gfwleak/tango-kni
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

重构maat扫描部分代码

Browse Source
This commit is contained in:
zhengchao
2019-06-04 16:37:42 +08:00
parent 55cd850403
commit b75683d9a5
3 changed files with 65 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

117
entry/src/kni_maat.cpp
View File

@@ -9,7 +9,7 @@ extern int g_iThreadNum;
2. 如果maat的编译配置表中有policy_id = 0的配置，则将 g_maat_default_action设为对应的action, policy_id = 0
*/
int g_maat_default_action;
enum kni_action g_maat_default_action;
struct kni_maat_handle{
Maat_feather_t feather;
@@ -32,7 +32,7 @@ void compile_ex_param_new(int idx, const struct Maat_rule_t* rule, const char* s
void *logger = argp;
KNI_LOG_DEBUG(logger, "call compile_ex_param_new");
if(rule->config_id == 0){
g_maat_default_action = rule->action;
g_maat_default_action = (enum kni_action)rule->action;
}
return;
}
@@ -89,7 +89,7 @@ struct kni_maat_handle* kni_maat_init(const char* profile, void *logger){
KNI_LOG_ERROR(logger, "MESA_prof_load: compile_alias not set, profile is %s, section is %s", profile, section);
goto error_out;
}
ret = MESA_load_profile_int_nodef(profile, section, "default_action", &g_maat_default_action);
ret = MESA_load_profile_int_nodef(profile, section, "default_action", (int*)&g_maat_default_action);
if(ret < 0){
KNI_LOG_ERROR(logger, "MESA_prof_load: default_action not set, profile is %s, section is %s", profile, section);
goto error_out;
@@ -174,72 +174,63 @@ error_out:
return NULL;
}
static int maat_process_scan_result(struct kni_maat_handle *handle, int num, struct Maat_rule_t *result, int *policy_id){
//void *logger = handle->logger;
int action = g_maat_default_action;
*policy_id = 0; //默认动作是编译表中policy_id=0的字段，所以默认policy_id=0;
for(int i = 0; i < num; i++){
action = result[i].action;
*policy_id = result[i].config_id;
if(action == KNI_ACTION_BYPASS){
return action;
static int index_of_enforce_policy(struct Maat_rule_t* result, size_t size)
{
size_t i=0;
int biggest_policy_id=0, ret_intercept_idx=0;
for(i=0; i<size; i++)
{
if(result->action==KNI_ACTION_BYPASS)
{
return i;
}
else
{
if(result->config_id>biggest_policy_id)
{
biggest_policy_id=result->config_id;
ret_intercept_idx=i;
}
}
}
return action;
return ret_intercept_idx;
}
//TODO: Maat_rule_get_ex_new_index compile_ex_param_new: config_id = 0, 取action即为全局变量, 一旦配置更新就回调, tableinfo怎么写，回调表， 编译配置表
int kni_maat_scan_ip(struct kni_maat_handle *handle, struct ipaddr *addr, int thread_seq, int *policy_id, int *maat_hit){
//printf("default action is %d\n", g_maat_default_action);
void *logger = handle->logger;
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
scan_status_t mid = NULL;
int ret = Maat_scan_proto_addr(handle->feather, handle->tableid_intercept_ip, addr, 0, result,
KNI_MAAT_RULE_NUM_MAX, &mid, thread_seq);
if(ret < 0){
KNI_LOG_ERROR(logger, "Failed at Maat_scan_proto_addr, ret is %d", ret);
return g_maat_default_action;
}
if(ret == 0){
return g_maat_default_action;
}
*maat_hit = 1;
int action = maat_process_scan_result(handle, ret, result, policy_id);
enum kni_action intercept_policy_scan(struct kni_maat_handle* handle, struct ipaddr *addr, char *domain, int domain_len, int thread_seq, int *policy_id, int *is_hit_policy){
//return KNI_ACTION_INTERCEPT;
Maat_feather_t maat_feather=handle->feather;
int table_intercept_ip=handle->tableid_intercept_ip;
int table_intercept_domain=handle->tableid_intercept_domain;
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
scan_status_t scan_mid = NULL;
int scan_ret=0, hit_policy_cnt=0, enforced_policy_idx=0;
/*for debug
char stream_addr[KNI_SYMBOL_MAX] = "";
kni_stream_addr_trans(addr, stream_addr, sizeof(stream_addr));
KNI_LOG_DEBUG(logger, "maat_scan_ip, %s, policy_id = %d, action = %s\n",
stream_addr, *policy_id, action == KNI_ACTION_BYPASS ? "bypss" : "intercept");
*/
return action;
}
int kni_maat_scan_domain(struct kni_maat_handle* handle, char *domain, int domain_len, int thread_seq, int *policy_id, int *maat_hit){
void *logger = handle->logger;
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
//必须要初始化为NULL, 不懂为什么
scan_status_t mid = NULL;
int ret = Maat_full_scan_string(handle->feather, handle->tableid_intercept_domain, CHARSET_UTF8,
domain, domain_len, result, NULL, KNI_MAAT_RULE_NUM_MAX, &mid, thread_seq);
if(ret < 0){
KNI_LOG_ERROR(logger, "Failed at Maat_full_scan_string, ret is %d", ret);
scan_ret = Maat_scan_proto_addr(maat_feather, table_intercept_ip, addr, 0,
result+hit_policy_cnt, KNI_MAAT_RULE_NUM_MAX-hit_policy_cnt,
&scan_mid, thread_seq);
if(scan_ret>0)
{
hit_policy_cnt+=scan_ret;
}
scan_ret = Maat_full_scan_string(maat_feather, table_intercept_domain, CHARSET_UTF8,
domain, domain_len,
result+hit_policy_cnt, NULL, KNI_MAAT_RULE_NUM_MAX-hit_policy_cnt,
&scan_mid, thread_seq);
if(scan_ret>0)
{
hit_policy_cnt+=scan_ret;
}
Maat_clean_status(&scan_mid);
if(hit_policy_cnt>0)
{
enforced_policy_idx=index_of_enforce_policy(result, hit_policy_cnt);
*policy_id=result[enforced_policy_idx].config_id;
*is_hit_policy=1;
return (enum kni_action)result[enforced_policy_idx].action;
}
else
{
return g_maat_default_action;
}
if(ret == 0){
return g_maat_default_action;
}
*maat_hit = 1;
int action = maat_process_scan_result(handle, ret, result, policy_id);
//for debug
char domain1[100] = "";
memcpy(domain1, domain, domain_len);
domain1[domain_len] = '\0';
KNI_LOG_DEBUG(logger, "maat_scan_domain: %s, policy_id = %d, action = %s\n",
domain, *policy_id, action == KNI_ACTION_BYPASS ? "bypss" : "intercept");
return action;
}