gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH]patch for physical NOT clause

Browse Source
This commit is contained in:
liuwentan
2023-10-24 21:19:33 +08:00
parent d24d6c1a5f
commit edab9520bd
16 changed files with 189 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/inc_internal/maat_compile.h
View File

@@ -104,7 +104,7 @@ void maat_compile_state_reset(struct maat_compile_state *compile_state);
void maat_compile_state_free(struct maat_compile_state *compile_state,
struct maat *maat_instance, int thread_id);
int maat_compile_state_update(int phy_table_id, int vtable_id, struct maat_item *hit_items,
int maat_compile_state_update(int vtable_id, struct maat_item *hit_items,
size_t n_hit_item, struct maat_state *state);
size_t maat_compile_state_get_internal_hit_paths(struct maat_compile_state *compile_state,

5
src/inc_internal/maat_expr.h
View File

@@ -50,13 +50,12 @@ long long expr_runtime_get_version(void *expr_runtime);
* @retval the num of hit group_id
*/
int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id, const char *data,
size_t data_len, int phy_table_id, int vtable_id, struct maat_state *state);
size_t data_len, int vtable_id, struct maat_state *state);
struct expr_matcher_stream *expr_runtime_stream_open(struct expr_runtime *expr_rt, int thread_id);
int expr_runtime_stream_scan(struct expr_runtime *expr_rt, struct expr_matcher_stream *s_handle,
const char *data, size_t data_len, int phy_table_id, int vtable_id,
struct maat_state *state);
const char *data, size_t data_len, int vtable_id, struct maat_state *state);
void expr_runtime_stream_close(struct expr_runtime *expr_rt, int thread_id,
struct expr_matcher_stream *stream);

2
src/inc_internal/maat_flag.h
View File

@@ -48,7 +48,7 @@ long long flag_runtime_rule_count(void *flag_runtime);
* @retval the num of hit group_id
*/
int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id, long long flag,
int phy_table_id, int vtable_id, struct maat_state *state);
int vtable_id, struct maat_state *state);
int flag_runtime_set_scan_district(struct flag_runtime *flag_rt, const char *district,
size_t district_len, long long *district_id);

3
src/inc_internal/maat_interval.h
View File

@@ -47,8 +47,7 @@ long long interval_runtime_rule_count(void *interval_runtime);
* @retval the num of hit group_id
*/
int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id,
long long integer, int phy_table_id, int vtable_id,
struct maat_state *state);
long long integer, int vtable_id, struct maat_state *state);
int interval_runtime_set_scan_district(struct interval_runtime *interval_rt, const char *district,
size_t district_len, long long *district_id);

2
src/inc_internal/maat_ip.h
View File

@@ -42,7 +42,7 @@ long long ip_runtime_ipv6_rule_count(void *ip_runtime);
/* ip runtime scan API */
int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type,
uint8_t *ip_addr, uint16_t port, int proto, int phy_table_id,
uint8_t *ip_addr, uint16_t port, int proto,
int vtable_id, struct maat_state *state);
void ip_runtime_hit_inc(struct ip_runtime *ip_rt, int thread_id);

27
src/maat_api.c
View File

@@ -1043,7 +1043,7 @@ static int flag_scan(struct table_manager *tbl_mgr, int thread_id, long long fla
}
int group_hit_cnt = flag_runtime_scan((struct flag_runtime *)flag_rt, thread_id,
flag, phy_table_id, vtable_id, state);
flag, vtable_id, state);
if (group_hit_cnt <= 0) {
return group_hit_cnt;
}
@@ -1073,8 +1073,7 @@ static int interval_scan(struct table_manager *tbl_mgr, int thread_id, long long
}
int group_hit_cnt = interval_runtime_scan((struct interval_runtime *)interval_rt,
thread_id, integer, phy_table_id,
vtable_id, state);
thread_id, integer, vtable_id, state);
if (group_hit_cnt <= 0) {
return group_hit_cnt;
}
@@ -1100,8 +1099,7 @@ static int ipv4_scan(struct table_manager *tbl_mgr, int thread_id, uint32_t ip_a
}
int group_hit_cnt = ip_runtime_scan((struct ip_runtime *)ip_rt, thread_id, IPv4,
(uint8_t *)&ip_addr, port, proto, phy_table_id,
vtable_id, state);
(uint8_t *)&ip_addr, port, proto, vtable_id, state);
if (group_hit_cnt <= 0) {
return group_hit_cnt;
}
@@ -1127,8 +1125,7 @@ static int ipv6_scan(struct table_manager *tbl_mgr, int thread_id,
}
int group_hit_cnt = ip_runtime_scan((struct ip_runtime *)ip_rt, thread_id, IPv6,
ip_addr, port, proto, phy_table_id, vtable_id,
state);
ip_addr, port, proto, vtable_id, state);
if (group_hit_cnt <= 0) {
return group_hit_cnt;
}
@@ -1159,7 +1156,7 @@ static int string_scan(struct table_manager *tbl_mgr, int thread_id,
int group_hit_cnt = expr_runtime_scan((struct expr_runtime *)expr_rt,
thread_id, data, data_len,
phy_table_id, vtable_id, state);
vtable_id, state);
if (group_hit_cnt <= 0) {
return group_hit_cnt;
}
@@ -1195,8 +1192,7 @@ static int expr_stream_scan(struct maat_stream *stream, const char *data,
int group_hit_cnt = expr_runtime_stream_scan((struct expr_runtime *)expr_rt,
stream->handle, data, data_len,
stream->phy_table_id, stream->vtable_id,
state);
stream->vtable_id, state);
if (group_hit_cnt <= 0) {
return group_hit_cnt;
}
@@ -1247,7 +1243,7 @@ int maat_scan_flag(struct maat *maat_inst, int table_id,
return MAAT_SCAN_OK;
}
int vtable_id = 0;
int vtable_id = table_id;
int phy_table_id = table_id;
enum table_type table_type = TABLE_TYPE_INVALID;
@@ -1331,7 +1327,7 @@ int maat_scan_integer(struct maat *maat_inst, int table_id,
return MAAT_SCAN_OK;
}
int vtable_id = 0;
int vtable_id = table_id;
int phy_table_id = table_id;
enum table_type table_type = TABLE_TYPE_INVALID;
@@ -1415,7 +1411,7 @@ int maat_scan_ipv4(struct maat *maat_inst, int table_id, uint32_t ip_addr,
return MAAT_SCAN_OK;
}
int vtable_id = 0;
int vtable_id = table_id;
int phy_table_id = table_id;
enum table_type table_type = TABLE_TYPE_INVALID;
@@ -1500,7 +1496,7 @@ int maat_scan_ipv6(struct maat *maat_inst, int table_id,
return MAAT_SCAN_OK;
}
int vtable_id = 0;
int vtable_id = table_id;
int phy_table_id = table_id;
enum table_type table_type = TABLE_TYPE_INVALID;
@@ -1584,7 +1580,7 @@ int maat_scan_string(struct maat *maat_inst, int table_id, const char *data,
return MAAT_SCAN_OK;
}
int vtable_id = 0;
int vtable_id = table_id;
int phy_table_id = table_id;
enum table_type table_type = TABLE_TYPE_INVALID;
@@ -1659,6 +1655,7 @@ struct maat_stream *maat_stream_new(struct maat *maat_inst, int table_id,
stream->last_full_version = maat_inst->last_full_version;
stream->thread_id = state->thread_id;
stream->phy_table_id = table_id;
stream->vtable_id = table_id;
stream->logger = maat_inst->logger;
enum table_type table_type = TABLE_TYPE_INVALID;

6
src/maat_compile.c
View File

@@ -2243,7 +2243,7 @@ int compile_runtime_match(struct compile_runtime *compile_rt, long long *compile
return MIN(bool_match_ret, compile_ids_size);
}
int maat_compile_state_update(int phy_table_id, int vtable_id, struct maat_item *hit_items,
int maat_compile_state_update(int vtable_id, struct maat_item *hit_items,
size_t n_hit_item, struct maat_state *state)
{
size_t i = 0, j = 0;
@@ -2307,10 +2307,6 @@ int maat_compile_state_update(int phy_table_id, int vtable_id, struct maat_item
hit_group_ids[i], vtable_id);
}
if (vtable_id == 0) {
vtable_id = phy_table_id;
}
long long hit_NOT_group_ids[VTABLE_MAX_NOT_GROUP_NUM];
size_t hit_not_cnt = maat_compile_state_update_hit_not_clauses(state->compile_state, compile_rt,
hit_group_ids, hit_cnt, vtable_id,

9
src/maat_expr.c
View File

@@ -955,7 +955,7 @@ long long expr_runtime_get_version(void *expr_runtime)
}
int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id,
const char *data, size_t data_len, int phy_table_id,
const char *data, size_t data_len,
int vtable_id, struct maat_state *state)
{
if (0 == expr_rt->rule_num) {
@@ -1002,7 +1002,7 @@ int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id,
}
next:
return maat_compile_state_update(phy_table_id, vtable_id, hit_maat_items, real_hit_item_cnt, state);
return maat_compile_state_update(vtable_id, hit_maat_items, real_hit_item_cnt, state);
}
struct expr_matcher_stream *
@@ -1024,8 +1024,7 @@ expr_runtime_stream_open(struct expr_runtime *expr_rt, int thread_id)
int expr_runtime_stream_scan(struct expr_runtime *expr_rt,
struct expr_matcher_stream *s_handle,
const char *data, size_t data_len,
int phy_table_id, int vtable_id,
struct maat_state *state)
int vtable_id, struct maat_state *state)
{
if (0 == expr_rt->rule_num) {
//empty expr table
@@ -1065,7 +1064,7 @@ int expr_runtime_stream_scan(struct expr_runtime *expr_rt,
}
next:
return maat_compile_state_update(phy_table_id, vtable_id, hit_maat_items, real_hit_item_cnt, state);
return maat_compile_state_update(vtable_id, hit_maat_items, real_hit_item_cnt, state);
}
void expr_runtime_stream_close(struct expr_runtime *expr_rt, int thread_id,

5
src/maat_flag.c
View File

@@ -544,8 +544,7 @@ long long flag_runtime_rule_count(void *flag_runtime)
}
int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id,
long long flag, int phy_table_id, int vtable_id,
struct maat_state *state)
long long flag, int vtable_id, struct maat_state *state)
{
if (0 == flag_rt->rule_num) {
//empty flag table
@@ -589,7 +588,7 @@ int flag_runtime_scan(struct flag_runtime *flag_rt, int thread_id,
}
next:
return maat_compile_state_update(phy_table_id, vtable_id, hit_maat_items, real_hit_item_cnt, state);
return maat_compile_state_update(vtable_id, hit_maat_items, real_hit_item_cnt, state);
}
void flag_runtime_hit_inc(struct flag_runtime *flag_rt, int thread_id)

5
src/maat_interval.c
View File

@@ -545,8 +545,7 @@ long long interval_runtime_rule_count(void *interval_runtime)
}
int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id,
long long integer, int phy_table_id, int vtable_id,
struct maat_state *state)
long long integer, int vtable_id, struct maat_state *state)
{
if (0 == interval_rt->rule_num) {
//empty interval table
@@ -590,7 +589,7 @@ int interval_runtime_scan(struct interval_runtime *interval_rt, int thread_id,
}
next:
return maat_compile_state_update(phy_table_id, vtable_id, hit_maat_items, real_hit_item_cnt, state);
return maat_compile_state_update(vtable_id, hit_maat_items, real_hit_item_cnt, state);
}
void interval_runtime_hit_inc(struct interval_runtime *interval_rt, int thread_id)

4
src/maat_ip.c
View File

@@ -700,7 +700,7 @@ static int validate_port_proto(struct ip_item *item, uint16_t port, int proto)
}
int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type,
uint8_t *ip_addr, uint16_t port, int proto, int phy_table_id,
uint8_t *ip_addr, uint16_t port, int proto,
int vtable_id, struct maat_state *state)
{
if (0 == ip_rt->rule_num) {
@@ -761,7 +761,7 @@ int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type,
}
next:
return maat_compile_state_update(phy_table_id, vtable_id, hit_maat_items, real_hit_item_cnt, state);
return maat_compile_state_update(vtable_id, hit_maat_items, real_hit_item_cnt, state);
}
void ip_runtime_hit_inc(struct ip_runtime *ip_rt, int thread_id)

1
test/json_update/new.json
View File

@@ -13,6 +13,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",

1
test/json_update/old.json
View File

@@ -14,6 +14,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",

143
test/maat_framework_gtest.cpp
View File

@@ -317,7 +317,7 @@ int test_add_expr_command(struct maat *maat_inst, const char *expr_table,
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, "GROUP2COMPILE", MAAT_OP_ADD,
group_id, compile_id, 0, "null", 1, timeout);
group_id, compile_id, 0, expr_table, 1, timeout);
EXPECT_EQ(ret, 1);
long long item_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -1073,6 +1073,7 @@ TEST_F(MaatHsStringScan, HexBinCaseSensitive) {
EXPECT_EQ(n_hit_result, 2);
EXPECT_EQ(results[0], 206);
EXPECT_EQ(results[1], 191);
maat_state_free(state);
}
@@ -1369,7 +1370,7 @@ TEST_F(MaatHsStringScan, dynamic_config) {
/* group2compile table add line */
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* expr table add line */
@@ -1397,7 +1398,7 @@ TEST_F(MaatHsStringScan, dynamic_config) {
/* group2compile table del line */
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* compile table del line */
@@ -2101,7 +2102,7 @@ TEST_F(MaatRsStringScan, dynamic_config) {
/* group2compile table add line */
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* expr table add line */
@@ -2130,12 +2131,12 @@ TEST_F(MaatRsStringScan, dynamic_config) {
/* group2compile table del line */
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* compile table del line */
ret = compile_table_set_line(maat_inst, compile_table_name, MAAT_OP_DEL,
compile_id, "null", 1, 0);
compile_id, table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S * 2);
@@ -2682,7 +2683,7 @@ TEST_F(MaatIPScan, dynamic_config) {
/* group2compile table add line */
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* ip table add line */
@@ -2709,7 +2710,7 @@ TEST_F(MaatIPScan, dynamic_config) {
/* group2compile table del line */
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* compile table del line */
@@ -3754,42 +3755,6 @@ TEST_F(ExcludeLogic, ExcludeInDifferentLevel) {
maat_state_free(state);
}
TEST_F(ExcludeLogic, ScanNotIP) {
const char *string_should_hit = "This string ONLY contains must-contained-string-of-rule-201.";
long long results[ARRAY_SIZE] = {0};
size_t n_hit_result = 0;
int thread_id = 0;
const char *hit_table_name = "HTTP_URL";
const char *not_hit_table_name = "IP_CONFIG";
struct maat *maat_inst = ExcludeLogic::_shared_maat_inst;
struct maat_state *state = maat_state_new(maat_inst, thread_id);
int hit_table_id = maat_get_table_id(maat_inst, hit_table_name);
ASSERT_GT(hit_table_id, 0);
int ret = maat_scan_string(maat_inst, hit_table_id, string_should_hit,
strlen(string_should_hit), results, ARRAY_SIZE,
&n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_HIT);
EXPECT_EQ(n_hit_result, 1);
EXPECT_EQ(results[0], 201);
uint32_t sip;
inet_pton(AF_INET, "10.0.6.205", &sip);
uint16_t port = htons(50001);
int proto = 6;
int not_hit_table_id = maat_get_table_id(maat_inst, not_hit_table_name);
ASSERT_GT(not_hit_table_id, 0);
ret = maat_scan_ipv4(maat_inst, not_hit_table_id, sip, port, proto,
results, ARRAY_SIZE, &n_hit_result, state);
EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
maat_state_free(state);
state = NULL;
}
void maat_read_entry_start_cb(int update_type, void *u_para)
{
}
@@ -5581,7 +5546,7 @@ TEST_F(MaatCmdTest, SetIP) {
/* group2compile table add line */
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* item table add line */
@@ -5701,7 +5666,7 @@ TEST_F(MaatCmdTest, SetExpr8) {
/* group2compile table add line */
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group_id, compile_id, 0, "null", 1, 0);
group_id, compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
/* EXPR_TYPE_AND MATCH_METHOD_SUB */
@@ -5910,12 +5875,12 @@ TEST_F(MaatCmdTest, SubGroup) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 1, 0);
group1_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
//group1 -> compile2
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile2_id, 0, "null", 1, 0);
group1_id, compile2_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
//group2 -> group1 -> compile1
@@ -5949,7 +5914,7 @@ TEST_F(MaatCmdTest, SubGroup) {
\_ X -> compile2
*/
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group1_id, compile2_id, 0, "null", 1, 0);
group1_id, compile2_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S);
@@ -5965,14 +5930,14 @@ TEST_F(MaatCmdTest, SubGroup) {
\_ -> compile2
*/
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group1_id, compile1_id, 0, "null", 1, 0);
group1_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
ret = compile_table_set_line(maat_inst, compile_table_name, MAAT_OP_DEL,
compile1_id, "null", 1, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile2_id, 0, "null", 1, 0);
group2_id, compile2_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(2);
@@ -6011,14 +5976,14 @@ TEST_F(MaatCmdTest, SubGroup) {
compile1_id, "null", 1, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 1, 0);
group1_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
ret = compile_table_set_line(maat_inst, compile_table_name, MAAT_OP_DEL,
compile1_id, "null", 1, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group1_id, compile1_id, 0, "null", 1, 0);
group1_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(2);
@@ -6054,7 +6019,7 @@ TEST_F(MaatCmdTest, RefGroup) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 1, 0);
group1_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -6074,7 +6039,7 @@ TEST_F(MaatCmdTest, RefGroup) {
*/
long long group2_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile1_id, 0, "null", 1, 0);
group2_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item2_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -6089,10 +6054,10 @@ TEST_F(MaatCmdTest, RefGroup) {
compile1_id, "null", 1, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group1_id, compile1_id, 0, "null", 1, 0);
group1_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile1_id, 0, "null", 1, 0);
group2_id, compile1_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
//TODO value=1 MAAT_OPT_ENABLE_UPDATE
@@ -6935,11 +6900,11 @@ TEST_F(MaatCmdTest, GroupInMassCompiles) {
for (i = 0; i < COMPILE_ID_NUMS; i++) {
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile_id[i], 0, "null", 0, 0);
group1_id, compile_id[i], 0, table_url, 0, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group3_id, compile_id[i], 0, "null", 2, 0);
group3_id, compile_id[i], 0, table_appid, 2, 0);
EXPECT_EQ(ret, 1);
}
@@ -6952,10 +6917,10 @@ TEST_F(MaatCmdTest, GroupInMassCompiles) {
target_compile_id, "null", 2, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, target_compile_id, 0, "null", 1, 0);
group2_id, target_compile_id, 0, table_url, 1, 0);
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group3_id, target_compile_id, 0, "null", 2, 0);
group3_id, target_compile_id, 0, table_appid, 2, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S * 2);
@@ -7202,11 +7167,11 @@ TEST_F(MaatCmdTest, HitGroup) {
EXPECT_EQ(hit_groups[0].item_id, item4_id);
EXPECT_EQ(hit_groups[0].group_id, group4_id);
EXPECT_EQ(hit_groups[0].vtable_id, 0); //physical table(keywords_table) vtable_id is 0
EXPECT_EQ(hit_groups[0].vtable_id, keywords_table_id); //physical table(keywords_table) vtable_id is 0
EXPECT_EQ(hit_groups[1].item_id, item3_id);
EXPECT_EQ(hit_groups[1].group_id, group3_id);
EXPECT_EQ(hit_groups[1].vtable_id, 0);
EXPECT_EQ(hit_groups[1].vtable_id, ip_table_id);
ret = maat_stream_scan(stream, keywords2, strlen(keywords2), results,
ARRAY_SIZE, &n_hit_result, state);
@@ -7222,7 +7187,7 @@ TEST_F(MaatCmdTest, HitGroup) {
EXPECT_EQ(hit_groups[0].item_id, item5_id);
EXPECT_EQ(hit_groups[0].group_id, group1_id);
EXPECT_EQ(hit_groups[0].vtable_id, 0); //physical table(keywords_table) vtable_id is 0
EXPECT_EQ(hit_groups[0].vtable_id, keywords_table_id); //physical table(keywords_table) vtable_id is 0
maat_stream_free(stream);
maat_state_free(state);
@@ -7445,7 +7410,7 @@ that the edges be all directed in the same direction.";
EXPECT_EQ(hit_path[path_idx].item_id, item4_id);
EXPECT_EQ(hit_path[path_idx].sub_group_id, group4_id);
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
EXPECT_EQ(hit_path[path_idx].vtable_id, 0);
EXPECT_EQ(hit_path[path_idx].vtable_id, keywords_table_id);
EXPECT_EQ(hit_path[path_idx].compile_id, -1);
int ip_table_id = maat_get_table_id(maat_inst, ip_table_name);
@@ -7470,7 +7435,7 @@ that the edges be all directed in the same direction.";
EXPECT_EQ(hit_path[path_idx].item_id, item3_id);
EXPECT_EQ(hit_path[path_idx].sub_group_id, group3_id);
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
EXPECT_EQ(hit_path[path_idx].vtable_id, 0);
EXPECT_EQ(hit_path[path_idx].vtable_id, ip_table_id);
EXPECT_EQ(hit_path[path_idx].compile_id, -1);
Nth_scan++;
@@ -7489,7 +7454,7 @@ that the edges be all directed in the same direction.";
EXPECT_EQ(hit_path[path_idx].item_id, item4_id);
EXPECT_EQ(hit_path[path_idx].sub_group_id, group4_id);
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
EXPECT_EQ(hit_path[path_idx].vtable_id, 0);
EXPECT_EQ(hit_path[path_idx].vtable_id, keywords_table_id);
EXPECT_EQ(hit_path[path_idx].compile_id, -1);
maat_stream_free(stream);
maat_state_free(state);
@@ -7713,7 +7678,7 @@ TEST_F(MaatCmdTest, HitPathHasNotGroup) {
EXPECT_EQ(hit_path[path_idx].item_id, item4_id);
EXPECT_EQ(hit_path[path_idx].sub_group_id, group4_id);
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
EXPECT_EQ(hit_path[path_idx].vtable_id, 0);
EXPECT_EQ(hit_path[path_idx].vtable_id, keywords_table_id);
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
EXPECT_EQ(hit_path[path_idx].compile_id, -1);
@@ -7739,7 +7704,7 @@ TEST_F(MaatCmdTest, HitPathHasNotGroup) {
EXPECT_EQ(hit_path[path_idx].item_id, item3_id);
EXPECT_EQ(hit_path[path_idx].sub_group_id, group3_id);
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
EXPECT_EQ(hit_path[path_idx].vtable_id, 0);
EXPECT_EQ(hit_path[path_idx].vtable_id, ip_table_id);
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
EXPECT_EQ(hit_path[path_idx].compile_id, -1);
@@ -7759,7 +7724,7 @@ TEST_F(MaatCmdTest, HitPathHasNotGroup) {
EXPECT_EQ(hit_path[path_idx].item_id, item4_id);
EXPECT_EQ(hit_path[path_idx].sub_group_id, group4_id);
EXPECT_EQ(hit_path[path_idx].top_group_id, -1);
EXPECT_EQ(hit_path[path_idx].vtable_id, 0);
EXPECT_EQ(hit_path[path_idx].vtable_id, keywords_table_id);
EXPECT_EQ(hit_path[path_idx].NOT_flag, 0);
EXPECT_EQ(hit_path[path_idx].compile_id, -1);
@@ -7885,7 +7850,7 @@ TEST_F(MaatCmdTest, SameScanStatusWhenClauseUpdate_TSG6419) {
*/
long long group11_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group11_id, compile1_id, 0, "null", 1, 0);
group11_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item11_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -7896,7 +7861,7 @@ TEST_F(MaatCmdTest, SameScanStatusWhenClauseUpdate_TSG6419) {
long long group21_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group21_id, compile1_id, 0, "null", 2, 0);
group21_id, compile1_id, 0, app_id_table_name, 2, 0);
EXPECT_EQ(ret, 1);
long long item21_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -7936,7 +7901,7 @@ TEST_F(MaatCmdTest, SameScanStatusWhenClauseUpdate_TSG6419) {
long long group22_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group22_id, compile1_id, 0, "null", 3, 0);
group22_id, compile1_id, 0, app_id_table_name, 3, 0);
EXPECT_EQ(ret, 1);
long long item22_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -7980,7 +7945,7 @@ TEST_F(MaatCmdTest, GroupEdit) {
*/
long long group11_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group11_id, compile1_id, 0, "null", 1, 0);
group11_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item11_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -7991,7 +7956,7 @@ TEST_F(MaatCmdTest, GroupEdit) {
long long group21_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group21_id, compile1_id, 0, "null", 2, 0);
group21_id, compile1_id, 0, app_id_table_name, 2, 0);
EXPECT_EQ(ret, 1);
long long item21_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -8100,7 +8065,7 @@ TEST_F(MaatCmdTest, CompileDelete_TSG6548) {
//item11 -> group11 -> clause1 -> compile1
long long group11_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group11_id, compile1_id, 0, "null", 1, 0);
group11_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item11_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -8132,7 +8097,7 @@ TEST_F(MaatCmdTest, CompileDelete_TSG6548) {
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_DEL,
group11_id, compile1_id, 0, "null", 1, 0);
group11_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
int hit_cnt = 0;
@@ -8173,7 +8138,7 @@ TEST_F(MaatCmdTest, UpdateDeadLockDetection) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, table_http_url, 0, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -8207,7 +8172,7 @@ TEST_F(MaatCmdTest, UpdateDeadLockDetection) {
//group2 -> compile2
long long group2_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile2_id, 0, "null", 0, 0);
group2_id, compile2_id, 0, table_http_url, 0, 0);
EXPECT_EQ(ret, 1);
//item2 -> group2 -> compile2
@@ -8249,7 +8214,7 @@ TEST_F(MaatCmdTest, StreamScanWhenExprTableIncUpdate) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, scan_table_name, 0, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S);
@@ -8312,7 +8277,7 @@ TEST_F(MaatCmdTest, StreamScanSegfaultWhenVersionRollBack_TSG6324) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, scan_table_name, 0, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -8372,7 +8337,7 @@ TEST_F(MaatCmdTest, IPAndStreamScanWhenIncUpdate) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, expr_table_name, 0, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -8393,7 +8358,7 @@ TEST_F(MaatCmdTest, IPAndStreamScanWhenIncUpdate) {
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile1_id, 0, "null", 1, 0);
group2_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S * 2);
@@ -8465,7 +8430,7 @@ TEST_F(MaatCmdTest, IPAndStreamScanWhenFullUpdate) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, expr_table_name, 0, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -8487,7 +8452,7 @@ TEST_F(MaatCmdTest, IPAndStreamScanWhenFullUpdate) {
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile1_id, 0, "null", 1, 0);
group2_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S * 2);
@@ -8558,7 +8523,7 @@ TEST_F(MaatCmdTest, IPAndStringScanWhenIncUpdate) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, expr_table_name, 0, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -8579,7 +8544,7 @@ TEST_F(MaatCmdTest, IPAndStringScanWhenIncUpdate) {
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile1_id, 0, "null", 1, 0);
group2_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S * 2);
@@ -8650,7 +8615,7 @@ TEST_F(MaatCmdTest, IPAndStringScanWhenFullupdate) {
//group1 -> compile1
long long group1_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group1_id, compile1_id, 0, "null", 0, 0);
group1_id, compile1_id, 0, expr_table_name, 0, 0);
EXPECT_EQ(ret, 1);
//item1 -> group1 -> compile1
@@ -8671,7 +8636,7 @@ TEST_F(MaatCmdTest, IPAndStringScanWhenFullupdate) {
EXPECT_EQ(ret, 1);
ret = group2compile_table_set_line(maat_inst, g2c_table_name, MAAT_OP_ADD,
group2_id, compile1_id, 0, "null", 1, 0);
group2_id, compile1_id, 0, ip_table_name, 1, 0);
EXPECT_EQ(ret, 1);
sleep(WAIT_FOR_EFFECTIVE_S * 2);

8
test/maat_framework_perf_gtest.cpp
View File

@@ -311,7 +311,7 @@ static void test_add_expr_command(struct maat *maat_inst, const char *table_name
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, "GROUP2COMPILE", MAAT_OP_ADD, group_id,
compile_id, 0, "null", 1, 0);
compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -329,7 +329,7 @@ static void test_add_ip_command(struct maat *maat_inst, const char *table_name,
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, "GROUP2COMPILE", MAAT_OP_ADD, group_id,
compile_id, 0, "null", 1, 0);
compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -347,7 +347,7 @@ static void test_add_integer_command(struct maat *maat_inst, const char *table_n
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, "GROUP2COMPILE", MAAT_OP_ADD, group_id,
compile_id, 0, "null", 1, 0);
compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);
@@ -365,7 +365,7 @@ static void test_add_flag_command(struct maat *maat_inst, const char *table_name
long long group_id = maat_cmd_incrby(maat_inst, "SEQUENCE_GROUP", 1);
ret = group2compile_table_set_line(maat_inst, "GROUP2COMPILE", MAAT_OP_ADD, group_id,
compile_id, 0, "null", 1, 0);
compile_id, 0, table_name, 1, 0);
EXPECT_EQ(ret, 1);
long long item_id = maat_cmd_incrby(maat_inst, "SEQUENCE_REGION", 1);

149
test/maat_json.json
View File

@@ -166,6 +166,7 @@
"groups": [
{
"group_name": "123_IP_group",
"virtual_table": "IP_CONFIG",
"regions": [
{
"table_name": "IP_CONFIG",
@@ -199,6 +200,7 @@
},
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -224,10 +226,12 @@
"is_valid": "yes",
"groups": [
{
"group_name": "123_IP_group"
"group_name": "123_IP_group",
"virtual_table":"IP_CONFIG"
},
{
"group_name": "Untitled",
"virtual_table": "CONTENT_SIZE",
"regions": [
{
"table_name": "CONTENT_SIZE",
@@ -251,6 +255,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table":"HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -277,6 +282,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -292,6 +298,7 @@
},
{
"group_name": "126_interval_group",
"virtual_table": "CONTENT_SIZE",
"regions": [
{
"table_name": "CONTENT_SIZE",
@@ -316,6 +323,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_SIGNATURE",
"regions": [
{
"table_name": "HTTP_SIGNATURE",
@@ -343,6 +351,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -369,6 +378,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_name": "KEYWORDS_TABLE",
@@ -395,6 +405,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_name": "KEYWORDS_TABLE",
@@ -421,6 +432,7 @@
"groups": [
{
"group_name": "TakeMeHome",
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_name": "KEYWORDS_TABLE",
@@ -447,6 +459,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_HOST",
"regions": [
{
"table_name": "HTTP_HOST",
@@ -473,6 +486,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -499,6 +513,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "IMAGE_FP",
"regions": [
{
"table_name": "IMAGE_FP",
@@ -525,6 +540,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "IMAGE_FP",
"regions": [
{
"table_name": "IMAGE_FP",
@@ -552,6 +568,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -579,6 +596,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -605,6 +623,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_name": "KEYWORDS_TABLE",
@@ -633,6 +652,7 @@
{
"group_name": "Untitled",
"g2c_table_name": "GROUP2COMPILE_ALIAS",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -658,6 +678,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -770,6 +791,7 @@
"groups": [
{
"not_flag": 0,
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -998,6 +1020,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -1024,6 +1047,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "APP_PAYLOAD",
"regions": [
{
"table_name": "APP_PAYLOAD",
@@ -1050,6 +1074,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "TROJAN_PAYLOAD",
"regions": [
{
"table_type": "expr",
@@ -1065,6 +1090,7 @@
"group_name": "billgates_regist1"
},
{
"virtual_table": "TROJAN_PAYLOAD",
"regions": [
{
"table_type": "expr",
@@ -1091,6 +1117,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "MAIL_ADDR",
"regions": [
{
"table_type": "expr",
@@ -1117,6 +1144,8 @@
"is_valid": "yes",
"groups": [
{
"group_name": "152_mail_addr",
"virtual_table": "MAIL_ADDR",
"regions": [
{
"table_type": "expr",
@@ -1138,11 +1167,11 @@
"match_method": "prefix"
}
}
],
"group_name": "152_mail_addr"
]
},
{
"group_name": "interval_group_refered",
"virtual_table": "CONTENT_SIZE",
"sub_groups": [
{
"group_name": "126_interval_group"
@@ -1161,6 +1190,9 @@
"is_valid": "yes",
"groups": [
{
"group_name": "Untitled",
"virtual_table": "MAIL_ADDR",
"not_flag": 0,
"regions": [
{
"table_type": "expr",
@@ -1173,16 +1205,16 @@
}
}
],
"group_name": "Untitled",
"sub_groups": [
{
"group_name": "152_mail_addr"
"group_name": "152_mail_addr",
"virtual_table": "MAIL_ADDR"
}
],
"not_flag": 0
]
},
{
"group_name": "IP_group_refered",
"virtual_table": "IP_CONFIG",
"sub_groups": [
{
"group_name": "123_IP_group"
@@ -1201,6 +1233,8 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"not_flag": 0,
"regions": [
{
"table_type": "ip_plus",
@@ -1216,8 +1250,7 @@
"protocol": 6
}
}
],
"not_flag": 0
]
}
]
},
@@ -1231,6 +1264,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1262,6 +1296,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_SIGNATURE",
"regions": [
{
"table_name": "HTTP_SIGNATURE",
@@ -1288,6 +1323,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "TROJAN_PAYLOAD",
"regions": [
{
"table_type": "expr",
@@ -1313,6 +1349,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1343,6 +1380,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1378,6 +1416,7 @@
"not_flag": 0
},
{
"virtual_table": "HTTP_URL",
"not_flag": 0,
"regions": [
{
@@ -1405,6 +1444,7 @@
"groups": [
{
"group_name": "vt_grp_http_sig1",
"virtual_table": "HTTP_SIGNATURE",
"not_flag": 0,
"regions": [
{
@@ -1422,6 +1462,7 @@
},
{
"group_name": "vt_grp_http_sig2",
"virtual_table": "HTTP_SIGNATURE",
"not_flag": 0,
"regions": [
{
@@ -1503,6 +1544,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_name": "KEYWORDS_TABLE",
@@ -1530,6 +1572,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -1544,6 +1587,7 @@
]
},
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1576,6 +1620,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -1603,6 +1648,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -1630,6 +1676,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -1655,6 +1702,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1686,6 +1734,7 @@
"groups": [
{
"group_name": "ipv4_virtual.source",
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1717,6 +1766,7 @@
"groups": [
{
"group_name": "ipv4_virtual.destination",
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1769,6 +1819,7 @@
"groups": [
{
"group_name": "ipv4_composition.source",
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1800,6 +1851,7 @@
"groups": [
{
"group_name": "ipv4_composition.destination",
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1852,6 +1904,7 @@
"groups": [
{
"group_name": "ipv4_composition.session",
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -1906,7 +1959,7 @@
},
{
"group_name": "financial-department-ip",
"virtual_table": "null",
"virtual_table": "IP_CONFIG",
"not_flag": 0,
"clause_index": 0
},
@@ -1935,6 +1988,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "INTERGER_PLUS",
"regions": [
{
"table_name": "INTERGER_PLUS",
@@ -1998,6 +2052,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_name": "KEYWORDS_TABLE",
@@ -2024,6 +2079,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "CORNER_CASE_TABLE",
"regions": [
{
"table_name": "CORNER_CASE_TABLE",
@@ -2051,6 +2107,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "IP_CONFIG",
"regions": [
{
"table_name": "IP_CONFIG",
@@ -2118,6 +2175,7 @@
},
{
"not_flag": 0,
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -2163,6 +2221,7 @@
]
},
{
"virtual_table": "IP_PLUS_CONFIG",
"not_flag": 0,
"regions": [
{
@@ -2209,6 +2268,7 @@
]
},
{
"virtual_table": "IP_PLUS_CONFIG",
"not_flag": 0,
"regions": [
{
@@ -2239,6 +2299,7 @@
"user_region": "StringScan.ShouldNotHitExprPlus",
"groups": [
{
"virtual_table": "APP_PAYLOAD",
"regions": [
{
"table_name": "APP_PAYLOAD",
@@ -2267,6 +2328,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_SIGNATURE",
"regions": [
{
"table_name": "HTTP_SIGNATURE",
@@ -2293,6 +2355,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_type": "expr",
@@ -2319,6 +2382,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "FLAG_CONFIG",
"regions": [
{
"table_type": "flag",
@@ -2342,6 +2406,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "FLAG_CONFIG",
"regions": [
{
"table_type": "flag",
@@ -2354,6 +2419,7 @@
]
},
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -2379,6 +2445,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "FLAG_CONFIG",
"regions": [
{
"table_type": "flag",
@@ -2402,6 +2469,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "HTTP_SIGNATURE",
"regions": [
{
"table_name": "HTTP_SIGNATURE",
@@ -2417,6 +2485,7 @@
]
},
{
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -2442,6 +2511,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "FLAG_PLUS_CONFIG",
"regions": [
{
"table_type": "flag_plus",
@@ -2467,6 +2537,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"regions": [
{
"table_name": "HTTP_URL",
@@ -2494,6 +2565,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "HTTP_URL",
"g2c_table_name": "GROUP2COMPILE_FIREWALL",
"regions": [
{
@@ -2521,6 +2593,7 @@
"groups": [
{
"group_name": "ExcludeLogicGroup199",
"virtual_table": "HTTP_URL",
"sub_groups":[
{
"group_name": "ExcludeLogicGroup199_1",
@@ -2545,7 +2618,7 @@
"clause_index": 0,
"regions": [
{
"table_name": "KEYWORDS_TABLE",
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "must-not-contained-string-of-rule-199",
@@ -2571,9 +2644,11 @@
"groups": [
{
"group_name": "ExcludeLogicGroup200",
"virtual_table": "HTTP_URL",
"sub_groups":[
{
"group_name": "ExcludeLogicGroup200_1",
"virtual_table": "HTTP_URL",
"is_exclude": 0,
"clause_index": 0,
"regions": [
@@ -2591,6 +2666,7 @@
},
{
"group_name": "ExcludeLogicGroup200_2",
"virtual_table": "HTTP_URL",
"is_exclude": 1,
"clause_index": 0,
"regions": [
@@ -2610,44 +2686,6 @@
}
]
},
{
"compile_id": 201,
"service": 1,
"action": 1,
"do_blacklist": 1,
"do_log": 1,
"user_region": "ExcludeLogic.ScanNotIP",
"is_valid": "yes",
"groups": [
{
"group_name": "ExcludeLogicGroup201",
"sub_groups":[
{
"group_name": "ExcludeLogicGroup201_1",
"is_exclude": 0,
"clause_index": 0,
"regions": [
{
"table_name": "HTTP_URL",
"table_type": "expr",
"table_content": {
"keywords": "must-contained-string-of-rule-201",
"expr_type": "none",
"match_method": "sub",
"format": "uncase plain"
}
}
]
},
{
"group_name": "123_IP_group",
"is_exclude": 1,
"clause_index": 0
}
]
}
]
},
{
"compile_id": 202,
"service": 1,
@@ -2948,6 +2986,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_type": "expr",
@@ -2974,6 +3013,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "KEYWORDS_TABLE",
"regions": [
{
"table_type": "expr",
@@ -3000,6 +3040,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "FLAG_CONFIG",
"regions": [
{
"table_type": "flag",
@@ -3023,6 +3064,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -3054,6 +3096,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "INTERGER_PLUS",
"regions": [
{
"table_name": "INTERGER_PLUS",
@@ -3078,6 +3121,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PLUS_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -3108,6 +3152,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "IP_PERF_CONFIG",
"regions": [
{
"table_type": "ip_plus",
@@ -3139,6 +3184,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "INTEGER_PERF_CONFIG",
"regions": [
{
"table_name": "INTEGER_PERF_CONFIG",
@@ -3162,6 +3208,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "EXPR_LITERAL_PERF_CONFIG",
"regions": [
{
"table_name": "EXPR_LITERAL_PERF_CONFIG",
@@ -3187,6 +3234,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "FLAG_PERF_CONFIG",
"regions": [
{
"table_type": "flag",
@@ -3210,6 +3258,7 @@
"is_valid": "yes",
"groups": [
{
"virtual_table": "EXPR_REGEX_PERF_CONFIG",
"regions": [
{
"table_name": "EXPR_REGEX_PERF_CONFIG",
@@ -3340,6 +3389,7 @@
"groups": [
{
"group_name": "Untitled",
"virtual_table": "CONTENT_SIZE",
"regions": [
{
"table_name": "CONTENT_SIZE",
@@ -3602,6 +3652,7 @@
},
{
"group_name": "NOTLogicGroup_221_2",
"virtual_table": "HTTP_URL",
"not_flag": 0,
"regions": [
{