安装特定版本tsg_master-devel-5.8.13.8f6a3e1

用户自定义没有符合的欺骗IP时，串联环境丢弃真实应答包

.gitignore

@@ -0,0 +1,17 @@
+SI/
+*.log
+*.o
+*.so
+*.si4project/
+*.a
+*.d
+build/
+.vscode
+.idea
+core.*
+cmake-build-*
+GPATH
+GTAGS
+GRTAGS
+src/tags
+version.txt

.gitlab-ci.yml

@@ -1,29 +1,49 @@
-image: "git.mesalab.cn:7443/mesa_platform/build-env:master"
 variables:
   GIT_STRATEGY: "clone"
+  BUILD_IMAGE_CENTOS7: "git.mesalab.cn:7443/mesa_platform/build-env:master"
+  BUILD_IMAGE_CENTOS8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
   BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
   INSTALL_PREFIX: "/home/mesasoft/sapp_run/"
-  INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel  libcjson-devel libMESA_field_stat2-devel  sapp-devel framework_env  libMESA_prof_load-devel http-devel dns-devel  ftp-devel mail-devel ssl-devel  librdkafka-devel libmaatframe-devel tsg_master-devel libdocumentanalyze-devel libasan
+  INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel  libcjson-devel libMESA_field_stat2-devel  sapp-devel framework_env  libMESA_prof_load-devel http-devel dns-devel  ftp-devel mail-devel ssl-devel  librdkafka-devel libmaatframe-devel tsg_master-devel-5.8.13.8f6a3e1 libdocumentanalyze-devel libasan
 
 stages:
 - build
 
-.build_by_travis:
+.build_before_script:
   before_script:
   - mkdir -p $BUILD_PADDING_PREFIX/$CI_PROJECT_NAMESPACE/
   - ln -s $CI_PROJECT_DIR $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
   - cd $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
   - chmod +x ./ci/travis.sh
-  script:
   - yum makecache
+  - yum install -y elfutils-libelf-devel
+
+.build_by_travis_for_centos7:
+  stage: build
+  image: $BUILD_IMAGE_CENTOS7
+  extends: .build_before_script
+  script:
+    - yum install -y libmnl-devel
+    - yum install -y libnfnetlink-devel
     - ./ci/travis.sh
       - cd build
   tags:
   - share
 
-branch_build_debug:
+.build_by_travis_for_centos8:
   stage: build
-  extends: .build_by_travis
+  image: $BUILD_IMAGE_CENTOS8
+  extends: .build_before_script
+  script:
+    - dnf --enablerepo=powertools install -y libmnl-devel
+    - dnf --enablerepo=powertools install -y libnfnetlink-devel
+    - ./ci/travis.sh
+  tags:
+  - share
+ 
+branch_build_debug_for_centos7:
+  stage: build
+  extends: .build_by_travis_for_centos7
   variables:
     BUILD_TYPE: Debug
   except:
@@ -31,19 +51,19 @@ branch_build_debug:
     - /^master.*$/i
     - tags
 
-branch_build_release:
+branch_build_release_for_centos7:
   stage: build
   variables:
     BUILD_TYPE: RelWithDebInfo
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
   except:
     - /^develop.*$/i
     - /^master.*$/i
     - tags
 
-develop_build_debug:
+develop_build_debug_for_centos7:
   stage: build
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
   variables:
     BUILD_TYPE: Debug
     PACKAGE: 1
@@ -60,9 +80,9 @@ develop_build_debug:
     - /^develop.*$/i
     - /^master.*$/i
 
-develop_build_release:
+develop_build_release_for_centos7:
   stage: build
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
   variables:
     BUILD_TYPE: RelWithDebInfo
     PACKAGE: 1
@@ -79,7 +99,7 @@ develop_build_release:
     - /^master.*$/i
 
 
-release_build_debug:
+release_build_debug_for_centos7:
   stage: build
   variables:
     BUILD_TYPE: Debug
@@ -87,7 +107,7 @@ release_build_debug:
     UPLOAD_RPM: 1
     PULP3_REPO_NAME: tsg-stable-x86_64.el7
     PULP3_DIST_NAME: tsg-stable-x86_64.el7
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
   artifacts:
     name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
     paths:
@@ -95,7 +115,7 @@ release_build_debug:
   only:
     - tags
 
-release_build_release:
+release_build_release_for_centos7:
   stage: build
   variables:
     BUILD_TYPE: RelWithDebInfo
@@ -106,7 +126,99 @@ release_build_release:
     SYMBOL_TARGET: fw_dns_plug
     PULP3_REPO_NAME: tsg-stable-x86_64.el7
     PULP3_DIST_NAME: tsg-stable-x86_64.el7
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+branch_build_debug_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: Debug
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+branch_build_release_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+  extends: .build_by_travis_for_centos8
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+develop_build_debug_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    ASAN_OPTION: ADDRESS
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: tsg-testing-x86_64.el8
+    PULP3_DIST_NAME: tsg-testing-x86_64.el8
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-debug"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+develop_build_release_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: tsg-testing-x86_64.el8
+    PULP3_DIST_NAME: tsg-testing-x86_64.el8
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+release_build_debug_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    PULP3_REPO_NAME: tsg-stable-x86_64.el8
+    PULP3_DIST_NAME: tsg-stable-x86_64.el8
+  extends: .build_by_travis_for_centos8
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+release_build_release_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    ENABLE_DEVEL_SWITCH: "ON"
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    UPLOAD_SYMBOL_FILES: 1
+    SYMBOL_TARGET: fw_dns_plug
+    PULP3_REPO_NAME: tsg-stable-x86_64.el8
+    PULP3_DIST_NAME: tsg-stable-x86_64.el8
+  extends: .build_by_travis_for_centos8
   artifacts:
     name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
     paths:

ci/travis.sh

@@ -38,7 +38,7 @@ if [ -n "${INSTALL_DEPENDENCY_LIBRARY}" ]; then
 	source /etc/profile.d/framework.sh
 fi
 
-if [ $ASAN_OPTION ];then
+if [ $ASAN_OPTION ] && [ -f "/opt/rh/devtoolset-7/enable" ] ;then
 	source /opt/rh/devtoolset-7/enable
 fi
 

cmake/Package.cmake

@@ -12,18 +12,18 @@ set(CPACK_PACKAGE_VERSION_MINOR "${VERSION_MINOR}")
 set(CPACK_PACKAGE_VERSION_PATCH "${VERSION_PATCH}.${VERSION_BUILD}")
 set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
 set(CPACK_PACKAGE_VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_BUILD}")
-execute_process(COMMAND bash -c "echo -ne \"`uname -r | awk -F'.' '{print $5\".\"$6\".\"$7}'`\"" OUTPUT_VARIABLE SYSTEM_VERSION)
 
 execute_process(COMMAND sh changelog.sh ${CMAKE_BINARY_DIR} WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/cmake)
 SET(CPACK_RPM_CHANGELOG_FILE ${CMAKE_BINARY_DIR}/changelog.txt)
 
 # RPM Build
 set(CPACK_GENERATOR "RPM")
+set(CPACK_RPM_AUTO_GENERATED_FILE_NAME ON)
+set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
 set(CPACK_RPM_PACKAGE_VENDOR "MESA")
 set(CPACK_RPM_PACKAGE_AUTOREQPROV "yes")
-set(CPACK_RPM_PACKAGE_RELEASE_LIBRARY "on")
+set(CPACK_RPM_PACKAGE_RELEASE_DIST "on")
 set(CPACK_RPM_DEBUGINFO_PACKAGE "on")
-set(CPACK_RPM_PACKAGE_DEBUG 1)
 
 set(CPACK_RPM_PACKAGE_AUTOREQPROV "no")
 set(CPACK_RPM_PACKAGE_AUTOREQ "no")
@@ -35,11 +35,8 @@ set(CPACK_COMPONENT_HEADER_DISPLAY_NAME "develop")
 
 set(CPACK_COMPONENT_LIBRARIES_REQUIRED TRUE)
 set(CPACK_RPM_LIBRARIES_PACKAGE_NAME ${MY_RPM_NAME_PREFIX})
-set(CPACK_RPM_LIBRARIES_FILE_NAME "${CPACK_RPM_LIBRARIES_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${SYSTEM_VERSION}.rpm")
-set(CPACK_RPM_LIBRARIES_DEBUGINFO_FILE_NAME "${CPACK_RPM_LIBRARIES_PACKAGE_NAME}-debuginfo-${CPACK_PACKAGE_VERSION}-${SYSTEM_VERSION}.rpm")
-
-set(CPACK_COMPONENT_LIBRARIES_GROUP "libraries")
-set(CPACK_COMPONENT_PROFILE_GROUP "libraries")
+set(CPACK_COMPONENT_PROFILE_GROUP "LIBRARIES")
+set(CPACK_COMPONENT_LIBRARIES_GROUP "LIBRARIES")
 
 set(CPACK_RPM_HEADER_PACKAGE_CONFLICTS ${CPACK_RPM_HEADER_PACKAGE_NAME})
 

cmake/changelog.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
 work_path=$1
 branch=`git status | grep branch | awk '{print $NF}'`
-git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %ad %an %ae %nhash: %H%ncommit:%n%B"  | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/  -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt
+git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %cd %an %ae %nhash: %H%ncommit:%n%B"  | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/  -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt

src/CMakeLists.txt

@@ -2,9 +2,8 @@ cmake_minimum_required(VERSION 2.8)
 
 add_definitions(-fPIC)
 
-set(SRC fw_dns_plug.cpp fw_dns_rule.cpp) 
+set(SRC fw_dns_plug.cpp) 
 
-include_directories(${CMAKE_SOURCE_DIR}/src)
 include_directories(/opt/MESA/include/)
 include_directories(/opt/MESA/include/tsg/)
 

src/fw_dns_plug.cpp

@@ -11,7 +11,6 @@
 #include "tsg_rule.h"
 #include "tsg_label.h"
 #include "tsg_send_log.h"
-#include "fw_dns_plug.h"
 #include "tsg_statistic.h"
 
 #ifdef __cplusplus
@@ -35,270 +34,23 @@ static __attribute__((__used__)) const char * GIT_VERSION_UNKNOWN = NULL;
 }
 #endif
 
+#define	MAX_TABLE_NAME_LEN	256
+struct fw_dns_plug
+{
+	int level;
+	int table_qname_id;
+	char table_qname[MAX_TABLE_NAME_LEN];
+	char log_path[MAX_TABLE_NAME_LEN*2];
+	void *logger;
+};
 
+char FW_DNS_PLUG_VERSION_20210607=0;
+struct fw_dns_plug g_fw_dns_plug_info;
 char *g_fw_dns_conffile=(char *)"tsgconf/main.conf";
-char FW_DNS_PLUG_VERSION_20191220=0;
-struct _fw_dns_plug g_fw_dns_plug_info;
-
-static int get_answer_ttl(cJSON *object)
-{
-	int min=0;
-	int max=0;
-	cJSON *item=NULL;
-
-	item=cJSON_GetObjectItem(object, "min");
-	min=item->valueint;
-
-	item=cJSON_GetObjectItem(object, "max");
-	max=item->valueint;
-
-	return (rand()%(max-min+1)+min);
-}
-
-static cJSON * get_answer_records(cJSON *object, int qtype)
-{
-	int i=0;
-	cJSON *item=NULL;
-	int resolution_size=0;
-	int answer_type=DNS_TYPE_UNKNOWN;
-	
-	cJSON *resolution_array=cJSON_GetObjectItem(object, "resolution");
-	resolution_size=cJSON_GetArraySize(resolution_array);
-	for(i=0; i<resolution_size; i++)
-	{
-		item=cJSON_GetArrayItem(resolution_array, i);
-		cJSON *tmp=cJSON_GetObjectItem(item, "qtype");
-		
-		answer_type=fw_dns_type2index(tmp->valuestring);
-		if(answer_type==qtype)
-		{
-			return cJSON_GetObjectItem(item, "answer");
-		}
-	}
-
-	return NULL;
-}
-
-static char fw_dns_action(struct streaminfo *a_stream, dns_info_t *dns_info, Maat_rule_t *p_result, const void *a_packet)
-{
-	int record_id=0;
-	int i=0,used_num=0;
-	int answer_size=0,ret=0;
-	int payload_len=0,ttl=0;
-	dns_hdr_t *dns_hdr = NULL;
-	cJSON *item=NULL;
-	cJSON *a_item=NULL;
-	cJSON *object=NULL;
-	cJSON *answer_array=NULL;
-	char *tmp_buff=NULL;
-	unsigned char senddir=0;
-	char state=PROT_STATE_GIVEME;
-	int answer_type=DNS_TYPE_UNKNOWN;
-	int method_type=TSG_METHOD_TYPE_UNKNOWN;
-	cheat_pkt_opt_t cheat_opt[MAX_ANSWER_RECORDS_NUM];
-	unsigned char cheat_pkt_payload[MAX_CHEAT_PKT_PAYLOAD_LEN];
-	
-	if(p_result->serv_def_len<128)
-	{
-		object=cJSON_Parse(p_result->service_defined);
-
-		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-								RLOG_LV_DEBUG,
-								"DO_ACTION",
-								"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
-								p_result->config_id,
-								p_result->service_id,
-								p_result->action,
-								p_result->service_defined,
-								(char *)dns_info->query_question.qname,
-								dns_info->query_question.qtype,
-								(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-								);
-	}
-	else
-	{
-		tmp_buff=(char *)calloc(1, p_result->serv_def_len+1);
-		Maat_read_rule(g_tsg_maat_feather, p_result, MAAT_RULE_SERV_DEFINE, tmp_buff, p_result->serv_def_len);
-		object=cJSON_Parse(tmp_buff);
-
-		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-								RLOG_LV_DEBUG,
-								"DO_ACTION",
-								"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
-								p_result->config_id,
-								p_result->service_id,
-								p_result->action,
-								tmp_buff,
-								(char *)dns_info->query_question.qname,
-								dns_info->query_question.qtype,
-								(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-								);
-	}
-
-	if(object==NULL)
-	{
-		MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-								RLOG_LV_FATAL,
-								"DO_ACTION",
-								"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
-								p_result->config_id,
-								p_result->service_id,
-								p_result->action,
-								(tmp_buff==NULL) ? p_result->service_defined : tmp_buff,
-								(char *)dns_info->query_question.qname,
-								dns_info->query_question.qtype,
-								(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-								);
-
-		if(tmp_buff!=NULL)
-		{
-			free(tmp_buff);
-			tmp_buff=NULL;
-		}
-		
-		return PROT_STATE_GIVEME;
-	}
-	
-	item=cJSON_GetObjectItem(object, "method");
-	if(item!=NULL)
-	{
-		method_type=tsg_get_method_id(item->valuestring);
-	}
-	
-	switch(method_type)
-	{
-		case	TSG_METHOD_TYPE_DROP:
-			state=PROT_STATE_DROPME|PROT_STATE_DROPPKT;
-			break;
-		case	TSG_METHOD_TYPE_REDIRECTION:
-			if(g_fw_dns_plug_info.mode==0 && dns_info->hdr_info.qr==1) //mirror
-			{
-				break;
-			}
-
-			if(g_fw_dns_plug_info.mode==1 && dns_info->hdr_info.qr==0) //inline or transparent
-			{
-				break;
-			}
-			
-			answer_array=get_answer_records(object, dns_info->query_question.qtype);
-			if(answer_array!=NULL)
-			{
-				memset(cheat_opt, 0, sizeof(cheat_opt));
-				answer_size=cJSON_GetArraySize(answer_array);
-				for(i=0; i<answer_size; i++)
-				{
-					item=cJSON_GetArrayItem(answer_array, i);
-					a_item=cJSON_GetObjectItem(item, "atype");
-					answer_type=fw_dns_type2index(a_item->valuestring);
-
-					a_item=cJSON_GetObjectItem(item, "ttl");
-					ttl=get_answer_ttl(a_item);
-						
-					a_item=cJSON_GetObjectItem(item, "value");
-					if(a_item!=NULL)
-					{
-						cheat_opt[used_num].res_type=answer_type;
-						cheat_opt[used_num].cfg_type=answer_type;
-						cheat_opt[used_num].ttl=ttl;
-
-						switch(answer_type)
-						{
-							case	DNS_TYPE_A:
-								cheat_opt[used_num].res_len=sizeof(unsigned int);
-								inet_pton(AF_INET, a_item->valuestring, (void *)cheat_opt[used_num].res_info);
-								break;
-							case	DNS_TYPE_AAAA:
-								cheat_opt[used_num].res_len=IPV6_ADDR_LEN;
-								inet_pton(AF_INET6, a_item->valuestring, (void *)cheat_opt[used_num].res_info);
-								break;
-							default:
-								cheat_opt[used_num].res_len=(strlen(a_item->valuestring) > sizeof(cheat_opt[used_num].res_info)-1) ? sizeof(cheat_opt[used_num].res_info)-1 : strlen(a_item->valuestring);
-								memcpy(cheat_opt[used_num].res_info, a_item->valuestring, cheat_opt[used_num].res_len);
-								break;
-						}
-						used_num++;
-					}
-					else
-					{
-						a_item=cJSON_GetObjectItem(object, "record_id");
-						record_id=a_item->valueint;
-
-						a_item=cJSON_GetObjectItem(object, "selected_num");
-						used_num+=get_cheat_opt(record_id, a_item->valueint, ttl, answer_type, cheat_opt+used_num, MAX_ANSWER_RECORDS_NUM-used_num);
-					}
-					
-				}
-
-				memset(cheat_pkt_payload, 0, MAX_CHEAT_PKT_PAYLOAD_LEN);
-
-				dns_hdr = (dns_hdr_t *)cheat_pkt_payload;
-				dns_hdr->id = dns_info->hdr_info.id;
-				dns_hdr->qdcount = 1;
-				dns_hdr->ancount = used_num;
-				
-				payload_len=build_cheat_pkt(cheat_pkt_payload, MAX_CHEAT_PKT_PAYLOAD_LEN, &dns_info->query_question, cheat_opt, used_num);
-				if(payload_len==-1)
-				{
-					return -1;
-				}
-
-                if(dns_info->hdr_info.qr==0)
-                {
-				    senddir = MESA_dir_reverse(a_stream->routedir);
-                }
-                else
-                {
-                    senddir = a_stream->routedir;
-                }
-				ret=MESA_inject_pkt(a_stream, (const char *)cheat_pkt_payload, payload_len, (const char *)a_packet, senddir);
-                
-				if(ret<0)
-				{
-					MESA_handle_runtime_log(g_fw_dns_plug_info.logger,
-												RLOG_LV_FATAL,
-												"SEND_CHEAT_PKT",
-												"Return of MESA_inject_pkt_feedback function is %d, qname: %s qtype: %d cfg_id: %d service: %d addr: %s",
-												ret,
-												dns_info->query_question.qname,
-												dns_info->query_question.qtype,
-												p_result->config_id,
-												p_result->service_id,
-												(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-												);
-				}
-
-				state=PROT_STATE_DROPME|PROT_STATE_DROPPKT;
-			}
-			else
-			{
-				MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-										RLOG_LV_FATAL,
-										"DO_ACTION",
-										"Hit policy_id: %d service: %d action: %d user_reagion: %s domain: %s qtype: %d addr: %s",
-										p_result->config_id,
-										p_result->service_id,
-										p_result->action,
-										(tmp_buff==NULL) ? p_result->service_defined : tmp_buff,
-										(char *)dns_info->query_question.qname,
-										dns_info->query_question.qtype,
-										(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-									);
-				state=PROT_STATE_GIVEME;
-			}
-			break;
-		default:
-			break;
-	}
-	
-	cJSON_Delete(object);
-	object=NULL;
-	return state;
-}
 
 static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
 {
-	int i=0;
+	int i=0,cname_flag=0;
 	dns_rr_t *rr=NULL;
 	tsg_log_t log_msg;
 	int dns_sec=1;
@@ -338,32 +90,41 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
 			{
 				item=cJSON_CreateString((const char *)rr->rdata.cname);
 				cJSON_AddItemToArray(cname_array, item);
+				cname_flag=1;
 			}
 		}
 	}
 
+	if(cname_flag==1)
+	{
 		cname=cJSON_PrintUnformatted(cname_array);
-	if(strlen(cname)>0)
+		if(cname!=NULL)
 		{
 			TLD_append(handle, (char *)"dns_cname", (void *)cname, TLD_TYPE_STRING);
-		free(cname);
+			cJSON_free(cname);
+			cname=NULL;
 		}
+	}
+
 	cJSON_Delete(cname_array);
 	cname_array=NULL;
 
+	if(dns_info->rr_count>0)
+	{
 		cJSON * object=cJSON_CreateObject();
 		get_rr_str2json(object, dns_info, &dns_sec);
 		rr_buf=cJSON_PrintUnformatted(object);
+		if(rr_buf!=NULL)
+		{
 			TLD_append(handle, (char *)"dns_rr", (void *)rr_buf, TLD_TYPE_STRING);
-	
+			cJSON_free(rr_buf);
+			rr_buf=NULL;
+		}
 		cJSON_Delete(object);
 		object=NULL;		
-
-	free(rr_buf);
-	rr_buf=NULL;
+	}
 	
 	TLD_append(handle, (char *)"dns_sub", (void *)(long)dns_sec, TLD_TYPE_LONG);
-
 	TLD_append(handle, (char *)"common_schema_type", (void *)"DNS", TLD_TYPE_STRING);
 
 	log_msg.a_stream=a_stream;
@@ -375,9 +136,25 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
 	return 0;
 }
 
+int fw_dns_select_monitor_result(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
+{
+	for(int i=0; i<result_num; i++)
+	{
+		if(result[i].action!=TSG_ACTION_MONITOR)
+		{
+			continue;
+		}
+		
+		tsg_notify_hited_monitor_result(a_stream, &(result[i]), 1, thread_seq);
+		fw_dns_send_log(a_stream, dns_info, &(result[i]), 1, thread_seq);
+	}
+
+	return 0;
+}
+
 extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int thread_seq,struct streaminfo *a_stream,const void *a_packet)
 {
-	int i=0,ret=0,hit_num=0;
+	int ret=0,hit_num=0;
 	scan_status_t mid=NULL;
 	int category_id_num=0;
 	char state=PROT_STATE_GIVEME;
@@ -385,7 +162,7 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 	struct Maat_rule_t result[MAX_RESULT_NUM], *p_result=NULL;
 	dns_info_t *dns_info=(dns_info_t *)session_info->app_info;
 
-	if(dns_info==NULL)
+	if(dns_info==NULL || a_stream==NULL)
 	{
 		return state;
 	}
@@ -397,7 +174,7 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 									"DNS_PLUG",
 									"Qname is %s, addr: %s",
 									(dns_info==NULL) ? "NULL" : ((strlen((char *)dns_info->query_question.qname)==0) ? "NULL" : (char *)dns_info->query_question.qname),
-									(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
+									PRINTADDR(a_stream, g_fw_dns_plug_info.level)
 								);
 		return state;
 	}
@@ -414,7 +191,7 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 									result[hit_num].action,
 									(char *)dns_info->query_question.qname,
 									dns_info->query_question.qtype,
-									(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
+									PRINTADDR(a_stream, g_fw_dns_plug_info.level)
 								);
 		hit_num+=ret;
 	}
@@ -427,7 +204,7 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 									(char *)dns_info->query_question.qname,
 									dns_info->query_question.qtype,
 									ret,
-									(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
+									PRINTADDR(a_stream, g_fw_dns_plug_info.level)
 								);
 								
 	}
@@ -455,7 +232,7 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 									result[hit_num].config_id,
 									result[hit_num].service_id,
 									result[hit_num].action,
-									(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
+									PRINTADDR(a_stream, g_fw_dns_plug_info.level)
 								);
 		hit_num+=ret;
 	}
@@ -468,60 +245,42 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 									(char *)dns_info->query_question.qname,
 									dns_info->query_question.qtype,
 									ret,
-									(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
+									PRINTADDR(a_stream, g_fw_dns_plug_info.level)
 								);
 								
 	}
 
 	category_id_num=tsg_get_fqdn_category_id(g_tsg_maat_feather, (char *)dns_info->query_question.qname, category_id, MAX_CATEGORY_ID_NUM, g_fw_dns_plug_info.logger, thread_seq);
-	for(i=0; i< category_id_num; i++)
-	{
-		ret=Maat_scan_intval(g_tsg_maat_feather, g_fw_dns_plug_info.table_qname_id, (unsigned int)category_id[i], result+hit_num,MAX_RESULT_NUM-hit_num, &mid, thread_seq);
-		if(ret>0)
-		{
-			MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-										RLOG_LV_DEBUG,
-										"SCAN_FQDN_CAT_ID",
-										"Hit qname: %s category id: %d policy_id: %d service: %d action: %d addr: %s",
-										(char *)dns_info->query_question.qname,
-										category_id[i],
-										result[hit_num].config_id,
-										result[hit_num].service_id,
-										result[hit_num].action,
-										(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-									);
-			hit_num+=ret;
-		}
-		else
-		{
-			MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-										RLOG_LV_DEBUG,
-										"SCAN_DOMAIN",
-										"Scan domain: %s category id: %d ret: %d addr: %s",
-										(char *)dns_info->query_question.qname,
-										category_id[i],
-										ret,
-										(g_fw_dns_plug_info.level<RLOG_LV_FATAL ? printaddr(&a_stream->addr, a_stream->threadnum) : "")
-									);
-									
-		}
-	}
-	
+	tsg_set_fqdn_category_id(a_stream, category_id, category_id_num, thread_seq);
+	hit_num+=tsg_scan_fqdn_category_id(g_tsg_maat_feather, a_stream, result+hit_num,MAX_RESULT_NUM-hit_num, &mid, g_fw_dns_plug_info.table_qname_id, category_id, category_id_num, thread_seq);
 	if(hit_num>0)
 	{
-		p_result=tsg_fetch_deny_rule(result, hit_num);
-		
-		if(p_result!=NULL)
+		p_result=tsg_policy_decision_criteria(result, hit_num);
+		switch(p_result->action)
 		{
-			state=fw_dns_action(a_stream, dns_info, p_result, a_packet);
-			if(PROT_STATE_GIVEME!=state)
+			case	TSG_ACTION_BYPASS:
+				fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
+				break;
+			case	TSG_ACTION_DENY:
+				ret=tsg_is_do_deny_action_by_enforce_direction(a_stream, p_result);
+				if(ret==0)
+				{
+					fw_dns_select_monitor_result(a_stream, dns_info, result, hit_num, thread_seq);
+					break;
+				}
+				
+				state=tsg_deal_deny_action(a_stream, p_result, PROTO_DNS, ACTION_RETURN_TYPE_PROT, (const void *)dns_info);
+				if(state!=PROT_STATE_GIVEME)
 				{
 					fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
 				}
-		}
-		else
-		{
+				break;
+			case	TSG_ACTION_MONITOR:
+				tsg_notify_hited_monitor_result(a_stream, result, hit_num, thread_seq);
 				fw_dns_send_log(a_stream, dns_info, result, hit_num, thread_seq);
+				break;
+			default:
+				break;
 		}
 	}
 
@@ -536,7 +295,6 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 
 extern "C" int FW_DNS_PLUG_INIT(void)
 {
-	int ret=0,len=0;
 	memset(&g_fw_dns_plug_info, 0, sizeof(g_fw_dns_plug_info));
 
 	MESA_load_profile_int_def(g_fw_dns_conffile, "DNS_PLUG", "LOG_LEVEL", &g_fw_dns_plug_info.level, RLOG_LV_FATAL);
@@ -559,26 +317,6 @@ extern "C" int FW_DNS_PLUG_INIT(void)
 		return -1;
 	}
 	
-	ret=fw_dns_rule_init(g_fw_dns_conffile, g_fw_dns_plug_info.logger);
-	if(ret<0)
-	{
-		return -1;
-	}
-
-	len=sizeof(g_fw_dns_plug_info.s_mode);
-	ret=sapp_get_platform_opt(SPO_DEPLOYMENT_MODE_STR, g_fw_dns_plug_info.s_mode, &len);
-	if(ret>=0)
-	{
-		if((memcmp(g_fw_dns_plug_info.s_mode, "mirror", strlen(g_fw_dns_plug_info.s_mode)))==0)
-		{
-			g_fw_dns_plug_info.mode=0;
-		}
-		else
-		{
-			g_fw_dns_plug_info.mode=1;
-		}
-	}
-	
 	return 0;
 }
 

src/fw_dns_plug.h

@@ -1,19 +0,0 @@
-#ifndef	__FW_DNS_PLUG_H__
-#define	__FW_DNS_PLUG_H__
-
-#include "fw_dns_rule.h"
-
-#define	MAX_ANSWER_RECORDS_NUM	32
-
-struct _fw_dns_plug
-{
-	int mode;
-	int level;
-	int table_qname_id;
-	char table_qname[MAX_TABLE_NAME_LEN];
-	char s_mode[MAX_TABLE_NAME_LEN];
-	char log_path[MAX_TABLE_NAME_LEN*2];
-	void *logger;
-};
-
-#endif

src/fw_dns_rule.cpp

@@ -1,196 +0,0 @@
-#include <stdio.h>
-#include <arpa/inet.h>
-
-#include <MESA/stream.h>
-#include <MESA/dns.h>
-#include <MESA/cJSON.h>
-
-#include <MESA_prof_load.h>
-#include <MESA/Maat_rule.h>
-#include <MESA/MESA_handle_logger.h>
-
-#include "tsg_rule.h"
-#include "fw_dns_rule.h"
-
-fw_dns_rule_t g_fw_dns_rule_info;
-char FW_DNS_RULE_VERSION_20191201=0;
-
-struct _dns_str2idx str2index[]={{DNS_TYPE_CNAME,	5, (char *)"CNAME"},
-								{DNS_TYPE_MX,	2, (char *)"MX"},
-								{DNS_TYPE_A, 	1, (char *)"A"},
-								{DNS_TYPE_NS,	2, (char *)"NS"},
-								{DNS_TYPE_AAAA,	4, (char *)"AAAA"},
-								{DNS_TYPE_TXT,	3, (char *)"TXT"},
-								{DNS_TYPE_PTR,	3, (char *)"PTR"}
-								};
-
-int fw_dns_type2index(char *type)
-{
-	int i=0;
-	
-	for(i=0; i<(int)(sizeof(str2index)/sizeof(struct _dns_str2idx)); i++)
-	{
-		if(str2index[i].len==(int)strlen(type) && (strncasecmp(str2index[i].type, type, str2index[i].len))==0)
-		{
-			return str2index[i].index;
-		}
-	}
-
-	return -1;
-}
-
-int get_cheat_opt(int record_id, int select_num, int ttl, int atype, cheat_pkt_opt_t* cheat_opt, int cheat_opt_num)
-{
-	int i=0,idx=0;
-	int used_num=0,real_num=0;
-	cb_rule_t *cb_rule=NULL;
-	
-	real_num=(select_num>cheat_opt_num) ? cheat_opt_num : select_num;
-	
-	cb_rule=(cb_rule_t *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_fw_dns_rule_info.table_records_id, (char *)&record_id);
-	if(cb_rule!=NULL && real_num>0)
-	{
-		idx = (cb_rule->record_num>=real_num) ? (random()%(cb_rule->record_num-real_num+1)) : 0;
-		for(i=0; i<real_num && i+idx<cb_rule->record_num; i++)
-		{
-			cheat_opt[used_num].ttl=ttl;
-			cheat_opt[used_num].res_type=atype;
-			cheat_opt[used_num].cfg_type=atype;
-			switch(atype)
-			{
-				case	DNS_TYPE_A:
-					cheat_opt[used_num].res_len=sizeof(unsigned int);
-					break;
-				case	DNS_TYPE_AAAA:
-					cheat_opt[used_num].res_len=IPV6_ADDR_LEN;
-					break;
-				default:					
-					cheat_opt[used_num].res_len=MIN(strlen((char *)(cb_rule->record_values[i+idx])), sizeof(cheat_opt[used_num].res_info)-1);
-					break;
-			}
-			
-			memcpy(cheat_opt[used_num].res_info, (char *)(cb_rule->record_values[i+idx]), cheat_opt[used_num].res_len);
-			used_num++;
-		}
-	}
-	
-	return used_num;
-}
-
-
-void fw_dns_EX_data_create(int table_id, const char* key, const char* table_line, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp)
-{
-	int i=0;
-	cJSON *pSub=NULL;
-	cb_rule_t *cb_rule=(cb_rule_t *)calloc(1, sizeof(cb_rule_t));
-	char *tmp_records=(char *)calloc(1, strlen(table_line)+1);
-		
-	sscanf(table_line, "%d	%s	%s	%s	%d", &cb_rule->record_id, cb_rule->record_name, cb_rule->record_type, tmp_records, &cb_rule->is_valid);
-
-	int index=fw_dns_type2index(cb_rule->record_type);
-
-	cJSON *tmp_array=cJSON_Parse(tmp_records);	
-	if(tmp_array != NULL)
-	{
-		cb_rule->record_num=cJSON_GetArraySize(tmp_array);
-		*cb_rule->record_values=(void *)malloc(cb_rule->record_num*sizeof(void *));
-		
-		for(i=0; i<cb_rule->record_num; i++)
-		{
-			pSub = cJSON_GetArrayItem(tmp_array, i);
-			if(NULL==pSub )
-			{
-				continue; 
-			}
-
-			switch(index)
-			{
-				case	DNS_TYPE_A:
-					cb_rule->record_values[i]=calloc(1, sizeof(unsigned int));
-					inet_pton(AF_INET, pSub->valuestring, cb_rule->record_values[i]);
-					break;
-				case	DNS_TYPE_AAAA:
-					cb_rule->record_values[i]=calloc(1, IPV6_ADDR_LEN);
-					inet_pton(AF_INET6, pSub->valuestring, cb_rule->record_values[i]);
-					break;
-				case	DNS_TYPE_MX:
-					break;
-				case	DNS_TYPE_NS:
-				case	DNS_TYPE_TXT:
-				case	DNS_TYPE_PTR:
-				case	DNS_TYPE_CNAME:
-					cb_rule->record_values[i]=calloc(1, strlen(pSub->valuestring)+1);
-					memcpy(cb_rule->record_values[i], pSub->valuestring, strlen(pSub->valuestring));
-					break;
-				default:
-					continue;	
-			}
-		}
-	}
-
-	free(tmp_records);
-}
-
-void fw_dns_EX_data_free(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void *argp)
-{
-	int i=0;
-	cb_rule_t *cb_rule=(cb_rule_t *)*ad;
-	
-	if(cb_rule!=NULL)
-	{
-		for(i=0; i<cb_rule->record_num; i++)
-		{
-			free(cb_rule->record_values[i]);
-			cb_rule->record_values[i]=NULL;
-		}
-		free(*cb_rule->record_values);
-		*cb_rule->record_values=NULL;
-
-		free(cb_rule);
-		cb_rule=NULL;
-	}
-}
-void fw_dns_EX_data_dup(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp)
-{
-	
-}
-
-int fw_dns_EX_data_key2index(const char* key)
-{
-	return 0;
-}
-
-
-int fw_dns_rule_init(const char *conffile, void *logger)
-{
-	int ret=0;
-	long arg=0;
-	memset(&g_fw_dns_rule_info, 0, sizeof(g_fw_dns_rule_info));
-	
-	MESA_load_profile_string_def(conffile, "DNS_PLUG", "TABLE_RECORDS", g_fw_dns_rule_info.table_records_name, MAX_TABLE_NAME_LEN, (char *)"FW_PROFILE_DNS_RECORDS");
-
-	g_fw_dns_rule_info.table_records_id=Maat_table_register(g_tsg_maat_feather, g_fw_dns_rule_info.table_records_name);
-	if(g_fw_dns_rule_info.table_records_id<0)
-	{
-		MESA_handle_runtime_log(logger, RLOG_LV_FATAL, "REGISTER_TABLE", "Maat_table_register failed, table_name: %s", g_fw_dns_rule_info.table_records_name);
-		return -1;
-	}
-
-	ret=Maat_plugin_EX_register(g_tsg_maat_feather,
-								g_fw_dns_rule_info.table_records_id,
-								fw_dns_EX_data_create,
-								fw_dns_EX_data_free,
-								fw_dns_EX_data_dup,
-								fw_dns_EX_data_key2index,
-								arg, 
-								NULL);
-
-	if(ret<0)
-	{
-		MESA_handle_runtime_log(logger, RLOG_LV_FATAL, "REGISTER_TABLE", "Maat_plugin_EX_register failed, table_name: %s", g_fw_dns_rule_info.table_records_name);
-		return -1;
-	}
-
-	return 0;
-}
-

src/fw_dns_rule.h

@@ -1,36 +0,0 @@
-#ifndef	__FW_DNS_RULE_H__
-#define	__FW_DNS_RULE_H__
-
-#define	MIN(a, b) ((a>b) ? b: a)
-
-#define	MAX_TABLE_NAME_LEN	32
-
-struct _dns_str2idx
-{
-	int index;
-	int len;
-	char *type;
-};
-
-typedef struct _cb_rule
-{
-	int record_id;
-	int record_num;
-	int is_valid;
-	char record_type[128];
-	char record_name[MAX_TABLE_NAME_LEN];
-	void **record_values;
-}cb_rule_t;
-
-typedef struct _fw_dns_rule
-{
-	int table_records_id;
-	char table_records_name[MAX_TABLE_NAME_LEN];
-}fw_dns_rule_t;
-
-
-int fw_dns_type2index(char *type);
-int fw_dns_rule_init(const char *conffile, void *logger);
-int get_cheat_opt(int record_id, int select_num, int ttl, int atype, cheat_pkt_opt_t* cheat_opt, int cheat_opt_num);
-	
-#endif