gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[BUGFIX]fix ip_matcher single ipv6 rule coredump

Browse Source
This commit is contained in:
liuwentan
2023-05-17 17:03:50 +08:00
parent 6626cbd57c
commit b58ecc09e6
4 changed files with 229 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
scanner/ip_matcher/IntervalIndex/SuccinctHash.cpp
View File

@@ -94,7 +94,8 @@ long long CSuccinctHash::init(unsigned int keys[], unsigned int values[], unsign
}
int tn=m_RT[(1U<<(m_hash_bits-8))].A;
m_kv_ptr=new unsigned int[tn+1];
m_kv_ptr=new unsigned int[tn+2]();
FOR(i, tn+1) m_kv_ptr[i]=0;
FOR(i, num)
{
@@ -103,7 +104,7 @@ long long CSuccinctHash::init(unsigned int keys[], unsigned int values[], unsign
unsigned int idx=rank(h);
m_kv_ptr[idx]++;
}
FOR(i, tn) m_kv_ptr[i+1]+=m_kv_ptr[i];
FOR(i, tn+1) m_kv_ptr[i+1]+=m_kv_ptr[i];
m_kv_array=new unsigned int[2*num];
FOR(i, num)

111
scanner/ip_matcher/ip_matcher.h
View File

@@ -27,92 +27,73 @@ extern "C"
{
#endif
enum IP_TYPE
{
IPv4=4,
IPv6=6
enum IP_TYPE {
IPv4 = 4,
IPv6 = 6
};
/* <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ĵ<EFBFBD><C4B5><EFBFBD>IPv4<76><34><EFBFBD><EFBFBD> */
struct ipv4_range
{
unsigned int start_ip; /* IP<49><50>Χ<EFBFBD>½<EFBFBD> */
unsigned int end_ip; /* IP<49><50>Χ<EFBFBD>Ͻ<EFBFBD> */
struct ipv4_range {
unsigned int start_ip; /* lower boundary(network-order) */
unsigned int end_ip; /* upper boundary(network-order) */
};
/* <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ĵ<EFBFBD><C4B5><EFBFBD>IPv6<76><36><EFBFBD><EFBFBD> */
struct ipv6_range
{
unsigned int start_ip[4]; /* IP<49><50>Χ<EFBFBD>½磬<C2BD><E7A3AC> Big-Endian ģʽ<C4A3>洢 */
unsigned int end_ip[4]; /* IP<49><50>Χ<EFBFBD>Ͻ磬<CFBD><E7A3AC> Big-Endian ģʽ<C4A3>洢 */
struct ipv6_range {
unsigned int start_ip[4]; /* lower boundary(network-order) */
unsigned int end_ip[4]; /* upper boundary(network-order) */
};
/* ͨ<EFBFBD>õ<EFBFBD>ip<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> */
struct ip_rule
{
enum IP_TYPE type; /* <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ͣ<EFBFBD>ipv4<76><34>ipv6 */
long long rule_id; /* <20><><EFBFBD><EFBFBD>ID */
void* user_tag; /* <20>û<EFBFBD><C3BB>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݣ<EFBFBD><DDA3><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>ƥ<EFBFBD><C6A5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> */
union
{
struct ipv4_range ipv4_rule; /*<2A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ĵ<EFBFBD><C4B5><EFBFBD>IPv4<76><34><EFBFBD><EFBFBD>*/
struct ipv6_range ipv6_rule; /*<2A><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ĵ<EFBFBD><C4B5><EFBFBD>IPv6<76><36><EFBFBD><EFBFBD>*/
/* common type for ip rule */
struct ip_rule {
enum IP_TYPE type; /* IPv4 or IPv6 */
long long rule_id; /* rule id */
void *user_tag; /* point to user-defined data which will return with hit results */
union {
struct ipv4_range ipv4_rule;
struct ipv6_range ipv6_rule;
};
};
/* ͨ<EFBFBD>õĴ<EFBFBD>ɨ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> */
struct ip_data
{
enum IP_TYPE type; /* <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ͣ<EFBFBD>ipv4<76><34>ipv6 */
union /* <20><><EFBFBD><EFBFBD>rule_type<70><65><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݸ<EFBFBD><DDB8><EFBFBD><EFBFBD><EFBFBD>ipv4<76><34><EFBFBD><EFBFBD>ipv6 */
{
unsigned int ipv4; /* ipv4<76><34><EFBFBD><EFBFBD>*/
unsigned int ipv6[4]; /* ipv6<76><36><EFBFBD>ݣ<EFBFBD><DDA3><EFBFBD> Big-Endian ģʽ<C4A3>洢*/
/* common type for scan data */
struct ip_data {
enum IP_TYPE type; /* IPv4 or IPv6 */
union {
unsigned int ipv4; /* network order */
unsigned int ipv6[4]; /* network order */
};
};
/* <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʽ<EFBFBD><CABD>ɨ<EFBFBD><C9A8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> */
struct scan_result
{
long long rule_id; /* <20><><EFBFBD><EFBFBD><EFBFBD>ID */
void * tag; /* <20>û<EFBFBD><C3BB>Զ<EFBFBD><D4B6><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݣ<EFBFBD><DDA3><EFBFBD><EFBFBD><EFBFBD>ʱ<EFBFBD><CAB1>ƥ<EFBFBD><C6A5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> */
/* data type for scan result */
struct scan_result {
long long rule_id; /* rule id */
void *tag; /* point to the same address as user_tag in struct ip_rule which has same rule_id */
};
struct ip_matcher;
/*
<09><><EFBFBD>ܣ<EFBFBD><DCA3><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ĺ<EFBFBD><C4B9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?<3F><><EFBFBD><EFBFBD>
<09><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
rules[in]<5D><>һ<EFBFBD><D2BB>ip<69><70><EFBFBD><EFBFBD>
rule_num[in]<5D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ĺ<EFBFBD><C4B9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?
mem_use[out]<5D><><EFBFBD>ڴ<EFBFBD><DAB4><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<09><><EFBFBD><EFBFBD>ֵ<EFBFBD><D6B5>
ipɨ<70><C9A8><EFBFBD><EFBFBD>,<2C><><EFBFBD>ؿ<EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ɨ<EFBFBD><C9A8><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>
/**
* @brief create an ip_matcher instance
*
* @param rules[input]: a set of ip rules
* @param rule_num[input]: the number of ip rules
* @param mem_use[output]: memory used by ip_matcher
*/
struct ip_matcher* ip_matcher_new(struct ip_rule * rules, size_t rule_num, size_t * mem_use);
/*
<09><><EFBFBD>ܣ<EFBFBD><DCA3><EFBFBD><EFBFBD><EFBFBD>ipɨ<70><C9A8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ip<69><70><EFBFBD>ݽ<EFBFBD><DDBD><EFBFBD>ɨ<EFBFBD><C9A8>
<09><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
matcher[in]<5D><>ipɨ<70><C9A8><EFBFBD><EFBFBD>
data[in]<5D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ĵ<EFBFBD><C4B4>?<3F><>ip<69><70><EFBFBD><EFBFBD>
result[in]<5D><><EFBFBD><EFBFBD><EFBFBD>ؽ<EFBFBD><D8BD><EFBFBD><EFBFBD><EFBFBD>?<3F><><EFBFBD><EFBFBD>
size[in]<5D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ĵ<EFBFBD>С
<09><><EFBFBD><EFBFBD>ֵ<EFBFBD><D6B5>
<09><><EFBFBD>н<EFBFBD><D0BD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?<=size<7A><65><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ֵΪ-1<><31>ʾ<EFBFBD><CABE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
struct ip_matcher *ip_matcher_new(struct ip_rule *rules, size_t rule_num, size_t *mem_use);
/**
* @brief scan ip_data to find out if has matched rules in ip_matcher
*
* @param matcher[intput]: ip_matcher which created by ip_matcher_new
* @param data[intput]: ip_data to be scanned
* @param result[input]: result array to store the rule_id and user_tag if there are matching rules
* @param size[input]: result array size
*/
int ip_matcher_match(struct ip_matcher* matcher, struct ip_data * data,
struct scan_result* result, size_t size);
int ip_matcher_match(struct ip_matcher *matcher, struct ip_data *data,
struct scan_result *result, size_t size);
/*
<09><><EFBFBD>ܣ<EFBFBD><DCA3><EFBFBD><EFBFBD><EFBFBD>һ<EFBFBD><D2BB>ipɨ<70><C9A8><EFBFBD><EFBFBD>
<09><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
matcher[in]<5D><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ٵ<EFBFBD>ipɨ<70><C9A8><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8>
/**
* @brief destroy ip_matcher instance
*/
void ip_matcher_free(struct ip_matcher* matcher);
void ip_matcher_free(struct ip_matcher *matcher);
#ifdef __cplusplus
}

3
test/CMakeLists.txt
View File

@@ -21,6 +21,9 @@ target_link_libraries(maat_framework_perf_gtest maat_frame_static gtest_static)
add_executable(adapter_hs_gtest adapter_hs_gtest.cpp)
target_link_libraries(adapter_hs_gtest maat_frame_static gtest_static)
add_executable(ip_matcher_gtest ip_matcher_gtest.cpp)
target_link_libraries(ip_matcher_gtest maat_frame_static gtest_static)
add_executable(maat_ex_data_gtest maat_ex_data_gtest.cpp)
target_link_libraries(maat_ex_data_gtest maat_frame_static gtest_static)

174
test/ip_matcher_gtest.cpp Normal file
View File

@@ -0,0 +1,174 @@
#include <gtest/gtest.h>
#include "log/log.h"
#include "ip_matcher.h"
#include "maat_utils.h"
#include "cJSON/cJSON.h"
#define MAX_ARRAY_SIZE 6
struct log_handle *g_logger = NULL;
TEST(ipv4_matcher_match, OneSingleIPv4Rule) {
const char *ip1_str = "192.168.0.1";
struct ip_rule rule;
rule.rule_id = 100;
rule.type = IPv4;
int ret = ip_format2range(4, IP_FORMAT_RANGE, ip1_str, ip1_str,
&rule.ipv4_rule.start_ip, &rule.ipv4_rule.end_ip);
size_t mem_size = 0;
struct ip_matcher *matcher = ip_matcher_new(&rule, 1, &mem_size);
ASSERT_TRUE(matcher != NULL);
struct ip_data data;
data.type = IPv4;
inet_pton(AF_INET, ip1_str, &data.ipv4);
data.ipv4 = ntohl(data.ipv4);
struct scan_result results[MAX_ARRAY_SIZE];
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 100);
}
TEST(ipv4_matcher_match, MultiSingleIPv4Rule) {
const char *ip1_str = "192.168.0.1";
const char *ip2_str = "192.168.0.2";
const char *ip3_str = "192.168.0.3";
struct ip_rule rule[3];
rule[0].rule_id = 100;
rule[0].type = IPv4;
int ret = ip_format2range(4, IP_FORMAT_RANGE, ip1_str, ip1_str,
&rule[0].ipv4_rule.start_ip, &rule[0].ipv4_rule.end_ip);
EXPECT_EQ(ret, 0);
rule[1].rule_id = 200;
rule[1].type = IPv4;
ret = ip_format2range(4, IP_FORMAT_RANGE, ip2_str, ip2_str,
&rule[1].ipv4_rule.start_ip, &rule[1].ipv4_rule.end_ip);
EXPECT_EQ(ret, 0);
rule[2].rule_id = 300;
rule[2].type = IPv4;
ret = ip_format2range(4, IP_FORMAT_RANGE, ip3_str, ip3_str,
&rule[2].ipv4_rule.start_ip, &rule[2].ipv4_rule.end_ip);
EXPECT_EQ(ret, 0);
size_t mem_size = 0;
struct ip_matcher *matcher = ip_matcher_new(rule, 3, &mem_size);
ASSERT_TRUE(matcher != NULL);
struct ip_data data;
data.type = IPv4;
inet_pton(AF_INET, ip1_str, &data.ipv4);
data.ipv4 = ntohl(data.ipv4);
struct scan_result results[MAX_ARRAY_SIZE];
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 100);
inet_pton(AF_INET, ip2_str, &data.ipv4);
data.ipv4 = ntohl(data.ipv4);
memset(results, 0, sizeof(results));
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 200);
inet_pton(AF_INET, ip3_str, &data.ipv4);
data.ipv4 = ntohl(data.ipv4);
memset(results, 0, sizeof(results));
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 300);
}
TEST(ipv6_matcher_match, OneSingleIPv6Rule) {
const char *ip1_str = "1001:da8:205:1::101";
const char *ip2_str = "1001:da8:205:1::101";
struct ip_rule rule;
rule.rule_id = 100;
rule.type = IPv6;
int ret = ip_format2range(6, IP_FORMAT_RANGE, ip1_str, ip2_str,
rule.ipv6_rule.start_ip, rule.ipv6_rule.end_ip);
EXPECT_EQ(ret, 0);
size_t mem_size = 0;
struct ip_matcher *matcher = ip_matcher_new(&rule, 1, &mem_size);
ASSERT_TRUE(matcher != NULL);
struct ip_data data;
data.type = IPv6;
inet_pton(AF_INET6, ip1_str, data.ipv6);
ipv6_ntoh(data.ipv6);
struct scan_result results[MAX_ARRAY_SIZE];
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 100);
}
TEST(ipv6_matcher_match, MultiSingleIPv6Rule) {
const char *ip1_str = "1001:da8:205:1::101";
const char *ip2_str = "1001:da8:205:1::102";
const char *ip3_str = "1001:da8:205:1::103";
struct ip_rule rule[3];
rule[0].rule_id = 100;
rule[0].type = IPv6;
int ret = ip_format2range(6, IP_FORMAT_RANGE, ip1_str, ip1_str,
rule[0].ipv6_rule.start_ip, rule[0].ipv6_rule.end_ip);
EXPECT_EQ(ret, 0);
rule[1].rule_id = 200;
rule[1].type = IPv6;
ret = ip_format2range(6, IP_FORMAT_RANGE, ip2_str, ip2_str,
rule[1].ipv6_rule.start_ip, rule[1].ipv6_rule.end_ip);
EXPECT_EQ(ret, 0);
rule[2].rule_id = 300;
rule[2].type = IPv6;
ret = ip_format2range(6, IP_FORMAT_RANGE, ip3_str, ip3_str,
rule[2].ipv6_rule.start_ip, rule[2].ipv6_rule.end_ip);
EXPECT_EQ(ret, 0);
size_t mem_size = 0;
struct ip_matcher *matcher = ip_matcher_new(rule, 3, &mem_size);
ASSERT_TRUE(matcher != NULL);
struct ip_data data;
data.type = IPv6;
inet_pton(AF_INET6, ip1_str, data.ipv6);
ipv6_ntoh(data.ipv6);
struct scan_result results[MAX_ARRAY_SIZE];
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 100);
memset(results, 0, sizeof(results));
inet_pton(AF_INET6, ip2_str, data.ipv6);
ipv6_ntoh(data.ipv6);
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 200);
memset(results, 0, sizeof(results));
inet_pton(AF_INET6, ip3_str, data.ipv6);
ipv6_ntoh(data.ipv6);
ret = ip_matcher_match(matcher, &data, results, MAX_ARRAY_SIZE);
EXPECT_EQ(ret, 1);
EXPECT_EQ(results[0].rule_id, 300);
}
int main(int argc, char **argv)
{
int ret = 0;
::testing::InitGoogleTest(&argc, argv);
g_logger = log_handle_create("./ip_matcher_gtest.log", 0);
ret = RUN_ALL_TESTS();
log_handle_destroy(g_logger);
return ret;
}