安装特定版本tsg_master-devel-5.8.13.8f6a3e1

TSG-14338: LTS22.11版本功能端安全策略Deny动作支持“生效方向”动作参数
TSG-12986: 当cname或者应答记录为空时不再发送相应的日志字段
2023-03-25 13:29:48 +08:00 · 2023-03-24 16:25:49 +08:00 · 2022-12-12 15:41:29 +08:00 · 2022-04-01 04:01:42 +00:00 · 2022-04-01 03:52:55 +00:00 · 2022-02-24 17:43:50 +08:00
6 changed files with 222 additions and 90 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,17 @@
+SI/
+*.log
+*.o
+*.so
+*.si4project/
+*.a
+*.d
+build/
+.vscode
+.idea
+core.*
+cmake-build-*
+GPATH
+GTAGS
+GRTAGS
+src/tags
+version.txt
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,29 +1,49 @@
-image: "git.mesalab.cn:7443/mesa_platform/build-env:master"
 variables:
  GIT_STRATEGY: "clone"
+  BUILD_IMAGE_CENTOS7: "git.mesalab.cn:7443/mesa_platform/build-env:master"
+  BUILD_IMAGE_CENTOS8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
  BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
  INSTALL_PREFIX: "/home/mesasoft/sapp_run/"
-  INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel  libcjson-devel libMESA_field_stat2-devel  sapp-devel framework_env  libMESA_prof_load-devel http-devel dns-devel  ftp-devel mail-devel ssl-devel  librdkafka-devel libmaatframe-devel tsg_master-devel libdocumentanalyze-devel libasan
+  INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel  libcjson-devel libMESA_field_stat2-devel  sapp-devel framework_env  libMESA_prof_load-devel http-devel dns-devel  ftp-devel mail-devel ssl-devel  librdkafka-devel libmaatframe-devel tsg_master-devel-5.8.13.8f6a3e1 libdocumentanalyze-devel libasan

 stages:
 - build

-.build_by_travis:
+.build_before_script:
  before_script:
  - mkdir -p $BUILD_PADDING_PREFIX/$CI_PROJECT_NAMESPACE/
  - ln -s $CI_PROJECT_DIR $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
  - cd $BUILD_PADDING_PREFIX/$CI_PROJECT_PATH
  - chmod +x ./ci/travis.sh
-  script:
  - yum makecache
-  - ./ci/travis.sh
-  - cd build
+  - yum install -y elfutils-libelf-devel
+
+.build_by_travis_for_centos7:
+  stage: build
+  image: $BUILD_IMAGE_CENTOS7
+  extends: .build_before_script
+  script:
+    - yum install -y libmnl-devel
+    - yum install -y libnfnetlink-devel
+    - ./ci/travis.sh
+      - cd build
  tags:
  - share

-branch_build_debug:
+.build_by_travis_for_centos8:
  stage: build
-  extends: .build_by_travis
+  image: $BUILD_IMAGE_CENTOS8
+  extends: .build_before_script
+  script:
+    - dnf --enablerepo=powertools install -y libmnl-devel
+    - dnf --enablerepo=powertools install -y libnfnetlink-devel
+    - ./ci/travis.sh
+  tags:
+  - share
+ 
+branch_build_debug_for_centos7:
+  stage: build
+  extends: .build_by_travis_for_centos7
  variables:
    BUILD_TYPE: Debug
  except:
@@ -31,19 +51,19 @@ branch_build_debug:
    - /^master.*$/i
    - tags

-branch_build_release:
+branch_build_release_for_centos7:
  stage: build
  variables:
    BUILD_TYPE: RelWithDebInfo
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
  except:
    - /^develop.*$/i
    - /^master.*$/i
    - tags

-develop_build_debug:
+develop_build_debug_for_centos7:
  stage: build
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
  variables:
    BUILD_TYPE: Debug
    PACKAGE: 1
@@ -60,9 +80,9 @@ develop_build_debug:
    - /^develop.*$/i
    - /^master.*$/i

-develop_build_release:
+develop_build_release_for_centos7:
  stage: build
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
  variables:
    BUILD_TYPE: RelWithDebInfo
    PACKAGE: 1
@@ -79,7 +99,7 @@ develop_build_release:
    - /^master.*$/i


-release_build_debug:
+release_build_debug_for_centos7:
  stage: build
  variables:
    BUILD_TYPE: Debug
@@ -87,7 +107,7 @@ release_build_debug:
    UPLOAD_RPM: 1
    PULP3_REPO_NAME: tsg-stable-x86_64.el7
    PULP3_DIST_NAME: tsg-stable-x86_64.el7
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
  artifacts:
    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
    paths:
@@ -95,7 +115,7 @@ release_build_debug:
  only:
    - tags

-release_build_release:
+release_build_release_for_centos7:
  stage: build
  variables:
    BUILD_TYPE: RelWithDebInfo
@@ -106,7 +126,99 @@ release_build_release:
    SYMBOL_TARGET: fw_dns_plug
    PULP3_REPO_NAME: tsg-stable-x86_64.el7
    PULP3_DIST_NAME: tsg-stable-x86_64.el7
-  extends: .build_by_travis
+  extends: .build_by_travis_for_centos7
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+branch_build_debug_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: Debug
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+branch_build_release_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+  extends: .build_by_travis_for_centos8
+  except:
+    - /^develop.*$/i
+    - /^master.*$/i
+    - tags
+
+develop_build_debug_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    ASAN_OPTION: ADDRESS
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: tsg-testing-x86_64.el8
+    PULP3_DIST_NAME: tsg-testing-x86_64.el8
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-debug"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+develop_build_release_for_centos8:
+  stage: build
+  extends: .build_by_travis_for_centos8
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    TESTING_VERSION_BUILD: 1
+    PULP3_REPO_NAME: tsg-testing-x86_64.el8
+    PULP3_DIST_NAME: tsg-testing-x86_64.el8
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - /^develop.*$/i
+    - /^master.*$/i
+
+release_build_debug_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: Debug
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    PULP3_REPO_NAME: tsg-stable-x86_64.el8
+    PULP3_DIST_NAME: tsg-stable-x86_64.el8
+  extends: .build_by_travis_for_centos8
+  artifacts:
+    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
+    paths:
+      - build/*.rpm
+  only:
+    - tags
+
+release_build_release_for_centos8:
+  stage: build
+  variables:
+    BUILD_TYPE: RelWithDebInfo
+    ENABLE_DEVEL_SWITCH: "ON"
+    PACKAGE: 1
+    UPLOAD_RPM: 1
+    UPLOAD_SYMBOL_FILES: 1
+    SYMBOL_TARGET: fw_dns_plug
+    PULP3_REPO_NAME: tsg-stable-x86_64.el8
+    PULP3_DIST_NAME: tsg-stable-x86_64.el8
+  extends: .build_by_travis_for_centos8
  artifacts:
    name: "fw_dns_plug-$CI_COMMIT_REF_NAME-release"
    paths:
--- a/ci/travis.sh
+++ b/ci/travis.sh
@@ -38,7 +38,7 @@ if [ -n "${INSTALL_DEPENDENCY_LIBRARY}" ]; then
 	source /etc/profile.d/framework.sh
 fi

-if [ $ASAN_OPTION ];then
+if [ $ASAN_OPTION ] && [ -f "/opt/rh/devtoolset-7/enable" ] ;then
 	source /opt/rh/devtoolset-7/enable
 fi

--- a/cmake/Package.cmake
+++ b/cmake/Package.cmake
@@ -12,18 +12,18 @@ set(CPACK_PACKAGE_VERSION_MINOR "${VERSION_MINOR}")
 set(CPACK_PACKAGE_VERSION_PATCH "${VERSION_PATCH}.${VERSION_BUILD}")
 set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
 set(CPACK_PACKAGE_VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_BUILD}")
-execute_process(COMMAND bash -c "echo -ne \"`uname -r | awk -F'.' '{print $5\".\"$6\".\"$7}'`\"" OUTPUT_VARIABLE SYSTEM_VERSION)

 execute_process(COMMAND sh changelog.sh ${CMAKE_BINARY_DIR} WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/cmake)
 SET(CPACK_RPM_CHANGELOG_FILE ${CMAKE_BINARY_DIR}/changelog.txt)

 # RPM Build
 set(CPACK_GENERATOR "RPM")
+set(CPACK_RPM_AUTO_GENERATED_FILE_NAME ON)
+set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
 set(CPACK_RPM_PACKAGE_VENDOR "MESA")
 set(CPACK_RPM_PACKAGE_AUTOREQPROV "yes")
-set(CPACK_RPM_PACKAGE_RELEASE_LIBRARY "on")
+set(CPACK_RPM_PACKAGE_RELEASE_DIST "on")
 set(CPACK_RPM_DEBUGINFO_PACKAGE "on")
-set(CPACK_RPM_PACKAGE_DEBUG 1)

 set(CPACK_RPM_PACKAGE_AUTOREQPROV "no")
 set(CPACK_RPM_PACKAGE_AUTOREQ "no")
@@ -35,11 +35,8 @@ set(CPACK_COMPONENT_HEADER_DISPLAY_NAME "develop")

 set(CPACK_COMPONENT_LIBRARIES_REQUIRED TRUE)
 set(CPACK_RPM_LIBRARIES_PACKAGE_NAME ${MY_RPM_NAME_PREFIX})
-set(CPACK_RPM_LIBRARIES_FILE_NAME "${CPACK_RPM_LIBRARIES_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${SYSTEM_VERSION}.rpm")
-set(CPACK_RPM_LIBRARIES_DEBUGINFO_FILE_NAME "${CPACK_RPM_LIBRARIES_PACKAGE_NAME}-debuginfo-${CPACK_PACKAGE_VERSION}-${SYSTEM_VERSION}.rpm")
-
-set(CPACK_COMPONENT_LIBRARIES_GROUP "libraries")
-set(CPACK_COMPONENT_PROFILE_GROUP "libraries")
+set(CPACK_COMPONENT_PROFILE_GROUP "LIBRARIES")
+set(CPACK_COMPONENT_LIBRARIES_GROUP "LIBRARIES")

 set(CPACK_RPM_HEADER_PACKAGE_CONFLICTS ${CPACK_RPM_HEADER_PACKAGE_NAME})

--- a/cmake/changelog.sh
+++ b/cmake/changelog.sh
@@ -1,4 +1,4 @@
 #!/bin/sh
 work_path=$1
 branch=`git status | grep branch | awk '{print $NF}'`
-git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %ad %an %ae %nhash: %H%ncommit:%n%B"  | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/  -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt
+git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %cd %an %ae %nhash: %H%ncommit:%n%B"  | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/  -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt
--- a/src/fw_dns_plug.cpp
+++ b/src/fw_dns_plug.cpp
@@ -50,7 +50,7 @@ char *g_fw_dns_conffile=(char *)"tsgconf/main.conf";

 static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
 {
-	int i=0;
+	int i=0,cname_flag=0;
 	dns_rr_t *rr=NULL;
 	tsg_log_t log_msg;
 	int dns_sec=1;
@@ -90,33 +90,41 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
 			{
 				item=cJSON_CreateString((const char *)rr->rdata.cname);
 				cJSON_AddItemToArray(cname_array, item);
+				cname_flag=1;
 			}
 		}
 	}

-	cname=cJSON_PrintUnformatted(cname_array);
-	if(cname!=NULL && strlen(cname)>0)
+	if(cname_flag==1)
 	{
-		TLD_append(handle, (char *)"dns_cname", (void *)cname, TLD_TYPE_STRING);
-		cJSON_free(cname);
-		cname=NULL;
+		cname=cJSON_PrintUnformatted(cname_array);
+		if(cname!=NULL)
+		{
+			TLD_append(handle, (char *)"dns_cname", (void *)cname, TLD_TYPE_STRING);
+			cJSON_free(cname);
+			cname=NULL;
+		}
 	}
+
 	cJSON_Delete(cname_array);
 	cname_array=NULL;
-	
-	cJSON * object=cJSON_CreateObject();
-	get_rr_str2json(object, dns_info, &dns_sec);
-	rr_buf=cJSON_PrintUnformatted(object);
-	TLD_append(handle, (char *)"dns_rr", (void *)rr_buf, TLD_TYPE_STRING);
-	
-	cJSON_Delete(object);
-	object=NULL;

-	cJSON_free(rr_buf);
-	rr_buf=NULL;
+	if(dns_info->rr_count>0)
+	{
+		cJSON * object=cJSON_CreateObject();
+		get_rr_str2json(object, dns_info, &dns_sec);
+		rr_buf=cJSON_PrintUnformatted(object);
+		if(rr_buf!=NULL)
+		{
+			TLD_append(handle, (char *)"dns_rr", (void *)rr_buf, TLD_TYPE_STRING);
+			cJSON_free(rr_buf);
+			rr_buf=NULL;
+		}
+		cJSON_Delete(object);
+		object=NULL;		
+	}
 	
 	TLD_append(handle, (char *)"dns_sub", (void *)(long)dns_sec, TLD_TYPE_LONG);
-
 	TLD_append(handle, (char *)"common_schema_type", (void *)"DNS", TLD_TYPE_STRING);

 	log_msg.a_stream=a_stream;
@@ -128,9 +136,25 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
 	return 0;
 }

+int fw_dns_select_monitor_result(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
+{
+	for(int i=0; i<result_num; i++)
+	{
+		if(result[i].action!=TSG_ACTION_MONITOR)
+		{
+			continue;
+		}
+		
+		tsg_notify_hited_monitor_result(a_stream, &(result[i]), 1, thread_seq);
+		fw_dns_send_log(a_stream, dns_info, &(result[i]), 1, thread_seq);
+	}
+
+	return 0;
+}
+
 extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int thread_seq,struct streaminfo *a_stream,const void *a_packet)
 {
-	int i=0,ret=0,hit_num=0;
+	int ret=0,hit_num=0;
 	scan_status_t mid=NULL;
 	int category_id_num=0;
 	char state=PROT_STATE_GIVEME;
@@ -227,54 +251,36 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 	}

 	category_id_num=tsg_get_fqdn_category_id(g_tsg_maat_feather, (char *)dns_info->query_question.qname, category_id, MAX_CATEGORY_ID_NUM, g_fw_dns_plug_info.logger, thread_seq);
-	for(i=0; i< category_id_num; i++)
-	{
-		ret=Maat_scan_intval(g_tsg_maat_feather, g_fw_dns_plug_info.table_qname_id, (unsigned int)category_id[i], result+hit_num,MAX_RESULT_NUM-hit_num, &mid, thread_seq);
-		if(ret>0)
-		{
-			MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-										RLOG_LV_DEBUG,
-										"SCAN_FQDN_CAT_ID",
-										"Hit qname: %s category id: %d policy_id: %d service: %d action: %d addr: %s",
-										(char *)dns_info->query_question.qname,
-										category_id[i],
-										result[hit_num].config_id,
-										result[hit_num].service_id,
-										result[hit_num].action,
-										PRINTADDR(a_stream, g_fw_dns_plug_info.level)
-									);
-			hit_num+=ret;
-		}
-		else
-		{
-			MESA_handle_runtime_log(g_fw_dns_plug_info.logger, 
-										RLOG_LV_DEBUG,
-										"SCAN_DOMAIN",
-										"Scan domain: %s category id: %d ret: %d addr: %s",
-										(char *)dns_info->query_question.qname,
-										category_id[i],
-										ret,
-										PRINTADDR(a_stream, g_fw_dns_plug_info.level)
-									);
-									
-		}
-	}
-	
+	tsg_set_fqdn_category_id(a_stream, category_id, category_id_num, thread_seq);
+	hit_num+=tsg_scan_fqdn_category_id(g_tsg_maat_feather, a_stream, result+hit_num,MAX_RESULT_NUM-hit_num, &mid, g_fw_dns_plug_info.table_qname_id, category_id, category_id_num, thread_seq);
 	if(hit_num>0)
 	{
-		p_result=tsg_fetch_deny_rule(result, hit_num);
-		if(p_result!=NULL)
+		p_result=tsg_policy_decision_criteria(result, hit_num);
+		switch(p_result->action)
 		{
-			state=tsg_deal_deny_action(a_stream, p_result, PROTO_DNS, ACTION_RETURN_TYPE_PROT, (const void *)dns_info);
-			if(state!=PROT_STATE_GIVEME)
-			{
+			case	TSG_ACTION_BYPASS:
 				fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
-			}
-		}
-		else
-		{
-			fw_dns_send_log(a_stream, dns_info, result, hit_num, thread_seq);
-			tsg_notify_hited_monitor_result(a_stream, result, hit_num, thread_seq);
+				break;
+			case	TSG_ACTION_DENY:
+				ret=tsg_is_do_deny_action_by_enforce_direction(a_stream, p_result);
+				if(ret==0)
+				{
+					fw_dns_select_monitor_result(a_stream, dns_info, result, hit_num, thread_seq);
+					break;
+				}
+				
+				state=tsg_deal_deny_action(a_stream, p_result, PROTO_DNS, ACTION_RETURN_TYPE_PROT, (const void *)dns_info);
+				if(state!=PROT_STATE_GIVEME)
+				{
+					fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
+				}
+				break;
+			case	TSG_ACTION_MONITOR:
+				tsg_notify_hited_monitor_result(a_stream, result, hit_num, thread_seq);
+				fw_dns_send_log(a_stream, dns_info, result, hit_num, thread_seq);
+				break;
+			default:
+				break;
 		}
 	}
Author	SHA1	Message	Date
liuxueli	74befd9468	安装特定版本tsg_master-devel-5.8.13.8f6a3e1	2023-03-25 13:29:48 +08:00
liuxueli	c387b3f2d2	TSG-14338: LTS22.11版本功能端安全策略Deny动作支持“生效方向”动作参数	2023-03-24 16:25:49 +08:00
liuxueli	7ce1b2976d	TSG-12986: 当cname或者应答记录为空时不再发送相应的日志字段	2022-12-12 15:41:29 +08:00
刘学利	3b4db47008	Update changelog.sh	2022-04-01 04:01:42 +00:00
“pengxuanzheng”	5a2181eb1e	🐞 fix(TSG-9466): 命中monitor时，先notify命中monitor结果，然后再发送日志	2022-04-01 03:52:55 +00:00
yangwenlin	e6075ce810	TSG-9689: 适配Rocky Linux8.5系统	2022-02-24 17:43:50 +08:00
liuxueli	e92fd7c9df	设置FQDN对应的分类ID到流标签	2021-08-13 19:35:33 +08:00