225 lines
8.9 KiB
C++
225 lines
8.9 KiB
C++
#include "kni_utils.h"
|
||
#include "kni_maat.h"
|
||
|
||
extern int g_iThreadNum;
|
||
|
||
int g_maat_default_action = -1;
|
||
|
||
struct kni_maat_handle{
|
||
Maat_feather_t feather;
|
||
int tableid_intercept_ip;
|
||
int tableid_intercept_domain;
|
||
void *logger;
|
||
};
|
||
|
||
void kni_maat_destroy(struct kni_maat_handle *handle){
|
||
if(handle != NULL){
|
||
if(handle->feather != NULL){
|
||
Maat_burn_feather(handle->feather);
|
||
}
|
||
}
|
||
FREE(&handle);
|
||
}
|
||
|
||
|
||
void compile_ex_param_new(int idx, const struct Maat_rule_t* rule, const char* srv_def_large, MAAT_RULE_EX_DATA* ad, long argl, void *argp){
|
||
void *logger = argp;
|
||
KNI_LOG_DEBUG(logger, "call compile_ex_param_new");
|
||
if(rule->config_id == 0){
|
||
g_maat_default_action = rule->action;
|
||
}
|
||
return;
|
||
}
|
||
|
||
void compile_ex_param_free(int idx, const struct Maat_rule_t* rule, const char* srv_def_large, MAAT_RULE_EX_DATA* ad, long argl, void *argp){
|
||
void *logger = argp;
|
||
KNI_LOG_DEBUG(logger, "call compile_ex_param_free");
|
||
return;
|
||
}
|
||
|
||
void compile_ex_param_dup(int idx, MAAT_RULE_EX_DATA *to, MAAT_RULE_EX_DATA *from, long argl, void *argp){
|
||
void *logger = argp;
|
||
KNI_LOG_DEBUG(logger, "call compile_ex_param_dup");
|
||
return;
|
||
}
|
||
|
||
struct kni_maat_handle* kni_maat_init(const char* profile, void *logger){
|
||
const char *section = "maat";
|
||
int readconf_mode;
|
||
char tableinfo_path[KNI_PATH_MAX];
|
||
char tablename_intercept_ip[KNI_SYMBOL_MAX];
|
||
char tablename_intercept_domain[KNI_SYMBOL_MAX];
|
||
char compile_alias[KNI_SYMBOL_MAX];
|
||
char maatjson_path[KNI_PATH_MAX];
|
||
char redis_ip[INET_ADDRSTRLEN];
|
||
int redis_port;
|
||
int redis_index;
|
||
Maat_feather_t feather = NULL;
|
||
int tableid_intercept_ip = -1;
|
||
int tableid_intercept_domain = -1;
|
||
struct kni_maat_handle *handle = NULL;
|
||
int ret = MESA_load_profile_int_nodef(profile, section, "readconf_mode", &readconf_mode);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: readconf_mode not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
ret = MESA_load_profile_string_nodef(profile, section, "tableinfo_path", tableinfo_path, sizeof(tableinfo_path));
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: tableinfo_path not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
ret = MESA_load_profile_string_nodef(profile, section, "tablename_intercept_ip", tablename_intercept_ip, sizeof(tablename_intercept_ip));
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: tablename_intercept_ip not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
ret = MESA_load_profile_string_nodef(profile, section, "tablename_intercept_domain", tablename_intercept_domain, sizeof(tablename_intercept_domain));
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: tablename_intercept_domain not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
ret = MESA_load_profile_string_nodef(profile, section, "compile_alias", compile_alias, sizeof(compile_alias));
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: compile_alias not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n readconf_mode: %d\n tableinfo_path: %s\n tablename_intercept_ip: %s\n tablename_intercept_domain: %s\n"
|
||
"compile_alias: %s\n", section, readconf_mode, tableinfo_path, tablename_intercept_ip, tablename_intercept_domain, compile_alias);
|
||
feather = Maat_feather(g_iThreadNum, tableinfo_path, logger);
|
||
handle = ALLOC(struct kni_maat_handle, 1);
|
||
handle->feather = feather;
|
||
if(feather == NULL){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_feather, max_thread_num is %d, tableinfo_path is %s", g_iThreadNum, tableinfo_path);
|
||
return NULL;
|
||
}
|
||
switch(readconf_mode){
|
||
case KNI_MAAT_READCONF_JSON:
|
||
ret = MESA_load_profile_string_nodef(profile, section, "maatjson_path", maatjson_path, sizeof(maatjson_path));
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: maatjson_path not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n maatjson_path: %s", section, maatjson_path);
|
||
Maat_set_feather_opt(feather, MAAT_OPT_JSON_FILE_PATH, maatjson_path, strlen(maatjson_path));
|
||
break;
|
||
case KNI_MAAT_READCONF_IRIS:
|
||
break;
|
||
case KNI_MAAT_READCONF_REDIS:
|
||
ret = MESA_load_profile_string_nodef(profile, section, "redis_ip", redis_ip, sizeof(redis_ip));
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: redis_ip not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
ret = MESA_load_profile_int_nodef(profile, section, "redis_port", &redis_port);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: redis_port not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
ret = MESA_load_profile_int_nodef(profile, section, "redis_index", &redis_index);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "MESA_prof_load: redis_index not set, profile is %s, section is %s", profile, section);
|
||
goto error_out;
|
||
}
|
||
KNI_LOG_INFO(logger, "MESA_prof_load, [%s]:\n redis_ip: %s\n redis_port: %d\n redis_index: %d",
|
||
section, redis_ip, redis_port, redis_index);
|
||
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_IP, (void*)redis_ip, strlen(redis_ip) + 1);
|
||
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_PORT, (void*)&redis_port, sizeof(redis_port));
|
||
Maat_set_feather_opt(feather, MAAT_OPT_REDIS_INDEX, (void*)&redis_index, sizeof(redis_index));
|
||
break;
|
||
default:
|
||
break;
|
||
}
|
||
ret = Maat_initiate_feather(feather);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_initiate_feather");
|
||
goto error_out;
|
||
}
|
||
tableid_intercept_ip = Maat_table_register(feather, tablename_intercept_ip);
|
||
tableid_intercept_domain = Maat_table_register(feather, tablename_intercept_domain);
|
||
if(tableid_intercept_ip < 0){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_table_register, tablename is %d, ret is %d",
|
||
tablename_intercept_ip, tableid_intercept_ip);
|
||
goto error_out;
|
||
}
|
||
if(tableid_intercept_domain < 0){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_table_register, tablename is %d, ret is %d",
|
||
tablename_intercept_domain, tableid_intercept_domain);
|
||
goto error_out;
|
||
}
|
||
ret = Maat_rule_get_ex_new_index(feather, compile_alias, compile_ex_param_new, compile_ex_param_free, compile_ex_param_dup, 0, logger);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_rule_get_ex_new_index, ret is %d", ret);
|
||
kni_maat_destroy(handle);
|
||
goto error_out;
|
||
}
|
||
handle->tableid_intercept_ip = tableid_intercept_ip;
|
||
handle->tableid_intercept_domain = tableid_intercept_domain;
|
||
handle->logger = logger;
|
||
return handle;
|
||
|
||
error_out:
|
||
kni_maat_destroy(handle);
|
||
return NULL;
|
||
}
|
||
|
||
static int maat_process_scan_result(struct kni_maat_handle *handle, int num, struct Maat_rule_t *result, int *policy_id){
|
||
//void *logger = handle->logger;
|
||
int action = g_maat_default_action;
|
||
*policy_id = 0; //默认动作是编译表中policy_id=0的字段，所以默认policy_id=0;
|
||
for(int i = 0; i < num; i++){
|
||
action = result[i].action;
|
||
*policy_id = result[i].config_id;
|
||
if(action == KNI_ACTION_BYPASS){
|
||
return action;
|
||
}
|
||
}
|
||
return action;
|
||
}
|
||
|
||
|
||
//TODO: Maat_rule_get_ex_new_index compile_ex_param_new: config_id = 0, 取action即为全局变量, 一旦配置更新就回调, tableinfo怎么写，回调表， 编译配置表
|
||
int kni_maat_scan_ip(struct kni_maat_handle *handle, struct ipaddr *addr, int thread_seq, int *policy_id){
|
||
//printf("default action is %d\n", g_maat_default_action);
|
||
void *logger = handle->logger;
|
||
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
|
||
scan_status_t mid = NULL;
|
||
int ret = Maat_scan_proto_addr(handle->feather, handle->tableid_intercept_ip, addr, 0, result,
|
||
KNI_MAAT_RULE_NUM_MAX, &mid, thread_seq);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_scan_proto_addr, ret is %d", ret);
|
||
return g_maat_default_action;
|
||
}
|
||
int action = maat_process_scan_result(handle, ret, result, policy_id);
|
||
|
||
//for debug
|
||
char stream_addr[KNI_SYMBOL_MAX] = "";
|
||
kni_stream_addr_trans(addr, stream_addr, sizeof(stream_addr));
|
||
KNI_LOG_DEBUG(logger, "maat_scan_ip, %s, policy_id = %d, action = %s\n",
|
||
stream_addr, *policy_id, action == KNI_ACTION_BYPASS ? "bypss" : "intercept");
|
||
return action;
|
||
}
|
||
|
||
int kni_maat_scan_domain(struct kni_maat_handle* handle, char *domain, int domain_len, int thread_seq, int *policy_id){
|
||
void *logger = handle->logger;
|
||
struct Maat_rule_t result[KNI_MAAT_RULE_NUM_MAX];
|
||
//必须要初始化为NULL, 不懂为什么
|
||
scan_status_t mid = NULL;
|
||
int ret = Maat_full_scan_string(handle->feather, handle->tableid_intercept_domain, CHARSET_UTF8,
|
||
domain, domain_len, result, NULL, KNI_MAAT_RULE_NUM_MAX, &mid, thread_seq);
|
||
if(ret < 0){
|
||
KNI_LOG_ERROR(logger, "Failed at Maat_full_scan_string, ret is %d", ret);
|
||
return g_maat_default_action;
|
||
}
|
||
int action = maat_process_scan_result(handle, ret, result, policy_id);
|
||
|
||
//for debug
|
||
char domain1[100] = "";
|
||
memcpy(domain1, domain, domain_len);
|
||
domain1[domain_len] = '\0';
|
||
KNI_LOG_DEBUG(logger, "maat_scan_domain: %s, policy_id = %d, action = %s\n",
|
||
domain, *policy_id, action == KNI_ACTION_BYPASS ? "bypss" : "intercept");
|
||
return action;
|
||
}
|
||
|
||
|