.100.1", "port":"255-300", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000104", "ip":"2001:db8:1234::5210", "port":"255-512", "is_valid":1} + ] + }, + { + "table_name": "TEST_FQDN_PLUGIN_WITH_EXDATA", + "table_content": [ + {"uuid":"00000000-0000-0000-0000-000000000201", "fqdn":"www.example1.com", "buffer":"catid=1", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000202", "fqdn":"*.example1.com", "buffer":"catid=1", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000203", "fqdn":"news.example1.com", "buffer":"catid=2", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000204", "fqdn":"r3---sn-i3belne6.example2.com", "buffer":"catid=3", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000205", "fqdn":"r3---sn-i3belne6.example2.com", "buffer":"catid=3", "is_valid":1} + ] + }, + { + "table_name": "TEST_BOOL_PLUGIN_WITH_EXDATA", + "table_content": [ + {"uuid":"00000000-0000-0000-0000-000000000301", "bool_expr":"1&2&1000", "buffer":"tunnel1", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000302", "bool_expr":"101&102", "buffer":"tunnel2", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000303", "bool_expr":"102", "buffer":"tunnel3", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000304", "bool_expr":"101", "buffer":"tunnel4", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000305", "bool_expr":"0&1&2&3&4&5&6&7", "buffer":"tunnel5", "is_valid":1}, + {"uuid":"00000000-0000-0000-0000-000000000306", "bool_expr":"101&101", "buffer":"invalid", "is_valid":1} + ] + }, + { + "table_name": "TEST_EFFECTIVE_RANGE_TABLE", + "table_content": [ + {"uuid":"00000000-0000-0000-0000-000000000001", "status":"SUCCESS", "entry_id":99, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里"]},{"tag":"isp","value":["电信","移动"]}]]} }, + {"uuid":"00000000-0000-0000-0000-000000000002", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":0}, + {"uuid":"00000000-0000-0000-0000-000000000003", "status":"FAILED", "entry_id":11, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京/朝阳/华严北里","上海/浦东/陆家嘴"]},{"tag":"isp","value":["电信","联通"]}], [{"tag":"location","value":["北京"]},{"tag":"isp","value":["联通"]}]]} }, + {"uuid":"00000000-0000-0000-0000-000000000004", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{} }, + {"uuid":"00000000-0000-0000-0000-000000000005", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"location","value":["北京"]}]]} }, + {"uuid":"00000000-0000-0000-0000-000000000006", "status":"SUCCESS", "entry_id":66, "is_valid":1, "effective_range":{"tag_sets":[[{"tag":"weather","value":["hot"]}]]} } + ] + }, + { + "table_name": "IR_INTERCEPT_IP", + "table_content": [ + { "uuid":"00000000-0000-0000-0000-001000000130", "is_valid":1, "effective_range":{}}, + { "uuid":"00000000-0000-0000-0000-000000000161", "is_valid":1, "effective_range":0} ] } ] diff --git a/test/table_info.json b/test/table_info.json index efd2307..b11b136 100644 --- a/test/table_info.json +++ b/test/table_info.json @@ -42,8 +42,7 @@ "schema_tag": "{\"rule_plugin\": \"plugin\"}", "custom": { "gc_timeout_s":3, - "key_type":"integer", - "key_len":8, + "key_type":"pointer", "key_name": "uuid" } }, @@ -54,9 +53,8 @@ "table_type":"plugin", "custom": { "gc_timeout_s":3, - "key_type":"integer", - "key_len":8, - "key_name":"TODO" + "key_type":"pointer", + "key_name":"uuid" } }, { @@ -89,11 +87,15 @@ "table_type":"plugin", "custom": { "gc_timeout_s":3, - "key_type":"integer", - "key_len":8, - "key_name":"TODO" + "key_type":"pointer", + "key_name":"uuid" } }, + { + "table_id":15, + "table_name":"HTTP_SIGNATURE", + "table_type":"expr" + }, { "table_id":16, "table_name":"IMAGE_FP", @@ -105,9 +107,8 @@ "table_type":"plugin", "custom": { "gc_timeout_s":3, - "key_type":"integer", - "key_len":8, - "key_name":"TODO" + "key_type":"pointer", + "key_name":"uuid" } }, { @@ -128,7 +129,7 @@ "custom": { "gc_timeout_s":3, "key_type":"pointer", - "key_name":"TODO" + "key_name":"key" } }, { @@ -138,7 +139,7 @@ "custom": { "gc_timeout_s":3, "key_type":"pointer", - "key_name":"TODO" + "key_name":"uuid" } }, { @@ -163,7 +164,7 @@ "table_type":"ip_plugin", "custom": { "gc_timeout_s": 3, - "key_name":"TODO" + "key_name":"uuid" } }, { @@ -182,7 +183,7 @@ "table_type":"fqdn_plugin", "custom": { "gc_timeout_s": 3, - "key_name":"TODO" + "key_name":"uuid" } }, { @@ -206,7 +207,7 @@ "table_type":"bool_plugin", "custom": { "gc_timeout_s": 3, - "key_name":"TODO" + "key_name":"uuid" } }, { @@ -222,7 +223,7 @@ "gc_timeout_s":3, "key_type":"integer", "key_len":8, - "key_name":"TODO" + "key_name":"key" } }, { @@ -233,7 +234,7 @@ "gc_timeout_s":3, "key_type":"integer", "key_len":4, - "key_name":"TODO" + "key_name":"key" } }, { @@ -243,7 +244,7 @@ "custom": { "gc_timeout_s":3, "key_type":"ip_addr", - "key_name":"TODO" + "key_name":"key" } }, { @@ -277,7 +278,7 @@ "table_type":"ipport_plugin", "custom": { "gc_timeout_s": 3, - "key_name":"TODO" + "key_name":"uuid" } }, { diff --git a/test/test_utils.cpp b/test/test_utils.cpp index dbe563d..9cfd17a 100644 --- a/test/test_utils.cpp +++ b/test/test_utils.cpp @@ -37,6 +37,11 @@ make_serial_rule(const char *table_name, const char *line, void *u_para, enum ma return -1; } cJSON *rule_uuid = cJSON_GetObjectItem(json, "uuid"); + + if (NULL == rule_uuid) { + rule_uuid = cJSON_GetObjectItem(json, "object_uuid");//for object2object table + } + if (NULL == rule_uuid || rule_uuid->type != cJSON_String) { return -1; }