add ci config

.gitignore

@@ -0,0 +1,2 @@
+# Vscode
+.vscode/*

.gitlab-ci.yml

@@ -0,0 +1,224 @@
+variables:
+  GIT_STRATEGY: "clone"
+  BUILD_IMAGE_CENTOS7: "git.mesalab.cn:7443/mesa_platform/build-env:master"
+  BUILD_IMAGE_CENTOS8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
+  BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
+  INSTALL_DEPENDENCY_LIBRARY: framework_env openssl-devel libasan
+
+stages:
+- build
+
+.build_before_script:
+  before_script:
+  - mkdir -p $BUILD_PADDING_PREFIX/$CI_PROJECT_NAMESPACE/
+  - ln -s $CI_PROJECT_DIR $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
+  - cd $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
+  - chmod +x ./ci/travis.sh
+  - yum makecache
+  - yum install -y elfutils-libelf-devel
+
+
+.build_by_travis_for_centos7:
+  stage: build
+  image: $BUILD_IMAGE_CENTOS7
+  extends: .build_before_script
+  script:
+    - yum install -y libmnl-devel
+    - yum install -y libnfnetlink-devel
+    - ./ci/travis.sh
+      - cd build
+  tags:
+  - share
+
+.build_by_travis_for_centos8:
+  stage: build
+  image: $BUILD_IMAGE_CENTOS8
+  extends: .build_before_script
+  script:
+    - dnf --enablerepo=powertools install -y libmnl-devel
+    - dnf --enablerepo=powertools install -y libnfnetlink-devel
+    - ./ci/travis.sh
+  tags:
+    - share
+
+branch_build_debug_for_centos7:
+  stage: build
+  extends: .build_by_travis_for_centos7
+  variables:
+    BUILD_TYPE: Debug
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+branch_build_release_for_centos7:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+  extends: .build_by_travis_for_centos7
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+develop_build_debug_for_centos7:
+  stage: build
+  extends: .build_by_travis_for_centos7
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD: 1
+    ASAN_OPTION: ADDRESS
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: framework-testing-x86_64.el7
+    PULP3_DIST_NAME: framework-testing-x86_64.el7
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-debug"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+develop_build_release_for_centos7:
+  stage: build
+  extends: .build_by_travis_for_centos7
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    PACKAGE: 1
+    UPLOAD: 1
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: framework-testing-x86_64.el7
+    PULP3_DIST_NAME: framework-testing-x86_64.el7
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+release_build_debug_for_centos7:
+  stage: build
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD: 1
+    PULP3_REPO_NAME: framework-stable-x86_64.el7
+    PULP3_DIST_NAME: framework-stable-x86_64.el7
+  extends: .build_by_travis_for_centos7
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-debug"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+release_build_release_for_centos7:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    PACKAGE: 1
+    UPLOAD: 1
+    UPLOAD_SYMBOL_FILES: 1
+    SYMBOL_TARGET: libmaatframe
+    PULP3_REPO_NAME: framework-stable-x86_64.el7
+    PULP3_DIST_NAME: framework-stable-x86_64.el7
+  extends: .build_by_travis_for_centos7
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+branch_build_debug_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: Debug
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+branch_build_release_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+  extends: .build_by_travis_for_centos8
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+develop_build_debug_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD: 1
+    ASAN_OPTION: ADDRESS
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: framework-testing-x86_64.el8
+    PULP3_DIST_NAME: framework-testing-x86_64.el8
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-debug"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+develop_build_release_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    PACKAGE: 1
+    UPLOAD: 1
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: framework-testing-x86_64.el8
+    PULP3_DIST_NAME: framework-testing-x86_64.el8
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+release_build_debug_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD: 1
+    PULP3_REPO_NAME: framework-stable-x86_64.el8
+    PULP3_DIST_NAME: framework-stable-x86_64.el8
+  extends: .build_by_travis_for_centos8
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-debug"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+release_build_release_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    PACKAGE: 1
+    UPLOAD: 1
+    UPLOAD_SYMBOL_FILES: 1
+    SYMBOL_TARGET: libmaatframe
+    PULP3_REPO_NAME: framework-stable-x86_64.el8
+    PULP3_DIST_NAME: framework-stable-x86_64.el8
+  extends: .build_by_travis_for_centos8
+  artifacts:
+    name: "maatframe-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - tags

readme.md

@@ -0,0 +1,25 @@
+# 简介
+MAAT是古埃及神话中真理与正义女神，她的羽毛（feather）能够判断离世之人能否前往天堂。 
+
+MAAT框架对网络流处理中的配置进行抽象，并具有配置写入、多机同步（基于Redis）、加载、扫描的功能。
+
+maat.h中描述了初始化和配置扫描的API。 
+
+maat_command.h中描述了配置写入的API。 
+
+# 编译
+普通编译
+
+` Make`
+
+带调试符号编译
+
+`Make debug`
+
+安装
+
+`Make install`
+
+生成动态链接库 `./build/src/libmaatframe.so`
+
+生成静态链接库 `./build/src/libmaatframe.a`

scanner/adapter_hs.cpp

@@ -465,6 +465,29 @@ int is_real_matched_pattern(struct matched_pattern *matched_pat, enum hs_match_m
     return -1;
 }
 
+int hs_tag_validate(struct hs_tag *hs_tag, struct matched_pattern_container *matched_pat_container,
+                    size_t data_len)
+{
+    /* check if real matched pattern, because pattern match_mode is different */
+    for (size_t i = 0; i < hs_tag->n_pat_attr; i++) {
+        struct matched_pattern *tmp_matched_pat = NULL;
+        int pattern_id = hs_tag->pat_attr[i].pattern_id;
+        HASH_FIND_INT(matched_pat_container->pat_hash, &pattern_id, tmp_matched_pat);
+        if (tmp_matched_pat) {
+            int matched_ret = is_real_matched_pattern(tmp_matched_pat,
+                                                      hs_tag->pat_attr[i].match_mode,
+                                                      data_len,
+                                                      hs_tag->pat_attr[i].l_offset,
+                                                      hs_tag->pat_attr[i].r_offset);
+            if (matched_ret < 0) {
+                return -1;
+            }
+        }
+    }
+
+    return 0;
+}
+
 int adapter_hs_scan(struct adapter_hs *hs_instance, int thread_id,
                     const char *data, size_t data_len, 
                     struct hs_scan_result *results,
@@ -518,7 +541,6 @@ int adapter_hs_scan(struct adapter_hs *hs_instance, int thread_id,
     }
 
     int ret = 0;
-    int matched_index = 0;
     int real_matched_index = 0;
     struct hs_tag *hs_tag = NULL;
     struct bool_expr_match *bool_matcher_results = ALLOC(struct bool_expr_match, hs_instance->n_expr);
@@ -533,29 +555,20 @@ int adapter_hs_scan(struct adapter_hs *hs_instance, int thread_id,
         bool_matcher_ret = n_result;
     }
 
-    for (matched_index = 0; matched_index < bool_matcher_ret; matched_index++) {
+    for (int index = 0; index < bool_matcher_ret; index++) {
-        hs_tag = (struct hs_tag *)bool_matcher_results[matched_index].user_tag;
+        hs_tag = (struct hs_tag *)bool_matcher_results[index].user_tag;
 
-        /* check if real matched pattern, because pattern match_mode is different */
+        int tag_ret = hs_tag_validate(hs_tag, &matched_pat_container, data_len);
-        for (i = 0; i < hs_tag->n_pat_attr; i++) {
+        if (tag_ret < 0) {
-            struct matched_pattern *tmp_matched_pat = NULL;
+            //bool_matcher_results[index] is invalid hit, continue
-            int pattern_id = hs_tag->pat_attr[i].pattern_id;
+            continue;
-            HASH_FIND_INT(matched_pat_container.pat_hash, &pattern_id, tmp_matched_pat);
+        }
-            if (tmp_matched_pat) {
+
-                int matched_ret = is_real_matched_pattern(tmp_matched_pat, 
+        results[real_matched_index].item_id = bool_matcher_results[index].expr_id;
-                                                          hs_tag->pat_attr[i].match_mode,
-                                                          data_len,
-                                                          hs_tag->pat_attr[i].l_offset,
-                                                          hs_tag->pat_attr[i].r_offset);
-                if (0 == matched_ret) {
-                    results[real_matched_index].item_id = bool_matcher_results[matched_index].expr_id;
         results[real_matched_index].user_tag = hs_tag->user_tag;
         real_matched_index++;
-                    break;
-                }
-            }
-        }
     }
+    
     *n_hit_result = real_matched_index;
 next:
     FREE(bool_matcher_results);

scanner/adapter_hs.h

@@ -34,6 +34,7 @@ enum hs_scan_mode {
 
 /* match method */
 enum hs_match_mode {
+    HS_MATCH_MODE_INVALID = -1,
     HS_MATCH_MODE_EXACTLY = 1,  /* scan data must match pattern exactly */
     HS_MATCH_MODE_PREFIX,       /* pattern must in the head of scan_data */
     HS_MATCH_MODE_SUFFIX,       /* pattern must in the end of scan_data */
@@ -60,6 +61,7 @@ struct hs_scan_result {
 typedef struct {
     enum hs_case_sensitive case_sensitive;
     enum hs_match_mode match_mode;
+    int is_hexbin; /* 1(yes) 0(no) */
 
     /* 
      * just match in scan_data's range of [l_offset, r_offset], -1 means no limits

src/maat_api.c

@@ -865,8 +865,7 @@ int maat_scan_integer(struct maat *maat_instance, int table_id, int thread_id,
     }
 
     int group_hit_cnt = interval_runtime_scan((struct interval_runtime *)interval_rt, 
-                                                      thread_id,
+                                              thread_id, intval, group_ids, 
-                                                      intval, group_ids, 
                                               MAX_SCANNER_HIT_GROUP_NUM,
                                               vtable_id, mid);
     if (group_hit_cnt < 0) {
@@ -1141,8 +1140,8 @@ int maat_scan_string(struct maat *maat_instance, int table_id, int thread_id,
     }
 
     int group_hit_cnt = expr_runtime_scan((struct expr_runtime *)expr_rt, 
-                                                 thread_id,
+                                           thread_id, data, data_len, 
-                                                 data, data_len, group_ids, 
+                                           group_ids, 
                                            MAX_SCANNER_HIT_GROUP_NUM,
                                            vtable_id, mid);
     if (group_hit_cnt < 0) {

src/maat_compile.c

@@ -1065,7 +1065,7 @@ maat_compile_bool_matcher_new(struct maat_compile *compile_hash,
 
 	//TODO:mytest need to delete
 	#if 0
-	printf("bool_matcher_new....................\n");
+	printf("bool_matcher_new....................expr_cnt:%zu\n", expr_cnt);
 	for (expr_index = 0; expr_index < expr_cnt; expr_index++) {
 		printf("bool_expr_array[%zu].expr_id:%llu, item_num:%zu\n", expr_index, bool_expr_array[expr_index].expr_id,
 																	bool_expr_array[expr_index].item_num);
@@ -1780,9 +1780,9 @@ int maat_compile_state_update(struct maat_item *item_hash, int vtable_id,
 
     for (size_t i = 0; i < hit_item_cnt; i++) {
         HASH_FIND_INT(item_hash, &(hit_item_ids[i]), item);
-        assert(item != NULL);
+        //assert(item != NULL);
         if (!item) {
-            // should not come here
+            // item config has been deleted
             continue;
         }
 

src/maat_expr.c

@@ -41,6 +41,7 @@ struct expr_schema {
 };
 
 enum expr_type {
+    EXPR_TYPE_INVALID = -1,
     EXPR_TYPE_STRING = 0,
 	EXPR_TYPE_AND,
     EXPR_TYPE_REGEX,
@@ -91,7 +92,7 @@ struct expr_runtime {
 
 enum expr_type int_to_expr_type(int expr_type)
 {
-    enum expr_type type = EXPR_TYPE_MAX;
+    enum expr_type type = EXPR_TYPE_INVALID;
 
     switch (expr_type) {
     case 0:
@@ -115,7 +116,7 @@ enum expr_type int_to_expr_type(int expr_type)
 
 enum hs_match_mode int_to_match_mode(int match_method)
 {
-    enum hs_match_mode mode = HS_MATCH_MODE_MAX;
+    enum hs_match_mode mode = HS_MATCH_MODE_INVALID;
 
     switch (match_method) {
     case 0:
@@ -197,6 +198,12 @@ struct expr_item *expr_item_new(const char *line, struct expr_schema *expr_schem
     
     expr_type = atoi(line + column_offset);
     expr_item->expr_type = int_to_expr_type(expr_type);
+    if (expr_item->expr_type == EXPR_TYPE_INVALID) {
+        log_error(logger, MODULE_EXPR, 
+                  "expr table(table_id:%d) line:%s has invalid expr_type",
+                  expr_schema->table_id, line);
+        goto error;
+    }
 
     ret = get_column_pos(line, expr_schema->match_method_column, &column_offset, &column_len);
     if (ret < 0) {
@@ -208,6 +215,12 @@ struct expr_item *expr_item_new(const char *line, struct expr_schema *expr_schem
     
     match_method_type = atoi(line + column_offset);
     expr_item->match_mode = int_to_match_mode(match_method_type);
+    if (expr_item->match_mode == HS_MATCH_MODE_INVALID) {
+        log_error(logger, MODULE_EXPR, 
+                  "expr table(table_id:%d) line:%s has invalid match_method",
+                  expr_schema->table_id, line);
+        goto error;
+    }
 
     ret = get_column_pos(line, expr_schema->is_hexbin_column, &column_offset, &column_len);
     if (ret < 0) {
@@ -522,7 +535,7 @@ enum hs_pattern_type expr_type2pattern_type(enum expr_type expr_type)
     return pattern_type;
 }
 
-int convertHextoint(char srctmp)
+static int convertHextoint(char srctmp)
 {
 	if (isdigit(srctmp)) {
 		return srctmp - '0';
@@ -533,7 +546,7 @@ int convertHextoint(char srctmp)
 	}
 }
 
-size_t hex2bin(char *hex, int hex_len, char *binary, size_t size)
+static size_t hex2bin(char *hex, int hex_len, char *binary, size_t size)
 {
 	size_t resultlen = 0;
 	int high,low;
@@ -559,8 +572,13 @@ and_expr_t *expr_item_to_expr_rule(struct expr_item *expr_item, void *user_data,
     char *tmp = NULL;
     char *saveptr = NULL;
     char *sub_key_array[MAAT_MAX_EXPR_ITEM_NUM];
-    int key_left_offset[MAAT_MAX_EXPR_ITEM_NUM] = {-1};
+    int key_left_offset[MAAT_MAX_EXPR_ITEM_NUM];
-    int key_right_offset[MAAT_MAX_EXPR_ITEM_NUM] = {-1};
+    int key_right_offset[MAAT_MAX_EXPR_ITEM_NUM];
+
+    /* -1 means offset no limit, As long as the pattern appears in the scan data, it will hit */
+    memset(key_left_offset, -1, sizeof(key_left_offset));
+    memset(key_right_offset, -1, sizeof(key_right_offset));
+
     and_expr_t *expr_rule = ALLOC(and_expr_t, 1);
 
     switch (expr_item->expr_type) {
@@ -852,6 +870,7 @@ int expr_runtime_scan(struct expr_runtime *expr_rt, int thread_id,
     struct maat_item_inner *item = NULL;
     int real_hit_item_cnt = 0;
     int district_id = state->district_id;
+
     for (size_t i = 0; i < n_hit_item; i++) {
         item = (struct maat_item_inner *)(hit_results[i].user_tag);
         if (item->district_id == district_id || district_id == DISTRICT_ANY) {

src/maat_ip.c

@@ -488,12 +488,13 @@ int ip_runtime_scan(struct ip_runtime *ip_rt, int thread_id, int ip_type,
     struct ip_data scan_data;
     if (ip_type == IPv4) {
         scan_data.type = IPv4;
-        scan_data.ipv4 = *(uint32_t *)ip_addr;
+        scan_data.ipv4 = ntohl(*(uint32_t *)ip_addr);
     } else {
         scan_data.type = IPv6;
         for (int i = 0; i < 4; i++) {
             scan_data.ipv6[i] = *((uint32_t *)ip_addr + i);
         }
+        ipv6_ntoh(scan_data.ipv6);
     }
 
     n_hit_item = ip_matcher_match(ip_rt->ip_matcher, &scan_data, scan_results, MAX_SCANNER_HIT_ITEM_NUM);

src/maat_table.c

@@ -696,7 +696,7 @@ int table_manager_set_scan_district(struct table_manager *tbl_mgr, const char *d
 
 int table_manager_get_district_id(struct table_manager *tbl_mgr, const char *district)
 {
-    int district_id = -1;
+    int district_id = DISTRICT_ANY;
 
 	int map_ret = maat_kv_read(tbl_mgr->district_map, district, &district_id);
 	if (map_ret < 0) {

src/maat_utils.c

@@ -447,7 +447,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 			return -1;
 		}
 
-		//ipv4_addr = ntohl(ipv4_addr);
+		ipv4_addr = ntohl(ipv4_addr);
         uint32_t ipv4_range_end = 0;
         uint32_t ipv4_mask = 0;
 		switch (format) {
@@ -457,7 +457,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}				
-				//ipv4_range_end = ntohl(ipv4_range_end);
+				ipv4_range_end = ntohl(ipv4_range_end);
 				range_end[0] = ipv4_range_end;
 				break;
 			case IP_FORMAT_MASK:
@@ -465,7 +465,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}
-				//ipv4_mask = ntohl(ipv4_mask);
+				ipv4_mask = ntohl(ipv4_mask);
 				range_begin[0] = ipv4_addr & ipv4_mask;
 				range_end[0] = ipv4_addr | ~ipv4_mask;
 				break;
@@ -492,7 +492,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 		if (ret <= 0) {
 			return -1;
 		}
-		//ipv6_ntoh(ipv6_addr);
+		ipv6_ntoh(ipv6_addr);
 
 		switch (format) {
 			case IP_FORMAT_RANGE:
@@ -500,7 +500,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}
-				//ipv6_ntoh(ipv6_range_end);
+				ipv6_ntoh(ipv6_range_end);
 
 				memcpy(range_begin, ipv6_addr, sizeof(ipv6_addr));				
 				memcpy(range_end, ipv6_range_end, sizeof(ipv6_range_end));
@@ -510,7 +510,7 @@ int ip_format2range(int ip_type, enum maat_ip_format format, const char *ip1, co
 				if (ret <= 0) {
 					return -1;
 				}
-				//ipv6_ntoh(ipv6_mask);
+				ipv6_ntoh(ipv6_mask);
                 
 				for (i = 0; i < 4; i++) {
 					range_begin[i]=ipv6_addr[i] & ipv6_mask[i];	

test/adapter_hs_gtest.cpp

@@ -41,6 +41,44 @@ enum hs_case_sensitive case_sensitive_str_to_enum(const char *str)
     return case_sensitive;
 }
 
+int is_hexbin_str_to_int(const char *str)
+{
+    int ret = 0;
+
+    if (strcmp(str, "yes") == 0) {
+        ret = 1;
+    }
+
+    return ret;
+}
+
+static int convertHextoint(char srctmp)
+{
+	if (isdigit(srctmp)) {
+		return srctmp - '0';
+	} else {
+		char temp = toupper(srctmp);
+		temp = temp - 'A' + 10;
+		return temp;
+	}
+}
+
+static size_t hex2bin(char *hex, int hex_len, char *binary, size_t size)
+{
+	size_t resultlen = 0;
+	int high,low;
+	for (int i = 0; i < hex_len && size > resultlen; i += 2, resultlen++) {
+		high = convertHextoint(hex[i]);
+		low = convertHextoint(hex[i+1]);
+		binary[resultlen] = high * 16 + low;
+	}
+
+	size = resultlen;
+	binary[resultlen] = '\0';
+
+	return resultlen;
+}
+
 int parse_config_file(const char *filename, and_expr_t exprs[], size_t *n_expr)
 {
     unsigned char *json_buff = NULL;
@@ -101,12 +139,27 @@ int parse_config_file(const char *filename, and_expr_t exprs[], size_t *n_expr)
                 exprs[i].patterns[j].case_sensitive = case_sensitive_str_to_enum(item->valuestring);
             }
 
+            item = cJSON_GetObjectItem(pat_item, "is_hexbin");
+            if (item != NULL && item->type == cJSON_String) {
+                exprs[i].patterns[j].is_hexbin = is_hexbin_str_to_int(item->valuestring);
+            }
+
             item = cJSON_GetObjectItem(pat_item, "pattern");
             if (item != NULL && item->type == cJSON_String) {
                 exprs[i].patterns[j].pat = ALLOC(char, strlen(item->valuestring));
+
+                if (exprs[i].patterns[j].is_hexbin == 1) {
+                    size_t pat_str_len = strlen(item->valuestring) + 1;
+                    char *pat_str = ALLOC(char, pat_str_len);
+                    pat_str_len = hex2bin(item->valuestring, strlen(item->valuestring), pat_str, pat_str_len);
+                    
+                    memcpy(exprs[i].patterns[j].pat, pat_str, pat_str_len);
+                    exprs[i].patterns[j].pat_len = pat_str_len;
+                } else {
                     memcpy(exprs[i].patterns[j].pat, item->valuestring, strlen(item->valuestring));
                     exprs[i].patterns[j].pat_len = strlen(item->valuestring);
                 }
+            }
 
             if (exprs[i].patterns->match_mode == HS_MATCH_MODE_SUB) {
                 item = cJSON_GetObjectItem(pat_item, "offset");
@@ -154,15 +207,15 @@ TEST(block_mode_initialize, invalid_input_parameter)
 
     /* case1: invalid scan_mode parameter */
     hs_instance = adapter_hs_initialize(HS_SCAN_MODE_MAX, HS_PATTERN_TYPE_REG, 1, exprs, 1, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 
     /* case2: invalid expr parameter */
-    hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, nullptr, 1, g_logger);
+    hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, NULL, 1, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 
     /* case3: invalid expr num */
     hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, exprs, 0, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 }
 
 TEST(block_mode_scan, invalid_input_parameter)
@@ -170,24 +223,24 @@ TEST(block_mode_scan, invalid_input_parameter)
     and_expr_t expr_array[64];
     size_t n_expr_array = 0;
 
-    struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, nullptr, 0, g_logger);
+    struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, NULL, 0, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 
     hs_instance = adapter_hs_initialize(HS_SCAN_MODE_MAX, HS_PATTERN_TYPE_REG, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 
     n_expr_array = 1;
     expr_array[0].expr_id = 101;
     expr_array[0].n_patterns = 10;
     hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 
     memset(expr_array, 0, sizeof(expr_array));
     n_expr_array = 1;
     expr_array[0].expr_id = 101;
     expr_array[0].n_patterns = 1;
     hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_REG, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_EQ(hs_instance, nullptr);
+    EXPECT_EQ(hs_instance, NULL);
 }
 
 TEST(block_mode_scan, literal_sub_has_normal_offset)
@@ -197,10 +250,10 @@ TEST(block_mode_scan, literal_sub_has_normal_offset)
 
     int ret = parse_config_file("./literal_expr.conf", expr_array, &n_expr_array);
     EXPECT_EQ(ret, 0);
-    EXPECT_EQ(n_expr_array, 15);
+    EXPECT_EQ(n_expr_array, 11);
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello aaa";
@@ -227,7 +280,7 @@ TEST(block_mode_scan, literal_sub_has_normal_offset)
     EXPECT_EQ(n_result, 0);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 TEST(block_mode_scan, literal_sub_has_left_unlimit_offset)
@@ -237,10 +290,9 @@ TEST(block_mode_scan, literal_sub_has_left_unlimit_offset)
 
     int ret = parse_config_file("./literal_expr.conf", expr_array, &n_expr_array);
     EXPECT_EQ(ret, 0);
-    EXPECT_EQ(n_expr_array, 15);
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello bbb";
@@ -268,7 +320,7 @@ TEST(block_mode_scan, literal_sub_has_left_unlimit_offset)
     EXPECT_EQ(n_result, 0);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 TEST(block_mode_scan, literal_sub_has_right_unlimit_offset)
@@ -278,10 +330,9 @@ TEST(block_mode_scan, literal_sub_has_right_unlimit_offset)
 
     int ret = parse_config_file("./literal_expr.conf", expr_array, &n_expr_array);
     EXPECT_EQ(ret, 0);
-    EXPECT_EQ(n_expr_array, 15);
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello ccc";
@@ -324,7 +375,7 @@ TEST(block_mode_scan, literal_sub_has_right_unlimit_offset)
     EXPECT_EQ(result[0].item_id, 103);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 TEST(block_mode_scan, literal_sub_with_no_offset)
@@ -336,7 +387,7 @@ TEST(block_mode_scan, literal_sub_with_no_offset)
     EXPECT_EQ(ret, 0);
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello ddd";
@@ -371,7 +422,7 @@ TEST(block_mode_scan, literal_sub_with_no_offset)
     EXPECT_EQ(n_result, 0);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 TEST(block_mode_scan, literal_exactly)
@@ -383,7 +434,7 @@ TEST(block_mode_scan, literal_exactly)
     EXPECT_EQ(ret, 0);
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello eee";
@@ -412,7 +463,7 @@ TEST(block_mode_scan, literal_exactly)
     EXPECT_EQ(n_result, 0);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 TEST(block_mode_scan, literal_prefix)
@@ -425,7 +476,7 @@ TEST(block_mode_scan, literal_prefix)
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, 
                                                             expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello fff";
@@ -463,7 +514,7 @@ TEST(block_mode_scan, literal_prefix)
     EXPECT_EQ(result[0].item_id, 106);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 TEST(block_mode_scan, literal_suffix)
@@ -476,7 +527,7 @@ TEST(block_mode_scan, literal_suffix)
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, 
                                                            expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char scan_data1[64] = "hello ggg";
@@ -514,33 +565,41 @@ TEST(block_mode_scan, literal_suffix)
     EXPECT_EQ(n_result, 0);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
-// TEST(block_mode_scan, literal_sub_with_hexbin)
+TEST(block_mode_scan, literal_sub_with_hexbin)
-// {
+{
-//     and_expr_t expr_array[64] = {0};
+    and_expr_t expr_array[64] = {0};
-//     size_t n_expr_array = 0;
+    size_t n_expr_array = 0;
     
-//     int ret = parse_config_file("./and_expr.conf", expr_array, &n_expr_array);
+    int ret = parse_config_file("./literal_expr.conf", expr_array, &n_expr_array);
-//     EXPECT_EQ(ret, 0);
+    EXPECT_EQ(ret, 0);
 
-//     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, 1, 
+    struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, 
-//                                                            expr_array, n_expr_array, g_logger);
+                                                           expr_array, n_expr_array, g_logger);
-//     EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
-//     expr_array_free(expr_array, n_expr_array);
+    expr_array_free(expr_array, n_expr_array);
 
-//     char data0[64] = "Cookie: Txa123aheadBCAxd";
+    char scan_data1[64] = "Content-Type: /html";
-//     struct hs_scan_result result0[64] = {0};
+    struct hs_scan_result result[64] = {0};
-//     size_t n_result0 = 0;
+    size_t n_result = 0;
-//     ret = adapter_hs_scan(hs_instance, 0, data0, strlen(data0), result0, 64, &n_result0);
+    ret = adapter_hs_scan(hs_instance, 0, scan_data1, strlen(scan_data1), result, 64, &n_result);
-//     EXPECT_EQ(ret, 0);
+    EXPECT_EQ(ret, 0);
-//     EXPECT_EQ(n_result0, 1);
+    EXPECT_EQ(n_result, 1);
-//     EXPECT_EQ(result0[0].item_id, 107);
+    EXPECT_EQ(result[0].item_id, 108);
 
-//     adapter_hs_destroy(hs_instance);
+    char scan_data2[64] = " html";
-//     hs_instance = nullptr;
+    memset(result, 0, sizeof(result));
-// }
+    n_result = 0;
+
+    ret = adapter_hs_scan(hs_instance, 0, scan_data2, strlen(scan_data2), result, 64, &n_result);
+    EXPECT_EQ(ret, 0);
+    EXPECT_EQ(n_result, 0);
+
+    adapter_hs_destroy(hs_instance);
+    hs_instance = NULL;
+}
 
 TEST(block_mode_scan, literal_with_chinese)
 {
@@ -552,7 +611,7 @@ TEST(block_mode_scan, literal_with_chinese)
 
     struct adapter_hs *hs_instance = adapter_hs_initialize(HS_SCAN_MODE_BLOCK, HS_PATTERN_TYPE_STR, 1, 
                                                            expr_array, n_expr_array, g_logger);
-    EXPECT_NE(hs_instance, nullptr);
+    EXPECT_NE(hs_instance, NULL);
     expr_array_free(expr_array, n_expr_array);
 
     char data0[64] = "#中国 你好";
@@ -561,10 +620,10 @@ TEST(block_mode_scan, literal_with_chinese)
     ret = adapter_hs_scan(hs_instance, 0, data0, strlen(data0), result0, 64, &n_result0);
     EXPECT_EQ(ret, 0);
     EXPECT_EQ(n_result0, 1);
-    EXPECT_EQ(result0[0].item_id, 114);
+    EXPECT_EQ(result0[0].item_id, 110);
 
     adapter_hs_destroy(hs_instance);
-    hs_instance = nullptr;
+    hs_instance = NULL;
 }
 
 int main(int argc, char **argv)

test/maat_framework_gtest.cpp

@@ -11,6 +11,9 @@
 
 #define MODULE_FRAMEWORK_GTEST	 module_name_str("maat.framework_gtest")
 
+#define ARRAY_SIZE    10
+#define HIT_PATH_SIZE 128
+
 const char *table_info_path = "./table_info.conf";
 const char *json_path="./maat_json.json";
 const char *json_filename = "maat_json.json";
@@ -22,38 +25,33 @@ class MaatFlagScan : public testing::Test
 {
 protected:
     static void SetUpTestCase() {
-        flag_table_id = maat_table_get_id(g_maat_instance, "FLAG_CONFIG");
+
-        expr_table_id = maat_table_get_id(g_maat_instance, "HTTP_URL");
     }
 
     static void TearDownTestCase() {
        
     }
 
-    static int flag_table_id;
-    static int expr_table_id;
 };
-int MaatFlagScan::flag_table_id;
-int MaatFlagScan::expr_table_id;
 
 TEST_F(MaatFlagScan, basic) {
-    int flag_table_id = MaatFlagScan::flag_table_id;
+    int flag_table_id = maat_table_get_id(g_maat_instance, "FLAG_CONFIG");
 
     //compile_id:192 flag: 0000 0001 mask: 0000 0011
     //scan_data: 0000 1001 or 0000 1101 should hit
     uint64_t scan_data = 9;
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
     int ret = maat_scan_flag(g_maat_instance, flag_table_id, 0, scan_data, results,
-                             5, &n_hit_result, &state);
+                             ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 1);
     EXPECT_EQ(results[0], 192);
 
-    struct maat_hit_path hit_path[128] = {0};
+    struct maat_hit_path hit_path[HIT_PATH_SIZE] = {0};
     int n_read = 0;
-    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, sizeof(hit_path));
+    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, HIT_PATH_SIZE);
     EXPECT_NE(n_read, 0);
     maat_state_free(&state);
 
@@ -61,7 +59,7 @@ TEST_F(MaatFlagScan, basic) {
     memset(results, 0, sizeof(results));
     n_hit_result = 0;
     ret = maat_scan_flag(g_maat_instance, flag_table_id, 0, scan_data, results, 
-                         5, &n_hit_result, &state);
+                         ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 1);
     EXPECT_EQ(results[0], 192);
@@ -71,36 +69,36 @@ TEST_F(MaatFlagScan, basic) {
     memset(results, 0, sizeof(results));
     n_hit_result = 0;
     ret = maat_scan_flag(g_maat_instance, flag_table_id, 0, scan_data, results, 
-                         5, &n_hit_result, &state);
+                         ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
     EXPECT_EQ(n_hit_result, 0);
     maat_state_free(&state);
 }   
 
 TEST_F(MaatFlagScan, withExprRegion) {
-    int flag_table_id = MaatFlagScan::flag_table_id;
+    int flag_table_id = maat_table_get_id(g_maat_instance, "FLAG_CONFIG");
-    int expr_table_id = MaatFlagScan::expr_table_id;
+    int expr_table_id = maat_table_get_id(g_maat_instance, "HTTP_URL_LITERAL");
 
     //compile_id:193 flag: 0000 0010 mask: 0000 0011
     //scan_data: 0000 0010 or 0000 0100 should hit
     uint64_t flag_scan_data = 2;
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
 
     int ret = maat_scan_flag(g_maat_instance, flag_table_id, 0, flag_scan_data, results, 
-                             5, &n_hit_result, &state);
+                             ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
     EXPECT_EQ(n_hit_result, 0);
 
-    struct maat_hit_path hit_path[128] = {0};
+    struct maat_hit_path hit_path[HIT_PATH_SIZE] = {0};
     int n_read = 0;
-    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, sizeof(hit_path));
+    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, HIT_PATH_SIZE);
     EXPECT_NE(n_read, 0);
 
     const char *expr_scan_data = "hello world";
     ret = maat_scan_string(g_maat_instance, expr_table_id, 0, expr_scan_data, strlen(expr_scan_data), 
-                           results, 5, &n_hit_result, &state);
+                           results, ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 1);
     EXPECT_EQ(results[0], 193);
@@ -108,26 +106,26 @@ TEST_F(MaatFlagScan, withExprRegion) {
 }   
 
 TEST_F(MaatFlagScan, hitMultiCompile) {
-    int flag_table_id = MaatFlagScan::flag_table_id;
+    int flag_table_id = maat_table_get_id(g_maat_instance, "FLAG_CONFIG");
 
     //compile_id:192 flag: 0000 0001 mask: 0000 0011
     //compile_id:194 flag: 0001 0101 mask: 0001 1111
     //scan_data: 0001 0101 should hit compile192 and compile194
     uint64_t flag_scan_data = 21;
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
 
     int ret = maat_scan_flag(g_maat_instance, flag_table_id, 0, flag_scan_data, results, 
-                             5, &n_hit_result, &state);
+                             ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 2);
     EXPECT_EQ(results[0], 194);
     EXPECT_EQ(results[1], 192);
 
-    struct maat_hit_path hit_path[128] = {0};
+    struct maat_hit_path hit_path[HIT_PATH_SIZE] = {0};
     int n_read = 0;
-    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, sizeof(hit_path));
+    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, HIT_PATH_SIZE);
     EXPECT_NE(n_read, 0);
 
     maat_state_free(&state);
@@ -137,7 +135,6 @@ class MaatStringScan : public testing::Test
 {
 protected:
     static void SetUpTestCase() {
-        table_id = maat_table_get_id(g_maat_instance, "KEYWORDS_TABLE");
     }
 
     static void TearDownTestCase() {
@@ -149,35 +146,35 @@ protected:
 int MaatStringScan::table_id;
 
 TEST_F(MaatStringScan, Expr8) {
-    int table_id = MaatStringScan::table_id;
+    int table_id = maat_table_get_id(g_maat_instance, "KEYWORDS_TABLE");
     char scan_data[128] = "string1, string2, string3, string4, string5, string6, string7, string8";
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
     int ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data, strlen(scan_data), 
-                               results, 5, &n_hit_result, &state);
+                               results, ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 1);
     EXPECT_EQ(results[0], 182);
 
-    struct maat_hit_path hit_path[128] = {0};
+    struct maat_hit_path hit_path[HIT_PATH_SIZE] = {0};
     int n_read = 0;
-    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, sizeof(hit_path));
+    n_read = maat_state_get_hit_paths(g_maat_instance, &state, hit_path, HIT_PATH_SIZE);
     EXPECT_NE(n_read, 0);
     maat_state_free(&state);
 }
 
 TEST_F(MaatStringScan, Regex) {
     int ret = 0;
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
     const char *cookie = "Cookie: Txa123aheadBCAxd";
-    int table_id = maat_table_get_id(g_maat_instance, "HTTP_URL");
+    int table_id = maat_table_get_id(g_maat_instance, "HTTP_URL_REGEX");
     ASSERT_GT(table_id, 0);
 
     ret = maat_scan_string(g_maat_instance, table_id, 0, cookie, strlen(cookie),
-                            results, 5, &n_hit_result, &state);
+                            results, ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(results[0], 146);
     maat_state_free(&state);
@@ -206,7 +203,7 @@ TEST_F(MaatStringScan, Regex) {
 }
 
 TEST_F(MaatStringScan, ExprPlus) {
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
 	const char *region_name1 ="HTTP URL";
@@ -218,13 +215,13 @@ TEST_F(MaatStringScan, ExprPlus) {
 	ASSERT_GT(table_id, 0);
 
 	int ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data1, strlen(scan_data1), 
-						        results, 5, &n_hit_result, &state);
+						        results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_ERR);//Should return error for district not setting.
 
 	ret = maat_state_set_scan_district(g_maat_instance, &state, region_name1, strlen(region_name1));
 	ASSERT_EQ(ret, 0);
 	ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data1, strlen(scan_data1), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HIT);
 	EXPECT_EQ(results[0], 128);
 	maat_state_free(&state);
@@ -232,7 +229,7 @@ TEST_F(MaatStringScan, ExprPlus) {
 	ret = maat_state_set_scan_district(g_maat_instance, &state, region_name2, strlen(region_name2));
 	ASSERT_EQ(ret, 0);
 	ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data2, strlen(scan_data2), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HIT);
 	EXPECT_EQ(results[0], 190);
 	maat_state_free(&state);
@@ -241,7 +238,7 @@ TEST_F(MaatStringScan, ExprPlus) {
 //TODO:
 #if 0
 TEST_F(MaatStringScan, ShouldNotHitExprPlus) {
-    int results[5] = {0};
+    int results[ARRAY] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
 	const char *region_name = "tcp.payload";
@@ -266,13 +263,13 @@ TEST_F(MaatStringScan, ShouldNotHitExprPlus) {
 	ASSERT_EQ(ret, 0);
     
 	ret = maat_scan_string(g_maat_instance, table_id, 0, (char *)udp_payload_not_hit, sizeof(udp_payload_not_hit), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
 	maat_state_free(&state);
 }
 
 TEST_F(MaatStringScan, ExprPlusWithHex) {
-    int results[5] = {0};
+    int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
 	const char *scan_data1 = "text/html; charset=UTF-8";
@@ -286,19 +283,19 @@ TEST_F(MaatStringScan, ExprPlusWithHex) {
 	int ret = maat_state_set_scan_district(g_maat_instance, &state, region_name1, strlen(region_name1));
 	ASSERT_EQ(ret, 0);
 	ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data1, strlen(scan_data1), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(results[0], 156);
 
     ret = maat_state_set_scan_district(g_maat_instance, &state, region_name2, strlen(region_name2));
 	ASSERT_EQ(ret, 0);
 	ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data1, strlen(scan_data1), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
     
     table_id = maat_table_get_id(g_maat_instance, "KEYWORDS_TABLE");
     ret = maat_scan_string(g_maat_instance, table_id, 0, scan_data2, strlen(scan_data2),
-                            results, 5, &n_hit_result, &state);
+                            results, ARRAY_SIZE, &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(results[0], 132);                    
 	maat_state_free(&state);
@@ -306,7 +303,7 @@ TEST_F(MaatStringScan, ExprPlusWithHex) {
 
 TEST_F(MaatStringScan, ExprPlusWithOffset)
 {
-	int results[5] = {0};
+	int results[ARRAY_SIZE] = {0};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
 	const char *region_name = "Payload";
@@ -344,11 +341,11 @@ TEST_F(MaatStringScan, ExprPlusWithOffset)
 	EXPECT_EQ(ret, 0);
 
 	ret = maat_scan_string(g_maat_instance, table_id, 0, (char*)udp_payload_not_hit, sizeof(udp_payload_not_hit), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_OK);
 
 	ret = maat_scan_string(g_maat_instance, table_id, 0, (char*)udp_payload_hit, sizeof(udp_payload_hit), 
-						   results, 5, &n_hit_result, &state);
+						   results, ARRAY_SIZE, &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HIT);
 	EXPECT_EQ(results[0], 148);
 	
@@ -356,32 +353,117 @@ TEST_F(MaatStringScan, ExprPlusWithOffset)
 }
 #endif
 
+TEST_F(MaatStringScan, dynamic_config) {
+    int table_id = maat_table_get_id(g_maat_instance, "HTTP_URL_LITERAL");
+   
+    char data[128] = "hello world";
+    int results[ARRAY_SIZE] = {0};
+    size_t n_hit_result = 0;
+    struct maat_state *state = NULL;
+    int ret = maat_scan_string(g_maat_instance, table_id, 0, data, strlen(data), results, 
+                               ARRAY_SIZE, &n_hit_result, &state);
+    EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
+    EXPECT_EQ(n_hit_result, 0);
+    maat_state_free(&state);
+
+    /* add new line in GROUP2COMPILE table */
+    const char *g2c_table_name = "GROUP2COMPILE";
+    const char *g2c_table_line_add = "8888\t9999\t1\t0\tnull\t1";
+    struct maat_cmd_line line_rule;
+    line_rule.rule_id = 8888;
+    line_rule.table_line = g2c_table_line_add;
+    line_rule.table_name = g2c_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* add new line in COMPILE table */
+    const char *compile_table_name = "COMPILE";
+    const char *compile_table_line_add = "9999\t0\t0\t0\t0\t0\tanything\t1\t1\t0.0";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9999;
+    line_rule.table_line = compile_table_line_add;
+    line_rule.table_name = compile_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* add new line in HTTP_URL_LITERAL table */
+    const char *table_name = "HTTP_URL_LITERAL";
+    const char *table_line_add = "9999\t8888\thello world\t0\t0\t0\t1\t";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9999;
+    line_rule.table_line = table_line_add;
+    line_rule.table_name = table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    sleep(2);
+    state = NULL;
+    ret = maat_scan_string(g_maat_instance, table_id, 0, data, strlen(data), results, 
+                           ARRAY_SIZE, &n_hit_result, &state);
+    EXPECT_EQ(ret, MAAT_SCAN_HIT);
+    EXPECT_EQ(n_hit_result, 1);
+    EXPECT_EQ(results[0], 9999);
+    maat_state_free(&state);
+
+    /* del new line from HTTP_URL_LITERAL table */
+    const char *table_line_del = "9999\t8888\thello world\t0\t0\t0\t0\t";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9999;
+    line_rule.table_line = table_line_del;
+    line_rule.table_name = table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* del new line from COMPILE table */
+    const char *compile_table_line_del = "9999\t0\t0\t0\t0\t0\tanything\t0\t1\t0.0";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9999;
+    line_rule.table_line = compile_table_line_del;
+    line_rule.table_name = compile_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* del new line from GROUP2COMPILE table */
+    const char *g2c_table_line_del = "8888\t9999\t0\t0\tnull\t1";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 8888;
+    line_rule.table_line = g2c_table_line_del;
+    line_rule.table_name = g2c_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    sleep(2);
+    state = NULL;
+    ret = maat_scan_string(g_maat_instance, table_id, 0, data, strlen(data), results, 
+                           ARRAY_SIZE, &n_hit_result, &state);
+    EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
+    EXPECT_EQ(n_hit_result, 0);
+    maat_state_free(&state);
+}
+
 class MaatIPScan : public testing::Test
 {
 protected:
     static void SetUpTestCase() {
-        table_id = maat_table_get_id(g_maat_instance, "IP_PLUS_CONFIG");
+        
     }
 
     static void TearDownTestCase() {
        
     }
-
-    static int table_id;
 };
-int MaatIPScan::table_id;
 
 TEST_F(MaatIPScan, IPv4) {
-    int table_id = MaatIPScan::table_id;
+    int table_id = maat_table_get_id(g_maat_instance, "IP_PLUS_CONFIG");
     char ip_str[32] = "10.0.7.100";
     uint32_t sip;
     int ret = inet_pton(AF_INET, ip_str, &sip);
     EXPECT_EQ(ret, 1);
 
-    int results[3] = {-1};
+    int results[ARRAY_SIZE] = {-1};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
-    ret = maat_scan_ipv4(g_maat_instance, table_id, 0, sip, results, 3,
+    ret = maat_scan_ipv4(g_maat_instance, table_id, 0, sip, results, ARRAY_SIZE,
                          &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 2);
@@ -391,16 +473,16 @@ TEST_F(MaatIPScan, IPv4) {
 }
 
 TEST_F(MaatIPScan, IPv6) {
-    int table_id = MaatIPScan::table_id;
+    int table_id = maat_table_get_id(g_maat_instance, "IP_PLUS_CONFIG");
     char ip_str[32] = "1001:da8:205:1::101";
     uint8_t sip[16];
     int ret = inet_pton(AF_INET6, ip_str, &sip);
     EXPECT_EQ(ret, 1);
 
-    int results[3] = {-1};
+    int results[ARRAY_SIZE] = {-1};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
-    ret = maat_scan_ipv6(g_maat_instance, table_id, 0, sip, results, 3,
+    ret = maat_scan_ipv6(g_maat_instance, table_id, 0, sip, results, ARRAY_SIZE,
                          &n_hit_result, &state);
     EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 1);
@@ -409,70 +491,150 @@ TEST_F(MaatIPScan, IPv6) {
     maat_state_free(&state);
 }
 
-TEST_F(MaatStringScan, dynamic_config) {
-    int table_id = maat_table_get_id(g_maat_instance, "HTTP_URL");
-   
-    char data[128] = "hello world";
-    int results[5] = {0};
-    size_t n_hit_result = 0;
-    struct maat_state *state = NULL;
-    int ret = maat_scan_string(g_maat_instance, table_id, 0, data, strlen(data), results, sizeof(results), &n_hit_result, &state);
-    EXPECT_EQ(ret, MAAT_SCAN_OK);
-    EXPECT_EQ(n_hit_result, 0);
-    maat_state_free(&state);
-
-    const char *table_name = "HTTP_URL";
-    const char *table_line = "9999\t8888\thello world\t0\t0\t0\t1\t";
-    struct maat_cmd_line line_rule;
-    line_rule.rule_id = 101;
-    line_rule.table_line = table_line;
-    line_rule.table_name = table_name;
-    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
-    EXPECT_EQ(ret, 1);
-
-    sleep(2);
-    state = NULL;
-    ret = maat_scan_string(g_maat_instance, table_id, 0, data, strlen(data), results, sizeof(results), &n_hit_result, &state);
-    EXPECT_EQ(ret, MAAT_SCAN_HIT);
-    EXPECT_EQ(n_hit_result, 1);
-    EXPECT_EQ(results[0], 9999);
-    maat_state_free(&state);
-}
-
 TEST_F(MaatIPScan, dynamic_config) {
     int table_id = maat_table_get_id(g_maat_instance, "IP_PLUS_CONFIG");
    
-    char ip_str[32] = "10.0.6.201";
+    char ip_str[32] = "100.100.100.100";
     uint32_t sip;
     int ret = inet_pton(AF_INET, ip_str, &sip);
     EXPECT_EQ(ret, 1);
 
-    int results[3] = {-1};
+    int results[ARRAY_SIZE] = {-1};
     size_t n_hit_result = 0;
     struct maat_state *state = NULL;
-    ret = maat_scan_ipv4(g_maat_instance, table_id, 0, sip, results, sizeof(results), &n_hit_result, &state);
+    ret = maat_scan_ipv4(g_maat_instance, table_id, 0, sip, results, ARRAY_SIZE, 
-    EXPECT_EQ(ret, MAAT_SCAN_OK);
+                         &n_hit_result, &state);
-    EXPECT_EQ(n_hit_result, 0);
+    EXPECT_EQ(ret, MAAT_SCAN_HIT);
+    EXPECT_EQ(n_hit_result, 1);
+    EXPECT_EQ(results[0], 169);
     maat_state_free(&state);
 
-    const char *table_name = "IP_PLUS_CONFIG";
+    /* add new line in GROUP2COMPILE table */
-    const char *table_line = "9998\t8887\t4\trange\t10.0.6.201\t255.255.0.0\trange\t0\t65535\t6\t0\t1";
+    const char *g2c_table_name = "GROUP2COMPILE";
+    const char *g2c_table_line_add = "8887\t9998\t1\t0\tnull\t1";
     struct maat_cmd_line line_rule;
-    line_rule.rule_id = 101;
+    line_rule.rule_id = 8887;
-    line_rule.table_line = table_line;
+    line_rule.table_line = g2c_table_line_add;
+    line_rule.table_name = g2c_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* add new line in COMPILE table */
+    const char *compile_table_name = "COMPILE";
+    const char *compile_table_line_add = "9998\t0\t0\t0\t0\t0\tanything\t1\t1\t0.0";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9998;
+    line_rule.table_line = compile_table_line_add;
+    line_rule.table_name = compile_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* add new line in IP_PLUS_CONFIG */
+    const char *table_name = "IP_PLUS_CONFIG";
+    const char *table_line_add = "9998\t8887\t4\trange\t100.100.100.100\t100.100.100.100\trange\t0\t65535\trange\t10.0.6.201\t255.255.0.0\trange\t0\t65535\t6\t0\t1";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9998;
+    line_rule.table_line = table_line_add;
     line_rule.table_name = table_name;
     ret = maat_cmd_set_line(g_maat_instance, &line_rule);
-    EXPECT_EQ(ret, 0);
+    EXPECT_EQ(ret, 1);
 
     sleep(2);
     state = NULL;
-    ret = maat_scan_ipv4(g_maat_instance, table_id, 0, sip, results, sizeof(results), &n_hit_result, &state);
+    ret = maat_scan_ipv4(g_maat_instance, table_id, 0, sip, results, ARRAY_SIZE, 
+                         &n_hit_result, &state);
+    EXPECT_EQ(ret, MAAT_SCAN_HIT);
+    EXPECT_EQ(n_hit_result, 2);
+    EXPECT_EQ(results[0], 9998);
+    EXPECT_EQ(results[1], 169);
+    maat_state_free(&state);
+
+    /* del new line in IP_PLUS_CONFIG */
+    const char *table_line_del = "9998\t8887\t4\trange\t100.100.100.100\t100.100.100.100\trange\t0\t65535\trange\t10.0.6.201\t255.255.0.0\trange\t0\t65535\t6\t0\t0";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9998;
+    line_rule.table_line = table_line_del;
+    line_rule.table_name = table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* del new line in COMPILE table */
+    const char *compile_table_line_del = "9998\t0\t0\t0\t0\t0\tanything\t0\t1\t0.0";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 9998;
+    line_rule.table_line = compile_table_line_del;
+    line_rule.table_name = compile_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+
+    /* del new line in GROUP2COMPILE table */
+    const char *g2c_table_line_del = "8887\t9998\t0\t0\tnull\t1";
+    memset(&line_rule, 0, sizeof(line_rule));
+    line_rule.rule_id = 8887;
+    line_rule.table_line = g2c_table_line_del;
+    line_rule.table_name = g2c_table_name;
+    ret = maat_cmd_set_line(g_maat_instance, &line_rule);
+    EXPECT_EQ(ret, 1);
+}
+
+class MaatIntervalScan : public testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        
+    }
+
+    static void TearDownTestCase() {
+       
+    }
+};
+#if 0
+TEST_F(MaatIntervalScan, Pure) {	
+	int results[ARRAY_SIZE] = {0};
+    size_t n_hit_result = 0;
+    struct maat_state *state = NULL;
+    const char *table_name = "CONTENT_SIZE";
+
+	int table_id = maat_table_get_id(g_maat_instance, table_name);
+	ASSERT_GT(table_id, 0);
+
+    unsigned int scan_data1 = 2015;
+	int ret = maat_scan_integer(g_maat_instance, table_id, 0, scan_data1, results, ARRAY_SIZE, 
+                                &n_hit_result, &state);
+	EXPECT_EQ(ret, MAAT_SCAN_HALF_HIT);
+	maat_state_free(&state);
+
+    unsigned int scan_data2 = 300;
+    int ret = maat_scan_integer(g_maat_instance, table_id, 0, scan_data2, results, ARRAY_SIZE, 
+                            &n_hit_result, &state);
 	EXPECT_EQ(ret, MAAT_SCAN_HIT);
     EXPECT_EQ(n_hit_result, 1);
-    EXPECT_EQ(results[0], 9998);
+    EXPECT_EQ(results[0], 124);
 	maat_state_free(&state);
 }
 
+TEST_F(MaatIntervalScan, IntervalPlus) {
+    int results[ARRAY_SIZE] = {0};
+    size_t n_hit_result = 0;
+    struct maat_state *state = NULL;
+    const char *table_name = "INTERGER_PLUS";
+    
+	int table_id = maat_table_get_id(g_maat_instance, table_name);
+	ASSERT_GT(table_id, 0);
+
+    const char *district_str = "interval.plus";
+    int ret = maat_state_set_scan_district(g_maat_instance, &state, district_str, strlen(district_str));
+    ASSERT_GT(ret, 0);
+
+    unsigned int scan_data1 = 2020;
+	ret = maat_scan_integer(g_maat_instance, table_id, 0, scan_data1, results, ARRAY_SIZE, 
+                                &n_hit_result, &state);
+	EXPECT_EQ(ret, MAAT_SCAN_HIT);
+    EXPECT_EQ(n_hit_result, 1);
+    EXPECT_EQ(results[0], 179);
+	maat_state_free(&state);
+}
+#endif
 int count_line_num_cb(const char *table_name, const char *line, void *u_para)
 {
 	(*((unsigned int *)u_para))++;
@@ -527,12 +689,12 @@ int write_config_to_redis(char *redis_ip, int redis_port, int redis_db,
     snprintf(json_iris_path, sizeof(json_iris_path), "./%s_iris_tmp", json_filename);
 
     redisContext *c = maat_cmd_connect_redis(redis_ip, redis_port, redis_db, logger);
-    if (nullptr == c) {
+    if (NULL == c) {
         return -1;
     }
 
     redisReply *reply = maat_cmd_wrap_redis_command(c, "flushdb");
-    if (nullptr == reply) {
+    if (NULL == reply) {
         return -1;
     }
     

test/maat_input_mode_gtest.cpp

@@ -34,7 +34,7 @@ TEST(json_mode, maat_scan_string) {
     maat_options_set_json_file(opts, json_path);
 
     struct maat *maat_instance = maat_new(opts, table_info_path);
-    EXPECT_NE(maat_instance, nullptr);
+    EXPECT_NE(maat_instance, NULL);
 
     int table_id = maat_table_get_id(maat_instance, "KEYWORDS_TABLE");
    
@@ -79,7 +79,7 @@ TEST(iris_mode, maat_scan_string) {
     maat_options_set_iris(opts, tmp_iris_full_idx_path, tmp_iris_inc_idx_path);
 
     struct maat *maat_instance = maat_new(opts, table_info_path);
-    EXPECT_NE(maat_instance, nullptr);
+    EXPECT_NE(maat_instance, NULL);
 
     int table_id = maat_table_get_id(maat_instance, "KEYWORDS_TABLE");
    
@@ -153,10 +153,10 @@ TEST(redis_mode, maat_scan_string) {
     snprintf(json_iris_path, sizeof(json_iris_path), "./%s_iris_tmp", json_filename);
 
     redisContext *c = maat_cmd_connect_redis(redis_ip, redis_port, redis_db, g_logger);
-    EXPECT_NE(c, nullptr);
+    EXPECT_NE(c, NULL);
 
     redisReply *reply = maat_cmd_wrap_redis_command(c, "flushdb");
-    EXPECT_NE(reply, nullptr);
+    EXPECT_NE(reply, NULL);
     
     if (access(json_iris_path, F_OK) < 0) {
         char tmp_iris_path[128] = {0};

test/maat_json.json

@@ -231,7 +231,7 @@
                     "group_name": "Untitled",
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "abckkk&123",
@@ -285,7 +285,7 @@
                     "group_name": "Untitled",
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "should_not_hit_any_rule",
@@ -376,7 +376,7 @@
                     "group_name": "Untitled",
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "C#中国",
@@ -506,7 +506,7 @@
                     "group_name": "Untitled",
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "novel&27122.txt",
@@ -609,7 +609,7 @@
                 {
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "should&hit&aaa",
@@ -636,7 +636,7 @@
                 {
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "should&hit&bbb",
@@ -689,7 +689,7 @@
                     "group_name": "Untitled",
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "i.ytimg.com",
@@ -714,7 +714,7 @@
                 {
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": ",IgpwcjA0LnN2bzAzKgkxMjcuMC4wLjE",
@@ -740,7 +740,7 @@
                     "not_flag":0,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-contained-string-of-rule-143",
@@ -755,7 +755,7 @@
                     "not_flag":1,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-not-contained-string-of-rule-143",
@@ -781,7 +781,7 @@
                     "not_flag":0,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-contained-string-of-rule-144",
@@ -822,7 +822,7 @@
                     "not_flag":0,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-contained-string-of-rule-145",
@@ -851,7 +851,7 @@
                 {
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_REGEX",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "Cookie:\\s&head",
@@ -876,7 +876,7 @@
                 {
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "googlevideo.com/videoplayback&mn=sn-35153iuxa-5a56%2Csn-n8v7znz7",
@@ -1315,7 +1315,7 @@
 		                "not_flag":0,
 		                "regions": [
 		                    {
-		                        "table_name": "HTTP_URL",
+		                        "table_name": "HTTP_URL_LITERAL",
 		                        "table_type": "expr",
 		                        "table_content": {
 		                            "keywords": "https://blog.csdn.net/littlefang/article/details/8213058",
@@ -1469,7 +1469,7 @@
                     "group_name": "Untitled",
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "cavemancircus.com/",
@@ -1511,7 +1511,7 @@
                         "group_name": "Untitled",
                         "regions": [
                             {
-                                "table_name": "HTTP_URL",
+                                "table_name": "HTTP_URL_LITERAL",
                                 "table_type": "expr",
                                 "table_content": {
                                     "keywords": "2019/12/27/pretty-girls-6",
@@ -1538,7 +1538,7 @@
                         "group_name": "Untitled",
                         "regions": [
                             {
-                                "table_name": "HTTP_URL",
+                                "table_name": "HTTP_URL_LITERAL",
                                 "table_type": "expr",
                                 "table_content": {
                                     "keywords": "2019/12/27",
@@ -1565,7 +1565,7 @@
                         "group_name": "Untitled",
                         "regions": [
                             {
-                                "table_name": "HTTP_URL",
+                                "table_name": "HTTP_URL_LITERAL",
                                 "table_type": "expr",
                                 "table_content": {
                                     "keywords": "2019/12/27",
@@ -1992,7 +1992,7 @@
                             "table_content": {
                                 "keywords": "string1&string2&string3&string4&string5&string6&string7&string8",
                                 "expr_type": "and",
-                                "match_method": "expr",
+                                "match_method": "sub",
                                 "format": "uncase plain"
                             }
                         }
@@ -2096,7 +2096,7 @@
                     "not_flag": 1,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-not-contained-string-of-rule-186",
@@ -2148,7 +2148,7 @@
                     "not_flag": 1,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-not-contained-string-of-rule-187",
@@ -2200,7 +2200,7 @@
                     "not_flag": 1,
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "must-not-contained-string-of-rule-188",
@@ -2368,7 +2368,7 @@
                 {
                     "regions": [
                         {
-                            "table_name": "HTTP_URL",
+                            "table_name": "HTTP_URL_LITERAL",
                             "table_type": "expr",
                             "table_content": {
                                 "keywords": "hello",

test/rcu_hash_gtest.cpp

@@ -14,14 +14,14 @@ void data_free(void *user_ctx, void *data)
 }
 
 TEST(rcu_hash_new, invalid_input_parameter) {
-    struct rcu_hash_table *htable = rcu_hash_new(nullptr);
+    struct rcu_hash_table *htable = rcu_hash_new(NULL);
-    EXPECT_EQ(htable, nullptr);
+    EXPECT_EQ(htable, NULL);
 }
 
 TEST(rcu_hash_add_one_node, single_thread) {
     /* add one node to hash */
     struct rcu_hash_table *htable = rcu_hash_new(data_free);
-    EXPECT_NE(htable, nullptr);
+    EXPECT_NE(htable, NULL);
 
     struct user_data *data = ALLOC(struct user_data, 1);
     data->id = 101;
@@ -35,7 +35,7 @@ TEST(rcu_hash_add_one_node, single_thread) {
 
     /* find in hash before commit */
     void *res = rcu_hash_find(htable, key, key_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     int ret = rcu_hash_count(htable);
     EXPECT_EQ(ret, 0);
@@ -51,7 +51,7 @@ TEST(rcu_hash_add_one_node, single_thread) {
 
     /* find in hash after commit */
     res = rcu_hash_find(htable, key, key_len);
-    EXPECT_NE(res, nullptr);
+    EXPECT_NE(res, NULL);
 
     struct user_data *res_data = (struct user_data *)res;
     EXPECT_EQ(res_data->id, 101);
@@ -72,7 +72,7 @@ TEST(rcu_hash_add_one_node, single_thread) {
 TEST(rcu_hash_add_multi_node, single_thread) {
     /* add multi node to hash */
     struct rcu_hash_table *htable = rcu_hash_new(data_free);
-    EXPECT_NE(htable, nullptr);
+    EXPECT_NE(htable, NULL);
 
     struct user_data *data0 = ALLOC(struct user_data, 1);
     data0->id = 101;
@@ -92,9 +92,9 @@ TEST(rcu_hash_add_multi_node, single_thread) {
 
     /* find in hash before commit */
     void *res = rcu_hash_find(htable, key0, key0_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
     res = rcu_hash_find(htable, key1, key1_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     int ret = rcu_hash_count(htable);
     EXPECT_EQ(ret, 0);
@@ -110,14 +110,14 @@ TEST(rcu_hash_add_multi_node, single_thread) {
 
     /* find in hash after commit */
     res = rcu_hash_find(htable, key0, key0_len);
-    EXPECT_NE(res, nullptr);
+    EXPECT_NE(res, NULL);
 
     struct user_data *res_data0 = (struct user_data *)res;
     EXPECT_EQ(res_data0->id, 101);
     EXPECT_STREQ(res_data0->name, "www.baidu.com");
 
     res = rcu_hash_find(htable, key1, key1_len);
-    EXPECT_NE(res, nullptr);
+    EXPECT_NE(res, NULL);
 
     struct user_data *res_data1 = (struct user_data *)res;
     EXPECT_EQ(res_data1->id, 102);
@@ -138,7 +138,7 @@ TEST(rcu_hash_add_multi_node, single_thread) {
 TEST(rcu_hash_del_one_node, single_thread) {
     /* case1: add and del before commit */
     struct rcu_hash_table *htable = rcu_hash_new(data_free);
-    EXPECT_NE(htable, nullptr);
+    EXPECT_NE(htable, NULL);
 
     struct user_data *data = ALLOC(struct user_data, 1);
     data->id = 101;
@@ -156,7 +156,7 @@ TEST(rcu_hash_del_one_node, single_thread) {
 
     /* find in hash before commit */
     void *res = rcu_hash_find(htable, key, key_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     ret = rcu_hash_count(htable);
     EXPECT_EQ(ret, 0);
@@ -173,7 +173,7 @@ TEST(rcu_hash_del_one_node, single_thread) {
 
     /* find in hash after commit */
     res = rcu_hash_find(htable, key, key_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     /* case2: add && commit, and del */
     struct user_data *data1 = ALLOC(struct user_data, 1);
@@ -190,7 +190,7 @@ TEST(rcu_hash_del_one_node, single_thread) {
     rcu_hash_del(htable, key1, key1_len);
 
     res = rcu_hash_find(htable, key1, key1_len);
-    EXPECT_NE(res, nullptr);
+    EXPECT_NE(res, NULL);
 
     struct user_data *res_data = (struct user_data *)res;
     EXPECT_EQ(res_data->id, 102);
@@ -205,7 +205,7 @@ TEST(rcu_hash_del_one_node, single_thread) {
     /* delete commit */
     rcu_hash_commit(htable);
     res = rcu_hash_find(htable, key1, key1_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     ret = rcu_hash_count(htable);
     EXPECT_EQ(ret, 0);
@@ -219,7 +219,7 @@ TEST(rcu_hash_del_one_node, single_thread) {
 TEST(rcu_hash_del_multi_node, single_thread) {
     /* case1: add and del before commit */
     struct rcu_hash_table *htable = rcu_hash_new(data_free);
-    EXPECT_NE(htable, nullptr);
+    EXPECT_NE(htable, NULL);
 
     struct user_data *data1 = ALLOC(struct user_data, 1);
     data1->id = 101;
@@ -239,7 +239,7 @@ TEST(rcu_hash_del_multi_node, single_thread) {
 
     /* find in hash before commit */
     void *res = rcu_hash_find(htable, key1, key1_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     int ret = rcu_hash_count(htable);
     EXPECT_EQ(ret, 0);
@@ -257,10 +257,10 @@ TEST(rcu_hash_del_multi_node, single_thread) {
 
     /* find in hash after commit */
     res = rcu_hash_find(htable, key1, key1_len);
-    EXPECT_EQ(res, nullptr);
+    EXPECT_EQ(res, NULL);
 
     res = rcu_hash_find(htable, key2, key2_len);
-    EXPECT_NE(res, nullptr);
+    EXPECT_NE(res, NULL);
 
     ret = rcu_hash_count(htable);
     EXPECT_EQ(ret, 1);

test/rule/full/HTTP_URL.000001

@@ -1,7 +0,0 @@
-0000000006
-101	1	hello	                    0  0  0  1
-102 2   maat                        0  0  0  1
-103 3   [W|w]orld                   2  0  0  1
-104 4   hello&world                 1  0  0  1
-105 5   [0-9]hello&world            2  0  0  1
-106 6   [0-9]hello&[0-9]world       2  0  0  1

test/rule/full/index/full_config_index.000001

@@ -1 +0,0 @@
-HTTP_URL	6	/home/liuwentan/project/maat-v4/test/rule/full/HTTP_URL.000001

test/table_info.conf

@@ -42,23 +42,7 @@
     },
     {
         "table_id":3,
-        "table_name":"HTTP_URL",
+        "table_name":"HTTP_URL_LITERAL",
-        "table_type":"expr",
-        "valid_column":7,
-        "custom": {
-            "scan_mode":"block",
-            "pattern_type":"literal",
-            "item_id":1,
-            "group_id":2,
-            "keywords":3,
-            "expr_type":4,
-            "match_method":5,
-            "is_hexbin":6
-        }
-    },  
-    {
-        "table_id":3,
-        "table_name":"HTTP_HOST",
         "table_type":"expr",
         "valid_column":7,
         "custom": {
@@ -74,7 +58,7 @@
     },
     {
         "table_id":4,
-        "table_name":"KEYWORDS_TABLE",
+        "table_name":"HTTP_URL_REGEX",
         "table_type":"expr",
         "valid_column":7,
         "custom": {
@@ -90,6 +74,38 @@
     },
     {
         "table_id":5,
+        "table_name":"HTTP_HOST",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "scan_mode":"block",
+            "pattern_type":"literal",
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    }, 
+    {
+        "table_id":6,
+        "table_name":"KEYWORDS_TABLE",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "scan_mode":"block",
+            "pattern_type":"literal",
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":7,
         "table_name":"IP_CONFIG",
         "table_type":"ip_plus",
         "valid_column":18,
@@ -103,7 +119,7 @@
         }
     },
     {
-        "table_id":6,
+        "table_id":8,
         "table_name":"CONTENT_SIZE",
         "table_type":"intval",
         "valid_column":5,
@@ -115,7 +131,7 @@
         }
     },
     {
-        "table_id":7,
+        "table_id":9,
         "table_name":"QD_ENTRY_INFO",
         "table_type":"plugin",
         "valid_column":4,
@@ -125,7 +141,7 @@
         }
     },
     {
-        "table_id":9,
+        "table_id":10,
         "table_name":"HTTP_SIGNATURE",
         "table_type":"expr_plus",
         "valid_column":8,

vendor/CMakeLists.txt

@@ -84,7 +84,7 @@ file(MAKE_DIRECTORY ${VENDOR_BUILD}/include)
 
 add_library(hiredis-static STATIC IMPORTED GLOBAL)
 add_dependencies(hiredis-static hiredis)
-set_property(TARGET hiredis-static  PROPERTY IMPORTED_LOCATION ${VENDOR_BUILD}/lib64/libhiredis.a)
+set_property(TARGET hiredis-static  PROPERTY IMPORTED_LOCATION ${VENDOR_BUILD}/lib64/libhiredisd.a)
 set_property(TARGET hiredis-static  PROPERTY INTERFACE_INCLUDE_DIRECTORIES ${VENDOR_BUILD}/include)
 
 #igraph-0.7.1