gfwleak/tango-fw-dns-plug
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Develop export version

Browse Source
This commit is contained in:
刘学利
2020-10-10 17:22:52 +08:00
parent 453c5330c0
commit 3d2324bb43
7 changed files with 191 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
.gitlab-ci.yml
View File

@@ -3,7 +3,7 @@ variables:
GIT_STRATEGY: "clone"
BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
INSTALL_PREFIX: "/home/mesasoft/sapp_run/"
INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel libcjson-devel libMESA_field_stat2-devel sapp-devel framework_env libMESA_prof_load-devel http-devel dns-devel ftp-devel mail-devel ssl-devel librdkafka-devel libmaatframe-devel tsg_master-devel libdocumentanalyze-devel
INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel libcjson-devel libMESA_field_stat2-devel sapp-devel framework_env libMESA_prof_load-devel http-devel dns-devel ftp-devel mail-devel ssl-devel librdkafka-devel libmaatframe-devel tsg_master-devel libdocumentanalyze-devel libasan
stages:
- build
@@ -47,6 +47,11 @@ develop_build_debug:
variables:
BUILD_TYPE: Debug
PACKAGE: 1
UPLOAD_RPM: 1
ASAN_OPTION: ADDRESS
TESTING_VERSION_BUILD: 1
PULP3_REPO_NAME: tsg-testing-x86_64.el7
PULP3_DIST_NAME: tsg-testing-x86_64.el7
artifacts:
name: "fw_dns_plug-$CI_COMMIT_REF_NAME-debug"
paths:
@@ -61,6 +66,11 @@ develop_build_release:
variables:
BUILD_TYPE: RelWithDebInfo
PACKAGE: 1
UPLOAD_RPM: 1
ASAN_OPTION: ADDRESS
TESTING_VERSION_BUILD: 1
PULP3_REPO_NAME: tsg-testing-x86_64.el7
PULP3_DIST_NAME: tsg-testing-x86_64.el7
artifacts:
name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
paths:
@@ -70,12 +80,12 @@ develop_build_release:
- /^master.*$/i
release_build_release:
release_build_debug:
stage: build
variables:
BUILD_TYPE: RelWithDebInfo
BUILD_TYPE: Debug
PACKAGE: 1
UPLOAD: 1
UPLOAD_RPM: 1
PULP3_REPO_NAME: tsg-stable-x86_64.el7
PULP3_DIST_NAME: tsg-stable-x86_64.el7
extends: .build_by_travis
@@ -86,13 +96,15 @@ release_build_release:
only:
- tags
release_build_release_devel:
release_build_release:
stage: build
variables:
BUILD_TYPE: RelWithDebInfo
ENABLE_DEVEL_SWITCH: "ON"
PACKAGE: 1
UPLOAD: 1
UPLOAD_RPM: 1
UPLOAD_SYMBOL_FILES: 1
SYMBOL_TARGET: fw_dns_plug
PULP3_REPO_NAME: tsg-stable-x86_64.el7
PULP3_DIST_NAME: tsg-stable-x86_64.el7
extends: .build_by_travis

17
ci/travis.sh
View File

@@ -43,7 +43,8 @@ cd build
cmake3 -DCMAKE_CXX_FLAGS=$CXX_FLAGS \
-DCMAKE_BUILD_TYPE=$BUILD_TYPE \
-DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
-DENABLE_DEVEL=$ENABLE_DEVEL_SWITCH \
-DASAN_OPTION=$ASAN_OPTION \
-DVERSION_DAILY_BUILD=$TESTING_VERSION_BUILD \
..
make
@@ -52,13 +53,15 @@ if [ -n "${PACKAGE}" ]; then
make package
fi
if [ -n "${UPLOAD}" ]; then
if [ -n "${UPLOAD_RPM}" ]; then
cp ~/rpm_upload_tools.py ./
python3 rpm_upload_tools.py ${PULP3_REPO_NAME} ${PULP3_DIST_NAME} *.rpm
fi
#if [ -n "${UPLOAD_SYMBOL_FILES}" ]; then
# rpm -i tfe*debuginfo*.rpm
# cp /usr/lib/debug/opt/tsg/tfe/bin/tfe.debug /tmp/tfe.debuginfo.${CI_COMMIT_SHORT_SHA}
# sentry-cli upload-dif -t elf /tmp/tfe.debuginfo.${CI_COMMIT_SHORT_SHA}
#fi
if [ -n "${UPLOAD_SYMBOL_FILES}" ]; then
rpm -i $SYMBOL_TARGET*debuginfo*.rpm
_symbol_file=`find /usr/lib/debug/ -name "$SYMBOL_TARGET*.so*.debug"`
cp $_symbol_file ${_symbol_file}info.${CI_COMMIT_SHORT_SHA}
sentry-cli upload-dif -t elf ${_symbol_file}info.${CI_COMMIT_SHORT_SHA}
fi

7
cmake/Package.cmake
View File

@@ -14,8 +14,8 @@ set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
set(CPACK_PACKAGE_VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_BUILD}")
execute_process(COMMAND bash -c "echo -ne \"`uname -r | awk -F'.' '{print $5\".\"$6\".\"$7}'`\"" OUTPUT_VARIABLE SYSTEM_VERSION)
execute_process(COMMAND sh changelog.sh WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/cmake)
SET(CPACK_RPM_CHANGELOG_FILE ${PROJECT_SOURCE_DIR}/cmake/changelog.txt)
execute_process(COMMAND sh changelog.sh ${CMAKE_BINARY_DIR} WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/cmake)
SET(CPACK_RPM_CHANGELOG_FILE ${CMAKE_BINARY_DIR}/changelog.txt)
# RPM Build
set(CPACK_GENERATOR "RPM")
@@ -25,6 +25,9 @@ set(CPACK_RPM_PACKAGE_RELEASE_LIBRARY "on")
set(CPACK_RPM_DEBUGINFO_PACKAGE "on")
set(CPACK_RPM_PACKAGE_DEBUG 1)
set(CPACK_RPM_PACKAGE_AUTOREQPROV "no")
set(CPACK_RPM_PACKAGE_AUTOREQ "no")
set(CPACK_RPM_COMPONENT_INSTALL ON)
set(CPACK_COMPONENTS_IGNORE_GROUPS 1)
set(CPACK_COMPONENTS_GROUPING ONE_PER_GROUP)

5
cmake/Version.cmake
View File

@@ -19,6 +19,11 @@ include(${__VERSION_CONFIG})
string(REGEX REPLACE "^v([0-9]+)\\..*" "\\1" VERSION_MAJOR "${VCS_TAG}")
string(REGEX REPLACE "^v[0-9]+\\.([0-9]+).*" "\\1" VERSION_MINOR "${VCS_TAG}")
string(REGEX REPLACE "^v[0-9]+\\.[0-9]+\\.([0-9]+).*" "\\1" VERSION_PATCH "${VCS_TAG}")
string(REGEX REPLACE "[T\\:\\+\\-]" "" VERSION_DATE "${VCS_DATE}")
if(VERSION_DAILY_BUILD)
set(VERSION_PATCH ${VERSION_PATCH}.${VERSION_DATE})
endif()
if(NOT VERSION_MAJOR)
set(VERSION_MAJOR 1)

4
cmake/changelog.sh
View File

@@ -1,4 +1,4 @@
#!/bin/sh
work_path=$1
branch=`git status | grep branch | awk '{print $NF}'`
git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %ad %an %ae %nhash: %H%ncommit:%n%B" | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/ -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > changelog.txt
git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %ad %an %ae %nhash: %H%ncommit:%n%B" | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/ -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt

208
src/fw_dns_plug.cpp
View File

@@ -9,10 +9,33 @@
#include <MESA/MESA_handle_logger.h>
#include "tsg_rule.h"
#include "tsg_label.h"
#include "tsg_send_log.h"
#include "fw_dns_plug.h"
#include "tsg_statistic.h"
#ifdef __cplusplus
extern "C"
{
#endif
#define GIT_VERSION_CATTER(v) __attribute__((__used__)) const char * GIT_VERSION_##v = NULL
#define GIT_VERSION_EXPEND(v) GIT_VERSION_CATTER(v)
/* VERSION TAG */
#ifdef GIT_VERSION
GIT_VERSION_EXPEND(GIT_VERSION);
#else
static __attribute__((__used__)) const char * GIT_VERSION_UNKNOWN = NULL;
#endif
#undef GIT_VERSION_CATTER
#undef GIT_VERSION_EXPEND
#ifdef __cplusplus
}
#endif
char *g_fw_dns_conffile=(char *)"tsgconf/main.conf";
char FW_DNS_PLUG_VERSION_20191220=0;
struct _fw_dns_plug g_fw_dns_plug_info;
@@ -89,7 +112,7 @@ static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maa
p_result->service_defined,
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
printaddr(&a_stream->addr, a_stream->threadnum)
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
}
else
@@ -108,7 +131,7 @@ static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maa
tmp_buff,
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
printaddr(&a_stream->addr, a_stream->threadnum)
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
}
@@ -124,7 +147,7 @@ static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maa
(tmp_buff==NULL) ? p_result->service_defined : tmp_buff,
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
printaddr(&a_stream->addr, a_stream->threadnum)
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
if(tmp_buff!=NULL)
@@ -148,6 +171,16 @@ static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maa
state=PROT_STATE_DROPME|PROT_STATE_DROPPKT;
break;
case TSG_METHOD_TYPE_REDIRECTION:
if(g_fw_dns_plug_info.mode==0 && dns_info->hdr_info.qr==1) //mirror
{
break;
}
if(g_fw_dns_plug_info.mode==1 && dns_info->hdr_info.qr==0) //inline or transparent
{
break;
}
answer_array=get_answer_records(object, dns_info->query_question.qtype);
if(answer_array!=NULL)
{
@@ -223,7 +256,7 @@ static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maa
dns_info->query_question.qtype,
p_result->config_id,
p_result->service_id,
printaddr(&a_stream->addr, a_stream->threadnum)
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
}
@@ -241,7 +274,7 @@ static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maa
(tmp_buff==NULL) ? p_result->service_defined : tmp_buff,
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
printaddr(&a_stream->addr, a_stream->threadnum)
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
state=PROT_STATE_GIVEME;
}
@@ -336,9 +369,11 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info, void **pme, int thread_seq,struct streaminfo *a_stream,const void *a_packet)
{
int ret=0,hit_num=0;
int i=0,ret=0,hit_num=0;
scan_status_t mid=NULL;
int category_id_num=0;
char state=PROT_STATE_GIVEME;
unsigned int category_id[MAX_CATEGORY_ID_NUM]={0};
struct Maat_rule_t result[MAX_RESULT_NUM], *p_result=NULL;
dns_info_t *dns_info=(dns_info_t *)session_info->app_info;
@@ -350,12 +385,12 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info, void **pme, int
if(strlen((char *)dns_info->query_question.qname)==0)
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"DNS_PLUG",
"Qname is %s, addr: %s",
(dns_info==NULL) ? "NULL" : ((strlen((char *)dns_info->query_question.qname)==0) ? "NULL" : (char *)dns_info->query_question.qname),
printaddr(&a_stream->addr, thread_seq)
);
RLOG_LV_DEBUG,
"DNS_PLUG",
"Qname is %s, addr: %s",
(dns_info==NULL) ? "NULL" : ((strlen((char *)dns_info->query_question.qname)==0) ? "NULL" : (char *)dns_info->query_question.qname),
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
return state;
}
@@ -363,72 +398,107 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info, void **pme, int
if(ret>0)
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"SCAN_NEST_ADDR",
"Hit policy_id: %d service: %d action: %d domain: %s qtype: %d addr: %s",
result[hit_num].config_id,
result[hit_num].service_id,
result[hit_num].action,
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
printaddr(&a_stream->addr, thread_seq)
RLOG_LV_DEBUG,
"SCAN_NEST_ADDR",
"Hit policy_id: %d service: %d action: %d domain: %s qtype: %d addr: %s",
result[hit_num].config_id,
result[hit_num].service_id,
result[hit_num].action,
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
hit_num+=ret;
}
else
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"SCAN_NEST_ADDR",
"Scan domain: %s qtype: %d ret: %d addr: %s",
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
ret,
printaddr(&a_stream->addr, thread_seq)
RLOG_LV_DEBUG,
"SCAN_NEST_ADDR",
"Scan domain: %s qtype: %d ret: %d addr: %s",
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
ret,
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
}
ret=Maat_full_scan_string(g_tsg_maat_feather,
g_fw_dns_plug_info.table_qname_id,
CHARSET_UTF8,
(char *)dns_info->query_question.qname,
strlen((char *)dns_info->query_question.qname),
result+hit_num,
NULL,
MAX_RESULT_NUM-hit_num,
&mid,
thread_seq);
g_fw_dns_plug_info.table_qname_id,
CHARSET_UTF8,
(char *)dns_info->query_question.qname,
strlen((char *)dns_info->query_question.qname),
result+hit_num,
NULL,
MAX_RESULT_NUM-hit_num,
&mid,
thread_seq
);
if(ret>0)
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"SCAN_DOMAIN",
"Hit domain: %s qtype: %d policy_id: %d service: %d action: %d addr: %s",
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
result[hit_num].config_id,
result[hit_num].service_id,
result[hit_num].action,
printaddr(&a_stream->addr, thread_seq)
RLOG_LV_DEBUG,
"SCAN_DOMAIN",
"Hit domain: %s qtype: %d policy_id: %d service: %d action: %d addr: %s",
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
result[hit_num].config_id,
result[hit_num].service_id,
result[hit_num].action,
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
hit_num+=ret;
}
else
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"SCAN_DOMAIN",
"Scan domain: %s qtype: %d ret: %d addr: %s",
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
ret,
printaddr(&a_stream->addr, thread_seq)
RLOG_LV_DEBUG,
"SCAN_DOMAIN",
"Scan domain: %s qtype: %d ret: %d addr: %s",
(char *)dns_info->query_question.qname,
dns_info->query_question.qtype,
ret,
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
}
category_id_num=tsg_get_fqdn_category_id(g_tsg_maat_feather, (char *)dns_info->query_question.qname, category_id, MAX_CATEGORY_ID_NUM, g_fw_dns_plug_info.logger, thread_seq);
for(i=0; i< category_id_num; i++)
{
ret=Maat_scan_intval(g_tsg_maat_feather, g_fw_dns_plug_info.table_qname_id, (unsigned int)category_id[i], result+hit_num,MAX_RESULT_NUM-hit_num, &mid, thread_seq);
if(ret>0)
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"SCAN_FQDN_CAT_ID",
"Hit qname: %s category id: %d policy_id: %d service: %d action: %d addr: %s",
(char *)dns_info->query_question.qname,
category_id[i],
result[hit_num].config_id,
result[hit_num].service_id,
result[hit_num].action,
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
hit_num+=ret;
}
else
{
MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
RLOG_LV_DEBUG,
"SCAN_DOMAIN",
"Scan domain: %s category id: %d ret: %d addr: %s",
(char *)dns_info->query_question.qname,
category_id[i],
ret,
(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
);
}
}
if(hit_num>0)
{
p_result=tsg_fetch_deny_rule(result, hit_num);
@@ -436,7 +506,10 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info, void **pme, int
if(p_result!=NULL)
{
state=fw_dns_action(a_stream, dns_info, p_result, a_packet);
fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
if(PROT_STATE_GIVEME!=state)
{
fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
}
}
else
{
@@ -455,20 +528,19 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info, void **pme, int
extern "C" int FW_DNS_PLUG_INIT(void)
{
int level=30,ret=0;
char log_path[256]={0};
int ret=0,len=0;
memset(&g_fw_dns_plug_info, 0, sizeof(g_fw_dns_plug_info));
MESA_load_profile_int_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_LEVEL", &level, 30);
MESA_load_profile_string_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_PATH", log_path, sizeof(log_path), "tsglog/fw_dns_plug/fw_dns_plug");
MESA_load_profile_int_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_LEVEL", &g_fw_dns_plug_info.level, RLOG_LV_FATAL);
MESA_load_profile_string_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_PATH", g_fw_dns_plug_info.log_path, sizeof(g_fw_dns_plug_info.log_path), "tsglog/fw_dns_plug/fw_dns_plug");
MESA_load_profile_string_def(g_fw_dns_conffile, "DNS_PLUG", "TABLE_QNAME", g_fw_dns_plug_info.table_qname, MAX_TABLE_NAME_LEN, "TSG_FIELD_DNS_QNAME");
g_fw_dns_plug_info.logger=MESA_create_runtime_log_handle(log_path, level);
g_fw_dns_plug_info.logger=MESA_create_runtime_log_handle(g_fw_dns_plug_info.log_path, g_fw_dns_plug_info.level);
if(g_fw_dns_plug_info.logger==NULL)
{
printf("MESA_create_runtime_log_handle failed, log_path: %s level: %d", (log_path==NULL) ? NULL : log_path, level);
printf("MESA_create_runtime_log_handle failed, log_path: %s level: %d", (g_fw_dns_plug_info.log_path==NULL) ? NULL : g_fw_dns_plug_info.log_path, g_fw_dns_plug_info.level);
return -1;
}
@@ -484,6 +556,20 @@ extern "C" int FW_DNS_PLUG_INIT(void)
{
return -1;
}
len=sizeof(g_fw_dns_plug_info.s_mode);
ret=sapp_get_platform_opt(SPO_DEPLOYMENT_MODE_STR, g_fw_dns_plug_info.s_mode, &len);
if(ret>=0)
{
if((memcmp(g_fw_dns_plug_info.s_mode, "mirror", strlen(g_fw_dns_plug_info.s_mode)))==0)
{
g_fw_dns_plug_info.mode=0;
}
else
{
g_fw_dns_plug_info.mode=1;
}
}
return 0;
}

4
src/fw_dns_plug.h
View File

@@ -7,8 +7,12 @@
struct _fw_dns_plug
{
int mode;
int level;
int table_qname_id;
char table_qname[MAX_TABLE_NAME_LEN];
char s_mode[MAX_TABLE_NAME_LEN];
char log_path[MAX_TABLE_NAME_LEN*2];
void *logger;
};