summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
authorroot <[email protected]>2024-08-22 07:35:53 +0000
committerroot <[email protected]>2024-08-22 07:35:53 +0000
commite538f5bb5209c264fdef4b49fee957ea5feaa0ed (patch)
tree92d7d5be80341ed53085f52f34be4586f0437c5f /docs
parentf660e6b2ac772ff6dcc8525e3d40ebbdff73a670 (diff)
rename terminology "clause" to "condition"
Diffstat (limited to 'docs')
-rw-r--r--docs/api_reference.md4
-rw-r--r--docs/getting_started.md4
-rw-r--r--docs/history.md2
-rw-r--r--docs/logical_combinations.md42
-rw-r--r--docs/maat_table.md44
-rw-r--r--docs/monitor_tools.md2
-rw-r--r--docs/overview.md4
-rw-r--r--docs/terminology.md12
8 files changed, 57 insertions, 57 deletions
diff --git a/docs/api_reference.md b/docs/api_reference.md
index c21d138..91376d1 100644
--- a/docs/api_reference.md
+++ b/docs/api_reference.md
@@ -861,9 +861,9 @@ int maat_scan_not_logic(struct maat *instance, int table_id,
size_t *n_hit_result, struct maat_state *state);
```
-If the rule configuration contains NOT-clauses, this interface needs to be called to activate the calculation of rule_id involving NOT-clauses. This means that other scanning interfaces will not activate NOT-clauses except for calling this interface. When to call this interface is determined by the caller. For example, on a session, four packets were scanned with maat_scan_string and three rule_id were hit. The NOT-clause was expected to be activated, so this interface was called and two new rule_id were hit.
+If the rule configuration contains NOT-conditions, this interface needs to be called to activate the calculation of rule_id involving NOT-conditions. This means that other scanning interfaces will not activate NOT-conditions except for calling this interface. When to call this interface is determined by the caller. For example, on a session, four packets were scanned with maat_scan_string and three rule_id were hit. The NOT-condition was expected to be activated, so this interface was called and two new rule_id were hit.
-Since this interface only activates non-clauses and does not call the underlying scanning engine to perform actual scanning tasks, there is no data to be scanned.
+Since this interface only activates non-conditions and does not call the underlying scanning engine to perform actual scanning tasks, there is no data to be scanned.
### maat_stream_new
diff --git a/docs/getting_started.md b/docs/getting_started.md
index 49cb606..dce8e43 100644
--- a/docs/getting_started.md
+++ b/docs/getting_started.md
@@ -48,7 +48,7 @@ Table schema is stored in a json file(such as table_info.conf), which is loaded
"custom": {
"rule_id":1,
"tags":6,
- "clause_num":9
+ "condition_num":9
}
},
{
@@ -62,7 +62,7 @@ Table schema is stored in a json file(such as table_info.conf), which is loaded
"rule_id":2,
"not_flag":4,
"attribute_name":5,
- "clause_index":6
+ "condition_index":6
}
},
{
diff --git a/docs/history.md b/docs/history.md
index 84d4c75..429a429 100644
--- a/docs/history.md
+++ b/docs/history.md
@@ -11,7 +11,7 @@
| v3.1.1 | 2020-9-27 | Add explanation for creating attributes on multiple different types of physical tables | Zheng Chao |
| v3.1.0 | 2020-9-18 | Add FQDN callback table | Zheng Chao |
| v3.0.4 | 2020-8-17 | Add extended numerical domain configuration interval_plus | Zheng Chao |
-| v3.0 | 2020-6-29 | Maat 3.0, support clauses, original grouping table split into grouping relationship table and grouping compilation table | Zheng Chao |
+| v3.0 | 2020-6-29 | Maat 3.0, support conditions, original grouping table split into grouping relationship table and grouping compilation table | Zheng Chao |
| v2.8 | 2020-3-13 | Support composite tables | Zheng Chao |
| v2.8 | 2020-2-11 | Support Hit Path | Zheng Chao |
| v2.8 | 2020-2-4 | Support sorting strategies by Evaluation Order | Zheng Chao |
diff --git a/docs/logical_combinations.md b/docs/logical_combinations.md
index 0716393..2f4064f 100644
--- a/docs/logical_combinations.md
+++ b/docs/logical_combinations.md
@@ -33,7 +33,7 @@ Before showing how to configure the specific rules, we need some raw materials (
## AND logic
-`Note`: Each rule supports a maximum of 8 clauses, which are connected by the logical 'AND' relationship, with clause index ranging from 0 to 7.
+`Note`: Each rule supports a maximum of 8 conditions, which are connected by the logical 'AND' relationship, with condition index ranging from 0 to 7.
* case1: Deny hosts with source IP addresses in the range of 192.168.1.11 to 192.168.1.20 from accessing the website www.baidu.com.
@@ -41,8 +41,8 @@ Before showing how to configure the specific rules, we need some raw materials (
* www.baidu.com => group_id(201)
```bash
-rule(rule) = clause1 & clause2
- = {attribute1, group1, clause_index1} & {attribute2, group2, clause_index2}
+rule(rule) = condition1 & condition2
+ = {attribute1, group1, condition_index1} & {attribute2, group2, condition_index2}
= {2, 211, 1} & {1, 201, 2}
```
@@ -52,19 +52,19 @@ rule(rule) = clause1 & clause2
* 端口80 ~ 80 => group_id(221)
```bash
-rule(rule) = clause1 & clause2
- = {attribute1, group1, clause_index1} & {attribute2, group2, clause_index2}
+rule(rule) = condition1 & condition2
+ = {attribute1, group1, condition_index1} & {attribute2, group2, condition_index2}
= {2, 211, 1} & {3, 221, 2}
```
The JSON configuration for the logical `AND` can be referenced at [unit_test Json configuration](../test/maat_json.json) with rule_id=152.
-group_name: "152_mail_addr" and group_name: "interval_group_refered" are two clauses of this rule, with a logical `AND` relationship between them.
+group_name: "152_mail_addr" and group_name: "interval_group_refered" are two conditions of this rule, with a logical `AND` relationship between them.
## OR logic
-`Note`: Multiple groups under the same clause have a logical 'OR' relationship.
+`Note`: Multiple groups under the same condition have a logical 'OR' relationship.
* case1: Deny hosts with source IP addresses in the range of 192.168.1.11 to 192.168.1.30 from accessing the website www.baidu.com.
@@ -73,8 +73,8 @@ group_name: "152_mail_addr" and group_name: "interval_group_refered" are two cla
* www.baidu.com => group_id(201)
```bash
-rule(rule) = clause1 & clause2
- = {attribute1, (group1 | group2), clause_index1} & {attribute2, group3, clause_index2}
+rule(rule) = condition1 & condition2
+ = {attribute1, (group1 | group2), condition_index1} & {attribute2, group3, condition_index2}
= {2, (211 | 212), 1} & {1, 201, 2}
```
@@ -85,8 +85,8 @@ rule(rule) = clause1 & clause2
* port 443 ~ 443 => group_id(222)
```bash
-rule(rule) = clause1 & clause2
- = {attribute1, group1, clause_index1} & {attribute2, (group2 | group3), clause_index2}
+rule(rule) = condition1 & condition2
+ = {attribute1, group1, condition_index1} & {attribute2, (group2 | group3), condition_index2}
= {2, 211, 1} & {3, (221 | 222), 2}
```
@@ -97,7 +97,7 @@ group_name: "152_mail_addr" contains two regions(items) with a logical `OR` rela
## NOT logic
-`Note`: Only clauses can support NOT-logic.
+`Note`: Only conditions can support NOT-logic.
* case1: Hosts with source ip addresses ranging from 192.168.1.11 to 192.168.1.20 are allowed to access websites other than www.baidu.com.
@@ -105,8 +105,8 @@ group_name: "152_mail_addr" contains two regions(items) with a logical `OR` rela
* www.baidu.com => group_id(201)
```bash
-rule(rule) = clause1 & !clause2
- = {attribute1, group1, clause_index1} & !{attribute2, group2, clause_index2}
+rule(rule) = condition1 & !condition2
+ = {attribute1, group1, condition_index1} & !{attribute2, group2, condition_index2}
= {2, 211, 1} & !{1, 201, 2}
```
@@ -117,14 +117,14 @@ rule(rule) = clause1 & !clause2
* port 443 ~ 443 => group_id(222)
```bash
-rule(rule) = clause1 & !clause2
- = {attribute1, group1, clause_index1} & !{attribute2, (group2 | group3), clause_index2}
+rule(rule) = condition1 & !condition2
+ = {attribute1, group1, condition_index1} & !{attribute2, (group2 | group3), condition_index2}
= {2, 211, 1} & !{3, (221 | 222), 2}
```
The JSON configuration for the logical `OR` can be referenced at [unit_test Json configuration](../test/maat_json.json) with rule_id=145.
-The group_name: "123_IP_group" is a NOT clause of this rule.
+The group_name: "123_IP_group" is a NOT condition of this rule.
## Group exclude
@@ -147,8 +147,8 @@ super_group1 = group1 exclude group2
And then configure the rule.
```bash
-rule(rule) = clause1 & clause2
- = {attribute1, super_group1, clause_index1} & {attribute2, group2, clause_index2}
+rule(rule) = condition1 & condition2
+ = {attribute1, super_group1, condition_index1} & {attribute2, group2, condition_index2}
= {2, (210 exclude 211), 1} & {1, 201, 2}
```
@@ -166,8 +166,8 @@ super_group2 = group2 exclude group3
And then configure the rule.
```bash
-rule(rule) = clause1 & clause2
- = {attribute1, group1, clause_index1} & {attribute2, super_group2, clause_index2}
+rule(rule) = condition1 & condition2
+ = {attribute1, group1, condition_index1} & {attribute2, super_group2, condition_index2}
= {2, 211, 1} & {1, (202 exclude 201), 2}
```
diff --git a/docs/maat_table.md b/docs/maat_table.md
index 06763ea..cf34468 100644
--- a/docs/maat_table.md
+++ b/docs/maat_table.md
@@ -245,7 +245,7 @@ Describe the specific policy, one maat instance can has multiple rule tables wit
| **rule_id** | LONG LONG | primary key, rule id |
| **tags** | VARCHAR2(1024) | default 0,means no tag |
| **is_valid** | INT | 0(invalid),1(valid) |
-| **clause_num** | INT | no more than 8 clauses |
+| **condition_num** | INT | no more than 8 conditions |
### 1.3 <a name='Group2RuleTable'></a> group2rule table
@@ -256,9 +256,9 @@ Describe the relationship between group and rule.
| **group_ids** | VARCHAR(256) | group ids are separated by commas(g1,g2,g3) |
| **rule_id** | LONG LONG | rule id |
| **is_valid** | INT | 0(invalid), 1(valid) |
-| **not_flag** | INT | logical 'NOT', identify a NOT clause, 0(no) 1(yes) |
+| **not_flag** | INT | logical 'NOT', identify a NOT condition, 0(no) 1(yes) |
| **attribute** | VARCHAR2(256) | attribute name, NOT NULL |
-| **Nth_clause** | INT | the clause seq in (conjunctive normal form)CNF, from 0 to 7. groups with the same clause ID are logical 'OR' |
+| **Nth_condition** | INT | the condition seq in (conjunctive normal form)CNF, from 0 to 7. groups with the same condition ID are logical 'OR' |
NOTE: If group_id is invalid in xx_item table, it must be marked as invalid in this table.
@@ -441,25 +441,25 @@ The `group2group_runtime` is a runtime that is built based on the reference rela
In addition to the rule table, there is also the group2rule table in the table schema. However, from a runtime perspective, the configurations of these two tables together constitute rule_runtime. This means that there is no standalone group2rule_runtime. Rule_runtime is the most complex among all runtime types because it serves multiple functions.
-**Note:** This will involve the terminology of [clause](./terminology.md#clause).
+**Note:** This will involve the terminology of [condition](./terminology.md#condition).
-1. For expressions without NOT-clauses, returning the matched rule_id:
+1. For expressions without NOT-conditions, returning the matched rule_id:
- * rule1 = clause1 & clause2 = {attribute1, g1} & {attribute2, g2}
+ * rule1 = condition1 & condition2 = {attribute1, g1} & {attribute2, g2}
- * rule2 = clause1 & clause2 = {attribute1, g2} & {attribute2, g3}
+ * rule2 = condition1 & condition2 = {attribute1, g2} & {attribute2, g3}
Given the matched attribute_id and group_id, all matching rule_ids can be provided. For example, if scanning attribute1 matches g2 and attribute2 matches g3, rule_runtime will return the matched rule_id 2.
-2. For expressions with NOT-clauses, returning the matched rule_id:
+2. For expressions with NOT-conditions, returning the matched rule_id:
- * rule3 = clause1 & !clause2 = {attribute1, g1} & !{attribute2, g2}
+ * rule3 = condition1 & !condition2 = {attribute1, g1} & !{attribute2, g2}
- * rule4 = !clause1 & clause2 = !{attribute1, g2} & {attribute2, g3}
+ * rule4 = !condition1 & condition2 = !{attribute1, g2} & {attribute2, g3}
If scanning attribute1 matches g1 and attribute2 matches g3, rule_runtime will return the matched rule_id 4.
-3. If a rule_id is matched, the full hit path can be obtained: **item_id -> group_id ->** {super_group_id} -> clause{**attribute_id, not_flag, clause_index} -> rule_id**. If the matched group is not referenced by a rule, a half hit path can be obtained: **item_id -> group_id** -> {super_group_id}.
+3. If a rule_id is matched, the full hit path can be obtained: **item_id -> group_id ->** {super_group_id} -> condition{**attribute_id, not_flag, condition_index} -> rule_id**. If the matched group is not referenced by a rule, a half hit path can be obtained: **item_id -> group_id** -> {super_group_id}.
4. Getting the matched group_ids and the count of hit groups.
@@ -469,13 +469,13 @@ The internal structure of rule_runtime is as follows, including the control plan
* **Control plane**
-Rule runtime loads the rule table and group2rule table configurations into memory, assigning a unique clause_id to all clauses of each rule. The following three parts are constructed based on the clause_id:
+Rule runtime loads the rule table and group2rule table configurations into memory, assigning a unique condition_id to all conditions of each rule. The following three parts are constructed based on the condition_id:
-1. All clause_ids under the same rule are used to construct AND expressions, and all rule AND expressions are used to build a bool_matcher.
+1. All condition_ids under the same rule are used to construct AND expressions, and all rule AND expressions are used to build a bool_matcher.
-2. For not_flag=0 (clauses), a `clause_id hash` is built, key:{group_id, attribute_id, not_flag}, value:clause_id.
+2. For not_flag=0 (conditions), a `condition_id hash` is built, key:{group_id, attribute_id, not_flag}, value:condition_id.
-3. For not_flag=1 (NOT-clauses), a `NOT_clause_id hash` is built, key:{group_id, attribute_id, not_flag}, value:clause_id.
+3. For not_flag=1 (NOT-conditions), a `NOT_condition_id hash` is built, key:{group_id, attribute_id, not_flag}, value:condition_id.
* **Data Plane**
@@ -485,18 +485,18 @@ On the data plane, services are provided externally through the maat API, primar
* The hit item_id and group_id form a half-hit path.
-* The group_id that is hit and the scanned `attribute_id` form the key {group_id, attribute_id, 0}. This key is used to find the `hit clause_ids` in the clause_id hash.
+* The group_id that is hit and the scanned `attribute_id` form the key {group_id, attribute_id, 0}. This key is used to find the `hit condition_ids` in the condition_id hash.
-* Use the key {group_id, attribute_id, 1} to search for NOT_clause_ids in the NOT_clause_id hash and cache them as `exclude clause_ids`. These clause_ids need to be removed from all clause_ids that are eventually hit. This is because the scan hit {group_id, attribute_id, 0} => clause_id, leading to the deduction that {group_id, attribute_id, 1} => NOT_clause_id does not hit.
+* Use the key {group_id, attribute_id, 1} to search for NOT_condition_ids in the NOT_condition_id hash and cache them as `exclude condition_ids`. These condition_ids need to be removed from all condition_ids that are eventually hit. This is because the scan hit {group_id, attribute_id, 0} => condition_id, leading to the deduction that {group_id, attribute_id, 1} => NOT_condition_id does not hit.
-* Identify the group_ids in attribute_id table that appear in the NOT_clause and add them to the `NOT_clause_group` set. Ensure that this set does not contain any group_id that was hit during scanning. If any such group_id is present, remove it from the set to form the final `NOT_clause_group` for the attribute_id table.
+* Identify the group_ids in attribute_id table that appear in the NOT_condition and add them to the `NOT_condition_group` set. Ensure that this set does not contain any group_id that was hit during scanning. If any such group_id is present, remove it from the set to form the final `NOT_condition_group` for the attribute_id table.
-* Use the hit clause_ids to determine if there are any hit rule_ids. If there are, populate the half-hit path which will become full-hit path.
+* Use the hit condition_ids to determine if there are any hit rule_ids. If there are, populate the half-hit path which will become full-hit path.
-2. **maat_scan_not_logic**: This interface is used to activate NOT-clause logic.
+2. **maat_scan_not_logic**: This interface is used to activate NOT-condition logic.
-* Traverse the `NOT_clause_group` of `attribute_id`. For each `group_id`, form a key `{group_id, attribute_id, 1}` to obtain the `NOT_clause_id`. If it is in the `exclude clause_ids` set, ignore it; otherwise, add it to the `all hit clause_ids` set as a hit `NOT_clause_id`, and record the half-hit path of the NOT-clause.
+* Traverse the `NOT_condition_group` of `attribute_id`. For each `group_id`, form a key `{group_id, attribute_id, 1}` to obtain the `NOT_condition_id`. If it is in the `exclude condition_ids` set, ignore it; otherwise, add it to the `all hit condition_ids` set as a hit `NOT_condition_id`, and record the half-hit path of the NOT-condition.
-* Use the `all hit clause_ids` to calculate if there are any newly hit rule_ids. If there are, populate the half-hit path of the NOT-clause which will become full-hit path.
+* Use the `all hit condition_ids` to calculate if there are any newly hit rule_ids. If there are, populate the half-hit path of the NOT-condition which will become full-hit path.
3. **xx_get_hit_path**: This interface is used to retrieve the hit path. \ No newline at end of file
diff --git a/docs/monitor_tools.md b/docs/monitor_tools.md
index f64865a..7851bf5 100644
--- a/docs/monitor_tools.md
+++ b/docs/monitor_tools.md
@@ -22,7 +22,7 @@ The statistical information in the above figure is divided into two parts, part1
- plug_acc_num: total number of configurations for plugin tables
-- NOT_clause_num: total number of NOT-clauses
+- NOT_condition_num: total number of NOT-conditions
- excl_grp_num: total number of exclude groups
diff --git a/docs/overview.md b/docs/overview.md
index ba37bd5..bb3f795 100644
--- a/docs/overview.md
+++ b/docs/overview.md
@@ -24,11 +24,11 @@ The physical tables are mainly divided into three categories: the item table, gr
### 1.2 Configuration relationship
-As shown in the diagram below, maat organizes and abstracts configurations using terms such as item, group, literal, clause, rule, etc., allowing users to flexibly configure various policies. The term "literal" is an internal concept in maat and is not visible to external users.
+As shown in the diagram below, maat organizes and abstracts configurations using terms such as item, group, literal, condition, rule, etc., allowing users to flexibly configure various policies. The term "literal" is an internal concept in maat and is not visible to external users.
In addition, groups support nesting. For more detailed information, please refer to [group hierarchy](./group_hierarchy.md).
-If we define literal_id = {attribute_id, group_id}, then a literal is composed of one or more literal_ids. The multiple literal_ids that form the same clause have a logical “OR” relationship. The multiple clauses that form the same rule have a logical “AND” relationship, and there can be a maximum of 8 clauses within the same rule. In addition, the clause itself supports logical "NOT".
+If we define literal_id = {attribute_id, group_id}, then a literal is composed of one or more literal_ids. The multiple literal_ids that form the same condition have a logical “OR” relationship. The multiple conditions that form the same rule have a logical “AND” relationship, and there can be a maximum of 8 conditions within the same rule. In addition, the condition itself supports logical "NOT".
<img src="./imgs/rule_diagram.png" width="800" height="450" >
diff --git a/docs/terminology.md b/docs/terminology.md
index a9d8fac..29760b5 100644
--- a/docs/terminology.md
+++ b/docs/terminology.md
@@ -3,7 +3,7 @@
* [Item](#item)
* [Group(Object)](#groupobject)
* [Rule(Policy)](#rulepolicy)
-* [Clause(Condition)](#clause)
+* [Condition(Condition)](#condition)
* [Literal](#literal)
* [Physical table](#physical-table)
* [Attribute](#attribute)
@@ -50,21 +50,21 @@ The relationship between group and group is stored in the [group2group table](./
A conjunctive normal form(CNF) consisting of multiple groups and attributes.
-`Note`: A rule can contain up to 8 clauses and multiple clauses in the same rule can be logical 'AND' and logical 'NOT' relationships.
+`Note`: A rule can contain up to 8 conditions and multiple conditions in the same rule can be logical 'AND' and logical 'NOT' relationships.
The relationship between group and rule is stored in the [group2rule table](./maat_table.md#13-group2rule-table).
<img src="./imgs/CNF.jpg" alt="exclude" style="zoom:80%" />
-## Clause
+## Condition
-A clause consists of several Literals and the relationship between them is a `logical 'OR'`.
+A condition consists of several Literals and the relationship between them is a `logical 'OR'`.
-Clauses are divided into two categories based on whether they contain the logical "NOT" operation: `clause` and `NOT-clause`. In Maat, the logical "NOT" only appears in the clause, which means that if you want to use the logical "NOT", you need to configure clauses for the rules.
+Conditions are divided into two categories based on whether they contain the logical "NOT" operation: `condition` and `NOT-condition`. In Maat, the logical "NOT" only appears in the condition, which means that if you want to use the logical "NOT", you need to configure conditions for the rules.
## Literal
-A Literal consists of `attribute_id(attribute id)` and `group_id`. During the rules loading process, a unique clause_id will be generated based on the combination of attribute_id and group_id in the same clause.
+A Literal consists of `attribute_id(attribute id)` and `group_id`. During the rules loading process, a unique condition_id will be generated based on the combination of attribute_id and group_id in the same condition.
## Physical table