diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp index 6902f47..24cf918 100644 --- a/src/tsg_entry.cpp +++ b/src/tsg_entry.cpp @@ -740,13 +740,13 @@ int session_application_full_path_combine(struct gather_app_result *gather_resul int offset=0,combined_num=0; unsigned int combined_array[COMBINED_APP_ID_NUM]={0}; - if(gather_result->l7_protocol_num>0) + if(gather_result->l7_protocol_num>=gather_result->l7_qm_engine_num) { combined_num+=copy_app_id(gather_result->l7_protocol, gather_result->l7_protocol_num, combined_array, COMBINED_APP_ID_NUM); } else { - combined_num+=copy_app_id(gather_result->qm_engine, gather_result->l7_protocol_num, combined_array, COMBINED_APP_ID_NUM); + combined_num+=copy_app_id(gather_result->qm_engine, gather_result->l7_qm_engine_num, combined_array, COMBINED_APP_ID_NUM); } if(gather_result->matched_app_flag > 0) @@ -765,10 +765,10 @@ int session_application_full_path_combine(struct gather_app_result *gather_resul { combined_num+=copy_app_id(gather_result->built_in, gather_result->built_in_num, combined_array+combined_num, COMBINED_APP_ID_NUM-combined_num); } - else if(gather_result->qm_engine_num-gather_result->l7_protocol_num > 0) + else if(gather_result->qm_engine_num-gather_result->l7_qm_engine_num > 0) { - combined_num+=copy_app_id( gather_result->qm_engine + gather_result->l7_protocol_num, - gather_result->qm_engine_num - gather_result->l7_protocol_num, + combined_num+=copy_app_id( gather_result->qm_engine + gather_result->l7_qm_engine_num, + gather_result->qm_engine_num - gather_result->l7_qm_engine_num, combined_array+combined_num, COMBINED_APP_ID_NUM-combined_num ); diff --git a/test/bin/gtest_maat.json b/test/bin/gtest_maat.json index 1694d91..8d14882 100644 --- a/test/bin/gtest_maat.json +++ b/test/bin/gtest_maat.json @@ -2311,6 +2311,10 @@ "67\thttp\t0\tnull\tnetworking\tinfrastructure\tnetwork-protocol\t3\tused-by-malware,vulnerability,widely-used\tnull\tnull\t{\"method\":\"drop\",\"after_n_packets\":0,\"send_icmp_unreachable\":1,\"send_tcp_reset\":1}\t0\t60\t120\t30\t30\t1", "68\thttps\t0\tnull\tnetworking\tinfrastructure\tnetwork-protocol\t3\tused-by-malware,vulnerability,widely-used\tnull\tnull\t{\"method\":\"rate_limit\",\"bps\":1000}\t0\t0\t0\t0\t0\t1", "4\tunknown\t0\tnull\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\tnull\t1\t3600\t3600\t1800\t1800\t1", + "199\tssl\t0\tnull\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\tnull\t1\t3600\t3600\t1800\t1800\t1", + "240\tyoutube\t0\tnull\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\tnull\t1\t3600\t3600\t1800\t1800\t1", + "15009\tuser_define_youtube\t0\tnull\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\tnull\t1\t3600\t3600\t1800\t1800\t1", + "1500\tbuilt_in_youtube\t0\tnull\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\tnull\t1\t3600\t3600\t1800\t1800\t1", "70\thttps\t1\tssl\tnetworking\tinfrastructure\tnetwork-protocol\t3\tused-by-malware,vulnerability,widely-used\tnull\tnull\t{\"method\":\"rate_limit\",\"bps\":1000}\t0\t0\t0\t0\t0\t1" ] }, diff --git a/test/src/gtest_master.cpp b/test/src/gtest_master.cpp index 4a59f8f..157e251 100644 --- a/test/src/gtest_master.cpp +++ b/test/src/gtest_master.cpp @@ -1008,6 +1008,102 @@ TEST(TSGMaster, SessionApplicationMetrics) } +extern int session_application_full_path_combine(struct gather_app_result * gather_result, char * out_full_path, int out_full_path_len); + +TEST(TSGMaster, SessionApplicationFullPath) +{ + char out_full_path[256]={0}; + int out_full_path_len=sizeof(out_full_path); + struct gather_app_result gather_result={0}; + + gather_result.l7_protocol_num=1; + struct app_attributes l7_protocol={68, 0, 4}; + gather_result.l7_protocol=&l7_protocol; + + gather_result.qm_engine_num=3; + gather_result.l7_qm_engine_num=2; + struct app_attributes qm_engine[3]={{199, 0, 6}, {68, 0, 4}, {240, 0, 6}}; + gather_result.qm_engine=qm_engine; + + int offset=session_application_full_path_combine(&gather_result, out_full_path, out_full_path_len); + EXPECT_NE(0, offset); + EXPECT_STREQ("ssl.https.youtube", out_full_path); + + // l7 protocol is empty + gather_result.l7_protocol_num=0; + gather_result.l7_protocol=NULL; + + gather_result.qm_engine_num=3; + gather_result.l7_qm_engine_num=0; + struct app_attributes qm_engine2[3]={{199, 0, 6}, {68, 0, 4}, {240, 0, 6}}; + gather_result.qm_engine=qm_engine2; + + offset=session_application_full_path_combine(&gather_result, out_full_path, out_full_path_len); + EXPECT_NE(0, offset); + EXPECT_STREQ("ssl.https.youtube", out_full_path); + + // matched application + gather_result.l7_protocol_num=1; + struct app_attributes l7_protocol_3={68, 0, 4}; + gather_result.l7_protocol=&l7_protocol_3; + + gather_result.qm_engine_num=3; + gather_result.l7_qm_engine_num=2; + struct app_attributes qm_engine3[3]={{199, 0, 6}, {68, 0, 4}, {240, 0, 6}}; + gather_result.qm_engine=qm_engine3; + + gather_result.matched_app_flag=1; + gather_result.matched_app={240, 0, 6}; + + struct app_attributes user_define_3={15009, 0, 4}; + gather_result.user_define_num=1; + gather_result.user_define=&user_define_3; + + offset=session_application_full_path_combine(&gather_result, out_full_path, out_full_path_len); + EXPECT_NE(0, offset); + EXPECT_STREQ("ssl.https.youtube", out_full_path); + + //userdefine application + gather_result.l7_protocol_num=1; + struct app_attributes l7_protocol_4={68, 0, 4}; + gather_result.l7_protocol=&l7_protocol_4; + + gather_result.qm_engine_num=3; + gather_result.l7_qm_engine_num=2; + struct app_attributes qm_engine4[3]={{199, 0, 6}, {68, 0, 4}, {240, 0, 6}}; + gather_result.qm_engine=qm_engine4; + + gather_result.matched_app_flag=0; + + struct app_attributes user_define_4={15009, 0, 4}; + gather_result.user_define_num=1; + gather_result.user_define=&user_define_4; + + offset=session_application_full_path_combine(&gather_result, out_full_path, out_full_path_len); + EXPECT_NE(0, offset); + EXPECT_STREQ("ssl.https.user_define_youtube", out_full_path); + + // built in application + gather_result.l7_protocol_num=1; + struct app_attributes l7_protocol_5={68, 0, 4}; + gather_result.l7_protocol=&l7_protocol_5; + + gather_result.qm_engine_num=3; + gather_result.l7_qm_engine_num=2; + struct app_attributes qm_engine5[3]={{199, 0, 6}, {68, 0, 4}, {240, 0, 6}}; + gather_result.qm_engine=qm_engine5; + + gather_result.matched_app_flag=0; + + struct app_attributes user_define_5={1500, 0, 4}; + gather_result.user_define_num=1; + gather_result.user_define=&user_define_5; + + offset=session_application_full_path_combine(&gather_result, out_full_path, out_full_path_len); + EXPECT_NE(0, offset); + EXPECT_STREQ("ssl.https.built_in_youtube", out_full_path); +} + int main(int argc, char *argv[]) { TSG_MASTER_INIT();