gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

modify ip_table and ip_plugin_table

Browse Source
This commit is contained in:
root
2024-08-08 03:32:09 +00:00
parent 906b8c92aa
commit a786103b94
15 changed files with 231 additions and 536 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/inc_internal/maat_utils.h
View File

@@ -71,8 +71,7 @@ enum ip_format {
};
enum ip_format ip_format_str2int(const char *format);
int ip_format2range(int ip_type, enum ip_format format, const char *ip1, const char *ip2,
uint32_t range_begin[], uint32_t range_end[]);
int ip_format2range(const char *ip_str, int ip_type, uint32_t range_begin[], uint32_t range_end[]);
#define UNUSED __attribute__((unused))

19
src/json2iris.c
View File

@@ -524,31 +524,14 @@ write_ip_line(cJSON *region_json, struct iris_description *p_iris,
json_cmd[cmd_cnt].json_string = "group_id";
json_cmd[cmd_cnt].json_type = cJSON_Number;
cmd_cnt++;
json_cmd[cmd_cnt].json_string = "addr_type";
json_cmd[cmd_cnt].json_type = cJSON_String;
json_cmd[cmd_cnt].str2int_flag = 1;
cmd_cnt++;
json_cmd[cmd_cnt].json_string = "addr_format";
json_cmd[cmd_cnt].json_type = cJSON_String;
json_cmd[cmd_cnt].empty_allowed = 1;
json_cmd[cmd_cnt].default_string = "mask";
cmd_cnt++;
json_cmd[cmd_cnt].json_string = "ip1";
json_cmd[cmd_cnt].json_string = "ip";
json_cmd[cmd_cnt].json_type = cJSON_String;
json_cmd[cmd_cnt].empty_allowed = 1;
json_cmd[cmd_cnt].default_string = "0.0.0.0";
cmd_cnt++;
json_cmd[cmd_cnt].json_string = "ip2";
json_cmd[cmd_cnt].json_type = cJSON_String;
json_cmd[cmd_cnt].empty_allowed = 1;
json_cmd[cmd_cnt].default_string = "255.255.255.255";
cmd_cnt++;
json_cmd[cmd_cnt].json_string = "port";
json_cmd[cmd_cnt].json_type = cJSON_String;
json_cmd[cmd_cnt].empty_allowed = 1;

103
src/maat_ip.c
View File

@@ -26,10 +26,7 @@
struct ip_schema {
int item_id_column;
int group_id_column;
int addr_type_column;
int addr_format_column;
int ip1_column;
int ip2_column;
int ip_column;
int table_id;
int port_column;
struct table_manager *ref_tbl_mgr;
@@ -53,7 +50,6 @@ struct ip_item {
struct ipv4_item_rule ipv4;
struct ipv6_item_rule ipv6;
};
enum ip_format ip_format;
int port_start;
int port_end;
};
@@ -121,42 +117,12 @@ void *ip_schema_new(cJSON *json, struct table_manager *tbl_mgr,
goto error;
}
custom_item = cJSON_GetObjectItem(item, "addr_type");
custom_item = cJSON_GetObjectItem(item, "ip");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
ip_schema->addr_type_column = custom_item->valueint;
ip_schema->ip_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> schema has no add_type column",
__FUNCTION__, __LINE__, table_name);
goto error;
}
custom_item = cJSON_GetObjectItem(item, "addr_format");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
ip_schema->addr_format_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> schema has no addr_format column",
__FUNCTION__, __LINE__, table_name);
goto error;
}
custom_item = cJSON_GetObjectItem(item, "ip1");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
ip_schema->ip1_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> schema has no ip1 column",
__FUNCTION__, __LINE__, table_name);
goto error;
}
custom_item = cJSON_GetObjectItem(item, "ip2");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
ip_schema->ip2_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> schema has no ip2 column",
"[%s:%d] ip table:<%s> schema has no ip column",
__FUNCTION__, __LINE__, table_name);
goto error;
}
@@ -185,9 +151,7 @@ ip_item_new(struct ip_schema *ip_schema, const char *table_name,
{
size_t column_offset = 0;
size_t column_len = 0;
char addr_format[16] = {0};
char ip1_str[40] = {0};
char ip2_str[40] = {0};
char ip_str[128] = {0};
struct ip_item *ip_item = ALLOC(struct ip_item, 1);
int ret = get_column_pos(line, ip_schema->item_id_column, &column_offset,
@@ -210,41 +174,7 @@ ip_item_new(struct ip_schema *ip_schema, const char *table_name,
}
ip_item->group_id = atoll(line + column_offset);
ret = get_column_pos(line, ip_schema->addr_type_column, &column_offset,
&column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> has no addr_type in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
ip_item->addr_type = atoi(line + column_offset);
if (ip_item->addr_type != IPv4 && ip_item->addr_type != IPv6) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> has invalid addr type:%d in line:%s",
__FUNCTION__, __LINE__, table_name, ip_item->addr_type, line);
goto error;
}
ret = get_column_pos(line, ip_schema->addr_format_column, &column_offset,
&column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> has no addr_format in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
memcpy(addr_format, (line + column_offset), column_len);
if (IP_FORMAT_UNKNOWN == ip_format_str2int(addr_format)) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> has invalid addr_format, "
"should be single/range/CIDR/mask in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
ret = get_column_pos(line, ip_schema->ip1_column, &column_offset,
ret = get_column_pos(line, ip_schema->ip_column, &column_offset,
&column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP,
@@ -252,21 +182,16 @@ ip_item_new(struct ip_schema *ip_schema, const char *table_name,
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
memcpy(ip1_str, (line + column_offset), column_len);
memcpy(ip_str, (line + column_offset), column_len);
ret = get_column_pos(line, ip_schema->ip2_column, &column_offset,
&column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> has no ip2 in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
if (strchr(ip_str, ':') != NULL) {
ip_item->addr_type = IPV6;
} else {
ip_item->addr_type = IPV4;
}
memcpy(ip2_str, (line + column_offset), column_len);
if (IPv4 == ip_item->addr_type) {
ret = ip_format2range(ip_item->addr_type, ip_format_str2int(addr_format),
ip1_str, ip2_str, &ip_item->ipv4.min_ip, &ip_item->ipv4.max_ip);
ret = ip_format2range(ip_str, ip_item->addr_type, &ip_item->ipv4.min_ip, &ip_item->ipv4.max_ip);
if (ret < 0) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> ip_format2range(ip4) failed in line:%s",
@@ -275,8 +200,7 @@ ip_item_new(struct ip_schema *ip_schema, const char *table_name,
}
} else {
//ipv6
ret = ip_format2range(ip_item->addr_type, ip_format_str2int(addr_format),
ip1_str, ip2_str, ip_item->ipv6.min_ip, ip_item->ipv6.max_ip);
ret = ip_format2range(ip_str, ip_item->addr_type, ip_item->ipv6.min_ip, ip_item->ipv6.max_ip);
if (ret < 0) {
log_fatal(logger, MODULE_IP,
"[%s:%d] ip table:<%s> ip_format2range(ip6) failed in line:%s",
@@ -284,6 +208,7 @@ ip_item_new(struct ip_schema *ip_schema, const char *table_name,
goto error;
}
}
if(ip_schema->port_column>0)
{
ret = get_column_pos(line, ip_schema->port_column, &column_offset,

110
src/maat_ip_plugin.c
View File

@@ -23,10 +23,7 @@
struct ip_plugin_schema {
int item_id_column;
int ip_type_column;
int start_ip_column;
int end_ip_column;
int addr_format_column;
int ip_column;
int rule_tag_column;
int gc_timeout_s;
int table_id;
@@ -85,31 +82,9 @@ void *ip_plugin_schema_new(cJSON *json, struct table_manager *tbl_mgr,
goto error;
}
custom_item = cJSON_GetObjectItem(item, "ip_type");
custom_item = cJSON_GetObjectItem(item, "ip");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
schema->ip_type_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> schema has no"
" ip_type column",
__FUNCTION__, __LINE__, table_name);
goto error;
}
custom_item = cJSON_GetObjectItem(item, "start_ip");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
schema->start_ip_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> schema has no"
" start_ip column", __FUNCTION__, __LINE__,
table_name);
goto error;
}
custom_item = cJSON_GetObjectItem(item, "end_ip");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
schema->end_ip_column = custom_item->valueint;
schema->ip_column = custom_item->valueint;
} else {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> schema has no"
@@ -118,11 +93,6 @@ void *ip_plugin_schema_new(cJSON *json, struct table_manager *tbl_mgr,
goto error;
}
custom_item = cJSON_GetObjectItem(item, "addr_format");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
schema->addr_format_column = custom_item->valueint;
}
// rule_tag is optional
custom_item = cJSON_GetObjectItem(item, "rule_tag");
if (custom_item != NULL && custom_item->type == cJSON_Number) {
@@ -206,9 +176,7 @@ ip_plugin_rule_new(struct ip_plugin_schema *schema, const char *table_name,
size_t column_offset = 0;
size_t column_len = 0;
char start_ip_str[40] = {0};
char end_ip_str[40] = {0};
char addr_format[16] = {"range"};
char ip_str[128] = {0};
struct ip_rule *ip_plugin_rule = ALLOC(struct ip_rule, 1);
ret = get_column_pos(line, schema->item_id_column,
@@ -220,58 +188,8 @@ ip_plugin_rule_new(struct ip_plugin_schema *schema, const char *table_name,
goto error;
}
ip_plugin_rule->rule_id = atoll(line + column_offset);
ret = get_column_pos(line, schema->ip_type_column,
&column_offset, &column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> has no ip_type in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
ip_plugin_rule->type = atoi(line + column_offset);
if (ip_plugin_rule->type != IPv4 &&
ip_plugin_rule->type != IPv6) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> ip_type[%d] invalid"
" in line:%s", __FUNCTION__, __LINE__, table_name,
ip_plugin_rule->type, line);
goto error;
}
if (schema->addr_format_column > 0) {
ret = get_column_pos(line, schema->addr_format_column,
&column_offset, &column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> has no addr_format column in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
memset(addr_format, 0, sizeof(addr_format));
memcpy(addr_format, (line + column_offset), column_len);
}
if (IP_FORMAT_UNKNOWN == ip_format_str2int(addr_format)) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table(table_id:%d) has invalid addr_format,"
" should be range/CIDR, line:%s",
__FUNCTION__, __LINE__, schema->table_id, line);
goto error;
}
ret = get_column_pos(line, schema->start_ip_column,
&column_offset, &column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> has no start_ip in line:%s",
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
strncpy(start_ip_str, line + column_offset, column_len);
ret = get_column_pos(line, schema->end_ip_column,
ret = get_column_pos(line, schema->ip_column,
&column_offset, &column_len);
if (ret < 0) {
log_fatal(logger, MODULE_IP_PLUGIN,
@@ -279,13 +197,16 @@ ip_plugin_rule_new(struct ip_plugin_schema *schema, const char *table_name,
__FUNCTION__, __LINE__, table_name, line);
goto error;
}
strncpy(end_ip_str, line + column_offset, column_len);
strncpy(ip_str, line + column_offset, column_len);
if (strchr(ip_str, ':') != NULL) {
ip_plugin_rule->type = IPV6;
} else {
ip_plugin_rule->type = IPV4;
}
if (IPv4 == ip_plugin_rule->type) {
ret = ip_format2range(ip_plugin_rule->type, ip_format_str2int(addr_format),
start_ip_str, end_ip_str,
&ip_plugin_rule->ipv4_rule.start_ip,
&ip_plugin_rule->ipv4_rule.end_ip);
ret = ip_format2range(ip_str, ip_plugin_rule->type, &ip_plugin_rule->ipv4_rule.start_ip, &ip_plugin_rule->ipv4_rule.end_ip);
if (ret < 0) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s>> ip_format2range(ip4)"
@@ -295,10 +216,7 @@ ip_plugin_rule_new(struct ip_plugin_schema *schema, const char *table_name,
}
} else {
//ipv6
ret = ip_format2range(ip_plugin_rule->type, ip_format_str2int(addr_format),
start_ip_str, end_ip_str,
ip_plugin_rule->ipv6_rule.start_ip,
ip_plugin_rule->ipv6_rule.end_ip);
ret = ip_format2range(ip_str, ip_plugin_rule->type, ip_plugin_rule->ipv6_rule.start_ip, ip_plugin_rule->ipv6_rule.end_ip);
if (ret < 0) {
log_fatal(logger, MODULE_IP_PLUGIN,
"[%s:%d] ip_plugin table:<%s> ip_format2range(ip6)"

149
src/maat_utils.c
View File

@@ -453,7 +453,7 @@ size_t memcat(void **dest, size_t offset, size_t *n_dest, const void *src, size_
return n_src;
}
enum ip_format ip_format_str2int(const char *format)
enum ip_format ip_format_str2int(const char *format)//TODO: need to delete?
{
if (0 == strcasecmp(format, "single")) {
return IP_FORMAT_SINGLE;
@@ -469,117 +469,124 @@ enum ip_format ip_format_str2int(const char *format)
return IP_FORMAT_UNKNOWN;
}
int ip_format2range(int ip_type, enum ip_format format, const char *ip1, const char *ip2,
uint32_t range_begin[], uint32_t range_end[])
int ip_format2range(const char *ip_str, int ip_type, uint32_t range_begin[], uint32_t range_end[])
{
int cidr = 0;
int ret = 0;
enum ip_format format = IP_FORMAT_UNKNOWN;
if (ip_type != IPV4 && ip_type != IPV6) {
assert(0);
return -1;
if (strchr(ip_str, '-') != NULL) {
format = IP_FORMAT_RANGE;
} else if (strchr(ip_str, '/') != NULL) {
format = IP_FORMAT_CIDR;
} else {
format = IP_FORMAT_SINGLE;
}
if (ip_type == IPV4) {
uint32_t ipv4_addr = 0;
ret = inet_pton(AF_INET, ip1, &ipv4_addr);
if (ret <= 0) {
return -1;
}
ipv4_addr = ntohl(ipv4_addr);
uint32_t ipv4_range_end = 0;
uint32_t ipv4_mask = 0;
uint32_t ipv4_addr_start = 0;
uint32_t ipv4_addr_end = 0;
char start_ip_str[16] = {0};
char end_ip_str[16] = {0};
int prefix_length = 0;
switch (format) {
case IP_FORMAT_SINGLE:
case IP_FORMAT_RANGE:
range_begin[0] = ipv4_addr;
ret = inet_pton(AF_INET, ip2, &ipv4_range_end);
if (ret <= 0) {
return -1;
}
ipv4_range_end = ntohl(ipv4_range_end);
range_end[0] = ipv4_range_end;
break;
case IP_FORMAT_MASK:
ret = inet_pton(AF_INET, ip2, &ipv4_mask);
case IP_FORMAT_SINGLE:
ret = inet_pton(AF_INET, ip_str, &ipv4_addr_start);
if (ret <= 0) {
return -1;
}
ipv4_mask = ntohl(ipv4_mask);
range_begin[0] = ipv4_addr & ipv4_mask;
range_end[0] = ipv4_addr | ~ipv4_mask;
range_begin[0] = ntohl(ipv4_addr_start);
range_end[0] = range_begin[0];
break;
case IP_FORMAT_RANGE:
sscanf(ip_str, "%15[^-]-%15s", start_ip_str, end_ip_str);
ret = inet_pton(AF_INET, start_ip_str, &ipv4_addr_start);
if (ret <= 0) {
return -1;
}
ret = inet_pton(AF_INET, end_ip_str, &ipv4_addr_end);
if (ret <= 0) {
return -1;
}
range_begin[0] = ntohl(ipv4_addr_start);
range_end[0] = ntohl(ipv4_addr_end);
break;
case IP_FORMAT_CIDR:
cidr = atoi(ip2);
if (cidr > 32 || cidr < 0) {
sscanf(ip_str, "%15[^/]/%d", start_ip_str, &prefix_length);
if (prefix_length > 32 || prefix_length < 0) {
return -1;
}
ipv4_mask = (0xFFFFFFFFUL << (32 - cidr)) & 0xFFFFFFFFUL;
range_begin[0] = ipv4_addr & ipv4_mask;
range_end[0] = ipv4_addr | ~ipv4_mask;
ret = inet_pton(AF_INET, start_ip_str, &ipv4_addr_start);
if (ret <= 0) {
return -1;
}
ipv4_addr_start = ntohl(ipv4_addr_start);
uint32_t ipv4_mask = (0xFFFFFFFFUL << (32 - prefix_length)) & 0xFFFFFFFFUL;
range_begin[0] = ipv4_addr_start & ipv4_mask;
range_end[0] = ipv4_addr_start | ~ipv4_mask;
break;
default:
assert(0);
}
} else {
//ipv6
int i = 0;
uint32_t ipv6_addr[4] = {0};
uint32_t ipv6_mask[4] = {0};
uint32_t ipv6_range_end[4] = {0};
ret = inet_pton(AF_INET6, ip1, ipv6_addr);
if (ret <= 0) {
return -1;
}
ipv6_ntoh(ipv6_addr);
//ipv6
uint32_t ipv6_addr_start[4] = {0};
uint32_t ipv6_mask[4] = {0};
uint32_t ipv6_addr_end[4] = {0};
char start_ip_str[40] = {0};
char end_ip_str[40] = {0};
int prefix_length = 0;
int i = 0;
switch (format) {
case IP_FORMAT_SINGLE:
case IP_FORMAT_RANGE:
ret = inet_pton(AF_INET6, ip2, ipv6_range_end);
case IP_FORMAT_SINGLE:
ret = inet_pton(AF_INET6, ip_str, ipv6_addr_start);
if (ret <= 0) {
return -1;
}
ipv6_ntoh(ipv6_range_end);
memcpy(range_begin, ipv6_addr, sizeof(ipv6_addr));
memcpy(range_end, ipv6_range_end, sizeof(ipv6_range_end));
ipv6_ntoh(ipv6_addr_start);
memcpy(range_begin, ipv6_addr_start, sizeof(ipv6_addr_start));
memcpy(range_end, ipv6_addr_start, sizeof(ipv6_addr_start));
break;
case IP_FORMAT_MASK:
ret = inet_pton(AF_INET6, ip2, ipv6_mask);
case IP_FORMAT_RANGE:
sscanf(ip_str, "%39[^-]-%39s", start_ip_str, end_ip_str);
ret = inet_pton(AF_INET6, start_ip_str, ipv6_addr_start);
if (ret <= 0) {
return -1;
}
ipv6_ntoh(ipv6_mask);
for (i = 0; i < 4; i++) {
range_begin[i]=ipv6_addr[i] & ipv6_mask[i];
range_end[i] = ipv6_addr[i] | ~ipv6_mask[i];
ret = inet_pton(AF_INET6, end_ip_str, ipv6_addr_end);
if (ret <= 0) {
return -1;
}
ipv6_ntoh(ipv6_addr_start);
ipv6_ntoh(ipv6_addr_end);
memcpy(range_begin, ipv6_addr_start, sizeof(ipv6_addr_start));
memcpy(range_end, ipv6_addr_end, sizeof(ipv6_addr_end));
break;
case IP_FORMAT_CIDR:
cidr = atoi(ip2);
if (cidr > 128 || cidr < 0) {
sscanf(ip_str, "%39[^/]/%d", start_ip_str, &prefix_length);
if (prefix_length > 128 || prefix_length < 0) {
return -1;
}
ret = inet_pton(AF_INET6, start_ip_str, ipv6_addr_start);
if (ret <= 0) {
return -1;
}
ipv6_ntoh(ipv6_addr_start);
for (i = 0; i < 4; i++) {
int bit32 = 128 - cidr - 32 * (3 - i);
int bit32 = 128 - prefix_length - 32 * (3 - i);
if (bit32 < 0) {
bit32 = 0;
}
bit32 = 0;
}
ipv6_mask[i] = (0xFFFFFFFFUL << bit32) & 0xFFFFFFFFUL;
range_begin[i] = ipv6_addr[i] & ipv6_mask[i];
range_end[i] = ipv6_addr[i] | ~ipv6_mask[i];
range_begin[i] = ipv6_addr_start[i] & ipv6_mask[i];
range_end[i] = ipv6_addr_start[i] | ~ipv6_mask[i];
}
break;
default:
assert(0);
}
}
return 0;
}