gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

change type of rule_id, object_id, item_id from (long long) to (uuid_t)

Browse Source 
just compile libmaatframe.so, without modifing about test case
This commit is contained in:
root
2024-09-20 11:20:21 +00:00
parent 20de47c873
commit fc99675b40
40 changed files with 972 additions and 934 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scanner/bool_matcher/bool_matcher.cpp
View File

@@ -46,7 +46,7 @@ struct bool_matcher * bool_matcher_new(struct bool_expr * exprs, size_t expr_num
mem_bytes+=(unsigned int)expr_num*(sizeof(struct bool_expr_match)+sizeof(struct bool_expr_item));
for(unsigned int i=0; i<expr_num; i++)
{
matcher->bool_expr_ids[i].expr_id =exprs[i].expr_id;
uuid_copy(matcher->bool_expr_ids[i].expr_uuid, exprs[i].expr_uuid);
matcher->bool_expr_ids[i].user_tag =exprs[i].user_tag;
matcher->bool_expr_items[i].item_num=exprs[i].item_num;
matcher->bool_expr_items[i].items=new struct bool_item[exprs[i].item_num];
@@ -121,7 +121,7 @@ int res_comp(const void * lhs, const void * rhs)
{
bool_expr_match * _lhs=(bool_expr_match *)lhs;
bool_expr_match * _rhs=(bool_expr_match *)rhs;
return (_lhs->expr_id<_rhs->expr_id) ? 1 : -1;
return (uuid_compare(_lhs->expr_uuid, _rhs->expr_uuid) < 0) ? 1 : -1;
}
int do_match(struct bool_expr_item * expr, unsigned long long * item_ids, size_t item_num)

5
scanner/bool_matcher/bool_matcher.h
View File

@@ -24,6 +24,7 @@ extern "C"
#endif
#include <stddef.h>
#include <uuid/uuid.h>
#define MAX_ITEMS_PER_BOOL_EXPR 8
@@ -37,7 +38,7 @@ extern "C"
/* At least one item's negate_option should be 0. */
struct bool_expr
{
unsigned long long expr_id;
uuid_t expr_uuid;
void *user_tag;
size_t item_num;
struct bool_item items[MAX_ITEMS_PER_BOOL_EXPR];
@@ -45,7 +46,7 @@ extern "C"
struct bool_expr_match
{
unsigned long long expr_id;
uuid_t expr_uuid;
void *user_tag;
};

10
scanner/expr_matcher/expr_matcher.cpp
View File

@@ -144,10 +144,12 @@ static int expr_rule_pattern_count(struct expr_rule *rules, size_t n_rule,
for (size_t i = 0; i < n_rule; i++) {
if (rules[i].n_patterns > MAX_EXPR_PATTERN_NUM) {
char uuid_str[37];
uuid_unparse(rules[i].expr_uuid, uuid_str);
log_fatal(logger, MODULE_EXPR_MATCHER,
"[%s:%d] the number of patterns in expr_rule(rule_id:%lld)"
"[%s:%d] the number of patterns in expr_rule(rule_id:%s)"
" should less than %d", __FUNCTION__, __LINE__,
rules[i].expr_id, MAX_EXPR_PATTERN_NUM);
uuid_str, MAX_EXPR_PATTERN_NUM);
return -1;
}
@@ -224,7 +226,7 @@ static struct bool_expr *bool_exprs_new(struct expr_rule *rules, size_t n_rule,
bool_exprs[i].items[j].negate_option = 0;
}
bool_exprs[i].expr_id = rules[i].expr_id;
uuid_copy(bool_exprs[i].expr_uuid, rules[i].expr_uuid);
bool_exprs[i].item_num = rules[i].n_patterns;
bool_exprs[i].user_tag = rules[i].tag;
}
@@ -432,7 +434,7 @@ static int expr_matcher_bool_matcher_match(struct bool_matcher *bm, struct bool_
}
for (int index = 0; index < bool_matcher_ret; index++) {
result_array[index].rule_id = match_buff[index].expr_id;
uuid_copy(result_array[index].rule_uuid, match_buff[index].expr_uuid);
result_array[index].user_tag = match_buff[index].user_tag;
}
*n_hit_result = bool_matcher_ret;

5
scanner/expr_matcher/expr_matcher.h
View File

@@ -17,6 +17,7 @@ extern "C"
#endif
#include <stddef.h>
#include <uuid/uuid.h>
#include "log/log.h"
@@ -65,13 +66,13 @@ struct expr_pattern {
};
struct expr_scan_result {
long long rule_id;
uuid_t rule_uuid;
void *user_tag;
};
/* logic AND expression, such as (rule1 & rule2) */
struct expr_rule {
long long expr_id; /* AND expression ID */
uuid_t expr_uuid; /* AND expression ID */
size_t n_patterns;
struct expr_pattern patterns[MAX_EXPR_PATTERN_NUM];
void *tag; /* user defined data, return with hit result */

2
scanner/flag_matcher/flag_matcher.cpp
View File

@@ -71,7 +71,7 @@ int flag_matcher_match(struct flag_matcher *flag_matcher, uint64_t flag, struct
{
if (!((flag ^ flag_matcher->rule_table[i].flag) & flag_matcher->rule_table[i].mask))
{
result[result_number].rule_id = flag_matcher->rule_table[i].rule_id;
uuid_copy(result[result_number].rule_uuid, flag_matcher->rule_table[i].rule_uuid);
result[result_number ++].user_tag = flag_matcher->rule_table[i].user_tag;
if (result_number >= n_result)

5
scanner/flag_matcher/flag_matcher.h
View File

@@ -10,6 +10,7 @@
#define FLAG_MATCHER_H
#include <stdint.h>
#include <stddef.h>
#include <uuid/uuid.h>
#ifdef __cplusplus
extern "C"
@@ -20,7 +21,7 @@ struct flag_rule
{
uint64_t flag;
uint64_t mask;
uint64_t rule_id; // unique for a rule;
uuid_t rule_uuid; // unique for a rule;
/* A transparent user tag for convenient accessing,
the caller is responsible for its memory management. */
@@ -31,7 +32,7 @@ struct flag_rule
// if matched, return id and tag;
struct flag_result
{
uint64_t rule_id; // unique for a rule;
uuid_t rule_uuid; // unique for a rule;
void *user_tag;
};

6
scanner/fqdn_engine/fqdn_engine.cpp
View File

@@ -84,7 +84,7 @@ static void aligned_free(void * aligned_ptr)
/*************************************************************************************/
struct domain_impl_t
{
unsigned int id;
uuid_t uuid;
int suf_match;
unsigned int len;
unsigned long long hash; /*<2A><>64λ<34><CEBB>ϣֵΨһ<CEA8><D2BB>ʾһ<CABE><D2BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD>*/
@@ -170,7 +170,7 @@ int CHashTrieFQDN::initialize(const struct FQDN_rule * rules, size_t n_rule)
FOR(k, m_num)
{
m_domains[k].id =rules[k].id;
uuid_copy(m_domains[k].uuid, rules[k].uuid);
m_domains[k].suf_match=rules[k].is_suffix_match;
m_domains[k].len=rules[k].len;
m_domains[k].next=NULL;
@@ -307,7 +307,7 @@ int CHashTrieFQDN::search(const char * FQDN, size_t FQDN_len, struct FQDN_match
if(pt->len+P[t]==FQDN_len && pt->hash==HASH[t])
{
//if(match_num>0 && P[t]!=results[match_num-1].offset) return match_num;
results[match_num].id=pt->id;
uuid_copy(results[match_num].uuid, pt->uuid);
results[match_num].offset=P[t];
results[match_num].user_tag=pt->utag;
++match_num;

5
scanner/fqdn_engine/fqdn_engine.h
View File

@@ -23,10 +23,11 @@ extern "C" {
#endif
#include <stddef.h>
#include <uuid/uuid.h>
struct FQDN_rule
{
unsigned int id;
uuid_t uuid;
int is_suffix_match; /* is_suffix_match==0: exact match; is_suffix_match==1: longest suffix matching. */
size_t len;
char * FQDN; /* Non-ASCII character is allowed. */
@@ -39,7 +40,7 @@ extern "C" {
struct FQDN_match
{
unsigned int id;
uuid_t uuid;
unsigned int offset; /* offset==0 for exact matching; offset>0 for longest suffix matching. */
void * user_tag;
};

3
scanner/interval_matcher/interval_matcher.h
View File

@@ -8,6 +8,7 @@
#define INTERVAL_MATCHER_H
#include <stdint.h>
#include <stddef.h>
#include <uuid/uuid.h>
#ifdef __cplusplus
extern "C"
@@ -17,7 +18,7 @@ extern "C"
// if matched, return id and tag;
struct interval_result
{
uint64_t rule_id;
uuid_t rule_uuid;
/* A transparent user tag for convenient accessing,
the caller is responsible for its memory management. */

5
scanner/ip_matcher/ip_matcher.cpp
View File

@@ -57,11 +57,10 @@ struct ip_matcher *ip_matcher_new(struct ip_rule *rules, size_t rule_num,
map<long long, struct ip_rule> ipv4_rules;
map<long long, struct ip_rule> ipv6_rules;
for (size_t i = 0; i < rule_num; i++) {
long long id = rules[i].rule_id;
if(rules[i].type == IPv4)
ipv4_rules[id] = rules[i];
ipv4_rules[i] = rules[i];
if(rules[i].type == IPv6 )
ipv6_rules[id] = rules[i];
ipv6_rules[i] = rules[i];
}
//<2F><><EFBFBD><EFBFBD>ipv4ɨ<34><C9A8><EFBFBD><EFBFBD>

5
scanner/ip_matcher/ip_matcher.h
View File

@@ -19,6 +19,7 @@
#define H_IP_MATCHER_H
#include <stddef.h>
#include <uuid/uuid.h>
#include "../../deps/log/log.h"
@@ -45,7 +46,7 @@ struct ipv6_range {
/* common type for ip rule */
struct ip_rule {
enum IP_TYPE type; /* IPv4 or IPv6 */
long long rule_id; /* rule id */
uuid_t rule_uuid; /* rule id */
void *user_tag; /* point to user-defined data which will return with hit results */
union {
struct ipv4_range ipv4_rule;
@@ -64,7 +65,7 @@ struct ip_data {
/* data type for scan result */
struct scan_result {
long long rule_id; /* rule id */
uuid_t rule_uuid; /* rule id */
void *tag; /* point to the same address as user_tag in struct ip_rule which has same rule_id */
};

4
scanner/ip_matcher/ipv4_match.cpp
View File

@@ -66,7 +66,7 @@ long long CIPv4Match::initialize(const map<long long, struct ip_rule>& rules)
{
struct ipv4_range arule = it->second.ipv4_rule;
m_rules[i].rule = arule;
m_rules[i].rule_id = it->first;
uuid_copy(m_rules[i].rule_uuid, it->second.rule_uuid);
m_rules[i++].tag = it->second.user_tag;
}
@@ -106,7 +106,7 @@ int CIPv4Match::search_rule(const struct ip_data * data, struct scan_result * pr
return hit_num;
unsigned int index = m_v[i];
presult[hit_num].rule_id = m_rules[index].rule_id;
uuid_copy(presult[hit_num].rule_uuid, m_rules[index].rule_uuid);
presult[hit_num++].tag = m_rules[index].tag;
}

2
scanner/ip_matcher/ipv4_match.h
View File

@@ -26,7 +26,7 @@ typedef struct _ipv4_rule_t{
struct ipv4_range rule;
void * tag;
long long rule_id;
uuid_t rule_uuid;
}ipv4_rule_t;
class CIPv4Match : public CRuleMatch

4
scanner/ip_matcher/ipv6_match.cpp
View File

@@ -75,7 +75,7 @@ long long CIPv6Match::initialize(const map<long long, struct ip_rule>& rules)
for (map<long long, struct ip_rule>::const_iterator it = rules.begin(); it != rules.end(); ++it) {
struct ipv6_range arule = it->second.ipv6_rule;;
m_rules[i].rule = arule;
m_rules[i].rule_id = it->first;
uuid_copy(m_rules[i].rule_uuid, it->second.rule_uuid);
m_rules[i++].tag = it->second.user_tag;
}
@@ -119,7 +119,7 @@ int CIPv6Match::search_rule(const struct ip_data * data, struct scan_result * pr
if(hit_num == size)
return hit_num;
unsigned int index = m_v[i];
presult[hit_num].rule_id = m_rules[index].rule_id;
uuid_copy(presult[hit_num].rule_uuid, m_rules[index].rule_uuid);
presult[hit_num++].tag = m_rules[index].tag;
}

2
scanner/ip_matcher/ipv6_match.h
View File

@@ -26,7 +26,7 @@
typedef struct _ipv6_rule_t{
struct ipv6_range rule;
long long rule_id;
uuid_t rule_uuid;
void * tag;
}ipv6_rule_t;

6
scanner/ipport_matcher/ipport_matcher.c
View File

@@ -15,7 +15,7 @@
#include "ipport_matcher.h"
struct port_range {
long long rule_id;
uuid_t rule_uuid;
void *tag;
uint16_t min_port; /* host order */
uint16_t max_port; /* host order */
@@ -105,7 +105,7 @@ struct ipport_matcher *ipport_matcher_new(struct ipport_rule *rules, size_t rule
struct port_range range;
range.min_port = rules[i].min_port;
range.max_port = rules[i].max_port;
range.rule_id = rules[i].rule_id;
uuid_copy(range.rule_uuid, rules[i].rule_uuid);
range.tag = rules[i].user_tag;
utarray_push_back(node->port_range_list, &range);
}
@@ -151,7 +151,7 @@ int ipport_matcher_match(struct ipport_matcher *matcher, const struct ip_addr *i
tmp_range = (struct port_range *)utarray_find(node->port_range_list,
&range, compare_port_range_for_find);
if (tmp_range != NULL) {
result_array[0].rule_id = tmp_range->rule_id;
uuid_copy(result_array[0].rule_uuid, tmp_range->rule_uuid);
result_array[0].tag = tmp_range->tag;
return 1;
}

4
scanner/ipport_matcher/ipport_matcher.h
View File

@@ -21,7 +21,7 @@ extern "C"
#include "maat.h"
struct ipport_rule {
long long rule_id; /* rule id */
uuid_t rule_uuid; /* rule id */
void *user_tag; /* point to user-defined data which will return with hit results */
struct ip_addr ip;
uint16_t min_port; /* host order */
@@ -29,7 +29,7 @@ struct ipport_rule {
};
struct ipport_result {
long long rule_id; /* matched rule id */
uuid_t rule_uuid; /* matched rule id */
void *tag; /* point to the same address as user_tag in struct ipport_rule which has same rule_id */
};