gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

compile table support conjunction, ip_plugin support cidr

Browse Source
This commit is contained in:
liuwentan
2023-02-20 10:57:40 +08:00
parent be5d157733
commit bbed56db80
30 changed files with 1030 additions and 523 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
include/bool_matcher.h
View File

@@ -1,66 +0,0 @@
/*
*
* Copyright (c) 2018
* String Algorithms Research Group
* Institute of Information Engineering, Chinese Academy of Sciences (IIE-CAS)
* National Engineering Laboratory for Information Security Technologies (NELIST)
* All rights reserved
*
* Written by: LIU YANBING (liuyanbing@iie.ac.cn)
* Last modification: 2021-06-12
*
* This code is the exclusive and proprietary property of IIE-CAS and NELIST.
* Usage for direct or indirect commercial advantage is not allowed without
* written permission from the authors.
*
*/
#ifndef INCLUDE_BOOL_MATCHER_H
#define INCLUDE_BOOL_MATCHER_H
#ifdef __cplusplus
extern "C"
{
#endif
#include <stddef.h>
#define MAX_ITEMS_PER_BOOL_EXPR 8
/* not_flag=0表示布尔项item_id必须出现；not_flag=1表示布尔项item_id不能出现 */
struct bool_item
{
unsigned long long item_id;
unsigned char not_flag;
};
/* At least one item's not_flag should be 0. */
struct bool_expr
{
unsigned long long expr_id;
void *user_tag;
size_t item_num;
struct bool_item items[MAX_ITEMS_PER_BOOL_EXPR];
};
struct bool_expr_match
{
unsigned long long expr_id;
void *user_tag;
};
struct bool_matcher;
struct bool_matcher *bool_matcher_new(struct bool_expr *exprs, size_t expr_num, size_t *mem_size);
/* Returned results are sorted by expr_id in descending order. */
// Input item_ids MUST be ASCENDING order and NO duplication.
int bool_matcher_match(struct bool_matcher *matcher, unsigned long long *item_ids, size_t item_num, struct bool_expr_match *results, size_t n_result);
void bool_matcher_free(struct bool_matcher *matcher);
#ifdef __cplusplus
}
#endif
#endif

32
include/maat.h
View File

@@ -51,15 +51,19 @@ enum maat_scan_status {
#define MAX_SERVICE_DEFINE_LEN 128
struct maat_rule {
int config_id;
int service_id;
uint8_t do_log;
uint8_t do_blacklist;
uint8_t action;
uint8_t reserved;
int serv_def_len;
char service_defined[MAX_SERVICE_DEFINE_LEN];
};
struct ip_addr {
int ip_type; //4: IPv4, 6: IPv6
union {
unsigned int ipv4; //network order
unsigned int ipv6[4];
};
};
typedef void maat_start_callback_t(int update_type, void *u_param);
typedef void maat_update_callback_t(int table_id, const char *table_line, void *u_para);
typedef void maat_finish_callback_t(void *u_para);
@@ -69,10 +73,10 @@ typedef void maat_plugin_ex_free_func_t(int table_id, void **ad, long argl, void
typedef void maat_plugin_ex_dup_func_t(int table_id, void **to, void **from, long argl, void *argp);
typedef void maat_rule_ex_new_func_t(int idx, const struct maat_rule *rule, const char *srv_def_large,
void *ex_data, long argl, void *argp);
void **ex_data, long argl, void *argp);
typedef void maat_rule_ex_free_func_t(int idx, const struct maat_rule *rule, const char *srv_def_large,
void *ex_data, long argl, void *argp);
typedef void maat_rule_ex_dup_func_t(int idx, void *to, void *from, long argl, void *argp);
void **ex_data, long argl, void *argp);
typedef void maat_rule_ex_dup_func_t(int idx, void **to, void **from, long argl, void *argp);
/* maat_instance options API */
struct maat_options;
@@ -106,7 +110,7 @@ int maat_table_callback_register(struct maat *instance, int table_id,
void *u_para);
/* maat compile table API */
int maat_compile_table_ex_schema_register(struct maat *instance, int table_id,
int maat_compile_table_ex_schema_register(struct maat *instance, const char *table_name,
maat_rule_ex_new_func_t *new_func,
maat_rule_ex_free_func_t *free_func,
maat_rule_ex_dup_func_t *dup_func,
@@ -114,16 +118,16 @@ int maat_compile_table_ex_schema_register(struct maat *instance, int table_id,
void *maat_compile_table_get_ex_data(struct maat *instance, int table_id, int compile_id, size_t idx);
/* maat plugin table API */
int maat_plugin_table_ex_schema_register(struct maat *instance, int table_id,
int maat_plugin_table_ex_schema_register(struct maat *instance, const char *table_name,
maat_plugin_ex_new_func_t *new_func,
maat_plugin_ex_free_func_t *free_func,
maat_plugin_ex_dup_func_t *dup_func,
long argl, void *argp);
/* returned data is duplicated by dup_func of maat_plugin_table_ex_schema_register,
caller is responsible to free the data. */
int maat_plugin_table_get_ex_data(struct maat *instance, int table_id,
const char *key, size_t key_len,
void **ex_data_array, size_t n_ex_data);
int maat_ip_plugin_table_get_ex_data(struct maat *instance, const char *table_name,
const struct ip_addr *ip,
void **ex_data_array, size_t n_ex_data);
/* maat scan API */
struct maat_state;
@@ -174,8 +178,8 @@ int maat_state_set_scan_district(struct maat *instance, struct maat_state **stat
int maat_state_set_last_scan(struct maat *maat_instance, struct maat_state **state);
int maat_state_set_scan_compile_table(struct maat *maat_instance, struct maat_state **state,
int compile_table_id);
int maat_state_set_scan_compile_tables(struct maat *maat_instance, struct maat_state **state,
const char *compile_table[], size_t n_table);
int maat_state_get_hit_paths(struct maat *instance, struct maat_state **state,
struct maat_hit_path *paths, size_t n_path);