fix: 调整 application export 格式，asw condition 和 tsg object 一对一

1 files changed, 193 insertions, 177 deletions

diff --git a/src/main/java/net/geedge/asw/module/app/service/impl/TSGApplicationServiceImpl.java b/src/main/java/net/geedge/asw/module/app/service/impl/TSGApplicationServiceImpl.java
index 7e89c9c..da42a17 100644
--- a/src/main/java/net/geedge/asw/module/app/service/impl/TSGApplicationServiceImpl.java
+++ b/src/main/java/net/geedge/asw/module/app/service/impl/TSGApplicationServiceImpl.java
@@ -159,53 +159,56 @@ public class TSGApplicationServiceImpl implements ITSGApplicationService {
                             .build();
 
                     List<Integer> source_object_ids = T.ListUtil.list(true);
+
                     // sig_objects
                     JSONArray items = conditionJSONObj.getJSONArray("items");
-                    for (Object item : items) {
-                        String name = T.MapUtil.getStr((JSONObject) item, "item");
-
-                        String objectType = attributeEntity.getObjectType();
-                        if ("application" .equalsIgnoreCase(objectType)) continue;
-
-                        if ("boolean" .equals(objectType)) {
-                            String itemValue = T.MapUtil.getStr((JSONObject) item, "item");
-                            if ("True" .equalsIgnoreCase(itemValue)) {
-                                source_object_ids.add(2);
-                            } else if ("False" .equalsIgnoreCase(itemValue)) {
-                                source_object_ids.add(3);
-                            } else {
-                                continue;
-                            }
-                        } else if ("ip_protocol" .equals(objectType)) {
-                            String itemValue = T.MapUtil.getStr((JSONObject) item, "item");
-                            if ("ICMP" .equalsIgnoreCase(itemValue)) {
-                                source_object_ids.add(5);
-                            } else if ("TCP" .equalsIgnoreCase(itemValue)) {
-                                source_object_ids.add(6);
-                            } else if ("UDP" .equalsIgnoreCase(itemValue)) {
-                                source_object_ids.add(7);
-                            } else {
-                                continue;
-                            }
-                        } else {
-                            source_object_ids.add(sig_object_id);
-
-                            Map<Object, Object> member = this.buildTSG2402SignaturesMember(attributeEntity, (JSONObject) item);
-
-                            Map<Object, Object> sig_object = T.MapUtil.builder()
-                                    .put("id", sig_object_id)
-                                    .put("source_id", sig_object_id)
-                                    .put("name", name)
-                                    .put("source_name", name)
-                                    .put("type", objectType)
-                                    .put("sub_type", attributeEntity.getType())
-                                    .put("member_type", "item")
-                                    .put("member", member)
-                                    .put("uuid", T.IdUtil.fastSimpleUUID())
-                                    .put("statistics_option", "none")
-                                    .build();
-                            sig_objects.add(sig_object);
-                        }
+
+                    String conditionType = attributeEntity.getObjectType();
+                    if ("application".equalsIgnoreCase(conditionType)) {
+                        continue;
+                    } else if ("boolean".equals(conditionType)) {
+                        items.stream()
+                                .map(obj -> (JSONObject) obj)
+                                .forEach(item -> {
+                                    String itemValue = T.MapUtil.getStr((JSONObject) item, "item");
+                                    if ("True".equalsIgnoreCase(itemValue)) {
+                                        source_object_ids.add(2);
+                                    } else if ("False".equalsIgnoreCase(itemValue)) {
+                                        source_object_ids.add(3);
+                                    }
+                                });
+                    } else if ("ip_protocol".equals(conditionType)) {
+                        items.stream()
+                                .map(obj -> (JSONObject) obj)
+                                .forEach(item -> {
+                                    String itemValue = T.MapUtil.getStr((JSONObject) item, "item");
+                                    if ("ICMP".equalsIgnoreCase(itemValue)) {
+                                        source_object_ids.add(5);
+                                    } else if ("TCP".equalsIgnoreCase(itemValue)) {
+                                        source_object_ids.add(6);
+                                    } else if ("UDP".equalsIgnoreCase(itemValue)) {
+                                        source_object_ids.add(7);
+                                    }
+                                });
+                    } else {
+                        String name = T.MapUtil.getStr((JSONObject) items.getFirst(), "item");
+                        Map<Object, Object> sig_object = T.MapUtil.builder()
+                                .put("id", sig_object_id)
+                                .put("source_id", sig_object_id)
+                                .put("name", name)
+                                .put("source_name", name)
+                                .put("type", conditionType)
+                                .put("sub_type", attributeEntity.getType())
+                                .put("member_type", "item")
+                                .put("uuid", T.IdUtil.fastSimpleUUID())
+                                .put("statistics_option", "none")
+                                .build();
+
+                        Map<Object, Object> member = this.buildTSG2402SignaturesMember(attributeEntity, items);
+                        sig_object.put("member", member);
+
+                        sig_objects.add(sig_object);
+                        source_object_ids.add(sig_object_id);
                         sig_object_id++;
                     }
 
@@ -217,8 +220,10 @@ public class TSGApplicationServiceImpl implements ITSGApplicationService {
                     and_conditions.add(and_condition_item);
                 }
 
-                m.put("and_conditions", and_conditions);
-                signatures.add(m);
+                if (T.CollUtil.isNotEmpty(and_conditions)) {
+                    m.put("and_conditions", and_conditions);
+                    signatures.add(m);
+                }
             }
         }
         sig_objects.add(T.JSONUtil.parseObj("""
@@ -298,139 +303,143 @@ public class TSGApplicationServiceImpl implements ITSGApplicationService {
         return m;
     }
 
-    private Map<Object, Object> buildTSG2402SignaturesMember(AttributeEntity attributeEntity, JSONObject item) {
+    private Map<Object, Object> buildTSG2402SignaturesMember(AttributeEntity attributeEntity, JSONArray itemArr) {
         List<Object> list = T.ListUtil.list(true);
-        String objectType = attributeEntity.getObjectType().toLowerCase();
-        switch (objectType) {
-            case "keywords":
-            case "http_signature": {
-                String str = item.getStr("item");
-                List<String> patternExprList = T.ListUtil.list(true);
-                patternExprList.add(str);
-
-                // 0 -> 无表达式，1 -> 与表达式，2 -> 正则表达式，3、带偏移量的子串匹配
-                int expr_type = 0;
-                String exprType = item.getStr("exprType", "and");
-                if ("and" .equalsIgnoreCase(exprType)) {
-                    patternExprList = T.StrUtil.split(str, "&");
-                    if (patternExprList.size() > 1) {
-                        expr_type = 1;
-                    }
-                } else if ("regex" .equalsIgnoreCase(exprType)) {
-                    expr_type = 2;
-                }
+        itemArr.stream()
+                .map(obj -> (JSONObject) obj)
+                .forEach(item -> {
+                    String objectType = attributeEntity.getObjectType().toLowerCase();
+                    switch (objectType) {
+                        case "keywords":
+                        case "http_signature": {
+                            String str = item.getStr("item");
+                            List<String> patternExprList = T.ListUtil.list(true);
+                            patternExprList.add(str);
+
+                            // 0 -> 无表达式，1 -> 与表达式，2 -> 正则表达式，3、带偏移量的子串匹配
+                            int expr_type = 0;
+                            String exprType = item.getStr("exprType", "and");
+                            if ("and".equalsIgnoreCase(exprType)) {
+                                patternExprList = T.StrUtil.split(str, "&");
+                                if (patternExprList.size() > 1) {
+                                    expr_type = 1;
+                                }
+                            } else if ("regex".equalsIgnoreCase(exprType)) {
+                                expr_type = 2;
+                            }
 
-                JSONArray patternArr = new JSONArray();
-                for (String expr : patternExprList) {
-                    JSONObject pattern = new JSONObject();
-                    pattern.put("keywords", expr);
-
-                    Map<String, String> rangeVarMap = this.getRangeVarFromExpr(expr);
-                    if (T.MapUtil.isNotEmpty(rangeVarMap)) {
-                        expr_type = 3;
-                        pattern.put("keywords", expr.replaceAll("^\\(.*?\\)", ""));
-                        pattern.put("offset", T.MapUtil.getInt(rangeVarMap, "offset"));
-                        pattern.put("depth", T.MapUtil.getInt(rangeVarMap, "depth"));
-                    }
-                    patternArr.add(pattern);
-                }
+                            JSONArray patternArr = new JSONArray();
+                            for (String expr : patternExprList) {
+                                JSONObject pattern = new JSONObject();
+                                pattern.put("keywords", expr);
+
+                                Map<String, String> rangeVarMap = this.getRangeVarFromExpr(expr);
+                                if (T.MapUtil.isNotEmpty(rangeVarMap)) {
+                                    expr_type = 3;
+                                    pattern.put("keywords", expr.replaceAll("^\\(.*?\\)", ""));
+                                    pattern.put("offset", T.MapUtil.getInt(rangeVarMap, "offset"));
+                                    pattern.put("depth", T.MapUtil.getInt(rangeVarMap, "depth"));
+                                }
+                                patternArr.add(pattern);
+                            }
 
-                if ("keywords" .equals(objectType)) {
-                    Map<Object, Object> m = T.MapUtil.builder()
-                            .put("string", T.MapUtil.builder()
-                                    .put("item_type", "keywords")
-                                    .put("expr_type", expr_type)
-                                    .put("is_hexbin", 0)
-                                    .put("patterns", patternArr)
-                                    .build()
-                            ).build();
-                    list.add(m);
-                }
-                if("http_signature".equals(objectType)){
-                    Map<Object, Object> m = T.MapUtil.builder()
-                            .put("contextual_string", T.MapUtil.builder()
-                                    .put("expr_type", expr_type)
-                                    .put("is_hexbin", 0)
-                                    .put("context_name", item.getStr("district", "Set-Cookie"))
-                                    .put("patterns", patternArr)
-                                    .build()
-                            )
-                            .build();
-                    list.add(m);
-                }
-                break;
-            }
-            case "url":
-            case "fqdn": {
-                Map<Object, Object> m = T.MapUtil.builder()
-                        .put("string", T.MapUtil.builder()
-                                .put("item_type", objectType)
-                                .put("expr_type", 0)
-                                .put("is_hexbin", 0)
-                                .put("patterns", T.ListUtil.of(
-                                        new JSONObject().put("keywords", item.getStr("item"))
-                                ))
-                                .build()
-                        )
-                        .build();
-                list.add(m);
-                break;
-            }
-            case "ip": {
-                String str = item.getStr("item");
-                String ip = str;
-                String port = "0-65535";
-                if (str.contains("#")) {
-                    ip = str.split("#")[0];
-                    port = str.split("#")[1];
-                }
-                Map<Object, Object> m = T.MapUtil.builder()
-                        .put("ip", T.MapUtil.builder()
-                                .put("addr_type", Validator.isIpv4(str) ? 4 : 6)
-                                .put("port", port)
-                                .put("ip_address", ip)
-                                .build()
-                        )
-                        .build();
-                list.add(m);
-                break;
-            }
-            case "port": {
-                String port = item.getStr("item");
-                Map<Object, Object> m = T.MapUtil.builder()
-                        .put("port", new JSONObject().put("port", port))
-                        .build();
-                if (port.contains("-")) {
-                    m.put("port", new JSONObject().put("port_range", port));
-                }
-                list.add(m);
-                break;
-            }
-            case "interval": {
-                String str = item.getStr("item");
-                String low_boundary = str, up_boundary = str;
-                if (str.contains("-")) {
-                    low_boundary = item.getStr("item").split("-")[0];
-                    up_boundary = item.getStr("item").split("-")[1];
-                }
-                Map<Object, Object> m = T.MapUtil.builder()
-                        .put("interval", T.MapUtil.builder()
-                                .put("low_boundary", low_boundary)
-                                .put("up_boundary", up_boundary)
-                                .build()
-                        )
-                        .build();
-                list.add(m);
-                break;
-            }
-            case "boolean":
-            case "ip_protocol":
-            case "application": {
-                break;
-            }
-            default:
-                break;
-        }
+                            if ("keywords".equals(objectType)) {
+                                Map<Object, Object> m = T.MapUtil.builder()
+                                        .put("string", T.MapUtil.builder()
+                                                .put("item_type", "keywords")
+                                                .put("expr_type", expr_type)
+                                                .put("is_hexbin", 0)
+                                                .put("patterns", patternArr)
+                                                .build()
+                                        ).build();
+                                list.add(m);
+                            }
+                            if ("http_signature".equals(objectType)) {
+                                Map<Object, Object> m = T.MapUtil.builder()
+                                        .put("contextual_string", T.MapUtil.builder()
+                                                .put("expr_type", expr_type)
+                                                .put("is_hexbin", 0)
+                                                .put("context_name", item.getStr("district", "Set-Cookie"))
+                                                .put("patterns", patternArr)
+                                                .build()
+                                        )
+                                        .build();
+                                list.add(m);
+                            }
+                            break;
+                        }
+                        case "url":
+                        case "fqdn": {
+                            Map<Object, Object> m = T.MapUtil.builder()
+                                    .put("string", T.MapUtil.builder()
+                                            .put("item_type", objectType)
+                                            .put("expr_type", 0)
+                                            .put("is_hexbin", 0)
+                                            .put("patterns", T.ListUtil.of(
+                                                    new JSONObject().put("keywords", item.getStr("item"))
+                                            ))
+                                            .build()
+                                    )
+                                    .build();
+                            list.add(m);
+                            break;
+                        }
+                        case "ip": {
+                            String str = item.getStr("item");
+                            String ip = str;
+                            String port = "0-65535";
+                            if (str.contains("#")) {
+                                ip = str.split("#")[0];
+                                port = str.split("#")[1];
+                            }
+                            Map<Object, Object> m = T.MapUtil.builder()
+                                    .put("ip", T.MapUtil.builder()
+                                            .put("addr_type", Validator.isIpv4(str) ? 4 : 6)
+                                            .put("port", port)
+                                            .put("ip_address", ip)
+                                            .build()
+                                    )
+                                    .build();
+                            list.add(m);
+                            break;
+                        }
+                        case "port": {
+                            String port = item.getStr("item");
+                            Map<Object, Object> m = T.MapUtil.builder()
+                                    .put("port", new JSONObject().put("port", port))
+                                    .build();
+                            if (port.contains("-")) {
+                                m.put("port", new JSONObject().put("port_range", port));
+                            }
+                            list.add(m);
+                            break;
+                        }
+                        case "interval": {
+                            String str = item.getStr("item");
+                            String low_boundary = str, up_boundary = str;
+                            if (str.contains("-")) {
+                                low_boundary = item.getStr("item").split("-")[0];
+                                up_boundary = item.getStr("item").split("-")[1];
+                            }
+                            Map<Object, Object> m = T.MapUtil.builder()
+                                    .put("interval", T.MapUtil.builder()
+                                            .put("low_boundary", low_boundary)
+                                            .put("up_boundary", up_boundary)
+                                            .build()
+                                    )
+                                    .build();
+                            list.add(m);
+                            break;
+                        }
+                        case "boolean":
+                        case "ip_protocol":
+                        case "application": {
+                            break;
+                        }
+                        default:
+                            break;
+                    }
+                });
 
         Map<Object, Object> member = T.MapUtil.builder()
                 .put("items", list)
@@ -467,6 +476,13 @@ public class TSGApplicationServiceImpl implements ITSGApplicationService {
         return new HashMap<>();
     }
 
+// ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+// ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+// ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+// ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+// ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+// ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+
     @Override
     @Transactional(rollbackFor = Exception.class)
     public List<ApplicationEntity> tsg2402ToAsw(String workspaceId, List<JSONObject> dataList) {