diff --git a/test/maat_json.json b/test/maat_json.json index a13ec5f..c53863a 100644 --- a/test/maat_json.json +++ b/test/maat_json.json @@ -685,6 +685,31 @@ "group_name": "IP_group" } ] + }, + { + "compile_id": 146, + "service": 1, + "action": 1, + "do_blacklist": 1, + "do_log": 1, + "user_region": "anything", + "is_valid": "yes", + "groups": [ + { + "regions": [ + { + "table_name": "HTTP_URL", + "table_type": "string", + "table_content": { + "keywords": "Cookie:\\s&head", + "expr_type": "regex", + "match_method": "sub", + "format": "uncase plain" + } + } + ] + } + ] } ], "plugin_table": [ diff --git a/test/test_maatframe.cpp b/test/test_maatframe.cpp index 1e13b58..cd09862 100644 --- a/test/test_maatframe.cpp +++ b/test/test_maatframe.cpp @@ -212,6 +212,7 @@ TEST(PluginTable, Callback) g_logger); } + TEST(StringScan, Full) { int ret=0; @@ -230,6 +231,25 @@ TEST(StringScan, Full) EXPECT_GE(ret, 1); Maat_clean_status(&mid); } +TEST(StringScan, Regex) +{ + int ret=0; + int table_id=0; + struct Maat_rule_t result[4]; + int found_pos[4]; + const char* table_name="HTTP_URL"; + scan_status_t mid=NULL; + const char* scan_data="Cookie: Txa123aheadBCAxd"; + table_id=Maat_table_register(g_feather,table_name); + ASSERT_GT(table_id, 0); + + ret=Maat_full_scan_string(g_feather, table_id,CHARSET_GBK, scan_data, strlen(scan_data), + result,found_pos, 4, &mid, 0); + + EXPECT_GE(ret, 1); + EXPECT_EQ(result[0].config_id, 146); + Maat_clean_status(&mid); +} TEST(IPScan, IPv4) {