安装特定版本tsg_master-devel-5.8.13.8f6a3e1

.gitignore

@@ -0,0 +1,17 @@
+SI/
+*.log
+*.o
+*.so
+*.si4project/
+*.a
+*.d
+build/
+.vscode
+.idea
+core.*
+cmake-build-*
+GPATH
+GTAGS
+GRTAGS
+src/tags
+version.txt

.gitlab-ci.yml

@@ -4,7 +4,7 @@ variables:
   BUILD_IMAGE_CENTOS8: "git.mesalab.cn:7443/mesa_platform/build-env:rockylinux"
   BUILD_PADDING_PREFIX: /tmp/padding_for_CPACK_RPM_BUILD_SOURCE_DIRS_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX_PREFIX/
   INSTALL_PREFIX: "/home/mesasoft/sapp_run/"
-  INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel  libcjson-devel libMESA_field_stat2-devel  sapp-devel framework_env  libMESA_prof_load-devel http-devel dns-devel  ftp-devel mail-devel ssl-devel  librdkafka-devel libmaatframe-devel tsg_master-devel libdocumentanalyze-devel libasan
+  INSTALL_DEPENDENCY_LIBRARY: libMESA_handle_logger-devel  libcjson-devel libMESA_field_stat2-devel  sapp-devel framework_env  libMESA_prof_load-devel http-devel dns-devel  ftp-devel mail-devel ssl-devel  librdkafka-devel libmaatframe-devel tsg_master-devel-5.8.13.8f6a3e1 libdocumentanalyze-devel libasan
 
 stages:
 - build

cmake/changelog.sh

@@ -1,4 +1,4 @@
 #!/bin/sh
 work_path=$1
 branch=`git status | grep branch | awk '{print $NF}'`
-git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %ad %an %ae %nhash: %H%ncommit:%n%B"  | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/  -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt
+git log --branches=$branch --no-merges --date=local --show-signature --pretty="* %cd %an %ae %nhash: %H%ncommit:%n%B"  | awk -F"-" '{print "- "$0}' | sed 's/- \*/\*/g' | sed 's/- $//g' | sed 's/-/  -/g' | sed 's/[0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}//g' > $work_path/changelog.txt

src/fw_dns_plug.cpp

@@ -50,7 +50,7 @@ char *g_fw_dns_conffile=(char *)"tsgconf/main.conf";
 
 static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
 {
-	int i=0;
+	int i=0,cname_flag=0;
 	dns_rr_t *rr=NULL;
 	tsg_log_t log_msg;
 	int dns_sec=1;
@@ -90,33 +90,41 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
 			{
 				item=cJSON_CreateString((const char *)rr->rdata.cname);
 				cJSON_AddItemToArray(cname_array, item);
+				cname_flag=1;
 			}
 		}
 	}
 
-	cname=cJSON_PrintUnformatted(cname_array);
-	if(cname!=NULL && strlen(cname)>0)
+	if(cname_flag==1)
 	{
-		TLD_append(handle, (char *)"dns_cname", (void *)cname, TLD_TYPE_STRING);
-		cJSON_free(cname);
-		cname=NULL;
+		cname=cJSON_PrintUnformatted(cname_array);
+		if(cname!=NULL)
+		{
+			TLD_append(handle, (char *)"dns_cname", (void *)cname, TLD_TYPE_STRING);
+			cJSON_free(cname);
+			cname=NULL;
+		}
 	}
+
 	cJSON_Delete(cname_array);
 	cname_array=NULL;
-	
-	cJSON * object=cJSON_CreateObject();
-	get_rr_str2json(object, dns_info, &dns_sec);
-	rr_buf=cJSON_PrintUnformatted(object);
-	TLD_append(handle, (char *)"dns_rr", (void *)rr_buf, TLD_TYPE_STRING);
-	
-	cJSON_Delete(object);
-	object=NULL;
 
-	cJSON_free(rr_buf);
-	rr_buf=NULL;
+	if(dns_info->rr_count>0)
+	{
+		cJSON * object=cJSON_CreateObject();
+		get_rr_str2json(object, dns_info, &dns_sec);
+		rr_buf=cJSON_PrintUnformatted(object);
+		if(rr_buf!=NULL)
+		{
+			TLD_append(handle, (char *)"dns_rr", (void *)rr_buf, TLD_TYPE_STRING);
+			cJSON_free(rr_buf);
+			rr_buf=NULL;
+		}
+		cJSON_Delete(object);
+		object=NULL;		
+	}
 	
 	TLD_append(handle, (char *)"dns_sub", (void *)(long)dns_sec, TLD_TYPE_LONG);
-
 	TLD_append(handle, (char *)"common_schema_type", (void *)"DNS", TLD_TYPE_STRING);
 
 	log_msg.a_stream=a_stream;
@@ -128,6 +136,22 @@ static int fw_dns_send_log(struct streaminfo *a_stream, dns_info_t *dns_info, st
 	return 0;
 }
 
+int fw_dns_select_monitor_result(struct streaminfo *a_stream, dns_info_t *dns_info, struct Maat_rule_t *result, int result_num, int thread_seq)
+{
+	for(int i=0; i<result_num; i++)
+	{
+		if(result[i].action!=TSG_ACTION_MONITOR)
+		{
+			continue;
+		}
+		
+		tsg_notify_hited_monitor_result(a_stream, &(result[i]), 1, thread_seq);
+		fw_dns_send_log(a_stream, dns_info, &(result[i]), 1, thread_seq);
+	}
+
+	return 0;
+}
+
 extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int thread_seq,struct streaminfo *a_stream,const void *a_packet)
 {
 	int ret=0,hit_num=0;
@@ -231,19 +255,32 @@ extern "C" char FW_DNS_PLUG_ENTRY(stSessionInfo* session_info,  void **pme, int
 	hit_num+=tsg_scan_fqdn_category_id(g_tsg_maat_feather, a_stream, result+hit_num,MAX_RESULT_NUM-hit_num, &mid, g_fw_dns_plug_info.table_qname_id, category_id, category_id_num, thread_seq);
 	if(hit_num>0)
 	{
-		p_result=tsg_fetch_deny_rule(result, hit_num);
-		if(p_result!=NULL)
+		p_result=tsg_policy_decision_criteria(result, hit_num);
+		switch(p_result->action)
 		{
-			state=tsg_deal_deny_action(a_stream, p_result, PROTO_DNS, ACTION_RETURN_TYPE_PROT, (const void *)dns_info);
-			if(state!=PROT_STATE_GIVEME)
-			{
+			case	TSG_ACTION_BYPASS:
 				fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
-			}
-		}
-		else
-		{
-			fw_dns_send_log(a_stream, dns_info, result, hit_num, thread_seq);
-			tsg_notify_hited_monitor_result(a_stream, result, hit_num, thread_seq);
+				break;
+			case	TSG_ACTION_DENY:
+				ret=tsg_is_do_deny_action_by_enforce_direction(a_stream, p_result);
+				if(ret==0)
+				{
+					fw_dns_select_monitor_result(a_stream, dns_info, result, hit_num, thread_seq);
+					break;
+				}
+				
+				state=tsg_deal_deny_action(a_stream, p_result, PROTO_DNS, ACTION_RETURN_TYPE_PROT, (const void *)dns_info);
+				if(state!=PROT_STATE_GIVEME)
+				{
+					fw_dns_send_log(a_stream, dns_info, p_result, 1, thread_seq);
+				}
+				break;
+			case	TSG_ACTION_MONITOR:
+				tsg_notify_hited_monitor_result(a_stream, result, hit_num, thread_seq);
+				fw_dns_send_log(a_stream, dns_info, result, hit_num, thread_seq);
+				break;
+			default:
+				break;
 		}
 	}